SB2026060349 - SUSE update for the Linux Kernel (Live Patch 10 for SUSE Linux Enterprise 16)
Published: June 3, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Race condition (CVE-ID: CVE-2026-23437)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper locking and missing liveness check in the net: shaper hierarchy handling when processing netlink operations that read the hierarchy under RCU. A local user can send specially crafted netlink requests to cause a denial of service.
The issue occurs because a net device reference obtained during netlink operation preparation may later be accessed under RCU without verifying that the device is still live and has not already been unregistered.
2) Race condition (CVE-ID: CVE-2026-31406)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in xfrm_nat_keepalive_net_fini() and nat_keepalive_work when cleaning up network namespaces. A local user can trigger network namespace cleanup to cause a denial of service.
The issue occurs because delayed work may be re-scheduled after cancellation and then execute on a freed net structure.
3) Improper access control (CVE-ID: CVE-2026-46333)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear
The vulnerability allows a local privileged user to disclose sensitive information.
The vulnerability exists due to improper access control in ptrace_may_access() when checking dumpability for tasks without an associated mm pointer. A local privileged user can inspect kernel thread details to disclose sensitive information.
The issue affects cases involving threads that no longer have a VM or never had one, such as kernel threads.
Remediation
Install update from vendor's website.