SUSE Ships Live Patch 59 Fixing Four Kernel Flaws In SLE 15 SP4
SUSE released announcement SUSE-SU-2026:5084-1 on 3 November 2026, rated important, delivering Live Patch 59 for SUSE Linux Enterprise 15 SP4 and naming four kernel CVEs: CVE-2026-74469, CVE-2026-89551, CVE-2026-89674 and CVE-2026-98432. The patch targets kernel 5.14.21-150400.24.240 and covers openSUSE Leap 15.4, SUSE Linux Enterprise Server 15 SP4, Server for SAP Applications 15 SP4, High Performance Computing 15 SP4, Real Time 15 SP4, Live Patching 15-SP4, and SUSE Linux Enterprise Micro 5.3 and 5.4 on ppc64le, s390x and x86_64. The four defects sit in the SCTP stack, the SUNRPC layer, the NFS server and IPv4 option handling, most of them network-facing subsystems on general-purpose fleets.
SUSE identifies the fixed code paths rather than publishing an exploitation route, so the mechanisms below are the defects as the vendor describes them. CVE-2026-74469 is an overflow in the peer transport count handling of the SCTP stack, scored 8.5 by SUSE under CVSS v4.0 as a local, low-privilege issue, while NVD rates it 8.8 with a network vector. CVE-2026-89551 is an underflow in the SUNRPC function xdr_buf_trim, where buf->len is now clamped; SUSE scores it 8.7 and limits the impact to availability, against 9.8 at NVD. CVE-2026-89674 is a wrong XDR length calculation in the NFS server routine nfsd4_ff_encode_layoutget, rated 7.5 by SUSE with high attack complexity and 9.8 by NVD. CVE-2026-98432 is a use-after-free style defect in IPv4 option handling, fixed by freeing inet_opt and ireq_opt only after an RCU grace period, and carries the highest SUSE score of the set at 9.2.
The practical exposure here is that SCTP, SUNRPC, NFS server and IPv4 option handling are all reachable from the network on general-purpose fleets, and the affected products include SAP application servers, HPC nodes and Real Time systems where unplanned reboots are expensive. That is precisely why SUSE ships these as live patches, applied to the running kernel without a restart, and why the vendor rates the announcement important and scores CVE-2026-98432 at 9.2 and CVE-2026-89551 at 8.7 under CVSS v4.0. Current exploitation status is low across the set: FIRST EPSS puts CVE-2026-74469 at a 1.5 percent probability of exploitation in the next 30 days, CVE-2026-98432 at 0.8 percent, and CVE-2026-89551 and CVE-2026-89674 at 0.5 percent each, and none of the four appears in the verified exploitation evidence as confirmed exploited. The combination of high vendor scores with no observed exploitation and no confirmed proof of concept places this in a planned maintenance window rather than an overnight emergency change, with the caveat that internet-facing NFS and SCTP endpoints on SLE 15 SP4 carry the shortest safe deferral. The realistic risk is an unpatched kernel sitting exposed while public analysis of the fix commits matures.
Attack Surface
Server OS, Infrastructure, Endpoint OS
Tactics
Privilege Escalation, Impact, Lateral Movement
Techniques
- T1068 – Exploitation for Privilege Escalation
- T1210 – Exploitation of Remote Services
- T1499 – Endpoint Denial of Service
- T1499.004 – Application or System Exploitation
SuperPRO's Threat Countermeasures Procedures
- On SUSE Linux Enterprise Live Patching 15-SP4 hosts, apply the new patch with: zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP4-2026-5084. On openSUSE Leap 15.4 use: zypper in -t patch SUSE-2026-5084.
- Confirm the live patch landed by checking that kernel-livepatch-5_14_21-150400_24_240-default-2-150400.2.1 and kernel-livepatch-SLE15-SP4_Update_59-debugsource-2-150400.2.1 are installed on ppc64le, s390x and x86_64 systems; hosts not running kernel 5.14.21-150400.24.240 need the matching live patch level instead.
- Inventory SUSE Linux Enterprise Server 15 SP4, Server for SAP Applications 15 SP4, High Performance Computing 15 SP4, Real Time 15 SP4, SUSE Linux Enterprise Micro 5.3 and 5.4, and openSUSE Leap 15.4 estates against SUSE-SU-2026:5084-1, and track remediation through bsc#1280285, bsc#1280693, bsc#1280728 and bsc#1285686.
- Prioritise hosts affected by the highest-scored defect, CVE-2026-98432 at SUSE CVSS v4.0 9.2 in IPv4 option handling, where the fix frees inet_opt and ireq_opt only after an RCU grace period. On those SUSE Linux Enterprise Server 15 SP4 and Server for SAP Applications 15 SP4 systems, install SUSE-SU-2026:5084-1 ahead of lower-scored estates.
- Until Live Patch 59 is installed, restrict NFS server exposure relevant to CVE-2026-89674 and CVE-2026-89551 by limiting TCP/UDP 2049 and the rpcbind port 111 to trusted subnets with firewalld on SUSE Linux Enterprise Server 15 SP4 hosts.
- For Server for SAP Applications 15 SP4 and Real Time 15 SP4 nodes where reboots are constrained, use the SUSE Linux Enterprise Live Patching 15-SP4 module to apply SUSE-SU-2026:5084-1 to the running kernel 5.14.21-150400.24.240 without a restart. Both products are listed among the affected products in that announcement.
- On SUSE Linux Enterprise Micro 5.3 and 5.4 systems, which SUSE-SU-2026:5084-1 also lists as affected, install the kernel-livepatch-5_14_21-150400_24_240-default-2-150400.2.1 package from that announcement. Hosts still showing the pre-update package set remain on the unfixed SCTP, SUNRPC, nfsd and IPv4 option code paths.
