SUSE Ships Broad Linux Kernel BPF Fixes for Local DoS and Privilege Bypass Flaws

SUSE has released a broad set of Linux kernel security updates addressing numerous BPF subsystem vulnerabilities that could be exploited locally with low privileges, including a permission-bypass flaw in BPF_PROG_DETACH on tcx and netkit devices tracked as CVE-2026-45932. That issue allowed unauthorized detachment of BPF programs when no program file descriptor was supplied, and was fixed by enforcing CAP_NET_ADMIN or CAP_SYS_ADMIN checks. Other patched flaws include verifier errors such as CVE-2026-43009 and CVE-2026-43030, a use-after-free in bpf_trampoline_link_cgroup_shim (CVE-2026-23319), an out-of-bounds write in devmap upper-device enumeration (CVE-2026-23359), and a nullable pointer dereference bug in map iterator callbacks (CVE-2026-43333).

The updates also cover earlier BPF and tcp_bpf issues that could crash the kernel or degrade availability, including ring buffer and verifier races, stackmap overflow handling, tail-call compatibility checks, invalid prog->stats access in cgroup BPF paths, and JIT constant-blinding gaps such as CVE-2026-23417. SUSE marked many fixes as released across SLES 15 SP7, SLES 16.0, SUSE Linux Micro 6.x, and openSUSE Leap 16.0, with advisories also listing remediated public cloud images for AWS, Azure, Google Cloud, and Alibaba in several cases. Some branches, including parts of SLES 16.1, older LTSS releases, and selected kernel-source variants, remain affected or in progress depending on product lifecycle and package line.