SUSE Ships Live Patch 17 Closing Five Kernel Flaws On Enterprise Linux 15 SP6
VTA-2026-000285, published on 2026-09-16, already covered Linux kernel vulnerability patching across affected distributions. This follow-up is being issued because SUSE has released SUSE-SU-2026:4791-1 on 2026-10-21, rated important, delivering Live Patch 17 for kernel 6.4.0-150600.23.78 and naming five CVEs, three of which the earlier advisory could not carry: CVE-2026-53131 in netfilter, CVE-2026-63887 in the iSCSI target subsystem, and CVE-2026-68158 in libceph. Alongside these sit CVE-2026-63794 in KVM on AMD SEV hosts and CVE-2026-63795 in the 9p filesystem client. The affected products are openSUSE Leap 15.6, SUSE Linux Enterprise Live Patching 15-SP6, SUSE Linux Enterprise Real Time 15 SP6, SUSE Linux Enterprise Server 15 SP6 and SUSE Linux Enterprise Server for SAP Applications 15 SP6, on ppc64le, s390x and x86_64.
SUSE describes each fix at the level of the kernel change rather than a working attack chain, and has not published exploitation details for any of the five. CVE-2026-53131 corrects netfilter code that called eth_hdr() without first requiring an Ethernet MAC header to be present. CVE-2026-63794 fixes a page overflow in sev_dbg_crypt() on the ENCRYPT path in KVM SVM, reachable locally on AMD SEV-enabled virtualisation hosts. CVE-2026-63795 stops oldfid being released on the error path of p9_client_walk() in the 9p client, a classic stale-reference pattern, while CVE-2026-63887 bounds the data iscsi_encode_text_output() appends to rsp_buf in the iSCSI target, and CVE-2026-68158 repairs a multiplication overflow in decode_new_up_state_weight() in libceph when parsing OSD map updates.
The scoring on this set is unusually divergent, which is the main thing a defender has to reconcile. SUSE rates CVE-2026-53131 at 8.8 (CVSS v4) and 8.2 (v3.1) while NVD puts it at 9.4; SUSE scores CVE-2026-63795 as a local 7.8 where NVD assigns a network-reachable 10.0; CVE-2026-63887 is 8.3 at SUSE against 9.8 at NVD; and CVE-2026-68158 is 8.2 at SUSE against 9.8 at NVD. The practical exposure depends heavily on what each host actually runs: netfilter is present almost everywhere, but the iSCSI target, 9p and libceph paths only matter on storage servers, virtualisation hosts and Ceph clients respectively. Current exploitation probability is low across the board, with FIRST EPSS placing CVE-2026-53131 at 0.4 percent, CVE-2026-63794 at 0.1 percent, CVE-2026-63795 at 0.5 percent, CVE-2026-63887 at 0.8 percent and CVE-2026-68158 at 0.7 percent over the next 30 days. Because these ship as live patches, the remediation path does not require a reboot, which removes the usual scheduling excuse for leaving SAP and Real Time workloads on an unpatched kernel for weeks.
Attack Surface
Server OS, Infrastructure
Tactics
Privilege Escalation, Impact
Techniques
- T1068 – Exploitation for Privilege Escalation
- T1499 – Endpoint Denial of Service
- T1211 – Exploitation for Defense Evasion
SuperPRO's Threat Countermeasures Procedures
- Apply the live patch on SUSE Linux Enterprise Live Patching 15-SP6 with: zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP6-2026-4790 SUSE-SLE-Module-Live-Patching-15-SP6-2026-4791 SUSE-SLE-Module-Live-Patching-15-SP6-2026-4782. On openSUSE Leap 15.6 use: zypper in -t patch SUSE-2026-4790 SUSE-2026-4791 SUSE-2026-4782.
- Confirm remediation by checking that hosts running kernel 6.4.0-150600.23.78 carry kernel-livepatch-6_4_0-150600_23_78-default-14-150600.2.1, and that hosts still on 23.70 or 23.73 carry kernel-livepatch-6_4_0-150600_23_70-default-19-150600.2.1 or kernel-livepatch-6_4_0-150600_23_73-default-16-150600.2.1 respectively.
- On SLES iSCSI target servers, restrict TCP/3260 to the storage VLAN with firewalld or nftables ACLs until Live Patch 17 is applied, since CVE-2026-63887 is an unbounded append in iscsi_encode_text_output() reached during iSCSI text parameter negotiation.
- On hosts that do not use VirtIO-9p or Plan 9 filesystem passthrough, blacklist the 9p, 9pnet, 9pnet_virtio and 9pnet_fd modules via /etc/modprobe.d/ and verify with lsmod, removing exposure to the p9_client_walk() error-path flaw CVE-2026-63795.
- On AMD SEV virtualisation hosts covered by CVE-2026-63794, restrict /dev/kvm to the libvirt-qemu service account and the kvm group only, and avoid granting guest-debug or SEV debug capability to untrusted tenant VMs until the patched kernel is active.
- On kernel CephFS and RBD clients affected by CVE-2026-68158, limit the monitor addresses configured in /etc/ceph/ceph.conf and the mount options to trusted monitor IPs, and unload the ceph, rbd and libceph modules on hosts that no longer mount Ceph storage.
- Enable kernel crash capture with kdump and alert in the SIEM on kernel oops or BUG entries from journalctl -k referencing netfilter, eth_hdr, iscsi_target_mod, 9pnet or libceph on SLE 15 SP6 hosts, which would indicate attempted triggering of these five defects.
