OPENSUSE-SU-2026:21388-1: Security update for 13 packages

OPENSUSE-SU-2026:21388-1, released July 21, 2026, fixes 252 CVEs across 13 products. 2 of them are being exploited (CVE-2026-53266); 2 on CISA KEV. Patch Radar priority: Patch now.

Patch now2 on CISA KEV

CVEs closed

252

12 rated Critical

Exploited

CVE-2026-53266

Highest CVSS

9.8

Base score, 0 to 10

Highest EPSS

0.9419

99th percentile

Priority of the 252 CVEs

Patch now 2
                                Urgent 12
                                High 145
                                Routine 93

Fixed package versions

Product	Release	Fixed in
dtb-aarch64	opensuse-leap 16.0	6.12.0-160000.36.1
kernel-64kb	opensuse-leap 16.0	6.12.0-160000.36.1
kernel-azure	opensuse-leap 16.0	6.12.0-160000.36.1
kernel-default	opensuse-leap 16.0	6.12.0-160000.36.1
kernel-default-base	opensuse-leap 16.0	6.12.0-160000.36.1.160000.2.17
kernel-docs	opensuse-leap 16.0	6.12.0-160000.36.1
kernel-kvmsmall	opensuse-leap 16.0	6.12.0-160000.36.1
kernel-obs-build	opensuse-leap 16.0	6.12.0-160000.36.1
kernel-obs-qa	opensuse-leap 16.0	6.12.0-160000.36.1
kernel-rt	opensuse-leap 16.0	6.12.0-160000.36.1
kernel-source	opensuse-leap 16.0	6.12.0-160000.36.1
kernel-syms	opensuse-leap 16.0	6.12.0-160000.36.1
kernel-zfcpdump	opensuse-leap 16.0	6.12.0-160000.36.1

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
Patch now	CVE-2026-53266	netfilter: bridge: make ebt_snat ARP rewrite writable	8.8	0.0093	KEVExploited
Patch now	CVE-2026-53362	ipv6: account for fraggap on the paged allocation path	7.8	0.0071	KEVExploited
Urgent	CVE-2025-10263	ARM: CVE-2025-10263 Completion of affected memory accesses might not be guaranteed by completion of a TLBI [kernel]	9.3	0.0054	Exploitation Less Likely
Urgent	CVE-2026-43465	kernel-64kb: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (bsc#1264997).	9.8	0.0054	None reported
Urgent	CVE-2026-46266	kernel-default: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (bsc#1267684).	9.1	0.0047	None reported
Urgent	CVE-2026-43384	kernel-64kb: net/tcp-ao: Fix MAC comparison to be constant-time (bsc#1265097).	9.8	0.0046	None reported
Urgent	CVE-2026-52993	tipc: fix double-free in tipc_buf_append()	9.8	0.0040	None reported
Urgent	CVE-2026-52955	kernel-default: libceph: Fix potential out-of-bounds access in crush_decode() (bsc#1269159).	9.8	0.0038	None reported
Urgent	CVE-2026-53086	net: bcmgenet: fix racing timeout handler	9.8	0.0030	None reported
Urgent	CVE-2026-53075	ppp: require CAP_NET_ADMIN in target netns for unattached ioctls	9.8	0.0027	None reported
Urgent	CVE-2026-45899	ext4: drop extent cache when splitting extent fails	9.8	0.0016	None reported
Urgent	CVE-2026-53036	bpf, arm64: Fix off-by-one in check_imm signed range check	9.8	0.0014	None reported
Urgent	CVE-2026-53053	iommu/amd: Fix clone_alias() to use the original device's devid	9.8	0.0013	None reported
Urgent	CVE-2026-52919	batman-adv: fix tp_meter counter underflow during shutdown	9.8	0.0012	None reported
High	CVE-2026-43284	xfrm: esp: avoid in-place decrypt on shared skb frags	8.8	0.9419	None reported
High	CVE-2026-46242	kernel-default: eventpoll: Fix integer overflow in ep_loop_check_proc() (bsc#1267618).	7.8	0.0458	None reported
High	CVE-2026-53176	IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN	9.8	0.0076	None reported
High	CVE-2026-52924	sctp: purge outqueue on stale COOKIE-ECHO handling	9.8	0.0066	None reported
High	CVE-2026-43407	kernel-64kb: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (bsc#1265020).	9.1	0.0066	None reported
High	CVE-2026-46331	net/sched: fix pedit partial COW leading to page cache corruption	8.1	0.0064	None reported
High	CVE-2026-43406	kernel-64kb: libceph: prevent potential out-of-bounds reads in process_message_header() (bsc#1265073).	9.1	0.0061	None reported
High	CVE-2026-43083	net: ioam6: fix OOB and missing lock	9.1	0.0060	None reported
High	CVE-2026-43405	kernel-64kb: libceph: Use u32 for non-negative values in ceph_monmap_decode() (bsc#1264741).	7.5	0.0060	None reported
High	CVE-2026-43101	ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()	7.5	0.0059	None reported
High	CVE-2026-31414	netfilter: nf_conntrack_expect: use expect->helper	9.8	0.0058	None reported

Also fixes CVE-2026-53266

SUSE-SU-2026:22835-1
kernel-64kb, kernel-azure, kernel-default and 7 more on sles 16.0
SUSE-SU-2026:2799-1
kernel-livepatch-SLE15-SP7-RT_Update_17 on sles 15.7
SUSE-SU-2026:2800-1
kernel-64kb, kernel-azure, kernel-default and 7 more on sles 15.7
RHSA-2026:71326
kernel on RHEL 10
RHSA-2026:39082
kernel-rt, kernel-rt-core, kernel-rt-debug and 9 more on RHEL 8
RHSA-2026:39083
bpftool, kernel, kernel-abi-stablelists and 20 more on RHEL 8
ALSA-2026:39082
kernel-rt, kernel-rt-core, kernel-rt-debug and 7 more on almalinux 8
ALSA-2026:39083
bpftool, kernel, kernel-abi-stablelists and 22 more on almalinux 8

Vendor advisory

https://osv.dev/vulnerability/openSUSE-SU-2026:21388-1

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/linux/opensuse-su-2026-21388-1">OPENSUSE-SU-2026:21388-1 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.