Multiple Linux kernel vulnerabilities affect SUSE systems
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
SUSE released patches for 60+ kernel vulnerabilities affecting SLES 12 SP5, SLES 16.0, and related systems with privilege escalation risks.
CERT-FR published an advisory covering multiple vulnerabilities discovered in the Linux kernel shipped with SUSE Linux Enterprise products. The affected systems include SUSE Linux Enterprise Server 12 SP5 (including LTSS variants), SUSE Linux Enterprise Server 16.0, SUSE Linux Enterprise High Performance Computing 12 SP5, SUSE Linux Enterprise Live Patching 12 SP5, SUSE Linux Micro 6.1 and 6.2, and SUSE Linux Enterprise Server for SAP Applications variants.
The vulnerabilities enable multiple attack vectors including privilege escalation, data confidentiality and integrity compromise, security policy bypass, and denial of service. This is a coordinated patch release across 22 separate SUSE security bulletins issued between May 18-26, 2026. Defenders operating any SUSE Linux Enterprise variant listed should prioritize applying kernel updates from the referenced security bulletins. The breadth of affected product families and the number of CVEs indicate a comprehensive kernel update addressing accumulated security issues.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0664
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs