SUSE Issues Live Patch 42 Closing Ten New Linux Kernel Flaws
Our advisory VTA-2026-000285 of 16 September 2026 covered Linux kernel vulnerability patching across enterprise distributions, but it could not name the ten flaws SUSE has now fixed in Live Patch 42 for SUSE Linux Enterprise 15 SP5. The update, released on 2 November 2026 as SUSE-SU-2026:5015-1 and rated important by the vendor, resolves ten CVEs in kernel 5.14.21-150500.55.172. Nine of these are new since the earlier advisory: CVE-2026-53016, CVE-2026-68426, CVE-2026-72262, CVE-2026-74469, CVE-2026-74669, CVE-2026-89544, CVE-2026-89551, CVE-2026-89674 and CVE-2026-98432, alongside CVE-2026-53381. Affected products are openSUSE Leap 15.5, SUSE Linux Enterprise Server 15 SP5, Server for SAP Applications 15 SP5, High Performance Computing 15 SP5, Real Time 15 SP5, Live Patching 15-SP5 and SUSE Linux Enterprise Micro 5.5, on ppc64le, s390x and x86_64. Organisations that acted on the September advisory are not covered for these ten issues, because this is a different vendor stream and a different kernel build.
SUSE describes each fix by the kernel subsystem it touches rather than publishing exploitation walkthroughs, so the mechanisms below are what the vendor states and no more. CVE-2026-53381 is a use-after-free in virtiofs triggered on submount unmount, and CVE-2026-72262 is a heap overflow in the ASoC SOF ipc3-control bytes_ext put and get handlers. CVE-2026-74469 is a peer transport count overflow in SCTP, while CVE-2026-98432 concerns inet_opt and ireq_opt structures in IPv4 being freed without waiting for an RCU grace period. The remaining issues sit in network and file-serving code paths that are frequently exposed on shared infrastructure: CVE-2026-89544 and CVE-2026-89551 are error-path and length-underflow bugs in SUNRPC, CVE-2026-89674 is an XDR length miscalculation in the nfsd layout encoder, CVE-2026-74669 involves IPv4 options not being cleared after IPVS rebases tunnel ICMP errors, and CVE-2026-68426 is a stale skb pointer in xfrm after asynchronous crypto consumes a GSO segment. CVE-2026-53016 is a smaller issue in the ccp crypto driver, where the initialisation vector is copied using the wrong size.
Scoring on this set is unusually divided, which matters for anyone triaging from a feed. SUSE rates most of the flaws as local privilege escalation issues requiring an existing account, for example 7.8 for CVE-2026-53381 and CVE-2026-72262 under CVSS 3.1, while NVD rates several of the same CVEs as remotely reachable at 9.8, including CVE-2026-68426, CVE-2026-74669, CVE-2026-89551, CVE-2026-89674 and CVE-2026-98432. The practical exposure depends heavily on configuration: an SAP or HPC host exporting NFS, terminating SCTP, running IPVS load balancing or hosting virtiofs-backed guests presents far more reachable surface than a standalone workstation. The SUNRPC and nfsd defects in particular affect services that typically listen on internal networks and are trusted by many clients at once, so a single unpatched file server carries more weight than its CVSS line suggests. None of these CVEs appears in CISA KEV, and FIRST EPSS currently places all ten below two percent probability of exploitation in the next thirty days, with CVE-2026-74469 highest at 1.5 percent, CVE-2026-98432 at 0.8 percent, CVE-2026-89544 at 0.7 percent, CVE-2026-68426, CVE-2026-74669, CVE-2026-89551 and CVE-2026-89674 each at 0.5 percent, CVE-2026-72262 at 0.2 percent, and CVE-2026-53016 and CVE-2026-53381 at 0.1 percent. There is no evidence of exploitation in the wild at this time, and the live patch mechanism means the fix can land without the reboot window that usually delays kernel remediation on production estates.
Attack Surface
Server OS, Endpoint OS, Infrastructure
Tactics
Privilege Escalation, Impact
Techniques
- T1068 – Exploitation for Privilege Escalation
- T1499 – Endpoint Denial of Service
- T1211 – Exploitation for Defense Evasion
SuperPRO's Threat Countermeasures Procedures
- Apply the live patch on SUSE Linux Enterprise Live Patching 15-SP5 hosts with: zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP5-2026-5015 SUSE-SLE-Module-Live-Patching-15-SP5-2026-5010; on openSUSE Leap 15.5 use: zypper in -t patch SUSE-2026-5010 SUSE-2026-5015.
- Verify the running kernel is 5.14.21-150500.55.172 and confirm the packages kernel-livepatch-5_14_21-150500_55_172-default-8-150500.2.1 and kernel-livepatch-5_14_21-150500_55_141-default-12-150500.2.1 are installed on ppc64le, s390x and x86_64 systems; check with klp -v patches or zypper se -is kernel-livepatch.
- Inventory SUSE Linux Enterprise Server 15 SP5, Server for SAP Applications 15 SP5, High Performance Computing 15 SP5, Real Time 15 SP5, SUSE Linux Enterprise Micro 5.5 and openSUSE Leap 15.5 estates against SUSE-SU-2026:5015-1, and prioritise NFS servers and virtiofs hosts given CVE-2026-89674, CVE-2026-89551, CVE-2026-89544 and CVE-2026-53381.
- Where the live patch cannot be staged immediately on NFS-serving hosts, restrict inbound TCP and UDP 2049 and the rpcbind port 111 to known client subnets at the host firewall, limiting reach to the SUNRPC and nfsd defects CVE-2026-89544, CVE-2026-89551 and CVE-2026-89674.
- On systems not using IPVS or SCTP, blacklist the ip_vs and sctp modules via /etc/modprobe.d so they cannot be autoloaded, removing the code paths behind CVE-2026-74669 and CVE-2026-74469 from reachable attack surface.
- On SUSE Linux Enterprise Micro 5.5 and other transactional-update systems where live patching does not apply, schedule the full kernel package update and reboot, as the livepatch packages listed in SUSE-SU-2026:5015-1 only cover Live Patching 15-SP5 and openSUSE Leap 15.5.
- Enable kernel audit rules and EDR alerting for unexpected kernel oops, BUG or KASAN use-after-free entries in dmesg on hosts running virtiofs, SOF audio (CVE-2026-72262) or the AMD CCP crypto driver (CVE-2026-53016), as crashes in these subsystems are the first visible sign of attempted exploitation.
