SUSE-SU-2026:24500-1: Security update for the Linux Kernel RT (Live Patch 13 for SUSE Linux Enterprise Micro 6.0)
This update for the SUSE Linux Enterprise Kernel 6.4.0-37.1 fixes various security issues:
The following security issues were fixed:
- CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269766). - CVE-2026-63968: ipv6: fix possible infinite loop in fib6selectpath() (bsc#1272521). - CVE-2026-64217: netfs: Fix overrun check in netfsextractuseriter() (bsc#1272874). - CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712). - CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytesext put/get (bsc#1277679). - CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693). - CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399). - CVE-2026-89544: SUNRPC: fix gssxdecoptionarray error path bugs (bsc#1280760). - CVE-2026-89551: SUNRPC: xdrbuftrim: clamp buf->len to avoid underflow (bsc#1280728). - CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4ffencodelayoutget (bsc#1280285). - CVE-2026-98432: ipv4: free inetopt and ireqopt after an RCU grace period (bsc#1285686).
Other sources
This update for the SUSE Linux Enterprise Kernel 6.4.0-37.1 fixes various security issues: The following security issues were fixed: CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269766). CVE-2026-63968: ipv6: fix possible infinite loop in fib6selectpath() (bsc#1272521). CVE-2026-64217: netfs: Fix overrun check in netfsextractuseriter() (bsc#1272874). CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712). CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytesext put/get (bsc#1277679). CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693). CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399). CVE-2026-89544: SUNRPC: fix gssxdecoptionarray error path bugs (bsc#1280760). CVE-2026-89551: SUNRPC: xdrbuftrim: clamp buf->len to avoid underflow (bsc#1280728). CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4ffencodelayoutget (bsc#1280285). CVE-2026-98432: ipv4: free inetopt and ireqopt after an RCU grace period (bsc#1285686).
— SUSE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/kernel-livepatch-MICRO-6-0-RT_Update_13to a version that resolves this vulnerability.Fixed in 15-1.1 - Upgrade
Upgrade
suse/kernel-livepatch-MICROto a version that resolves this vulnerability.Fixed in 6-0-RT_Update_13-debugsource-15-1.1 - Upgrade
Upgrade
suse/kernel-livepatchto a version that resolves this vulnerability.Fixed in 6_4_0-37-rt-15-1.1 - Upgrade
Upgrade
suse/kernel-livepatchto a version that resolves this vulnerability.Fixed in 6_4_0-37-rt-debuginfo-15-1.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.4.0-37.1Patch SUSE-SLE-Micro-6.0-kernel-736
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which systems should be prioritized for this update?
Systems running the SUSE Linux Enterprise Kernel 6.4.0-37.1 should be prioritized, particularly those using affected kernel subsystems such as IPv4/IPv6 networking, SCTP, IPVS, XFRM, SUNRPC, NFS server functionality, AMD CCP crypto, or SOF audio IPC3 controls.
What evidence is available that a system may be exposed to a specific issue in this update?
The advisory identifies affected kernel subsystems but does not provide exploit prerequisites, affected configurations, or detection indicators. Exposure assessment therefore requires determining whether the system runs the addressed kernel version and uses the relevant subsystem.
Are mitigations available if the kernel update cannot be installed immediately?
The provided advisory does not list mitigations or configuration workarounds. It identifies the SUSE kernel update as the remediation for the listed security issues.