SUSE-SU-2026:23541-1
Vulnerability from csaf_suse - Published: 2026-09-08 13:48 - Updated: 2026-09-15 07:40Summary
Security update for the Linux Kernel RT (Live Patch 14 for SUSE Linux Enterprise Micro 6.0)
Severity
Important
Notes
Title of the patch: Security update for the Linux Kernel RT (Live Patch 14 for SUSE Linux Enterprise Micro 6.0)
Description of the patch:
This update for the SUSE Linux Enterprise Kernel 6.4.0-38.1 fixes various security issues:
The following security issues were fixed:
- CVE-2025-40204: sctp: Fix MAC comparison to be constant-time (bsc#1253437).
- CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1262404).
- CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1262213).
- CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263791).
- CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264078).
- CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1265306).
- CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1269282).
- CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264483).
- CVE-2026-43206: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (bsc#1266668).
- CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267362).
- CVE-2026-46242: eventpoll: fix ep_remove struct eventpoll / struct file UAF (bsc#1270300).
- CVE-2026-46274: io-wq: check that the predecessor is hashed in io_wq_remove_pending() (bsc#1268624).
- CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268281).
- CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269034).
- CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1272139).
- CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269196).
- CVE-2026-53133: RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1269822).
- CVE-2026-53182: wifi: nl80211: reject oversized EMA RNR lists (bsc#1269885).
- CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1270023).
- CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1270024).
- CVE-2026-64530: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_hand (bsc#1271867).
- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (RefluXFS) (bsc#1271543).
Patchnames: SUSE-SLE-Micro-6.1-kernel-605
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.5 (High)
Affected products
Recommended
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
1 product, the same list as for
CVE-2025-40204
Threats
Impact
important
Affected products
Recommended
1 product, the same list as for
CVE-2025-40204
Threats
Impact
important
8.8 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2025-40204
Threats
Impact
important
7.1 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2025-40204
Threats
Impact
important
Affected products
Recommended
1 product, the same list as for
CVE-2025-40204
Threats
Impact
important
Affected products
Recommended
1 product, the same list as for
CVE-2025-40204
Threats
Impact
important
7.5 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2025-40204
Threats
Impact
important
7.8 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2025-40204
Threats
Impact
important
8.2 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2025-40204
Threats
Impact
important
7.8 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2025-40204
Threats
Impact
important
Affected products
Recommended
1 product, the same list as for
CVE-2025-40204
Threats
Impact
important
Affected products
Recommended
1 product, the same list as for
CVE-2025-40204
Threats
Impact
important
7.8 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2025-40204
Threats
Impact
important
7.5 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2025-40204
Threats
Impact
important
7.8 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2025-40204
Threats
Impact
important
7.8 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2025-40204
Threats
Impact
important
7.8 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2025-40204
Threats
Impact
important
Affected products
Recommended
1 product, the same list as for
CVE-2025-40204
Threats
Impact
important
8.6 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2025-40204
Threats
Impact
important
Affected products
Recommended
1 product, the same list as for
CVE-2025-40204
Threats
Impact
important
7.8 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2025-40204
Threats
Impact
important
References
116 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for the Linux Kernel RT (Live Patch 14 for SUSE Linux Enterprise Micro 6.0)",
"title": "Title of the patch"
},
{
"category": "description",
"text": "\nThis update for the SUSE Linux Enterprise Kernel 6.4.0-38.1 fixes various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2025-40204: sctp: Fix MAC comparison to be constant-time (bsc#1253437).\n- CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1262404).\n- CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1262213).\n- CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263791).\n- CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264078).\n- CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1265306).\n- CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1269282).\n- CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264483).\n- CVE-2026-43206: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (bsc#1266668).\n- CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267362).\n- CVE-2026-46242: eventpoll: fix ep_remove struct eventpoll / struct file UAF (bsc#1270300).\n- CVE-2026-46274: io-wq: check that the predecessor is hashed in io_wq_remove_pending() (bsc#1268624).\n- CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268281).\n- CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269034).\n- CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1272139).\n- CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269196).\n- CVE-2026-53133: RDMA/umem: Fix truncation for block sizes \u003e= 4G (bsc#1269822).\n- CVE-2026-53182: wifi: nl80211: reject oversized EMA RNR lists (bsc#1269885).\n- CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1270023).\n- CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1270024).\n- CVE-2026-64530: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_hand (bsc#1271867).\n- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (RefluXFS) (bsc#1271543).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-Micro-6.1-kernel-605",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_23541-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:23541-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202623541-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:23541-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-September/029012.html"
},
{
"category": "self",
"summary": "SUSE Bug 1253437",
"url": "https://bugzilla.suse.com/1253437"
},
{
"category": "self",
"summary": "SUSE Bug 1262213",
"url": "https://bugzilla.suse.com/1262213"
},
{
"category": "self",
"summary": "SUSE Bug 1262404",
"url": "https://bugzilla.suse.com/1262404"
},
{
"category": "self",
"summary": "SUSE Bug 1263791",
"url": "https://bugzilla.suse.com/1263791"
},
{
"category": "self",
"summary": "SUSE Bug 1264078",
"url": "https://bugzilla.suse.com/1264078"
},
{
"category": "self",
"summary": "SUSE Bug 1264483",
"url": "https://bugzilla.suse.com/1264483"
},
{
"category": "self",
"summary": "SUSE Bug 1265306",
"url": "https://bugzilla.suse.com/1265306"
},
{
"category": "self",
"summary": "SUSE Bug 1266668",
"url": "https://bugzilla.suse.com/1266668"
},
{
"category": "self",
"summary": "SUSE Bug 1267362",
"url": "https://bugzilla.suse.com/1267362"
},
{
"category": "self",
"summary": "SUSE Bug 1268281",
"url": "https://bugzilla.suse.com/1268281"
},
{
"category": "self",
"summary": "SUSE Bug 1268624",
"url": "https://bugzilla.suse.com/1268624"
},
{
"category": "self",
"summary": "SUSE Bug 1269034",
"url": "https://bugzilla.suse.com/1269034"
},
{
"category": "self",
"summary": "SUSE Bug 1269196",
"url": "https://bugzilla.suse.com/1269196"
},
{
"category": "self",
"summary": "SUSE Bug 1269282",
"url": "https://bugzilla.suse.com/1269282"
},
{
"category": "self",
"summary": "SUSE Bug 1269822",
"url": "https://bugzilla.suse.com/1269822"
},
{
"category": "self",
"summary": "SUSE Bug 1269885",
"url": "https://bugzilla.suse.com/1269885"
},
{
"category": "self",
"summary": "SUSE Bug 1270023",
"url": "https://bugzilla.suse.com/1270023"
},
{
"category": "self",
"summary": "SUSE Bug 1270024",
"url": "https://bugzilla.suse.com/1270024"
},
{
"category": "self",
"summary": "SUSE Bug 1270300",
"url": "https://bugzilla.suse.com/1270300"
},
{
"category": "self",
"summary": "SUSE Bug 1271543",
"url": "https://bugzilla.suse.com/1271543"
},
{
"category": "self",
"summary": "SUSE Bug 1271867",
"url": "https://bugzilla.suse.com/1271867"
},
{
"category": "self",
"summary": "SUSE Bug 1272139",
"url": "https://bugzilla.suse.com/1272139"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-40204 page",
"url": "https://www.suse.com/security/cve/CVE-2025-40204/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-23240 page",
"url": "https://www.suse.com/security/cve/CVE-2026-23240/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-23449 page",
"url": "https://www.suse.com/security/cve/CVE-2026-23449/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31629 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31629/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31759 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31759/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-43077 page",
"url": "https://www.suse.com/security/cve/CVE-2026-43077/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-43109 page",
"url": "https://www.suse.com/security/cve/CVE-2026-43109/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-43110 page",
"url": "https://www.suse.com/security/cve/CVE-2026-43110/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-43206 page",
"url": "https://www.suse.com/security/cve/CVE-2026-43206/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46037 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46037/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46242 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46242/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46274 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46274/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46319 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46319/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-52923 page",
"url": "https://www.suse.com/security/cve/CVE-2026-52923/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-52956 page",
"url": "https://www.suse.com/security/cve/CVE-2026-52956/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-52972 page",
"url": "https://www.suse.com/security/cve/CVE-2026-52972/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-53133 page",
"url": "https://www.suse.com/security/cve/CVE-2026-53133/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-53182 page",
"url": "https://www.suse.com/security/cve/CVE-2026-53182/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-53224 page",
"url": "https://www.suse.com/security/cve/CVE-2026-53224/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-53246 page",
"url": "https://www.suse.com/security/cve/CVE-2026-53246/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-64530 page",
"url": "https://www.suse.com/security/cve/CVE-2026-64530/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-64600 page",
"url": "https://www.suse.com/security/cve/CVE-2026-64600/"
}
],
"title": "Security update for the Linux Kernel RT (Live Patch 14 for SUSE Linux Enterprise Micro 6.0)",
"tracking": {
"current_release_date": "2026-09-15T07:40:48Z",
"generator": {
"date": "2026-09-08T13:48:22Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:23541-1",
"initial_release_date": "2026-09-08T13:48:22Z",
"revision_history": [
{
"date": "2026-09-08T13:48:22Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-15T07:40:48Z",
"number": "2",
"summary": "unknown changes"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64",
"product": {
"name": "kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64",
"product_id": "kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.1",
"product": {
"name": "SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.1"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64 as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
},
"product_reference": "kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-40204",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-40204"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: Fix MAC comparison to be constant-time\n\nTo prevent timing attacks, MACs need to be compared in constant time.\nUse the appropriate helper function for this.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-40204",
"url": "https://www.suse.com/security/cve/CVE-2025-40204"
},
{
"category": "external",
"summary": "SUSE Bug 1253436 for CVE-2025-40204",
"url": "https://bugzilla.suse.com/1253436"
},
{
"category": "external",
"summary": "SUSE Bug 1253437 for CVE-2025-40204",
"url": "https://bugzilla.suse.com/1253437"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T13:48:22Z",
"details": "important"
}
],
"title": "CVE-2025-40204"
},
{
"cve": "CVE-2026-23240",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-23240"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: Fix race condition in tls_sw_cancel_work_tx()\n\nThis issue was discovered during a code audit.\n\nAfter cancel_delayed_work_sync() is called from tls_sk_proto_close(),\ntx_work_handler() can still be scheduled from paths such as the\nDelayed ACK handler or ksoftirqd.\nAs a result, the tx_work_handler() worker may dereference a freed\nTLS object.\n\nThe following is a simple race scenario:\n\n cpu0 cpu1\n\ntls_sk_proto_close()\n tls_sw_cancel_work_tx()\n tls_write_space()\n tls_sw_write_space()\n if (!test_and_set_bit(BIT_TX_SCHEDULED, \u0026tx_ctx-\u003etx_bitmask))\n set_bit(BIT_TX_SCHEDULED, \u0026ctx-\u003etx_bitmask);\n cancel_delayed_work_sync(\u0026ctx-\u003etx_work.work);\n schedule_delayed_work(\u0026tx_ctx-\u003etx_work.work, 0);\n\nTo prevent this race condition, cancel_delayed_work_sync() is\nreplaced with disable_delayed_work_sync().",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-23240",
"url": "https://www.suse.com/security/cve/CVE-2026-23240"
},
{
"category": "external",
"summary": "SUSE Bug 1259484 for CVE-2026-23240",
"url": "https://bugzilla.suse.com/1259484"
},
{
"category": "external",
"summary": "SUSE Bug 1262404 for CVE-2026-23240",
"url": "https://bugzilla.suse.com/1262404"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T13:48:22Z",
"details": "important"
}
],
"title": "CVE-2026-23240"
},
{
"cve": "CVE-2026-23449",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-23449"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: teql: Fix double-free in teql_master_xmit\n\nWhenever a TEQL devices has a lockless Qdisc as root, qdisc_reset should\nbe called using the seq_lock to avoid racing with the datapath. Failure\nto do so may cause crashes like the following:\n\n[ 238.028993][ T318] BUG: KASAN: double-free in skb_release_data (net/core/skbuff.c:1139)\n[ 238.029328][ T318] Free of addr ffff88810c67ec00 by task poc_teql_uaf_ke/318\n[ 238.029749][ T318]\n[ 238.029900][ T318] CPU: 3 UID: 0 PID: 318 Comm: poc_teql_ke Not tainted 7.0.0-rc3-00149-ge5b31d988a41 #704 PREEMPT(full)\n[ 238.029906][ T318] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n[ 238.029910][ T318] Call Trace:\n[ 238.029913][ T318] \u003cTASK\u003e\n[ 238.029916][ T318] dump_stack_lvl (lib/dump_stack.c:122)\n[ 238.029928][ T318] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)\n[ 238.029940][ T318] ? skb_release_data (net/core/skbuff.c:1139)\n[ 238.029944][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n...\n[ 238.029957][ T318] ? skb_release_data (net/core/skbuff.c:1139)\n[ 238.029969][ T318] kasan_report_invalid_free (mm/kasan/report.c:221 mm/kasan/report.c:563)\n[ 238.029979][ T318] ? skb_release_data (net/core/skbuff.c:1139)\n[ 238.029989][ T318] check_slab_allocation (mm/kasan/common.c:231)\n[ 238.029995][ T318] kmem_cache_free (mm/slub.c:2637 (discriminator 1) mm/slub.c:6168 (discriminator 1) mm/slub.c:6298 (discriminator 1))\n[ 238.030004][ T318] skb_release_data (net/core/skbuff.c:1139)\n...\n[ 238.030025][ T318] sk_skb_reason_drop (net/core/skbuff.c:1256)\n[ 238.030032][ T318] pfifo_fast_reset (./include/linux/ptr_ring.h:171 ./include/linux/ptr_ring.h:309 ./include/linux/skb_array.h:98 net/sched/sch_generic.c:827)\n[ 238.030039][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n...\n[ 238.030054][ T318] qdisc_reset (net/sched/sch_generic.c:1034)\n[ 238.030062][ T318] teql_destroy (./include/linux/spinlock.h:395 net/sched/sch_teql.c:157)\n[ 238.030071][ T318] __qdisc_destroy (./include/net/pkt_sched.h:328 net/sched/sch_generic.c:1077)\n[ 238.030077][ T318] qdisc_graft (net/sched/sch_api.c:1062 net/sched/sch_api.c:1053 net/sched/sch_api.c:1159)\n[ 238.030089][ T318] ? __pfx_qdisc_graft (net/sched/sch_api.c:1091)\n[ 238.030095][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n[ 238.030102][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n[ 238.030106][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n[ 238.030114][ T318] tc_get_qdisc (net/sched/sch_api.c:1529 net/sched/sch_api.c:1556)\n...\n[ 238.072958][ T318] Allocated by task 303 on cpu 5 at 238.026275s:\n[ 238.073392][ T318] kasan_save_stack (mm/kasan/common.c:58)\n[ 238.073884][ T318] kasan_save_track (mm/kasan/common.c:64 (discriminator 5) mm/kasan/common.c:79 (discriminator 5))\n[ 238.074230][ T318] __kasan_slab_alloc (mm/kasan/common.c:369)\n[ 238.074578][ T318] kmem_cache_alloc_node_noprof (./include/linux/kasan.h:253 mm/slub.c:4542 mm/slub.c:4869 mm/slub.c:4921)\n[ 238.076091][ T318] kmalloc_reserve (net/core/skbuff.c:616 (discriminator 107))\n[ 238.076450][ T318] __alloc_skb (net/core/skbuff.c:713)\n[ 238.076834][ T318] alloc_skb_with_frags (./include/linux/skbuff.h:1383 net/core/skbuff.c:6763)\n[ 238.077178][ T318] sock_alloc_send_pskb (net/core/sock.c:2997)\n[ 238.077520][ T318] packet_sendmsg (net/packet/af_packet.c:2926 net/packet/af_packet.c:3019 net/packet/af_packet.c:3108)\n[ 238.081469][ T318]\n[ 238.081870][ T318] Freed by task 299 on cpu 1 at 238.028496s:\n[ 238.082761][ T318] kasan_save_stack (mm/kasan/common.c:58)\n[ 238.083481][ T318] kasan_save_track (mm/kasan/common.c:64 (discriminator 5) mm/kasan/common.c:79 (discriminator 5))\n[ 238.085348][ T318] kasan_save_free_info (mm/kasan/generic.c:587 (discriminator 1))\n[ 238.085900][ T318] __kasan_slab_free (mm/\n---truncated---",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-23449",
"url": "https://www.suse.com/security/cve/CVE-2026-23449"
},
{
"category": "external",
"summary": "SUSE Bug 1261779 for CVE-2026-23449",
"url": "https://bugzilla.suse.com/1261779"
},
{
"category": "external",
"summary": "SUSE Bug 1262213 for CVE-2026-23449",
"url": "https://bugzilla.suse.com/1262213"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T13:48:22Z",
"details": "important"
}
],
"title": "CVE-2026-23449"
},
{
"cve": "CVE-2026-31629",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31629"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: add missing return after LLCP_CLOSED checks\n\nIn nfc_llcp_recv_hdlc() and nfc_llcp_recv_disc(), when the socket\nstate is LLCP_CLOSED, the code correctly calls release_sock() and\nnfc_llcp_sock_put() but fails to return. Execution falls through to\nthe remainder of the function, which calls release_sock() and\nnfc_llcp_sock_put() again. This results in a double release_sock()\nand a refcount underflow via double nfc_llcp_sock_put(), leading to\na use-after-free.\n\nAdd the missing return statements after the LLCP_CLOSED branches\nin both functions to prevent the fall-through.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31629",
"url": "https://www.suse.com/security/cve/CVE-2026-31629"
},
{
"category": "external",
"summary": "SUSE Bug 1263790 for CVE-2026-31629",
"url": "https://bugzilla.suse.com/1263790"
},
{
"category": "external",
"summary": "SUSE Bug 1263791 for CVE-2026-31629",
"url": "https://bugzilla.suse.com/1263791"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T13:48:22Z",
"details": "important"
}
],
"title": "CVE-2026-31629"
},
{
"cve": "CVE-2026-31759",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31759"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: ulpi: fix double free in ulpi_register_interface() error path\n\nWhen device_register() fails, ulpi_register() calls put_device() on\nulpi-\u003edev.\n\nThe device release callback ulpi_dev_release() drops the OF node\nreference and frees ulpi, but the current error path in\nulpi_register_interface() then calls kfree(ulpi) again, causing a\ndouble free.\n\nLet put_device() handle the cleanup through ulpi_dev_release() and\navoid freeing ulpi again in ulpi_register_interface().",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31759",
"url": "https://www.suse.com/security/cve/CVE-2026-31759"
},
{
"category": "external",
"summary": "SUSE Bug 1264076 for CVE-2026-31759",
"url": "https://bugzilla.suse.com/1264076"
},
{
"category": "external",
"summary": "SUSE Bug 1264078 for CVE-2026-31759",
"url": "https://bugzilla.suse.com/1264078"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T13:48:22Z",
"details": "important"
}
],
"title": "CVE-2026-31759"
},
{
"cve": "CVE-2026-43077",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-43077"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_aead - Fix minimum RX size check for decryption\n\nThe check for the minimum receive buffer size did not take the\ntag size into account during decryption. Fix this by adding the\nrequired extra length.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-43077",
"url": "https://www.suse.com/security/cve/CVE-2026-43077"
},
{
"category": "external",
"summary": "SUSE Bug 1264470 for CVE-2026-43077",
"url": "https://bugzilla.suse.com/1264470"
},
{
"category": "external",
"summary": "SUSE Bug 1265306 for CVE-2026-43077",
"url": "https://bugzilla.suse.com/1265306"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T13:48:22Z",
"details": "important"
}
],
"title": "CVE-2026-43077"
},
{
"cve": "CVE-2026-43109",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-43109"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86: shadow stacks: proper error handling for mmap lock\n\n\uae40\uc601\ubbfc reports that shstk_pop_sigframe() doesn\u0027t check for errors from\nmmap_read_lock_killable(), which is a silly oversight, and also shows\nthat we haven\u0027t marked those functions with \"__must_check\", which would\nhave immediately caught it.\n\nSo let\u0027s fix both issues.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-43109",
"url": "https://www.suse.com/security/cve/CVE-2026-43109"
},
{
"category": "external",
"summary": "SUSE Bug 1264484 for CVE-2026-43109",
"url": "https://bugzilla.suse.com/1264484"
},
{
"category": "external",
"summary": "SUSE Bug 1269282 for CVE-2026-43109",
"url": "https://bugzilla.suse.com/1269282"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T13:48:22Z",
"details": "important"
}
],
"title": "CVE-2026-43109"
},
{
"cve": "CVE-2026-43110",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-43110"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: validate bsscfg indices in IF events\n\nbrcmf_fweh_handle_if_event() validates the firmware-provided interface\nindex before it touches drvr-\u003eiflist[], but it still uses the raw\nbsscfgidx field as an array index without a matching range check.\n\nReject IF events whose bsscfg index does not fit in drvr-\u003eiflist[]\nbefore indexing the interface array.\n\n[add missing wifi prefix]",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-43110",
"url": "https://www.suse.com/security/cve/CVE-2026-43110"
},
{
"category": "external",
"summary": "SUSE Bug 1264482 for CVE-2026-43110",
"url": "https://bugzilla.suse.com/1264482"
},
{
"category": "external",
"summary": "SUSE Bug 1264483 for CVE-2026-43110",
"url": "https://bugzilla.suse.com/1264483"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T13:48:22Z",
"details": "important"
}
],
"title": "CVE-2026-43110"
},
{
"cve": "CVE-2026-43206",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-43206"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()\n\nThe kfd_event_page_set() function writes KFD_SIGNAL_EVENT_LIMIT * 8\nbytes via memset without checking the buffer size parameter. This allows\nunprivileged userspace to trigger an out-of bounds kernel memory write\nby passing a small buffer, leading to potential privilege\nescalation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-43206",
"url": "https://www.suse.com/security/cve/CVE-2026-43206"
},
{
"category": "external",
"summary": "SUSE Bug 1264551 for CVE-2026-43206",
"url": "https://bugzilla.suse.com/1264551"
},
{
"category": "external",
"summary": "SUSE Bug 1266668 for CVE-2026-43206",
"url": "https://bugzilla.suse.com/1266668"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T13:48:22Z",
"details": "important"
}
],
"title": "CVE-2026-43206"
},
{
"cve": "CVE-2026-46037",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46037"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: icmp: validate reply type before using icmp_pointers\n\nExtended echo replies use ICMP_EXT_ECHOREPLY as the outbound reply type.\nThat value is outside the range covered by icmp_pointers[], which only\ndescribes the traditional ICMP types up to NR_ICMP_TYPES.\n\nAvoid consulting icmp_pointers[] for reply types outside that range, and\nuse array_index_nospec() for the remaining in-range lookup. Normal ICMP\nreplies keep their existing behavior unchanged.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46037",
"url": "https://www.suse.com/security/cve/CVE-2026-46037"
},
{
"category": "external",
"summary": "SUSE Bug 1267361 for CVE-2026-46037",
"url": "https://bugzilla.suse.com/1267361"
},
{
"category": "external",
"summary": "SUSE Bug 1267362 for CVE-2026-46037",
"url": "https://bugzilla.suse.com/1267362"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T13:48:22Z",
"details": "important"
}
],
"title": "CVE-2026-46037"
},
{
"cve": "CVE-2026-46242",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46242"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\neventpoll: fix ep_remove struct eventpoll / struct file UAF\n\nep_remove() (via ep_remove_file()) cleared file-\u003ef_ep under\nfile-\u003ef_lock but then kept using @file inside the critical section\n(is_file_epoll(), hlist_del_rcu() through the head, spin_unlock).\nA concurrent __fput() taking the eventpoll_release() fastpath in\nthat window observed the transient NULL, skipped\neventpoll_release_file() and ran to f_op-\u003erelease / file_free().\n\nFor the epoll-watches-epoll case, f_op-\u003erelease is\nep_eventpoll_release() -\u003e ep_clear_and_put() -\u003e ep_free(), which\nkfree()s the watched struct eventpoll. Its embedded -\u003erefs\nhlist_head is exactly where epi-\u003efllink.pprev points, so the\nsubsequent hlist_del_rcu()\u0027s \"*pprev = next\" scribbles into freed\nkmalloc-192 memory.\n\nIn addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot\nbacking @file could be recycled by alloc_empty_file() --\nreinitializing f_lock and f_ep -- while ep_remove() is still\nnominally inside that lock. The upshot is an attacker-controllable\nkmem_cache_free() against the wrong slab cache.\n\nPin @file via epi_fget() at the top of ep_remove() and gate the\ncritical section on the pin succeeding. With the pin held @file\ncannot reach refcount zero, which holds __fput() off and\ntransitively keeps the watched struct eventpoll alive across the\nhlist_del_rcu() and the f_lock use, closing both UAFs.\n\nIf the pin fails @file has already reached refcount zero and its\n__fput() is in flight. Because we bailed before clearing f_ep,\nthat path takes the eventpoll_release() slow path into\neventpoll_release_file() and blocks on ep-\u003emtx until the waiter\nside\u0027s ep_clear_and_put() drops it. The bailed epi\u0027s share of\nep-\u003erefcount stays intact, so the trailing ep_refcount_dec_and_test()\nin ep_clear_and_put() cannot free the eventpoll out from under\neventpoll_release_file(); the orphaned epi is then cleaned up\nthere.\n\nA successful pin also proves we are not racing\neventpoll_release_file() on this epi, so drop the now-redundant\nre-check of epi-\u003edying under f_lock. The cheap lockless\nREAD_ONCE(epi-\u003edying) fast-path bailout stays.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46242",
"url": "https://www.suse.com/security/cve/CVE-2026-46242"
},
{
"category": "external",
"summary": "SUSE Bug 1267618 for CVE-2026-46242",
"url": "https://bugzilla.suse.com/1267618"
},
{
"category": "external",
"summary": "SUSE Bug 1270352 for CVE-2026-46242",
"url": "https://bugzilla.suse.com/1270352"
},
{
"category": "external",
"summary": "SUSE Bug 1271279 for CVE-2026-46242",
"url": "https://bugzilla.suse.com/1271279"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T13:48:22Z",
"details": "important"
}
],
"title": "CVE-2026-46242"
},
{
"cve": "CVE-2026-46274",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46274"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nio-wq: check that the predecessor is hashed in io_wq_remove_pending()\n\nio_wq_remove_pending() needs to fix up wq-\u003ehash_tail[] if the cancelled\nwork was the tail of its hash bucket. When doing this, it checks whether\nthe preceding entry in acct-\u003ework_list has the same hash value, but\nnever checks that the predecessor is hashed at all. io_get_work_hash()\nis simply atomic_read(\u0026work-\u003eflags) \u003e\u003e IO_WQ_HASH_SHIFT, and the hash\nbits are never set for non-hashed work, so it returns 0. Thus, when a\nhashed bucket-0 work is cancelled while a non-hashed work is its list\npredecessor, the check spuriously passes and a pointer to the non-hashed\nio_kiocb is stored in wq-\u003ehash_tail[0].\n\nBecause non-hashed work is dequeued via the fast path in\nio_get_next_work(), which never touches hash_tail[], the stale pointer\nis never cleared. Therefore, after the non-hashed io_kiocb completes and\nis freed back to req_cachep, wq-\u003ehash_tail[0] is a dangling pointer. The\nio_wq is per-task (tctx-\u003eio_wq) and survives ring open/close, so the\ndangling pointer persists for the lifetime of the task; the next hashed\nbucket-0 enqueue dereferences it in io_wq_insert_work() and\nwq_list_add_after() writes through freed memory.\n\nAdd the missing io_wq_is_hashed() check so a non-hashed predecessor\nnever inherits a hash_tail[] slot.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46274",
"url": "https://www.suse.com/security/cve/CVE-2026-46274"
},
{
"category": "external",
"summary": "SUSE Bug 1267918 for CVE-2026-46274",
"url": "https://bugzilla.suse.com/1267918"
},
{
"category": "external",
"summary": "SUSE Bug 1268624 for CVE-2026-46274",
"url": "https://bugzilla.suse.com/1268624"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T13:48:22Z",
"details": "important"
}
],
"title": "CVE-2026-46274"
},
{
"cve": "CVE-2026-46319",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46319"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ct: Only release RCU read lock after ct_ft\n\nWhen looking up a flow table in act_ct in tcf_ct_flow_table_get(),\nrhashtable_lookup_fast() internally opens and closes an RCU read critical\nsection before returning ct_ft.\nThe tcf_ct_flow_table_cleanup_work() can complete before refcount_inc_not_zero()\nis invoked on the returned ct_ft resulting in a UAF on the already freed ct_ft\nobject. This vulnerability can lead to privilege escalation.\n\nAnalysis from zdi-disclosures@trendmicro.com:\nWhen initializing act_ct, tcf_ct_init() is called, which internally triggers\ntcf_ct_flow_table_get().\n\nstatic int tcf_ct_flow_table_get(struct net *net, struct tcf_ct_params *params)\n\n{\n struct zones_ht_key key = { .net = net, .zone = params-\u003ezone };\n struct tcf_ct_flow_table *ct_ft;\n int err = -ENOMEM;\n\n mutex_lock(\u0026zones_mutex);\n ct_ft = rhashtable_lookup_fast(\u0026zones_ht, \u0026key, zones_params); // [1]\n if (ct_ft \u0026\u0026 refcount_inc_not_zero(\u0026ct_ft-\u003eref)) // [2]\n goto out_unlock;\n ...\n}\n\nstatic __always_inline void *rhashtable_lookup_fast(\n struct rhashtable *ht, const void *key,\n const struct rhashtable_params params)\n{\n void *obj;\n\n rcu_read_lock();\n obj = rhashtable_lookup(ht, key, params);\n rcu_read_unlock();\n\n return obj;\n}\n\nAt [1], rhashtable_lookup_fast() looks up and returns the corresponding ct_ft\nfrom zones_ht . The lookup is performed within an RCU read critical section\nthrough rcu_read_lock() / rcu_read_unlock(), which prevents the object from\nbeing freed. However, at the point of function return, rcu_read_unlock() has\nalready been called, and there is nothing preventing ct_ft from being freed\nbefore reaching refcount_inc_not_zero(\u0026ct_ft-\u003eref) at [2]. This interval becomes\nthe race window, during which ct_ft can be freed.\n\nFree Process:\n\ntcf_ct_flow_table_put() is executed through the path tcf_ct_cleanup() call_rcu()\ntcf_ct_params_free_rcu() tcf_ct_params_free() tcf_ct_flow_table_put().\n\nstatic void tcf_ct_flow_table_put(struct tcf_ct_flow_table *ct_ft)\n{\n if (refcount_dec_and_test(\u0026ct_ft-\u003eref)) {\n rhashtable_remove_fast(\u0026zones_ht, \u0026ct_ft-\u003enode, zones_params);\n INIT_RCU_WORK(\u0026ct_ft-\u003erwork, tcf_ct_flow_table_cleanup_work); // [3]\n queue_rcu_work(act_ct_wq, \u0026ct_ft-\u003erwork);\n }\n}\n\nAt [3], tcf_ct_flow_table_cleanup_work() is scheduled as RCU work\n\nstatic void tcf_ct_flow_table_cleanup_work(struct work_struct *work)\n\n{\n struct tcf_ct_flow_table *ct_ft;\n struct flow_block *block;\n\n ct_ft = container_of(to_rcu_work(work), struct tcf_ct_flow_table,\n rwork);\n nf_flow_table_free(\u0026ct_ft-\u003enf_ft);\n block = \u0026ct_ft-\u003enf_ft.flow_block;\n down_write(\u0026ct_ft-\u003enf_ft.flow_block_lock);\n WARN_ON(!list_empty(\u0026block-\u003ecb_list));\n up_write(\u0026ct_ft-\u003enf_ft.flow_block_lock);\n kfree(ct_ft); // [4]\n\n module_put(THIS_MODULE);\n}\n\ntcf_ct_flow_table_cleanup_work() frees ct_ft at [4]. When this function executes\nbetween [1] and [2], UAF occurs.\n\nThis race condition has a very short race window, making it generally\ndifficult to trigger. Therefore, to trigger the vulnerability an msleep(100) was\ninserted after[1]",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46319",
"url": "https://www.suse.com/security/cve/CVE-2026-46319"
},
{
"category": "external",
"summary": "SUSE Bug 1268022 for CVE-2026-46319",
"url": "https://bugzilla.suse.com/1268022"
},
{
"category": "external",
"summary": "SUSE Bug 1268281 for CVE-2026-46319",
"url": "https://bugzilla.suse.com/1268281"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T13:48:22Z",
"details": "important"
}
],
"title": "CVE-2026-46319"
},
{
"cve": "CVE-2026-52923",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-52923"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipc: limit next_id allocation to the valid ID range\n\nThe checkpoint/restore sysctl path can request the next SysV IPC id\nthrough ids-\u003enext_id. ipc_idr_alloc() currently forwards that request to\nidr_alloc() with an open-ended upper bound.\n\nIf the valid tail of the SysV IPC id space is full, the allocation can\nspill beyond ipc_mni. The returned SysV IPC id still uses the normal\nindex encoding, so later lookup and removal can target the wrong slot. \nThis leaves the real IDR entry behind and breaks the IDR state for the\nobject.\n\nThe bug is in ipc_idr_alloc() in the checkpoint/restore path.\n\n1. ids-\u003enext_id is passed to:\n\n idr_alloc(\u0026ids-\u003eipcs_idr, new, ipcid_to_idx(next_id), 0, ...)\n\n2. The zero upper bound makes the allocation effectively open-ended.\n Once the valid SysV IPC tail is occupied, idr_alloc() can spill past\n ipc_mni and allocate an entry beyond the valid IPC id range.\n\n3. The new object id is still encoded with the narrower SysV IPC index\n width:\n\n new-\u003eid = (new-\u003eseq \u003c\u003c ipcmni_seq_shift()) + idx\n\n4. Later removal goes through ipc_rmid(), which uses:\n\n ipcid_to_idx(ipcp-\u003eid)\n\n That truncates the real IDR index. An object actually stored at a\n high index can then be removed as if it lived at a low in-range\n index.\n\n5. For shared memory, shm_destroy() frees the current object anyway, but\n the real high IDR slot is left behind as a dangling pointer.\n\n6. A subsequent walk of /proc/sysvipc/shm reaches the stale IDR entry\n and dereferences freed memory.\n\nPrevent this by bounding the requested allocation to ipc_mni so the\ncheckpoint/restore path fails once the valid range is exhausted.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-52923",
"url": "https://www.suse.com/security/cve/CVE-2026-52923"
},
{
"category": "external",
"summary": "SUSE Bug 1269033 for CVE-2026-52923",
"url": "https://bugzilla.suse.com/1269033"
},
{
"category": "external",
"summary": "SUSE Bug 1269034 for CVE-2026-52923",
"url": "https://bugzilla.suse.com/1269034"
},
{
"category": "external",
"summary": "SUSE Bug 1274780 for CVE-2026-52923",
"url": "https://bugzilla.suse.com/1274780"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T13:48:22Z",
"details": "important"
}
],
"title": "CVE-2026-52923"
},
{
"cve": "CVE-2026-52956",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-52956"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Fix potential out-of-bounds access in __ceph_x_decrypt()\n\nIn __ceph_x_decrypt(), a part of the buffer p is interpreted as a\nceph_x_encrypt_header, and the magic field of this struct is accessed.\nThis happens without any guarantee that the buffer is large enough to\nhold this struct. The function parameter ciphertext_len represents the\nlength of the ciphertext to decrypt and is guaranteed to be at most the\nremaining size of the allocated buffer p. However, this value is not\nnecessarily greater than sizeof(ceph_x_encrypt_header). E.g., a message\nframe of type FRAME_TAG_AUTH_REPLY_MORE, that is just as long to hold\nthe ciphertext at its end with a ciphertext_len of 8 or less, can\ntrigger an out-of-bounds memory access when accessing hdr-\u003emagic.\n\nThis patch fixes the issue by adding a check to ensure that the\ndecrypted plaintext in the buffer is large enough to represent at least\nthe ceph_x_encrypt_header.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-52956",
"url": "https://www.suse.com/security/cve/CVE-2026-52956"
},
{
"category": "external",
"summary": "SUSE Bug 1269172 for CVE-2026-52956",
"url": "https://bugzilla.suse.com/1269172"
},
{
"category": "external",
"summary": "SUSE Bug 1272139 for CVE-2026-52956",
"url": "https://bugzilla.suse.com/1272139"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T13:48:22Z",
"details": "important"
}
],
"title": "CVE-2026-52956"
},
{
"cve": "CVE-2026-52972",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-52972"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Cap AEAD AD length to 0x80000000\n\nIn order to prevent arithmetic overflows when checking the TX\nbuffer size, cap the associated data length to 0x80000000.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-52972",
"url": "https://www.suse.com/security/cve/CVE-2026-52972"
},
{
"category": "external",
"summary": "SUSE Bug 1269195 for CVE-2026-52972",
"url": "https://bugzilla.suse.com/1269195"
},
{
"category": "external",
"summary": "SUSE Bug 1269196 for CVE-2026-52972",
"url": "https://bugzilla.suse.com/1269196"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T13:48:22Z",
"details": "important"
}
],
"title": "CVE-2026-52972"
},
{
"cve": "CVE-2026-53133",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-53133"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/umem: Fix truncation for block sizes \u003e= 4G\n\nWhen the iommu is used the linearization of the mapping can give a single\nblock that is very large split across multiple SG entries.\n\nWhen __rdma_block_iter_next() reassembles the split SG entries it is\noverflowing the 32 bit stack values and computed the wrong DMA addresses\nfor blocks after the truncation.\n\nUse the right types to hold DMA addresses.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-53133",
"url": "https://www.suse.com/security/cve/CVE-2026-53133"
},
{
"category": "external",
"summary": "SUSE Bug 1269821 for CVE-2026-53133",
"url": "https://bugzilla.suse.com/1269821"
},
{
"category": "external",
"summary": "SUSE Bug 1269822 for CVE-2026-53133",
"url": "https://bugzilla.suse.com/1269822"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T13:48:22Z",
"details": "important"
}
],
"title": "CVE-2026-53133"
},
{
"cve": "CVE-2026-53182",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-53182"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: nl80211: reject oversized EMA RNR lists\n\nnl80211_parse_rnr_elems() stores the parsed element count in a\nu8-backed cfg80211_rnr_elems::cnt field and uses that count to size\nthe flexible array allocation.\n\nReject nested NL80211_ATTR_EMA_RNR_ELEMS input once the count reaches\n255, before incrementing it again. This keeps the parser aligned with\nthe data structure it fills and matches the existing bound check used\nby nl80211_parse_mbssid_elems().",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-53182",
"url": "https://www.suse.com/security/cve/CVE-2026-53182"
},
{
"category": "external",
"summary": "SUSE Bug 1269884 for CVE-2026-53182",
"url": "https://bugzilla.suse.com/1269884"
},
{
"category": "external",
"summary": "SUSE Bug 1269885 for CVE-2026-53182",
"url": "https://bugzilla.suse.com/1269885"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T13:48:22Z",
"details": "important"
}
],
"title": "CVE-2026-53182"
},
{
"cve": "CVE-2026-53224",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-53224"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate embedded INIT chunk and address list lengths in cookie\n\nsctp_unpack_cookie() only checked that the embedded INIT chunk length\ndid not exceed the remaining cookie payload, but did not ensure that the\nINIT chunk is large enough to contain a complete INIT header.\n\nA malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose\nlength field is smaller than sizeof(struct sctp_init_chunk). Later,\nsctp_process_init() accesses INIT parameters unconditionally, which may\nlead to out-of-bounds reads.\n\nIn addition, raw_addr_list_len is not fully validated against the\nremaining cookie payload. When cookie authentication is disabled, an\nattacker can supply an oversized raw_addr_list_len and cause\nsctp_raw_to_bind_addrs() to read beyond the end of the cookie. The\naddress parser also lacks sufficient bounds checks for parameter headers\nand lengths, allowing malformed address parameters to trigger\nout-of-bounds reads.\n\nFix this by:\n\n- requiring the embedded INIT chunk length to be at least sizeof(struct\n sctp_init_chunk);\n- validating that the INIT chunk and raw address list together fit\n within the cookie payload;\n- verifying sufficient data exists for each address parameter header and\n payload before parsing it.\n\nNote that sctp_verify_init() must be called after sctp_unpack_cookie()\nand before sctp_process_init() when cookie authentication is disabled.\nThis will be addressed in a separate patch.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-53224",
"url": "https://www.suse.com/security/cve/CVE-2026-53224"
},
{
"category": "external",
"summary": "SUSE Bug 1269997 for CVE-2026-53224",
"url": "https://bugzilla.suse.com/1269997"
},
{
"category": "external",
"summary": "SUSE Bug 1270023 for CVE-2026-53224",
"url": "https://bugzilla.suse.com/1270023"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T13:48:22Z",
"details": "important"
}
],
"title": "CVE-2026-53224"
},
{
"cve": "CVE-2026-53246",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-53246"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate cached peer INIT chunk length in COOKIE_ECHO processing\n\nWhen a listening SCTP server processes a COOKIE_ECHO chunk, the cached\npeer INIT chunk embedded after the cookie is parsed and its parameters\nare later walked by sctp_process_init() using sctp_walk_params().\n\nHowever, the chunk header length of this cached INIT chunk was not\nvalidated against the remaining buffer in the COOKIE_ECHO payload. If\nthe length field is inflated, the parameter walk can run beyond the\nactual received data, leading to out-of-bounds reads and potential\nmemory corruption during later parameter handling (e.g. STATE_COOKIE\nprocessing and kmemdup() copies).\n\nAdd a bounds check in sctp_unpack_cookie() to ensure the cached INIT\nchunk length does not exceed the available data in the COOKIE_ECHO\nbuffer before it is used.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-53246",
"url": "https://www.suse.com/security/cve/CVE-2026-53246"
},
{
"category": "external",
"summary": "SUSE Bug 1269988 for CVE-2026-53246",
"url": "https://bugzilla.suse.com/1269988"
},
{
"category": "external",
"summary": "SUSE Bug 1270024 for CVE-2026-53246",
"url": "https://bugzilla.suse.com/1270024"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T13:48:22Z",
"details": "important"
}
],
"title": "CVE-2026-53246"
},
{
"cve": "CVE-2026-64530",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-64530"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle\n\ntcf_classify() can return TC_ACT_CONSUMED while the skb is held by the\ndefragmentation engine (e.g. act_ct on out-of-order fragments). When\nthat happens the skb is no longer owned by the caller and must not be\ntouched again.\n\ntcf_qevent_handle() did not handle TC_ACT_CONSUMED: it fell through the\nswitch and returned the skb to the caller as if classification had\npassed. The only qdisc that wires up qevents today is RED, via three call sites\n(qe_mark on RED_PROB_MARK/HARD_MARK, qe_early_drop on congestion_drop)\nred_enqueue() was continuing to operate on an skb it no longer owns in this\ncase -- enqueueing it, dropping it, or updating statistics. Resulting in a UAF.\n\n tc qdisc add dev eth0 root handle 1: red ... qevent early_drop block 10\n tc filter add block 10 ... action ct\n\n (with ct defrag enabled and traffic that produces out-of-order\n fragments, e.g. a fragmented UDP stream)\n\nHandle TC_ACT_CONSUMED in tcf_qevent_handle() the same way the ingress\nand egress fast paths do: treat it as stolen and return NULL without\ntouching the skb. Unlike the TC_ACT_STOLEN case, the skb must not be\ndropped/freed here, as it is no longer owned by us.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-64530",
"url": "https://www.suse.com/security/cve/CVE-2026-64530"
},
{
"category": "external",
"summary": "SUSE Bug 1271866 for CVE-2026-64530",
"url": "https://bugzilla.suse.com/1271866"
},
{
"category": "external",
"summary": "SUSE Bug 1271867 for CVE-2026-64530",
"url": "https://bugzilla.suse.com/1271867"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T13:48:22Z",
"details": "important"
}
],
"title": "CVE-2026-64530"
},
{
"cve": "CVE-2026-64600",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-64600"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: resample the data fork mapping after cycling ILOCK\n\nxfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode,\na data fork mapping, and a cow fork mapping. Unfortunately, these two\nhelpers cycle the ILOCK to grab a transaction, which means that the\nmappings are stale as soon as we reacquire the ILOCK. Currently we\nrefresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but\nwe don\u0027t refresh the data fork mapping beforehand, which means that the\nxfs_bmap_trim_cow in that function queries the refcount btree about the\nwrong physical blocks and returns an inaccurate value in *shared.\n\nIf *shared is now false, the directio write proceeds with a stale data\nfork mapping. Fix this by querying the data fork mapping if the\nsequence counter changes across the ILOCK cycle.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-64600",
"url": "https://www.suse.com/security/cve/CVE-2026-64600"
},
{
"category": "external",
"summary": "SUSE Bug 1271526 for CVE-2026-64600",
"url": "https://bugzilla.suse.com/1271526"
},
{
"category": "external",
"summary": "SUSE Bug 1271543 for CVE-2026-64600",
"url": "https://bugzilla.suse.com/1271543"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-38-rt-11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T13:48:22Z",
"details": "important"
}
],
"title": "CVE-2026-64600"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…