The Linux Kernel Got 8 Security Fixes: Here’s Your Permanent Action Plan

 

Stop chasing kernel CVE dates. Learn to check, patch, and mitigate Linux kernel vulnerabilities (like the 8 fixes in SUSE-SU-2026:21096-1) on Ubuntu, Rocky, and SUSE. Includes a universal bash script, iptables fallback, and a recommended security book for deep defense. 

Don’t focus on the date. Focus on the pattern.

On April 11, 2026, SUSE released an important kernel live patch (SUSE-SU-2026:21096-1) fixing eight CVEs – including a network-dos (CVE-2025-71120, CVSS 8.7) and multiple local privilege escalations.

But here’s the evergreen truth: Kernel vulnerabilities happen every month. What matters is having a repeatable process to detect, patch, or block them – without panic.

This guide gives you that process. Use it for this SUSE update, the next Ubuntu one, or any future kernel bug.

1. How to check if you are vulnerable (actual commands)

Run these today on your systems. The same logic works for any kernel CVE.

Ubuntu 22.04 / 24.04

bash

# Check running kernel version
uname -r

# See if a specific CVE affects you (example using CVE-2025-71120)
grep -i "CVE-2025-71120" /usr/share/doc/linux-image-$(uname -r)/changelog.Debian.gz 2>/dev/null | zcat | head -5

# List pending kernel updates
apt list --upgradable | grep linux-image

Rocky Linux / AlmaLinux 8 or 9 

bash

# Current kernel
uname -r

# Check if CVE is fixed in available updates
rpm -q --changelog kernel-$(uname -r) | grep -i "CVE-2025-71120"

# Show available kernel updates
dnf check-update kernel

SUSE Linux Micro / LEAP

bash

# Verify running kernel
uname -r

# List needed live patches (like the one from the advisory)
zypper list-patches | grep -i kernel

# Check for specific CVE in current kernel
zypper patch-info $(zypper list-patches | grep kernel | awk '{print $1}') | grep -i CVE

2. Automation script to apply the fix (bash, major distros)

Save this as kernel-patch-helper.sh – it detects your distro and applies the kernel fix safely.

bash

#!/bin/bash
# Universal kernel patcher for Ubuntu, Rocky, SUSE
# Run with: sudo bash kernel-patch-helper.sh

set -e

if [[ $EUID -ne 0 ]]; then
   echo "This script must be run as root (use sudo)" 
   exit 1
fi

echo "🔍 Detecting distribution..."
if [[ -f /etc/os-release ]]; then
    . /etc/os-release
    OS=$ID
    VER=$VERSION_ID
else
    echo "Cannot detect OS. Exiting."
    exit 1
fi

case $OS in
    ubuntu|debian)
        echo "📦 Updating kernel on Ubuntu/Debian"
        apt update
        apt install -y linux-image-generic
        echo "✅ Kernel updated. REBOOT required."
        ;;
    rhel|centos|rocky|almalinux)
        echo "📦 Updating kernel on Rocky/AlmaLinux"
        dnf update kernel -y
        echo "✅ Kernel updated. REBOOT required."
        ;;
    suse|opensuse-leap|sles)
        echo "📦 Applying live patch on SUSE"
        zypper refresh
        zypper install -t patch kernel-livepatch-6_12_0-160000_5-default
        # No reboot needed for livepatch
        echo "✅ Live patch applied. No reboot needed."
        ;;
    *)
        echo "Unsupported OS: $OS"
        exit 1
        ;;
esac

echo "🎯 Done. For non-livepatch updates, reboot when possible."

3. Alternative mitigation if you can’t update now

Can’t reboot or apply the live patch? Use these immediate network filters to block the most dangerous CVE from the SUSE advisory: CVE-2025-71120 (SUNRPC NULL deref – remote DoS).

iptables works on any distro

bash

# Block RPC-based attacks targeting SUNRPC service
iptables -A INPUT -p tcp --dport 2049 -j DROP        # NFS
iptables -A INPUT -p udp --dport 2049 -j DROP
iptables -A INPUT -p tcp --dport 111 -j DROP         # portmap/rpcbind
iptables -A INPUT -p udp --dport 111 -j DROP

# Save rules (persist)
iptables-save > /etc/iptables/rules.v4   # Debian/Ubuntu
# or: service iptables save               # RHEL/Rocky

AppArmor (Ubuntu/SUSE) – deny kernel module loading

bash

# Create profile to block the vulnerable 'sch_qfq' scheduler (CVE-2026-22999)
cat << EOF > /etc/apparmor.d/block.sch_qfq
abi <abi/4.0>,
include <tunables/global>

profile block_sch_qfq /usr/bin/* {
  deny /sys/module/sch_qfq/ r,
  deny /sys/module/sch_qfq/** rw,
}
EOF

apparmor_parser -r /etc/apparmor.d/block.sch_qfq
systemctl restart apparmor

Proxy workaround (if you run containers)

If you’re on SUSE Linux Micro (the affected product), put this in your container runtime:

json

{
  "securityContext": {
    "capabilities": {
      "drop": ["NET_ADMIN", "SYS_MODULE"]
    }
  }
}

Suggeted book :

Mastering Linux Security and Hardening   - Amazon 

Affiliate disclosure: As an Amazon Associate, I earn from qualifying purchases. This helps me keep writing in-depth security guides – at no extra cost to you.)