Linux · SUSE Linux Enterprise · Security advisory · August 11, 2026
SUSE-SU-2026:23237-1: kernel-default security update
SUSE-SU-2026:23237-1, released August 11, 2026, fixes 891 CVEs in kernel-default (version 6.12.0-160000.37.1). 2 of them are being exploited (CVE-2026-31431); 2 on CISA KEV. Patch Radar priority: Patch now.
Patch now2 on CISA KEV
CVEs closed
891
26 rated Critical
Exploited
2
CVE-2026-31431
Highest CVSS
10.0
Base score, 0 to 10
Highest EPSS
0.9811
99th percentile
Priority of the 891 CVEs
Patch now 2
Urgent 26
High 457
Routine 406
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| kernel-default | sles 16.0 | 6.12.0-160000.37.1 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Patch now | CVE-2026-31431 | crypto: algif_aead - Revert to operating out-of-place | 8.1 | 0.9811 | KEVExploited |
| Patch now | CVE-2025-39964 | crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg | 8.8 | 0.0161 | KEVExploited |
| Urgent | CVE-2026-64564 | sctp: don't free the ASCONF's own transport in DEL-IP processing | 9.8 | 0.0143 | None reported |
| Urgent | CVE-2026-43011 | kernel-64kb: Security update for the Linux Kernel | 9.8 | 0.0059 | None reported |
| Urgent | CVE-2026-53224 | kernel-default: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997). | 9.1 | 0.0057 | None reported |
| Urgent | CVE-2026-52982 | kernel-64kb: Security update for the Linux Kernel | 9.8 | 0.0054 | None reported |
| Urgent | CVE-2026-53045 | kernel-64kb: Security update for the Linux Kernel | 9.8 | 0.0051 | None reported |
| Urgent | CVE-2026-64061 | kernel-64kb: netfs: Fix early put of sink folio in netfs_read_gaps() (bsc#1272505). | 9.8 | 0.0047 | None reported |
| Urgent | CVE-2026-52922 | batman-adv: dat: handle forward allocation error | 9.8 | 0.0039 | None reported |
| Urgent | CVE-2026-64025 | kernel-64kb: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx (bsc#1273117). | 9.8 | 0.0037 | None reported |
| Urgent | CVE-2026-53002 | netfilter: conntrack: remove sprintf usage | 9.8 | 0.0037 | None reported |
| Urgent | CVE-2026-52989 | nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers | 9.8 | 0.0036 | None reported |
| Urgent | CVE-2026-63974 | Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close | 9.8 | 0.0035 | None reported |
| Urgent | CVE-2026-53260 | linux: In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in re... | 9.8 | 0.0029 | None reported |
| Urgent | CVE-2026-52934 | batman-adv: tvlv: reject oversized TVLV packets | 9.8 | 0.0024 | None reported |
| Urgent | CVE-2026-63882 | drm/amdkfd: fix NULL pointer bug in svm_range_set_attr | 9.8 | 0.0022 | None reported |
| Urgent | CVE-2026-53009 | ice: fix double-free of tx_buf skb | 9.8 | 0.0018 | None reported |
| Urgent | CVE-2026-63824 | KEYS: fix overflow in keyctl_pkey_params_get_2() | 9.8 | 0.0017 | None reported |
| Urgent | CVE-2026-53376 | drm/amdkfd: Add upper bound check for num_of_nodes | 9.8 | 0.0016 | None reported |
| Urgent | CVE-2025-71305 | drm/display/dp_mst: Add protection against 0 vcpi | 9.8 | 0.0016 | None reported |
| Urgent | CVE-2026-63959 | usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT | 9.8 | 0.0016 | None reported |
| Urgent | CVE-2026-64106 | kernel-default: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (bsc#1272242). | 9.0 | 0.0015 | None reported |
| Urgent | CVE-2026-53403 | fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var | 9.8 | 0.0013 | None reported |
| Urgent | CVE-2026-53374 | drm/amdgpu: zero-initialize GART table on allocation | 9.8 | 0.0013 | None reported |
| Urgent | CVE-2026-63827 | apparmor: fix use-after-free in rawdata dedup loop | 9.8 | 0.0012 | None reported |
Showing 1 to 25 of 891
1Next
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.