SUSE Live Patch 35 Closes Ten Kernel Holes Across Enterprise 15 SP5 Servers
SUSE published announcement SUSE-SU-2026:4978-1 on 1 November 2026, rated important, delivering Live Patch 35 for kernel 5.14.21-150500.55.136 and resolving ten Linux kernel vulnerabilities in one package. The ten issues are CVE-2026-53381, CVE-2026-53016, CVE-2026-68426, CVE-2026-72262, CVE-2026-74469, CVE-2026-74669, CVE-2026-89544, CVE-2026-89551, CVE-2026-89674 and CVE-2026-98432, spread across unrelated kernel subsystems rather than concentrated in one component. Affected products are openSUSE Leap 15.5, SUSE Linux Enterprise Server 15 SP5, SUSE Linux Enterprise Server for SAP Applications 15 SP5, SUSE Linux Enterprise High Performance Computing 15 SP5, SUSE Linux Enterprise Real Time 15 SP5, SUSE Linux Enterprise Micro 5.5 and SUSE Linux Enterprise Live Patching 15-SP5, on ppc64le, s390x and x86_64. The live patch packages are version-specific, so whether a host is covered depends on the exact kernel revision it is running rather than on any earlier kernel update already in place.
SUSE has not published exploitation walkthroughs, so what is known comes from the fix descriptions themselves. The defects sit in several unrelated subsystems: a use-after-free in virtiofs on submount umount (CVE-2026-53381), an initialisation-vector copy in the ccp crypto driver that ignored the skcipher ivsize (CVE-2026-53016), a stale skb pointer in xfrm after async crypto takes a GSO segment (CVE-2026-68426), a heap overflow in the ASoC SOF ipc3-control bytes_ext get and put paths (CVE-2026-72262), an SCTP peer transport count overflow (CVE-2026-74469), unsanitised IPv4 options after IPVS rebases tunnel ICMP errors (CVE-2026-74669), error-path bugs in the SUNRPC gssx_dec_option_array routine (CVE-2026-89544), a length underflow in SUNRPC xdr_buf_trim now clamped (CVE-2026-89551), a bad XDR length calculation in nfsd4_ff_encode_layoutget (CVE-2026-89674), and a missing RCU grace period before freeing inet_opt and ireq_opt in IPv4 (CVE-2026-98432). Scoring diverges sharply between the two bodies that rated them. SUSE treats most as local privilege escalation at 7.0 to 8.5, with the network-facing SUNRPC and IPv4 issues at 7.5 to 9.2; NVD scores the local ccp driver flaw CVE-2026-53016 at 7.8 and 7.0, while rating CVE-2026-68426, CVE-2026-74669, CVE-2026-89551, CVE-2026-89674 and CVE-2026-98432 at 9.8 with a remote, unauthenticated vector.
The practical exposure is uneven and depends heavily on what a given host actually runs. Memory corruption in SUNRPC, nfsd and the IPv4 option handling paths is reachable on file servers and any box exporting NFS, which puts the SAP Applications and HPC variants of SLE 15 SP5 squarely in scope, and it is these network-facing paths that NVD scores at 9.8 with a remote, unauthenticated vector. SCTP and IPVS defects matter mainly to telecom signalling nodes and load balancers, while the virtiofs and ccp issues bite on virtualisation hosts and AMD platforms with the crypto co-processor enabled; the audio SOF flaw is a desktop and workstation concern rather than a server one. On current evidence none of these is being exploited: FIRST EPSS places CVE-2026-74469 highest at a 1.5 percent probability of exploitation in the next 30 days, followed by CVE-2026-89544 at 0.7 percent, CVE-2026-74669, CVE-2026-89551, CVE-2026-89674 and CVE-2026-98432 at 0.5 percent, CVE-2026-68426 at 0.4 percent, CVE-2026-72262 at 0.2 percent, and CVE-2026-53016 and CVE-2026-53381 at 0.1 percent each. None appears in the CISA Known Exploited Vulnerabilities catalogue and SUSE reports no in-the-wild activity. The residual risk is the familiar live-patching trap: a live patch is bound to one exact kernel build, so a fleet running mixed 15 SP5 kernel revisions will have hosts that silently fall outside the scope of this particular patch and remain carrying all ten defects.
Attack Surface
Server OS, Endpoint OS, Infrastructure
Tactics
Privilege Escalation, Impact, Initial Access
Techniques
- T1068 – Exploitation for Privilege Escalation
- T1210 – Exploitation of Remote Services
- T1499 – Endpoint Denial of Service
- T1211 – Exploitation for Defense Evasion
SuperPRO's Threat Countermeasures Procedures
- On SUSE Linux Enterprise Live Patching 15-SP5 hosts, apply the new patch with zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP5-2026-4978; on openSUSE Leap 15.5 use zypper in -t patch SUSE-2026-4978. Confirm kernel-livepatch-5_14_21-150500_55_136-default-15-150500.2.1 is installed afterwards.
- The live patch package kernel-livepatch-5_14_21-150500_55_136-default-15-150500.2.1 binds only to kernel 5.14.21-150500.55.136; any SLE 15 SP5 host whose uname -r reports a different revision is outside the scope of SUSE-SU-2026:4978-1 and still carries all ten CVEs, including CVE-2026-98432 and CVE-2026-89674, until the matching full kernel package for that revision is installed.
- SUSE Linux Enterprise Server for SAP Applications 15 SP5 and SUSE Linux Enterprise High Performance Computing 15 SP5 hosts take the same Live Patch 35 content listed in SUSE-SU-2026:4978-1; on NFS-exporting servers, rpm -q kernel-livepatch-5_14_21-150500_55_136-default returning 15-150500.2.1 confirms the SUNRPC and nfsd fixes for CVE-2026-89544, CVE-2026-89551 and CVE-2026-89674 are present.
- The packages in SUSE-SU-2026:4978-1 are published for ppc64le, s390x and x86_64, and the live patch binds to the running kernel without a reboot; uname -r reporting 5.14.21-150500.55.136 together with zypper patch-info SUSE-SLE-Module-Live-Patching-15-SP5-2026-4978 shows whether a given SLE 15 SP5 host has taken the update covering CVE-2026-74469 and the remaining nine CVEs.
- SLE 15 SP5 hosts without a SUSE Linux Enterprise Live Patching 15-SP5 subscription receive these ten fixes only through the full kernel package matching 5.14.21-150500.55.136, installed with zypper up kernel-default followed by a reboot, since the kernel-livepatch-5_14_21-150500_55_136-default package in SUSE-SU-2026:4978-1 is delivered through the Live Patching module.
- SUSE Linux Enterprise Micro 5.5 and SUSE Linux Enterprise Real Time 15 SP5 are listed as affected products in SUSE-SU-2026:4978-1 and have packages published for them, so the Live Patch 35 content for kernel 5.14.21-150500.55.136 is available on those systems through zypper patch, with zypper patches | grep 4978 showing whether the update has been applied.
- openSUSE Leap 15.5 desktop and workstation installations carry the ASoC SOF ipc3-control heap overflow CVE-2026-72262 as well as the server-side defects, and the same SUSE-SU-2026:4978-1 content reaches them with zypper in -t patch SUSE-2026-4978, after which rpm -q kernel-livepatch-5_14_21-150500_55_136-default verifies version 15-150500.2.1 is installed.
