SUSE Ships Another Kernel Update Closing Twenty Seven New Linux Flaws
SUSE has released SUSE-SU-2026:4936-1, rated important, which updates the SUSE Linux Enterprise 15 SP5 kernel to resolve 27 vulnerabilities. The identifiers include CVE-2026-72110, CVE-2026-72493, CVE-2026-74587, CVE-2026-89528, CVE-2026-89542, CVE-2026-89669, CVE-2026-98323, CVE-2026-98432 and CVE-2026-99999, the last carrying a SUSE CVSS v4.0 score of 9.3 and an NVD CVSS v3.1 score of 9.3 with a changed scope. Affected products are openSUSE Leap 15.5, SUSE Linux Enterprise Server 15 SP5 and its LTSS stream, SUSE Linux Enterprise Server for SAP Applications 15 SP5, SUSE Linux Enterprise High Performance Computing 15 SP5 including the ESPOS and LTSS variants, SUSE Linux Enterprise Real Time 15 SP5, SUSE Linux Enterprise Micro 5.5 and SUSE Linux Enterprise Live Patching 15-SP5.
The advisory describes each fix at the level of the kernel subsystem rather than publishing exploitation details, and no proof-of-concept code is referenced for any of the 27 issues. The named mechanisms cluster around networking and remote file services. CVE-2026-74587 is a use-after-free of a cached ASCONF chunk in the SCTP stack, while CVE-2026-72493 is a race in the netif_running check inside enqueue_to_backlog and CVE-2026-74624 is a conntrack condition where the receive window is exceeded. On the storage and RPC side, CVE-2026-89528 covers svcrdma accepting Read lists that exceed the page budget, CVE-2026-89542 hardens gss_krb5_unwrap_v2 against short Kerberos tokens, and CVE-2026-89669 fixes a publish race in nfsd's nfs4_init_cp_state. Local attack paths are also represented: CVE-2026-72110 concerns BPF task-local storage not being wiped before fork bailouts, CVE-2026-72301 is a time-of-check to time-of-use flaw in the SOF audio IPC control path, CVE-2026-74578 forces synchronous processing in algif_skcipher, and CVE-2026-80977 stops skb_tx_error touching shared zerocopy state. The remaining CVEs in the set are listed with scores and bug references only, so the exploitation path for those is not published by the vendor.
The practical exposure splits along two lines. The network-reachable issues matter most on hosts that terminate SCTP, serve NFS over RDMA, or run Kerberised SUNRPC, which in SUSE estates typically means SAP application servers, HPC compute and storage nodes, and clustered file servers rather than general-purpose endpoints. SUSE's own scoring is noticeably more conservative than NVD's on several entries: CVE-2026-72041 is 5.5 at SUSE against 9.8 at NVD, and CVE-2026-89669 is 7.5 against 9.8, a gap that reflects whether the affected code path is reachable in SUSE's shipped configuration. Current exploitation status is quiet. FIRST EPSS places the thirty-day exploitation probability at 0.7 percent for CVE-2026-72041, CVE-2026-89528 and CVE-2026-89669, 0.5 percent for CVE-2026-74587, CVE-2026-74624 and CVE-2026-89542, 0.4 percent for CVE-2026-72493, 0.2 percent for CVE-2026-72110 and CVE-2026-72301, and 0.1 percent for CVE-2026-74578 and CVE-2026-80977. No exploitation data is published for the remaining CVEs in the set, and none appear on the CISA Known Exploited Vulnerabilities catalogue. The strategic point for defenders is cumulative rather than urgent: estates on LTSS or extended-support streams that defer reboots accumulate a growing set of local privilege-escalation primitives usable by any attacker who already has a shell, including through container breakout on Micro 5.5 hosts.
Attack Surface
Server OS, Endpoint OS, Infrastructure
Tactics
Privilege Escalation, Impact, Lateral Movement
Techniques
- T1068 – Exploitation for Privilege Escalation
- T1210 – Exploitation of Remote Services
- T1499 – Endpoint Denial of Service
- T1611 – Escape to Host
SuperPRO's Threat Countermeasures Procedures
- Install the kernel packages from SUSE-SU-2026:4936-1 on openSUSE Leap 15.5, SUSE Linux Enterprise Server 15 SP5 and SP5 LTSS, SLES for SAP Applications 15 SP5, HPC 15 SP5 (including ESPOS and LTSS), Real Time 15 SP5 and Micro 5.5 using 'zypper patch' or 'zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5', then reboot to activate the new kernel.
- Where reboot windows are constrained on SAP or HPC nodes, install the matching SUSE Linux Enterprise Live Patching 15-SP5 payload shipped with SUSE-SU-2026:4936-1 via 'zypper patch', treating live patching as interim cover until the full kernel reboot into the fixed kernel-default build is scheduled.
- Restrict NFS and RPC exposure on hosts affected by CVE-2026-89528 (svcrdma Read list page budget), CVE-2026-89542 (gss_krb5_unwrap_v2 short tokens) and CVE-2026-89669 (nfsd nfs4_init_cp_state race) by limiting TCP/2049 to known client subnets at the host firewall until the updated kernel from SUSE-SU-2026:4936-1 is running.
- Identify hosts where the SCTP stack is in use with 'lsmod | grep sctp' and schedule those systems first for the SUSE-SU-2026:4936-1 kernel install and reboot, since they expose the CVE-2026-74587 cached ASCONF chunk use-after-free path until the fixed kernel is running.
- Identify systems exposing the AF_ALG crypto user API with 'lsmod | grep algif_skcipher' and prioritise the SUSE-SU-2026:4936-1 kernel install on multi-tenant or shared-shell hosts among them, as CVE-2026-74578 in algif_skcipher is reachable by unprivileged local workloads until the updated kernel is active.
- Confirm remediation by comparing 'uname -r' and 'rpm -q –changelog kernel-default | head' against the fixed build referenced in SUSE-SU-2026:4936-1, and track the bug references bsc#1275510 through bsc#1285685 in the change record for the affected fleet.
- Audit container and virtualisation hosts running SUSE Linux Enterprise Micro 5.5 first, since the local privilege-escalation issues in this set (including CVE-2026-72110 in BPF task-local storage and CVE-2026-72301 in the SOF IPC control path) are reachable by any workload that already has code execution on the node.
