Security update for the Linux Kernel

Announcement ID: SUSE-SU-2026:3156-1
Release Date: 2026-07-21T13:34:56Z
Rating: important
References:
Cross-References:
CVSS scores:
  • CVE-2026-43109 ( SUSE ): 7.3 CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CVE-2026-43109 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-43109 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2026-46052 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-46052 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • CVE-2026-46071 ( SUSE ): 9.3 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
  • CVE-2026-46071 ( SUSE ): 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
  • CVE-2026-46071 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2026-46076 ( SUSE ): 8.3 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:H
  • CVE-2026-46076 ( SUSE ): 7.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
  • CVE-2026-46076 ( NVD ): 7.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
  • CVE-2026-46116 ( SUSE ): 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CVE-2026-46116 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-46116 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-46116 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-46173 ( SUSE ): 7.3 CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CVE-2026-46173 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-46173 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-46229 ( SUSE ): 6.9 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
  • CVE-2026-46229 ( SUSE ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
  • CVE-2026-46229 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2026-46242 ( SUSE ): 8.9 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
  • CVE-2026-46242 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-46242 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-46253 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2026-46253 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-46266 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-46266 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
  • CVE-2026-46274 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-46274 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-46289 ( SUSE ): 6.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  • CVE-2026-46289 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2026-46289 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-46319 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-46319 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-46320 ( SUSE ): 4.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
  • CVE-2026-46320 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
  • CVE-2026-46320 ( NVD ): 7.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
  • CVE-2026-46330 ( SUSE ): 7.3 CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CVE-2026-46330 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-46330 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-46331 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
  • CVE-2026-46331 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-46331 ( NVD ): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-52909 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
  • CVE-2026-52909 ( SUSE ): 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
  • CVE-2026-52909 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-52918 ( SUSE ): 8.6 CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CVE-2026-52918 ( SUSE ): 7.1 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-52918 ( NVD ): 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-52923 ( SUSE ): 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CVE-2026-52923 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-52923 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-52923 ( NVD ): 5.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
  • CVE-2026-52924 ( SUSE ): 8.3 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
  • CVE-2026-52924 ( SUSE ): 7.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
  • CVE-2026-52924 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-52924 ( NVD ): 7.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
  • CVE-2026-52933 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2026-52933 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-52943 ( SUSE ): 7.3 CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CVE-2026-52943 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-52943 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-52943 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-52955 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • CVE-2026-52955 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-52955 ( NVD ): 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2026-52956 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • CVE-2026-52956 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • CVE-2026-52958 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • CVE-2026-52958 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
  • CVE-2026-52969 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-52969 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-52969 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-52972 ( SUSE ): 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CVE-2026-52972 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-52972 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-52972 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2026-52993 ( SUSE ): 9.2 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CVE-2026-52993 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-52993 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-52993 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-53016 ( SUSE ): 7.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
  • CVE-2026-53016 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-53016 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-53041 ( SUSE ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
  • CVE-2026-53041 ( NVD ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
  • CVE-2026-53052 ( SUSE ): 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CVE-2026-53052 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-53052 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2026-53053 ( SUSE ): 7.3 CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CVE-2026-53053 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-53053 ( NVD ): 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
  • CVE-2026-53071 ( SUSE ): 7.1 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-53071 ( NVD ): 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-53071 ( NVD ): 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-53072 ( SUSE ): 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-53072 ( NVD ): 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-53133 ( SUSE ): 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CVE-2026-53133 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-53133 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-53178 ( SUSE ): 7.1 CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
  • CVE-2026-53178 ( SUSE ): 7.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
  • CVE-2026-53178 ( NVD ): 8.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
  • CVE-2026-53182 ( SUSE ): 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CVE-2026-53182 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-53182 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-53196 ( SUSE ): 7.0 CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CVE-2026-53196 ( SUSE ): 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-53196 ( NVD ): 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-53196 ( NVD ): 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-53253 ( SUSE ): 7.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
  • CVE-2026-53253 ( NVD ): 7.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
  • CVE-2026-53256 ( SUSE ): 7.7 CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CVE-2026-53256 ( SUSE ): 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-53256 ( NVD ): 8.0 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-53357 ( SUSE ): 7.3 CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CVE-2026-53357 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-53357 ( NVD ): 8.0 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-53359 ( SUSE ): 9.3 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
  • CVE-2026-53359 ( SUSE ): 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
  • CVE-2026-53359 ( NVD ): 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
  • CVE-2026-53362 ( SUSE ): 9.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
  • CVE-2026-53362 ( SUSE ): 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
  • CVE-2026-53362 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2026-53366 ( SUSE ): 9.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
  • CVE-2026-53366 ( SUSE ): 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
  • CVE-2026-53366 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products:
  • openSUSE Leap 15.6
  • SUSE Linux Enterprise High Availability Extension 15 SP6
  • SUSE Linux Enterprise Live Patching 15-SP6
  • SUSE Linux Enterprise Real Time 15 SP6
  • SUSE Linux Enterprise Server 15 SP6
  • SUSE Linux Enterprise Server 15 SP6 LTSS
  • SUSE Linux Enterprise Server for SAP Applications 15 SP6

An update that solves 44 vulnerabilities, contains two features and has five security fixes can now be installed.

Description:

The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues

The following security issues were fixed:

  • CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).
  • CVE-2026-46052: ceph: only d_add() negative dentries when they are unhashed (bsc#1267494).
  • CVE-2026-46071: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 (bsc#1267591).
  • CVE-2026-46076: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (bsc#1267365).
  • CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267369).
  • CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267722).
  • CVE-2026-46229: drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure (bsc#1267567).
  • CVE-2026-46242: eventpoll: Fix integer overflow in ep_loop_check_proc() (bsc#1267618).
  • CVE-2026-46253: pstore/ram: fix buffer overflow in persistent_ram_save_old() (bsc#1267635).
  • CVE-2026-46266: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (bsc#1267684).
  • CVE-2026-46289: lib/scatterlist: fix length calculations in extract_kvec_to_sg (bsc#1267966).
  • CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268022).
  • CVE-2026-46320: tap: free page on error paths in tap_get_user_xdp() (bsc#1267993).
  • CVE-2026-46330: Revert "net/smc: Introduce TCP ULP support" (bsc#1268049).
  • CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268660).
  • CVE-2026-52918: Bluetooth: serialize accept_q access (bsc#1269100).
  • CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269033).
  • CVE-2026-52924: sctp: purge outqueue on stale COOKIE-ECHO handling (bsc#1269036).
  • CVE-2026-52933: io_uring/poll: fix signed comparison in io_poll_get_ownership() (bsc#1268989).
  • CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269022).
  • CVE-2026-52955: libceph: Fix potential out-of-bounds access in crush_decode() (bsc#1269159).
  • CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1269172).
  • CVE-2026-52958: libceph: Fix potential out-of-bounds access in osdmap_decode() (bsc#1269174).
  • CVE-2026-52969: KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (bsc#1269184).
  • CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269195).
  • CVE-2026-52993: tipc: fix double-free in tipc_buf_append() (bsc#1269193).
  • CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269090).
  • CVE-2026-53041: ocfs2: fix listxattr handling when the buffer is full (bsc#1269398).
  • CVE-2026-53052: ASoC: qcom: qdsp6: topology: check widget type before accessing data (bsc#1269314).
  • CVE-2026-53053: iommu/amd: Fix clone_alias() to use the original device's devid (bsc#1269310).
  • CVE-2026-53071: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (bsc#1269678).
  • CVE-2026-53072: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (bsc#1269681).
  • CVE-2026-53133: RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1269821).
  • CVE-2026-53178: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction (bsc#1269795).
  • CVE-2026-53182: wifi: nl80211: reject oversized EMA RNR lists (bsc#1269884).
  • CVE-2026-53196: USB: serial: io_ti: fix heap overflow in get_manuf_info() (bsc#1269986).
  • CVE-2026-53253: Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling (bsc#1269574).
  • CVE-2026-53256: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (bsc#1269993).
  • CVE-2026-53357: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (bsc#1270257).
  • CVE-2026-53359: KVM: x86: Fix shadow paging use-after-free due to unexpected role (bsc#1270059).
  • CVE-2026-53362: ipv6: account for fraggap on the paged allocation path (bsc#1269493).
  • CVE-2026-53366: ipv4: account for fraggap on the paged allocation path (bsc#1271366).

The following non security issues were fixed:

  • hv_balloon: Simplify data output in hv_balloon_debug_show() (git-fixes).
  • ipv4: account for fraggap on the paged allocation path (git-fixes).
  • ipv6: account for fraggap on the paged allocation path (git-fixes).
  • KVM: x86/mmu: Recover TDP MMU NX huge pages using MMU read lock (bsc#1271050).
  • KVM: x86/mmu: Rename kvm_tdp_mmu_zap_sp() to better indicate its purpose (bsc#1271050).
  • KVM: x86/mmu: Track possible NX huge pages separately for TDP vs. Shadow MMU (bsc#1271050).
  • KVM: x86: Fix shadow paging use-after-free due to unexpected role (git-fixes).
  • loadpin: Prevent SECURITY_LOADPIN_ENFORCE=y without module decompression (jsc#PED-16303).
  • loadpin: remove MODULE_COMPRESS_NONE as it is no longer supported (jsc#PED-16303).
  • module: fix init_module_from_file() error handling (jsc#PED-16303).
  • module: make waiting for a concurrent module loader interruptible (jsc#PED-16303).
  • module: Split modules_install compression and in-kernel decompression (jsc#PED-16303).
  • module: split up 'finit_module()' into init_module_from_file() helper (jsc#PED-16303).
  • module: warn about excessively long module waits (jsc#PED-16303).
  • modules: catch concurrent module loads, treat them as idempotent (jsc#PED-16303).
  • net: mana: Add support for PF device 0x00C1 (bsc#1268237).
  • net: mana: Allocate interrupt context for each EQ when creating vPort (git-fixes).
  • net: mana: Create separate EQs for each vPort (git-fixes).
  • net: mana: Fall back to standard MTU when PF reports adapter_mtu of 0 (git-fixes).
  • net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check (git-fixes).
  • net: mana: initialize gdma queue id to INVALID_QUEUE_ID (git-fixes).
  • net: mana: Introduce GIC context with refcounting for interrupt management (git-fixes).
  • net: mana: Optimize irq affinity for low vcpu configs (git-fixes).
  • net: mana: Query device capabilities and configure MSI-X sharing for EQs (git-fixes).
  • net: mana: Use GIC functions to allocate global EQs (git-fixes).
  • RDMA/mana_ib: Allocate interrupt contexts on EQs (git-fixes).
  • RDMA/mana_ib: Use ib_get_eth_speed for reporting port speed (git-fixes).
  • scsi: storvsc: Replace symbolic permissions with octal (git-fixes).
  • scsi: target: Fix hexadecimal CHAP_I handling (git-fixes).
  • x86/platform/uv: Expose the uv_hub_type() interface (jsc#PED-16305).
  • x86/tsc: Disable clocksource watchdog checking on recent and future UV platforms (jsc#PED-16305).

Special Instructions and Notes:

  • Please reboot the system after installing this update.

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE Linux Enterprise High Availability Extension 15 SP6
    zypper in -t patch SUSE-SLE-Product-HA-15-SP6-2026-3156=1
  • SUSE Linux Enterprise Live Patching 15-SP6
    zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP6-2026-3156=1
  • SUSE Linux Enterprise Server 15 SP6 LTSS
    zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-3156=1
  • openSUSE Leap 15.6
    zypper in -t patch SUSE-2026-3156=1
  • SUSE Linux Enterprise Server for SAP Applications 15 SP6
    zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-3156=1

Package List:

  • openSUSE Leap 15.6 (aarch64)
    • dtb-apm-6.4.0-150600.23.125.1
    • dtb-lg-6.4.0-150600.23.125.1
    • kernel-64kb-optional-debuginfo-6.4.0-150600.23.125.1
    • kselftests-kmp-64kb-debuginfo-6.4.0-150600.23.125.1
    • dlm-kmp-64kb-6.4.0-150600.23.125.1
    • dtb-amazon-6.4.0-150600.23.125.1
    • cluster-md-kmp-64kb-debuginfo-6.4.0-150600.23.125.1
    • dtb-amlogic-6.4.0-150600.23.125.1
    • dtb-amd-6.4.0-150600.23.125.1
    • kernel-64kb-debuginfo-6.4.0-150600.23.125.1
    • dtb-sprd-6.4.0-150600.23.125.1
    • kernel-64kb-extra-debuginfo-6.4.0-150600.23.125.1
    • dtb-nvidia-6.4.0-150600.23.125.1
    • dtb-xilinx-6.4.0-150600.23.125.1
    • dtb-mediatek-6.4.0-150600.23.125.1
    • kernel-64kb-extra-6.4.0-150600.23.125.1
    • ocfs2-kmp-64kb-6.4.0-150600.23.125.1
    • reiserfs-kmp-64kb-debuginfo-6.4.0-150600.23.125.1
    • ocfs2-kmp-64kb-debuginfo-6.4.0-150600.23.125.1
    • kernel-64kb-debugsource-6.4.0-150600.23.125.1
    • dtb-renesas-6.4.0-150600.23.125.1
    • dtb-arm-6.4.0-150600.23.125.1
    • kernel-64kb-devel-debuginfo-6.4.0-150600.23.125.1
    • dtb-broadcom-6.4.0-150600.23.125.1
    • dtb-altera-6.4.0-150600.23.125.1
    • kselftests-kmp-64kb-6.4.0-150600.23.125.1
    • kernel-64kb-optional-6.4.0-150600.23.125.1
    • dtb-qcom-6.4.0-150600.23.125.1
    • cluster-md-kmp-64kb-6.4.0-150600.23.125.1
    • dtb-hisilicon-6.4.0-150600.23.125.1
    • gfs2-kmp-64kb-debuginfo-6.4.0-150600.23.125.1
    • dtb-allwinner-6.4.0-150600.23.125.1
    • dtb-exynos-6.4.0-150600.23.125.1
    • dtb-apple-6.4.0-150600.23.125.1
    • dtb-marvell-6.4.0-150600.23.125.1
    • kernel-64kb-devel-6.4.0-150600.23.125.1
    • dtb-cavium-6.4.0-150600.23.125.1
    • reiserfs-kmp-64kb-6.4.0-150600.23.125.1
    • dtb-freescale-6.4.0-150600.23.125.1
    • dtb-rockchip-6.4.0-150600.23.125.1
    • dlm-kmp-64kb-debuginfo-6.4.0-150600.23.125.1
    • gfs2-kmp-64kb-6.4.0-150600.23.125.1
    • dtb-socionext-6.4.0-150600.23.125.1
  • openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64)
    • kernel-default-livepatch-6.4.0-150600.23.125.1
    • kernel-default-extra-debuginfo-6.4.0-150600.23.125.1
    • kernel-default-optional-debuginfo-6.4.0-150600.23.125.1
    • kselftests-kmp-default-6.4.0-150600.23.125.1
    • kernel-default-devel-6.4.0-150600.23.125.1
    • kernel-default-debuginfo-6.4.0-150600.23.125.1
    • dlm-kmp-default-6.4.0-150600.23.125.1
    • reiserfs-kmp-default-6.4.0-150600.23.125.1
    • kernel-obs-build-debugsource-6.4.0-150600.23.125.1
    • kernel-default-debugsource-6.4.0-150600.23.125.1
    • kernel-obs-build-6.4.0-150600.23.125.1
    • cluster-md-kmp-default-debuginfo-6.4.0-150600.23.125.1
    • ocfs2-kmp-default-debuginfo-6.4.0-150600.23.125.1
    • kselftests-kmp-default-debuginfo-6.4.0-150600.23.125.1
    • kernel-syms-6.4.0-150600.23.125.1
    • kernel-default-optional-6.4.0-150600.23.125.1
    • dlm-kmp-default-debuginfo-6.4.0-150600.23.125.1
    • cluster-md-kmp-default-6.4.0-150600.23.125.1
    • ocfs2-kmp-default-6.4.0-150600.23.125.1
    • reiserfs-kmp-default-debuginfo-6.4.0-150600.23.125.1
    • kernel-default-devel-debuginfo-6.4.0-150600.23.125.1
    • gfs2-kmp-default-debuginfo-6.4.0-150600.23.125.1
    • kernel-obs-qa-6.4.0-150600.23.125.1
    • kernel-default-extra-6.4.0-150600.23.125.1
    • gfs2-kmp-default-6.4.0-150600.23.125.1
  • openSUSE Leap 15.6 (aarch64 ppc64le x86_64)
    • kernel-kvmsmall-devel-debuginfo-6.4.0-150600.23.125.1
    • kernel-kvmsmall-devel-6.4.0-150600.23.125.1
    • kernel-kvmsmall-debuginfo-6.4.0-150600.23.125.1
    • kernel-default-base-6.4.0-150600.23.125.1.150600.12.58.3
    • kernel-default-base-rebuild-6.4.0-150600.23.125.1.150600.12.58.3
    • kernel-kvmsmall-debugsource-6.4.0-150600.23.125.1
  • openSUSE Leap 15.6 (noarch)
    • kernel-source-vanilla-6.4.0-150600.23.125.1
    • kernel-macros-6.4.0-150600.23.125.1
    • kernel-devel-6.4.0-150600.23.125.1
    • kernel-docs-html-6.4.0-150600.23.125.1
    • kernel-source-6.4.0-150600.23.125.1
  • openSUSE Leap 15.6 (nosrc s390x)
    • kernel-zfcpdump-6.4.0-150600.23.125.1
  • openSUSE Leap 15.6 (ppc64le s390x x86_64)
    • kernel-livepatch-SLE15-SP6_Update_29-debugsource-1-150600.13.7.1
    • kernel-livepatch-6_4_0-150600_23_125-default-1-150600.13.7.1
    • kernel-livepatch-6_4_0-150600_23_125-default-debuginfo-1-150600.13.7.1
    • kernel-default-livepatch-devel-6.4.0-150600.23.125.1
  • openSUSE Leap 15.6 (aarch64 nosrc ppc64le x86_64)
    • kernel-kvmsmall-6.4.0-150600.23.125.1
  • openSUSE Leap 15.6 (aarch64 nosrc ppc64le s390x x86_64)
    • kernel-default-6.4.0-150600.23.125.1
  • openSUSE Leap 15.6 (ppc64le x86_64)
    • kernel-debug-debugsource-6.4.0-150600.23.125.1
    • kernel-debug-devel-debuginfo-6.4.0-150600.23.125.1
    • kernel-debug-devel-6.4.0-150600.23.125.1
    • kernel-debug-debuginfo-6.4.0-150600.23.125.1
  • openSUSE Leap 15.6 (nosrc)
    • dtb-aarch64-6.4.0-150600.23.125.1
  • openSUSE Leap 15.6 (noarch nosrc)
    • kernel-docs-6.4.0-150600.23.125.1
  • openSUSE Leap 15.6 (aarch64 nosrc)
    • kernel-64kb-6.4.0-150600.23.125.1
  • openSUSE Leap 15.6 (nosrc ppc64le x86_64)
    • kernel-debug-6.4.0-150600.23.125.1
  • openSUSE Leap 15.6 (s390x)
    • kernel-zfcpdump-debuginfo-6.4.0-150600.23.125.1
    • kernel-zfcpdump-debugsource-6.4.0-150600.23.125.1
  • openSUSE Leap 15.6 (x86_64)
    • kernel-debug-vdso-debuginfo-6.4.0-150600.23.125.1
    • kernel-kvmsmall-vdso-6.4.0-150600.23.125.1
    • kernel-kvmsmall-vdso-debuginfo-6.4.0-150600.23.125.1
    • kernel-default-vdso-6.4.0-150600.23.125.1
    • kernel-debug-vdso-6.4.0-150600.23.125.1
    • kernel-default-vdso-debuginfo-6.4.0-150600.23.125.1
  • SUSE Linux Enterprise Server 15 SP6 LTSS (noarch nosrc)
    • kernel-docs-6.4.0-150600.23.125.1
  • SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64)
    • kernel-syms-6.4.0-150600.23.125.1
    • kernel-default-devel-6.4.0-150600.23.125.1
    • kernel-default-debuginfo-6.4.0-150600.23.125.1
    • dlm-kmp-default-6.4.0-150600.23.125.1
    • reiserfs-kmp-default-6.4.0-150600.23.125.1
    • kernel-obs-build-debugsource-6.4.0-150600.23.125.1
    • cluster-md-kmp-default-6.4.0-150600.23.125.1
    • dlm-kmp-default-debuginfo-6.4.0-150600.23.125.1
    • kernel-default-debugsource-6.4.0-150600.23.125.1
    • kernel-obs-build-6.4.0-150600.23.125.1
    • reiserfs-kmp-default-debuginfo-6.4.0-150600.23.125.1
    • ocfs2-kmp-default-6.4.0-150600.23.125.1
    • cluster-md-kmp-default-debuginfo-6.4.0-150600.23.125.1
    • gfs2-kmp-default-6.4.0-150600.23.125.1
    • ocfs2-kmp-default-debuginfo-6.4.0-150600.23.125.1
    • kernel-default-devel-debuginfo-6.4.0-150600.23.125.1
    • gfs2-kmp-default-debuginfo-6.4.0-150600.23.125.1
  • SUSE Linux Enterprise Server 15 SP6 LTSS (noarch)
    • kernel-macros-6.4.0-150600.23.125.1
    • kernel-devel-6.4.0-150600.23.125.1
    • kernel-source-6.4.0-150600.23.125.1
  • SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 nosrc ppc64le s390x x86_64)
    • kernel-default-6.4.0-150600.23.125.1
  • SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 nosrc)
    • kernel-64kb-6.4.0-150600.23.125.1
  • SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64)
    • kernel-64kb-debugsource-6.4.0-150600.23.125.1
    • kernel-64kb-debuginfo-6.4.0-150600.23.125.1
    • kernel-64kb-devel-6.4.0-150600.23.125.1
    • kernel-64kb-devel-debuginfo-6.4.0-150600.23.125.1
  • SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le x86_64)
    • kernel-default-base-6.4.0-150600.23.125.1.150600.12.58.3
  • SUSE Linux Enterprise Server 15 SP6 LTSS (s390x)
    • kernel-zfcpdump-debuginfo-6.4.0-150600.23.125.1
    • kernel-zfcpdump-debugsource-6.4.0-150600.23.125.1
  • SUSE Linux Enterprise Server 15 SP6 LTSS (nosrc s390x)
    • kernel-zfcpdump-6.4.0-150600.23.125.1
  • SUSE Linux Enterprise Server for SAP Applications 15 SP6 (nosrc ppc64le x86_64)
    • kernel-default-6.4.0-150600.23.125.1
  • SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64)
    • kernel-syms-6.4.0-150600.23.125.1
    • kernel-default-devel-6.4.0-150600.23.125.1
    • kernel-default-debuginfo-6.4.0-150600.23.125.1
    • dlm-kmp-default-6.4.0-150600.23.125.1
    • reiserfs-kmp-default-6.4.0-150600.23.125.1
    • kernel-obs-build-debugsource-6.4.0-150600.23.125.1
    • dlm-kmp-default-debuginfo-6.4.0-150600.23.125.1
    • cluster-md-kmp-default-6.4.0-150600.23.125.1
    • kernel-default-debugsource-6.4.0-150600.23.125.1
    • kernel-obs-build-6.4.0-150600.23.125.1
    • reiserfs-kmp-default-debuginfo-6.4.0-150600.23.125.1
    • ocfs2-kmp-default-6.4.0-150600.23.125.1
    • cluster-md-kmp-default-debuginfo-6.4.0-150600.23.125.1
    • gfs2-kmp-default-6.4.0-150600.23.125.1
    • ocfs2-kmp-default-debuginfo-6.4.0-150600.23.125.1
    • kernel-default-base-6.4.0-150600.23.125.1.150600.12.58.3
    • kernel-default-devel-debuginfo-6.4.0-150600.23.125.1
    • gfs2-kmp-default-debuginfo-6.4.0-150600.23.125.1
  • SUSE Linux Enterprise Server for SAP Applications 15 SP6 (noarch)
    • kernel-macros-6.4.0-150600.23.125.1
    • kernel-devel-6.4.0-150600.23.125.1
    • kernel-source-6.4.0-150600.23.125.1
  • SUSE Linux Enterprise Server for SAP Applications 15 SP6 (noarch nosrc)
    • kernel-docs-6.4.0-150600.23.125.1
  • SUSE Linux Enterprise Live Patching 15-SP6 (ppc64le s390x x86_64)
    • kernel-default-debuginfo-6.4.0-150600.23.125.1
    • kernel-default-livepatch-6.4.0-150600.23.125.1
    • kernel-livepatch-6_4_0-150600_23_125-default-debuginfo-1-150600.13.7.1
    • kernel-default-debugsource-6.4.0-150600.23.125.1
    • kernel-default-livepatch-devel-6.4.0-150600.23.125.1
    • kernel-livepatch-SLE15-SP6_Update_29-debugsource-1-150600.13.7.1
    • kernel-livepatch-6_4_0-150600_23_125-default-1-150600.13.7.1
  • SUSE Linux Enterprise Live Patching 15-SP6 (nosrc)
    • kernel-default-6.4.0-150600.23.125.1
  • SUSE Linux Enterprise High Availability Extension 15 SP6 (aarch64 ppc64le s390x x86_64)
    • kernel-default-debugsource-6.4.0-150600.23.125.1
    • kernel-default-debuginfo-6.4.0-150600.23.125.1
  • SUSE Linux Enterprise High Availability Extension 15 SP6 (nosrc)
    • kernel-default-6.4.0-150600.23.125.1

References: