SUSE-SU-2026:24495-1: Security update for the Linux Kernel (Live Patch 24 for SUSE Linux Enterprise Micro 6.0)
This update for the SUSE Linux Enterprise Kernel 6.4.0-47.1 fixes various security issues:
The following security issues were fixed:
- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271837). - CVE-2026-63968: ipv6: fix possible infinite loop in fib6selectpath() (bsc#1272521). - CVE-2026-64217: netfs: Fix overrun check in netfsextractuseriter() (bsc#1272874). - CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712). - CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytesext put/get (bsc#1277679). - CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693). - CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399). - CVE-2026-89544: SUNRPC: fix gssxdecoptionarray error path bugs (bsc#1280760). - CVE-2026-89551: SUNRPC: xdrbuftrim: clamp buf->len to avoid underflow (bsc#1280728). - CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4ffencodelayoutget (bsc#1280285). - CVE-2026-98432: ipv4: free inetopt and ireqopt after an RCU grace period (bsc#1285686).
Other sources
This update for the SUSE Linux Enterprise Kernel 6.4.0-47.1 fixes various security issues: The following security issues were fixed: CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271837). CVE-2026-63968: ipv6: fix possible infinite loop in fib6selectpath() (bsc#1272521). CVE-2026-64217: netfs: Fix overrun check in netfsextractuseriter() (bsc#1272874). CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712). CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytesext put/get (bsc#1277679). CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693). CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399). CVE-2026-89544: SUNRPC: fix gssxdecoptionarray error path bugs (bsc#1280760). CVE-2026-89551: SUNRPC: xdrbuftrim: clamp buf->len to avoid underflow (bsc#1280728). CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4ffencodelayoutget (bsc#1280285). CVE-2026-98432: ipv4: free inetopt and ireqopt after an RCU grace period (bsc#1285686).
— SUSE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/kernel-livepatch-MICRO-6-0_Update_24to a version that resolves this vulnerability.Fixed in 8-1.1 - Upgrade
Upgrade
suse/kernel-livepatchto a version that resolves this vulnerability.Fixed in 6_4_0-47-default-debuginfo-8-1.1 - Upgrade
Upgrade
suse/kernel-livepatchto a version that resolves this vulnerability.Fixed in 6_4_0-47-default-8-1.1 - Upgrade
Upgrade
suse/kernel-livepatch-MICROto a version that resolves this vulnerability.Fixed in 6-0_Update_24-debugsource-8-1.1 - Upgrade
Upgrade
SUSE Linux Enterprise Kernelto a version that resolves this vulnerability.Fixed in 6.4.0-47.1Patch SUSE-SLE-Micro-6.0-kernel-741
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which systems should be prioritized for this update?
Systems running the SUSE Linux Enterprise Kernel 6.4.0-47.1 should be prioritized, particularly those using virtiofs, IPv4 or IPv6 networking, SCTP, IPVS, XFRM, SUNRPC, NFS/NFS server functionality, netfs, or SOF audio control paths. The advisory rates the update high severity (7).
Are systems affected only when the listed kernel features are in use?
The advisory identifies fixes in specific kernel subsystems, but it does not state whether each issue is reachable in a default configuration. Exposure depends on whether the affected subsystem and its relevant functionality are enabled and used.
How can I determine whether a host needs the update?
Check whether the host is running the SUSE Linux Enterprise Kernel 6.4.0-47.1 covered by this advisory. Also inventory use of the affected subsystems, including virtiofs, IPv4/IPv6 networking, SCTP, IPVS, XFRM, SUNRPC, NFS/nfsd, netfs, and SOF.
What mitigations are documented if the update cannot be applied immediately?
No interim mitigations or workarounds are provided in the advisory data. Where operationally feasible, reducing use or exposure of affected kernel subsystems may limit exposure, but the advisory does not validate any specific mitigation.