# SUSE Linux kernel vulnerabilities enable code execution

Published: 2026-10-02 · Severity: routine
Canonical: https://vorant.io/reports/32e83dfd-1189-53de-a758-a86d4557f334/suse-linux-kernel-vulnerabilities-enable-code-execution

> Multiple Linux kernel flaws in SUSE affect data integrity, confidentiality, and enable arbitrary code execution.

CERT-FR reports multiple vulnerabilities discovered in the Linux kernel used across SUSE products, including SUSE Linux Enterprise Live Patching 15-SP7, SUSE Linux Enterprise Real Time 15 SP7, SUSE Linux Micro 6.2, and SUSE Linux Micro Extras 6.2. These vulnerabilities allow attackers to achieve arbitrary code execution, compromise data confidentiality and integrity, bypass security policies, and cause denial of service. The advisory references over 200 CVEs and directs affected organizations to SUSE security bulletins issued between September 22 and September 29, 2026 for patches. The scale and diversity of the flaw set suggests a coordinated kernel update addressing accumulated security issues across multiple kernel versions and product variants.

## Mentioned in this report

- Vulnerabilities: CVE-2025-68214, CVE-2025-68358, CVE-2025-68780, CVE-2025-71075, CVE-2026-23113, CVE-2026-23306, CVE-2026-23348, CVE-2026-31418, CVE-2026-31530, CVE-2026-31531, CVE-2026-43116, CVE-2026-43125, CVE-2026-43163, CVE-2026-43239, CVE-2026-43271, CVE-2026-43299, CVE-2026-43331, CVE-2026-43355, CVE-2026-43363, CVE-2026-43416, CVE-2026-43439, CVE-2026-43448, CVE-2026-45860, CVE-2026-45897, CVE-2026-45968, CVE-2026-46007, CVE-2026-46070, CVE-2026-46091, CVE-2026-46107, CVE-2026-46115, CVE-2026-46133, CVE-2026-46135, CVE-2026-46150, CVE-2026-46195, CVE-2026-46304, CVE-2026-52912, CVE-2026-52920, CVE-2026-52928, CVE-2026-52929, CVE-2026-52935

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1255

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/32e83dfd-1189-53de-a758-a86d4557f334/suse-linux-kernel-vulnerabilities-enable-code-execution.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup