Security update for the Linux Kernel (Live Patch 5 for SUSE Linux Enterprise 15 SP7)
| Announcement ID: | SUSE-SU-2026:2930-1 |
|---|---|
| Release Date: | 2026-07-13T18:35:20Z |
| Rating: | important |
| References: | |
| Cross-References: |
|
| CVSS scores: |
|
| Affected Products: |
|
An update that solves 25 vulnerabilities can now be installed.
Description:
This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.19 fixes various security issues
The following security issues were fixed:
- CVE-2025-71089: iommu: disable SVA when CONFIG_X86 is set (bsc#1256615).
- CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260524).
- CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263094).
- CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262759).
- CVE-2026-31570: can: gw: fix OOB heap access in cgw_csum_crc8_rel() (bsc#1263118).
- CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263177).
- CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263670).
- CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264094).
- CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1264253).
- CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1264252).
- CVE-2026-43037: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (bsc#1265197).
- CVE-2026-43120: RDMA/irdma: Fix double free related to rereg_user_mr (bsc#1264567).
- CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264849).
- CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265117).
- CVE-2026-43437: ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() (bsc#1265127).
- CVE-2026-43494: RDS zerocopy attack aka PinTheft (bsc#1265945).
- CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266015).
- CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267206).
- CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267893).
- CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267723).
- CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267698).
- CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (CIFSwitch) (bsc#1266265).
- CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268662).
- CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269023).
- CVE-2026-53362: ipv6: account for fraggap on the paged allocation path (bsc#1269495).
Patch Instructions:
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
-
SUSE Linux Enterprise Live Patching 15-SP7
zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP7-2026-2927=1 SUSE-SLE-Module-Live-Patching-15-SP7-2026-2928=1 SUSE-SLE-Module-Live-Patching-15-SP7-2026-2919=1 SUSE-SLE-Module-Live-Patching-15-SP7-2026-2918=1 SUSE-SLE-Module-Live-Patching-15-SP7-2026-2930=1 SUSE-SLE-Module-Live-Patching-15-SP7-2026-2929=1 SUSE-SLE-Module-Live-Patching-15-SP7-2026-2921=1
Package List:
-
SUSE Linux Enterprise Live Patching 15-SP7 (ppc64le s390x x86_64)
- kernel-livepatch-SLE15-SP7_Update_1-debugsource-19-150700.2.2
- kernel-livepatch-SLE15-SP7_Update_6-debugsource-9-150700.2.2
- kernel-livepatch-6_4_0-150700_53_6-default-18-150700.2.2
- kernel-livepatch-SLE15-SP7_Update_5-debugsource-11-150700.2.2
- kernel-livepatch-SLE15-SP7_Update_4-debugsource-14-150700.2.2
- kernel-livepatch-6_4_0-150700_51-default-19-150700.3.54.1
- kernel-livepatch-SLE15-SP7_Update_0-debugsource-19-150700.3.54.1
- kernel-livepatch-6_4_0-150700_53_11-default-debuginfo-14-150700.2.2
- kernel-livepatch-6_4_0-150700_53_3-default-19-150700.2.2
- kernel-livepatch-6_4_0-150700_53_16-default-14-150700.2.2
- kernel-livepatch-SLE15-SP7_Update_2-debugsource-18-150700.2.2
- kernel-livepatch-6_4_0-150700_53_16-default-debuginfo-14-150700.2.2
- kernel-livepatch-6_4_0-150700_53_11-default-14-150700.2.2
- kernel-livepatch-SLE15-SP7_Update_3-debugsource-14-150700.2.2
- kernel-livepatch-6_4_0-150700_53_6-default-debuginfo-18-150700.2.2
- kernel-livepatch-6_4_0-150700_51-default-debuginfo-19-150700.3.54.1
- kernel-livepatch-6_4_0-150700_53_19-default-debuginfo-11-150700.2.2
- kernel-livepatch-6_4_0-150700_53_22-default-debuginfo-9-150700.2.2
- kernel-livepatch-6_4_0-150700_53_3-default-debuginfo-19-150700.2.2
- kernel-livepatch-6_4_0-150700_53_19-default-11-150700.2.2
- kernel-livepatch-6_4_0-150700_53_22-default-9-150700.2.2
References:
- https://www.suse.com/security/cve/CVE-2025-71089.html
- https://www.suse.com/security/cve/CVE-2026-23393.html
- https://www.suse.com/security/cve/CVE-2026-31505.html
- https://www.suse.com/security/cve/CVE-2026-31533.html
- https://www.suse.com/security/cve/CVE-2026-31570.html
- https://www.suse.com/security/cve/CVE-2026-31586.html
- https://www.suse.com/security/cve/CVE-2026-31685.html
- https://www.suse.com/security/cve/CVE-2026-31758.html
- https://www.suse.com/security/cve/CVE-2026-43025.html
- https://www.suse.com/security/cve/CVE-2026-43027.html
- https://www.suse.com/security/cve/CVE-2026-43037.html
- https://www.suse.com/security/cve/CVE-2026-43120.html
- https://www.suse.com/security/cve/CVE-2026-43190.html
- https://www.suse.com/security/cve/CVE-2026-43366.html
- https://www.suse.com/security/cve/CVE-2026-43437.html
- https://www.suse.com/security/cve/CVE-2026-43494.html
- https://www.suse.com/security/cve/CVE-2026-43501.html
- https://www.suse.com/security/cve/CVE-2026-45970.html
- https://www.suse.com/security/cve/CVE-2026-46120.html
- https://www.suse.com/security/cve/CVE-2026-46173.html
- https://www.suse.com/security/cve/CVE-2026-46227.html
- https://www.suse.com/security/cve/CVE-2026-46243.html
- https://www.suse.com/security/cve/CVE-2026-52909.html
- https://www.suse.com/security/cve/CVE-2026-52943.html
- https://www.suse.com/security/cve/CVE-2026-53362.html
- https://bugzilla.suse.com/show_bug.cgi?id=1256615
- https://bugzilla.suse.com/show_bug.cgi?id=1260524
- https://bugzilla.suse.com/show_bug.cgi?id=1262759
- https://bugzilla.suse.com/show_bug.cgi?id=1263094
- https://bugzilla.suse.com/show_bug.cgi?id=1263118
- https://bugzilla.suse.com/show_bug.cgi?id=1263177
- https://bugzilla.suse.com/show_bug.cgi?id=1263670
- https://bugzilla.suse.com/show_bug.cgi?id=1264094
- https://bugzilla.suse.com/show_bug.cgi?id=1264252
- https://bugzilla.suse.com/show_bug.cgi?id=1264253
- https://bugzilla.suse.com/show_bug.cgi?id=1264567
- https://bugzilla.suse.com/show_bug.cgi?id=1264849
- https://bugzilla.suse.com/show_bug.cgi?id=1265117
- https://bugzilla.suse.com/show_bug.cgi?id=1265127
- https://bugzilla.suse.com/show_bug.cgi?id=1265197
- https://bugzilla.suse.com/show_bug.cgi?id=1265945
- https://bugzilla.suse.com/show_bug.cgi?id=1266015
- https://bugzilla.suse.com/show_bug.cgi?id=1266265
- https://bugzilla.suse.com/show_bug.cgi?id=1267206
- https://bugzilla.suse.com/show_bug.cgi?id=1267698
- https://bugzilla.suse.com/show_bug.cgi?id=1267723
- https://bugzilla.suse.com/show_bug.cgi?id=1267893
- https://bugzilla.suse.com/show_bug.cgi?id=1268662
- https://bugzilla.suse.com/show_bug.cgi?id=1269023
- https://bugzilla.suse.com/show_bug.cgi?id=1269495