SUSE Kernel Update Fixes More Than One Hundred Flaws Including Two Exploited in the Wild
VTA-2026-000285, published on 16 September 2026, covered a round of Linux kernel vulnerability fixes and the subsystems affected by them. That incident has moved on. SUSE released SUSE-SU-2026:4667-1 on 14 October 2026, rated important, and the advisory cross-references well over a hundred CVEs in the Linux kernel, more than a hundred of which did not appear in the earlier advisory at all. The new entries run from CVE-2022-50645 and CVE-2025-39964 through large blocks of 2026 identifiers including the CVE-2026-68xxx, CVE-2026-72xxx, CVE-2026-74xxx, CVE-2026-80xxx and CVE-2026-89xxx ranges. Anyone running SUSE Linux Enterprise kernel packages covered by this announcement is in scope, which in most estates means the entire Linux server fleet rather than a single product or appliance.
SUSE has not published per-CVE exploitation walkthroughs in the announcement itself, so the shape of the risk has to be read from the scoring the vendor and NVD assigned. The bulk of the fixed issues carry local vectors with low privilege requirements, such as CVE-2026-43502, CVE-2026-64556 and CVE-2026-64580, all rated 7.8 under CVSS v3.1 with attack vector local and full loss of confidentiality, integrity and availability. A smaller but more exposed group is reachable over the network without authentication, including CVE-2026-64319 at 8.2 by SUSE and 9.1 at NVD, CVE-2026-68155 at 7.5, and CVE-2026-68158 and CVE-2026-68159, each scored 8.2 by SUSE but 9.8 by NVD. CVE-2026-68376 is the highest SUSE rating in the set at 9.2 under CVSS v4.0, network reachable with high attack complexity and no privileges required, while CVE-2026-100075 is adjacent-network under SUSE's reading at 7.5 and network-reachable at 9.8 under NVD's. Vendor and NVD scores diverge sharply on several entries, with CVE-2026-64279 rated 4.7 by SUSE against 7.8 at NVD and CVE-2026-53266 rated 7.5 by SUSE against 8.8 at NVD, so triage based on a single feed will produce different priorities depending on which one is used.
Two items in this bundle separate it from a routine kernel round-up. CVE-2025-39964 and CVE-2026-53266 are both listed in the CISA Known Exploited Vulnerabilities catalogue as of 18 September 2026, meaning exploitation against real targets is confirmed rather than theoretical. FIRST EPSS currently puts CVE-2025-39964 at a 1.3 percent probability of exploitation in the next 30 days and CVE-2026-53266 at 0.8 percent, while the other scored entries with published data sit between 0.1 and 0.5 percent, including CVE-2026-64319 at 0.5 percent, CVE-2026-100075 at 0.4 percent and CVE-2022-50645, CVE-2025-40022 and CVE-2026-43502 at 0.2 percent each. Low EPSS figures describe near-term likelihood, not safety, and they say nothing about the many CVEs in this advisory for which no exploitation data exists. The practical exposure is that kernel-level local privilege escalation is the standard second stage after an attacker lands on a host through phished credentials, an exposed service or a compromised container, and a flaw in that layer defeats the isolation that everything above it depends on. Because kernel packages only take effect after a reboot, the window between package installation and the next maintenance slot leaves uptime-sensitive systems running vulnerable code even after they appear patched in inventory, and multi-tenant hosts, shared build servers and container platforms where untrusted local code already executes carry the sharpest version of that risk.
Attack Surface
Server OS, Endpoint OS, Infrastructure
Tactics
Privilege Escalation, Initial Access, Impact, Lateral Movement
Techniques
- T1068 – Exploitation for Privilege Escalation
- T1190 – Exploit Public-Facing Application
- T1210 – Exploitation of Remote Services
- T1499 – Endpoint Denial of Service
- T1611 – Escape to Host
SuperPRO's Threat Countermeasures Procedures
- Install SUSE-SU-2026:4667-1 on affected SUSE Linux Enterprise hosts using zypper patch or zypper in -t patch, then reboot, since kernel packages do not take effect on the running system until restart.
- Verify remediation rather than assuming it: compare the output of uname -r against the kernel package version installed by rpm -q kernel-default, and flag any host where the running release lags the installed package as pending-reboot.
- Schedule the two CISA KEV entries first. CVE-2025-39964 and CVE-2026-53266 were added to the KEV catalogue on 2026-09-18 and are confirmed exploited, so patch and reboot shared shell servers, CI build nodes, container hosts and any multi-tenant system where untrusted local code runs ahead of single-purpose appliances.
- Treat the unauthenticated network-reachable entries as perimeter work: CVE-2026-64319, CVE-2026-68155, CVE-2026-68158, CVE-2026-68159, CVE-2026-68376 and CVE-2026-100075 all carry network or adjacent-network vectors with no privileges required, so restrict the exposed listening services on those hosts to management VLANs or VPN ranges until the reboot is complete.
- Reduce local kernel attack surface on servers by disabling unused protocol and filesystem modules with modprobe blacklist entries of the form 'install <module> /bin/true' in /etc/modprobe.d/, and set user.max_user_namespaces=0 via sysctl on hosts that do not run rootless containers.
- Add auditd coverage for the behaviour these flaws enable: watch module loading with '-w /sbin/insmod -p x -k module_load' and '-w /sbin/modprobe -p x -k module_load', and alert in EDR on a root shell whose parent process runs as an unprivileged user.
- Rebuild and redeploy container base images and VM golden templates from the patched SUSE kernel packages, because images built before 2026-10-14 will continue to ship the vulnerable kernel into new workloads even after the hosts themselves are updated.
