SUSE-SU-2026:5059-1: Security update for the Linux Kernel (Live Patch 19 for SUSE Linux Enterprise 15 SP7)
This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.73 fixes various security issues:
The following security issues were fixed:
- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271837). - CVE-2026-63968: ipv6: fix possible infinite loop in fib6selectpath() (bsc#1272521). - CVE-2026-64217: netfs: Fix overrun check in netfsextractuseriter() (bsc#1272874). - CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712). - CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693). - CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399). - CVE-2026-89544: SUNRPC: fix gssxdecoptionarray error path bugs (bsc#1280760). - CVE-2026-89551: SUNRPC: xdrbuftrim: clamp buf->len to avoid underflow (bsc#1280728). - CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4ffencodelayoutget (bsc#1280285). - CVE-2026-98432: ipv4: free inetopt and ireqopt after an RCU grace period (bsc#1285686).
Other sources
This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.73 fixes various security issues: The following security issues were fixed: CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271837). CVE-2026-63968: ipv6: fix possible infinite loop in fib6selectpath() (bsc#1272521). CVE-2026-64217: netfs: Fix overrun check in netfsextractuseriter() (bsc#1272874). CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712). CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693). CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399). CVE-2026-89544: SUNRPC: fix gssxdecoptionarray error path bugs (bsc#1280760). CVE-2026-89551: SUNRPC: xdrbuftrim: clamp buf->len to avoid underflow (bsc#1280728). CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4ffencodelayoutget (bsc#1280285). CVE-2026-98432: ipv4: free inetopt and ireqopt after an RCU grace period (bsc#1285686).
— SUSE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/kernel-livepatch-SLE15-SP7_Update_19to a version that resolves this vulnerability.Fixed in 6-150700.2.1 - Upgrade
Upgrade
suse/kernel-livepatchto a version that resolves this vulnerability.Fixed in 6_4_0-150700_53_73-default-6-150700.2.1 - Upgrade
Upgrade
suse/kernel-livepatchto a version that resolves this vulnerability.Fixed in 6_4_0-150700_53_73-default-debuginfo-6-150700.2.1 - Upgrade
Upgrade
SUSE Linux Enterprise Kernelto a version that resolves this vulnerability.Fixed in 6.4.0-150700.53.73Patch SUSE-SLE-Module-Live-Patching-15-SP7-2026-5059
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which systems should be prioritized for this update?
Prioritize SUSE Linux Enterprise Live Patching 15-SP7 systems on ppc64le, s390x, or x86_64 that use the SUSE kernel livepatch packages covered by this advisory. The update targets the SUSE Linux Enterprise Kernel 6.4.0-150700.53.73.
Which kernel areas are covered by the fixes?
The fixes span virtiofs, IPv4 and IPv6 networking, XFRM, SCTP, IPVS, SUNRPC, NFS server code, and netfs. Systems using these kernel subsystems should be assessed first when scheduling deployment.
What is the indicated remediation?
Deploy the SUSE Linux Enterprise 15 SP7 Live Patch 19 update identified by SUSE-SU-2026:5059-1. The advisory lists fixes for ten CVEs, including a virtiofs use-after-free issue and multiple networking and RPC/NFS-related issues.