SUSE-SU-2026:1003-1

Description

Security update for the Linux Kernel The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2025-21738: ata: libata-sff: Ensure that we cannot write outside the allocated buffer (bsc#1238917). - CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075). - CVE-2025-71066: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (bsc#1256645). - CVE-2026-23004: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231). - CVE-2026-23060: crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (bsc#1257735). - CVE-2026-23074: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749). - CVE-2026-23089: ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (bsc#1257790). - CVE-2026-23191: ALSA: aloop: Fix racy access at PCM trigger (bsc#1258395). - CVE-2026-23204: net/sched: cls_u32: use skb_header_pointer_careful() (bsc#1258340). - CVE-2026-23209: macvlan: fix error recovery in macvlan_common_newlink() (bsc#1258518). - CVE-2026-23268: apparmor: fix unprivileged local user can do privileged policy management (bsc#1258850). - CVE-2026-23269: apparmor: validate DFA start states are in bounds in unpack_pdb (bsc#1259857). The following non-security bugs were fixed: - Disable CONFIG_NET_SCH_ATM (jsc#PED-12836). - apparmor: Fix double free of ns_name in aa_replace_profiles() (bsc#1258849). - apparmor: fix differential encoding verification (bsc#1258849). - apparmor: fix memory leak in verify_header (bsc#1258849). - apparmor: fix missing bounds check on DEFAULT table in verify_dfa() (bsc#1258849). - apparmor: fix race between freeing data and fs accessing it (bsc#1258849). - apparmor: fix race on rawdata dereference (bsc#1258849). - apparmor: fix side-effect bug in match_char() macro usage (bsc#1258849). - apparmor: fix unprivileged local user can do privileged policy management (bsc#1258849). - apparmor: fix: limit the number of levels of policy namespaces (bsc#1258849). - apparmor: replace recursive profile removal with iterative approach (bsc#1258849). - apparmor: validate DFA start states are in bounds in unpack_pdb (bsc#1258849).

Affected Systems

• suse•kernel-64kb&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS

  < 5.14.21-150500.55.141.1

• suse•kernel-64kb&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS

  < 5.14.21-150500.55.141.1

• suse•kernel-64kb&distro=SUSE Linux Enterprise Server 15 SP5-LTSS

  < 5.14.21-150500.55.141.1

• suse•kernel-default-base&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS

  < 5.14.21-150500.55.141.1.150500.6.69.2

• suse•kernel-default-base&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS

  < 5.14.21-150500.55.141.1.150500.6.69.2

• suse•kernel-default-base&distro=SUSE Linux Enterprise Micro 5.5

  < 5.14.21-150500.55.141.1.150500.6.69.2

• suse•kernel-default-base&distro=SUSE Linux Enterprise Server 15 SP5-LTSS

  < 5.14.21-150500.55.141.1.150500.6.69.2

• suse•kernel-default-base&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP5

  < 5.14.21-150500.55.141.1.150500.6.69.2

• suse•kernel-default&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS

  < 5.14.21-150500.55.141.1

• suse•kernel-default&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS

  < 5.14.21-150500.55.141.1

• suse•kernel-default&distro=SUSE Linux Enterprise Live Patching 15 SP5

  < 5.14.21-150500.55.141.1

• suse•kernel-default&distro=SUSE Linux Enterprise Micro 5.5

  < 5.14.21-150500.55.141.1

• suse•kernel-default&distro=SUSE Linux Enterprise Server 15 SP5-LTSS

  < 5.14.21-150500.55.141.1

• suse•kernel-default&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP5

  < 5.14.21-150500.55.141.1

• suse•kernel-docs&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS

  < 5.14.21-150500.55.141.1

• suse•kernel-docs&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS

  < 5.14.21-150500.55.141.1

• suse•kernel-docs&distro=SUSE Linux Enterprise Server 15 SP5-LTSS

  < 5.14.21-150500.55.141.1

• suse•kernel-docs&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP5

  < 5.14.21-150500.55.141.1

• suse•kernel-livepatch-SLE15-SP5_Update_36&distro=SUSE Linux Enterprise Live Patching 15 SP5

  < 1-150500.11.5.1

• suse•kernel-obs-build&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS

  < 5.14.21-150500.55.141.1

• suse•kernel-obs-build&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS

  < 5.14.21-150500.55.141.1

• suse•kernel-obs-build&distro=SUSE Linux Enterprise Server 15 SP5-LTSS

  < 5.14.21-150500.55.141.1

• suse•kernel-obs-build&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP5

  < 5.14.21-150500.55.141.1

• suse•kernel-source&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS

  < 5.14.21-150500.55.141.1

• suse•kernel-source&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS

  < 5.14.21-150500.55.141.1

• suse•kernel-source&distro=SUSE Linux Enterprise Micro 5.5

  < 5.14.21-150500.55.141.1

• suse•kernel-source&distro=SUSE Linux Enterprise Server 15 SP5-LTSS

  < 5.14.21-150500.55.141.1

• suse•kernel-source&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP5

  < 5.14.21-150500.55.141.1

• suse•kernel-syms&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS

  < 5.14.21-150500.55.141.1

• suse•kernel-syms&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS

  < 5.14.21-150500.55.141.1

• suse•kernel-syms&distro=SUSE Linux Enterprise Server 15 SP5-LTSS

  < 5.14.21-150500.55.141.1

• suse•kernel-syms&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP5

  < 5.14.21-150500.55.141.1

• suse•kernel-zfcpdump&distro=SUSE Linux Enterprise Server 15 SP5-LTSS

  < 5.14.21-150500.55.141.1

References (29)

• https://www.suse.com/support/update/announcement/2026/suse-su-20261003-1/
• https://bugzilla.suse.com/1238917
• https://bugzilla.suse.com/1255075
• https://bugzilla.suse.com/1256645
• https://bugzilla.suse.com/1257231
• https://bugzilla.suse.com/1257473
• https://bugzilla.suse.com/1257732
• https://bugzilla.suse.com/1257735
• https://bugzilla.suse.com/1257749
• https://bugzilla.suse.com/1257790
• https://bugzilla.suse.com/1258340
• https://bugzilla.suse.com/1258395
• https://bugzilla.suse.com/1258518
• https://bugzilla.suse.com/1258849
• https://bugzilla.suse.com/1258850
• https://bugzilla.suse.com/1259857
• https://www.suse.com/security/cve/CVE-2025-21738
• https://www.suse.com/security/cve/CVE-2025-40242
• https://www.suse.com/security/cve/CVE-2025-71066
• https://www.suse.com/security/cve/CVE-2026-23004
• https://www.suse.com/security/cve/CVE-2026-23054
• https://www.suse.com/security/cve/CVE-2026-23060
• https://www.suse.com/security/cve/CVE-2026-23074
• https://www.suse.com/security/cve/CVE-2026-23089
• https://www.suse.com/security/cve/CVE-2026-23191
• https://www.suse.com/security/cve/CVE-2026-23204
• https://www.suse.com/security/cve/CVE-2026-23209
• https://www.suse.com/security/cve/CVE-2026-23268
• https://www.suse.com/security/cve/CVE-2026-23269