OPENSUSE-SU-2025:20091-1: Security update for 12 packages

OPENSUSE-SU-2025:20091-1, released November 26, 2025, fixes 83 CVEs across 12 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent

CVEs closed

12 rated Critical

Exploited

None reported

Highest CVSS

9.8

Base score, 0 to 10

Highest EPSS

0.0064

51st percentile

Priority of the 83 CVEs

Patch now 0
                                Urgent 12
                                High 40
                                Routine 31

Fixed package versions

Product	Release	Fixed in
dtb-aarch64	opensuse-leap 16.0	6.12.0-160000.7.1
kernel-64kb	opensuse-leap 16.0	6.12.0-160000.7.1
kernel-default	opensuse-leap 16.0	6.12.0-160000.7.1
kernel-default-base	opensuse-leap 16.0	6.12.0-160000.6.1.160000.2.4
kernel-docs	opensuse-leap 16.0	6.12.0-160000.7.1
kernel-kvmsmall	opensuse-leap 16.0	6.12.0-160000.7.1
kernel-obs-build	opensuse-leap 16.0	6.12.0-160000.7.1
kernel-obs-qa	opensuse-leap 16.0	6.12.0-160000.7.1
kernel-rt	opensuse-leap 16.0	6.12.0-160000.7.1
kernel-source	opensuse-leap 16.0	6.12.0-160000.7.1
kernel-syms	opensuse-leap 16.0	6.12.0-160000.7.1
kernel-zfcpdump	opensuse-leap 16.0	6.12.0-160000.7.1

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
Urgent	CVE-2025-40000	wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait()	9.8	0.0027	None reported
Urgent	CVE-2025-39996	media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove	9.8	0.0023	None reported
Urgent	CVE-2025-39985	can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow	9.8	0.0018	None reported
Urgent	CVE-2025-39986	can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow	9.8	0.0018	None reported
Urgent	CVE-2025-39967	fbcon: fix integer overflow in fbcon_do_set_font	9.8	0.0017	None reported
Urgent	CVE-2025-39994	media: tuner: xc5000: Fix use-after-free in xc5000_release	9.8	0.0016	None reported
Urgent	CVE-2025-39970	i40e: fix input validation logic for action_meta	9.8	0.0016	None reported
Urgent	CVE-2025-39971	i40e: fix idx validation in config queues msg	9.8	0.0016	None reported
Urgent	CVE-2025-39972	i40e: fix idx validation in i40e_validate_queue_map	9.8	0.0016	None reported
Urgent	CVE-2025-39973	i40e: add validation for ring_len param	9.8	0.0016	None reported
Urgent	CVE-2025-39978	octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()	9.8	0.0015	None reported
Urgent	CVE-2025-39968	i40e: add max boundary check for VF filters	9.8	0.0015	None reported
High	CVE-2025-40048	uio_hv_generic: Let userspace take care of interrupt mask	8.4	0.0064	None reported
High	CVE-2025-40087	NFSD: Define a proc_layoutcommit for the FlexFiles layout type	7.5	0.0050	None reported
High	CVE-2025-39702	ipv6: sr: Fix MAC comparison to be constant-time	7.1	0.0045	None reported
High	CVE-2025-40043	net: nfc: nci: Add parameter validation for packet data	8.8	0.0031	None reported
High	CVE-2025-39866	fs: writeback: fix use-after-free in __mark_inode_dirty()	7.8	0.0031	None reported
High	CVE-2025-40019	crypto: essiv - Check ssize for decryption and in-place encryption	7.0	0.0029	None reported
High	CVE-2025-40364	linux: In the Linux kernel, the following vulnerability has been resolved: io_uring: fix io_req_prep_async with provided bu...	7.8	0.0028	None reported
High	CVE-2025-39982	Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync	8.8	0.0028	None reported
High	CVE-2025-40009	linux: In the Linux kernel, the following vulnerability has been resolved: fs/proc/task_mmu: check p->vec_buf for NULL Whe...	n/a	0.0024	None reported
High	CVE-2025-39995	media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe	7.1	0.0023	None reported
High	CVE-2025-40035	Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak	7.1	0.0023	None reported
High	CVE-2025-40036	misc: fastrpc: fix possible map leak in fastrpc_put_args	7.1	0.0021	None reported
High	CVE-2025-40052	smb: client: fix crypto buffers in non-linear memory	7.1	0.0021	None reported

Also fixes CVE-2025-40000

SUSE-SU-2025:4057-1
kernel-64kb, kernel-default, kernel-default-base and 6 more on sles 15.7
SUSE-SU-2025:4141-1
kernel-livepatch-SLE15-SP7-RT_Update_6 on sles 15.7
SUSE-SU-2025:4132-1
kernel-azure, kernel-source-azure, kernel-syms-azure on sles 15.7
SUSE-SU-2025:4301-1
kernel-livepatch-SLE15-SP6-RT_Update_17, kernel-rt, kernel-rt_debug and 2 more on opensuse-leap 15.6, sles 15.6
SUSE-SU-2025:4140-1
dtb-aarch64, kernel-64kb, kernel-debug and 10 more on opensuse-leap 15.6, sles 15.6
SUSE-SU-2025:4128-1
kernel-azure, kernel-source-azure, kernel-syms-azure on opensuse-leap 15.6, sles 15.6
SUSE-SU-2025:21147-1
kernel-64kb, kernel-default, kernel-default-base and 6 more on sles 16.0
DEBIAN-CVE-2025-40000
linux on Debian 13.5 (trixie), Debian 14

Vendor advisory

https://osv.dev/vulnerability/openSUSE-SU-2025:20091-1

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/linux/opensuse-su-2025-20091-1">OPENSUSE-SU-2025:20091-1 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.