GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

SUSE-SU-2026:23537-1

Vulnerability from csaf_suse - Published: 2026-09-08 13:50 - Updated: 2026-09-15 07:40
Summary
Security update for the Linux Kernel (Live Patch 27 for SUSE Linux Enterprise Micro 6.0)
Severity
Important
Notes
Title of the patch: Security update for the Linux Kernel (Live Patch 27 for SUSE Linux Enterprise Micro 6.0)
Description of the patch: This update for the SUSE Linux Enterprise Kernel 6.4.0-50.2 fixes various security issues: The following security issues were fixed: - CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1270023). - CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1270024). - CVE-2026-64530: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_hand (bsc#1271867). - CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (RefluXFS) (bsc#1271543).
Patchnames: SUSE-SLE-Micro-6.1-kernel-612
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2026-53224
7 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-50-default-2-1.1.s390x —
Vendor Fix
Unresolved product id: SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-50-default-2-1.1.x86_64 —
Vendor Fix
Threats
Impact important
CVE-2026-53246
8.6 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Affected products
Recommended 2 products, the same list as for CVE-2026-53224
Threats
Impact important
CVE-2026-64530
7 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Recommended 2 products, the same list as for CVE-2026-53224
Threats
Impact important
CVE-2026-64600
7.8 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
Recommended 2 products, the same list as for CVE-2026-53224
Threats
Impact important
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for the Linux Kernel (Live Patch 27 for SUSE Linux Enterprise Micro 6.0)",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "\nThis update for the SUSE Linux Enterprise Kernel 6.4.0-50.2 fixes various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1270023).\n- CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1270024).\n- CVE-2026-64530: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_hand (bsc#1271867).\n- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (RefluXFS) (bsc#1271543).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-Micro-6.1-kernel-612",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_23537-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:23537-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202623537-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:23537-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-September/029016.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1270023",
        "url": "https://bugzilla.suse.com/1270023"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1270024",
        "url": "https://bugzilla.suse.com/1270024"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1271543",
        "url": "https://bugzilla.suse.com/1271543"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1271867",
        "url": "https://bugzilla.suse.com/1271867"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-53224 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-53224/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-53246 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-53246/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-64530 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-64530/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-64600 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-64600/"
      }
    ],
    "title": "Security update for the Linux Kernel (Live Patch 27 for SUSE Linux Enterprise Micro 6.0)",
    "tracking": {
      "current_release_date": "2026-09-15T07:40:41Z",
      "generator": {
        "date": "2026-09-08T13:50:06Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:23537-1",
      "initial_release_date": "2026-09-08T13:50:06Z",
      "revision_history": [
        {
          "date": "2026-09-08T13:50:06Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-15T07:40:41Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-livepatch-6_4_0-50-default-2-1.1.s390x",
                "product": {
                  "name": "kernel-livepatch-6_4_0-50-default-2-1.1.s390x",
                  "product_id": "kernel-livepatch-6_4_0-50-default-2-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-livepatch-6_4_0-50-default-2-1.1.x86_64",
                "product": {
                  "name": "kernel-livepatch-6_4_0-50-default-2-1.1.x86_64",
                  "product_id": "kernel-livepatch-6_4_0-50-default-2-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Micro 6.1",
                "product": {
                  "name": "SUSE Linux Micro 6.1",
                  "product_id": "SUSE Linux Micro 6.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sl-micro:6.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-livepatch-6_4_0-50-default-2-1.1.s390x as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-50-default-2-1.1.s390x"
        },
        "product_reference": "kernel-livepatch-6_4_0-50-default-2-1.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-livepatch-6_4_0-50-default-2-1.1.x86_64 as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-50-default-2-1.1.x86_64"
        },
        "product_reference": "kernel-livepatch-6_4_0-50-default-2-1.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-53224",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-53224"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate embedded INIT chunk and address list lengths in cookie\n\nsctp_unpack_cookie() only checked that the embedded INIT chunk length\ndid not exceed the remaining cookie payload, but did not ensure that the\nINIT chunk is large enough to contain a complete INIT header.\n\nA malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose\nlength field is smaller than sizeof(struct sctp_init_chunk).  Later,\nsctp_process_init() accesses INIT parameters unconditionally, which may\nlead to out-of-bounds reads.\n\nIn addition, raw_addr_list_len is not fully validated against the\nremaining cookie payload. When cookie authentication is disabled, an\nattacker can supply an oversized raw_addr_list_len and cause\nsctp_raw_to_bind_addrs() to read beyond the end of the cookie. The\naddress parser also lacks sufficient bounds checks for parameter headers\nand lengths, allowing malformed address parameters to trigger\nout-of-bounds reads.\n\nFix this by:\n\n- requiring the embedded INIT chunk length to be at least sizeof(struct\n  sctp_init_chunk);\n- validating that the INIT chunk and raw address list together fit\n  within the cookie payload;\n- verifying sufficient data exists for each address parameter header and\n  payload before parsing it.\n\nNote that sctp_verify_init() must be called after sctp_unpack_cookie()\nand before sctp_process_init() when cookie authentication is disabled.\nThis will be addressed in a separate patch.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-50-default-2-1.1.s390x",
          "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-50-default-2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-53224",
          "url": "https://www.suse.com/security/cve/CVE-2026-53224"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1269997 for CVE-2026-53224",
          "url": "https://bugzilla.suse.com/1269997"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1270023 for CVE-2026-53224",
          "url": "https://bugzilla.suse.com/1270023"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-50-default-2-1.1.s390x",
            "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-50-default-2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-50-default-2-1.1.s390x",
            "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-50-default-2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-08T13:50:06Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-53224"
    },
    {
      "cve": "CVE-2026-53246",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-53246"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate cached peer INIT chunk length in COOKIE_ECHO processing\n\nWhen a listening SCTP server processes a COOKIE_ECHO chunk, the cached\npeer INIT chunk embedded after the cookie is parsed and its parameters\nare later walked by sctp_process_init() using sctp_walk_params().\n\nHowever, the chunk header length of this cached INIT chunk was not\nvalidated against the remaining buffer in the COOKIE_ECHO payload. If\nthe length field is inflated, the parameter walk can run beyond the\nactual received data, leading to out-of-bounds reads and potential\nmemory corruption during later parameter handling (e.g. STATE_COOKIE\nprocessing and kmemdup() copies).\n\nAdd a bounds check in sctp_unpack_cookie() to ensure the cached INIT\nchunk length does not exceed the available data in the COOKIE_ECHO\nbuffer before it is used.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-50-default-2-1.1.s390x",
          "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-50-default-2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-53246",
          "url": "https://www.suse.com/security/cve/CVE-2026-53246"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1269988 for CVE-2026-53246",
          "url": "https://bugzilla.suse.com/1269988"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1270024 for CVE-2026-53246",
          "url": "https://bugzilla.suse.com/1270024"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-50-default-2-1.1.s390x",
            "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-50-default-2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-50-default-2-1.1.s390x",
            "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-50-default-2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-08T13:50:06Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-53246"
    },
    {
      "cve": "CVE-2026-64530",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-64530"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle\n\ntcf_classify() can return TC_ACT_CONSUMED while the skb is held by the\ndefragmentation engine (e.g. act_ct on out-of-order fragments). When\nthat happens the skb is no longer owned by the caller and must not be\ntouched again.\n\ntcf_qevent_handle() did not handle TC_ACT_CONSUMED: it fell through the\nswitch and returned the skb to the caller as if classification had\npassed. The only qdisc that wires up qevents today is RED, via three call sites\n(qe_mark on RED_PROB_MARK/HARD_MARK, qe_early_drop on congestion_drop)\nred_enqueue() was continuing to operate on an skb it no longer owns  in this\ncase -- enqueueing it, dropping it, or updating statistics. Resulting in a UAF.\n\n  tc qdisc add dev eth0 root handle 1: red ... qevent early_drop block 10\n  tc filter add block 10 ... action ct\n\n  (with ct defrag enabled and traffic that produces out-of-order\n  fragments, e.g. a fragmented UDP stream)\n\nHandle TC_ACT_CONSUMED in tcf_qevent_handle() the same way the ingress\nand egress fast paths do: treat it as stolen and return NULL without\ntouching the skb. Unlike the TC_ACT_STOLEN case, the skb must not be\ndropped/freed here, as it is no longer owned by us.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-50-default-2-1.1.s390x",
          "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-50-default-2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-64530",
          "url": "https://www.suse.com/security/cve/CVE-2026-64530"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271866 for CVE-2026-64530",
          "url": "https://bugzilla.suse.com/1271866"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271867 for CVE-2026-64530",
          "url": "https://bugzilla.suse.com/1271867"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-50-default-2-1.1.s390x",
            "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-50-default-2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-50-default-2-1.1.s390x",
            "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-50-default-2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-08T13:50:06Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-64530"
    },
    {
      "cve": "CVE-2026-64600",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-64600"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: resample the data fork mapping after cycling ILOCK\n\nxfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode,\na data fork mapping, and a cow fork mapping.  Unfortunately, these two\nhelpers cycle the ILOCK to grab a transaction, which means that the\nmappings are stale as soon as we reacquire the ILOCK.  Currently we\nrefresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but\nwe don\u0027t refresh the data fork mapping beforehand, which means that the\nxfs_bmap_trim_cow in that function queries the refcount btree about the\nwrong physical blocks and returns an inaccurate value in *shared.\n\nIf *shared is now false, the directio write proceeds with a stale data\nfork mapping.  Fix this by querying the data fork mapping if the\nsequence counter changes across the ILOCK cycle.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-50-default-2-1.1.s390x",
          "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-50-default-2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-64600",
          "url": "https://www.suse.com/security/cve/CVE-2026-64600"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271526 for CVE-2026-64600",
          "url": "https://bugzilla.suse.com/1271526"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271543 for CVE-2026-64600",
          "url": "https://bugzilla.suse.com/1271543"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-50-default-2-1.1.s390x",
            "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-50-default-2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-50-default-2-1.1.s390x",
            "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-50-default-2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-08T13:50:06Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-64600"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.