SUSE Ships Live Patch 54 Closing Eight Kernel Flaws On Enterprise Linux 15 SP4
SUSE has released announcement SUSE-SU-2026:5046-1 on 2 November 2026, rated important, delivering Live Patch 54 for kernel 5.14.21-150400.24.219 on SUSE Linux Enterprise 15 SP4. Eight CVEs are addressed: CVE-2026-53016, CVE-2026-53381, CVE-2026-68426, CVE-2026-74469, CVE-2026-74669, CVE-2026-89551, CVE-2026-89674 and CVE-2026-98432. The affected product set is wider than a single server image and includes openSUSE Leap 15.4, SUSE Linux Enterprise Server 15 SP4, Server for SAP Applications 15 SP4, High Performance Computing 15 SP4, Real Time 15 SP4, Live Patching 15-SP4 and SUSE Linux Enterprise Micro 5.3 and 5.4.
SUSE describes each fix in a single line and has not published exploitation details, proof-of-concept code or attack chains for any of the eight issues, so the mechanism below is limited to what the advisory itself states. The fixes span the crypto subsystem, where the ccp driver copied an initialisation vector without respecting the skcipher ivsize (CVE-2026-53016); virtiofs, which suffered a use-after-free on submount umount (CVE-2026-53381); and xfrm, where a stale skb->prev remained after asynchronous crypto took a GSO segment (CVE-2026-68426). Several of the remaining defects sit directly in network-facing code paths: SCTP could overflow its peer transport count (CVE-2026-74469), IPVS failed to clear IPv4 options when rebasing tunnel ICMP errors (CVE-2026-74669), SUNRPC's xdr_buf_trim did not clamp buf->len and could underflow (CVE-2026-89551), nfsd miscalculated XDR length in nfsd4_ff_encode_layoutget (CVE-2026-89674), and the IPv4 stack freed inet_opt and ireq_opt without waiting for an RCU grace period (CVE-2026-98432). Scoring diverges notably between the two bodies: SUSE rates CVE-2026-68426 and CVE-2026-74669 at 7.0 with local access and high attack complexity, while NVD rates both 9.8 as unauthenticated network issues, and SUSE's own CVSS v4.0 figures reach 9.2 for CVE-2026-98432.
The practical exposure sits with fleets that terminate network traffic on these kernels. NFS servers using nfsd and SUNRPC, load balancers running IPVS, hosts carrying SCTP for telecom signalling, and IPsec gateways using xfrm all process attacker-reachable input in exactly the subsystems being corrected, and memory-corruption defects in that position typically map to denial of service or privilege escalation on the host rather than a contained application fault. SAP and HPC estates are explicitly in scope, which places the patch against workloads where unplanned reboots are expensive, and the live patch mechanism is relevant for precisely that reason. None of the eight CVEs appears in the CISA Known Exploited Vulnerabilities catalogue in the verified exploitation evidence supplied with this advisory, which is a statement about the available evidence rather than an assurance that exploitation is not occurring. FIRST EPSS puts the thirty-day exploitation probability at 1.5 percent for CVE-2026-74469, 0.8 percent for CVE-2026-98432, 0.5 percent each for CVE-2026-68426, CVE-2026-74669, CVE-2026-89551 and CVE-2026-89674, and 0.1 percent each for CVE-2026-53016 and CVE-2026-53381. The gap that matters is coverage: live patches bind to a specific kernel build, so hosts running a kernel other than 5.14.21-150400.24.219 remain outside the protection this release provides.
Attack Surface
Server OS, Endpoint OS, Infrastructure
Tactics
Privilege Escalation, Impact, Lateral Movement
Techniques
- T1068 – Exploitation for Privilege Escalation
- T1210 – Exploitation of Remote Services
- T1499 – Endpoint Denial of Service
- T1499.004 – Application or System Exploitation
SuperPRO's Threat Countermeasures Procedures
- On SUSE Linux Enterprise Live Patching 15-SP4 hosts, install the new live patch with: zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP4-2026-5046 SUSE-SLE-Module-Live-Patching-15-SP4-2026-5047. On openSUSE Leap 15.4 use: zypper in -t patch SUSE-2026-5046 SUSE-2026-5047.
- Verify the fix actually landed by confirming kernel-livepatch-5_14_21-150400_24_219-default-8-150400.2.1 is installed (rpm -q kernel-livepatch-5_14_21-150400_24_219-default) and that the running kernel reported by uname -r is 5.14.21-150400.24.219; live patch 54 does not protect any other kernel build.
- Inventory hosts across SLES 15 SP4, SLES for SAP Applications 15 SP4, HPC 15 SP4, Real Time 15 SP4, openSUSE Leap 15.4 and SLE Micro 5.3 and 5.4, and sequence patching so NFS servers and load balancers are treated first, since CVE-2026-89551, CVE-2026-89674 and CVE-2026-74669 sit in SUNRPC, nfsd and IPVS.
- Ensure affected hosts are registered to the module that carries this announcement before SUSE-SU-2026:5046-1 can be offered: check with SUSEConnect –status-text and zypper lr that the SUSE Linux Enterprise Live Patching 15-SP4 module is present, as hosts without it will never be offered kernel-livepatch-5_14_21-150400_24_219-default-8-150400.2.1.
- On SUSE Linux Enterprise Server 15 SP4, Server for SAP Applications 15 SP4, High Performance Computing 15 SP4 and Real Time 15 SP4 systems not covered by live patching, take the same fixes by applying announcement SUSE-SU-2026:5046-1 with zypper patch and booting the updated kernel, since the eight CVEs are only closed in kernel 5.14.21-150400.24.219 and its live patch.
- On SUSE Linux Enterprise Micro 5.3 and 5.4 nodes, which SUSE lists as affected products for this announcement, apply the update through the transactional stack (transactional-update patch) and reboot the node, then confirm with uname -r that the running kernel is the fixed 5.14.21-150400.24.219 build.
- After each maintenance window, confirm on every listed product that the announcement is no longer outstanding by running zypper patches and zypper patch –dry-run and checking that patches SUSE-SLE-Module-Live-Patching-15-SP4-2026-5046 and -5047 (SUSE-2026-5046 and SUSE-2026-5047 on openSUSE Leap 15.4) are reported as applied rather than needed.
