SUSE Ships Live Patch 36 Fixing Four Linux Kernel Flaws on Enterprise 15 SP5
SUSE has released SUSE-SU-2026:4734-1, a security update rated important that resolves four vulnerabilities in the SUSE Linux Enterprise kernel 5.14.21-150500.55.141. The fixes are delivered as Live Patch 36 for SUSE Linux Enterprise 15 SP5, so they load into a running kernel rather than requiring a reboot. The affected products are SUSE Linux Enterprise Server 15 SP5, Server for SAP Applications 15 SP5, High Performance Computing 15 SP5, Real Time 15 SP5, Live Patching 15-SP5, SUSE Linux Enterprise Micro 5.5 and openSUSE Leap 15.5, on ppc64le, s390x and x86_64. The four issues are CVE-2026-53131, CVE-2026-63794, CVE-2026-63887 and CVE-2026-68158, tracked by SUSE as bsc#1269775, bsc#1271965, bsc#1272386 and bsc#1276303. SUSE's own CVSS v3.1 scores run from 7.0 to 8.3, while NVD rates three of the four at 9.4 or higher.
The flaw classes named in the advisory are familiar kernel memory-safety and input-validation problems. CVE-2026-53131 sits in netfilter, where the kernel used eth_hdr() without first requiring that an Ethernet MAC header be present; SUSE scores it AV:N with high availability impact, meaning it is reachable from the network without credentials. CVE-2026-63887 is in the SCSI iSCSI target code, where iscsi_encode_text_output() appended to the rsp_buf response buffer without a bound, and SUSE rates it network-reachable with low privileges required. CVE-2026-63794 is a page overflow in the ENCRYPT path of sev_dbg_crypt() in KVM's AMD SVM code, which SUSE scores as a local issue requiring high attack complexity, and CVE-2026-68158 is a multiplication overflow in the libceph function decode_new_up_state_weight(). Beyond these one-line fix summaries and the four bug references, the published advisory text carries no further exploitation detail.
Live patch streams matter because the hosts that rely on them are the ones organisations are least willing to reboot, including SAP application servers, HPC compute nodes and real-time systems where downtime carries direct cost. Two of the four flaws are rated by SUSE as network-reachable, placing them in the path of anything that processes untrusted packets or exposes a kernel iSCSI target, while the KVM SEV and libceph issues land on AMD virtualisation hosts and Ceph kernel clients respectively. Current exploitation likelihood is low: FIRST EPSS puts the 30-day probability of exploitation at 0.4% for CVE-2026-53131, 0.1% for CVE-2026-63794, 0.8% for CVE-2026-63887 and 0.7% for CVE-2026-68158. Hosts still running kernel 5.14.21-150500.55.141 without Live Patch 36 continue to carry all four issues, and the gap between SUSE's and NVD's scoring means vulnerability scanners will surface several of these as critical findings in audit and compliance reporting.
Attack Surface
Server OS, Infrastructure, Storage
Tactics
Initial Access, Privilege Escalation, Impact
Techniques
- T1190 – Exploit Public-Facing Application
- T1068 – Exploitation for Privilege Escalation
- T1499.004 – Application or System Exploitation
SuperPRO's Threat Countermeasures Procedures
- On SUSE Linux Enterprise Live Patching 15-SP5, install the update named in SUSE-SU-2026:4734-1 with 'zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP5-2026-4734'.
- On openSUSE Leap 15.5, install the same update with 'zypper in -t patch SUSE-2026-4734', or use the SUSE-recommended alternatives YaST online_update or 'zypper patch'.
- Verify the advisory's package list landed on each host: kernel-livepatch-5_14_21-150500_55_141-default-11-150500.2.1 and kernel-livepatch-SLE15-SP5_Update_36-debugsource-11-150500.2.1 on ppc64le, s390x and x86_64.
- Scope the rollout to the exact kernel the live patch targets, 5.14.21-150500.55.141 on SLES 15 SP5, SLES for SAP Applications 15 SP5, HPC 15 SP5, Real Time 15 SP5, Micro 5.5 and Leap 15.5; hosts on any other kernel build require the corresponding kernel update instead of Live Patch 36.
- Schedule the network-reachable issues first: SUSE scores CVE-2026-53131 (netfilter eth_hdr) and CVE-2026-63887 (iscsi_encode_text_output in the SCSI iSCSI target) as AV:N, so prioritise packet-filtering gateways and any host exporting a kernel iSCSI target.
- Schedule the local-vector issues next, applying Live Patch 36 to AMD SEV KVM hypervisors for CVE-2026-63794 in sev_dbg_crypt() and to Ceph kernel client nodes for CVE-2026-68158 in libceph decode_new_up_state_weight().
- Record the four SUSE bug references bsc#1269775, bsc#1271965, bsc#1272386 and bsc#1276303 in the vulnerability register, and note in scanner exception handling that SUSE scores these 7.0 to 8.3 while NVD scores CVE-2026-63887 and CVE-2026-68158 at 9.8.
