The openEuler 22.03 LTS version has not been upgraded to SP4. How can I fix these vulnerabilities (CVE-2026-46300, CVE-2026-43284, CVE-2026-43500, CVE-2026-31431)? Can these be resolved without upgrading to SP4?
You can download and install the kernel from the openEuler-22.03-SP4 version that has fixed CVE-2026-31431 onto the openEuler-22.03-LTS version, as both share the same major kernel version (kernel-5.10), with only minor version differences, making them largely compatible. Using the SP4 kernel version should pose no issues.
Senior, do you have any reference documentation I can refer to? I’m not quite clear about this operation: “Downloading and installing the patched openEuler-22.03-SP4 kernel onto the openEuler-22.03-LTS version.”
The following link is the repository containing all the packages for the openEuler-22.03-LTS-SP4 update:
https://repo.openeuler.org/openEuler-22.03-LTS-SP4/update/x86_64/Packages/
Download the following RPM from this repository and install it on your LTS version using the rpm command. I checked, and the version of this RPM package appears to be the latest release:
https://repo.openeuler.org/openEuler-22.03-LTS-SP4/update/x86_64/Packages/kernel-5.10.0-318.0.0.221.oe2203sp4.x86_64.rpm
So, does this mean upgrading my current 5.10.0-60.18.0.50.oe2203.x86_64 to 5.10.0-318.0.0.221.oe2203sp4.x86_64 and then resolving the security issues?
Yes
Thanks, big guy.
Can I resolve the issues related to CVE-31431 and CVE-2026-43284 by following the method described below to disable specific modules? (Question: Is this method applicable only to version 2203 SP4? I am using the 22.03 LTS version—would applying this method pose any risks?)
The method described above is the solution provided in the corresponding security bulletin from the WeChat official account.
Teacher, could you please help me with this question?
The kernels of both 22.03 SP4 and 22.03 LTS are derived from the same source, based on OLK-5.10. The main difference is that 22.03 SP4 is still under official support and continues to receive updates with integrated patches. The official mitigation measures provided are fully applicable to 22.03 LTS, and there are no risks involved.
However, this applies only if the relevant features are available as kernel modules. According to your description, 22.03 LTS has these features compiled directly into the kernel image and not as loadable modules. To make them available as modules, you need to download the corresponding source code, reconfigure, and recompile the kernel. Therefore, the best approach is to download the latest kernel from 22.03 SP4 and install it on your 22.03 LTS system.
After the update, the vulnerability still appears to exist. Teacher, do I need to perform any other operations?
If the openEuler kernel version is 5.10.0-318.0.0.221.oe2203sp4.x86_64, and the official announcement has already stated that the issues are fixed, then there’s nothing wrong and no action is needed. Looking at your screenshot, it seems the corresponding config options are still enabled. However, this doesn’t indicate that the two CVEs are not fixed. The fixes are implemented at the kernel code level, and config settings alone cannot determine whether they are resolved. To verify if the fixes are effective, you could search online for exploit examples targeting these CVEs and test them to see whether the vulnerabilities have been successfully patched.