Linux · 
openSUSE Leap · Security advisory · July 21, 2026
openSUSE Leap · Security advisory · July 21, 2026OPENSUSE-SU-2026:21388-1: Security update for 13 packages
OPENSUSE-SU-2026:21388-1, released July 21, 2026, fixes 252 CVEs across 13 products. 2 of them are being exploited (CVE-2026-53266); 2 on CISA KEV. Patch Radar priority: Patch now.
Patch now2 on CISA KEV
CVEs closed
252
17 rated Critical
Exploited
2
CVE-2026-53266
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.9419
99th percentile
Priority of the 252 CVEs
Patch now 2
Urgent 17
High 140
Routine 93
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| dtb-aarch64 | opensuse-leap 16.0 | 6.12.0-160000.36.1 |
| kernel-64kb | opensuse-leap 16.0 | 6.12.0-160000.36.1 |
| kernel-azure | opensuse-leap 16.0 | 6.12.0-160000.36.1 |
| kernel-default | opensuse-leap 16.0 | 6.12.0-160000.36.1 |
| kernel-default-base | opensuse-leap 16.0 | 6.12.0-160000.36.1.160000.2.17 |
| kernel-docs | opensuse-leap 16.0 | 6.12.0-160000.36.1 |
| kernel-kvmsmall | opensuse-leap 16.0 | 6.12.0-160000.36.1 |
| kernel-obs-build | opensuse-leap 16.0 | 6.12.0-160000.36.1 |
| kernel-obs-qa | opensuse-leap 16.0 | 6.12.0-160000.36.1 |
| kernel-rt | opensuse-leap 16.0 | 6.12.0-160000.36.1 |
| kernel-source | opensuse-leap 16.0 | 6.12.0-160000.36.1 |
| kernel-syms | opensuse-leap 16.0 | 6.12.0-160000.36.1 |
| kernel-zfcpdump | opensuse-leap 16.0 | 6.12.0-160000.36.1 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Patch now | CVE-2026-53266 | netfilter: bridge: make ebt_snat ARP rewrite writable | 8.8 | 0.0093 | KEVExploited |
| Patch now | CVE-2026-53362 | ipv6: account for fraggap on the paged allocation path | 7.8 | 0.0071 | KEVExploited |
| Urgent | CVE-2026-43407 | linux: In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in c... | 9.1 | 0.0066 | None reported |
| Urgent | CVE-2026-43406 | linux: In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads i... | 9.1 | 0.0061 | None reported |
| Urgent | CVE-2025-10263 | ARM: CVE-2025-10263 Completion of affected memory accesses might not be guaranteed by completion of a TLBI [kernel] | 9.3 | 0.0054 | Exploitation Less Likely |
| Urgent | CVE-2026-43383 | linux: In the Linux kernel, the following vulnerability has been resolved: net/tcp-md5: Fix MAC comparison to be constant-t... | 9.4 | 0.0054 | None reported |
| Urgent | CVE-2026-43465 | linux: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: RX, Fix XDP multi-buf frag counting f... | 9.8 | 0.0054 | None reported |
| Urgent | CVE-2026-53215 | bpftool: [5.15.0-323.211.3.3] - Revert 'x86/alternatives: Add alt_instr.flags' (Harshit Mogalapalli) [Orabug: 39853924] [5.1... | 9.8 | 0.0050 | None reported |
| Urgent | CVE-2026-53216 | bpftool: [5.15.0-323.211.3.3] - Revert 'x86/alternatives: Add alt_instr.flags' (Harshit Mogalapalli) [Orabug: 39853924] [5.1... | 9.8 | 0.0050 | None reported |
| Urgent | CVE-2026-46266 | linux: In the Linux kernel, the following vulnerability has been resolved: inet: RAW sockets using IPPROTO_RAW MUST drop in... | 9.1 | 0.0047 | None reported |
| Urgent | CVE-2026-43384 | linux: In the Linux kernel, the following vulnerability has been resolved: net/tcp-ao: Fix MAC comparison to be constant-ti... | 9.8 | 0.0046 | None reported |
| Urgent | CVE-2026-52993 | tipc: fix double-free in tipc_buf_append() | 9.8 | 0.0040 | None reported |
| Urgent | CVE-2026-52955 | kernel-uek64k-core: [5.15.0-323.211.3.3] - Revert 'x86/alternatives: Add alt_instr.flags' (Harshit Mogalapalli) [Orabug: 39853924] [5.1... | 9.8 | 0.0038 | None reported |
| Urgent | CVE-2026-53086 | net: bcmgenet: fix racing timeout handler | 9.8 | 0.0030 | None reported |
| Urgent | CVE-2026-53075 | ppp: require CAP_NET_ADMIN in target netns for unattached ioctls | 9.8 | 0.0027 | None reported |
| Urgent | CVE-2026-45899 | ext4: drop extent cache when splitting extent fails | 9.8 | 0.0016 | None reported |
| Urgent | CVE-2026-53036 | bpf, arm64: Fix off-by-one in check_imm signed range check | 9.8 | 0.0014 | None reported |
| Urgent | CVE-2026-53053 | iommu/amd: Fix clone_alias() to use the original device's devid | 9.8 | 0.0013 | None reported |
| Urgent | CVE-2026-52919 | batman-adv: fix tp_meter counter underflow during shutdown | 9.8 | 0.0012 | None reported |
| High | CVE-2026-43284 | xfrm: esp: avoid in-place decrypt on shared skb frags | 8.8 | 0.9419 | None reported |
| High | CVE-2026-46242 | kpatch-patch-5_14_0-687_10_1: This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a run... | 7.8 | 0.0458 | None reported |
| High | CVE-2026-53176 | IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN | 9.8 | 0.0076 | None reported |
| High | CVE-2026-52924 | sctp: purge outqueue on stale COOKIE-ECHO handling | 9.8 | 0.0066 | None reported |
| High | CVE-2026-46331 | net/sched: fix pedit partial COW leading to page cache corruption | 8.1 | 0.0064 | None reported |
| High | CVE-2026-43083 | net: ioam6: fix OOB and missing lock | 9.1 | 0.0060 | None reported |
Showing 1 to 25 of 252
1Next
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.