OPENSUSE-SU-2026:20416-1: Security update for 13 packages

OPENSUSE-SU-2026:20416-1, released March 25, 2026, fixes 175 CVEs across 13 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent

CVEs closed

175

1 rated Critical

Exploited

None reported

Highest CVSS

9.8

Base score, 0 to 10

Highest EPSS

0.0113

66th percentile

Priority of the 175 CVEs

Patch now 0
                                Urgent 1
                                High 63
                                Routine 111

Fixed package versions

Product	Release	Fixed in
dtb-aarch64	opensuse-leap 16.0	6.12.0-160000.27.1
kernel-64kb	opensuse-leap 16.0	6.12.0-160000.27.1
kernel-azure	opensuse-leap 16.0	6.12.0-160000.27.1
kernel-default	opensuse-leap 16.0	6.12.0-160000.27.1
kernel-default-base	opensuse-leap 16.0	6.12.0-160000.27.1.160000.2.8
kernel-docs	opensuse-leap 16.0	6.12.0-160000.27.1
kernel-kvmsmall	opensuse-leap 16.0	6.12.0-160000.27.1
kernel-obs-build	opensuse-leap 16.0	6.12.0-160000.27.1
kernel-obs-qa	opensuse-leap 16.0	6.12.0-160000.27.1
kernel-rt	opensuse-leap 16.0	6.12.0-160000.27.1
kernel-source	opensuse-leap 16.0	6.12.0-160000.27.1
kernel-syms	opensuse-leap 16.0	6.12.0-160000.27.1
kernel-zfcpdump	opensuse-leap 16.0	6.12.0-160000.27.1

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
Urgent	CVE-2025-68745	linux: In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Clear cmds after chip reset Comm...	9.8	0.0050	None reported
High	CVE-2026-23111	kernel-64kb: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (bsc#1258181).	7.8	0.0113	None reported
High	CVE-2026-22998	kernel-64kb: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (bsc#1257209).	7.5	0.0078	None reported
High	CVE-2026-23003	kernel-64kb: geneve: Fix incorrect inner network header offset when innerprotoinherit is set (bsc#1257246).	8.8	0.0055	None reported
High	CVE-2026-23112	kernel-64kb: Security update for the Linux Kernel	9.8	0.0048	None reported
High	CVE-2025-40099	cifs: parse_dfs_referrals: prevent oob on malformed input	9.4	0.0041	None reported
High	CVE-2026-23139	kernel-64kb: netfilter: nf_conncount: update last_gc only when GC has been performed (bsc#1258304).	7.6	0.0039	None reported
High	CVE-2025-71236	scsi: qla2xxx: Validate sp before freeing associated memory	7.8	0.0038	None reported
High	CVE-2025-68818	scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path"	8.8	0.0033	None reported
High	CVE-2026-23230	smb: client: split cached_fid bitfields to avoid shared-byte RMW races	8.4	0.0028	None reported
High	CVE-2025-71197	kernel-64kb: Security update for the Linux Kernel	n/a	0.0026	None reported
High	CVE-2026-23136	kernel-livepatch-SLE15-SP7-RT_Update_11: libceph: reset sparse-read state in osd_fault() (bsc#1258303).	8.1	0.0025	None reported
High	CVE-2026-23030	kernel-livepatch-SLE15-SP7-RT_Update_11: phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (bsc#1257561).	n/a	0.0024	None reported
High	CVE-2025-71234	wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add	7.8	0.0024	None reported
High	CVE-2026-23056	kernel-64kb: Security update for the Linux Kernel	n/a	0.0021	None reported
High	CVE-2026-23054	kernel-64kb: Security update for the Linux Kernel	7.0	0.0021	None reported
High	CVE-2026-23049	kernel-64kb: Security update for the Linux Kernel	n/a	0.0021	None reported
High	CVE-2026-23176	kernel-64kb: Security update for the Linux Kernel	n/a	0.0021	None reported
High	CVE-2026-23182	kernel-64kb: Security update for the Linux Kernel	n/a	0.0021	None reported
High	CVE-2025-40103	smb: client: Fix refcount leak for cifs_sb_tlink	7.1	0.0021	None reported
High	CVE-2026-23172	kernel-64kb: Security update for the Linux Kernel	8.8	0.0020	None reported
High	CVE-2026-23050	kernel-64kb: Security update for the Linux Kernel	7.0	0.0020	None reported
High	CVE-2026-23010	kernel-64kb: ipv6: Fix use-after-free in inet6_addr_del() (bsc#1257332).	7.8	0.0020	None reported
High	CVE-2025-68371	kernel-64kb: scsi: smartpqi: Fix device resources accessed after device removal (bsc#1255572).	7.0	0.0020	None reported
High	CVE-2025-68186	kernel-64kb: ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (bsc#1255144).	n/a	0.0020	None reported

Also fixes CVE-2025-68745

SUSE-SU-2026:20931-1
kernel-64kb, kernel-azure, kernel-default and 7 more on sles 16.0
RHSA-2026:67150
kernel, kernel-64k, kernel-64k-core and 69 more on RHEL 9
RLSA-2026:67150
kernel on rocky 9
ALSA-2026:67150
kernel, kernel-64k, kernel-64k-core and 71 more on almalinux 9
ELSA-2026-67150-0
kernel, kernel-abi-stablelists, kernel-core and 26 more on ol 9
RHSA-2026:88687
kernel on RHEL 10
RLSA-2026:67471
kernel on rocky 10
ALSA-2026:67471
kernel, kernel-64k, kernel-64k-core and 72 more on almalinux 10

Vendor advisory

https://osv.dev/vulnerability/openSUSE-SU-2026:20416-1

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/linux/opensuse-su-2026-20416-1">OPENSUSE-SU-2026:20416-1 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.