SUSE-SU-2026:24486-1
Vulnerability from csaf_suse - Published: 2026-11-02 09:02 - Updated: 2026-11-04 21:51Summary
Security update for the Linux Kernel (Live Patch 25 for SUSE Linux Enterprise Micro 6.0)
Severity
Important
Notes
Title of the patch: Security update for the Linux Kernel (Live Patch 25 for SUSE Linux Enterprise Micro 6.0)
Description of the patch:
This update for the SUSE Linux Enterprise Kernel 6.4.0-48.1 fixes various security issues:
The following security issues were fixed:
- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271837).
- CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272521).
- CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272874).
- CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712).
- CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693).
- CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399).
- CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280760).
- CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280728).
- CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280285).
- CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285686).
Patchnames: SUSE-SLE-Micro-6.0-kernel-731
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.8 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2026-53381
Threats
Impact
important
7.8 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2026-53381
Threats
Impact
important
Affected products
Recommended
2 products, the same list as for
CVE-2026-53381
Threats
Impact
important
7.8 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2026-53381
Threats
Impact
important
Affected products
Recommended
2 products, the same list as for
CVE-2026-53381
Threats
Impact
important
7.5 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2026-53381
Threats
Impact
important
7.5 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2026-53381
Threats
Impact
important
7.5 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2026-53381
Threats
Impact
important
8.1 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2026-53381
Threats
Impact
important
References
60 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for the Linux Kernel (Live Patch 25 for SUSE Linux Enterprise Micro 6.0)",
"title": "Title of the patch"
},
{
"category": "description",
"text": "\nThis update for the SUSE Linux Enterprise Kernel 6.4.0-48.1 fixes various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271837).\n- CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272521).\n- CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272874).\n- CVE-2026-68426: xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment (bsc#1274712).\n- CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693).\n- CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399).\n- CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280760).\n- CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow (bsc#1280728).\n- CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280285).\n- CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285686).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-Micro-6.0-kernel-731",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_24486-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:24486-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202624486-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:24486-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202624486-1/"
},
{
"category": "self",
"summary": "SUSE Bug 1271837",
"url": "https://bugzilla.suse.com/1271837"
},
{
"category": "self",
"summary": "SUSE Bug 1272521",
"url": "https://bugzilla.suse.com/1272521"
},
{
"category": "self",
"summary": "SUSE Bug 1272874",
"url": "https://bugzilla.suse.com/1272874"
},
{
"category": "self",
"summary": "SUSE Bug 1274712",
"url": "https://bugzilla.suse.com/1274712"
},
{
"category": "self",
"summary": "SUSE Bug 1277399",
"url": "https://bugzilla.suse.com/1277399"
},
{
"category": "self",
"summary": "SUSE Bug 1280285",
"url": "https://bugzilla.suse.com/1280285"
},
{
"category": "self",
"summary": "SUSE Bug 1280693",
"url": "https://bugzilla.suse.com/1280693"
},
{
"category": "self",
"summary": "SUSE Bug 1280728",
"url": "https://bugzilla.suse.com/1280728"
},
{
"category": "self",
"summary": "SUSE Bug 1280760",
"url": "https://bugzilla.suse.com/1280760"
},
{
"category": "self",
"summary": "SUSE Bug 1285686",
"url": "https://bugzilla.suse.com/1285686"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-53381 page",
"url": "https://www.suse.com/security/cve/CVE-2026-53381/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-63968 page",
"url": "https://www.suse.com/security/cve/CVE-2026-63968/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-64217 page",
"url": "https://www.suse.com/security/cve/CVE-2026-64217/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-68426 page",
"url": "https://www.suse.com/security/cve/CVE-2026-68426/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-74469 page",
"url": "https://www.suse.com/security/cve/CVE-2026-74469/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-74669 page",
"url": "https://www.suse.com/security/cve/CVE-2026-74669/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-89544 page",
"url": "https://www.suse.com/security/cve/CVE-2026-89544/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-89551 page",
"url": "https://www.suse.com/security/cve/CVE-2026-89551/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-89674 page",
"url": "https://www.suse.com/security/cve/CVE-2026-89674/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-98432 page",
"url": "https://www.suse.com/security/cve/CVE-2026-98432/"
}
],
"title": "Security update for the Linux Kernel (Live Patch 25 for SUSE Linux Enterprise Micro 6.0)",
"tracking": {
"current_release_date": "2026-11-04T21:51:35Z",
"generator": {
"date": "2026-11-02T09:02:27Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:24486-1",
"initial_release_date": "2026-11-02T09:02:27Z",
"revision_history": [
{
"date": "2026-11-02T09:02:27Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-11-03T21:48:17Z",
"number": "2",
"summary": "unknown changes"
},
{
"date": "2026-11-04T21:51:35Z",
"number": "3",
"summary": "unknown changes"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x",
"product": {
"name": "kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x",
"product_id": "kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/suse/kernel-livepatch-6_4_0-48-default@7-1.1?arch=s390x\u0026upstream=kernel-livepatch-MICRO-6-0_Update_25-0:7-1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64",
"product": {
"name": "kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64",
"product_id": "kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/kernel-livepatch-6_4_0-48-default@7-1.1?arch=x86_64\u0026upstream=kernel-livepatch-MICRO-6-0_Update_25-0:7-1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.0",
"product": {
"name": "SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.0"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x"
},
"product_reference": "kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64"
},
"product_reference": "kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-53381",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-53381"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtiofs: fix UAF on submount umount\n\niput() called from fuse_release_end() can Oops if the super block has\nalready been destroyed. Normally this is prevented by waiting for\nnum_waiting to go down to zero before commencing with super block shutdown.\n\nThis only works, however, for the last submount instance, as the wait\ncounter is per connection, not per superblock.\n\nRevert to using synchronous release requests for the auto_submounts case,\nwhich is virtiofs only at this time.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-53381",
"url": "https://www.suse.com/security/cve/CVE-2026-53381"
},
{
"category": "external",
"summary": "SUSE Bug 1271830 for CVE-2026-53381",
"url": "https://bugzilla.suse.com/1271830"
},
{
"category": "external",
"summary": "SUSE Bug 1271837 for CVE-2026-53381",
"url": "https://bugzilla.suse.com/1271837"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-11-02T09:02:27Z",
"details": "important"
}
],
"title": "CVE-2026-53381"
},
{
"cve": "CVE-2026-63968",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-63968"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fix possible infinite loop in fib6_select_path()\n\nFound while auditing the same pattern Sashiko reported in\nrt6_fill_node() [1]. Apply the same fix as\ncommit f8d8ce1b515a (\"ipv6: fix possible infinite loop in fib6_info_uses_dev()\").\n\nWriters holding tb6_lock can list_del_rcu(\u0026first-\u003efib6_siblings)\nwithout waiting for RCU readers; first-\u003efib6_siblings.next then\nstill points into the old ring and this softirq-side walker never\nreaches \u0026first-\u003efib6_siblings as its terminator. fib6_purge_rt()\nalways WRITE_ONCE()s first-\u003efib6_nsiblings to 0 before\nlist_del_rcu(), so an inside-loop check is a reliable detach signal.\n\n[1] https://sashiko.dev/#/patchset/20260526020227.4857-1-jiayuan.chen%40linux.dev",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-63968",
"url": "https://www.suse.com/security/cve/CVE-2026-63968"
},
{
"category": "external",
"summary": "SUSE Bug 1272466 for CVE-2026-63968",
"url": "https://bugzilla.suse.com/1272466"
},
{
"category": "external",
"summary": "SUSE Bug 1272521 for CVE-2026-63968",
"url": "https://bugzilla.suse.com/1272521"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-11-02T09:02:27Z",
"details": "important"
}
],
"title": "CVE-2026-63968"
},
{
"cve": "CVE-2026-64217",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-64217"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix overrun check in netfs_extract_user_iter()\n\nFix netfs_extract_user_iter() so that if iov_iter_extract_pages() overfills\npages[], then those pages don\u0027t get included in the iterator constructed at\nthe end of the function. If there was an overfill, memory corruption has\nalready happened.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-64217",
"url": "https://www.suse.com/security/cve/CVE-2026-64217"
},
{
"category": "external",
"summary": "SUSE Bug 1272798 for CVE-2026-64217",
"url": "https://bugzilla.suse.com/1272798"
},
{
"category": "external",
"summary": "SUSE Bug 1272874 for CVE-2026-64217",
"url": "https://bugzilla.suse.com/1272874"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-11-02T09:02:27Z",
"details": "important"
}
],
"title": "CVE-2026-64217"
},
{
"cve": "CVE-2026-68426",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-68426"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment\n\nskb_gso_segment() leaves the segment list head with -\u003eprev pointing at\nthe last segment, an invariant validate_xmit_skb_list() relies on when\nit sets its tail pointer (tail = skb-\u003eprev).\n\nWhen validate_xmit_xfrm() walks a GSO list and some segments are stolen\nby async crypto (-\u003exmit() returns -EINPROGRESS), those segments are\nunlinked from the list but the head -\u003eprev is never updated. If the\nlast segment is the one stolen, the returned head still has -\u003eprev\npointing at it, even though it is now owned by the crypto engine and may\nbe freed. validate_xmit_skb_list() later does tail-\u003enext = skb, writing\nthrough that stale pointer -- a use-after-free.\n\nRepoint skb-\u003eprev at the last retained segment before returning.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-68426",
"url": "https://www.suse.com/security/cve/CVE-2026-68426"
},
{
"category": "external",
"summary": "SUSE Bug 1274705 for CVE-2026-68426",
"url": "https://bugzilla.suse.com/1274705"
},
{
"category": "external",
"summary": "SUSE Bug 1274712 for CVE-2026-68426",
"url": "https://bugzilla.suse.com/1274712"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-11-02T09:02:27Z",
"details": "important"
}
],
"title": "CVE-2026-68426"
},
{
"cve": "CVE-2026-74469",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-74469"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: prevent peer transport count overflow\n\nsctp_assoc_add_peer() increments the association\u0027s 16-bit transport_count\nfor every new unique peer. Adding the 65,536th transport wraps the count to\nzero.\n\nSCTP sock_diag uses transport_count to reserve the INET_DIAG_PEERS payload,\nthen copies one sockaddr_storage for every entry in transport_addr_list.\nAfter the wrap, a diagnostic dump reserves an empty payload and writes\n8 MiB of peer addresses past the skb tail.\n\nReject a new unique peer when transport_count has reached U16_MAX. Perform\nthe check after the existing-peer lookup so a duplicate address continues\nto return its existing transport at the limit.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-74469",
"url": "https://www.suse.com/security/cve/CVE-2026-74469"
},
{
"category": "external",
"summary": "SUSE Bug 1277792 for CVE-2026-74469",
"url": "https://bugzilla.suse.com/1277792"
},
{
"category": "external",
"summary": "SUSE Bug 1280693 for CVE-2026-74469",
"url": "https://bugzilla.suse.com/1280693"
},
{
"category": "external",
"summary": "SUSE Bug 1282936 for CVE-2026-74469",
"url": "https://bugzilla.suse.com/1282936"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-11-02T09:02:27Z",
"details": "important"
}
],
"title": "CVE-2026-74469"
},
{
"cve": "CVE-2026-74669",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-74669"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: clear IPv4 options after rebasing tunnel ICMP errors\n\nip_vs_in_icmp() rebases an skb from the outer ICMP packet to the\nquoted original request before passing it to icmp_send(). However,\nIPCB(skb)-\u003eopt still describes the outer IPv4 header.\n\nA timestamp option in the outer header can therefore leave an offset\nthat points into the quoted transport header after the rebase.\n__ip_options_echo() treats a byte at that stale location as the option\nlength and copies it into the fixed-size option storage on the\n__icmp_send() stack, causing a stack out-of-bounds write.\n\nClear the stale option metadata after resetting the network header.\nKeep the remaining control block fields, including the ingress\ninterface used by the ICMP response path.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-74669",
"url": "https://www.suse.com/security/cve/CVE-2026-74669"
},
{
"category": "external",
"summary": "SUSE Bug 1277391 for CVE-2026-74669",
"url": "https://bugzilla.suse.com/1277391"
},
{
"category": "external",
"summary": "SUSE Bug 1277399 for CVE-2026-74669",
"url": "https://bugzilla.suse.com/1277399"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-11-02T09:02:27Z",
"details": "important"
}
],
"title": "CVE-2026-74669"
},
{
"cve": "CVE-2026-89544",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-89544"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: fix gssx_dec_option_array error path bugs\n\nFour coupled defects in the gssx XDR option-array decoder make the\nerror paths unsafe: a NULL deref in the caller, a refcount leak on\nthe decoded group_info, and a latent use-after-free that the leak\nfix would otherwise expose.\n\ngssx_dec_option_array() sets oa-\u003ecount = 1 before allocating\noa-\u003edata. If that allocation fails, -ENOMEM is returned with\noa-\u003ecount == 1 and oa-\u003edata == NULL. All other error paths jump\nto free_oa: which frees oa-\u003edata and NULLs it but also leaves\noa-\u003ecount == 1. The caller trusts the count:\n\n gssp_accept_sec_context_upcall()\n gssx_dec_accept_sec_context()\n gssx_dec_option_array() /* fails, count=1 data=NULL */\n data = res.options.data[0].value /* NULL deref */\n\nIndependently, free_creds: releases the partially decoded svc_cred\nwith a bare kfree(creds). gssx_dec_linux_creds() installs a\ngroups_alloc() result into creds-\u003ecr_group_info; that object is\nkvmalloc-backed and refcounted, and only put_group_info() reaches\nkvfree(). A plain kfree(creds) drops the wrapper and leaks the\ngroup_info allocation.\n\nThe natural fix for the leak is to call free_svc_cred(creds) before\nkfree(creds), but free_svc_cred() invokes put_group_info() on\ncreds-\u003ecr_group_info unconditionally when non-NULL. The existing\nout_free_groups: path in gssx_dec_linux_creds() already called\ngroups_free() on that pointer without clearing it, so once\nfree_svc_cred() is wired in, the subsequent put_group_info() would\ntouch freed memory.\n\nFix all four together:\n\n - Move the oa-\u003ecount = 1 assignment below the oa-\u003edata allocation\n so it is never set when oa-\u003edata is NULL.\n - Reset oa-\u003ecount to 0 at free_oa: so count and data stay\n coherent and the caller sees an empty option array.\n - Call free_svc_cred(creds) before kfree(creds) at free_creds:\n so the refcounted cr_group_info is released. free_svc_cred()\n either NULL-guards each field explicitly (cr_group_info has\n an if() check) or delegates to a helper that is NULL-safe\n itself (kfree for the string fields, gss_mech_put() which\n guards with if(gm) at gss_mech_switch.c:342), so it is safe\n to call on a partially decoded svc_cred where only\n cr_uid/cr_gid/cr_group_info have been written and everything\n else is zero from kzalloc.\n - In gssx_dec_linux_creds()\u0027s out_free_groups: path, release\n cr_group_info with put_group_info() rather than groups_free()\n so the teardown matches free_svc_cred()\u0027s refcount-aware path,\n and clear the pointer so a later free_svc_cred() on the same\n creds does not release it a second time.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-89544",
"url": "https://www.suse.com/security/cve/CVE-2026-89544"
},
{
"category": "external",
"summary": "SUSE Bug 1280758 for CVE-2026-89544",
"url": "https://bugzilla.suse.com/1280758"
},
{
"category": "external",
"summary": "SUSE Bug 1280760 for CVE-2026-89544",
"url": "https://bugzilla.suse.com/1280760"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-11-02T09:02:27Z",
"details": "important"
}
],
"title": "CVE-2026-89544"
},
{
"cve": "CVE-2026-89551",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-89551"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow\n\nxdr_buf_trim() trims `len` bytes from the tail of an xdr_buf by\nwalking the tail, pages, and head iovecs. Each per-section step\nuses min_t() so it never removes more bytes than that section\nholds, but the final accounting at the fix_len label subtracts the\ntotal bytes actually consumed from buf-\u003elen without any clamp:\n\n fix_len:\n buf-\u003elen -= (len - trim);\n\nWhen the caller has set buf-\u003elen to a value smaller than the sum\nof the iov_lens, (len - trim) can exceed buf-\u003elen and the unsigned\nsubtraction wraps to near UINT_MAX. gss_krb5_unwrap_v2() reaches\nxdr_buf_trim() in exactly that state:\n\n buf-\u003ehead[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip;\n buf-\u003elen = len - (GSS_KRB5_TOK_HDR_LEN + headskip);\n xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip);\n\nbuf-\u003elen is a small wire-derived value while the iov_lens are at\npage scale, so the per-section loops legitimately consume far more\nbytes than buf-\u003elen records. The wrapped buf-\u003elen then propagates\nas the authoritative stream bound into every downstream XDR\ndecoder.\n\nFix by clamping the decrement so buf-\u003elen bottoms out at zero:\n\n buf-\u003elen -= min_t(unsigned int, buf-\u003elen, len - trim);\n\nOn the normal path where the iov_lens sum to buf-\u003elen, (len - trim)\nis always \u003c= buf-\u003elen and the result is identical to before. No\ncallers change behavior outside the underflow case.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-89551",
"url": "https://www.suse.com/security/cve/CVE-2026-89551"
},
{
"category": "external",
"summary": "SUSE Bug 1280727 for CVE-2026-89551",
"url": "https://bugzilla.suse.com/1280727"
},
{
"category": "external",
"summary": "SUSE Bug 1280728 for CVE-2026-89551",
"url": "https://bugzilla.suse.com/1280728"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-11-02T09:02:27Z",
"details": "important"
}
],
"title": "CVE-2026-89551"
},
{
"cve": "CVE-2026-89674",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-89674"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget\n\nThe XDR buffer size calculation in nfsd4_ff_encode_layoutget() has\nmultiple errors that can result in either an out-of-bounds write or\nleaking uninitialized kernel memory to the client:\n\n - fh_len doesn\u0027t account for XDR padding on the file handle data\n - uid and gid lengths use \"8 + len\" but xdr_encode_opaque() actually\n writes \"4 + xdr_align_size(len)\" bytes\n - ds_len omits the flags and stats_collect_hint fields (8 bytes),\n while len\u0027s header constant overestimates by 8 bytes -- these\n partially cancel but leave a net mismatch\n\nThe worst case occurs with short strings (e.g. uid=0, gid=0 with an\nodd-sized file handle), where the function writes up to 5 bytes past\nthe reserved XDR buffer. Conversely, when string lengths happen to be\n4-byte aligned, the reservation is too large and stale buffer content\nis sent to the client.\n\nFix this by breaking out every encoded field explicitly in the ds_len\ncalculation, using xdr_align_size() for all variable-length opaque\nfields, and correcting the header constants.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-89674",
"url": "https://www.suse.com/security/cve/CVE-2026-89674"
},
{
"category": "external",
"summary": "SUSE Bug 1280243 for CVE-2026-89674",
"url": "https://bugzilla.suse.com/1280243"
},
{
"category": "external",
"summary": "SUSE Bug 1280285 for CVE-2026-89674",
"url": "https://bugzilla.suse.com/1280285"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-11-02T09:02:27Z",
"details": "important"
}
],
"title": "CVE-2026-89674"
},
{
"cve": "CVE-2026-98432",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-98432"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: free inet_opt and ireq_opt after an RCU grace period\n\ntcp_v4_syn_recv_sock() transfers ownership of ireq-\u003eireq_opt to the\nchild socket (newinet-\u003einet_opt) without copying it.\n\nAnother cpu can concurrently process a retransmitted SYN for the same\nrequest socket, and send a SYNACK from tcp_check_req().\ntcp_v4_send_synack() and inet_csk_route_req() read ireq-\u003eireq_opt\nunder rcu_read_lock() only, and ip_build_and_send_pkt() and\nip_options_build() then read opt-\u003eoptlen twice.\n\nNote that the SYNACK timer itself is not an issue: it holds a\nreference on its request socket, and inet_csk_reqsk_queue_drop()\ncalls timer_delete_sync() before the child can be freed.\n\nSince commit 079096f103fa (\"tcp/dccp: install syn_recv requests\ninto ehash table\"), request sockets are processed without holding\nthe listener lock, so nothing prevents the child socket from being\nfreed while the SYNACK is still being built. TCP child sockets do\nnot have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt\nwith a plain kfree(), leading to a use-after-free in\nip_options_build().\n\nA similar issue exists with request socket migration\n(net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE\nprogram). reqsk_timer_handler() clones the request socket with\ninet_reqsk_clone(), so that the old request socket and its clone\nshare the same ireq_opt, then reqsk_migrate_reset() clears the\npointer in the old one. Another cpu holding a reference on the old\nrequest socket can still be using these options (sending a SYNACK,\nor creating a child in tcp_v4_syn_recv_sock()) when the clone is\nfreed, and tcp_v4_reqsk_destructor() also uses a plain kfree().\n\nReaders already use RCU, and other paths replacing inet_opt\n(do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use\nkfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and\ntcp_v4_reqsk_destructor() as well.\n\nIPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock()\nduplicates the options. tcp_v6_reqsk_destructor() has the same\nmigration issue with ipv6_opt, which is only set by CALIPSO. This\nwill be addressed in a separate patch.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-98432",
"url": "https://www.suse.com/security/cve/CVE-2026-98432"
},
{
"category": "external",
"summary": "SUSE Bug 1285685 for CVE-2026-98432",
"url": "https://bugzilla.suse.com/1285685"
},
{
"category": "external",
"summary": "SUSE Bug 1285686 for CVE-2026-98432",
"url": "https://bugzilla.suse.com/1285686"
},
{
"category": "external",
"summary": "SUSE Bug 1288904 for CVE-2026-98432",
"url": "https://bugzilla.suse.com/1288904"
},
{
"category": "external",
"summary": "SUSE Bug 1288918 for CVE-2026-98432",
"url": "https://bugzilla.suse.com/1288918"
},
{
"category": "external",
"summary": "SUSE Bug 1289140 for CVE-2026-98432",
"url": "https://bugzilla.suse.com/1289140"
},
{
"category": "external",
"summary": "SUSE Bug 1289141 for CVE-2026-98432",
"url": "https://bugzilla.suse.com/1289141"
},
{
"category": "external",
"summary": "SUSE Bug 1289274 for CVE-2026-98432",
"url": "https://bugzilla.suse.com/1289274"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-48-default-0:7-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-11-02T09:02:27Z",
"details": "important"
}
],
"title": "CVE-2026-98432"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.