SUSE-CU-2026:12254-1: Security update of suse/sle-micro-rancher/5.4
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Thu Oct 15 08:05:22 UTC 2026
SUSE Container Update Advisory: suse/sle-micro-rancher/5.4
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:12254-1
Container Tags : suse/sle-micro-rancher/5.4:5.4.4.5.199 , suse/sle-micro-rancher/5.4:latest
Container Release : 4.5.199
Severity : important
Type : security
References : 1216813 1235133 1251966 1252682 1254633 1269136 1271906 1273290
1273339 1273953 1274037 1274836 1275543 1275545 1275681 1275972
1276007 1276009 1276277 1276287 1276295 1276337 1276338 1276340
1276353 1276354 1276381 1276475 1276519 1276572 1276801 1276803
1276814 1276818 1276821 1277129 1277149 1277249 1277410 1277489
1277493 1277544 1277574 1277590 1277626 1277766 1277792 1277820
1277857 1277904 1277906 1278054 1278094 1278178 1278191 1278210
1278211 1278315 1279532 1279619 1279621 1279786 1279835 1279875
1280139 1280243 1280263 1280350 1280496 1280727 1280733 1280786
1280923 1280985 1280993 1281042 1281046 1281229 1281295 1281360
1281546 1281818 1282110 1282113 1282284 1282881 1282906 1282932
CVE-2022-50645 CVE-2024-56644 CVE-2025-39964 CVE-2025-40022 CVE-2026-100075
CVE-2026-53266 CVE-2026-53400 CVE-2026-64279 CVE-2026-64319 CVE-2026-64422
CVE-2026-64580 CVE-2026-68376 CVE-2026-68445 CVE-2026-68451 CVE-2026-68452
CVE-2026-72051 CVE-2026-72052 CVE-2026-72053 CVE-2026-72054 CVE-2026-72055
CVE-2026-72061 CVE-2026-72066 CVE-2026-72098 CVE-2026-72129 CVE-2026-72136
CVE-2026-72157 CVE-2026-72322 CVE-2026-72348 CVE-2026-72351 CVE-2026-72383
CVE-2026-72398 CVE-2026-72434 CVE-2026-74267 CVE-2026-74283 CVE-2026-74330
CVE-2026-74398 CVE-2026-74443 CVE-2026-74444 CVE-2026-74453 CVE-2026-74469
CVE-2026-74473 CVE-2026-74479 CVE-2026-74480 CVE-2026-74492 CVE-2026-74493
CVE-2026-74540 CVE-2026-74586 CVE-2026-74588 CVE-2026-74589 CVE-2026-74597
CVE-2026-74609 CVE-2026-74630 CVE-2026-74688 CVE-2026-74700 CVE-2026-74719
CVE-2026-74744 CVE-2026-74752 CVE-2026-80540 CVE-2026-80785 CVE-2026-80789
CVE-2026-80840 CVE-2026-80841 CVE-2026-80844 CVE-2026-80852 CVE-2026-81000
CVE-2026-89479 CVE-2026-89482 CVE-2026-89532 CVE-2026-89533 CVE-2026-89551
CVE-2026-89569 CVE-2026-89603 CVE-2026-89631 CVE-2026-89636 CVE-2026-89638
CVE-2026-89674 CVE-2026-89932 CVE-2026-89968 CVE-2026-90003 CVE-2026-90104
CVE-2026-90198 CVE-2026-90413 CVE-2026-90414 CVE-2026-93104 CVE-2026-93782
CVE-2026-93787
-----------------------------------------------------------------
The container suse/sle-micro-rancher/5.4 was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4668-1
Released: Wed Oct 14 15:00:14 2026
Summary: Security update for the Linux Kernel
Type: security
Severity: important
References: 1216813,1235133,1251966,1252682,1254633,1269136,1271906,1273290,1273339,1273953,1274037,1274836,1275543,1275545,1275681,1275972,1276007,1276009,1276277,1276287,1276295,1276337,1276338,1276340,1276353,1276354,1276381,1276475,1276519,1276572,1276801,1276803,1276814,1276818,1276821,1277129,1277149,1277249,1277410,1277489,1277493,1277544,1277574,1277590,1277626,1277766,1277792,1277820,1277857,1277904,1277906,1278054,1278094,1278178,1278191,1278210,1278211,1278315,1279532,1279619,1279621,1279786,1279835,1279875,1280139,1280243,1280263,1280350,1280496,1280727,1280733,1280786,1280923,1280985,1280993,1281042,1281046,1281229,1281295,1281360,1281546,1281818,1282110,1282113,1282284,1282881,1282906,1282932,CVE-2022-50645,CVE-2024-56644,CVE-2025-39964,CVE-2025-40022,CVE-2026-100075,CVE-2026-53266,CVE-2026-53400,CVE-2026-64279,CVE-2026-64319,CVE-2026-64422,CVE-2026-64580,CVE-2026-68376,CVE-2026-68445,CVE-2026-68451,CVE-2026-68452,CVE-2026-72051,CVE-2026-72052,CVE-2026-72053,CVE-2026-7
2054,CVE-2026-72055,CVE-2026-72061,CVE-2026-72066,CVE-2026-72098,CVE-2026-72129,CVE-2026-72136,CVE-2026-72157,CVE-2026-72322,CVE-2026-72348,CVE-2026-72351,CVE-2026-72383,CVE-2026-72398,CVE-2026-72434,CVE-2026-74267,CVE-2026-74283,CVE-2026-74330,CVE-2026-74398,CVE-2026-74443,CVE-2026-74444,CVE-2026-74453,CVE-2026-74469,CVE-2026-74473,CVE-2026-74479,CVE-2026-74480,CVE-2026-74492,CVE-2026-74493,CVE-2026-74540,CVE-2026-74586,CVE-2026-74588,CVE-2026-74589,CVE-2026-74597,CVE-2026-74609,CVE-2026-74630,CVE-2026-74688,CVE-2026-74700,CVE-2026-74719,CVE-2026-74744,CVE-2026-74752,CVE-2026-80540,CVE-2026-80785,CVE-2026-80789,CVE-2026-80840,CVE-2026-80841,CVE-2026-80844,CVE-2026-80852,CVE-2026-81000,CVE-2026-89479,CVE-2026-89482,CVE-2026-89532,CVE-2026-89533,CVE-2026-89551,CVE-2026-89569,CVE-2026-89603,CVE-2026-89631,CVE-2026-89636,CVE-2026-89638,CVE-2026-89674,CVE-2026-89932,CVE-2026-89968,CVE-2026-90003,CVE-2026-90104,CVE-2026-90198,CVE-2026-90413,CVE-2026-90414,CVE-2026-93104,CVE-2026-93782,CV
E-2026-93787
The SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues:
The following security issues were fixed:
- CVE-2022-50645: EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() (bsc#1254633).
- CVE-2024-56644: net/ipv6: release expired exception dst cached in socket (bsc#1216813 bsc#1235133).
- CVE-2025-39964: crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (bsc#1252682).
- CVE-2025-40022: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
- CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable (bsc#1269136).
- CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
- CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
- CVE-2026-64319: nvmet-auth: fix return value check in auth send (bsc#1273339).
- CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
- CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).
- CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).
- CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).
- CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).
- CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).
- CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).
- CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).
- CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).
- CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).
- CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821).
- CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).
- CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).
- CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).
- CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).
- CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277574).
- CVE-2026-72157: net: thunderbolt: Fix frags[] overflow by bounding frame_count (bsc#1277544).
- CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).
- CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).
- CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).
- CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).
- CVE-2026-72398: sctp: fix association labeling in the duplicate COOKIE-ECHO case (bsc#1276381).
- CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).
- CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen
(bsc#1276519).
- CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).
- CVE-2026-74330: configfs: fix lockless traversals of ->s_children (bsc#1277129).
- CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).
- CVE-2026-74443: drm/vmwgfx: bound DMA command body size against suffix pointer (bsc#1278210).
- CVE-2026-74444: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (bsc#1278211).
- CVE-2026-74453: drm/vc4: Zero the tile state data array before each BIN job (bsc#1278178).
- CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).
- CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).
- CVE-2026-74479: net: pktgen: fix proc entry use-after-free (bsc#1276354).
- CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).
- CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).
- CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).
- CVE-2026-74540: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (bsc#1275681).
- CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).
- CVE-2026-74588: sctp: keep chunk->transport in step with the list it is queued on (bsc#1277766).
- CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).
- CVE-2026-74597: ip6_tunnel: clear skb2->cb in ip6ip6_err() (bsc#1277493).
- CVE-2026-74609: tipc: read le->link under the node lock in tipc_node_link_down() (bsc#1277906).
- CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).
- CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).
- CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (bsc#1277626).
- CVE-2026-74719: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()
(bsc#1276572).
- CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (bsc#1278094).
- CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).
- CVE-2026-80540: drm/amdgpu: Fix UVD decode image min size calculation (bsc#1277590).
- CVE-2026-80785: fbdev: serialize mode sysfs access with lock_fb_info() (bsc#1279619).
- CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).
- CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).
- CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).
- CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).
- CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).
- CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).
- CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).
- CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).
- CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).
- CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).
- CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280727).
- CVE-2026-89569: Bluetooth: RFCOMM: serialize security confirmation handling (bsc#1280733).
- CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).
- CVE-2026-89631: smb: client: reject a tree connect response whose byte count is too small (bsc#1280496).
- CVE-2026-89636: smb: client: clear ce->tgthint in free_tgts() (bsc#1281042).
- CVE-2026-89638: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (bsc#1281046).
- CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).
- CVE-2026-89932: KVM: nVMX: Always flush vpid02 on first use (bsc#1281360).
- CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).
- CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).
- CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).
- CVE-2026-90198: ALSA: core: Fix use-after-free in snd_card_do_free() (bsc#1281818).
- CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).
- CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).
- CVE-2026-93104: RDMA/rvt: Return NULL after port allocation failure (bsc#1282284).
- CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).
- CVE-2026-93787: smb: client: bound dirent name against end of SMB response in cifs_filldir (bsc#1282932).
- CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).
The following non security issues were fixed:
- default_gfp(): avoid using the 'newfangled' __VA_OPT__ trick (bsc#1280139).
- fbdev/sysfs: Fix locking (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218 jsc#PED-1220 jsc#PED-1222 jsc#PED-1223
jsc#PED-1225).
- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).
- slab: Introduce kmalloc_obj() and family (bsc#1280139).
- slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139).
The following package changes have been done:
- kernel-default-5.14.21-150400.24.243.1 updated
More information about the sle-container-updates
mailing list