# SUSE-SU-2026:2195-1: Security update for 7 packages

SUSE-SU-2026:2195-1, released July 1, 2026, fixes 69 CVEs across 7 products. None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/suse-su-2026-2195-1
- Platform: Linux
- Released: Jul 1, 2026
- Priority: Urgent (Closes CVE-2026-23450, rated Critical)
- CVEs: 69, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://osv.dev/vulnerability/SUSE-SU-2026:2195-1

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [kernel-default](https://patchblox.com/security/data/product/linux/kernel-default.md) | sles 15.6 | 6.4.0-150600.23.112.1 |
| [kernel-default-base](https://patchblox.com/security/data/product/linux/kernel-default-base.md) | sles 15.6 | 6.4.0-150600.23.112.1.150600.12.52.1 |
| [kernel-docs](https://patchblox.com/security/data/product/linux/kernel-docs.md) | sles 15.6 | 6.4.0-150600.23.112.1 |
| [kernel-livepatch-SLE15-SP6_Update_26](https://patchblox.com/security/data/product/linux/kernel-livepatch-sle15-sp6-update-26.md) | sles 15.6 | 1-150600.13.3.1 |
| [kernel-obs-build](https://patchblox.com/security/data/product/linux/kernel-obs-build.md) | sles 15.6 | 6.4.0-150600.23.112.1 |
| [kernel-source](https://patchblox.com/security/data/product/linux/kernel-source.md) | sles 15.6 | 6.4.0-150600.23.112.1 |
| [kernel-syms](https://patchblox.com/security/data/product/linux/kernel-syms.md) | sles 15.6 | 6.4.0-150600.23.112.1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-23450](https://patchblox.com/security/data/cve/CVE-2026-23450.md) | Urgent | kernel-default: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584). | 9.8 | 0.0046 |  |
| [CVE-2026-31402](https://patchblox.com/security/data/cve/CVE-2026-31402.md) | High | kernel-64kb: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638). | 9.8 | 0.0122 |  |
| [CVE-2026-46331](https://patchblox.com/security/data/cve/CVE-2026-46331.md) | High | net/sched: fix pedit partial COW leading to page cache corruption | 8.1 | 0.0064 |  |
| [CVE-2026-23240](https://patchblox.com/security/data/cve/CVE-2026-23240.md) | High | tls: Fix race condition in tls_sw_cancel_work_tx() | 9.8 | 0.0056 |  |
| [CVE-2026-43365](https://patchblox.com/security/data/cve/CVE-2026-43365.md) | High | kernel-64kb: xfs: fix undersized l_iclog_roundoff values (bsc#1265119). | 8.2 | 0.0051 |  |
| [CVE-2026-31685](https://patchblox.com/security/data/cve/CVE-2026-31685.md) | High | netfilter: ip6t_eui64: reject invalid MAC header for all packets | 9.4 | 0.0049 |  |
| [CVE-2026-31669](https://patchblox.com/security/data/cve/CVE-2026-31669.md) | High | mptcp: fix slab-use-after-free in __inet_lookup_established | 9.8 | 0.0047 |  |
| [CVE-2026-43190](https://patchblox.com/security/data/cve/CVE-2026-43190.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_tcpmss: check remaining length befo... | 8.2 | 0.0046 |  |
| [CVE-2026-31649](https://patchblox.com/security/data/cve/CVE-2026-31649.md) | High | net: stmmac: fix integer underflow in chain mode | 9.8 | 0.0046 |  |
| [CVE-2026-31436](https://patchblox.com/security/data/cve/CVE-2026-31436.md) | High | kernel-64kb: dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() (bsc#1262602). | 9.8 | 0.0046 |  |
| [CVE-2026-43494](https://patchblox.com/security/data/cve/CVE-2026-43494.md) | High | net/rds: reset op_nents when zerocopy page pin fails | 7.8 | 0.0041 |  |
| [CVE-2026-31533](https://patchblox.com/security/data/cve/CVE-2026-31533.md) | High | kernel-default: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262758). | 9.8 | 0.0040 |  |
| [CVE-2026-31662](https://patchblox.com/security/data/cve/CVE-2026-31662.md) | High | tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG | 7.5 | 0.0039 |  |
| [CVE-2026-31408](https://patchblox.com/security/data/cve/CVE-2026-31408.md) | High | Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold | 8.8 | 0.0032 |  |
| [CVE-2026-31607](https://patchblox.com/security/data/cve/CVE-2026-31607.md) | High | usbip: validate number_of_packets in usbip_pack_ret_submit() | 9.8 | 0.0031 |  |
| [CVE-2026-31622](https://patchblox.com/security/data/cve/CVE-2026-31622.md) | High | NFC: digital: Bounds check NFC-A cascade depth in SDD response handler | 8.8 | 0.0029 |  |
| [CVE-2025-54518](https://patchblox.com/security/data/cve/CVE-2025-54518.md) | High | AMD: CVE-2025-54518 CPU OP Cache Corruption | 7.8 | 0.0029 |  |
| [CVE-2026-31694](https://patchblox.com/security/data/cve/CVE-2026-31694.md) | High | fuse: reject oversized dirents in page cache | 7.8 | 0.0028 |  |
| [CVE-2026-43334](https://patchblox.com/security/data/cve/CVE-2026-43334.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SMP: force responder MITM requirements... | 8.8 | 0.0028 |  |
| [CVE-2026-23462](https://patchblox.com/security/data/cve/CVE-2026-23462.md) | High | kernel-default: Bluetooth: HIDP: Fix possible UAF (bsc#1261710). | 8.8 | 0.0028 |  |
| [CVE-2026-43110](https://patchblox.com/security/data/cve/CVE-2026-43110.md) | High | kernel-default: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264482). | 8.8 | 0.0027 |  |
| [CVE-2026-31570](https://patchblox.com/security/data/cve/CVE-2026-31570.md) | High | can: gw: fix OOB heap access in cgw_csum_crc8_rel() | 8.8 | 0.0026 |  |
| [CVE-2026-43038](https://patchblox.com/security/data/cve/CVE-2026-43038.md) | High | kpatch-patch-4_18_0-553_125_1: kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() | 9.8 | 0.0026 |  |
| [CVE-2026-23461](https://patchblox.com/security/data/cve/CVE-2026-23461.md) | High | kernel-source: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707). | 8.8 | 0.0024 |  |
| [CVE-2026-31588](https://patchblox.com/security/data/cve/CVE-2026-31588.md) | High | KVM: x86: Use scratch field in MMIO fragment to hold small write values | 8.8 | 0.0019 |  |
| [CVE-2026-23406](https://patchblox.com/security/data/cve/CVE-2026-23406.md) | High | apparmor: fix side-effect bug in match_char() macro usage | 7.8 | 0.0018 |  |
| [CVE-2026-23407](https://patchblox.com/security/data/cve/CVE-2026-23407.md) | High | apparmor: fix missing bounds check on DEFAULT table in verify_dfa() | 7.8 | 0.0018 |  |
| [CVE-2026-23408](https://patchblox.com/security/data/cve/CVE-2026-23408.md) | High | apparmor: Fix double free of ns_name in aa_replace_profiles() | 7.8 | 0.0018 |  |
| [CVE-2026-23409](https://patchblox.com/security/data/cve/CVE-2026-23409.md) | High | apparmor: fix differential encoding verification | 7.1 | 0.0018 |  |
| [CVE-2026-31787](https://patchblox.com/security/data/cve/CVE-2026-31787.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: fix double free via VMA splitting pr... | 7.8 | 0.0018 |  |
| [CVE-2026-43329](https://patchblox.com/security/data/cve/CVE-2026-43329.md) | High | kernel-64kb: netfilter: flowtable: strictly check for maximum number of actions (bsc#1265085). | 7.8 | 0.0018 |  |
| [CVE-2026-23209](https://patchblox.com/security/data/cve/CVE-2026-23209.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0017 |  |
| [CVE-2026-31505](https://patchblox.com/security/data/cve/CVE-2026-31505.md) | High | iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() | 7.8 | 0.0016 |  |
| [CVE-2026-43126](https://patchblox.com/security/data/cve/CVE-2026-43126.md) | High | ALSA: mixer: oss: Add card disconnect checkpoints | 7.8 | 0.0016 |  |
| [CVE-2026-43437](https://patchblox.com/security/data/cve/CVE-2026-43437.md) | High | kernel-default: ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() (bsc#1265126). | 7.8 | 0.0016 |  |
| [CVE-2026-23268](https://patchblox.com/security/data/cve/CVE-2026-23268.md) | High | apparmor: fix unprivileged local user can do privileged policy management | 7.8 | 0.0015 |  |
| [CVE-2026-23411](https://patchblox.com/security/data/cve/CVE-2026-23411.md) | High | apparmor: fix race between freeing data and fs accessing it | 7.8 | 0.0015 |  |
| [CVE-2026-23410](https://patchblox.com/security/data/cve/CVE-2026-23410.md) | High | apparmor: fix race on rawdata dereference | 7.8 | 0.0014 |  |
| [CVE-2026-23269](https://patchblox.com/security/data/cve/CVE-2026-23269.md) | High | apparmor: validate DFA start states are in bounds in unpack_pdb | 7.1 | 0.0014 |  |
| [CVE-2026-23449](https://patchblox.com/security/data/cve/CVE-2026-23449.md) | High | kernel-default: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779). | 7.8 | 0.0014 |  |
| [CVE-2026-23458](https://patchblox.com/security/data/cve/CVE-2026-23458.md) | High | kernel-64kb: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781). | 7.8 | 0.0014 |  |
| [CVE-2026-23273](https://patchblox.com/security/data/cve/CVE-2026-23273.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0014 |  |
| [CVE-2026-23351](https://patchblox.com/security/data/cve/CVE-2026-23351.md) | High | netfilter: nft_set_pipapo: split gc into unlink and reclaim phase | 7.8 | 0.0013 |  |
| [CVE-2026-23239](https://patchblox.com/security/data/cve/CVE-2026-23239.md) | High | espintcp: Fix race condition in espintcp_close() | 7.8 | 0.0013 |  |
| [CVE-2026-31507](https://patchblox.com/security/data/cve/CVE-2026-31507.md) | High | net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer | 7.8 | 0.0013 |  |
| [CVE-2026-31586](https://patchblox.com/security/data/cve/CVE-2026-31586.md) | High | mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() | 7.8 | 0.0013 |  |
| [CVE-2026-31403](https://patchblox.com/security/data/cve/CVE-2026-31403.md) | High | kernel-64kb: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796). | 7.8 | 0.0013 |  |
| [CVE-2026-31602](https://patchblox.com/security/data/cve/CVE-2026-31602.md) | High | ALSA: ctxfi: Limit PTP to a single page | 7.8 | 0.0013 |  |
| [CVE-2026-43027](https://patchblox.com/security/data/cve/CVE-2026-43027.md) | High | kernel-default: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1263933). | 7.8 | 0.0013 |  |
| [CVE-2026-31528](https://patchblox.com/security/data/cve/CVE-2026-31528.md) | High | perf: Make sure to use pmu_ctx->pmu for groups | 7.8 | 0.0013 |  |
| [CVE-2026-43330](https://patchblox.com/security/data/cve/CVE-2026-43330.md) | High | kernel-64kb: crypto: caam - fix overflow on long hmac keys (bsc#1264801). | 7.8 | 0.0013 |  |
| [CVE-2026-43025](https://patchblox.com/security/data/cve/CVE-2026-43025.md) | High | kernel-default: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1263931). | 7.3 | 0.0013 |  |
| [CVE-2026-43366](https://patchblox.com/security/data/cve/CVE-2026-43366.md) | High | kernel-docs: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265116). | 7.8 | 0.0013 |  |
| [CVE-2026-31470](https://patchblox.com/security/data/cve/CVE-2026-31470.md) | High | kernel-64kb: virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (bsc#1262665). | 7.1 | 0.0013 |  |
| [CVE-2026-43120](https://patchblox.com/security/data/cve/CVE-2026-43120.md) | High | kernel-default: RDMA/irdma: Fix double free related to rereg_user_mr. | 7.8 | 0.0012 |  |
| [CVE-2026-31512](https://patchblox.com/security/data/cve/CVE-2026-31512.md) | High | Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() | 7.1 | 0.0012 |  |
| [CVE-2026-43044](https://patchblox.com/security/data/cve/CVE-2026-43044.md) | High | kernel-default: crypto: caam - fix DMA corruption on long hmac keys (bsc#1264087). | 7.8 | 0.0012 |  |
| [CVE-2026-43050](https://patchblox.com/security/data/cve/CVE-2026-43050.md) | High | kernel-default: atm: lec: fix use-after-free in sock_def_readable() (bsc#1264082). | 7.0 | 0.0012 |  |
| [CVE-2026-23271](https://patchblox.com/security/data/cve/CVE-2026-23271.md) | High | perf: Fix __perf_event_overflow() vs perf_remove_from_context() race | 7.8 | 0.0011 |  |
| [CVE-2026-31700](https://patchblox.com/security/data/cve/CVE-2026-31700.md) | High | net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() | 7.8 | 0.0011 |  |
| [CVE-2026-43214](https://patchblox.com/security/data/cve/CVE-2026-43214.md) | High | kernel-default: KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (bsc#1264651). | 7.8 | 0.0011 |  |
| [CVE-2026-31504](https://patchblox.com/security/data/cve/CVE-2026-31504.md) | High | net: fix fanout UAF in packet_release() via NETDEV_UP race | 7.8 | 0.0011 |  |
| [CVE-2026-23393](https://patchblox.com/security/data/cve/CVE-2026-23393.md) | High | bridge: cfm: Fix race condition in peer_mep deletion | 7.8 | 0.0010 |  |
| [CVE-2026-31656](https://patchblox.com/security/data/cve/CVE-2026-31656.md) | High | drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat | 8.8 | 0.0009 |  |
| [CVE-2023-2058](https://patchblox.com/security/data/cve/CVE-2023-2058.md) | Routine | kernel-64kb: Security update for the Linux Kernel | n/a | 0.0061 |  |
| [CVE-2026-23405](https://patchblox.com/security/data/cve/CVE-2026-23405.md) | Routine | apparmor: fix: limit the number of levels of policy namespaces | 6.5 | 0.0018 |  |
| [CVE-2026-23403](https://patchblox.com/security/data/cve/CVE-2026-23403.md) | Routine | apparmor: fix memory leak in verify_header | 5.5 | 0.0018 |  |
| [CVE-2026-23404](https://patchblox.com/security/data/cve/CVE-2026-23404.md) | Routine | apparmor: replace recursive profile removal with iterative approach | 5.5 | 0.0018 |  |
| [CVE-2026-31738](https://patchblox.com/security/data/cve/CVE-2026-31738.md) | Routine | kernel-source: vxlan: validate ND option lengths in vxlan_na_create (bsc#1264059). | 5.5 | 0.0012 |  |

---

Data as of 2026-11-11T01:20:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.