SB20260921195 - SUSE update for the Linux Kernel
Published: September 21, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 vulnerabilities.
1) Use-after-free (CVE-ID: CVE-2026-46116)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in __xfrm_state_delete when deleting xfrm_state list entries during xfrm_state lifecycle handling. A local user can trigger repeated deletion of the same xfrm_state object to cause a denial of service.
The issue was reproduced under syzkaller load during network namespace cleanup in the xfrm subsystem.
2) Out-of-bounds read (CVE-ID: CVE-2026-52955)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an out-of-bounds access in crush_decode() when processing a CEPH_MSG_OSD_MAP message containing a crush map with mismatched bucket algorithm fields. A remote attacker can send a specially crafted CEPH_MSG_OSD_MAP message to cause a denial of service.
3) Out-of-bounds write (CVE-ID: CVE-2026-53059)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an out-of-bounds write in create_log_context() and dm-log bitset handling when processing a crafted device-mapper mirror target configuration with an oversized region count. A local user can create a crafted mirror target to cause a denial of service.
The issue is triggered when region_count overflows 32 bits, causing bitsets to be allocated smaller than required and later accessed with indices derived from the full region space.
4) NULL pointer dereference (CVE-ID: CVE-2026-53163)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a null pointer dereference in remove_waiter() in the rtmutex futex proxy locking path when handling FUTEX_CMP_REQUEUE_PI operations during deadlock detection or proxy lock acquisition. A local user can invoke crafted futex operations to cause a denial of service.
5) Heap-based buffer overflow (CVE-ID: CVE-2026-63887)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a heap-based buffer overflow in iscsi_encode_text_output() when processing iSCSI login text parameters. A remote attacker can send a specially crafted login request with many minimal key-value pairs to cause a denial of service.
The issue can be triggered by expansion of unknown keys into larger "NotUnderstood" response records during login negotiation.
6) Use-after-free (CVE-ID: CVE-2026-68121)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause memory corruption.
The vulnerability exists due to a use-after-free in pppoe_sendmsg() when handling a blocked send while a non-Ethernet port is added to an empty team device. A local user can trigger skb head reallocation and subsequent writes through a stale PPPoE header pointer to cause memory corruption.
The issue occurs because device header callbacks may reallocate the skb head and invalidate saved pointers into it.
7) Use-after-free (CVE-ID: CVE-2026-68202)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the ALSA sequencer queue timer handling in snd_seq_timer_delete() and related queue destruction logic when accessing /dev/snd/seq and re-opening a queue timer during queue teardown. A local user can issue crafted sequencer operations to leave a timer instance live and trigger a dereference of freed queue memory to cause a denial of service.
No queue ownership is required.
8) Use-after-free (CVE-ID: CVE-2026-72389)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in the STP timer handling in the Linux kernel bridge subsystem when deleting a bridge while the topology change timer is armed on an administratively down bridge. A local user can trigger bridge topology change detection and delete the bridge to cause a denial of service.
The issue occurs because the IFF_UP check was missing in br_topology_change_detection().
9) Out-of-bounds write (CVE-ID: CVE-2026-80580)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to an out-of-bounds write in the fbdev sysfs mode output handling in drivers/video/fbdev/core/fbsysfs.c when processing a long modelist for sysfs output. A local user can trigger sysfs mode listing with a sufficiently long modelist to execute arbitrary code.
Remediation
Install update from vendor's website.