SB2026110451 - SUSE update for the Linux Kernel (Live Patch 20 for SUSE Linux Enterprise 15 SP7)
Published: November 4, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 10 vulnerabilities.
1) Use-after-free (CVE-ID: CVE-2026-53381)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in fuse_release_end() during virtiofs auto_submount unmount processing when releasing files during submount unmount after the superblock has already been destroyed. A local user can trigger submount unmount activity to cause a denial of service.
The issue affects the virtiofs auto_submounts case, where the wait counter is tracked per connection rather than per superblock.
2) Out-of-bounds write (CVE-ID: CVE-2026-64217)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause memory corruption.
The vulnerability exists due to an out-of-bounds write in netfs_extract_user_iter() when extracting user-supplied pages from an iov_iter. A local user can trigger an extract_pages overrun to cause memory corruption.
The issue occurs if iov_iter_extract_pages() overfills the pages array, causing excess pages to be included in the constructed iterator.
3) Use-after-free (CVE-ID: CVE-2026-68426)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in validate_xmit_xfrm() in net/xfrm/xfrm_device.c when processing GSO segment lists with asynchronous crypto handling. A local user can trigger asynchronous processing that steals a segment and leaves a stale skb->prev pointer to cause a denial of service.
The issue occurs when a stolen segment remains referenced as the list tail and is later dereferenced by validate_xmit_skb_list().
4) Out-of-bounds write (CVE-ID: CVE-2026-74469)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an out-of-bounds write in SCTP sock_diag when processing a diagnostic dump after adding many unique peer transports. A local user can add unique peer addresses until the 16-bit transport_count wraps and trigger a diagnostic dump to cause a denial of service.
The issue occurs when the association accumulates 65,536 unique peer transports, causing transport_count to wrap to zero while peer addresses are still copied from transport_addr_list.
5) Stack-based buffer overflow (CVE-ID: CVE-2026-74669)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a stack out-of-bounds write in ip_vs_in_icmp() when rebasing tunnel ICMP errors and processing IPv4 options. A remote attacker can send a specially crafted ICMP packet with IPv4 timestamp options to cause a denial of service.
The issue is triggered because stale IPv4 option metadata from the outer header is retained after the packet is rebased to the quoted original request.
6) NULL pointer dereference (CVE-ID: CVE-2026-89544)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper error handling in the SUNRPC gssx XDR option-array decoder when handling an allocation failure while decoding an option array. A local user can trigger the decoder's error path to cause a denial of service.
The affected error paths also include a group_info reference-count leak and a latent use-after-free condition.
7) Integer underflow (CVE-ID: CVE-2026-89551)
CWE-ID: CWE-191 - Integer underflow
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause downstream XDR decoders to use an incorrect stream bound.
The vulnerability exists due to an integer underflow in xdr_buf_trim() when processing GSS Kerberos v2 data whose recorded buffer length is smaller than the associated I/O vector lengths. A remote attacker can cause xdr_buf_trim() to consume more bytes than buf->len records to cause downstream XDR decoders to use an incorrect stream bound.
8) Out-of-bounds write (CVE-ID: CVE-2026-89674)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to write beyond the reserved XDR buffer or disclose uninitialized kernel memory.
The vulnerability exists due to an incorrect XDR buffer size calculation in nfsd4_ff_encode_layoutget() when encoding layoutget responses with short user or group strings and an odd-sized file handle. A remote attacker can request a layoutget operation to write beyond the reserved XDR buffer or disclose uninitialized kernel memory.
9) Use-after-free (CVE-ID: CVE-2026-98432)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to potentially cause a denial of service through access to freed IPv6 request socket options.
The vulnerability exists due to use-after-free in tcp_v6_reqsk_destructor() when request socket migration leaves concurrent processing using shared options after they have been freed. A remote attacker can send TCP traffic that encounters concurrent request socket migration and destruction to potentially cause a kernel crash.
The affected ipv6_opt options are only set by CALIPSO.
10) Use-after-free (CVE-ID: CVE-2026-98432)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to use-after-free in the Linux kernel IPv4 TCP socket option handling when socket destruction frees shared options while another CPU is still using them to build a SYNACK or create a child socket. A remote attacker can send TCP traffic that encounters these concurrent processing paths to potentially cause a kernel crash.
The request socket migration path requires net.ipv4.tcp_migrate_req=1 or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program. IPv6 is not affected by the child socket ownership-transfer path because it duplicates the options.
Remediation
Install update from vendor's website.