SUSE-SU-2026:4939-1
Vulnerability from csaf_suse - Published: 2026-10-29 13:40 - Updated: 2026-10-31 17:16Summary
Security update for the Linux Kernel
Severity
Important
Notes
Title of the patch: Security update for the Linux Kernel
Description of the patch:
The SUSE Linux Enterprise 15 SP4 RT kernel was updated to fix various security issues:
The following security issues were fixed:
- CVE-2024-39468: smb: client: fix deadlock in smb2_find_smb_tcon() (bsc#1227103, bsc#1280176).
- CVE-2026-72041: espintcp: use sk_msg_free_partial to fix partial send (bsc#1275510).
- CVE-2026-72110: bpf,fork: wipe ->bpf_storage before bailouts that access it (bsc#1277357).
- CVE-2026-72493: net: serialize netif_running() check in enqueue_to_backlog() (bsc#1276951).
- CVE-2026-74578: crypto: algif_skcipher - force synchronous processing on trees without ctx->state (bsc#1275564).
- CVE-2026-74587: sctp: fix use-after-free of cached ASCONF chunk (bsc#1277821).
- CVE-2026-74624: netfilter: conntrack: work around exceeded receive window (bsc#1277599).
- CVE-2026-80977: net: skbuff: don't touch shared zerocopy state in skb_tx_error() (bsc#1280259).
- CVE-2026-89528: svcrdma: Reject Read lists that exceed the page budget (bsc#1280743).
- CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387).
- CVE-2026-89669: nfsd: fix cpntf publish race in nfs4_init_cp_state (bsc#1280251).
- CVE-2026-90011: scsi: target: iscsi: Reserve a terminator byte for the login payload (bsc#1281280).
- CVE-2026-90088: Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (bsc#1281397).
- CVE-2026-97555: smb: client: fix heap overflow in DACL owner/group rewrite (bsc#1283851).
- CVE-2026-97564: smb: client: reject userspace cifs.idmap descriptions (bsc#1283946).
- CVE-2026-98015: net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put (bsc#1283963).
- CVE-2026-98016: net/mlx5e: Fix use-after-free race in sample_restore_put() (bsc#1283894).
- CVE-2026-98041: bpf: Don't predict JMP32 pointer vs zero comparisons (bsc#1284064).
- CVE-2026-98130: sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START (bsc#1283835).
- CVE-2026-98248: arm64: Use load LSE atomics for the non-return per-CPU atomic operations (bsc#1284518).
- CVE-2026-98253: RDMA/ucma: Serialize join and leave on copy_to_user failure (bsc#1284790).
- CVE-2026-98260: exec: Cleanup POSIX timers right after de_thread() (bsc#1284408).
- CVE-2026-98323: RDMA/siw: Bound fragmented header copies by the remaining length (bsc#1284713).
- CVE-2026-98357: IB/isert: wait for deferred control PDU completions before releasing the connection (bsc#1284791).
- CVE-2026-98359: RDMA/core: Reject unregistering netdevs in ib_get_eth_speed (bsc#1284746).
- CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285685).
- CVE-2026-99999: ipv4: validate checksum_start before completing checksum (bsc#1285684).
The following non security issue was fixed:
- netfilter: nfnetlink_queue: unbreak SCTP traffic (bsc#1285684).
Patchnames: SUSE-2026-4939,SUSE-SLE-Micro-5.4-2026-4939
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
4.1 (Medium)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
5.5 (Medium)
Affected products
Recommended
2 products, the same list as for
CVE-2024-39468
Threats
Impact
moderate
7.8 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2024-39468
Threats
Impact
important
Affected products
Recommended
2 products, the same list as for
CVE-2024-39468
Threats
Impact
important
5.3 (Medium)
Affected products
Recommended
2 products, the same list as for
CVE-2024-39468
Threats
Impact
moderate
8.2 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2024-39468
Threats
Impact
important
7.5 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2024-39468
Threats
Impact
important
7.4 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2024-39468
Threats
Impact
important
7.5 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2024-39468
Threats
Impact
important
7.7 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2024-39468
Threats
Impact
important
7.5 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2024-39468
Threats
Impact
important
8.2 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2024-39468
Threats
Impact
important
7.5 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2024-39468
Threats
Impact
important
7.8 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2024-39468
Threats
Impact
important
7.8 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2024-39468
Threats
Impact
important
Affected products
Recommended
2 products, the same list as for
CVE-2024-39468
Threats
Impact
important
Affected products
Recommended
2 products, the same list as for
CVE-2024-39468
Threats
Impact
important
6.4 (Medium)
Affected products
Recommended
2 products, the same list as for
CVE-2024-39468
Threats
Impact
moderate
7.8 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2024-39468
Threats
Impact
important
7.8 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2024-39468
Threats
Impact
important
Affected products
Recommended
2 products, the same list as for
CVE-2024-39468
Threats
Impact
important
Affected products
Recommended
2 products, the same list as for
CVE-2024-39468
Threats
Impact
important
8.1 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2024-39468
Threats
Impact
important
7.1 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2024-39468
Threats
Impact
important
Affected products
Recommended
2 products, the same list as for
CVE-2024-39468
Threats
Impact
important
8.1 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2024-39468
Threats
Impact
important
8.8 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2024-39468
Threats
Impact
important
References
142 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for the Linux Kernel",
"title": "Title of the patch"
},
{
"category": "description",
"text": "\nThe SUSE Linux Enterprise 15 SP4 RT kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2024-39468: smb: client: fix deadlock in smb2_find_smb_tcon() (bsc#1227103, bsc#1280176).\n- CVE-2026-72041: espintcp: use sk_msg_free_partial to fix partial send (bsc#1275510).\n- CVE-2026-72110: bpf,fork: wipe -\u003ebpf_storage before bailouts that access it (bsc#1277357).\n- CVE-2026-72493: net: serialize netif_running() check in enqueue_to_backlog() (bsc#1276951).\n- CVE-2026-74578: crypto: algif_skcipher - force synchronous processing on trees without ctx-\u003estate (bsc#1275564).\n- CVE-2026-74587: sctp: fix use-after-free of cached ASCONF chunk (bsc#1277821).\n- CVE-2026-74624: netfilter: conntrack: work around exceeded receive window (bsc#1277599).\n- CVE-2026-80977: net: skbuff: don\u0027t touch shared zerocopy state in skb_tx_error() (bsc#1280259).\n- CVE-2026-89528: svcrdma: Reject Read lists that exceed the page budget (bsc#1280743).\n- CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387).\n- CVE-2026-89669: nfsd: fix cpntf publish race in nfs4_init_cp_state (bsc#1280251).\n- CVE-2026-90011: scsi: target: iscsi: Reserve a terminator byte for the login payload (bsc#1281280).\n- CVE-2026-90088: Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (bsc#1281397).\n- CVE-2026-97555: smb: client: fix heap overflow in DACL owner/group rewrite (bsc#1283851).\n- CVE-2026-97564: smb: client: reject userspace cifs.idmap descriptions (bsc#1283946).\n- CVE-2026-98015: net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put (bsc#1283963).\n- CVE-2026-98016: net/mlx5e: Fix use-after-free race in sample_restore_put() (bsc#1283894).\n- CVE-2026-98041: bpf: Don\u0027t predict JMP32 pointer vs zero comparisons (bsc#1284064).\n- CVE-2026-98130: sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START (bsc#1283835).\n- CVE-2026-98248: arm64: Use load LSE atomics for the non-return per-CPU atomic operations (bsc#1284518).\n- CVE-2026-98253: RDMA/ucma: Serialize join and leave on copy_to_user failure (bsc#1284790).\n- CVE-2026-98260: exec: Cleanup POSIX timers right after de_thread() (bsc#1284408).\n- CVE-2026-98323: RDMA/siw: Bound fragmented header copies by the remaining length (bsc#1284713).\n- CVE-2026-98357: IB/isert: wait for deferred control PDU completions before releasing the connection (bsc#1284791).\n- CVE-2026-98359: RDMA/core: Reject unregistering netdevs in ib_get_eth_speed (bsc#1284746).\n- CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285685).\n- CVE-2026-99999: ipv4: validate checksum_start before completing checksum (bsc#1285684).\n\nThe following non security issue was fixed:\n\n- netfilter: nfnetlink_queue: unbreak SCTP traffic (bsc#1285684).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2026-4939,SUSE-SLE-Micro-5.4-2026-4939",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_4939-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:4939-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20264939-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:4939-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20264939-1/"
},
{
"category": "self",
"summary": "SUSE Bug 1227103",
"url": "https://bugzilla.suse.com/1227103"
},
{
"category": "self",
"summary": "SUSE Bug 1275510",
"url": "https://bugzilla.suse.com/1275510"
},
{
"category": "self",
"summary": "SUSE Bug 1275564",
"url": "https://bugzilla.suse.com/1275564"
},
{
"category": "self",
"summary": "SUSE Bug 1276951",
"url": "https://bugzilla.suse.com/1276951"
},
{
"category": "self",
"summary": "SUSE Bug 1277357",
"url": "https://bugzilla.suse.com/1277357"
},
{
"category": "self",
"summary": "SUSE Bug 1277599",
"url": "https://bugzilla.suse.com/1277599"
},
{
"category": "self",
"summary": "SUSE Bug 1277821",
"url": "https://bugzilla.suse.com/1277821"
},
{
"category": "self",
"summary": "SUSE Bug 1280176",
"url": "https://bugzilla.suse.com/1280176"
},
{
"category": "self",
"summary": "SUSE Bug 1280251",
"url": "https://bugzilla.suse.com/1280251"
},
{
"category": "self",
"summary": "SUSE Bug 1280259",
"url": "https://bugzilla.suse.com/1280259"
},
{
"category": "self",
"summary": "SUSE Bug 1280387",
"url": "https://bugzilla.suse.com/1280387"
},
{
"category": "self",
"summary": "SUSE Bug 1280743",
"url": "https://bugzilla.suse.com/1280743"
},
{
"category": "self",
"summary": "SUSE Bug 1281280",
"url": "https://bugzilla.suse.com/1281280"
},
{
"category": "self",
"summary": "SUSE Bug 1281397",
"url": "https://bugzilla.suse.com/1281397"
},
{
"category": "self",
"summary": "SUSE Bug 1283835",
"url": "https://bugzilla.suse.com/1283835"
},
{
"category": "self",
"summary": "SUSE Bug 1283851",
"url": "https://bugzilla.suse.com/1283851"
},
{
"category": "self",
"summary": "SUSE Bug 1283894",
"url": "https://bugzilla.suse.com/1283894"
},
{
"category": "self",
"summary": "SUSE Bug 1283946",
"url": "https://bugzilla.suse.com/1283946"
},
{
"category": "self",
"summary": "SUSE Bug 1283963",
"url": "https://bugzilla.suse.com/1283963"
},
{
"category": "self",
"summary": "SUSE Bug 1284064",
"url": "https://bugzilla.suse.com/1284064"
},
{
"category": "self",
"summary": "SUSE Bug 1284408",
"url": "https://bugzilla.suse.com/1284408"
},
{
"category": "self",
"summary": "SUSE Bug 1284518",
"url": "https://bugzilla.suse.com/1284518"
},
{
"category": "self",
"summary": "SUSE Bug 1284713",
"url": "https://bugzilla.suse.com/1284713"
},
{
"category": "self",
"summary": "SUSE Bug 1284746",
"url": "https://bugzilla.suse.com/1284746"
},
{
"category": "self",
"summary": "SUSE Bug 1284790",
"url": "https://bugzilla.suse.com/1284790"
},
{
"category": "self",
"summary": "SUSE Bug 1284791",
"url": "https://bugzilla.suse.com/1284791"
},
{
"category": "self",
"summary": "SUSE Bug 1285684",
"url": "https://bugzilla.suse.com/1285684"
},
{
"category": "self",
"summary": "SUSE Bug 1285685",
"url": "https://bugzilla.suse.com/1285685"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-39468 page",
"url": "https://www.suse.com/security/cve/CVE-2024-39468/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-72041 page",
"url": "https://www.suse.com/security/cve/CVE-2026-72041/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-72110 page",
"url": "https://www.suse.com/security/cve/CVE-2026-72110/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-72493 page",
"url": "https://www.suse.com/security/cve/CVE-2026-72493/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-74578 page",
"url": "https://www.suse.com/security/cve/CVE-2026-74578/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-74587 page",
"url": "https://www.suse.com/security/cve/CVE-2026-74587/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-74624 page",
"url": "https://www.suse.com/security/cve/CVE-2026-74624/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-80977 page",
"url": "https://www.suse.com/security/cve/CVE-2026-80977/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-89528 page",
"url": "https://www.suse.com/security/cve/CVE-2026-89528/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-89542 page",
"url": "https://www.suse.com/security/cve/CVE-2026-89542/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-89669 page",
"url": "https://www.suse.com/security/cve/CVE-2026-89669/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-90011 page",
"url": "https://www.suse.com/security/cve/CVE-2026-90011/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-90088 page",
"url": "https://www.suse.com/security/cve/CVE-2026-90088/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-97555 page",
"url": "https://www.suse.com/security/cve/CVE-2026-97555/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-97564 page",
"url": "https://www.suse.com/security/cve/CVE-2026-97564/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-98015 page",
"url": "https://www.suse.com/security/cve/CVE-2026-98015/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-98016 page",
"url": "https://www.suse.com/security/cve/CVE-2026-98016/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-98041 page",
"url": "https://www.suse.com/security/cve/CVE-2026-98041/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-98130 page",
"url": "https://www.suse.com/security/cve/CVE-2026-98130/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-98248 page",
"url": "https://www.suse.com/security/cve/CVE-2026-98248/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-98253 page",
"url": "https://www.suse.com/security/cve/CVE-2026-98253/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-98260 page",
"url": "https://www.suse.com/security/cve/CVE-2026-98260/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-98323 page",
"url": "https://www.suse.com/security/cve/CVE-2026-98323/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-98357 page",
"url": "https://www.suse.com/security/cve/CVE-2026-98357/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-98359 page",
"url": "https://www.suse.com/security/cve/CVE-2026-98359/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-98432 page",
"url": "https://www.suse.com/security/cve/CVE-2026-98432/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-99999 page",
"url": "https://www.suse.com/security/cve/CVE-2026-99999/"
}
],
"title": "Security update for the Linux Kernel",
"tracking": {
"current_release_date": "2026-10-31T17:16:36Z",
"generator": {
"date": "2026-10-29T13:40:41Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:4939-1",
"initial_release_date": "2026-10-29T13:40:41Z",
"revision_history": [
{
"date": "2026-10-29T13:40:41Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-10-30T11:39:42Z",
"number": "2",
"summary": "unknown changes"
},
{
"date": "2026-10-31T17:16:36Z",
"number": "3",
"summary": "unknown changes"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "kernel-devel-rt-0:5.14.21-150400.15.192.2.noarch",
"product": {
"name": "kernel-devel-rt-0:5.14.21-150400.15.192.2.noarch",
"product_id": "kernel-devel-rt-0:5.14.21-150400.15.192.2.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:o:linux:linux_kernel:5.14.21:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/kernel-devel-rt@5.14.21-150400.15.192.2?arch=noarch\u0026upstream=kernel-source-rt-0:5.14.21-150400.15.192.2.src.rpm"
}
}
},
{
"category": "product_version",
"name": "kernel-source-rt-0:5.14.21-150400.15.192.2.noarch",
"product": {
"name": "kernel-source-rt-0:5.14.21-150400.15.192.2.noarch",
"product_id": "kernel-source-rt-0:5.14.21-150400.15.192.2.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:o:linux:linux_kernel:5.14.21:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/kernel-source-rt@5.14.21-150400.15.192.2?arch=noarch\u0026upstream=kernel-source-rt-0:5.14.21-150400.15.192.2.src.rpm"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "cluster-md-kmp-rt-0:5.14.21-150400.15.192.2.x86_64",
"product": {
"name": "cluster-md-kmp-rt-0:5.14.21-150400.15.192.2.x86_64",
"product_id": "cluster-md-kmp-rt-0:5.14.21-150400.15.192.2.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:o:linux:linux_kernel:5.14.21:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/cluster-md-kmp-rt@5.14.21-150400.15.192.2?arch=x86_64\u0026upstream=kernel-source-0:5.14.21-150400.15.192.2.src.rpm"
}
}
},
{
"category": "product_version",
"name": "dlm-kmp-rt-0:5.14.21-150400.15.192.2.x86_64",
"product": {
"name": "dlm-kmp-rt-0:5.14.21-150400.15.192.2.x86_64",
"product_id": "dlm-kmp-rt-0:5.14.21-150400.15.192.2.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:o:linux:linux_kernel:5.14.21:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/dlm-kmp-rt@5.14.21-150400.15.192.2?arch=x86_64\u0026upstream=kernel-source-0:5.14.21-150400.15.192.2.src.rpm"
}
}
},
{
"category": "product_version",
"name": "gfs2-kmp-rt-0:5.14.21-150400.15.192.2.x86_64",
"product": {
"name": "gfs2-kmp-rt-0:5.14.21-150400.15.192.2.x86_64",
"product_id": "gfs2-kmp-rt-0:5.14.21-150400.15.192.2.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:o:linux:linux_kernel:5.14.21:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/gfs2-kmp-rt@5.14.21-150400.15.192.2?arch=x86_64\u0026upstream=kernel-source-0:5.14.21-150400.15.192.2.src.rpm"
}
}
},
{
"category": "product_version",
"name": "kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"product": {
"name": "kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"product_id": "kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:o:linux:linux_kernel:5.14.21:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/kernel-rt@5.14.21-150400.15.192.2?arch=x86_64\u0026upstream=kernel-source-0:5.14.21-150400.15.192.2.src.rpm"
}
}
},
{
"category": "product_version",
"name": "kernel-rt-devel-0:5.14.21-150400.15.192.2.x86_64",
"product": {
"name": "kernel-rt-devel-0:5.14.21-150400.15.192.2.x86_64",
"product_id": "kernel-rt-devel-0:5.14.21-150400.15.192.2.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:o:linux:linux_kernel:5.14.21:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/kernel-rt-devel@5.14.21-150400.15.192.2?arch=x86_64\u0026upstream=kernel-source-0:5.14.21-150400.15.192.2.src.rpm"
}
}
},
{
"category": "product_version",
"name": "kernel-rt-extra-0:5.14.21-150400.15.192.2.x86_64",
"product": {
"name": "kernel-rt-extra-0:5.14.21-150400.15.192.2.x86_64",
"product_id": "kernel-rt-extra-0:5.14.21-150400.15.192.2.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:o:linux:linux_kernel:5.14.21:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/kernel-rt-extra@5.14.21-150400.15.192.2?arch=x86_64\u0026upstream=kernel-source-0:5.14.21-150400.15.192.2.src.rpm"
}
}
},
{
"category": "product_version",
"name": "kernel-rt-livepatch-0:5.14.21-150400.15.192.2.x86_64",
"product": {
"name": "kernel-rt-livepatch-0:5.14.21-150400.15.192.2.x86_64",
"product_id": "kernel-rt-livepatch-0:5.14.21-150400.15.192.2.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:o:linux:linux_kernel:5.14.21:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/kernel-rt-livepatch@5.14.21-150400.15.192.2?arch=x86_64\u0026upstream=kernel-source-0:5.14.21-150400.15.192.2.src.rpm"
}
}
},
{
"category": "product_version",
"name": "kernel-rt-livepatch-devel-0:5.14.21-150400.15.192.2.x86_64",
"product": {
"name": "kernel-rt-livepatch-devel-0:5.14.21-150400.15.192.2.x86_64",
"product_id": "kernel-rt-livepatch-devel-0:5.14.21-150400.15.192.2.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:o:linux:linux_kernel:5.14.21:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/kernel-rt-livepatch-devel@5.14.21-150400.15.192.2?arch=x86_64\u0026upstream=kernel-source-0:5.14.21-150400.15.192.2.src.rpm"
}
}
},
{
"category": "product_version",
"name": "kernel-rt-optional-0:5.14.21-150400.15.192.2.x86_64",
"product": {
"name": "kernel-rt-optional-0:5.14.21-150400.15.192.2.x86_64",
"product_id": "kernel-rt-optional-0:5.14.21-150400.15.192.2.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:o:linux:linux_kernel:5.14.21:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/kernel-rt-optional@5.14.21-150400.15.192.2?arch=x86_64\u0026upstream=kernel-rt-0:5.14.21-150400.15.192.2.src.rpm"
}
}
},
{
"category": "product_version",
"name": "kernel-rt_debug-0:5.14.21-150400.15.192.2.x86_64",
"product": {
"name": "kernel-rt_debug-0:5.14.21-150400.15.192.2.x86_64",
"product_id": "kernel-rt_debug-0:5.14.21-150400.15.192.2.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:o:linux:linux_kernel:5.14.21:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/kernel-rt_debug@5.14.21-150400.15.192.2?arch=x86_64\u0026upstream=kernel-rt_debug-0:5.14.21-150400.15.192.2.src.rpm"
}
}
},
{
"category": "product_version",
"name": "kernel-rt_debug-devel-0:5.14.21-150400.15.192.2.x86_64",
"product": {
"name": "kernel-rt_debug-devel-0:5.14.21-150400.15.192.2.x86_64",
"product_id": "kernel-rt_debug-devel-0:5.14.21-150400.15.192.2.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:o:linux:linux_kernel:5.14.21:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/kernel-rt_debug-devel@5.14.21-150400.15.192.2?arch=x86_64\u0026upstream=kernel-rt_debug-0:5.14.21-150400.15.192.2.src.rpm"
}
}
},
{
"category": "product_version",
"name": "kernel-syms-rt-0:5.14.21-150400.15.192.1.x86_64",
"product": {
"name": "kernel-syms-rt-0:5.14.21-150400.15.192.1.x86_64",
"product_id": "kernel-syms-rt-0:5.14.21-150400.15.192.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:o:linux:linux_kernel:5.14.21:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/kernel-syms-rt@5.14.21-150400.15.192.1?arch=x86_64\u0026upstream=kernel-syms-rt-0:5.14.21-150400.15.192.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "kselftests-kmp-rt-0:5.14.21-150400.15.192.2.x86_64",
"product": {
"name": "kselftests-kmp-rt-0:5.14.21-150400.15.192.2.x86_64",
"product_id": "kselftests-kmp-rt-0:5.14.21-150400.15.192.2.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:o:linux:linux_kernel:5.14.21:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/kselftests-kmp-rt@5.14.21-150400.15.192.2?arch=x86_64\u0026upstream=kernel-rt-0:5.14.21-150400.15.192.2.src.rpm"
}
}
},
{
"category": "product_version",
"name": "ocfs2-kmp-rt-0:5.14.21-150400.15.192.2.x86_64",
"product": {
"name": "ocfs2-kmp-rt-0:5.14.21-150400.15.192.2.x86_64",
"product_id": "ocfs2-kmp-rt-0:5.14.21-150400.15.192.2.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:o:linux:linux_kernel:5.14.21:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/ocfs2-kmp-rt@5.14.21-150400.15.192.2?arch=x86_64\u0026upstream=kernel-rt-0:5.14.21-150400.15.192.2.src.rpm"
}
}
},
{
"category": "product_version",
"name": "reiserfs-kmp-rt-0:5.14.21-150400.15.192.2.x86_64",
"product": {
"name": "reiserfs-kmp-rt-0:5.14.21-150400.15.192.2.x86_64",
"product_id": "reiserfs-kmp-rt-0:5.14.21-150400.15.192.2.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:o:linux:linux_kernel:5.14.21:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/reiserfs-kmp-rt@5.14.21-150400.15.192.2?arch=x86_64\u0026upstream=kernel-rt-0:5.14.21-150400.15.192.2.src.rpm"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Micro 5.4",
"product": {
"name": "SUSE Linux Enterprise Micro 5.4",
"product_id": "SUSE Linux Enterprise Micro 5.4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-micro:5.4"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-0:5.14.21-150400.15.192.2.x86_64 as component of SUSE Linux Enterprise Micro 5.4",
"product_id": "SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64"
},
"product_reference": "kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-source-rt-0:5.14.21-150400.15.192.2.noarch as component of SUSE Linux Enterprise Micro 5.4",
"product_id": "SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
},
"product_reference": "kernel-source-rt-0:5.14.21-150400.15.192.2.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-39468",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-39468"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix deadlock in smb2_find_smb_tcon()\n\nUnlock cifs_tcp_ses_lock before calling cifs_put_smb_ses() to avoid such\ndeadlock.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-39468",
"url": "https://www.suse.com/security/cve/CVE-2024-39468"
},
{
"category": "external",
"summary": "SUSE Bug 1227103 for CVE-2024-39468",
"url": "https://bugzilla.suse.com/1227103"
},
{
"category": "external",
"summary": "SUSE Bug 1280176 for CVE-2024-39468",
"url": "https://bugzilla.suse.com/1280176"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-29T13:40:41Z",
"details": "moderate"
}
],
"title": "CVE-2024-39468"
},
{
"cve": "CVE-2026-72041",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-72041"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nespintcp: use sk_msg_free_partial to fix partial send\n\nsk_msg_free_partial() ensures consistency of the skmsg at every\niteration, without having to manually handle uncharges and offsets.\nThis simplifies the code, and fixes some bugs in skmsg accounting when\nwe don\u0027t send the full contents.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-72041",
"url": "https://www.suse.com/security/cve/CVE-2026-72041"
},
{
"category": "external",
"summary": "SUSE Bug 1275510 for CVE-2026-72041",
"url": "https://bugzilla.suse.com/1275510"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-29T13:40:41Z",
"details": "moderate"
}
],
"title": "CVE-2026-72041"
},
{
"cve": "CVE-2026-72110",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-72110"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf,fork: wipe -\u003ebpf_storage before bailouts that access it\n\nCurrently, copy_process() can bail out to free_task() before p-\u003ebpf_storage\nhas been initialized, with this call graph (shown here for the\n!CONFIG_MEMCG case):\n\ncopy_process\n dup_task_struct\n arch_dup_task_struct\n [copies the entire task_struct, including -\u003ebpf_storage member]\n [RLIMIT_NPROC check fails]\n delayed_free_task\n free_task\n bpf_task_storage_free\n rcu_dereference(task-\u003ebpf_storage)\n bpf_local_storage_destroy\n\nIn this case, the nascent task\u0027s -\u003ebpf_storage member that\nbpf_local_storage_destroy() operates on is a plain copy of the parent\u0027s\n-\u003ebpf_storage pointer, not a real initialized pointer.\nThis leads to badness (kernel hangs, UAF).\n\nThis is reachable as long as the process calling fork() has been inserted\ninto a task storage map.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-72110",
"url": "https://www.suse.com/security/cve/CVE-2026-72110"
},
{
"category": "external",
"summary": "SUSE Bug 1277357 for CVE-2026-72110",
"url": "https://bugzilla.suse.com/1277357"
},
{
"category": "external",
"summary": "SUSE Bug 1277363 for CVE-2026-72110",
"url": "https://bugzilla.suse.com/1277363"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-29T13:40:41Z",
"details": "important"
}
],
"title": "CVE-2026-72110"
},
{
"cve": "CVE-2026-72493",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-72493"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: serialize netif_running() check in enqueue_to_backlog()\n\nSyzbot reported a KASAN slab-use-after-free in fib_rules_lookup().\n\nThe root cause is a race condition where packets can escape the backlog\nflushing during device unregistration (e.g., during netns exit).\n\nCommit e9e4dd3267d0 (\"net: do not process device backlog during unregistration\")\nintroduced a lockless netif_running() check in enqueue_to_backlog() to\nprevent queuing packets to an unregistering device.\n\nHowever, this creates a TOCTOU race window.\n\nA lockless transmitter (like veth_xmit) can pass\nthe check before dev_close() clears IFF_UP. If the transmitter is then\ndelayed, flush_all_backlogs() can run and finish before the transmitter\ngrabs the backlog lock and queues the packet. The packet then escapes\nthe flush and triggers UAF later when processed.\n\nFix this by moving the netif_running() check inside the backlog lock.\nThis serializes the check with the flush work (which also grabs the lock).\nWe then either queue the packet before the flush runs (so it gets flushed),\nor check netif_running() after the flush/close completes (so it gets dropped).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-72493",
"url": "https://www.suse.com/security/cve/CVE-2026-72493"
},
{
"category": "external",
"summary": "SUSE Bug 1276951 for CVE-2026-72493",
"url": "https://bugzilla.suse.com/1276951"
},
{
"category": "external",
"summary": "SUSE Bug 1276959 for CVE-2026-72493",
"url": "https://bugzilla.suse.com/1276959"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-29T13:40:41Z",
"details": "important"
}
],
"title": "CVE-2026-72493"
},
{
"cve": "CVE-2026-74578",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-74578"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_skcipher - force synchronous processing on trees without ctx-\u003estate\n\nThe AIO/async path in skcipher_recvmsg() passes the socket-wide ctx-\u003eiv\ndirectly into the skcipher request. After io_submit() the socket lock is\ndropped and the request is processed asynchronously, so a concurrent\nsendmsg(ALG_SET_IV) can overwrite ctx-\u003eiv and make the in-flight request\nrun under an attacker-controlled IV. For CTR/stream modes this is\nIV/keystream reuse and lets an unprivileged user recover the plaintext of\na concurrent operation.\n\nSnapshotting ctx-\u003eiv into per-request storage for the async path is not\nsufficient. For ciphers with statesize == 0 - which includes cbc and ctr -\nthe MSG_MORE inter-chunk IV chaining is carried solely by the in-place\nreq-\u003eiv writeback, which a snapshot redirects into per-request memory that\naf_alg_free_resources() releases on completion, silently producing wrong\noutput. Writing the IV back from the completion callback instead is not\npossible either: that would require lock_sock() there, but the callback can\nrun in softirq/atomic context, so it must not sleep.\n\nMake the operation synchronous instead, which removes both the IV race and\nany writeback race. This is equivalent to the upstream resolution, commit\nfcc77d33a34c (\"net: Remove support for AIO on sockets\"), which removed the\nAIO socket path across net/ entirely and so produces the same end state for\nthis file. This patch deviates from that commit deliberately: rather than\nremoving AIO socket support tree-wide, which would be far too invasive for\nstable, it removes only the AIO branch in crypto/algif_skcipher.c.\nio_submit() now completes synchronously; AF_ALG async is rarely used in\npractice.\n\nThe -EIOCBQUEUED check in skcipher_recvmsg() is now dead but harmless,\nand is left alone to keep the fix minimal.\n\nTested on 6.6.y: attacker IV injection dropped from 2296/200000 to 0/200000\nafter the change; MSG_MORE chunked CTR output bit-identical to single-shot.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-74578",
"url": "https://www.suse.com/security/cve/CVE-2026-74578"
},
{
"category": "external",
"summary": "SUSE Bug 1275564 for CVE-2026-74578",
"url": "https://bugzilla.suse.com/1275564"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-29T13:40:41Z",
"details": "moderate"
}
],
"title": "CVE-2026-74578"
},
{
"cve": "CVE-2026-74587",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-74587"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix use-after-free of cached ASCONF chunk\n\naddip_last_asconf caches the outstanding outbound ASCONF chunk. The normal\nASCONF-ACK completion path releases the chunk and clears the pointer.\n\nHowever, sctp_asconf_queue_teardown() releases the cached chunk without\nclearing addip_last_asconf. During peer restart handling,\nsctp_sf_do_dupcook_a() queues SCTP_CMD_PURGE_ASCONF_QUEUE, which invokes\nsctp_asconf_queue_teardown() while the association remains alive and leaves\nthe pointer dangling.\n\nA delayed authenticated ASCONF-ACK can then reach sctp_sf_do_asconf_ack(),\nwhich accesses the stale chunk and passes it to sctp_process_asconf_ack(),\ncausing a use-after-free and a second release.\n\nClearing the pointer exposes a race with T4 expiry. Peer restart handling\nqueues the timer stop before the purge, but SCTP_CMD_TIMER_STOP uses\ntimer_delete(), which does not wait for a callback already running on\nanother CPU. Such a callback can reach sctp_sf_t4_timer_expire() after\nthe purge and dereference NULL.\n\nClear addip_last_asconf after releasing the cached chunk, and make\nsctp_sf_t4_timer_expire() consume a stale T4 expiry if no outstanding\nASCONF remains.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-74587",
"url": "https://www.suse.com/security/cve/CVE-2026-74587"
},
{
"category": "external",
"summary": "SUSE Bug 1277821 for CVE-2026-74587",
"url": "https://bugzilla.suse.com/1277821"
},
{
"category": "external",
"summary": "SUSE Bug 1282644 for CVE-2026-74587",
"url": "https://bugzilla.suse.com/1282644"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-29T13:40:41Z",
"details": "important"
}
],
"title": "CVE-2026-74587"
},
{
"cve": "CVE-2026-74624",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-74624"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack: defer invalid log until after unlock\n\nTCP and SCTP conntrack paths can emit invalid-packet logs while ct-\u003elock\nis still held.\n\nWhen invalid logging is routed to nfnetlink_log and conntrack export is\nenabled, the log path can re-enter conntrack netlink glue and dump the\nsame conntrack again. Protocol attribute dumping may take ct-\u003elock, so\nlogging while holding that lock can deadlock.\n\nDefer the TCP invalid logs by storing only the minimal log context while\nct-\u003elock is held and emitting the log after unlocking. Also make the TCP\ntimeout-lowering invalid path return whether a log is needed, then emit\nthat log after unlocking.\n\nDo the same for the SCTP invalid state-transition log that can be reached\nwhile ct-\u003elock is held.\n\nAdd a lockdep assertion to nf_ct_l4proto_log_invalid() so future callers\nthat log invalid conntracks while holding ct-\u003elock are caught outside TCP\nand SCTP as well.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-74624",
"url": "https://www.suse.com/security/cve/CVE-2026-74624"
},
{
"category": "external",
"summary": "SUSE Bug 1277599 for CVE-2026-74624",
"url": "https://bugzilla.suse.com/1277599"
},
{
"category": "external",
"summary": "SUSE Bug 1285756 for CVE-2026-74624",
"url": "https://bugzilla.suse.com/1285756"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-29T13:40:41Z",
"details": "important"
}
],
"title": "CVE-2026-74624"
},
{
"cve": "CVE-2026-80977",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-80977"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: don\u0027t touch shared zerocopy state in skb_tx_error()\n\nskb_tx_error() completes the zerocopy uarg and clears\nSKBFL_ALL_ZEROCOPY, and skb_zcopy_downgrade_managed() clears\nSKBFL_MANAGED_FRAG_REFS. Both live in skb_shinfo(), which every clone\nshares, while the caller only owns the reference it is about to drop.\nThrough a clone it tells the producer its pages are free and drops\nSKBFL_SHARED_FRAG for an skb that is still in flight.\n\nOpen vSwitch reaches this with a non-last OVS_ACTION_ATTR_RECIRC:\nclone_execute() sends a skb_clone() into ovs_dp_process_packet() while\ndo_execute_actions() keeps forwarding the original, and skb_clone()\ndoes not privatise the frags here -- skb_orphan_frags() returns early\non SKBFL_DONT_ORPHAN. A flow miss on the clone then strips the marker\nfrom the packet still being forwarded, and a later local ESP delivery\ndecrypts in place over frags it does not own privately.\n\nSkip it for a cloned skb. Nothing is lost: skb_release_data() clears\nthe zerocopy state once the last reference to the shared data goes.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-80977",
"url": "https://www.suse.com/security/cve/CVE-2026-80977"
},
{
"category": "external",
"summary": "SUSE Bug 1280259 for CVE-2026-80977",
"url": "https://bugzilla.suse.com/1280259"
},
{
"category": "external",
"summary": "SUSE Bug 1280462 for CVE-2026-80977",
"url": "https://bugzilla.suse.com/1280462"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-29T13:40:41Z",
"details": "important"
}
],
"title": "CVE-2026-80977"
},
{
"cve": "CVE-2026-89528",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-89528"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Reject Read lists that exceed the page budget\n\nIndividual Read segment lengths are validated at decode time, but\nnothing prevents a requester from sending multiple segments whose\ncumulative length exceeds the rq_pages array budget. When one\nsegment fills the page array exactly, the runtime guard in\nsvc_rdma_build_read_segment() is bypassed because len reaches zero.\nA subsequent segment then accesses the NULL sentinel slot at\nrq_pages[rq_maxpages], resulting in a NULL pointer dereference during\nDMA mapping.\n\nAccumulate pages across all Read segments and reject the message at\ndecode time when the total would overflow the page budget.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-89528",
"url": "https://www.suse.com/security/cve/CVE-2026-89528"
},
{
"category": "external",
"summary": "SUSE Bug 1280743 for CVE-2026-89528",
"url": "https://bugzilla.suse.com/1280743"
},
{
"category": "external",
"summary": "SUSE Bug 1280744 for CVE-2026-89528",
"url": "https://bugzilla.suse.com/1280744"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-29T13:40:41Z",
"details": "important"
}
],
"title": "CVE-2026-89528"
},
{
"cve": "CVE-2026-89542",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-89542"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: harden gss_krb5_unwrap_v2 against short tokens\n\ngss_krb5_unwrap_v2() reads the EC and RRC header fields at ptr+4 and\nptr+6 before validating that the token is at least GSS_KRB5_TOK_HDR_LEN\n(16) bytes long, and its rotate_left() helper passes buf-\u003elen - base\nto xdr_buf_subsegment() without verifying that base \u003c= buf-\u003elen. When\na caller hands in a sub-16-byte token, or a token whose declared len\nleaves base past the end of the buffer, three distinct failures follow:\n\n gss_krb5_unwrap_v2(offset, len, buf)\n ptr = buf-\u003ehead[0].iov_base + offset\n ec = *(ptr + 4) /* OOB read on short head */\n rrc = *(ptr + 6) /* OOB read on short head */\n rotate_left(offset + 16, buf, rrc)\n xdr_buf_subsegment(buf, \u0026subbuf,\n base, buf-\u003elen - base) /* u32 wrap when base \u003e len */\n _rotate_left(\u0026subbuf, shift)\n shift %= buf-\u003elen /* divide-by-zero when base == len */\n\nAfter decryption, the cleanup arithmetic has the same shape:\n\n movelen = min_t(unsigned int, buf-\u003ehead[0].iov_len, len);\n movelen -= offset + GSS_KRB5_TOK_HDR_LEN + headskip;\n BUG_ON(offset + GSS_KRB5_TOK_HDR_LEN + headskip + movelen \u003e\n buf-\u003ehead[0].iov_len);\n\nThe BUG_ON re-adds the value just subtracted, so it reduces to\nmin(A, B) \u003e A and is permanently false; it cannot catch the unsigned\nunderflow of movelen, which then drives a ~UINT_MAX-byte memmove().\n\nAdd four defense-in-depth guards inside the unwrap core so it is safe\nregardless of what its callers validate:\n\n - reject tokens with len - offset \u003c GSS_KRB5_TOK_HDR_LEN before\n touching ptr+4/ptr+6;\n - bail from rotate_left() when buf-\u003elen \u003c= base, covering both the\n underflow and zero-length cases;\n - return early from _rotate_left() when buf-\u003elen is zero, so the\n shift %= buf-\u003elen modulo cannot fault;\n - replace the dead BUG_ON with a live check that returns\n GSS_S_DEFECTIVE_TOKEN before the movelen subtraction.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-89542",
"url": "https://www.suse.com/security/cve/CVE-2026-89542"
},
{
"category": "external",
"summary": "SUSE Bug 1280387 for CVE-2026-89542",
"url": "https://bugzilla.suse.com/1280387"
},
{
"category": "external",
"summary": "SUSE Bug 1280390 for CVE-2026-89542",
"url": "https://bugzilla.suse.com/1280390"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-29T13:40:41Z",
"details": "important"
}
],
"title": "CVE-2026-89542"
},
{
"cve": "CVE-2026-89669",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-89669"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: initialize copy-notify stateid before publishing it\n\nnfsd4_copy_notify() finished initializing the cpntf state after\nnfs4_alloc_init_cpntf_state() had already linked it into the\ns2s_cp_stateids IDR and the parent\u0027s sc_cp_list, with cs_count == 1 (the\nmembership reference) and none held for the caller. A racing\nOFFLOAD_CANCEL (crafted cl_id == nn-\u003es2s_cp_cl_id plus the guessable\nso_id) could reach manage_cpntf_state() and free the entry, turning the\ncaller\u0027s subsequent cpn_cnr_stateid read and cp_p_stateid/cp_p_clid\nwrites into use-after-free. The owning clientid was also only recorded\nafter publication, so it could not gate an ownership check in that window.\n\nRecord cp_p_stateid and cp_p_clid inside nfs4_alloc_init_cpntf_state()\nbefore nfs4_init_cp_state() publishes the entry, and return it with an\nextra reference. The caller reads the stateid under that reference and\ndrops it with nfs4_put_cpntf_state(); on a late error the laundromat\nreaps the entry.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-89669",
"url": "https://www.suse.com/security/cve/CVE-2026-89669"
},
{
"category": "external",
"summary": "SUSE Bug 1280251 for CVE-2026-89669",
"url": "https://bugzilla.suse.com/1280251"
},
{
"category": "external",
"summary": "SUSE Bug 1280286 for CVE-2026-89669",
"url": "https://bugzilla.suse.com/1280286"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-29T13:40:41Z",
"details": "important"
}
],
"title": "CVE-2026-89669"
},
{
"cve": "CVE-2026-90011",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-90011"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Reserve a terminator byte for the login payload\n\niscsi_target_check_login_request() rejects a login PDU whose\nDataSegmentLength exceeds MAX_KEY_VALUE_PAIRS, but the test is \u0027\u003e\u0027 and\nlogin-\u003ereq_buf is allocated with exactly MAX_KEY_VALUE_PAIRS\nbytes. Since iscsit_get_login_rx() receives payload_length + padding\nbytes, where\n\n\tpadding = ((-payload_length) \u0026 3);\n\nany payload_length from 8189 to 8192 fills the whole 8192 byte\nbuffer. The write stays in bounds, but no byte is left for a NUL\nterminator.\n\nThe buffer is subsequently consumed as a C string. In the CHAP path\nchap_check_algorithm() calls kstrdup(a_str), and extract_param() calls\nstrstr(in_buf, pattern) followed by strlen_semi(), none of which take a\nlength. convert_null_to_semi() additionally rewrites every embedded NUL\nto \u0027;\u0027, so even a payload made of well formed NUL separated key=value\nrecords is left without a terminator. These walk past the end of the\nobject into adjacent slab memory. It is reachable by an unauthenticated\ninitiator against a portal configured for CHAP; when authentication is\nnot required iscsi_login_zero_tsih_s2() rewrites AuthMethod to None and\nthe CHAP path is never entered.\n\nAllocate one extra byte. kzalloc() zeroes it and nothing ever writes to\nit, as every writer copies to offset 0 for at most MAX_KEY_VALUE_PAIRS\nbytes, so the buffer is always terminated.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-90011",
"url": "https://www.suse.com/security/cve/CVE-2026-90011"
},
{
"category": "external",
"summary": "SUSE Bug 1281280 for CVE-2026-90011",
"url": "https://bugzilla.suse.com/1281280"
},
{
"category": "external",
"summary": "SUSE Bug 1281282 for CVE-2026-90011",
"url": "https://bugzilla.suse.com/1281282"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-29T13:40:41Z",
"details": "important"
}
],
"title": "CVE-2026-90011"
},
{
"cve": "CVE-2026-90088",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-90088"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop\n\nrfcomm_apply_pn() accepts the MTU value from a remote PN (Parameter\nNegotiation) frame without checking for zero. When the remote peer\nsends an MTU of zero, d-\u003emtu is set to 0. This causes the sendmsg\npath to enter an infinite loop when fragmenting data, as each fragment\nhas size == min_t(size_t, len, 0) == 0, so the remaining length never\ndecreases. The infinite allocation of zero-length skbs exhausts all\nsystem memory.\n\nFix by clamping d-\u003emtu to RFCOMM_DEFAULT_MTU when the negotiated\nvalue is zero, consistent with the initial value assigned in\nrfcomm_dlc_alloc().",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-90088",
"url": "https://www.suse.com/security/cve/CVE-2026-90088"
},
{
"category": "external",
"summary": "SUSE Bug 1281397 for CVE-2026-90088",
"url": "https://bugzilla.suse.com/1281397"
},
{
"category": "external",
"summary": "SUSE Bug 1281398 for CVE-2026-90088",
"url": "https://bugzilla.suse.com/1281398"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-29T13:40:41Z",
"details": "important"
}
],
"title": "CVE-2026-90088"
},
{
"cve": "CVE-2026-97555",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-97555"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix heap overflow in DACL owner/group rewrite\n\nWhen id_mode_to_cifs_acl rewrites an existing DACL, it allocates a\nbuffer sized according to the on-disk DACL length reported by\ndacl_ptr-\u003esize. However, replace_sids_and_copy_aces may rewrite each\nACE with a new owner/group SID obtained from the cifs.idmap upcall.\nThose SIDs can have up to SID_MAX_SUB_AUTHORITIES (15) sub-authorities,\nmaking each ACE up to 76 bytes (sizeof(struct smb_ace)).\n\nIf the original DACL contains short SIDs (e.g., 1 sub-authority) while\nthe replacement SIDs are long, the rewritten ACEs overflow the\nallocation.\n\nFix this by always budgeting for worst-case SID expansion: allocate\nsizeof(struct smb_acl) plus num_aces * sizeof(struct smb_ace), which\ncovers the smb_acl header and room for every ACE at maximum SID size.\nThis replaces the previous split logic that used dacl_ptr-\u003esize for\ncifsacl mounts but num_aces * sizeof(struct smb_ace) for mode_from_sid\nmounts: both paths can trigger the same rewrite and need the same\nheadroom.\n\nKASAN reports this as:\n BUG: KASAN: slab-out-of-bounds in build_sec_desc+0x1e8a/0x2680 [cifs]\n Write of size 4 at addr ffff8881a5e25374 by task chown/5298\n ...\n The buggy address is located 0 bytes to the right of\n allocated 884-byte region [ffff8881a5e25000, ffff8881a5e25374)",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-97555",
"url": "https://www.suse.com/security/cve/CVE-2026-97555"
},
{
"category": "external",
"summary": "SUSE Bug 1283851 for CVE-2026-97555",
"url": "https://bugzilla.suse.com/1283851"
},
{
"category": "external",
"summary": "SUSE Bug 1283852 for CVE-2026-97555",
"url": "https://bugzilla.suse.com/1283852"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-29T13:40:41Z",
"details": "important"
}
],
"title": "CVE-2026-97555"
},
{
"cve": "CVE-2026-97564",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-97564"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: reject userspace cifs.idmap descriptions\n\ncifs.idmap key descriptions carry authority-bearing fields (owner and\ngroup SIDs and uid/gid values in \"os:\"/\"gs:\"/\"oi:\"/\"gi:\" form) that the\ncifs.idmap upcall helper treats as kernel-originating inputs. Unlike\nits sibling cifs.spnego, the cifs.idmap key type has no vet_description\nhook, so userspace can create keys of this type through\nrequest_key(2)/add_key(2) and supply those fields without CIFS origin.\nA request_key(2) call with a non-NULL callout then drives a root\nusermodehelper upcall (/sbin/request-key -\u003e cifs.idmap) that consumes\nthe unvetted description in root context.\n\nOnly accept cifs.idmap descriptions while CIFS is using its private\nroot_cred to request the key. id_to_sid()/sid_to_id() already run\nunder override_creds(root_cred), so the kernel-originated path is\nunaffected.\n\nThis mirrors commit 3da1fdf4efbc (\"smb: client: reject userspace\ncifs.spnego descriptions\"), which applied the same restriction to\ncifs.spnego.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-97564",
"url": "https://www.suse.com/security/cve/CVE-2026-97564"
},
{
"category": "external",
"summary": "SUSE Bug 1283946 for CVE-2026-97564",
"url": "https://bugzilla.suse.com/1283946"
},
{
"category": "external",
"summary": "SUSE Bug 1283947 for CVE-2026-97564",
"url": "https://bugzilla.suse.com/1283947"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-29T13:40:41Z",
"details": "important"
}
],
"title": "CVE-2026-97564"
},
{
"cve": "CVE-2026-98015",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-98015"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put\n\nIn mlx5_eswitch_termtbl_put(), the zero-ref cleanup check reads\ntt-\u003eref_count after termtbl_mutex has been released. Two concurrent\ncallers on the same mlx5_termtbl_handle race: one decrements ref_count\nto zero, removes the hash entry, and calls kfree(tt) while the other\nhas already dropped the mutex and is about to evaluate\nif (!tt-\u003eref_count), producing a use-after-free.\n\nFix this by capturing the result of the decrement into a stack-local\nlast variable before dropping the mutex. The cleanup decision is now\nmade entirely under termtbl_mutex, and tt is not touched after\nkfree.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-98015",
"url": "https://www.suse.com/security/cve/CVE-2026-98015"
},
{
"category": "external",
"summary": "SUSE Bug 1283963 for CVE-2026-98015",
"url": "https://bugzilla.suse.com/1283963"
},
{
"category": "external",
"summary": "SUSE Bug 1283964 for CVE-2026-98015",
"url": "https://bugzilla.suse.com/1283964"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-29T13:40:41Z",
"details": "important"
}
],
"title": "CVE-2026-98015"
},
{
"cve": "CVE-2026-98016",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-98016"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix use-after-free race in sample_restore_put()\n\nConcurrent teardown of TC sample rules sharing the same restore\ncontext may re-read restore-\u003ecount after dropping restore_lock.\nAt that point another thread may already have completed cleanup and\nfreed the restore object.\n\nUse the result of the refcount decrement while holding restore_lock to\ndetermine whether cleanup is needed.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-98016",
"url": "https://www.suse.com/security/cve/CVE-2026-98016"
},
{
"category": "external",
"summary": "SUSE Bug 1283894 for CVE-2026-98016",
"url": "https://bugzilla.suse.com/1283894"
},
{
"category": "external",
"summary": "SUSE Bug 1283895 for CVE-2026-98016",
"url": "https://bugzilla.suse.com/1283895"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-29T13:40:41Z",
"details": "important"
}
],
"title": "CVE-2026-98016"
},
{
"cve": "CVE-2026-98041",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-98041"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Don\u0027t predict JMP32 pointer vs zero comparisons\n\nConsider the following program:\n\n r1 = map_value; /* low 32 bits are zero at runtime */\n r6 = 0xdead000000000000;\n if w1 != 0 goto l1;\n l0: r1 += r6;\n r2 = *(u64 *)(r1 + 0);\n exit;\n l1: r6 = 0;\n goto l0;\n\nAt the moment is_branch_taken() reports the jump as always taken,\nbecause it does not distinguish between BPF_JMP and BPF_JMP32\ncomparisons when processing \u0027if w1 != 0 ...\u0027.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-98041",
"url": "https://www.suse.com/security/cve/CVE-2026-98041"
},
{
"category": "external",
"summary": "SUSE Bug 1284064 for CVE-2026-98041",
"url": "https://bugzilla.suse.com/1284064"
},
{
"category": "external",
"summary": "SUSE Bug 1284070 for CVE-2026-98041",
"url": "https://bugzilla.suse.com/1284070"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-29T13:40:41Z",
"details": "moderate"
}
],
"title": "CVE-2026-98041"
},
{
"cve": "CVE-2026-98130",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-98130"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix a TOCTOU race in SCTP_CMD_TIMER_START\n\nThe SCTP_CMD_TIMER_START handler checks timer_pending() before calling\ntimer_reduce(). The timer can expire and detach between these operations,\ncausing timer_reduce() to rearm the timer without taking the association\nreference required for the newly armed timer.\n\nThe timer callback later unconditionally drops its association reference,\nwhich can leave the association reference count unbalanced and result in\nuse-after-free during association teardown.\n\nUse the return value of timer_reduce() to determine whether the timer was\nactually armed. Take the association reference only when timer_reduce()\nsuccessfully starts a new timer, closing the race between checking the\ntimer state and rearming it.\n\nThis issue was reported by Nico Yip (@_cyeaa_) working with TrendAI Zero\nDay Initiative.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-98130",
"url": "https://www.suse.com/security/cve/CVE-2026-98130"
},
{
"category": "external",
"summary": "SUSE Bug 1283835 for CVE-2026-98130",
"url": "https://bugzilla.suse.com/1283835"
},
{
"category": "external",
"summary": "SUSE Bug 1285041 for CVE-2026-98130",
"url": "https://bugzilla.suse.com/1285041"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-29T13:40:41Z",
"details": "important"
}
],
"title": "CVE-2026-98130"
},
{
"cve": "CVE-2026-98248",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-98248"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: percpu: Fix LSE operations on {8,16}-bit types\n\nThe assembly for __percpu_##name##_case_##sz() and\n__percpu_##name##_return_case_##sz() doesn\u0027t use the \u0027sfx\u0027 macro\nargument to form the LSE instruction. Without \u0027sfx\u0027, a W register\nargument will imply a 32-bit memory location, and consequently\n{8,16}-bit ops will erroneously read and write 32 bits of memory when\nthe LSE instruction is used.\n\nFix this by appending \u0027sfx\u0027 to \u0027op_lse\u0027 to LSE instruction. It is not\nnecessary (and not valid) to append \u0027sfx\u0027 to \u0027op_llsc\u0027, as \u0027op_llsc\u0027 is\na register-register operation which does not access memory (and does not\ntake a size suffix).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-98248",
"url": "https://www.suse.com/security/cve/CVE-2026-98248"
},
{
"category": "external",
"summary": "SUSE Bug 1284518 for CVE-2026-98248",
"url": "https://bugzilla.suse.com/1284518"
},
{
"category": "external",
"summary": "SUSE Bug 1284519 for CVE-2026-98248",
"url": "https://bugzilla.suse.com/1284519"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-29T13:40:41Z",
"details": "important"
}
],
"title": "CVE-2026-98248"
},
{
"cve": "CVE-2026-98253",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-98253"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/ucma: Serialize join and leave on copy_to_user failure\n\nrdma_join_multicast() queues RoCE work that later reads the ucma_multicast\nthrough event-\u003eparam.ud.private_data, then list_add()s the CMA multicast\nat the head of id_priv-\u003emc_list. rdma_leave_multicast() matches only by\nsockaddr and destroys the first hit.\n\nucma_process_join() used to drop ctx-\u003emutex after a successful join and\nretake it only if copy_to_user() failed. Two concurrent JOIN_MCAST calls\nwith the same address can therefore insert a second CMA entry before the\nfirst thread\u0027s leave. leave then cancels the newer work and the older\nworker still dereferences the ucma_multicast that the first thread frees.\n\nKeep ctx-\u003emutex held from rdma_join_multicast() through copy_to_user() and,\non -EFAULT, through rdma_leave_multicast() so leave cannot miss this join.\nDo not leave if join itself failed: that path never published this address\non mc_list, and a leave-by-addr would destroy an earlier successful join.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-98253",
"url": "https://www.suse.com/security/cve/CVE-2026-98253"
},
{
"category": "external",
"summary": "SUSE Bug 1284790 for CVE-2026-98253",
"url": "https://bugzilla.suse.com/1284790"
},
{
"category": "external",
"summary": "SUSE Bug 1284793 for CVE-2026-98253",
"url": "https://bugzilla.suse.com/1284793"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-29T13:40:41Z",
"details": "important"
}
],
"title": "CVE-2026-98253"
},
{
"cve": "CVE-2026-98260",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-98260"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nexec: Cleanup POSIX timers right after de_thread()\n\nA per-thread CPU timer holds a reference to the PID of the thread it is\nattached to and, while it is armed, its node is queued in that thread\u0027s\nposix_cputimers. The task is looked up by that PID.\n\nWhen a non-leader thread exec()s, de_thread() changes which task owns\nthat PID. pid_task(timer-\u003eit.cpu.pid, PIDTYPE_PID) then returns NULL,\nbut the node is still queued on tsk, which is alive. timer_lock_sighand()\ntakes a failed lookup to mean that the node is already dequeued, so it\nhas nothing to undo.\n\nbegin_new_exec() calls posix_cpu_timers_exit(me) right after\nexec_task_namespaces() and that removes the leftover node, so the state\nnormally stays invisible. But bprm-\u003epoint_of_no_return is set before\nde_thread(), so if unshare_files(), set_mm_exe_file(), exec_mmap() or\nexec_task_namespaces() fails, the task dies before it gets there.\nexit_itimers() then frees the k_itimer while its node is still queued,\nand reaping tsk later erases that freed node from the rbtree.\n\nIn short:\n\n the non-leader thread B the parent\n\n timer_create(CLOCK_THREAD_CPUTIME_ID)\n timer_settime()\n arm_timer() // the node is queued on B\n execve()\n de_thread(B)\n exchange_tids(B, leader) // B\u0027s PID now belongs to the leader\n release_task(leader)\n __exit_signal(leader)\n posix_cpu_timers_exit(leader) // cleans leader\u0027s queue, not B\u0027s\n __unhash_process(leader) // that PID has no task anymore\n exec_mmap()\n mmap_read_lock_killable(old_mm)\n kill(B, SIGKILL)\n // -EINTR\n get_signal()\n do_exit()\n exit_itimers()\n posix_timer_delete()\n posix_cpu_timer_del()\n posix_timer_unhash_and_free() // freed while still queued\n wait4()\n release_task(B)\n posix_cpu_timers_exit(B)\n cleanup_timerqueue()\n timerqueue_del() // use-after-free\n\nMove the POSIX timer cleanup right after de_thread() before any of the\nlater failure conditions brings the task into do_exit().\n\n[ tglx: Move the cleanup right after de_thread() ]",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-98260",
"url": "https://www.suse.com/security/cve/CVE-2026-98260"
},
{
"category": "external",
"summary": "SUSE Bug 1284408 for CVE-2026-98260",
"url": "https://bugzilla.suse.com/1284408"
},
{
"category": "external",
"summary": "SUSE Bug 1285052 for CVE-2026-98260",
"url": "https://bugzilla.suse.com/1285052"
},
{
"category": "external",
"summary": "SUSE Bug 1286032 for CVE-2026-98260",
"url": "https://bugzilla.suse.com/1286032"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-29T13:40:41Z",
"details": "important"
}
],
"title": "CVE-2026-98260"
},
{
"cve": "CVE-2026-98323",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-98323"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Bound fragmented header copies by the remaining length\n\nsiw_get_hdr() can receive an extended DDP/RDMAP header across more than\none TCP callback. The first callback may receive most of the header,\nwhile the next one still limits the copy to hdrlen - MIN_DDP_HDR instead\nof the number of missing bytes. This makes the destination move past the\nend of the header and overwrite the receive state, including\nfpdu_part_rcvd. A later callback can then use a negative fpdu_part_rcvd\nvalue as a copy offset, which creates an OOB write.\n\nUse the number of header bytes already received when calculating the\nnext copy length.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-98323",
"url": "https://www.suse.com/security/cve/CVE-2026-98323"
},
{
"category": "external",
"summary": "SUSE Bug 1284713 for CVE-2026-98323",
"url": "https://bugzilla.suse.com/1284713"
},
{
"category": "external",
"summary": "SUSE Bug 1284714 for CVE-2026-98323",
"url": "https://bugzilla.suse.com/1284714"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-29T13:40:41Z",
"details": "important"
}
],
"title": "CVE-2026-98323"
},
{
"cve": "CVE-2026-98357",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-98357"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/isert: wait for deferred control PDU completions before releasing the connection\n\nisert_send_done() hands ISTATE_SEND_TASKMGTRSP, ISTATE_SEND_REJECT and\nISTATE_SEND_TEXTRSP completions off to isert_comp_wq and returns. The work\nitem then runs isert_completion_put() -\u003e isert_put_cmd(), which reads\nisert_conn-\u003econn and takes conn-\u003ecmd_lock.\n\nNothing orders that work item against teardown. isert_wait_conn() queues\nisert_release_work, which frees isert_conn, and iscsit_close_connection()\nfrees the iscsit_conn right after it returns, so the queued work can run\nagainst freed memory.\n\nCount the deferred control PDU completions per connection and let\nisert_wait_conn() wait for them before the release work is queued.\n\nISTATE_SEND_LOGOUTRSP is deliberately not counted: that branch runs\niscsit_logout_post_handler(), which ends up waiting for\nconn-\u003econn_wait_comp, and that completion is only sent by\niscsit_close_connection() after it has called iscsit_wait_conn().\nWaiting for it here would deadlock. Its wait stays the existing\nisert_wait4logout().\n\nThe splat below is from a kernel with tracing printk()s and an msleep(200)\ninjected into isert_do_control_comp() to widen the window:\n\n BUG: KASAN: slab-use-after-free in isert_put_cmd+0x53d/0x620\n Read of size 8 at addr ffff8881054f1038 by task kworker/u17:1/182\n\n CPU: 0 UID: 0 PID: 182 Comm: kworker/u17:1 Tainted: G B 7.2.0-rc5-TWIDE-gb8babf08acc7 #1 PREEMPT(lazy)\n Tainted: [B]=BAD_PAGE\n Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n Workqueue: isert_comp_wq isert_do_control_comp\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x53/0x70\n print_report+0xd0/0x630\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n ? _raw_spin_unlock_irqrestore+0x3e/0x70\n ? isert_put_cmd+0x53d/0x620\n kasan_report+0xce/0x100\n ? isert_put_cmd+0x53d/0x620\n isert_put_cmd+0x53d/0x620\n ? isert_completion_put+0x305/0x330\n ? isert_do_control_comp+0x2ef/0x310\n process_one_work+0x633/0x1030\n ? assign_work+0x11d/0x370\n worker_thread+0x45b/0xd10\n ? __pfx_worker_thread+0x10/0x10\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x2c6/0x3b0\n ? recalc_sigpending+0x15c/0x1e0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x36e/0x5a0\n ? __pfx_ret_from_fork+0x10/0x10\n ? __switch_to+0x572/0xdd0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\n Allocated by task 48:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x8f/0xa0\n __kmalloc_cache_noprof+0x158/0x370\n isert_cma_handler+0x1e3/0x2ae0\n cma_cm_event_handler+0x3e/0x240\n cma_ib_req_handler+0x17d9/0x4490\n cm_process_work+0x41/0x330\n cm_work_handler+0x5727/0xc160\n process_one_work+0x633/0x1030\n worker_thread+0x45b/0xd10\n kthread+0x2c6/0x3b0\n ret_from_fork+0x36e/0x5a0\n ret_from_fork_asm+0x1a/0x30\n\n Freed by task 184:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x43/0x70\n kfree+0x121/0x380\n iscsit_close_connection+0x7cf/0x1e60\n iscsit_take_action_for_connection_exit+0x1b6/0x360\n iscsi_target_tx_thread+0x472/0x690\n kthread+0x2c6/0x3b0\n ret_from_fork+0x36e/0x5a0\n ret_from_fork_asm+0x1a/0x30",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-98357",
"url": "https://www.suse.com/security/cve/CVE-2026-98357"
},
{
"category": "external",
"summary": "SUSE Bug 1284791 for CVE-2026-98357",
"url": "https://bugzilla.suse.com/1284791"
},
{
"category": "external",
"summary": "SUSE Bug 1284794 for CVE-2026-98357",
"url": "https://bugzilla.suse.com/1284794"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-29T13:40:41Z",
"details": "important"
}
],
"title": "CVE-2026-98357"
},
{
"cve": "CVE-2026-98359",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-98359"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/core: Reject unregistering netdevs in ib_get_eth_speed\n\nib_device_get_netdev() intentionally returns a referenced net_device even\nwhen it is unregistering, so matching and cleanup callers can still find\nthe association. The reference keeps struct net_device allocated, but does\nnot guarantee that the device remains operational.\n\nib_get_eth_speed() uses the returned device operationally by invoking its\nethtool callback. Although that call is made under RTNL, the function does\nnot verify the registration state first. An asynchronous RDMA port query\ncan therefore call into a netdev after NETDEV_UNREGISTER and ndo_uninit\nhave completed.\n\nCheck for NETREG_REGISTERED while holding RTNL and return -ENODEV for a\ndevice which is being unregistered. Keeping RTNL across the check and the\nethtool operation prevents unregister from starting between them.\n\nKeep the speed fallback and warning under RTNL as well, so the warning can\nsafely read netdev-\u003ename. Drop the netdev reference before releasing RTNL\nonce all accesses to the device are complete.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-98359",
"url": "https://www.suse.com/security/cve/CVE-2026-98359"
},
{
"category": "external",
"summary": "SUSE Bug 1284746 for CVE-2026-98359",
"url": "https://bugzilla.suse.com/1284746"
},
{
"category": "external",
"summary": "SUSE Bug 1284747 for CVE-2026-98359",
"url": "https://bugzilla.suse.com/1284747"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-29T13:40:41Z",
"details": "important"
}
],
"title": "CVE-2026-98359"
},
{
"cve": "CVE-2026-98432",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-98432"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: free inet_opt and ireq_opt after an RCU grace period\n\ntcp_v4_syn_recv_sock() transfers ownership of ireq-\u003eireq_opt to the\nchild socket (newinet-\u003einet_opt) without copying it.\n\nAnother cpu can concurrently process a retransmitted SYN for the same\nrequest socket, and send a SYNACK from tcp_check_req().\ntcp_v4_send_synack() and inet_csk_route_req() read ireq-\u003eireq_opt\nunder rcu_read_lock() only, and ip_build_and_send_pkt() and\nip_options_build() then read opt-\u003eoptlen twice.\n\nNote that the SYNACK timer itself is not an issue: it holds a\nreference on its request socket, and inet_csk_reqsk_queue_drop()\ncalls timer_delete_sync() before the child can be freed.\n\nSince commit 079096f103fa (\"tcp/dccp: install syn_recv requests\ninto ehash table\"), request sockets are processed without holding\nthe listener lock, so nothing prevents the child socket from being\nfreed while the SYNACK is still being built. TCP child sockets do\nnot have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt\nwith a plain kfree(), leading to a use-after-free in\nip_options_build().\n\nA similar issue exists with request socket migration\n(net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE\nprogram). reqsk_timer_handler() clones the request socket with\ninet_reqsk_clone(), so that the old request socket and its clone\nshare the same ireq_opt, then reqsk_migrate_reset() clears the\npointer in the old one. Another cpu holding a reference on the old\nrequest socket can still be using these options (sending a SYNACK,\nor creating a child in tcp_v4_syn_recv_sock()) when the clone is\nfreed, and tcp_v4_reqsk_destructor() also uses a plain kfree().\n\nReaders already use RCU, and other paths replacing inet_opt\n(do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use\nkfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and\ntcp_v4_reqsk_destructor() as well.\n\nIPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock()\nduplicates the options. tcp_v6_reqsk_destructor() has the same\nmigration issue with ipv6_opt, which is only set by CALIPSO. This\nwill be addressed in a separate patch.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-98432",
"url": "https://www.suse.com/security/cve/CVE-2026-98432"
},
{
"category": "external",
"summary": "SUSE Bug 1285685 for CVE-2026-98432",
"url": "https://bugzilla.suse.com/1285685"
},
{
"category": "external",
"summary": "SUSE Bug 1285686 for CVE-2026-98432",
"url": "https://bugzilla.suse.com/1285686"
},
{
"category": "external",
"summary": "SUSE Bug 1288904 for CVE-2026-98432",
"url": "https://bugzilla.suse.com/1288904"
},
{
"category": "external",
"summary": "SUSE Bug 1288918 for CVE-2026-98432",
"url": "https://bugzilla.suse.com/1288918"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-29T13:40:41Z",
"details": "important"
}
],
"title": "CVE-2026-98432"
},
{
"cve": "CVE-2026-99999",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-99999"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: validate checksum_start before completing checksum\n\nIf a packet with bad checksum metadata gets into the ipv4 stack,\nskb_checksum_help can corrupt the network header and cause a bunch of\nmischief.\n\nThis was discovered and reported by Paulos, and has been reporoduced\nby others independently since.\n\nWe really shouldn\u0027t allow such packets in, but as a defence\nin depth measure, let\u0027s also check before we complete the checksum.\n\nA more complete validation at input is forthcoming, but needs more work.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-99999",
"url": "https://www.suse.com/security/cve/CVE-2026-99999"
},
{
"category": "external",
"summary": "SUSE Bug 1285684 for CVE-2026-99999",
"url": "https://bugzilla.suse.com/1285684"
},
{
"category": "external",
"summary": "SUSE Bug 1285687 for CVE-2026-99999",
"url": "https://bugzilla.suse.com/1285687"
},
{
"category": "external",
"summary": "SUSE Bug 1286031 for CVE-2026-99999",
"url": "https://bugzilla.suse.com/1286031"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.4:kernel-rt-0:5.14.21-150400.15.192.2.x86_64",
"SUSE Linux Enterprise Micro 5.4:kernel-source-rt-0:5.14.21-150400.15.192.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-29T13:40:41Z",
"details": "important"
}
],
"title": "CVE-2026-99999"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.