SUSE-SU-2026:3734-1
Vulnerability from csaf_suse - Published: 2026-08-24 10:35 - Updated: 2026-09-17 16:42Summary
Security update for the Linux Kernel (Live Patch 56 for SUSE Linux Enterprise 15 SP4)
Severity
Important
Notes
Title of the patch: Security update for the Linux Kernel (Live Patch 56 for SUSE Linux Enterprise 15 SP4)
Description of the patch:
This update for the SUSE Linux Enterprise Kernel 5.14.21-150400.24.225 fixes various security issues:
The following security issues were fixed:
- CVE-2023-53995: net: ipv4: fix one memleak in __inet_del_ifa() (bsc#1269284).
- CVE-2025-40204,CVE-2026-53224,CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing
(bsc#1253437 bsc#1270023 bsc#1270024).
- CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268281).
- CVE-2026-46331: net/sched: fix pedit partial COW leading to page cache (bsc#1267625).
- CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269034).
- CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1272139).
- CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269196).
- CVE-2026-53133: RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1269822).
- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (RefluXFS) (bsc#1271543).
Patchnames: SUSE-2026-3734,SUSE-SLE-Module-Live-Patching-15-SP4-2026-3734
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
3 products, the same list as for
CVE-2023-53995
Threats
Impact
important
7.8 (High)
Affected products
Recommended
3 products, the same list as for
CVE-2023-53995
Threats
Impact
important
7.8 (High)
Affected products
Recommended
3 products, the same list as for
CVE-2023-53995
Threats
Impact
important
7.5 (High)
Affected products
Recommended
3 products, the same list as for
CVE-2023-53995
Threats
Impact
important
7.8 (High)
Affected products
Recommended
3 products, the same list as for
CVE-2023-53995
Threats
Impact
important
7.8 (High)
Affected products
Recommended
3 products, the same list as for
CVE-2023-53995
Threats
Impact
important
Affected products
Recommended
3 products, the same list as for
CVE-2023-53995
Threats
Impact
important
8.6 (High)
Affected products
Recommended
3 products, the same list as for
CVE-2023-53995
Threats
Impact
important
7.8 (High)
Affected products
Recommended
3 products, the same list as for
CVE-2023-53995
Threats
Impact
important
References
55 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for the Linux Kernel (Live Patch 56 for SUSE Linux Enterprise 15 SP4)",
"title": "Title of the patch"
},
{
"category": "description",
"text": "\nThis update for the SUSE Linux Enterprise Kernel 5.14.21-150400.24.225 fixes various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2023-53995: net: ipv4: fix one memleak in __inet_del_ifa() (bsc#1269284).\n- CVE-2025-40204,CVE-2026-53224,CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing\n (bsc#1253437 bsc#1270023 bsc#1270024).\n- CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268281).\n- CVE-2026-46331: net/sched: fix pedit partial COW leading to page cache (bsc#1267625).\n- CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269034).\n- CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1272139).\n- CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269196).\n- CVE-2026-53133: RDMA/umem: Fix truncation for block sizes \u003e= 4G (bsc#1269822).\n- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (RefluXFS) (bsc#1271543).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2026-3734,SUSE-SLE-Module-Live-Patching-15-SP4-2026-3734",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_3734-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:3734-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20263734-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:3734-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-August/028475.html"
},
{
"category": "self",
"summary": "SUSE Bug 1267625",
"url": "https://bugzilla.suse.com/1267625"
},
{
"category": "self",
"summary": "SUSE Bug 1268281",
"url": "https://bugzilla.suse.com/1268281"
},
{
"category": "self",
"summary": "SUSE Bug 1269034",
"url": "https://bugzilla.suse.com/1269034"
},
{
"category": "self",
"summary": "SUSE Bug 1269196",
"url": "https://bugzilla.suse.com/1269196"
},
{
"category": "self",
"summary": "SUSE Bug 1269284",
"url": "https://bugzilla.suse.com/1269284"
},
{
"category": "self",
"summary": "SUSE Bug 1269822",
"url": "https://bugzilla.suse.com/1269822"
},
{
"category": "self",
"summary": "SUSE Bug 1270023",
"url": "https://bugzilla.suse.com/1270023"
},
{
"category": "self",
"summary": "SUSE Bug 1270024",
"url": "https://bugzilla.suse.com/1270024"
},
{
"category": "self",
"summary": "SUSE Bug 1271543",
"url": "https://bugzilla.suse.com/1271543"
},
{
"category": "self",
"summary": "SUSE Bug 1272139",
"url": "https://bugzilla.suse.com/1272139"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-53995 page",
"url": "https://www.suse.com/security/cve/CVE-2023-53995/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46319 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46319/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46331 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46331/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-52923 page",
"url": "https://www.suse.com/security/cve/CVE-2026-52923/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-52956 page",
"url": "https://www.suse.com/security/cve/CVE-2026-52956/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-52972 page",
"url": "https://www.suse.com/security/cve/CVE-2026-52972/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-53133 page",
"url": "https://www.suse.com/security/cve/CVE-2026-53133/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-53224 page",
"url": "https://www.suse.com/security/cve/CVE-2026-53224/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-53246 page",
"url": "https://www.suse.com/security/cve/CVE-2026-53246/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-64600 page",
"url": "https://www.suse.com/security/cve/CVE-2026-64600/"
}
],
"title": "Security update for the Linux Kernel (Live Patch 56 for SUSE Linux Enterprise 15 SP4)",
"tracking": {
"current_release_date": "2026-09-17T16:42:28Z",
"generator": {
"date": "2026-08-24T10:35:31Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:3734-1",
"initial_release_date": "2026-08-24T10:35:31Z",
"revision_history": [
{
"date": "2026-08-24T10:35:31Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-16T19:48:36Z",
"number": "2",
"summary": "unknown changes"
},
{
"date": "2026-09-16T20:51:30Z",
"number": "3",
"summary": "unknown changes"
},
{
"date": "2026-09-17T16:42:28Z",
"number": "4",
"summary": "unknown changes"
}
],
"status": "final",
"version": "4"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le",
"product": {
"name": "kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le",
"product_id": "kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/suse/kernel-livepatch-5_14_21-150400_24_225-default@4-150400.2.1?arch=ppc64le\u0026upstream=kernel-livepatch-SLE15-SP4_Update_56-0:4-150400.2.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x",
"product": {
"name": "kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x",
"product_id": "kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/suse/kernel-livepatch-5_14_21-150400_24_225-default@4-150400.2.1?arch=s390x\u0026upstream=kernel-livepatch-SLE15-SP4_Update_56-0:4-150400.2.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64",
"product": {
"name": "kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64",
"product_id": "kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/kernel-livepatch-5_14_21-150400_24_225-default@4-150400.2.1?arch=x86_64\u0026upstream=kernel-livepatch-SLE15-SP4_Update_56-0:4-150400.2.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Live Patching 15 SP4",
"product": {
"name": "SUSE Linux Enterprise Live Patching 15 SP4",
"product_id": "SUSE Linux Enterprise Live Patching 15 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-live-patching:15:sp4"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le as component of SUSE Linux Enterprise Live Patching 15 SP4",
"product_id": "SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le"
},
"product_reference": "kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Live Patching 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x as component of SUSE Linux Enterprise Live Patching 15 SP4",
"product_id": "SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x"
},
"product_reference": "kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Live Patching 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64 as component of SUSE Linux Enterprise Live Patching 15 SP4",
"product_id": "SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64"
},
"product_reference": "kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Live Patching 15 SP4"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-53995",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-53995"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv4: fix one memleak in __inet_del_ifa()\n\nI got the below warning when do fuzzing test:\nunregister_netdevice: waiting for bond0 to become free. Usage count = 2\n\nIt can be repoduced via:\n\nip link add bond0 type bond\nsysctl -w net.ipv4.conf.bond0.promote_secondaries=1\nip addr add 4.117.174.103/0 scope 0x40 dev bond0\nip addr add 192.168.100.111/255.255.255.254 scope 0 dev bond0\nip addr add 0.0.0.4/0 scope 0x40 secondary dev bond0\nip addr del 4.117.174.103/0 scope 0x40 dev bond0\nip link delete bond0 type bond\n\nIn this reproduction test case, an incorrect \u0027last_prim\u0027 is found in\n__inet_del_ifa(), as a result, the secondary address(0.0.0.4/0 scope 0x40)\nis lost. The memory of the secondary address is leaked and the reference of\nin_device and net_device is leaked.\n\nFix this problem:\nLook for \u0027last_prim\u0027 starting at location of the deleted IP and inserting\nthe promoted IP into the location of \u0027last_prim\u0027.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-53995",
"url": "https://www.suse.com/security/cve/CVE-2023-53995"
},
{
"category": "external",
"summary": "SUSE Bug 1255616 for CVE-2023-53995",
"url": "https://bugzilla.suse.com/1255616"
},
{
"category": "external",
"summary": "SUSE Bug 1269284 for CVE-2023-53995",
"url": "https://bugzilla.suse.com/1269284"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-24T10:35:31Z",
"details": "important"
}
],
"title": "CVE-2023-53995"
},
{
"cve": "CVE-2026-46319",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46319"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ct: Only release RCU read lock after ct_ft\n\nWhen looking up a flow table in act_ct in tcf_ct_flow_table_get(),\nrhashtable_lookup_fast() internally opens and closes an RCU read critical\nsection before returning ct_ft.\nThe tcf_ct_flow_table_cleanup_work() can complete before refcount_inc_not_zero()\nis invoked on the returned ct_ft resulting in a UAF on the already freed ct_ft\nobject. This vulnerability can lead to privilege escalation.\n\nAnalysis from zdi-disclosures@trendmicro.com:\nWhen initializing act_ct, tcf_ct_init() is called, which internally triggers\ntcf_ct_flow_table_get().\n\nstatic int tcf_ct_flow_table_get(struct net *net, struct tcf_ct_params *params)\n\n{\n struct zones_ht_key key = { .net = net, .zone = params-\u003ezone };\n struct tcf_ct_flow_table *ct_ft;\n int err = -ENOMEM;\n\n mutex_lock(\u0026zones_mutex);\n ct_ft = rhashtable_lookup_fast(\u0026zones_ht, \u0026key, zones_params); // [1]\n if (ct_ft \u0026\u0026 refcount_inc_not_zero(\u0026ct_ft-\u003eref)) // [2]\n goto out_unlock;\n ...\n}\n\nstatic __always_inline void *rhashtable_lookup_fast(\n struct rhashtable *ht, const void *key,\n const struct rhashtable_params params)\n{\n void *obj;\n\n rcu_read_lock();\n obj = rhashtable_lookup(ht, key, params);\n rcu_read_unlock();\n\n return obj;\n}\n\nAt [1], rhashtable_lookup_fast() looks up and returns the corresponding ct_ft\nfrom zones_ht . The lookup is performed within an RCU read critical section\nthrough rcu_read_lock() / rcu_read_unlock(), which prevents the object from\nbeing freed. However, at the point of function return, rcu_read_unlock() has\nalready been called, and there is nothing preventing ct_ft from being freed\nbefore reaching refcount_inc_not_zero(\u0026ct_ft-\u003eref) at [2]. This interval becomes\nthe race window, during which ct_ft can be freed.\n\nFree Process:\n\ntcf_ct_flow_table_put() is executed through the path tcf_ct_cleanup() call_rcu()\ntcf_ct_params_free_rcu() tcf_ct_params_free() tcf_ct_flow_table_put().\n\nstatic void tcf_ct_flow_table_put(struct tcf_ct_flow_table *ct_ft)\n{\n if (refcount_dec_and_test(\u0026ct_ft-\u003eref)) {\n rhashtable_remove_fast(\u0026zones_ht, \u0026ct_ft-\u003enode, zones_params);\n INIT_RCU_WORK(\u0026ct_ft-\u003erwork, tcf_ct_flow_table_cleanup_work); // [3]\n queue_rcu_work(act_ct_wq, \u0026ct_ft-\u003erwork);\n }\n}\n\nAt [3], tcf_ct_flow_table_cleanup_work() is scheduled as RCU work\n\nstatic void tcf_ct_flow_table_cleanup_work(struct work_struct *work)\n\n{\n struct tcf_ct_flow_table *ct_ft;\n struct flow_block *block;\n\n ct_ft = container_of(to_rcu_work(work), struct tcf_ct_flow_table,\n rwork);\n nf_flow_table_free(\u0026ct_ft-\u003enf_ft);\n block = \u0026ct_ft-\u003enf_ft.flow_block;\n down_write(\u0026ct_ft-\u003enf_ft.flow_block_lock);\n WARN_ON(!list_empty(\u0026block-\u003ecb_list));\n up_write(\u0026ct_ft-\u003enf_ft.flow_block_lock);\n kfree(ct_ft); // [4]\n\n module_put(THIS_MODULE);\n}\n\ntcf_ct_flow_table_cleanup_work() frees ct_ft at [4]. When this function executes\nbetween [1] and [2], UAF occurs.\n\nThis race condition has a very short race window, making it generally\ndifficult to trigger. Therefore, to trigger the vulnerability an msleep(100) was\ninserted after[1]",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46319",
"url": "https://www.suse.com/security/cve/CVE-2026-46319"
},
{
"category": "external",
"summary": "SUSE Bug 1268022 for CVE-2026-46319",
"url": "https://bugzilla.suse.com/1268022"
},
{
"category": "external",
"summary": "SUSE Bug 1268281 for CVE-2026-46319",
"url": "https://bugzilla.suse.com/1268281"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-24T10:35:31Z",
"details": "important"
}
],
"title": "CVE-2026-46319"
},
{
"cve": "CVE-2026-46331",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46331"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fix pedit partial COW leading to page cache corruption\n\ntcf_pedit_act() computes the COW range for skb_ensure_writable()\nonce before the key loop using tcfp_off_max_hint, but the hint does\nnot account for the runtime header offset added by typed keys. This\ncan leave part of the write region un-COW\u0027d.\n\nFix by moving skb_ensure_writable() inside the per-key loop where\nthe actual write offset is known, and add overflow checking on the\noffset arithmetic. For negative offsets (e.g. Ethernet header edits\nat ingress), use skb_cow() to COW the headroom instead. Guard\noffset_valid() against INT_MIN, where negation is undefined.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46331",
"url": "https://www.suse.com/security/cve/CVE-2026-46331"
},
{
"category": "external",
"summary": "SUSE Bug 1265421 for CVE-2026-46331",
"url": "https://bugzilla.suse.com/1265421"
},
{
"category": "external",
"summary": "SUSE Bug 1268335 for CVE-2026-46331",
"url": "https://bugzilla.suse.com/1268335"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-24T10:35:31Z",
"details": "important"
}
],
"title": "CVE-2026-46331"
},
{
"cve": "CVE-2026-52923",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-52923"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipc: limit next_id allocation to the valid ID range\n\nThe checkpoint/restore sysctl path can request the next SysV IPC id\nthrough ids-\u003enext_id. ipc_idr_alloc() currently forwards that request to\nidr_alloc() with an open-ended upper bound.\n\nIf the valid tail of the SysV IPC id space is full, the allocation can\nspill beyond ipc_mni. The returned SysV IPC id still uses the normal\nindex encoding, so later lookup and removal can target the wrong slot. \nThis leaves the real IDR entry behind and breaks the IDR state for the\nobject.\n\nThe bug is in ipc_idr_alloc() in the checkpoint/restore path.\n\n1. ids-\u003enext_id is passed to:\n\n idr_alloc(\u0026ids-\u003eipcs_idr, new, ipcid_to_idx(next_id), 0, ...)\n\n2. The zero upper bound makes the allocation effectively open-ended.\n Once the valid SysV IPC tail is occupied, idr_alloc() can spill past\n ipc_mni and allocate an entry beyond the valid IPC id range.\n\n3. The new object id is still encoded with the narrower SysV IPC index\n width:\n\n new-\u003eid = (new-\u003eseq \u003c\u003c ipcmni_seq_shift()) + idx\n\n4. Later removal goes through ipc_rmid(), which uses:\n\n ipcid_to_idx(ipcp-\u003eid)\n\n That truncates the real IDR index. An object actually stored at a\n high index can then be removed as if it lived at a low in-range\n index.\n\n5. For shared memory, shm_destroy() frees the current object anyway, but\n the real high IDR slot is left behind as a dangling pointer.\n\n6. A subsequent walk of /proc/sysvipc/shm reaches the stale IDR entry\n and dereferences freed memory.\n\nPrevent this by bounding the requested allocation to ipc_mni so the\ncheckpoint/restore path fails once the valid range is exhausted.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-52923",
"url": "https://www.suse.com/security/cve/CVE-2026-52923"
},
{
"category": "external",
"summary": "SUSE Bug 1269033 for CVE-2026-52923",
"url": "https://bugzilla.suse.com/1269033"
},
{
"category": "external",
"summary": "SUSE Bug 1269034 for CVE-2026-52923",
"url": "https://bugzilla.suse.com/1269034"
},
{
"category": "external",
"summary": "SUSE Bug 1274780 for CVE-2026-52923",
"url": "https://bugzilla.suse.com/1274780"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-24T10:35:31Z",
"details": "important"
}
],
"title": "CVE-2026-52923"
},
{
"cve": "CVE-2026-52956",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-52956"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Fix potential out-of-bounds access in __ceph_x_decrypt()\n\nIn __ceph_x_decrypt(), a part of the buffer p is interpreted as a\nceph_x_encrypt_header, and the magic field of this struct is accessed.\nThis happens without any guarantee that the buffer is large enough to\nhold this struct. The function parameter ciphertext_len represents the\nlength of the ciphertext to decrypt and is guaranteed to be at most the\nremaining size of the allocated buffer p. However, this value is not\nnecessarily greater than sizeof(ceph_x_encrypt_header). E.g., a message\nframe of type FRAME_TAG_AUTH_REPLY_MORE, that is just as long to hold\nthe ciphertext at its end with a ciphertext_len of 8 or less, can\ntrigger an out-of-bounds memory access when accessing hdr-\u003emagic.\n\nThis patch fixes the issue by adding a check to ensure that the\ndecrypted plaintext in the buffer is large enough to represent at least\nthe ceph_x_encrypt_header.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-52956",
"url": "https://www.suse.com/security/cve/CVE-2026-52956"
},
{
"category": "external",
"summary": "SUSE Bug 1269172 for CVE-2026-52956",
"url": "https://bugzilla.suse.com/1269172"
},
{
"category": "external",
"summary": "SUSE Bug 1272139 for CVE-2026-52956",
"url": "https://bugzilla.suse.com/1272139"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-24T10:35:31Z",
"details": "important"
}
],
"title": "CVE-2026-52956"
},
{
"cve": "CVE-2026-52972",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-52972"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Cap AEAD AD length to 0x80000000\n\nIn order to prevent arithmetic overflows when checking the TX\nbuffer size, cap the associated data length to 0x80000000.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-52972",
"url": "https://www.suse.com/security/cve/CVE-2026-52972"
},
{
"category": "external",
"summary": "SUSE Bug 1269195 for CVE-2026-52972",
"url": "https://bugzilla.suse.com/1269195"
},
{
"category": "external",
"summary": "SUSE Bug 1269196 for CVE-2026-52972",
"url": "https://bugzilla.suse.com/1269196"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-24T10:35:31Z",
"details": "important"
}
],
"title": "CVE-2026-52972"
},
{
"cve": "CVE-2026-53133",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-53133"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/umem: Fix truncation for block sizes \u003e= 4G\n\nWhen the iommu is used the linearization of the mapping can give a single\nblock that is very large split across multiple SG entries.\n\nWhen __rdma_block_iter_next() reassembles the split SG entries it is\noverflowing the 32 bit stack values and computed the wrong DMA addresses\nfor blocks after the truncation.\n\nUse the right types to hold DMA addresses.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-53133",
"url": "https://www.suse.com/security/cve/CVE-2026-53133"
},
{
"category": "external",
"summary": "SUSE Bug 1269821 for CVE-2026-53133",
"url": "https://bugzilla.suse.com/1269821"
},
{
"category": "external",
"summary": "SUSE Bug 1269822 for CVE-2026-53133",
"url": "https://bugzilla.suse.com/1269822"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-24T10:35:31Z",
"details": "important"
}
],
"title": "CVE-2026-53133"
},
{
"cve": "CVE-2026-53224",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-53224"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate embedded INIT chunk and address list lengths in cookie\n\nsctp_unpack_cookie() only checked that the embedded INIT chunk length\ndid not exceed the remaining cookie payload, but did not ensure that the\nINIT chunk is large enough to contain a complete INIT header.\n\nA malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose\nlength field is smaller than sizeof(struct sctp_init_chunk). Later,\nsctp_process_init() accesses INIT parameters unconditionally, which may\nlead to out-of-bounds reads.\n\nIn addition, raw_addr_list_len is not fully validated against the\nremaining cookie payload. When cookie authentication is disabled, an\nattacker can supply an oversized raw_addr_list_len and cause\nsctp_raw_to_bind_addrs() to read beyond the end of the cookie. The\naddress parser also lacks sufficient bounds checks for parameter headers\nand lengths, allowing malformed address parameters to trigger\nout-of-bounds reads.\n\nFix this by:\n\n- requiring the embedded INIT chunk length to be at least sizeof(struct\n sctp_init_chunk);\n- validating that the INIT chunk and raw address list together fit\n within the cookie payload;\n- verifying sufficient data exists for each address parameter header and\n payload before parsing it.\n\nNote that sctp_verify_init() must be called after sctp_unpack_cookie()\nand before sctp_process_init() when cookie authentication is disabled.\nThis will be addressed in a separate patch.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-53224",
"url": "https://www.suse.com/security/cve/CVE-2026-53224"
},
{
"category": "external",
"summary": "SUSE Bug 1269997 for CVE-2026-53224",
"url": "https://bugzilla.suse.com/1269997"
},
{
"category": "external",
"summary": "SUSE Bug 1270023 for CVE-2026-53224",
"url": "https://bugzilla.suse.com/1270023"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-24T10:35:31Z",
"details": "important"
}
],
"title": "CVE-2026-53224"
},
{
"cve": "CVE-2026-53246",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-53246"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate cached peer INIT chunk length in COOKIE_ECHO processing\n\nWhen a listening SCTP server processes a COOKIE_ECHO chunk, the cached\npeer INIT chunk embedded after the cookie is parsed and its parameters\nare later walked by sctp_process_init() using sctp_walk_params().\n\nHowever, the chunk header length of this cached INIT chunk was not\nvalidated against the remaining buffer in the COOKIE_ECHO payload. If\nthe length field is inflated, the parameter walk can run beyond the\nactual received data, leading to out-of-bounds reads and potential\nmemory corruption during later parameter handling (e.g. STATE_COOKIE\nprocessing and kmemdup() copies).\n\nAdd a bounds check in sctp_unpack_cookie() to ensure the cached INIT\nchunk length does not exceed the available data in the COOKIE_ECHO\nbuffer before it is used.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-53246",
"url": "https://www.suse.com/security/cve/CVE-2026-53246"
},
{
"category": "external",
"summary": "SUSE Bug 1269988 for CVE-2026-53246",
"url": "https://bugzilla.suse.com/1269988"
},
{
"category": "external",
"summary": "SUSE Bug 1270024 for CVE-2026-53246",
"url": "https://bugzilla.suse.com/1270024"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-24T10:35:31Z",
"details": "important"
}
],
"title": "CVE-2026-53246"
},
{
"cve": "CVE-2026-64600",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-64600"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: resample the data fork mapping after cycling ILOCK\n\nxfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode,\na data fork mapping, and a cow fork mapping. Unfortunately, these two\nhelpers cycle the ILOCK to grab a transaction, which means that the\nmappings are stale as soon as we reacquire the ILOCK. Currently we\nrefresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but\nwe don\u0027t refresh the data fork mapping beforehand, which means that the\nxfs_bmap_trim_cow in that function queries the refcount btree about the\nwrong physical blocks and returns an inaccurate value in *shared.\n\nIf *shared is now false, the directio write proceeds with a stale data\nfork mapping. Fix this by querying the data fork mapping if the\nsequence counter changes across the ILOCK cycle.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-64600",
"url": "https://www.suse.com/security/cve/CVE-2026-64600"
},
{
"category": "external",
"summary": "SUSE Bug 1271526 for CVE-2026-64600",
"url": "https://bugzilla.suse.com/1271526"
},
{
"category": "external",
"summary": "SUSE Bug 1271543 for CVE-2026-64600",
"url": "https://bugzilla.suse.com/1271543"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.ppc64le",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.s390x",
"SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_225-default-0:4-150400.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-24T10:35:31Z",
"details": "important"
}
],
"title": "CVE-2026-64600"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…