SUSE-SU-2026:5055-1: Security update for the Linux Kernel (Live Patch 30 for SUSE Linux Enterprise 15 SP6)
This update for the SUSE Linux Enterprise Kernel 6.4.0-150600.23.130 fixes various security issues:
The following security issues were fixed:
- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271837). - CVE-2026-64217: netfs: Fix overrun check in netfsextractuseriter() (bsc#1272874). - CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712). - CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytesext put/get (bsc#1277679). - CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693). - CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399). - CVE-2026-89544: SUNRPC: fix gssxdecoptionarray error path bugs (bsc#1280760). - CVE-2026-89551: SUNRPC: xdrbuftrim: clamp buf->len to avoid underflow (bsc#1280728). - CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4ffencodelayoutget (bsc#1280285). - CVE-2026-98432: ipv4: free inetopt and ireqopt after an RCU grace period (bsc#1285686).
Other sources
This update for the SUSE Linux Enterprise Kernel 6.4.0-150600.23.130 fixes various security issues: The following security issues were fixed: CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271837). CVE-2026-64217: netfs: Fix overrun check in netfsextractuseriter() (bsc#1272874). CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712). CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytesext put/get (bsc#1277679). CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693). CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399). CVE-2026-89544: SUNRPC: fix gssxdecoptionarray error path bugs (bsc#1280760). CVE-2026-89551: SUNRPC: xdrbuftrim: clamp buf->len to avoid underflow (bsc#1280728). CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4ffencodelayoutget (bsc#1280285). CVE-2026-98432: ipv4: free inetopt and ireqopt after an RCU grace period (bsc#1285686).
— SUSE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/kernel-livepatch-SLE15-SP6_Update_30to a version that resolves this vulnerability.Fixed in 5-150600.2.1 - Upgrade
Upgrade
suse/kernel-livepatchto a version that resolves this vulnerability.Fixed in 6_4_0-150600_23_130-default-debuginfo-5-150600.2.1 - Upgrade
Upgrade
suse/kernel-livepatchto a version that resolves this vulnerability.Fixed in 6_4_0-150600_23_130-default-5-150600.2.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-2026-5055 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Live-Patching-15-SP6-2026-5055
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which environments are in scope for this update?
The update is listed for SUSE Linux Enterprise Live Patching 15 SP6 and openSUSE Leap 15.6 on ppc64le, s390x, and x86_64 architectures. The affected software listings include kernel-livepatch and kernel-livepatch-sle15-sp6_update_30.
What is the immediate remediation?
Apply the SUSE live patch update associated with this advisory. It addresses security fixes in the SUSE Linux Enterprise Kernel 6.4.0-150600.23.130.
Does the advisory identify exploit prerequisites or affected default configurations?
No. The provided advisory details list the corrected kernel subsystems and CVEs, but do not state attack prerequisites, network exposure requirements, or whether default configurations are affected.