SUSE-SU-2026:4172-1
Vulnerability from csaf_suse - Published: 2026-09-14 10:03 - Updated: 2026-09-17 16:48Summary
Security update for the Linux Kernel RT (Live Patch 18 for SUSE Linux Enterprise 15 SP7)
Severity
Important
Notes
Title of the patch: Security update for the Linux Kernel RT (Live Patch 18 for SUSE Linux Enterprise 15 SP7)
Description of the patch:
This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.67 fixes various security issues:
The following security issues were fixed:
- CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1275458).
- CVE-2026-64530: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_hand (bsc#1271867).
- CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Zapscape) (bsc#1273232).
- CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (SCTPhantom) (bsc#1274074).
- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (RefluXFS) (bsc#1271543).
- CVE-2026-68138: net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274942).
Patchnames: SUSE-2026-4172,SUSE-SLE-Module-Live-Patching-15-SP7-2026-4172
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.8 (High)
Affected products
Recommended
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_67-rt-0:2-150700.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
1 product, the same list as for
CVE-2026-64423
Threats
Impact
important
8.8 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2026-64423
Threats
Impact
important
7.8 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2026-64423
Threats
Impact
important
7.8 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2026-64423
Threats
Impact
important
Affected products
Recommended
1 product, the same list as for
CVE-2026-64423
Threats
Impact
important
References
34 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for the Linux Kernel RT (Live Patch 18 for SUSE Linux Enterprise 15 SP7)",
"title": "Title of the patch"
},
{
"category": "description",
"text": "\nThis update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.67 fixes various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1275458).\n- CVE-2026-64530: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_hand (bsc#1271867).\n- CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Zapscape) (bsc#1273232).\n- CVE-2026-64564: sctp: don\u0027t free the ASCONF\u0027s own transport in DEL-IP processing (SCTPhantom) (bsc#1274074).\n- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (RefluXFS) (bsc#1271543).\n- CVE-2026-68138: net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274942).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2026-4172,SUSE-SLE-Module-Live-Patching-15-SP7-2026-4172",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_4172-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:4172-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20264172-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:4172-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20264172-1/"
},
{
"category": "self",
"summary": "SUSE Bug 1271543",
"url": "https://bugzilla.suse.com/1271543"
},
{
"category": "self",
"summary": "SUSE Bug 1271867",
"url": "https://bugzilla.suse.com/1271867"
},
{
"category": "self",
"summary": "SUSE Bug 1273232",
"url": "https://bugzilla.suse.com/1273232"
},
{
"category": "self",
"summary": "SUSE Bug 1274074",
"url": "https://bugzilla.suse.com/1274074"
},
{
"category": "self",
"summary": "SUSE Bug 1274942",
"url": "https://bugzilla.suse.com/1274942"
},
{
"category": "self",
"summary": "SUSE Bug 1275458",
"url": "https://bugzilla.suse.com/1275458"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-64423 page",
"url": "https://www.suse.com/security/cve/CVE-2026-64423/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-64530 page",
"url": "https://www.suse.com/security/cve/CVE-2026-64530/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-64561 page",
"url": "https://www.suse.com/security/cve/CVE-2026-64561/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-64564 page",
"url": "https://www.suse.com/security/cve/CVE-2026-64564/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-64600 page",
"url": "https://www.suse.com/security/cve/CVE-2026-64600/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-68138 page",
"url": "https://www.suse.com/security/cve/CVE-2026-68138/"
}
],
"title": "Security update for the Linux Kernel RT (Live Patch 18 for SUSE Linux Enterprise 15 SP7)",
"tracking": {
"current_release_date": "2026-09-17T16:48:34Z",
"generator": {
"date": "2026-09-14T10:03:54Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:4172-1",
"initial_release_date": "2026-09-14T10:03:54Z",
"revision_history": [
{
"date": "2026-09-14T10:03:54Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-15T16:11:26Z",
"number": "2",
"summary": "unknown changes"
},
{
"date": "2026-09-16T19:54:45Z",
"number": "3",
"summary": "unknown changes"
},
{
"date": "2026-09-16T20:57:31Z",
"number": "4",
"summary": "unknown changes"
},
{
"date": "2026-09-17T16:48:34Z",
"number": "5",
"summary": "unknown changes"
}
],
"status": "final",
"version": "5"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "kernel-livepatch-6_4_0-150700_7_67-rt-0:2-150700.2.1.x86_64",
"product": {
"name": "kernel-livepatch-6_4_0-150700_7_67-rt-0:2-150700.2.1.x86_64",
"product_id": "kernel-livepatch-6_4_0-150700_7_67-rt-0:2-150700.2.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/kernel-livepatch-6_4_0-150700_7_67-rt@2-150700.2.1?arch=x86_64\u0026upstream=kernel-livepatch-SLE15-SP7-RT_Update_18-0:2-150700.2.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Live Patching 15 SP7",
"product": {
"name": "SUSE Linux Enterprise Live Patching 15 SP7",
"product_id": "SUSE Linux Enterprise Live Patching 15 SP7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-live-patching:15:sp7"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-livepatch-6_4_0-150700_7_67-rt-0:2-150700.2.1.x86_64 as component of SUSE Linux Enterprise Live Patching 15 SP7",
"product_id": "SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_67-rt-0:2-150700.2.1.x86_64"
},
"product_reference": "kernel-livepatch-6_4_0-150700_7_67-rt-0:2-150700.2.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Live Patching 15 SP7"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-64423",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-64423"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: igmp: remove multicast group from hash table on device destruction\n\nWhen a device is destroyed under RTNL, ip_mc_destroy_dev() iterates through\nthe multicast list and calls ip_ma_put() on each membership, scheduling\nthem for RCU reclamation. However, they are not unlinked from the device\u0027s\nmulticast hash table (mc_hash).\n\nSince the device remains published in dev-\u003eip_ptr until after\nip_mc_destroy_dev() completes, concurrent RCU readers traversing mc_hash\ncan still locate and access the multicast group after its refcount is\ndecremented. If the RCU callback runs and frees the group while a reader is\naccessing it, a use-after-free occurs.\n\nFix this by unlinking the multicast group from mc_hash using\nip_mc_hash_remove() before scheduling it for reclamation.\n\nBUG: KASAN: slab-use-after-free in ip_check_mc_rcu+0x149/0x3f0\nRead of size 4 at addr ffff888009bf1408 by task mausezahn/2276\n\nCall Trace:\n \u003cIRQ\u003e\n dump_stack_lvl+0x67/0x90\n print_report+0x175/0x7c0\n kasan_report+0x147/0x180\n ip_check_mc_rcu+0x149/0x3f0\n udp_v4_early_demux+0x36d/0x12d0\n ip_rcv_finish_core+0xb8b/0x1390\n ip_rcv_finish+0x54/0x120\n NF_HOOK+0x213/0x2b0\n __netif_receive_skb+0x126/0x340\n process_backlog+0x4f2/0xf00\n __napi_poll+0x92/0x2c0\n net_rx_action+0x583/0xc60\n handle_softirqs+0x236/0x7f0\n do_softirq+0x57/0x80\n \u003c/IRQ\u003e\n\nAllocated by task 2239:\n kasan_save_track+0x3e/0x80\n __kasan_kmalloc+0x72/0x90\n ____ip_mc_inc_group+0x31a/0xa40\n __ip_mc_join_group+0x334/0x3f0\n do_ip_setsockopt+0x16fa/0x2010\n ip_setsockopt+0x3f/0x90\n do_sock_setsockopt+0x1ad/0x300\n\nFreed by task 0:\n kasan_save_track+0x3e/0x80\n kasan_save_free_info+0x40/0x50\n __kasan_slab_free+0x3a/0x60\n __rcu_free_sheaf_prepare+0xd4/0x220\n rcu_free_sheaf+0x36/0x190\n rcu_core+0x8d9/0x12f0\n handle_softirqs+0x236/0x7f0",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_67-rt-0:2-150700.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-64423",
"url": "https://www.suse.com/security/cve/CVE-2026-64423"
},
{
"category": "external",
"summary": "SUSE Bug 1274274 for CVE-2026-64423",
"url": "https://bugzilla.suse.com/1274274"
},
{
"category": "external",
"summary": "SUSE Bug 1275458 for CVE-2026-64423",
"url": "https://bugzilla.suse.com/1275458"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_67-rt-0:2-150700.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_67-rt-0:2-150700.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-14T10:03:54Z",
"details": "important"
}
],
"title": "CVE-2026-64423"
},
{
"cve": "CVE-2026-64530",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-64530"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle\n\ntcf_classify() can return TC_ACT_CONSUMED while the skb is held by the\ndefragmentation engine (e.g. act_ct on out-of-order fragments). When\nthat happens the skb is no longer owned by the caller and must not be\ntouched again.\n\ntcf_qevent_handle() did not handle TC_ACT_CONSUMED: it fell through the\nswitch and returned the skb to the caller as if classification had\npassed. The only qdisc that wires up qevents today is RED, via three call sites\n(qe_mark on RED_PROB_MARK/HARD_MARK, qe_early_drop on congestion_drop)\nred_enqueue() was continuing to operate on an skb it no longer owns in this\ncase -- enqueueing it, dropping it, or updating statistics. Resulting in a UAF.\n\n tc qdisc add dev eth0 root handle 1: red ... qevent early_drop block 10\n tc filter add block 10 ... action ct\n\n (with ct defrag enabled and traffic that produces out-of-order\n fragments, e.g. a fragmented UDP stream)\n\nHandle TC_ACT_CONSUMED in tcf_qevent_handle() the same way the ingress\nand egress fast paths do: treat it as stolen and return NULL without\ntouching the skb. Unlike the TC_ACT_STOLEN case, the skb must not be\ndropped/freed here, as it is no longer owned by us.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_67-rt-0:2-150700.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-64530",
"url": "https://www.suse.com/security/cve/CVE-2026-64530"
},
{
"category": "external",
"summary": "SUSE Bug 1271866 for CVE-2026-64530",
"url": "https://bugzilla.suse.com/1271866"
},
{
"category": "external",
"summary": "SUSE Bug 1271867 for CVE-2026-64530",
"url": "https://bugzilla.suse.com/1271867"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_67-rt-0:2-150700.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_67-rt-0:2-150700.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-14T10:03:54Z",
"details": "important"
}
],
"title": "CVE-2026-64530"
},
{
"cve": "CVE-2026-64561",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-64561"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Check for invalid/obsolete root *after* making MMU pages available\n\nCheck for a \"stale\" page fault, i.e. for an invalid and/or obsolete root,\nafter making MMU pages available for the shadow MMU. If reclaiming shadow\npages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to\nmap memory into an invalid root. On its own, populating an invalid root is\n\"fine\", but because child shadow pages inherit their parent\u0027s role, any\nchildren created during the map/fetch will be created as invalid pages,\nthus violating KVM\u0027s invariant that invalid pages are never on the list of\nactive MMU pages.\n\nNote, the underlying flaw has existed since KVM first started tracking\ninvalid roots in 2008 (commit 2e53d63acba7, \"KVM: MMU: ignore zapped root\npagetables\"), but the true badness only came along in 2020 (Linux 5.9)\nwith the invariant that invalid shadow pages can\u0027t be on the list of\nactive pages.\n\nNote #2, inheriting role.invalid when creating child shadow pages is also\nfar from ideal; that flaw will be addressed separately.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_67-rt-0:2-150700.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-64561",
"url": "https://www.suse.com/security/cve/CVE-2026-64561"
},
{
"category": "external",
"summary": "SUSE Bug 1273231 for CVE-2026-64561",
"url": "https://bugzilla.suse.com/1273231"
},
{
"category": "external",
"summary": "SUSE Bug 1273232 for CVE-2026-64561",
"url": "https://bugzilla.suse.com/1273232"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_67-rt-0:2-150700.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_67-rt-0:2-150700.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-14T10:03:54Z",
"details": "important"
}
],
"title": "CVE-2026-64561"
},
{
"cve": "CVE-2026-64564",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-64564"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: don\u0027t free the ASCONF\u0027s own transport in DEL-IP processing\n\nsctp_process_asconf() caches the transport the ASCONF chunk is processed\nagainst in asconf-\u003etransport (== chunk-\u003etransport, set once in sctp_rcv()).\nFor an ASCONF located through its Address Parameter by\n__sctp_rcv_asconf_lookup(), that cached transport corresponds to the\nAddress Parameter, which need not be the packet\u0027s source address.\n\nsctp_process_asconf_param() rejects a DEL-IP for the packet source address\n(ADDIP D8, SCTP_ERROR_DEL_SRC_IP), but nothing protects asconf-\u003etransport.\nA single ASCONF can therefore carry, in order:\n\n [Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0]\n\nwhere L differs from the source. The DEL-IP for L passes the D8 check and\ncalls sctp_assoc_rm_peer() on the transport that asconf-\u003etransport still\npoints at, freeing it (RCU-deferred). The following wildcard DEL-IP then\nreuses the now-dangling asconf-\u003etransport in sctp_assoc_set_primary() and\nsctp_assoc_del_nonprimary_peers(): set_primary() dereferences the freed\ntransport (-\u003eipaddr, -\u003estate) and plants the dangling pointer into\nasoc-\u003epeer.primary_path / active_path, and del_nonprimary_peers(), keeping\nonly the pointer that is no longer on the list, removes every real\ntransport, leaving the association with a transport_count of 0 and\nprimary_path/active_path pointing at freed memory.\n\nReject a DEL-IP that targets the transport the ASCONF is being processed\nagainst, mirroring the existing source-address guard, so the wildcard\nbranch can never reuse a freed transport.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_67-rt-0:2-150700.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-64564",
"url": "https://www.suse.com/security/cve/CVE-2026-64564"
},
{
"category": "external",
"summary": "SUSE Bug 1274072 for CVE-2026-64564",
"url": "https://bugzilla.suse.com/1274072"
},
{
"category": "external",
"summary": "SUSE Bug 1274074 for CVE-2026-64564",
"url": "https://bugzilla.suse.com/1274074"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_67-rt-0:2-150700.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_67-rt-0:2-150700.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-14T10:03:54Z",
"details": "important"
}
],
"title": "CVE-2026-64564"
},
{
"cve": "CVE-2026-64600",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-64600"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: resample the data fork mapping after cycling ILOCK\n\nxfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode,\na data fork mapping, and a cow fork mapping. Unfortunately, these two\nhelpers cycle the ILOCK to grab a transaction, which means that the\nmappings are stale as soon as we reacquire the ILOCK. Currently we\nrefresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but\nwe don\u0027t refresh the data fork mapping beforehand, which means that the\nxfs_bmap_trim_cow in that function queries the refcount btree about the\nwrong physical blocks and returns an inaccurate value in *shared.\n\nIf *shared is now false, the directio write proceeds with a stale data\nfork mapping. Fix this by querying the data fork mapping if the\nsequence counter changes across the ILOCK cycle.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_67-rt-0:2-150700.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-64600",
"url": "https://www.suse.com/security/cve/CVE-2026-64600"
},
{
"category": "external",
"summary": "SUSE Bug 1271526 for CVE-2026-64600",
"url": "https://bugzilla.suse.com/1271526"
},
{
"category": "external",
"summary": "SUSE Bug 1271543 for CVE-2026-64600",
"url": "https://bugzilla.suse.com/1271543"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_67-rt-0:2-150700.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_67-rt-0:2-150700.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-14T10:03:54Z",
"details": "important"
}
],
"title": "CVE-2026-64600"
},
{
"cve": "CVE-2026-68138",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-68138"
}
],
"notes": [
{
"category": "general",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: serialize qdisc_rtab_list against concurrent get/put\n\nqdisc_get_rtab() and qdisc_put_rtab() mutate the process-global singly\nlinked list qdisc_rtab_list and a plain non-atomic \u0027int refcnt\u0027 with no\nlock. This was only safe because every caller historically held the RTNL\nmutex, which serialized all rate-table lookups, inserts and frees.\n\nThat invariant no longer holds. cls_flower sets\nTCF_PROTO_OPS_DOIT_UNLOCKED, so tc_new_tfilter() keeps rtnl_held == false\nfor it and sets TCA_ACT_FLAGS_NO_RTNL. That flag propagates through\ntcf_exts_validate_ex() -\u003e tcf_action_init() -\u003e tcf_action_init_1() -\u003e\ntcf_police_init(), which calls qdisc_get_rtab()/qdisc_put_rtab() with the\nRTNL mutex NOT held. Two RTM_NEWTFILTER requests on different CPUs, each\nadding a flower filter with a police action carrying the same rate, then\nrace on qdisc_rtab_list and on the non-atomic refcnt, leading to a\nuse-after-free / double-free of the kmalloc-2k struct qdisc_rate_table.\nqdisc_rtab_list is a single global (not per-netns), so the corrupted\nobject is shared system-wide.\n\n BUG: KASAN: slab-use-after-free in qdisc_put_rtab+0x12f/0x160\n qdisc_put_rtab+0x12f/0x160\n tcf_police_init+0xda9/0x1590\n tcf_action_init_1+0x460/0x6b0\n tcf_action_init+0x439/0xa40\n tcf_exts_validate_ex+0x42d/0x550\n fl_change+0xddd/0x7da0\n tc_new_tfilter+0xaa7/0x2420\n rtnetlink_rcv_msg+0x95e/0xe90\n which belongs to the cache kmalloc-2k of size 2048\n\nProtect qdisc_rtab_list and the refcount with a dedicated spinlock. The\n(sleeping, GFP_KERNEL) allocation in qdisc_get_rtab() is performed before\ntaking the lock; if a concurrent inserter added an identical table in the\nmeantime the freshly allocated one is freed under the lock, so no\nduplicate is leaked. qdisc_put_rtab() now decrements the refcount and\nunlinks under the same lock.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_67-rt-0:2-150700.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-68138",
"url": "https://www.suse.com/security/cve/CVE-2026-68138"
},
{
"category": "external",
"summary": "SUSE Bug 1274941 for CVE-2026-68138",
"url": "https://bugzilla.suse.com/1274941"
},
{
"category": "external",
"summary": "SUSE Bug 1274942 for CVE-2026-68138",
"url": "https://bugzilla.suse.com/1274942"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_67-rt-0:2-150700.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_7_67-rt-0:2-150700.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-14T10:03:54Z",
"details": "important"
}
],
"title": "CVE-2026-68138"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…