Back Linuxsecurity

SUSE Wicked Important Security Update CVE-2026-71401 CVE-2026

Linuxsecurity •LinuxSecurity Advisories • August 28, 2026

Find practical guidance for preventing, investigating, and responding to Linux security problems. Find practical guidance for preventing, investigating, and responding to Linux security problems. _ Review Linux Privileges ×

## This update for wicked fixes the following issue: * CVE-2026-71401: out-of-bounds read due to IP length underflow in checksum handling of DHCPv4 capture parsing (bsc#1274627). * CVE-2026-71402: out-of-bounds read due to DHCP option reader being extended beyond provided allocation in DHCPv4 capture parsing (bsc#1274627). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * Basesystem Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-3841=1 ## Package List: * Basesystem Module 15-SP7 (aarch64 ppc64le s390x x86_64) * wicked-0.6.79-150700.3.8.1 * wicked-service-0.6.79-150700.3.8.1 * wicked-debuginfo-0.6.79-150700.3.8.1

* CVE-2026-71401 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

* CVE-2026-71401 ( NVD ): 5.3

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

* CVE-2026-71402 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

* CVE-2026-71402 ( NVD ): 5.3

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

* CVE-2026-71402 ( NVD ): 5.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Announcement ID: SUSE-SU-2026:3841-1 Release Date: 2026-08-27T12:21:40Z Rating: important

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in SUSE Wicked Affecting DHCP Parsing SUSE has released important security updates addressing two critical vulnerabilities in the Wicked network management tool, identified as CVE-2026-71401 and CVE-2026-71402, both published on 2026-08-27. These vulnerabilities involve out-of-bounds reads due to IP length underflow and improper handling of DHCP options, potentially allowing attackers to exploit these flaws for unauthorized access or denial of service. The affected systems include various versions of SUSE Linux Enterprise and openSUSE. The updates are crucial for preventing potential exploits that could lead to significant security breaches. Administrators are advised to apply the patches immediately using the recommended installation methods. The vulnerabilities have been rated with CVSS scores indicating a high severity level, emphasizing the urgency of remediation. Current reports indicate that there is no confirmed active exploitation in the wild, but the potential risk remains significant. 8 sources 61

Extracted Entities

CVEs (2)

CVE-2026-71401 CVE-2026-71402

CWE Weaknesses (1)

CWE-125 - Out-of-bounds Read