# SUSE-SU-2026:2238-1: Security update for 10 packages

SUSE-SU-2026:2238-1, released June 30, 2026, fixes 204 CVEs across 10 products. One of them is being exploited (CVE-2026-46300); 1 on CISA KEV. Patch Radar priority: Patch now.

- Web page: https://patchblox.com/security/fix/linux/suse-su-2026-2238-1
- Platform: Linux
- Released: Jun 30, 2026
- Priority: Patch now (Closes CVE-2026-46300, exploited (CISA KEV))
- CVEs: 204, exploited: 1, on CISA KEV: 1
- Vendor advisory: https://osv.dev/vulnerability/SUSE-SU-2026:2238-1

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [kernel-64kb](https://patchblox.com/security/data/product/linux/kernel-64kb.md) | sles 15.7 | 6.4.0-150700.53.55.1 |
| [kernel-azure](https://patchblox.com/security/data/product/linux/kernel-azure.md) | sles 15.7 | 6.4.0-150700.53.55.1 |
| [kernel-default](https://patchblox.com/security/data/product/linux/kernel-default.md) | sles 15.7 | 6.4.0-150700.53.55.1 |
| [kernel-default-base](https://patchblox.com/security/data/product/linux/kernel-default-base.md) | sles 15.7 | 6.4.0-150700.53.55.1.150700.17.33.1 |
| [kernel-docs](https://patchblox.com/security/data/product/linux/kernel-docs.md) | sles 15.7 | 6.4.0-150700.53.55.1 |
| [kernel-livepatch-SLE15-SP7_Update_15](https://patchblox.com/security/data/product/linux/kernel-livepatch-sle15-sp7-update-15.md) | sles 15.7 | 1-150700.15.3.1 |
| [kernel-obs-build](https://patchblox.com/security/data/product/linux/kernel-obs-build.md) | sles 15.7 | 6.4.0-150700.53.55.1 |
| [kernel-source](https://patchblox.com/security/data/product/linux/kernel-source.md) | sles 15.7 | 6.4.0-150700.53.55.1 |
| [kernel-syms](https://patchblox.com/security/data/product/linux/kernel-syms.md) | sles 15.7 | 6.4.0-150700.53.55.1 |
| [kernel-zfcpdump](https://patchblox.com/security/data/product/linux/kernel-zfcpdump.md) | sles 15.7 | 6.4.0-150700.53.55.1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-46300](https://patchblox.com/security/data/cve/CVE-2026-46300.md) | Patch now | net: skbuff: preserve shared-frag marker during coalescing | 8.1 | 0.1613 | CISA KEV |
| [CVE-2026-23450](https://patchblox.com/security/data/cve/CVE-2026-23450.md) | Urgent | kernel-default: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584). | 9.8 | 0.0046 |  |
| [CVE-2026-23395](https://patchblox.com/security/data/cve/CVE-2026-23395.md) | Urgent | Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ | 9.1 | 0.0027 |  |
| [CVE-2026-43503](https://patchblox.com/security/data/cve/CVE-2026-43503.md) | High | net: skbuff: propagate shared-frag marker through frag-transfer helpers | 8.8 | 0.0199 |  |
| [CVE-2026-23455](https://patchblox.com/security/data/cve/CVE-2026-23455.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero leng... | 9.1 | 0.0159 |  |
| [CVE-2026-31402](https://patchblox.com/security/data/cve/CVE-2026-31402.md) | High | kernel-64kb: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638). | 9.8 | 0.0122 |  |
| [CVE-2026-43037](https://patchblox.com/security/data/cve/CVE-2026-43037.md) | High | ip6_tunnel: clear skb2->cb[] in ip4ip6_err() | 9.8 | 0.0069 |  |
| [CVE-2026-46331](https://patchblox.com/security/data/cve/CVE-2026-46331.md) | High | net/sched: fix pedit partial COW leading to page cache corruption | 8.1 | 0.0064 |  |
| [CVE-2026-31682](https://patchblox.com/security/data/cve/CVE-2026-31682.md) | High | bridge: br_nd_send: linearize skb before parsing ND options | 9.1 | 0.0064 |  |
| [CVE-2026-43441](https://patchblox.com/security/data/cve/CVE-2026-43441.md) | High | kernel-64kb: net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1264674). | 7.5 | 0.0059 |  |
| [CVE-2026-23240](https://patchblox.com/security/data/cve/CVE-2026-23240.md) | High | tls: Fix race condition in tls_sw_cancel_work_tx() | 9.8 | 0.0056 |  |
| [CVE-2026-31405](https://patchblox.com/security/data/cve/CVE-2026-31405.md) | High | kernel-64kb: Security update for the Linux Kernel | 9.8 | 0.0056 |  |
| [CVE-2026-23456](https://patchblox.com/security/data/cve/CVE-2026-23456.md) | High | kernel-64kb: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703). | 8.2 | 0.0054 |  |
| [CVE-2026-43365](https://patchblox.com/security/data/cve/CVE-2026-43365.md) | High | kernel-64kb: xfs: fix undersized l_iclog_roundoff values (bsc#1265119). | 8.2 | 0.0051 |  |
| [CVE-2026-31685](https://patchblox.com/security/data/cve/CVE-2026-31685.md) | High | netfilter: ip6t_eui64: reject invalid MAC header for all packets | 9.4 | 0.0049 |  |
| [CVE-2026-31669](https://patchblox.com/security/data/cve/CVE-2026-31669.md) | High | mptcp: fix slab-use-after-free in __inet_lookup_established | 9.8 | 0.0047 |  |
| [CVE-2026-31417](https://patchblox.com/security/data/cve/CVE-2026-31417.md) | High | net/x25: Fix overflow when accumulating packets | 8.1 | 0.0047 |  |
| [CVE-2026-43190](https://patchblox.com/security/data/cve/CVE-2026-43190.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_tcpmss: check remaining length befo... | 8.2 | 0.0046 |  |
| [CVE-2026-31649](https://patchblox.com/security/data/cve/CVE-2026-31649.md) | High | net: stmmac: fix integer underflow in chain mode | 9.8 | 0.0046 |  |
| [CVE-2026-31436](https://patchblox.com/security/data/cve/CVE-2026-31436.md) | High | kernel-64kb: dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() (bsc#1262602). | 9.8 | 0.0046 |  |
| [CVE-2026-23457](https://patchblox.com/security/data/cve/CVE-2026-23457.md) | High | kernel-64kb: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686). | 8.6 | 0.0045 |  |
| [CVE-2026-31668](https://patchblox.com/security/data/cve/CVE-2026-31668.md) | High | seg6: separate dst_cache for input and output paths in seg6 lwtunnel | 9.8 | 0.0044 |  |
| [CVE-2026-43494](https://patchblox.com/security/data/cve/CVE-2026-43494.md) | High | net/rds: reset op_nents when zerocopy page pin fails | 7.8 | 0.0041 |  |
| [CVE-2026-31533](https://patchblox.com/security/data/cve/CVE-2026-31533.md) | High | kernel-default: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262758). | 9.8 | 0.0040 |  |
| [CVE-2026-31662](https://patchblox.com/security/data/cve/CVE-2026-31662.md) | High | tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG | 7.5 | 0.0039 |  |
| [CVE-2026-31408](https://patchblox.com/security/data/cve/CVE-2026-31408.md) | High | Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold | 8.8 | 0.0032 |  |
| [CVE-2026-31607](https://patchblox.com/security/data/cve/CVE-2026-31607.md) | High | usbip: validate number_of_packets in usbip_pack_ret_submit() | 9.8 | 0.0031 |  |
| [CVE-2026-31622](https://patchblox.com/security/data/cve/CVE-2026-31622.md) | High | NFC: digital: Bounds check NFC-A cascade depth in SDD response handler | 8.8 | 0.0029 |  |
| [CVE-2026-23246](https://patchblox.com/security/data/cve/CVE-2026-23246.md) | High | wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration | 8.8 | 0.0029 |  |
| [CVE-2025-54518](https://patchblox.com/security/data/cve/CVE-2025-54518.md) | High | AMD: CVE-2025-54518 CPU OP Cache Corruption | 7.8 | 0.0029 |  |
| [CVE-2026-31694](https://patchblox.com/security/data/cve/CVE-2026-31694.md) | High | fuse: reject oversized dirents in page cache | 7.8 | 0.0028 |  |
| [CVE-2026-43334](https://patchblox.com/security/data/cve/CVE-2026-43334.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SMP: force responder MITM requirements... | 8.8 | 0.0028 |  |
| [CVE-2026-23462](https://patchblox.com/security/data/cve/CVE-2026-23462.md) | High | kernel-default: Bluetooth: HIDP: Fix possible UAF (bsc#1261710). | 8.8 | 0.0028 |  |
| [CVE-2026-43110](https://patchblox.com/security/data/cve/CVE-2026-43110.md) | High | kernel-default: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264482). | 8.8 | 0.0027 |  |
| [CVE-2026-31393](https://patchblox.com/security/data/cve/CVE-2026-31393.md) | High | kernel-64kb: Security update for the Linux Kernel | 8.1 | 0.0027 |  |
| [CVE-2026-31570](https://patchblox.com/security/data/cve/CVE-2026-31570.md) | High | can: gw: fix OOB heap access in cgw_csum_crc8_rel() | 8.8 | 0.0026 |  |
| [CVE-2026-43038](https://patchblox.com/security/data/cve/CVE-2026-43038.md) | High | kpatch-patch-4_18_0-553_125_1: kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() | 9.8 | 0.0026 |  |
| [CVE-2026-23461](https://patchblox.com/security/data/cve/CVE-2026-23461.md) | High | kernel-source: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707). | 8.8 | 0.0024 |  |
| [CVE-2025-71238](https://patchblox.com/security/data/cve/CVE-2025-71238.md) | High | scsi: qla2xxx: Fix bsg_done() causing double free | 7.8 | 0.0022 |  |
| [CVE-2026-31588](https://patchblox.com/security/data/cve/CVE-2026-31588.md) | High | KVM: x86: Use scratch field in MMIO fragment to hold small write values | 8.8 | 0.0019 |  |
| [CVE-2026-23406](https://patchblox.com/security/data/cve/CVE-2026-23406.md) | High | apparmor: fix side-effect bug in match_char() macro usage | 7.8 | 0.0018 |  |
| [CVE-2026-23407](https://patchblox.com/security/data/cve/CVE-2026-23407.md) | High | apparmor: fix missing bounds check on DEFAULT table in verify_dfa() | 7.8 | 0.0018 |  |
| [CVE-2026-23408](https://patchblox.com/security/data/cve/CVE-2026-23408.md) | High | apparmor: Fix double free of ns_name in aa_replace_profiles() | 7.8 | 0.0018 |  |
| [CVE-2026-23409](https://patchblox.com/security/data/cve/CVE-2026-23409.md) | High | apparmor: fix differential encoding verification | 7.1 | 0.0018 |  |
| [CVE-2026-31787](https://patchblox.com/security/data/cve/CVE-2026-31787.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: fix double free via VMA splitting pr... | 7.8 | 0.0018 |  |
| [CVE-2026-31407](https://patchblox.com/security/data/cve/CVE-2026-31407.md) | High | netfilter: conntrack: add missing netlink policy validations | 7.1 | 0.0018 |  |
| [CVE-2026-43329](https://patchblox.com/security/data/cve/CVE-2026-43329.md) | High | kernel-64kb: netfilter: flowtable: strictly check for maximum number of actions (bsc#1265085). | 7.8 | 0.0018 |  |
| [CVE-2026-23383](https://patchblox.com/security/data/cve/CVE-2026-23383.md) | High | bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing | 7.8 | 0.0018 |  |
| [CVE-2026-23209](https://patchblox.com/security/data/cve/CVE-2026-23209.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0017 |  |
| [CVE-2026-23392](https://patchblox.com/security/data/cve/CVE-2026-23392.md) | High | netfilter: nf_tables: release flowtable after rcu grace period on error | 8.8 | 0.0017 |  |
| [CVE-2026-31505](https://patchblox.com/security/data/cve/CVE-2026-31505.md) | High | iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() | 7.8 | 0.0016 |  |
| [CVE-2026-31675](https://patchblox.com/security/data/cve/CVE-2026-31675.md) | High | net/sched: sch_netem: fix out-of-bounds access in packet corruption | 7.8 | 0.0016 |  |
| [CVE-2026-43009](https://patchblox.com/security/data/cve/CVE-2026-43009.md) | High | bpf: Fix incorrect pruning due to atomic fetch precision tracking | 7.8 | 0.0016 |  |
| [CVE-2026-43126](https://patchblox.com/security/data/cve/CVE-2026-43126.md) | High | ALSA: mixer: oss: Add card disconnect checkpoints | 7.8 | 0.0016 |  |
| [CVE-2026-31525](https://patchblox.com/security/data/cve/CVE-2026-31525.md) | High | bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN | 7.8 | 0.0016 |  |
| [CVE-2026-31679](https://patchblox.com/security/data/cve/CVE-2026-31679.md) | High | openvswitch: validate MPLS set/set_masked payload length | 7.1 | 0.0016 |  |
| [CVE-2026-43437](https://patchblox.com/security/data/cve/CVE-2026-43437.md) | High | kernel-default: ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() (bsc#1265126). | 7.8 | 0.0016 |  |
| [CVE-2026-23412](https://patchblox.com/security/data/cve/CVE-2026-23412.md) | High | kernel-64kb: netfilter: bpf: defer hook memory release until rcu readers are done (bsc#1261412). | 7.8 | 0.0016 |  |
| [CVE-2026-31426](https://patchblox.com/security/data/cve/CVE-2026-31426.md) | High | ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() | 7.0 | 0.0015 |  |
| [CVE-2026-23268](https://patchblox.com/security/data/cve/CVE-2026-23268.md) | High | apparmor: fix unprivileged local user can do privileged policy management | 7.8 | 0.0015 |  |
| [CVE-2026-23411](https://patchblox.com/security/data/cve/CVE-2026-23411.md) | High | apparmor: fix race between freeing data and fs accessing it | 7.8 | 0.0015 |  |
| [CVE-2026-31449](https://patchblox.com/security/data/cve/CVE-2026-31449.md) | High | ext4: validate p_idx bounds in ext4_ext_correct_indexes | 7.8 | 0.0015 |  |
| [CVE-2026-23253](https://patchblox.com/security/data/cve/CVE-2026-23253.md) | High | media: dvb-core: fix wrong reinitialization of ringbuffer on reopen | 7.8 | 0.0015 |  |
| [CVE-2026-23410](https://patchblox.com/security/data/cve/CVE-2026-23410.md) | High | apparmor: fix race on rawdata dereference | 7.8 | 0.0014 |  |
| [CVE-2026-23343](https://patchblox.com/security/data/cve/CVE-2026-23343.md) | High | xdp: produce a warning when calculated tailroom is negative | 7.8 | 0.0014 |  |
| [CVE-2026-23372](https://patchblox.com/security/data/cve/CVE-2026-23372.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0014 |  |
| [CVE-2026-23378](https://patchblox.com/security/data/cve/CVE-2026-23378.md) | High | net/sched: act_ife: Fix metalist update behavior | 7.8 | 0.0014 |  |
| [CVE-2026-31488](https://patchblox.com/security/data/cve/CVE-2026-31488.md) | High | drm/amd/display: Do not skip unrelated mode changes in DSC validation | 7.8 | 0.0014 |  |
| [CVE-2026-23245](https://patchblox.com/security/data/cve/CVE-2026-23245.md) | High | net/sched: act_gate: snapshot parameters with RCU on replace | 7.8 | 0.0014 |  |
| [CVE-2026-23318](https://patchblox.com/security/data/cve/CVE-2026-23318.md) | High | ALSA: usb-audio: Use correct version for UAC3 header validation | 7.7 | 0.0014 |  |
| [CVE-2026-23269](https://patchblox.com/security/data/cve/CVE-2026-23269.md) | High | apparmor: validate DFA start states are in bounds in unpack_pdb | 7.1 | 0.0014 |  |
| [CVE-2026-23336](https://patchblox.com/security/data/cve/CVE-2026-23336.md) | High | wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() | 7.8 | 0.0014 |  |
| [CVE-2026-23168](https://patchblox.com/security/data/cve/CVE-2026-23168.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: flex_proportions: make fprop_new_period() hardirq... | 7.8 | 0.0014 |  |
| [CVE-2026-23449](https://patchblox.com/security/data/cve/CVE-2026-23449.md) | High | kernel-default: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779). | 7.8 | 0.0014 |  |
| [CVE-2026-23458](https://patchblox.com/security/data/cve/CVE-2026-23458.md) | High | kernel-64kb: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781). | 7.8 | 0.0014 |  |
| [CVE-2026-23273](https://patchblox.com/security/data/cve/CVE-2026-23273.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0014 |  |
| [CVE-2026-31494](https://patchblox.com/security/data/cve/CVE-2026-31494.md) | High | net: macb: use the current queue number for stats | 7.8 | 0.0014 |  |
| [CVE-2026-23351](https://patchblox.com/security/data/cve/CVE-2026-23351.md) | High | netfilter: nft_set_pipapo: split gc into unlink and reclaim phase | 7.8 | 0.0013 |  |
| [CVE-2026-23354](https://patchblox.com/security/data/cve/CVE-2026-23354.md) | High | kernel-64kb: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801). | 7.8 | 0.0013 |  |
| [CVE-2026-23442](https://patchblox.com/security/data/cve/CVE-2026-23442.md) | High | ipv6: add NULL checks for idev in SRv6 paths | 7.8 | 0.0013 |  |
| [CVE-2026-23447](https://patchblox.com/security/data/cve/CVE-2026-23447.md) | High | net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check | 7.8 | 0.0013 |  |
| [CVE-2026-23448](https://patchblox.com/security/data/cve/CVE-2026-23448.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0013 |  |
| [CVE-2026-23300](https://patchblox.com/security/data/cve/CVE-2026-23300.md) | High | net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop | 7.5 | 0.0013 |  |
| [CVE-2026-23335](https://patchblox.com/security/data/cve/CVE-2026-23335.md) | High | RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() | 7.1 | 0.0013 |  |
| [CVE-2026-23239](https://patchblox.com/security/data/cve/CVE-2026-23239.md) | High | espintcp: Fix race condition in espintcp_close() | 7.8 | 0.0013 |  |
| [CVE-2026-31411](https://patchblox.com/security/data/cve/CVE-2026-31411.md) | High | kernel-64kb: net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (bsc#1261752). | 7.1 | 0.0013 |  |
| [CVE-2026-31507](https://patchblox.com/security/data/cve/CVE-2026-31507.md) | High | net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer | 7.8 | 0.0013 |  |
| [CVE-2026-31586](https://patchblox.com/security/data/cve/CVE-2026-31586.md) | High | mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() | 7.8 | 0.0013 |  |
| [CVE-2026-23391](https://patchblox.com/security/data/cve/CVE-2026-23391.md) | High | netfilter: xt_CT: drop pending enqueued packets on template removal | 7.8 | 0.0013 |  |
| [CVE-2026-31403](https://patchblox.com/security/data/cve/CVE-2026-31403.md) | High | kernel-64kb: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796). | 7.8 | 0.0013 |  |
| [CVE-2026-31602](https://patchblox.com/security/data/cve/CVE-2026-31602.md) | High | ALSA: ctxfi: Limit PTP to a single page | 7.8 | 0.0013 |  |
| [CVE-2026-43027](https://patchblox.com/security/data/cve/CVE-2026-43027.md) | High | kernel-default: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1263933). | 7.8 | 0.0013 |  |
| [CVE-2026-23315](https://patchblox.com/security/data/cve/CVE-2026-23315.md) | High | wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() | 7.1 | 0.0013 |  |
| [CVE-2026-23306](https://patchblox.com/security/data/cve/CVE-2026-23306.md) | High | scsi: pm8001: Fix use-after-free in pm8001_queue_command() | 7.8 | 0.0013 |  |
| [CVE-2026-23325](https://patchblox.com/security/data/cve/CVE-2026-23325.md) | High | wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() | 7.1 | 0.0013 |  |
| [CVE-2026-23339](https://patchblox.com/security/data/cve/CVE-2026-23339.md) | High | nfc: nci: free skb on nci_transceive early error paths | 7.1 | 0.0013 |  |
| [CVE-2026-23363](https://patchblox.com/security/data/cve/CVE-2026-23363.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.1 | 0.0013 |  |
| [CVE-2026-23367](https://patchblox.com/security/data/cve/CVE-2026-23367.md) | High | wifi: radiotap: reject radiotap with unknown bits | 7.1 | 0.0013 |  |
| [CVE-2026-31528](https://patchblox.com/security/data/cve/CVE-2026-31528.md) | High | perf: Make sure to use pmu_ctx->pmu for groups | 7.8 | 0.0013 |  |
| [CVE-2026-43330](https://patchblox.com/security/data/cve/CVE-2026-43330.md) | High | kernel-64kb: crypto: caam - fix overflow on long hmac keys (bsc#1264801). | 7.8 | 0.0013 |  |
| [CVE-2026-23454](https://patchblox.com/security/data/cve/CVE-2026-23454.md) | High | kernel-default: Security update for the Linux Kernel | 7.0 | 0.0013 |  |
| [CVE-2026-31515](https://patchblox.com/security/data/cve/CVE-2026-31515.md) | High | af_key: validate families in pfkey_send_migrate() | 7.0 | 0.0013 |  |
| [CVE-2026-23262](https://patchblox.com/security/data/cve/CVE-2026-23262.md) | High | kernel-64kb: gve: Fix stats report corruption on queue count change (bsc#1259870). | 7.8 | 0.0013 |  |
| [CVE-2026-43025](https://patchblox.com/security/data/cve/CVE-2026-43025.md) | High | kernel-default: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1263931). | 7.3 | 0.0013 |  |
| [CVE-2026-23308](https://patchblox.com/security/data/cve/CVE-2026-23308.md) | High | pinctrl: equilibrium: fix warning trace on load | 7.8 | 0.0013 |  |
| [CVE-2026-43366](https://patchblox.com/security/data/cve/CVE-2026-43366.md) | High | kernel-docs: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265116). | 7.8 | 0.0013 |  |
| [CVE-2026-23397](https://patchblox.com/security/data/cve/CVE-2026-23397.md) | High | nfnetlink_osf: validate individual option lengths in fingerprints | 7.1 | 0.0013 |  |
| [CVE-2026-31470](https://patchblox.com/security/data/cve/CVE-2026-31470.md) | High | kernel-64kb: virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (bsc#1262665). | 7.1 | 0.0013 |  |
| [CVE-2026-31416](https://patchblox.com/security/data/cve/CVE-2026-31416.md) | High | netfilter: nfnetlink_log: account for netlink header size | 8.1 | 0.0013 |  |
| [CVE-2026-31427](https://patchblox.com/security/data/cve/CVE-2026-31427.md) | High | netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp | 7.8 | 0.0013 |  |
| [CVE-2026-23374](https://patchblox.com/security/data/cve/CVE-2026-23374.md) | High | blktrace: fix __this_cpu_read/write in preemptible context | 8.4 | 0.0012 |  |
| [CVE-2026-31389](https://patchblox.com/security/data/cve/CVE-2026-31389.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0012 |  |
| [CVE-2026-43120](https://patchblox.com/security/data/cve/CVE-2026-43120.md) | High | kernel-default: RDMA/irdma: Fix double free related to rereg_user_mr. | 7.8 | 0.0012 |  |
| [CVE-2026-31512](https://patchblox.com/security/data/cve/CVE-2026-31512.md) | High | Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() | 7.1 | 0.0012 |  |
| [CVE-2026-31519](https://patchblox.com/security/data/cve/CVE-2026-31519.md) | High | btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create | 7.1 | 0.0012 |  |
| [CVE-2026-43088](https://patchblox.com/security/data/cve/CVE-2026-43088.md) | High | net: af_key: zero aligned sockaddr tail in PF_KEY exports | 7.1 | 0.0012 |  |
| [CVE-2026-31392](https://patchblox.com/security/data/cve/CVE-2026-31392.md) | High | kernel-64kb: Security update for the Linux Kernel | 8.1 | 0.0012 |  |
| [CVE-2026-43060](https://patchblox.com/security/data/cve/CVE-2026-43060.md) | High | kernel-64kb: netfilter: nft_ct: drop pending enqueued packets on removal (bsc#1264183). | 7.8 | 0.0012 |  |
| [CVE-2026-43044](https://patchblox.com/security/data/cve/CVE-2026-43044.md) | High | kernel-default: crypto: caam - fix DMA corruption on long hmac keys (bsc#1264087). | 7.8 | 0.0012 |  |
| [CVE-2026-31395](https://patchblox.com/security/data/cve/CVE-2026-31395.md) | High | kernel-64kb: bnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handler (bsc#1261786). | 7.1 | 0.0012 |  |
| [CVE-2026-43050](https://patchblox.com/security/data/cve/CVE-2026-43050.md) | High | kernel-default: atm: lec: fix use-after-free in sock_def_readable() (bsc#1264082). | 7.0 | 0.0012 |  |
| [CVE-2026-23340](https://patchblox.com/security/data/cve/CVE-2026-23340.md) | High | net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs | 7.8 | 0.0012 |  |
| [CVE-2026-31684](https://patchblox.com/security/data/cve/CVE-2026-31684.md) | High | net: sched: act_csum: validate nested VLAN headers | 7.8 | 0.0012 |  |
| [CVE-2026-23271](https://patchblox.com/security/data/cve/CVE-2026-23271.md) | High | perf: Fix __perf_event_overflow() vs perf_remove_from_context() race | 7.8 | 0.0011 |  |
| [CVE-2026-31700](https://patchblox.com/security/data/cve/CVE-2026-31700.md) | High | net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() | 7.8 | 0.0011 |  |
| [CVE-2026-43214](https://patchblox.com/security/data/cve/CVE-2026-43214.md) | High | kernel-default: KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (bsc#1264651). | 7.8 | 0.0011 |  |
| [CVE-2026-31504](https://patchblox.com/security/data/cve/CVE-2026-31504.md) | High | net: fix fanout UAF in packet_release() via NETDEV_UP race | 7.8 | 0.0011 |  |
| [CVE-2026-23466](https://patchblox.com/security/data/cve/CVE-2026-23466.md) | High | kernel-64kb: Security update for the Linux Kernel | 8.8 | 0.0010 |  |
| [CVE-2026-23393](https://patchblox.com/security/data/cve/CVE-2026-23393.md) | High | bridge: cfm: Fix race condition in peer_mep deletion | 7.8 | 0.0010 |  |
| [CVE-2026-31656](https://patchblox.com/security/data/cve/CVE-2026-31656.md) | High | drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat | 8.8 | 0.0009 |  |
| [CVE-2026-31404](https://patchblox.com/security/data/cve/CVE-2026-31404.md) | High | kernel-64kb: xfs: avoid dereferencing log items after push callbacks (bsc#1261628). | 7.8 | n/a |  |
| [CVE-2025-71183](https://patchblox.com/security/data/cve/CVE-2025-71183.md) | Routine | btrfs: always detect conflicting inodes when logging inode refs | 5.5 | 0.0032 |  |
| [CVE-2026-23440](https://patchblox.com/security/data/cve/CVE-2026-23440.md) | Routine | kernel-64kb: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641). | 4.7 | 0.0028 |  |
| [CVE-2025-40219](https://patchblox.com/security/data/cve/CVE-2025-40219.md) | Routine | PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV | 6.7 | 0.0024 |  |
| [CVE-2026-23236](https://patchblox.com/security/data/cve/CVE-2026-23236.md) | Routine | fbdev: smscufx: properly copy ioctl memory to kernelspace | 5.5 | 0.0023 |  |
| [CVE-2026-23237](https://patchblox.com/security/data/cve/CVE-2026-23237.md) | Routine | platform/x86: classmate-laptop: Add missing NULL pointer checks | 5.5 | 0.0022 |  |
| [CVE-2026-23419](https://patchblox.com/security/data/cve/CVE-2026-23419.md) | Routine | kernel-64kb: net/rds: Fix circular locking dependency in rds_tcp_tune (bsc#1261507). | 5.5 | 0.0019 |  |
| [CVE-2025-68310](https://patchblox.com/security/data/cve/CVE-2025-68310.md) | Routine | kernel-64kb: s390/pci: Use pci_uevent_ers() in PCI recovery (bsc#1255160). | n/a | 0.0019 |  |
| [CVE-2026-23405](https://patchblox.com/security/data/cve/CVE-2026-23405.md) | Routine | apparmor: fix: limit the number of levels of policy namespaces | 6.5 | 0.0018 |  |
| [CVE-2026-23403](https://patchblox.com/security/data/cve/CVE-2026-23403.md) | Routine | apparmor: fix memory leak in verify_header | 5.5 | 0.0018 |  |
| [CVE-2026-23404](https://patchblox.com/security/data/cve/CVE-2026-23404.md) | Routine | apparmor: replace recursive profile removal with iterative approach | 5.5 | 0.0018 |  |
| [CVE-2026-23276](https://patchblox.com/security/data/cve/CVE-2026-23276.md) | Routine | net: add xmit recursion limit to tunnel xmit functions | 5.5 | 0.0018 |  |
| [CVE-2026-31412](https://patchblox.com/security/data/cve/CVE-2026-31412.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0017 |  |
| [CVE-2026-23472](https://patchblox.com/security/data/cve/CVE-2026-23472.md) | Routine | serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN | 5.5 | 0.0016 |  |
| [CVE-2026-23474](https://patchblox.com/security/data/cve/CVE-2026-23474.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0015 |  |
| [CVE-2026-23279](https://patchblox.com/security/data/cve/CVE-2026-23279.md) | Routine | wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() | 6.5 | 0.0015 |  |
| [CVE-2026-31428](https://patchblox.com/security/data/cve/CVE-2026-31428.md) | Routine | netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD | 5.5 | 0.0014 |  |
| [CVE-2026-23290](https://patchblox.com/security/data/cve/CVE-2026-23290.md) | Routine | net: usb: pegasus: validate USB endpoints | 5.5 | 0.0013 |  |
| [CVE-2026-23304](https://patchblox.com/security/data/cve/CVE-2026-23304.md) | Routine | ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() | 5.5 | 0.0013 |  |
| [CVE-2026-23321](https://patchblox.com/security/data/cve/CVE-2026-23321.md) | Routine | kernel-64kb: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505). | 5.5 | 0.0013 |  |
| [CVE-2026-23365](https://patchblox.com/security/data/cve/CVE-2026-23365.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0013 |  |
| [CVE-2026-23370](https://patchblox.com/security/data/cve/CVE-2026-23370.md) | Routine | platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data | 5.5 | 0.0013 |  |
| [CVE-2026-23445](https://patchblox.com/security/data/cve/CVE-2026-23445.md) | Routine | kernel-64kb: igc: fix page fault in XDP TX timestamps handling (bsc#1261702). | 5.5 | 0.0013 |  |
| [CVE-2026-23446](https://patchblox.com/security/data/cve/CVE-2026-23446.md) | Routine | net: usb: aqc111: Do not perform PM inside suspend callback | 5.5 | 0.0013 |  |
| [CVE-2026-23399](https://patchblox.com/security/data/cve/CVE-2026-23399.md) | Routine | nf_tables: nft_dynset: fix possible stateful expression memleak in error path | 6.5 | 0.0013 |  |
| [CVE-2026-23346](https://patchblox.com/security/data/cve/CVE-2026-23346.md) | Routine | arm64: io: Extract user memory type in ioremap_prot() | 5.5 | 0.0013 |  |
| [CVE-2026-23291](https://patchblox.com/security/data/cve/CVE-2026-23291.md) | Routine | nfc: pn533: properly drop the usb interface reference on disconnect | 5.5 | 0.0013 |  |
| [CVE-2026-23312](https://patchblox.com/security/data/cve/CVE-2026-23312.md) | Routine | net: usb: kaweth: validate USB endpoints | 5.5 | 0.0013 |  |
| [CVE-2026-23475](https://patchblox.com/security/data/cve/CVE-2026-23475.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0013 |  |
| [CVE-2026-23460](https://patchblox.com/security/data/cve/CVE-2026-23460.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0013 |  |
| [CVE-2026-23465](https://patchblox.com/security/data/cve/CVE-2026-23465.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0013 |  |
| [CVE-2026-23468](https://patchblox.com/security/data/cve/CVE-2026-23468.md) | Routine | drm/amdgpu: Limit BO list entry count to prevent resource exhaustion | 5.5 | 0.0013 |  |
| [CVE-2026-23298](https://patchblox.com/security/data/cve/CVE-2026-23298.md) | Routine | can: ucan: Fix infinite loop from zero-length messages | 5.5 | 0.0013 |  |
| [CVE-2026-23307](https://patchblox.com/security/data/cve/CVE-2026-23307.md) | Routine | can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message | 5.5 | 0.0013 |  |
| [CVE-2026-23313](https://patchblox.com/security/data/cve/CVE-2026-23313.md) | Routine | kernel-64kb: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555). | 5.5 | 0.0013 |  |
| [CVE-2026-23324](https://patchblox.com/security/data/cve/CVE-2026-23324.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0013 |  |
| [CVE-2026-31422](https://patchblox.com/security/data/cve/CVE-2026-31422.md) | Routine | net/sched: cls_flow: fix NULL pointer dereference on shared blocks | 5.5 | 0.0013 |  |
| [CVE-2026-31424](https://patchblox.com/security/data/cve/CVE-2026-31424.md) | Routine | netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP | 5.5 | 0.0013 |  |
| [CVE-2026-31421](https://patchblox.com/security/data/cve/CVE-2026-31421.md) | Routine | net/sched: cls_fw: fix NULL pointer dereference on shared blocks | 5.5 | 0.0013 |  |
| [CVE-2026-31423](https://patchblox.com/security/data/cve/CVE-2026-31423.md) | Routine | net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() | 5.5 | 0.0013 |  |
| [CVE-2026-31496](https://patchblox.com/security/data/cve/CVE-2026-31496.md) | Routine | netfilter: nf_conntrack_expect: skip expectations in other netns via proc | 5.5 | 0.0013 |  |
| [CVE-2026-23443](https://patchblox.com/security/data/cve/CVE-2026-23443.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0012 |  |
| [CVE-2026-31681](https://patchblox.com/security/data/cve/CVE-2026-31681.md) | Routine | netfilter: xt_multiport: validate range encoding in checkentry | 6.1 | 0.0012 |  |
| [CVE-2026-31550](https://patchblox.com/security/data/cve/CVE-2026-31550.md) | Routine | pmdomain: bcm: bcm2835-power: Increase ASB control timeout | 5.5 | 0.0012 |  |
| [CVE-2026-31738](https://patchblox.com/security/data/cve/CVE-2026-31738.md) | Routine | kernel-source: vxlan: validate ND option lengths in vxlan_na_create (bsc#1264059). | 5.5 | 0.0012 |  |
| [CVE-2026-43419](https://patchblox.com/security/data/cve/CVE-2026-43419.md) | Routine | kernel-rt-debug: kernel: ceph: fix memory leaks in ceph_mdsc_build_path() | 5.5 | 0.0012 |  |
| [CVE-2026-23396](https://patchblox.com/security/data/cve/CVE-2026-23396.md) | Routine | wifi: mac80211: fix NULL deref in mesh_matches_local() | 6.5 | 0.0012 |  |
| [CVE-2026-23260](https://patchblox.com/security/data/cve/CVE-2026-23260.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0012 |  |
| [CVE-2026-23261](https://patchblox.com/security/data/cve/CVE-2026-23261.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0012 |  |
| [CVE-2026-23264](https://patchblox.com/security/data/cve/CVE-2026-23264.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0012 |  |
| [CVE-2026-23266](https://patchblox.com/security/data/cve/CVE-2026-23266.md) | Routine | fbdev: rivafb: fix divide error in nv3_arb() | 5.5 | 0.0012 |  |
| [CVE-2026-23382](https://patchblox.com/security/data/cve/CVE-2026-23382.md) | Routine | HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them | 5.5 | 0.0012 |  |
| [CVE-2026-23426](https://patchblox.com/security/data/cve/CVE-2026-23426.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0012 |  |
| [CVE-2026-31400](https://patchblox.com/security/data/cve/CVE-2026-31400.md) | Routine | kernel-64kb: sunrpc: fix cache_request leak in cache_release (bsc#1261645). | 5.5 | 0.0012 |  |
| [CVE-2026-31425](https://patchblox.com/security/data/cve/CVE-2026-31425.md) | Routine | kernel-64kb: rds: ib: reject FRMR registration before IB connection is established (bsc#1262074). | 5.5 | 0.0012 |  |
| [CVE-2026-43265](https://patchblox.com/security/data/cve/CVE-2026-43265.md) | Routine | kernel-64kb: KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() (bsc#1264427). | 5.5 | 0.0012 |  |
| [CVE-2026-23373](https://patchblox.com/security/data/cve/CVE-2026-23373.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0012 |  |
| [CVE-2026-31394](https://patchblox.com/security/data/cve/CVE-2026-31394.md) | Routine | mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations | 5.5 | 0.0012 |  |
| [CVE-2026-31415](https://patchblox.com/security/data/cve/CVE-2026-31415.md) | Routine | kernel-64kb: ipv6: avoid overflows in ip6_datagram_send_ctl() (bsc#1262099). | 5.5 | 0.0012 |  |
| [CVE-2026-23418](https://patchblox.com/security/data/cve/CVE-2026-23418.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0012 |  |
| [CVE-2026-23434](https://patchblox.com/security/data/cve/CVE-2026-23434.md) | Routine | mtd: rawnand: serialize lock/unlock against other NAND operations | 5.5 | 0.0011 |  |
| [CVE-2026-31547](https://patchblox.com/security/data/cve/CVE-2026-31547.md) | Routine | kernel-64kb: drm/xe: Fix missing runtime PM reference in ccs_mode_store (bsc#1263018). | 5.5 | 0.0011 |  |
| [CVE-2026-23357](https://patchblox.com/security/data/cve/CVE-2026-23357.md) | Routine | can: mcp251x: fix deadlock in error path of mcp251x_open | 5.5 | 0.0011 |  |
| [CVE-2026-23368](https://patchblox.com/security/data/cve/CVE-2026-23368.md) | Routine | kernel-source: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530). | 5.5 | 0.0010 |  |
| [CVE-2026-31565](https://patchblox.com/security/data/cve/CVE-2026-31565.md) | Routine | RDMA/irdma: Fix deadlock during netdev reset with active connections | 5.5 | 0.0010 |  |
| [CVE-2026-23362](https://patchblox.com/security/data/cve/CVE-2026-23362.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0010 |  |
| [CVE-2026-23470](https://patchblox.com/security/data/cve/CVE-2026-23470.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0010 |  |
| [CVE-2023-20585](https://patchblox.com/security/data/cve/CVE-2023-20585.md) | Routine | AMD: CVE-2023-20585 IOMMU Write Buffer Vulnerability | 5.3 | 0.0010 |  |
| [CVE-2026-23463](https://patchblox.com/security/data/cve/CVE-2026-23463.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 4.7 | 0.0010 |  |
| [CVE-2026-23420](https://patchblox.com/security/data/cve/CVE-2026-23420.md) | Routine | wifi: wlcore: Fix a locking bug | 5.5 | 0.0010 |  |
| [CVE-2026-23452](https://patchblox.com/security/data/cve/CVE-2026-23452.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0010 |  |
| [CVE-2026-31420](https://patchblox.com/security/data/cve/CVE-2026-31420.md) | Routine | bridge: mrp: reject zero test interval to avoid OOM panic | 5.5 | 0.0010 |  |
| [CVE-2026-23441](https://patchblox.com/security/data/cve/CVE-2026-23441.md) | Routine | kernel-64kb: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768). | 5.5 | 0.0009 |  |
| [CVE-2026-23473](https://patchblox.com/security/data/cve/CVE-2026-23473.md) | Routine | io_uring/poll: fix multishot recv missing EOF on wakeup race | 4.7 | n/a |  |

---

Data as of 2026-11-11T01:43:54Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.