# OPENSUSE-SU-2025:20091-1: Security update for 12 packages

OPENSUSE-SU-2025:20091-1, released November 26, 2025, fixes 83 CVEs across 12 products. None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/opensuse-su-2025-20091-1
- Platform: Linux
- Released: Nov 26, 2025
- Priority: Urgent (Closes CVE-2025-40000, rated Critical)
- CVEs: 83, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://osv.dev/vulnerability/openSUSE-SU-2025:20091-1

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [dtb-aarch64](https://patchblox.com/security/data/product/linux/dtb-aarch64.md) | opensuse-leap 16.0 | 6.12.0-160000.7.1 |
| [kernel-64kb](https://patchblox.com/security/data/product/linux/kernel-64kb.md) | opensuse-leap 16.0 | 6.12.0-160000.7.1 |
| [kernel-default](https://patchblox.com/security/data/product/linux/kernel-default.md) | opensuse-leap 16.0 | 6.12.0-160000.7.1 |
| [kernel-default-base](https://patchblox.com/security/data/product/linux/kernel-default-base.md) | opensuse-leap 16.0 | 6.12.0-160000.6.1.160000.2.4 |
| [kernel-docs](https://patchblox.com/security/data/product/linux/kernel-docs.md) | opensuse-leap 16.0 | 6.12.0-160000.7.1 |
| [kernel-kvmsmall](https://patchblox.com/security/data/product/linux/kernel-kvmsmall.md) | opensuse-leap 16.0 | 6.12.0-160000.7.1 |
| [kernel-obs-build](https://patchblox.com/security/data/product/linux/kernel-obs-build.md) | opensuse-leap 16.0 | 6.12.0-160000.7.1 |
| [kernel-obs-qa](https://patchblox.com/security/data/product/linux/kernel-obs-qa.md) | opensuse-leap 16.0 | 6.12.0-160000.7.1 |
| [kernel-rt](https://patchblox.com/security/data/product/linux/kernel-rt.md) | opensuse-leap 16.0 | 6.12.0-160000.7.1 |
| [kernel-source](https://patchblox.com/security/data/product/linux/kernel-source.md) | opensuse-leap 16.0 | 6.12.0-160000.7.1 |
| [kernel-syms](https://patchblox.com/security/data/product/linux/kernel-syms.md) | opensuse-leap 16.0 | 6.12.0-160000.7.1 |
| [kernel-zfcpdump](https://patchblox.com/security/data/product/linux/kernel-zfcpdump.md) | opensuse-leap 16.0 | 6.12.0-160000.7.1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2025-40000](https://patchblox.com/security/data/cve/CVE-2025-40000.md) | Urgent | wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() | 9.8 | 0.0027 |  |
| [CVE-2025-39996](https://patchblox.com/security/data/cve/CVE-2025-39996.md) | Urgent | media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove | 9.8 | 0.0023 |  |
| [CVE-2025-39985](https://patchblox.com/security/data/cve/CVE-2025-39985.md) | Urgent | can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow | 9.8 | 0.0018 |  |
| [CVE-2025-39986](https://patchblox.com/security/data/cve/CVE-2025-39986.md) | Urgent | can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow | 9.8 | 0.0018 |  |
| [CVE-2025-39967](https://patchblox.com/security/data/cve/CVE-2025-39967.md) | Urgent | fbcon: fix integer overflow in fbcon_do_set_font | 9.8 | 0.0017 |  |
| [CVE-2025-39994](https://patchblox.com/security/data/cve/CVE-2025-39994.md) | Urgent | media: tuner: xc5000: Fix use-after-free in xc5000_release | 9.8 | 0.0016 |  |
| [CVE-2025-39970](https://patchblox.com/security/data/cve/CVE-2025-39970.md) | Urgent | i40e: fix input validation logic for action_meta | 9.8 | 0.0016 |  |
| [CVE-2025-39971](https://patchblox.com/security/data/cve/CVE-2025-39971.md) | Urgent | i40e: fix idx validation in config queues msg | 9.8 | 0.0016 |  |
| [CVE-2025-39972](https://patchblox.com/security/data/cve/CVE-2025-39972.md) | Urgent | i40e: fix idx validation in i40e_validate_queue_map | 9.8 | 0.0016 |  |
| [CVE-2025-39973](https://patchblox.com/security/data/cve/CVE-2025-39973.md) | Urgent | i40e: add validation for ring_len param | 9.8 | 0.0016 |  |
| [CVE-2025-39978](https://patchblox.com/security/data/cve/CVE-2025-39978.md) | Urgent | octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() | 9.8 | 0.0015 |  |
| [CVE-2025-39968](https://patchblox.com/security/data/cve/CVE-2025-39968.md) | Urgent | i40e: add max boundary check for VF filters | 9.8 | 0.0015 |  |
| [CVE-2025-40048](https://patchblox.com/security/data/cve/CVE-2025-40048.md) | High | uio_hv_generic: Let userspace take care of interrupt mask | 8.4 | 0.0064 |  |
| [CVE-2025-40087](https://patchblox.com/security/data/cve/CVE-2025-40087.md) | High | NFSD: Define a proc_layoutcommit for the FlexFiles layout type | 7.5 | 0.0050 |  |
| [CVE-2025-39702](https://patchblox.com/security/data/cve/CVE-2025-39702.md) | High | ipv6: sr: Fix MAC comparison to be constant-time | 7.1 | 0.0045 |  |
| [CVE-2025-40043](https://patchblox.com/security/data/cve/CVE-2025-40043.md) | High | net: nfc: nci: Add parameter validation for packet data | 8.8 | 0.0031 |  |
| [CVE-2025-39866](https://patchblox.com/security/data/cve/CVE-2025-39866.md) | High | fs: writeback: fix use-after-free in __mark_inode_dirty() | 7.8 | 0.0031 |  |
| [CVE-2025-40019](https://patchblox.com/security/data/cve/CVE-2025-40019.md) | High | crypto: essiv - Check ssize for decryption and in-place encryption | 7.0 | 0.0029 |  |
| [CVE-2025-40364](https://patchblox.com/security/data/cve/CVE-2025-40364.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  io_uring: fix io_req_prep_async with provided bu... | 7.8 | 0.0028 |  |
| [CVE-2025-39982](https://patchblox.com/security/data/cve/CVE-2025-39982.md) | High | Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync | 8.8 | 0.0028 |  |
| [CVE-2025-40009](https://patchblox.com/security/data/cve/CVE-2025-40009.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  fs/proc/task_mmu: check p->vec_buf for NULL  Whe... | n/a | 0.0024 |  |
| [CVE-2025-39995](https://patchblox.com/security/data/cve/CVE-2025-39995.md) | High | media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe | 7.1 | 0.0023 |  |
| [CVE-2025-40035](https://patchblox.com/security/data/cve/CVE-2025-40035.md) | High | Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak | 7.1 | 0.0023 |  |
| [CVE-2025-40036](https://patchblox.com/security/data/cve/CVE-2025-40036.md) | High | misc: fastrpc: fix possible map leak in fastrpc_put_args | 7.1 | 0.0021 |  |
| [CVE-2025-40052](https://patchblox.com/security/data/cve/CVE-2025-40052.md) | High | smb: client: fix crypto buffers in non-linear memory | 7.1 | 0.0021 |  |
| [CVE-2025-40020](https://patchblox.com/security/data/cve/CVE-2025-40020.md) | High | can: peak_usb: fix shift-out-of-bounds issue | 7.1 | 0.0021 |  |
| [CVE-2025-39965](https://patchblox.com/security/data/cve/CVE-2025-39965.md) | High | xfrm: xfrm_alloc_spi shouldn't use 0 as SPI | 7.8 | 0.0020 |  |
| [CVE-2025-39992](https://patchblox.com/security/data/cve/CVE-2025-39992.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  mm: swap: check for stable address space before... | n/a | 0.0020 |  |
| [CVE-2025-40012](https://patchblox.com/security/data/cve/CVE-2025-40012.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  net/smc: fix warning in smc_rx_splice() when cal... | 7.8 | 0.0020 |  |
| [CVE-2025-39984](https://patchblox.com/security/data/cve/CVE-2025-39984.md) | High | kernel-default: The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues  The following security issues wer... | 7.8 | 0.0020 |  |
| [CVE-2025-39987](https://patchblox.com/security/data/cve/CVE-2025-39987.md) | High | can: hi311x: populate ndo_change_mtu() to prevent buffer overflow | 7.8 | 0.0018 |  |
| [CVE-2025-39988](https://patchblox.com/security/data/cve/CVE-2025-39988.md) | High | can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow | 7.8 | 0.0018 |  |
| [CVE-2025-38653](https://patchblox.com/security/data/cve/CVE-2025-38653.md) | High | proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al | 7.8 | 0.0018 |  |
| [CVE-2025-40044](https://patchblox.com/security/data/cve/CVE-2025-40044.md) | High | fs: udf: fix OOB read in lengthAllocDescs handling | 7.8 | 0.0017 |  |
| [CVE-2025-38718](https://patchblox.com/security/data/cve/CVE-2025-38718.md) | High | sctp: linearize cloned gso packets in sctp_rcv | 7.8 | 0.0017 |  |
| [CVE-2025-39955](https://patchblox.com/security/data/cve/CVE-2025-39955.md) | High | tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). | 7.8 | 0.0017 |  |
| [CVE-2025-40051](https://patchblox.com/security/data/cve/CVE-2025-40051.md) | High | vhost: vringh: Modify the return value check | 7.8 | 0.0017 |  |
| [CVE-2025-40058](https://patchblox.com/security/data/cve/CVE-2025-40058.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  iommu/vt-d: Disallow dirty tracking if incoheren... | 8.8 | 0.0016 |  |
| [CVE-2025-39911](https://patchblox.com/security/data/cve/CVE-2025-39911.md) | High | i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path | 7.8 | 0.0016 |  |
| [CVE-2025-39797](https://patchblox.com/security/data/cve/CVE-2025-39797.md) | High | xfrm: Duplicate SPI Handling | 7.8 | 0.0016 |  |
| [CVE-2025-39993](https://patchblox.com/security/data/cve/CVE-2025-39993.md) | High | media: rc: fix races with imon_disconnect() | 7.8 | 0.0016 |  |
| [CVE-2025-39969](https://patchblox.com/security/data/cve/CVE-2025-39969.md) | High | i40e: fix validation of VF state in get resources | 8.8 | 0.0016 |  |
| [CVE-2025-39949](https://patchblox.com/security/data/cve/CVE-2025-39949.md) | High | qed: Don't collect too many protection override GRC elements | 7.0 | 0.0016 |  |
| [CVE-2025-39963](https://patchblox.com/security/data/cve/CVE-2025-39963.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  io_uring: fix incorrect io_kiocb reference in io... | 7.8 | 0.0016 |  |
| [CVE-2025-39881](https://patchblox.com/security/data/cve/CVE-2025-39881.md) | High | kernfs: Fix UAF in polling when open file is released | 7.8 | 0.0015 |  |
| [CVE-2025-40096](https://patchblox.com/security/data/cve/CVE-2025-40096.md) | High | drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies | 7.8 | 0.0015 |  |
| [CVE-2025-39981](https://patchblox.com/security/data/cve/CVE-2025-39981.md) | High | Bluetooth: MGMT: Fix possible UAFs | 7.8 | 0.0015 |  |
| [CVE-2025-40104](https://patchblox.com/security/data/cve/CVE-2025-40104.md) | High | ixgbevf: fix mailbox API compatibility by negotiating supported features | 7.8 | 0.0015 |  |
| [CVE-2025-40018](https://patchblox.com/security/data/cve/CVE-2025-40018.md) | High | ipvs: Defer ip_vs_ftp unregister during netns cleanup | 7.8 | 0.0015 |  |
| [CVE-2025-40061](https://patchblox.com/security/data/cve/CVE-2025-40061.md) | High | RDMA/rxe: Fix race in do_task() when draining | 7.8 | 0.0015 |  |
| [CVE-2025-39979](https://patchblox.com/security/data/cve/CVE-2025-39979.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  net/mlx5: fs, fix UAF in flow counter release  F... | 7.8 | 0.0015 |  |
| [CVE-2025-39903](https://patchblox.com/security/data/cve/CVE-2025-39903.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: of_numa: fix uninitialized memory nodes causing k... | 7.3 | 0.0015 |  |
| [CVE-2025-39948](https://patchblox.com/security/data/cve/CVE-2025-39948.md) | Routine | kernel-docs: The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues  The following security issues wer... | 6.4 | 0.0040 |  |
| [CVE-2025-40040](https://patchblox.com/security/data/cve/CVE-2025-40040.md) | Routine | mm/ksm: fix flag-dropping behavior in ksm_madvise | 5.8 | 0.0038 |  |
| [CVE-2025-40011](https://patchblox.com/security/data/cve/CVE-2025-40011.md) | Routine | drm/gma500: Fix null dereference in hdmi teardown | 5.5 | 0.0026 |  |
| [CVE-2025-40016](https://patchblox.com/security/data/cve/CVE-2025-40016.md) | Routine | media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID | 6.2 | 0.0025 |  |
| [CVE-2025-40013](https://patchblox.com/security/data/cve/CVE-2025-40013.md) | Routine | ASoC: qcom: audioreach: fix potential null pointer dereference | 5.5 | 0.0025 |  |
| [CVE-2025-40078](https://patchblox.com/security/data/cve/CVE-2025-40078.md) | Routine | bpf: Explicitly check accesses to bpf_sock_addr | 5.5 | 0.0025 |  |
| [CVE-2025-40049](https://patchblox.com/security/data/cve/CVE-2025-40049.md) | Routine | Squashfs: fix uninit-value in squashfs_get_parent | 5.5 | 0.0023 |  |
| [CVE-2025-40029](https://patchblox.com/security/data/cve/CVE-2025-40029.md) | Routine | bus: fsl-mc: Check return value of platform_get_resource() | 5.5 | 0.0022 |  |
| [CVE-2025-40060](https://patchblox.com/security/data/cve/CVE-2025-40060.md) | Routine | coresight: trbe: Return NULL pointer for allocation failures | 5.5 | 0.0022 |  |
| [CVE-2025-40032](https://patchblox.com/security/data/cve/CVE-2025-40032.md) | Routine | PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release | 5.5 | 0.0021 |  |
| [CVE-2025-40056](https://patchblox.com/security/data/cve/CVE-2025-40056.md) | Routine | vhost: vringh: Fix copy_to_iter return value check | 5.5 | 0.0021 |  |
| [CVE-2025-40037](https://patchblox.com/security/data/cve/CVE-2025-40037.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  fbdev: simplefb: Fix use after free in simplefb_... | 5.5 | 0.0021 |  |
| [CVE-2025-39997](https://patchblox.com/security/data/cve/CVE-2025-39997.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  ALSA: usb-audio: fix race condition to UAF in sn... | n/a | 0.0021 |  |
| [CVE-2025-40080](https://patchblox.com/security/data/cve/CVE-2025-40080.md) | Routine | nbd: restrict sockets to TCP and UDP | 6.1 | 0.0021 |  |
| [CVE-2025-21816](https://patchblox.com/security/data/cve/CVE-2025-21816.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  hrtimers: Force migrate away hrtimers queued aft... | 5.5 | 0.0021 |  |
| [CVE-2025-40085](https://patchblox.com/security/data/cve/CVE-2025-40085.md) | Routine | ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card | 5.8 | 0.0021 |  |
| [CVE-2025-40005](https://patchblox.com/security/data/cve/CVE-2025-40005.md) | Routine | spi: cadence-quadspi: Implement refcount to handle unbind during busy | 6.6 | 0.0020 |  |
| [CVE-2025-40071](https://patchblox.com/security/data/cve/CVE-2025-40071.md) | Routine | tty: n_gsm: Don't block input queue by waiting MSC | 6.1 | 0.0020 |  |
| [CVE-2025-39991](https://patchblox.com/security/data/cve/CVE-2025-39991.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  wifi: ath11k: fix NULL dereference in ath11k_qmi... | n/a | 0.0020 |  |
| [CVE-2025-40100](https://patchblox.com/security/data/cve/CVE-2025-40100.md) | Routine | btrfs: do not assert we found block group item when creating free space tree | 5.5 | 0.0020 |  |
| [CVE-2025-40062](https://patchblox.com/security/data/cve/CVE-2025-40062.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  crypto: hisilicon/qm - set NULL to qm->debug.qm_... | n/a | 0.0020 |  |
| [CVE-2025-40091](https://patchblox.com/security/data/cve/CVE-2025-40091.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  ixgbe: fix too early devlink_free() in ixgbe_rem... | n/a | 0.0018 |  |
| [CVE-2025-39676](https://patchblox.com/security/data/cve/CVE-2025-39676.md) | Routine | scsi: qla4xxx: Prevent a potential error pointer dereference | 5.5 | 0.0018 |  |
| [CVE-2025-39756](https://patchblox.com/security/data/cve/CVE-2025-39756.md) | Routine | fs: Prevent file descriptor table allocations exceeding INT_MAX | 5.5 | 0.0018 |  |
| [CVE-2025-39812](https://patchblox.com/security/data/cve/CVE-2025-39812.md) | Routine | sctp: initialize more fields in sctp_v6_from_sk() | 5.5 | 0.0018 |  |
| [CVE-2025-39956](https://patchblox.com/security/data/cve/CVE-2025-39956.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  igc: don't fail igc_probe() on LED setup error... | 5.5 | 0.0017 |  |
| [CVE-2025-39779](https://patchblox.com/security/data/cve/CVE-2025-39779.md) | Routine | btrfs: subpage: keep TOWRITE tag until folio is cleaned | 5.5 | 0.0015 |  |
| [CVE-2025-39876](https://patchblox.com/security/data/cve/CVE-2025-39876.md) | Routine | net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() | 5.5 | 0.0015 |  |
| [CVE-2025-39950](https://patchblox.com/security/data/cve/CVE-2025-39950.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  net/tcp: Fix a NULL pointer dereference when usi... | 5.5 | 0.0015 |  |
| [CVE-2025-39895](https://patchblox.com/security/data/cve/CVE-2025-39895.md) | Routine | sched: Fix sched_numa_find_nth_cpu() if mask offline | 5.5 | 0.0015 |  |
| [CVE-2025-39947](https://patchblox.com/security/data/cve/CVE-2025-39947.md) | Routine | net/mlx5e: Harden uplink netdev access against device unbind | 5.5 | 0.0015 |  |

---

Data as of 2026-11-10T13:56:55Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.