Linux · SUSE Linux Enterprise · Security advisory · March 25, 2026
SUSE-SU-2026:1041-1: Security update for 13 packages
SUSE-SU-2026:1041-1, released March 25, 2026, fixes 27 CVEs across 13 products. One of them is being exploited (CVE-2025-39964); 1 on CISA KEV. Patch Radar priority: Patch now.
Patch now1 on CISA KEV
CVEs closed
27
None rated Critical
Exploited
1
CVE-2025-39964
Highest CVSS
9.4
Base score, 0 to 10
Highest EPSS
0.0161
76th percentile
Priority of the 27 CVEs
Patch now 1
Urgent 0
High 21
Routine 5
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| dtb-aarch64 | opensuse-leap 15.6 | 6.4.0-150600.23.92.1 |
| kernel-64kb | opensuse-leap 15.6 | 6.4.0-150600.23.92.1 |
| kernel-debug | opensuse-leap 15.6 | 6.4.0-150600.23.92.1 |
| kernel-default | opensuse-leap 15.6 | 6.4.0-150600.23.92.1 |
| kernel-default | sles 15.6 | 6.4.0-150600.23.92.1 |
| kernel-default-base | opensuse-leap 15.6 | 6.4.0-150600.23.92.1.150600.12.42.2 |
| kernel-default-base | sles 15.6 | 6.4.0-150600.23.92.1.150600.12.42.2 |
| kernel-docs | opensuse-leap 15.6 | 6.4.0-150600.23.92.1 |
| kernel-docs | sles 15.6 | 6.4.0-150600.23.92.1 |
| kernel-kvmsmall | opensuse-leap 15.6 | 6.4.0-150600.23.92.1 |
| kernel-livepatch-SLE15-SP6_Update_21 | sles 15.6 | 1-150600.13.5.1 |
| kernel-obs-build | opensuse-leap 15.6 | 6.4.0-150600.23.92.1 |
| kernel-obs-build | sles 15.6 | 6.4.0-150600.23.92.1 |
| kernel-obs-qa | opensuse-leap 15.6 | 6.4.0-150600.23.92.1 |
| kernel-source | opensuse-leap 15.6 | 6.4.0-150600.23.92.1 |
| kernel-source | sles 15.6 | 6.4.0-150600.23.92.1 |
| kernel-syms | opensuse-leap 15.6 | 6.4.0-150600.23.92.1 |
| kernel-syms | sles 15.6 | 6.4.0-150600.23.92.1 |
| kernel-zfcpdump | opensuse-leap 15.6 | 6.4.0-150600.23.92.1 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Patch now | CVE-2025-39964 | crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg | 8.8 | 0.0161 | KEVExploited |
| High | CVE-2026-23111 | kernel-64kb: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (bsc#1258181). | 7.8 | 0.0113 | None reported |
| High | CVE-2023-53817 | linux: In the Linux kernel, the following vulnerability has been resolved: crypto: lib/mpi - avoid null pointer deref in mp... | 7.5 | 0.0054 | None reported |
| High | CVE-2025-40099 | cifs: parse_dfs_referrals: prevent oob on malformed input | 9.4 | 0.0041 | None reported |
| High | CVE-2025-37861 | scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue | 7.8 | 0.0033 | None reported |
| High | CVE-2025-40253 | s390/ctcm: Fix double-kfree | 8.8 | 0.0032 | None reported |
| High | CVE-2024-38542 | linux: In the Linux kernel, the following vulnerability has been resolved: RDMA/mana_ib: boundary check before installing c... | 7.8 | 0.0025 | None reported |
| High | CVE-2026-23054 | kernel-64kb: Security update for the Linux Kernel | 7.0 | 0.0021 | None reported |
| High | CVE-2025-40103 | smb: client: Fix refcount leak for cifs_sb_tlink | 7.1 | 0.0021 | None reported |
| High | CVE-2026-23074 | kernel-64kb: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749). | 7.8 | 0.0019 | None reported |
| High | CVE-2026-23214 | btrfs: reject new transactions if the fs is fully read-only | 8.4 | 0.0018 | None reported |
| High | CVE-2025-71066 | linux: In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: Always remove class from active... | 7.8 | 0.0017 | None reported |
| High | CVE-2026-23209 | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0017 | None reported |
| High | CVE-2025-39817 | efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare | 7.6 | 0.0017 | None reported |
| High | CVE-2026-23089 | kernel-64kb: ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (bsc#1257790). | 7.8 | 0.0016 | None reported |
| High | CVE-2026-23204 | kernel-64kb: net/sched: cls_u32: use skb_header_pointer_careful() (bsc#1258340). | 8.1 | 0.0016 | None reported |
| High | CVE-2026-23004 | kernel-64kb: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231). | 7.0 | 0.0016 | None reported |
| High | CVE-2025-71113 | kernel: In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - zero initialize memory allocated... | 7.8 | 0.0015 | None reported |
| High | CVE-2026-23268 | apparmor: fix unprivileged local user can do privileged policy management | 7.8 | 0.0015 | None reported |
| High | CVE-2026-23269 | apparmor: validate DFA start states are in bounds in unpack_pdb | 7.1 | 0.0014 | None reported |
| High | CVE-2025-71231 | crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode | 8.4 | 0.0014 | None reported |
| High | CVE-2026-23191 | kernel-64kb: ALSA: aloop: Fix racy access at PCM trigger (bsc#1258395). | 7.3 | 0.0013 | None reported |
| Routine | CVE-2026-23060 | kernel-64kb: crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (bsc#1257735). | 6.5 | 0.0018 | None reported |
| Routine | CVE-2026-23141 | kernel-64kb: btrfs: send: check for inline extents in range_is_hole_in_parent() (bsc#1258377). | 5.5 | 0.0015 | None reported |
| Routine | CVE-2026-23157 | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0014 | None reported |
Showing 1 to 25 of 27
1Next
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.