# SUSE-SU-2026:2722-1: Security update for 10 packages

SUSE-SU-2026:2722-1, released July 1, 2026, fixes 66 CVEs across 10 products. None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/suse-su-2026-2722-1
- Platform: Linux
- Released: Jul 1, 2026
- Priority: Urgent (Closes CVE-2025-10263, rated Critical)
- CVEs: 66, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://osv.dev/vulnerability/SUSE-SU-2026:2722-1

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [kernel-64kb](https://patchblox.com/security/data/product/linux/kernel-64kb.md) | sles 15.7 | 6.4.0-150700.53.63.1 |
| [kernel-azure](https://patchblox.com/security/data/product/linux/kernel-azure.md) | sles 15.7 | 6.4.0-150700.53.63.1 |
| [kernel-default](https://patchblox.com/security/data/product/linux/kernel-default.md) | sles 15.7 | 6.4.0-150700.53.63.1 |
| [kernel-default-base](https://patchblox.com/security/data/product/linux/kernel-default-base.md) | sles 15.7 | 6.4.0-150700.53.63.1.150700.17.37.1 |
| [kernel-docs](https://patchblox.com/security/data/product/linux/kernel-docs.md) | sles 15.7 | 6.4.0-150700.53.63.1 |
| [kernel-livepatch-SLE15-SP7_Update_17](https://patchblox.com/security/data/product/linux/kernel-livepatch-sle15-sp7-update-17.md) | sles 15.7 | 1-150700.15.3.1 |
| [kernel-obs-build](https://patchblox.com/security/data/product/linux/kernel-obs-build.md) | sles 15.7 | 6.4.0-150700.53.63.1 |
| [kernel-source](https://patchblox.com/security/data/product/linux/kernel-source.md) | sles 15.7 | 6.4.0-150700.53.63.1 |
| [kernel-syms](https://patchblox.com/security/data/product/linux/kernel-syms.md) | sles 15.7 | 6.4.0-150700.53.63.1 |
| [kernel-zfcpdump](https://patchblox.com/security/data/product/linux/kernel-zfcpdump.md) | sles 15.7 | 6.4.0-150700.53.63.1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2025-10263](https://patchblox.com/security/data/cve/CVE-2025-10263.md) | Urgent | ARM: CVE-2025-10263 Completion of affected memory accesses might not be guaranteed by completion of a TLBI [kernel] | 9.3 | 0.0054 |  |
| [CVE-2025-68822](https://patchblox.com/security/data/cve/CVE-2025-68822.md) | Urgent | Input: alps - fix use-after-free bugs caused by dev3_register_work | 9.8 | 0.0018 |  |
| [CVE-2026-43083](https://patchblox.com/security/data/cve/CVE-2026-43083.md) | High | net: ioam6: fix OOB and missing lock | 9.1 | 0.0060 |  |
| [CVE-2026-43405](https://patchblox.com/security/data/cve/CVE-2026-43405.md) | High | kernel-64kb: libceph: Use u32 for non-negative values in ceph_monmap_decode() (bsc#1264741). | 7.5 | 0.0060 |  |
| [CVE-2026-43101](https://patchblox.com/security/data/cve/CVE-2026-43101.md) | High | ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() | 7.5 | 0.0059 |  |
| [CVE-2026-31414](https://patchblox.com/security/data/cve/CVE-2026-31414.md) | High | netfilter: nf_conntrack_expect: use expect->helper | 9.8 | 0.0058 |  |
| [CVE-2026-46119](https://patchblox.com/security/data/cve/CVE-2026-46119.md) | High | libceph: Fix slab-out-of-bounds access in auth message processing | 9.1 | 0.0053 |  |
| [CVE-2026-46037](https://patchblox.com/security/data/cve/CVE-2026-46037.md) | High | ipv4: icmp: validate reply type before using icmp_pointers | 8.2 | 0.0051 |  |
| [CVE-2026-43158](https://patchblox.com/security/data/cve/CVE-2026-43158.md) | High | kernel-64kb: xfs: fix freemap adjustments when adding xattrs to leaf blocks (bsc#1264595). | 8.8 | 0.0047 |  |
| [CVE-2026-43187](https://patchblox.com/security/data/cve/CVE-2026-43187.md) | High | kernel-64kb: xfs: delete attr leaf freemap entries when empty (bsc#1264603). | 8.8 | 0.0047 |  |
| [CVE-2026-46244](https://patchblox.com/security/data/cve/CVE-2026-46244.md) | High | netfilter: nft_inner: Fix IPv6 inner_thoff desync | 9.1 | 0.0042 |  |
| [CVE-2026-43469](https://patchblox.com/security/data/cve/CVE-2026-43469.md) | High | kernel-64kb: xprtrdma: Decrement re_receiving on the early exit paths (bsc#1265143). | 7.5 | 0.0040 |  |
| [CVE-2026-46273](https://patchblox.com/security/data/cve/CVE-2026-46273.md) | High | ibmveth: Disable GSO for packets with small MSS | 8.6 | 0.0039 |  |
| [CVE-2026-43345](https://patchblox.com/security/data/cve/CVE-2026-43345.md) | High | kernel-64kb: net: ipa: fix event ring index not programmed for IPA v5.0+ (bsc#1265103). | 7.5 | 0.0035 |  |
| [CVE-2026-43112](https://patchblox.com/security/data/cve/CVE-2026-43112.md) | High | kernel-64kb: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (bsc#1264437). | 8.8 | 0.0035 |  |
| [CVE-2026-43198](https://patchblox.com/security/data/cve/CVE-2026-43198.md) | High | tcp: fix potential race in tcp_v6_syn_recv_sock() | 9.8 | 0.0030 |  |
| [CVE-2026-43239](https://patchblox.com/security/data/cve/CVE-2026-43239.md) | High | kernel-64kb: smb: client: prevent races in ->query_interfaces() (bsc#1264444). | 8.8 | 0.0029 |  |
| [CVE-2026-45940](https://patchblox.com/security/data/cve/CVE-2026-45940.md) | High | net: stmmac: fix oops when split header is enabled | 7.0 | 0.0018 |  |
| [CVE-2026-31693](https://patchblox.com/security/data/cve/CVE-2026-31693.md) | High | kernel-64kb: cifs: some missing initializations on replay (bsc#1267744). | 7.8 | 0.0017 |  |
| [CVE-2026-31674](https://patchblox.com/security/data/cve/CVE-2026-31674.md) | High | netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() | 7.1 | 0.0017 |  |
| [CVE-2026-23392](https://patchblox.com/security/data/cve/CVE-2026-23392.md) | High | netfilter: nf_tables: release flowtable after rcu grace period on error | 8.8 | 0.0017 |  |
| [CVE-2026-31680](https://patchblox.com/security/data/cve/CVE-2026-31680.md) | High | net: ipv6: flowlabel: defer exclusive option free until RCU teardown | 7.8 | 0.0016 |  |
| [CVE-2026-43339](https://patchblox.com/security/data/cve/CVE-2026-43339.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible UaF in addrconf_permanent_... | 8.1 | 0.0016 |  |
| [CVE-2026-43049](https://patchblox.com/security/data/cve/CVE-2026-43049.md) | High | HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure | 7.8 | 0.0015 |  |
| [CVE-2026-43491](https://patchblox.com/security/data/cve/CVE-2026-43491.md) | High | net: qrtr: ns: Limit the maximum server registration per node | 7.0 | 0.0015 |  |
| [CVE-2026-46123](https://patchblox.com/security/data/cve/CVE-2026-46123.md) | High | kernel-default: Bluetooth: virtio_bt: clamp rx length before skb_put (bsc#1267621). | 8.1 | 0.0014 |  |
| [CVE-2026-46162](https://patchblox.com/security/data/cve/CVE-2026-46162.md) | High | kernel-64kb: ice: fix double free in ice_sf_eth_activate() error path (bsc#1266840). | 7.8 | 0.0014 |  |
| [CVE-2026-31452](https://patchblox.com/security/data/cve/CVE-2026-31452.md) | High | ext4: convert inline data to extents when truncate exceeds inline size | 7.8 | 0.0014 |  |
| [CVE-2026-31469](https://patchblox.com/security/data/cve/CVE-2026-31469.md) | High | virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false | 7.8 | 0.0014 |  |
| [CVE-2026-46172](https://patchblox.com/security/data/cve/CVE-2026-46172.md) | High | kernel-64kb: ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() (bsc#1266903). | 7.0 | 0.0013 |  |
| [CVE-2026-43028](https://patchblox.com/security/data/cve/CVE-2026-43028.md) | High | kernel-64kb: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934). | 7.1 | 0.0013 |  |
| [CVE-2026-45840](https://patchblox.com/security/data/cve/CVE-2026-45840.md) | High | kernel-uek-debug-modules-extra: openvswitch: cap upcall PID array size and pre-size vport replies (Weiming Shi) [Orabug: 39451479] | 7.0 | 0.0013 |  |
| [CVE-2026-45894](https://patchblox.com/security/data/cve/CVE-2026-45894.md) | High | iommu/vt-d: Clear Present bit before tearing down PASID entry | 8.8 | 0.0013 |  |
| [CVE-2026-45862](https://patchblox.com/security/data/cve/CVE-2026-45862.md) | High | kernel-64kb: iommu/vt-d: Flush cache for PASID table before using it (bsc#1266705). | 7.8 | 0.0013 |  |
| [CVE-2026-31453](https://patchblox.com/security/data/cve/CVE-2026-31453.md) | High | xfs: avoid dereferencing log items after push callbacks | 7.8 | 0.0013 |  |
| [CVE-2026-46150](https://patchblox.com/security/data/cve/CVE-2026-46150.md) | High | fanotify: fix false positive on permission events | 7.8 | 0.0013 |  |
| [CVE-2026-31759](https://patchblox.com/security/data/cve/CVE-2026-31759.md) | High | kernel-default: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264076). | 7.8 | 0.0013 |  |
| [CVE-2026-31555](https://patchblox.com/security/data/cve/CVE-2026-31555.md) | High | futex: Clear stale exiting pointer in futex_lock_pi() retry path | 7.0 | 0.0013 |  |
| [CVE-2026-46160](https://patchblox.com/security/data/cve/CVE-2026-46160.md) | High | btrfs: fix missing last_unlink_trans update when removing a directory | 7.0 | 0.0013 |  |
| [CVE-2026-31500](https://patchblox.com/security/data/cve/CVE-2026-31500.md) | High | Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock | 7.8 | 0.0013 |  |
| [CVE-2026-43077](https://patchblox.com/security/data/cve/CVE-2026-43077.md) | High | kernel-default: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1264470). | 8.1 | 0.0012 |  |
| [CVE-2026-31665](https://patchblox.com/security/data/cve/CVE-2026-31665.md) | High | netfilter: nft_ct: fix use-after-free in timeout object destroy | 7.8 | 0.0012 |  |
| [CVE-2026-31492](https://patchblox.com/security/data/cve/CVE-2026-31492.md) | High | RDMA/irdma: Initialize free_qp completion before using it | 7.1 | 0.0012 |  |
| [CVE-2026-31593](https://patchblox.com/security/data/cve/CVE-2026-31593.md) | High | KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU | 8.8 | 0.0012 |  |
| [CVE-2026-46259](https://patchblox.com/security/data/cve/CVE-2026-46259.md) | High | kernel-64kb: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (bsc#1267685). | 8.4 | 0.0012 |  |
| [CVE-2026-43023](https://patchblox.com/security/data/cve/CVE-2026-43023.md) | High | kernel-default: Bluetooth: SCO: fix race conditions in sco_sock_connect() (bsc#1264137). | 7.8 | 0.0010 |  |
| [CVE-2026-31429](https://patchblox.com/security/data/cve/CVE-2026-31429.md) | Routine | net: skb: fix cross-cache free of KFENCE-allocated skb head | 6.6 | 0.0026 |  |
| [CVE-2026-45961](https://patchblox.com/security/data/cve/CVE-2026-45961.md) | Routine | kernel-64kb: gfs2: fix memory leaks in gfs2_fill_super error path (bsc#1266933). | 5.5 | 0.0016 |  |
| [CVE-2026-45870](https://patchblox.com/security/data/cve/CVE-2026-45870.md) | Routine | kernel-64kb: SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (bsc#1266704). | 5.5 | 0.0016 |  |
| [CVE-2026-45964](https://patchblox.com/security/data/cve/CVE-2026-45964.md) | Routine | kernel-64kb: SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (bsc#1266698). | 5.5 | 0.0016 |  |
| [CVE-2026-45965](https://patchblox.com/security/data/cve/CVE-2026-45965.md) | Routine | kernel-64kb: apparmor: fix invalid deref of rawdata when export_binary is unset (bsc#1267208). | 5.5 | 0.0016 |  |
| [CVE-2026-31592](https://patchblox.com/security/data/cve/CVE-2026-31592.md) | Routine | KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock | 6.6 | 0.0016 |  |
| [CVE-2026-31560](https://patchblox.com/security/data/cve/CVE-2026-31560.md) | Routine | spi: spi-dw-dma: fix print error log when wait finish transaction | 5.5 | 0.0016 |  |
| [CVE-2026-43036](https://patchblox.com/security/data/cve/CVE-2026-43036.md) | Routine | net: use skb_header_pointer() for TCPv4 GSO frag_off check | 5.5 | 0.0016 |  |
| [CVE-2026-45841](https://patchblox.com/security/data/cve/CVE-2026-45841.md) | Routine | netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO | 5.5 | 0.0013 |  |
| [CVE-2026-31495](https://patchblox.com/security/data/cve/CVE-2026-31495.md) | Routine | netfilter: ctnetlink: use netlink policy range checks | 5.5 | 0.0013 |  |
| [CVE-2026-31752](https://patchblox.com/security/data/cve/CVE-2026-31752.md) | Routine | kernel-64kb: bridge: br_nd_send: validate ND option lengths (bsc#1264045). | 5.5 | 0.0013 |  |
| [CVE-2026-43024](https://patchblox.com/security/data/cve/CVE-2026-43024.md) | Routine | kernel-64kb: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930). | 5.5 | 0.0013 |  |
| [CVE-2026-43035](https://patchblox.com/security/data/cve/CVE-2026-43035.md) | Routine | kernel-64kb: net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak (bsc#1263996). | 5.5 | 0.0013 |  |
| [CVE-2026-46101](https://patchblox.com/security/data/cve/CVE-2026-46101.md) | Routine | bpftool: netfilter: reject zero shift in nft_bitwise (Kai Ma) [Orabug: 39452465] | 5.5 | 0.0013 |  |
| [CVE-2026-45974](https://patchblox.com/security/data/cve/CVE-2026-45974.md) | Routine | kernel-64kb: btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (bsc#1266922). | 5.5 | 0.0013 |  |
| [CVE-2026-46005](https://patchblox.com/security/data/cve/CVE-2026-46005.md) | Routine | xfs: fix a resource leak in xfs_alloc_buftarg() | 5.5 | 0.0013 |  |
| [CVE-2026-43171](https://patchblox.com/security/data/cve/CVE-2026-43171.md) | Routine | kernel-64kb: EFI/CPER: do not dump the entire memory region (bsc#1264549). | 5.5 | 0.0012 |  |
| [CVE-2026-31664](https://patchblox.com/security/data/cve/CVE-2026-31664.md) | Routine | xfrm: clear trailing padding in build_polexpire() | 5.5 | 0.0012 |  |
| [CVE-2026-43119](https://patchblox.com/security/data/cve/CVE-2026-43119.md) | Routine | Bluetooth: hci_sync: annotate data-races around hdev->req_status | 5.5 | 0.0011 |  |
| [CVE-2026-31499](https://patchblox.com/security/data/cve/CVE-2026-31499.md) | Routine | kernel-64kb: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674). | 5.5 | 0.0009 |  |

---

Data as of 2026-11-11T01:43:54Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.