Back Linuxsecurity

SUSE swtpm Moderate Out-Of-Bounds Issue Advisory 2026-4366-1 CVE-2026

Linuxsecurity •LinuxSecurity Advisories • September 29, 2026

CISA confirms exploitation of a Linux firewall flaw. Check if your systems need the fix. ×

## This update for swtpm fixes the following issue: * CVE-2026-75900: out-of-bounds read in SWTPM_NVRAM_CheckHeader due to sizeof(pointer) vs sizeof(struct) mismatch (bsc#1275653). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * Server Applications Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP7-2026-4366 ## Package List: * Server Applications Module 15-SP7 (aarch64 ppc64le s390x x86_64) * swtpm-devel-0.9.0-150700.3.3.1 * swtpm-debugsource-0.9.0-150700.3.3.1 * swtpm-debuginfo-0.9.0-150700.3.3.1 * swtpm-0.9.0-150700.3.3.1

* CVE-2026-75900 ( SUSE ): 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

* CVE-2026-75900 ( NVD ): 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

* Server Applications Module 15-SP7

* SUSE Linux Enterprise Real Time 15 SP7

* SUSE Linux Enterprise Server 15 SP7

* SUSE Linux Enterprise Server for SAP Applications 15 SP7

An update that solves one vulnerability can now be installed.

Announcement ID: SUSE-SU-2026:4366-1 Release Date: 2026-09-28T15:01:37Z Rating: moderate

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple SUSE Vulnerabilities Exploited: Heap Overflow and Out-of-Bounds Issues SUSE has released advisories for several vulnerabilities affecting its software, including critical heap overflow and out-of-bounds read issues. The vulnerabilities include CVE-2026-49275, CVE-2026-68546, and CVE-2026-68547 in exiv2, and CVE-2026-85769 in libtpms, which has been confirmed to be actively exploited. The CVE-2026-85769 vulnerability involves a heap out-of-bounds read during TPM2 state unmarshalling, affecting various SUSE and openSUSE products. The CVE-2026-75900 vulnerability in swtpm also presents an out-of-bounds read issue. Administrators are urged to apply patches immediately to mitigate risks. The vulnerabilities pose a significant risk to systems running affected versions of SUSE software, and CISA has confirmed exploitation of these flaws. Patches are available through standard installation methods. 8 sources 72

Extracted Entities

SUSE swtpm Moderate Out-Of-Bounds Issue Advisory 2026-4366-1 CVE-2026

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Platforms (1)