SUSE-SU-2026:4639-1: kernel-default&distro=SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE SUSE Linux Enterprise

Vulnerability summary

SUSE-SU-2026:4639-1 is a vulnerability in kernel-default&distro=SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE SUSE Linux Enterprise with no CVSS score yet.

Timeline

1. 13-10-2026
   PublishedVulnerability first disclosed.
2. 14-10-2026
   Last modifiedVulnerability information updated.

Description

Security update for the Linux Kernel The SUSE Linux Enterprise 11 SP4 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290). - CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037). - CVE-2026-68376: sctp: patch over auth_hmacs copy overflow (bsc#1274836). - CVE-2026-72083: target: fix double unmap data sg in core_scsi3_emulate_pro_register_and_move() (bsc#1275535). - CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972). - CVE-2026-72323: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (bsc#1275985). - CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007). - CVE-2026-72398: sctp: add INIT verification after cookie unpacking (bsc#1276381). - CVE-2026-74388: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (bsc#1278253). - CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (bsc#1275696). - CVE-2026-74588: sctp: keep chunk->transport in step with the list it is queued on (bsc#1277766). - CVE-2026-74597: ip6_tunnel: clear skb2->cb in ip6ip6_err() (bsc#1277493). - CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191). - CVE-2026-74641: ALSA: usx2y: bound the hwdep mmap fault offset (bsc#1278310). - CVE-2026-74743: macvlan: inherit needed_headroom and needed_tailroom from lowerdev (bsc#1277908). - CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315). - CVE-2026-80785: fbdev: serialize mode sysfs access with lock_fb_info() (bsc#1279619). - CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786). - CVE-2026-90088: Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (bsc#1281397). - CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546). The following non security issue was fixed: - Disable BATMAN in supported.conf - Disable CONFIG_BATMAN_ADV (jsc#PED-16892) - Disable CONFIG_CAN (jsc#PED-17000)

No weakness data has been published for this record.