Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-43503 (GCVE-0-2026-43503)
Vulnerability from cvelistv5 – Published: 2026-05-23 11:44 – Updated: 2026-08-05 12:28
VLAI
EPSS
VEX
Title
net: skbuff: propagate shared-frag marker through frag-transfer helpers
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: skbuff: propagate shared-frag marker through frag-transfer helpers
Two frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail
to propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()->flags when
moving frags from source to destination. __pskb_copy_fclone() defers
the rest of the shinfo metadata to skb_copy_header() after copying
frag descriptors, but that helper only carries over gso_{size,segs,
type} and never touches skb_shinfo()->flags; skb_shift() moves frag
descriptors directly and leaves flags untouched. As a result, the
destination skb keeps a reference to the same externally-owned or
page-cache-backed pages while reporting skb_has_shared_frag() as
false.
The mismatch is harmful in any in-place writer that uses
skb_has_shared_frag() to decide whether shared pages must be detoured
through skb_cow_data(). ESP input is one such writer (esp4.c,
esp6.c), and a single nft 'dup to <local>' rule -- or any other
nf_dup_ipv4() / xt_TEE caller -- is enough to land a pskb_copy()'d
skb in esp_input() with the marker stripped, letting an unprivileged
user write into the page cache of a root-owned read-only file via
authencesn-ESN stray writes.
Set SKBFL_SHARED_FRAG on the destination whenever frag descriptors
were actually moved from the source. skb_copy() and skb_copy_expand()
share skb_copy_header() too but linearize all paged data into freshly
allocated head storage and emerge with nr_frags == 0, so
skb_has_shared_frag() returns false on its own; they need no change.
The same omission exists in skb_gro_receive() and skb_gro_receive_list().
The former moves the incoming skb's frag descriptors into the
accumulator's last sub-skb via two paths (a direct frag-move loop and
the head_frag + memcpy path); the latter chains the incoming skb whole
onto p's frag_list. Downstream skb_segment() reads only
skb_shinfo(p)->flags, and skb_segment_list() reuses each sub-skb's
shinfo as the nskb -- both p and lp must carry the marker.
The same omission also exists in tcp_clone_payload(), which builds an
MTU probe skb by moving frag descriptors from skbs on sk_write_queue
into a freshly allocated nskb. The helper falls into the same family
and warrants the same fix for consistency; no TCP TX-side in-place
writer is currently known to reach a user page through this gap, but
a future consumer depending on the marker would regress silently.
The same omission exists in skb_segment(): the per-iteration flag
merge takes only head_skb's flag, and the inner switch that rebinds
frag_skb to list_skb on head_skb-frags exhaustion does not fold the
new frag_skb's flag into nskb. Fold frag_skb's flag at both sites
so segments drawing frags from frag_list members carry the marker.
Severity
CWE
- CWE-664 - Improper Control of a Resource Through its Lifetime
Assigner
References
41 references
Impacted products
37 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
cef401de7be8c4e155c6746bfccf721a4fa5fab9 , < fbeab9555564a1b98e8582cd106dfe46c4606991
(git)
Affected: cef401de7be8c4e155c6746bfccf721a4fa5fab9 , < 179f1852bdedc300e373e807cc102cd81feff196 (git) Affected: cef401de7be8c4e155c6746bfccf721a4fa5fab9 , < 12401fcfb01f53ccc63ab0a3246570fe8f3105ee (git) Affected: cef401de7be8c4e155c6746bfccf721a4fa5fab9 , < 989214c66884d70716d83dc1d0bf5e16287bf349 (git) Affected: cef401de7be8c4e155c6746bfccf721a4fa5fab9 , < fc6eb39c55e97df2f94ad974b8a5bbcd019da2c8 (git) Affected: cef401de7be8c4e155c6746bfccf721a4fa5fab9 , < ff375cc75f9167168db38e0464a482d5fbc8d81d (git) Affected: cef401de7be8c4e155c6746bfccf721a4fa5fab9 , < 9bc9d6d6967a2239aa57af2aa53554eddd640d20 (git) Affected: cef401de7be8c4e155c6746bfccf721a4fa5fab9 , < 48f6a5356a33dd78e7144ae1faef95ffc990aae0 (git) |
|
| Linux | Linux |
Affected:
3.9
Unaffected: 0 , < 3.9 (semver) Unaffected: 5.10.257 , ≤ 5.10.* (semver) Unaffected: 5.15.208 , ≤ 5.15.* (semver) Unaffected: 6.1.174 , ≤ 6.1.* (semver) Unaffected: 6.6.141 , ≤ 6.6.* (semver) Unaffected: 6.12.91 , ≤ 6.12.* (semver) Unaffected: 6.18.33 , ≤ 6.18.* (semver) Unaffected: 7.0.10 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
|
| Red Hat | NVIDIA for RHEL 10 |
Unaffected:
0:6.12.0-211.8.el10nv , < *
(rpm)
Unaffected: 0:6.12.0-231.12.el10nv , < * (rpm) cpe:/a:redhat:enterprise_linux_nvidia:10::el10 |
|
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected:
0:6.12.0-211.16.1.el10_2 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:10.2 |
|
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support |
Unaffected:
0:6.12.0-55.75.1.el10_0 , < *
(rpm)
cpe:/o:redhat:enterprise_linux_eus:10.0 |
|
| Red Hat | Red Hat Enterprise Linux 8 |
Unaffected:
0:4.18.0-553.125.1.rt7.466.el8_10 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:8::nfv |
|
| Red Hat | Red Hat Enterprise Linux 8 |
Unaffected:
0:4.18.0-553.125.1.el8_10 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:8 |
|
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/o:redhat:enterprise_linux:8 |
|
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support |
Unaffected:
0:4.18.0-305.192.1.el8_4 , < *
(rpm)
cpe:/o:redhat:rhel_aus:8.4 |
|
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On |
Unaffected:
0:4.18.0-305.192.1.el8_4 , < *
(rpm)
cpe:/o:redhat:rhel_eus_long_life:8.4 |
|
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support |
Unaffected:
0:4.18.0-372.193.1.el8_6 , < *
(rpm)
cpe:/o:redhat:rhel_aus:8.6 |
|
| Red Hat | Red Hat Enterprise Linux 8.6 Telecommunications Update Service |
Unaffected:
0:4.18.0-372.193.1.el8_6 , < *
(rpm)
cpe:/o:redhat:rhel_tus:8.6 |
|
| Red Hat | Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions |
Unaffected:
0:4.18.0-372.193.1.el8_6 , < *
(rpm)
cpe:/o:redhat:rhel_e4s:8.6 |
|
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service |
Unaffected:
0:4.18.0-477.143.1.el8_8 , < *
(rpm)
cpe:/o:redhat:rhel_tus:8.8 |
|
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions |
Unaffected:
0:4.18.0-477.143.1.el8_8 , < *
(rpm)
cpe:/o:redhat:rhel_e4s:8.8 |
|
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions |
cpe:/o:redhat:rhel_e4s:8.8 |
|
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
0:5.14.0-687.10.1.el9_8 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9 |
|
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions |
Unaffected:
0:5.14.0-70.180.1.el9_0 , < *
(rpm)
cpe:/a:redhat:rhel_e4s:9.0 |
|
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions |
Unaffected:
0:5.14.0-70.180.1.rt21.252.el9_0 , < *
(rpm)
cpe:/a:redhat:rhel_e4s:9.0::nfv |
|
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions |
Unaffected:
0:5.14.0-284.172.1.el9_2 , < *
(rpm)
cpe:/a:redhat:rhel_e4s:9.2 |
|
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions |
Unaffected:
0:5.14.0-284.172.1.rt14.457.el9_2 , < *
(rpm)
cpe:/a:redhat:rhel_e4s:9.2::nfv |
|
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions |
cpe:/o:redhat:rhel_e4s:9.2 |
|
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support |
Unaffected:
0:5.14.0-427.126.1.el9_4 , < *
(rpm)
cpe:/a:redhat:rhel_eus:9.4 |
|
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions |
cpe:/o:redhat:rhel_e4s:9.4 |
|
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support |
Unaffected:
0:5.14.0-570.116.1.el9_6 , < *
(rpm)
cpe:/a:redhat:rhel_eus:9.6 |
|
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support |
cpe:/o:redhat:rhel_eus:9.6 |
|
| Red Hat | Red Hat OpenShift Container Platform 4.12 |
Unaffected:
412.86.202605271418-0 , < *
(rpm)
cpe:/a:redhat:openshift:4.12::el8 |
|
| Red Hat | Red Hat OpenShift Container Platform 4.13 |
Unaffected:
413.92.202605271328-0 , < *
(rpm)
cpe:/a:redhat:openshift:4.13::el9 |
|
| Red Hat | Red Hat OpenShift Container Platform 4.15 |
Unaffected:
415.92.202606030318-0 , < *
(rpm)
cpe:/a:redhat:openshift:4.15::el9 |
|
| Red Hat | Red Hat OpenShift Container Platform 4.16 |
Unaffected:
416.94.202605200242-0 , < *
(rpm)
Unaffected: 416.94.202606051757-0 , < * (rpm) cpe:/a:redhat:openshift:4.16::el9 |
|
| Red Hat | Red Hat OpenShift Container Platform 4.18 |
Unaffected:
418.94.202605260517-0 , < *
(rpm)
cpe:/a:redhat:openshift:4.18::el9 |
|
| Red Hat | Red Hat OpenShift Container Platform 4.19 |
Unaffected:
4.19.9.6.202606031700-0 , < *
(rpm)
cpe:/a:redhat:openshift:4.19::el9 |
|
| Red Hat | Red Hat OpenShift Container Platform 4.20 |
Unaffected:
4.20.9.6.202605270908-0 , < *
(rpm)
cpe:/a:redhat:openshift:4.20::el9 |
|
| Red Hat | Red Hat OpenShift Container Platform 4.21 |
Unaffected:
4.21.9.6.202606030721-0 , < *
(rpm)
cpe:/a:redhat:openshift:4.21::el9 |
|
| Red Hat | Red Hat Enterprise Linux 6 |
cpe:/o:redhat:enterprise_linux:6 |
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:enterprise_linux:7 |
|
| Red Hat | Red Hat OpenShift Container Platform 4 |
cpe:/a:redhat:openshift:4 |
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_nvidia:10::el10"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "NVIDIA for RHEL 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.8.el10nv",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-231.12.el10nv",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.16.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-55.75.1.el10_0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.125.1.rt7.466.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.125.1.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-305.192.1.el8_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus_long_life:8.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-305.192.1.el8_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-372.193.1.el8_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_tus:8.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-372.193.1.el8_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:8.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-372.193.1.el8_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_tus:8.8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-477.143.1.el8_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:8.8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-477.143.1.el8_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:8.8"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.10.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.0"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-70.180.1.el9_0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.0::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-70.180.1.rt21.252.el9_0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.172.1.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.172.1.rt14.457.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:9.2"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-427.126.1.el9_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:9.4"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-570.116.1.el9_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus:9.6"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.12::el8"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.12",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "412.86.202605271418-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.13::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.13",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "413.92.202605271328-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.15::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.15",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "415.92.202606030318-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.16::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.16",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "416.94.202605200242-0",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "416.94.202606051757-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.18::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.18",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "418.94.202605260517-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.19::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.19",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.19.9.6.202606031700-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.20::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.20",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.20.9.6.202605270908-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.21::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.21",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.21.9.6.202606030721-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "unaffected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
}
],
"datePublic": "2026-05-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s networking (skbuff) component. When skb_try_coalesce() attaches paged fragments, it can lose the SKBFL_SHARED_FRAG marker. This can lead to the Encapsulating Security Payload (ESP) input decrypting data in place over page-cache backed fragments, potentially resulting in data corruption."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-664",
"description": "Improper Control of a Resource Through its Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T00:55:44.928Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-43503"
},
{
"name": "RHBZ#2480902",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480902"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43503.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19540"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33486"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21695"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21690"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:23233"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:20087"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25044"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21656"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:23245"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21702"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:23240"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:20299"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19569"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19705"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:20593"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:20054"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:20129"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19568"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19666"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:23470"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:20130"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:20051"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19521"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:23471"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:23469"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:24814"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:23468"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19664"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19711"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19875"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:19540: NVIDIA for RHEL 10"
},
{
"lang": "en",
"value": "RHSA-2026:33486: NVIDIA for RHEL 10"
},
{
"lang": "en",
"value": "RHSA-2026:21695: Red Hat OpenShift Container Platform 4.12"
},
{
"lang": "en",
"value": "RHSA-2026:21690: Red Hat OpenShift Container Platform 4.13"
},
{
"lang": "en",
"value": "RHSA-2026:23233: Red Hat OpenShift Container Platform 4.15"
},
{
"lang": "en",
"value": "RHSA-2026:20087: Red Hat OpenShift Container Platform 4.16"
},
{
"lang": "en",
"value": "RHSA-2026:25044: Red Hat OpenShift Container Platform 4.16"
},
{
"lang": "en",
"value": "RHSA-2026:21656: Red Hat OpenShift Container Platform 4.18"
},
{
"lang": "en",
"value": "RHSA-2026:23245: Red Hat OpenShift Container Platform 4.19"
},
{
"lang": "en",
"value": "RHSA-2026:21702: Red Hat OpenShift Container Platform 4.20"
},
{
"lang": "en",
"value": "RHSA-2026:23240: Red Hat OpenShift Container Platform 4.21"
},
{
"lang": "en",
"value": "RHSA-2026:20299: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:19569: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:19705: Red Hat Enterprise Linux AppStream E4S (v.9.0), Red Hat Enterprise Linux BaseOS E4S (v.9.0)"
},
{
"lang": "en",
"value": "RHSA-2026:20593: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:20054: Red Hat CodeReady Linux Builder EUS (v.9.4), Red Hat Enterprise Linux AppStream EUS (v.9.4), Red Hat Enterprise Linux BaseOS EUS (v.9.4), Red Hat Enterprise Linux Real Time EUS (v.9.4), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:20129: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:19568: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:19666: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:23470: Red Hat Enterprise Linux BaseOS (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:20130: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)"
},
{
"lang": "en",
"value": "RHSA-2026:20051: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS E4S (v.8.6), Red Hat Enterprise Linux BaseOS TUS (v.8.6)"
},
{
"lang": "en",
"value": "RHSA-2026:19521: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:23471: Red Hat Enterprise Linux BaseOS E4S (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:23469: Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:24814: Red Hat Enterprise Linux BaseOS E4S (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:23468: Red Hat Enterprise Linux BaseOS EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:19664: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:19711: Red Hat Enterprise Linux NFV E4S (v.9.0), Red Hat Enterprise Linux Real Time E4S (v.9.0)"
},
{
"lang": "en",
"value": "RHSA-2026:19875: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-23T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-05-23T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: net: skbuff: propagate shared-frag marker through frag-transfer helpers",
"workarounds": [
{
"lang": "en",
"value": "See the security bulletin for a detailed mitigation procedure."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/gro.c",
"net/core/skbuff.c",
"net/ipv4/tcp_output.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fbeab9555564a1b98e8582cd106dfe46c4606991",
"status": "affected",
"version": "cef401de7be8c4e155c6746bfccf721a4fa5fab9",
"versionType": "git"
},
{
"lessThan": "179f1852bdedc300e373e807cc102cd81feff196",
"status": "affected",
"version": "cef401de7be8c4e155c6746bfccf721a4fa5fab9",
"versionType": "git"
},
{
"lessThan": "12401fcfb01f53ccc63ab0a3246570fe8f3105ee",
"status": "affected",
"version": "cef401de7be8c4e155c6746bfccf721a4fa5fab9",
"versionType": "git"
},
{
"lessThan": "989214c66884d70716d83dc1d0bf5e16287bf349",
"status": "affected",
"version": "cef401de7be8c4e155c6746bfccf721a4fa5fab9",
"versionType": "git"
},
{
"lessThan": "fc6eb39c55e97df2f94ad974b8a5bbcd019da2c8",
"status": "affected",
"version": "cef401de7be8c4e155c6746bfccf721a4fa5fab9",
"versionType": "git"
},
{
"lessThan": "ff375cc75f9167168db38e0464a482d5fbc8d81d",
"status": "affected",
"version": "cef401de7be8c4e155c6746bfccf721a4fa5fab9",
"versionType": "git"
},
{
"lessThan": "9bc9d6d6967a2239aa57af2aa53554eddd640d20",
"status": "affected",
"version": "cef401de7be8c4e155c6746bfccf721a4fa5fab9",
"versionType": "git"
},
{
"lessThan": "48f6a5356a33dd78e7144ae1faef95ffc990aae0",
"status": "affected",
"version": "cef401de7be8c4e155c6746bfccf721a4fa5fab9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/gro.c",
"net/core/skbuff.c",
"net/ipv4/tcp_output.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.9"
},
{
"lessThan": "3.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.257",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.208",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.174",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.257",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.208",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.174",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: propagate shared-frag marker through frag-transfer helpers\n\nTwo frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail\nto propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()-\u003eflags when\nmoving frags from source to destination. __pskb_copy_fclone() defers\nthe rest of the shinfo metadata to skb_copy_header() after copying\nfrag descriptors, but that helper only carries over gso_{size,segs,\ntype} and never touches skb_shinfo()-\u003eflags; skb_shift() moves frag\ndescriptors directly and leaves flags untouched. As a result, the\ndestination skb keeps a reference to the same externally-owned or\npage-cache-backed pages while reporting skb_has_shared_frag() as\nfalse.\n\nThe mismatch is harmful in any in-place writer that uses\nskb_has_shared_frag() to decide whether shared pages must be detoured\nthrough skb_cow_data(). ESP input is one such writer (esp4.c,\nesp6.c), and a single nft \u0027dup to \u003clocal\u003e\u0027 rule -- or any other\nnf_dup_ipv4() / xt_TEE caller -- is enough to land a pskb_copy()\u0027d\nskb in esp_input() with the marker stripped, letting an unprivileged\nuser write into the page cache of a root-owned read-only file via\nauthencesn-ESN stray writes.\n\nSet SKBFL_SHARED_FRAG on the destination whenever frag descriptors\nwere actually moved from the source. skb_copy() and skb_copy_expand()\nshare skb_copy_header() too but linearize all paged data into freshly\nallocated head storage and emerge with nr_frags == 0, so\nskb_has_shared_frag() returns false on its own; they need no change.\n\nThe same omission exists in skb_gro_receive() and skb_gro_receive_list().\nThe former moves the incoming skb\u0027s frag descriptors into the\naccumulator\u0027s last sub-skb via two paths (a direct frag-move loop and\nthe head_frag + memcpy path); the latter chains the incoming skb whole\nonto p\u0027s frag_list. Downstream skb_segment() reads only\nskb_shinfo(p)-\u003eflags, and skb_segment_list() reuses each sub-skb\u0027s\nshinfo as the nskb -- both p and lp must carry the marker.\n\nThe same omission also exists in tcp_clone_payload(), which builds an\nMTU probe skb by moving frag descriptors from skbs on sk_write_queue\ninto a freshly allocated nskb. The helper falls into the same family\nand warrants the same fix for consistency; no TCP TX-side in-place\nwriter is currently known to reach a user page through this gap, but\na future consumer depending on the marker would regress silently.\n\nThe same omission exists in skb_segment(): the per-iteration flag\nmerge takes only head_skb\u0027s flag, and the inner switch that rebinds\nfrag_skb to list_skb on head_skb-frags exhaustion does not fold the\nnew frag_skb\u0027s flag into nskb. Fold frag_skb\u0027s flag at both sites\nso segments drawing frags from frag_list members carry the marker."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Triggering the impact requires locally splicing a root-owned file\u0027s page-cache pages into a socket and configuring an xfrm SA plus an nftables `dup`/TEE rule; a purely remote peer cannot create externally-owned, page-cache-backed frags. Matches the predecessor CVE-2026-43284 (AV:L).\nAC:L - The attacker controls every condition \u2014 the SA key, the dup/TEE rule, the spliced file pages, and the crafted ESP packet \u2014 and can reliably reproduce the in-place decrypt with no race or layout dependency outside their control.\nPR:L - Requires only an unprivileged local user: CAP_NET_ADMIN for xfrm/nftables is obtainable via user namespaces (`unshare -Urn`), and only read access to a (e.g. world-readable) root-owned file is needed to splice its page-cache pages.\nUI:N - The attacker performs all steps; the page-cache corruption occurs at decrypt time with no action required from any victim.\nS:C - The vulnerable component (ESP/network packet processing acting on the attacker\u0027s own packet) modifies resources in a different security authority \u2014 the page cache of a root-owned read-only file \u2014 crossing a privilege boundary, as scored in the predecessor CVE-2026-43284 (S:C).\nC:H - The in-place AEAD operation reads and writes externally-owned/potentially-freed pages across a trust boundary, a memory-safety violation leverageable for information disclosure; scored C:H consistent with the predecessor.\nI:H - The decrypt writes attacker-influenced data into the page cache of a root-owned read-only file, corrupting content read by privileged processes \u2014 a powerful confused-deputy write primitive enabling privilege escalation.\nA:H - Writing into pages the skb does not own (page-cache or freed/reused spliced pages) is memory corruption that can crash or destabilize the kernel and corrupt file/system state."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:28:26.468Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fbeab9555564a1b98e8582cd106dfe46c4606991"
},
{
"url": "https://git.kernel.org/stable/c/179f1852bdedc300e373e807cc102cd81feff196"
},
{
"url": "https://git.kernel.org/stable/c/12401fcfb01f53ccc63ab0a3246570fe8f3105ee"
},
{
"url": "https://git.kernel.org/stable/c/989214c66884d70716d83dc1d0bf5e16287bf349"
},
{
"url": "https://git.kernel.org/stable/c/fc6eb39c55e97df2f94ad974b8a5bbcd019da2c8"
},
{
"url": "https://git.kernel.org/stable/c/ff375cc75f9167168db38e0464a482d5fbc8d81d"
},
{
"url": "https://git.kernel.org/stable/c/9bc9d6d6967a2239aa57af2aa53554eddd640d20"
},
{
"url": "https://git.kernel.org/stable/c/48f6a5356a33dd78e7144ae1faef95ffc990aae0"
}
],
"title": "net: skbuff: propagate shared-frag marker through frag-transfer helpers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43503",
"datePublished": "2026-05-23T11:44:01.103Z",
"dateReserved": "2026-05-01T14:12:56.014Z",
"dateUpdated": "2026-08-05T12:28:26.468Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-43503",
"date": "2026-08-05",
"epss": "0.00337",
"percentile": "0.26222"
},
"microsoft_vex": {
"current_release_date": "2026-06-09T14:40:55.000Z",
"cve": "CVE-2026-43503",
"id": "msrc_CVE-2026-43503",
"initial_release_date": "2026-05-02T00:00:00.000Z",
"product_status:fixed": "1",
"product_status:known_affected": "1",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "net: skbuff: propagate shared-frag marker through frag-transfer helpers",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-43503.json",
"version": "3"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-43503\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-23T12:17:02.547\",\"lastModified\":\"2026-07-23T11:10:00.120\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: skbuff: propagate shared-frag marker through frag-transfer helpers\\n\\nTwo frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail\\nto propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()-\u003eflags when\\nmoving frags from source to destination. __pskb_copy_fclone() defers\\nthe rest of the shinfo metadata to skb_copy_header() after copying\\nfrag descriptors, but that helper only carries over gso_{size,segs,\\ntype} and never touches skb_shinfo()-\u003eflags; skb_shift() moves frag\\ndescriptors directly and leaves flags untouched. As a result, the\\ndestination skb keeps a reference to the same externally-owned or\\npage-cache-backed pages while reporting skb_has_shared_frag() as\\nfalse.\\n\\nThe mismatch is harmful in any in-place writer that uses\\nskb_has_shared_frag() to decide whether shared pages must be detoured\\nthrough skb_cow_data(). ESP input is one such writer (esp4.c,\\nesp6.c), and a single nft \u0027dup to \u003clocal\u003e\u0027 rule -- or any other\\nnf_dup_ipv4() / xt_TEE caller -- is enough to land a pskb_copy()\u0027d\\nskb in esp_input() with the marker stripped, letting an unprivileged\\nuser write into the page cache of a root-owned read-only file via\\nauthencesn-ESN stray writes.\\n\\nSet SKBFL_SHARED_FRAG on the destination whenever frag descriptors\\nwere actually moved from the source. skb_copy() and skb_copy_expand()\\nshare skb_copy_header() too but linearize all paged data into freshly\\nallocated head storage and emerge with nr_frags == 0, so\\nskb_has_shared_frag() returns false on its own; they need no change.\\n\\nThe same omission exists in skb_gro_receive() and skb_gro_receive_list().\\nThe former moves the incoming skb\u0027s frag descriptors into the\\naccumulator\u0027s last sub-skb via two paths (a direct frag-move loop and\\nthe head_frag + memcpy path); the latter chains the incoming skb whole\\nonto p\u0027s frag_list. Downstream skb_segment() reads only\\nskb_shinfo(p)-\u003eflags, and skb_segment_list() reuses each sub-skb\u0027s\\nshinfo as the nskb -- both p and lp must carry the marker.\\n\\nThe same omission also exists in tcp_clone_payload(), which builds an\\nMTU probe skb by moving frag descriptors from skbs on sk_write_queue\\ninto a freshly allocated nskb. The helper falls into the same family\\nand warrants the same fix for consistency; no TCP TX-side in-place\\nwriter is currently known to reach a user page through this gap, but\\na future consumer depending on the marker would regress silently.\\n\\nThe same omission exists in skb_segment(): the per-iteration flag\\nmerge takes only head_skb\u0027s flag, and the inner switch that rebinds\\nfrag_skb to list_skb on head_skb-frags exhaustion does not fold the\\nnew frag_skb\u0027s flag into nskb. Fold frag_skb\u0027s flag at both sites\\nso segments drawing frags from frag_list members carry the marker.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nnet: skbuff: propagar el marcador de fragmento compartido a trav\u00e9s de los ayudantes de transferencia de fragmentos\\n\\nDos ayudantes de transferencia de fragmentos (__pskb_copy_fclone() y skb_shift()) no logran propagar el bit SKBFL_SHARED_FRAG en skb_shinfo()-\u003eflags al mover fragmentos del origen al destino. __pskb_copy_fclone() difiere el resto de los metadatos de shinfo a skb_copy_header() despu\u00e9s de copiar los descriptores de fragmentos, pero ese ayudante solo transfiere gso_{size,segs,type} y nunca toca skb_shinfo()-\u003eflags; skb_shift() mueve los descriptores de fragmentos directamente y deja las banderas intactas. Como resultado, el skb de destino mantiene una referencia a las mismas p\u00e1ginas de propiedad externa o respaldadas por la cach\u00e9 de p\u00e1ginas mientras informa skb_has_shared_frag() como falso.\\n\\nLa falta de coincidencia es perjudicial en cualquier escritor in situ que utiliza skb_has_shared_frag() para decidir si las p\u00e1ginas compartidas deben desviarse a trav\u00e9s de skb_cow_data(). La entrada ESP es uno de esos escritores (esp4.c, esp6.c), y una \u00fanica regla nft \u0027dup to \u003clocal\u003e\u0027 -- o cualquier otro llamador de nf_dup_ipv4() / xt_TEE -- es suficiente para que un skb copiado con pskb_copy() llegue a esp_input() con el marcador eliminado, permitiendo que un usuario sin privilegios escriba en la cach\u00e9 de p\u00e1ginas de un archivo de solo lectura propiedad de root a trav\u00e9s de escrituras errantes de authencesn-ESN.\\n\\nEstablecer SKBFL_SHARED_FRAG en el destino siempre que los descriptores de fragmentos se hayan movido realmente del origen. skb_copy() y skb_copy_expand() tambi\u00e9n comparten skb_copy_header() pero linealizan todos los datos paginados en almacenamiento de cabecera reci\u00e9n asignado y emergen con nr_frags == 0, por lo que skb_has_shared_frag() devuelve falso por s\u00ed mismo; no necesitan cambios.\\n\\nLa misma omisi\u00f3n existe en skb_gro_receive() y skb_gro_receive_list(). El primero mueve los descriptores de fragmentos del skb entrante al \u00faltimo sub-skb del acumulador a trav\u00e9s de dos rutas (un bucle directo de movimiento de fragmentos y la ruta head_frag + memcpy); el segundo encadena el skb entrante completo a la frag_list de p. skb_segment() aguas abajo solo lee skb_shinfo(p)-\u003eflags, y skb_segment_list() reutiliza el shinfo de cada sub-skb como el nskb -- tanto p como lp deben llevar el marcador.\\n\\nLa misma omisi\u00f3n tambi\u00e9n existe en tcp_clone_payload(), que construye un skb de sondeo de MTU moviendo descriptores de fragmentos de skbs en sk_write_queue a un nskb reci\u00e9n asignado. El ayudante pertenece a la misma familia y justifica la misma correcci\u00f3n por coherencia; actualmente no se conoce ning\u00fan escritor in situ del lado TX de TCP que alcance una p\u00e1gina de usuario a trav\u00e9s de esta brecha, pero un futuro consumidor que dependa del marcador regresar\u00eda silenciosamente.\\n\\nLa misma omisi\u00f3n existe en skb_segment(): la fusi\u00f3n de banderas por iteraci\u00f3n toma solo la bandera de head_skb, y el switch interno que reasigna frag_skb a list_skb al agotarse los fragmentos de head_skb no incorpora la bandera del nuevo frag_skb en nskb. Incorporar la bandera de frag_skb en ambos sitios para que los segmentos que extraen fragmentos de los miembros de frag_list lleven el marcador.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/core/gro.c\",\"net/core/skbuff.c\",\"net/ipv4/tcp_output.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"cef401de7be8c4e155c6746bfccf721a4fa5fab9\",\"lessThan\":\"fbeab9555564a1b98e8582cd106dfe46c4606991\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cef401de7be8c4e155c6746bfccf721a4fa5fab9\",\"lessThan\":\"179f1852bdedc300e373e807cc102cd81feff196\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cef401de7be8c4e155c6746bfccf721a4fa5fab9\",\"lessThan\":\"12401fcfb01f53ccc63ab0a3246570fe8f3105ee\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cef401de7be8c4e155c6746bfccf721a4fa5fab9\",\"lessThan\":\"989214c66884d70716d83dc1d0bf5e16287bf349\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cef401de7be8c4e155c6746bfccf721a4fa5fab9\",\"lessThan\":\"fc6eb39c55e97df2f94ad974b8a5bbcd019da2c8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cef401de7be8c4e155c6746bfccf721a4fa5fab9\",\"lessThan\":\"ff375cc75f9167168db38e0464a482d5fbc8d81d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cef401de7be8c4e155c6746bfccf721a4fa5fab9\",\"lessThan\":\"9bc9d6d6967a2239aa57af2aa53554eddd640d20\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cef401de7be8c4e155c6746bfccf721a4fa5fab9\",\"lessThan\":\"48f6a5356a33dd78e7144ae1faef95ffc990aae0\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/core/gro.c\",\"net/core/skbuff.c\",\"net/ipv4/tcp_output.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.257\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.208\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.174\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.141\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.91\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.33\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.10\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"NVIDIA for RHEL 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"kernel\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux_nvidia:10::el10\"],\"versions\":[{\"version\":\"0:6.12.0-211.8.el10nv\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"},{\"version\":\"0:6.12.0-231.12.el10nv\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"kernel\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10.2\"],\"versions\":[{\"version\":\"0:6.12.0-211.16.1.el10_2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10.0 Extended Update Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"kernel\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux_eus:10.0\"],\"versions\":[{\"version\":\"0:6.12.0-55.75.1.el10_0\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"kernel-rt\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:8::nfv\"],\"versions\":[{\"version\":\"0:4.18.0-553.125.1.rt7.466.el8_10\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"kernel\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"],\"versions\":[{\"version\":\"0:4.18.0-553.125.1.el8_10\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"kpatch-patch\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"kernel\",\"cpes\":[\"cpe:/o:redhat:rhel_aus:8.4\"],\"versions\":[{\"version\":\"0:4.18.0-305.192.1.el8_4\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"kernel\",\"cpes\":[\"cpe:/o:redhat:rhel_eus_long_life:8.4\"],\"versions\":[{\"version\":\"0:4.18.0-305.192.1.el8_4\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"kernel\",\"cpes\":[\"cpe:/o:redhat:rhel_aus:8.6\"],\"versions\":[{\"version\":\"0:4.18.0-372.193.1.el8_6\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.6 Telecommunications Update Service\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"kernel\",\"cpes\":[\"cpe:/o:redhat:rhel_tus:8.6\"],\"versions\":[{\"version\":\"0:4.18.0-372.193.1.el8_6\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"kernel\",\"cpes\":[\"cpe:/o:redhat:rhel_e4s:8.6\"],\"versions\":[{\"version\":\"0:4.18.0-372.193.1.el8_6\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.8 Telecommunications Update Service\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"kernel\",\"cpes\":[\"cpe:/o:redhat:rhel_tus:8.8\"],\"versions\":[{\"version\":\"0:4.18.0-477.143.1.el8_8\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"kernel\",\"cpes\":[\"cpe:/o:redhat:rhel_e4s:8.8\"],\"versions\":[{\"version\":\"0:4.18.0-477.143.1.el8_8\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"kpatch-patch\",\"cpes\":[\"cpe:/o:redhat:rhel_e4s:8.8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"kernel\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:9\",\"cpe:/o:redhat:enterprise_linux:9\"],\"versions\":[{\"version\":\"0:5.14.0-687.10.1.el9_8\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"kernel\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:9.0\"],\"versions\":[{\"version\":\"0:5.14.0-70.180.1.el9_0\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"kernel-rt\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:9.0::nfv\"],\"versions\":[{\"version\":\"0:5.14.0-70.180.1.rt21.252.el9_0\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"kernel\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:9.2\"],\"versions\":[{\"version\":\"0:5.14.0-284.172.1.el9_2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"kernel-rt\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:9.2::nfv\"],\"versions\":[{\"version\":\"0:5.14.0-284.172.1.rt14.457.el9_2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"kpatch-patch\",\"cpes\":[\"cpe:/o:redhat:rhel_e4s:9.2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9.4 Extended Update Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"kernel\",\"cpes\":[\"cpe:/a:redhat:rhel_eus:9.4\"],\"versions\":[{\"version\":\"0:5.14.0-427.126.1.el9_4\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"kpatch-patch\",\"cpes\":[\"cpe:/o:redhat:rhel_e4s:9.4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9.6 Extended Update Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"kernel\",\"cpes\":[\"cpe:/a:redhat:rhel_eus:9.6\"],\"versions\":[{\"version\":\"0:5.14.0-570.116.1.el9_6\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9.6 Extended Update Support\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"kpatch-patch\",\"cpes\":[\"cpe:/o:redhat:rhel_eus:9.6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.12\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhcos\",\"cpes\":[\"cpe:/a:redhat:openshift:4.12::el8\"],\"versions\":[{\"version\":\"412.86.202605271418-0\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.13\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhcos\",\"cpes\":[\"cpe:/a:redhat:openshift:4.13::el9\"],\"versions\":[{\"version\":\"413.92.202605271328-0\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.15\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhcos\",\"cpes\":[\"cpe:/a:redhat:openshift:4.15::el9\"],\"versions\":[{\"version\":\"415.92.202606030318-0\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.16\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhcos\",\"cpes\":[\"cpe:/a:redhat:openshift:4.16::el9\"],\"versions\":[{\"version\":\"416.94.202605200242-0\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"},{\"version\":\"416.94.202606051757-0\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.18\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhcos\",\"cpes\":[\"cpe:/a:redhat:openshift:4.18::el9\"],\"versions\":[{\"version\":\"418.94.202605260517-0\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.19\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhcos\",\"cpes\":[\"cpe:/a:redhat:openshift:4.19::el9\"],\"versions\":[{\"version\":\"4.19.9.6.202606031700-0\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.20\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhcos\",\"cpes\":[\"cpe:/a:redhat:openshift:4.20::el9\"],\"versions\":[{\"version\":\"4.20.9.6.202605270908-0\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.21\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhcos\",\"cpes\":[\"cpe:/a:redhat:openshift:4.21::el9\"],\"versions\":[{\"version\":\"4.21.9.6.202606030721-0\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"kernel\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"kernel\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"kernel-rt\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhcos\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-664\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.9\",\"versionEndExcluding\":\"5.10.257\",\"matchCriteriaId\":\"58674383-C5FC-436D-8E6F-D03657D566FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.208\",\"matchCriteriaId\":\"E12545D2-1AE9-4FE1-83B6-2F9BD440AA95\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.174\",\"matchCriteriaId\":\"8190F4E2-90A8-4343-8E30-95288912FFD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.141\",\"matchCriteriaId\":\"97A9FFFA-22BB-4D5C-9790-5A2286E392F7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.91\",\"matchCriteriaId\":\"C918746B-DE6F-448F-A93E-A04C5481688D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.33\",\"matchCriteriaId\":\"96D99E49-380D-43AB-BDBA-25C3AD018A9C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.10\",\"matchCriteriaId\":\"A13475D2-59BF-4716-94B5-7C1D239A2CF4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1EF7059-E670-45F4-B422-54C40FA86390\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D38F0BF-A728-4133-A358-D44A2F7EE6D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"EC732D08-5F7B-46D9-B154-E60C7F4F0A97\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"E5910A9D-F60A-409A-B486-FE66BFEBA9B9\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/12401fcfb01f53ccc63ab0a3246570fe8f3105ee\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/179f1852bdedc300e373e807cc102cd81feff196\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/48f6a5356a33dd78e7144ae1faef95ffc990aae0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/989214c66884d70716d83dc1d0bf5e16287bf349\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9bc9d6d6967a2239aa57af2aa53554eddd640d20\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fbeab9555564a1b98e8582cd106dfe46c4606991\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fc6eb39c55e97df2f94ad974b8a5bbcd019da2c8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ff375cc75f9167168db38e0464a482d5fbc8d81d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19521\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19540\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19568\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19569\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19664\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19666\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19705\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19711\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19875\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:20051\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:20054\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:20087\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:20129\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:20130\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:20299\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:20593\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21656\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21690\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21695\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21702\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:23233\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:23240\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:23245\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:23468\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:23469\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:23470\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:23471\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:24814\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:25044\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:33486\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-43503\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2480902\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43503.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
"redhat_vex": {
"aggregate_severity": "Important",
"current_release_date": "2026-07-02T13:09:42+00:00",
"cve": "CVE-2026-43503",
"id": "CVE-2026-43503",
"initial_release_date": "2026-05-23T00:00:00+00:00",
"product_status:fixed": "2576",
"product_status:known_not_affected": "43",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: net: skbuff: propagate shared-frag marker through frag-transfer helpers",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43503.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "important",
"current_release_date": "2026-07-31T16:41:06Z",
"cve": "CVE-2026-43503",
"id": "CVE-2026-43503",
"initial_release_date": "2026-05-24T00:49:46Z",
"product_status:first_fixed": "2",
"product_status:known_affected": "431",
"product_status:known_not_affected": "4",
"product_status:recommended": "848",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2026-43503",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-43503.json",
"version": "37"
}
}
}
SUSE-SU-2026:22386-1
Vulnerability from csaf_suse - Published: 2026-06-25 11:19 - Updated: 2026-06-25 11:19Summary
Security update for the Linux Kernel (Live Patch 4 for SUSE Linux Enterprise 16)
Severity
Important
Notes
Title of the patch: Security update for the Linux Kernel (Live Patch 4 for SUSE Linux Enterprise 16)
Description of the patch:
This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.9.1 fixes various security issues
The following security issues were fixed:
- CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1260907).
- CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).
- CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).
- CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263108).
- CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).
- CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).
- CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282).
- net/sched: fix pedit partial COW leading to page cache (bsc#1267625).
Patchnames: SUSE-SLES-16.0-1071
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.2 (High)
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.8 (High)
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.8 (High)
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.8 (High)
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
43 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for the Linux Kernel (Live Patch 4 for SUSE Linux Enterprise 16)",
"title": "Title of the patch"
},
{
"category": "description",
"text": "\nThis update for the SUSE Linux Enterprise Kernel 6.12.0-160000.9.1 fixes various security issues\n\nThe following security issues were fixed:\n\n- CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1260907).\n- CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).\n- CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).\n- CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263108).\n- CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).\n- CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).\n- CVE-2026-46323: net: gro: don\u0027t merge zcopy skbs (bsc#1268282).\n- net/sched: fix pedit partial COW leading to page cache (bsc#1267625).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLES-16.0-1071",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22386-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:22386-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622386-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:22386-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-July/047753.html"
},
{
"category": "self",
"summary": "SUSE Bug 1260907",
"url": "https://bugzilla.suse.com/1260907"
},
{
"category": "self",
"summary": "SUSE Bug 1261640",
"url": "https://bugzilla.suse.com/1261640"
},
{
"category": "self",
"summary": "SUSE Bug 1263088",
"url": "https://bugzilla.suse.com/1263088"
},
{
"category": "self",
"summary": "SUSE Bug 1263108",
"url": "https://bugzilla.suse.com/1263108"
},
{
"category": "self",
"summary": "SUSE Bug 1263902",
"url": "https://bugzilla.suse.com/1263902"
},
{
"category": "self",
"summary": "SUSE Bug 1266229",
"url": "https://bugzilla.suse.com/1266229"
},
{
"category": "self",
"summary": "SUSE Bug 1267625",
"url": "https://bugzilla.suse.com/1267625"
},
{
"category": "self",
"summary": "SUSE Bug 1268282",
"url": "https://bugzilla.suse.com/1268282"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-23278 page",
"url": "https://www.suse.com/security/cve/CVE-2026-23278/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31402 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31402/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31504 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31504/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31554 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31554/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31694 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31694/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-43503 page",
"url": "https://www.suse.com/security/cve/CVE-2026-43503/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46323 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46323/"
}
],
"title": "Security update for the Linux Kernel (Live Patch 4 for SUSE Linux Enterprise 16)",
"tracking": {
"current_release_date": "2026-06-25T11:19:56Z",
"generator": {
"date": "2026-06-25T11:19:56Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:22386-1",
"initial_release_date": "2026-06-25T11:19:56Z",
"revision_history": [
{
"date": "2026-06-25T11:19:56Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"product": {
"name": "kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"product_id": "kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"product": {
"name": "kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"product_id": "kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64",
"product": {
"name": "kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64",
"product_id": "kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 16.0",
"product": {
"name": "SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product": {
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le"
},
"product_reference": "kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x"
},
"product_reference": "kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64"
},
"product_reference": "kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le"
},
"product_reference": "kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x"
},
"product_reference": "kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64"
},
"product_reference": "kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-23278",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-23278"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: always walk all pending catchall elements\n\nDuring transaction processing we might have more than one catchall element:\n1 live catchall element and 1 pending element that is coming as part of the\nnew batch.\n\nIf the map holding the catchall elements is also going away, its\nrequired to toggle all catchall elements and not just the first viable\ncandidate.\n\nOtherwise, we get:\n WARNING: ./include/net/netfilter/nf_tables.h:1281 at nft_data_release+0xb7/0xe0 [nf_tables], CPU#2: nft/1404\n RIP: 0010:nft_data_release+0xb7/0xe0 [nf_tables]\n [..]\n __nft_set_elem_destroy+0x106/0x380 [nf_tables]\n nf_tables_abort_release+0x348/0x8d0 [nf_tables]\n nf_tables_abort+0xcf2/0x3ac0 [nf_tables]\n nfnetlink_rcv_batch+0x9c9/0x20e0 [..]",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-23278",
"url": "https://www.suse.com/security/cve/CVE-2026-23278"
},
{
"category": "external",
"summary": "SUSE Bug 1259998 for CVE-2026-23278",
"url": "https://bugzilla.suse.com/1259998"
},
{
"category": "external",
"summary": "SUSE Bug 1260907 for CVE-2026-23278",
"url": "https://bugzilla.suse.com/1260907"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T11:19:56Z",
"details": "important"
}
],
"title": "CVE-2026-23278"
},
{
"cve": "CVE-2026-31402",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31402"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix heap overflow in NFSv4.0 LOCK replay cache\n\nThe NFSv4.0 replay cache uses a fixed 112-byte inline buffer\n(rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses.\nThis size was calculated based on OPEN responses and does not account\nfor LOCK denied responses, which include the conflicting lock owner as\na variable-length field up to 1024 bytes (NFS4_OPAQUE_LIMIT).\n\nWhen a LOCK operation is denied due to a conflict with an existing lock\nthat has a large owner, nfsd4_encode_operation() copies the full encoded\nresponse into the undersized replay buffer via read_bytes_from_xdr_buf()\nwith no bounds check. This results in a slab-out-of-bounds write of up\nto 944 bytes past the end of the buffer, corrupting adjacent heap memory.\n\nThis can be triggered remotely by an unauthenticated attacker with two\ncooperating NFSv4.0 clients: one sets a lock with a large owner string,\nthen the other requests a conflicting lock to provoke the denial.\n\nWe could fix this by increasing NFSD4_REPLAY_ISIZE to allow for a full\nopaque, but that would increase the size of every stateowner, when most\nlockowners are not that large.\n\nInstead, fix this by checking the encoded response length against\nNFSD4_REPLAY_ISIZE before copying into the replay buffer. If the\nresponse is too large, set rp_buflen to 0 to skip caching the replay\npayload. The status is still cached, and the client already received the\ncorrect response on the original request.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31402",
"url": "https://www.suse.com/security/cve/CVE-2026-31402"
},
{
"category": "external",
"summary": "SUSE Bug 1261638 for CVE-2026-31402",
"url": "https://bugzilla.suse.com/1261638"
},
{
"category": "external",
"summary": "SUSE Bug 1261640 for CVE-2026-31402",
"url": "https://bugzilla.suse.com/1261640"
},
{
"category": "external",
"summary": "SUSE Bug 1265160 for CVE-2026-31402",
"url": "https://bugzilla.suse.com/1265160"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T11:19:56Z",
"details": "important"
}
],
"title": "CVE-2026-31402"
},
{
"cve": "CVE-2026-31504",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31504"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix fanout UAF in packet_release() via NETDEV_UP race\n\n`packet_release()` has a race window where `NETDEV_UP` can re-register a\nsocket into a fanout group\u0027s `arr[]` array. The re-registration is not\ncleaned up by `fanout_release()`, leaving a dangling pointer in the fanout\narray.\n`packet_release()` does NOT zero `po-\u003enum` in its `bind_lock` section.\nAfter releasing `bind_lock`, `po-\u003enum` is still non-zero and `po-\u003eifindex`\nstill matches the bound device. A concurrent `packet_notifier(NETDEV_UP)`\nthat already found the socket in `sklist` can re-register the hook.\nFor fanout sockets, this re-registration calls `__fanout_link(sk, po)`\nwhich adds the socket back into `f-\u003earr[]` and increments `f-\u003enum_members`,\nbut does NOT increment `f-\u003esk_ref`.\n\nThe fix sets `po-\u003enum` to zero in `packet_release` while `bind_lock` is\nheld to prevent NETDEV_UP from linking, preventing the race window.\n\nThis bug was found following an additional audit with Claude Code based\non CVE-2025-38617.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31504",
"url": "https://www.suse.com/security/cve/CVE-2026-31504"
},
{
"category": "external",
"summary": "SUSE Bug 1263085 for CVE-2026-31504",
"url": "https://bugzilla.suse.com/1263085"
},
{
"category": "external",
"summary": "SUSE Bug 1263088 for CVE-2026-31504",
"url": "https://bugzilla.suse.com/1263088"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T11:19:56Z",
"details": "important"
}
],
"title": "CVE-2026-31504"
},
{
"cve": "CVE-2026-31554",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31554"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Require sys_futex_requeue() to have identical flags\n\nNicholas reported that his LLM found it was possible to create a UaF\nwhen sys_futex_requeue() is used with different flags. The initial\nmotivation for allowing different flags was the variable sized futex,\nbut since that hasn\u0027t been merged (yet), simply mandate the flags are\nidentical, as is the case for the old style sys_futex() requeue\noperations.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31554",
"url": "https://www.suse.com/security/cve/CVE-2026-31554"
},
{
"category": "external",
"summary": "SUSE Bug 1263107 for CVE-2026-31554",
"url": "https://bugzilla.suse.com/1263107"
},
{
"category": "external",
"summary": "SUSE Bug 1263108 for CVE-2026-31554",
"url": "https://bugzilla.suse.com/1263108"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T11:19:56Z",
"details": "important"
}
],
"title": "CVE-2026-31554"
},
{
"cve": "CVE-2026-31694",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31694"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: reject oversized dirents in page cache\n\nfuse_add_dirent_to_cache() computes a serialized dirent size from the\nserver-controlled namelen field and copies the dirent into a single\npage-cache page. The existing logic only checks whether the dirent fits\nin the remaining space of the current page and advances to a fresh page\nif not. It never checks whether the dirent itself exceeds PAGE_SIZE.\n\nAs a result, a malicious FUSE server can return a dirent with\nnamelen=4095, producing a serialized record size of 4120 bytes. On 4 KiB\npage systems this causes memcpy() to overflow the cache page by 24 bytes\ninto the following kernel page.\n\nReject dirents that cannot fit in a single page before copying them into\nthe readdir cache.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31694",
"url": "https://www.suse.com/security/cve/CVE-2026-31694"
},
{
"category": "external",
"summary": "SUSE Bug 1263901 for CVE-2026-31694",
"url": "https://bugzilla.suse.com/1263901"
},
{
"category": "external",
"summary": "SUSE Bug 1263902 for CVE-2026-31694",
"url": "https://bugzilla.suse.com/1263902"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T11:19:56Z",
"details": "important"
}
],
"title": "CVE-2026-31694"
},
{
"cve": "CVE-2026-43503",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-43503"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: propagate shared-frag marker through frag-transfer helpers\n\nTwo frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail\nto propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()-\u003eflags when\nmoving frags from source to destination. __pskb_copy_fclone() defers\nthe rest of the shinfo metadata to skb_copy_header() after copying\nfrag descriptors, but that helper only carries over gso_{size,segs,\ntype} and never touches skb_shinfo()-\u003eflags; skb_shift() moves frag\ndescriptors directly and leaves flags untouched. As a result, the\ndestination skb keeps a reference to the same externally-owned or\npage-cache-backed pages while reporting skb_has_shared_frag() as\nfalse.\n\nThe mismatch is harmful in any in-place writer that uses\nskb_has_shared_frag() to decide whether shared pages must be detoured\nthrough skb_cow_data(). ESP input is one such writer (esp4.c,\nesp6.c), and a single nft \u0027dup to \u003clocal\u003e\u0027 rule -- or any other\nnf_dup_ipv4() / xt_TEE caller -- is enough to land a pskb_copy()\u0027d\nskb in esp_input() with the marker stripped, letting an unprivileged\nuser write into the page cache of a root-owned read-only file via\nauthencesn-ESN stray writes.\n\nSet SKBFL_SHARED_FRAG on the destination whenever frag descriptors\nwere actually moved from the source. skb_copy() and skb_copy_expand()\nshare skb_copy_header() too but linearize all paged data into freshly\nallocated head storage and emerge with nr_frags == 0, so\nskb_has_shared_frag() returns false on its own; they need no change.\n\nThe same omission exists in skb_gro_receive() and skb_gro_receive_list().\nThe former moves the incoming skb\u0027s frag descriptors into the\naccumulator\u0027s last sub-skb via two paths (a direct frag-move loop and\nthe head_frag + memcpy path); the latter chains the incoming skb whole\nonto p\u0027s frag_list. Downstream skb_segment() reads only\nskb_shinfo(p)-\u003eflags, and skb_segment_list() reuses each sub-skb\u0027s\nshinfo as the nskb -- both p and lp must carry the marker.\n\nThe same omission also exists in tcp_clone_payload(), which builds an\nMTU probe skb by moving frag descriptors from skbs on sk_write_queue\ninto a freshly allocated nskb. The helper falls into the same family\nand warrants the same fix for consistency; no TCP TX-side in-place\nwriter is currently known to reach a user page through this gap, but\na future consumer depending on the marker would regress silently.\n\nThe same omission exists in skb_segment(): the per-iteration flag\nmerge takes only head_skb\u0027s flag, and the inner switch that rebinds\nfrag_skb to list_skb on head_skb-frags exhaustion does not fold the\nnew frag_skb\u0027s flag into nskb. Fold frag_skb\u0027s flag at both sites\nso segments drawing frags from frag_list members carry the marker.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-43503",
"url": "https://www.suse.com/security/cve/CVE-2026-43503"
},
{
"category": "external",
"summary": "SUSE Bug 1265209 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1265209"
},
{
"category": "external",
"summary": "SUSE Bug 1265960 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1265960"
},
{
"category": "external",
"summary": "SUSE Bug 1266229 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1266229"
},
{
"category": "external",
"summary": "SUSE Bug 1269878 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1269878"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T11:19:56Z",
"details": "important"
}
],
"title": "CVE-2026-43503"
},
{
"cve": "CVE-2026-46323",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46323"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gro: don\u0027t merge zcopy skbs\n\nskb_gro_receive() can currently copy frags between the source and GRO\nskb, without checking the zerocopy status, and in particular the\nSKBFL_MANAGED_FRAG_REFS flag.\n\nWhen SKBFL_MANAGED_FRAG_REFS is set, the skb doesn\u0027t hold a reference\non the pages in shinfo-\u003efrags. Appending those frags to another skb\u0027s\nfrags without fixing up the page refcount can lead to UAF.\n\nWhen either the last skb in the GRO chain (the one we would append\nfrags to) or the source skb is zerocopy, don\u0027t merge the skbs.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46323",
"url": "https://www.suse.com/security/cve/CVE-2026-46323"
},
{
"category": "external",
"summary": "SUSE Bug 1268029 for CVE-2026-46323",
"url": "https://bugzilla.suse.com/1268029"
},
{
"category": "external",
"summary": "SUSE Bug 1268282 for CVE-2026-46323",
"url": "https://bugzilla.suse.com/1268282"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_9-default-8-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T11:19:56Z",
"details": "important"
}
],
"title": "CVE-2026-46323"
}
]
}
SUSE-SU-2026:22387-1
Vulnerability from csaf_suse - Published: 2026-06-25 11:19 - Updated: 2026-06-25 11:19Summary
Security update for the Linux Kernel (Live Patch 6 for SUSE Linux Enterprise 16)
Severity
Important
Notes
Title of the patch: Security update for the Linux Kernel (Live Patch 6 for SUSE Linux Enterprise 16)
Description of the patch:
This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.27.1 fixes various security issues
The following security issues were fixed:
- CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1260907).
- CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).
- CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).
- CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263108).
- CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).
- CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).
- CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282).
- net/sched: fix pedit partial COW leading to page cache (bsc#1267625).
Patchnames: SUSE-SLES-16.0-1072
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.2 (High)
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.8 (High)
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.8 (High)
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.8 (High)
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
43 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for the Linux Kernel (Live Patch 6 for SUSE Linux Enterprise 16)",
"title": "Title of the patch"
},
{
"category": "description",
"text": "\nThis update for the SUSE Linux Enterprise Kernel 6.12.0-160000.27.1 fixes various security issues\n\nThe following security issues were fixed:\n\n- CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1260907).\n- CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).\n- CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).\n- CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263108).\n- CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).\n- CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).\n- CVE-2026-46323: net: gro: don\u0027t merge zcopy skbs (bsc#1268282).\n- net/sched: fix pedit partial COW leading to page cache (bsc#1267625).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLES-16.0-1072",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22387-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:22387-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622387-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:22387-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-July/047752.html"
},
{
"category": "self",
"summary": "SUSE Bug 1260907",
"url": "https://bugzilla.suse.com/1260907"
},
{
"category": "self",
"summary": "SUSE Bug 1261640",
"url": "https://bugzilla.suse.com/1261640"
},
{
"category": "self",
"summary": "SUSE Bug 1263088",
"url": "https://bugzilla.suse.com/1263088"
},
{
"category": "self",
"summary": "SUSE Bug 1263108",
"url": "https://bugzilla.suse.com/1263108"
},
{
"category": "self",
"summary": "SUSE Bug 1263902",
"url": "https://bugzilla.suse.com/1263902"
},
{
"category": "self",
"summary": "SUSE Bug 1266229",
"url": "https://bugzilla.suse.com/1266229"
},
{
"category": "self",
"summary": "SUSE Bug 1267625",
"url": "https://bugzilla.suse.com/1267625"
},
{
"category": "self",
"summary": "SUSE Bug 1268282",
"url": "https://bugzilla.suse.com/1268282"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-23278 page",
"url": "https://www.suse.com/security/cve/CVE-2026-23278/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31402 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31402/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31504 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31504/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31554 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31554/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31694 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31694/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-43503 page",
"url": "https://www.suse.com/security/cve/CVE-2026-43503/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46323 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46323/"
}
],
"title": "Security update for the Linux Kernel (Live Patch 6 for SUSE Linux Enterprise 16)",
"tracking": {
"current_release_date": "2026-06-25T11:19:56Z",
"generator": {
"date": "2026-06-25T11:19:56Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:22387-1",
"initial_release_date": "2026-06-25T11:19:56Z",
"revision_history": [
{
"date": "2026-06-25T11:19:56Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"product": {
"name": "kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"product_id": "kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"product": {
"name": "kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"product_id": "kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64",
"product": {
"name": "kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64",
"product_id": "kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 16.0",
"product": {
"name": "SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product": {
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le"
},
"product_reference": "kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x"
},
"product_reference": "kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64"
},
"product_reference": "kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le"
},
"product_reference": "kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x"
},
"product_reference": "kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64"
},
"product_reference": "kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-23278",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-23278"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: always walk all pending catchall elements\n\nDuring transaction processing we might have more than one catchall element:\n1 live catchall element and 1 pending element that is coming as part of the\nnew batch.\n\nIf the map holding the catchall elements is also going away, its\nrequired to toggle all catchall elements and not just the first viable\ncandidate.\n\nOtherwise, we get:\n WARNING: ./include/net/netfilter/nf_tables.h:1281 at nft_data_release+0xb7/0xe0 [nf_tables], CPU#2: nft/1404\n RIP: 0010:nft_data_release+0xb7/0xe0 [nf_tables]\n [..]\n __nft_set_elem_destroy+0x106/0x380 [nf_tables]\n nf_tables_abort_release+0x348/0x8d0 [nf_tables]\n nf_tables_abort+0xcf2/0x3ac0 [nf_tables]\n nfnetlink_rcv_batch+0x9c9/0x20e0 [..]",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-23278",
"url": "https://www.suse.com/security/cve/CVE-2026-23278"
},
{
"category": "external",
"summary": "SUSE Bug 1259998 for CVE-2026-23278",
"url": "https://bugzilla.suse.com/1259998"
},
{
"category": "external",
"summary": "SUSE Bug 1260907 for CVE-2026-23278",
"url": "https://bugzilla.suse.com/1260907"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T11:19:56Z",
"details": "important"
}
],
"title": "CVE-2026-23278"
},
{
"cve": "CVE-2026-31402",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31402"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix heap overflow in NFSv4.0 LOCK replay cache\n\nThe NFSv4.0 replay cache uses a fixed 112-byte inline buffer\n(rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses.\nThis size was calculated based on OPEN responses and does not account\nfor LOCK denied responses, which include the conflicting lock owner as\na variable-length field up to 1024 bytes (NFS4_OPAQUE_LIMIT).\n\nWhen a LOCK operation is denied due to a conflict with an existing lock\nthat has a large owner, nfsd4_encode_operation() copies the full encoded\nresponse into the undersized replay buffer via read_bytes_from_xdr_buf()\nwith no bounds check. This results in a slab-out-of-bounds write of up\nto 944 bytes past the end of the buffer, corrupting adjacent heap memory.\n\nThis can be triggered remotely by an unauthenticated attacker with two\ncooperating NFSv4.0 clients: one sets a lock with a large owner string,\nthen the other requests a conflicting lock to provoke the denial.\n\nWe could fix this by increasing NFSD4_REPLAY_ISIZE to allow for a full\nopaque, but that would increase the size of every stateowner, when most\nlockowners are not that large.\n\nInstead, fix this by checking the encoded response length against\nNFSD4_REPLAY_ISIZE before copying into the replay buffer. If the\nresponse is too large, set rp_buflen to 0 to skip caching the replay\npayload. The status is still cached, and the client already received the\ncorrect response on the original request.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31402",
"url": "https://www.suse.com/security/cve/CVE-2026-31402"
},
{
"category": "external",
"summary": "SUSE Bug 1261638 for CVE-2026-31402",
"url": "https://bugzilla.suse.com/1261638"
},
{
"category": "external",
"summary": "SUSE Bug 1261640 for CVE-2026-31402",
"url": "https://bugzilla.suse.com/1261640"
},
{
"category": "external",
"summary": "SUSE Bug 1265160 for CVE-2026-31402",
"url": "https://bugzilla.suse.com/1265160"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T11:19:56Z",
"details": "important"
}
],
"title": "CVE-2026-31402"
},
{
"cve": "CVE-2026-31504",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31504"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix fanout UAF in packet_release() via NETDEV_UP race\n\n`packet_release()` has a race window where `NETDEV_UP` can re-register a\nsocket into a fanout group\u0027s `arr[]` array. The re-registration is not\ncleaned up by `fanout_release()`, leaving a dangling pointer in the fanout\narray.\n`packet_release()` does NOT zero `po-\u003enum` in its `bind_lock` section.\nAfter releasing `bind_lock`, `po-\u003enum` is still non-zero and `po-\u003eifindex`\nstill matches the bound device. A concurrent `packet_notifier(NETDEV_UP)`\nthat already found the socket in `sklist` can re-register the hook.\nFor fanout sockets, this re-registration calls `__fanout_link(sk, po)`\nwhich adds the socket back into `f-\u003earr[]` and increments `f-\u003enum_members`,\nbut does NOT increment `f-\u003esk_ref`.\n\nThe fix sets `po-\u003enum` to zero in `packet_release` while `bind_lock` is\nheld to prevent NETDEV_UP from linking, preventing the race window.\n\nThis bug was found following an additional audit with Claude Code based\non CVE-2025-38617.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31504",
"url": "https://www.suse.com/security/cve/CVE-2026-31504"
},
{
"category": "external",
"summary": "SUSE Bug 1263085 for CVE-2026-31504",
"url": "https://bugzilla.suse.com/1263085"
},
{
"category": "external",
"summary": "SUSE Bug 1263088 for CVE-2026-31504",
"url": "https://bugzilla.suse.com/1263088"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T11:19:56Z",
"details": "important"
}
],
"title": "CVE-2026-31504"
},
{
"cve": "CVE-2026-31554",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31554"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Require sys_futex_requeue() to have identical flags\n\nNicholas reported that his LLM found it was possible to create a UaF\nwhen sys_futex_requeue() is used with different flags. The initial\nmotivation for allowing different flags was the variable sized futex,\nbut since that hasn\u0027t been merged (yet), simply mandate the flags are\nidentical, as is the case for the old style sys_futex() requeue\noperations.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31554",
"url": "https://www.suse.com/security/cve/CVE-2026-31554"
},
{
"category": "external",
"summary": "SUSE Bug 1263107 for CVE-2026-31554",
"url": "https://bugzilla.suse.com/1263107"
},
{
"category": "external",
"summary": "SUSE Bug 1263108 for CVE-2026-31554",
"url": "https://bugzilla.suse.com/1263108"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T11:19:56Z",
"details": "important"
}
],
"title": "CVE-2026-31554"
},
{
"cve": "CVE-2026-31694",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31694"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: reject oversized dirents in page cache\n\nfuse_add_dirent_to_cache() computes a serialized dirent size from the\nserver-controlled namelen field and copies the dirent into a single\npage-cache page. The existing logic only checks whether the dirent fits\nin the remaining space of the current page and advances to a fresh page\nif not. It never checks whether the dirent itself exceeds PAGE_SIZE.\n\nAs a result, a malicious FUSE server can return a dirent with\nnamelen=4095, producing a serialized record size of 4120 bytes. On 4 KiB\npage systems this causes memcpy() to overflow the cache page by 24 bytes\ninto the following kernel page.\n\nReject dirents that cannot fit in a single page before copying them into\nthe readdir cache.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31694",
"url": "https://www.suse.com/security/cve/CVE-2026-31694"
},
{
"category": "external",
"summary": "SUSE Bug 1263901 for CVE-2026-31694",
"url": "https://bugzilla.suse.com/1263901"
},
{
"category": "external",
"summary": "SUSE Bug 1263902 for CVE-2026-31694",
"url": "https://bugzilla.suse.com/1263902"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T11:19:56Z",
"details": "important"
}
],
"title": "CVE-2026-31694"
},
{
"cve": "CVE-2026-43503",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-43503"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: propagate shared-frag marker through frag-transfer helpers\n\nTwo frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail\nto propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()-\u003eflags when\nmoving frags from source to destination. __pskb_copy_fclone() defers\nthe rest of the shinfo metadata to skb_copy_header() after copying\nfrag descriptors, but that helper only carries over gso_{size,segs,\ntype} and never touches skb_shinfo()-\u003eflags; skb_shift() moves frag\ndescriptors directly and leaves flags untouched. As a result, the\ndestination skb keeps a reference to the same externally-owned or\npage-cache-backed pages while reporting skb_has_shared_frag() as\nfalse.\n\nThe mismatch is harmful in any in-place writer that uses\nskb_has_shared_frag() to decide whether shared pages must be detoured\nthrough skb_cow_data(). ESP input is one such writer (esp4.c,\nesp6.c), and a single nft \u0027dup to \u003clocal\u003e\u0027 rule -- or any other\nnf_dup_ipv4() / xt_TEE caller -- is enough to land a pskb_copy()\u0027d\nskb in esp_input() with the marker stripped, letting an unprivileged\nuser write into the page cache of a root-owned read-only file via\nauthencesn-ESN stray writes.\n\nSet SKBFL_SHARED_FRAG on the destination whenever frag descriptors\nwere actually moved from the source. skb_copy() and skb_copy_expand()\nshare skb_copy_header() too but linearize all paged data into freshly\nallocated head storage and emerge with nr_frags == 0, so\nskb_has_shared_frag() returns false on its own; they need no change.\n\nThe same omission exists in skb_gro_receive() and skb_gro_receive_list().\nThe former moves the incoming skb\u0027s frag descriptors into the\naccumulator\u0027s last sub-skb via two paths (a direct frag-move loop and\nthe head_frag + memcpy path); the latter chains the incoming skb whole\nonto p\u0027s frag_list. Downstream skb_segment() reads only\nskb_shinfo(p)-\u003eflags, and skb_segment_list() reuses each sub-skb\u0027s\nshinfo as the nskb -- both p and lp must carry the marker.\n\nThe same omission also exists in tcp_clone_payload(), which builds an\nMTU probe skb by moving frag descriptors from skbs on sk_write_queue\ninto a freshly allocated nskb. The helper falls into the same family\nand warrants the same fix for consistency; no TCP TX-side in-place\nwriter is currently known to reach a user page through this gap, but\na future consumer depending on the marker would regress silently.\n\nThe same omission exists in skb_segment(): the per-iteration flag\nmerge takes only head_skb\u0027s flag, and the inner switch that rebinds\nfrag_skb to list_skb on head_skb-frags exhaustion does not fold the\nnew frag_skb\u0027s flag into nskb. Fold frag_skb\u0027s flag at both sites\nso segments drawing frags from frag_list members carry the marker.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-43503",
"url": "https://www.suse.com/security/cve/CVE-2026-43503"
},
{
"category": "external",
"summary": "SUSE Bug 1265209 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1265209"
},
{
"category": "external",
"summary": "SUSE Bug 1265960 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1265960"
},
{
"category": "external",
"summary": "SUSE Bug 1266229 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1266229"
},
{
"category": "external",
"summary": "SUSE Bug 1269878 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1269878"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T11:19:56Z",
"details": "important"
}
],
"title": "CVE-2026-43503"
},
{
"cve": "CVE-2026-46323",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46323"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gro: don\u0027t merge zcopy skbs\n\nskb_gro_receive() can currently copy frags between the source and GRO\nskb, without checking the zerocopy status, and in particular the\nSKBFL_MANAGED_FRAG_REFS flag.\n\nWhen SKBFL_MANAGED_FRAG_REFS is set, the skb doesn\u0027t hold a reference\non the pages in shinfo-\u003efrags. Appending those frags to another skb\u0027s\nfrags without fixing up the page refcount can lead to UAF.\n\nWhen either the last skb in the GRO chain (the one we would append\nfrags to) or the source skb is zerocopy, don\u0027t merge the skbs.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46323",
"url": "https://www.suse.com/security/cve/CVE-2026-46323"
},
{
"category": "external",
"summary": "SUSE Bug 1268029 for CVE-2026-46323",
"url": "https://bugzilla.suse.com/1268029"
},
{
"category": "external",
"summary": "SUSE Bug 1268282 for CVE-2026-46323",
"url": "https://bugzilla.suse.com/1268282"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_27-default-6-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T11:19:56Z",
"details": "important"
}
],
"title": "CVE-2026-46323"
}
]
}
SUSE-SU-2026:22388-1
Vulnerability from csaf_suse - Published: 2026-06-25 11:19 - Updated: 2026-06-25 11:19Summary
Security update for the Linux Kernel (Live Patch 7 for SUSE Linux Enterprise 16)
Severity
Important
Notes
Title of the patch: Security update for the Linux Kernel (Live Patch 7 for SUSE Linux Enterprise 16)
Description of the patch:
This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.28.1 fixes various security issues
The following security issues were fixed:
- CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).
- CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).
- CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263108).
- CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).
- CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).
- CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282).
- net/sched: fix pedit partial COW leading to page cache (bsc#1267625).
Patchnames: SUSE-SLES-16.0-1073
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
8.2 (High)
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.8 (High)
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.8 (High)
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.8 (High)
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
38 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for the Linux Kernel (Live Patch 7 for SUSE Linux Enterprise 16)",
"title": "Title of the patch"
},
{
"category": "description",
"text": "\nThis update for the SUSE Linux Enterprise Kernel 6.12.0-160000.28.1 fixes various security issues\n\nThe following security issues were fixed:\n\n- CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).\n- CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).\n- CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263108).\n- CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).\n- CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).\n- CVE-2026-46323: net: gro: don\u0027t merge zcopy skbs (bsc#1268282).\n- net/sched: fix pedit partial COW leading to page cache (bsc#1267625).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLES-16.0-1073",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22388-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:22388-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622388-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:22388-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-July/047751.html"
},
{
"category": "self",
"summary": "SUSE Bug 1261640",
"url": "https://bugzilla.suse.com/1261640"
},
{
"category": "self",
"summary": "SUSE Bug 1263088",
"url": "https://bugzilla.suse.com/1263088"
},
{
"category": "self",
"summary": "SUSE Bug 1263108",
"url": "https://bugzilla.suse.com/1263108"
},
{
"category": "self",
"summary": "SUSE Bug 1263902",
"url": "https://bugzilla.suse.com/1263902"
},
{
"category": "self",
"summary": "SUSE Bug 1266229",
"url": "https://bugzilla.suse.com/1266229"
},
{
"category": "self",
"summary": "SUSE Bug 1267625",
"url": "https://bugzilla.suse.com/1267625"
},
{
"category": "self",
"summary": "SUSE Bug 1268282",
"url": "https://bugzilla.suse.com/1268282"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31402 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31402/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31504 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31504/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31554 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31554/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31694 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31694/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-43503 page",
"url": "https://www.suse.com/security/cve/CVE-2026-43503/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46323 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46323/"
}
],
"title": "Security update for the Linux Kernel (Live Patch 7 for SUSE Linux Enterprise 16)",
"tracking": {
"current_release_date": "2026-06-25T11:19:56Z",
"generator": {
"date": "2026-06-25T11:19:56Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:22388-1",
"initial_release_date": "2026-06-25T11:19:56Z",
"revision_history": [
{
"date": "2026-06-25T11:19:56Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"product": {
"name": "kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"product_id": "kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"product": {
"name": "kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"product_id": "kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64",
"product": {
"name": "kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64",
"product_id": "kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 16.0",
"product": {
"name": "SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product": {
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le"
},
"product_reference": "kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x"
},
"product_reference": "kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64"
},
"product_reference": "kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le"
},
"product_reference": "kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x"
},
"product_reference": "kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64"
},
"product_reference": "kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-31402",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31402"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix heap overflow in NFSv4.0 LOCK replay cache\n\nThe NFSv4.0 replay cache uses a fixed 112-byte inline buffer\n(rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses.\nThis size was calculated based on OPEN responses and does not account\nfor LOCK denied responses, which include the conflicting lock owner as\na variable-length field up to 1024 bytes (NFS4_OPAQUE_LIMIT).\n\nWhen a LOCK operation is denied due to a conflict with an existing lock\nthat has a large owner, nfsd4_encode_operation() copies the full encoded\nresponse into the undersized replay buffer via read_bytes_from_xdr_buf()\nwith no bounds check. This results in a slab-out-of-bounds write of up\nto 944 bytes past the end of the buffer, corrupting adjacent heap memory.\n\nThis can be triggered remotely by an unauthenticated attacker with two\ncooperating NFSv4.0 clients: one sets a lock with a large owner string,\nthen the other requests a conflicting lock to provoke the denial.\n\nWe could fix this by increasing NFSD4_REPLAY_ISIZE to allow for a full\nopaque, but that would increase the size of every stateowner, when most\nlockowners are not that large.\n\nInstead, fix this by checking the encoded response length against\nNFSD4_REPLAY_ISIZE before copying into the replay buffer. If the\nresponse is too large, set rp_buflen to 0 to skip caching the replay\npayload. The status is still cached, and the client already received the\ncorrect response on the original request.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31402",
"url": "https://www.suse.com/security/cve/CVE-2026-31402"
},
{
"category": "external",
"summary": "SUSE Bug 1261638 for CVE-2026-31402",
"url": "https://bugzilla.suse.com/1261638"
},
{
"category": "external",
"summary": "SUSE Bug 1261640 for CVE-2026-31402",
"url": "https://bugzilla.suse.com/1261640"
},
{
"category": "external",
"summary": "SUSE Bug 1265160 for CVE-2026-31402",
"url": "https://bugzilla.suse.com/1265160"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T11:19:56Z",
"details": "important"
}
],
"title": "CVE-2026-31402"
},
{
"cve": "CVE-2026-31504",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31504"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix fanout UAF in packet_release() via NETDEV_UP race\n\n`packet_release()` has a race window where `NETDEV_UP` can re-register a\nsocket into a fanout group\u0027s `arr[]` array. The re-registration is not\ncleaned up by `fanout_release()`, leaving a dangling pointer in the fanout\narray.\n`packet_release()` does NOT zero `po-\u003enum` in its `bind_lock` section.\nAfter releasing `bind_lock`, `po-\u003enum` is still non-zero and `po-\u003eifindex`\nstill matches the bound device. A concurrent `packet_notifier(NETDEV_UP)`\nthat already found the socket in `sklist` can re-register the hook.\nFor fanout sockets, this re-registration calls `__fanout_link(sk, po)`\nwhich adds the socket back into `f-\u003earr[]` and increments `f-\u003enum_members`,\nbut does NOT increment `f-\u003esk_ref`.\n\nThe fix sets `po-\u003enum` to zero in `packet_release` while `bind_lock` is\nheld to prevent NETDEV_UP from linking, preventing the race window.\n\nThis bug was found following an additional audit with Claude Code based\non CVE-2025-38617.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31504",
"url": "https://www.suse.com/security/cve/CVE-2026-31504"
},
{
"category": "external",
"summary": "SUSE Bug 1263085 for CVE-2026-31504",
"url": "https://bugzilla.suse.com/1263085"
},
{
"category": "external",
"summary": "SUSE Bug 1263088 for CVE-2026-31504",
"url": "https://bugzilla.suse.com/1263088"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T11:19:56Z",
"details": "important"
}
],
"title": "CVE-2026-31504"
},
{
"cve": "CVE-2026-31554",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31554"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Require sys_futex_requeue() to have identical flags\n\nNicholas reported that his LLM found it was possible to create a UaF\nwhen sys_futex_requeue() is used with different flags. The initial\nmotivation for allowing different flags was the variable sized futex,\nbut since that hasn\u0027t been merged (yet), simply mandate the flags are\nidentical, as is the case for the old style sys_futex() requeue\noperations.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31554",
"url": "https://www.suse.com/security/cve/CVE-2026-31554"
},
{
"category": "external",
"summary": "SUSE Bug 1263107 for CVE-2026-31554",
"url": "https://bugzilla.suse.com/1263107"
},
{
"category": "external",
"summary": "SUSE Bug 1263108 for CVE-2026-31554",
"url": "https://bugzilla.suse.com/1263108"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T11:19:56Z",
"details": "important"
}
],
"title": "CVE-2026-31554"
},
{
"cve": "CVE-2026-31694",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31694"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: reject oversized dirents in page cache\n\nfuse_add_dirent_to_cache() computes a serialized dirent size from the\nserver-controlled namelen field and copies the dirent into a single\npage-cache page. The existing logic only checks whether the dirent fits\nin the remaining space of the current page and advances to a fresh page\nif not. It never checks whether the dirent itself exceeds PAGE_SIZE.\n\nAs a result, a malicious FUSE server can return a dirent with\nnamelen=4095, producing a serialized record size of 4120 bytes. On 4 KiB\npage systems this causes memcpy() to overflow the cache page by 24 bytes\ninto the following kernel page.\n\nReject dirents that cannot fit in a single page before copying them into\nthe readdir cache.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31694",
"url": "https://www.suse.com/security/cve/CVE-2026-31694"
},
{
"category": "external",
"summary": "SUSE Bug 1263901 for CVE-2026-31694",
"url": "https://bugzilla.suse.com/1263901"
},
{
"category": "external",
"summary": "SUSE Bug 1263902 for CVE-2026-31694",
"url": "https://bugzilla.suse.com/1263902"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T11:19:56Z",
"details": "important"
}
],
"title": "CVE-2026-31694"
},
{
"cve": "CVE-2026-43503",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-43503"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: propagate shared-frag marker through frag-transfer helpers\n\nTwo frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail\nto propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()-\u003eflags when\nmoving frags from source to destination. __pskb_copy_fclone() defers\nthe rest of the shinfo metadata to skb_copy_header() after copying\nfrag descriptors, but that helper only carries over gso_{size,segs,\ntype} and never touches skb_shinfo()-\u003eflags; skb_shift() moves frag\ndescriptors directly and leaves flags untouched. As a result, the\ndestination skb keeps a reference to the same externally-owned or\npage-cache-backed pages while reporting skb_has_shared_frag() as\nfalse.\n\nThe mismatch is harmful in any in-place writer that uses\nskb_has_shared_frag() to decide whether shared pages must be detoured\nthrough skb_cow_data(). ESP input is one such writer (esp4.c,\nesp6.c), and a single nft \u0027dup to \u003clocal\u003e\u0027 rule -- or any other\nnf_dup_ipv4() / xt_TEE caller -- is enough to land a pskb_copy()\u0027d\nskb in esp_input() with the marker stripped, letting an unprivileged\nuser write into the page cache of a root-owned read-only file via\nauthencesn-ESN stray writes.\n\nSet SKBFL_SHARED_FRAG on the destination whenever frag descriptors\nwere actually moved from the source. skb_copy() and skb_copy_expand()\nshare skb_copy_header() too but linearize all paged data into freshly\nallocated head storage and emerge with nr_frags == 0, so\nskb_has_shared_frag() returns false on its own; they need no change.\n\nThe same omission exists in skb_gro_receive() and skb_gro_receive_list().\nThe former moves the incoming skb\u0027s frag descriptors into the\naccumulator\u0027s last sub-skb via two paths (a direct frag-move loop and\nthe head_frag + memcpy path); the latter chains the incoming skb whole\nonto p\u0027s frag_list. Downstream skb_segment() reads only\nskb_shinfo(p)-\u003eflags, and skb_segment_list() reuses each sub-skb\u0027s\nshinfo as the nskb -- both p and lp must carry the marker.\n\nThe same omission also exists in tcp_clone_payload(), which builds an\nMTU probe skb by moving frag descriptors from skbs on sk_write_queue\ninto a freshly allocated nskb. The helper falls into the same family\nand warrants the same fix for consistency; no TCP TX-side in-place\nwriter is currently known to reach a user page through this gap, but\na future consumer depending on the marker would regress silently.\n\nThe same omission exists in skb_segment(): the per-iteration flag\nmerge takes only head_skb\u0027s flag, and the inner switch that rebinds\nfrag_skb to list_skb on head_skb-frags exhaustion does not fold the\nnew frag_skb\u0027s flag into nskb. Fold frag_skb\u0027s flag at both sites\nso segments drawing frags from frag_list members carry the marker.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-43503",
"url": "https://www.suse.com/security/cve/CVE-2026-43503"
},
{
"category": "external",
"summary": "SUSE Bug 1265209 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1265209"
},
{
"category": "external",
"summary": "SUSE Bug 1265960 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1265960"
},
{
"category": "external",
"summary": "SUSE Bug 1266229 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1266229"
},
{
"category": "external",
"summary": "SUSE Bug 1269878 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1269878"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T11:19:56Z",
"details": "important"
}
],
"title": "CVE-2026-43503"
},
{
"cve": "CVE-2026-46323",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46323"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gro: don\u0027t merge zcopy skbs\n\nskb_gro_receive() can currently copy frags between the source and GRO\nskb, without checking the zerocopy status, and in particular the\nSKBFL_MANAGED_FRAG_REFS flag.\n\nWhen SKBFL_MANAGED_FRAG_REFS is set, the skb doesn\u0027t hold a reference\non the pages in shinfo-\u003efrags. Appending those frags to another skb\u0027s\nfrags without fixing up the page refcount can lead to UAF.\n\nWhen either the last skb in the GRO chain (the one we would append\nfrags to) or the source skb is zerocopy, don\u0027t merge the skbs.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46323",
"url": "https://www.suse.com/security/cve/CVE-2026-46323"
},
{
"category": "external",
"summary": "SUSE Bug 1268029 for CVE-2026-46323",
"url": "https://bugzilla.suse.com/1268029"
},
{
"category": "external",
"summary": "SUSE Bug 1268282 for CVE-2026-46323",
"url": "https://bugzilla.suse.com/1268282"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_28-default-5-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T11:19:56Z",
"details": "important"
}
],
"title": "CVE-2026-46323"
}
]
}
SUSE-SU-2026:22389-1
Vulnerability from csaf_suse - Published: 2026-06-25 11:19 - Updated: 2026-06-25 11:19Summary
Security update for the Linux Kernel (Live Patch 8 for SUSE Linux Enterprise 16)
Severity
Important
Notes
Title of the patch: Security update for the Linux Kernel (Live Patch 8 for SUSE Linux Enterprise 16)
Description of the patch:
This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.29.1 fixes various security issues
The following security issues were fixed:
- CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).
- CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).
- CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263108).
- CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).
- CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).
- CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282).
- net/sched: fix pedit partial COW leading to page cache (bsc#1267625).
Patchnames: SUSE-SLES-16.0-1074
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
8.2 (High)
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.8 (High)
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.8 (High)
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.8 (High)
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
38 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for the Linux Kernel (Live Patch 8 for SUSE Linux Enterprise 16)",
"title": "Title of the patch"
},
{
"category": "description",
"text": "\nThis update for the SUSE Linux Enterprise Kernel 6.12.0-160000.29.1 fixes various security issues\n\nThe following security issues were fixed:\n\n- CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).\n- CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).\n- CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263108).\n- CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).\n- CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).\n- CVE-2026-46323: net: gro: don\u0027t merge zcopy skbs (bsc#1268282).\n- net/sched: fix pedit partial COW leading to page cache (bsc#1267625).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLES-16.0-1074",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22389-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:22389-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622389-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:22389-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-July/047750.html"
},
{
"category": "self",
"summary": "SUSE Bug 1261640",
"url": "https://bugzilla.suse.com/1261640"
},
{
"category": "self",
"summary": "SUSE Bug 1263088",
"url": "https://bugzilla.suse.com/1263088"
},
{
"category": "self",
"summary": "SUSE Bug 1263108",
"url": "https://bugzilla.suse.com/1263108"
},
{
"category": "self",
"summary": "SUSE Bug 1263902",
"url": "https://bugzilla.suse.com/1263902"
},
{
"category": "self",
"summary": "SUSE Bug 1266229",
"url": "https://bugzilla.suse.com/1266229"
},
{
"category": "self",
"summary": "SUSE Bug 1267625",
"url": "https://bugzilla.suse.com/1267625"
},
{
"category": "self",
"summary": "SUSE Bug 1268282",
"url": "https://bugzilla.suse.com/1268282"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31402 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31402/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31504 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31504/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31554 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31554/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31694 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31694/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-43503 page",
"url": "https://www.suse.com/security/cve/CVE-2026-43503/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46323 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46323/"
}
],
"title": "Security update for the Linux Kernel (Live Patch 8 for SUSE Linux Enterprise 16)",
"tracking": {
"current_release_date": "2026-06-25T11:19:56Z",
"generator": {
"date": "2026-06-25T11:19:56Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:22389-1",
"initial_release_date": "2026-06-25T11:19:56Z",
"revision_history": [
{
"date": "2026-06-25T11:19:56Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"product": {
"name": "kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"product_id": "kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"product": {
"name": "kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"product_id": "kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64",
"product": {
"name": "kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64",
"product_id": "kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 16.0",
"product": {
"name": "SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product": {
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le"
},
"product_reference": "kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x"
},
"product_reference": "kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64"
},
"product_reference": "kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le"
},
"product_reference": "kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x"
},
"product_reference": "kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64"
},
"product_reference": "kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-31402",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31402"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix heap overflow in NFSv4.0 LOCK replay cache\n\nThe NFSv4.0 replay cache uses a fixed 112-byte inline buffer\n(rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses.\nThis size was calculated based on OPEN responses and does not account\nfor LOCK denied responses, which include the conflicting lock owner as\na variable-length field up to 1024 bytes (NFS4_OPAQUE_LIMIT).\n\nWhen a LOCK operation is denied due to a conflict with an existing lock\nthat has a large owner, nfsd4_encode_operation() copies the full encoded\nresponse into the undersized replay buffer via read_bytes_from_xdr_buf()\nwith no bounds check. This results in a slab-out-of-bounds write of up\nto 944 bytes past the end of the buffer, corrupting adjacent heap memory.\n\nThis can be triggered remotely by an unauthenticated attacker with two\ncooperating NFSv4.0 clients: one sets a lock with a large owner string,\nthen the other requests a conflicting lock to provoke the denial.\n\nWe could fix this by increasing NFSD4_REPLAY_ISIZE to allow for a full\nopaque, but that would increase the size of every stateowner, when most\nlockowners are not that large.\n\nInstead, fix this by checking the encoded response length against\nNFSD4_REPLAY_ISIZE before copying into the replay buffer. If the\nresponse is too large, set rp_buflen to 0 to skip caching the replay\npayload. The status is still cached, and the client already received the\ncorrect response on the original request.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31402",
"url": "https://www.suse.com/security/cve/CVE-2026-31402"
},
{
"category": "external",
"summary": "SUSE Bug 1261638 for CVE-2026-31402",
"url": "https://bugzilla.suse.com/1261638"
},
{
"category": "external",
"summary": "SUSE Bug 1261640 for CVE-2026-31402",
"url": "https://bugzilla.suse.com/1261640"
},
{
"category": "external",
"summary": "SUSE Bug 1265160 for CVE-2026-31402",
"url": "https://bugzilla.suse.com/1265160"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T11:19:56Z",
"details": "important"
}
],
"title": "CVE-2026-31402"
},
{
"cve": "CVE-2026-31504",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31504"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix fanout UAF in packet_release() via NETDEV_UP race\n\n`packet_release()` has a race window where `NETDEV_UP` can re-register a\nsocket into a fanout group\u0027s `arr[]` array. The re-registration is not\ncleaned up by `fanout_release()`, leaving a dangling pointer in the fanout\narray.\n`packet_release()` does NOT zero `po-\u003enum` in its `bind_lock` section.\nAfter releasing `bind_lock`, `po-\u003enum` is still non-zero and `po-\u003eifindex`\nstill matches the bound device. A concurrent `packet_notifier(NETDEV_UP)`\nthat already found the socket in `sklist` can re-register the hook.\nFor fanout sockets, this re-registration calls `__fanout_link(sk, po)`\nwhich adds the socket back into `f-\u003earr[]` and increments `f-\u003enum_members`,\nbut does NOT increment `f-\u003esk_ref`.\n\nThe fix sets `po-\u003enum` to zero in `packet_release` while `bind_lock` is\nheld to prevent NETDEV_UP from linking, preventing the race window.\n\nThis bug was found following an additional audit with Claude Code based\non CVE-2025-38617.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31504",
"url": "https://www.suse.com/security/cve/CVE-2026-31504"
},
{
"category": "external",
"summary": "SUSE Bug 1263085 for CVE-2026-31504",
"url": "https://bugzilla.suse.com/1263085"
},
{
"category": "external",
"summary": "SUSE Bug 1263088 for CVE-2026-31504",
"url": "https://bugzilla.suse.com/1263088"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T11:19:56Z",
"details": "important"
}
],
"title": "CVE-2026-31504"
},
{
"cve": "CVE-2026-31554",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31554"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Require sys_futex_requeue() to have identical flags\n\nNicholas reported that his LLM found it was possible to create a UaF\nwhen sys_futex_requeue() is used with different flags. The initial\nmotivation for allowing different flags was the variable sized futex,\nbut since that hasn\u0027t been merged (yet), simply mandate the flags are\nidentical, as is the case for the old style sys_futex() requeue\noperations.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31554",
"url": "https://www.suse.com/security/cve/CVE-2026-31554"
},
{
"category": "external",
"summary": "SUSE Bug 1263107 for CVE-2026-31554",
"url": "https://bugzilla.suse.com/1263107"
},
{
"category": "external",
"summary": "SUSE Bug 1263108 for CVE-2026-31554",
"url": "https://bugzilla.suse.com/1263108"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T11:19:56Z",
"details": "important"
}
],
"title": "CVE-2026-31554"
},
{
"cve": "CVE-2026-31694",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31694"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: reject oversized dirents in page cache\n\nfuse_add_dirent_to_cache() computes a serialized dirent size from the\nserver-controlled namelen field and copies the dirent into a single\npage-cache page. The existing logic only checks whether the dirent fits\nin the remaining space of the current page and advances to a fresh page\nif not. It never checks whether the dirent itself exceeds PAGE_SIZE.\n\nAs a result, a malicious FUSE server can return a dirent with\nnamelen=4095, producing a serialized record size of 4120 bytes. On 4 KiB\npage systems this causes memcpy() to overflow the cache page by 24 bytes\ninto the following kernel page.\n\nReject dirents that cannot fit in a single page before copying them into\nthe readdir cache.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31694",
"url": "https://www.suse.com/security/cve/CVE-2026-31694"
},
{
"category": "external",
"summary": "SUSE Bug 1263901 for CVE-2026-31694",
"url": "https://bugzilla.suse.com/1263901"
},
{
"category": "external",
"summary": "SUSE Bug 1263902 for CVE-2026-31694",
"url": "https://bugzilla.suse.com/1263902"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T11:19:56Z",
"details": "important"
}
],
"title": "CVE-2026-31694"
},
{
"cve": "CVE-2026-43503",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-43503"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: propagate shared-frag marker through frag-transfer helpers\n\nTwo frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail\nto propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()-\u003eflags when\nmoving frags from source to destination. __pskb_copy_fclone() defers\nthe rest of the shinfo metadata to skb_copy_header() after copying\nfrag descriptors, but that helper only carries over gso_{size,segs,\ntype} and never touches skb_shinfo()-\u003eflags; skb_shift() moves frag\ndescriptors directly and leaves flags untouched. As a result, the\ndestination skb keeps a reference to the same externally-owned or\npage-cache-backed pages while reporting skb_has_shared_frag() as\nfalse.\n\nThe mismatch is harmful in any in-place writer that uses\nskb_has_shared_frag() to decide whether shared pages must be detoured\nthrough skb_cow_data(). ESP input is one such writer (esp4.c,\nesp6.c), and a single nft \u0027dup to \u003clocal\u003e\u0027 rule -- or any other\nnf_dup_ipv4() / xt_TEE caller -- is enough to land a pskb_copy()\u0027d\nskb in esp_input() with the marker stripped, letting an unprivileged\nuser write into the page cache of a root-owned read-only file via\nauthencesn-ESN stray writes.\n\nSet SKBFL_SHARED_FRAG on the destination whenever frag descriptors\nwere actually moved from the source. skb_copy() and skb_copy_expand()\nshare skb_copy_header() too but linearize all paged data into freshly\nallocated head storage and emerge with nr_frags == 0, so\nskb_has_shared_frag() returns false on its own; they need no change.\n\nThe same omission exists in skb_gro_receive() and skb_gro_receive_list().\nThe former moves the incoming skb\u0027s frag descriptors into the\naccumulator\u0027s last sub-skb via two paths (a direct frag-move loop and\nthe head_frag + memcpy path); the latter chains the incoming skb whole\nonto p\u0027s frag_list. Downstream skb_segment() reads only\nskb_shinfo(p)-\u003eflags, and skb_segment_list() reuses each sub-skb\u0027s\nshinfo as the nskb -- both p and lp must carry the marker.\n\nThe same omission also exists in tcp_clone_payload(), which builds an\nMTU probe skb by moving frag descriptors from skbs on sk_write_queue\ninto a freshly allocated nskb. The helper falls into the same family\nand warrants the same fix for consistency; no TCP TX-side in-place\nwriter is currently known to reach a user page through this gap, but\na future consumer depending on the marker would regress silently.\n\nThe same omission exists in skb_segment(): the per-iteration flag\nmerge takes only head_skb\u0027s flag, and the inner switch that rebinds\nfrag_skb to list_skb on head_skb-frags exhaustion does not fold the\nnew frag_skb\u0027s flag into nskb. Fold frag_skb\u0027s flag at both sites\nso segments drawing frags from frag_list members carry the marker.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-43503",
"url": "https://www.suse.com/security/cve/CVE-2026-43503"
},
{
"category": "external",
"summary": "SUSE Bug 1265209 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1265209"
},
{
"category": "external",
"summary": "SUSE Bug 1265960 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1265960"
},
{
"category": "external",
"summary": "SUSE Bug 1266229 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1266229"
},
{
"category": "external",
"summary": "SUSE Bug 1269878 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1269878"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T11:19:56Z",
"details": "important"
}
],
"title": "CVE-2026-43503"
},
{
"cve": "CVE-2026-46323",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46323"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gro: don\u0027t merge zcopy skbs\n\nskb_gro_receive() can currently copy frags between the source and GRO\nskb, without checking the zerocopy status, and in particular the\nSKBFL_MANAGED_FRAG_REFS flag.\n\nWhen SKBFL_MANAGED_FRAG_REFS is set, the skb doesn\u0027t hold a reference\non the pages in shinfo-\u003efrags. Appending those frags to another skb\u0027s\nfrags without fixing up the page refcount can lead to UAF.\n\nWhen either the last skb in the GRO chain (the one we would append\nfrags to) or the source skb is zerocopy, don\u0027t merge the skbs.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46323",
"url": "https://www.suse.com/security/cve/CVE-2026-46323"
},
{
"category": "external",
"summary": "SUSE Bug 1268029 for CVE-2026-46323",
"url": "https://bugzilla.suse.com/1268029"
},
{
"category": "external",
"summary": "SUSE Bug 1268282 for CVE-2026-46323",
"url": "https://bugzilla.suse.com/1268282"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_29-default-4-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T11:19:56Z",
"details": "important"
}
],
"title": "CVE-2026-46323"
}
]
}
SUSE-SU-2026:22390-1
Vulnerability from csaf_suse - Published: 2026-06-25 11:19 - Updated: 2026-06-25 11:19Summary
Security update for the Linux Kernel (Live Patch 3 for SUSE Linux Enterprise 16)
Severity
Important
Notes
Title of the patch: Security update for the Linux Kernel (Live Patch 3 for SUSE Linux Enterprise 16)
Description of the patch:
This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.8.1 fixes various security issues
The following security issues were fixed:
- CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1260907).
- CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).
- CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).
- CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263108).
- CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).
- CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).
- CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282).
- net/sched: fix pedit partial COW leading to page cache (bsc#1267625).
Patchnames: SUSE-SLES-16.0-1075
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.2 (High)
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.8 (High)
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.8 (High)
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.8 (High)
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
43 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for the Linux Kernel (Live Patch 3 for SUSE Linux Enterprise 16)",
"title": "Title of the patch"
},
{
"category": "description",
"text": "\nThis update for the SUSE Linux Enterprise Kernel 6.12.0-160000.8.1 fixes various security issues\n\nThe following security issues were fixed:\n\n- CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1260907).\n- CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).\n- CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).\n- CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263108).\n- CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).\n- CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).\n- CVE-2026-46323: net: gro: don\u0027t merge zcopy skbs (bsc#1268282).\n- net/sched: fix pedit partial COW leading to page cache (bsc#1267625).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLES-16.0-1075",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22390-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:22390-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622390-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:22390-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-July/047749.html"
},
{
"category": "self",
"summary": "SUSE Bug 1260907",
"url": "https://bugzilla.suse.com/1260907"
},
{
"category": "self",
"summary": "SUSE Bug 1261640",
"url": "https://bugzilla.suse.com/1261640"
},
{
"category": "self",
"summary": "SUSE Bug 1263088",
"url": "https://bugzilla.suse.com/1263088"
},
{
"category": "self",
"summary": "SUSE Bug 1263108",
"url": "https://bugzilla.suse.com/1263108"
},
{
"category": "self",
"summary": "SUSE Bug 1263902",
"url": "https://bugzilla.suse.com/1263902"
},
{
"category": "self",
"summary": "SUSE Bug 1266229",
"url": "https://bugzilla.suse.com/1266229"
},
{
"category": "self",
"summary": "SUSE Bug 1267625",
"url": "https://bugzilla.suse.com/1267625"
},
{
"category": "self",
"summary": "SUSE Bug 1268282",
"url": "https://bugzilla.suse.com/1268282"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-23278 page",
"url": "https://www.suse.com/security/cve/CVE-2026-23278/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31402 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31402/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31504 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31504/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31554 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31554/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31694 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31694/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-43503 page",
"url": "https://www.suse.com/security/cve/CVE-2026-43503/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46323 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46323/"
}
],
"title": "Security update for the Linux Kernel (Live Patch 3 for SUSE Linux Enterprise 16)",
"tracking": {
"current_release_date": "2026-06-25T11:19:56Z",
"generator": {
"date": "2026-06-25T11:19:56Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:22390-1",
"initial_release_date": "2026-06-25T11:19:56Z",
"revision_history": [
{
"date": "2026-06-25T11:19:56Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"product": {
"name": "kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"product_id": "kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"product": {
"name": "kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"product_id": "kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64",
"product": {
"name": "kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64",
"product_id": "kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 16.0",
"product": {
"name": "SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product": {
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le"
},
"product_reference": "kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x"
},
"product_reference": "kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64"
},
"product_reference": "kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le"
},
"product_reference": "kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x"
},
"product_reference": "kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64"
},
"product_reference": "kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-23278",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-23278"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: always walk all pending catchall elements\n\nDuring transaction processing we might have more than one catchall element:\n1 live catchall element and 1 pending element that is coming as part of the\nnew batch.\n\nIf the map holding the catchall elements is also going away, its\nrequired to toggle all catchall elements and not just the first viable\ncandidate.\n\nOtherwise, we get:\n WARNING: ./include/net/netfilter/nf_tables.h:1281 at nft_data_release+0xb7/0xe0 [nf_tables], CPU#2: nft/1404\n RIP: 0010:nft_data_release+0xb7/0xe0 [nf_tables]\n [..]\n __nft_set_elem_destroy+0x106/0x380 [nf_tables]\n nf_tables_abort_release+0x348/0x8d0 [nf_tables]\n nf_tables_abort+0xcf2/0x3ac0 [nf_tables]\n nfnetlink_rcv_batch+0x9c9/0x20e0 [..]",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-23278",
"url": "https://www.suse.com/security/cve/CVE-2026-23278"
},
{
"category": "external",
"summary": "SUSE Bug 1259998 for CVE-2026-23278",
"url": "https://bugzilla.suse.com/1259998"
},
{
"category": "external",
"summary": "SUSE Bug 1260907 for CVE-2026-23278",
"url": "https://bugzilla.suse.com/1260907"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T11:19:56Z",
"details": "important"
}
],
"title": "CVE-2026-23278"
},
{
"cve": "CVE-2026-31402",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31402"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix heap overflow in NFSv4.0 LOCK replay cache\n\nThe NFSv4.0 replay cache uses a fixed 112-byte inline buffer\n(rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses.\nThis size was calculated based on OPEN responses and does not account\nfor LOCK denied responses, which include the conflicting lock owner as\na variable-length field up to 1024 bytes (NFS4_OPAQUE_LIMIT).\n\nWhen a LOCK operation is denied due to a conflict with an existing lock\nthat has a large owner, nfsd4_encode_operation() copies the full encoded\nresponse into the undersized replay buffer via read_bytes_from_xdr_buf()\nwith no bounds check. This results in a slab-out-of-bounds write of up\nto 944 bytes past the end of the buffer, corrupting adjacent heap memory.\n\nThis can be triggered remotely by an unauthenticated attacker with two\ncooperating NFSv4.0 clients: one sets a lock with a large owner string,\nthen the other requests a conflicting lock to provoke the denial.\n\nWe could fix this by increasing NFSD4_REPLAY_ISIZE to allow for a full\nopaque, but that would increase the size of every stateowner, when most\nlockowners are not that large.\n\nInstead, fix this by checking the encoded response length against\nNFSD4_REPLAY_ISIZE before copying into the replay buffer. If the\nresponse is too large, set rp_buflen to 0 to skip caching the replay\npayload. The status is still cached, and the client already received the\ncorrect response on the original request.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31402",
"url": "https://www.suse.com/security/cve/CVE-2026-31402"
},
{
"category": "external",
"summary": "SUSE Bug 1261638 for CVE-2026-31402",
"url": "https://bugzilla.suse.com/1261638"
},
{
"category": "external",
"summary": "SUSE Bug 1261640 for CVE-2026-31402",
"url": "https://bugzilla.suse.com/1261640"
},
{
"category": "external",
"summary": "SUSE Bug 1265160 for CVE-2026-31402",
"url": "https://bugzilla.suse.com/1265160"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T11:19:56Z",
"details": "important"
}
],
"title": "CVE-2026-31402"
},
{
"cve": "CVE-2026-31504",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31504"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix fanout UAF in packet_release() via NETDEV_UP race\n\n`packet_release()` has a race window where `NETDEV_UP` can re-register a\nsocket into a fanout group\u0027s `arr[]` array. The re-registration is not\ncleaned up by `fanout_release()`, leaving a dangling pointer in the fanout\narray.\n`packet_release()` does NOT zero `po-\u003enum` in its `bind_lock` section.\nAfter releasing `bind_lock`, `po-\u003enum` is still non-zero and `po-\u003eifindex`\nstill matches the bound device. A concurrent `packet_notifier(NETDEV_UP)`\nthat already found the socket in `sklist` can re-register the hook.\nFor fanout sockets, this re-registration calls `__fanout_link(sk, po)`\nwhich adds the socket back into `f-\u003earr[]` and increments `f-\u003enum_members`,\nbut does NOT increment `f-\u003esk_ref`.\n\nThe fix sets `po-\u003enum` to zero in `packet_release` while `bind_lock` is\nheld to prevent NETDEV_UP from linking, preventing the race window.\n\nThis bug was found following an additional audit with Claude Code based\non CVE-2025-38617.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31504",
"url": "https://www.suse.com/security/cve/CVE-2026-31504"
},
{
"category": "external",
"summary": "SUSE Bug 1263085 for CVE-2026-31504",
"url": "https://bugzilla.suse.com/1263085"
},
{
"category": "external",
"summary": "SUSE Bug 1263088 for CVE-2026-31504",
"url": "https://bugzilla.suse.com/1263088"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T11:19:56Z",
"details": "important"
}
],
"title": "CVE-2026-31504"
},
{
"cve": "CVE-2026-31554",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31554"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Require sys_futex_requeue() to have identical flags\n\nNicholas reported that his LLM found it was possible to create a UaF\nwhen sys_futex_requeue() is used with different flags. The initial\nmotivation for allowing different flags was the variable sized futex,\nbut since that hasn\u0027t been merged (yet), simply mandate the flags are\nidentical, as is the case for the old style sys_futex() requeue\noperations.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31554",
"url": "https://www.suse.com/security/cve/CVE-2026-31554"
},
{
"category": "external",
"summary": "SUSE Bug 1263107 for CVE-2026-31554",
"url": "https://bugzilla.suse.com/1263107"
},
{
"category": "external",
"summary": "SUSE Bug 1263108 for CVE-2026-31554",
"url": "https://bugzilla.suse.com/1263108"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T11:19:56Z",
"details": "important"
}
],
"title": "CVE-2026-31554"
},
{
"cve": "CVE-2026-31694",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31694"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: reject oversized dirents in page cache\n\nfuse_add_dirent_to_cache() computes a serialized dirent size from the\nserver-controlled namelen field and copies the dirent into a single\npage-cache page. The existing logic only checks whether the dirent fits\nin the remaining space of the current page and advances to a fresh page\nif not. It never checks whether the dirent itself exceeds PAGE_SIZE.\n\nAs a result, a malicious FUSE server can return a dirent with\nnamelen=4095, producing a serialized record size of 4120 bytes. On 4 KiB\npage systems this causes memcpy() to overflow the cache page by 24 bytes\ninto the following kernel page.\n\nReject dirents that cannot fit in a single page before copying them into\nthe readdir cache.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31694",
"url": "https://www.suse.com/security/cve/CVE-2026-31694"
},
{
"category": "external",
"summary": "SUSE Bug 1263901 for CVE-2026-31694",
"url": "https://bugzilla.suse.com/1263901"
},
{
"category": "external",
"summary": "SUSE Bug 1263902 for CVE-2026-31694",
"url": "https://bugzilla.suse.com/1263902"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T11:19:56Z",
"details": "important"
}
],
"title": "CVE-2026-31694"
},
{
"cve": "CVE-2026-43503",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-43503"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: propagate shared-frag marker through frag-transfer helpers\n\nTwo frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail\nto propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()-\u003eflags when\nmoving frags from source to destination. __pskb_copy_fclone() defers\nthe rest of the shinfo metadata to skb_copy_header() after copying\nfrag descriptors, but that helper only carries over gso_{size,segs,\ntype} and never touches skb_shinfo()-\u003eflags; skb_shift() moves frag\ndescriptors directly and leaves flags untouched. As a result, the\ndestination skb keeps a reference to the same externally-owned or\npage-cache-backed pages while reporting skb_has_shared_frag() as\nfalse.\n\nThe mismatch is harmful in any in-place writer that uses\nskb_has_shared_frag() to decide whether shared pages must be detoured\nthrough skb_cow_data(). ESP input is one such writer (esp4.c,\nesp6.c), and a single nft \u0027dup to \u003clocal\u003e\u0027 rule -- or any other\nnf_dup_ipv4() / xt_TEE caller -- is enough to land a pskb_copy()\u0027d\nskb in esp_input() with the marker stripped, letting an unprivileged\nuser write into the page cache of a root-owned read-only file via\nauthencesn-ESN stray writes.\n\nSet SKBFL_SHARED_FRAG on the destination whenever frag descriptors\nwere actually moved from the source. skb_copy() and skb_copy_expand()\nshare skb_copy_header() too but linearize all paged data into freshly\nallocated head storage and emerge with nr_frags == 0, so\nskb_has_shared_frag() returns false on its own; they need no change.\n\nThe same omission exists in skb_gro_receive() and skb_gro_receive_list().\nThe former moves the incoming skb\u0027s frag descriptors into the\naccumulator\u0027s last sub-skb via two paths (a direct frag-move loop and\nthe head_frag + memcpy path); the latter chains the incoming skb whole\nonto p\u0027s frag_list. Downstream skb_segment() reads only\nskb_shinfo(p)-\u003eflags, and skb_segment_list() reuses each sub-skb\u0027s\nshinfo as the nskb -- both p and lp must carry the marker.\n\nThe same omission also exists in tcp_clone_payload(), which builds an\nMTU probe skb by moving frag descriptors from skbs on sk_write_queue\ninto a freshly allocated nskb. The helper falls into the same family\nand warrants the same fix for consistency; no TCP TX-side in-place\nwriter is currently known to reach a user page through this gap, but\na future consumer depending on the marker would regress silently.\n\nThe same omission exists in skb_segment(): the per-iteration flag\nmerge takes only head_skb\u0027s flag, and the inner switch that rebinds\nfrag_skb to list_skb on head_skb-frags exhaustion does not fold the\nnew frag_skb\u0027s flag into nskb. Fold frag_skb\u0027s flag at both sites\nso segments drawing frags from frag_list members carry the marker.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-43503",
"url": "https://www.suse.com/security/cve/CVE-2026-43503"
},
{
"category": "external",
"summary": "SUSE Bug 1265209 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1265209"
},
{
"category": "external",
"summary": "SUSE Bug 1265960 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1265960"
},
{
"category": "external",
"summary": "SUSE Bug 1266229 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1266229"
},
{
"category": "external",
"summary": "SUSE Bug 1269878 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1269878"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T11:19:56Z",
"details": "important"
}
],
"title": "CVE-2026-43503"
},
{
"cve": "CVE-2026-46323",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46323"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gro: don\u0027t merge zcopy skbs\n\nskb_gro_receive() can currently copy frags between the source and GRO\nskb, without checking the zerocopy status, and in particular the\nSKBFL_MANAGED_FRAG_REFS flag.\n\nWhen SKBFL_MANAGED_FRAG_REFS is set, the skb doesn\u0027t hold a reference\non the pages in shinfo-\u003efrags. Appending those frags to another skb\u0027s\nfrags without fixing up the page refcount can lead to UAF.\n\nWhen either the last skb in the GRO chain (the one we would append\nfrags to) or the source skb is zerocopy, don\u0027t merge the skbs.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46323",
"url": "https://www.suse.com/security/cve/CVE-2026-46323"
},
{
"category": "external",
"summary": "SUSE Bug 1268029 for CVE-2026-46323",
"url": "https://bugzilla.suse.com/1268029"
},
{
"category": "external",
"summary": "SUSE Bug 1268282 for CVE-2026-46323",
"url": "https://bugzilla.suse.com/1268282"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_8-default-9-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T11:19:56Z",
"details": "important"
}
],
"title": "CVE-2026-46323"
}
]
}
SUSE-SU-2026:22391-1
Vulnerability from csaf_suse - Published: 2026-06-26 08:09 - Updated: 2026-06-26 08:09Summary
Security update for the Linux Kernel (Live Patch 10 for SUSE Linux Enterprise 16)
Severity
Important
Notes
Title of the patch: Security update for the Linux Kernel (Live Patch 10 for SUSE Linux Enterprise 16)
Description of the patch:
This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.31.1 fixes various security issues
The following security issues were fixed:
- CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).
- CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).
- CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263108).
- CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).
- CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).
- CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282).
- net/sched: fix pedit partial COW leading to page cache (bsc#1267625).
Patchnames: SUSE-SLES-16.0-1087
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
8.2 (High)
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.8 (High)
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.8 (High)
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.8 (High)
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
38 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for the Linux Kernel (Live Patch 10 for SUSE Linux Enterprise 16)",
"title": "Title of the patch"
},
{
"category": "description",
"text": "\nThis update for the SUSE Linux Enterprise Kernel 6.12.0-160000.31.1 fixes various security issues\n\nThe following security issues were fixed:\n\n- CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).\n- CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).\n- CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263108).\n- CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).\n- CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).\n- CVE-2026-46323: net: gro: don\u0027t merge zcopy skbs (bsc#1268282).\n- net/sched: fix pedit partial COW leading to page cache (bsc#1267625).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLES-16.0-1087",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22391-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:22391-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622391-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:22391-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-July/047748.html"
},
{
"category": "self",
"summary": "SUSE Bug 1261640",
"url": "https://bugzilla.suse.com/1261640"
},
{
"category": "self",
"summary": "SUSE Bug 1263088",
"url": "https://bugzilla.suse.com/1263088"
},
{
"category": "self",
"summary": "SUSE Bug 1263108",
"url": "https://bugzilla.suse.com/1263108"
},
{
"category": "self",
"summary": "SUSE Bug 1263902",
"url": "https://bugzilla.suse.com/1263902"
},
{
"category": "self",
"summary": "SUSE Bug 1266229",
"url": "https://bugzilla.suse.com/1266229"
},
{
"category": "self",
"summary": "SUSE Bug 1267625",
"url": "https://bugzilla.suse.com/1267625"
},
{
"category": "self",
"summary": "SUSE Bug 1268282",
"url": "https://bugzilla.suse.com/1268282"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31402 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31402/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31504 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31504/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31554 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31554/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31694 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31694/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-43503 page",
"url": "https://www.suse.com/security/cve/CVE-2026-43503/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46323 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46323/"
}
],
"title": "Security update for the Linux Kernel (Live Patch 10 for SUSE Linux Enterprise 16)",
"tracking": {
"current_release_date": "2026-06-26T08:09:55Z",
"generator": {
"date": "2026-06-26T08:09:55Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:22391-1",
"initial_release_date": "2026-06-26T08:09:55Z",
"revision_history": [
{
"date": "2026-06-26T08:09:55Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"product": {
"name": "kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"product_id": "kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"product": {
"name": "kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"product_id": "kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64",
"product": {
"name": "kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64",
"product_id": "kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 16.0",
"product": {
"name": "SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product": {
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le"
},
"product_reference": "kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x"
},
"product_reference": "kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64"
},
"product_reference": "kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le"
},
"product_reference": "kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x"
},
"product_reference": "kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64"
},
"product_reference": "kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-31402",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31402"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix heap overflow in NFSv4.0 LOCK replay cache\n\nThe NFSv4.0 replay cache uses a fixed 112-byte inline buffer\n(rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses.\nThis size was calculated based on OPEN responses and does not account\nfor LOCK denied responses, which include the conflicting lock owner as\na variable-length field up to 1024 bytes (NFS4_OPAQUE_LIMIT).\n\nWhen a LOCK operation is denied due to a conflict with an existing lock\nthat has a large owner, nfsd4_encode_operation() copies the full encoded\nresponse into the undersized replay buffer via read_bytes_from_xdr_buf()\nwith no bounds check. This results in a slab-out-of-bounds write of up\nto 944 bytes past the end of the buffer, corrupting adjacent heap memory.\n\nThis can be triggered remotely by an unauthenticated attacker with two\ncooperating NFSv4.0 clients: one sets a lock with a large owner string,\nthen the other requests a conflicting lock to provoke the denial.\n\nWe could fix this by increasing NFSD4_REPLAY_ISIZE to allow for a full\nopaque, but that would increase the size of every stateowner, when most\nlockowners are not that large.\n\nInstead, fix this by checking the encoded response length against\nNFSD4_REPLAY_ISIZE before copying into the replay buffer. If the\nresponse is too large, set rp_buflen to 0 to skip caching the replay\npayload. The status is still cached, and the client already received the\ncorrect response on the original request.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31402",
"url": "https://www.suse.com/security/cve/CVE-2026-31402"
},
{
"category": "external",
"summary": "SUSE Bug 1261638 for CVE-2026-31402",
"url": "https://bugzilla.suse.com/1261638"
},
{
"category": "external",
"summary": "SUSE Bug 1261640 for CVE-2026-31402",
"url": "https://bugzilla.suse.com/1261640"
},
{
"category": "external",
"summary": "SUSE Bug 1265160 for CVE-2026-31402",
"url": "https://bugzilla.suse.com/1265160"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-26T08:09:55Z",
"details": "important"
}
],
"title": "CVE-2026-31402"
},
{
"cve": "CVE-2026-31504",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31504"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix fanout UAF in packet_release() via NETDEV_UP race\n\n`packet_release()` has a race window where `NETDEV_UP` can re-register a\nsocket into a fanout group\u0027s `arr[]` array. The re-registration is not\ncleaned up by `fanout_release()`, leaving a dangling pointer in the fanout\narray.\n`packet_release()` does NOT zero `po-\u003enum` in its `bind_lock` section.\nAfter releasing `bind_lock`, `po-\u003enum` is still non-zero and `po-\u003eifindex`\nstill matches the bound device. A concurrent `packet_notifier(NETDEV_UP)`\nthat already found the socket in `sklist` can re-register the hook.\nFor fanout sockets, this re-registration calls `__fanout_link(sk, po)`\nwhich adds the socket back into `f-\u003earr[]` and increments `f-\u003enum_members`,\nbut does NOT increment `f-\u003esk_ref`.\n\nThe fix sets `po-\u003enum` to zero in `packet_release` while `bind_lock` is\nheld to prevent NETDEV_UP from linking, preventing the race window.\n\nThis bug was found following an additional audit with Claude Code based\non CVE-2025-38617.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31504",
"url": "https://www.suse.com/security/cve/CVE-2026-31504"
},
{
"category": "external",
"summary": "SUSE Bug 1263085 for CVE-2026-31504",
"url": "https://bugzilla.suse.com/1263085"
},
{
"category": "external",
"summary": "SUSE Bug 1263088 for CVE-2026-31504",
"url": "https://bugzilla.suse.com/1263088"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-26T08:09:55Z",
"details": "important"
}
],
"title": "CVE-2026-31504"
},
{
"cve": "CVE-2026-31554",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31554"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Require sys_futex_requeue() to have identical flags\n\nNicholas reported that his LLM found it was possible to create a UaF\nwhen sys_futex_requeue() is used with different flags. The initial\nmotivation for allowing different flags was the variable sized futex,\nbut since that hasn\u0027t been merged (yet), simply mandate the flags are\nidentical, as is the case for the old style sys_futex() requeue\noperations.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31554",
"url": "https://www.suse.com/security/cve/CVE-2026-31554"
},
{
"category": "external",
"summary": "SUSE Bug 1263107 for CVE-2026-31554",
"url": "https://bugzilla.suse.com/1263107"
},
{
"category": "external",
"summary": "SUSE Bug 1263108 for CVE-2026-31554",
"url": "https://bugzilla.suse.com/1263108"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-26T08:09:55Z",
"details": "important"
}
],
"title": "CVE-2026-31554"
},
{
"cve": "CVE-2026-31694",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31694"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: reject oversized dirents in page cache\n\nfuse_add_dirent_to_cache() computes a serialized dirent size from the\nserver-controlled namelen field and copies the dirent into a single\npage-cache page. The existing logic only checks whether the dirent fits\nin the remaining space of the current page and advances to a fresh page\nif not. It never checks whether the dirent itself exceeds PAGE_SIZE.\n\nAs a result, a malicious FUSE server can return a dirent with\nnamelen=4095, producing a serialized record size of 4120 bytes. On 4 KiB\npage systems this causes memcpy() to overflow the cache page by 24 bytes\ninto the following kernel page.\n\nReject dirents that cannot fit in a single page before copying them into\nthe readdir cache.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31694",
"url": "https://www.suse.com/security/cve/CVE-2026-31694"
},
{
"category": "external",
"summary": "SUSE Bug 1263901 for CVE-2026-31694",
"url": "https://bugzilla.suse.com/1263901"
},
{
"category": "external",
"summary": "SUSE Bug 1263902 for CVE-2026-31694",
"url": "https://bugzilla.suse.com/1263902"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-26T08:09:55Z",
"details": "important"
}
],
"title": "CVE-2026-31694"
},
{
"cve": "CVE-2026-43503",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-43503"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: propagate shared-frag marker through frag-transfer helpers\n\nTwo frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail\nto propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()-\u003eflags when\nmoving frags from source to destination. __pskb_copy_fclone() defers\nthe rest of the shinfo metadata to skb_copy_header() after copying\nfrag descriptors, but that helper only carries over gso_{size,segs,\ntype} and never touches skb_shinfo()-\u003eflags; skb_shift() moves frag\ndescriptors directly and leaves flags untouched. As a result, the\ndestination skb keeps a reference to the same externally-owned or\npage-cache-backed pages while reporting skb_has_shared_frag() as\nfalse.\n\nThe mismatch is harmful in any in-place writer that uses\nskb_has_shared_frag() to decide whether shared pages must be detoured\nthrough skb_cow_data(). ESP input is one such writer (esp4.c,\nesp6.c), and a single nft \u0027dup to \u003clocal\u003e\u0027 rule -- or any other\nnf_dup_ipv4() / xt_TEE caller -- is enough to land a pskb_copy()\u0027d\nskb in esp_input() with the marker stripped, letting an unprivileged\nuser write into the page cache of a root-owned read-only file via\nauthencesn-ESN stray writes.\n\nSet SKBFL_SHARED_FRAG on the destination whenever frag descriptors\nwere actually moved from the source. skb_copy() and skb_copy_expand()\nshare skb_copy_header() too but linearize all paged data into freshly\nallocated head storage and emerge with nr_frags == 0, so\nskb_has_shared_frag() returns false on its own; they need no change.\n\nThe same omission exists in skb_gro_receive() and skb_gro_receive_list().\nThe former moves the incoming skb\u0027s frag descriptors into the\naccumulator\u0027s last sub-skb via two paths (a direct frag-move loop and\nthe head_frag + memcpy path); the latter chains the incoming skb whole\nonto p\u0027s frag_list. Downstream skb_segment() reads only\nskb_shinfo(p)-\u003eflags, and skb_segment_list() reuses each sub-skb\u0027s\nshinfo as the nskb -- both p and lp must carry the marker.\n\nThe same omission also exists in tcp_clone_payload(), which builds an\nMTU probe skb by moving frag descriptors from skbs on sk_write_queue\ninto a freshly allocated nskb. The helper falls into the same family\nand warrants the same fix for consistency; no TCP TX-side in-place\nwriter is currently known to reach a user page through this gap, but\na future consumer depending on the marker would regress silently.\n\nThe same omission exists in skb_segment(): the per-iteration flag\nmerge takes only head_skb\u0027s flag, and the inner switch that rebinds\nfrag_skb to list_skb on head_skb-frags exhaustion does not fold the\nnew frag_skb\u0027s flag into nskb. Fold frag_skb\u0027s flag at both sites\nso segments drawing frags from frag_list members carry the marker.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-43503",
"url": "https://www.suse.com/security/cve/CVE-2026-43503"
},
{
"category": "external",
"summary": "SUSE Bug 1265209 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1265209"
},
{
"category": "external",
"summary": "SUSE Bug 1265960 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1265960"
},
{
"category": "external",
"summary": "SUSE Bug 1266229 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1266229"
},
{
"category": "external",
"summary": "SUSE Bug 1269878 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1269878"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-26T08:09:55Z",
"details": "important"
}
],
"title": "CVE-2026-43503"
},
{
"cve": "CVE-2026-46323",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46323"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gro: don\u0027t merge zcopy skbs\n\nskb_gro_receive() can currently copy frags between the source and GRO\nskb, without checking the zerocopy status, and in particular the\nSKBFL_MANAGED_FRAG_REFS flag.\n\nWhen SKBFL_MANAGED_FRAG_REFS is set, the skb doesn\u0027t hold a reference\non the pages in shinfo-\u003efrags. Appending those frags to another skb\u0027s\nfrags without fixing up the page refcount can lead to UAF.\n\nWhen either the last skb in the GRO chain (the one we would append\nfrags to) or the source skb is zerocopy, don\u0027t merge the skbs.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46323",
"url": "https://www.suse.com/security/cve/CVE-2026-46323"
},
{
"category": "external",
"summary": "SUSE Bug 1268029 for CVE-2026-46323",
"url": "https://bugzilla.suse.com/1268029"
},
{
"category": "external",
"summary": "SUSE Bug 1268282 for CVE-2026-46323",
"url": "https://bugzilla.suse.com/1268282"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:kernel-livepatch-6_12_0-160000_31-default-3-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-26T08:09:55Z",
"details": "important"
}
],
"title": "CVE-2026-46323"
}
]
}
SUSE-SU-2026:22396-1
Vulnerability from csaf_suse - Published: 2026-06-24 09:39 - Updated: 2026-06-24 09:39Summary
Security update for the Linux Kernel RT (Live Patch 8 for SUSE Linux Enterprise Micro 6.0)
Severity
Important
Notes
Title of the patch: Security update for the Linux Kernel RT (Live Patch 8 for SUSE Linux Enterprise Micro 6.0)
Description of the patch:
This update for the SUSE Linux Enterprise Kernel 6.4.0-31.1 fixes various security issues
The following security issues were fixed:
- CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1260907).
- CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).
- CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).
- CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).
- CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).
- CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282).
- net/sched: fix pedit partial COW leading to page cache (bsc#1267625).
Patchnames: SUSE-SLE-Micro-6.0-kernel-468
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
Affected products
Recommended
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-31-rt-19-1.2.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.2 (High)
Affected products
Recommended
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-31-rt-19-1.2.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-31-rt-19-1.2.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.8 (High)
Affected products
Recommended
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-31-rt-19-1.2.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.8 (High)
Affected products
Recommended
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-31-rt-19-1.2.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-31-rt-19-1.2.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
40 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for the Linux Kernel RT (Live Patch 8 for SUSE Linux Enterprise Micro 6.0)",
"title": "Title of the patch"
},
{
"category": "description",
"text": "\nThis update for the SUSE Linux Enterprise Kernel 6.4.0-31.1 fixes various security issues\n\nThe following security issues were fixed:\n\n- CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1260907).\n- CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).\n- CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).\n- CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).\n- CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).\n- CVE-2026-46323: net: gro: don\u0027t merge zcopy skbs (bsc#1268282).\n- net/sched: fix pedit partial COW leading to page cache (bsc#1267625).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-Micro-6.0-kernel-468",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22396-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:22396-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622396-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:22396-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027208.html"
},
{
"category": "self",
"summary": "SUSE Bug 1260907",
"url": "https://bugzilla.suse.com/1260907"
},
{
"category": "self",
"summary": "SUSE Bug 1261640",
"url": "https://bugzilla.suse.com/1261640"
},
{
"category": "self",
"summary": "SUSE Bug 1263088",
"url": "https://bugzilla.suse.com/1263088"
},
{
"category": "self",
"summary": "SUSE Bug 1263902",
"url": "https://bugzilla.suse.com/1263902"
},
{
"category": "self",
"summary": "SUSE Bug 1266229",
"url": "https://bugzilla.suse.com/1266229"
},
{
"category": "self",
"summary": "SUSE Bug 1267625",
"url": "https://bugzilla.suse.com/1267625"
},
{
"category": "self",
"summary": "SUSE Bug 1268282",
"url": "https://bugzilla.suse.com/1268282"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-23278 page",
"url": "https://www.suse.com/security/cve/CVE-2026-23278/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31402 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31402/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31504 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31504/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31694 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31694/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-43503 page",
"url": "https://www.suse.com/security/cve/CVE-2026-43503/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46323 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46323/"
}
],
"title": "Security update for the Linux Kernel RT (Live Patch 8 for SUSE Linux Enterprise Micro 6.0)",
"tracking": {
"current_release_date": "2026-06-24T09:39:09Z",
"generator": {
"date": "2026-06-24T09:39:09Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:22396-1",
"initial_release_date": "2026-06-24T09:39:09Z",
"revision_history": [
{
"date": "2026-06-24T09:39:09Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "kernel-livepatch-6_4_0-31-rt-19-1.2.x86_64",
"product": {
"name": "kernel-livepatch-6_4_0-31-rt-19-1.2.x86_64",
"product_id": "kernel-livepatch-6_4_0-31-rt-19-1.2.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.0",
"product": {
"name": "SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.0"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_4_0-31-rt-19-1.2.x86_64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-31-rt-19-1.2.x86_64"
},
"product_reference": "kernel-livepatch-6_4_0-31-rt-19-1.2.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-23278",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-23278"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: always walk all pending catchall elements\n\nDuring transaction processing we might have more than one catchall element:\n1 live catchall element and 1 pending element that is coming as part of the\nnew batch.\n\nIf the map holding the catchall elements is also going away, its\nrequired to toggle all catchall elements and not just the first viable\ncandidate.\n\nOtherwise, we get:\n WARNING: ./include/net/netfilter/nf_tables.h:1281 at nft_data_release+0xb7/0xe0 [nf_tables], CPU#2: nft/1404\n RIP: 0010:nft_data_release+0xb7/0xe0 [nf_tables]\n [..]\n __nft_set_elem_destroy+0x106/0x380 [nf_tables]\n nf_tables_abort_release+0x348/0x8d0 [nf_tables]\n nf_tables_abort+0xcf2/0x3ac0 [nf_tables]\n nfnetlink_rcv_batch+0x9c9/0x20e0 [..]",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-31-rt-19-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-23278",
"url": "https://www.suse.com/security/cve/CVE-2026-23278"
},
{
"category": "external",
"summary": "SUSE Bug 1259998 for CVE-2026-23278",
"url": "https://bugzilla.suse.com/1259998"
},
{
"category": "external",
"summary": "SUSE Bug 1260907 for CVE-2026-23278",
"url": "https://bugzilla.suse.com/1260907"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-31-rt-19-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-31-rt-19-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-24T09:39:09Z",
"details": "important"
}
],
"title": "CVE-2026-23278"
},
{
"cve": "CVE-2026-31402",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31402"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix heap overflow in NFSv4.0 LOCK replay cache\n\nThe NFSv4.0 replay cache uses a fixed 112-byte inline buffer\n(rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses.\nThis size was calculated based on OPEN responses and does not account\nfor LOCK denied responses, which include the conflicting lock owner as\na variable-length field up to 1024 bytes (NFS4_OPAQUE_LIMIT).\n\nWhen a LOCK operation is denied due to a conflict with an existing lock\nthat has a large owner, nfsd4_encode_operation() copies the full encoded\nresponse into the undersized replay buffer via read_bytes_from_xdr_buf()\nwith no bounds check. This results in a slab-out-of-bounds write of up\nto 944 bytes past the end of the buffer, corrupting adjacent heap memory.\n\nThis can be triggered remotely by an unauthenticated attacker with two\ncooperating NFSv4.0 clients: one sets a lock with a large owner string,\nthen the other requests a conflicting lock to provoke the denial.\n\nWe could fix this by increasing NFSD4_REPLAY_ISIZE to allow for a full\nopaque, but that would increase the size of every stateowner, when most\nlockowners are not that large.\n\nInstead, fix this by checking the encoded response length against\nNFSD4_REPLAY_ISIZE before copying into the replay buffer. If the\nresponse is too large, set rp_buflen to 0 to skip caching the replay\npayload. The status is still cached, and the client already received the\ncorrect response on the original request.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-31-rt-19-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31402",
"url": "https://www.suse.com/security/cve/CVE-2026-31402"
},
{
"category": "external",
"summary": "SUSE Bug 1261638 for CVE-2026-31402",
"url": "https://bugzilla.suse.com/1261638"
},
{
"category": "external",
"summary": "SUSE Bug 1261640 for CVE-2026-31402",
"url": "https://bugzilla.suse.com/1261640"
},
{
"category": "external",
"summary": "SUSE Bug 1265160 for CVE-2026-31402",
"url": "https://bugzilla.suse.com/1265160"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-31-rt-19-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-31-rt-19-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-24T09:39:09Z",
"details": "important"
}
],
"title": "CVE-2026-31402"
},
{
"cve": "CVE-2026-31504",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31504"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix fanout UAF in packet_release() via NETDEV_UP race\n\n`packet_release()` has a race window where `NETDEV_UP` can re-register a\nsocket into a fanout group\u0027s `arr[]` array. The re-registration is not\ncleaned up by `fanout_release()`, leaving a dangling pointer in the fanout\narray.\n`packet_release()` does NOT zero `po-\u003enum` in its `bind_lock` section.\nAfter releasing `bind_lock`, `po-\u003enum` is still non-zero and `po-\u003eifindex`\nstill matches the bound device. A concurrent `packet_notifier(NETDEV_UP)`\nthat already found the socket in `sklist` can re-register the hook.\nFor fanout sockets, this re-registration calls `__fanout_link(sk, po)`\nwhich adds the socket back into `f-\u003earr[]` and increments `f-\u003enum_members`,\nbut does NOT increment `f-\u003esk_ref`.\n\nThe fix sets `po-\u003enum` to zero in `packet_release` while `bind_lock` is\nheld to prevent NETDEV_UP from linking, preventing the race window.\n\nThis bug was found following an additional audit with Claude Code based\non CVE-2025-38617.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-31-rt-19-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31504",
"url": "https://www.suse.com/security/cve/CVE-2026-31504"
},
{
"category": "external",
"summary": "SUSE Bug 1263085 for CVE-2026-31504",
"url": "https://bugzilla.suse.com/1263085"
},
{
"category": "external",
"summary": "SUSE Bug 1263088 for CVE-2026-31504",
"url": "https://bugzilla.suse.com/1263088"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-31-rt-19-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-31-rt-19-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-24T09:39:09Z",
"details": "important"
}
],
"title": "CVE-2026-31504"
},
{
"cve": "CVE-2026-31694",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31694"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: reject oversized dirents in page cache\n\nfuse_add_dirent_to_cache() computes a serialized dirent size from the\nserver-controlled namelen field and copies the dirent into a single\npage-cache page. The existing logic only checks whether the dirent fits\nin the remaining space of the current page and advances to a fresh page\nif not. It never checks whether the dirent itself exceeds PAGE_SIZE.\n\nAs a result, a malicious FUSE server can return a dirent with\nnamelen=4095, producing a serialized record size of 4120 bytes. On 4 KiB\npage systems this causes memcpy() to overflow the cache page by 24 bytes\ninto the following kernel page.\n\nReject dirents that cannot fit in a single page before copying them into\nthe readdir cache.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-31-rt-19-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31694",
"url": "https://www.suse.com/security/cve/CVE-2026-31694"
},
{
"category": "external",
"summary": "SUSE Bug 1263901 for CVE-2026-31694",
"url": "https://bugzilla.suse.com/1263901"
},
{
"category": "external",
"summary": "SUSE Bug 1263902 for CVE-2026-31694",
"url": "https://bugzilla.suse.com/1263902"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-31-rt-19-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-31-rt-19-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-24T09:39:09Z",
"details": "important"
}
],
"title": "CVE-2026-31694"
},
{
"cve": "CVE-2026-43503",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-43503"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: propagate shared-frag marker through frag-transfer helpers\n\nTwo frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail\nto propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()-\u003eflags when\nmoving frags from source to destination. __pskb_copy_fclone() defers\nthe rest of the shinfo metadata to skb_copy_header() after copying\nfrag descriptors, but that helper only carries over gso_{size,segs,\ntype} and never touches skb_shinfo()-\u003eflags; skb_shift() moves frag\ndescriptors directly and leaves flags untouched. As a result, the\ndestination skb keeps a reference to the same externally-owned or\npage-cache-backed pages while reporting skb_has_shared_frag() as\nfalse.\n\nThe mismatch is harmful in any in-place writer that uses\nskb_has_shared_frag() to decide whether shared pages must be detoured\nthrough skb_cow_data(). ESP input is one such writer (esp4.c,\nesp6.c), and a single nft \u0027dup to \u003clocal\u003e\u0027 rule -- or any other\nnf_dup_ipv4() / xt_TEE caller -- is enough to land a pskb_copy()\u0027d\nskb in esp_input() with the marker stripped, letting an unprivileged\nuser write into the page cache of a root-owned read-only file via\nauthencesn-ESN stray writes.\n\nSet SKBFL_SHARED_FRAG on the destination whenever frag descriptors\nwere actually moved from the source. skb_copy() and skb_copy_expand()\nshare skb_copy_header() too but linearize all paged data into freshly\nallocated head storage and emerge with nr_frags == 0, so\nskb_has_shared_frag() returns false on its own; they need no change.\n\nThe same omission exists in skb_gro_receive() and skb_gro_receive_list().\nThe former moves the incoming skb\u0027s frag descriptors into the\naccumulator\u0027s last sub-skb via two paths (a direct frag-move loop and\nthe head_frag + memcpy path); the latter chains the incoming skb whole\nonto p\u0027s frag_list. Downstream skb_segment() reads only\nskb_shinfo(p)-\u003eflags, and skb_segment_list() reuses each sub-skb\u0027s\nshinfo as the nskb -- both p and lp must carry the marker.\n\nThe same omission also exists in tcp_clone_payload(), which builds an\nMTU probe skb by moving frag descriptors from skbs on sk_write_queue\ninto a freshly allocated nskb. The helper falls into the same family\nand warrants the same fix for consistency; no TCP TX-side in-place\nwriter is currently known to reach a user page through this gap, but\na future consumer depending on the marker would regress silently.\n\nThe same omission exists in skb_segment(): the per-iteration flag\nmerge takes only head_skb\u0027s flag, and the inner switch that rebinds\nfrag_skb to list_skb on head_skb-frags exhaustion does not fold the\nnew frag_skb\u0027s flag into nskb. Fold frag_skb\u0027s flag at both sites\nso segments drawing frags from frag_list members carry the marker.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-31-rt-19-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-43503",
"url": "https://www.suse.com/security/cve/CVE-2026-43503"
},
{
"category": "external",
"summary": "SUSE Bug 1265209 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1265209"
},
{
"category": "external",
"summary": "SUSE Bug 1265960 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1265960"
},
{
"category": "external",
"summary": "SUSE Bug 1266229 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1266229"
},
{
"category": "external",
"summary": "SUSE Bug 1269878 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1269878"
},
{
"category": "external",
"summary": "SUSE Bug 1270098 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1270098"
},
{
"category": "external",
"summary": "SUSE Bug 1270100 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1270100"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-31-rt-19-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-31-rt-19-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-24T09:39:09Z",
"details": "important"
}
],
"title": "CVE-2026-43503"
},
{
"cve": "CVE-2026-46323",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46323"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gro: don\u0027t merge zcopy skbs\n\nskb_gro_receive() can currently copy frags between the source and GRO\nskb, without checking the zerocopy status, and in particular the\nSKBFL_MANAGED_FRAG_REFS flag.\n\nWhen SKBFL_MANAGED_FRAG_REFS is set, the skb doesn\u0027t hold a reference\non the pages in shinfo-\u003efrags. Appending those frags to another skb\u0027s\nfrags without fixing up the page refcount can lead to UAF.\n\nWhen either the last skb in the GRO chain (the one we would append\nfrags to) or the source skb is zerocopy, don\u0027t merge the skbs.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-31-rt-19-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46323",
"url": "https://www.suse.com/security/cve/CVE-2026-46323"
},
{
"category": "external",
"summary": "SUSE Bug 1268029 for CVE-2026-46323",
"url": "https://bugzilla.suse.com/1268029"
},
{
"category": "external",
"summary": "SUSE Bug 1268282 for CVE-2026-46323",
"url": "https://bugzilla.suse.com/1268282"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-31-rt-19-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-31-rt-19-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-24T09:39:09Z",
"details": "important"
}
],
"title": "CVE-2026-46323"
}
]
}
SUSE-SU-2026:22397-1
Vulnerability from csaf_suse - Published: 2026-06-24 09:39 - Updated: 2026-06-24 09:39Summary
Security update for the Linux Kernel RT (Live Patch 9 for SUSE Linux Enterprise Micro 6.0)
Severity
Important
Notes
Title of the patch: Security update for the Linux Kernel RT (Live Patch 9 for SUSE Linux Enterprise Micro 6.0)
Description of the patch:
This update for the SUSE Linux Enterprise Kernel 6.4.0-33.1 fixes various security issues
The following security issues were fixed:
- CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1260907).
- CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).
- CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).
- CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).
- CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).
- CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282).
- net/sched: fix pedit partial COW leading to page cache (bsc#1267625).
Patchnames: SUSE-SLE-Micro-6.0-kernel-469
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
Affected products
Recommended
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-33-rt-17-1.2.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.2 (High)
Affected products
Recommended
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-33-rt-17-1.2.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-33-rt-17-1.2.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.8 (High)
Affected products
Recommended
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-33-rt-17-1.2.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.8 (High)
Affected products
Recommended
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-33-rt-17-1.2.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-33-rt-17-1.2.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
40 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for the Linux Kernel RT (Live Patch 9 for SUSE Linux Enterprise Micro 6.0)",
"title": "Title of the patch"
},
{
"category": "description",
"text": "\nThis update for the SUSE Linux Enterprise Kernel 6.4.0-33.1 fixes various security issues\n\nThe following security issues were fixed:\n\n- CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1260907).\n- CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).\n- CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).\n- CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).\n- CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).\n- CVE-2026-46323: net: gro: don\u0027t merge zcopy skbs (bsc#1268282).\n- net/sched: fix pedit partial COW leading to page cache (bsc#1267625).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-Micro-6.0-kernel-469",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22397-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:22397-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622397-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:22397-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027207.html"
},
{
"category": "self",
"summary": "SUSE Bug 1260907",
"url": "https://bugzilla.suse.com/1260907"
},
{
"category": "self",
"summary": "SUSE Bug 1261640",
"url": "https://bugzilla.suse.com/1261640"
},
{
"category": "self",
"summary": "SUSE Bug 1263088",
"url": "https://bugzilla.suse.com/1263088"
},
{
"category": "self",
"summary": "SUSE Bug 1263902",
"url": "https://bugzilla.suse.com/1263902"
},
{
"category": "self",
"summary": "SUSE Bug 1266229",
"url": "https://bugzilla.suse.com/1266229"
},
{
"category": "self",
"summary": "SUSE Bug 1267625",
"url": "https://bugzilla.suse.com/1267625"
},
{
"category": "self",
"summary": "SUSE Bug 1268282",
"url": "https://bugzilla.suse.com/1268282"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-23278 page",
"url": "https://www.suse.com/security/cve/CVE-2026-23278/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31402 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31402/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31504 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31504/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31694 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31694/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-43503 page",
"url": "https://www.suse.com/security/cve/CVE-2026-43503/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46323 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46323/"
}
],
"title": "Security update for the Linux Kernel RT (Live Patch 9 for SUSE Linux Enterprise Micro 6.0)",
"tracking": {
"current_release_date": "2026-06-24T09:39:09Z",
"generator": {
"date": "2026-06-24T09:39:09Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:22397-1",
"initial_release_date": "2026-06-24T09:39:09Z",
"revision_history": [
{
"date": "2026-06-24T09:39:09Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "kernel-livepatch-6_4_0-33-rt-17-1.2.x86_64",
"product": {
"name": "kernel-livepatch-6_4_0-33-rt-17-1.2.x86_64",
"product_id": "kernel-livepatch-6_4_0-33-rt-17-1.2.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.0",
"product": {
"name": "SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.0"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_4_0-33-rt-17-1.2.x86_64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-33-rt-17-1.2.x86_64"
},
"product_reference": "kernel-livepatch-6_4_0-33-rt-17-1.2.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-23278",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-23278"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: always walk all pending catchall elements\n\nDuring transaction processing we might have more than one catchall element:\n1 live catchall element and 1 pending element that is coming as part of the\nnew batch.\n\nIf the map holding the catchall elements is also going away, its\nrequired to toggle all catchall elements and not just the first viable\ncandidate.\n\nOtherwise, we get:\n WARNING: ./include/net/netfilter/nf_tables.h:1281 at nft_data_release+0xb7/0xe0 [nf_tables], CPU#2: nft/1404\n RIP: 0010:nft_data_release+0xb7/0xe0 [nf_tables]\n [..]\n __nft_set_elem_destroy+0x106/0x380 [nf_tables]\n nf_tables_abort_release+0x348/0x8d0 [nf_tables]\n nf_tables_abort+0xcf2/0x3ac0 [nf_tables]\n nfnetlink_rcv_batch+0x9c9/0x20e0 [..]",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-33-rt-17-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-23278",
"url": "https://www.suse.com/security/cve/CVE-2026-23278"
},
{
"category": "external",
"summary": "SUSE Bug 1259998 for CVE-2026-23278",
"url": "https://bugzilla.suse.com/1259998"
},
{
"category": "external",
"summary": "SUSE Bug 1260907 for CVE-2026-23278",
"url": "https://bugzilla.suse.com/1260907"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-33-rt-17-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-33-rt-17-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-24T09:39:09Z",
"details": "important"
}
],
"title": "CVE-2026-23278"
},
{
"cve": "CVE-2026-31402",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31402"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix heap overflow in NFSv4.0 LOCK replay cache\n\nThe NFSv4.0 replay cache uses a fixed 112-byte inline buffer\n(rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses.\nThis size was calculated based on OPEN responses and does not account\nfor LOCK denied responses, which include the conflicting lock owner as\na variable-length field up to 1024 bytes (NFS4_OPAQUE_LIMIT).\n\nWhen a LOCK operation is denied due to a conflict with an existing lock\nthat has a large owner, nfsd4_encode_operation() copies the full encoded\nresponse into the undersized replay buffer via read_bytes_from_xdr_buf()\nwith no bounds check. This results in a slab-out-of-bounds write of up\nto 944 bytes past the end of the buffer, corrupting adjacent heap memory.\n\nThis can be triggered remotely by an unauthenticated attacker with two\ncooperating NFSv4.0 clients: one sets a lock with a large owner string,\nthen the other requests a conflicting lock to provoke the denial.\n\nWe could fix this by increasing NFSD4_REPLAY_ISIZE to allow for a full\nopaque, but that would increase the size of every stateowner, when most\nlockowners are not that large.\n\nInstead, fix this by checking the encoded response length against\nNFSD4_REPLAY_ISIZE before copying into the replay buffer. If the\nresponse is too large, set rp_buflen to 0 to skip caching the replay\npayload. The status is still cached, and the client already received the\ncorrect response on the original request.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-33-rt-17-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31402",
"url": "https://www.suse.com/security/cve/CVE-2026-31402"
},
{
"category": "external",
"summary": "SUSE Bug 1261638 for CVE-2026-31402",
"url": "https://bugzilla.suse.com/1261638"
},
{
"category": "external",
"summary": "SUSE Bug 1261640 for CVE-2026-31402",
"url": "https://bugzilla.suse.com/1261640"
},
{
"category": "external",
"summary": "SUSE Bug 1265160 for CVE-2026-31402",
"url": "https://bugzilla.suse.com/1265160"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-33-rt-17-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-33-rt-17-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-24T09:39:09Z",
"details": "important"
}
],
"title": "CVE-2026-31402"
},
{
"cve": "CVE-2026-31504",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31504"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix fanout UAF in packet_release() via NETDEV_UP race\n\n`packet_release()` has a race window where `NETDEV_UP` can re-register a\nsocket into a fanout group\u0027s `arr[]` array. The re-registration is not\ncleaned up by `fanout_release()`, leaving a dangling pointer in the fanout\narray.\n`packet_release()` does NOT zero `po-\u003enum` in its `bind_lock` section.\nAfter releasing `bind_lock`, `po-\u003enum` is still non-zero and `po-\u003eifindex`\nstill matches the bound device. A concurrent `packet_notifier(NETDEV_UP)`\nthat already found the socket in `sklist` can re-register the hook.\nFor fanout sockets, this re-registration calls `__fanout_link(sk, po)`\nwhich adds the socket back into `f-\u003earr[]` and increments `f-\u003enum_members`,\nbut does NOT increment `f-\u003esk_ref`.\n\nThe fix sets `po-\u003enum` to zero in `packet_release` while `bind_lock` is\nheld to prevent NETDEV_UP from linking, preventing the race window.\n\nThis bug was found following an additional audit with Claude Code based\non CVE-2025-38617.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-33-rt-17-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31504",
"url": "https://www.suse.com/security/cve/CVE-2026-31504"
},
{
"category": "external",
"summary": "SUSE Bug 1263085 for CVE-2026-31504",
"url": "https://bugzilla.suse.com/1263085"
},
{
"category": "external",
"summary": "SUSE Bug 1263088 for CVE-2026-31504",
"url": "https://bugzilla.suse.com/1263088"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-33-rt-17-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-33-rt-17-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-24T09:39:09Z",
"details": "important"
}
],
"title": "CVE-2026-31504"
},
{
"cve": "CVE-2026-31694",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31694"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: reject oversized dirents in page cache\n\nfuse_add_dirent_to_cache() computes a serialized dirent size from the\nserver-controlled namelen field and copies the dirent into a single\npage-cache page. The existing logic only checks whether the dirent fits\nin the remaining space of the current page and advances to a fresh page\nif not. It never checks whether the dirent itself exceeds PAGE_SIZE.\n\nAs a result, a malicious FUSE server can return a dirent with\nnamelen=4095, producing a serialized record size of 4120 bytes. On 4 KiB\npage systems this causes memcpy() to overflow the cache page by 24 bytes\ninto the following kernel page.\n\nReject dirents that cannot fit in a single page before copying them into\nthe readdir cache.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-33-rt-17-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31694",
"url": "https://www.suse.com/security/cve/CVE-2026-31694"
},
{
"category": "external",
"summary": "SUSE Bug 1263901 for CVE-2026-31694",
"url": "https://bugzilla.suse.com/1263901"
},
{
"category": "external",
"summary": "SUSE Bug 1263902 for CVE-2026-31694",
"url": "https://bugzilla.suse.com/1263902"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-33-rt-17-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-33-rt-17-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-24T09:39:09Z",
"details": "important"
}
],
"title": "CVE-2026-31694"
},
{
"cve": "CVE-2026-43503",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-43503"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: propagate shared-frag marker through frag-transfer helpers\n\nTwo frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail\nto propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()-\u003eflags when\nmoving frags from source to destination. __pskb_copy_fclone() defers\nthe rest of the shinfo metadata to skb_copy_header() after copying\nfrag descriptors, but that helper only carries over gso_{size,segs,\ntype} and never touches skb_shinfo()-\u003eflags; skb_shift() moves frag\ndescriptors directly and leaves flags untouched. As a result, the\ndestination skb keeps a reference to the same externally-owned or\npage-cache-backed pages while reporting skb_has_shared_frag() as\nfalse.\n\nThe mismatch is harmful in any in-place writer that uses\nskb_has_shared_frag() to decide whether shared pages must be detoured\nthrough skb_cow_data(). ESP input is one such writer (esp4.c,\nesp6.c), and a single nft \u0027dup to \u003clocal\u003e\u0027 rule -- or any other\nnf_dup_ipv4() / xt_TEE caller -- is enough to land a pskb_copy()\u0027d\nskb in esp_input() with the marker stripped, letting an unprivileged\nuser write into the page cache of a root-owned read-only file via\nauthencesn-ESN stray writes.\n\nSet SKBFL_SHARED_FRAG on the destination whenever frag descriptors\nwere actually moved from the source. skb_copy() and skb_copy_expand()\nshare skb_copy_header() too but linearize all paged data into freshly\nallocated head storage and emerge with nr_frags == 0, so\nskb_has_shared_frag() returns false on its own; they need no change.\n\nThe same omission exists in skb_gro_receive() and skb_gro_receive_list().\nThe former moves the incoming skb\u0027s frag descriptors into the\naccumulator\u0027s last sub-skb via two paths (a direct frag-move loop and\nthe head_frag + memcpy path); the latter chains the incoming skb whole\nonto p\u0027s frag_list. Downstream skb_segment() reads only\nskb_shinfo(p)-\u003eflags, and skb_segment_list() reuses each sub-skb\u0027s\nshinfo as the nskb -- both p and lp must carry the marker.\n\nThe same omission also exists in tcp_clone_payload(), which builds an\nMTU probe skb by moving frag descriptors from skbs on sk_write_queue\ninto a freshly allocated nskb. The helper falls into the same family\nand warrants the same fix for consistency; no TCP TX-side in-place\nwriter is currently known to reach a user page through this gap, but\na future consumer depending on the marker would regress silently.\n\nThe same omission exists in skb_segment(): the per-iteration flag\nmerge takes only head_skb\u0027s flag, and the inner switch that rebinds\nfrag_skb to list_skb on head_skb-frags exhaustion does not fold the\nnew frag_skb\u0027s flag into nskb. Fold frag_skb\u0027s flag at both sites\nso segments drawing frags from frag_list members carry the marker.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-33-rt-17-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-43503",
"url": "https://www.suse.com/security/cve/CVE-2026-43503"
},
{
"category": "external",
"summary": "SUSE Bug 1265209 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1265209"
},
{
"category": "external",
"summary": "SUSE Bug 1265960 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1265960"
},
{
"category": "external",
"summary": "SUSE Bug 1266229 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1266229"
},
{
"category": "external",
"summary": "SUSE Bug 1269878 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1269878"
},
{
"category": "external",
"summary": "SUSE Bug 1270098 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1270098"
},
{
"category": "external",
"summary": "SUSE Bug 1270100 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1270100"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-33-rt-17-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-33-rt-17-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-24T09:39:09Z",
"details": "important"
}
],
"title": "CVE-2026-43503"
},
{
"cve": "CVE-2026-46323",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46323"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gro: don\u0027t merge zcopy skbs\n\nskb_gro_receive() can currently copy frags between the source and GRO\nskb, without checking the zerocopy status, and in particular the\nSKBFL_MANAGED_FRAG_REFS flag.\n\nWhen SKBFL_MANAGED_FRAG_REFS is set, the skb doesn\u0027t hold a reference\non the pages in shinfo-\u003efrags. Appending those frags to another skb\u0027s\nfrags without fixing up the page refcount can lead to UAF.\n\nWhen either the last skb in the GRO chain (the one we would append\nfrags to) or the source skb is zerocopy, don\u0027t merge the skbs.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-33-rt-17-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46323",
"url": "https://www.suse.com/security/cve/CVE-2026-46323"
},
{
"category": "external",
"summary": "SUSE Bug 1268029 for CVE-2026-46323",
"url": "https://bugzilla.suse.com/1268029"
},
{
"category": "external",
"summary": "SUSE Bug 1268282 for CVE-2026-46323",
"url": "https://bugzilla.suse.com/1268282"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-33-rt-17-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-33-rt-17-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-24T09:39:09Z",
"details": "important"
}
],
"title": "CVE-2026-46323"
}
]
}
SUSE-SU-2026:22398-1
Vulnerability from csaf_suse - Published: 2026-06-24 09:39 - Updated: 2026-06-24 09:39Summary
Security update for the Linux Kernel (Live Patch 7 for SUSE Linux Enterprise Micro 6.0)
Severity
Important
Notes
Title of the patch: Security update for the Linux Kernel (Live Patch 7 for SUSE Linux Enterprise Micro 6.0)
Description of the patch:
This update for the SUSE Linux Enterprise Kernel 6.4.0-29.1 fixes various security issues
The following security issues were fixed:
- CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1260907).
- CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).
- CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).
- CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).
- CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).
- CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282).
- net/sched: fix pedit partial COW leading to page cache (bsc#1267625).
Patchnames: SUSE-SLE-Micro-6.0-kernel-482
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.2 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.8 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.8 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
40 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for the Linux Kernel (Live Patch 7 for SUSE Linux Enterprise Micro 6.0)",
"title": "Title of the patch"
},
{
"category": "description",
"text": "\nThis update for the SUSE Linux Enterprise Kernel 6.4.0-29.1 fixes various security issues\n\nThe following security issues were fixed:\n\n- CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1260907).\n- CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).\n- CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).\n- CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).\n- CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).\n- CVE-2026-46323: net: gro: don\u0027t merge zcopy skbs (bsc#1268282).\n- net/sched: fix pedit partial COW leading to page cache (bsc#1267625).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-Micro-6.0-kernel-482",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22398-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:22398-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622398-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:22398-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027206.html"
},
{
"category": "self",
"summary": "SUSE Bug 1260907",
"url": "https://bugzilla.suse.com/1260907"
},
{
"category": "self",
"summary": "SUSE Bug 1261640",
"url": "https://bugzilla.suse.com/1261640"
},
{
"category": "self",
"summary": "SUSE Bug 1263088",
"url": "https://bugzilla.suse.com/1263088"
},
{
"category": "self",
"summary": "SUSE Bug 1263902",
"url": "https://bugzilla.suse.com/1263902"
},
{
"category": "self",
"summary": "SUSE Bug 1266229",
"url": "https://bugzilla.suse.com/1266229"
},
{
"category": "self",
"summary": "SUSE Bug 1267625",
"url": "https://bugzilla.suse.com/1267625"
},
{
"category": "self",
"summary": "SUSE Bug 1268282",
"url": "https://bugzilla.suse.com/1268282"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-23278 page",
"url": "https://www.suse.com/security/cve/CVE-2026-23278/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31402 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31402/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31504 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31504/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31694 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31694/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-43503 page",
"url": "https://www.suse.com/security/cve/CVE-2026-43503/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46323 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46323/"
}
],
"title": "Security update for the Linux Kernel (Live Patch 7 for SUSE Linux Enterprise Micro 6.0)",
"tracking": {
"current_release_date": "2026-06-24T09:39:06Z",
"generator": {
"date": "2026-06-24T09:39:06Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:22398-1",
"initial_release_date": "2026-06-24T09:39:06Z",
"revision_history": [
{
"date": "2026-06-24T09:39:06Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "kernel-livepatch-6_4_0-29-default-20-1.2.s390x",
"product": {
"name": "kernel-livepatch-6_4_0-29-default-20-1.2.s390x",
"product_id": "kernel-livepatch-6_4_0-29-default-20-1.2.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "kernel-livepatch-6_4_0-29-default-20-1.2.x86_64",
"product": {
"name": "kernel-livepatch-6_4_0-29-default-20-1.2.x86_64",
"product_id": "kernel-livepatch-6_4_0-29-default-20-1.2.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.0",
"product": {
"name": "SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.0"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_4_0-29-default-20-1.2.s390x as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.s390x"
},
"product_reference": "kernel-livepatch-6_4_0-29-default-20-1.2.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_4_0-29-default-20-1.2.x86_64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.x86_64"
},
"product_reference": "kernel-livepatch-6_4_0-29-default-20-1.2.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-23278",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-23278"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: always walk all pending catchall elements\n\nDuring transaction processing we might have more than one catchall element:\n1 live catchall element and 1 pending element that is coming as part of the\nnew batch.\n\nIf the map holding the catchall elements is also going away, its\nrequired to toggle all catchall elements and not just the first viable\ncandidate.\n\nOtherwise, we get:\n WARNING: ./include/net/netfilter/nf_tables.h:1281 at nft_data_release+0xb7/0xe0 [nf_tables], CPU#2: nft/1404\n RIP: 0010:nft_data_release+0xb7/0xe0 [nf_tables]\n [..]\n __nft_set_elem_destroy+0x106/0x380 [nf_tables]\n nf_tables_abort_release+0x348/0x8d0 [nf_tables]\n nf_tables_abort+0xcf2/0x3ac0 [nf_tables]\n nfnetlink_rcv_batch+0x9c9/0x20e0 [..]",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-23278",
"url": "https://www.suse.com/security/cve/CVE-2026-23278"
},
{
"category": "external",
"summary": "SUSE Bug 1259998 for CVE-2026-23278",
"url": "https://bugzilla.suse.com/1259998"
},
{
"category": "external",
"summary": "SUSE Bug 1260907 for CVE-2026-23278",
"url": "https://bugzilla.suse.com/1260907"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-24T09:39:06Z",
"details": "important"
}
],
"title": "CVE-2026-23278"
},
{
"cve": "CVE-2026-31402",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31402"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix heap overflow in NFSv4.0 LOCK replay cache\n\nThe NFSv4.0 replay cache uses a fixed 112-byte inline buffer\n(rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses.\nThis size was calculated based on OPEN responses and does not account\nfor LOCK denied responses, which include the conflicting lock owner as\na variable-length field up to 1024 bytes (NFS4_OPAQUE_LIMIT).\n\nWhen a LOCK operation is denied due to a conflict with an existing lock\nthat has a large owner, nfsd4_encode_operation() copies the full encoded\nresponse into the undersized replay buffer via read_bytes_from_xdr_buf()\nwith no bounds check. This results in a slab-out-of-bounds write of up\nto 944 bytes past the end of the buffer, corrupting adjacent heap memory.\n\nThis can be triggered remotely by an unauthenticated attacker with two\ncooperating NFSv4.0 clients: one sets a lock with a large owner string,\nthen the other requests a conflicting lock to provoke the denial.\n\nWe could fix this by increasing NFSD4_REPLAY_ISIZE to allow for a full\nopaque, but that would increase the size of every stateowner, when most\nlockowners are not that large.\n\nInstead, fix this by checking the encoded response length against\nNFSD4_REPLAY_ISIZE before copying into the replay buffer. If the\nresponse is too large, set rp_buflen to 0 to skip caching the replay\npayload. The status is still cached, and the client already received the\ncorrect response on the original request.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31402",
"url": "https://www.suse.com/security/cve/CVE-2026-31402"
},
{
"category": "external",
"summary": "SUSE Bug 1261638 for CVE-2026-31402",
"url": "https://bugzilla.suse.com/1261638"
},
{
"category": "external",
"summary": "SUSE Bug 1261640 for CVE-2026-31402",
"url": "https://bugzilla.suse.com/1261640"
},
{
"category": "external",
"summary": "SUSE Bug 1265160 for CVE-2026-31402",
"url": "https://bugzilla.suse.com/1265160"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-24T09:39:06Z",
"details": "important"
}
],
"title": "CVE-2026-31402"
},
{
"cve": "CVE-2026-31504",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31504"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix fanout UAF in packet_release() via NETDEV_UP race\n\n`packet_release()` has a race window where `NETDEV_UP` can re-register a\nsocket into a fanout group\u0027s `arr[]` array. The re-registration is not\ncleaned up by `fanout_release()`, leaving a dangling pointer in the fanout\narray.\n`packet_release()` does NOT zero `po-\u003enum` in its `bind_lock` section.\nAfter releasing `bind_lock`, `po-\u003enum` is still non-zero and `po-\u003eifindex`\nstill matches the bound device. A concurrent `packet_notifier(NETDEV_UP)`\nthat already found the socket in `sklist` can re-register the hook.\nFor fanout sockets, this re-registration calls `__fanout_link(sk, po)`\nwhich adds the socket back into `f-\u003earr[]` and increments `f-\u003enum_members`,\nbut does NOT increment `f-\u003esk_ref`.\n\nThe fix sets `po-\u003enum` to zero in `packet_release` while `bind_lock` is\nheld to prevent NETDEV_UP from linking, preventing the race window.\n\nThis bug was found following an additional audit with Claude Code based\non CVE-2025-38617.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31504",
"url": "https://www.suse.com/security/cve/CVE-2026-31504"
},
{
"category": "external",
"summary": "SUSE Bug 1263085 for CVE-2026-31504",
"url": "https://bugzilla.suse.com/1263085"
},
{
"category": "external",
"summary": "SUSE Bug 1263088 for CVE-2026-31504",
"url": "https://bugzilla.suse.com/1263088"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-24T09:39:06Z",
"details": "important"
}
],
"title": "CVE-2026-31504"
},
{
"cve": "CVE-2026-31694",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31694"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: reject oversized dirents in page cache\n\nfuse_add_dirent_to_cache() computes a serialized dirent size from the\nserver-controlled namelen field and copies the dirent into a single\npage-cache page. The existing logic only checks whether the dirent fits\nin the remaining space of the current page and advances to a fresh page\nif not. It never checks whether the dirent itself exceeds PAGE_SIZE.\n\nAs a result, a malicious FUSE server can return a dirent with\nnamelen=4095, producing a serialized record size of 4120 bytes. On 4 KiB\npage systems this causes memcpy() to overflow the cache page by 24 bytes\ninto the following kernel page.\n\nReject dirents that cannot fit in a single page before copying them into\nthe readdir cache.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31694",
"url": "https://www.suse.com/security/cve/CVE-2026-31694"
},
{
"category": "external",
"summary": "SUSE Bug 1263901 for CVE-2026-31694",
"url": "https://bugzilla.suse.com/1263901"
},
{
"category": "external",
"summary": "SUSE Bug 1263902 for CVE-2026-31694",
"url": "https://bugzilla.suse.com/1263902"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-24T09:39:06Z",
"details": "important"
}
],
"title": "CVE-2026-31694"
},
{
"cve": "CVE-2026-43503",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-43503"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: propagate shared-frag marker through frag-transfer helpers\n\nTwo frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail\nto propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()-\u003eflags when\nmoving frags from source to destination. __pskb_copy_fclone() defers\nthe rest of the shinfo metadata to skb_copy_header() after copying\nfrag descriptors, but that helper only carries over gso_{size,segs,\ntype} and never touches skb_shinfo()-\u003eflags; skb_shift() moves frag\ndescriptors directly and leaves flags untouched. As a result, the\ndestination skb keeps a reference to the same externally-owned or\npage-cache-backed pages while reporting skb_has_shared_frag() as\nfalse.\n\nThe mismatch is harmful in any in-place writer that uses\nskb_has_shared_frag() to decide whether shared pages must be detoured\nthrough skb_cow_data(). ESP input is one such writer (esp4.c,\nesp6.c), and a single nft \u0027dup to \u003clocal\u003e\u0027 rule -- or any other\nnf_dup_ipv4() / xt_TEE caller -- is enough to land a pskb_copy()\u0027d\nskb in esp_input() with the marker stripped, letting an unprivileged\nuser write into the page cache of a root-owned read-only file via\nauthencesn-ESN stray writes.\n\nSet SKBFL_SHARED_FRAG on the destination whenever frag descriptors\nwere actually moved from the source. skb_copy() and skb_copy_expand()\nshare skb_copy_header() too but linearize all paged data into freshly\nallocated head storage and emerge with nr_frags == 0, so\nskb_has_shared_frag() returns false on its own; they need no change.\n\nThe same omission exists in skb_gro_receive() and skb_gro_receive_list().\nThe former moves the incoming skb\u0027s frag descriptors into the\naccumulator\u0027s last sub-skb via two paths (a direct frag-move loop and\nthe head_frag + memcpy path); the latter chains the incoming skb whole\nonto p\u0027s frag_list. Downstream skb_segment() reads only\nskb_shinfo(p)-\u003eflags, and skb_segment_list() reuses each sub-skb\u0027s\nshinfo as the nskb -- both p and lp must carry the marker.\n\nThe same omission also exists in tcp_clone_payload(), which builds an\nMTU probe skb by moving frag descriptors from skbs on sk_write_queue\ninto a freshly allocated nskb. The helper falls into the same family\nand warrants the same fix for consistency; no TCP TX-side in-place\nwriter is currently known to reach a user page through this gap, but\na future consumer depending on the marker would regress silently.\n\nThe same omission exists in skb_segment(): the per-iteration flag\nmerge takes only head_skb\u0027s flag, and the inner switch that rebinds\nfrag_skb to list_skb on head_skb-frags exhaustion does not fold the\nnew frag_skb\u0027s flag into nskb. Fold frag_skb\u0027s flag at both sites\nso segments drawing frags from frag_list members carry the marker.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-43503",
"url": "https://www.suse.com/security/cve/CVE-2026-43503"
},
{
"category": "external",
"summary": "SUSE Bug 1265209 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1265209"
},
{
"category": "external",
"summary": "SUSE Bug 1265960 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1265960"
},
{
"category": "external",
"summary": "SUSE Bug 1266229 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1266229"
},
{
"category": "external",
"summary": "SUSE Bug 1269878 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1269878"
},
{
"category": "external",
"summary": "SUSE Bug 1270098 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1270098"
},
{
"category": "external",
"summary": "SUSE Bug 1270100 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1270100"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-24T09:39:06Z",
"details": "important"
}
],
"title": "CVE-2026-43503"
},
{
"cve": "CVE-2026-46323",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46323"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gro: don\u0027t merge zcopy skbs\n\nskb_gro_receive() can currently copy frags between the source and GRO\nskb, without checking the zerocopy status, and in particular the\nSKBFL_MANAGED_FRAG_REFS flag.\n\nWhen SKBFL_MANAGED_FRAG_REFS is set, the skb doesn\u0027t hold a reference\non the pages in shinfo-\u003efrags. Appending those frags to another skb\u0027s\nfrags without fixing up the page refcount can lead to UAF.\n\nWhen either the last skb in the GRO chain (the one we would append\nfrags to) or the source skb is zerocopy, don\u0027t merge the skbs.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46323",
"url": "https://www.suse.com/security/cve/CVE-2026-46323"
},
{
"category": "external",
"summary": "SUSE Bug 1268029 for CVE-2026-46323",
"url": "https://bugzilla.suse.com/1268029"
},
{
"category": "external",
"summary": "SUSE Bug 1268282 for CVE-2026-46323",
"url": "https://bugzilla.suse.com/1268282"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-29-default-20-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-24T09:39:06Z",
"details": "important"
}
],
"title": "CVE-2026-46323"
}
]
}
SUSE-SU-2026:22399-1
Vulnerability from csaf_suse - Published: 2026-06-24 09:39 - Updated: 2026-06-24 09:39Summary
Security update for the Linux Kernel (Live Patch 8 for SUSE Linux Enterprise Micro 6.0)
Severity
Important
Notes
Title of the patch: Security update for the Linux Kernel (Live Patch 8 for SUSE Linux Enterprise Micro 6.0)
Description of the patch:
This update for the SUSE Linux Enterprise Kernel 6.4.0-30.1 fixes various security issues
The following security issues were fixed:
- CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1260907).
- CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).
- CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).
- CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).
- CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).
- CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282).
- net/sched: fix pedit partial COW leading to page cache (bsc#1267625).
Patchnames: SUSE-SLE-Micro-6.0-kernel-483
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.2 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.8 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.8 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
40 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for the Linux Kernel (Live Patch 8 for SUSE Linux Enterprise Micro 6.0)",
"title": "Title of the patch"
},
{
"category": "description",
"text": "\nThis update for the SUSE Linux Enterprise Kernel 6.4.0-30.1 fixes various security issues\n\nThe following security issues were fixed:\n\n- CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1260907).\n- CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).\n- CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).\n- CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).\n- CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).\n- CVE-2026-46323: net: gro: don\u0027t merge zcopy skbs (bsc#1268282).\n- net/sched: fix pedit partial COW leading to page cache (bsc#1267625).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-Micro-6.0-kernel-483",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22399-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:22399-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622399-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:22399-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027205.html"
},
{
"category": "self",
"summary": "SUSE Bug 1260907",
"url": "https://bugzilla.suse.com/1260907"
},
{
"category": "self",
"summary": "SUSE Bug 1261640",
"url": "https://bugzilla.suse.com/1261640"
},
{
"category": "self",
"summary": "SUSE Bug 1263088",
"url": "https://bugzilla.suse.com/1263088"
},
{
"category": "self",
"summary": "SUSE Bug 1263902",
"url": "https://bugzilla.suse.com/1263902"
},
{
"category": "self",
"summary": "SUSE Bug 1266229",
"url": "https://bugzilla.suse.com/1266229"
},
{
"category": "self",
"summary": "SUSE Bug 1267625",
"url": "https://bugzilla.suse.com/1267625"
},
{
"category": "self",
"summary": "SUSE Bug 1268282",
"url": "https://bugzilla.suse.com/1268282"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-23278 page",
"url": "https://www.suse.com/security/cve/CVE-2026-23278/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31402 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31402/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31504 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31504/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31694 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31694/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-43503 page",
"url": "https://www.suse.com/security/cve/CVE-2026-43503/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46323 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46323/"
}
],
"title": "Security update for the Linux Kernel (Live Patch 8 for SUSE Linux Enterprise Micro 6.0)",
"tracking": {
"current_release_date": "2026-06-24T09:39:06Z",
"generator": {
"date": "2026-06-24T09:39:06Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:22399-1",
"initial_release_date": "2026-06-24T09:39:06Z",
"revision_history": [
{
"date": "2026-06-24T09:39:06Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "kernel-livepatch-6_4_0-30-default-19-1.2.s390x",
"product": {
"name": "kernel-livepatch-6_4_0-30-default-19-1.2.s390x",
"product_id": "kernel-livepatch-6_4_0-30-default-19-1.2.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "kernel-livepatch-6_4_0-30-default-19-1.2.x86_64",
"product": {
"name": "kernel-livepatch-6_4_0-30-default-19-1.2.x86_64",
"product_id": "kernel-livepatch-6_4_0-30-default-19-1.2.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.0",
"product": {
"name": "SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.0"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_4_0-30-default-19-1.2.s390x as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.s390x"
},
"product_reference": "kernel-livepatch-6_4_0-30-default-19-1.2.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_4_0-30-default-19-1.2.x86_64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.x86_64"
},
"product_reference": "kernel-livepatch-6_4_0-30-default-19-1.2.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-23278",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-23278"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: always walk all pending catchall elements\n\nDuring transaction processing we might have more than one catchall element:\n1 live catchall element and 1 pending element that is coming as part of the\nnew batch.\n\nIf the map holding the catchall elements is also going away, its\nrequired to toggle all catchall elements and not just the first viable\ncandidate.\n\nOtherwise, we get:\n WARNING: ./include/net/netfilter/nf_tables.h:1281 at nft_data_release+0xb7/0xe0 [nf_tables], CPU#2: nft/1404\n RIP: 0010:nft_data_release+0xb7/0xe0 [nf_tables]\n [..]\n __nft_set_elem_destroy+0x106/0x380 [nf_tables]\n nf_tables_abort_release+0x348/0x8d0 [nf_tables]\n nf_tables_abort+0xcf2/0x3ac0 [nf_tables]\n nfnetlink_rcv_batch+0x9c9/0x20e0 [..]",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-23278",
"url": "https://www.suse.com/security/cve/CVE-2026-23278"
},
{
"category": "external",
"summary": "SUSE Bug 1259998 for CVE-2026-23278",
"url": "https://bugzilla.suse.com/1259998"
},
{
"category": "external",
"summary": "SUSE Bug 1260907 for CVE-2026-23278",
"url": "https://bugzilla.suse.com/1260907"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-24T09:39:06Z",
"details": "important"
}
],
"title": "CVE-2026-23278"
},
{
"cve": "CVE-2026-31402",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31402"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix heap overflow in NFSv4.0 LOCK replay cache\n\nThe NFSv4.0 replay cache uses a fixed 112-byte inline buffer\n(rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses.\nThis size was calculated based on OPEN responses and does not account\nfor LOCK denied responses, which include the conflicting lock owner as\na variable-length field up to 1024 bytes (NFS4_OPAQUE_LIMIT).\n\nWhen a LOCK operation is denied due to a conflict with an existing lock\nthat has a large owner, nfsd4_encode_operation() copies the full encoded\nresponse into the undersized replay buffer via read_bytes_from_xdr_buf()\nwith no bounds check. This results in a slab-out-of-bounds write of up\nto 944 bytes past the end of the buffer, corrupting adjacent heap memory.\n\nThis can be triggered remotely by an unauthenticated attacker with two\ncooperating NFSv4.0 clients: one sets a lock with a large owner string,\nthen the other requests a conflicting lock to provoke the denial.\n\nWe could fix this by increasing NFSD4_REPLAY_ISIZE to allow for a full\nopaque, but that would increase the size of every stateowner, when most\nlockowners are not that large.\n\nInstead, fix this by checking the encoded response length against\nNFSD4_REPLAY_ISIZE before copying into the replay buffer. If the\nresponse is too large, set rp_buflen to 0 to skip caching the replay\npayload. The status is still cached, and the client already received the\ncorrect response on the original request.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31402",
"url": "https://www.suse.com/security/cve/CVE-2026-31402"
},
{
"category": "external",
"summary": "SUSE Bug 1261638 for CVE-2026-31402",
"url": "https://bugzilla.suse.com/1261638"
},
{
"category": "external",
"summary": "SUSE Bug 1261640 for CVE-2026-31402",
"url": "https://bugzilla.suse.com/1261640"
},
{
"category": "external",
"summary": "SUSE Bug 1265160 for CVE-2026-31402",
"url": "https://bugzilla.suse.com/1265160"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-24T09:39:06Z",
"details": "important"
}
],
"title": "CVE-2026-31402"
},
{
"cve": "CVE-2026-31504",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31504"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix fanout UAF in packet_release() via NETDEV_UP race\n\n`packet_release()` has a race window where `NETDEV_UP` can re-register a\nsocket into a fanout group\u0027s `arr[]` array. The re-registration is not\ncleaned up by `fanout_release()`, leaving a dangling pointer in the fanout\narray.\n`packet_release()` does NOT zero `po-\u003enum` in its `bind_lock` section.\nAfter releasing `bind_lock`, `po-\u003enum` is still non-zero and `po-\u003eifindex`\nstill matches the bound device. A concurrent `packet_notifier(NETDEV_UP)`\nthat already found the socket in `sklist` can re-register the hook.\nFor fanout sockets, this re-registration calls `__fanout_link(sk, po)`\nwhich adds the socket back into `f-\u003earr[]` and increments `f-\u003enum_members`,\nbut does NOT increment `f-\u003esk_ref`.\n\nThe fix sets `po-\u003enum` to zero in `packet_release` while `bind_lock` is\nheld to prevent NETDEV_UP from linking, preventing the race window.\n\nThis bug was found following an additional audit with Claude Code based\non CVE-2025-38617.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31504",
"url": "https://www.suse.com/security/cve/CVE-2026-31504"
},
{
"category": "external",
"summary": "SUSE Bug 1263085 for CVE-2026-31504",
"url": "https://bugzilla.suse.com/1263085"
},
{
"category": "external",
"summary": "SUSE Bug 1263088 for CVE-2026-31504",
"url": "https://bugzilla.suse.com/1263088"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-24T09:39:06Z",
"details": "important"
}
],
"title": "CVE-2026-31504"
},
{
"cve": "CVE-2026-31694",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31694"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: reject oversized dirents in page cache\n\nfuse_add_dirent_to_cache() computes a serialized dirent size from the\nserver-controlled namelen field and copies the dirent into a single\npage-cache page. The existing logic only checks whether the dirent fits\nin the remaining space of the current page and advances to a fresh page\nif not. It never checks whether the dirent itself exceeds PAGE_SIZE.\n\nAs a result, a malicious FUSE server can return a dirent with\nnamelen=4095, producing a serialized record size of 4120 bytes. On 4 KiB\npage systems this causes memcpy() to overflow the cache page by 24 bytes\ninto the following kernel page.\n\nReject dirents that cannot fit in a single page before copying them into\nthe readdir cache.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31694",
"url": "https://www.suse.com/security/cve/CVE-2026-31694"
},
{
"category": "external",
"summary": "SUSE Bug 1263901 for CVE-2026-31694",
"url": "https://bugzilla.suse.com/1263901"
},
{
"category": "external",
"summary": "SUSE Bug 1263902 for CVE-2026-31694",
"url": "https://bugzilla.suse.com/1263902"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-24T09:39:06Z",
"details": "important"
}
],
"title": "CVE-2026-31694"
},
{
"cve": "CVE-2026-43503",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-43503"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: propagate shared-frag marker through frag-transfer helpers\n\nTwo frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail\nto propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()-\u003eflags when\nmoving frags from source to destination. __pskb_copy_fclone() defers\nthe rest of the shinfo metadata to skb_copy_header() after copying\nfrag descriptors, but that helper only carries over gso_{size,segs,\ntype} and never touches skb_shinfo()-\u003eflags; skb_shift() moves frag\ndescriptors directly and leaves flags untouched. As a result, the\ndestination skb keeps a reference to the same externally-owned or\npage-cache-backed pages while reporting skb_has_shared_frag() as\nfalse.\n\nThe mismatch is harmful in any in-place writer that uses\nskb_has_shared_frag() to decide whether shared pages must be detoured\nthrough skb_cow_data(). ESP input is one such writer (esp4.c,\nesp6.c), and a single nft \u0027dup to \u003clocal\u003e\u0027 rule -- or any other\nnf_dup_ipv4() / xt_TEE caller -- is enough to land a pskb_copy()\u0027d\nskb in esp_input() with the marker stripped, letting an unprivileged\nuser write into the page cache of a root-owned read-only file via\nauthencesn-ESN stray writes.\n\nSet SKBFL_SHARED_FRAG on the destination whenever frag descriptors\nwere actually moved from the source. skb_copy() and skb_copy_expand()\nshare skb_copy_header() too but linearize all paged data into freshly\nallocated head storage and emerge with nr_frags == 0, so\nskb_has_shared_frag() returns false on its own; they need no change.\n\nThe same omission exists in skb_gro_receive() and skb_gro_receive_list().\nThe former moves the incoming skb\u0027s frag descriptors into the\naccumulator\u0027s last sub-skb via two paths (a direct frag-move loop and\nthe head_frag + memcpy path); the latter chains the incoming skb whole\nonto p\u0027s frag_list. Downstream skb_segment() reads only\nskb_shinfo(p)-\u003eflags, and skb_segment_list() reuses each sub-skb\u0027s\nshinfo as the nskb -- both p and lp must carry the marker.\n\nThe same omission also exists in tcp_clone_payload(), which builds an\nMTU probe skb by moving frag descriptors from skbs on sk_write_queue\ninto a freshly allocated nskb. The helper falls into the same family\nand warrants the same fix for consistency; no TCP TX-side in-place\nwriter is currently known to reach a user page through this gap, but\na future consumer depending on the marker would regress silently.\n\nThe same omission exists in skb_segment(): the per-iteration flag\nmerge takes only head_skb\u0027s flag, and the inner switch that rebinds\nfrag_skb to list_skb on head_skb-frags exhaustion does not fold the\nnew frag_skb\u0027s flag into nskb. Fold frag_skb\u0027s flag at both sites\nso segments drawing frags from frag_list members carry the marker.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-43503",
"url": "https://www.suse.com/security/cve/CVE-2026-43503"
},
{
"category": "external",
"summary": "SUSE Bug 1265209 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1265209"
},
{
"category": "external",
"summary": "SUSE Bug 1265960 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1265960"
},
{
"category": "external",
"summary": "SUSE Bug 1266229 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1266229"
},
{
"category": "external",
"summary": "SUSE Bug 1269878 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1269878"
},
{
"category": "external",
"summary": "SUSE Bug 1270098 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1270098"
},
{
"category": "external",
"summary": "SUSE Bug 1270100 for CVE-2026-43503",
"url": "https://bugzilla.suse.com/1270100"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-24T09:39:06Z",
"details": "important"
}
],
"title": "CVE-2026-43503"
},
{
"cve": "CVE-2026-46323",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46323"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gro: don\u0027t merge zcopy skbs\n\nskb_gro_receive() can currently copy frags between the source and GRO\nskb, without checking the zerocopy status, and in particular the\nSKBFL_MANAGED_FRAG_REFS flag.\n\nWhen SKBFL_MANAGED_FRAG_REFS is set, the skb doesn\u0027t hold a reference\non the pages in shinfo-\u003efrags. Appending those frags to another skb\u0027s\nfrags without fixing up the page refcount can lead to UAF.\n\nWhen either the last skb in the GRO chain (the one we would append\nfrags to) or the source skb is zerocopy, don\u0027t merge the skbs.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46323",
"url": "https://www.suse.com/security/cve/CVE-2026-46323"
},
{
"category": "external",
"summary": "SUSE Bug 1268029 for CVE-2026-46323",
"url": "https://bugzilla.suse.com/1268029"
},
{
"category": "external",
"summary": "SUSE Bug 1268282 for CVE-2026-46323",
"url": "https://bugzilla.suse.com/1268282"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.s390x",
"SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-default-19-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-24T09:39:06Z",
"details": "important"
}
],
"title": "CVE-2026-46323"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…