CVE-2026-25702 is an improper access control flaw in the SUSE Linux Enterprise Server 12 SP5 kernel that breaks nftables, so firewall rules applied through it may not be effective. NVD rates it 7.3. Install the kernel update SUSE lists in its bug entry.
What's affected
- Product: SUSE Linux Enterprise Server 12 SP5, kernel.
- Affected: kernels built from a commit range given by SUSE, from 9e6d9d46 up to but not including 9c294edb.
- Fixed: kernel builds containing commit 9c294edb7085fb91650bc12233495a8974c5ff2d. Check the SUSE bug entry for the package version.
- Impact area: hosts that rely on nftables for filtering.
How to check if you're exposed
Find out whether the host uses nftables and what kernel it is running:
uname -r
zypper patch-check
sudo nft list ruleset | head
The record gives only the commit boundary, so use the SUSE bugzilla entry and your update channel to match it to a package version. Test with a harmless connection to a port your ruleset blocks, from a host you control.
What to do now
- Read the SUSE entry for CVE-2026-25702 and apply the listed kernel update.
- Reboot into the new kernel and confirm uname -r reflects it.
- Verify that rules you depend on actually block traffic, using a test from a trusted peer.
- Until patched, add a second layer such as a network firewall or cloud security group in front of exposed services.
- Inventory other SLES 12 SP5 hosts, since this release is in long term support and often forgotten.
Why it matters
The class is improper access control, CWE-284. The risk here is quiet: nothing crashes, and the operator believes a port is closed when it is open. That gap between intended and real policy is what makes firewall faults dangerous.
The vector in the record is network, no privileges and low impact on each of confidentiality, integrity and availability, which explains the 7.3. It is not listed in CISA KEV.
Quick check
How would I notice this problem?
You probably would not from logs. Test the ruleset from outside, because the rules may show as loaded while having no effect.
Sources
Last reviewed: 19 October 2026.
