# OPENSUSE-SU-2026:20572-1: Security update for 13 packages

OPENSUSE-SU-2026:20572-1, released April 20, 2026, fixes 49 CVEs across 13 products. None of them is reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/fix/linux/opensuse-su-2026-20572-1
- Platform: Linux
- Released: Apr 20, 2026
- Priority: High (Closes CVE-2026-23231, high severity)
- CVEs: 49, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://osv.dev/vulnerability/openSUSE-SU-2026:20572-1

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [dtb-aarch64](https://patchblox.com/security/data/product/linux/dtb-aarch64.md) | opensuse-leap 16.0 | 6.12.0-160000.28.1 |
| [kernel-64kb](https://patchblox.com/security/data/product/linux/kernel-64kb.md) | opensuse-leap 16.0 | 6.12.0-160000.28.1 |
| [kernel-azure](https://patchblox.com/security/data/product/linux/kernel-azure.md) | opensuse-leap 16.0 | 6.12.0-160000.28.1 |
| [kernel-default](https://patchblox.com/security/data/product/linux/kernel-default.md) | opensuse-leap 16.0 | 6.12.0-160000.28.1 |
| [kernel-default-base](https://patchblox.com/security/data/product/linux/kernel-default-base.md) | opensuse-leap 16.0 | 6.12.0-160000.27.1.160000.2.8 |
| [kernel-docs](https://patchblox.com/security/data/product/linux/kernel-docs.md) | opensuse-leap 16.0 | 6.12.0-160000.28.1 |
| [kernel-kvmsmall](https://patchblox.com/security/data/product/linux/kernel-kvmsmall.md) | opensuse-leap 16.0 | 6.12.0-160000.28.1 |
| [kernel-obs-build](https://patchblox.com/security/data/product/linux/kernel-obs-build.md) | opensuse-leap 16.0 | 6.12.0-160000.28.1 |
| [kernel-obs-qa](https://patchblox.com/security/data/product/linux/kernel-obs-qa.md) | opensuse-leap 16.0 | 6.12.0-160000.28.1 |
| [kernel-rt](https://patchblox.com/security/data/product/linux/kernel-rt.md) | opensuse-leap 16.0 | 6.12.0-160000.28.1 |
| [kernel-source](https://patchblox.com/security/data/product/linux/kernel-source.md) | opensuse-leap 16.0 | 6.12.0-160000.28.1 |
| [kernel-syms](https://patchblox.com/security/data/product/linux/kernel-syms.md) | opensuse-leap 16.0 | 6.12.0-160000.28.1 |
| [kernel-zfcpdump](https://patchblox.com/security/data/product/linux/kernel-zfcpdump.md) | opensuse-leap 16.0 | 6.12.0-160000.28.1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-23231](https://patchblox.com/security/data/cve/CVE-2026-23231.md) | High | netfilter: nf_tables: fix use-after-free in nf_tables_addchain() | 7.8 | 0.0105 |  |
| [CVE-2025-68794](https://patchblox.com/security/data/cve/CVE-2025-68794.md) | High | iomap: adjust read range correctly for non-block-aligned positions | 9.8 | 0.0069 |  |
| [CVE-2026-23242](https://patchblox.com/security/data/cve/CVE-2026-23242.md) | High | RDMA/siw: Fix potential NULL pointer dereference in header processing | 7.5 | 0.0063 |  |
| [CVE-2026-23240](https://patchblox.com/security/data/cve/CVE-2026-23240.md) | High | tls: Fix race condition in tls_sw_cancel_work_tx() | 9.8 | 0.0056 |  |
| [CVE-2026-23193](https://patchblox.com/security/data/cve/CVE-2026-23193.md) | High | kernel-livepatch-SLE15-SP7-RT_Update_11: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (bsc#1258414). | 7.8 | 0.0036 |  |
| [CVE-2025-40253](https://patchblox.com/security/data/cve/CVE-2025-40253.md) | High | s390/ctcm: Fix double-kfree | 8.8 | 0.0032 |  |
| [CVE-2026-23278](https://patchblox.com/security/data/cve/CVE-2026-23278.md) | High | netfilter: nf_tables: always walk all pending catchall elements | 7.8 | 0.0023 |  |
| [CVE-2026-31788](https://patchblox.com/security/data/cve/CVE-2026-31788.md) | High | kernel-livepatch-SLE15-SP7-RT_Update_11: xen/privcmd: restrict usage in unprivileged domU (bsc#1259707). | 8.2 | 0.0019 |  |
| [CVE-2026-23274](https://patchblox.com/security/data/cve/CVE-2026-23274.md) | High | netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels | 7.8 | 0.0018 |  |
| [CVE-2026-23243](https://patchblox.com/security/data/cve/CVE-2026-23243.md) | High | RDMA/umad: Reject negative data_len in ib_umad_write | 7.8 | 0.0018 |  |
| [CVE-2026-23272](https://patchblox.com/security/data/cve/CVE-2026-23272.md) | High | netfilter: nf_tables: unconditionally bump set->nelems before insertion | 7.8 | 0.0018 |  |
| [CVE-2025-39998](https://patchblox.com/security/data/cve/CVE-2025-39998.md) | High | scsi: target: target_core_configfs: Add length check to avoid buffer overflow | 7.8 | 0.0018 |  |
| [CVE-2026-23383](https://patchblox.com/security/data/cve/CVE-2026-23383.md) | High | bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing | 7.8 | 0.0018 |  |
| [CVE-2026-23361](https://patchblox.com/security/data/cve/CVE-2026-23361.md) | High | PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry | 7.8 | 0.0017 |  |
| [CVE-2026-23413](https://patchblox.com/security/data/cve/CVE-2026-23413.md) | High | kernel-uek64k-modules-deprecated: ELSA-2026-50372: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0016 |  |
| [CVE-2026-23204](https://patchblox.com/security/data/cve/CVE-2026-23204.md) | High | kernel-64kb: net/sched: cls_u32: use skb_header_pointer_careful() (bsc#1258340). | 8.1 | 0.0016 |  |
| [CVE-2026-23216](https://patchblox.com/security/data/cve/CVE-2026-23216.md) | High | scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() | 8.8 | 0.0014 |  |
| [CVE-2026-23343](https://patchblox.com/security/data/cve/CVE-2026-23343.md) | High | xdp: produce a warning when calculated tailroom is negative | 7.8 | 0.0014 |  |
| [CVE-2026-23187](https://patchblox.com/security/data/cve/CVE-2026-23187.md) | High | kernel-livepatch-SLE15-SP7-RT_Update_11: pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains (bsc#1258330). | 7.1 | 0.0014 |  |
| [CVE-2026-23270](https://patchblox.com/security/data/cve/CVE-2026-23270.md) | High | kernel-livepatch-SLE15-SP7-RT_Update_11: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (bsc#1259886). | 8.1 | 0.0014 |  |
| [CVE-2026-23319](https://patchblox.com/security/data/cve/CVE-2026-23319.md) | High | bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim | 7.8 | 0.0014 |  |
| [CVE-2026-23326](https://patchblox.com/security/data/cve/CVE-2026-23326.md) | High | dtb-aarch64: xsk: Fix fragment node deletion to prevent buffer leak (bsc#1260606). | 7.8 | 0.0013 |  |
| [CVE-2026-23293](https://patchblox.com/security/data/cve/CVE-2026-23293.md) | High | net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled | 7.5 | 0.0013 |  |
| [CVE-2026-23335](https://patchblox.com/security/data/cve/CVE-2026-23335.md) | High | RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() | 7.1 | 0.0013 |  |
| [CVE-2026-23239](https://patchblox.com/security/data/cve/CVE-2026-23239.md) | High | espintcp: Fix race condition in espintcp_close() | 7.8 | 0.0013 |  |
| [CVE-2026-23281](https://patchblox.com/security/data/cve/CVE-2026-23281.md) | High | wifi: libertas: fix use-after-free in lbs_free_adapter() | 7.8 | 0.0013 |  |
| [CVE-2026-23215](https://patchblox.com/security/data/cve/CVE-2026-23215.md) | High | x86/vmware: Fix hypercall clobbers | 8.4 | 0.0013 |  |
| [CVE-2026-23103](https://patchblox.com/security/data/cve/CVE-2026-23103.md) | High | kernel: kernel: ipvlan: Make the addrs_lock be per port | 8.8 | 0.0013 |  |
| [CVE-2026-23262](https://patchblox.com/security/data/cve/CVE-2026-23262.md) | High | kernel-64kb: gve: Fix stats report corruption on queue count change (bsc#1259870). | 7.8 | 0.0013 |  |
| [CVE-2026-23386](https://patchblox.com/security/data/cve/CVE-2026-23386.md) | High | gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL | 7.1 | 0.0012 |  |
| [CVE-2026-23393](https://patchblox.com/security/data/cve/CVE-2026-23393.md) | High | bridge: cfm: Fix race condition in peer_mep deletion | 7.8 | 0.0010 |  |
| [CVE-2026-23414](https://patchblox.com/security/data/cve/CVE-2026-23414.md) | Routine | tls: Purge async_hold in tls_decrypt_async_wait() | 5.5 | 0.0037 |  |
| [CVE-2026-23419](https://patchblox.com/security/data/cve/CVE-2026-23419.md) | Routine | kernel-64kb: net/rds: Fix circular locking dependency in rds_tcp_tune (bsc#1261507). | 5.5 | 0.0019 |  |
| [CVE-2026-23138](https://patchblox.com/security/data/cve/CVE-2026-23138.md) | Routine | kernel-uek: ELSA-2026-50372: Unbreakable Enterprise kernel security update (IMPORTANT) | 5.5 | 0.0015 |  |
| [CVE-2026-23140](https://patchblox.com/security/data/cve/CVE-2026-23140.md) | Routine | kernel-livepatch-SLE15-SP7-RT_Update_11: bpf, test_run: Subtract size of xdp_frame from allowed metadata size (bsc#1258305). | 5.5 | 0.0015 |  |
| [CVE-2026-23072](https://patchblox.com/security/data/cve/CVE-2026-23072.md) | Routine | kernel-uek: ELSA-2026-50232: Unbreakable Enterprise kernel security update (IMPORTANT) | 5.5 | 0.0015 |  |
| [CVE-2026-23125](https://patchblox.com/security/data/cve/CVE-2026-23125.md) | Routine | kernel-64kb: sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (bsc#1258293). | 5.5 | 0.0014 |  |
| [CVE-2026-23201](https://patchblox.com/security/data/cve/CVE-2026-23201.md) | Routine | cephfs: ceph: fix oops due to invalid pointer for kfree() in parse_longname() (bsc#1258337). | 5.5 | 0.0014 |  |
| [CVE-2026-23304](https://patchblox.com/security/data/cve/CVE-2026-23304.md) | Routine | ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() | 5.5 | 0.0013 |  |
| [CVE-2025-71239](https://patchblox.com/security/data/cve/CVE-2025-71239.md) | Routine | audit: add fchmodat2() to change attributes class | 5.5 | 0.0013 |  |
| [CVE-2026-23379](https://patchblox.com/security/data/cve/CVE-2026-23379.md) | Routine | kernel-livepatch-SLE15-SP7-RT_Update_11: net/sched: ets: fix divide by zero in the offload path (bsc#1260481). | 5.5 | 0.0013 |  |
| [CVE-2026-23398](https://patchblox.com/security/data/cve/CVE-2026-23398.md) | Routine | icmp: fix NULL pointer dereference in icmp_tag_validation() | 6.5 | 0.0013 |  |
| [CVE-2026-23277](https://patchblox.com/security/data/cve/CVE-2026-23277.md) | Routine | net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit | 5.9 | 0.0013 |  |
| [CVE-2026-23292](https://patchblox.com/security/data/cve/CVE-2026-23292.md) | Routine | scsi: target: Fix recursive locking in __configfs_open_file() | 5.5 | 0.0013 |  |
| [CVE-2026-23297](https://patchblox.com/security/data/cve/CVE-2026-23297.md) | Routine | kernel-uek: ELSA-2026-50372: Unbreakable Enterprise kernel security update (IMPORTANT) | 5.5 | 0.0013 |  |
| [CVE-2026-23381](https://patchblox.com/security/data/cve/CVE-2026-23381.md) | Routine | net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled | 5.5 | 0.0013 |  |
| [CVE-2026-23425](https://patchblox.com/security/data/cve/CVE-2026-23425.md) | Routine | dtb-aarch64: KVM: arm64: Fix ID register initialization for non-protected pKVM guests (bsc#1261506). | 5.5 | 0.0012 |  |
| [CVE-2026-23255](https://patchblox.com/security/data/cve/CVE-2026-23255.md) | Routine | net: add proper RCU protection to /proc/net/ptype | 5.5 | 0.0012 |  |
| [CVE-2026-23120](https://patchblox.com/security/data/cve/CVE-2026-23120.md) | Routine | kernel-livepatch-SLE15-SP7-RT_Update_11: l2tp: avoid one data-race in l2tp_tunnel_del_work() (bsc#1258280). | 5.8 | 0.0011 |  |

---

Data as of 2026-11-11T01:43:54Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.