SUSE Linux Enterprise and openSUSE: security patches

Updated November 2026

On SUSE Linux Enterprise Server (SLES) and openSUSE Leap, security fixes arrive as patches, and zypper patch --category security installs them. openSUSE Tumbleweed is different: it is a rolling release and is updated with zypper dup.

Supported releases

These dates come from SUSE’s lifecycle page and openSUSE announcements, as of November 2026. “General” support means normal updates for everyone with a subscription. After that, a service pack only gets fixes through Long Term Service Pack Support (LTSS), a paid add-on (SUSE calls the extended phase “LTS” for SLES 16).

SUSE Linux Enterprise Server and openSUSE support, as of November 2026
Release	General support ends	Extended support ends (LTSS/LTS)
SLES 16.0 (released 4 Nov 2025)	30 Nov 2027	30 Nov 2030
SLES 16.1 (scheduled Nov 2026)	30 Nov 2028	30 Nov 2031
SLES 15 SP7	31 Jul 2031	31 Jul 2034
SLES 15 SP6	Ended 31 Dec 2025	31 Dec 2028
SLES 15 SP5	Ended 31 Dec 2024	31 Dec 2027
SLES 15 SP4	Ended 31 Dec 2023	31 Dec 2026
SLES 12 SP5	Ended 31 Oct 2024	31 Oct 2027
openSUSE Leap 16.0 (Oct 2025)	24 months of community support per point release	None
openSUSE Leap 15.6	Ended 30 Apr 2026	None
openSUSE Tumbleweed	Rolling; supported only when fully updated	None

So if you run SLES 15 SP4 without LTSS, you have had no fixes since the end of 2023. With LTSS, you still have to move before 31 December 2026.

Check your release

cat /etc/os-release
zypper lifecycle

zypper lifecycle (SLES) lists end-of-support dates for your installed products. SLES only receives updates while it is registered with an active subscription.

Apply security updates now

Refresh the repositories, see what is pending, then install. All commands need root.

sudo zypper refresh
sudo zypper patch-check
sudo zypper lp --category security
sudo zypper patch --category security

zypper lp is short for list-patches. patch-check also reports through its exit code: 100 means patches are available, 101 means security patches are available. To install every needed patch (security and bug fixes), run plain sudo zypper patch.

Useful filters:

sudo zypper lp --category security --severity critical,important
sudo zypper lp --cve=CVE-2024-6387
sudo zypper patch --cve=CVE-2024-6387

Run it twice if asked. When a patch updates zypper or its libraries (the “update stack”), zypper installs that first and asks you to run the command again. In scripts this shows up as exit code 103.

openSUSE Tumbleweed

Tumbleweed makes no distinction between updating and upgrading. openSUSE’s documentation says to update with:

sudo zypper dup

Run it often. A Tumbleweed system that has not been updated for weeks is missing fixes, and there is no separate security channel to fall back on.

Automatic updates

There is no single built-in “unattended upgrades” switch for every SUSE edition. A common approach is a systemd timer, cron job or configuration-management task that runs:

zypper --non-interactive patch --category security --with-interactive

Run it as root. In non-interactive mode zypper normally skips “interactive” patches: those that need a reboot (kernel updates, for example), show a message, or need a license accepted. --with-interactive stops that skipping, so kernel fixes are installed too; you still choose when to reboot. Afterwards check the exit code or run zypper patch-check to confirm nothing is still waiting. The zypper manual also suggests --skip-not-applicable-patches for unattended runs, so one conflicting patch does not block all the others. For large fleets, SUSE sells central management tools (SUSE Multi-Linux Manager). Immutable variants such as SUSE Linux Micro and openSUSE Leap Micro use transactional updates instead; follow their own documentation.

Restart services and reboot

Updated libraries stay loaded in running programs until those programs restart. zypper can tell you what still uses deleted files:

sudo zypper ps -s
sudo zypper ps -sss
sudo zypper needs-rebooting

zypper ps -s shows processes without the file list. -sss prints only the systemd service names, so you know what to restart with sudo systemctl restart name (this briefly interrupts the service). needs-rebooting returns exit code 102 when a reboot is suggested, for example after a kernel or glibc update. Plan that reboot; it restarts the machine.

Kernel updates and live patching

A new kernel package does nothing until you reboot into it. SUSE’s Kernel Live Patching (KLP) applies critical kernel fixes to the running kernel. For SLES 16, SUSE’s documentation says KLP is included in the standard subscription. Enable it with:

sudo zypper install -t pattern kernel_livepatching
sudo klp status
sudo klp -v patches

Live patches then arrive with normal zypper patch runs. Each live patch gets updates for 13 months from the release of the kernel package it applies to. SUSE states that live patches contain only critical fixes and do not replace regular kernel updates, which need a reboot. Use live patching to buy time, then reboot into the new kernel in your next maintenance window. See our live patching guide.

Where SUSE publishes advisories

SUSE Update Advisories: searchable list of security (SUSE-SU) and other updates, filterable by severity.
SUSE CVE database: status of each CVE for SLES, openSUSE Leap and Tumbleweed, with fixed package versions.
Mailing list sle-security-updates: security announcements by email.
Machine-readable data in OVAL and CSAF formats, for scanners.

On an end-of-life release

SLES service pack past general support: buy LTSS for it, or move to a supported service pack with zypper migration.
SLES 15 to 16: SUSE supports upgrades to SLES 16.0 only from SLES 15 SP7. Run zypper patch first, then follow SUSE’s upgrade guide (it uses the Distribution Migration System and reboots the machine).
openSUSE Leap 15.6: it gets no fixes since 30 April 2026. Upgrade to Leap 16 with the openSUSE migration tool, or move to SLES if you need longer support.
Until you move, limit exposure: close unused ports, restrict SSH, and watch the SUSE CVE database for issues that affect you.

For more on running old systems safely, see what to do with end-of-life systems.