SUSE-SU-2026:5111-1: important: Security update for cephfs
SLE-SECURITY-UPDATES
null at suse.de
Thu Nov 5 12:30:58 UTC 2026
# Security update for cephfs
Announcement ID: SUSE-SU-2026:5111-1
Release Date: 2026-11-05T08:10:03Z
Rating: important
References:
* bsc#1248634
* bsc#1255403
* bsc#1258337
* bsc#1264446
* bsc#1264661
* bsc#1264814
* bsc#1267494
* bsc#1269129
* bsc#1269135
* bsc#1275472
Cross-References:
* CVE-2025-38660
* CVE-2025-68297
* CVE-2026-23201
* CVE-2026-43273
* CVE-2026-43419
* CVE-2026-43420
* CVE-2026-46052
* CVE-2026-52961
* CVE-2026-52962
* CVE-2026-68160
CVSS scores:
* CVE-2025-38660 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2025-38660 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2025-38660 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-68297 ( SUSE ): 6.8
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2025-68297 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-23201 ( SUSE ): 6.8
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-23201 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-23201 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-43273 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-43273 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-43419 ( SUSE ): 4.8
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2026-43419 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-43419 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-43420 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-46052 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-46052 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-52961 ( SUSE ): 6.8
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-52961 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-52961 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-52962 ( SUSE ): 4.8
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2026-52962 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-52962 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-68160 ( SUSE ): 8.8
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-68160 ( SUSE ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
* CVE-2026-68160 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products:
* Legacy Module 15-SP7
* SUSE Linux Enterprise Server 15 SP7
* SUSE Linux Enterprise Server for SAP Applications 15 SP7
An update that solves 10 vulnerabilities can now be installed.
## Description:
This update for cephfs fixes the following security issues:
* CVE-2026-68160: ceph: fix pre-auth out-of-bounds read on snaptrace in
ceph_handle_caps() (bsc#1275472).
* CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object()
(bsc#1264446).
* CVE-2026-52961: ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale
blob size (bsc#1269129).
* CVE-2026-46052: ceph: only d_add() negative dentries when they are unhashed
(bsc#1267494).
* CVE-2026-52962: ceph: fix a buffer leak in __ceph_setxattr() (bsc#1269135).
* CVE-2026-43420: ceph: fix i_nlink underrun during async unlink
(bsc#1264814).
* CVE-2026-43419: ceph: fix memory leaks in ceph_mdsc_build_path()
(bsc#1264661).
* CVE-2026-23201: ceph: fix oops due to invalid pointer for kfree() in
parse_longname() (bsc#1258337).
* CVE-2025-68297: ceph: fix crash in process_v2_sparse_read() for encrypted
directories (bsc#1255403).
* CVE-2025-38660: ceph: parse_longname(): strrchr() expects NUL-terminated
string (bsc#1248634).
* ceph: validate snapdirname option length when mounting (git-fixes).
* ceph: fix possible integer overflow in ceph_zero_objects() (git-fixes).
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* Legacy Module 15-SP7
zypper in -t patch SUSE-SLE-Module-Legacy-15-SP7-2026-5111
## Package List:
* Legacy Module 15-SP7 (aarch64 ppc64le s390x x86_64)
* cephfs-kmp-default-debuginfo-1.0_k6.4.0_150700.53.84-150700.15.7.1
* cephfs-kmp-default-1.0_k6.4.0_150700.53.84-150700.15.7.1
* cephfs-debugsource-1.0-150700.15.7.1
* Legacy Module 15-SP7 (aarch64)
* cephfs-kmp-64kb-1.0_k6.4.0_150700.53.84-150700.15.7.1
* cephfs-kmp-64kb-debuginfo-1.0_k6.4.0_150700.53.84-150700.15.7.1
## References:
* https://www.suse.com/security/cve/CVE-2025-38660.html
* https://www.suse.com/security/cve/CVE-2025-68297.html
* https://www.suse.com/security/cve/CVE-2026-23201.html
* https://www.suse.com/security/cve/CVE-2026-43273.html
* https://www.suse.com/security/cve/CVE-2026-43419.html
* https://www.suse.com/security/cve/CVE-2026-43420.html
* https://www.suse.com/security/cve/CVE-2026-46052.html
* https://www.suse.com/security/cve/CVE-2026-52961.html
* https://www.suse.com/security/cve/CVE-2026-52962.html
* https://www.suse.com/security/cve/CVE-2026-68160.html
* https://bugzilla.suse.com/show_bug.cgi?id=1248634
* https://bugzilla.suse.com/show_bug.cgi?id=1255403
* https://bugzilla.suse.com/show_bug.cgi?id=1258337
* https://bugzilla.suse.com/show_bug.cgi?id=1264446
* https://bugzilla.suse.com/show_bug.cgi?id=1264661
* https://bugzilla.suse.com/show_bug.cgi?id=1264814
* https://bugzilla.suse.com/show_bug.cgi?id=1267494
* https://bugzilla.suse.com/show_bug.cgi?id=1269129
* https://bugzilla.suse.com/show_bug.cgi?id=1269135
* https://bugzilla.suse.com/show_bug.cgi?id=1275472
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-security-updates/attachments/20261105/fc916483/attachment.htm>
More information about the sle-security-updates
mailing list