SUSE Live Patch 37 Closes Four Kernel Holes In Enterprise Linux 15 SP5
Our advisory VTA-2026-000285, published on 2026-09-16, covered a round of Linux kernel vulnerabilities and their vendor fixes. SUSE has now shipped SUSE-SU-2026:4749-1, released 2026-10-20 and rated important, which carries three CVEs the earlier advisory could not name — CVE-2026-53131, CVE-2026-63887 and CVE-2026-68158 — alongside CVE-2026-63794. The update is delivered as Live Patch 37 against kernel 5.14.21-150500.55.144 and reaches a broad slice of the SUSE estate: openSUSE Leap 15.5, SUSE Linux Enterprise Server 15 SP5 and 12 SP5, Server for SAP Applications 15 SP5 and 12 SP5, High Performance Computing 15 SP5 and 12 SP5, Real Time 15 SP5, Micro 5.5, and Live Patching 12-SP5 and 15-SP5 on ppc64le, s390x and x86_64. Scores diverge noticeably between the vendor and NVD, with SUSE rating CVE-2026-53131 and CVE-2026-68158 at 8.2 under CVSS v3.1 while NVD puts them at 9.4 and 9.8 respectively.
SUSE describes each defect by the code path it repairs rather than by any attack chain, and has not published exploitation details or proof-of-concept code. CVE-2026-53131 sits in netfilter, where the fix requires an Ethernet MAC header to be present before eth_hdr() is used — a packet-processing path reachable from the network. CVE-2026-63794 is a page overflow in the KVM SVM ENCRYPT path inside sev_dbg_crypt(), scored by SUSE as locally exploitable with high attack complexity. CVE-2026-63887 bounds appends made by iscsi_encode_text_output() into rsp_buf in the SCSI iSCSI target code, and CVE-2026-68158 corrects a multiplication overflow in the libceph function decode_new_up_state_weight(), which parses OSD map data from a Ceph cluster. The common thread is unvalidated length or header assumptions in parsers that handle remote or guest-supplied input.
The exposure here is shaped by what each subsystem is doing on a given host. A firewall or router running netfilter, an iSCSI target serving block storage, a Ceph client, and a KVM host running SEV-encrypted guests are all distinct roles, and most fleets will only run some of them — but SAP, HPC and Real Time builds are in scope, which puts the fix in front of production and latency-sensitive workloads. Current exploitation evidence is low across the set: FIRST EPSS places CVE-2026-63887 at 0.8 percent probability of exploitation in the next 30 days, CVE-2026-68158 at 0.7 percent, CVE-2026-53131 at 0.4 percent and CVE-2026-63794 at 0.1 percent. None of the four appears in any confirmed in-the-wild activity reported by the vendor. The practical significance is that kernel-level memory-safety defects of this kind, once public alongside their fixes, give attackers a clear map of the vulnerable code path, and unpatched hosts in storage and virtualisation tiers tend to be the ones with the longest change windows.
Attack Surface
Server OS, Infrastructure, Storage
Tactics
Privilege Escalation, Impact, Initial Access
Techniques
- T1068 – Exploitation for Privilege Escalation
- T1190 – Exploit Public-Facing Application
- T1499 – Endpoint Denial of Service
- T1211 – Exploitation for Defense Evasion
SuperPRO's Threat Countermeasures Procedures
- On SUSE Linux Enterprise Live Patching 15-SP5 and openSUSE Leap 15.5, apply the live patch with 'zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP5-2026-4755' (Leap 15.5 uses 'zypper in -t patch SUSE-2026-4755'), which installs kernel-livepatch-5_14_21-150500_55_144-default-11-150500.2.1 against kernel 5.14.21-150500.55.144.
- On SUSE Linux Enterprise Live Patching 12-SP5, run 'zypper in -t patch SUSE-SLE-Live-Patching-12-SP5-2026-4749' to install kgraft-patch-4_12_14-122_275-default-17-2.1 on ppc64le, s390x and x86_64 hosts.
- Inventory which SLES 15 SP5, SLES 12 SP5, SLES for SAP, HPC, Real Time 15 SP5 and Micro 5.5 systems are running kernel 5.14.21-150500.55.144 by comparing 'uname -r' output against the fixed package level, and confirm the live patch is active with 'klp -v patches' or 'cat /sys/kernel/livepatch/*/enabled'.
- Prioritise hosts exposing the vulnerable subsystems named in the advisory: nodes running the iSCSI target stack (target_core_iscsi / LIO on TCP 3260) for CVE-2026-63887, Ceph clients loading the libceph module for CVE-2026-68158, and netfilter-based firewalls or routers for CVE-2026-53131.
- Restrict TCP/3260 iSCSI target access to storage VLANs or explicitly listed initiator IQNs, and enable CHAP authentication on LIO targets, so that the unbounded iscsi_encode_text_output() text response path (CVE-2026-63887) is not reachable from general-purpose networks before the patch lands.
- Where KVM SEV is in use, enumerate guests started with SEV or SEV-ES policies and defer new untrusted tenant workloads onto those hosts until Live Patch 37 is applied, since CVE-2026-63794 is a page overflow in the sev_dbg_crypt() ENCRYPT path reachable from a local or guest context.
- Track the four SUSE bug references bsc#1269775, bsc#1271965, bsc#1272386 and bsc#1276303 in the change record for this patch cycle, and verify after reboot or live patch activation that the kernel no longer reports the vulnerable build so the fix is not silently lost on the next kernel update.
