# OPENSUSE-SU-2025:20091-1: Security update for 12 packages

OPENSUSE-SU-2025:20091-1, released November 26, 2025, fixes 83 CVEs across 12 products. None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/opensuse-su-2025-20091-1
- Platform: Linux
- Released: Nov 26, 2025
- Priority: Urgent (Closes CVE-2025-40000, rated Critical)
- CVEs: 83, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://osv.dev/vulnerability/openSUSE-SU-2025:20091-1

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [dtb-aarch64](https://patchblox.com/security/data/product/linux/dtb-aarch64.md) | opensuse-leap 16.0 | 6.12.0-160000.7.1 |
| [kernel-64kb](https://patchblox.com/security/data/product/linux/kernel-64kb.md) | opensuse-leap 16.0 | 6.12.0-160000.7.1 |
| [kernel-default](https://patchblox.com/security/data/product/linux/kernel-default.md) | opensuse-leap 16.0 | 6.12.0-160000.7.1 |
| [kernel-default-base](https://patchblox.com/security/data/product/linux/kernel-default-base.md) | opensuse-leap 16.0 | 6.12.0-160000.6.1.160000.2.4 |
| [kernel-docs](https://patchblox.com/security/data/product/linux/kernel-docs.md) | opensuse-leap 16.0 | 6.12.0-160000.7.1 |
| [kernel-kvmsmall](https://patchblox.com/security/data/product/linux/kernel-kvmsmall.md) | opensuse-leap 16.0 | 6.12.0-160000.7.1 |
| [kernel-obs-build](https://patchblox.com/security/data/product/linux/kernel-obs-build.md) | opensuse-leap 16.0 | 6.12.0-160000.7.1 |
| [kernel-obs-qa](https://patchblox.com/security/data/product/linux/kernel-obs-qa.md) | opensuse-leap 16.0 | 6.12.0-160000.7.1 |
| [kernel-rt](https://patchblox.com/security/data/product/linux/kernel-rt.md) | opensuse-leap 16.0 | 6.12.0-160000.7.1 |
| [kernel-source](https://patchblox.com/security/data/product/linux/kernel-source.md) | opensuse-leap 16.0 | 6.12.0-160000.7.1 |
| [kernel-syms](https://patchblox.com/security/data/product/linux/kernel-syms.md) | opensuse-leap 16.0 | 6.12.0-160000.7.1 |
| [kernel-zfcpdump](https://patchblox.com/security/data/product/linux/kernel-zfcpdump.md) | opensuse-leap 16.0 | 6.12.0-160000.7.1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2025-40000](https://patchblox.com/security/data/cve/CVE-2025-40000.md) | Urgent | wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() | 9.8 | 0.0027 |  |
| [CVE-2025-39996](https://patchblox.com/security/data/cve/CVE-2025-39996.md) | Urgent | media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove | 9.8 | 0.0023 |  |
| [CVE-2025-39985](https://patchblox.com/security/data/cve/CVE-2025-39985.md) | Urgent | can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow | 9.8 | 0.0018 |  |
| [CVE-2025-39986](https://patchblox.com/security/data/cve/CVE-2025-39986.md) | Urgent | can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow | 9.8 | 0.0018 |  |
| [CVE-2025-39967](https://patchblox.com/security/data/cve/CVE-2025-39967.md) | Urgent | fbcon: fix integer overflow in fbcon_do_set_font | 9.8 | 0.0017 |  |
| [CVE-2025-39994](https://patchblox.com/security/data/cve/CVE-2025-39994.md) | Urgent | media: tuner: xc5000: Fix use-after-free in xc5000_release | 9.8 | 0.0016 |  |
| [CVE-2025-39970](https://patchblox.com/security/data/cve/CVE-2025-39970.md) | Urgent | i40e: fix input validation logic for action_meta | 9.8 | 0.0016 |  |
| [CVE-2025-39971](https://patchblox.com/security/data/cve/CVE-2025-39971.md) | Urgent | i40e: fix idx validation in config queues msg | 9.8 | 0.0016 |  |
| [CVE-2025-39972](https://patchblox.com/security/data/cve/CVE-2025-39972.md) | Urgent | i40e: fix idx validation in i40e_validate_queue_map | 9.8 | 0.0016 |  |
| [CVE-2025-39973](https://patchblox.com/security/data/cve/CVE-2025-39973.md) | Urgent | i40e: add validation for ring_len param | 9.8 | 0.0016 |  |
| [CVE-2025-39978](https://patchblox.com/security/data/cve/CVE-2025-39978.md) | Urgent | octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() | 9.8 | 0.0015 |  |
| [CVE-2025-39968](https://patchblox.com/security/data/cve/CVE-2025-39968.md) | Urgent | i40e: add max boundary check for VF filters | 9.8 | 0.0015 |  |
| [CVE-2025-40048](https://patchblox.com/security/data/cve/CVE-2025-40048.md) | High | uio_hv_generic: Let userspace take care of interrupt mask | 8.4 | 0.0064 |  |
| [CVE-2025-40087](https://patchblox.com/security/data/cve/CVE-2025-40087.md) | High | NFSD: Define a proc_layoutcommit for the FlexFiles layout type | 7.5 | 0.0050 |  |
| [CVE-2025-39702](https://patchblox.com/security/data/cve/CVE-2025-39702.md) | High | ipv6: sr: Fix MAC comparison to be constant-time | 7.1 | 0.0045 |  |
| [CVE-2025-40043](https://patchblox.com/security/data/cve/CVE-2025-40043.md) | High | net: nfc: nci: Add parameter validation for packet data | 8.8 | 0.0031 |  |
| [CVE-2025-39866](https://patchblox.com/security/data/cve/CVE-2025-39866.md) | High | fs: writeback: fix use-after-free in __mark_inode_dirty() | 7.8 | 0.0031 |  |
| [CVE-2025-40364](https://patchblox.com/security/data/cve/CVE-2025-40364.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0029 |  |
| [CVE-2025-40019](https://patchblox.com/security/data/cve/CVE-2025-40019.md) | High | crypto: essiv - Check ssize for decryption and in-place encryption | 7.0 | 0.0029 |  |
| [CVE-2025-39982](https://patchblox.com/security/data/cve/CVE-2025-39982.md) | High | Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync | 8.8 | 0.0028 |  |
| [CVE-2025-40009](https://patchblox.com/security/data/cve/CVE-2025-40009.md) | High | kernel-64kb: Security update for the Linux Kernel | n/a | 0.0024 |  |
| [CVE-2025-39995](https://patchblox.com/security/data/cve/CVE-2025-39995.md) | High | media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe | 7.1 | 0.0023 |  |
| [CVE-2025-40035](https://patchblox.com/security/data/cve/CVE-2025-40035.md) | High | Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak | 7.1 | 0.0023 |  |
| [CVE-2025-40036](https://patchblox.com/security/data/cve/CVE-2025-40036.md) | High | misc: fastrpc: fix possible map leak in fastrpc_put_args | 7.1 | 0.0021 |  |
| [CVE-2025-40052](https://patchblox.com/security/data/cve/CVE-2025-40052.md) | High | smb: client: fix crypto buffers in non-linear memory | 7.1 | 0.0021 |  |
| [CVE-2025-40020](https://patchblox.com/security/data/cve/CVE-2025-40020.md) | High | can: peak_usb: fix shift-out-of-bounds issue | 7.1 | 0.0021 |  |
| [CVE-2025-39965](https://patchblox.com/security/data/cve/CVE-2025-39965.md) | High | xfrm: xfrm_alloc_spi shouldn't use 0 as SPI | 7.8 | 0.0020 |  |
| [CVE-2025-39992](https://patchblox.com/security/data/cve/CVE-2025-39992.md) | High | kernel-64kb: mm: swap: check for stable address space before operating on the VMA (bsc#1252076). | n/a | 0.0020 |  |
| [CVE-2025-40012](https://patchblox.com/security/data/cve/CVE-2025-40012.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  net/smc: fix warning in smc_rx_splice() when cal... | 7.8 | 0.0020 |  |
| [CVE-2025-39984](https://patchblox.com/security/data/cve/CVE-2025-39984.md) | High | kernel-64kb: net: tun: Update napi->skb after XDP process (bsc#1252081). | 7.8 | 0.0020 |  |
| [CVE-2025-39987](https://patchblox.com/security/data/cve/CVE-2025-39987.md) | High | can: hi311x: populate ndo_change_mtu() to prevent buffer overflow | 7.8 | 0.0018 |  |
| [CVE-2025-39988](https://patchblox.com/security/data/cve/CVE-2025-39988.md) | High | can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow | 7.8 | 0.0018 |  |
| [CVE-2025-38653](https://patchblox.com/security/data/cve/CVE-2025-38653.md) | High | proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al | 7.8 | 0.0018 |  |
| [CVE-2025-40044](https://patchblox.com/security/data/cve/CVE-2025-40044.md) | High | fs: udf: fix OOB read in lengthAllocDescs handling | 7.8 | 0.0017 |  |
| [CVE-2025-38718](https://patchblox.com/security/data/cve/CVE-2025-38718.md) | High | sctp: linearize cloned gso packets in sctp_rcv | 7.8 | 0.0017 |  |
| [CVE-2025-39955](https://patchblox.com/security/data/cve/CVE-2025-39955.md) | High | tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). | 7.8 | 0.0017 |  |
| [CVE-2025-40051](https://patchblox.com/security/data/cve/CVE-2025-40051.md) | High | vhost: vringh: Modify the return value check | 7.8 | 0.0017 |  |
| [CVE-2025-40058](https://patchblox.com/security/data/cve/CVE-2025-40058.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  iommu/vt-d: Disallow dirty tracking if incoheren... | 8.8 | 0.0016 |  |
| [CVE-2025-39911](https://patchblox.com/security/data/cve/CVE-2025-39911.md) | High | i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path | 7.8 | 0.0016 |  |
| [CVE-2025-39797](https://patchblox.com/security/data/cve/CVE-2025-39797.md) | High | xfrm: Duplicate SPI Handling | 7.8 | 0.0016 |  |
| [CVE-2025-39993](https://patchblox.com/security/data/cve/CVE-2025-39993.md) | High | media: rc: fix races with imon_disconnect() | 7.8 | 0.0016 |  |
| [CVE-2025-39969](https://patchblox.com/security/data/cve/CVE-2025-39969.md) | High | i40e: fix validation of VF state in get resources | 8.8 | 0.0016 |  |
| [CVE-2025-39949](https://patchblox.com/security/data/cve/CVE-2025-39949.md) | High | qed: Don't collect too many protection override GRC elements | 7.0 | 0.0016 |  |
| [CVE-2025-39963](https://patchblox.com/security/data/cve/CVE-2025-39963.md) | High | kernel-64kb: io_uring: fix incorrect io_kiocb reference in io_link_skb (bsc#1251819). | 7.8 | 0.0016 |  |
| [CVE-2025-39881](https://patchblox.com/security/data/cve/CVE-2025-39881.md) | High | kernfs: Fix UAF in polling when open file is released | 7.8 | 0.0015 |  |
| [CVE-2025-40096](https://patchblox.com/security/data/cve/CVE-2025-40096.md) | High | drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies | 7.8 | 0.0015 |  |
| [CVE-2025-39981](https://patchblox.com/security/data/cve/CVE-2025-39981.md) | High | Bluetooth: MGMT: Fix possible UAFs | 7.8 | 0.0015 |  |
| [CVE-2025-40104](https://patchblox.com/security/data/cve/CVE-2025-40104.md) | High | ixgbevf: fix mailbox API compatibility by negotiating supported features | 7.8 | 0.0015 |  |
| [CVE-2025-40018](https://patchblox.com/security/data/cve/CVE-2025-40018.md) | High | ipvs: Defer ip_vs_ftp unregister during netns cleanup | 7.8 | 0.0015 |  |
| [CVE-2025-40061](https://patchblox.com/security/data/cve/CVE-2025-40061.md) | High | RDMA/rxe: Fix race in do_task() when draining | 7.8 | 0.0015 |  |
| [CVE-2025-39979](https://patchblox.com/security/data/cve/CVE-2025-39979.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  net/mlx5: fs, fix UAF in flow counter release  F... | 7.8 | 0.0015 |  |
| [CVE-2025-39903](https://patchblox.com/security/data/cve/CVE-2025-39903.md) | High | kernel-64kb: of_numa: fix uninitialized memory nodes causing kernel panic (bsc#1250749). | 7.3 | 0.0015 |  |
| [CVE-2025-39948](https://patchblox.com/security/data/cve/CVE-2025-39948.md) | Routine | kernel-64kb: ice: fix Rx page leak on multi-buffer frames (bsc#1251233). | 6.4 | 0.0040 |  |
| [CVE-2025-40040](https://patchblox.com/security/data/cve/CVE-2025-40040.md) | Routine | mm/ksm: fix flag-dropping behavior in ksm_madvise | 5.8 | 0.0038 |  |
| [CVE-2025-40011](https://patchblox.com/security/data/cve/CVE-2025-40011.md) | Routine | drm/gma500: Fix null dereference in hdmi teardown | 5.5 | 0.0026 |  |
| [CVE-2025-40016](https://patchblox.com/security/data/cve/CVE-2025-40016.md) | Routine | media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID | 6.2 | 0.0025 |  |
| [CVE-2025-40013](https://patchblox.com/security/data/cve/CVE-2025-40013.md) | Routine | ASoC: qcom: audioreach: fix potential null pointer dereference | 5.5 | 0.0025 |  |
| [CVE-2025-40078](https://patchblox.com/security/data/cve/CVE-2025-40078.md) | Routine | bpf: Explicitly check accesses to bpf_sock_addr | 5.5 | 0.0025 |  |
| [CVE-2025-40049](https://patchblox.com/security/data/cve/CVE-2025-40049.md) | Routine | Squashfs: fix uninit-value in squashfs_get_parent | 5.5 | 0.0023 |  |
| [CVE-2025-40029](https://patchblox.com/security/data/cve/CVE-2025-40029.md) | Routine | bus: fsl-mc: Check return value of platform_get_resource() | 5.5 | 0.0022 |  |
| [CVE-2025-40060](https://patchblox.com/security/data/cve/CVE-2025-40060.md) | Routine | coresight: trbe: Return NULL pointer for allocation failures | 5.5 | 0.0022 |  |
| [CVE-2025-40032](https://patchblox.com/security/data/cve/CVE-2025-40032.md) | Routine | PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release | 5.5 | 0.0021 |  |
| [CVE-2025-40056](https://patchblox.com/security/data/cve/CVE-2025-40056.md) | Routine | vhost: vringh: Fix copy_to_iter return value check | 5.5 | 0.0021 |  |
| [CVE-2025-40037](https://patchblox.com/security/data/cve/CVE-2025-40037.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0021 |  |
| [CVE-2025-39997](https://patchblox.com/security/data/cve/CVE-2025-39997.md) | Routine | kernel-64kb: Security update for the Linux Kernel | n/a | 0.0021 |  |
| [CVE-2025-40080](https://patchblox.com/security/data/cve/CVE-2025-40080.md) | Routine | nbd: restrict sockets to TCP and UDP | 6.1 | 0.0021 |  |
| [CVE-2025-21816](https://patchblox.com/security/data/cve/CVE-2025-21816.md) | Routine | kernel-64kb: hrtimers: Force migrate away hrtimers queued after (bsc#1238472). | 5.5 | 0.0021 |  |
| [CVE-2025-40085](https://patchblox.com/security/data/cve/CVE-2025-40085.md) | Routine | ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card | 5.8 | 0.0021 |  |
| [CVE-2025-40005](https://patchblox.com/security/data/cve/CVE-2025-40005.md) | Routine | spi: cadence-quadspi: Implement refcount to handle unbind during busy | 6.6 | 0.0020 |  |
| [CVE-2025-40071](https://patchblox.com/security/data/cve/CVE-2025-40071.md) | Routine | tty: n_gsm: Don't block input queue by waiting MSC | 6.1 | 0.0020 |  |
| [CVE-2025-39991](https://patchblox.com/security/data/cve/CVE-2025-39991.md) | Routine | kernel-64kb: Security update for the Linux Kernel | n/a | 0.0020 |  |
| [CVE-2025-40100](https://patchblox.com/security/data/cve/CVE-2025-40100.md) | Routine | btrfs: do not assert we found block group item when creating free space tree | 5.5 | 0.0020 |  |
| [CVE-2025-40062](https://patchblox.com/security/data/cve/CVE-2025-40062.md) | Routine | kernel-64kb: Security update for the Linux Kernel | n/a | 0.0020 |  |
| [CVE-2025-39756](https://patchblox.com/security/data/cve/CVE-2025-39756.md) | Routine | fs: Prevent file descriptor table allocations exceeding INT_MAX | 5.5 | 0.0019 |  |
| [CVE-2025-40091](https://patchblox.com/security/data/cve/CVE-2025-40091.md) | Routine | kernel-64kb: Security update for the Linux Kernel | n/a | 0.0018 |  |
| [CVE-2025-39676](https://patchblox.com/security/data/cve/CVE-2025-39676.md) | Routine | scsi: qla4xxx: Prevent a potential error pointer dereference | 5.5 | 0.0018 |  |
| [CVE-2025-39812](https://patchblox.com/security/data/cve/CVE-2025-39812.md) | Routine | sctp: initialize more fields in sctp_v6_from_sk() | 5.5 | 0.0018 |  |
| [CVE-2025-39956](https://patchblox.com/security/data/cve/CVE-2025-39956.md) | Routine | kernel-64kb: igc: don't fail igc_probe() on LED setup error (bsc#1251809). | 5.5 | 0.0017 |  |
| [CVE-2025-39779](https://patchblox.com/security/data/cve/CVE-2025-39779.md) | Routine | btrfs: subpage: keep TOWRITE tag until folio is cleaned | 5.5 | 0.0016 |  |
| [CVE-2025-39876](https://patchblox.com/security/data/cve/CVE-2025-39876.md) | Routine | net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() | 5.5 | 0.0015 |  |
| [CVE-2025-39950](https://patchblox.com/security/data/cve/CVE-2025-39950.md) | Routine | kernel-64kb: net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (bsc#1251176). | 5.5 | 0.0015 |  |
| [CVE-2025-39895](https://patchblox.com/security/data/cve/CVE-2025-39895.md) | Routine | sched: Fix sched_numa_find_nth_cpu() if mask offline | 5.5 | 0.0015 |  |
| [CVE-2025-39947](https://patchblox.com/security/data/cve/CVE-2025-39947.md) | Routine | net/mlx5e: Harden uplink netdev access against device unbind | 5.5 | 0.0015 |  |

---

Data as of 2026-11-11T13:47:35Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.