SUSE Kernel Update Rolls Up Over 100 Flaws Including Two Under Active Exploitation
This incident was previously covered in VTA-2026-000285 on 2026-09-16, which dealt with Ubuntu kernel fixes across NVIDIA and other subsystems. The picture has since widened considerably. SUSE has published announcement SUSE-SU-2026:4665-1, rated important and released on 2026-10-14, which bundles more than one hundred Linux kernel CVEs for SUSE Linux Enterprise customers, alongside roughly 120 internal bug references (bsc) and several feature tracking items (jsc). The great majority of these identifiers were not in the earlier advisory, including older carry-overs such as CVE-2022-50645 and CVE-2025-39964 as well as large blocks of newly assigned 2026 identifiers in the CVE-2026-72xxx, CVE-2026-74xxx, CVE-2026-80xxx and CVE-2026-89xxx ranges. The most significant change for defenders is that two of the CVEs now rolled into this kernel update, CVE-2025-39964 and CVE-2026-53266, are listed in the CISA Known Exploited Vulnerabilities catalogue as of 2026-09-18, which moves this from a routine kernel refresh to a patch cycle with confirmed in-the-wild activity behind it.
SUSE has not published per-CVE exploitation details in this announcement, so the practical read of the update comes from the scoring vectors it carries rather than from any described attack chain. The bulk of the issues are local in nature: CVE-2026-43502, CVE-2026-64556 and CVE-2026-64580 are each scored 7.8 under CVSS v3.1 with vectors of AV:L/AC:L/PR:L/UI:N and high impact to confidentiality, integrity and availability, the classic profile of a kernel memory-safety defect reachable by an already authenticated local user. A smaller but more exposed group is reachable over the network without credentials. CVE-2026-68155, CVE-2026-68158 and CVE-2026-68159 all carry AV:N/AC:L/PR:N/UI:N vectors with high availability impact and SUSE scores of 7.5 to 8.8, while CVE-2026-64319 is scored 8.2 by SUSE and 9.1 by NVD on the same unauthenticated network vector. CVE-2026-68376 is the highest-rated entry in the set at CVSS v4.0 9.2 from SUSE, again network-reachable without privileges but with high attack complexity. Several entries also show a meaningful split between SUSE and NVD scoring, with CVE-2026-100075 assessed at 7.5 by SUSE on an adjacent-network vector but 9.8 by NVD on a fully remote one.
The operational weight of this advisory sits in the two KEV entries. CVE-2025-39964 is confirmed exploited in the wild and carries a 1.3 percent probability of exploitation in the next 30 days according to FIRST EPSS, with SUSE and NVD both scoring it 7.8 for local privilege escalation. CVE-2026-53266 is likewise confirmed exploited and sits at 0.8 percent EPSS, scored 7.5 by SUSE on an adjacent-network vector and 8.8 by NVD with a scope change, meaning a successful exploit is assessed as breaking out of the originally affected component. The remaining CVEs with published exploitation data show low near-term likelihood, with CVE-2022-50645, CVE-2025-40022, CVE-2026-43502, CVE-2026-100075 and CVE-2026-64319 all between 0.1 and 0.5 percent EPSS, and no exploitation data is available for the rest of the set. Kernel flaws of this kind matter disproportionately in shared and virtualised estates, because a local privilege escalation on a multi-tenant host, a container platform or a build server converts a limited foothold into full control of every workload on that machine. The scale of the roll-up is itself a risk factor: an estate that has deferred SUSE kernel updates since the September cycle is now carrying the entire backlog, including both actively exploited issues, on every unpatched host.
Attack Surface
Server OS, Endpoint OS, Infrastructure
Tactics
Privilege Escalation, Execution, Impact
Techniques
- T1068 – Exploitation for Privilege Escalation
- T1190 – Exploit Public-Facing Application
- T1499 – Endpoint Denial of Service
- T1211 – Exploitation for Defense Evasion
SuperPRO's Threat Countermeasures Procedures
- Apply SUSE-SU-2026:4665-1 (released 2026-10-14, rated important) to all SUSE Linux Enterprise hosts using 'zypper patch' or 'zypper in -t patch SUSE-SU-2026:4665-1', then reboot and confirm the running kernel with 'uname -r' against 'rpm -q kernel-default' — the update is not effective until the new kernel is actually booted.
- Sequence the rollout so that hosts exposed to untrusted users or networks go first, because CVE-2025-39964 and CVE-2026-53266 are in the CISA KEV catalogue (listed 2026-09-18) and are the only two entries in this set with confirmed in-the-wild exploitation.
- Where a reboot window cannot be obtained quickly, install SUSE Kernel Live Patching ('zypper in kernel-livepatch-<version>' and verify with 'klp -v patches') for the local privilege-escalation entries such as CVE-2026-43502, CVE-2026-64556 and CVE-2026-64580, and record that live patches do not cover every driver or module fix in this roll-up.
- Restrict untrusted network reachability to the affected hosts while patching is in progress, since CVE-2026-68155, CVE-2026-68158, CVE-2026-68159 and CVE-2026-64319 are scored AV:N/PR:N with high availability impact — limit inbound traffic at the host firewall (firewalld or SuSEfirewall rules) to known management and application sources.
- Harden the local kernel attack surface on multi-user and container hosts by setting 'kernel.unprivileged_userns_clone=0', 'kernel.dmesg_restrict=1' and 'kernel.perf_event_paranoid=3' in /etc/sysctl.d/ and reloading with 'sysctl –system', reducing the paths an unprivileged account can use to reach the local escalation bugs in this advisory.
- Blacklist kernel modules the estate does not use by adding 'install <module> /bin/true' entries under /etc/modprobe.d/ and rebuilding the initrd with 'dracut -f', so unused network protocol and filesystem drivers cannot be auto-loaded and exercised.
- Alert on kernel oops, BUG, general protection fault and panic messages collected from journald or rsyslog on SUSE hosts, and treat repeated crashes on an unpatched system as a possible exploitation attempt against the availability-impacting CVEs in this set rather than as a hardware fault.
