VORANT. Threat Intelligence Research Sign in Create a free account

Multiple Linux kernel vulnerabilities in SUSE products

high vulnerability

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

SUSE Linux kernel contains multiple vulnerabilities allowing arbitrary code execution, data theft, and denial of service.

CERT-FR has disclosed multiple vulnerabilities in the Linux kernel as shipped in SUSE products. The advisory lists over 150 CVEs affecting the kernel across numerous SUSE distributions including SUSE Linux Enterprise Server (11, 12, 15 SP4-SP7), openSUSE Leap (15.4-15.6), SUSE Linux Enterprise Micro, and High Performance Computing variants. The vulnerabilities enable attackers to execute arbitrary code, compromise data confidentiality and integrity, bypass security policies, and cause denial of service. SUSE has released coordinated security updates across multiple bulletins issued between 8-17 September 2026. The article provides CVE references and SUSE bulletin links for remediation but does not detail individual vulnerability mechanics or exploitation status in the wild.

Mentioned in this report

Vulnerabilities CVE-2024-44981CVE-2024-57841CVE-2025-23137CVE-2025-38469CVE-2025-39939CVE-2025-39964KEVCVE-2025-40022CVE-2025-40199CVE-2025-40204CVE-2025-68179CVE-2025-68214CVE-2025-71075CVE-2025-71104CVE-2026-23210CVE-2026-23227CVE-2026-23230CVE-2026-23240CVE-2026-23449CVE-2026-23454CVE-2026-31392CVE-2026-31418CVE-2026-31531CVE-2026-31557CVE-2026-31629CVE-2026-31658CVE-2026-31663CVE-2026-31759CVE-2026-43014CVE-2026-43015CVE-2026-43077CVE-2026-43109CVE-2026-43110CVE-2026-43116CVE-2026-43125CVE-2026-43163CVE-2026-43206CVE-2026-43213CVE-2026-43271CVE-2026-43273CVE-2026-43278

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1202

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.

It sits in a corpus of 13,571 reports from 145 sources, 595 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.

Create a free account   What it costs