CVE-2026-89948 Affecting kernel-livepatch-6_4_0-150700_53_90-default package, versions <1-150700.15.3.1
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-SLES157-KERNELLIVEPATCH6401507005390DEFAULT-22236873
- published5 Nov 2026
- disclosed3 Nov 2026
Introduced: 3 Nov 2026
NewCVE-2026-89948 (opens in a new tab)How to fix?
Upgrade SLES:15.7 kernel-livepatch-6_4_0-150700_53_90-default to version 1-150700.15.3.1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-livepatch-6_4_0-150700_53_90-default package and not the kernel-livepatch-6_4_0-150700_53_90-default package as distributed by SLES.
See How to fix? for SLES:15.7 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: bla: fix freeing of claims on meshif deletion
When the mesh interface is getting deleted, then batadv_bla_del_backbone_claims() (via batadv_bla_purge_backbone_gw()) could make sure that all claims gets removed. But this function is only executed when bat_priv->bla.claim_hash is not NULL. And since batadv_bla_free() is always setting it to NULL before it is (indirectly) called, it was never actually executed.
But the batadv_bla_purge_claims() -> batadv_handle_unclaim() is at the moment too fragile because the BLA code is not handling the rehashing in batadv_bla_update_orig_address(). The stored backbone address doesn't have to be the one actually used for the hash bucket selection during the initial adding of the backbone. The batadv_handle_unclaim() can therefore fail to find the respective backbone for the unclaim and then stop the deletion.
But the actual backbone_gw object is not needed for the unclaim because all relevant information is always provided by the caller. And the check for the existence of the backbone_gw doesn't provide any additional security check for the deletion of a claim.
References
- https://www.suse.com/security/cve/CVE-2026-89948.html
- https://bugzilla.suse.com/1281221
- https://git.kernel.org/stable/c/76aedcde5a2489cc971d4d1e396e784a49565e96
- https://git.kernel.org/stable/c/844a95a734f178d56c7acce14c5cce2cecff7e1a
- https://git.kernel.org/stable/c/871acdf97f64cee8398f72b88b89e8b4f4816dbe
- https://git.kernel.org/stable/c/8d128c932bced74e3b1625ba3d7c78ef122a88a7
- https://git.kernel.org/stable/c/9a0c47023d3254048a1588534755d4476bcc3abc
- https://git.kernel.org/stable/c/aacffa780a37e06cd5a13d33740a6e96c3a67e6c
- https://git.kernel.org/stable/c/baeb1a28fd8e2f68193650d3664a8cd1adfd85c6
- https://git.kernel.org/stable/c/f50edb69082a8ba990cc23d642089829f99afe6a