SB2026102119 - SUSE update for the Linux Kernel RT (Live Patch 18 for SUSE Linux Enterprise 15 SP7)
Published: October 21, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 vulnerabilities.
1) Improper input validation (CVE-ID: CVE-2026-53131)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in netfilter Ethernet header handling when processing packets that reach ip6t_eui64, xt_mac, ipset bitmap:ip,mac, hash:ip,mac, hash:mac, or nf_log_syslog code paths without a valid Ethernet MAC header. A remote attacker can send a specially crafted packet to cause a denial of service.
The issue occurs because these paths access eth_hdr(skb) after insufficient validation that the skb is associated with an Ethernet device and that a full MAC header is present.
2) Use-after-free (CVE-ID: CVE-2026-63795)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in p9_client_walk() when handling a failed non-cloning walk after a request has been sent. A local user can trigger a multi-component walk split into multiple p9_client_walk() calls to cause a denial of service.
The issue occurs because fid may alias oldfid, causing a reference owned by the caller to be dropped while the caller still expects the object to remain valid.
3) Heap-based buffer overflow (CVE-ID: CVE-2026-63887)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a heap-based buffer overflow in iscsi_encode_text_output() when processing iSCSI login text parameters. A remote attacker can send a specially crafted login request with many minimal key-value pairs to cause a denial of service.
The issue can be triggered by expansion of unknown keys into larger "NotUnderstood" response records during login negotiation.
4) Heap-based buffer overflow (CVE-ID: CVE-2026-63939)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a heap-based buffer overflow in the KVM SEV GHCB scratch area handling in arch/x86/kvm/svm/sev.c when processing PSC requests with a guest-provided scratch area pointer. A local user can provide a crafted scratch area pointer and length values to cause a denial of service.
The issue occurs when the scratch area is located in the GHCB shared buffer, where only the minimum header length was tracked instead of the full effective scratch area size.
5) Integer overflow (CVE-ID: CVE-2026-68158)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to an integer overflow in decode_new_up_state_weight() when processing a corrupted CEPH_MSG_OSD_MAP message containing a crafted osdmap. A remote attacker can send a specially crafted message to disclose sensitive information.
The issue can lead to out-of-bounds reads while decoding the new_state portion of the osdmap.
Remediation
Install update from vendor's website.