SUSE Live Patch 44 Closes Four Kernel Flaws in Netfilter KVM iSCSI and Ceph
SUSE has shipped Live Patch 44 for SUSE Linux Enterprise 15 SP4 under announcement SUSE-SU-2026:4718-1, released 18 October 2026 and rated important by the vendor, fixing four Linux kernel vulnerabilities: CVE-2026-53131, CVE-2026-63794, CVE-2026-63887 and CVE-2026-68158. The update applies to kernel 5.14.21-150400.24.176 and covers openSUSE Leap 15.4, SUSE Linux Enterprise Server 15 SP4 and 12 SP5, Server for SAP Applications 15 SP4 and 12 SP5, High Performance Computing 15 SP4 and 12 SP5, Real Time 15 SP4, Live Patching 12-SP5 and 15-SP4, and SLE Micro 5.3 and 5.4. The four defects sit in the netfilter, KVM SVM, SCSI iSCSI target and libceph subsystems, and they reach the affected fleet through the live patch stream as well as the full kernel update.
SUSE has not published exploitation details or proof-of-concept code for any of the four issues, so only the fixed code paths are known. CVE-2026-53131 corrects netfilter so that an Ethernet MAC header is required before eth_hdr() is used; SUSE scores it 8.2 under CVSS v3.1 as network-reachable with no privileges, while NVD rates it 9.4. CVE-2026-63794 fixes a page overflow in sev_dbg_crypt() on the KVM SVM ENCRYPT path, a local-access issue on AMD SEV virtualisation hosts scored 7.0 by SUSE and 7.8 by NVD. CVE-2026-63887 bounds the appends iscsi_encode_text_output() makes to rsp_buf in the SCSI iSCSI target, scored 8.3 by SUSE with low privileges required and 9.8 by NVD. CVE-2026-68158 repairs a multiplication overflow in the libceph function decode_new_up_state_weight(), scored 8.2 by SUSE and 9.8 by NVD.
The practical exposure sits with hosts that actually expose these subsystems: firewall and bridging nodes running netfilter against untrusted traffic, AMD SEV hypervisors, systems serving LIO iSCSI targets, and kernel clients mounting CephFS or RBD. Scores in the high eights and nines look alarming, but current exploitation data does not match them. FIRST EPSS puts the probability of exploitation in the next 30 days at 0.4 percent for CVE-2026-53131, 0.1 percent for CVE-2026-63794, 0.8 percent for CVE-2026-63887 and 0.7 percent for CVE-2026-68158, and no in-the-wild activity is reported for any of them. Because these ship as live patches, the affected fleet can take the fix without a reboot, which removes the usual reason kernel updates sit unapplied on SAP, HPC and real-time workloads for weeks. The residual risk is concentrated in long-lived storage and virtualisation hosts, where an unpatched kernel keeps a remotely reachable memory-safety bug available for far longer than the maintenance window would suggest.
Attack Surface
Server OS, Infrastructure, Storage
Tactics
Initial Access, Privilege Escalation, Impact
Techniques
- T1190 – Exploit Public-Facing Application
- T1068 – Exploitation for Privilege Escalation
- T1499 – Endpoint Denial of Service
- T1211 – Exploitation for Defense Evasion
SuperPRO's Threat Countermeasures Procedures
- On SUSE Linux Enterprise Live Patching 15-SP4 run 'zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP4-2026-4722' to install kernel-livepatch-5_14_21-150400_24_176-default-21-150400.2.1; on openSUSE Leap 15.4 the equivalent patch ID is SUSE-2026-4722.
- On SUSE Linux Enterprise Live Patching 12-SP5 install all four patches in one transaction: 'zypper in -t patch SUSE-SLE-Live-Patching-12-SP5-2026-4718 SUSE-SLE-Live-Patching-12-SP5-2026-4719 SUSE-SLE-Live-Patching-12-SP5-2026-4720 SUSE-SLE-Live-Patching-12-SP5-2026-4721', covering kgraft-patch-4_12_14-122_293, 122_296, 122_302 and 122_307-default.
- Confirm the live patch is active rather than merely installed by checking 'uname -r' reports 5.14.21-150400.24.176 and that the module appears enabled under /sys/kernel/livepatch/ before closing the change ticket on SAP, HPC and Real Time 15 SP4 nodes.
- Apply the SUSE-SU-2026:4718-1 kernel update to SUSE Linux Enterprise Server for SAP Applications 15 SP4 and 12 SP5 and to High Performance Computing 15 SP4 and 12 SP5, which SUSE lists as affected, so that the iSCSI target bounds fix in iscsi_encode_text_output() for CVE-2026-63887 is present in the running kernel on hosts exporting LIO targets.
- On SLE Micro 5.3 and 5.4, move the kernel to the fixed level 5.14.21-150400.24.176 shipped in SUSE-SU-2026:4718-1, which carries the libceph decode_new_up_state_weight() multiplication overflow fix for CVE-2026-68158 used by kernel CephFS and RBD clients.
- On AMD SEV virtualisation hosts running SUSE Linux Enterprise Server 15 SP4 or 12 SP5, install the live patch from SUSE-SU-2026:4718-1 and confirm kernel-livepatch-5_14_21-150400_24_176-default-21-150400.2.1 (or the matching kgraft-patch package on 12 SP5) is present, as it carries the sev_dbg_crypt() page overflow fix for CVE-2026-63794.
- Where the live patch stream is not in use, install the full kernel update to 5.14.21-150400.24.176 from SUSE-SU-2026:4718-1 and reboot, since the netfilter eth_hdr() fix for CVE-2026-53131 is only active once the patched kernel is running; on 12 SP5 systems track the kgraft-patch-4_12_14-122_293, 122_296, 122_302 and 122_307-default packages instead.
