SUSE Ships Live Patch 33 Closing Four New Linux Kernel Flaws on Enterprise 15 SP5
Our advisory VTA-2026-000285 of 2026-09-16 covered the ongoing round of Linux kernel vulnerability fixes across enterprise distributions. SUSE has now published announcement SUSE-SU-2026:4733-1, rated important, delivering Live Patch 33 for kernel 5.14.21-150500.55.130 on SUSE Linux Enterprise 15 SP5. What is new since the earlier advisory is three previously unnamed CVEs — CVE-2026-53131 in netfilter, CVE-2026-63887 in the iSCSI target subsystem and CVE-2026-68158 in libceph — alongside CVE-2026-63794 in the KVM SVM code, giving four distinct indicators for tracking. Affected products include SUSE Linux Enterprise Server 15 SP5, Server for SAP Applications 15 SP5, High Performance Computing 15 SP5, Real Time 15 SP5, Micro 5.5, Live Patching 15-SP5 and openSUSE Leap 15.5 on ppc64le, s390x and x86_64.
SUSE has not published exploitation walkthroughs, but the patch descriptions identify each defect precisely. CVE-2026-53131 stems from netfilter calling eth_hdr() without first confirming an Ethernet MAC header is present, and SUSE scores it 8.8 under CVSS v4.0 as network-reachable without privileges or user interaction, with high availability impact. CVE-2026-63794 is a page overflow in sev_dbg_crypt() on the ENCRYPT path in KVM's AMD SEV support, rated 7.5 by SUSE and requiring local access with high attack complexity. CVE-2026-63887 covers unbounded appends by iscsi_encode_text_output() into rsp_buf in the SCSI iSCSI target, scored 7.2 by SUSE and 9.8 by NVD, reachable over the network with low privileges. CVE-2026-68158 is a multiplication overflow in libceph's decode_new_up_state_weight(), scored 8.8 by SUSE and 9.8 by NVD.
The practical exposure here is concentrated in roles these subsystems serve: firewalling and packet filtering through netfilter, storage export through the iSCSI target, Ceph cluster membership through libceph, and virtualisation hosts running confidential guests under KVM SEV. Hosts carrying SAP, HPC or real-time workloads on 15 SP5 are inside the affected set, and the live patch route means the fix lands without a reboot for Live Patching subscribers. Current exploitation likelihood is low across all four issues: FIRST EPSS places CVE-2026-53131 at 0.4 percent, CVE-2026-63794 at 0.1 percent, CVE-2026-63887 at 0.8 percent and CVE-2026-68158 at 0.7 percent probability of exploitation in the next 30 days. None of the four appears in any confirmed in-the-wild activity reported by the vendor. The divergence between SUSE and NVD scoring — notably 7.2 versus 9.8 on CVE-2026-63887 — reflects differing assumptions about privilege requirements rather than observed attacks.
Attack Surface
Server OS, Infrastructure, Storage
Tactics
Privilege Escalation, Impact, Initial Access
Techniques
- T1068 – Exploitation for Privilege Escalation
- T1190 – Exploit Public-Facing Application
- T1499 – Endpoint Denial of Service
- T1499.004 – Application or System Exploitation
SuperPRO's Threat Countermeasures Procedures
- On SUSE Linux Enterprise Live Patching 15-SP5 hosts, apply the patch with: zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP5-2026-4733 — this installs kernel-livepatch-5_14_21-150500_55_130-default-15-150500.2.1 and closes CVE-2026-53131, CVE-2026-63794, CVE-2026-63887 and CVE-2026-68158 without a reboot.
- On openSUSE Leap 15.5 systems run: zypper in -t patch SUSE-2026-4733, then confirm kernel-livepatch-SLE15-SP5_Update_33-debugsource-15-150500.2.1 is present on ppc64le, s390x or x86_64 builds.
- Inventory hosts running kernel 5.14.21-150500.55.130 using uname -r across SLES 15 SP5, SLES for SAP 15 SP5, SLE HPC 15 SP5, SLE Real Time 15 SP5 and SLE Micro 5.5 estates, and confirm livepatch state with klp -v patches or zypper lifecycle before closing the change ticket.
- For CVE-2026-63887 in the SCSI iSCSI target, restrict TCP/3260 on LIO targets to known initiator subnets with firewalld or nftables and disable any unused iSCSI target portal groups via targetcli, since the flaw is reachable over the network at low privilege.
- For CVE-2026-68158 in libceph, limit Ceph monitor and OSD traffic (TCP/3300 and TCP/6789, plus the 6800-7300 OSD range) to cluster and client networks only, and verify that CephFS or RBD kernel clients on 15 SP5 are running the patched livepatch before trusting OSD map decoding.
- For CVE-2026-63794 in KVM SVM, audit which AMD hosts have SEV enabled by checking /sys/module/kvm_amd/parameters/sev, and gate local access to /dev/kvm to the libvirt-qemu or kvm group only until Live Patch 33 is confirmed loaded, as the flaw requires local access on the hypervisor.
- Where the live patch cannot be applied, schedule the full kernel update to 5.14.21-150500.55.130 or later via YaST online_update or zypper patch, and monitor dmesg and journalctl -k for netfilter, iscsi_target_mod and libceph oops or BUG traces that would indicate memory corruption in the affected code paths.
