{
  "fix": "SUSE-SU-2026:1041-1",
  "url": "https://patchblox.com/security/fix/linux/suse-su-2026-1041-1",
  "summary": "SUSE-SU-2026:1041-1, released March 25, 2026, fixes 27 CVEs across 13 products. One of them is being exploited (CVE-2025-39964); 1 on CISA KEV. Patch Radar priority: Patch now.",
  "platform": "linux",
  "type": "advisory",
  "title": "Security update for 13 packages",
  "released": "2026-03-25T14:13:20Z",
  "priority": "Patch now",
  "priorityTier": 1,
  "priorityReason": "Closes CVE-2025-39964, exploited (CISA KEV)",
  "supported": true,
  "cveCount": 27,
  "exploitedCveCount": 1,
  "kevCveCount": 1,
  "ransomwareCveCount": 0,
  "maxEpss": 0.01607,
  "maxCvss": 9.4,
  "vendorAdvisory": "https://osv.dev/vulnerability/SUSE-SU-2026:1041-1",
  "appliesTo": [
    {
      "product": "dtb-aarch64",
      "productUrl": "https://patchblox.com/security/product/linux/dtb-aarch64",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "6.4.0-150600.23.92.1",
      "supported": true
    },
    {
      "product": "kernel-64kb",
      "productUrl": "https://patchblox.com/security/product/linux/kernel-64kb",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "6.4.0-150600.23.92.1",
      "supported": true
    },
    {
      "product": "kernel-debug",
      "productUrl": "https://patchblox.com/security/product/linux/kernel-debug",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "6.4.0-150600.23.92.1",
      "supported": true
    },
    {
      "product": "kernel-default",
      "productUrl": "https://patchblox.com/security/product/linux/kernel-default",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "6.4.0-150600.23.92.1",
      "supported": true
    },
    {
      "product": "kernel-default",
      "productUrl": "https://patchblox.com/security/product/linux/kernel-default",
      "release": "sles 15.6",
      "fixedVersion": "6.4.0-150600.23.92.1",
      "supported": true
    },
    {
      "product": "kernel-default-base",
      "productUrl": "https://patchblox.com/security/product/linux/kernel-default-base",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "6.4.0-150600.23.92.1.150600.12.42.2",
      "supported": true
    },
    {
      "product": "kernel-default-base",
      "productUrl": "https://patchblox.com/security/product/linux/kernel-default-base",
      "release": "sles 15.6",
      "fixedVersion": "6.4.0-150600.23.92.1.150600.12.42.2",
      "supported": true
    },
    {
      "product": "kernel-docs",
      "productUrl": "https://patchblox.com/security/product/linux/kernel-docs",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "6.4.0-150600.23.92.1",
      "supported": true
    },
    {
      "product": "kernel-docs",
      "productUrl": "https://patchblox.com/security/product/linux/kernel-docs",
      "release": "sles 15.6",
      "fixedVersion": "6.4.0-150600.23.92.1",
      "supported": true
    },
    {
      "product": "kernel-kvmsmall",
      "productUrl": "https://patchblox.com/security/product/linux/kernel-kvmsmall",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "6.4.0-150600.23.92.1",
      "supported": true
    },
    {
      "product": "kernel-livepatch-SLE15-SP6_Update_21",
      "productUrl": "https://patchblox.com/security/product/linux/kernel-livepatch-sle15-sp6-update-21",
      "release": "sles 15.6",
      "fixedVersion": "1-150600.13.5.1",
      "supported": true
    },
    {
      "product": "kernel-obs-build",
      "productUrl": "https://patchblox.com/security/product/linux/kernel-obs-build",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "6.4.0-150600.23.92.1",
      "supported": true
    },
    {
      "product": "kernel-obs-build",
      "productUrl": "https://patchblox.com/security/product/linux/kernel-obs-build",
      "release": "sles 15.6",
      "fixedVersion": "6.4.0-150600.23.92.1",
      "supported": true
    },
    {
      "product": "kernel-obs-qa",
      "productUrl": "https://patchblox.com/security/product/linux/kernel-obs-qa",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "6.4.0-150600.23.92.1",
      "supported": true
    },
    {
      "product": "kernel-source",
      "productUrl": "https://patchblox.com/security/product/linux/kernel-source",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "6.4.0-150600.23.92.1",
      "supported": true
    },
    {
      "product": "kernel-source",
      "productUrl": "https://patchblox.com/security/product/linux/kernel-source",
      "release": "sles 15.6",
      "fixedVersion": "6.4.0-150600.23.92.1",
      "supported": true
    },
    {
      "product": "kernel-syms",
      "productUrl": "https://patchblox.com/security/product/linux/kernel-syms",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "6.4.0-150600.23.92.1",
      "supported": true
    },
    {
      "product": "kernel-syms",
      "productUrl": "https://patchblox.com/security/product/linux/kernel-syms",
      "release": "sles 15.6",
      "fixedVersion": "6.4.0-150600.23.92.1",
      "supported": true
    },
    {
      "product": "kernel-zfcpdump",
      "productUrl": "https://patchblox.com/security/product/linux/kernel-zfcpdump",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "6.4.0-150600.23.92.1",
      "supported": true
    }
  ],
  "cves": [
    {
      "cveId": "CVE-2025-39964",
      "url": "https://patchblox.com/security/cve/CVE-2025-39964",
      "title": "crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg",
      "priority": "Patch now",
      "severity": "Moderate",
      "cvss": 8.8,
      "epss": 0.01607,
      "kev": true,
      "ransomware": false,
      "exploited": true,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-23111",
      "url": "https://patchblox.com/security/cve/CVE-2026-23111",
      "title": "kernel-64kb: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (bsc#1258181).",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 7.8,
      "epss": 0.01133,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2023-53817",
      "url": "https://patchblox.com/security/cve/CVE-2023-53817",
      "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  crypto: lib/mpi - avoid null pointer deref in mp...",
      "priority": "High",
      "severity": "high",
      "cvss": 7.5,
      "epss": 0.00541,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-40099",
      "url": "https://patchblox.com/security/cve/CVE-2025-40099",
      "title": "cifs: parse_dfs_referrals: prevent oob on malformed input",
      "priority": "High",
      "severity": "Moderate",
      "cvss": 9.4,
      "epss": 0.00406,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-37861",
      "url": "https://patchblox.com/security/cve/CVE-2025-37861",
      "title": "scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 7.8,
      "epss": 0.00325,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-40253",
      "url": "https://patchblox.com/security/cve/CVE-2025-40253",
      "title": "s390/ctcm: Fix double-kfree",
      "priority": "High",
      "severity": "Moderate",
      "cvss": 8.8,
      "epss": 0.00322,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-38542",
      "url": "https://patchblox.com/security/cve/CVE-2024-38542",
      "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  RDMA/mana_ib: boundary check before installing c...",
      "priority": "High",
      "severity": "high",
      "cvss": 7.8,
      "epss": 0.00247,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-23054",
      "url": "https://patchblox.com/security/cve/CVE-2026-23054",
      "title": "kernel-64kb: Security update for the Linux Kernel",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 7,
      "epss": 0.00207,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-40103",
      "url": "https://patchblox.com/security/cve/CVE-2025-40103",
      "title": "smb: client: Fix refcount leak for cifs_sb_tlink",
      "priority": "High",
      "severity": "Important",
      "cvss": 7.1,
      "epss": 0.00206,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-23074",
      "url": "https://patchblox.com/security/cve/CVE-2026-23074",
      "title": "kernel-64kb: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749).",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 7.8,
      "epss": 0.0019,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-23214",
      "url": "https://patchblox.com/security/cve/CVE-2026-23214",
      "title": "btrfs: reject new transactions if the fs is fully read-only",
      "priority": "High",
      "severity": "Important",
      "cvss": 8.4,
      "epss": 0.00175,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-71066",
      "url": "https://patchblox.com/security/cve/CVE-2025-71066",
      "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  net/sched: ets: Always remove class from active...",
      "priority": "High",
      "severity": "high",
      "cvss": 7.8,
      "epss": 0.00174,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-23209",
      "url": "https://patchblox.com/security/cve/CVE-2026-23209",
      "title": "kernel-64kb: Security update for the Linux Kernel",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 7.8,
      "epss": 0.00174,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-39817",
      "url": "https://patchblox.com/security/cve/CVE-2025-39817",
      "title": "efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare",
      "priority": "High",
      "severity": "Important",
      "cvss": 7.6,
      "epss": 0.00167,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-23089",
      "url": "https://patchblox.com/security/cve/CVE-2026-23089",
      "title": "kernel-64kb: ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (bsc#1257790).",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 7.8,
      "epss": 0.00162,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-23204",
      "url": "https://patchblox.com/security/cve/CVE-2026-23204",
      "title": "kernel-64kb: net/sched: cls_u32: use skb_header_pointer_careful() (bsc#1258340).",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 8.1,
      "epss": 0.00156,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-23004",
      "url": "https://patchblox.com/security/cve/CVE-2026-23004",
      "title": "kernel-64kb: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231).",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 7,
      "epss": 0.00156,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-71113",
      "url": "https://patchblox.com/security/cve/CVE-2025-71113",
      "title": "kernel: In the Linux kernel, the following vulnerability has been resolved:\ncrypto: af_alg - zero initialize memory allocated...",
      "priority": "High",
      "severity": "low",
      "cvss": 7.8,
      "epss": 0.00151,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-23268",
      "url": "https://patchblox.com/security/cve/CVE-2026-23268",
      "title": "apparmor: fix unprivileged local user can do privileged policy management",
      "priority": "High",
      "severity": "Important",
      "cvss": 7.8,
      "epss": 0.00148,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-23269",
      "url": "https://patchblox.com/security/cve/CVE-2026-23269",
      "title": "apparmor: validate DFA start states are in bounds in unpack_pdb",
      "priority": "High",
      "severity": "Moderate",
      "cvss": 7.1,
      "epss": 0.00139,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-71231",
      "url": "https://patchblox.com/security/cve/CVE-2025-71231",
      "title": "crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode",
      "priority": "High",
      "severity": "Important",
      "cvss": 8.4,
      "epss": 0.00137,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-23191",
      "url": "https://patchblox.com/security/cve/CVE-2026-23191",
      "title": "kernel-64kb: ALSA: aloop: Fix racy access at PCM trigger (bsc#1258395).",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 7.3,
      "epss": 0.00131,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-23060",
      "url": "https://patchblox.com/security/cve/CVE-2026-23060",
      "title": "kernel-64kb: crypto: authencesn - reject too-short AAD (assoclen\u003C8) to match ESP/ESN spec (bsc#1257735).",
      "priority": "Routine",
      "severity": "IMPORTANT",
      "cvss": 6.5,
      "epss": 0.00178,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-23141",
      "url": "https://patchblox.com/security/cve/CVE-2026-23141",
      "title": "kernel-64kb: btrfs: send: check for inline extents in range_is_hole_in_parent() (bsc#1258377).",
      "priority": "Routine",
      "severity": "IMPORTANT",
      "cvss": 5.5,
      "epss": 0.00147,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-23157",
      "url": "https://patchblox.com/security/cve/CVE-2026-23157",
      "title": "kernel-64kb: Security update for the Linux Kernel",
      "priority": "Routine",
      "severity": "IMPORTANT",
      "cvss": 5.5,
      "epss": 0.00137,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-23207",
      "url": "https://patchblox.com/security/cve/CVE-2026-23207",
      "title": "spi: tegra210-quad: Protect curr_xfer check in IRQ handler",
      "priority": "Routine",
      "severity": "Moderate",
      "cvss": 5.5,
      "epss": 0.00133,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-23202",
      "url": "https://patchblox.com/security/cve/CVE-2026-23202",
      "title": "kernel-64kb: Security update for the Linux Kernel",
      "priority": "Routine",
      "severity": "IMPORTANT",
      "cvss": 5.5,
      "epss": 0.00104,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    }
  ],
  "dataAsOf": "2026-11-11T01:43:54Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}