# SUSE-SU-2026:3602-1: Security update for 7 packages

SUSE-SU-2026:3602-1, released October 2, 2026, fixes 73 CVEs across 7 products. None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/suse-su-2026-3602-1
- Platform: Linux
- Released: Oct 2, 2026
- Priority: Urgent (Closes CVE-2026-64564, rated Critical)
- CVEs: 73, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://osv.dev/vulnerability/SUSE-SU-2026:3602-1

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [kernel-default](https://patchblox.com/security/data/product/linux/kernel-default.md) | sles 15.6 | 6.4.0-150600.23.130.1 |
| [kernel-default-base](https://patchblox.com/security/data/product/linux/kernel-default-base.md) | sles 15.6 | 6.4.0-150600.23.130.1.150600.12.60.3 |
| [kernel-docs](https://patchblox.com/security/data/product/linux/kernel-docs.md) | sles 15.6 | 6.4.0-150600.23.130.1 |
| [kernel-livepatch-SLE15-SP6_Update_30](https://patchblox.com/security/data/product/linux/kernel-livepatch-sle15-sp6-update-30.md) | sles 15.6 | 1-150600.13.5.1 |
| [kernel-obs-build](https://patchblox.com/security/data/product/linux/kernel-obs-build.md) | sles 15.6 | 6.4.0-150600.23.130.1 |
| [kernel-source](https://patchblox.com/security/data/product/linux/kernel-source.md) | sles 15.6 | 6.4.0-150600.23.130.1 |
| [kernel-syms](https://patchblox.com/security/data/product/linux/kernel-syms.md) | sles 15.6 | 6.4.0-150600.23.130.1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-64564](https://patchblox.com/security/data/cve/CVE-2026-64564.md) | Urgent | sctp: don't free the ASCONF's own transport in DEL-IP processing | 9.8 | 0.0143 |  |
| [CVE-2026-53224](https://patchblox.com/security/data/cve/CVE-2026-53224.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  sctp: validate embedded INIT chunk and address l... | 9.1 | 0.0057 |  |
| [CVE-2026-63984](https://patchblox.com/security/data/cve/CVE-2026-63984.md) | Urgent | kernel-uek-debug: [5.15.0-323.211.3.3] - Revert 'x86/alternatives: Add alt_instr.flags' (Harshit Mogalapalli)  [Orabug: 39853924]  [5.1... | 9.8 | 0.0051 |  |
| [CVE-2026-63824](https://patchblox.com/security/data/cve/CVE-2026-63824.md) | Urgent | KEYS: fix overflow in keyctl_pkey_params_get_2() | 9.8 | 0.0017 |  |
| [CVE-2026-64106](https://patchblox.com/security/data/cve/CVE-2026-64106.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  KVM: arm64: vgic-its: Reject restored DTE with o... | 9.0 | 0.0015 |  |
| [CVE-2026-46333](https://patchblox.com/security/data/cve/CVE-2026-46333.md) | High | ptrace: slightly saner 'get_dumpable()' logic | 8.1 | 0.0430 |  |
| [CVE-2026-63912](https://patchblox.com/security/data/cve/CVE-2026-63912.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system | 9.8 | 0.0071 |  |
| [CVE-2026-63922](https://patchblox.com/security/data/cve/CVE-2026-63922.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system.  Security Fix(es):  * kernel: t... | 9.8 | 0.0071 |  |
| [CVE-2026-63924](https://patchblox.com/security/data/cve/CVE-2026-63924.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system.  Security Fix(es):  * kernel: t... | 9.8 | 0.0071 |  |
| [CVE-2026-63968](https://patchblox.com/security/data/cve/CVE-2026-63968.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  ipv6: fix possible infinite loop in fib6_select_... | 7.5 | 0.0067 |  |
| [CVE-2026-64530](https://patchblox.com/security/data/cve/CVE-2026-64530.md) | High | net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle | 9.8 | 0.0066 |  |
| [CVE-2026-63919](https://patchblox.com/security/data/cve/CVE-2026-63919.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system | 8.8 | 0.0065 |  |
| [CVE-2026-52986](https://patchblox.com/security/data/cve/CVE-2026-52986.md) | High | netfilter: nf_conntrack_sip: don't use simple_strtoul | 9.8 | 0.0063 |  |
| [CVE-2026-53391](https://patchblox.com/security/data/cve/CVE-2026-53391.md) | High | NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr | 8.8 | 0.0052 |  |
| [CVE-2026-63994](https://patchblox.com/security/data/cve/CVE-2026-63994.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system | 9.8 | 0.0051 |  |
| [CVE-2026-64560](https://patchblox.com/security/data/cve/CVE-2026-64560.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  posix-cpu-timers: Prevent UAF caused by non-lead... | 7.8 | 0.0050 |  |
| [CVE-2026-64600](https://patchblox.com/security/data/cve/CVE-2026-64600.md) | High | xfs: resample the data fork mapping after cycling ILOCK | 7.8 | 0.0047 |  |
| [CVE-2026-53246](https://patchblox.com/security/data/cve/CVE-2026-53246.md) | High | sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing | 9.8 | 0.0044 |  |
| [CVE-2026-53131](https://patchblox.com/security/data/cve/CVE-2026-53131.md) | High | netfilter: require Ethernet MAC header before using eth_hdr() | 9.4 | 0.0044 |  |
| [CVE-2026-31598](https://patchblox.com/security/data/cve/CVE-2026-31598.md) | High | ocfs2: fix possible deadlock between unlink and dio_end_io_write | 7.5 | 0.0044 |  |
| [CVE-2026-46243](https://patchblox.com/security/data/cve/CVE-2026-46243.md) | High | smb: client: reject userspace cifs.spnego descriptions | 7.8 | 0.0041 |  |
| [CVE-2026-52967](https://patchblox.com/security/data/cve/CVE-2026-52967.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  smb/client: fix possible infinite loop and oob r... | 8.1 | 0.0039 |  |
| [CVE-2026-63893](https://patchblox.com/security/data/cve/CVE-2026-63893.md) | High | kernel-uek-debug-modules-extra: [5.15.0-323.211.3.3] - Revert 'x86/alternatives: Add alt_instr.flags' (Harshit Mogalapalli)  [Orabug: 39853924]  [5.1... | 8.1 | 0.0039 |  |
| [CVE-2026-46056](https://patchblox.com/security/data/cve/CVE-2026-46056.md) | High | Bluetooth: hci_event: fix potential UAF in SSP passkey handlers | 8.8 | 0.0028 |  |
| [CVE-2026-63975](https://patchblox.com/security/data/cve/CVE-2026-63975.md) | High | kernel-rt-64k-debug-core: The kernel packages contain the Linux kernel, the core of any Linux operating system | 8.8 | 0.0027 |  |
| [CVE-2026-64561](https://patchblox.com/security/data/cve/CVE-2026-64561.md) | High | KVM: x86: Check for invalid/obsolete root *after* making MMU pages available | 8.8 | 0.0027 |  |
| [CVE-2026-63946](https://patchblox.com/security/data/cve/CVE-2026-63946.md) | High | kernel-64k-debug-devel-matched: The kernel packages contain the Linux kernel, the core of any Linux operating system | 8.8 | 0.0026 |  |
| [CVE-2026-53375](https://patchblox.com/security/data/cve/CVE-2026-53375.md) | High | drm/amdgpu/vce: Prevent partial address patches | 8.8 | 0.0018 |  |
| [CVE-2026-63884](https://patchblox.com/security/data/cve/CVE-2026-63884.md) | High | bpftool: The kernel packages contain the Linux kernel, the core of any Linux operating system.  Security Fix(es):  * kernel: m... | 7.8 | 0.0018 |  |
| [CVE-2026-63807](https://patchblox.com/security/data/cve/CVE-2026-63807.md) | High | KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level | 8.8 | 0.0017 |  |
| [CVE-2026-53402](https://patchblox.com/security/data/cve/CVE-2026-53402.md) | High | fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() | 7.1 | 0.0017 |  |
| [CVE-2026-63826](https://patchblox.com/security/data/cve/CVE-2026-63826.md) | High | fbdev: fix use-after-free in store_modes() | 7.1 | 0.0017 |  |
| [CVE-2026-63917](https://patchblox.com/security/data/cve/CVE-2026-63917.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system | 8.8 | 0.0017 |  |
| [CVE-2026-63921](https://patchblox.com/security/data/cve/CVE-2026-63921.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system | 8.8 | 0.0016 |  |
| [CVE-2026-63806](https://patchblox.com/security/data/cve/CVE-2026-63806.md) | High | KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() | 7.3 | 0.0016 |  |
| [CVE-2026-46174](https://patchblox.com/security/data/cve/CVE-2026-46174.md) | High | x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache | 9.8 | 0.0015 |  |
| [CVE-2026-63829](https://patchblox.com/security/data/cve/CVE-2026-63829.md) | High | net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink | 8.8 | 0.0015 |  |
| [CVE-2026-46145](https://patchblox.com/security/data/cve/CVE-2026-46145.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Validate rx_hash_key_len Sashiko point... | 7.8 | 0.0015 |  |
| [CVE-2026-63794](https://patchblox.com/security/data/cve/CVE-2026-63794.md) | High | KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path | 8.8 | 0.0014 |  |
| [CVE-2026-46117](https://patchblox.com/security/data/cve/CVE-2026-46117.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  RDMA/mana: Remove user triggerable WARN_ON() in... | 7.8 | 0.0014 |  |
| [CVE-2026-46193](https://patchblox.com/security/data/cve/CVE-2026-46193.md) | High | kernel-uek-debug: [5.15.0-323.211.3.3] - Revert 'x86/alternatives: Add alt_instr.flags' (Harshit Mogalapalli)  [Orabug: 39853924]  [5.1... | 7.0 | 0.0014 |  |
| [CVE-2026-46323](https://patchblox.com/security/data/cve/CVE-2026-46323.md) | High | net: gro: don't merge zcopy skbs | 8.4 | 0.0014 |  |
| [CVE-2026-46080](https://patchblox.com/security/data/cve/CVE-2026-46080.md) | High | ocfs2: split transactions in dio completion to avoid credit exhaustion | 7.1 | 0.0014 |  |
| [CVE-2026-43033](https://patchblox.com/security/data/cve/CVE-2026-43033.md) | High | crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption | 7.8 | 0.0014 |  |
| [CVE-2026-53388](https://patchblox.com/security/data/cve/CVE-2026-53388.md) | High | fuse: re-lock request before replacing page cache folio | 8.8 | 0.0013 |  |
| [CVE-2026-63971](https://patchblox.com/security/data/cve/CVE-2026-63971.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system | 8.8 | 0.0013 |  |
| [CVE-2026-46084](https://patchblox.com/security/data/cve/CVE-2026-46084.md) | High | RDMA/mana_ib: Disable RX steering on RSS QP destroy | 7.8 | 0.0013 |  |
| [CVE-2026-63952](https://patchblox.com/security/data/cve/CVE-2026-63952.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system.  Security Fix(es):  * kernel: n... | 8.4 | 0.0013 |  |
| [CVE-2026-64189](https://patchblox.com/security/data/cve/CVE-2026-64189.md) | High | netfilter: ipset: fix race between dump and ip_set_list resize | 8.8 | 0.0013 |  |
| [CVE-2026-46324](https://patchblox.com/security/data/cve/CVE-2026-46324.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  netfilter: nf_tables: use list_del_rcu for netli... | 7.8 | 0.0013 |  |
| [CVE-2026-43440](https://patchblox.com/security/data/cve/CVE-2026-43440.md) | High | kernel-docs: The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues:  The following security issues we... | 7.8 | 0.0012 |  |
| [CVE-2026-31483](https://patchblox.com/security/data/cve/CVE-2026-31483.md) | High | s390/syscalls: Add spectre boundary for syscall dispatch table | 7.8 | 0.0012 |  |
| [CVE-2026-31482](https://patchblox.com/security/data/cve/CVE-2026-31482.md) | High | s390/entry: Scrub r12 register on kernel entry | 7.1 | 0.0012 |  |
| [CVE-2026-53267](https://patchblox.com/security/data/cve/CVE-2026-53267.md) | High | netfilter: nft_ct: bail out on template ct in get eval | 7.8 | 0.0012 |  |
| [CVE-2026-53262](https://patchblox.com/security/data/cve/CVE-2026-53262.md) | High | l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() | 7.8 | 0.0012 |  |
| [CVE-2026-43276](https://patchblox.com/security/data/cve/CVE-2026-43276.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  net: mana: Fix double destroy_workqueue on servi... | 8.4 | 0.0012 |  |
| [CVE-2026-43056](https://patchblox.com/security/data/cve/CVE-2026-43056.md) | High | kernel-default-base: The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues:  The following security issues we... | 8.8 | 0.0012 |  |
| [CVE-2026-53129](https://patchblox.com/security/data/cve/CVE-2026-53129.md) | High | fs/mbcache: cancel shrink work before destroying the cache | 7.8 | 0.0012 |  |
| [CVE-2026-53250](https://patchblox.com/security/data/cve/CVE-2026-53250.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  xsk: cache csum_start/csum_offset to fix TOCTOU... | 7.8 | 0.0011 |  |
| [CVE-2026-53354](https://patchblox.com/security/data/cve/CVE-2026-53354.md) | High | arm64: errata: Mitigate TLBI errata on various Arm CPUs | 8.8 | 0.0010 |  |
| [CVE-2026-53050](https://patchblox.com/security/data/cve/CVE-2026-53050.md) | High | quota: Fix race of dquot_scan_active() with quota deactivation | 7.8 | 0.0010 |  |
| [CVE-2026-63802](https://patchblox.com/security/data/cve/CVE-2026-63802.md) | High | blk-cgroup: fix UAF in __blkcg_rstat_flush() | 8.3 | 0.0010 |  |
| [CVE-2026-53297](https://patchblox.com/security/data/cve/CVE-2026-53297.md) | Routine | net: mana: Guard mana_remove against double invocation | 5.5 | 0.0016 |  |
| [CVE-2026-45904](https://patchblox.com/security/data/cve/CVE-2026-45904.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  powerpc/eeh: fix recursive pci_lock_rescan_remov... | 5.5 | 0.0016 |  |
| [CVE-2026-53324](https://patchblox.com/security/data/cve/CVE-2026-53324.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  net: mana: Use pci_name() for debugfs directory... | 5.5 | 0.0016 |  |
| [CVE-2026-31628](https://patchblox.com/security/data/cve/CVE-2026-31628.md) | Routine | x86/CPU: Fix FPDSS on Zen1 | 5.5 | 0.0013 |  |
| [CVE-2026-46126](https://patchblox.com/security/data/cve/CVE-2026-46126.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  RDMA/mana: Fix mana_destroy_wq_obj() cleanup in... | 5.5 | 0.0013 |  |
| [CVE-2026-46144](https://patchblox.com/security/data/cve/CVE-2026-46144.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  RDMA/mana: Fix error unwind in mana_ib_create_qp... | 5.5 | 0.0013 |  |
| [CVE-2026-53177](https://patchblox.com/security/data/cve/CVE-2026-53177.md) | Routine | bnxt_en: Fix NULL pointer dereference | 5.5 | 0.0013 |  |
| [CVE-2026-46109](https://patchblox.com/security/data/cve/CVE-2026-46109.md) | Routine | usb: ulpi: fix memory leak on ulpi_register() error paths | 5.5 | 0.0012 |  |
| [CVE-2026-31542](https://patchblox.com/security/data/cve/CVE-2026-31542.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  x86/platform/uv: Handle deconfigured sockets  Wh... | 5.5 | 0.0012 |  |
| [CVE-2026-43046](https://patchblox.com/security/data/cve/CVE-2026-43046.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  btrfs: reject root items with drop_progress and... | 5.5 | 0.0011 |  |
| [CVE-2026-43475](https://patchblox.com/security/data/cve/CVE-2026-43475.md) | Routine | kernel-default: The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues:  The following security issues we... | 5.5 | 0.0011 |  |

---

Data as of 2026-11-10T13:56:55Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.