SUSE Live Patch 47 Closes Seven Kernel Flaws Across SUSE Linux Enterprise 15 SP4
SUSE has shipped Live Patch 47 for SUSE Linux Enterprise 15 SP4 as announcement SUSE-SU-2026:4996-1, released 2 November 2026 and rated important, closing seven kernel flaws: CVE-2026-53016, CVE-2026-68426, CVE-2026-74469, CVE-2026-74669, CVE-2026-89551, CVE-2026-89674 and CVE-2026-98432. The update targets kernel 5.14.21-150400.24.187 and lists openSUSE Leap 15.4, SUSE Linux Enterprise Server 15 SP4, Server for SAP Applications 15 SP4, High Performance Computing 15 SP4, Real Time 15 SP4, Live Patching 15-SP4 and SUSE Linux Enterprise Micro 5.3 and 5.4 as affected products. Estates running any of those products on the 15 SP4 kernel line are in scope, and the fixes arrive as new livepatch packages rather than as a replacement kernel for subscribed Live Patching hosts.
SUSE has not published exploitation details or proof-of-concept code for any of the seven issues, so what follows is drawn strictly from the code-level fix descriptions in the advisory. CVE-2026-53016 corrects the ccp crypto driver copying an initialisation vector without using the skcipher ivsize. CVE-2026-68426 addresses a stale skb->prev pointer in xfrm after asynchronous crypto steals a GSO segment, while CVE-2026-74469 prevents a peer transport count overflow in SCTP and CVE-2026-74669 clears IPv4 options after IPVS rebases tunnel ICMP errors. The remaining three sit in file-serving and IP paths: CVE-2026-89551 clamps buf->len in the SUNRPC xdr_buf_trim routine to avoid an underflow, CVE-2026-89674 repairs an XDR length calculation in nfsd4_ff_encode_layoutget, and CVE-2026-98432 frees inet_opt and ireq_opt only after an RCU grace period, a classic use-after-free pattern. Each carries a SUSE bug reference, from bsc#1269766 through bsc#1285686.
The scoring spread is the most useful signal for triage. SUSE rates CVE-2026-98432 at 9.2 under CVSS 4.0 and 8.1 under CVSS 3.1, and CVE-2026-74469 at 8.5 and 7.8 respectively, while NVD places five of the seven at 9.8 with a network attack vector and no privileges required. SUSE's own analysis is consistently more conservative, placing several of the same flaws as local, high-complexity privilege escalation issues rather than remote takeover. Verified exploitation data supports the calmer reading: FIRST EPSS gives CVE-2026-74469 a 1.5 percent probability of exploitation in the next 30 days, CVE-2026-98432 0.8 percent, CVE-2026-68426, CVE-2026-74669, CVE-2026-89551 and CVE-2026-89674 each 0.5 percent, and CVE-2026-53016 0.1 percent. None appear in the CISA Known Exploited Vulnerabilities catalogue and no in-the-wild activity is reported. The practical exposure sits with hosts that terminate NFS, SCTP, IPsec or IPVS traffic, where the affected subsystems are reachable by network peers, and with SAP and HPC fleets that lean on live patching precisely because reboot windows are scarce.
Attack Surface
Server OS, Infrastructure, Endpoint OS
Tactics
Privilege Escalation, Impact
Techniques
- T1068 – Exploitation for Privilege Escalation
- T1499 – Endpoint Denial of Service
- T1203 – Exploitation for Client Execution
SuperPRO's Threat Countermeasures Procedures
- On SUSE Linux Enterprise Live Patching 15-SP4 hosts run: zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP4-2026-4996 SUSE-SLE-Module-Live-Patching-15-SP4-2026-4992 SUSE-SLE-Module-Live-Patching-15-SP4-2026-4998. On openSUSE Leap 15.4 use: zypper in -t patch SUSE-2026-4996 SUSE-2026-4992 SUSE-2026-4998.
- Verify the correct livepatch package is present for the running kernel: kernel-livepatch-5_14_21-150400_24_187-default-16-150400.2.1 for 5.14.21-150400.24.187, kernel-livepatch-5_14_21-150400_24_184-default-16-150400.2.1 for .184 and kernel-livepatch-5_14_21-150400_24_179-default-20-150400.2.1 for .179. Cross-check with uname -r and rpm -qa 'kernel-livepatch*' on ppc64le, s390x and x86_64 systems.
- For SUSE Linux Enterprise Micro 5.3 and 5.4 and any 15 SP4 host without a Live Patching subscription, schedule a full kernel update to 5.14.21-150400.24.187 via zypper patch plus reboot, since the livepatch packages only cover subscribed systems.
- Until patched, restrict NFS server exposure (nfsd and SUNRPC, TCP/UDP 2049 and 111) to trusted management or storage VLANs, as CVE-2026-89674 in nfsd4_ff_encode_layoutget and CVE-2026-89551 in xdr_buf_trim are reached through NFS client traffic.
- Where SCTP is not in use, prevent the module loading to remove the CVE-2026-74469 peer transport count overflow path: add 'install sctp /bin/true' to /etc/modprobe.d/disable-sctp.conf and confirm with lsmod | grep sctp.
- On hosts that are not LVS load balancers, blacklist the ip_vs module in /etc/modprobe.d to close the CVE-2026-74669 IPVS tunnel ICMP error path; on genuine directors prioritise the livepatch rather than unloading the module.
- Track the SUSE bug references bsc#1269766, bsc#1274712, bsc#1277399, bsc#1280285, bsc#1280693, bsc#1280728 and bsc#1285686 in the patch ticket, and alert on kernel oops or panic entries in dmesg and /var/log/messages naming xfrm, xdr_buf_trim, inet_opt or ip_vs on unpatched hosts.
