SUSE SLES16 Security Update : kernel (SUSE-SU-2026:22127-1)

high Nessus Plugin ID 321588

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22127-1 advisory.

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

- CVE-2026-23254: net: gro: fix outer network offset (bsc#1259884).
- CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
- CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() (bsc#1260548).
- CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).
- CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
- CVE-2026-31401: HID: bpf: prevent buffer overflow in hid_hw_request (bsc#1261603).
- CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
- CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
- CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
- CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
- CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
- CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
- CVE-2026-31556: xfs: scrub: unlock dquot before early return in quota scrub (bsc#1263062).
- CVE-2026-31562: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register (bsc#1263058).
- CVE-2026-31584: media: mediatek: vcodec: fix use-after-free in encoder release path (bsc#1263180).
- CVE-2026-31645: net: lan966x: fix page pool leak in error paths (bsc#1263794).
- CVE-2026-31648: mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() (bsc#1263579).
- CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
- CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
- CVE-2026-31683: batman-adv: avoid OGM aggregation when skb tailroom is insufficient (bsc#1263594).
- CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).
- CVE-2026-31774: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (bsc#1264040).
- CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
- CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).
- CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak (bsc#1264091).
- CVE-2026-43063: xfs: don't irele after failing to iget in xfs_attri_recover_work (bsc#1264196).
- CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).
- CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).
- CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).
- CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).
- CVE-2026-43150: perf/arm-cmn: Reject unsupported hardware configurations (bsc#1264415).
- CVE-2026-43184: rnbd-srv: Zero the rsp buffer before using it (bsc#1264622).
- CVE-2026-43197: netconsole: avoid OOB reads, msg is not nul-terminated (bsc#1264609).
- CVE-2026-43332: thermal: core: Fix thermal zone device registration error path (bsc#1265114).
- CVE-2026-43393: btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies() (bsc#1264723).
- CVE-2026-43394: nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit() (bsc#1265081).
- CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672).
- CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).
- CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).
- CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394).
- CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init (bsc#1266711).
- CVE-2026-45856: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (bsc#1266720).
- CVE-2026-45886: bpf: Fix bpf_xdp_store_bytes proto for read-only arg (bsc#1266810).
- CVE-2026-45898: RDMA/iwcm: Fix workqueue list corruption by removing work_list (bsc#1266888).
- CVE-2026-45910: RDMA/rxe: Fix race condition in QP timer handlers (bsc#1266889).
- CVE-2026-45932: bpf: Fix tcx/netkit detach permissions when prog fd isn't given (bsc#1266827).
- CVE-2026-45942: ext4: fix e4b bitmap inconsistency reports (bsc#1266914).
- CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267205).
- CVE-2026-45984: gfs2: Fix use-after-free in iomap inline data write path (bsc#1267214).
- CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues (bsc#1267220).
- CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (bsc#1266901).
- CVE-2026-46083: spi: fix resource leaks on device setup failure (bsc#1266696).
- CVE-2026-46090: ALSA: aloop: Use guard() for spin locks (bsc#1267531).
- CVE-2026-46094: ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (bsc#1266927).
- CVE-2026-46114: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (bsc#1266972).
- CVE-2026-46159: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak (bsc#1267652).
- CVE-2026-46176: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (bsc#1266816).
- CVE-2026-46181: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (bsc#1266826).

The following non security issues were fixed:

- accel/ivpu: Add bounds checks for firmware log indices (git-fixes).
- accel/ivpu: Add buffer overflow check in MS get_info_ioctl (git-fixes).
- ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams (git-fixes).
- ALSA: seq: dummy: fix UMP event stack overread (git-fixes).
- arm64: tlb: Allow XZR argument to TLBI ops (git-fixes).
- arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes).
- Bluetooth: bnep: reject short frames before parsing (git-fixes).
- Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (git-fixes).
- Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync (git-fixes).
- Bluetooth: MGMT: Fix backward compatibility with userspace (git-fixes).
- Bluetooth: MGMT: validate advertising TLV before type checks (git-fixes).
- Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (git-fixes).
- Bluetooth: RFCOMM: validate skb length in MCC handlers (git-fixes).
- config: remove DEBUG_FS_DISALLOW_MOUNT
- debugfs: Remove broken no-mount mode (bsc#1265186).
- debugfs: Fix default access mode config check (bsc#1265186).
- debugfs: Remove broken no-mount mode (bsc#1265186).
- debugfs: Remove redundant access mode checks (bsc#1265186).
- drm/amd/display: Bound VBIOS record-chain walk loops (git-fixes).
- drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size (git-fixes).
- drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs (git-fixes).
- drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() (git-fixes).
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (git-fixes).
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (git-fixes).
- drm/amdkfd: fix NULL dereference in get_queue_ids() (git-fixes).
- drm/imx: Fix three kernel-doc warnings in dcss-scaler.c (git-fixes).
- drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups (git-fixes).
- drm/xe: Clear pending_disable before signaling suspend fence (git-fixes).
- ima: return error early if file xattr cannot be changed (bsc#1261041).
- Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard (git-fixes).
- KVM: arm64: Reassign nested_mmus array behind mmu_lock (git-fixes).
- KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (git-fixes).
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (git-fixes).
- KVM: SEV: Check PSC request indices against the actual size of the buffer (git-fixes).
- KVM: SEV: Compute the correct max length of the in-GHCB scratch area (git-fixes).
- KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (git-fixes).
- KVM: SEV: Ignore MMIO requests of length '0' (git-fixes).
- KVM: SEV: Ignore Port I/O requests of length '0' (git-fixes).
- KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (git-fixes).
- KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (git-fixes).
- KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (git-fixes).
- KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (git-fixes).
- KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (git-fixes).
- KVM: SVM: Convert plain error code numbers to defines (git-fixes).
- KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC (git-fixes).
- KVM: SVM: Provide helpers to set the error code (git-fixes).
- KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (git-fixes).
- KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (git-fixes).
- KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (git-fixes).
- KVM: x86: Move MMIO write tracing into vcpu_mmio_write() (git-fixes).
- KVM: x86: Open code handling of completed MMIO reads in emulator_read_write() (git-fixes).
- KVM: x86: Open code read vs. write userspace MMIO exits in emulator_read_write() (git-fixes).
- KVM: x86: Trace unsatisfied MMIO reads on a per-page basis (git-fixes).
- KVM: x86: Use local MMIO fragment variable to clean up emulator_read_write() (git-fixes).
- mmc: core: Fix host controller programming for fixed driver type (git-fixes).
- mmc: dw_mmc-rockchip: Add missing private data for very old controllers (git-fixes).
- mmc: litex_mmc: Set mandatory idle clocks before CMD0 (git-fixes).
- mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation (git-fixes).
- mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC (git-fixes).
- mmc: sdhci: add signal voltage switch in sdhci_resume_host (git-fixes).
- wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (git-fixes).
- wifi: nl80211: reject oversized EMA RNR lists (git-fixes).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 321588

File Name: suse_SU-2026-22127-1.nasl

Version: 1.1

Type: Local

Agent: unix

Family: SuSE Local Security Checks

Published: 6/20/2026

Updated: 6/20/2026

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.9

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-43150

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:kernel-azure-vdso, p-cpe:/a:novell:suse_linux:kernel-zfcpdump, p-cpe:/a:novell:suse_linux:dlm-kmp-default, p-cpe:/a:novell:suse_linux:kernel-default-vdso, p-cpe:/a:novell:suse_linux:kernel-default-base, p-cpe:/a:novell:suse_linux:kernel-azure-extra, p-cpe:/a:novell:suse_linux:kernel-64kb-extra, p-cpe:/a:novell:suse_linux:kernel-kvmsmall, p-cpe:/a:novell:suse_linux:kernel-default-livepatch, p-cpe:/a:novell:suse_linux:gfs2-kmp-default, p-cpe:/a:novell:suse_linux:kernel-default-extra, p-cpe:/a:novell:suse_linux:kernel-azure, p-cpe:/a:novell:suse_linux:kernel-source-vanilla, p-cpe:/a:novell:suse_linux:kernel-obs-qa, p-cpe:/a:novell:suse_linux:kernel-kvmsmall-vdso, p-cpe:/a:novell:suse_linux:cluster-md-kmp-default, p-cpe:/a:novell:suse_linux:kernel-default, cpe:/o:novell:suse_linux:16, p-cpe:/a:novell:suse_linux:kernel-source, p-cpe:/a:novell:suse_linux:kernel-64kb

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 6/15/2026

Vulnerability Publication Date: 3/12/2026

Reference Information

CVE: CVE-2026-23254, CVE-2026-23303, CVE-2026-23327, CVE-2026-23438, CVE-2026-31396, CVE-2026-31401, CVE-2026-31446, CVE-2026-31448, CVE-2026-31454, CVE-2026-31455, CVE-2026-31518, CVE-2026-31546, CVE-2026-31556, CVE-2026-31562, CVE-2026-31584, CVE-2026-31645, CVE-2026-31648, CVE-2026-31655, CVE-2026-31671, CVE-2026-31683, CVE-2026-31703, CVE-2026-31774, CVE-2026-43026, CVE-2026-43030, CVE-2026-43040, CVE-2026-43063, CVE-2026-43065, CVE-2026-43066, CVE-2026-43068, CVE-2026-43109, CVE-2026-43150, CVE-2026-43184, CVE-2026-43197, CVE-2026-43332, CVE-2026-43393, CVE-2026-43394, CVE-2026-43411, CVE-2026-43455, CVE-2026-45842, CVE-2026-45846, CVE-2026-45852, CVE-2026-45856, CVE-2026-45886, CVE-2026-45898, CVE-2026-45910, CVE-2026-45932, CVE-2026-45942, CVE-2026-45970, CVE-2026-45984, CVE-2026-46021, CVE-2026-46043, CVE-2026-46083, CVE-2026-46090, CVE-2026-46094, CVE-2026-46114, CVE-2026-46159, CVE-2026-46176, CVE-2026-46181, CVE-2026-46316, CVE-2026-46317

SuSE: SUSE-SU-2026:22127-1

Detections

Analytics