OPENSUSE-SU-2026:20965-1: Security update for 13 packages

OPENSUSE-SU-2026:20965-1, released June 15, 2026, fixes 60 CVEs across 13 products. None of them is reported as exploited. Patch Radar priority: High.

High

CVEs closed

None rated Critical

Exploited

None reported

Highest CVSS

9.8

Base score, 0 to 10

Highest EPSS

0.0058

48th percentile

Priority of the 60 CVEs

Patch now 0
                                Urgent 0
                                High 39
                                Routine 21

Fixed package versions

Product	Release	Fixed in
dtb-aarch64	opensuse-leap 16.0	6.12.0-160000.35.1
kernel-64kb	opensuse-leap 16.0	6.12.0-160000.35.1
kernel-azure	opensuse-leap 16.0	6.12.0-160000.35.1
kernel-default	opensuse-leap 16.0	6.12.0-160000.35.1
kernel-default-base	opensuse-leap 16.0	6.12.0-160000.35.1.160000.2.16
kernel-docs	opensuse-leap 16.0	6.12.0-160000.35.1
kernel-kvmsmall	opensuse-leap 16.0	6.12.0-160000.35.1
kernel-obs-build	opensuse-leap 16.0	6.12.0-160000.35.1
kernel-obs-qa	opensuse-leap 16.0	6.12.0-160000.35.1
kernel-rt	opensuse-leap 16.0	6.12.0-160000.35.1
kernel-source	opensuse-leap 16.0	6.12.0-160000.35.1
kernel-syms	opensuse-leap 16.0	6.12.0-160000.35.1
kernel-zfcpdump	opensuse-leap 16.0	6.12.0-160000.35.1

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
High	CVE-2026-43197	netconsole: avoid OOB reads, msg is not nul-terminated	9.1	0.0058	None reported
High	CVE-2026-45898	kernel-64kb: RDMA/iwcm: Fix workqueue list corruption by removing work_list (bsc#1266888).	9.8	0.0053	None reported
High	CVE-2026-46043	RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv	9.1	0.0051	None reported
High	CVE-2026-31448	ext4: avoid infinite loops caused by residual data	9.4	0.0050	None reported
High	CVE-2026-46114	RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads	8.8	0.0047	None reported
High	CVE-2026-43184	kernel-64kb: rnbd-srv: Zero the rsp buffer before using it (bsc#1264622).	7.5	0.0044	None reported
High	CVE-2026-46316	kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969]	9.3	0.0034	None reported
High	CVE-2026-45852	kernel-default: RDMA/rxe: Fix double free in rxe_srq_from_init (bsc#1266711).	8.8	0.0020	None reported
High	CVE-2026-45856	kernel-64kb: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (bsc#1266720).	8.8	0.0019	None reported
High	CVE-2026-45984	kernel-default: gfs2: Move the inode glock locking to gfs2_file_buffered_write (bsc#1267214).	7.8	0.0018	None reported
High	CVE-2026-45932	bpf: Fix tcx/netkit detach permissions when prog fd isn't given	7.3	0.0017	None reported
High	CVE-2026-23327	cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()	7.1	0.0017	None reported
High	CVE-2026-43332	kernel-doc: kernel: thermal: core: Fix thermal zone device registration error path	7.8	0.0016	None reported
High	CVE-2026-45886	kernel-default: bpf: Fix bpf_xdp_store_bytes proto for read-only arg (bsc#1266810).	7.0	0.0016	None reported
High	CVE-2026-46181	RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()	8.8	0.0014	None reported
High	CVE-2026-46176	RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()	7.8	0.0014	None reported
High	CVE-2026-46021	thermal: core: Fix thermal zone governor cleanup issues	7.0	0.0014	None reported
High	CVE-2026-31446	ext4: fix use-after-free in update_super_work when racing with umount	7.8	0.0014	None reported
High	CVE-2026-43150	kernel-64kb: perf/arm-cmn: Ensure dtm_idx is big enough (bsc#1264415).	7.8	0.0014	None reported
High	CVE-2026-31401	kernel-64kb: HID: bpf: prevent buffer overflow in hid_hw_request (bsc#1261603).	7.8	0.0014	None reported
High	CVE-2026-43030	kernel-64kb: bpf: Fix regsafe() for pointers to packet (bsc#1264000).	7.8	0.0014	None reported
High	CVE-2026-31518	esp: fix skb leak with espintcp and async crypto	7.1	0.0013	None reported
High	CVE-2026-43040	kernel-64kb: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-	7.1	0.0013	None reported
High	CVE-2026-45942	ext4: fix e4b bitmap inconsistency reports	8.8	0.0013	None reported
High	CVE-2026-31396	kernel-64kb: net: macb: fix use-after-free access to PTP clock (bsc#1261791).	7.8	0.0013	None reported

Also fixes CVE-2026-43197

ELSA-2026-500248
kernel-uek, kernel-uek-core, kernel-uek-debug and 32 more on ol 10, ol 9
SUSE-SU-2026:22127-1
kernel-64kb, kernel-azure, kernel-default and 7 more on sles 16.0
DEBIAN-CVE-2026-43197
linux, linux-6.12 on Debian 12.15 (bookworm), Debian 13.5 (trixie), Debian 14

Vendor advisory

https://osv.dev/vulnerability/openSUSE-SU-2026:20965-1

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/linux/opensuse-su-2026-20965-1">OPENSUSE-SU-2026:20965-1 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.