openSUSE Extends Kernel Live Patch 18 to Real Time Systems on Leap 16
An earlier advisory covered live patch 18 for the standard SUSE Linux Enterprise 16 kernel and CVE-2026-98432. That same fix has now been issued for the real time kernel variant under announcement openSUSE-SU-2026:22235-1, rated important. It applies to openSUSE Leap 16.0 running kernel 6.12.0-160000.39.1 RT and ships as the package kernel-livepatch-6_12_0-160000_39-rt-2-160000.1.1. SUSE scores the flaw 8.1 under CVSS v3.1 and 9.2 under CVSS v4.0, tracked as bsc#1285686. Hosts on the real time kernel are not covered by the earlier generic live patch.
The advisory describes the change in a single line: the IPv4 stack now frees the inet_opt and ireq_opt structures only after an RCU grace period. Those structures hold IP options attached to sockets and to half open connection requests, so releasing them early can leave readers pointing at memory already returned. SUSE has not published exploitation details or proof of concept code. The v3.1 vector marks the issue network reachable with no privileges and no user interaction, but with high attack complexity.
Real time kernels typically sit under latency sensitive workloads in telecommunications, industrial control and financial systems, where an unplanned kernel fault carries more weight than the CVSS number alone suggests. A successful attack against this class of flaw could affect confidentiality, integrity and availability on the host. There is no evidence of exploitation, and FIRST EPSS puts the probability at 0.8 percent over the next 30 days. The practical exposure is patch drift across mixed fleets, where real time and generic kernels move on separate streams.
Attack Surface
Server OS, Endpoint OS, Infrastructure
Tactics
Initial Access, Privilege Escalation, Impact
Techniques
- T1190 – Exploit Public-Facing Application
- T1068 – Exploitation for Privilege Escalation
- T1499 – Endpoint Denial of Service
SuperPRO's Threat Countermeasures Procedures
- Apply the real time live patch on openSUSE Leap 16.0 with 'zypper in -t patch openSUSE-Leap-16.0-2012=1', which installs kernel-livepatch-6_12_0-160000_39-rt-2-160000.1.1 for kernel 6.12.0-160000.39.1 RT.
- Separate the fleet inventory by kernel flavour using 'uname -r' and 'rpm -qa | grep kernel-rt' – hosts patched under the earlier advisory openSUSE-SU-2026:22243-1 received the generic kernel fix only and still need this RT package.
- Confirm the live patch is active after installation by checking '/sys/kernel/livepatch/' for the loaded patch module and verifying its enabled flag reads 1, rather than assuming the zypper transaction succeeded.
- Verify the running kernel on each RT host is 6.12.0-160000.39.1 RT with 'uname -r', since the kernel-livepatch-6_12_0-160000_39-rt-2-160000.1.1 package in openSUSE-SU-2026:22235-1 binds to that exact build and hosts on any other RT kernel build are not covered by it.
- Ensure the openSUSE Leap 16.0 update repository is enabled and refreshed with 'zypper ref', then run 'zypper lp' to confirm whether patch openSUSE-Leap-16.0-2012=1 carrying the fix for CVE-2026-98432 is still listed as pending on the host.
- Confirm installation on each Leap 16.0 RT host with 'rpm -q kernel-livepatch-6_12_0-160000_39-rt', checking the version returned is 2-160000.1.1 as shipped in openSUSE-SU-2026:22235-1, and re-run the zypper patch command where an older version or no package is reported.
- Track SUSE bug bsc#1285686 and the vendor CVE page for CVE-2026-98432 for follow-on live patch releases covering other kernel flavours and SLE 16 branches in your estate.
