# Multiple Linux kernel vulnerabilities in SUSE products

Published: 2026-08-14 · Severity: high
Canonical: https://vorant.io/reports/4e23e084-5c1e-5009-b45a-79e74b888e8c/multiple-linux-kernel-vulnerabilities-in-suse-products
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> SUSE Linux kernel has multiple vulnerabilities enabling privilege escalation, denial of service, and data confidentiality breaches.

Source: cert.ssi.gouv.fr — https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1029

## What to check

- Applies to: The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: CISA lists CVE-2026-31431 as exploited in the wild.

CERT-FR has published an advisory documenting multiple vulnerabilities in the Linux kernel affecting a wide range of SUSE products and versions. The affected products span openSUSE Leap, SUSE Linux Enterprise Server, SUSE Linux Enterprise High Availability Extension, SUSE Linux Enterprise High Performance Computing, SUSE Linux Enterprise Micro, SUSE Linux Enterprise Real Time, and SUSE Manager deployments across multiple release branches including SP4, SP5, and SP6 variants, as well as LTSS and extended support versions dating back to SUSE Linux Enterprise Server 12 SP5.

The vulnerabilities enable attackers to achieve privilege escalation, bypass security policies, cause remote denial of service, and compromise data confidentiality. SUSE has released 12 distinct security bulletins addressing these kernel issues across the affected product families, published between late July and mid-August 2026. Defenders should prioritize kernel patching across all SUSE-based systems, particularly those running production workloads or handling sensitive data.

The advisory references over 170 individual CVE identifiers spanning multiple vulnerability classes affecting kernel subsystems. Organizations running SUSE infrastructure should consult the provided SUSE security bulletins to identify which patches apply to their specific product versions and deployment configurations, then schedule and execute kernel updates accordingly.

## Mentioned in this report

- Vulnerabilities: CVE-2022-4994, CVE-2023-2058, CVE-2023-53995, CVE-2024-38542, CVE-2025-21710, CVE-2025-21953, CVE-2025-38250, CVE-2025-54518, CVE-2026-23240, CVE-2026-31431 (KEV), CVE-2026-31450, CVE-2026-31482, CVE-2026-31483, CVE-2026-31510, CVE-2026-31542, CVE-2026-31598, CVE-2026-31624, CVE-2026-31628, CVE-2026-31678, CVE-2026-31738, CVE-2026-31759, CVE-2026-43033, CVE-2026-43038, CVE-2026-43046, CVE-2026-43056, CVE-2026-43068, CVE-2026-43069, CVE-2026-43123, CVE-2026-43124, CVE-2026-43156, CVE-2026-43168, CVE-2026-43180, CVE-2026-43211, CVE-2026-43216, CVE-2026-43226, CVE-2026-43230, CVE-2026-43244, CVE-2026-43253, CVE-2026-43255, CVE-2026-43266

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1029

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/4e23e084-5c1e-5009-b45a-79e74b888e8c/multiple-linux-kernel-vulnerabilities-in-suse-products.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup