SUSE-SU-2026:23534-1
Vulnerability from csaf_suse - Published: 2026-09-08 13:50 - Updated: 2026-09-15 07:40Summary
Security update for the Linux Kernel (Live Patch 24 for SUSE Linux Enterprise Micro 6.0)
Severity
Important
Notes
Title of the patch: Security update for the Linux Kernel (Live Patch 24 for SUSE Linux Enterprise Micro 6.0)
Description of the patch:
This update for the SUSE Linux Enterprise Kernel 6.4.0-47.1 fixes various security issues:
The following security issues were fixed:
- CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267362).
- CVE-2026-46242: eventpoll: fix ep_remove struct eventpoll / struct file UAF (bsc#1270300).
- CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268281).
- CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269034).
- CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1272139).
- CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269196).
- CVE-2026-53133: RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1269822).
- CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1270023).
- CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1270024).
- CVE-2026-64530: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_hand (bsc#1271867).
- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (RefluXFS) (bsc#1271543).
Patchnames: SUSE-SLE-Micro-6.1-kernel-609
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
8.2 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.8 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2026-46037
Threats
Impact
important
Affected products
Recommended
2 products, the same list as for
CVE-2026-46037
Threats
Impact
important
7.8 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2026-46037
Threats
Impact
important
7.5 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2026-46037
Threats
Impact
important
7.8 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2026-46037
Threats
Impact
important
7.8 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2026-46037
Threats
Impact
important
Affected products
Recommended
2 products, the same list as for
CVE-2026-46037
Threats
Impact
important
8.6 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2026-46037
Threats
Impact
important
Affected products
Recommended
2 products, the same list as for
CVE-2026-46037
Threats
Impact
important
7.8 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2026-46037
Threats
Impact
important
References
61 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for the Linux Kernel (Live Patch 24 for SUSE Linux Enterprise Micro 6.0)",
"title": "Title of the patch"
},
{
"category": "description",
"text": "\nThis update for the SUSE Linux Enterprise Kernel 6.4.0-47.1 fixes various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267362).\n- CVE-2026-46242: eventpoll: fix ep_remove struct eventpoll / struct file UAF (bsc#1270300).\n- CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268281).\n- CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269034).\n- CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1272139).\n- CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269196).\n- CVE-2026-53133: RDMA/umem: Fix truncation for block sizes \u003e= 4G (bsc#1269822).\n- CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1270023).\n- CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1270024).\n- CVE-2026-64530: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_hand (bsc#1271867).\n- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (RefluXFS) (bsc#1271543).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-Micro-6.1-kernel-609",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_23534-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:23534-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202623534-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:23534-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-September/029019.html"
},
{
"category": "self",
"summary": "SUSE Bug 1267362",
"url": "https://bugzilla.suse.com/1267362"
},
{
"category": "self",
"summary": "SUSE Bug 1268281",
"url": "https://bugzilla.suse.com/1268281"
},
{
"category": "self",
"summary": "SUSE Bug 1269034",
"url": "https://bugzilla.suse.com/1269034"
},
{
"category": "self",
"summary": "SUSE Bug 1269196",
"url": "https://bugzilla.suse.com/1269196"
},
{
"category": "self",
"summary": "SUSE Bug 1269822",
"url": "https://bugzilla.suse.com/1269822"
},
{
"category": "self",
"summary": "SUSE Bug 1270023",
"url": "https://bugzilla.suse.com/1270023"
},
{
"category": "self",
"summary": "SUSE Bug 1270024",
"url": "https://bugzilla.suse.com/1270024"
},
{
"category": "self",
"summary": "SUSE Bug 1270300",
"url": "https://bugzilla.suse.com/1270300"
},
{
"category": "self",
"summary": "SUSE Bug 1271543",
"url": "https://bugzilla.suse.com/1271543"
},
{
"category": "self",
"summary": "SUSE Bug 1271867",
"url": "https://bugzilla.suse.com/1271867"
},
{
"category": "self",
"summary": "SUSE Bug 1272139",
"url": "https://bugzilla.suse.com/1272139"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46037 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46037/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46242 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46242/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46319 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46319/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-52923 page",
"url": "https://www.suse.com/security/cve/CVE-2026-52923/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-52956 page",
"url": "https://www.suse.com/security/cve/CVE-2026-52956/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-52972 page",
"url": "https://www.suse.com/security/cve/CVE-2026-52972/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-53133 page",
"url": "https://www.suse.com/security/cve/CVE-2026-53133/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-53224 page",
"url": "https://www.suse.com/security/cve/CVE-2026-53224/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-53246 page",
"url": "https://www.suse.com/security/cve/CVE-2026-53246/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-64530 page",
"url": "https://www.suse.com/security/cve/CVE-2026-64530/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-64600 page",
"url": "https://www.suse.com/security/cve/CVE-2026-64600/"
}
],
"title": "Security update for the Linux Kernel (Live Patch 24 for SUSE Linux Enterprise Micro 6.0)",
"tracking": {
"current_release_date": "2026-09-15T07:40:37Z",
"generator": {
"date": "2026-09-08T13:50:06Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:23534-1",
"initial_release_date": "2026-09-08T13:50:06Z",
"revision_history": [
{
"date": "2026-09-08T13:50:06Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-15T07:40:37Z",
"number": "2",
"summary": "unknown changes"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "kernel-livepatch-6_4_0-47-default-4-1.1.s390x",
"product": {
"name": "kernel-livepatch-6_4_0-47-default-4-1.1.s390x",
"product_id": "kernel-livepatch-6_4_0-47-default-4-1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "kernel-livepatch-6_4_0-47-default-4-1.1.x86_64",
"product": {
"name": "kernel-livepatch-6_4_0-47-default-4-1.1.x86_64",
"product_id": "kernel-livepatch-6_4_0-47-default-4-1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.1",
"product": {
"name": "SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.1"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_4_0-47-default-4-1.1.s390x as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.s390x"
},
"product_reference": "kernel-livepatch-6_4_0-47-default-4-1.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_4_0-47-default-4-1.1.x86_64 as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.x86_64"
},
"product_reference": "kernel-livepatch-6_4_0-47-default-4-1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-46037",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46037"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: icmp: validate reply type before using icmp_pointers\n\nExtended echo replies use ICMP_EXT_ECHOREPLY as the outbound reply type.\nThat value is outside the range covered by icmp_pointers[], which only\ndescribes the traditional ICMP types up to NR_ICMP_TYPES.\n\nAvoid consulting icmp_pointers[] for reply types outside that range, and\nuse array_index_nospec() for the remaining in-range lookup. Normal ICMP\nreplies keep their existing behavior unchanged.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.s390x",
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46037",
"url": "https://www.suse.com/security/cve/CVE-2026-46037"
},
{
"category": "external",
"summary": "SUSE Bug 1267361 for CVE-2026-46037",
"url": "https://bugzilla.suse.com/1267361"
},
{
"category": "external",
"summary": "SUSE Bug 1267362 for CVE-2026-46037",
"url": "https://bugzilla.suse.com/1267362"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.s390x",
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.s390x",
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T13:50:06Z",
"details": "important"
}
],
"title": "CVE-2026-46037"
},
{
"cve": "CVE-2026-46242",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46242"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\neventpoll: fix ep_remove struct eventpoll / struct file UAF\n\nep_remove() (via ep_remove_file()) cleared file-\u003ef_ep under\nfile-\u003ef_lock but then kept using @file inside the critical section\n(is_file_epoll(), hlist_del_rcu() through the head, spin_unlock).\nA concurrent __fput() taking the eventpoll_release() fastpath in\nthat window observed the transient NULL, skipped\neventpoll_release_file() and ran to f_op-\u003erelease / file_free().\n\nFor the epoll-watches-epoll case, f_op-\u003erelease is\nep_eventpoll_release() -\u003e ep_clear_and_put() -\u003e ep_free(), which\nkfree()s the watched struct eventpoll. Its embedded -\u003erefs\nhlist_head is exactly where epi-\u003efllink.pprev points, so the\nsubsequent hlist_del_rcu()\u0027s \"*pprev = next\" scribbles into freed\nkmalloc-192 memory.\n\nIn addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot\nbacking @file could be recycled by alloc_empty_file() --\nreinitializing f_lock and f_ep -- while ep_remove() is still\nnominally inside that lock. The upshot is an attacker-controllable\nkmem_cache_free() against the wrong slab cache.\n\nPin @file via epi_fget() at the top of ep_remove() and gate the\ncritical section on the pin succeeding. With the pin held @file\ncannot reach refcount zero, which holds __fput() off and\ntransitively keeps the watched struct eventpoll alive across the\nhlist_del_rcu() and the f_lock use, closing both UAFs.\n\nIf the pin fails @file has already reached refcount zero and its\n__fput() is in flight. Because we bailed before clearing f_ep,\nthat path takes the eventpoll_release() slow path into\neventpoll_release_file() and blocks on ep-\u003emtx until the waiter\nside\u0027s ep_clear_and_put() drops it. The bailed epi\u0027s share of\nep-\u003erefcount stays intact, so the trailing ep_refcount_dec_and_test()\nin ep_clear_and_put() cannot free the eventpoll out from under\neventpoll_release_file(); the orphaned epi is then cleaned up\nthere.\n\nA successful pin also proves we are not racing\neventpoll_release_file() on this epi, so drop the now-redundant\nre-check of epi-\u003edying under f_lock. The cheap lockless\nREAD_ONCE(epi-\u003edying) fast-path bailout stays.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.s390x",
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46242",
"url": "https://www.suse.com/security/cve/CVE-2026-46242"
},
{
"category": "external",
"summary": "SUSE Bug 1267618 for CVE-2026-46242",
"url": "https://bugzilla.suse.com/1267618"
},
{
"category": "external",
"summary": "SUSE Bug 1270352 for CVE-2026-46242",
"url": "https://bugzilla.suse.com/1270352"
},
{
"category": "external",
"summary": "SUSE Bug 1271279 for CVE-2026-46242",
"url": "https://bugzilla.suse.com/1271279"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.s390x",
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.s390x",
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T13:50:06Z",
"details": "important"
}
],
"title": "CVE-2026-46242"
},
{
"cve": "CVE-2026-46319",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46319"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ct: Only release RCU read lock after ct_ft\n\nWhen looking up a flow table in act_ct in tcf_ct_flow_table_get(),\nrhashtable_lookup_fast() internally opens and closes an RCU read critical\nsection before returning ct_ft.\nThe tcf_ct_flow_table_cleanup_work() can complete before refcount_inc_not_zero()\nis invoked on the returned ct_ft resulting in a UAF on the already freed ct_ft\nobject. This vulnerability can lead to privilege escalation.\n\nAnalysis from zdi-disclosures@trendmicro.com:\nWhen initializing act_ct, tcf_ct_init() is called, which internally triggers\ntcf_ct_flow_table_get().\n\nstatic int tcf_ct_flow_table_get(struct net *net, struct tcf_ct_params *params)\n\n{\n struct zones_ht_key key = { .net = net, .zone = params-\u003ezone };\n struct tcf_ct_flow_table *ct_ft;\n int err = -ENOMEM;\n\n mutex_lock(\u0026zones_mutex);\n ct_ft = rhashtable_lookup_fast(\u0026zones_ht, \u0026key, zones_params); // [1]\n if (ct_ft \u0026\u0026 refcount_inc_not_zero(\u0026ct_ft-\u003eref)) // [2]\n goto out_unlock;\n ...\n}\n\nstatic __always_inline void *rhashtable_lookup_fast(\n struct rhashtable *ht, const void *key,\n const struct rhashtable_params params)\n{\n void *obj;\n\n rcu_read_lock();\n obj = rhashtable_lookup(ht, key, params);\n rcu_read_unlock();\n\n return obj;\n}\n\nAt [1], rhashtable_lookup_fast() looks up and returns the corresponding ct_ft\nfrom zones_ht . The lookup is performed within an RCU read critical section\nthrough rcu_read_lock() / rcu_read_unlock(), which prevents the object from\nbeing freed. However, at the point of function return, rcu_read_unlock() has\nalready been called, and there is nothing preventing ct_ft from being freed\nbefore reaching refcount_inc_not_zero(\u0026ct_ft-\u003eref) at [2]. This interval becomes\nthe race window, during which ct_ft can be freed.\n\nFree Process:\n\ntcf_ct_flow_table_put() is executed through the path tcf_ct_cleanup() call_rcu()\ntcf_ct_params_free_rcu() tcf_ct_params_free() tcf_ct_flow_table_put().\n\nstatic void tcf_ct_flow_table_put(struct tcf_ct_flow_table *ct_ft)\n{\n if (refcount_dec_and_test(\u0026ct_ft-\u003eref)) {\n rhashtable_remove_fast(\u0026zones_ht, \u0026ct_ft-\u003enode, zones_params);\n INIT_RCU_WORK(\u0026ct_ft-\u003erwork, tcf_ct_flow_table_cleanup_work); // [3]\n queue_rcu_work(act_ct_wq, \u0026ct_ft-\u003erwork);\n }\n}\n\nAt [3], tcf_ct_flow_table_cleanup_work() is scheduled as RCU work\n\nstatic void tcf_ct_flow_table_cleanup_work(struct work_struct *work)\n\n{\n struct tcf_ct_flow_table *ct_ft;\n struct flow_block *block;\n\n ct_ft = container_of(to_rcu_work(work), struct tcf_ct_flow_table,\n rwork);\n nf_flow_table_free(\u0026ct_ft-\u003enf_ft);\n block = \u0026ct_ft-\u003enf_ft.flow_block;\n down_write(\u0026ct_ft-\u003enf_ft.flow_block_lock);\n WARN_ON(!list_empty(\u0026block-\u003ecb_list));\n up_write(\u0026ct_ft-\u003enf_ft.flow_block_lock);\n kfree(ct_ft); // [4]\n\n module_put(THIS_MODULE);\n}\n\ntcf_ct_flow_table_cleanup_work() frees ct_ft at [4]. When this function executes\nbetween [1] and [2], UAF occurs.\n\nThis race condition has a very short race window, making it generally\ndifficult to trigger. Therefore, to trigger the vulnerability an msleep(100) was\ninserted after[1]",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.s390x",
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46319",
"url": "https://www.suse.com/security/cve/CVE-2026-46319"
},
{
"category": "external",
"summary": "SUSE Bug 1268022 for CVE-2026-46319",
"url": "https://bugzilla.suse.com/1268022"
},
{
"category": "external",
"summary": "SUSE Bug 1268281 for CVE-2026-46319",
"url": "https://bugzilla.suse.com/1268281"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.s390x",
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.s390x",
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T13:50:06Z",
"details": "important"
}
],
"title": "CVE-2026-46319"
},
{
"cve": "CVE-2026-52923",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-52923"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipc: limit next_id allocation to the valid ID range\n\nThe checkpoint/restore sysctl path can request the next SysV IPC id\nthrough ids-\u003enext_id. ipc_idr_alloc() currently forwards that request to\nidr_alloc() with an open-ended upper bound.\n\nIf the valid tail of the SysV IPC id space is full, the allocation can\nspill beyond ipc_mni. The returned SysV IPC id still uses the normal\nindex encoding, so later lookup and removal can target the wrong slot. \nThis leaves the real IDR entry behind and breaks the IDR state for the\nobject.\n\nThe bug is in ipc_idr_alloc() in the checkpoint/restore path.\n\n1. ids-\u003enext_id is passed to:\n\n idr_alloc(\u0026ids-\u003eipcs_idr, new, ipcid_to_idx(next_id), 0, ...)\n\n2. The zero upper bound makes the allocation effectively open-ended.\n Once the valid SysV IPC tail is occupied, idr_alloc() can spill past\n ipc_mni and allocate an entry beyond the valid IPC id range.\n\n3. The new object id is still encoded with the narrower SysV IPC index\n width:\n\n new-\u003eid = (new-\u003eseq \u003c\u003c ipcmni_seq_shift()) + idx\n\n4. Later removal goes through ipc_rmid(), which uses:\n\n ipcid_to_idx(ipcp-\u003eid)\n\n That truncates the real IDR index. An object actually stored at a\n high index can then be removed as if it lived at a low in-range\n index.\n\n5. For shared memory, shm_destroy() frees the current object anyway, but\n the real high IDR slot is left behind as a dangling pointer.\n\n6. A subsequent walk of /proc/sysvipc/shm reaches the stale IDR entry\n and dereferences freed memory.\n\nPrevent this by bounding the requested allocation to ipc_mni so the\ncheckpoint/restore path fails once the valid range is exhausted.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.s390x",
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-52923",
"url": "https://www.suse.com/security/cve/CVE-2026-52923"
},
{
"category": "external",
"summary": "SUSE Bug 1269033 for CVE-2026-52923",
"url": "https://bugzilla.suse.com/1269033"
},
{
"category": "external",
"summary": "SUSE Bug 1269034 for CVE-2026-52923",
"url": "https://bugzilla.suse.com/1269034"
},
{
"category": "external",
"summary": "SUSE Bug 1274780 for CVE-2026-52923",
"url": "https://bugzilla.suse.com/1274780"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.s390x",
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.s390x",
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T13:50:06Z",
"details": "important"
}
],
"title": "CVE-2026-52923"
},
{
"cve": "CVE-2026-52956",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-52956"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Fix potential out-of-bounds access in __ceph_x_decrypt()\n\nIn __ceph_x_decrypt(), a part of the buffer p is interpreted as a\nceph_x_encrypt_header, and the magic field of this struct is accessed.\nThis happens without any guarantee that the buffer is large enough to\nhold this struct. The function parameter ciphertext_len represents the\nlength of the ciphertext to decrypt and is guaranteed to be at most the\nremaining size of the allocated buffer p. However, this value is not\nnecessarily greater than sizeof(ceph_x_encrypt_header). E.g., a message\nframe of type FRAME_TAG_AUTH_REPLY_MORE, that is just as long to hold\nthe ciphertext at its end with a ciphertext_len of 8 or less, can\ntrigger an out-of-bounds memory access when accessing hdr-\u003emagic.\n\nThis patch fixes the issue by adding a check to ensure that the\ndecrypted plaintext in the buffer is large enough to represent at least\nthe ceph_x_encrypt_header.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.s390x",
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-52956",
"url": "https://www.suse.com/security/cve/CVE-2026-52956"
},
{
"category": "external",
"summary": "SUSE Bug 1269172 for CVE-2026-52956",
"url": "https://bugzilla.suse.com/1269172"
},
{
"category": "external",
"summary": "SUSE Bug 1272139 for CVE-2026-52956",
"url": "https://bugzilla.suse.com/1272139"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.s390x",
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.s390x",
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T13:50:06Z",
"details": "important"
}
],
"title": "CVE-2026-52956"
},
{
"cve": "CVE-2026-52972",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-52972"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Cap AEAD AD length to 0x80000000\n\nIn order to prevent arithmetic overflows when checking the TX\nbuffer size, cap the associated data length to 0x80000000.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.s390x",
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-52972",
"url": "https://www.suse.com/security/cve/CVE-2026-52972"
},
{
"category": "external",
"summary": "SUSE Bug 1269195 for CVE-2026-52972",
"url": "https://bugzilla.suse.com/1269195"
},
{
"category": "external",
"summary": "SUSE Bug 1269196 for CVE-2026-52972",
"url": "https://bugzilla.suse.com/1269196"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.s390x",
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.s390x",
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T13:50:06Z",
"details": "important"
}
],
"title": "CVE-2026-52972"
},
{
"cve": "CVE-2026-53133",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-53133"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/umem: Fix truncation for block sizes \u003e= 4G\n\nWhen the iommu is used the linearization of the mapping can give a single\nblock that is very large split across multiple SG entries.\n\nWhen __rdma_block_iter_next() reassembles the split SG entries it is\noverflowing the 32 bit stack values and computed the wrong DMA addresses\nfor blocks after the truncation.\n\nUse the right types to hold DMA addresses.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.s390x",
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-53133",
"url": "https://www.suse.com/security/cve/CVE-2026-53133"
},
{
"category": "external",
"summary": "SUSE Bug 1269821 for CVE-2026-53133",
"url": "https://bugzilla.suse.com/1269821"
},
{
"category": "external",
"summary": "SUSE Bug 1269822 for CVE-2026-53133",
"url": "https://bugzilla.suse.com/1269822"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.s390x",
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.s390x",
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T13:50:06Z",
"details": "important"
}
],
"title": "CVE-2026-53133"
},
{
"cve": "CVE-2026-53224",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-53224"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate embedded INIT chunk and address list lengths in cookie\n\nsctp_unpack_cookie() only checked that the embedded INIT chunk length\ndid not exceed the remaining cookie payload, but did not ensure that the\nINIT chunk is large enough to contain a complete INIT header.\n\nA malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose\nlength field is smaller than sizeof(struct sctp_init_chunk). Later,\nsctp_process_init() accesses INIT parameters unconditionally, which may\nlead to out-of-bounds reads.\n\nIn addition, raw_addr_list_len is not fully validated against the\nremaining cookie payload. When cookie authentication is disabled, an\nattacker can supply an oversized raw_addr_list_len and cause\nsctp_raw_to_bind_addrs() to read beyond the end of the cookie. The\naddress parser also lacks sufficient bounds checks for parameter headers\nand lengths, allowing malformed address parameters to trigger\nout-of-bounds reads.\n\nFix this by:\n\n- requiring the embedded INIT chunk length to be at least sizeof(struct\n sctp_init_chunk);\n- validating that the INIT chunk and raw address list together fit\n within the cookie payload;\n- verifying sufficient data exists for each address parameter header and\n payload before parsing it.\n\nNote that sctp_verify_init() must be called after sctp_unpack_cookie()\nand before sctp_process_init() when cookie authentication is disabled.\nThis will be addressed in a separate patch.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.s390x",
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-53224",
"url": "https://www.suse.com/security/cve/CVE-2026-53224"
},
{
"category": "external",
"summary": "SUSE Bug 1269997 for CVE-2026-53224",
"url": "https://bugzilla.suse.com/1269997"
},
{
"category": "external",
"summary": "SUSE Bug 1270023 for CVE-2026-53224",
"url": "https://bugzilla.suse.com/1270023"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.s390x",
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.s390x",
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T13:50:06Z",
"details": "important"
}
],
"title": "CVE-2026-53224"
},
{
"cve": "CVE-2026-53246",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-53246"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate cached peer INIT chunk length in COOKIE_ECHO processing\n\nWhen a listening SCTP server processes a COOKIE_ECHO chunk, the cached\npeer INIT chunk embedded after the cookie is parsed and its parameters\nare later walked by sctp_process_init() using sctp_walk_params().\n\nHowever, the chunk header length of this cached INIT chunk was not\nvalidated against the remaining buffer in the COOKIE_ECHO payload. If\nthe length field is inflated, the parameter walk can run beyond the\nactual received data, leading to out-of-bounds reads and potential\nmemory corruption during later parameter handling (e.g. STATE_COOKIE\nprocessing and kmemdup() copies).\n\nAdd a bounds check in sctp_unpack_cookie() to ensure the cached INIT\nchunk length does not exceed the available data in the COOKIE_ECHO\nbuffer before it is used.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.s390x",
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-53246",
"url": "https://www.suse.com/security/cve/CVE-2026-53246"
},
{
"category": "external",
"summary": "SUSE Bug 1269988 for CVE-2026-53246",
"url": "https://bugzilla.suse.com/1269988"
},
{
"category": "external",
"summary": "SUSE Bug 1270024 for CVE-2026-53246",
"url": "https://bugzilla.suse.com/1270024"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.s390x",
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.s390x",
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T13:50:06Z",
"details": "important"
}
],
"title": "CVE-2026-53246"
},
{
"cve": "CVE-2026-64530",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-64530"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle\n\ntcf_classify() can return TC_ACT_CONSUMED while the skb is held by the\ndefragmentation engine (e.g. act_ct on out-of-order fragments). When\nthat happens the skb is no longer owned by the caller and must not be\ntouched again.\n\ntcf_qevent_handle() did not handle TC_ACT_CONSUMED: it fell through the\nswitch and returned the skb to the caller as if classification had\npassed. The only qdisc that wires up qevents today is RED, via three call sites\n(qe_mark on RED_PROB_MARK/HARD_MARK, qe_early_drop on congestion_drop)\nred_enqueue() was continuing to operate on an skb it no longer owns in this\ncase -- enqueueing it, dropping it, or updating statistics. Resulting in a UAF.\n\n tc qdisc add dev eth0 root handle 1: red ... qevent early_drop block 10\n tc filter add block 10 ... action ct\n\n (with ct defrag enabled and traffic that produces out-of-order\n fragments, e.g. a fragmented UDP stream)\n\nHandle TC_ACT_CONSUMED in tcf_qevent_handle() the same way the ingress\nand egress fast paths do: treat it as stolen and return NULL without\ntouching the skb. Unlike the TC_ACT_STOLEN case, the skb must not be\ndropped/freed here, as it is no longer owned by us.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.s390x",
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-64530",
"url": "https://www.suse.com/security/cve/CVE-2026-64530"
},
{
"category": "external",
"summary": "SUSE Bug 1271866 for CVE-2026-64530",
"url": "https://bugzilla.suse.com/1271866"
},
{
"category": "external",
"summary": "SUSE Bug 1271867 for CVE-2026-64530",
"url": "https://bugzilla.suse.com/1271867"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.s390x",
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.s390x",
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T13:50:06Z",
"details": "important"
}
],
"title": "CVE-2026-64530"
},
{
"cve": "CVE-2026-64600",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-64600"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: resample the data fork mapping after cycling ILOCK\n\nxfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode,\na data fork mapping, and a cow fork mapping. Unfortunately, these two\nhelpers cycle the ILOCK to grab a transaction, which means that the\nmappings are stale as soon as we reacquire the ILOCK. Currently we\nrefresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but\nwe don\u0027t refresh the data fork mapping beforehand, which means that the\nxfs_bmap_trim_cow in that function queries the refcount btree about the\nwrong physical blocks and returns an inaccurate value in *shared.\n\nIf *shared is now false, the directio write proceeds with a stale data\nfork mapping. Fix this by querying the data fork mapping if the\nsequence counter changes across the ILOCK cycle.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.s390x",
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-64600",
"url": "https://www.suse.com/security/cve/CVE-2026-64600"
},
{
"category": "external",
"summary": "SUSE Bug 1271526 for CVE-2026-64600",
"url": "https://bugzilla.suse.com/1271526"
},
{
"category": "external",
"summary": "SUSE Bug 1271543 for CVE-2026-64600",
"url": "https://bugzilla.suse.com/1271543"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.s390x",
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.s390x",
"SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-47-default-4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T13:50:06Z",
"details": "important"
}
],
"title": "CVE-2026-64600"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…