# SUSE-SU-2026:3602-1: Security update for 7 packages

SUSE-SU-2026:3602-1, released October 2, 2026, fixes 73 CVEs across 7 products. None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/suse-su-2026-3602-1
- Platform: Linux
- Released: Oct 2, 2026
- Priority: Urgent (Closes CVE-2026-64564, rated Critical)
- CVEs: 73, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://osv.dev/vulnerability/SUSE-SU-2026:3602-1

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [kernel-default](https://patchblox.com/security/data/product/linux/kernel-default.md) | sles 15.6 | 6.4.0-150600.23.130.1 |
| [kernel-default-base](https://patchblox.com/security/data/product/linux/kernel-default-base.md) | sles 15.6 | 6.4.0-150600.23.130.1.150600.12.60.3 |
| [kernel-docs](https://patchblox.com/security/data/product/linux/kernel-docs.md) | sles 15.6 | 6.4.0-150600.23.130.1 |
| [kernel-livepatch-SLE15-SP6_Update_30](https://patchblox.com/security/data/product/linux/kernel-livepatch-sle15-sp6-update-30.md) | sles 15.6 | 1-150600.13.5.1 |
| [kernel-obs-build](https://patchblox.com/security/data/product/linux/kernel-obs-build.md) | sles 15.6 | 6.4.0-150600.23.130.1 |
| [kernel-source](https://patchblox.com/security/data/product/linux/kernel-source.md) | sles 15.6 | 6.4.0-150600.23.130.1 |
| [kernel-syms](https://patchblox.com/security/data/product/linux/kernel-syms.md) | sles 15.6 | 6.4.0-150600.23.130.1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-64564](https://patchblox.com/security/data/cve/CVE-2026-64564.md) | Urgent | sctp: don't free the ASCONF's own transport in DEL-IP processing | 9.8 | 0.0143 |  |
| [CVE-2026-53224](https://patchblox.com/security/data/cve/CVE-2026-53224.md) | Urgent | kernel-default: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997). | 9.1 | 0.0057 |  |
| [CVE-2026-63824](https://patchblox.com/security/data/cve/CVE-2026-63824.md) | Urgent | KEYS: fix overflow in keyctl_pkey_params_get_2() | 9.8 | 0.0017 |  |
| [CVE-2026-64106](https://patchblox.com/security/data/cve/CVE-2026-64106.md) | Urgent | kernel-default: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (bsc#1272242). | 9.0 | 0.0015 |  |
| [CVE-2026-46333](https://patchblox.com/security/data/cve/CVE-2026-46333.md) | High | ptrace: slightly saner 'get_dumpable()' logic | 8.1 | 0.0430 |  |
| [CVE-2026-63912](https://patchblox.com/security/data/cve/CVE-2026-63912.md) | High | kernel-default: xfrm: esp: restore combined single-frag length gate (bsc#1272836). | 9.8 | 0.0071 |  |
| [CVE-2026-63922](https://patchblox.com/security/data/cve/CVE-2026-63922.md) | High | kernel: kernel: ipv6: exthdrs: refresh nh after handling HAO option | 9.8 | 0.0071 |  |
| [CVE-2026-63924](https://patchblox.com/security/data/cve/CVE-2026-63924.md) | High | kernel: kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() | 9.8 | 0.0071 |  |
| [CVE-2026-63968](https://patchblox.com/security/data/cve/CVE-2026-63968.md) | High | kernel-default: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272466). | 7.5 | 0.0067 |  |
| [CVE-2026-64530](https://patchblox.com/security/data/cve/CVE-2026-64530.md) | High | net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle | 9.8 | 0.0066 |  |
| [CVE-2026-63919](https://patchblox.com/security/data/cve/CVE-2026-63919.md) | High | kernel-default: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907). | 8.8 | 0.0065 |  |
| [CVE-2026-52986](https://patchblox.com/security/data/cve/CVE-2026-52986.md) | High | netfilter: nf_conntrack_sip: don't use simple_strtoul | 9.8 | 0.0063 |  |
| [CVE-2026-53391](https://patchblox.com/security/data/cve/CVE-2026-53391.md) | High | NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr | 8.8 | 0.0052 |  |
| [CVE-2026-63984](https://patchblox.com/security/data/cve/CVE-2026-63984.md) | High | kernel-default: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (bsc#1272865). | 9.8 | 0.0051 |  |
| [CVE-2026-63994](https://patchblox.com/security/data/cve/CVE-2026-63994.md) | High | kernel-default: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp() (bsc#1273035). | 9.8 | 0.0051 |  |
| [CVE-2026-64560](https://patchblox.com/security/data/cve/CVE-2026-64560.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  posix-cpu-timers: Prevent UAF caused by non-lead... | 7.8 | 0.0050 |  |
| [CVE-2026-64600](https://patchblox.com/security/data/cve/CVE-2026-64600.md) | High | xfs: resample the data fork mapping after cycling ILOCK | 7.8 | 0.0047 |  |
| [CVE-2026-53246](https://patchblox.com/security/data/cve/CVE-2026-53246.md) | High | sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing | 9.8 | 0.0044 |  |
| [CVE-2026-53131](https://patchblox.com/security/data/cve/CVE-2026-53131.md) | High | netfilter: require Ethernet MAC header before using eth_hdr() | 9.4 | 0.0044 |  |
| [CVE-2026-31598](https://patchblox.com/security/data/cve/CVE-2026-31598.md) | High | ocfs2: fix possible deadlock between unlink and dio_end_io_write | 7.5 | 0.0044 |  |
| [CVE-2026-46243](https://patchblox.com/security/data/cve/CVE-2026-46243.md) | High | smb: client: reject userspace cifs.spnego descriptions | 7.8 | 0.0041 |  |
| [CVE-2026-52967](https://patchblox.com/security/data/cve/CVE-2026-52967.md) | High | kernel-default: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181). | 8.1 | 0.0039 |  |
| [CVE-2026-63893](https://patchblox.com/security/data/cve/CVE-2026-63893.md) | High | kernel-default: thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (bsc#1272607). | 8.1 | 0.0039 |  |
| [CVE-2026-46056](https://patchblox.com/security/data/cve/CVE-2026-46056.md) | High | Bluetooth: hci_event: fix potential UAF in SSP passkey handlers | 8.8 | 0.0028 |  |
| [CVE-2026-63975](https://patchblox.com/security/data/cve/CVE-2026-63975.md) | High | kernel-default: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (bsc#1272694). | 8.8 | 0.0027 |  |
| [CVE-2026-64561](https://patchblox.com/security/data/cve/CVE-2026-64561.md) | High | KVM: x86: Check for invalid/obsolete root *after* making MMU pages available | 8.8 | 0.0027 |  |
| [CVE-2026-63946](https://patchblox.com/security/data/cve/CVE-2026-63946.md) | High | kernel-default: Bluetooth: ISO: fix UAF in iso_recv_frame (bsc#1272665). | 8.8 | 0.0026 |  |
| [CVE-2026-53375](https://patchblox.com/security/data/cve/CVE-2026-53375.md) | High | drm/amdgpu/vce: Prevent partial address patches | 8.8 | 0.0018 |  |
| [CVE-2026-63884](https://patchblox.com/security/data/cve/CVE-2026-63884.md) | High | kernel-zfcpdump: kernel: drm/i915: Fix potential UAF in TTM object purge | 7.8 | 0.0018 |  |
| [CVE-2026-63807](https://patchblox.com/security/data/cve/CVE-2026-63807.md) | High | KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level | 8.8 | 0.0017 |  |
| [CVE-2026-53402](https://patchblox.com/security/data/cve/CVE-2026-53402.md) | High | fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() | 7.1 | 0.0017 |  |
| [CVE-2026-63826](https://patchblox.com/security/data/cve/CVE-2026-63826.md) | High | fbdev: fix use-after-free in store_modes() | 7.1 | 0.0017 |  |
| [CVE-2026-63917](https://patchblox.com/security/data/cve/CVE-2026-63917.md) | High | kernel-default: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1272904). | 8.8 | 0.0017 |  |
| [CVE-2026-63921](https://patchblox.com/security/data/cve/CVE-2026-63921.md) | High | kernel-default: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1272918). | 8.8 | 0.0016 |  |
| [CVE-2026-63806](https://patchblox.com/security/data/cve/CVE-2026-63806.md) | High | KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() | 7.3 | 0.0016 |  |
| [CVE-2026-46174](https://patchblox.com/security/data/cve/CVE-2026-46174.md) | High | x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache | 9.8 | 0.0015 |  |
| [CVE-2026-63829](https://patchblox.com/security/data/cve/CVE-2026-63829.md) | High | net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink | 8.8 | 0.0015 |  |
| [CVE-2026-46145](https://patchblox.com/security/data/cve/CVE-2026-46145.md) | High | kernel-default: Security update for the Linux Kernel | 7.8 | 0.0015 |  |
| [CVE-2026-63794](https://patchblox.com/security/data/cve/CVE-2026-63794.md) | High | KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path | 8.8 | 0.0014 |  |
| [CVE-2026-46117](https://patchblox.com/security/data/cve/CVE-2026-46117.md) | High | kernel-default: Security update for the Linux Kernel | 7.8 | 0.0014 |  |
| [CVE-2026-46193](https://patchblox.com/security/data/cve/CVE-2026-46193.md) | High | kernel-uek-debug-devel: xfrm: ah: account for ESN high bits in async callbacks (Michael Bommarito) [Orabug: 39460554] | 7.0 | 0.0014 |  |
| [CVE-2026-46323](https://patchblox.com/security/data/cve/CVE-2026-46323.md) | High | net: gro: don't merge zcopy skbs | 8.4 | 0.0014 |  |
| [CVE-2026-46080](https://patchblox.com/security/data/cve/CVE-2026-46080.md) | High | ocfs2: split transactions in dio completion to avoid credit exhaustion | 7.1 | 0.0014 |  |
| [CVE-2026-43033](https://patchblox.com/security/data/cve/CVE-2026-43033.md) | High | crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption | 7.8 | 0.0014 |  |
| [CVE-2026-53388](https://patchblox.com/security/data/cve/CVE-2026-53388.md) | High | fuse: re-lock request before replacing page cache folio | 8.8 | 0.0013 |  |
| [CVE-2026-63971](https://patchblox.com/security/data/cve/CVE-2026-63971.md) | High | kernel-default: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272678). | 8.8 | 0.0013 |  |
| [CVE-2026-46084](https://patchblox.com/security/data/cve/CVE-2026-46084.md) | High | RDMA/mana_ib: Disable RX steering on RSS QP destroy | 7.8 | 0.0013 |  |
| [CVE-2026-63952](https://patchblox.com/security/data/cve/CVE-2026-63952.md) | High | kernel-default: memfd: deny writeable mappings when implying SEAL_WRITE (bsc#1272468). | 8.4 | 0.0013 |  |
| [CVE-2026-64189](https://patchblox.com/security/data/cve/CVE-2026-64189.md) | High | netfilter: ipset: fix race between dump and ip_set_list resize | 8.8 | 0.0013 |  |
| [CVE-2026-46324](https://patchblox.com/security/data/cve/CVE-2026-46324.md) | High | kernel-default: netfilter: nf_tables: Introduce functions freeing nft_hook objects (bsc#1267995). | 7.8 | 0.0013 |  |
| [CVE-2026-43440](https://patchblox.com/security/data/cve/CVE-2026-43440.md) | High | kernel-default: Security update for the Linux Kernel | 7.8 | 0.0012 |  |
| [CVE-2026-31483](https://patchblox.com/security/data/cve/CVE-2026-31483.md) | High | s390/syscalls: Add spectre boundary for syscall dispatch table | 7.8 | 0.0012 |  |
| [CVE-2026-31482](https://patchblox.com/security/data/cve/CVE-2026-31482.md) | High | s390/entry: Scrub r12 register on kernel entry | 7.1 | 0.0012 |  |
| [CVE-2026-53267](https://patchblox.com/security/data/cve/CVE-2026-53267.md) | High | netfilter: nft_ct: bail out on template ct in get eval | 7.8 | 0.0012 |  |
| [CVE-2026-53262](https://patchblox.com/security/data/cve/CVE-2026-53262.md) | High | l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() | 7.8 | 0.0012 |  |
| [CVE-2026-43276](https://patchblox.com/security/data/cve/CVE-2026-43276.md) | High | kernel-default: Security update for the Linux Kernel | 8.4 | 0.0012 |  |
| [CVE-2026-43056](https://patchblox.com/security/data/cve/CVE-2026-43056.md) | High | kernel-default: Security update for the Linux Kernel | 8.8 | 0.0012 |  |
| [CVE-2026-53129](https://patchblox.com/security/data/cve/CVE-2026-53129.md) | High | fs/mbcache: cancel shrink work before destroying the cache | 7.8 | 0.0012 |  |
| [CVE-2026-53250](https://patchblox.com/security/data/cve/CVE-2026-53250.md) | High | kernel-default: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (bsc#1269808). | 7.8 | 0.0011 |  |
| [CVE-2026-53354](https://patchblox.com/security/data/cve/CVE-2026-53354.md) | High | arm64: errata: Mitigate TLBI errata on various Arm CPUs | 8.8 | 0.0010 |  |
| [CVE-2026-53050](https://patchblox.com/security/data/cve/CVE-2026-53050.md) | High | quota: Fix race of dquot_scan_active() with quota deactivation | 7.8 | 0.0010 |  |
| [CVE-2026-63802](https://patchblox.com/security/data/cve/CVE-2026-63802.md) | High | blk-cgroup: fix UAF in __blkcg_rstat_flush() | 8.3 | 0.0010 |  |
| [CVE-2026-53297](https://patchblox.com/security/data/cve/CVE-2026-53297.md) | Routine | net: mana: Guard mana_remove against double invocation | 5.5 | 0.0016 |  |
| [CVE-2026-45904](https://patchblox.com/security/data/cve/CVE-2026-45904.md) | Routine | kernel-livepatch-SLE15-SP6_Update_30: Security update for the Linux Kernel | 5.5 | 0.0016 |  |
| [CVE-2026-53324](https://patchblox.com/security/data/cve/CVE-2026-53324.md) | Routine | kernel-default: Security update for the Linux Kernel | 5.5 | 0.0016 |  |
| [CVE-2026-31628](https://patchblox.com/security/data/cve/CVE-2026-31628.md) | Routine | x86/CPU: Fix FPDSS on Zen1 | 5.5 | 0.0013 |  |
| [CVE-2026-46126](https://patchblox.com/security/data/cve/CVE-2026-46126.md) | Routine | kernel-default: Security update for the Linux Kernel | 5.5 | 0.0013 |  |
| [CVE-2026-46144](https://patchblox.com/security/data/cve/CVE-2026-46144.md) | Routine | kernel-default: Security update for the Linux Kernel | 5.5 | 0.0013 |  |
| [CVE-2026-53177](https://patchblox.com/security/data/cve/CVE-2026-53177.md) | Routine | bnxt_en: Fix NULL pointer dereference | 5.5 | 0.0013 |  |
| [CVE-2026-46109](https://patchblox.com/security/data/cve/CVE-2026-46109.md) | Routine | usb: ulpi: fix memory leak on ulpi_register() error paths | 5.5 | 0.0012 |  |
| [CVE-2026-31542](https://patchblox.com/security/data/cve/CVE-2026-31542.md) | Routine | kernel-default: Security update for the Linux Kernel | 5.5 | 0.0012 |  |
| [CVE-2026-43046](https://patchblox.com/security/data/cve/CVE-2026-43046.md) | Routine | kernel-default: Security update for the Linux Kernel | 5.5 | 0.0011 |  |
| [CVE-2026-43475](https://patchblox.com/security/data/cve/CVE-2026-43475.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0011 |  |

---

Data as of 2026-11-11T13:47:35Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.