Linux · SUSE Linux Enterprise · Security advisory · November 7, 2026
SUSE-SU-2026:5091-1: Security update for 10 packages
SUSE-SU-2026:5091-1, released November 7, 2026, fixes 1,077 CVEs across 10 products. None of them is reported as exploited. Patch Radar priority: Urgent.
Urgent
CVEs closed
1,077
53 rated Critical
Exploited
0
None reported
Highest CVSS
10.0
Base score, 0 to 10
Highest EPSS
0.0076
55th percentile
Priority of the 1,077 CVEs
Patch now 0
Urgent 53
High 488
Routine 536
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| kernel-64kb | sles 15.7 | 6.4.0-150700.53.90.1 |
| kernel-azure | sles 15.7 | 6.4.0-150700.53.90.1 |
| kernel-default | sles 15.7 | 6.4.0-150700.53.90.1 |
| kernel-default-base | sles 15.7 | 6.4.0-150700.53.90.1.150700.17.51.1 |
| kernel-docs | sles 15.7 | 6.4.0-150700.53.90.1 |
| kernel-livepatch-SLE15-SP7_Update_24 | sles 15.7 | 1-150700.15.3.1 |
| kernel-obs-build | sles 15.7 | 6.4.0-150700.53.90.1 |
| kernel-source | sles 15.7 | 6.4.0-150700.53.90.1 |
| kernel-syms | sles 15.7 | 6.4.0-150700.53.90.1 |
| kernel-zfcpdump | sles 15.7 | 6.4.0-150700.53.90.1 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Urgent | CVE-2026-74280 | linux: In the Linux kernel, the following vulnerability has been resolved: crypto: marvell/octeontx - fix DMA cleanup using... | 10.0 | 0.0076 | None reported |
| Urgent | CVE-2026-80600 | linux: In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: acquire ARP hw source only afte... | 9.8 | 0.0073 | None reported |
| Urgent | CVE-2026-89847 | scsi: qla2xxx: Avoid double completion in async IOCB timeout | 9.8 | 0.0069 | None reported |
| Urgent | CVE-2026-89654 | kernel-64kb: ceph: fix UAF in check_new_map() on session freed during unlock (bsc#1280415). | 9.8 | 0.0064 | None reported |
| Urgent | CVE-2026-89637 | kernel-64kb: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 (bsc#1280492). | 9.8 | 0.0060 | None reported |
| Urgent | CVE-2026-80637 | netfilter: synproxy: fix unaligned memory access in timestamp adjustment | 9.8 | 0.0059 | None reported |
| Urgent | CVE-2026-64535 | linux: In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch... | 9.8 | 0.0055 | None reported |
| Urgent | CVE-2026-72064 | linux: In the Linux kernel, the following vulnerability has been resolved: net: mana: Sync page pool RX frags for CPU MANA... | 9.8 | 0.0050 | None reported |
| Urgent | CVE-2026-90042 | ceph: properly decrypt filenames in vmalloc() buffers | 9.8 | 0.0050 | None reported |
| Urgent | CVE-2026-52989 | nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers | 9.8 | 0.0036 | None reported |
| Urgent | CVE-2026-64534 | linux: In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED before nvmet_req_un... | 9.8 | 0.0032 | None reported |
| Urgent | CVE-2026-98339 | wifi: cfg80211: don't filter by BSS type when removing stale entries | 9.8 | 0.0028 | None reported |
| Urgent | CVE-2026-98348 | wifi: libipw: reject too-short association responses | 9.8 | 0.0025 | None reported |
| Urgent | CVE-2026-98209 | mmc: sdhci-of-aspeed: Remove children before releasing SDC resources | 9.8 | 0.0022 | None reported |
| Urgent | CVE-2026-80698 | dmaengine: idxd: fix double free of wq, engine, and group structs | 9.8 | 0.0022 | None reported |
| Urgent | CVE-2026-98212 | mmc: hsq: Fix use-after-free in retry work | 9.8 | 0.0021 | None reported |
| Urgent | CVE-2026-98298 | dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() | 9.8 | 0.0018 | None reported |
| Urgent | CVE-2026-98319 | drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr | 9.8 | 0.0018 | None reported |
| Urgent | CVE-2026-98326 | wifi: mac80211: mesh: release the channel if start fails | 9.8 | 0.0018 | None reported |
| Urgent | CVE-2026-98328 | wifi: mac80211: add HE 6 GHz capability in the scan elems len | 9.8 | 0.0018 | None reported |
| Urgent | CVE-2025-71073 | Input: lkkbd - disable pending work before freeing device | 9.8 | 0.0018 | None reported |
| Urgent | CVE-2026-98186 | wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length | 9.8 | 0.0018 | None reported |
| Urgent | CVE-2026-98187 | wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST | 9.8 | 0.0018 | None reported |
| Urgent | CVE-2026-98188 | wifi: p54: validate curve data length in the calibration curve converters | 9.8 | 0.0018 | None reported |
| Urgent | CVE-2026-98191 | wifi: wlcore: release runtime PM ref on regdomain config failure | 9.8 | 0.0018 | None reported |
Showing 1 to 25 of 1,077
1Next
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.