{"document":{"aggregate_severity":{"namespace":"https://www.suse.com/support/security/rating/","text":"important"},"category":"csaf_security_advisory","csaf_version":"2.0","distribution":{"text":"Copyright 2024 SUSE LLC. All rights reserved.","tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en","notes":[{"category":"summary","text":"Security update for the Linux Kernel RT (Live Patch 6 for SUSE Linux Enterprise 15 SP7)","title":"Title of the patch"},{"category":"description","text":"\nThis update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.22 fixes various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269766).\n- CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272521).\n- CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272874).\n- CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712).\n- CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277679).\n- CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693).\n- CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399).\n- CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280760).\n- CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280728).\n- CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280285).\n- CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285686).\n","title":"Description of the patch"},{"category":"details","text":"SUSE-2026-4969,SUSE-SLE-Module-Live-Patching-15-SP7-2026-4969","title":"Patchnames"},{"category":"legal_disclaimer","text":"CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).","title":"Terms of use"}],"publisher":{"category":"vendor","contact_details":"https://www.suse.com/support/security/contact/","name":"SUSE Product Security Team","namespace":"https://www.suse.com/"},"references":[{"category":"external","summary":"SUSE ratings","url":"https://www.suse.com/support/security/rating/"},{"category":"self","summary":"URL of this CSAF notice","url":"https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_4969-1.json"},{"category":"self","summary":"URL for SUSE-SU-2026:4969-1","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264969-1/"},{"category":"self","summary":"E-Mail link for SUSE-SU-2026:4969-1","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264969-1/"},{"category":"self","summary":"SUSE Bug 1269766","url":"https://bugzilla.suse.com/1269766"},{"category":"self","summary":"SUSE Bug 1272521","url":"https://bugzilla.suse.com/1272521"},{"category":"self","summary":"SUSE Bug 1272874","url":"https://bugzilla.suse.com/1272874"},{"category":"self","summary":"SUSE Bug 1274712","url":"https://bugzilla.suse.com/1274712"},{"category":"self","summary":"SUSE Bug 1277399","url":"https://bugzilla.suse.com/1277399"},{"category":"self","summary":"SUSE Bug 1277679","url":"https://bugzilla.suse.com/1277679"},{"category":"self","summary":"SUSE Bug 1280285","url":"https://bugzilla.suse.com/1280285"},{"category":"self","summary":"SUSE Bug 1280693","url":"https://bugzilla.suse.com/1280693"},{"category":"self","summary":"SUSE Bug 1280728","url":"https://bugzilla.suse.com/1280728"},{"category":"self","summary":"SUSE Bug 1280760","url":"https://bugzilla.suse.com/1280760"},{"category":"self","summary":"SUSE Bug 1285686","url":"https://bugzilla.suse.com/1285686"},{"category":"self","summary":"SUSE CVE CVE-2026-53016 page","url":"https://www.suse.com/security/cve/CVE-2026-53016/"},{"category":"self","summary":"SUSE CVE CVE-2026-63968 page","url":"https://www.suse.com/security/cve/CVE-2026-63968/"},{"category":"self","summary":"SUSE CVE CVE-2026-64217 page","url":"https://www.suse.com/security/cve/CVE-2026-64217/"},{"category":"self","summary":"SUSE CVE CVE-2026-68426 page","url":"https://www.suse.com/security/cve/CVE-2026-68426/"},{"category":"self","summary":"SUSE CVE CVE-2026-72262 page","url":"https://www.suse.com/security/cve/CVE-2026-72262/"},{"category":"self","summary":"SUSE CVE CVE-2026-74469 page","url":"https://www.suse.com/security/cve/CVE-2026-74469/"},{"category":"self","summary":"SUSE CVE CVE-2026-74669 page","url":"https://www.suse.com/security/cve/CVE-2026-74669/"},{"category":"self","summary":"SUSE CVE CVE-2026-89544 page","url":"https://www.suse.com/security/cve/CVE-2026-89544/"},{"category":"self","summary":"SUSE CVE CVE-2026-89551 page","url":"https://www.suse.com/security/cve/CVE-2026-89551/"},{"category":"self","summary":"SUSE CVE CVE-2026-89674 page","url":"https://www.suse.com/security/cve/CVE-2026-89674/"},{"category":"self","summary":"SUSE CVE CVE-2026-98432 page","url":"https://www.suse.com/security/cve/CVE-2026-98432/"}],"title":"Security update for the Linux Kernel RT (Live Patch 6 for SUSE Linux Enterprise 15 SP7)","tracking":{"current_release_date":"2026-11-04T21:54:09Z","generator":{"date":"2026-10-31T17:04:46Z","engine":{"name":"cve-database.git:bin/generate-csaf.pl","version":"1"}},"id":"SUSE-SU-2026:4969-1","initial_release_date":"2026-10-31T17:04:46Z","revision_history":[{"date":"2026-10-31T17:04:46Z","number":"1","summary":"Current version"},{"date":"2026-11-03T21:50:40Z","number":"2","summary":"unknown changes"},{"date":"2026-11-04T21:54:09Z","number":"3","summary":"unknown changes"}],"status":"final","version":"3"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_version","name":"kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64","product":{"name":"kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64","product_id":"kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64","product_identification_helper":{"purl":"pkg:rpm/suse/kernel-livepatch-6_4_0-150700_7_22-rt@16-150700.2.1?arch=x86_64&upstream=kernel-livepatch-SLE15-SP7-RT_Update_6-0:16-150700.2.1.src.rpm"}}}],"category":"architecture","name":"x86_64"},{"branches":[{"category":"product_name","name":"SUSE Linux Enterprise Live Patching 15 SP7","product":{"name":"SUSE Linux Enterprise Live Patching 15 SP7","product_id":"SUSE Linux Enterprise Live Patching 15 SP7","product_identification_helper":{"cpe":"cpe:/o:suse:sle-module-live-patching:15:sp7"}}}],"category":"product_family","name":"SUSE Linux Enterprise"}],"category":"vendor","name":"SUSE"}],"relationships":[{"category":"default_component_of","full_product_name":{"name":"kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64 as component of SUSE Linux Enterprise Live Patching 15 SP7","product_id":"SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64"},"product_reference":"kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64","relates_to_product_reference":"SUSE Linux Enterprise Live Patching 15 SP7"}]},"vulnerabilities":[{"cve":"CVE-2026-53016","ids":[{"system_name":"SUSE CVE Page","text":"https://www.suse.com/security/cve/CVE-2026-53016"}],"notes":[{"category":"general","text":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp - copy IV using skcipher ivsize\n\nAF_ALG rfc3686-ctr-aes-ccp requests pass an 8-byte IV to the driver.\n\nccp_aes_complete() restores AES_BLOCK_SIZE bytes into the caller's IV\nbuffer while RFC3686 skciphers expose an 8-byte IV, so the restore\noverruns the provided buffer.\n\nUse crypto_skcipher_ivsize() to copy only the algorithm's IV length.","title":"CVE description"}],"product_status":{"recommended":["SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64"]},"references":[{"category":"external","summary":"CVE-2026-53016","url":"https://www.suse.com/security/cve/CVE-2026-53016"},{"category":"external","summary":"SUSE Bug 1269090 for CVE-2026-53016","url":"https://bugzilla.suse.com/1269090"},{"category":"external","summary":"SUSE Bug 1269766 for CVE-2026-53016","url":"https://bugzilla.suse.com/1269766"}],"remediations":[{"category":"vendor_fix","details":"To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n","product_ids":["SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64"]}],"scores":[{"cvss_v3":{"baseScore":7.3,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","version":"3.1"},"products":["SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64"]}],"threats":[{"category":"impact","date":"2026-10-31T17:04:46Z","details":"important"}],"title":"CVE-2026-53016"},{"cve":"CVE-2026-63968","ids":[{"system_name":"SUSE CVE Page","text":"https://www.suse.com/security/cve/CVE-2026-63968"}],"notes":[{"category":"general","text":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fix possible infinite loop in fib6_select_path()\n\nFound while auditing the same pattern Sashiko reported in\nrt6_fill_node() [1]. Apply the same fix as\ncommit f8d8ce1b515a (\"ipv6: fix possible infinite loop in fib6_info_uses_dev()\").\n\nWriters holding tb6_lock can list_del_rcu(&first->fib6_siblings)\nwithout waiting for RCU readers; first->fib6_siblings.next then\nstill points into the old ring and this softirq-side walker never\nreaches &first->fib6_siblings as its terminator. fib6_purge_rt()\nalways WRITE_ONCE()s first->fib6_nsiblings to 0 before\nlist_del_rcu(), so an inside-loop check is a reliable detach signal.\n\n[1] https://sashiko.dev/#/patchset/20260526020227.4857-1-jiayuan.chen%40linux.dev","title":"CVE description"}],"product_status":{"recommended":["SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64"]},"references":[{"category":"external","summary":"CVE-2026-63968","url":"https://www.suse.com/security/cve/CVE-2026-63968"},{"category":"external","summary":"SUSE Bug 1272466 for CVE-2026-63968","url":"https://bugzilla.suse.com/1272466"},{"category":"external","summary":"SUSE Bug 1272521 for CVE-2026-63968","url":"https://bugzilla.suse.com/1272521"}],"remediations":[{"category":"vendor_fix","details":"To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n","product_ids":["SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64"]}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64"]}],"threats":[{"category":"impact","date":"2026-10-31T17:04:46Z","details":"important"}],"title":"CVE-2026-63968"},{"cve":"CVE-2026-64217","ids":[{"system_name":"SUSE CVE Page","text":"https://www.suse.com/security/cve/CVE-2026-64217"}],"notes":[{"category":"general","text":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix overrun check in netfs_extract_user_iter()\n\nFix netfs_extract_user_iter() so that if iov_iter_extract_pages() overfills\npages[], then those pages don't get included in the iterator constructed at\nthe end of the function.  If there was an overfill, memory corruption has\nalready happened.","title":"CVE description"}],"product_status":{"recommended":["SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64"]},"references":[{"category":"external","summary":"CVE-2026-64217","url":"https://www.suse.com/security/cve/CVE-2026-64217"},{"category":"external","summary":"SUSE Bug 1272798 for CVE-2026-64217","url":"https://bugzilla.suse.com/1272798"},{"category":"external","summary":"SUSE Bug 1272874 for CVE-2026-64217","url":"https://bugzilla.suse.com/1272874"}],"remediations":[{"category":"vendor_fix","details":"To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n","product_ids":["SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64"]}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64"]}],"threats":[{"category":"impact","date":"2026-10-31T17:04:46Z","details":"important"}],"title":"CVE-2026-64217"},{"cve":"CVE-2026-68426","ids":[{"system_name":"SUSE CVE Page","text":"https://www.suse.com/security/cve/CVE-2026-68426"}],"notes":[{"category":"general","text":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: fix stale skb->prev after async crypto steals a GSO segment\n\nskb_gso_segment() leaves the segment list head with ->prev pointing at\nthe last segment, an invariant validate_xmit_skb_list() relies on when\nit sets its tail pointer (tail = skb->prev).\n\nWhen validate_xmit_xfrm() walks a GSO list and some segments are stolen\nby async crypto (->xmit() returns -EINPROGRESS), those segments are\nunlinked from the list but the head ->prev is never updated.  If the\nlast segment is the one stolen, the returned head still has ->prev\npointing at it, even though it is now owned by the crypto engine and may\nbe freed.  validate_xmit_skb_list() later does tail->next = skb, writing\nthrough that stale pointer -- a use-after-free.\n\nRepoint skb->prev at the last retained segment before returning.","title":"CVE description"}],"product_status":{"recommended":["SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64"]},"references":[{"category":"external","summary":"CVE-2026-68426","url":"https://www.suse.com/security/cve/CVE-2026-68426"},{"category":"external","summary":"SUSE Bug 1274705 for CVE-2026-68426","url":"https://bugzilla.suse.com/1274705"},{"category":"external","summary":"SUSE Bug 1274712 for CVE-2026-68426","url":"https://bugzilla.suse.com/1274712"}],"remediations":[{"category":"vendor_fix","details":"To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n","product_ids":["SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64"]}],"scores":[{"cvss_v3":{"baseScore":7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64"]}],"threats":[{"category":"impact","date":"2026-10-31T17:04:46Z","details":"important"}],"title":"CVE-2026-68426"},{"cve":"CVE-2026-72262","ids":[{"system_name":"SUSE CVE Page","text":"https://www.suse.com/security/cve/CVE-2026-72262"}],"notes":[{"category":"general","text":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get\n\nThe ipc_control_data buffer is allocated as kzalloc(max_size), where\nmax_size covers the entire struct sof_ipc_ctrl_data including its\nflexible array payload. However, the bounds checks in bytes_ext_put\nand _bytes_ext_get compared user data lengths against max_size\ndirectly, ignoring that cdata->data sits at an offset of\nsizeof(struct sof_ipc_ctrl_data) bytes into the allocation.\n\nThis allowed writing up to sizeof(struct sof_ipc_ctrl_data) bytes past\nthe end of the heap buffer from unprivileged userspace via the ALSA TLV\nkcontrol interface, and similarly allowed over-reading adjacent heap\ndata on the get path.\n\nFix all bounds checks to subtract sizeof(*cdata) from max_size so they\nreflect the actual space available at the cdata->data offset. Also fix\nthe error-path restore in bytes_ext_put which wrote to cdata->data\ninstead of cdata, causing the same overflow.","title":"CVE description"}],"product_status":{"recommended":["SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64"]},"references":[{"category":"external","summary":"CVE-2026-72262","url":"https://www.suse.com/security/cve/CVE-2026-72262"},{"category":"external","summary":"SUSE Bug 1277678 for CVE-2026-72262","url":"https://bugzilla.suse.com/1277678"},{"category":"external","summary":"SUSE Bug 1277679 for CVE-2026-72262","url":"https://bugzilla.suse.com/1277679"}],"remediations":[{"category":"vendor_fix","details":"To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n","product_ids":["SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64"]}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64"]}],"threats":[{"category":"impact","date":"2026-10-31T17:04:46Z","details":"important"}],"title":"CVE-2026-72262"},{"cve":"CVE-2026-74469","ids":[{"system_name":"SUSE CVE Page","text":"https://www.suse.com/security/cve/CVE-2026-74469"}],"notes":[{"category":"general","text":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: prevent peer transport count overflow\n\nsctp_assoc_add_peer() increments the association's 16-bit transport_count\nfor every new unique peer. Adding the 65,536th transport wraps the count to\nzero.\n\nSCTP sock_diag uses transport_count to reserve the INET_DIAG_PEERS payload,\nthen copies one sockaddr_storage for every entry in transport_addr_list.\nAfter the wrap, a diagnostic dump reserves an empty payload and writes\n8 MiB of peer addresses past the skb tail.\n\nReject a new unique peer when transport_count has reached U16_MAX. Perform\nthe check after the existing-peer lookup so a duplicate address continues\nto return its existing transport at the limit.","title":"CVE description"}],"product_status":{"recommended":["SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64"]},"references":[{"category":"external","summary":"CVE-2026-74469","url":"https://www.suse.com/security/cve/CVE-2026-74469"},{"category":"external","summary":"SUSE Bug 1277792 for CVE-2026-74469","url":"https://bugzilla.suse.com/1277792"},{"category":"external","summary":"SUSE Bug 1280693 for CVE-2026-74469","url":"https://bugzilla.suse.com/1280693"},{"category":"external","summary":"SUSE Bug 1282936 for CVE-2026-74469","url":"https://bugzilla.suse.com/1282936"}],"remediations":[{"category":"vendor_fix","details":"To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n","product_ids":["SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64"]}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64"]}],"threats":[{"category":"impact","date":"2026-10-31T17:04:46Z","details":"important"}],"title":"CVE-2026-74469"},{"cve":"CVE-2026-74669","ids":[{"system_name":"SUSE CVE Page","text":"https://www.suse.com/security/cve/CVE-2026-74669"}],"notes":[{"category":"general","text":"In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: clear IPv4 options after rebasing tunnel ICMP errors\n\nip_vs_in_icmp() rebases an skb from the outer ICMP packet to the\nquoted original request before passing it to icmp_send(). However,\nIPCB(skb)->opt still describes the outer IPv4 header.\n\nA timestamp option in the outer header can therefore leave an offset\nthat points into the quoted transport header after the rebase.\n__ip_options_echo() treats a byte at that stale location as the option\nlength and copies it into the fixed-size option storage on the\n__icmp_send() stack, causing a stack out-of-bounds write.\n\nClear the stale option metadata after resetting the network header.\nKeep the remaining control block fields, including the ingress\ninterface used by the ICMP response path.","title":"CVE description"}],"product_status":{"recommended":["SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64"]},"references":[{"category":"external","summary":"CVE-2026-74669","url":"https://www.suse.com/security/cve/CVE-2026-74669"},{"category":"external","summary":"SUSE Bug 1277391 for CVE-2026-74669","url":"https://bugzilla.suse.com/1277391"},{"category":"external","summary":"SUSE Bug 1277399 for CVE-2026-74669","url":"https://bugzilla.suse.com/1277399"}],"remediations":[{"category":"vendor_fix","details":"To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n","product_ids":["SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64"]}],"scores":[{"cvss_v3":{"baseScore":7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64"]}],"threats":[{"category":"impact","date":"2026-10-31T17:04:46Z","details":"important"}],"title":"CVE-2026-74669"},{"cve":"CVE-2026-89544","ids":[{"system_name":"SUSE CVE Page","text":"https://www.suse.com/security/cve/CVE-2026-89544"}],"notes":[{"category":"general","text":"In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: fix gssx_dec_option_array error path bugs\n\nFour coupled defects in the gssx XDR option-array decoder make the\nerror paths unsafe: a NULL deref in the caller, a refcount leak on\nthe decoded group_info, and a latent use-after-free that the leak\nfix would otherwise expose.\n\ngssx_dec_option_array() sets oa->count = 1 before allocating\noa->data.  If that allocation fails, -ENOMEM is returned with\noa->count == 1 and oa->data == NULL.  All other error paths jump\nto free_oa: which frees oa->data and NULLs it but also leaves\noa->count == 1.  The caller trusts the count:\n\n    gssp_accept_sec_context_upcall()\n      gssx_dec_accept_sec_context()\n        gssx_dec_option_array()        /* fails, count=1 data=NULL */\n      data = res.options.data[0].value /* NULL deref */\n\nIndependently, free_creds: releases the partially decoded svc_cred\nwith a bare kfree(creds).  gssx_dec_linux_creds() installs a\ngroups_alloc() result into creds->cr_group_info; that object is\nkvmalloc-backed and refcounted, and only put_group_info() reaches\nkvfree().  A plain kfree(creds) drops the wrapper and leaks the\ngroup_info allocation.\n\nThe natural fix for the leak is to call free_svc_cred(creds) before\nkfree(creds), but free_svc_cred() invokes put_group_info() on\ncreds->cr_group_info unconditionally when non-NULL.  The existing\nout_free_groups: path in gssx_dec_linux_creds() already called\ngroups_free() on that pointer without clearing it, so once\nfree_svc_cred() is wired in, the subsequent put_group_info() would\ntouch freed memory.\n\nFix all four together:\n\n  - Move the oa->count = 1 assignment below the oa->data allocation\n    so it is never set when oa->data is NULL.\n  - Reset oa->count to 0 at free_oa: so count and data stay\n    coherent and the caller sees an empty option array.\n  - Call free_svc_cred(creds) before kfree(creds) at free_creds:\n    so the refcounted cr_group_info is released.  free_svc_cred()\n    either NULL-guards each field explicitly (cr_group_info has\n    an if() check) or delegates to a helper that is NULL-safe\n    itself (kfree for the string fields, gss_mech_put() which\n    guards with if(gm) at gss_mech_switch.c:342), so it is safe\n    to call on a partially decoded svc_cred where only\n    cr_uid/cr_gid/cr_group_info have been written and everything\n    else is zero from kzalloc.\n  - In gssx_dec_linux_creds()'s out_free_groups: path, release\n    cr_group_info with put_group_info() rather than groups_free()\n    so the teardown matches free_svc_cred()'s refcount-aware path,\n    and clear the pointer so a later free_svc_cred() on the same\n    creds does not release it a second time.","title":"CVE description"}],"product_status":{"recommended":["SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64"]},"references":[{"category":"external","summary":"CVE-2026-89544","url":"https://www.suse.com/security/cve/CVE-2026-89544"},{"category":"external","summary":"SUSE Bug 1280758 for CVE-2026-89544","url":"https://bugzilla.suse.com/1280758"},{"category":"external","summary":"SUSE Bug 1280760 for CVE-2026-89544","url":"https://bugzilla.suse.com/1280760"}],"remediations":[{"category":"vendor_fix","details":"To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n","product_ids":["SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64"]}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64"]}],"threats":[{"category":"impact","date":"2026-10-31T17:04:46Z","details":"important"}],"title":"CVE-2026-89544"},{"cve":"CVE-2026-89551","ids":[{"system_name":"SUSE CVE Page","text":"https://www.suse.com/security/cve/CVE-2026-89551"}],"notes":[{"category":"general","text":"In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow\n\nxdr_buf_trim() trims `len` bytes from the tail of an xdr_buf by\nwalking the tail, pages, and head iovecs.  Each per-section step\nuses min_t() so it never removes more bytes than that section\nholds, but the final accounting at the fix_len label subtracts the\ntotal bytes actually consumed from buf->len without any clamp:\n\n    fix_len:\n            buf->len -= (len - trim);\n\nWhen the caller has set buf->len to a value smaller than the sum\nof the iov_lens, (len - trim) can exceed buf->len and the unsigned\nsubtraction wraps to near UINT_MAX.  gss_krb5_unwrap_v2() reaches\nxdr_buf_trim() in exactly that state:\n\n    buf->head[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip;\n    buf->len = len - (GSS_KRB5_TOK_HDR_LEN + headskip);\n    xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip);\n\nbuf->len is a small wire-derived value while the iov_lens are at\npage scale, so the per-section loops legitimately consume far more\nbytes than buf->len records.  The wrapped buf->len then propagates\nas the authoritative stream bound into every downstream XDR\ndecoder.\n\nFix by clamping the decrement so buf->len bottoms out at zero:\n\n    buf->len -= min_t(unsigned int, buf->len, len - trim);\n\nOn the normal path where the iov_lens sum to buf->len, (len - trim)\nis always <= buf->len and the result is identical to before.  No\ncallers change behavior outside the underflow case.","title":"CVE description"}],"product_status":{"recommended":["SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64"]},"references":[{"category":"external","summary":"CVE-2026-89551","url":"https://www.suse.com/security/cve/CVE-2026-89551"},{"category":"external","summary":"SUSE Bug 1280727 for CVE-2026-89551","url":"https://bugzilla.suse.com/1280727"},{"category":"external","summary":"SUSE Bug 1280728 for CVE-2026-89551","url":"https://bugzilla.suse.com/1280728"}],"remediations":[{"category":"vendor_fix","details":"To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n","product_ids":["SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64"]}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64"]}],"threats":[{"category":"impact","date":"2026-10-31T17:04:46Z","details":"important"}],"title":"CVE-2026-89551"},{"cve":"CVE-2026-89674","ids":[{"system_name":"SUSE CVE Page","text":"https://www.suse.com/security/cve/CVE-2026-89674"}],"notes":[{"category":"general","text":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget\n\nThe XDR buffer size calculation in nfsd4_ff_encode_layoutget() has\nmultiple errors that can result in either an out-of-bounds write or\nleaking uninitialized kernel memory to the client:\n\n - fh_len doesn't account for XDR padding on the file handle data\n - uid and gid lengths use \"8 + len\" but xdr_encode_opaque() actually\n   writes \"4 + xdr_align_size(len)\" bytes\n - ds_len omits the flags and stats_collect_hint fields (8 bytes),\n   while len's header constant overestimates by 8 bytes -- these\n   partially cancel but leave a net mismatch\n\nThe worst case occurs with short strings (e.g. uid=0, gid=0 with an\nodd-sized file handle), where the function writes up to 5 bytes past\nthe reserved XDR buffer. Conversely, when string lengths happen to be\n4-byte aligned, the reservation is too large and stale buffer content\nis sent to the client.\n\nFix this by breaking out every encoded field explicitly in the ds_len\ncalculation, using xdr_align_size() for all variable-length opaque\nfields, and correcting the header constants.","title":"CVE description"}],"product_status":{"recommended":["SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64"]},"references":[{"category":"external","summary":"CVE-2026-89674","url":"https://www.suse.com/security/cve/CVE-2026-89674"},{"category":"external","summary":"SUSE Bug 1280243 for CVE-2026-89674","url":"https://bugzilla.suse.com/1280243"},{"category":"external","summary":"SUSE Bug 1280285 for CVE-2026-89674","url":"https://bugzilla.suse.com/1280285"}],"remediations":[{"category":"vendor_fix","details":"To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n","product_ids":["SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64"]}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64"]}],"threats":[{"category":"impact","date":"2026-10-31T17:04:46Z","details":"important"}],"title":"CVE-2026-89674"},{"cve":"CVE-2026-98432","ids":[{"system_name":"SUSE CVE Page","text":"https://www.suse.com/security/cve/CVE-2026-98432"}],"notes":[{"category":"general","text":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: free inet_opt and ireq_opt after an RCU grace period\n\ntcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the\nchild socket (newinet->inet_opt) without copying it.\n\nAnother cpu can concurrently process a retransmitted SYN for the same\nrequest socket, and send a SYNACK from tcp_check_req().\ntcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt\nunder rcu_read_lock() only, and ip_build_and_send_pkt() and\nip_options_build() then read opt->optlen twice.\n\nNote that the SYNACK timer itself is not an issue: it holds a\nreference on its request socket, and inet_csk_reqsk_queue_drop()\ncalls timer_delete_sync() before the child can be freed.\n\nSince commit 079096f103fa (\"tcp/dccp: install syn_recv requests\ninto ehash table\"), request sockets are processed without holding\nthe listener lock, so nothing prevents the child socket from being\nfreed while the SYNACK is still being built. TCP child sockets do\nnot have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt\nwith a plain kfree(), leading to a use-after-free in\nip_options_build().\n\nA similar issue exists with request socket migration\n(net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE\nprogram). reqsk_timer_handler() clones the request socket with\ninet_reqsk_clone(), so that the old request socket and its clone\nshare the same ireq_opt, then reqsk_migrate_reset() clears the\npointer in the old one. Another cpu holding a reference on the old\nrequest socket can still be using these options (sending a SYNACK,\nor creating a child in tcp_v4_syn_recv_sock()) when the clone is\nfreed, and tcp_v4_reqsk_destructor() also uses a plain kfree().\n\nReaders already use RCU, and other paths replacing inet_opt\n(do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use\nkfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and\ntcp_v4_reqsk_destructor() as well.\n\nIPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock()\nduplicates the options. tcp_v6_reqsk_destructor() has the same\nmigration issue with ipv6_opt, which is only set by CALIPSO. This\nwill be addressed in a separate patch.","title":"CVE description"}],"product_status":{"recommended":["SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64"]},"references":[{"category":"external","summary":"CVE-2026-98432","url":"https://www.suse.com/security/cve/CVE-2026-98432"},{"category":"external","summary":"SUSE Bug 1285685 for CVE-2026-98432","url":"https://bugzilla.suse.com/1285685"},{"category":"external","summary":"SUSE Bug 1285686 for CVE-2026-98432","url":"https://bugzilla.suse.com/1285686"},{"category":"external","summary":"SUSE Bug 1288904 for CVE-2026-98432","url":"https://bugzilla.suse.com/1288904"},{"category":"external","summary":"SUSE Bug 1288918 for CVE-2026-98432","url":"https://bugzilla.suse.com/1288918"},{"category":"external","summary":"SUSE Bug 1289140 for CVE-2026-98432","url":"https://bugzilla.suse.com/1289140"},{"category":"external","summary":"SUSE Bug 1289141 for CVE-2026-98432","url":"https://bugzilla.suse.com/1289141"},{"category":"external","summary":"SUSE Bug 1289274 for CVE-2026-98432","url":"https://bugzilla.suse.com/1289274"}],"remediations":[{"category":"vendor_fix","details":"To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n","product_ids":["SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64"]}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_22-rt-0:16-150700.2.1.x86_64"]}],"threats":[{"category":"impact","date":"2026-10-31T17:04:46Z","details":"important"}],"title":"CVE-2026-98432"}]}