SB2026100990 - SUSE update for the Linux Kernel RT (Live Patch 16 for SUSE Linux Enterprise 15 SP7)
Published: October 9, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 19 vulnerabilities.
1) Use-after-free (CVE-ID: CVE-2026-63994)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() when processing tunnel PMTU ICMP and ICMPv6 packet generation. A local user can trigger skb_cow() reallocation while stale network header pointers are still used to cause a denial of service.
2) Out-of-bounds read (CVE-ID: CVE-2026-74612)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information to userspace.
The vulnerability exists due to an out-of-bounds read in veth_xdp_rcv_skb() when processing an skb after XDP fragment area adjustment. A local user can run an XDP program that shrinks the fragment area to disclose sensitive information to userspace.
The issue can expose skb metadata including fragment state and a kernel pointer, and was observed on the UDP receive path.
3) Integer overflow (CVE-ID: CVE-2026-74394)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to integer overflow in the immediate data length check in the RDMA/srpt subsystem when processing user-supplied immediate data received over the network. A remote attacker can send a specially crafted network request with an oversized length value to cause a denial of service.
The length field is user-controlled and may wrap the computed request size, bypassing the bounds check before a very large length is passed to sg_init_one().
4) Use-after-free (CVE-ID: CVE-2026-68202)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the ALSA sequencer queue timer handling in snd_seq_timer_delete() and related queue destruction logic when accessing /dev/snd/seq and re-opening a queue timer during queue teardown. A local user can issue crafted sequencer operations to leave a timer instance live and trigger a dereference of freed queue memory to cause a denial of service.
No queue ownership is required.
5) Use-after-free (CVE-ID: CVE-2026-68121)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause memory corruption.
The vulnerability exists due to a use-after-free in pppoe_sendmsg() when handling a blocked send while a non-Ethernet port is added to an empty team device. A local user can trigger skb head reallocation and subsequent writes through a stale PPPoE header pointer to cause memory corruption.
The issue occurs because device header callbacks may reallocate the skb head and invalidate saved pointers into it.
6) Use-after-free (CVE-ID: CVE-2026-64189)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in ip_set_dump_do() and ip_set_dump_done() in the ipset netfilter subsystem when handling netlink dump operations concurrently with ip_set_list resizing. A local user can trigger concurrent netlink dump and set creation operations to cause a denial of service.
The issue can lead to a general protection fault and kernel panic.
7) Out-of-bounds read (CVE-ID: CVE-2026-64121)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in ifb_get_ethtool_stats in the IFB network driver when handling ethtool statistics requests on a device with more RX queues than TX queues. A local user can request ethtool statistics for a crafted asymmetric IFB device to disclose sensitive information.
Exploitation requires an IFB device configuration where the RX queue count exceeds the TX queue count.
8) Out-of-bounds read (CVE-ID: CVE-2026-64114)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an out-of-bounds access in the raw_send_hdrinc IPv4 packet handling in the Linux kernel when processing a malformed IP_HDRINCL packet with an IPv4 header length value less than 5. A local user can send a specially crafted packet through a raw socket to cause a denial of service.
Exploitation requires CAP_NET_RAW. Triggering the reproduced crash path also requires a matching xfrm AH policy on the outgoing route, and loopback does not reach the affected path.
9) Use-after-free (CVE-ID: CVE-2026-64011)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in llcp_sock_release() when releasing an LLCP socket in connecting state. A local user can trigger socket release in that state to cause a denial of service.
10) Out-of-bounds read (CVE-ID: CVE-2026-64000)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in supervision frame handling in net/hsr/hsr_forward.c when processing truncated supervision frames. A remote attacker can send a specially crafted frame to cause a denial of service.
11) Use-after-free (CVE-ID: CVE-2026-46116)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in __xfrm_state_delete when deleting xfrm_state list entries during xfrm_state lifecycle handling. A local user can trigger repeated deletion of the same xfrm_state object to cause a denial of service.
The issue was reproduced under syzkaller load during network namespace cleanup in the xfrm subsystem.
12) Race condition (CVE-ID: CVE-2026-63971)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in sctp_wait_for_connect() in the SCTP socket implementation when waiting for an association to reach established state while another thread peels off the association to a new socket. A local user can trigger association migration during this window to cause a denial of service.
Exploitation requires concurrent access from another thread while the socket lock is dropped and re-acquired.
13) Improper access control (CVE-ID: CVE-2026-63921)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to redirect packets across network namespaces.
The vulnerability exists due to improper access control in vti6_siocdevprivate() in the IPv6 VTI tunnel handling code when processing SIOCCHGTUNNEL requests on a migrated tunnel. A local user can supply tunnel parameters that collide with a tunnel in the creation namespace to redirect packets across network namespaces.
Exploitation is reachable from an unprivileged user namespace and can have cross-tenant scope on container hosts.
14) Out-of-bounds read (CVE-ID: CVE-2026-63920)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in ip6_datagram_recv_specific_ctl() when processing IPv6 extension headers for recvmsg control messages after the hdrlen field is modified. A local user can use an nftables payload-write expression to corrupt the extension header length and trigger copying beyond the available header data to disclose sensitive information.
Exploitation is reachable from an unprivileged user namespace.
15) Use-after-free (CVE-ID: CVE-2026-63917)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the vti6 tunnel handling code in net/ipv6/ip6_vti.c when changing the configuration of a vti6 device after moving it across network namespaces. A local user can move a vti6 device between namespaces and then change its link parameters to cause a denial of service.
The issue is reachable from an unprivileged user namespace and may have cross-tenant impact on container hosts.
16) Improper input validation (CVE-ID: CVE-2026-63912)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper input validation in the ESP out-of-place fast path in net/ipv4/esp4.c and net/ipv6/esp6.c when processing packet data with a combined aligned data length and trailer length exceeding a page. A local user can trigger this condition to cause a denial of service.
The issue affects both IPv4 and IPv6 ESP processing paths.
17) Out-of-bounds read (CVE-ID: CVE-2026-63888)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in iscsit_handle_text_cmd() when processing Text PDUs with DataDigest enabled. A remote user can send a specially crafted text request to cause a denial of service.
The issue is triggered when DataDigest is negotiated for the connection.
18) Double free (CVE-ID: CVE-2026-63888)
CWE-ID: CWE-415 - Double Free
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to a double free in iscsit_handle_text_cmd() when handling a Text PDU with a bad DataDigest on connections using ErrorRecoveryLevel greater than 0. A remote user can send a specially crafted text request to cause a denial of service.
On hardened kernels the flaw can trigger a remote kernel BUG(), while on non-hardened kernels it can corrupt the slab freelist. A follow-up Text Request on the same ITT or session teardown can free the same pointer again.
19) Use-after-free (CVE-ID: CVE-2026-63802)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in __blkcg_rstat_flush() when releasing multiple blkgs in the same blkcg concurrently. A local user can trigger concurrent blkg release operations to cause a denial of service.
The race occurs when one blkg removes another blkg's iostat entries via llist_del_all() while the other blkg is still being processed.
Remediation
Install update from vendor's website.