CVE Intelligence
Analysis AI-assisted

CVE-2026-25702: SUSE Linux Enterprise Server nftables disabled by incorrect kernel backport

CVE-2026-25702 is a CWE-284 improper access control issue in the SUSE Linux Enterprise Server kernel for 12-sp5 that disables nftables, so firewall rules applied through it may not take effect. NVD scores it 9.8 (critical) under CVSS, while two other providers list 7.3. The record shows no KEV listing and no confirmed exploitation in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The record describes CVE-2026-25702 as an improper access control weakness (CWE-284) in the kernel of SUSE Linux Enterprise Server. According to the description, an incorrect kernel backport leaves nftables disabled, so firewall rules applied through nftables are not effective.

Impact

  • Firewall rules managed with nftables may not be enforced, which could leave services exposed that administrators believed were filtered.
  • NVD rates the issue 9.8 under CVSS, with high confidentiality, integrity and availability impact in its vector. Two other providers listed 7.3.
  • The record gives SSVC exploitation as none, automatable as yes and technical impact as partial.

Affected products and versions

  • SUSE Linux Enterprise Server, version 12-sp5.
  • The record gives a range of kernel commits from 9e6d9d4601768c75fdb0bad3fbbe636e748939c2 (inclusive) up to 9c294edb7085fb91650bc12233495a8974c5ff2d (exclusive).
  • The record does not list a fixed version or patched package.

Exploitation status

The CISA KEV catalog does not list this CVE according to the record. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.0038 with a percentile of 0.30836.

Remediation and mitigation

  • Check the SUSE bug tracker entry and the NVD record for current status.
  • Apply the vendor kernel updates for SUSE Linux Enterprise Server 12-sp5 when they are published, and confirm that the installed kernel includes the corrected change.
  • Until the system is patched, do not rely solely on nftables for critical filtering. Verify firewall behavior and add independent controls where risk is high.

Detection guidance

  • Confirm that the expected nftables rulesets are loaded and active after boot and after kernel updates.
  • Compare installed kernel package versions and changelogs with vendor advisories.
  • Monitor for unexpected listening network services on hosts where filtering is required.

Limitations of the available information

The record does not state a fixed version, the technical details of the backport defect, or a vendor advisory identifier. The only reference is a SUSE bugzilla entry tagged Broken Link. The CVSS difference between NVD (9.8) and the other providers (7.3) is not explained. The EPSS date is given as 2026-10-23, which the record does not reconcile with the publication date.

Frequently asked questions

What is CVE-2026-25702?

It is an improper access control issue (CWE-284) in the SUSE Linux Enterprise Server kernel for 12-sp5. An incorrect kernel backport disables nftables, so firewall rules applied through it may not be effective.

Is this CVE known to be actively exploited?

The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Is a fixed version available?

The record does not list a fixed version or patched package. Check the SUSE bug tracker entry and the vendor's updates for current status.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.