FERRAMENTAS LINUX: Linux Kernel Security: A Practical Guide to Checking, Patching, and Mitigating Vulnerabilities (CVE-2025-39973, CVE-2026-23111, and others)

Stop blindly running zypper patch. Learn to audit kernel drivers, netfilter, and macvlan bugs like the April 2026 CVEs. The Linux Kernel Programming Guide (5th Ed.) – includes CVE-to-Code appendix. Buy on Amazon.

In April 2026, SUSE released an important kernel security update (SUSE-SU-2026:1259-1) addressing eight vulnerabilities, including several local privilege escalation flaws (CVSS 7.8) and a network denial-of-service issue (CVE-2025-71120, CVSS 7.5).

But here’s the reality: similar kernel bugs appear every few months on every major distribution. This guide gives you reusable commands and scripts that work today, next month, and next year—regardless of the specific CVE number.

How to check if your Linux server is vulnerable to common kernel flaws

You don’t need to memorize CVE lists. Use these commands to check your current kernel version and compare it against known-fixed versions.

On Ubuntu 20.04, 22.04, 24.04

# Show current kernel
uname -r

# Check available kernel updates
apt list --upgradable | grep linux-image

# See if a reboot is pending (check for /var/run/reboot-required)
if [ -f /var/run/reboot-required ]; then
    echo "Reboot required - kernel updated but not running"
    cat /var/run/reboot-required
fi

On Rocky Linux / AlmaLinux / RHEL

# Current kernel version
uname -r

# List installed kernels
rpm -qa kernel-core

# Check for updates
dnf check-update kernel

# See which kernel is default in GRUB
grubby --default-kernel

On SUSE Linux Enterprise Server (SLES) / openSUSE Leap

# Current kernel
uname -r

# List all installed kernels
zypper search --installed-only kernel-default

# Check for available kernel patches (like the April 2026 update)
zypper list-patches | grep -i kernel

Quick vulnerability test – A common symptom of the (CVE-2026-22999) is a kernel crash when using specific traffic control rules. To test if your system might be affected:

# Check if you have any qfq qdiscs loaded
tc qdisc show | grep qfq

# Check kernel logs for qfq-related errors
dmesg | grep -i qfq

Automation script to apply the fix (bash – works on Ubuntu, Rocky Linux, SUSE)

Save this as and run it with sudo bash kernel-update.sh. It detects your distro, updates the kernel, and prompts for reboot.

#!/bin/bash
# kernel-update.sh – Universal Linux kernel patcher
# Run as root or with sudo

set -e

# Detect distribution
if [ -f /etc/os-release ]; then
    . /etc/os-release
    OS=$ID
    VER=$VERSION_ID
else
    echo "Cannot detect OS. Exiting."
    exit 1
fi

echo "Detected: $OS $VER"
echo "Current kernel: $(uname -r)"

# Update kernel based on distro
case $OS in
    ubuntu|debian)
        apt update
        apt install -y linux-image-generic
        ;;
    rocky|almalinux|rhel|centos)
        dnf update kernel-core -y
        ;;
    suse|opensuse-leap)
        zypper refresh
        zypper update -y kernel-default
        # Apply live patch if available (SP6 only)
        if zypper search kernel-livepatch | grep -q installed; then
            zypper install -y kernel-livepatch-SLE15-SP6_Update_9
        fi
        ;;
    *)
        echo "Unsupported OS: $OS"
        exit 1
        ;;
esac

echo "Kernel packages updated."
echo "You need to reboot to load the new kernel."

read -p "Reboot now? (y/n): " -n 1 -r
echo
if [[ $REPLY =~ ^[Yy]$ ]]; then
    reboot
else
    echo "Remember to reboot later. Until then, your system is still vulnerable."
fi

Alternative mitigation if you can’t update the kernel now

Sometimes you cannot reboot a production server immediately. Here are three stop-gap mitigations that work for many local kernel flaws (including privilege escalation via network subsystems like nf_tables or ).

1. Block specific kernel modules (AppArmor / modprobe)

For vulnerabilities in modules like macvlan or ip_vs_ftp, prevent them from loading:

echo "install macvlan /bin/false" >> /etc/modprobe.d/blacklist-macvlan.conf
echo "install ip_vs_ftp /bin/false" >> /etc/modprobe.d/blacklist-ipvs.conf
update-initramfs -u   # Debian/Ubuntu
dracut -f             # RHEL/Rocky/SUSE

2. Restrict unprivileged user namespaces (Ubuntu-specific)

Many local privilege escalation bugs require . Disable or restrict them:

# Temporarily (until reboot)
echo 0 > /proc/sys/user/max_user_namespaces

# Permanently – add to /etc/sysctl.d/99-disable-userns.conf
echo "user.max_user_namespaces=0" > /etc/sysctl.d/99-disable-userns.conf
sysctl -p /etc/sysctl.d/99-disable-userns.conf

3. iptables rules for network-based kernel flaws

For remote DoS like CVE-2025-71120 (), block malformed RPC traffic:

# Limit RPC packet size
iptables -A INPUT -p tcp --dport 2049 -m length --length 0:512 -j ACCEPT
iptables -A INPUT -p tcp --dport 2049 -j DROP

# Rate-limit new RPC connections
iptables -A INPUT -p tcp --dport 2049 -m connlimit --connlimit-above 10 -j DROP