Linux · openSUSE Leap · Security advisory · November 7, 2026

OPENSUSE-SU-2026:22091-1: Security update for 13 packages

OPENSUSE-SU-2026:22091-1, released November 7, 2026, fixes 401 CVEs across 13 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
401
49 rated Critical
Exploited
0
None reported
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.0147
73rd percentile

Priority of the 401 CVEs

Patch now 0 Urgent 49 High 250 Routine 102

Fixed package versions

ProductReleaseFixed in
dtb-aarch64opensuse-leap 16.06.12.0-160000.39.1
kernel-64kbopensuse-leap 16.06.12.0-160000.39.1
kernel-azureopensuse-leap 16.06.12.0-160000.39.1
kernel-defaultopensuse-leap 16.06.12.0-160000.39.1
kernel-default-baseopensuse-leap 16.06.12.0-160000.39.1.160000.2.25
kernel-docsopensuse-leap 16.06.12.0-160000.39.1
kernel-kvmsmallopensuse-leap 16.06.12.0-160000.39.1
kernel-obs-buildopensuse-leap 16.06.12.0-160000.39.1
kernel-obs-qaopensuse-leap 16.06.12.0-160000.39.1
kernel-rtopensuse-leap 16.06.12.0-160000.39.1
kernel-sourceopensuse-leap 16.06.12.0-160000.39.1
kernel-symsopensuse-leap 16.06.12.0-160000.39.1
kernel-zfcpdumpopensuse-leap 16.06.12.0-160000.39.1

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Urgent CVE-2026-72130 linux: In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: reject short AUTH_RECEIVE buffers n...9.8 0.0080 None reported
Urgent CVE-2026-89970 nvmet-auth: Synchronize timeout work during SQ teardown9.8 0.0080 None reported
Urgent CVE-2026-90151 linux: In the Linux kernel, the following vulnerability has been resolved: NFSv4: remove callback IDR entry on client alloc...9.8 0.0075 None reported
Urgent CVE-2026-72299 linux: In the Linux kernel, the following vulnerability has been resolved: tipc: restrict socket queue dumps in enqueue tra...9.8 0.0075 None reported
Urgent CVE-2026-72351 linux: In the Linux kernel, the following vulnerability has been resolved: gue: validate REMCSUM private option length GUE...9.8 0.0075 None reported
Urgent CVE-2026-89688 linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: drop the stateid, not the stateowner, on s...9.8 0.0074 None reported
Urgent CVE-2026-72322 linux: In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix potential UAF in MLD delayed wo...9.8 0.0072 None reported
Urgent CVE-2026-72491 linux: In the Linux kernel, the following vulnerability has been resolved: net/9p: fix race condition on rdma->state in tra...9.8 0.0072 None reported
Urgent CVE-2026-68477 linux: In the Linux kernel, the following vulnerability has been resolved: ipvs: fix more places with wrong ipv6 transport...9.8 0.0071 None reported
Urgent CVE-2026-72129 linux: In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero of...9.8 0.0071 None reported
Urgent CVE-2026-74267 linux: In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_codel: Do not call qdisc_tree_red...9.8 0.0071 None reported
Urgent CVE-2026-80976 linux: In the Linux kernel, the following vulnerability has been resolved: seg6: reset IP6CB after IPv6 decapsulation deca...9.8 0.0071 None reported
Urgent CVE-2026-89485 linux: In the Linux kernel, the following vulnerability has been resolved: lockd: pin next file across nlm_inspect_file loc...9.8 0.0071 None reported
Urgent CVE-2026-89712 linux: In the Linux kernel, the following vulnerability has been resolved: NFSD: restart ssc_expire_umount walk after dropp...9.8 0.0071 None reported
Urgent CVE-2026-72436 linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Don't use test_bit() in lockle...9.8 0.0071 None reported
Urgent CVE-2026-89697 linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: add fh_want_write() for early-verified SET...9.1 0.0070 None reported
Urgent CVE-2026-89526 svcrdma: Validate Read chunk positions before reconstruction9.8 0.0068 None reported
Urgent CVE-2026-89713 linux: In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock...9.1 0.0067 None reported
Urgent CVE-2026-89536 linux: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: wait for in-flight client TLS handshake...9.8 0.0064 None reported
Urgent CVE-2026-72348 linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6tables: mark malformed IPv6 extens...9.1 0.0063 None reported
Urgent CVE-2026-89658 linux: In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during NFSv4...9.8 0.0062 None reported
Urgent CVE-2026-89660 linux: In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during admin...9.8 0.0062 None reported
Urgent CVE-2026-89703 linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_...9.8 0.0062 None reported
Urgent CVE-2026-80694 net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller9.8 0.0060 None reported
Urgent CVE-2026-89672 linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs2 setacl by argp->mask The NFSACL...9.1 0.0060 None reported
Showing 1 to 25 of 401 1Next

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.