# SUSE-SU-2026:5111-1: cephfs security update

SUSE-SU-2026:5111-1, released November 7, 2026, fixes 10 CVEs in cephfs (version 1.0-150700.15.7.1). None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/suse-su-2026-5111-1
- Platform: Linux
- Released: Nov 7, 2026
- Priority: Urgent (Closes CVE-2026-68160, rated Critical)
- CVEs: 10, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://osv.dev/vulnerability/SUSE-SU-2026:5111-1

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [cephfs](https://patchblox.com/security/data/product/linux/cephfs.md) | sles 15.7 | 1.0-150700.15.7.1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-68160](https://patchblox.com/security/data/cve/CVE-2026-68160.md) | Urgent | ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() | 9.8 | 0.0077 |  |
| [CVE-2026-46052](https://patchblox.com/security/data/cve/CVE-2026-46052.md) | High | ceph: only d_add() negative dentries when they are unhashed | 7.5 | 0.0050 |  |
| [CVE-2025-38660](https://patchblox.com/security/data/cve/CVE-2025-38660.md) | High | [ceph] parse_longname(): strrchr() expects NUL-terminated string | 7.1 | 0.0041 |  |
| [CVE-2025-68297](https://patchblox.com/security/data/cve/CVE-2025-68297.md) | High | ceph: fix crash in process_v2_sparse_read() for encrypted directories | 7.0 | 0.0021 |  |
| [CVE-2026-52962](https://patchblox.com/security/data/cve/CVE-2026-52962.md) | High | ceph: fix a buffer leak in __ceph_setxattr() | 7.8 | 0.0014 |  |
| [CVE-2026-52961](https://patchblox.com/security/data/cve/CVE-2026-52961.md) | Routine | cephfs: ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size (bsc#1269129). | 5.5 | 0.0015 |  |
| [CVE-2026-23201](https://patchblox.com/security/data/cve/CVE-2026-23201.md) | Routine | cephfs: ceph: fix oops due to invalid pointer for kfree() in parse_longname() (bsc#1258337). | 5.5 | 0.0014 |  |
| [CVE-2026-43419](https://patchblox.com/security/data/cve/CVE-2026-43419.md) | Routine | kernel-rt-debug: kernel: ceph: fix memory leaks in ceph_mdsc_build_path() | 5.5 | 0.0012 |  |
| [CVE-2026-43273](https://patchblox.com/security/data/cve/CVE-2026-43273.md) | Routine | cephfs: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446). | 5.5 | 0.0012 |  |
| [CVE-2026-43420](https://patchblox.com/security/data/cve/CVE-2026-43420.md) | Routine | cephfs: ceph: fix i_nlink underrun during async unlink (bsc#1264814). | 5.5 | 0.0009 |  |

---

Data as of 2026-11-11T19:49:26Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.