- bind
-
- Upgrade to release 9.20.11
Security Fixes:
* Fix a possible assertion failure when
stale-answer-client-timeout is set to 0. In specific
circumstances the named resolver process could exit with an
assertion failure when stale answers were enabled and the
stale-answer-client-timeout configuration option was set to 0.
(CVE-2025-40777)
[bsc#1246548]
New Features:
* Add support for the CO flag to dig.
* Implement a new notify-defer configuration option. This new
option sets a delay (in seconds) to wait before sending a set
of NOTIFY messages for a zone. Whenever a NOTIFY message is
ready to be sent, sending is deferred for this duration. This
option should not be confused with the notify-delay option. The
default is 0 seconds.
Removed Features:
* Implement the systemd notification protocol manually to remove
dependency on libsystemd.
Bug Fixes:
* Correct the default interface-interval from 60s to 60m.
* Fix a purge-keys bug when using multiple views of a zone.
* Use IPv6 queries in delv +ns.
* A secondary zone could initiate a new zone transfer from the
primary server after it had been already deleted from the
secondary server, and before the internal garbage collection
was activated to clean it up completely. This has been fixed.
* A secondary zone could fail to further refresh with new
versions of the zone from a primary server if named was
reconfigured during the SOA request step of an ongoing zone
transfer. This has been fixed.
- Clean up systemd BuildRequires
- boost
-
- CVE-2016-9840: fixed out-of-bounds pointer arithmetic in zlib in beast
(bsc#1245936)
- adds patch boost-zlib.patch
- cifs-utils
-
- Add patches:
* 0001-cifs.upcall-correctly-treat-UPTARGET_UNSPECIFIED-as-.patch
(bsc#1243488)
* 0001-mount.cifs-retry-mount-on-EINPROGRESS.patch
- cloud-regionsrv-client
-
- Update version to 10.5.2 (bsc#1247539)
+ When an instance fails verification server side the default credentials
were left behind requireing manual intervantion prior to the next
registration attempt.
+ Fix issue triggered when using instance-billing-flavor-check due to
IP address handling as object rather than string introduced 10.5.0
- Update version to 10.5.1
+ Fix issue with picking up configured server names from the
regionsrv config file. Previously only IP addresses were collected
+ Update scriptlet for package uninstall to avoid issues in the
build service
- Update version to 10.5.0
+ Use region server IP addresses to determine Internet access rather
than a generic address. Region server IP addresses may not be blocked
in the network construct. (bsc#1245305)
- coreutils
-
- coreutils-9.7-sort-CVE-2025-5278.patch: Add upstream patch:
sort with key character offsets of SIZE_MAX, could induce
a read of 1 byte before an allocated heap buffer.
(CVE-2025-5278, bsc#1243767)
- crypto-policies
-
- Update the BSI policy [jsc#PED-12880]
* BSI: switch to 3072 minimum RSA key size [322f0ba4]
* BSI: Update BSI policy for new 2024 minimum [64b9dddd]
* Add patches:
- crypto-policies-BSI-Update-BSI-policy-for-new-2024-minimum-recommend.patch
- crypto-policies-BSI-switch-to-3072-minimum-RSA-key-size.patch
- curl
-
- tool_operate: fix return code when --retry is used but not
triggered [bsc#1249367]
* Add curl-tool_operate-fix-return-code-when-retry-is-used.patch
- Security fixes:
* [bsc#1249191, CVE-2025-9086] Out of bounds read for cookie path
* [bsc#1249348, CVE-2025-10148] Predictable WebSocket mask
* Add patches:
- curl-CVE-2025-9086.patch
- curl-CVE-2025-10148.patch
- Fix the --ftp-pasv option in curl v8.14.1 [bsc#1246197]
* tool_getparam: fix --ftp-pasv [5f805ee]
* Add curl-fix--ftp-pasv.patch
- Update to 8.14.1: [jsc#PED-13055, jsc#PED-13056]
* Add _multibuild
* Remove patches fixed in the update:
- curl-CVE-2024-11053.patch
- curl-CVE-2024-2004.patch
- curl-CVE-2024-2379.patch
- curl-CVE-2024-2398.patch
- curl-CVE-2024-2466.patch
- curl-CVE-2024-6197.patch
- curl-CVE-2024-7264.patch
- curl-CVE-2024-8096.patch
- curl-CVE-2024-9681.patch
- curl-CVE-2025-0167.patch
- curl-CVE-2025-0725.patch
- curl-aws_sigv4-url-encode-the-canonical-path.patch
- curl-mstp-starttls.patch
- Sync spec file with SLE codestreams: [jsc#PED-13055, jsc#PED-13056]
* Add curl-mini.rpmlintrc to avoid rpmlint shlib-policy-name-error
when building the curl-mini package in SLE.
* Add libssh minimum version requirements.
* Use ldconfig_scriptlets when available.
* Remove unused option --disable-ntlm-wb.
- Update to 8.14.1:
* Security fixes:
- [bsc#1243933, CVE-2025-5399] libcurl can possibly get
trapped in an endless busy-loop when processing specially
crafted packets [d1145df2]
* Bugfixes:
- asyn-thrdd: fix cleanup when RR fails due to OOM
- ftp: fix teardown of DATA connection in done
- http: fail early when rewind of input failed when following redirects
- multi: fix add_handle resizing
- tls BIOs: handle BIO_CTRL_EOF correctly
- tool_getparam: make --no-anyauth not be accepted
- wolfssl: fix sending of early data
- ws: handle blocked sends better
- ws: tests and fixes
- Update to 8.14.0:
* Security fixes:
- [CVE-2025-4947, bsc#1243397] QUIC certificate check skip with wolfSSL
- [CVE-2025-5025, bsc#1243706] No QUIC certificate pinning with wolfSSL
* Changes:
- mqtt: send ping at upkeep interval
- schannel: handle pkcs12 client certificates containing CA certificates
- TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs
- vquic: ngtcp2 + openssl support
- wcurl: import v2025.04.20 script + docs
- websocket: add option to disable auto-pong reply
* Bugfixes:
- asny-thrdd: fix detach from running thread
- async-threaded resolver: use ref counter
- async: DoH improvements
- build: enable gcc-12/13+, clang-10+ picky warnings
- build: enable gcc-15 picky warnings
- certs: drop unused `default_bits` from `.prm` files
- cf-https-connect: use the passed in dns struct pointer
- cf-socket: fix FTP accept connect
- cfilters: remove assert
- cmake: fix nghttp3 static linking with `USE_OPENSSL_QUIC=ON`
- cmake: prefer `COMPILE_OPTIONS` over `CMAKE_C_FLAGS` for custom C options
- cmake: revert `CURL_LTO` behavior for multi-config generators
- configure: fix --disable-rt
- CONTRIBUTE: add project guidelines for AI use
- cpool/cshutdown: force close connections under pressure
- curl: fix memory leak when -h is used in config file
- curl_get_line: handle lines ending on the buffer boundary
- headers: enforce a max number of response header to accept
- http: fix HTTP/2 handling of TE request header using "trailers"
- lib: include files using known path
- lib: unify conversions to/from hex
- libssh: add NULL check for Curl_meta_get()
- libssh: fix memory leak
- mqtt: use conn/easy meta hash
- multi: do transfer book keeping using mid
- multi: init_do(): check result
- netrc: avoid NULL deref on weird input
- netrc: avoid strdup NULL
- netrc: deal with null token better
- openssl-quic: avoid potential `-Wnull-dereference`, add assert
- openssl-quic: fix shutdown when stream not open
- openssl: enable builds for *both* engines and providers
- openssl: set the cipher string before doing private cert
- progress: avoid integer overflow when gathering total transfer size
- rand: update comment on Curl_rand_bytes weak random
- rustls: make max size of cert and key reasonable
- smb: avoid integer overflow on weird input date
- urlapi: redirecting to "" is considered fine
* Remove curl-8.13.0-CloseSocket.patch upstream
* Rebase libcurl-ocloexec.patch
- fix Leap build add curl-8.13.0-CloseSocket.patch
- Update to 8.13.0:
* Changes:
- curl: add write-out variable 'tls_earlydata'
- curl: make --url support a file with URLs
- gnutls: set priority via --ciphers
- IMAP: add CURLOPT_UPLOAD_FLAGS and --upload-flags
- lib: add CURLFOLLOW_OBEYCODE and CURLFOLLOW_FIRSTONLY
- OpenSSL/quictls: add support for TLSv1.3 early data
- rustls: add support for CERTINFO
- rustls: add support for SSLKEYLOGFILE
- rustls: support ECH w/ DoH lookup for config
- rustls: support native platform verifier
- var: add a '64dec' function that can base64 decode a string
* Bugfixes:
- conn: fix connection reuse when SSL is optional
- hash: use single linked list for entries
- http2: detect session being closed on ingress handling
- http2: reset stream on response header error
- http: remove a HTTP method size restriction
- http: version negotiation
- httpsrr: fix port detection
- libssh: fix freeing of resources in disconnect
- libssh: fix scp large file upload for 32-bit size_t systems
- openssl-quic: do not iterate over multi handles
- openssl: check return value of X509_get0_pubkey
- openssl: drop support for old OpenSSL/LibreSSL versions
- openssl: fix crash on missing cert password
- openssl: fix pkcs11 URI checking for key files.
- openssl: remove bad `goto`s into other scope
- setopt: illegal CURLOPT_SOCKS5_AUTH should return error
- setopt: setting PROXYUSERPWD after PROXYUSERNAME/PASSWORD is fine
- sshserver.pl: adjust `AuthorizedKeysFile2` cutoff version
- sshserver: fix excluding obsolete client config lines
- SSLCERTS: list support for SSL_CERT_FILE and SSL_CERT_DIR
- tftpd: prefix TFTP protocol error `E*` constants with `TFTP_`
- tool_operate: fail SSH transfers without server auth
- url: call protocol handler's disconnect in Curl_conn_free
- urlapi: remove percent encoded dot sequences from the URL path
- urldata: remove 'hostname' from struct Curl_async
* Rebase patches:
- libcurl-ocloexec.patch
- curl-secure-getenv.patch
- Update to 8.12.1:
* Bugfixes:
- asyn-thread: fix build with 'CURL_DISABLE_SOCKETPAIR'
- asyn-thread: fix HTTPS RR crash
- asyn-thread: fix the returned bitmask from Curl_resolver_getsock
- asyn-thread: survive a c-ares channel set to NULL
- cmake: always reference OpenSSL and ZLIB via imported targets
- cmake: respect 'GNUTLS_CFLAGS' when detected via 'pkg-config'
- cmake: respect 'GNUTLS_LIBRARY_DIRS' in 'libcurl.pc' and 'curl-config'
- content_encoding: #error on too old zlib
- imap: TLS upgrade fix
- ldap: drop support for legacy Novell LDAP SDK
- libssh2: comparison is always true because rc <= -1
- libssh2: raise lowest supported version to 1.2.8
- libssh: drop support for libssh older than 0.9.0
- openssl-quic: ignore ciphers for h3
- pop3: TLS upgrade fix
- runtests: fix the disabling of the memory tracking
- runtests: quote commands to support paths with spaces
- scache: add magic checks
- smb: silence '-Warray-bounds' with gcc 13+
- smtp: TLS upgrade fix
- tool_cfgable: sort struct fields by size, use bitfields for booleans
- tool_getparam: add "TLS required" flag for each such option
- vtls: fix multissl-init
- wakeup_write: make sure the eventfd write sends eight bytes
- Update to 8.12.0:
* Security fixes:
- [bsc#1234068, CVE-2024-11053] curl could leak the password used
for the first host to the followed-to host under certain circumstances.
- [bsc#1232528, CVE-2024-9681] HSTS subdomain overwrites parent cache entry
- [bsc#1236589, CVE-2025-0665] eventfd double close
* Changes:
- curl: add byte range support to --variable reading from file
- curl: make --etag-save acknowledge --create-dirs
- getinfo: fix CURLINFO_QUEUE_TIME_T and add 'time_queue' var
- getinfo: provide info which auth was used for HTTP and proxy
- hyper: drop support
- openssl: add support to use keys and certificates from PKCS#11 provider
- QUIC: 0RTT for gnutls via CURLSSLOPT_EARLYDATA
- vtls: feature ssls-export for SSL session im-/export
* Bugfixes:
- altsvc: avoid integer overflow in expire calculation
- asyn-ares: acknowledge CURLOPT_DNS_SERVERS set to NULL
- asyn-ares: fix memory leak
- asyn-ares: initial HTTPS resolve support
- asyn-thread: use c-ares to resolve HTTPS RR
- async-thread: avoid closing eventfd twice
- cd2nroff: do not insist on quoted <> within backticks
- cd2nroff: support "none" as a TLS backend
- conncache: count shutdowns against host and max limits
- content_encoding: drop support for zlib before 1.2.0.4
- content_encoding: namespace GZIP flag constants
- content_encoding: put the decomp buffers into the writer structs
- content_encoding: support use of custom libzstd memory functions
- cookie: cap expire times to 400 days
- cookie: parse only the exact expire date
- curl: return error if etag options are used with multiple URLs
- curl_multi_fdset: include the shutdown connections in the set
- curl_sha512_256: rename symbols to the curl namespace
- curl_url_set.md: adjust the added-in to 7.62.0
- doh: send HTTPS RR requests for all HTTP(S) transfers
- easy: allow connect-only handle reuse with easy_perform
- easy: make curl_easy_perform() return error if connection still there
- easy_lock: use Sleep(1) for thread yield on old Windows
- ECH: update APIs to those agreed with OpenSSL maintainers
- GnuTLS: fix 'time_appconnect' for early data
- HTTP/2: strip TE request header
- http2: fix data_pending check
- http2: fix value stored to 'result' is never read
- http: ignore invalid Retry-After times
- http_aws_sigv4: Fix invalid compare function handling zero-length pairs
- https-connect: start next immediately on failure
- lib: redirect handling by protocol handler
- multi: fix curl_multi_waitfds reporting of fd_count
- netrc: 'default' with no credentials is not a match
- netrc: fix password-only entries
- netrc: restore _netrc fallback logic
- ngtcp2: fix memory leak on connect failure
- openssl: define `HAVE_KEYLOG_CALLBACK` before use
- openssl: fix ECH logic
- osslq: use SSL_poll to determine writeability of QUIC streams
- sectransp: free certificate on error
- select: avoid a NULL deref in cwfds_add_sock
- src: omit hugehelp and ca-embed from libcurltool
- ssl session cache: change cache dimensions
- system.h: add 64-bit curl_off_t definitions for NonStop
- telnet: handle single-byte input option
- TLS: check connection for SSL use, not handler
- tool_formparse.c: make curlx_uztoso a static in here
- tool_formparse: accept digits in --form type= strings
- tool_getparam: ECH param parsing refix
- tool_getparam: fail --hostpubsha256 if libssh2 is not used
- tool_getparam: fix "Ignored Return Value"
- tool_getparam: fix memory leak on error in parse_ech
- tool_getparam: fix the ECH parser
- tool_operate: make --etag-compare always accept a non-existing file
- transfer: fix CURLOPT_CURLU override logic
- urlapi: fix redirect to a new fragment or query (only)
- vquic: make vquic_send_packets not return without setting psent
- vtls: fix default SSL backend as a fallback
- vtls: only remember the expiry timestamp in session cache
- websocket: fix message send corruption
- x509asn1: add parse recursion limit
* Rebase pathes:
- libcurl-ocloexec.patch
- dont-mess-with-rpmoptflags.patch
- cyrus-sasl
-
- Add Channel Binding support for GSSAPI/GSS-SPNEGO; (bsc#1229655);
(jsc#PED-12097); Add patch
0009-Add-Channel-Binding-support-for-GSSAPI-GSS-SPNEGO.patch
- Add support for setting max ssf 0 to GSS-SPNEGO; (bsc#1229655);
(jsc#PED-12097); Add patch
0010-Add-support-for-setting-max-ssf-0-to-GSS-SPNEGO.patch
- docker
-
- Update to Docker 28.3.3-ce. See upstream changelog online at
<https://docs.docker.com/engine/release-notes/28/#2833>
CVE-2025-54388 bsc#1247367
- Update to docker-buildx v0.26.1. Upstream changelog:
<https://github.com/docker/buildx/releases/tag/v0.26.1>
- Update to docker-buildx v0.26.0. Upstream changelog:
<https://github.com/docker/buildx/releases/tag/v0.26.0>
- Update to Go 1.24 for builds, to match upstream.
- Update to Docker 28.3.2-ce. See upstream changelog online at
<https://docs.docker.com/engine/release-notes/28/#2832>
- Update to Docker 28.3.1-ce. See upstream changelog online at
<https://docs.docker.com/engine/release-notes/28/#2831>
- Update to Docker 28.3.0-ce. See upstream changelog online at
<https://docs.docker.com/engine/release-notes/28/#2830>
bsc#1246556
- Rebase patches:
* 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
* 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
* 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
* 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
* 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
* 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
[ This update is a no-op, only needed to work around unfortunate automated
packaging script behaviour on SLES. ]
- The following patches were removed in openSUSE in the Docker 28.1.1-ce
update, but the patch names were later renamed in a SLES-only update before
Docker 28.1.1-ce was submitted to SLES.
This causes the SLES build scripts to refuse the update because the patches
are not referenced in the changelog. There is no obvious place to put the
patch removals (the 28.1.1-ce update removing the patches chronologically
predates their renaming in SLES), so they are included here a dummy changelog
entry to work around the issue.
- 0007-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
- 0008-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch
- Update to docker-buildx v0.25.0. Upstream changelog:
<https://github.com/docker/buildx/releases/tag/v0.25.0>
- Do not try to inject SUSEConnect secrets when in Rootless Docker mode, as
Docker does not have permission to access the host zypper credentials in this
mode (and unprivileged users cannot disable the feature using
/etc/docker/suse-secrets-enable.) bsc#1240150
* 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
- Rebase patches:
* 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
* 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
* 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
* 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
* 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Always clear SUSEConnect suse_* secrets when starting containers regardless
of whether the daemon was built with SUSEConnect support. Not doing this
causes containers from SUSEConnect-enabled daemons to fail to start when
running with SUSEConnect-disabled (i.e. upstream) daemons.
This was a long-standing issue with our secrets support but until recently
this would've required migrating from SLE packages to openSUSE packages
(which wasn't supported). However, as SLE Micro 6.x and SLES 16 will move
away from in-built SUSEConnect support, this is now a practical issue users
will run into. bsc#1244035
+ 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
- Rearrange patches:
- 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
+ 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
- 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
+ 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
- 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
+ 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
- 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
+ 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
+ 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
[NOTE: This update was only ever released in SLES and Leap.]
- Always clear SUSEConnect suse_* secrets when starting containers regardless
of whether the daemon was built with SUSEConnect support. Not doing this
causes containers from SUSEConnect-enabled daemons to fail to start when
running with SUSEConnect-disabled (i.e. upstream) daemons.
This was a long-standing issue with our secrets support but until recently
this would've required migrating from SLE packages to openSUSE packages
(which wasn't supported). However, as SLE Micro 6.x and SLES 16 will move
away from in-built SUSEConnect support, this is now a practical issue users
will run into. bsc#1244035
+ 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
- Rearrange patches:
- 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
+ 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
- 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
+ 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
- 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
+ 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
- 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
+ 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
+ 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- 0006-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
+ 0007-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
- 0007-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch
+ 0008-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch
- Update to Docker 28.2.2-ce. See upstream changelog online at
<https://docs.docker.com/engine/release-notes/28/#2822>
- Rebase patches:
* 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
* 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
* 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
* 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
* 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Update to Docker 28.2.1-ce. See upstream changelog online at
<https://docs.docker.com/engine/release-notes/28/#2820> bsc#1243833
<https://github.com/moby/moby/releases/tag/v28.2.1>
- Rebase patches:
* 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
* 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
* 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
* 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
* 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Update to docker-buildx v0.24.0. Upstream changelog:
<https://github.com/docker/buildx/releases/tag/v0.24.0>
- Update to Docker 28.1.1-ce. See upstream changelog online at
<https://docs.docker.com/engine/release-notes/28/#2811> bsc#1242114
Includes upstream fixes:
- CVE-2025-22872 bsc#1241830
- Remove long-outdated build handling for deprecated and unsupported
devicemapper and AUFS storage drivers. AUFS was removed in v24, and
devicemapper was removed in v25.
<https://docs.docker.com/engine/deprecated/#aufs-storage-driver>
- Rebase patches:
* 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
* 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
* 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
* 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
* 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Remove upstreamed patches:
- 0006-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
- 0007-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch
- cli-0001-docs-include-required-tools-in-source-tree.patch
- Update to docker-buildx v0.23.0. Upstream changelog:
<https://github.com/docker/buildx/releases/tag/v0.23.0>
- Update to docker-buildx v0.22.0. Upstream changelog:
<https://github.com/docker/buildx/releases/tag/v0.22.0>
* Includes fixes for CVE-2025-0495. bsc#1239765
- Disable transparent SUSEConnect support for SLE-16. PED-12534
When this patchset was first added in 2013 (and rewritten over the years),
there was no upstream way to easily provide SLE customers with a way to build
container images based on SLE using the host subscription. However, with
docker-buildx you can now define secrets for builds (this is not entirely
transparent, but we can easily document this new requirement for SLE-16).
Users should use
RUN --mount=type=secret,id=SCCcredentials zypper -n ...
in their Dockerfiles, and
docker buildx build --secret id=SCCcredentials,src=/etc/zypp/credentials.d/SCCcredentials,type=file .
when doing their builds.
- Now that the only blocker for docker-buildx support was removed for SLE-16,
enable docker-buildx for SLE-16 as well. PED-8905
- dracut
-
- Update to version 059+suse.564.g984c275a:
* fix(rngd): adjust license to match the license of the whole project
* fix(dracut): kernel module name normalization in drivers lists (bsc#1241680)
- glib2
-
- Add glib2-CVE-2025-6052.patch: fix overflow check when expanding
a GString (bsc#1244596 CVE-2025-6052).
- Add glib2-CVE-2025-4373.patch: carefully handle gssize parameters
(bsc#1242844 CVE-2025-4373 glgo#GNOME/glib#3677).
- glibc
-
- regcomp-double-free.patch: posix: Fix double-free after allocation
failure in regcomp (CVE-2025-8058, bsc#1246965, BZ #33185)
- nscd-gethst-race.patch: Reduce chance of crash when using nscd GETFDHST
(bsc#1240058)
- gpg2
-
- Security fix: [bsc#1236931, bsc#1239119, CVE-2025-30258]
* gpg: Fix regression for the recent malicious subkey DoS fix.
* gpg: Fix another regression due to the T7547 fix.
* gpg: Allow the use of an ADSK subkey as ADSK subkey.
* Add patches:
- gnupg-gpg-Fix-regression-for-the-recent-malicious-subkey-D.patch
- gnupg-gpg-Fix-another-regression-due-to-the-T7547-fix.patch
- gnupg-gpg-Allow-the-use-of-an-ADSK-subkey-as-ADSK-subkey.patch
- Don't install expired sks certificate [bsc#1243069]
* Add patch gnupg-dirmngr-Don-t-install-expired-sks-certificate.patch
- Fix a verification DoS due to a malicious subkey in the keyring: [bsc#1239119]
* Add patch gnupg-gpg-Fix-a-verification-DoS-due-to-a-malicious-subkey-in-the-keyring.patch
- grub2
-
- Skip mount point in grub_find_device function (bsc#1246231)
* 0001-getroot-Skip-mount-points-in-grub_find_device.patch
- Fix CVE-2024-56738: side-channel attack due to not constant-time
algorithm in grub_crypto_memcmp (bsc#1234959)
* grub2-constant-time-grub_crypto_memcmp.patch
- Fix test -f and -s do not work properly over the network files served via
tftp and http (bsc#1246157) (bsc#1246237)
* 0001-test-Fix-f-test-on-files-over-network.patch
* 0002-http-Return-HTTP-status-code-in-http_establish.patch
* 0003-docs-Clarify-test-for-files-on-TFTP-and-HTTP.patch
* 0004-tftp-Fix-hang-when-file-is-a-directory.patch
- hwinfo
-
- merge gh#openSUSE/hwinfo#168
- fix usb network card detection (bsc#1245950)
- 21.89
- iputils
-
- Security fix [bsc#1243772, CVE-2025-48964]
* Fix integer overflow in ping statistics via zero timestamp
* Add iputils-CVE-2025-48964_01.patch
* Add iputils-CVE-2025-48964_02.patch
* Add iputils-CVE-2025-48964_03.patch
* Add iputils-CVE-2025-48964_04.patch
* Add iputils-CVE-2025-48964_regression.patch
- kbd
-
- dummy update to trigger rebuild after having updated
console-setup (bsc#1246522); so this needs to be checked in and
build after checking in console-setup !!!
- kbd-better-error-message-on-unsupported-unicode-value.patch
* has been extremely useful for debugging that issue
- kdump
-
- upgrade to version 2.0.18+git2.g881ca8c
* kdumptool calibrate: add per-cpu userspace requirements
- upgrade to version 2.0.18+git1.ga389ce7
* set KDUMP_CPUs to 1 on XEN (bsc#1244289)
- kernel-default
-
- ice, irdma: fix an off by one in error handling code
(bsc#1247712).
- irdma: free iwdev->rf after removing MSI-X (bsc#1247712).
- ice: Fix signedness bug in ice_init_interrupt_scheme()
(bsc#1247712).
- commit eba4226
- ice: init flow director before RDMA (bsc#1247712).
- ice: simplify VF MSI-X managing (bsc#1247712).
- ice: enable_rdma devlink param (bsc#1247712).
- ice: treat dyn_allowed only as suggestion (bsc#1247712).
- ice, irdma: move interrupts code to irdma (bsc#1247712).
- ice: get rid of num_lan_msix field (bsc#1247712).
- ice: remove splitting MSI-X between features (bsc#1247712).
- ice: devlink PF MSI-X max and min parameter (bsc#1247712).
- ice: count combined queues using Rx/Tx count (bsc#1247712).
- commit 0afdc75
- smb3: move server check earlier when setting channel sequence
number (git-fixes).
- commit df2adca
- ring-buffer: Do not allow events in NMI with generic atomic64
cmpxchg() (git-fixes).
- commit 890fc59
- module: Restore the moduleparam prefix length check (git-fixes).
- commit ad2fc48
- module: Remove unnecessary +1 from last_unloaded_module::name
size (git-fixes).
- commit 3efc8ab
- audit,module: restore audit logging in load failure case
(git-fixes).
- kABI: Fix the module::name type in audit_context (git-fixes).
- commit 7e23359
- module: Fix memory deallocation on error path in move_module()
(git-fixes).
- commit bb37d39
- SMB3: rename macro CIFS_SERVER_IS_CHAN to avoid confusion
(git-fixes).
- Refresh
patches.suse/smb-client-fix-use-after-free-of-signing-key.patch.
- commit ee8ada8
- smb: client: fix potential deadlock when reconnecting channels
(bsc#1246183, CVE-2025-38244).
- commit fcf601a
- cifs: reconnect helper should set reconnect for the right
channel (git-fixes).
- commit ae3173e
- [SMB3] send channel sequence number in SMB3 requests after
reconnects (git-fixes).
- commit baa81e9
- net: mana: Add debug logs in MANA network driver (bsc#1246212).
- Refresh
patches.suse/msft-hv-3280-net-mana-Add-support-for-Multi-Vports-on-Bare-metal.patch.
- commit 1b4ad82
- netlink: avoid infinite retry looping in netlink_unicast()
(CVE-2025-38465 bsc#1247118).
- net: mana: Set tx_packets to post gso processing packet count
(bsc#1245731).
- net: mana: Allocate MSI-X vectors dynamically (bsc#1245457).
- net: mana: Allow irq_setup() to skip cpus for affinity
(bsc#1245457).
- net: mana: explain irq_setup() algorithm (bsc#1245457).
- PCI: hv: Allow dynamic MSI-X vector allocation (bsc#1245457).
- PCI/MSI: Export pci_msix_prepare_desc() for dynamic MSI-X
allocations (bsc#1245457).
- net: mana: Add handler for hardware servicing events
(bsc#1245730).
- net: mana: Expose additional hardware counters for drop and
TC via ethtool (bsc#1245729).
- hv_netvsc: Use VF's tso_max_size value when data path is VF
(bsc#1246203).
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE
(bsc#1246203).
- commit bdd7f41
- NFS: Fix wakeup of __nfs_lookup_revalidate() in
unblock_revalidate() (git-fixes).
- commit 80e576f
- sched: Add test_and_clear_wake_up_bit() and
atomic_dec_and_wake_up() (git-fixes).
- commit 3754627
- drm/amdgpu: Add basic validation for RAS header (bsc#1247252 CVE-2025-38426)
- commit 5d23e74
- NFS: Fix the setting of capabilities when automounting a new
filesystem (git-fixes).
- commit fabe208
- sunrpc: fix client side handling of tls alerts (git-fixes).
- commit 4c093f3
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY
(git-fixes).
- commit fd58755
- NFSv4.2: another fix for listxattr (git-fixes).
- commit 5a2e576
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()
(git-fixes).
- commit 094541e
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors
(git-fixes).
- commit ec1d884
- gpio: mlxbf2: use platform_get_irq_optional() (git-fixes).
- ALSA: hda/ca0132: Fix missing error handling in
ca0132_alt_select_out() (git-fixes).
- ALSA: intel_hdmi: Fix off-by-one error in
__hdmi_lpe_audio_probe() (git-fixes).
- commit 1750f05
- kABI: io_uring: msg_ring ensure io_kiocb freeing is deferred
(CVE-2025-38453 bsc#1247234).
- commit 0f853c5
- posix-cpu-timers: fix race between handle_posix_cpu_timers()
and posix_cpu_timer_del() (bsc#1246911 CVE-2025-38352).
- commit ab7e2c1
- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU
(CVE-2025-38453 bsc#1247234).
- commit d411ddb
- tls: always refresh the queue when reading sock (CVE-2025-38471
bsc#1247450).
- ext4: only dirty folios when data journaling regular files
(CVE-2025-38220 bsc#1245966).
- commit 4468ab0
- virtio-pci: Check if is_avq is NULL (bsc#1247831 bsc#1228664
CVE-2024-42134).
- commit fd0b149
- net/sched: mqprio: fix stack out-of-bounds write in tc entry
parsing (git-fixes).
- commit 87e34c3
- net/packet: fix a race in packet_set_ring() and
packet_notifier() (git-fixes).
- commit caa5d02
- net/sched: taprio: enforce minimum value for picos_per_byte
(git-fixes).
- commit d33d37f
- ipv6: reject malicious packets in ipv6_gso_segment()
(git-fixes).
- commit e120573
- netpoll: prevent hanging NAPI when netcons gets enabled
(git-fixes).
- commit d8e3fe4
- tracing/kprobes: Fix to free objects when failed to copy a
symbol (git-fixes).
- commit a2d3373
- tracing/kprobe: Make trace_kprobe's module callback called
after jump_label update (git-fixes).
- commit 34ee7ea
- kABI fix for net: vlan: fix VLAN 0 refcount imbalance of
toggling (CVE-2025-38470 bsc#1247288).
- commit 00f8e79
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering
during runtime (CVE-2025-38470 bsc#1247288).
- net/sched: Abort __tc_modify_qdisc if parent class does not
exist (CVE-2025-38457 bsc#1247098).
- atm: clip: Fix potential null-ptr-deref in to_atmarpd()
(CVE-2025-38460 bsc#1247143).
- idpf: convert control queue mutex to a spinlock (CVE-2025-38392
bsc#1247169).
- commit 4f53008
- drm/amd/display: Don't overwrite dce60_clk_mgr (git-fixes).
- Revert "vgacon: Add check for vc_origin address range in
vgacon_scroll()" (stable-fixes).
- commit 6cc69eb
- exfat: fdatasync flag should be same like generic_write_sync()
(git-fixes).
- commit ec3f01f
- do_change_type(): refuse to operate on unmounted/not ours mounts (CVE-2025-38498 bsc#1247374)
- commit 545afad
- vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() (CVE-2024-56742 bsc#1235613)
- commit ff30550
- scsi: target: Fix NULL pointer dereference in
core_scsi3_decode_spec_i_port() (CVE-2025-38399 bsc#1247097).
- commit e689eaa
- smc: Fix various oops due to inet_sock type confusion
(CVE-2025-38475 bsc#1247308).
- commit a8e35aa
- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (git-fixes)
- commit 39fb4df
- drm/v3d: Disable interrupts before resetting the GPU
(CVE-2025-38371 bsc#1247178).
- commit 4160ac6
- io_uring/rsrc: fix folio unpinning (bsc#1246188 CVE-2025-38256).
- mm: release number of pages of a folio (CVE-2025-38256
bsc#1246188).
- commit 3b7e190
- io_uring: fix potential page leak in io_sqe_buffer_register()
(git-fixes).
- commit a038a0d
- btrfs: fix log tree replay failure due to file with 0 links
and extents (git-fixes).
- commit fd0c9dd
- netlink: make sure we allow at least one dump skb
(CVE-2025-38465 bsc#1247118).
- netlink: Fix rmem check in netlink_broadcast_deliver()
(CVE-2025-38465 bsc#1247118).
- netlink: Fix wraparounds of sk->sk_rmem_alloc (CVE-2025-38465
bsc#1247118).
- commit b3ac9f0
- Enable SMC_LO (a.k.a SMC-D) (jsc#PED-13248).
- commit e35260b
- Refresh
patches.kabi/xsk-Fix-race-condition-in-AF_XDP-generic-RX-path.patch.
Drop the static_assert() kABI checks temporarily until we have a proper
solution to signal kABI verification.
- commit d4817c8
- af_unix: Add a prompt to CONFIG_AF_UNIX_OOB (bsc#1246093).
- commit 9dcc611
- net: usbnet: Fix the wrong netif_carrier_on() call (git-fixes).
- commit 3ed80f8
- io_uring/timeout: fix multishot updates (bsc#1247021).
- commit 3631cdf
- kABI: restore layout of struct msi_desc (CVE-2025-38062
bsc#1245216).
- genirq/msi: Store the IOMMU IOVA directly in msi_desc instead
of iommu_cookie (CVE-2025-38062 bsc#1245216).
- commit 19502f4
- Delete
patches.suse/af_unix-Disable-MSG_OOB-for-unprivileged-users.patch.
- commit e99b1bb
- Update config files. (CVE-2025-38236 bsc#1246093)
Disable CONFIG_AF_UNIX_OOB as the implementation is ridden with security
bugs whose fixes would be hard to backport and the feature has no known
users.
- commit f8cd607
- Refresh patches.suse/x86-its-Enumerate-Indirect-Target-Selection-ITS-bug.patch.
- Refresh
patches.suse/x86-its-Add-vmexit-option-to-skip-mitigation-on-some-CPUs.patch.
Fix affected model steppings.
- commit 115d04b
- KVM: x86: Reset IRTE to host control if *new* route isn't
postable (bsc#1242960 CVE-2025-37885).
- commit b463fcd
- enabled CONFIG_X86_INTEL_TSX_MODE_AUTO
This is a response to bsc#1246695. As result of TAA vulnerability
(CVE-2019-11135) we have aimed to follow the upstream default for TSX
but due to a mistake we have ended up using CONFIG_X86_INTEL_TSX_MODE_ON
rather than CONFIG_X86_INTEL_TSX_MODE_OFF. This has been noticed later
on and fixed to align with upstream. Which has made some users unhappy
because they have lost a default TSX functionality even on HW that is
not susceptible to CVE-2019-11135.
We have discussed different ways to deal with that but the likely most
straightforward turned out to be to go with CONFIG_X86_INTEL_TSX_MODE_AUTO
which disables TSX only on CVE-2019-11135 affected HW. We are still
diverging from the upstream here but there are some positive indications
that no new TSX based side channels have been discovered since.
- commit 395c9dd
- kABI fix after KVM: SVM: Fix SNP AP destroy race with VMRUN
(git-fixes).
- commit 8a8d140
- KVM: SVM: Fix SNP AP destroy race with VMRUN (git-fixes).
- commit a050518
- tcp: call tcp_measure_rcv_mss() for ooo packets (git-fixes).
- commit 54261d2
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic
context in qfq_delete_class (git-fixes).
- commit cdfb027
- Refresh
patches.suse/af_unix-Disable-MSG_OOB-for-unprivileged-users.patch.
Print message upon disabled use.
- commit 31d5690
- Refresh
patches.suse/virtio-blk-scsi-use-block-layer-helpers-to-calculate.patch.
- commit 773f5a0
- Rename to
patches.suse/scsi-use-block-layer-helpers-to-calculate-num-of-que.patch.
- commit dd839b8
- Refresh
patches.suse/nvme-pci-use-block-layer-helpers-to-calculate-num-of.patch.
- commit e114e47
- Refresh
patches.suse/blk-mq-add-number-of-queue-calc-helper.patch.
- commit db4fa45
- Rename to
patches.suse/lib-group_cpus-Let-group_cpu_evenly-return-the-numbe.patch.
Refresh:
- patches.kabi/kabi-fix-group-cpus-evenly.patch
- patches.suse/lib-group_cpus-honor-housekeeping-config-when-grouping.patch
- commit ca07a82
- btrfs: tests: fix chunk map leak after failure to add it to
the tree (git-fixes).
- commit 4c3fd9d
- lib/group_cpus: fix NULL pointer dereference from
group_cpus_evenly() (bsc#1236897).
- lib/group_cpus.c: avoid acquiring cpu hotplug lock in
group_cpus_evenly (bsc#1236897).
- commit 749ceff
- btrfs: fix ssd_spread overallocation (git-fixes).
- commit 760f402
- btrfs: use btrfs_record_snapshot_destroy() during rmdir
(git-fixes).
- commit 05219d1
- btrfs: propagate last_unlink_trans earlier when doing a rmdir
(git-fixes).
- btrfs: rename err to ret in btrfs_rmdir() (git-fixes).
- commit 6fea6c3
- btrfs: don't skip remaining extrefs if dir not found during
log replay (git-fixes).
- commit ae66e11
- btrfs: don't ignore inode missing when replaying log tree
(git-fixes).
- commit 87671c8
- btrfs: fix inode lookup error handling during log replay
(git-fixes).
- commit a89d2a6
- nvmet-tcp: fix callback lock for TLS handshake (git-fixes).
- nvme: fix misaccounting of nvme-mpath inflight I/O (git-fixes).
- nvme: fix endianness of command word prints in
nvme_log_err_passthru() (git-fixes).
- nvme: fix inconsistent RCU list manipulation in
nvme_ns_add_to_ctrl_list() (git-fixes).
- commit bbf2481
- RDMA/core: Rate limit GID cache warning messages (git-fixes)
- commit fd0e41a
- kernel-syms.spec: Drop old rpm release number hack (bsc#1247172).
- commit b4fa2d1
- rtc: rv3028: fix incorrect maximum clock rate handling
(git-fixes).
- rtc: pcf8563: fix incorrect maximum clock rate handling
(git-fixes).
- rtc: pcf85063: fix incorrect maximum clock rate handling
(git-fixes).
- rtc: nct3018y: fix incorrect maximum clock rate handling
(git-fixes).
- rtc: hym8563: fix incorrect maximum clock rate handling
(git-fixes).
- rtc: ds1307: fix incorrect maximum clock rate handling
(git-fixes).
- ucount: fix atomic_long_inc_below() argument type (git-fixes).
- i3c: fix module_i3c_i2c_driver() with I3C=n (git-fixes).
- commit e466472
- pinmux: fix race causing mux_owner NULL with active mux_usecount
(git-fixes).
- pinctrl: sunxi: Fix memory leak on krealloc failure (git-fixes).
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref
(git-fixes).
- firewire: ohci: correct code comments about bus_reset tasklet
(git-fixes).
- commit fd1a6ae
- drm/amd/display: fix initial backlight brightness calculation
(git-fixes).
- commit 9a59f80
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx()
(git-fixes).
- drm/xe/vf: Disable CSC support on VF (git-fixes).
- drm/amdgpu: Initialize data to NULL in
imu_v12_0_program_rlc_ram() (git-fixes).
- staging: vchiq_arm: Make vchiq_shutdown never fail (git-fixes).
- regulator: core: fix NULL dereference on unbind due to stale
coupling data (stable-fixes).
- commit 9ec53f4
- PCI: rockchip-host: Fix "Unexpected Completion" log message
(git-fixes).
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem
attribute (git-fixes).
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if
pci_epc_get_next_free_bar() fails (git-fixes).
- PCI: endpoint: Fix configfs group removal on driver teardown
(git-fixes).
- PCI: endpoint: Fix configfs group list head handling
(git-fixes).
- watchdog: ziirave_wdt: check record length in
ziirave_firm_verify() (git-fixes).
- dmaengine: nbpfaxi: Add missing check after DMA map (git-fixes).
- dmaengine: mv_xor: Fix missing check after DMA map and missing
unmap (git-fixes).
- dmaengine: qcom: gpi: Drop unused gpi_write_reg_field()
(git-fixes).
- dmaengine: dw-edma: Drop unused dchan2dev() and chan2dev()
(git-fixes).
- ASoC: fsl_xcvr: get channel status data when PHY is not exists
(git-fixes).
- soundwire: stream: restore params when prepare ports fail
(git-fixes).
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is
not set (git-fixes).
- power: supply: cpcap-charger: Fix null check for
power_supply_get_by_name (git-fixes).
- ALSA: hda/realtek - Add mute LED support for HP Pavilion
15-eg0xxx (stable-fixes).
- can: netlink: can_changelink(): fix NULL pointer deref of
struct can_priv::do_set_mode (git-fixes).
- ALSA: hda: Add missing NVIDIA HDA codec IDs (stable-fixes).
- usb: typec: tcpm: apply vbus before data bringup in
tcpm_src_attach (git-fixes).
- usb: typec: tcpm: allow switching to mode accessory to mux
properly (stable-fixes).
- usb: typec: tcpm: allow to use sink in accessory mode
(stable-fixes).
- ALSA: hda/tegra: Add Tegra264 support (stable-fixes).
- can: dev: can_restart(): move debug message and stats after
successful restart (stable-fixes).
- can: dev: can_restart(): reverse logic to remove need for goto
(stable-fixes).
- commit 0f0c0d9
- btrfs: don't silently ignore unexpected extent type when
replaying log (git-fixes).
- commit e423498
- btrfs: fix invalid inode pointer dereferences during log replay
(git-fixes).
- commit 78cbba9
- btrfs: return a btrfs_inode from read_one_inode() (git-fixes).
- commit b3a9472
- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (git-fixes).
- iommu/amd: Fix geometry.aperture_end for V2 tables (git-fixes).
- commit f8c05a9
- btrfs: return a btrfs_inode from btrfs_iget_logging()
(git-fixes).
- commit 88ed97b
- btrfs: use NOFS context when getting inodes during logging
and log replay (git-fixes).
- commit 88eb1d5
- virtio-net: ensure the received length does not exceed allocated
size (CVE-2025-38375 bsc#1247177).
- commit 2adf745
- btrfs: update superblock's device bytes_used when dropping chunk
(git-fixes).
- commit e33076b
- Update
patches.suse/0001-mm-hugetlb-fix-huge_pmd_unshare-vs-GUP-fast-race.patch
(bsc#1245431 CVE-2025-38085 bsc#1245499).
- Update
patches.suse/0001-mm-hugetlb-unshare-page-tables-during-VMA-split-not-.patch
(bsc#1245431 CVE-2025-38084 bsc#1245498).
- Update
patches.suse/ACPI-CPPC-Fix-NULL-pointer-dereference-when-nosmp-is.patch
(git-fixes CVE-2025-38113 bsc#1245683).
- Update
patches.suse/ACPICA-Refuse-to-evaluate-a-method-if-arguments-are-.patch
(stable-fixes CVE-2025-38386 bsc#1247138).
- Update
patches.suse/ACPICA-fix-acpi-operand-cache-leak-in-dswstate.c.patch
(stable-fixes CVE-2025-38345 bsc#1246337).
- Update
patches.suse/ACPICA-fix-acpi-parse-and-parseext-cache-leaks.patch
(stable-fixes CVE-2025-38344 bsc#1246334).
- Update
patches.suse/ALSA-usb-audio-Fix-out-of-bounds-read-in-snd_usb_get.patch
(git-fixes CVE-2025-38249 bsc#1246171).
- Update
patches.suse/ASoC-Intel-avs-Verify-content-returned-by-parse_int_.patch
(git-fixes CVE-2025-38307 bsc#1246364).
- Update
patches.suse/ASoC-codecs-wcd9335-Fix-missing-free-of-regulator-su.patch
(git-fixes CVE-2025-38259 bsc#1246220).
- Update
patches.suse/Bluetooth-Fix-NULL-pointer-deference-on-eir_get_serv.patch
(git-fixes CVE-2025-38304 bsc#1246240).
- Update
patches.suse/Bluetooth-Fix-null-ptr-deref-in-l2cap_sock_resume_cb.patch
(git-fixes CVE-2025-38473 bsc#1247289).
- Update
patches.suse/Bluetooth-MGMT-Fix-UAF-on-mgmt_remove_adv_monitor_co.patch
(git-fixes CVE-2025-38118 bsc#1245670).
- Update
patches.suse/HID-core-do-not-bypass-hid_hw_raw_request.patch
(stable-fixes CVE-2025-38494 bsc#1247349).
- Update
patches.suse/HID-core-ensure-the-allocated-report-buffer-can-cont.patch
(stable-fixes CVE-2025-38495 bsc#1247348).
- Update
patches.suse/IB-mlx5-Fix-potential-deadlock-in-MR-deregistration.patch
(git-fixes CVE-2025-38373 bsc#1247033).
- Update
patches.suse/Input-ims-pcu-check-record-size-in-ims_pcu_flash_fir.patch
(git-fixes CVE-2025-38428 bsc#1247150).
- Update
patches.suse/NFC-nci-uart-Set-tty-disc_data-only-in-success-path.patch
(git-fixes CVE-2025-38416 bsc#1247151).
- Update
patches.suse/NFSv4-pNFS-Fix-a-race-to-wake-on-NFS_LAYOUT_DRAIN.patch
(git-fixes CVE-2025-38393 bsc#1247170).
- Update
patches.suse/RDMA-cma-Fix-hang-when-cma_netevent_callback-fails-t.patch
(git-fixes CVE-2025-38151 bsc#1245745).
- Update
patches.suse/RDMA-iwcm-Fix-use-after-free-of-work-objects-after-c.patch
(git-fixes CVE-2025-38211 bsc#1246008).
- Update
patches.suse/RDMA-mlx5-Fix-error-flow-upon-firmware-failure-for-R.patch
(git-fixes CVE-2025-38161 bsc#1245777).
- Update
patches.suse/RDMA-mlx5-Initialize-obj_event-obj_sub_list-before-x.patch
(git-fixes CVE-2025-38387 bsc#1247154).
- Update
patches.suse/Squashfs-check-return-result-of-sb_min_blocksize.patch
(git-fixes CVE-2025-38415 bsc#1247147).
- Update
patches.suse/VMCI-fix-race-between-vmci_host_setup_notify-and-vmc.patch
(git-fixes CVE-2025-38102 bsc#1245669).
- Update
patches.suse/aoe-clean-device-rq_list-in-aoedev_downdev.patch
(git-fixes CVE-2025-38326 bsc#1246490).
- Update
patches.suse/ata-pata_via-Force-PIO-for-ATAPI-devices-on-VT6415-V.patch
(stable-fixes CVE-2025-38336 bsc#1246370).
- Update
patches.suse/backlight-pm8941-Add-NULL-check-in-wled_configure.patch
(git-fixes CVE-2025-38143 bsc#1245714).
- Update patches.suse/bnxt-properly-flush-XDP-redirect-lists.patch
(git-fixes CVE-2025-38246 bsc#1246195).
- Update
patches.suse/bpf-sockmap-Fix-panic-when-calling-skb_linearize.patch
(bsc#1245749 CVE-2025-38154 CVE-2025-38165 bsc#1245757).
- Update patches.suse/bus-fsl-mc-fix-double-free-on-mc_dev.patch
(git-fixes CVE-2025-38313 bsc#1246342).
- Update
patches.suse/calipso-Fix-null-ptr-deref-in-calipso_req_-set-del-a.patch
(git-fixes CVE-2025-38181 bsc#1246000).
- Update
patches.suse/comedi-Fail-COMEDI_INSNLIST-ioctl-if-n_insns-is-too-.patch
(git-fixes CVE-2025-38481 bsc#1247276).
- Update
patches.suse/comedi-Fix-initialization-of-data-for-instructions-t.patch
(git-fixes CVE-2025-38478 bsc#1247273).
- Update
patches.suse/comedi-Fix-use-of-uninitialized-data-in-insn_rw_emul.patch
(git-fixes CVE-2025-38480 bsc#1247274).
- Update
patches.suse/comedi-das16m1-Fix-bit-shift-out-of-bounds.patch
(git-fixes CVE-2025-38483 bsc#1247278).
- Update
patches.suse/comedi-das6402-Fix-bit-shift-out-of-bounds.patch
(git-fixes CVE-2025-38482 bsc#1247277).
- Update
patches.suse/crypto-marvell-cesa-Handle-zero-length-skcipher-requ.patch
(git-fixes CVE-2025-38173 bsc#1245769).
- Update
patches.suse/crypto-sun8i-ce-cipher-fix-error-handling-in-sun8i_c.patch
(git-fixes CVE-2025-38300 bsc#1246349).
- Update patches.suse/dm-bufio-fix-sched-in-atomic-context.patch
(git-fixes CVE-2025-38496 bsc#1247284).
- Update
patches.suse/dma-buf-insert-memory-barrier-before-updating-num_fe.patch
(git-fixes CVE-2025-38095 bsc#1245658).
- Update
patches.suse/dmaengine-idxd-Check-availability-of-workqueue-alloc.patch
(stable-fixes CVE-2025-38369 bsc#1247209).
- Update
patches.suse/dmaengine-ti-Add-NULL-check-in-udma_probe.patch
(git-fixes CVE-2025-38138 bsc#1245719).
- Update
patches.suse/drivers-rapidio-rio_cm.c-prevent-possible-heap-overw.patch
(stable-fixes CVE-2025-38090 bsc#1245510).
- Update
patches.suse/drm-amd-display-Add-null-pointer-check-for-get_first.patch
(git-fixes CVE-2025-38362 bsc#1247089).
- Update
patches.suse/drm-amd-pp-Fix-potential-NULL-pointer-dereference-in.patch
(git-fixes CVE-2025-38319 bsc#1246243).
- Update
patches.suse/drm-exynos-exynos7_drm_decon-add-vblank-check-in-IRQ.patch
(git-fixes CVE-2025-38467 bsc#1247146).
- Update
patches.suse/drm-gem-Acquire-references-on-GEM-handles-for-frameb.patch
(stable-fixes CVE-2025-38449 bsc#1247255).
- Update
patches.suse/drm-i915-gt-Fix-timeline-left-held-on-VMA-alloc-erro.patch
(git-fixes CVE-2025-38389 bsc#1247153).
- Update
patches.suse/drm-msm-Fix-a-fence-leak-in-submit-error-path.patch
(stable-fixes CVE-2025-38410 bsc#1247128).
- Update
patches.suse/drm-msm-Fix-another-leak-in-the-submit-error-path.patch
(stable-fixes CVE-2025-38409 bsc#1247285).
- Update
patches.suse/drm-msm-gpu-Fix-crash-when-throttling-GPU-immediatel.patch
(git-fixes CVE-2025-38354 bsc#1247061).
- Update
patches.suse/drm-scheduler-signal-scheduled-fence-when-kill-job.patch
(stable-fixes CVE-2025-38436 bsc#1247227).
- Update
patches.suse/drm-tegra-Fix-a-possible-null-pointer-dereference.patch
(git-fixes CVE-2025-38363 bsc#1247018).
- Update
patches.suse/fbcon-Make-sure-modelist-not-set-on-unregistered-con.patch
(stable-fixes CVE-2025-38198 bsc#1245952).
- Update
patches.suse/fbdev-Fix-do_register_framebuffer-to-prevent-null-pt.patch
(git-fixes CVE-2025-38215 bsc#1246109).
- Update
patches.suse/fbdev-Fix-fb_set_var-to-prevent-null-ptr-deref-in-fb.patch
(git-fixes CVE-2025-38214 bsc#1246042).
- Update
patches.suse/fbdev-core-fbcvt-avoid-division-by-0-in-fb_cvt_hperi.patch
(git-fixes CVE-2025-38312 bsc#1246386).
- Update
patches.suse/fs-nfs-read-fix-double-unlock-bug-in-nfs_return_empty_folio.patch
(git-fixes CVE-2025-38338 bsc#1246258).
- Update
patches.suse/gve-add-missing-NULL-check-for-gve_alloc_pending_pac.patch
(git-fixes CVE-2025-38122 bsc#1245746).
- Update
patches.suse/hwmon-asus-ec-sensors-check-sensor-index-in-read_str.patch
(git-fixes CVE-2025-38142 bsc#1245713).
- Update
patches.suse/hwmon-ftsteutates-Fix-TOCTOU-race-in-fts_read.patch
(git-fixes CVE-2025-38217 bsc#1246002).
- Update
patches.suse/i2c-designware-Fix-an-initialization-issue.patch
(git-fixes CVE-2025-38380 bsc#1247028).
- Update
patches.suse/i2c-tegra-check-msg-length-in-SMBUS-block-read.patch
(bsc#1242086 CVE-2025-38425 bsc#1247251).
- Update
patches.suse/ice-fix-Tx-scheduler-error-handling-in-XDP-callback.patch
(git-fixes CVE-2025-38127 bsc#1245705).
- Update
patches.suse/iio-accel-fxls8962af-Fix-use-after-free-in-fxls8962a.patch
(git-fixes CVE-2025-38485 bsc#1247236).
- Update
patches.suse/jffs2-check-jffs2_prealloc_raw_node_refs-result-in-few-other-places.patch
(git-fixes CVE-2025-38328 bsc#1246249).
- Update
patches.suse/jffs2-check-that-raw-node-were-preallocated-before-writing-summary.patch
(git-fixes CVE-2025-38194 bsc#1245957).
- Update
patches.suse/media-cxusb-no-longer-judge-rbuf-when-the-write-fail.patch
(git-fixes CVE-2025-38229 bsc#1246049).
- Update
patches.suse/media-imx-jpeg-Cleanup-after-an-allocation-error.patch
(git-fixes CVE-2025-38225 bsc#1246041).
- Update
patches.suse/media-vidtv-Terminating-the-subsequent-process-of-in.patch
(git-fixes CVE-2025-38227 bsc#1246031).
- Update
patches.suse/media-vivid-Change-the-siize-of-the-composing.patch
(git-fixes CVE-2025-38226 bsc#1246050).
- Update
patches.suse/mtd-nand-ecc-mxic-Fix-use-of-uninitialized-variable-.patch
(git-fixes CVE-2025-38277 bsc#1246246).
- Update
patches.suse/mtd-spinand-fix-memory-leak-of-ECC-engine-conf.patch
(stable-fixes CVE-2025-38384 bsc#1247035).
- Update
patches.suse/mtk-sd-Prevent-memory-corruption-from-DMA-map-failur.patch
(git-fixes CVE-2025-38401 bsc#1247125).
- Update
patches.suse/nbd-fix-uaf-in-nbd_genl_connect-error-path.patch
(git-fixes CVE-2025-38443 bsc#1247164).
- Update patches.suse/net-Fix-TOCTOU-issue-in-sk_is_readable.patch
(git-fixes CVE-2025-38112 bsc#1245668).
- Update
patches.suse/net-fix-udp-gso-skb_segment-after-pull-from-frag_lis.patch
(git-fixes CVE-2025-38124 bsc#1245690).
- Update
patches.suse/net-mdiobus-Fix-potential-out-of-bounds-clause-45-re.patch
(git-fixes CVE-2025-38110 bsc#1245665).
- Update
patches.suse/net-mdiobus-Fix-potential-out-of-bounds-read-write-a.patch
(git-fixes CVE-2025-38111 bsc#1245666).
- Update
patches.suse/net-mlx5-Fix-ECVF-vports-unload-on-shutdown-flow.patch
(git-fixes CVE-2025-38109 bsc#1245684).
- Update
patches.suse/net-phy-clear-phydev-devlink-when-the-link-is-delete.patch
(git-fixes CVE-2025-38149 bsc#1245737).
- Update
patches.suse/net-phy-mscc-Fix-memory-leak-when-using-one-step-tim.patch
(git-fixes CVE-2025-38148 bsc#1245735).
- Update
patches.suse/net-sched-Return-NULL-when-htb_lookup_leaf-encounter.patch
(git-fixes CVE-2025-38468 bsc#1247437).
- Update
patches.suse/net-sched-fix-use-after-free-in-taprio_dev_notifier.patch
(git-fixes CVE-2025-38087 bsc#1245504).
- Update
patches.suse/net-sched-sch_qfq-Fix-race-condition-on-qfq_aggregat.patch
(git-fixes CVE-2025-38477 bsc#1247314).
- Update
patches.suse/net-tipc-fix-refcount-warning-in-tipc_aead_encrypt.patch
(CVE-2025-38052 bsc#1244749 CVE-2025-38273 bsc#1246266).
- Update
patches.suse/net-usb-aqc111-fix-error-handling-of-usbnet-read-cal.patch
(git-fixes CVE-2025-38153 bsc#1245744).
- Update
patches.suse/net-usb-lan78xx-fix-WARN-in-__netif_napi_del_locked-.patch
(git-fixes CVE-2025-38385 bsc#1247149).
- Update patches.suse/net-wwan-t7xx-Fix-napi-rx-poll-issue.patch
(git-fixes CVE-2025-38123 bsc#1245688).
- Update
patches.suse/net_sched-ets-fix-a-race-in-ets_qdisc_change.patch
(git-fixes CVE-2025-38107 bsc#1245676).
- Update
patches.suse/net_sched-red-fix-a-race-in-__red_change.patch
(git-fixes CVE-2025-38108 bsc#1245675).
- Update
patches.suse/net_sched-sch_sfq-reject-invalid-perturb-period.patch
(git-fixes CVE-2025-38193 bsc#1245945).
- Update
patches.suse/netfilter-nf_set_pipapo_avx2-fix-initial-map-fill.patch
(git-fixes CVE-2024-57947 bsc#1236333 CVE-2025-38120
bsc#1245711).
- Update
patches.suse/nfs-Clean-up-proc-net-rpc-nfs-when-nfs_fs_proc_net_init-fails.patch
(git-fixes CVE-2025-38400 bsc#1247123).
- Update
patches.suse/nfsd-Initialize-ssc-before-laundromat_work-to-prevent-NULL-dereference.patch
(git-fixes CVE-2025-38231 bsc#1246055).
- Update
patches.suse/nfsd-nfsd4_spo_must_allow-must-check-this-is-a-v4-compound-request.patch
(git-fixes CVE-2025-38430 bsc#1247160).
- Update
patches.suse/page_pool-Fix-use-after-free-in-page_pool_recycle_in.patch
(git-fixes CVE-2025-38129 bsc#1245723).
- Update patches.suse/perf-Fix-sample-vs-do_exit.patch
(bsc#1246547 CVE-2025-38424 bsc#1247293).
- Update
patches.suse/phy-qcom-qmp-usb-Fix-an-NULL-vs-IS_ERR-bug.patch
(git-fixes CVE-2025-38275 bsc#1246236).
- Update
patches.suse/pinctrl-at91-Fix-possible-out-of-boundary-access.patch
(git-fixes CVE-2025-38286 bsc#1246283).
- Update
patches.suse/platform-x86-dell-wmi-sysman-Fix-WMI-data-block-retr.patch
(git-fixes CVE-2025-38412 bsc#1247132).
- Update patches.suse/platform-x86-dell_rbu-Fix-list-usage.patch
(git-fixes CVE-2025-38197 bsc#1246047).
- Update
patches.suse/powerpc-powernv-memtrace-Fix-out-of-bounds-issue-in-.patch
(bsc#1244309 ltc#213790 CVE-2025-38088 bsc#1245506).
- Update
patches.suse/ptp-remove-ptp-n_vclocks-check-logic-in-ptp_vclock_i.patch
(git-fixes CVE-2025-38305 bsc#1246358).
- Update
patches.suse/regulator-gpio-Fix-the-out-of-bounds-access-to-drvda.patch
(git-fixes CVE-2025-38395 bsc#1247171).
- Update
patches.suse/rose-fix-dangling-neighbour-pointers-in-rose_rt_devi.patch
(git-fixes CVE-2025-38377 bsc#1247174).
- Update
patches.suse/rpl-Fix-use-after-free-in-rpl_do_srh_inline.patch
(git-fixes CVE-2025-38476 bsc#1247317).
- Update
patches.suse/s390-bpf-Fix-bpf_arch_text_poke-with-new_addr-NULL-again.patch
(git-fixes bsc#1246870 CVE-2025-38489 bsc#1247241).
- Update
patches.suse/s390-pkey-Prevent-overflow-in-size-calculation-for-memdup_.patch
(git-fixes bsc#1245598 CVE-2025-38257 bsc#1246186).
- Update
patches.suse/sch_hfsc-make-hfsc_qlen_notify-idempotent.patch
(CVE-2025-37798 bsc#1242414 CVE-2025-38177 bsc#1245986).
- Update
patches.suse/scsi-lpfc-Avoid-potential-ndlp-use-after-free-in-dev.patch
(bsc#1242993 CVE-2025-38289 bsc#1246287).
- Update patches.suse/scsi-lpfc-Use-memcpy-for-BIOS-version.patch
(bsc#1240966 CVE-2025-38332 bsc#1246375).
- Update
patches.suse/serial-Fix-potential-null-ptr-deref-in-mlb_usio_prob.patch
(git-fixes CVE-2025-38135 bsc#1246023).
- Update
patches.suse/soc-aspeed-Add-NULL-check-in-aspeed_lpc_enable_snoop.patch
(git-fixes CVE-2025-38145 bsc#1245765).
- Update
patches.suse/soc-aspeed-lpc-snoop-Don-t-disable-channels-that-are.patch
(git-fixes CVE-2025-38487 bsc#1247238).
- Update
patches.suse/software-node-Correct-a-OOB-check-in-software_node_g.patch
(stable-fixes CVE-2025-38342 bsc#1246453).
- Update
patches.suse/sunrpc-handle-SVC_GARBAGE-during-svc-auth-processing-as-auth-error.patch
(git-fixes CVE-2025-38089 bsc#1245508).
- Update
patches.suse/thunderbolt-Do-not-double-dequeue-a-configuration-re.patch
(stable-fixes CVE-2025-38174 bsc#1245781).
- Update
patches.suse/usb-chipidea-udc-disconnect-reconnect-from-host-when.patch
(git-fixes CVE-2025-38376 bsc#1247176).
- Update
patches.suse/usb-gadget-u_serial-Fix-race-condition-in-TTY-wakeup.patch
(git-fixes CVE-2025-38448 bsc#1247233).
- Update
patches.suse/usb-net-sierra-check-for-no-status-endpoint.patch
(git-fixes CVE-2025-38474 bsc#1247311).
- Update
patches.suse/usb-renesas_usbhs-Reorder-clock-handling-and-power-m.patch
(git-fixes CVE-2025-38136 bsc#1245691).
- Update
patches.suse/usb-typec-altmodes-displayport-do-not-index-invalid-.patch
(git-fixes CVE-2025-38391 bsc#1247181).
- Update
patches.suse/usb-typec-displayport-Fix-potential-deadlock.patch
(git-fixes CVE-2025-38404 bsc#1247271).
- Update
patches.suse/vgacon-Add-check-for-vc_origin-address-range-in-vgac.patch
(git-fixes CVE-2025-38213 bsc#1246037).
- Update
patches.suse/wifi-ath11k-fix-node-corruption-in-ar-arvifs-list.patch
(git-fixes CVE-2025-38293 bsc#1246292).
- Update
patches.suse/wifi-ath12k-fix-invalid-access-to-memory.patch
(git-fixes CVE-2025-38292 bsc#1246295).
- Update
patches.suse/wifi-ath12k-fix-node-corruption-in-ar-arvifs-list.patch
(git-fixes CVE-2025-38290 bsc#1246293).
- Update
patches.suse/wifi-ath6kl-remove-WARN-on-bad-firmware-input.patch
(stable-fixes CVE-2025-38406 bsc#1247210).
- Update
patches.suse/wifi-ath9k_htc-Abort-software-beacon-handling-if-dis.patch
(git-fixes CVE-2025-38157 bsc#1245747).
- Update
patches.suse/wifi-carl9170-do-not-ping-device-which-has-failed-to.patch
(git-fixes CVE-2025-38420 bsc#1247279).
- Update
patches.suse/wifi-mt76-mt7915-Fix-null-ptr-deref-in-mt7915_mmio_w.patch
(git-fixes CVE-2025-38155 bsc#1245748).
- Update
patches.suse/wifi-mt76-mt7996-drop-fragments-with-multicast-or-br.patch
(stable-fixes CVE-2025-38343 bsc#1246438).
- Update
patches.suse/wifi-p54-prevent-buffer-overflow-in-p54_rx_eeprom_re.patch
(git-fixes CVE-2025-38348 bsc#1246262).
- Update
patches.suse/wifi-rtw88-fix-the-para-buffer-size-to-avoid-reading.patch
(git-fixes CVE-2025-38159 bsc#1245751).
- commit de345c9
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen"
(bsc#1219338).
- sched,freezer: Remove unnecessary warning in __thaw_task
(bsc#1219338).
- commit 108588a
- Update
patches.suse/ASoC-mediatek-mt8195-Set-ETDM1-2-IN-OUT-to-COMP_DUMM.patch
(git-fixes CVE-2025-38299 bsc#1246290).
- Update
patches.suse/Bluetooth-btintel-Check-dsbr-size-from-EFI-variable.patch
(git-fixes CVE-2025-38315 bsc#1246333).
- Update
patches.suse/IB-cm-Drop-lockdep-assert-and-WARN-when-freeing-old-.patch
(git-fixes CVE-2025-38287 bsc#1246285).
- Update
patches.suse/bnxt_en-Fix-double-invocation-of-bnxt_ulp_stop-bnxt_.patch
(git-fixes CVE-2025-38186 bsc#1245955).
- Update
patches.suse/drm-amd-display-Check-dce_hwseq-before-dereferencing.patch
(stable-fixes CVE-2025-38361 bsc#1247079).
- Update
patches.suse/drm-amd-display-check-stream-id-dml21-wrapper-to-get.patch
(stable-fixes CVE-2025-38091 bsc#1245621).
- Update
patches.suse/drm-v3d-Avoid-NULL-pointer-dereference-in-v3d_job_up.patch
(stable-fixes CVE-2025-38189 bsc#1245812).
- Update
patches.suse/drm-v3d-Disable-interrupts-before-resetting-the-GPU.patch
(git-fixes CVE-2025-38371 bsc#1247178).
- Update
patches.suse/drm-xe-Fix-taking-invalid-lock-on-wedge.patch
(stable-fixes CVE-2025-38353 bsc#1247265).
- Update
patches.suse/drm-xe-Process-deferred-GGTT-node-removals-on-device.patch
(git-fixes CVE-2025-38355 bsc#1247062).
- Update
patches.suse/drm-xe-guc-Explicitly-exit-CT-safe-mode-on-unwind.patch
(git-fixes CVE-2025-38356 bsc#1247064).
- Update
patches.suse/e1000-Move-cancel_work_sync-to-avoid-deadlock.patch
(git-fixes CVE-2025-38114 bsc#1245686).
- Update
patches.suse/ice-fix-eswitch-code-memory-leak-in-reset-scenario.patch
(git-fixes CVE-2025-38417 bsc#1247282).
- Update
patches.suse/scsi-fnic-Fix-crash-in-fnic_wq_cmpl_handler-when-FDMI-time.patch
(git-fixes CVE-2025-38238 bsc#1246179).
- Update
patches.suse/scsi-smartpqi-Fix-smp_processor_id-call-trace-for-preempti.patch
(git-fixes CVE-2025-38288 bsc#1246286).
- Update
patches.suse/serial-jsm-fix-NPE-during-jsm_uart_port_init.patch
(git-fixes CVE-2025-38265 bsc#1246244).
- Update
patches.suse/usb-typec-tcpm-move-tcpm_queue_vdm_unlocked-to-async.patch
(git-fixes CVE-2025-38268 bsc#1246385).
- Update
patches.suse/video-screen_info-Update-framebuffers-behind-PCI-bri.patch
(bsc#1240696 CVE-2025-38427 bsc#1247152).
- Update
patches.suse/wifi-ath12k-Fix-buffer-overflow-in-debugfs.patch
(bsc#1240998 CVE-2025-38317 bsc#1246443).
- Update
patches.suse/wifi-ath12k-Prevent-sending-WMI-commands-to-firmware.patch
(bsc#1240998 CVE-2025-38291 bsc#1246297).
- commit 7a0cbb6
- ipv6: fix possible infinite loop in fib6_info_uses_dev()
(git-fixes).
- commit 16f1f6e
- ipv6: prevent infinite loop in rt6_nlmsg_size() (git-fixes).
- commit cb535e8
- net/sched: Restrict conditions for adding duplicating netems
to qdisc tree (git-fixes).
- commit 6fae648
- Refresh
patches.suse/af_unix-Disable-MSG_OOB-for-unprivileged-users.patch.
Add cmdline override.
- commit 4b6e594
- af_unix: Disable MSG_OOB for unprivileged users (CVE-2025-38236
bsc#1246093).
- commit 6110a63
- fs/orangefs: Allow 2 more characters in do_c_string()
(git-fixes).
- commit 642fa26
- media: ipu6: isys: Use correct pads for xlate_streams()
(git-fixes).
- media: ivsc: Fix crash at shutdown due to missing
mei_cldev_disable() calls (git-fixes).
- media: verisilicon: Fix AV1 decoder clock frequency (git-fixes).
- commit ce0d383
- jfs: fix metapage reference count leak in dbAllocCtl
(git-fixes).
- commit 58c926b
- x86/mce/amd: Fix threshold limit reset (git-fixes).
- commit 468e2ae
- bus: mhi: ep: Update read pointer only after buffer is written
(CVE-2025-38429 bsc#1247253).
- commit 3341565
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (git-fixes).
- commit 3d8385a
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (git-fixes).
- commit fe9eb0f
- x86/mce/amd: Add default names for MCA banks and blocks (git-fixes).
- commit 27f7700
- x86/traps: Initialize DR6 by writing its architectural reset value (git-fixes).
- commit 80ddfd8
- media: venus: vdec: Clamp param smaller than 1fps and bigger
than 240 (git-fixes).
- commit 1212a93
- x86/cpu/amd: Fix workaround for erratum 1054 (git-fixes).
- commit 2d80ddf
- mtd: rawnand: atmel: set pmecc data setup time (git-fixes).
- mtd: spinand: propagate spinand_wait() errors from
spinand_write_page() (git-fixes).
- mtd: rawnand: fsmc: Add missing check after DMA map (git-fixes).
- mtd: rawnand: rockchip: Add missing check after DMA map
(git-fixes).
- mtd: rawnand: atmel: Fix dma_mapping_error() address
(git-fixes).
- mtd: rawnand: renesas: Add missing check after DMA map
(git-fixes).
- mtd: spi-nor: Fix spi_nor_try_unlock_all() (git-fixes).
- mtd: fix possible integer overflow in erase_xfer() (git-fixes).
- clk: sunxi-ng: v3s: Fix de clock definition (git-fixes).
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq
(git-fixes).
- clk: xilinx: vcu: unregister pll_post only if registered
correctly (git-fixes).
- clk: davinci: Add NULL check in davinci_lpsc_clk_register()
(git-fixes).
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions
(git-fixes).
- pwm: imx-tpm: Reset counter if CMOD is 0 (git-fixes).
- media: uvcvideo: Do not mark valid metadata as invalid
(git-fixes).
- media: ov2659: Fix memory leaks in ov2659_probe() (git-fixes).
- media: hi556: correct the test pattern configuration
(git-fixes).
- media: vivid: fix wrong pixel_array control size (git-fixes).
- media: venus: hfi: explicitly release IRQ during teardown
(git-fixes).
- media: venus: Add a check for packet size after reading from
shared memory (git-fixes).
- media: venus: protect against spurious interrupts during probe
(git-fixes).
- media: venus: venc: Clamp param smaller than 1fps and bigger
than 240 (git-fixes).
- media: v4l2-ctrls: Don't reset handler's error in
v4l2_ctrl_handler_free() (git-fixes).
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check
(git-fixes).
- media: imx: fix a potential memory leak in
imx_media_csc_scaler_device_init() (git-fixes).
- media: rainshadow-cec: fix TOCTOU race condition in
rain_interrupt() (git-fixes).
- media: gspca: Add bounds checking to firmware parser
(git-fixes).
- media: usbtv: Lock resolution while streaming (git-fixes).
- media: uvcvideo: Fix 1-byte out-of-bounds read in
uvc_parse_format() (git-fixes).
- crypto: qat - fix seq_file position update in adf_ring_next()
(git-fixes).
- crypto: qat - fix DMA direction for compression on GEN2 devices
(git-fixes).
- crypto: qat - flush misc workqueue during device shutdown
(git-fixes).
- crypto: qat - disable ZUC-256 capability for QAT GEN5
(git-fixes).
- crypto: img-hash - Fix dma_unmap_sg() nents value (git-fixes).
- crypto: keembay - Fix dma_unmap_sg() nents value (git-fixes).
- hwrng: mtk - handle devm_pm_runtime_enable errors (git-fixes).
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko
(git-fixes).
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value
(git-fixes).
- crypto: ccp - Fix locking on alloc failure handling (git-fixes).
- crypto: arm/aes-neonbs - work around gcc-15 warning (git-fixes).
- crypto: qat - fix state restore for banks with exceptions
(git-fixes).
- crypto: qat - allow enabling VFs in the absence of IOMMU
(git-fixes).
- crypto: marvell/cesa - Fix engine load inaccuracy (git-fixes).
- crypto: qat - use unmanaged allocation for dc_data (git-fixes).
- crypto: sun8i-ce - fix nents passed to dma_unmap_sg()
(git-fixes).
- commit 8f3fb2a
- Move upstreamed SCSI and ACPI patches into sorted section
- commit 09d9d7c
- RDMA/uverbs: Add empty rdma_uattrs_has_raw_cap() declaration (git-fixes)
- commit ced3c6d
- Update config files.
run_oldconfig, no functional change.
- commit 0b6044b
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (git-fixes)
- commit dce79bd
- RDMA/hns: Fix -Wframe-larger-than issue (git-fixes)
- commit 90a067b
- RDMA/hns: Drop GFP_NOWARN (git-fixes)
- commit 927f6d6
- RDMA/hns: Fix accessing uninitialized resources (git-fixes)
- commit c1be2f8
- RDMA/hns: Get message length of ack_req from FW (git-fixes)
- commit 2e9a431
- RDMA/hns: Fix HW configurations not cleared in error flow (git-fixes)
- commit ba6e757
- RDMA/hns: Fix double destruction of rsv_qp (git-fixes)
- commit 0d7fee3
- Fix dma_unmap_sg() nents value (git-fixes)
- commit 89d1cb0
- RDMA/counter: Check CAP_NET_RAW check in user namespace for RDMA counters (git-fixes)
- commit c5238e7
- RDMA/nldev: Check CAP_NET_RAW in user namespace for QP modify (git-fixes)
- commit 0d7ab5b
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (git-fixes)
- commit c162c8c
- RDMA/uverbs: Check CAP_NET_RAW in user namespace for RAW QP create (git-fixes)
- commit 3292115
- RDMA/uverbs: Check CAP_NET_RAW in user namespace for QP create (git-fixes)
- commit 90f88d3
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (git-fixes)
- commit a812e80
- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (git-fixes)
- commit 9dcd5e1
- RDMA/uverbs: Check CAP_NET_RAW in user namespace for flow create (git-fixes)
- commit eaff4b0
- vsock: Fix transport_{g2h,h2g} TOCTOU (CVE-2025-38462
bsc#1247104).
- commit f5da768
- tcp: Correct signedness in skb remaining space calculation
(CVE-2025-38463 bsc#1247113).
- net/sched: Always pass notifications when child class becomes
empty (CVE-2025-38350 bsc#1246781).
- maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate()
(CVE-2025-38364 bsc#1247091).
- commit 7390872
- x86: UV RTC: Add parameter to disable RTC clocksource
(bsc#1241345).
- commit 79ccdce
- clocksource: Set cs_watchdog_read() checks based on
.uncertainty_margin (bsc#1241345 bsc#1244457).
- commit 09911af
- clocksource: Scale the watchdog read retries automatically
(bsc#1241345 bsc#1244457).
- Refresh
patches.suse/clocksource-Fix-brown-bag-boolean-thinko-in-cs_watch.patch.
- Refresh
patches.suse/clocksource-Make-watchdog-and-suspend-timing-multipl.patch.
- commit fdf040b
- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (git-fixes).
- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (git-fixes).
- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (git-fixes).
- drm/xe/uapi: Correct sync type definition in comments
(git-fixes).
- drm/amdgpu: Remove nbiov7.9 replay count reporting (git-fixes).
- drm/panthor: Add missing explicit padding in
drm_panthor_gpu_info (git-fixes).
- drm/connector: hdmi: Evaluate limited range after computing
format (git-fixes).
- wifi: nl80211: Set num_sub_specs before looping through
sub_specs (git-fixes).
- wifi: mac80211: Write cnt before copying in
ieee80211_copy_rnr_beacon() (git-fixes).
- wifi: ath12k: Pass ab pointer directly to
ath12k_dp_tx_get_encap_type() (git-fixes).
- commit 52bb8aa
- wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start()
(git-fixes).
- wifi: iwlwifi: return ERR_PTR from opmode start()
(stable-fixes).
- commit bb4c593
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and
value (git-fixes).
- fbcon: Fix outdated registered_fb reference in comment
(git-fixes).
- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (git-fixes).
- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel
(git-fixes).
- drm/panfrost: Fix panfrost device variable name in devfreq
(git-fixes).
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed
(git-fixes).
- can: peak_usb: fix USB FD devices potential malfunction
(git-fixes).
- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (git-fixes).
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event
(git-fixes).
- can: kvaser_usb: Assign netdev.dev_port based on device channel
index (git-fixes).
- can: kvaser_pciefd: Store device channel index (git-fixes).
- Bluetooth: hci_event: Mask data status from LE ext adv reports
(git-fixes).
- wifi: ath12k: fix endianness handling while accessing wmi
service bit (git-fixes).
- wifi: ath11k: fix sleeping-in-atomic in
ath11k_mac_op_set_bitrate_mask() (git-fixes).
- wifi: ath12k: fix dest ring-buffer corruption when ring is full
(git-fixes).
- wifi: ath12k: fix source ring-buffer corruption (git-fixes).
- wifi: ath12k: fix dest ring-buffer corruption (git-fixes).
- wifi: ath11k: fix dest ring-buffer corruption when ring is full
(git-fixes).
- wifi: ath11k: fix source ring-buffer corruption (git-fixes).
- wifi: ath11k: fix dest ring-buffer corruption (git-fixes).
- wifi: ath11k: fix suspend use-after-free after probe failure
(git-fixes).
- wifi: ath11k: clear initialized flag for deinit-ed srng lists
(git-fixes).
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to
missing P2P IE (git-fixes).
- Reapply "wifi: mac80211: Update skb's control block key in
ieee80211_tx_dequeue()" (git-fixes).
- wifi: mac80211: Check 802.11 encaps offloading in
ieee80211_tx_h_select_key() (git-fixes).
- wifi: mac80211: Don't call fq_flow_idx() for management frames
(git-fixes).
- wifi: mac80211: Do not schedule stopped TXQs (git-fixes).
- wifi: plfxlc: Fix error handling in usb driver probe
(git-fixes).
- wifi: mac80211: reject TDLS operations when station is not
associated (git-fixes).
- wifi: brcmsmac: Remove const from tbl_ptr parameter in
wlc_lcnphy_common_read_table() (git-fixes).
- mwl8k: Add missing check after DMA map (git-fixes).
- iwlwifi: Add missing check for alloc_ordered_workqueue
(git-fixes).
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (git-fixes).
- wifi: rtl818x: Kill URBs before clearing tx status queue
(git-fixes).
- wifi: rtw89: avoid NULL dereference when RX problematic packet
on unsupported 6 GHz band (git-fixes).
- commit 338f129
- RDMA/mlx5: Fix UMR modifying of mkey page size (git-fixes)
- commit d8f496b
- io_uring/sqpoll: don't put task_struct on tctx setup failure
(bsc#1245664 CVE-2025-38106).
- commit 99ec003
- io_uring: consistently use rcu semantics with sqpoll thread
(bsc#1245664 CVE-2025-38106).
- commit 528e7aa
- usb: gadget: configfs: Fix OOB read on empty string write
(CVE-2025-38497 bsc#1247347).
- commit 96c22e3
- fs: export anon_inode_make_secure_inode() and fix secretmem
LSM bypass (CVE-2025-38396 bsc#1247156).
- commit 281f5f1
- kabi/severities: ignore two unused/dropped symbols from MEI
- commit 7263fd9
- mei: vsc: Fix "BUG: Invalid wait context" lockdep error
(git-fixes).
- mei: vsc: Run event callback from a workqueue (git-fixes).
- mei: vsc: Unset the event callback on remove and probe errors
(git-fixes).
- mei: vsc: Event notifier fixes (git-fixes).
- mei: vsc: Destroy mutex after freeing the IRQ (git-fixes).
- mei: vsc: Don't re-init VSC from mei_vsc_hw_reset() on stop
(git-fixes).
- mei: vsc: Drop unused vsc_tp_request_irq() and vsc_tp_free_irq()
(stable-fixes).
- pwm: rockchip: Round period/duty down on apply, up on get
(git-fixes).
- ASoC: mediatek: use reserved memory or enable buffer
pre-allocation (git-fixes).
- commit 88c8c1c
- wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850
(CVE-2025-38414 bsc#1247145).
- commit be37365
- Docs/ABI: Fix sysfs-kernel-address_bits path (git-fixes).
- soc: qcom: pmic_glink: fix OF node leak (git-fixes).
- soc: qcom: fix endianness for QMI header (git-fixes).
- soc: qcom: QMI encoding/decoding for big endian (git-fixes).
- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS
(git-fixes).
- usb: musb: omap2430: fix device leak at unbind (git-fixes).
- usb: gadget: udc: renesas_usb3: fix device leak at unbind
(git-fixes).
- usb: dwc3: meson-g12a: fix device leaks at unbind (git-fixes).
- usb: atm: cxacru: Merge cxacru_upload_firmware() into
cxacru_heavy_init() (git-fixes).
- thunderbolt: Fix copy+paste error in match_service_id()
(git-fixes).
- usb: typec: ucsi: Update power_supply on power role change
(git-fixes).
- usb: gadget : fix use-after-free in composite_dev_cleanup()
(git-fixes).
- cdc-acm: fix race between initial clearing halt and open
(git-fixes).
- usb: early: xhci-dbc: Fix early_ioremap leak (git-fixes).
- usb: misc: apple-mfi-fastcharge: Make power supply names unique
(git-fixes).
- Documentation: usb: gadget: Wrap remaining usage snippets in
literal code block (git-fixes).
- usb: host: xhci-plat: fix incorrect type for of_match variable
in xhci_plat_probe() (git-fixes).
- vt: defkeymap: Map keycodes above 127 to K_HOLE (git-fixes).
- vt: keyboard: Don't process Unicode characters in K_OFF mode
(git-fixes).
- staging: axis-fifo: remove sysfs interface (git-fixes).
- staging: nvec: Fix incorrect null termination of battery
manufacturer (git-fixes).
- staging: fbtft: fix potential memory leak in
fbtft_framebuffer_alloc() (git-fixes).
- iio: adc: ad_sigma_delta: change to buffer predisable
(git-fixes).
- iio: imu: bno055: fix OOB access of hw_xlate array (git-fixes).
- bus: mhi: host: Detect events pointing to unexpected TREs
(git-fixes).
- misc: rtsx: usb: Ensure mmc child device is active when card
is present (git-fixes).
- vmci: Prevent the dispatching of uninitialized payloads
(git-fixes).
- samples: mei: Fix building on musl libc (git-fixes).
- platform/chrome: cros_ec: Unregister notifier in
cros_ec_unregister() (git-fixes).
- gpio: virtio: Fix config space reading (git-fixes).
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value
(git-fixes).
- ASoC: soc-dai: tidyup return value of
snd_soc_xlate_tdm_slot_mask() (git-fixes).
- Documentation: ACPI: Fix parent device references (git-fixes).
- ACPI: LPSS: Remove AudioDSP related ID (git-fixes).
- ACPI: processor: perflib: Fix initial _PPC limit application
(git-fixes).
- powercap: dtpm_cpu: Fix NULL pointer dereference in
get_pd_power_uw() (git-fixes).
- PM / devfreq: Check governor before using governor->name
(git-fixes).
- commit fbd21ae
- apple-mfi-fastcharge: protect first device name (git-fixes).
- commit 903dc58
- vsock/vmci: Clear the vmci transport packet properly when
initializing it (CVE-2025-38403 bsc#1247141).
- commit 6379963
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation
is in-flight (CVE-2025-38455 bsc#1247101).
- commit ca76701
- vsock: Fix transport_* TOCTOU (CVE-2025-38461 bsc#1247103).
- commit 916fdd6
- iommu/tegra241-cmdqv: Read SMMU IDR1.CMDQS instead of
hardcoding (git-fixes).
- commit 8985193
- eventpoll: don't decrement ep refcount while still holding
the ep mutex (bsc#1246777 CVE-2025-38349).
- commit 6c5e857
- jbd2: fix data-race and null-ptr-deref in
jbd2_journal_dirty_metadata() (bsc#1246253 CVE-2025-38337).
- commit 4cfb834
- ext4: inline: fix len overflow in ext4_prepare_inline_data
(bsc#1245976 CVE-2025-38222).
- commit bdddb2f
- ublk: santizize the arguments from userspace when adding a
device (bsc#1245937 CVE-2025-38182).
- commit c70260e
- __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under
mount_lock (bsc#1245151 CVE-2025-38058).
- commit 5d79b46
- xfs: remove unused trace event xfs_reflink_cow_enospc
(git-fixes).
- commit 43f2e3c
- xfs: only create event xfs_file_compat_ioctl when CONFIG_COMPAT
is configure (git-fixes).
- commit 90cf0ff
- xfs: remove usused xfs_end_io_direct events (git-fixes).
- commit 973d0e0
- xfs: remove unused event xfs_pagecache_inval (git-fixes).
- commit 92f5436
- xfs: remove unused event xfs_alloc_near_nominleft (git-fixes).
- commit cce777b
- xfs: remove unused event xfs_alloc_near_error (git-fixes).
- commit 5b572bf
- xfs: remove unused event xfs_attr_node_removename (git-fixes).
- commit 4753b23
- xfs: remove unused xfs_attr events (git-fixes).
- commit 1b0cc0c
- xfs: remove unused trace event xfs_attr_rmtval_set (git-fixes).
- commit d855e56
- xfs: remove unused xfs_reflink_compare_extents events
(git-fixes).
- commit a7afc4b
- xfs: remove unused event xfs_ioctl_clone (git-fixes).
- commit b5dfc1b
- xfs: remove unused event xlog_iclog_want_sync (git-fixes).
- commit 217c9f9
- xfs: remove unused trace event xfs_attr_remove_iter_return
(git-fixes).
- commit 70b1bc5
- NFSD: detect mismatch of file handle and delegation stateid
in OPEN op (git-fixes).
- commit 00b51c6
- nfsd: handle get_client_locked() failure in
nfsd4_setclientid_confirm() (git-fixes).
- commit b0cf612
- hfsplus: remove mutex_lock check in hfsplus_free_extents
(git-fixes).
- commit e14f374
- s390/entry: Fix last breaking event handling in case of stack
corruption (git-fixes bsc#1243806).
- commit d31e65a
- hfs: make splice write available again (git-fixes).
- commit 96498bf
- hfsplus: make splice write available again (git-fixes).
- commit 5121068
- Refresh
patches.suse/btrfs-always-fallback-to-buffered-write-if-the-inode.patch.
To remove an incorrectly generated file which is not utilized at all.
- commit 8e57a15
- io_uring: fix use-after-free of sq->thread in
__io_uring_show_fdinfo() (bsc#1245664 CVE-2025-38106).
- io_uring/sqpoll: fix sqpoll error handling races (bsc#1245664
CVE-2025-38106).
- commit d9c3e11
- sprintf.h: mask additional include (git-fixes).
- sprintf.h requires stdarg.h (git-fixes).
- commit 3d7f6c0
- btrfs: fix non-empty delayed iputs list on unmount due to
async workers (git-fixes).
- commit 285c1f5
- btrfs: fix assertion when building free space tree (git-fixes).
- commit a3fd65f
- btrfs: fix iteration of extrefs during log replay (bsc#1247031
CVE-2025-38382).
- commit 5e64fe6
- btrfs: fix missing error handling when searching for inode
refs during log replay (git-fixes).
- commit a8205e6
- kabi: Hide adding of u64 to devlink_param_type (jsc#PED-12745).
- commit aad1545
- i2c: qup: jump out of the loop in case of timeout (git-fixes).
- i2c: virtio: Avoid hang by using interruptible completion wait
(git-fixes).
- i2c: tegra: Fix reset error handling with ACPI (git-fixes).
- commit 5a2e6c7
- drm/xe: Fix build without debugfs (git-fixes).
- drm/i915/display: Fix dma_fence_wait_timeout() return value
handling (git-fixes).
- commit c72dd8f
- btrfs: fix a race between renames and directory logging
(bsc#1247023 CVE-2025-38365).
- commit 322c28e
- netlink: specs: devlink: replace underscores with dashes in
names (jsc#PED-12745).
- netlink: fix policy dump for int with validation callback
(jsc#PED-12745).
- commit 379185c
- dpll: Add basic Microchip ZL3073x support (jsc#PED-12745).
- Update config files.
- supported.conf: Mark ZL3073X modules supported
- commit d22a1c3
- supported.conf: move nvme-apple to optional again
- commit a3e3a0c
- dpll: zl3073x: Add support to get/set frequency on pins
(jsc#PED-12745).
- dpll: zl3073x: Implement input pin state setting in automatic
mode (jsc#PED-12745).
- dpll: zl3073x: Add support to get/set priority on input pins
(jsc#PED-12745).
- dpll: zl3073x: Implement input pin selection in manual mode
(jsc#PED-12745).
- dpll: zl3073x: Register DPLL devices and pins (jsc#PED-12745).
- dpll: zl3073x: Read DPLL types and pin properties from system
firmware (jsc#PED-12745).
- dpll: zl3073x: Fetch invariants during probe (jsc#PED-12745).
- devlink: Add support for u64 parameters (jsc#PED-12745).
- dt-bindings: dpll: Add support for Microchip Azurite chip family
(jsc#PED-12745).
- dt-bindings: dpll: Add DPLL device and pin (jsc#PED-12745).
- devlink: avoid param type value translations (jsc#PED-12745).
- devlink: define enum for attr types of dynamic attributes
(jsc#PED-12745).
- devlink: introduce devlink_nl_put_u64() (jsc#PED-12745).
- commit d75c228
- llist: add interface to check if a node is on a list
(CVE-2025-38264 bsc#1246387).
- commit f06e99c
- nvme-tcp: sanitize request list handling (CVE-2025-38264
bsc#1246387).
- commit 33933f9
- supported.conf: sort entries again
- commit c720956
- supported.conf: sort entries again
- commit 2db834f
- supported.conf: add missing entries for armv7hl
- commit 3fcf489
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop
(git-fixes).
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset
(git-fixes).
- drm/xe/mocs: Initialize MOCS index early (stable-fixes).
- drm/amdgpu: Increase reset counter only on success
(stable-fixes).
- drm/amd/display: Disable CRTC degamma LUT for DCN401
(stable-fixes).
- drm/amd/display: Free memory allocation (stable-fixes).
- drm/xe/pf: Move VFs reprovisioning to worker (stable-fixes).
- drm/xe/pf: Sanitize VF scratch registers on FLR (stable-fixes).
- commit 13260a4
- nilfs2: reject invalid file types when reading inodes
(git-fixes).
- commit b094111
- resource: fix false warning in __request_region() (git-fixes).
- bus: fsl-mc: Fix potential double device reference in
fsl_mc_get_endpoint() (git-fixes).
- USB: serial: option: add Telit Cinterion FE910C04 (ECM)
composition (stable-fixes).
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI
(stable-fixes).
- USB: serial: option: add Foxconn T99W640 (stable-fixes).
- iio: adc: max1363: Reorder mode_list[] entries (stable-fixes).
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[]
(stable-fixes).
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS
(stable-fixes).
- HID: core: do not bypass hid_hw_raw_request (stable-fixes).
- HID: core: ensure the allocated report buffer can contain the
reserved report ID (stable-fixes).
- regulator: pwm-regulator: Calculate the output voltage for
disabled PWMs (stable-fixes).
- commit 829a426
- rpm/kernel-subpackage-spec: Skip brp-strip-debug to avoid file truncation (bsc#1246879)
Put the same workaround to avoid file truncation of vmlinux and co in
kernel-default-base package, too.
- commit 2329734
- iommu/vt-d: Fix possible circular locking dependency
(git-fixes).
- commit 0774c7d
- Revert "drm/nouveau: check ioctl command codes better"
(git-fixes).
- drm/amdgpu: Reset the clear flag in buddy during resume
(git-fixes).
- platform/x86: Fix initialization order for
firmware_attributes_class (git-fixes).
- commit 46d2d36
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in
ti_sn_bridge_probe() (git-fixes).
- drm/sched: Remove optimization that causes hang when killing
dependent jobs (git-fixes).
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered
among boots (git-fixes).
- commit 0083a37
- iommu/vt-d: Fix system hang on reboot -f (git-fixes).
- commit 034e69f
- rpm/kernel-binary.spec.in: Ignore return code from ksymtypes compare
When using suse-kabi-tools, the RPM build invokes 'ksymvers compare' to
compare the resulting symbol CRCs with the reference data. If the values
differ, it then invokes 'ksymtypes compare' to provide a detailed report
explaining why the symbols differ. The build expects the latter
'ksymtypes compare' command to always return zero, even if the two
compared kABI corpuses are different.
This is currently the case for 'ksymtypes compare'. However, I plan to
update the command to return a non-zero code when the comparison detects
any differences. This should ensure consistent behavior with 'ksymvers
compare'.
Since the build uses 'ksymtypes compare' only for more detailed
diagnostics, ignore its return code.
- commit 5ac1381
- net: atm: fix /proc/net/atm/lec handling (CVE-2025-38180
bsc#1245970).
- net: atm: add lec_mutex (CVE-2025-38323 bsc#1246473).
- commit 1698a7c
- KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (bsc#1239061 CVE-2025-21839).
- commit fe1f630
- net: dsa: b53: do not enable EEE on bcm63xx (CVE-2025-38272
bsc#1246268).
- commit ee16b59
- Refresh
patches.suse/selftests-bpf-Clean-up-open-coded-gettid-syscall-inv.patch.
Fix following BPF selftests compilation error due to missing dependency.
/home/runner/work/libbpf/libbpf/.kernel/tools/testing/selftests/bpf/prog_tests/ns_current_pid_tgid.c: In function ‘test_current_pid_tgid’:
/home/runner/work/libbpf/libbpf/.kernel/tools/testing/selftests/bpf/prog_tests/ns_current_pid_tgid.c:31:9: error: invalid type argument of unary ‘*’ (have ‘pid_t’ {aka ‘int’})
31 | *pid = sys_gettid();
| ^~~~
- commit d85d5ff
- Delete
patches.suse/selftests-bpf-Add-tests-for-sdiv-smod-overflow-cases.patch.
The __arch_x86_64 macro is not yet supported in BPF selftests (depends
on c64d2f72bf2e "selftests/bpf: *_arch** macro to limit test cases to
specific archs"), so drop tests that uses it.
- commit 55e800e
- scsi: fnic: Set appropriate logging level for log message
(bsc#1246644).
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths
(bsc#1246644).
- commit b87ecf0
- Bluetooth: hci_sync: Fix UAF on create_le_conn_complete
(git-fixes).
- commit 7a089da
- hci_dev centralize extra lock (CVE-2025-38117 bsc#1245695).
- commit 892de21
- Bluetooth: MGMT: Protect mgmt_pending list with its own lock
(CVE-2025-38117 bsc#1245695).
- commit e0d8b29
- Bluetooth: hci_sync: Introduce
hci_cmd_sync_run/hci_cmd_sync_run_once (CVE-2025-38117
bsc#1245695).
- commit c86dd9a
- Bluetooth: hci_core: Make hci_is_le_conn_scanning public
(CVE-2025-38117 bsc#1245695).
- Refresh
patches.suse/Bluetooth-hci_sync-Use-QoS-to-determine-which-PHY-to.patch.
- commit 566b348
- Bluetooth: hci_sync: Fix handling of HCI_OP_CREATE_CONN_CANCEL
(git-fixes).
- commit 79fc3de
- gpiolib: of: Add polarity quirk for s5m8767 (stable-fixes).
- gpio: vf610: add locking to gpio direction functions
(git-fixes).
- gpio: pca953x: log an error when failing to get the reset GPIO
(git-fixes).
- gpiolib: cdev: Ignore reconfiguration without direction
(git-fixes).
- gpiolib: acpi: Fix failed in acpi_gpiochip_find() by adding
parent node match (bsc#1233300).
- gpiolib: Fix debug messaging in gpiod_find_and_request()
(git-fixes).
- gpiolib: Handle no pin_ranges in gpiochip_generic_config()
(git-fixes).
- gpio: sim: include a missing header (git-fixes).
- gpiolib: acpi: Don't use GPIO chip fwnode in
acpi_gpiochip_find() (bsc#1233300).
- commit 75afc01
- Bluetooth: MGMT: convert timeouts to secs_to_jiffies()
(CVE-2025-38117 bsc#1245695).
- commit 3e2758a
- bluetooth: mgmt: convert timeouts to secs_to_jiffies()
(CVE-2025-38117 bsc#1245695).
- commit b8976eb
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again
(git-fixes bsc#1246870).
- commit 8e4fb25
- Fix build warning
Refresh
patches.suse/mm-hugetlb-fix-DEBUG_LOCKS_WARN_ON-1-when-dissolve_f.patch.
- commit ccb6e90
- Bluetooth: MGMT: Fix not generating command complete for
MGMT_OP_DISCONNECT (git-fixes).
- Refresh
patches.suse/Bluetooth-hci_event-Fix-not-using-key-encryption-siz.patch.
- commit 6f743e7
- Bluetooth: hci_sync: Attempt to dequeue connection attempt
(git-fixes).
- Refresh
patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-Read-in-l2ca.patch.
- Refresh
patches.suse/Bluetooth-hci_event-Fix-not-using-key-encryption-siz.patch.
- Refresh
patches.suse/Bluetooth-hci_sync-Fix-UAF-in-hci_acl_create_conn_sy.patch.
- commit 22a7d25
- Bluetooth: hci_conn: Fix sending
BT_HCI_CMD_LE_CREATE_CONN_CANCEL (git-fixes).
- commit defb49e
- Bluetooth: mgmt: remove NULL check in
add_ext_adv_params_complete() (CVE-2025-38117 bsc#1245695).
- Bluetooth: mgmt: remove NULL check in
mgmt_set_connectable_complete() (CVE-2025-38117 bsc#1245695).
- commit 3217653
- bluetooth: restore le_scan_restart in struct hci_dev
(CVE-2025-38117 bsc#1245695).
- commit 7e7eb69
- Bluetooth: hci_core: Remove le_restart_scan work (CVE-2025-38117
bsc#1245695).
- commit 9530108
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT
(CVE-2025-38335 bsc#1246250).
- commit 4b421f0
- Correctly put RDMA kabi patch into patches.kabi instead of patches.suse
- commit 0433d1f
- kABI workaround for bluetooth hci_dev changes (CVE-2025-38250
bsc#1246182).
- commit 2bfeee5
- Bluetooth: hci_core: Fix use-after-free in vhci_flush()
(CVE-2025-38250 bsc#1246182).
- commit 45dea35
- selftests/bpf: Support more socket types in create_pair()
(bsc#1239470 CVE-2025-21854).
- selftests/bpf: Refactor out helper functions for a few tests
(bsc#1239470 CVE-2025-21854).
- commit 21d7fea
- mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when
dissolve_free_hugetlb_folio() (bsc#1225707 CVE-2024-36028).
- commit ce47e5b
- Delete
patches.suse/selftest-bpf-Add-test-for-af_vsock-poll.patch.
It requires the "bpf_program__attach_sockmap" API in libbpf, which isn't
backported.
- Refresh patches.suse/selftest-bpf-Add-vsock-test-for-sockmap-rejecting-un.patch
- commit a7dddad
- i2c: stm32: fix the device used for the DMA map (git-fixes).
- usb: hub: Don't try to recover devices lost during warm reset
(git-fixes).
- usb: musb: fix gadget state on disconnect (git-fixes).
- thunderbolt: Fix bit masking in tb_dp_port_set_hops()
(git-fixes).
- thunderbolt: Fix wake on connect at runtime (git-fixes).
- pch_uart: Fix dma_sync_sg_for_device() nents value (git-fixes).
- comedi: Fix initialization of data for instructions that write
to subdevice (git-fixes).
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits()
(git-fixes).
- comedi: das6402: Fix bit shift out of bounds (git-fixes).
- comedi: aio_iiro_16: Fix bit shift out of bounds (git-fixes).
- comedi: pcl812: Fix bit shift out of bounds (git-fixes).
- comedi: das16m1: Fix bit shift out of bounds (git-fixes).
- comedi: Fix some signed shift left operations (git-fixes).
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
(git-fixes).
- iio: adc: ad7949: use spi_is_bpw_supported() (git-fixes).
- iio: accel: fxls8962af: Fix use after free in
fxls8962af_fifo_flush (git-fixes).
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler
(git-fixes).
- regmap: fix potential memory leak of regmap_bus (git-fixes).
- Input: xpad - set correct controller type for Acer NGR200
(git-fixes).
- commit 08dfa63
- jfs: Fix null-ptr-deref in jfs_ioc_trim (bsc#1246044
CVE-2025-38203).
- commit e88ea13
- drm/mediatek: only announce AFBC if really supported
(git-fixes).
- drm/mediatek: Add wait_event_timeout when disabling plane
(git-fixes).
- drm/nouveau: check ioctl command codes better (git-fixes).
- commit 8f80850
- hwmon: (corsair-cpro) Validate the size of the received input
buffer (git-fixes).
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume
(git-fixes).
- soundwire: amd: fix for clearing command status register
(git-fixes).
- dmaengine: nbpfaxi: Fix memory corruption in probe()
(git-fixes).
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI
PHY mode (git-fixes).
- memstick: core: Zero initialize id_reg in
h_memstick_read_dev_id() (git-fixes).
- mmc: bcm2835: Fix dma_unmap_sg() nents value (git-fixes).
- mmc: sdhci_am654: Workaround for Errata i2312 (git-fixes).
- mmc: sdhci-pci: Quirk for broken command queuing on Intel
GLK-based Positivo models (git-fixes).
- commit 0d9aae2
- net/sched: Return NULL when htb_lookup_leaf encounters an
empty rbtree (git-fixes).
- commit fb42307
- ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
(git-fixes).
- commit 505c14c
- rpl: Fix use-after-free in rpl_do_srh_inline() (git-fixes).
- commit 3342938
- af_packet: fix the SO_SNDTIMEO constraint not effective on
tpacked_snd() (git-fixes).
- commit 877c186
- net/sched: sch_qfq: Fix race condition on qfq_aggregate
(git-fixes).
- commit 2e8a829
- Delete
patches.kabi/struct-ucsi_operations-use-padding-for-new-operation.patch.
- Delete
patches.kabi/ucsi_operations-add-stubs-for-all-operations.patch.
- Delete
patches.kabi/ucsi_ops-adapt-update_connector-to-kABI-consistency.patch.
- commit 0ef32b8
- wifi: cfg80211: remove scan request n_channels counted_by
(git-fixes).
- Refresh patches.suse/wireless-suse-kabi-padding.patch.
- commit b29e6bc
- Bluetooth: hci_core: add missing braces when using macro
parameters (git-fixes).
- Bluetooth: btintel: Check if controller is ISO capable on
btintel_classify_pkt_type (git-fixes).
- wifi: rt2x00: fix remove callback type mismatch (git-fixes).
- wifi: cfg80211: fix S1G beacon head validation in nl80211
(git-fixes).
- wifi: cfg80211/mac80211: correctly parse S1G beacon optional
elements (git-fixes).
- drm/amdgpu/ip_discovery: add missing ip_discovery fw
(stable-fixes).
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy
asics (stable-fixes).
- commit 201bdcf
- kABI workaround for struct drm_framebuffer changes (git-fixes).
- commit 7b3cefa
- drm/framebuffer: Acquire internal references on GEM handles
(git-fixes).
- commit 736ff8d
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU
(git-fixes).
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855
GF variant without board ID (git-fixes).
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout
(git-fixes).
- Bluetooth: SMP: If an unallowed command is received consider
it a failure (git-fixes).
- Bluetooth: hci_sync: fix connectable extended advertising when
using static random address (git-fixes).
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()
(git-fixes).
- usb: net: sierra: check for no status endpoint (git-fixes).
- net: phy: Don't register LEDs for genphy (git-fixes).
- drm/gem: Fix race in drm_gem_handle_create_tail()
(stable-fixes).
- wifi: prevent A-MSDU attacks in mesh networks (stable-fixes).
- Revert "ACPI: battery: negate current when discharging"
(stable-fixes).
- usb: cdnsp: Fix issue with CV Bad Descriptor test (git-fixes).
- drm/gem: Acquire references on GEM handles for framebuffers
(stable-fixes).
- vt: add missing notification when switching back to text mode
(stable-fixes).
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic
(stable-fixes).
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop
15-eg100 (stable-fixes).
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard
Gen2 (stable-fixes).
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (stable-fixes).
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
(stable-fixes).
- net: usb: qmi_wwan: add SIMCom 8230C composition (stable-fixes).
- usb: cdnsp: Replace snprintf() with the safer scnprintf()
variant (stable-fixes).
- usb:cdnsp: remove TRB_FLUSH_ENDPOINT command (stable-fixes).
- commit b8ce602
- Refresh
patches.suse/selftests-bpf-Add-tests-for-iter-next-method-returni.patch.
Fix BPF selftests build failure in progs/iters_testmod.c due to missing
definition of 'struct bpf_iter_task_vma' and 'bpf_iter_task_vma()'.
- commit ca03a47
- selftests/bpf: Add ASSERT_OK_FD macro (bsc#1239470
CVE-2025-21854).
- commit 746f5fc
- ptp: fix breakage after ptp_vclock_in_use() rework
(bsc#1246506).
- commit bbe324a
- x86/virt/tdx: Avoid indirect calls to TDX assembly functions (git-fixes).
- commit 9c296c1
- soc: aspeed: lpc-snoop: Don't disable channels that aren't
enabled (git-fixes).
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order
(git-fixes).
- HID: core: ensure __hid_request reserves the report ID as the
first byte (git-fixes).
- commit 5cd5cd3
- drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE (CVE-2025-38188
bsc#1246098).
- drm/msm/a6xx+: Insert a fence wait before SMMU table update
(CVE-2025-38188 bsc#1246098).
- commit e22ddaf
- x86/iopl: Cure TIF_IO_BITMAP inconsistencies (CVE-2025-38100
bsc#1245650).
- commit 143bbc6
- Bluetooth: eir: Fix possible crashes on eir_create_adv_data
(CVE-2025-38303 bsc#1246354).
- commit 89447f6
- kABI workaround for bpf: Do not include stack ptr register in
precision backtracking bookkeeping (bsc#1246264 CVE-2025-38279).
- commit 8287c19
- btrfs: explicitly ref count block_group on new_bgs list (bsc#1243068)
- commit 8647d2c
- btrfs: make btrfs_discard_workfn() block_group ref explicit (bsc#1243068)
- commit 32e19f5
- btrfs: harden block_group::bg_list against list_del() races (CVE-2025-37856 bsc#1243068)
- commit 3333359
- btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (CVE-2025-38034 bsc#1244792)
- commit 55c0ec4
- btrfs: do not BUG_ON() when freeing tree block after error (CVE-2024-44963 1230216)
- commit d292416
- scsi: megaraid_sas: Fix invalid node index (CVE-2025-38239
bsc#1246178).
- seg6: Fix validation of nexthop addresses (CVE-2025-38310
bsc#1246361).
- x86/sgx: Prevent attempts to reclaim poisoned pages
(CVE-2025-38334 bsc#1246384).
- commit 740f6c2
- selftests/bpf: Add tests with stack ptr register in conditional
jmp (bsc#1246264 CVE-2025-38279).
- bpf: Do not include stack ptr register in precision backtracking
bookkeeping (bsc#1246264 CVE-2025-38279).
- Refresh patches.kabi/bpf-verifier-kABI-workarounds.patch
- commit ccc2c5b
- bridge: mcast: Fix use-after-free during router port
configuration (CVE-2025-38248 bsc#1246173).
- net: stmmac: make sure that ptp_rate is not 0 before configuring
timestamping (CVE-2025-38126 bsc#1245708).
- bpf: fix ktls panic with sockmap (CVE-2025-38166 bsc#1245758).
- commit 01133bb
- iommu/amd: Set the pgsize_bitmap correctly (git-fixes).
- commit 8746ec5
- scsi: core: Enforce unlimited max_segment_size when
virt_boundary_mask is set (git-fixes).
- scsi: qla4xxx: Fix missing DMA mapping error in
qla4xxx_alloc_pdu() (git-fixes).
- scsi: qla2xxx: Fix DMA mapping test in
qla24xx_get_port_database() (git-fixes).
- scsi: megaraid_sas: Fix invalid node index (git-fixes).
- aoe: clean device rq_list in aoedev_downdev() (git-fixes).
- md/md-bitmap: fix dm-raid max_write_behind setting (git-fixes).
- commit 2e07501
- dm-bufio: fix sched in atomic context (git-fixes).
- commit c664ddf
- Update
patches.suse/nvme-pci-fix-queue-unquiesce-check-on-slot_reset.patch
(git-fixes bsc#1240885).
- commit 08c0025
- scsi: fnic: Fix missing DMA mapping error in fnic_send_frame()
(git-fixes).
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (git-fixes).
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times
out (git-fixes).
- commit 60bac5b
- perf: Fix sample vs do_exit() (bsc#1246547).
- commit 5327721
- thermal: trip: Use READ_ONCE() for lockless access to trip
properties (git-fixes).
- commit bd7ba80
- thermal: trip: Use common set of trip type names (git-fixes).
- commit a92e9b8
- x86/CPU/AMD: Add more models to X86_FEATURE_ZEN5 (bsc#1246449).
- Refresh
patches.suse/x86-CPU-AMD-Add-models-0x10-0x1f-to-the-Zen5-range.patch.
- commit b606b50
- nvme-pci: refresh visible attrs after being checked (git-fixes).
- nvme: Fix incorrect cdw15 value in passthru error logging
(git-fixes).
- commit c5d3460
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (bsc#1245260
bsc#1243100 bsc#1246125).
- commit 58f7c6e
- scsi: lpfc: Update lpfc version to 14.4.0.10 (bsc#1245260
bsc#1243100 bsc#1246125).
- scsi: lpfc: Modify end-of-life adapters' model descriptions
(bsc#1245260 bsc#1243100 bsc#1246125 bsc#1204142).
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions
(bsc#1245260 bsc#1243100 bsc#1246125).
- scsi: lpfc: Move clearing of HBA_SETUP flag to before
lpfc_sli4_queue_unset (bsc#1245260 bsc#1243100 bsc#1246125).
- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in
dev_loss_tmo_callbk (bsc#1245260 bsc#1243100 bsc#1246125).
- scsi: lpfc: Relocate clearing initial phba flags from link up
to link down hdlr (bsc#1245260 bsc#1243100 bsc#1246125).
- scsi: lpfc: Simplify error handling for failed
lpfc_get_sli4_parameters cmd (bsc#1245260 bsc#1243100
bsc#1246125).
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected
statuses (bsc#1245260 bsc#1243100 bsc#1246125).
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set
(bsc#1245260 bsc#1243100 bsc#1246125).
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport
structure (bsc#1245260 bsc#1243100 bsc#1246125).
- scsi: lpfc: Update debugfs trace ring initialization messages
(bsc#1245260 bsc#1243100 bsc#1246125).
- scsi: lpfc: Revise logging format for failed CT MIB requests
(bsc#1245260 bsc#1243100 bsc#1246125).
- commit 14dcfed
- crypto: hkdf - skip TVs with unapproved salt lengths in FIPS
mode (bsc#1241200 bsc#1246134).
- commit 1b17c76
- Update
patches.suse/net-clear-the-dst-when-changing-skb-protocol.patch
(bsc#1245954 CVE-2025-38192).
Fix incorrect CVE reference.
- commit 288e8f6
- drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() (bsc#1245951 CVE-2025-38187)
- commit 62c6956
- bpf: Check rcu_read_lock_trace_held() in
bpf_map_lookup_percpu_elem() (bsc#1245980 CVE-2025-38202).
- commit 630834e
- selftest/bpf/benchs: Add benchmark for sockmap usage
(bsc#1245749 CVE-2025-38154).
- commit ac96089
- bpf, sockmap: Avoid using sk_socket after free when sending
(bsc#1245749 CVE-2025-38154).
- bpf, sockmap: Fix panic when calling skb_linearize (bsc#1245749
CVE-2025-38154).
- bpf, sockmap: fix duplicated data transmission (bsc#1245749
CVE-2025-38154).
- bpf, sockmap: Fix data lost during EAGAIN retries (bsc#1245749
CVE-2025-38154).
- commit bc1361f
- bpf: Fix memory leak in bpf_core_apply (git-fixes).
- commit 44b4ba3
- bpf/selftests: Check errno when percpu map value size exceeds
(git-fixes).
- bpf: Check percpu map value size first (git-fixes).
- commit 81feacb
- bpftool: Fix undefined behavior caused by shifting into the
sign bit (git-fixes).
- commit 9363920
- ipc: fix to protect IPCS lookups using RCU (CVE-2025-38212
bsc#1246029).
- commit 9ff5b2e
- calipso: unlock rcu before returning -EAFNOSUPPORT
(CVE-2025-38147 bsc#1245768).
- calipso: Don't call calipso functions for AF_INET sk
(CVE-2025-38147 bsc#1245768).
- commit 74ee184
- ucsi_operations: add stubs for all operations (git-fixes).
- commit 1e9baf6
- drm/amd/display: Don't treat wb connector as physical in (bsc#1245654 CVE-2025-38098)
- commit 277f764
- x86/fred: Fix system hang during S4 resume with FRED enabled (bsc#1245084 CVE-2025-38047).
- commit 77102ae
- net/smc: Fix lookup of netdev by using ib_device_get_netdev()
(git-fixes bsc#1246217).
- commit a5383eb
- selftests/bpf: Add tests for iter next method returning valid
pointer (git-fixes).
- bpf: Make the pointer returned by iter next method valid
(git-fixes).
- commit fcdc4ee
- hisi_acc_vfio_pci: bugfix live migration function without VF
device driver (CVE-2025-38283 bsc#1246273).
- configfs-tsm-report: Fix NULL dereference of tsm_ops
(CVE-2025-38210 bsc#1246020).
- commit eef28a4
- kasan: remove kasan_find_vm_area() to prevent possible deadlock
(git-fixes).
- maple_tree: fix mt_destroy_walk() on root leaf node (git-fixes).
- commit aaacc92
- drm/imagination: Fix kernel crash when hard resetting the GPU
(git-fixes).
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold()
(git-fixes).
- drm/xe/bmg: fix compressed VRAM handling (git-fixes).
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2"
(git-fixes).
- drm/xe: Allocate PF queue size on pow2 boundary (git-fixes).
- drm/xe/pf: Clear all LMTT pages on alloc (git-fixes).
- wifi: mac80211: fix non-transmitted BSSID profile search
(git-fixes).
- commit ec1cfba
- drm/tegra: nvdec: Fix dma_alloc_coherent error check
(git-fixes).
- nbd: fix uaf in nbd_genl_connect() error path (git-fixes).
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx
message to debug level (git-fixes).
- net: phy: microchip: limit 100M workaround to link-down events
on LAN88xx (git-fixes).
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init()
(git-fixes).
- wifi: mt76: mt7925: fix invalid array index in ssid assignment
during hw scan (git-fixes).
- wifi: mt76: mt7925: fix the wrong config for tx interrupt
(git-fixes).
- wifi: zd1211rw: Fix potential NULL pointer dereference in
zd_mac_tx_to_dev() (git-fixes).
- commit 067b949
- xfs: fix off-by-one error in fsmap's end_daddr usage
(bsc#1235837).
- commit 919d943
- hisi_acc_vfio_pci: fix XQE dma address error (CVE-2025-38158
bsc#1245750).
- commit 373ef61
- i40e: fix MMIO write access to an invalid page in i40e_clear_hw
(CVE-2025-38200 bsc#1246045).
- net: cadence: macb: Fix a possible deadlock in macb_halt_tx
(CVE-2025-38094 bsc#1245649).
- commit 45301b8
- kABI workaround for fw_attributes_class_get() (stable-fixes).
- commit 8322949
- drm/xe/guc: Dead CT helper (stable-fixes).
- Refresh
patches.suse/drm-xe-Fix-early-wedge-on-GuC-load-failure.patch.
- commit 169fbda
- platform/x86: dell-wmi-sysman: Fix class device unregistration
(git-fixes).
- platform/x86: think-lmi: Fix class device unregistration
(git-fixes).
- platform/x86: hp-bioscfg: Fix class device unregistration
(git-fixes).
- usb: dwc3: Abort suspend on soft disconnect failure (git-fixes).
- drm/xe/guc: Explicitly exit CT safe mode on unwind (git-fixes).
- drm/xe: move DPT l2 flush to a more sensible place (git-fixes).
- drm/xe: Move DSB l2 flush to a more sensible place (git-fixes).
- platform/x86: dell-sysman: Directly use
firmware_attributes_class (stable-fixes).
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class
(stable-fixes).
- platform/x86: think-lmi: Directly use firmware_attributes_class
(stable-fixes).
- platform/x86: firmware_attributes_class: Simplify API
(stable-fixes).
- platform/x86: firmware_attributes_class: Move include
linux/device/class.h (stable-fixes).
- drm/xe: Allow bo mapping on multiple ggtts (stable-fixes).
- drm/xe: add interface to request physical alignment for buffer
objects (stable-fixes).
- drm/xe: Fix DSB buffer coherency (stable-fixes).
- drm/xe: Replace double space with single space after comma
(stable-fixes).
- platform/x86: make fw_attr_class constant (stable-fixes).
- commit 5fd840c
- x86/CPU/AMD: Terminate the erratum_1386_microcode array (git-fixes).
- Refresh
patches.suse/x86-cpu-Move-AMD-erratum-1386-table-over-to-x86_cpu_id.patch.
- commit 1e0fa3d
- x86/cpu: Avoid running off the end of an AMD erratum table (git-fixes).
- commit 9861130
- platform/x86: think-lmi: Create ksets consecutively
(stable-fixes).
- Refresh
patches.suse/platform-x86-think-lmi-Fix-kobject-cleanup.patch.
- commit 5072bed
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX
(git-fixes).
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by
strap (git-fixes).
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as
connected (git-fixes).
- Bluetooth: hci_sync: Fix not disabling advertising instance
(git-fixes).
- usb: xhci: quirk for data loss in ISOC transfers (stable-fixes).
- Logitech C-270 even more broken (stable-fixes).
- Input: xpad - support Acer NGR 200 Controller (stable-fixes).
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2
(stable-fixes).
- mmc: sdhci: Add a helper function for dump register in dynamic
debug mode (stable-fixes).
- ACPICA: Refuse to evaluate a method if arguments are missing
(stable-fixes).
- mtd: spinand: fix memory leak of ECC engine conf (stable-fixes).
- ASoC: amd: yc: update quirk data for HP Victus (stable-fixes).
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic
(stable-fixes).
- ALSA: sb: Force to disable DMAs once when DMA mode is changed
(stable-fixes).
- ALSA: sb: Don't allow changing the DMA mode during operations
(stable-fixes).
- drm/msm: Fix another leak in the submit error path
(stable-fixes).
- drm/msm: Fix a fence leak in submit error path (stable-fixes).
- regulator: fan53555: add enable_time support and soft-start
times (stable-fixes).
- wifi: ath6kl: remove WARN on bad firmware input (stable-fixes).
- wifi: mac80211: drop invalid source address OCB frames
(stable-fixes).
- ata: pata_cs5536: fix build on 32-bit UML (stable-fixes).
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to
8042 quirks list (stable-fixes).
- Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts
on DG1" (stable-fixes).
- wifi: mac80211: Add link iteration macro for link data
(stable-fixes).
- wifi: mac80211: chan: chandef is non-NULL for reserved
(stable-fixes).
- commit 66a4a55
- net: clear the dst when changing skb protocol (bsc#1245954
CVE-2024-49861).
- commit eed1284
- usb: typec: ucsi: Set orientation as none when connector is
unplugged (git-fixes).
- commit 9b64a84
- usb: typec: ucsi: glink: fix off-by-one in connector_status
(git-fixes).
- commit 63d64a6
- coresight: prevent deactivate active config while enabling
the config (CVE-2025-38131 bsc#1245677).
- coresight: holding cscfg_csdev_lock while removing cscfg from
csdev (CVE-2025-38132 bsc#1245679).
- commit f8db328
- x86/process: Move the buffer clearing before MONITOR (bsc#1238896 CVE-2024-36350 CVE-2024-36357 CVE-2024-36348 CVE-2024-36349).
- commit 4a10507
- KVM: SVM: Advertise TSA CPUID bits to guests (bsc#1238896 CVE-2024-36350 CVE-2024-36357 CVE-2024-36348 CVE-2024-36349).
- Refresh
patches.suse/x86-bugs-Add-a-Transient-Scheduler-Attacks-mitigation.patch.
- commit 09387da
- x86/cpu: Move AMD erratum 1386 table over to 'x86_cpu_id' (git-fixes).
- commit ba3af9a
- x86/CPU/AMD: Improve the erratum 1386 workaround (git-fixes).
- commit 4c8067b
- x86/cpu: Replace PEBS use of 'x86_cpu_desc' use with 'x86_cpu_id' (git-fixes).
- commit 32b283a
- x86/cpu: Expose only stepping min/max interface (git-fixes).
- Refresh
patches.suse/x86-its-Add-vmexit-option-to-skip-mitigation-on-some-CPUs.patch.
- Refresh
patches.suse/x86-its-Enumerate-Indirect-Target-Selection-ITS-bug.patch.
- commit 4c83b07
- x86/cpu: Introduce new microcode matching helper (git-fixes).
- commit e25965b
- x86/bugs: Add a Transient Scheduler Attacks mitigation (bsc#1238896 CVE-2024-36350 CVE-2024-36357 CVE-2024-36348 CVE-2024-36349).
- Update config files.
- commit ed9e719
- ACPI: PRM: Reduce unnecessary printing to avoid user confusion
(bsc#1246122).
- commit f060328
- usb: typec: ucsi: Fix busy loop on ASUS VivoBooks (git-fixes).
- usb: typec: ucsi: Fix the partner PD revision (git-fixes).
- commit cb5cfe6
- restore UCSI_CONNECTOR_RESET_HARD definition (git-fixes).
- commit 3a50af7
- series.txt: Sort cBPF security patches
- commit adce8c6
- usb: typec: ucsi: Add DATA_RESET option of Connector Reset
command (git-fixes).
- commit ebc917a
- pinctrl: amd: Clear GPIO debounce for suspend (git-fixes).
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts
(git-fixes).
- commit 7a0a421
- Re-enable qmi_wwan for arm64 (bsc#1246113)
- commit d07961b
- efi/mokvar-table: Avoid repeated map/unmap of the same page
(bsc#1240323 CVE-2025-21872).
- commit a16e799
- usb: typec: ucsi: move ucsi_acknowledge() from ucsi_read_error()
(git-fixes).
- commit 9793505
- kabi: restore encap_sk in struct xfrm_state (CVE-2025-38097
bsc#1245660).
- espintcp: remove encap socket caching to avoid reference leak
(CVE-2025-38097 bsc#1245660).
- commit 94f2735
- net: lan743x: fix potential out-of-bounds write in
lan743x_ptp_io_event_clock_get() (CVE-2025-38183 bsc#1246006).
- commit 0eb12cd
- net_sched: sch_sfq: fix a potential crash on gso_skb handling
(CVE-2025-38115 bsc#1245689).
- commit 6a4ffd3
- usb: typec: ucsi_acpi: Add LG Gram quirk (git-fixes).
- commit da7fb49
- usb: typec: ucsi: don't retrieve PDOs if not supported
(git-fixes).
- commit d303a5e
- usb: typec: ucsi: Delay alternate mode discovery (git-fixes).
- commit b7ba22d
- usb: typec: Update sysfs when setting ops (git-fixes).
- commit b336d78
- usb: typec: ucsi: glink: increase max ports for x1e80100
(git-fixes).
- commit 31de9c9
- ucsi_ops: adapt update_connector to kABI consistency
(git-fixes).
- usb: typec: ucsi: add update_connector callback (git-fixes).
- blacklist.conf: needed for infrastructure. kABI fix added
- Refresh
patches.kabi/struct-ucsi_operations-use-padding-for-new-operation.patch.
- Refresh patches.suse/paddings-add-paddings-to-TypeC-stuff.patch.
- commit a70b9ee
- ALSA: usb-audio: Kill timer properly at removal (CVE-2025-38105
bsc#1245682).
- commit 2bf6099
- x86/process: Move the buffer clearing before MONITOR (bsc#1238896 CVE-2024-36350 CVE-2024-36357 CVE-2024-36348 CVE-2024-36349).
- commit 9303368
- usb: typec: ucsi: glink: use typec_set_orientation (git-fixes).
- Refresh
patches.suse/soc-qcom-pmic_glink-Fix-race-during-initialization.patch.
- Refresh
patches.suse/usb-typec-ucsi-glink-fix-child-node-release-in-probe.patch.
- commit b105e3e
- KVM: SVM: Advertise TSA CPUID bits to guests (bsc#1238896 CVE-2024-36350 CVE-2024-36357 CVE-2024-36348 CVE-2024-36349).
- commit 67b316f
- Bluetooth: btusb: Fix regression in the initialization of fake
Bluetooth controllers (CVE-2025-38099 bsc#1245671).
- Bluetooth: Disable SCO support if READ_VOICE_SETTING is
unsupported/broken (CVE-2025-38099 bsc#1245671).
- Bluetooth: Add quirk for broken READ_PAGE_SCAN_TYPE
(CVE-2025-38099 bsc#1245671).
- Bluetooth: Add quirk for broken READ_VOICE_SETTING
(CVE-2025-38099 bsc#1245671).
- commit 254e65a
- jfs: fix array-index-out-of-bounds read in add_missing_indices
(bsc#1245983 CVE-2025-38204).
- commit 65d9d7f
- usb: typec: ucsi_glink: drop NO_PARTNER_PDOS quirk for sm8550 /
sm8650 (git-fixes).
- commit 380eca4
- usb: typec: ucsi_glink: enable the UCSI_DELAY_DEVICE_PDOS
quirk on qcm6490 (git-fixes).
- commit 3de42d7
- usb: typec: ucsi_glink: enable the UCSI_DELAY_DEVICE_PDOS quirk
(git-fixes).
- commit 2a3ce34
- usb: typec: ucsi_glink: rework quirks implementation
(git-fixes).
- commit b78f907
- usb: typec: ucsi: support delaying GET_PDOS for device
(git-fixes).
- Refresh patches.kabi/struct-usci-hide-additional-member.patch.
- commit 95f3b03
- rpm/mkspec: Fix missing kernel-syms-rt creation (bsc#1244337)
- commit 630f139
- usb: typec: ucsi: extract code to read PD caps (git-fixes).
- commit ebc6c46
- usb: typec: ucsi: properly register partner's PD device
(git-fixes).
- commit 7b95fc1
- usb: typec: ucsi: fix UCSI on SM8550 & SM8650 Qualcomm devices
(git-fixes).
- commit c40444f
- usb: typec: ucsi: Add qcm6490-pmic-glink as needing PDOS quirk
(git-fixes).
- commit 46f5c2a
- ucsi_ccg: Refine the UCSI Interrupt handling (git-fixes).
- commit e97f436
- exfat: fix double free in delayed_free (bsc#1246073
CVE-2025-38206).
- commit 38c1950
- usb: typec: ucsi: Get PD revision for partner (git-fixes).
- commit a80ec70
- x86/bugs: Add a Transient Scheduler Attacks mitigation (bsc#1238896 CVE-2024-36350 CVE-2024-36357 CVE-2024-36348 CVE-2024-36349).
- Update config files.
- commit 45d6a14
- ASoC: fsl_sai: Force a software reset when starting in consumer
mode (git-fixes).
- commit d1c8181
- pwm: mediatek: Ensure to disable clocks in error path
(git-fixes).
- ASoC: cs35l56: probe() should fail if the device ID is not
recognized (git-fixes).
- ASoC: fsl_asrc: use internal measured ratio for non-ideal
ratio mode (git-fixes).
- commit 5b2c070
- dm-raid: fix variable in journal device check (git-fixes).
- commit 7e51a3f
- dm-verity: fix a memory leak if some arguments are specified
multiple times (git-fixes).
- commit 18c3347
- dm-mirror: fix a tiny race condition (git-fixes).
- commit 6d6aef6
- dm-flakey: make corrupting read bios work (git-fixes).
- commit bbf383a
- dm-flakey: error all IOs when num_features is absent
(git-fixes).
- commit d4d758e
- dm: free table mempools if not used in __bind (git-fixes).
- commit 6abd700
- dm: don't change md if dm_table_set_restrictions() fails
(git-fixes).
- commit 0d534aa
- dm: restrict dm device size to 2^63-512 bytes (git-fixes).
- commit 240dadc
- virtgpu: don't reset on shutdown (git-fixes).
- commit 82f42df
- kernel/fork: only call untrack_pfn_clear() on VMAs duplicated
for fork() (git-fix for CVE-2025-22090 bsc#1241537).
- commit 852f7f4
- netfilter: nft_set_pipapo: prevent overflow in lookup table
allocation (CVE-2025-38162 bsc#1245752).
- commit c7520cc
- efi: Don't map the entire mokvar table to determine its size
(bsc#1240323 CVE-2025-21872).
- commit aefffb0
- ucsi-glink: adapt to kABI consistency (git-fixes).
- usb: typec: ucsi: glink: move GPIO reading into connector_status
callback (git-fixes).
- Refresh
patches.suse/usb-typec-ucsi-Move-unregister-out-of-atomic-section.patch.
- commit 8ae6c79
- vhost-scsi: protect vq->log_used with vq->mutex (CVE-2025-38074
bsc#1244735).
- commit 29ecfb7
- struct ucsi_operations: use padding for new operation
(git-fixes).
- commit 5fe6bda
- crypto: ecdsa - Harden against integer overflows in
DIV_ROUND_UP() (CVE-2025-37984 bsc#1243669).
- commit 4115893
- virtio: break and reset virtio devices on device_shutdown()
(CVE-2025-38064 bsc#1245201).
- commit 1ef712f
- usb: typec: ucsi: add callback for connector status updates
(git-fixes).
- blacklist.conf: needed as infrastructure. kABI workaround following
- Refresh patches.suse/paddings-add-paddings-to-TypeC-stuff.patch.
- Refresh
patches.suse/usb-typec-ucsi-displayport-Fix-deadlock.patch.
- commit de5a5b0
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (git-fixes).
- commit 676e3b6
- struct cdns: move new member to the end (git-fixes).
- commit 4384b08
- usb: cdnsp: Fix issue with resuming from L1 (git-fixes).
- commit c8b7c96
- net: dsa: clean up FDB, MDB, VLAN entries on unbind
(CVE-2025-37864 bsc#1242965).
- commit d1f463e
- NFSv4: Always set NLINK even if the server doesn't support it
(git-fixes).
- commit 84005c5
- NFSv4.2: fix listxattr to return selinux security label
(git-fixes).
- commit 0319baa
- NFSv4: xattr handlers should check for absent nfs filehandles
(git-fixes).
- commit 80ac5a3
- sunrpc: don't immediately retransmit on seqno miss (git-fixes).
- commit ceebf6f
- fs/jfs: consolidate sanity checking in dbMount (git-fixes).
- commit 5c4bc1b
- objtool: Ignore end-of-section jumps for KCOV/GCOV (git-fixes).
- commit e383ffb
- objtool: Silence more KCOV warnings, part 2 (git-fixes).
- commit ddae9d6
- netfilter: nf_set_pipapo_avx2: fix initial map fill (git-fixes
CVE-2024-57947 bsc#1236333).
- commit cedcb24
- drm/amdgpu: Add kicker device detection (stable-fixes).
- commit d4202db
- drm/amdkfd: Fix instruction hazard in gfx12 trap handler
(stable-fixes).
- commit bcd44b6
- wifi: mac80211: finish link init before RCU publish (git-fixes).
- drm/xe: Fix early wedge on GuC load failure (git-fixes).
- drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences
(stable-fixes).
- drm/amd/display: Check dce_hwseq before dereferencing it
(stable-fixes).
- drm/amd/display: Fix RMCM programming seq errors (stable-fixes).
- drm/amd/display: Fix mpv playback corruption on weston
(stable-fixes).
- drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL
(stable-fixes).
- drm/amd/display: Correct non-OLED pre_T11_delay (stable-fixes).
- drm/xe/guc_submit: add back fix (git-fixes).
- drm/amdgpu: seq64 memory unmap uses uninterruptible lock
(stable-fixes).
- Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts
on DG1" (stable-fixes).
- wifi: mac80211: Create separate links for VLAN interfaces
(stable-fixes).
- wifi: mac80211: Add link iteration macro for link data
(stable-fixes).
- drm/xe: Fix taking invalid lock on wedge (stable-fixes).
- drm/amdkfd: remove gfx 12 trap handler page size cap
(stable-fixes).
- accel/ivpu: Remove copy engine support (stable-fixes).
- commit 934978c
- usb: typec: displayport: Fix potential deadlock (git-fixes).
- commit a45e2f9
- drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type
(git-fixes).
- ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15
(stable-fixes).
- Bluetooth: L2CAP: Fix L2CAP MTU negotiation (stable-fixes).
- drm/amdkfd: Fix race in GWS queue scheduling (stable-fixes).
- ASoC: codecs: wcd9335: Fix missing free of regulator supplies
(git-fixes).
- ALSA: hda: Ignore unsol events for cards being shut down
(stable-fixes).
- ALSA: hda: Add new pci id for AMD GPU display HD audio
controller (stable-fixes).
- usb: dwc2: also exit clock_gating when stopping udc while
suspended (stable-fixes).
- usb: potential integer overflow in usbg_make_tpg()
(stable-fixes).
- usb: common: usb-conn-gpio: use a unique name for usb connector
device (stable-fixes).
- usb: Add checks for snprintf() calls in usb_alloc_dev()
(stable-fixes).
- usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (stable-fixes).
- usb: typec: displayport: Receive DP Status Update NAK request
exit dp altmode (stable-fixes).
- usb: typec: mux: do not return on EOPNOTSUPP in {mux,
switch}_set (stable-fixes).
- iio: pressure: zpa2326: Use aligned_s64 for the timestamp
(stable-fixes).
- iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos
(stable-fixes).
- drm/scheduler: signal scheduled fence when kill job
(stable-fixes).
- amd/amdkfd: fix a kfd_process ref leak (stable-fixes).
- drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram
(stable-fixes).
- dmaengine: idxd: Check availability of workqueue allocated by
idxd wq driver before using (stable-fixes).
- dmaengine: xilinx_dma: Set dma_device directions (stable-fixes).
- PCI: dwc: Make link training more robust by setting
PORT_LOGIC_LINK_WIDTH to one lane (stable-fixes).
- leds: multicolor: Fix intensity setting while SW blinking
(stable-fixes).
- mfd: max14577: Fix wakeup source leaks on device unbind
(stable-fixes).
- hwmon: (pmbus/max34440) Fix support for max34451 (stable-fixes).
- drm/bridge: ti-sn65dsi86: make use of debugfs_init callback
(stable-fixes).
- ASoC: codec: wcd9335: Convert to GPIO descriptors
(stable-fixes).
- types: Complement the aligned types with signed 64-bit one
(stable-fixes).
- ASoC: codecs: wcd9335: Handle nicer probe deferral and simplify
with dev_err_probe() (stable-fixes).
- commit 9aa1e05
- i2c/designware: Fix an initialization issue (git-fixes).
- commit d80f186
- drm/v3d: Disable interrupts before resetting the GPU
(git-fixes).
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node
(git-fixes).
- drm/amdkfd: Don't call mmput from MMU notifier callback
(git-fixes).
- commit 8444f01
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE
bit cannot be changed (git-fixes).
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods
(git-fixes).
- spi: spi-fsl-dspi: Clear completion counter before initiating
transfer (git-fixes).
- platform/x86: think-lmi: Fix sysfs group cleanup (git-fixes).
- platform/x86: think-lmi: Fix kobject cleanup (git-fixes).
- platform/mellanox: mlxreg-lc: Fix logic error in power state
check (git-fixes).
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval
in sysfs callbacks (git-fixes).
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter
error message (git-fixes).
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for
CACHE_DATA1 (git-fixes).
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment
(git-fixes).
- xhci: dbc: Flush queued requests before stopping dbc
(git-fixes).
- xhci: dbctty: disable ECHO flag by default (git-fixes).
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS
(git-fixes).
- usb: typec: altmodes/displayport: do not index invalid
pin_assignments (git-fixes).
- Revert "usb: xhci: Implement xhci_handshake_check_state()
helper" (git-fixes).
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being
removed (git-fixes).
- usb: gadget: u_serial: Fix race condition in TTY wakeup
(git-fixes).
- usb: chipidea: udc: disconnect/reconnect from host when do
suspend/resume (git-fixes).
- usb: cdnsp: do not disable slot for disabled slot (git-fixes).
- Input: iqs7222 - explicitly define number of external channels
(git-fixes).
- Input: xpad - adjust error handling for disconnect (git-fixes).
- drm/exynos: fimd: Guard display clock control with runtime PM
calls (git-fixes).
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling
(git-fixes).
- drm/i915/gsc: mei interrupt top half should be in irq disabled
context (git-fixes).
- drm/i915/gt: Fix timeline left held on VMA alloc error
(git-fixes).
- drm/i915/selftests: Change mock_request() to return error
pointers (git-fixes).
- drm/sched: Increment job count before swapping tail spsc queue
(git-fixes).
- drm/bridge: panel: move prepare_prev_first handling to
drm_panel_bridge_add_typed (git-fixes).
- drm/ttm: fix error handling in ttm_buffer_object_transfer
(git-fixes).
- powercap: call put_device() on an error path in
powercap_register_control_type() (stable-fixes).
- commit d0cb71b
- dm: fix unconditional IO throttle caused by REQ_PREFLUSH
(CVE-2025-38063 bsc#1245202).
- commit 65fa7b7
- smb: client: Fix use-after-free in cifs_fill_dirent
(CVE-2025-38051 bsc#1244750).
- commit 0f203bf
- cgroup,freezer: fix incomplete freezing when attaching tasks
(bsc#1245789).
- commit 1970df7
- cgroup/cpuset: Extend kthread_is_per_cpu() check to all
PF_NO_SETAFFINITY tasks (bsc#1241166).
- commit 86012b8
- objtool: Stop UNRET validation on UD2 (git-fixes).
- commit 0be0bc6
- objtool: Fix INSN_CONTEXT_SWITCH handling in validate_unret()
(git-fixes).
- commit f1073e2
- objtool: Properly disable uaccess validation (git-fixes).
- commit b170301
- mm/memory-failure: fix handling of dissolved but not taken
off from buddy pages (CVE-2024-39298 bsc#1227082).
Refreshed:
blacklist.conf: De-blacklist 8cf360b9d6a840700e06864236a01a883b34bbad
- commit 1d1f80f
- Bluetooth: HCI: Set extended advertising data synchronously
(git-fixes).
- commit 70fcbcd
- rose: fix dangling neighbour pointers in rose_rt_device_down()
(git-fixes).
- Bluetooth: MGMT: mesh_send: check instances prior disabling
advertising (git-fixes).
- Bluetooth: MGMT: set_mesh: update LE scan interval and window
(git-fixes).
- Bluetooth: hci_sync: revert some mesh modifications (git-fixes).
- Bluetooth: Prevent unintended pause by checking if advertising
is active (git-fixes).
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on
disconnect (git-fixes).
- commit 9d01c7e
- objtool: Silence more KCOV warnings (git-fixes).
- commit 246e013
- objtool: Fix error handling inconsistencies in check()
(git-fixes).
- commit 2b123dd
- objtool: Ignore dangling jump table entries (git-fixes).
- commit 694bcb3
- objtool: Fix UNWIND_HINT_{SAVE,RESTORE} across basic blocks
(git-fixes).
- commit 24df4fe
- x86/tdx: Fix __noreturn build warning around
__tdx_hypercall_failed() (git-fixes).
- Refresh
patches.suse/x86-virt-tdx-Define-TDX-supported-page-sizes-as-macros.patch.
- commit 741a25e
- objtool: Fix _THIS_IP_ detection for cold functions (git-fixes).
- commit b2539b9
- nvmet-tcp: don't restore null sk_state_change (bsc#1244801
CVE-2025-38035).
- commit a1cc55e
- s390/pci: Fix stale function handles in error handling
(git-fixes bsc#1245647).
- commit 1f0ecfd
- s390/pci: Do not try re-enabling load/store if device is
disabled (git-fixes bsc#1245646).
- commit a7a5884
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (git-fixes).
- commit cbe692c
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init()
fails (git-fixes).
- commit 29c2a95
- IB/mlx5: Fix potential deadlock in MR deregistration (git-fixes)
- commit a31c762
- RDMA/mlx5: Fix vport loopback for MPV device (git-fixes)
- commit 50aa3ad
- RDMA/mlx5: Fix CC counters query for MPV (git-fixes)
- commit 6fac6aa
- RDMA/mlx5: Fix HW counters query for non-representor devices (git-fixes)
- commit f645a5e
- RDMA/mlx5: reduce stack usage in mlx5_ib_ufile_hw_cleanup (git-fixes)
- commit 1e8906b
- RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (git-fixes)
- commit 9bf32eb
- mtk-sd: reset host->mrq on prepare_data() error (git-fixes).
- commit 85b8654
- Revert "mmc: sdhci: Disable SD card clock before changing
parameters" (git-fixes).
- mtk-sd: Prevent memory corruption from DMA map failure
(git-fixes).
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data
(git-fixes).
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier
(git-fixes).
- commit 4977a9e
- kABI workaround for xsk: Fix race condition in AF_XDP generic
RX path (CVE-2025-37920 bsc#1243479).
- commit 2cbaa5f
- xsk: Fix race condition in AF_XDP generic RX path
(CVE-2025-37920 bsc#1243479).
- commit b0fed9b
- bpf, sockmap: Fix sk_msg_reset_curr (git-fixes).
- commit 3936762
- scsi: s390: zfcp: Ensure synchronous unit_add (git-fixes
bsc#1245599).
- commit 4cb28a8
- s390/pkey: Prevent overflow in size calculation for
memdup_user() (git-fixes bsc#1245598).
- commit 458c9d8
- s390: Add z17 elf platform (LTC#214086 bsc#1245540).
- commit a338278
- netlink: specs: tc: replace underscores with dashes in names
(git-fixes).
- netlink: specs: nfsd: replace underscores with dashes in names
(git-fixes).
- ice: fix eswitch code memory leak in reset scenario (git-fixes).
- bnxt_en: Fix double invocation of
bnxt_ulp_stop()/bnxt_ulp_start() (git-fixes).
- net/mlx5: HWS, fix missing ip_version handling in definer
(git-fixes).
- e1000: Move cancel_work_sync to avoid deadlock (git-fixes).
- bonding: Correctly support GSO ESP offload (git-fixes).
- commit fca0d66
- net: pktgen: fix access outside of user given buffer in
pktgen_thread_write() (CVE-2025-38061 bsc#1245440).
- commit 386f111
- net: tipc: fix refcount warning in tipc_aead_encrypt
(CVE-2025-38052 bsc#1244749).
- net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done
(CVE-2025-38052 bsc#1244749).
- commit 39309cf
- r8152: add vendor/device ID pair for Dell Alienware AW1022z
(git-fixes).
- commit 9bd4e20
- perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq
(CVE-2025-38055 bsc#1244747).
- commit 144da01
- net: vlan: don't propagate flags on open (CVE-2025-23163
bsc#1242837).
- commit a49d71b
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (git-fixes).
- commit d8e756f
- add bug reference to existing hv_storvsc change (bsc#1245455).
- net: mana: Record doorbell physical address in PF mode (bsc#1244229).
- commit 1c553b0
- kernel-obs-qa: Do not depend on srchash when qemu emulation is used
In this case the dependency is never fulfilled
Fixes: 485ae1da2b88 ("kernel-obs-qa: Use srchash for dependency as well")
- commit a840f87
- nfsd: nfsd4_spo_must_allow() must check this is a v4 compound
request (git-fixes).
- commit 784f61d
- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
(bsc#1245431).
- commit dd145d5
- netlink: specs: dpll: replace underscores with dashes in names
(git-fixes).
- bnxt: properly flush XDP redirect lists (git-fixes).
- e1000e: set fixed clock frequency indication for Nahum 11 and
Nahum 13 (git-fixes).
- net: ice: Perform accurate aRFS flow match (git-fixes).
- net/mlx5e: Fix leak of Geneve TLV option object (git-fixes).
- net/mlx5: Fix return value when searching for existing flow
group (git-fixes).
- net/mlx5: Fix ECVF vports unload on shutdown flow (git-fixes).
- net/mlx5: Ensure fw pages are always allocated on same NUMA
(git-fixes).
- i40e: retry VFLR handling if there is ongoing VF reset
(git-fixes).
- i40e: return false from i40e_reset_vf if reset is in progress
(git-fixes).
- gve: add missing NULL check for gve_alloc_pending_packet()
in TX DQO (git-fixes).
- ice: fix rebuilding the Tx scheduler tree for large queue counts
(git-fixes).
- ice: create new Tx scheduler nodes for new queues only
(git-fixes).
- ice: fix Tx scheduler error handling in XDP callback
(git-fixes).
- net/mlx4_en: Prevent potential integer overflow calculating Hz
(git-fixes).
- gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt
(git-fixes).
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid()
(git-fixes).
- net/mlx5_core: Add error handling
inmlx5_query_nic_vport_qkey_viol_cntr() (git-fixes).
- idpf: fix null-ptr-deref in idpf_features_check (CVE-2025-38053
bsc#1244746).
- ice: Fix LACP bonds without SRIOV environment (git-fixes).
- ice: fix vf->num_mac count with port representors (git-fixes).
- devlink: fix port dump cmd type (git-fixes).
- devlink: Fix referring to hw_addr attribute during state
validation (git-fixes).
- netlink: fix potential sleeping issue in mqueue_flush_file
(git-fixes).
- commit 6dccf5f
- mm/hugetlb: unshare page tables during VMA split, not before
(bsc#1245431).
- commit bf8eb79
- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
(bsc#1245431).
- commit 0b96583
- mm/hugetlb: unshare page tables during VMA split, not before
(bsc#1245431).
- commit cdfa193
- serial: core: restore of_node information in sysfs (git-fixes).
- commit 6ac0cc6
- bpf: Add a possibly-zero-sized read test (git-fixes).
- bpf: Simplify checking size of helper accesses (git-fixes).
- commit 04f6dc5
- staging: rtl8723bs: Avoid memset() in aes_cipher() and
aes_decipher() (git-fixes).
- serial: imx: Restore original RXTL for console to fix data loss
(git-fixes).
- commit 652de47
- drm/amdgpu: csa unmap use uninterruptible lock (CVE-2025-38011
bsc#1244729).
- commit d370e7c
- selftests/bpf: Fix prog numbers in test_sockmap (git-fixes).
- bpftool: Un-const bpf_func_info to fix it for llvm 17 and newer
(git-fixes).
- commit fadce21
- bpf: fix order of args in call to bpf_map_kvcalloc (git-fixes).
- bpf: Harden __bpf_kfunc tag against linker kfunc removal
(git-fixes).
- compiler_types.h: Define __retain for
__attribute__((__retain__)) (git-fixes).
- powerpc/bpf: enforce full ordering for ATOMIC operations with
BPF_FETCH (git-fixes).
- commit e32b4e5
- bpf: Fix potential integer overflow in resolve_btfids
(git-fixes).
- commit 7ce99c9
- selftests/bpf: Fix a few tests for GCC related warnings
(git-fixes).
- selftests/bpf: Change functions definitions to support GCC
(git-fixes).
- selftests/bpf: Add CFLAGS per source file and runner
(git-fixes).
- bpf: Disable some `attribute ignored' warnings in GCC
(git-fixes).
- bpf: Avoid __hidden__ attribute in static object (git-fixes).
- selftests/bpf: Fix pointer arithmetic in test_xdp_do_redirect
(git-fixes).
- commit 71918be
- bpftool: Mount bpffs on provided dir instead of parent dir
(git-fixes).
- commit 1bba21b
- bpftool: Remove unnecessary source files from bootstrap version
(git-fixes).
- bpf/lpm_trie: Inline longest_prefix_match for fastpath
(git-fixes).
- commit 99d4fb6
- bpftool: Fix missing pids during link show (git-fixes).
- bpf: sockmap, updating the sg structure should also update curr
(git-fixes).
- commit 2322e0e
- drm/xe/gt: Update handling of xe_force_wake_get return
(stable-fixes).
- Refresh
patches.suse/drm-xe-Fix-GT-for-each-engine-workarounds.patch.
- commit 2738ff8
- drm/xe: Process deferred GGTT node removals on device unwind
(git-fixes).
- drm/xe/display: Add check for alloc_ordered_workqueue()
(git-fixes).
- drm/amd: Adjust output for discovery error handling (git-fixes).
- drm/xe/bmg: Update Wa_16023588340 (git-fixes).
- drm/v3d: Avoid NULL pointer dereference in
`v3d_job_update_stats()` (stable-fixes).
- PCI: Add ACS quirk for Loongson PCIe (stable-fixes).
- wifi: mt76: mt7925: introduce thermal protection (stable-fixes).
- wifi: mac80211: validate SCAN_FLAG_AP in scan request during
MLO (stable-fixes).
- wifi: rtw89: 8922a: fix TX fail with wrong VCO setting
(stable-fixes).
- wifi: iwlwifi: mvm: fix beacon CCK flag (stable-fixes).
- wireless: purelifi: plfxlc: fix memory leak in
plfxlc_usb_wreq_asyn() (stable-fixes).
- wifi: ath12k: using msdu end descriptor to check for rx
multicast packets (stable-fixes).
- ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86
case (stable-fixes).
- drm/amdgpu: read back register after written for VCN v4.0.5
(stable-fixes).
- wifi: rtw89: phy: add dummy C2H event handler for report of
TAS power (stable-fixes).
- drm/xe: Wire up device shutdown handler (stable-fixes).
- commit 59cc8a5
- i2c: tiny-usb: disable zero-length read messages (git-fixes).
- i2c: robotfuzz-osif: disable zero-length read messages
(git-fixes).
- drm/i915: fix build error some more (git-fixes).
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR
(git-fixes).
- ALSA: usb-audio: Fix out-of-bounds read in
snd_usb_get_audioformat_uac3() (git-fixes).
- ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged
(stable-fixes).
- ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the
KTMicro sound card (stable-fixes).
- ALSA: hda/intel: Add Thinkpad E15 to PM deny list
(stable-fixes).
- ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330
(stable-fixes).
- drivers/rapidio/rio_cm.c: prevent possible heap overwrite
(stable-fixes).
- watchdog: da9052_wdt: respect TWDMIN (stable-fixes).
- watchdog: fix watchdog may detect false positive of softlockup
(stable-fixes).
- fbcon: Make sure modelist not set on unregistered console
(stable-fixes).
- bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
(stable-fixes).
- i2c: designware: Invoke runtime suspend on quick slave
re-registration (stable-fixes).
- i2c: npcm: Add clock toggle recovery (stable-fixes).
- pinctrl: armada-37xx: propagate error from
armada_37xx_pmx_set_by_name() (stable-fixes).
- pinctrl: armada-37xx: propagate error from
armada_37xx_gpio_get_direction() (stable-fixes).
- pinctrl: armada-37xx: propagate error from
armada_37xx_pmx_gpio_set_direction() (stable-fixes).
- pinctrl: armada-37xx: propagate error from
armada_37xx_gpio_get() (stable-fixes).
- pinctrl: mcp23s08: Reset all pins to input at probe
(stable-fixes).
- software node: Correct a OOB check in
software_node_get_reference_args() (stable-fixes).
- wifi: mt76: mt7996: drop fragments with multicast or broadcast
RA (stable-fixes).
- wifi: mt76: mt7921: add 160 MHz AP for mt7922 device
(stable-fixes).
- wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R
(stable-fixes).
- wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET
(stable-fixes).
- wifi: ath12k: fix a possible dead lock caused by ab->base_lock
(stable-fixes).
- wifi: ath11k: Fix QMI memory reuse logic (stable-fixes).
- wifi: rtw89: leave idle mode when setting WEP encryption for
AP mode (stable-fixes).
- wifi: mac80211: do not offer a mesh path if forwarding is
disabled (stable-fixes).
- wifi: iwlwifi: pcie: make sure to lock rxq->read (stable-fixes).
- wifi: mac80211_hwsim: Prevent tsf from setting if beacon is
disabled (stable-fixes).
- wifi: ath12k: fix failed to set mhi state error during reboot
with hardware grouping (stable-fixes).
- wifi: ath12k: fix link valid field initialization in the
monitor Rx (stable-fixes).
- wifi: ath12k: fix incorrect CE addresses (stable-fixes).
- wifi: ath12k: Pass correct values of center freq1 and center
freq2 for 160 MHz (stable-fixes).
- wifi: mac80211: VLAN traffic in multicast path (stable-fixes).
- wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0
(stable-fixes).
- usbnet: asix AX88772: leave the carrier control to phylink
(stable-fixes).
- PM: runtime: fix denying of auto suspend in
pm_suspend_timer_fn() (stable-fixes).
- ACPI: battery: negate current when discharging (stable-fixes).
- ACPICA: Avoid sequence overread in call to strncmp()
(stable-fixes).
- ACPICA: utilities: Fix overflow check in vsnprintf()
(stable-fixes).
- ACPICA: fix acpi parse and parseext cache leaks (stable-fixes).
- ACPICA: fix acpi operand cache leak in dswstate.c
(stable-fixes).
- ACPI: bus: Bail out if acpi_kobj registration fails
(stable-fixes).
- mmc: Add quirk to disable DDR50 tuning (stable-fixes).
- power: supply: bq27xxx: Retrieve again when busy (stable-fixes).
- power: supply: collie: Fix wakeup source leaks on device unbind
(stable-fixes).
- ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9
(stable-fixes).
- ASoC: tegra210_ahub: Add check to of_device_get_match_data()
(stable-fixes).
- ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change
(stable-fixes).
- Input: sparcspkr - avoid unannotated fall-through
(stable-fixes).
- commit 0dc7dde
- Update
patches.suse/HID-uclogic-Add-NULL-check-in-uclogic_input_configur.patch
(git-fixes CVE-2025-38007 bsc#1244938).
- Update
patches.suse/RDMA-core-Fix-KASAN-slab-use-after-free-Read-in-ib_r.patch
(git-fixes CVE-2025-38022 bsc#1245003).
- Update
patches.suse/RDMA-rxe-Fix-slab-use-after-free-Read-in-rxe_queue_c.patch
(git-fixes CVE-2025-38024 bsc#1245025).
- Update
patches.suse/btrfs-avoid-NULL-pointer-dereference-if-no-valid-csu.patch
(bsc#1243342 CVE-2025-38059 bsc#1244759).
- Update
patches.suse/btrfs-avoid-NULL-pointer-dereference-if-no-valid-ext.patch
(bsc#1236208 CVE-2025-21658).
- Update
patches.suse/can-bcm-add-locking-for-bcm_op-runtime-updates.patch
(git-fixes CVE-2025-38004 bsc#1244274).
- Update
patches.suse/can-bcm-add-missing-rcu-read-protection-for-procfs-c.patch
(git-fixes CVE-2025-38003 bsc#1244275).
- Update
patches.suse/crypto-algif_hash-fix-double-free-in-hash_accept.patch
(git-fixes CVE-2025-38079 bsc#1245217).
- Update
patches.suse/crypto-lzo-Fix-compression-buffer-overrun.patch
(stable-fixes CVE-2025-38068 bsc#1245210).
- Update
patches.suse/dmaengine-idxd-Refactor-remove-call-with-idxd_cleanu.patch
(git-fixes CVE-2025-38014 bsc#1244732).
- Update
patches.suse/dmaengine-idxd-fix-memory-leak-in-error-handling-pat-46a5cca.patch
(git-fixes CVE-2025-38015 bsc#1244789).
- Update
patches.suse/dmaengine-ti-k3-udma-Add-missing-locking.patch
(git-fixes CVE-2025-38005 bsc#1244727).
- Update
patches.suse/drm-amd-display-Increase-block_sequence-array-size.patch
(stable-fixes CVE-2025-38080 bsc#1244738).
- Update
patches.suse/ext4-goto-right-label-out_mmap_sem-in-ext4_setattr.patch
(bsc#1242556 CVE-2025-22120 bsc#1241592).
- Update
patches.suse/firmware-arm_ffa-Set-dma_mask-for-ffa-devices.patch
(stable-fixes CVE-2025-38043 bsc#1245081).
- Update patches.suse/media-cx231xx-set-device_caps-for-417.patch
(stable-fixes CVE-2025-38044 bsc#1245082).
- Update
patches.suse/net-handshake-Fix-handshake_req_destroy_test1.patch
(git-fixes CVE-2024-26831 bsc#1223008).
- Update
patches.suse/net-mlx5e-Disable-MACsec-offload-for-uplink-represen.patch
(git-fixes CVE-2025-38020 bsc#1245001).
- Update patches.suse/net_sched-prio-fix-a-race-in-prio_tune.patch
(git-fixes CVE-2025-38083 bsc#1245183).
- Update
patches.suse/nfs-handle-failure-of-nfs_get_lock_context-in-unlock-path.patch
(git-fixes CVE-2025-38023 bsc#1245004).
- Update patches.suse/orangefs-Do-not-truncate-file-size.patch
(git-fixes CVE-2025-38065 bsc#1244906).
- Update
patches.suse/padata-do-not-leak-refcount-in-reorder_work.patch
(git-fixes CVE-2025-38031 bsc#1245046).
- Update
patches.suse/phy-tegra-xusb-Use-a-bitmask-for-UTMI-pad-power-stat.patch
(git-fixes CVE-2025-38010 bsc#1244996).
- Update
patches.suse/platform-x86-dell-wmi-sysman-Avoid-buffer-overflow-i.patch
(git-fixes CVE-2025-38077 bsc#1244736).
- Update
patches.suse/regulator-max20086-fix-invalid-memory-access.patch
(git-fixes CVE-2025-38027 bsc#1245042).
- Update
patches.suse/s390-pci-Fix-duplicate-pci_dev_put-in-disable_slot-w.patch
(git-fixes bsc#1244145 CVE-2025-37946 bsc#1243506).
- Update
patches.suse/s390-pci-fix-potential-double-remove-of-hotplug-slot.patch
(bsc#1244145 CVE-2024-56699 bsc#1235490).
- Update
patches.suse/sched-numa-fix-memory-leak-due-to-the-overwritten-vma-numab_state.patch
(git fixes (sched/numa) CVE-2024-56613 bsc#1244176).
- Update
patches.suse/serial-mctrl_gpio-split-disable_ms-into-sync-and-no_.patch
(git-fixes CVE-2025-38040 bsc#1245078).
- Update
patches.suse/spi-rockchip-Fix-register-out-of-bounds-access.patch
(stable-fixes CVE-2025-38081 bsc#1244739).
- Update
patches.suse/usb-typec-ucsi-displayport-Fix-NULL-pointer-access.patch
(git-fixes CVE-2025-37994 bsc#1243823).
- Update
patches.suse/vhost-scsi-Fix-handling-of-multiple-calls-to-vhost_s.patch
(git-fixes CVE-2025-22083 bsc#1241414).
- Update
patches.suse/wifi-cfg80211-fix-out-of-bounds-access-during-multi-.patch
(git-fixes CVE-2025-37973 bsc#1244172).
- Update patches.suse/wifi-iwlwifi-fix-debug-actions-order.patch
(stable-fixes CVE-2025-38045 bsc#1245083).
- Update
patches.suse/wifi-mac80211-Set-n_channels-after-allocating-struct.patch
(git-fixes CVE-2025-38013 bsc#1244731).
- Update
patches.suse/wifi-mt76-disable-napi-on-driver-removal.patch
(git-fixes CVE-2025-38009 bsc#1244995).
- commit fee1c31
- Update
patches.suse/ASoC-soc-pcm-don-t-use-soc_pcm_ret-on-.prepare-callb.patch
(stable-fixes CVE-2024-58077 bsc#1239090).
- Update
patches.suse/Bluetooth-btbcm-Fix-NULL-deref-in-btbcm_get_board_na.patch
(git-fixes CVE-2024-57988 bsc#1237910).
- Update
patches.suse/Bluetooth-btrtl-check-for-NULL-in-btrtl_setup_realte.patch
(git-fixes CVE-2024-57987 bsc#1237905).
- Update
patches.suse/RDMA-bnxt_re-Add-sanity-checks-on-rdev-validity.patch
(bsc#1237200 CVE-2025-21901 bsc#1240579).
- Update patches.suse/RDMA-rtrs-Add-missing-deinit-call.patch
(git-fixes CVE-2025-21805 bsc#1238741).
- Update
patches.suse/amdkfd-properly-free-gang_ctx_bo-when-failed-to-init.patch
(git-fixes CVE-2025-21842 bsc#1239063).
- Update
patches.suse/cxl-mem-Fix-no-cxl_nvd-during-pmem-region-auto-assem.patch
(jsc#PED-10836 CVE-2024-41085 bsc#1228478).
- Update
patches.suse/cxl-pci-Skip-to-handle-RAS-errors-if-CXL.mem-device-.patch
(jsc#PED-10836 CVE-2024-26762 bsc#1230337).
- Update
patches.suse/drm-amd-display-Fix-invalid-context-error-in-dml-hel.patch
(git-fixes CVE-2025-37965 bsc#1244174).
- Update
patches.suse/drm-amdgpu-init-return-value-in-amdgpu_ttm_clear_buf.patch
(git-fixes CVE-2025-21987 bsc#1240798).
- Update
patches.suse/drm-amdkfd-Fix-NULL-Pointer-Dereference-in-KFD-queue.patch
(git-fixes CVE-2025-21940 bsc#1240702).
- Update
patches.suse/drm-i915-gt-Use-spin_lock_irqsave-in-interruptible-c.patch
(git-fixes CVE-2025-21849 bsc#1239485).
- Update
patches.suse/drm-imagination-avoid-deadlock-on-fence-release.patch
(git-fixes CVE-2025-21911 bsc#1240589).
- Update
patches.suse/drm-xe-hmm-Don-t-dereference-struct-page-pointers-wi.patch
(git-fixes CVE-2025-21939 bsc#1240710).
- Update patches.suse/drm-xe-userptr-fix-EFAULT-handling.patch
(git-fixes CVE-2025-21880 bsc#1240170).
- Update
patches.suse/gpu-host1x-Fix-a-use-of-uninitialized-mutex.patch
(git-fixes CVE-2025-21824 bsc#1238478).
- Update
patches.suse/iommu-Fix-potential-memory-leak-in-iopf_queue_remove.patch
(git-fixes CVE-2025-21770 bsc#1238495).
- Update
patches.suse/media-intel-ipu6-remove-cpu-latency-qos-request-on-e.patch
(git-fixes CVE-2024-58004 bsc#1238508).
- Update
patches.suse/net-smc-do-not-leave-a-dangling-sk-pointer-in-__smc_create.patch
(jsc#PED-10299 bsc#1241689 CVE-2024-50293 bsc#1233482).
- Update
patches.suse/net-smc-fix-lacks-of-icsk_syn_mss-with-IPPROTO_SMC.patch
(jsc#PED-10299 bsc#1241689 CVE-2024-50034 bsc#1231913).
- Update
patches.suse/powerpc-pseries-iommu-Don-t-unset-window-if-it-was-n.patch
(jsc#PED-10539 git-fixes CVE-2025-21713 bsc#1237887).
- Update
patches.suse/wifi-ath12k-Fix-for-out-of-bound-access-error.patch
(bsc#1240998 CVE-2024-58015 bsc#1238995).
- Update
patches.suse/wifi-ath12k-fix-use-after-free-in-ath12k_dp_cc_clean.patch
(bsc#1240998 CVE-2024-56541 bsc#1235064).
- Update
patches.suse/wifi-iwlwifi-mvm-avoid-NULL-pointer-dereference-cf704a7.patch
(git-fixes CVE-2024-58062 bsc#1238965).
- commit 0597d89
- HID: lenovo: Restrict F7/9/11 mode to compact keyboards only
(git-fixes).
- HID: wacom: fix kobject reference count leak (git-fixes).
- HID: wacom: fix memory leak on sysfs attribute creation failure
(git-fixes).
- HID: wacom: fix memory leak on kobject creation failure
(git-fixes).
- wifi: mac80211: fix beacon interval calculation overflow
(git-fixes).
- commit 8d2d6ad
- scsi: storvsc: Increase the timeouts to storvsc_timeout (git-fixes).
- net: mana: Add support for Multi Vports on Bare metal (bsc#1244229).
- scsi: storvsc: Don't report the host packet status as the hv status (git-fixes).
- commit cde971c
- btrfs: fix fsync of files with no hard links not persisting
deletion (git-fixes).
- btrfs: remove end_no_trans label from btrfs_log_inode_parent()
(git-fixes).
- btrfs: simplify condition for logging new dentries at
btrfs_log_inode_parent() (git-fixes).
- commit 9370aa3
- btrfs: fix wrong start offset for delalloc space release during
mmap write (git-fixes).
- commit 59b0f84
- btrfs: fix invalid data space release when truncating block
in NOCOW mode (git-fixes).
- commit b11e8b5
- btrfs: fix qgroup reservation leak on failure to allocate
ordered extent (git-fixes).
- commit e13d6e0
- ntp: Remove invalid cast in time offset math (git-fixes)
- commit 92649f3
- timekeeping: Fix bogus clock_was_set() invocation in (git-fixes)
- commit 17fecee
- ntp: Safeguard against time_constant overflow (git-fixes)
- commit fb90573
- ntp: Clamp maxerror and esterror to operating range (git-fixes)
- commit 947fc29
- clocksource: Fix brown-bag boolean thinko in (git-fixes)
- commit f65bb99
- clocksource: Make watchdog and suspend-timing multiplication (git-fixes)
- commit a87f573
- timekeeping: Fix cross-timestamp interpolation for non-x86 (git-fixes)
- commit 1a57489
- timekeeping: Fix cross-timestamp interpolation corner case (git-fixes)
- commit dc250ae
- timekeeping: Fix cross-timestamp interpolation on counter (git-fixes)
- commit 4e863aa
- Refresh
patches.kabi/kabi-restore-layout-of-struct-mem_control.patch.
- commit 5049495
- kabi: restore layout of struct cgroup_subsys (bsc#1241166).
- commit 2014732
- cgroup/cpuset: Fix race between newly created partition and
dying one (bsc#1241166).
- cgroup/cpuset: Don't allow creation of local partition over
a remote one (bsc#1241166).
- commit 36dffbc
- fgraph: Still initialize idle shadow stacks when starting
(git-fixes).
- commit 1697414
- tracing/eprobe: Fix to release eprobe when failed to add
dyn_event (git-fixes).
- commit a8fd69f
- tracing: Fix cmp_entries_dup() to respect sort() comparison
rules (git-fixes).
- commit f73056c
- tracing: Use atomic64_inc_return() in trace_clock_counter()
(git-fixes).
- commit 23262fc
- trace/trace_event_perf: remove duplicate samples on the first
tracepoint event (git-fixes).
- commit b4e63e6
- bpf: Force uprobe bpf program to always return 0 (git-fixes).
- commit 90effed
- uprobes: Use kzalloc to allocate xol area (git-fixes).
- Refresh
patches.suse/uprobes-introduce-the-global-struct-vm_special_mapping-xol_mapping.patch.
- commit 30d8536
- bpf: abort verification if env->cur_state->loop_entry != NULL
(CVE-2025-38060 bsc#1245155).
- Refresh patches.kabi/bpf-verifier-kABI-workarounds.patch.
- commit c80eca0
- selftests/bpf: check states pruning for deeply nested iterator
(CVE-2025-38060 bsc#1245155).
- bpf: don't do clean_live_states when state->loop_entry->branches
> 0 (CVE-2025-38060 bsc#1245155).
- commit f0d9333
- supported.conf: support firmware_attributes_class
We added support for hp_bioscfg in commit 23a469a682d6 and the build now
fails:
The following unsupported modules are used by supported modules:
firmware_attributes_class needed by hp_bioscfg
So support firmware_attributes_class too.
- commit 939c58c
- vmxnet3: support higher link speeds from vmxnet3 v9
(bsc#1244626).
- commit 0aa445e
- vmxnet3: correctly report gso type for UDP tunnels
(bsc#1244626).
- commit 44584be
- vmxnet3: update MTU after device quiesce (bsc#1244626).
- commit 14400a7
- scsi: elx: efct: Fix memory leak in efct_hw_parse_filter()
(git-fixes).
- commit 11611ac
- mm/memory_hotplug: fix memmap_on_memory sysfs value retrieval
(git-fixes).
- commit e4e3ed3
- tracing: Fix compilation warning on arm32 (bsc#1243551).
- commit bc2f48d
- kABI fixes for struct memory_block changes
(bsc#1235515,jsc#PED-12731).
- commit c5d4cff
- tracing: Fix oob write in trace_seq_to_buffer() (CVE-2025-37923
bsc#1243551).
- commit ff6a777
- ata: libata-eh: Do not use ATAPI DMA for a device limited to
PIO mode (stable-fixes).
- commit 07065f3
- bpf: copy_verifier_state() should copy 'loop_entry' field
(CVE-2025-38060 bsc#1245155).
- Refresh patches.kabi/bpf-verifier-kABI-workarounds.patch.
- commit 815fadf
- selftests/bpf: test correct loop_entry update in
copy_verifier_state (CVE-2025-38060 bsc#1245155).
- commit b2e3449
- tracing: Fix use-after-free in print_graph_function_flags
during tracer switching (CVE-2025-22035 bsc#1241544).
- commit b6d43f4
- bpf: Fix deadlock between rcu_tasks_trace and event_mutex
(CVE-2025-37884 bsc#1243060).
- commit 7f690ab
- truct dwc3 hide new member wakeup_pending_funcs (git-fixes).
- commit 84579a6
- kabi: restore layout of struct page_counter (jsc#PED-12551).
- commit ef34a22
- usb: dwc3: gadget: Make gadget_wakeup asynchronous (git-fixes).
- commit 39cb14b
- ucsi_debugfs_entry: hide signedness change (git-fixes).
- commit 154816e
- usb: typec: ucsi: fix Clang -Wsign-conversion warning
(git-fixes).
- Refresh patches.suse/paddings-add-paddings-to-TypeC-stuff.patch.
- commit 40f2bc3
- dax: add a sysfs knob to control memmap_on_memory behavior (bsc#1235515,jsc#PED-12731).
- mm/memory_hotplug: export mhp_supports_memmap_on_memory() (bsc#1235515,jsc#PED-12731).
- commit 09f84d7
- Documentatiion/ABI: add ABI documentation for sys-bus-dax (bsc#1235515,jsc#PED-12731).
- commit 8ee67a8
- mm/memory_hotplug: split memmap_on_memory requests across memblocks (bsc#1235515,jsc#PED-12731).
- commit 08c671b
- mm/memory_hotplug: replace an open-coded kmemdup() in (bsc#1235515,jsc#PED-12731).
- commit d8a9dae
- mm/memory_hotplug: embed vmem_altmap details in memory block
(bsc#1235515,jsc#PED-12731).
- Refresh
patches.suse/mm-memory_hotplug-add-missing-mem_hotplug_lock.patch.
- Refresh
patches.suse/mm-memory_hotplug-fix-error-handling-in-add_memory_r.patch.
- commit b3d81f3
- mm/memory_hotplug: support memmap_on_memory when memmap is
not aligned to pageblocks (bsc#1235515,jsc#PED-12731).
- Refresh
patches.suse/mm-memory_hotplug-fix-error-handling-in-add_memory_r.patch.
- commit e3abf57
- mm/memory_hotplug: allow architecture to override memmap on
memory support check (bsc#1235515,jsc#PED-12731).
- commit b1ed4e9
- mm/memory_hotplug: allow memmap on memory hotplug request to
fallback (bsc#1235515,jsc#PED-12731).
- mm/memory_hotplug: simplify ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE
kconfig (bsc#1235515,jsc#PED-12731).
- commit e613057
- hwmon: corsair-psu: add USB id of HX1200i Series 2023 psu
(git-fixes).
- commit b5678d7
- net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend() (bsc#1243538)
- commit 416e192
- hwmon: (peci/dimmtemp) Do not provide fake thresholds data
(git-fixes).
- hwmon: (nct6775): Actually make use of the HWMON_NCT6775 symbol
namespace (git-fixes).
- commit 53b0cf2
- Update reference for patches.suse/net_sched-sch_sfq-use-a-temporary-work-area-for-vali.patch (bsc#1242504)
- commit 8730da1
- s390/tty: Fix a potential memory leak bug (git-fixes
bsc#1245228).
- commit e4f3ff4
- s390/pci: Fix __pcilg_mio_inuser() inline assembly (git-fixes
bsc#1245226).
- commit 7cf700b
- ceph: fix memory leaks in __ceph_sync_read() (git-fixes).
- Refresh
patches.suse/ceph-improve-error-handling-and-short-overflow-read-.patch.
- commit 04880f5
- ceph: allocate sparse_ext map only for sparse reads (git-fixes).
- commit e7c7fa7
- ceph: Fix incorrect flush end position calculation (git-fixes).
- commit 626f897
- KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY (git-fixes
bsc#1245225).
- commit 7cc3455
- iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid
(CVE-2025-37927 bsc#1243620).
- commit 4916f47
- nvme-fc: do not reference lsrsp after failure (bsc#1245193).
- nvmet-fcloop: don't wait for lport cleanup (bsc#1245193).
- nvmet-fcloop: add missing fcloop_callback_host_done
(bsc#1245193).
- nvmet-fc: take tgtport refs for portentry (bsc#1245193).
- nvmet-fc: free pending reqs on tgtport unregister (bsc#1245193).
- nvmet-fcloop: drop response if targetport is gone (bsc#1245193).
- nvmet-fcloop: allocate/free fcloop_lsreq directly (bsc#1245193).
- nvmet-fcloop: prevent double port deletion (bsc#1245193).
- nvmet-fcloop: access fcpreq only when holding reqlock
(bsc#1245193).
- nvmet-fcloop: update refs on tfcp_req (bsc#1245193).
- nvmet-fcloop: refactor fcloop_delete_local_port (bsc#1245193).
- nvmet-fcloop: refactor fcloop_nport_alloc and track lport
(bsc#1245193).
- nvmet-fcloop: remove nport from list on last user (bsc#1245193).
- nvmet-fcloop: track ref counts for nports (bsc#1245193).
- commit 20104c4
- Remove host-memcpy-hack.h
This might have been usefult at some point but we have more things that
depend on specific library versions today.
- commit 0396c23
- Remove compress-vmlinux.sh
/usr/lib/rpm/brp-suse.d/brp-99-compress-vmlinux was added in
pesign-obs-integration during SLE12 RC. This workaround can be removed.
- commit 19caac0
- Remove try-disable-staging-driver
The config for linux-next is autogenerated from master config, and
defaults filled for missing options. This is unlikely to enable any
staging driver in the first place.
- commit a6f21ed
- nvme: always punt polled uring_cmd end_io work to task_work
(git-fixes).
- nvme: fix implicit bool to flags conversion (git-fixes).
- commit 36de06b
- platform/x86: hp-bioscfg: Removed needless asm-generic
(jsc#PED-13019).
- platform/x86: hp-bioscfg: Remove unused obj in
hp_add_other_attributes() (jsc#PED-13019).
- platform/x86: hp-bioscfg: Fix error handling in
hp_add_other_attributes() (jsc#PED-13019).
- platform/x86: hp-bioscfg: move mutex_lock() down in
hp_add_other_attributes() (jsc#PED-13019).
- platform/x86: hp-bioscfg: Simplify return check in
hp_add_other_attributes() (jsc#PED-13019).
- platform/x86: hp-bioscfg: Annotate struct bios_args with
__counted_by (jsc#PED-13019).
- platform/x86: hp-bioscfg: Fix reference leak (jsc#PED-13019).
- platform/x86: hp-bioscfg: Update steps order list elements
are evaluated (jsc#PED-13019).
- platform/x86: hp-bioscfg: Use kmemdup() to replace kmalloc +
memcpy (jsc#PED-13019).
- platform/x86: hp-bioscfg: Remove duplicate use of variable in
inner loop (jsc#PED-13019).
- platform/x86: hp-bioscfg: Change how password encoding size
is evaluated (jsc#PED-13019).
- platform/x86: hp-bioscfg: Change how enum possible values size
is evaluated (jsc#PED-13019).
- platform/x86: hp-bioscfg: Change how order list size is
evaluated (jsc#PED-13019).
- platform/x86: hp-bioscfg: Change how prerequisites size is
evaluated (jsc#PED-13019).
- platform/x86: hp-bioscfg: Replace the word HACK from source code
(jsc#PED-13019).
- platform/x86: hp-bioscfg: Fix uninitialized variable errors
(jsc#PED-13019).
- platform/x86: hp-bioscfg: Fix memory leaks in attribute packages
(jsc#PED-13019).
- platform/x86: hp-bioscfg: fix error reporting in
hp_add_other_attributes() (jsc#PED-13019).
- platform/x86: hp-bioscfg: prevent a small buffer overflow
(jsc#PED-13019).
- platform/x86: hp-bioscfg: fix a signedness bug in
hp_wmi_perform_query() (jsc#PED-13019).
- platform/x86: hp-bioscfg: Makefile (jsc#PED-13019).
- Update config files. (HP_BIOSCFG=m)
- supported.conf: add it
- platform/x86: hp-bioscfg: surestart-attributes (jsc#PED-13019).
- platform/x86: hp-bioscfg: string-attributes (jsc#PED-13019).
- platform/x86: hp-bioscfg: spmobj-attributes (jsc#PED-13019).
- platform/x86: hp-bioscfg: passwdobj-attributes (jsc#PED-13019).
- platform/x86: hp-bioscfg: order-list-attributes (jsc#PED-13019).
- platform/x86: hp-bioscfg: int-attributes (jsc#PED-13019).
- platform/x86: hp-bioscfg: enum-attributes (jsc#PED-13019).
- platform/x86: hp-bioscfg: biosattr-interface (jsc#PED-13019).
- platform/x86: hp-bioscfg: bioscfg (jsc#PED-13019).
- platform/x86: hp-bioscfg: bioscfg-h (jsc#PED-13019).
- commit 9e16bbb
- net/tls: fix kernel panic when alloc_page failed (CVE-2025-38018
bsc#1244999).
- commit 1124110
- espintcp: fix skb leaks (CVE-2025-38057 bsc#1244862).
- commit dffbfd5
- nvme: fix command limits status code (git-fixes).
- nvme-pci: add NVME_QUIRK_NO_DEEPEST_PS quirk for SOLIDIGM P44
Pro (git-fixes).
- nvme-pci: add quirks for WDC Blue SN550 15b7:5009 (git-fixes).
- nvme-pci: add quirks for device 126f:1001 (git-fixes).
- commit 990928c
- sunrpc: handle SVC_GARBAGE during svc auth processing as auth
error (git-fixes).
- commit afe6d07
- x86/fred/signal: Prevent immediate repeat of single step trap on return from SIGTRAP handler (git-fixes).
- commit 2684d30
- x86/acpi: Fix LAPIC/x2APIC parsing order (git-fixes).
- commit ecc04e3
- x86/microcode/AMD: Add get_patch_level() (git-fixes).
- commit 73bb23d
- x86/microcode/AMD: Get rid of the _load_microcode_amd() forward declaration (git-fixes).
- commit c818693
- x86/microcode/AMD: Merge early_apply_microcode() into its single callsite (git-fixes).
- commit 761df14
- x86/microcode/AMD: Remove ugly linebreak in __verify_patch_section() signature (git-fixes).
- commit d6c2d35
- x86/microcode: Consolidate the loader enablement checking (git-fixes).
- commit d0fff01
- scsi: iscsi: Fix incorrect error path labels for flashnode
operations (git-fixes).
- md/raid1,raid10: don't handle IO error for REQ_RAHEAD and
REQ_NOWAIT (git-fixes).
- commit cbd3a76
- PCI/PM: Set up runtime PM even for devices without PCI PM
(git-fixes).
- commit 871b129
- drm/xe: Fix memset on iomem (git-fixes).
- drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE (git-fixes).
- drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names (git-fixes).
- commit 68c42f4
- gpio: mlxbf3: only get IRQ for device instance 0 (git-fixes).
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA
(git-fixes).
- drm/etnaviv: Protect the scheduler's pending list with its lock
(git-fixes).
- drm/nouveau/bl: increase buffer size to avoid truncate warning
(git-fixes).
- drm/ssd130x: fix ssd132x_clear_screen() columns (git-fixes).
- drm/amdgpu: switch job hw_fence to amdgpu_fence (git-fixes).
- drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled
(git-fixes).
- drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate
(git-fixes).
- drm/msm/disp: Correct porch timing for SDM845 (git-fixes).
- commit 3df7edd
- libnvdimm/labels: Fix divide error in nd_label_data_init()
(bsc#1244743, CVE-2025-38072).
- commit 42a394c
- kabi: restore layout of struct mem_control (jsc#PED-12551).
- commit e948e2e
- mm, memcg: cg2 memory{.swap,}.peak write handlers
(jsc#PED-12551).
- mm/memcontrol: export memcg.swap watermark via sysfs for v2
memcg (jsc#PED-12551).
- commit 97c4d37
- wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850
(git-fixes).
- wifi: ath12k: refactor ath12k_hw_regs structure (stable-fixes).
- commit 0aa272e
- can: tcan4x5x: fix power regulator retrieval during probe
(git-fixes).
- commit 5798451
- wifi: carl9170: do not ping device which has failed to load
firmware (git-fixes).
- NFC: nci: uart: Set tty->disc_data only in success path
(git-fixes).
- hwmon: (occ) fix unaligned accesses (git-fixes).
- hwmon: (occ) Rework attribute registration for stack usage
(git-fixes).
- hwmon: (ftsteutates) Fix TOCTOU race in fts_read() (git-fixes).
- wifi: ath11k: move some firmware stats related functions
outside of debugfs (git-fixes).
- wifi: ath11k: don't wait when there is no vdev started
(git-fixes).
- wifi: ath11k: don't use static variables in
ath11k_debugfs_fw_stats_process() (git-fixes).
- wifi: ath11k: avoid burning CPU in
ath11k_debugfs_fw_stats_request() (git-fixes).
- USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB
(stable-fixes).
- usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage
device (stable-fixes).
- usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE
(stable-fixes).
- thunderbolt: Do not double dequeue a configuration request
(stable-fixes).
- rtc: Make rtc_time64_to_tm() support dates before 1970
(stable-fixes).
- firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES
(git-fixes).
- Bluetooth: MGMT: Remove unused mgmt_pending_find_data
(stable-fixes).
- serial: sh-sci: Move runtime PM enable to sci_probe_single()
(stable-fixes).
- wifi: ath11k: convert timeouts to secs_to_jiffies()
(stable-fixes).
- wifi: ath11k: fix soc_dp_stats debugfs file permission
(stable-fixes).
- commit d77b71f
- Update patches.suse/ALSA-pcm-Fix-race-of-buffer-access-at-PCM-OSS-layer.patch
(CVE-2025-38078 bsc#1244737).
- commit 9ad878b
- workqueue: Initialize wq_isolated_cpumask in
workqueue_init_early() (bsc#1245101 jsc#PED-11934).
- commit cf8ea05
- calipso: Fix null-ptr-deref in calipso_req_{set,del}attr()
(git-fixes).
- commit 1a53756
- net/sched: fix use-after-free in taprio_dev_notifier
(git-fixes).
- commit bd7e23e
- net_sched: ets: fix a race in ets_qdisc_change() (git-fixes).
- commit c8863c2
- net_sched: tbf: fix a race in tbf_change() (git-fixes).
- commit 8dd49d3
- net_sched: red: fix a race in __red_change() (git-fixes).
- commit eb63704
- net_sched: prio: fix a race in prio_tune() (git-fixes).
- commit 2898595
- net_sched: sch_sfq: reject invalid perturb period (git-fixes).
- commit 11af7b7
- net: Fix TOCTOU issue in sk_is_readable() (git-fixes).
- commit 9bf44e9
- Update patches.suse/dlm-mask-sk_shutdown-value.patch
(bsc#1241278).
- Update patches.suse/dlm-use-SHUT_RDWR-for-SCTP-shutdown.patch
(bsc#1241278).
Original bsc number was wrong. Fix it.
- commit 37c9443
- net_sched: hfsc: Address reentrant enqueue adding class to
eltree twice (CVE-2025-38001 bsc#1244234).
- commit 6a31481
- packaging: Add support for suse-kabi-tools
The current workflow to check kABI stability during the RPM build of SUSE
kernels consists of the following steps:
* The downstream script rpm/modversions unpacks the consolidated kABI
symtypes reference data from kabi/<arch>/symtypes-<flavor> and creates
individual symref files.
* The build performs a regular kernel make. During this operation, genksyms
is invoked for each source file. The tool determines type signatures of
all exports within the file, reports any differences compared to the
associated symref reference, calculates symbol CRCs from the signatures
and writes new type data into a symtypes file.
* The script rpm/modversions is invoked again, this time it packs all new
symtypes files to a consolidated kABI file.
* The downstream script rpm/kabi.pl checks symbol CRCs in the new build and
compares them to a reference from kabi/<arch>/symvers-<flavor>, taking
kabi/severities into account.
suse-kabi-tools is a new set of tools to improve the kABI checking process.
The suite includes two tools, ksymtypes and ksymvers, which replace the
existing scripts rpm/modversions and rpm/kabi.pl, as well as the comparison
functionality previously provided by genksyms. The tools have their own
source repository and package.
The tools provide faster operation and more detailed, unified output. In
addition, they allow the use of the new upstream tool gendwarfksyms, which
lacks any built-in comparison functionality.
The updated workflow is as follows:
* The build performs a regular kernel make. During this operation, genksyms
(gendwarfksyms) is invoked as usual, determinining signatures and CRCs of
all exports and writing the type data to symtypes files. However,
genksyms no longer performs any comparison.
* 'ksymtypes consolidate' packs all new symtypes files to a consolidated
kABI file.
* 'ksymvers compare' checks symbol CRCs in the new build and compares them
to a reference from kabi/<arch>/symvers-<flavor>, taking kabi/severities
into account. The tool writes its result in a human-readable form on
standard output and also writes a list of all changed exports (not
ignored by kabi/severities) to the changed-exports file.
* 'ksymtypes compare' takes the changed-exports file, the consolidated kABI
symtypes reference data from kabi/<arch>/symtypes-<flavor> and the new
consolidated data. Based on this data, it produces a detailed report
explaining why the symbols changed.
The patch enables the use of suse-kabi-tools via rpm/config.sh, providing
explicit control to each branch. To enable the support, set
USE_SUSE_KABI_TOOLS=Yes in the config file.
- commit a2c6f89
- rpm/kernel-source.changes.old: Drop bogus bugzilla reference (bsc#1244725)
- commit 5432961
- platform/x86/amd/hsmp: mark hsmp_msg_desc_table as maybe_unused (git-fixes).
- commit eaf3f3e
- platform/x86: ideapad-laptop: use usleep_range() for EC polling
(git-fixes).
- commit 1373cac
- platform/x86: dell_rbu: Stop overwriting data buffer
(git-fixes).
- platform/x86: dell_rbu: Fix list usage (git-fixes).
- platform/x86/amd: pmc: Clear metrics table at start of cycle
(git-fixes).
- platform/x86/intel-uncore-freq: Fail module load when plat_info
is NULL (git-fixes).
- commit 4eb007c
- platform/x86/amd/hsmp: fix building with CONFIG_HWMON=m (jsc#PED-13094).
- commit 7e90eae
- platform/x86/amd/hsmp: acpi: Add sysfs files to display HSMP telemetry (jsc#PED-13094).
- commit c34bfd9
- Bluetooth: hci_sync: Fix UAF in hci_acl_create_conn_sync
(git-fixes).
- Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync (git-fixes).
- Bluetooth: hci_conn: Fix UAF Write in
__hci_acl_create_connection_sync (git-fixes).
- commit cc24dff
- Bluetooth: hci_event: Fix not using key encryption size when
its known (git-fixes).
- Bluetooth: Remove pending ACL connection attempts
(stable-fixes).
- Bluetooth: hci_conn: Only do ACL connections sequentially
(stable-fixes).
- commit 45b89a8
- platform/x86/amd/hsmp: Report power via hwmon sensor (jsc#PED-13094).
- commit 3fa9047
- platform/x86/amd/hsmp: Use a single DRIVER_VERSION for all hsmp modules (jsc#PED-13094).
- commit b70cb9c
- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (jsc#PED-13094).
- Refresh
patches.suse/x86-platform-amd-Move-the-asm-amd_hsmp.h-header-to-asm-amd.patch.
- commit e869dba
- x86/platform/amd: Move the <asm/amd_hsmp.h> header to <asm/amd/hsmp.h> (jsc#PED-13094).
- commit b780fd8
- x86/amd_node: Use defines for SMN register offsets (jsc#PED-13094).
- commit bea8590
- kernel-source: Remove log.sh from sources
- commit 96bd779
- powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO
EEH recovery (bsc#1215199).
- commit 8ae69e3
- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (jsc#PED-13094).
- commit 379d9d8
- platform/x86/amd/hsmp: Use dev_groups in the driver structure (jsc#PED-13094).
- commit 66e3f77
- platform/x86/amd/hsmp: Use name space while exporting module symbols (jsc#PED-13094).
- commit 2dee567
- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (jsc#PED-13094).
- Update config files.
- Refresh
patches.suse/platform-x86-amd-amd_3d_vcache-Add-AMD-3D-V-Cache-optimize.patch.
- commit ffd3128
- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (jsc#PED-13094).
- commit 915a3f7
- platform/x86/amd/hsmp: Move ACPI code to acpi.c (jsc#PED-13094).
- commit 783665d
- platform/x86/amd/hsmp: Move platform device specific code to plat.c (jsc#PED-13094).
- commit 05a6a05
- platform/x86/amd/hsmp: Move structure and macros to header file (jsc#PED-13094).
- commit bfb5c2a
- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (jsc#PED-13094).
- commit 9f08011
- platform/x86/amd/hsmp: Create wrapper function init_acpi() (jsc#PED-13094).
- commit b6c3243
- platform/x86/amd/hsmp: Create hsmp/ directory (jsc#PED-13094).
- Refresh
patches.suse/platform-x86-amd-amd_3d_vcache-Add-AMD-3D-V-Cache-optimize.patch.
- commit 9dae3f7
- x86/amd_node: Add support for debugfs access to SMN registers (jsc#PED-13094).
- commit a3ccd34
- x86/amd_node: Add SMN offsets to exclusive region access (jsc#PED-13094).
- commit d16a516
- ima: Suspend PCR extends and log appends when rebooting
(bsc#1210025 ltc#196650).
- commit 25c308f
- wifi: ath12k: Prevent sending WMI commands to firmware during
firmware crash (bsc#1240998).
- wifi: ath12k: Resolve multicast packet drop by populating
key_cipher in ath12k_install_key() (bsc#1240998).
- commit eceaca4
- x86/amd_node: Remove dependency on AMD_NB (jsc#PED-13094).
- commit c48ff26
- x86/amd_node: Update __amd_smn_rw() error paths (jsc#PED-13094).
- commit fe719a3
- x86/amd_nb: Move SMN access code to a new amd_node driver (jsc#PED-13094).
- commit 72c9a97
- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (jsc#PED-13094).
- commit 66ca957
- x86/amd_nb: Simplify root device search (jsc#PED-13094).
- commit ec70dba
- x86/amd_nb: Simplify function 4 search (jsc#PED-13094).
- commit 60f7dbe
- x86: Start moving AMD node functionality out of AMD_NB (jsc#PED-13094).
- commit 03a65bb
- x86/amd_nb: Clean up early_is_amd_nb() (jsc#PED-13094).
- commit 300fc20
- x86/amd_nb: Restrict init function to AMD-based systems (jsc#PED-13094).
- commit 00ad037
- x86/mce/amd: Remove shared threshold bank plumbing (jsc#PED-13094).
- commit daa6443
- platform/x86: amd: Use *-y instead of *-objs in Makefiles (jsc#PED-13094).
- commit 0e11b2e
- platform/x86/amd/hsmp: Add support for HSMP protocol version 7 messages (jsc#PED-13094).
- commit ea1af9f
- platform/x86/amd/hsmp: Change the error type (jsc#PED-13094).
- commit a7ed99b
- platform/x86/amd/hsmp: Add new error code and error logs (jsc#PED-13094).
- commit 5e1eefb
- ACPI: CPPC: Fix NULL pointer dereference when nosmp is used
(git-fixes).
- regulator: max20086: Fix refcount leak in
max20086_parse_regulators_dt() (git-fixes).
- commit 5b8c5a3
- scsi: dc395x: Remove leftover if statement in reselect()
(git-fixes).
- commit c259874
- loop: add file_start_write() and file_end_write() (git-fixes).
- scsi: dc395x: Remove DEBUG conditional compilation (git-fixes).
- scsi: hisi_sas: Call I_T_nexus after soft reset for SATA disk
(git-fixes).
- scsi: qedf: Use designated initializer for struct
qed_fcoe_cb_ops (git-fixes).
- scsi: sd_zbc: block: Respect bio vector limits for REPORT
ZONES buffer (git-fixes).
- scsi: mpi3mr: Add level check to control event logging
(git-fixes).
- scsi: st: Tighten the page format heuristics with MODE SELECT
(git-fixes).
- scsi: st: ERASE does not change tape location (git-fixes).
- scsi: mpt3sas: Send a diag reset if target reset fails
(git-fixes).
- scsi: st: Restore some drive settings after reset (git-fixes).
- commit 6dba36f
- scsi: mpt3sas: Fix _ctl_get_mpt_mctp_passthru_adapter() to
return IOC pointer (git-fixes).
- scsi: smartpqi: Fix smp_processor_id() call trace for
preemptible kernels (git-fixes).
- commit 26561f1
- x86/mm/init: Handle the special case of device private
pages in add_pages(), to not increase max_pfn and trigger
dma_addressing_limited() bounce buffers (git-fixes).
- commit d67c7bf
- PCI/MSI: Size device MSI domain with the maximum number of
vectors (git-fixes).
- PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from
rockchip_pcie_link_up() (git-fixes).
- PCI: apple: Set only available ports up (git-fixes).
- PCI: dwc: ep: Correct PBA offset in .set_msix() callback
(git-fixes).
- PCI: endpoint: Retain fixed-size BAR size as well as aligned
size (git-fixes).
- kABI: PCI: endpoint: Retain fixed-size BAR size as well as
aligned size (git-fixes).
- PCI/DPC: Log Error Source ID only when valid (git-fixes).
- serial: mctrl_gpio: split disable_ms into sync and no_sync APIs
(git-fixes).
- kABI: serial: mctrl_gpio: split disable_ms into sync and
no_sync APIs (git-fixes).
- x86/kaslr: Reduce KASLR entropy on most x86 systems (git-fixes).
- PCI/DPC: Use defines with DPC reason fields (git-fixes).
- commit 67e24e5
- Revert "wifi: mwifiex: Fix HT40 bandwidth issue." (git-fixes).
- Bluetooth: eir: Fix possible crashes on eir_create_adv_data
(git-fixes).
- Bluetooth: btintel_pcie: Reduce driver buffer posting to
prevent race condition (git-fixes).
- Bluetooth: btintel_pcie: Increase the tx and rx descriptor count
(git-fixes).
- Bluetooth: btintel_pcie: Fix driver not posting maximum rx
buffers (git-fixes).
- ptp: ocp: fix start time alignment in ptp_ocp_signal_set
(git-fixes).
- ptp: ocp: reject unsupported periodic output flags (git-fixes).
- commit 7815601
- Bluetooth: MGMT: Fix sparse errors (git-fixes).
- commit bcd5c33
- wifi: ath11k: validate ath11k_crypto_mode on top of
ath11k_core_qmi_firmware_ready (git-fixes).
- ath10k: snoc: fix unbalanced IRQ enable in crash recovery
(git-fixes).
- Bluetooth: hci_sync: Fix broadcast/PA when using an existing
instance (git-fixes).
- Bluetooth: Fix NULL pointer deference on eir_get_service_data
(git-fixes).
- net/mdiobus: Fix potential out-of-bounds clause 45 read/write
access (git-fixes).
- net/mdiobus: Fix potential out-of-bounds read/write access
(git-fixes).
- Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete
(git-fixes).
- Bluetooth: hci_core: fix list_for_each_entry_rcu usage
(git-fixes).
- ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use()
(git-fixes).
- pinctrl: st: Drop unused st_gpio_bank() function (git-fixes).
- pinctrl: qcom: pinctrl-qcm2290: Add missing pins (git-fixes).
- commit d9ecc09
- wifi: ath12k: fix key cache handling (bsc#1240998).
- wifi: ath12k: ath12k_mac_op_set_key(): fix uninitialized symbol
'ret' (bsc#1240998).
- wifi: ath12k: Fix for out-of bound access error (bsc#1240998).
- commit 8ff94a8
- wifi: ath12k: fix A-MSDU indication in monitor mode
(bsc#1240998).
- wifi: ath12k: use tail MSDU to get MSDU information
(bsc#1240998).
- commit e2172a0
- wifi: ath12k: modify link arvif creation and removal for MLO
(bsc#1240998).
- Refresh
patches.suse/wifi-ath12k-fix-read-pointer-after-free-in-ath12k_ma.patch.
- commit 923a9a5
- wifi: ath12k: delete NSS and TX power setting for monitor vdev
(bsc#1240998).
- wifi: ath12k: fix struct hal_rx_mpdu_start (bsc#1240998).
- wifi: ath12k: fix struct hal_rx_phyrx_rssi_legacy_info
(bsc#1240998).
- wifi: ath12k: fix struct hal_rx_ppdu_start (bsc#1240998).
- wifi: ath12k: fix struct hal_rx_ppdu_end_user_stats
(bsc#1240998).
- wifi: ath12k: remove unused variable monitor_present
(bsc#1240998).
- wifi: ath12k: update ath12k_mac_op_update_vif_offload() for MLO
(bsc#1240998).
- wifi: ath12k: update ath12k_mac_op_conf_tx() for MLO
(bsc#1240998).
- wifi: ath12k: modify ath12k_mac_op_set_key() for MLO
(bsc#1240998).
- commit 875025b
- wifi: ath12k: prepare vif data structure for MLO handling
(bsc#1240998).
- Refresh
patches.suse/wifi-ath12k-Handle-error-cases-during-extended-skb-a.patch.
- Refresh
patches.suse/wifi-ath12k-fix-tx-power-max-reg-power-update-to-fir.patch.
- commit d3bc90b
- wifi: ath12k: modify ath12k_mac_op_bss_info_changed() for MLO
(bsc#1240998).
- wifi: ath12k: modify ath12k_get_arvif_iter() for MLO
(bsc#1240998).
- wifi: ath12k: modify ath12k_mac_vif_chan() for MLO
(bsc#1240998).
- wifi: ath12k: prepare vif config caching for MLO (bsc#1240998).
- wifi: ath12k: prepare sta data structure for MLO handling
(bsc#1240998).
- wifi: ath12k: pass ath12k_link_vif instead of vif/ahvif
(bsc#1240998).
- wifi: ath12k: Support BE OFDMA Pdev Rate Stats (bsc#1240998).
- wifi: ath12k: Support Pdev Scheduled Algorithm Stats
(bsc#1240998).
- wifi: ath12k: Support DMAC Reset Stats (bsc#1240998).
- commit 45b89e0
- Update config files: set CONFIG_ATH12K_COREDUMP=n
- commit 6743252
- wifi: ath12k: switch to using wiphy_lock() and remove
ar->conf_mutex (bsc#1240998).
- Refresh
patches.suse/wifi-ath12k-fix-node-corruption-in-ar-arvifs-list.patch.
- Refresh
patches.suse/wifi-ath12k-fix-read-pointer-after-free-in-ath12k_ma.patch.
- commit e4becf9
- wifi: ath12k: Add firmware coredump collection support
(bsc#1240998).
- wifi: ath12k: add missing lockdep_assert_wiphy() for
ath12k_mac_op_ functions (bsc#1240998).
- wifi: ath12k: ath12k_mac_op_sta_state(): clean up update_wk
cancellation (bsc#1240998).
- wifi: ath12k: ath12k_mac_set_key(): remove exit label
(bsc#1240998).
- wifi: ath12k: cleanup unneeded labels (bsc#1240998).
- wifi: ath12k: convert struct ath12k_sta::update_wk to use
struct wiphy_work (bsc#1240998).
- wifi: ath12k: Support Pdev OBSS Stats (bsc#1240998).
- wifi: ath12k: Support pdev CCA Stats (bsc#1240998).
- wifi: ath12k: Support pdev Transmit Multi-user stats
(bsc#1240998).
- wifi: ath12k: Support Ring and SFM stats (bsc#1240998).
- wifi: ath12k: Support Self-Generated Transmit stats
(bsc#1240998).
- wifi: ath12k: Modify print_array_to_buf() to support arrays
with 1-based semantics (bsc#1240998).
- wifi: ath12k: move txbaddr/rxbaddr into struct ath12k_dp
(bsc#1240998).
- wifi: ath12k: make read-only array svc_id static const
(bsc#1240998).
- commit 52faf57
- sch_hfsc: Fix qlen accounting bug when using peek in
hfsc_enqueue() (CVE-2025-38000 bsc#1244277).
- commit ffb9ab4
- thunderbolt: Improve redrive mode handling (git-fixes).
- commit 9923d39
- net_sched: sch_fifo: implement lockless __fifo_dump() (bsc#1237312)
- commit 8196566
- wifi: ath12k: Handle error cases during extended skb allocation
(git-fixes).
- wifi: ath12k: fix read pointer after free in
ath12k_mac_assign_vif_to_vdev() (git-fixes CVE-2024-57995
bsc#1237895).
- commit f9ec810
- wifi: ath12k: Fix buffer overflow in debugfs (bsc#1240998).
- wifi: ath12k: Add missing htt_metadata flag in ath12k_dp_tx()
(bsc#1240998).
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path
(bsc#1240998).
- wifi: ath12k: fix one more memcpy size error (bsc#1240998).
- wifi: ath12k: fix use-after-free in ath12k_dp_cc_cleanup()
(bsc#1240998).
- commit 911b319
- wifi: ath12k: Avoid -Wflex-array-member-not-at-end warnings
(bsc#1240998).
- wifi: ath12k: fix the stack frame size warning in
ath12k_mac_op_hw_scan (bsc#1240998).
- commit 00bca74
- wifi: ath12k: restore ASPM for supported hardwares only
(bsc#1240998).
- commit 32459d7
- wifi: ath12k: Support Transmit DE stats (bsc#1240998).
- wifi: ath12k: use 128 bytes aligned iova in transmit path for
WCN7850 (bsc#1240998).
- wifi: ath12k: fix reusing outside iterator in
ath12k_wow_vif_set_wakeups() (bsc#1240998).
- wifi: ath12k: fix build vs old compiler (bsc#1240998).
- wifi: ath12k: Support TQM stats (bsc#1240998).
- wifi: ath12k: Support pdev error stats (bsc#1240998).
- wifi: ath12k: Support Transmit Scheduler stats (bsc#1240998).
- wifi: ath12k: Dump additional Tx PDEV HTT stats (bsc#1240998).
- commit 55670c2
- Revert "ipv6: save dontfrag in cork (git-fixes)."
This reverts commit d3fe600164867bd0529ed1049fbd53ca9fce2eaf.
See https://lore.kernel.org/all/aElivdUXqd1OqgMY@karahi.gladserv.com/
and https://bugzilla.suse.com/show_bug.cgi?id=1244313.
- commit b9e7a4e
- wifi: ath12k: Add support to parse requested stats_type
(bsc#1240998).
- wifi: ath12k: Add htt_stats_dump file ops support (bsc#1240998).
- wifi: ath12k: Add support to enable debugfs_htt_stats
(bsc#1240998).
- wifi: ath12k: fix driver initialization for WoW unsupported
devices (bsc#1240998).
- wifi: ath12k: Fix pdev id sent to firmware for single phy
devices (bsc#1240998).
- wifi: ath12k: handle keepalive during WoWLAN suspend and resume
(bsc#1240998).
- wifi: ath12k: support GTK rekey offload (bsc#1240998).
- wifi: ath12k: support ARP and NS offload (bsc#1240998).
- wifi: ath12k: implement hardware data filter (bsc#1240998).
- wifi: ath12k: add WoW net-detect functionality (bsc#1240998).
- wifi: ath12k: add basic WoW functionalities (bsc#1240998).
- wifi: ath12k: implement WoW enable and wakeup commands
(bsc#1240998).
- wifi: ath12k: add ATH12K_DBG_WOW log level (bsc#1240998).
- wifi: ath12k: fix mbssid max interface advertisement
(bsc#1240998).
- wifi: ath12k: fix legacy peer association due to missing HT
or 6 GHz capabilities (bsc#1240998).
- wifi: ath12k: fix NULL pointer access in
ath12k_mac_op_get_survey() (bsc#1240998).
- wifi: ath12k: Remove unused ath12k_base from ath12k_hw
(bsc#1240998).
- wifi: ath12k: Fix WARN_ON during firmware crash in split-phy
(bsc#1240998).
- wifi: ath12k: handle symlink cleanup for per pdev debugfs dentry
(bsc#1240998).
- wifi: ath12k: unregister per pdev debugfs (bsc#1240998).
- commit 0bd0160
- Revert "kABI: ipv6: save dontfrag in cork (git-fixes)."
This reverts commit cbc81e238815721048ac709726467c90981753c9.
See https://lore.kernel.org/all/aElivdUXqd1OqgMY@karahi.gladserv.com/
and https://bugzilla.suse.com/show_bug.cgi?id=1244313.
- commit 38d0091
- wifi: ath12k: fix per pdev debugfs registration (bsc#1240998).
- wifi: ath12k: avoid unnecessary MSDU drop in the Rx error
process (bsc#1240998).
- wifi: ath12k: fix ACPI warning when resume (bsc#1240998).
- wifi: ath12k: modify remain on channel for single wiphy
(bsc#1240998).
- wifi: ath12k: add hw_link_id in ath12k_pdev (bsc#1240998).
- wifi: ath12k: add panic handler (bsc#1240998).
- wifi: ath12k: do not process consecutive RDDM event
(bsc#1240998).
- wifi: ath12k: Fix devmem address prefix when logging
(bsc#1240998).
- wifi: ath12k: improve the rx descriptor error information
(bsc#1240998).
- wifi: ath12k: refactor rx descriptor CMEM configuration
(bsc#1240998).
- wifi: ath12k: fix Smatch warnings on ath12k_core_suspend()
(bsc#1240998).
- wifi: ath12k: dynamic VLAN support (bsc#1240998).
- wifi: ath12k: fix ack signal strength calculation (bsc#1240998).
- wifi: ath12k: use correct MAX_RADIOS (bsc#1240998).
- wifi: ath12k: remove duplicate definition of MAX_RADIOS
(bsc#1240998).
- wifi: ath12k: remove redundant peer delete for WCN7850
(bsc#1240998).
- wifi: ath12k: skip sending vdev down for channel switch
(bsc#1240998).
- wifi: ath12k: add EMA beacon support (bsc#1240998).
- wifi: ath12k: add MBSSID beacon support (bsc#1240998).
- wifi: ath12k: refactor arvif security parameter configuration
(bsc#1240998).
- commit 187e02f
- wifi: ath12k: advertise driver capabilities for MBSSID and EMA
(bsc#1240998).
- Refresh
patches.suse/wifi-ath12k-fix-peer-metadata-parsing.patch.
- commit 9bb543e
- wifi: ath12k: allocate dummy net_device dynamically
(bsc#1240998).
- Refresh
patches.suse/wifi-ath12k-Avoid-napi_sync-before-napi_enable.patch.
- commit 6102136
- wifi: ath12k: configure MBSSID parameters in AP mode
(bsc#1240998).
- wifi: ath12k: create a structure for WMI vdev up parameters
(bsc#1240998).
- wifi: ath12k: rename MBSSID fields in wmi_vdev_up_cmd
(bsc#1240998).
- wifi: ath12k: configure MBSSID params in vdev create/start
(bsc#1240998).
- wifi: ath12k: support SMPS configuration for 6 GHz
(bsc#1240998).
- wifi: ath12k: refactor SMPS configuration (bsc#1240998).
- wifi: ath12k: add 6 GHz params in peer assoc command
(bsc#1240998).
- wifi: ath12k: fix survey dump collection in 6 GHz (bsc#1240998).
- wifi: ath12k: add channel 2 into 6 GHz channel list
(bsc#1240998).
- wifi: ath12k: fix misspelling of "dma" in num_rxmda_per_pdev
(bsc#1240998).
- wifi: ath12k: avoid double SW2HW_MACID conversion (bsc#1240998).
- wifi: ath12k: remove invalid peer create logic (bsc#1240998).
- wifi: ath12k: avoid duplicated vdev down (bsc#1240998).
- wifi: ath12k: remove unused variable monitor_flags
(bsc#1240998).
- wifi: ath12k: Remove unused tcl_*_ring configuration
(bsc#1240998).
- wifi: ath12k: Remove unsupported tx monitor handling
(bsc#1240998).
- wifi: ath12k: fix calling correct function for rx monitor mode
(bsc#1240998).
- wifi: ath12k: add multi device support for WBM idle ring buffer
setup (bsc#1240998).
- commit ea4159d
- wifi: ath12k: Refactor idle ring descriptor setup (bsc#1240998).
- Refresh
patches.suse/wifi-ath12k-fix-firmware-crash-during-reo-reinject.patch.
- commit 3c261ef
- wifi: ath12k: Introduce device index (bsc#1240998).
- wifi: ath12k: Replace "chip" with "device" in hal Rx return
buffer manager (bsc#1240998).
- wifi: ath12k: Add lock to protect the hardware state
(bsc#1240998).
- wifi: ath12k: Refactor the hardware state (bsc#1240998).
- wifi: ath12k: Refactor the hardware recovery procedure
(bsc#1240998).
- wifi: ath12k: fix flush failure in recovery scenarios
(bsc#1240998).
- wifi: ath12k: set mlo_capable_flags based on QMI PHY capability
(bsc#1240998).
- wifi: ath12k: read single_chip_mlo_support parameter from QMI
PHY capability (bsc#1240998).
- wifi: ath12k: add support to handle beacon miss for WCN7850
(bsc#1240998).
- wifi: ath12k: ACPI band edge channel power support
(bsc#1240998).
- wifi: ath12k: ACPI CCA threshold support (bsc#1240998).
- wifi: ath12k: ACPI SAR support (bsc#1240998).
- wifi: ath12k: ACPI TAS support (bsc#1240998).
- wifi: ath12k: change supports_suspend to true for WCN7850
(bsc#1240998).
- wifi: ath12k: support suspend/resume (bsc#1240998).
- wifi: ath12k: avoid stopping mac80211 queues in
ath12k_core_restart() (bsc#1240998).
- wifi: ath12k: no need to handle pktlog during suspend/resume
(bsc#1240998).
- wifi: ath12k: flush all packets before suspend (bsc#1240998).
- commit 9a64ae8
- wifi: ath12k: decrease MHI channel buffer length to 8KB
(bsc#1240998).
- wifi: ath12k: fix warning on DMA ring capabilities event
(bsc#1240998).
- wifi: ath12k: do not dump SRNG statistics during resume
(bsc#1240998).
- wifi: ath12k: remove MHI LOOPBACK channels (bsc#1240998).
- wifi: ath12k: rearrange IRQ enable/disable in reset path
(bsc#1240998).
- wifi: ath12k: Refactor data path cmem init (bsc#1240998).
- wifi: ath12k: displace the Tx and Rx descriptor in cookie
conversion table (bsc#1240998).
- wifi: ath12k: Refactor the hardware cookie conversion init
(bsc#1240998).
- wifi: ath12k: avoid redundant code in Rx cookie conversion init
(bsc#1240998).
- wifi: ath12k: don't use %pK in dmesg format strings
(bsc#1240998).
- wifi: ath12k: enable service flag for survey dump stats
(bsc#1240998).
- wifi: ath12k: enable WIPHY_FLAG_DISABLE_WEXT (bsc#1240998).
- wifi: ath12k: dynamically update peer puncturing bitmap for STA
(bsc#1240998).
- wifi: ath12k: fix mac id extraction when MSDU spillover in rx
error path (bsc#1240998).
- wifi: ath12k: support get_survey mac op for single wiphy
(bsc#1240998).
- wifi: ath12k: Modify rts threshold mac op for single wiphy
(bsc#1240998).
- wifi: ath12k: Modify set and get antenna mac ops for single
wiphy (bsc#1240998).
- wifi: ath12k: modify regulatory support for single wiphy
architecture (bsc#1240998).
- wifi: ath12k: Add additional checks for vif and sta iterators
(bsc#1240998).
- wifi: ath12k: Cache vdev configs before vdev create
(bsc#1240998).
- commit ea1744e
- wifi: ath12k: vdev statemachine changes for single wiphy
(bsc#1240998).
- Refresh
patches.suse/wifi-ath12k-fix-peer-metadata-parsing.patch.
- commit ab212a6
- wifi: ath12k: modify ath12k mac start/stop ops for single wiphy
(bsc#1240998).
- Refresh
patches.suse/wifi-mac80211-inform-the-low-level-if-drv_stop-is-a-.patch.
- commit 0a8727c
- wifi: ath12k: add multiple radio support in a single MAC HW
un/register (bsc#1240998).
- Refresh
patches.suse/wifi-mac80211-inform-the-low-level-if-drv_stop-is-a-.patch.
- commit 5897b5c
- wifi: ath12k: fetch correct radio based on vdev status
(bsc#1240998).
- wifi: ath12k: scan statemachine changes for single wiphy
(bsc#1240998).
- wifi: ath12k: Modify add and remove chanctx ops for single
wiphy support (bsc#1240998).
- wifi: ath12k: correct the capital word typo (bsc#1240998).
- wifi: ath12k: fix link capable flags (bsc#1240998).
- wifi: ath12k: extend the link capable flag (bsc#1240998).
- wifi: ath12k: fix hal_rx_buf_return_buf_manager documentation
(bsc#1240998).
- wifi: ath12k: fix missing endianness conversion in
wmi_vdev_create_cmd() (bsc#1240998).
- wifi: ath12k: debugfs: radar simulation support (bsc#1240998).
- wifi: ath12k: initial debugfs support (bsc#1240998).
- wifi: ath12k: Refactor error handler of Rxdma replenish
(bsc#1240998).
- wifi: ath12k: Optimize the lock contention of used list in Rx
data path (bsc#1240998).
- wifi: ath12k: Refactor Rxdma buffer replinish argument
(bsc#1240998).
- wifi: ath12k: remove duplicate definitions in wmi.h
(bsc#1240998).
- wifi: ath12k: fix desc address calculation in wbm tx completion
(bsc#1240998).
- wifi: ath12k: remove obsolete struct wmi_start_scan_arg
(bsc#1240998).
- commit 56d49fd
- kABI fix for net: Remove RTNL dance for SIOCBRADDIF and
SIOCBRDELIF (CVE-2025-22111 bsc#1241572).
- commit edfd43c
- page_pool: avoid infinite loop to schedule delayed worker
(CVE-2025-37859 bsc#1243051).
- commit b8f1dfd
- tipc: fix memory leak in tipc_link_xmit (CVE-2025-37757 bsc#1242521)
- commit 48e0415
- struct usci: hide additional member (git-fixes).
- commit 1b8456a
- net_sched: Flush gso_skb list too during ->change()
(CVE-2025-37992 bsc#1243698).
- netfilter: ipset: fix region locking in hash types
(CVE-2025-37997 bsc#1243832).
- ipvs: fix uninit-value for saddr in do_output_route4
(CVE-2025-37961 bsc#1243523).
- net: dsa: free routing table on probe failure (CVE-2025-37786
bsc#1242725).
- net: tls: explicitly disallow disconnect (CVE-2025-37756
bsc#1242515).
- net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF
(CVE-2025-22111 bsc#1241572).
- vlan: enforce underlying device type (CVE-2025-21920
bsc#1240686).
- xfrm: delete intermediate secpath entry in packet offload mode
(CVE-2025-21720 bsc#1238859).
- xfrm: state: fix out-of-bounds read during lookup
(CVE-2024-57982 bsc#1237913).
- rxrpc: Fix handling of received connection abort (CVE-2024-58053
bsc#1238982).
- commit d3e755f
- isolcpus: fix bug in returning number of allocated cpumask (bsc#1243774).
Return the correct upper limit of the allocated cpumask.
modified:
- patches.suse/lib-group_cpus-honor-housekeeping-config-when-grouping.patch
- patches.suse/lib-group_cpus-let-group_cpu_evenly-return-number.patch
- commit 092bf4a
- xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (git-fixes)
- commit 24d5250
- arm64: dts: marvell: uDPU: define pinctrl state for alarm LEDs (git-fixes)
- commit 28d162e
- Revert "arm64: dts: allwinner: h6: Use RSB for AXP805 PMIC (git-fixes)
- commit 9dd3301
- xen/x86: fix initial memory balloon target (git-fixes).
- commit 7e938b1
- ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt
3 dock (stable-fixes).
- ALSA: usb-audio: Fix NULL pointer deref in
snd_usb_power_domain_set() (git-fixes).
- commit 9d209cd
- ALSA: usb-audio: Rename Pioneer mixer channel controls
(git-fixes).
- ALSA: usb-audio: Add Pioneer DJ DJM-V10 support (stable-fixes).
- ALSA: usb-audio: Fix duplicated name in MIDI substream names
(stable-fixes).
- ALSA: usb-audio: mixer: Remove temporary string use in
parse_clock_source_unit (stable-fixes).
- commit e8737ac
- ALSA: usb-audio: Set MIDI1 flag appropriately for GTB MIDI
1.0 entry (stable-fixes).
- ALSA: usb-audio: Accept multiple protocols in GTBs
(stable-fixes).
- ALSA: usb-audio: Add name for HP Engage Go dock (stable-fixes).
- commit 498a796
- Revert "ALSA: usb-audio: Skip setting clock selector for single
connections" (stable-fixes).
- Refresh
patches.suse/ALSA-usb-audio-Ignore-clock-selector-errors-for-sing.patch.
- Refresh
patches.suse/ALSA-usb-audio-Support-multiple-control-interfaces.patch.
- commit d0138e9
- ALSA: usb-audio: Support read-only clock selector control
(stable-fixes).
- Refresh
patches.suse/ALSA-usb-audio-Ignore-clock-selector-errors-for-sing.patch.
- Refresh
patches.suse/ALSA-usb-audio-Support-multiple-control-interfaces.patch.
- commit ee97bec
- ALSA: usb-audio: Skip setting clock selector for single
connections (stable-fixes).
- Refresh
patches.suse/ALSA-usb-audio-Ignore-clock-selector-errors-for-sing.patch.
- Refresh
patches.suse/ALSA-usb-audio-Support-multiple-control-interfaces.patch.
- commit 7326e0b
- ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1
(stable-fixes).
- ALSA: usb-audio: enable support for Presonus Studio 1824c
within 1810c file (stable-fixes).
- ALSA: usb-audio: Support multiple control interfaces
(stable-fixes).
- ALSA: usb-audio: Check shutdown at endpoint_set_interface()
(stable-fixes).
- commit d4a0ce3
- wifi: ath11k: update channel list in worker when wait flag is
set (bsc#1243847).
- commit 4cfebaa
- net: lan743x: Fix memleak issue when GSO enabled (CVE-2025-37909
bsc#1243467).
- vxlan: vnifilter: Fix unlocked deletion of default FDB entry
(CVE-2025-37921 bsc#1243480).
- commit 788c92a
- watchdog: mediatek: Add support for MT6735 TOPRGU/WDT
(git-fixes).
- commit 4df631e
- watchdog: it87_wdt: add PWRGD enable quirk for Qotom QCML04
(git-fixes).
- commit ba2db88
- module: ensure that kobject_put() is safe for module type kobjects (CVE-2025-37995 bsc#1243827)
- commit 6979c9a
- mkspec: Exclude rt flavor from kernel-syms dependencies (bsc#1244337).
- commit 7c95ae0
- x86/xen: fix balloon target initialization for PVH dom0
(git-fixes).
- commit ad18aba
- powerpc/vas: Return -EINVAL if the offset is non-zero in mmap()
(bsc#1244309 ltc#213790).
- powerpc/powernv/memtrace: Fix out of bounds issue in memtrace
mmap (bsc#1244309 ltc#213790).
- commit 2d4ad48
- tracing: Verify event formats that have "%*p.." (CVE-2025-37938
bsc#1243544).
- tracing: Add __print_dynamic_array() helper (bsc#1243544).
- tracing: Add __string_len() example (bsc#1243544).
- commit c705d1d
- fbdev/efifb: Remove PM for parent device (bsc#1244261).
- Refresh
patches.suse/fbdev-efifb-Register-sysfs-groups-through-driver-cor.patch.
- commit 0c56458
- RDMA/uverbs: Propagate errors from rdma_lookup_get_uobject() (git-fixes)
- commit 7d2ce51
- RDMA/core: Fix best page size finding when it can cross SG entries (git-fixes)
- commit bfdc372
- Update config files.
config/x86_64/default
config/arm64/default
CONFIG_INTEGRITY_MACHINE_KEYRING=y
+CONFIG_INTEGRITY_CA_MACHINE_KEYRING=y
+CONFIG_INTEGRITY_CA_MACHINE_KEYRING_MAX=y
+CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY=y
(bsc#1243678)
- commit a35da96
- MyBS: Do not build kernel-obs-qa with limit_packages
Fixes: 58e3f8c34b2b ("bs-upload-kernel: Pass limit_packages also on multibuild")
- commit f4c6047
- MyBS: Simplify qa_expr generation
Start with a 0 which makes the expression valid even if there are no QA
repositories (currently does not happen). Then separator is always
needed.
- commit e4c2851
- MyBS: Correctly generate build flags for non-multibuild package limit
(bsc# 1244241)
Fixes: 0999112774fc ("MyBS: Use buildflags to set which package to build")
- commit 27588c9
- bs-upload-kernel: Pass limit_packages also on multibuild
Fixes: 0999112774fc ("MyBS: Use buildflags to set which package to build")
Fixes: 747f601d4156 ("bs-upload-kernel, MyBS, Buildresults: Support multibuild (JSC-SLE#5501, boo#1211226, bsc#1218184)")
- commit 8ef486c
- ftrace: Avoid potential division by zero in function_stat_show()
(CVE-2025-21898 bsc#1240610).
- commit d476f96
- tracing: Fix bad hist from corrupting named_triggers list
(CVE-2025-21899 bsc#1240577).
- commit 60219e4
- iommu: Skip PASID validation for devices without PASID capability (bsc#1244100)
- commit 647b2f4
- iommu: Validate the PASID in iommu_attach_device_pasid() (bsc#1244100)
- commit ca42766
- nfsd: Initialize ssc before laundromat_work to prevent NULL
dereference (git-fixes).
- commit 153c2a2
- nfsd: validate the nfsd_serv pointer before calling svc_wake_up
(git-fixes).
- commit af8b93e
- NFSD: Insulate nfsd4_encode_read_plus() from page boundaries
in the encode buffer (git-fixes).
- commit 91b6192
- jffs2: check jffs2_prealloc_raw_node_refs() result in few
other places (git-fixes).
- commit 254a145
- jffs2: check that raw node were preallocated before writing
summary (git-fixes).
- commit 4a6701a
- x86/microcode/AMD: Have __apply_microcode_amd() return bool (git-fixes).
- commit ae818bc
- x86/microcode/AMD: Make __verify_patch_size() return bool (git-fixes).
- commit dcdd8b6
- x86/microcode/AMD: Return bool from find_blobs_in_containers() (git-fixes).
- commit 65dff7c
- x86/microcode/AMD: Do not return error when microcode update is not necessary (git-fixes).
- commit 662ffcd
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (git-fixes).
- commit 15bb5b3
- blacklist.conf: Disable fineibt part of ITS mitigation
- Refresh
patches.suse/x86-its-Enumerate-Indirect-Target-Selection-ITS-bug.patch.
- commit cedb857
- xsk: fix an integer overflow in xp_create_and_assign_umem()
(bsc#1240823 CVE-2025-21997).
- commit 931fc27
- dlm: use SHUT_RDWR for SCTP shutdown (bsc#1228854).
- dlm: mask sk_shutdown value (bsc#1228854).
- commit 730d8cf
- drm/xe: Rework eviction rejection of bound external bos
(git-fixes).
- commit 939c62a
- ASoC: ti: omap-hdmi: Re-add dai_link->platform to fix card init
(git-fixes).
- commit e678093
- ASoC: Intel: avs: Verify content returned by parse_int_array()
(git-fixes).
- ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX
(git-fixes).
- ASoC: codecs: hda: Fix RPM usage count underflow (git-fixes).
- commit 7d227ae
- Move upstreamed iommu patch into sorted section
- commit f4c105a
- Move upstreamed crypto patches into sorted section
- commit 9df372d
- drm/xe: remove unmatched xe_vm_unlock() from
__xe_exec_queue_init() (git-fixes).
- commit 5e0c63a
- usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous
work (git-fixes).
- tty: serial: 8250_omap: fix TX with DMA for am33xx (git-fixes).
- serial: jsm: fix NPE during jsm_uart_port_init (git-fixes).
- sysfb: Fix screen_info type check for VGA (git-fixes).
- accel/ivpu: Use dma_resv_lock() instead of a custom mutex
(git-fixes).
- drm/panel-simple: fix the warnings for the Evervision VGG644804
(git-fixes).
- accel/ivpu: Improve buffer object logging (git-fixes).
- dummycon: Trigger redraw when switching consoles with deferred
takeover (git-fixes).
- drm/xe: Create LRC BO without VM (git-fixes).
- drm/xe/sched: stop re-submitting signalled jobs (git-fixes).
- drm/xe/vm: move rebind_work init earlier (git-fixes).
- drm/i915/guc: Handle race condition where wakeref count drops
below 0 (git-fixes).
- drm/i915/psr: Fix using wrong mask in REG_FIELD_PREP
(git-fixes).
- drm/i915/guc: Check if expecting reply before decrementing
outstanding_submission_g2h (git-fixes).
- drm/xe: Make xe_gt_freq part of the Documentation (git-fixes).
- commit 5cf14c5
- Update video patch to the upstream version (bsc#1240696).
- commit 8af5790
- Move upstreamed patches into sorted section
- commit 022730e
- spi: bcm63xx-hsspi: fix shared reset (git-fixes).
- spi: bcm63xx-spi: fix shared reset (git-fixes).
- regulator: max14577: Add error check for max14577_read_reg()
(git-fixes).
- usb: usbtmc: Fix timeout value in get_stb (git-fixes).
- usb: usbtmc: Fix read_stb function and get_stb ioctl
(git-fixes).
- usb: cdnsp: Fix issue with detecting command completion event
(git-fixes).
- usb: cdnsp: Fix issue with detecting USB 3.2 speed (git-fixes).
- usb: Flush altsetting 0 endpoints before reinitializating them
after reset (git-fixes).
- usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx()
(git-fixes).
- thunderbolt: Fix a logic error in wake on connect (git-fixes).
- usb: renesas_usbhs: Reorder clock handling and power management
in probe (git-fixes).
- vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl()
(git-fixes).
- serial: Fix potential null-ptr-deref in mlb_usio_probe()
(git-fixes).
- staging: iio: ad5933: Correct settling cycles encoding per
datasheet (git-fixes).
- iio: adc: ad7124: Fix 3dB filter frequency reading (git-fixes).
- iio: filter: admv8818: Support frequencies >= 2^32 (git-fixes).
- iio: filter: admv8818: fix range calculation (git-fixes).
- iio: filter: admv8818: fix integer overflow (git-fixes).
- iio: filter: admv8818: fix band 4, state 15 (git-fixes).
- VMCI: fix race between vmci_host_setup_notify and
vmci_ctx_unset_notify (git-fixes).
- iio: accel: fxls8962af: Fix temperature scan element sign
(git-fixes).
- iio: imu: inv_icm42600: Fix temperature calculation (git-fixes).
- iio: adc: ad7606_spi: fix reg write value mask (git-fixes).
- bus: mhi: host: Fix conflict between power_up and SYSERR
(git-fixes).
- drm/amd/display: Add null pointer check for
get_first_active_display() (git-fixes).
- drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1
(git-fixes).
- commit def2214
- s390/pci: Serialize device addition and removal (bsc#1244145).
- commit f1ae730
- s390/pci: Allow re-add of a reserved but not yet removed device
(bsc#1244145).
- commit a73fcdb
- s390/pci: Prevent self deletion in disable_slot() (bsc#1244145).
- commit 136fe4f
- s390/pci: Remove redundant bus removal and disable from
zpci_release_device() (bsc#1244145).
- commit 9bbc219
- s390/pci: Fix potential double remove of hotplug slot
(bsc#1244145).
- commit 9714d95
- s390/pci: remove hotplug slot when releasing the device
(bsc#1244145).
- commit 1415bb1
- s390/pci: Fix duplicate pci_dev_put() in disable_slot() when
PF has child VFs (git-fixes bsc#1244145).
- commit 3430d11
- s390/pci: introduce lock to synchronize state of zpci_dev's
(jsc#PED-10253 bsc#1244145).
- Refresh
patches.suse/s390-pci-Fix-leak-of-struct-zpci_dev-when-zpci_add_device-fails.patch.
- Refresh
patches.suse/s390-pci-Sort-PCI-functions-prior-to-creating-virtual-busses.patch.
- commit 2644b79
- s390/pci: rename lock member in struct zpci_dev (jsc#PED-10253
bsc#1244145).
- Refresh
patches.suse/s390-pci-Fix-leak-of-struct-zpci_dev-when-zpci_add_device-fails.patch.
- Refresh
patches.suse/s390-pci-Sort-PCI-functions-prior-to-creating-virtual-busses.patch.
- Refresh
patches.suse/s390-pci-Use-topology-ID-for-multi-function-devices.patch.
- commit 9223df0
- media: mediatek: vcodec: Only free buffer VA that is not NULL
(CVE-2023-52888 bsc#1228557).
- commit 0299171
- drm/amd/display: Fix default DC and AC levels (bsc#1240650).
- drm/amd/display: Add debugging message for brightness caps
(bsc#1240650).
- commit 5941cb0
- net: fix udp gso skb_segment after pull from frag_list
(git-fixes).
- commit 8353437
- page_pool: Fix use-after-free in page_pool_recycle_in_ring
(git-fixes).
- commit 69ccdcd
- net: Implement missing getsockopt(SO_TIMESTAMPING_NEW)
(git-fixes).
- commit d107edf
- net: sched: em_text: fix possible memory leak in
em_text_destroy() (git-fixes).
- commit 71395f7
- neighbour: Don't let neigh_forced_gc() disable preemption for
long (git-fixes).
- commit fea49bb
- net: sched: cls_u32: Fix allocation size in u32_init()
(git-fixes).
- commit eea3eab
- Move upstreamed patches into sorted section
- commit c9465fb
- kernel-source: Do not use multiple -r in sed parameters
This usage is enabled in commit b18d64d
(sed: allow multiple (non-conflicting) -E/-r parameters, 2016-07-31)
only available since sed 4.3
Fixes: dc2037cd8f94 ("kernel-source: Also replace bin/env"
- commit 91ad98e
- efi/libstub: Describe missing 'out' parameter in efi_load_initrd
(git-fixes).
- drm/msm/dpu: Clear CTL_FETCH_PIPE_ACTIVE before blend setup
(git-fixes).
- drm/msm/dpu: Clear CTL_FETCH_PIPE_ACTIVE on ctl_path reset
(git-fixes).
- drm/msm/a6xx: Disable rgb565_predicator on Adreno 7c3
(git-fixes).
- drm/msm/dpu: enable SmartDMA on SC8180X (git-fixes).
- drm/msm/dpu: enable SmartDMA on SM8150 (git-fixes).
- drm/panthor: Update panthor_mmu::irq::mask when needed
(git-fixes).
- drm/panthor: Fix GPU_COHERENCY_ACE[_LITE] definitions
(git-fixes).
- drm/panic: add missing space (git-fixes).
- drm/vmwgfx: Fix dumb buffer leak (git-fixes).
- drm/vmwgfx: Add error path for xa_store in
vmw_bo_add_detached_resource (git-fixes).
- drm/xe/d3cold: Set power state to D3Cold during s2idle/s3
(git-fixes).
- media: verisilicon: Free post processor buffers on error
(git-fixes).
- media: platform: mtk-mdp3: Remove unused mdp_get_plat_device
(git-fixes).
- media: intel/ipu6: Fix dma mask for non-secure mode (git-fixes).
- media: ov2740: Move pm-runtime cleanup on probe-errors to
proper place (git-fixes).
- media: ipu6: Remove workaround for Meteor Lake ES2 (git-fixes).
- thermal/drivers/mediatek/lvts: Fix debugfs unregister on failure
(git-fixes).
- drm/xe: Save the gt pointer in lrc and drop the tile
(stable-fixes).
- wifi: mt76: mt7925: load the appropriate CLC data based on
hardware type (stable-fixes).
- wifi: mt76: mt7925: fix fails to enter low power mode in
suspend state (stable-fixes).
- wifi: rtw89: fw: get sb_sel_ver via get_unaligned_le32()
(stable-fixes).
- wifi: rtw89: 8922a: fix incorrect STA-ID in EHT MU PPDU
(stable-fixes).
- wifi: mwifiex: Fix HT40 bandwidth issue (stable-fixes).
- wifi: iwlwifi: mvm: fix setting the TK when associated
(stable-fixes).
- wifi: iwlwifi: don't warn when if there is a FW error
(stable-fixes).
- wifi: iwlwifi: w/a FW SMPS mode selection (stable-fixes).
- wifi: iwlwifi: mark Br device not integrated (stable-fixes).
- wifi: iwlwifi: fix the ECKV UEFI variable name (stable-fixes).
- wifi: mac80211: fix warning on disconnect during failed ML
reconf (stable-fixes).
- wifi: mac80211_hwsim: Fix MLD address translation
(stable-fixes).
- wifi: cfg80211: allow IR in 20 MHz configurations
(stable-fixes).
- wifi: ath12k: fix the ampdu id fetch in the HAL_RX_MPDU_START
TLV (stable-fixes).
- wifi: ath12k: Fetch regdb.bin file from board-2.bin
(stable-fixes).
- wifi: rtw89: call power_on ahead before selecting firmware
(stable-fixes).
- wifi: iwlwifi: use correct IMR dump variable (stable-fixes).
- wifi: iwlwifi: don't warn during reprobe (stable-fixes).
- wifi: mac80211: set ieee80211_prep_tx_info::link_id upon Auth Rx
(stable-fixes).
- commit 33f1dc1
- drm/amd/display: Configure DTBCLK_P with OPTC only for dcn401
(stable-fixes).
- Refresh
patches.suse/drm-amd-display-prevent-hang-on-link-training-fail.patch.
- commit 063600f
- Bluetooth: btintel: Check dsbr size from EFI variable
(git-fixes).
- Documentation: ACPI: Use all-string data node references
(git-fixes).
- ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY()
(git-fixes).
- ASoC: SOF: Intel: hda-bus: Use PIO mode on ACE2+ platforms
(git-fixes).
- drm/xe/xe2hpg: Add Wa_22021007897 (stable-fixes).
- drm/amd/display: check stream id dml21 wrapper to get plane_id
(stable-fixes).
- drm/amd/display: Defer BW-optimization-blocked DRR adjustments
(git-fixes).
- drm/amd/display: Call FP Protect Before Mode Programming/Mode
Support (stable-fixes).
- ASoC: cs42l43: Disable headphone clamps during type detection
(stable-fixes).
- drm/amdgpu: Allow P2P access through XGMI (stable-fixes).
- drm/amdgpu/discovery: check ip_discovery fw file available
(stable-fixes).
- drm/amdkfd: set precise mem ops caps to disabled for gfx 11
and 12 (stable-fixes).
- drm/amdgpu: Skip pcie_replay_count sysfs creation for VF
(stable-fixes).
- drm/amdgpu: release xcp_mgr on exit (stable-fixes).
- drm/amdgpu: adjust drm_firmware_drivers_only() handling
(stable-fixes).
- drm/amdkfd: Correct F8_MODE for gfx950 (git-fixes).
- drm/amdgpu/gfx12: don't read registers in mqd init
(stable-fixes).
- drm/amdgpu/gfx11: don't read registers in mqd init
(stable-fixes).
- drm/amdgpu: Fix the race condition for draining retry fault
(stable-fixes).
- drm/amd/display: Correct timing_adjust_pending flag setting
(stable-fixes).
- drm/amd/display: calculate the remain segments for all pipes
(stable-fixes).
- drm/amd/display: not abort link train when bw is low
(stable-fixes).
- drm/amd/display: Do not enable replay when vtotal update is
pending (stable-fixes).
- drm/xe: Nuke VM's mapping upon close (stable-fixes).
- drm/xe: Retry BO allocation (stable-fixes).
- drm/xe/vf: Retry sending MMIO request to GUC on timeout error
(stable-fixes).
- drm/xe/pf: Create a link between PF and VF devices
(stable-fixes).
- drm/xe: xe_gen_wa_oob: replace program_invocation_short_name
(stable-fixes).
- drm/amdkfd: Set per-process flags only once for gfx9/10/11/12
(stable-fixes).
- drm/amdgpu: Fix missing drain retry fault the last entry
(stable-fixes).
- drm/amd/display: Ensure DMCUB idle before reset on DCN31/DCN35
(stable-fixes).
- drm/amd/display: Fix DMUB reset sequence for DCN401
(stable-fixes).
- drm/amd/display: Fix p-state type when p-state is unsupported
(stable-fixes).
- drm/amd/display: Request HW cursor on DCN3.2 with SubVP
(stable-fixes).
- drm/amd/display: handle max_downscale_src_width fail check
(stable-fixes).
- drm/amd/display: fix dcn4x init failed (stable-fixes).
- drm/amdgpu: remove all KFD fences from the BO on release
(stable-fixes).
- drm/xe/oa: Ensure that polled read returns latest data
(stable-fixes).
- drm/xe: Stop ignoring errors from xe_ttm_stolen_mgr_init()
(stable-fixes).
- drm/xe: Fix xe_tile_init_noalloc() error propagation
(stable-fixes).
- drm/xe/debugfs: fixed the return value of wedged_mode_set
(stable-fixes).
- drm/xe/debugfs: Add missing xe_pm_runtime_put in wedge_mode_set
(stable-fixes).
- drm/xe/relay: Don't use GFP_KERNEL for new transactions
(stable-fixes).
- drm/xe/pf: Reset GuC VF config when unprovisioning critical
resource (stable-fixes).
- drm/xe: Move suballocator init to after display init
(stable-fixes).
- drm/xe: Do not attempt to bootstrap VF in execlists mode
(stable-fixes).
- drm/xe/sa: Always call drm_suballoc_manager_fini()
(stable-fixes).
- drm/xe: Reject BO eviction if BO is bound to current VM
(stable-fixes).
- drm/amd/pm: Fetch current power limit from PMFW (stable-fixes).
- drm/amd/display: Add support for disconnected eDP streams
(stable-fixes).
- drm/amd/display: Guard against setting dispclk low when active
(stable-fixes).
- drm/amd/display: Fix BT2020 YCbCr limited/full range input
(stable-fixes).
- drm/amd/display: Read LTTPR ALPM caps during link cap retrieval
(stable-fixes).
- drm/amd/display: Don't treat wb connector as physical in
create_validate_stream_for_sink (stable-fixes).
- drm/amdgpu/mes11: fix set_hw_resources_1 calculation
(stable-fixes).
- drm/amdkfd: fix missing L2 cache info in topology
(stable-fixes).
- drm/amd/display: pass calculated dram_speed_mts to dml2
(stable-fixes).
- drm/amd/pm: Skip P2S load for SMU v13.0.12 (stable-fixes).
- drm/amd/display: Support multiple options during psr entry
(stable-fixes).
- drm/amd/display: Use Nominal vBlank If Provided Instead Of
Capping It (stable-fixes).
- drm/amd/display: Populate register address for dentist for
dcn401 (stable-fixes).
- drm/amdgpu: Use active umc info from discovery (stable-fixes).
- drm/rockchip: vop2: Improve display modes handling on RK3588
HDMI0 (stable-fixes).
- drm/nouveau: fix the broken marco GSP_MSG_MAX_SIZE
(stable-fixes).
- drm/buddy: fix issue that force_merge cannot free all roots
(stable-fixes).
- commit c1bcb86
- Drop AMDGPU patch that may cause regressions (bsc#1243782)
Deleted:
patches.suse/drm-amd-display-more-liberal-vmin-vmax-update-for-fr.patch
- commit c23b99f
- wifi: ath12k: Avoid memory leak while enabling statistics
(CVE-2025-37743 bsc#1242163).
- commit f493528
- PM: sleep: Fix power.is_suspended cleanup for direct-complete
devices (git-fixes).
- net: wwan: t7xx: Fix napi rx poll issue (git-fixes).
- Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION
(git-fixes).
- Bluetooth: hci_qca: move the SoC type check to the right place
(git-fixes).
- rtc: Fix offset calculation for .start_secs < 0 (git-fixes).
- rtc: stm32: drop unused module alias (git-fixes).
- rtc: s3c: drop unused module alias (git-fixes).
- rtc: pm8xxx: drop unused module alias (git-fixes).
- rtc: jz4740: drop unused module alias (git-fixes).
- rtc: da9063: drop unused module alias (git-fixes).
- rtc: cpcap: drop unused module alias (git-fixes).
- rtc: at91rm9200: drop unused module alias (git-fixes).
- rtc: sh: assign correct interrupts with DT (git-fixes).
- dmaengine: ti: Add NULL check in udma_probe() (git-fixes).
- phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (git-fixes).
- commit ec23ee6
- net: usb: aqc111: debug info before sanitation (git-fixes).
- commit fc18979
- openvswitch: Fix unsafe attribute parsing in output_userspace() (CVE-2025-37998 bsc#1243836)
- commit 51afd13
- octeon_ep: Fix host hang issue during device reboot (CVE-2025-37933 bsc#1243628)
- commit 44230dd
- kABI: ipv6: save dontfrag in cork (git-fixes).
Patch-up the kABI change with an #ifdef __GENKSYMS__. This change is
safe (as detailed in the patch commit message) due to the struct
having a 6-byte hole at the end we can use.
- commit cbc81e2
- ipv6: save dontfrag in cork (git-fixes).
- commit d3fe600
- tcp: bring back NUMA dispersion in inet_ehash_locks_alloc()
(git-fixes).
- commit 756fa72
- netpoll: hold rcu read lock in __netpoll_send_skb() (git-fixes).
- commit e02eac4
- ipvs: Always clear ipvs_property flag in skb_scrub_packet()
(git-fixes).
- commit d943643
- tcp/dccp: allow a connection when sk_max_ack_backlog is zero
(git-fixes).
- commit 09561a1
- xsk: always clear DMA mapping information when unmapping the
pool (git-fixes).
- commit 9908bc6
- net: sched: fix erspan_opt settings in cls_flower (git-fixes).
- commit fc52734
- spi: spi-imx: Add check for spi_imx_setupxfer() (CVE-2025-37801 bsc#1242850)
- commit f3955e7
- ipmr: fix tables suspicious RCU usage (git-fixes).
- commit d029f0f
- ip6mr: fix tables suspicious RCU usage (git-fixes).
- commit 79bb134
- netpoll: Use rcu_access_pointer() in __netpoll_setup
(git-fixes).
- commit f180c62
- netdev-genl: Hold rcu_read_lock in napi_get (git-fixes).
- commit 895e121
- net/neighbor: clear error in case strict check is not set
(git-fixes).
- commit 9eb711a
- ipv4: Convert ip_route_input() to dscp_t (git-fixes).
- commit 401defe
- net: sched: consistently use rcu_replace_pointer() in
taprio_change() (git-fixes).
- commit a6910eb
- udp: fix receiving fraglist GSO packets (git-fixes).
- commit 5b87500
- net: linkwatch: use system_unbound_wq (git-fixes).
- commit 34d590e
- net: page_pool: fix warning code (git-fixes).
- commit 0d77245
- net: give more chances to rcu in netdev_wait_allrefs_any()
(git-fixes).
- commit a1b1859
- tcp/dccp: complete lockless accesses to sk->sk_max_ack_backlog
(git-fixes).
- commit b96b4a8
- tcp/dccp: bypass empty buckets in inet_twsk_purge() (git-fixes).
- commit afdb9bb
- udp: preserve the connected status if only UDP cmsg (git-fixes).
- commit 8714e3a
- udp: fix incorrect parameter validation in the
udp_lib_getsockopt() function (git-fixes).
- commit 34a2994
- ipmr: fix incorrect parameter validation in the
ip_mroute_getsockopt() function (git-fixes).
- commit f23f4c9
- ip_tunnel: annotate data-races around t->parms.link (git-fixes).
- commit 765e083
- net: add rcu safety to rtnl_prop_list_size() (git-fixes).
- commit 1e0fceb
- net: ipv4: fix a memleak in ip_setup_cork (git-fixes).
- commit 935ac41
- udp: annotate data-races around up->pending (git-fixes).
- commit 72fda93
- ipv4: Correct/silence an endian warning in __ip_do_redirect
(git-fixes).
- commit 011b9c9
- driver core: fix potential NULL pointer dereference in
dev_uevent() (CVE-2025-37800 bsc#1242849).
- driver core: introduce device_set_driver() helper
(CVE-2025-37800 bsc#1242849).
- commit 3aecdc2
- soc: qcom: smp2p: Fix fallback to qcom,ipc parse (git-fixes).
- commit a145886
- wifi: mt76: mt7996: fix RX buffer size of MCU event (git-fixes).
- wifi: mt76: mt7996: set EHT max ampdu length capability
(git-fixes).
- wifi: mt76: mt7925: ensure all MCU commands wait for response
(git-fixes).
- wifi: mt76: mt7925: refine the sniffer commnad (git-fixes).
- wifi: mt76: mt7925: prevent multiple scan commands (git-fixes).
- wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init()
(git-fixes).
- wifi: mt76: mt7925: fix host interrupt register initialization
(git-fixes).
- Revert "wifi: mt76: mt7996: fill txd by host driver"
(stable-fixes).
- wifi: ath9k_htc: Abort software beacon handling if disabled
(git-fixes).
- wifi: ath12k: fix ring-buffer corruption (git-fixes).
- wifi: ath11k: fix rx completion meta data corruption
(git-fixes).
- wifi: ath11k: fix ring-buffer corruption (git-fixes).
- wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()
(git-fixes).
- wifi: rtw88: fix the 'para' buffer size to avoid reading out
of bounds (git-fixes).
- wifi: rtw88: usb: Reduce control message timeout to 500 ms
(git-fixes).
- wifi: rtw89: pci: enlarge retry times of RX tag to 1000
(git-fixes).
- wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID
11ad:1723 (git-fixes).
- wifi: rtw88: do not ignore hardware read error during DPK
(git-fixes).
- wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status
unconditionally (git-fixes).
- wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT
(git-fixes).
- wifi: iwlfiwi: mvm: Fix the rate reporting (git-fixes).
- wifi: ath12k: fix node corruption in ar->arvifs list
(git-fixes).
- wifi: ath12k: Fix the QoS control field offset to build QoS
header (git-fixes).
- commit 3f5d0e4
- wifi: mt76: only mark tx-status-failed frames as ACKed on
mt76x0/2 (stable-fixes).
- commit 0de0b80
- wifi: ath12k: Add MSDU length validation for TKIP MIC error
(git-fixes).
- wifi: ath12k: fix invalid access to memory (git-fixes).
- wifi: ath12k: Fix WMI tag for EHT rate in peer assoc
(git-fixes).
- wifi: ath12k: fix cleanup path after mhi init (git-fixes).
- wifi: ath12k: Fix invalid memory access while forming 802.11
header (git-fixes).
- wifi: ath12k: Fix memory leak during vdev_id mismatch
(git-fixes).
- wifi: ath11k: fix node corruption in ar->arvifs list
(git-fixes).
- watchdog: exar: Shorten identity name to fit correctly
(git-fixes).
- wifi: iwlwifi: add support for Killer on MTL (stable-fixes).
- wifi: mt76: mt7996: revise TXS size (stable-fixes).
- wifi: rtw88: Fix rtw_init_vht_cap() for RTL8814AU
(stable-fixes).
- wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU (stable-fixes).
- wifi: rtw88: Fix rtw_desc_to_mcsrate() to handle MCS16-31
(stable-fixes).
- wifi: rtw89: fw: propagate error code from rtw89_h2c_tx()
(stable-fixes).
- wifi: iwlwifi: fix debug actions order (stable-fixes).
- wifi: ath12k: Report proper tx completion status to mac80211
(stable-fixes).
- wifi: ath12k: Improve BSS discovery with hidden SSID in 6 GHz
band (stable-fixes).
- wifi: ath12k: Avoid napi_sync() before napi_enable()
(stable-fixes).
- wifi: ath12k: fix ath12k_hal_tx_cmd_ext_desc_setup() info1
override (stable-fixes).
- wifi: ath9k: return by of_get_mac_address (stable-fixes).
- wifi: ath12k: Fix end offset bit definition in monitor ring
descriptor (stable-fixes).
- wifi: rtw88: Fix download_firmware_validate() for RTL8814AU
(stable-fixes).
- wifi: rtw88: Fix __rtw_download_firmware() for RTL8814AU
(stable-fixes).
- wifi: rtw88: Don't use static local variable in
rtw8822b_set_tx_power_index_by_rate (stable-fixes).
- wifi: rtw89: add wiphy_lock() to work that isn't held
wiphy_lock() yet (stable-fixes).
- wifi: mac80211: don't unconditionally call drv_mgd_complete_tx()
(stable-fixes).
- wifi: mac80211: remove misplaced drv_mgd_complete_tx() call
(stable-fixes).
- commit 9963350
- vgacon: Add check for vc_origin address range in vgacon_scroll()
(git-fixes).
- soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()
(git-fixes).
- soc: aspeed: lpc: Fix impossible judgment condition (git-fixes).
- spi: sh-msiof: Fix maximum DMA transfer size (git-fixes).
- spi: tegra210-quad: modify chip select (CS) deactivation
(git-fixes).
- spi: tegra210-quad: remove redundant error handling code
(git-fixes).
- spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4
transfers (git-fixes).
- spi: spi-sun4i: fix early activation (stable-fixes).
- spi-rockchip: Fix register out of bounds access (stable-fixes).
- thunderbolt: Do not add non-active NVM if NVM upgrade is
disabled for retimer (stable-fixes).
- usb: xhci: Don't change the status of stalled TDs on failed
Stop EP (stable-fixes).
- serial: sh-sci: Save and restore more registers (git-fixes).
- serial: sh-sci: Update the suspend/resume support
(stable-fixes).
- thermal/drivers/qoriq: Power down TMU on system suspend
(stable-fixes).
- soundwire: amd: change the soundwire wake enable/disable
sequence (stable-fixes).
- soc: ti: k3-socinfo: Do not use syscon helper to build regmap
(stable-fixes).
- spi: zynqmp-gqspi: Always acknowledge interrupts (stable-fixes).
- commit 38d0a8f
- PM: sleep: Print PM debug messages during hibernation
(git-fixes).
- commit 96179c7
- PCI: dw-rockchip: Fix PHY function call sequence in
rockchip_pcie_phy_deinit() (git-fixes).
- PCI: cadence: Fix runtime atomic count underflow (git-fixes).
- PCI: apple: Use gpiod_set_value_cansleep in probe flow
(git-fixes).
- PCI: cadence-ep: Correct PBA offset in .set_msix() callback
(git-fixes).
- PCI: Fix lock symmetry in pci_slot_unlock() (git-fixes).
- PCI: Explicitly put devices into D0 when initializing
(git-fixes).
- PCI/DPC: Initialize aer_err_info before using it (git-fixes).
- selftests/mm: restore default nr_hugepages value during cleanup
in hugetlb_reparenting_test.sh (git-fixes).
- pinctrl: armada-37xx: set GPIO output value before setting
direction (git-fixes).
- pinctrl: armada-37xx: use correct OUTPUT_VAL register for
GPIOs > 31 (git-fixes).
- pinctrl: at91: Fix possible out-of-boundary access (git-fixes).
- selftests/bpf: Fix bpf_nf selftest failure (git-fixes).
- selftests/seccomp: fix syscall_restart test for arm compat
(git-fixes).
- PM: wakeup: Delete space in the end of string shown by
pm_show_wakelocks() (git-fixes).
- power: reset: at91-reset: Optimize at91_reset() (git-fixes).
- regulator: max20086: Change enable gpio to optional (git-fixes).
- regulator: max20086: Fix MAX200086 chip id (git-fixes).
- platform/x86: thinkpad_acpi: Ignore battery threshold change
event notification (stable-fixes).
- platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys
(stable-fixes).
- phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off
(git-fixes).
- phy: renesas: rcar-gen3-usb2: Lock around hardware registers
and driver data (git-fixes).
- phy: renesas: rcar-gen3-usb2: Move IRQ request in probe
(stable-fixes).
- platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS
(stable-fixes).
- pinctrl: meson: define the pull up/down resistor value as 60
kOhm (stable-fixes).
- rtc: rv3032: fix EERD location (stable-fixes).
- rtc: ds1307: stop disabling alarms on probe (stable-fixes).
- phy: core: don't require set_mode() callback for phy_get_mode()
to work (stable-fixes).
- pinctrl: tegra: Fix off by one in tegra_pinctrl_get_group()
(git-fixes).
- pinctrl-tegra: Restore SFSEL bit when freeing pins
(stable-fixes).
- pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned"
(stable-fixes).
- pinctrl: devicetree: do not goto err when probing hogs in
pinctrl_dt_to_map (stable-fixes).
- PCI: dwc: ep: Ensure proper iteration over outbound map windows
(stable-fixes).
- PCI: brcmstb: Expand inbound window size up to 64GB
(stable-fixes).
- PCI: brcmstb: Add a softdep to MIP MSI-X driver (stable-fixes).
- PCI: Fix old_size lower bound in calculate_iosize() too
(stable-fixes).
- selftests/net: have `gro.sh -t` return a correct exit code
(stable-fixes).
- regulator: ad5398: Add device tree support (stable-fixes).
- PCI: vmd: Disable MSI remapping bypass under Xen (stable-fixes).
- phy: renesas: rcar-gen3-usb2: Add support to initialize the bus
(stable-fixes).
- commit 32a9142
- tcp_metrics: optimize tcp_metrics_flush_all() (git-fixes).
- commit 2a9c7bb
- mtd: rawnand: sunxi: Add randomizer configuration in
sunxi_nfc_hw_ecc_write_chunk (git-fixes).
- mtd: nand: sunxi: Add randomizer configuration before randomizer
enable (git-fixes).
- mtd: nand: ecc-mxic: Fix use of uninitialized variable ret
(git-fixes).
- net: phy: mscc: Stop clearing the the UDPv4 checksum for L2
frames (git-fixes).
- net: phy: mscc: Fix memory leak when using one step timestamping
(git-fixes).
- net: phy: clear phydev->devlink when the link is deleted
(git-fixes).
- net: phy: fix up const issues in to_mdio_device() and
to_phy_device() (git-fixes).
- net: usb: aqc111: fix error handling of usbnet read calls
(git-fixes).
- mmc: host: Wait for Vdd to settle on card power off
(stable-fixes).
- mmc: dw_mmc: add exynos7870 DW MMC support (stable-fixes).
- commit eedda90
- mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE
(git-fixes).
- mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice
in exynos_lpass_remove() (git-fixes).
- media: uvcvideo: Fix deferred probing error (git-fixes).
- media: uvcvideo: Return the number of processed controls
(git-fixes).
- media: omap3isp: use sgtable-based scatterlist wrappers
(git-fixes).
- media: videobuf2: use sgtable-based scatterlist wrappers
(git-fixes).
- media: v4l2-dev: fix error handling in __video_register_device()
(git-fixes).
- media: ov8856: suppress probe deferral errors (git-fixes).
- media: ov5675: suppress probe deferral errors (git-fixes).
- media: nxp: imx8-isi: better handle the m2m usage_count
(git-fixes).
- media: gspca: Add error handling for stv06xx_read_sensor()
(git-fixes).
- media: davinci: vpif: Fix memory leak in probe error path
(git-fixes).
- media: vivid: Change the siize of the composing (git-fixes).
- media: cxusb: no longer judge rbuf when the write fails
(git-fixes).
- media: vidtv: Terminating the subsequent process of
initialization failure (git-fixes).
- media: ccs-pll: Correct the upper limit of maximum
op_pre_pll_clk_div (git-fixes).
- media: ccs-pll: Check for too high VT PLL multiplier in dual
PLL case (git-fixes).
- media: ccs-pll: Start VT pre-PLL multiplier search from correct
value (git-fixes).
- media: ccs-pll: Start OP pre-PLL multiplier search from correct
value (git-fixes).
- media: imx-jpeg: Cleanup after an allocation error (git-fixes).
- media: imx-jpeg: Reset slot data pointers when freed
(git-fixes).
- media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead
(git-fixes).
- media: imx-jpeg: Drop the first error frames (git-fixes).
- media: venus: Fix probe error handling (git-fixes).
- media: rkvdec: Fix frame size enumeration (git-fixes).
- mfd: tps65219: Remove TPS65219_REG_TI_DEV_ID check
(stable-fixes).
- media: c8sectpfe: Call of_node_put(i2c_bus) only once in
c8sectpfe_probe() (stable-fixes).
- media: cx231xx: set device_caps for 417 (stable-fixes).
- media: uvcvideo: Add sanity check to uvc_ioctl_xu_ctrl_map
(stable-fixes).
- media: uvcvideo: Handle uvc menu translation inside
uvc_get_le_value (stable-fixes).
- media: adv7180: Disable test-pattern control on adv7180
(stable-fixes).
- media: tc358746: improve calculation of the D-PHY timing
registers (stable-fixes).
- media: test-drivers: vivid: don't call schedule in loop
(stable-fixes).
- media: i2c: imx219: Correct the minimum vblanking value
(stable-fixes).
- media: v4l: Memset argument to 0 before calling get_mbus_config
pad op (stable-fixes).
- media: qcom: camss: csid: Only add TPG v4l2 ctrl if TPG hardware
is available (stable-fixes).
- mmc: sdhci: Disable SD card clock before changing parameters
(stable-fixes).
- commit de6c9a2
- Input: gpio-keys - fix possible concurrent access in
gpio_keys_irq_timer() (git-fixes).
- commit e29f865
- hwmon: (asus-ec-sensors) check sensor index in read_string()
(git-fixes).
- Input: ims-pcu - check record size in ims_pcu_flash_firmware()
(git-fixes).
- firmware: psci: Fix refcount leak in psci_dt_init (git-fixes).
- gpiolib: Revert "Don't WARN on gpiod_put() for optional GPIO"
(stable-fixes).
- Input: xpad - add more controllers (stable-fixes).
- gpio: pca953x: fix IRQ storm on system wake up (git-fixes).
- HID: quirks: Add ADATA XPG alpha wireless mouse support
(stable-fixes).
- intel_th: avoid using deprecated page->mapping, index fields
(stable-fixes).
- ima: process_measurement() needlessly takes inode_lock()
on MAY_READ (stable-fixes).
- i3c: master: svc: Fix implicit fallthrough in
svc_i3c_master_ibi_work() (git-fixes).
- i3c: master: svc: Fix missing STOP for master request
(stable-fixes).
- i3c: master: svc: Flush FIFO before sending Dynamic Address
Assignment(DAA) (stable-fixes).
- i2c: qup: Vote for interconnect bandwidth to DRAM
(stable-fixes).
- i2c: pxa: fix call balance of i2c->clk handling routines
(stable-fixes).
- fpga: altera-cvp: Increase credit timeout (stable-fixes).
- mailbox: use error ret code of of_parse_phandle_with_args()
(stable-fixes).
- leds: pwm-multicolor: Add check for fwnode_property_read_u32
(stable-fixes).
- firmware: arm_ffa: Set dma_mask for ffa devices (stable-fixes).
- firmware: arm_ffa: Reject higher major version as incompatible
(stable-fixes).
- ieee802154: ca8210: Use proper setters and getters for bitwise
types (stable-fixes).
- HID: usbkbd: Fix the bit shift number for LED_KANA
(stable-fixes).
- hwmon: (dell-smm) Increment the number of fans (stable-fixes).
- hwmon: (gpio-fan) Add missing mutex locks (stable-fixes).
- hwmon: (xgene-hwmon) use appropriate type for the latency value
(stable-fixes).
- gpio: pca953x: Simplify code with cleanup helpers
(stable-fixes).
- gpio: pca953x: Split pca953x_restore_context() and
pca953x_save_context() (stable-fixes).
- commit 50f84af
- fbdev: Fix fb_set_var to prevent null-ptr-deref in
fb_videomode_to_var (git-fixes).
- fbdev: Fix do_register_framebuffer to prevent null-ptr-deref
in fb_videomode_to_var (git-fixes).
- fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()
(git-fixes).
- drm/msm/gpu: Fix crash when throttling GPU immediately during
boot (git-fixes).
- drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components
on err (git-fixes).
- drm/mediatek: Fix kobject put for component sub-drivers
(git-fixes).
- drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device
ptr (git-fixes).
- Revert "drm/amdgpu: don't allow userspace to create a doorbell
BO" (stable-fixes).
- drm/amd/pp: Fix potential NULL pointer dereference in
atomctrl_initialize_mc_reg_table (git-fixes).
- drm/tegra: Fix a possible null pointer dereference (git-fixes).
- drm/tegra: rgb: Fix the unbound reference count (git-fixes).
- drm/tegra: Assign plane type before registration (git-fixes).
- drm/vkms: Adjust vkms_state->active_planes allocation type
(git-fixes).
- drm: rcar-du: Fix memory leak in rcar_du_vsps_init()
(git-fixes).
- drm/bridge: lt9611uxc: Fix an error handling path in
lt9611uxc_probe() (git-fixes).
- drm/panel: samsung-sofef00: Drop s6e3fc2x01 support (git-fixes).
- drm/ast: Fix comment on modeset lock (git-fixes).
- drm/vc4: tests: Use return instead of assert (git-fixes).
- drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready
(git-fixes).
- drm/bridge: cdns-dsi: Check return value when getting default
PHY config (git-fixes).
- drm/bridge: cdns-dsi: Fix the clock variable for mode_valid()
(git-fixes).
- drm/bridge: cdns-dsi: Fix phy de-init and flag it so
(git-fixes).
- drm/bridge: cdns-dsi: Fix connecting to next bridge (git-fixes).
- drm/udl: Unregister device before cleaning up on disconnect
(git-fixes).
- drm/vmwgfx: Add seqno waiter for sync_files (git-fixes).
- Documentation/rtla: Fix typo in common_timerlat_description.rst
(git-fixes).
- Documentation/rtla: Fix typo in rtla-timerlat.rst (git-fixes).
- drm/amd/display: fix link_set_dpms_off multi-display MST corner
case (stable-fixes).
- drm/amd/display: Guard against setting dispclk low for dcn31x
(stable-fixes).
- drm/amdgpu: Update SRIOV video codec caps (stable-fixes).
- drm/amd/display: remove minimum Dispclk and apply oem panel
timing (stable-fixes).
- drm/amd/display: Fix incorrect DPCD configs while Replay/PSR
switch (stable-fixes).
- drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence
(stable-fixes).
- drm/amdkfd: Set per-process flags only once cik/vi
(stable-fixes).
- drm/amdgpu: Do not program AGP BAR regs under SRIOV in
gfxhub_v1_0.c (stable-fixes).
- drm/amd/display: Skip checking FRL_MODE bit for PCON BW
determination (stable-fixes).
- drm/amdkfd: KFD release_work possible circular locking
(stable-fixes).
- drm/rockchip: vop2: Add uv swap for cluster window
(stable-fixes).
- drm/amdgpu: Set snoop bit for SDMA for MI series (stable-fixes).
- drm/amd/display: Don't try AUX transactions on disconnected link
(stable-fixes).
- drm/amdgpu: reset psp->cmd to NULL after releasing the buffer
(stable-fixes).
- drm/amd/display: Update CR AUX RD interval interpretation
(stable-fixes).
- drm/amd/display: Initial psr_version with correct setting
(stable-fixes).
- drm/amd/display: Increase block_sequence array size
(stable-fixes).
- drm/amdgpu: enlarge the VBIOS binary size limit (stable-fixes).
- drm/amd/display/dm: drop hw_support check in
amdgpu_dm_i2c_xfer() (stable-fixes).
- drm/v3d: Add clock handling (stable-fixes).
- drm/ast: Find VBIOS mode from regular display size
(stable-fixes).
- drm: bridge: adv7511: fill stream capabilities (stable-fixes).
- drm/atomic: clarify the rules around
drm_atomic_state->allow_modeset (stable-fixes).
- drm/panel-edp: Add Starry 116KHD024006 (stable-fixes).
- drm: Add valid clones check (stable-fixes).
- fbdev: fsl-diu-fb: add missing device_remove_file()
(stable-fixes).
- fbcon: Use correct erase colour for clearing in fbcon
(stable-fixes).
- fbdev: core: tileblit: Implement missing margin clearing for
tileblit (stable-fixes).
- firmware: arm_scmi: Relax duplicate name constraint across
protocol ids (stable-fixes).
- commit 0574d41
- Documentation/rtla: Fix duplicate text about timerlat tracer
(git-fixes).
- crypto: marvell/cesa - Do not chain submitted requests
(git-fixes).
- crypto: sun8i-ce - move fallback ahash_request to the end of
the struct (git-fixes).
- crypto: xts - Only add ecb if it is not already there
(git-fixes).
- crypto: lrw - Only add ecb if it is not already there
(git-fixes).
- crypto: marvell/cesa - Avoid empty transfer descriptor
(git-fixes).
- crypto: marvell/cesa - Handle zero-length skcipher requests
(git-fixes).
- crypto: sun8i-ss - do not use sg_dma_len before calling DMA
functions (git-fixes).
- Documentation: fix typo in root= kernel parameter description
(git-fixes).
- dmaengine: idxd: cdev: Fix uninitialized use of sva in
idxd_cdev_open (stable-fixes).
- commit 8e41cce
- backlight: pm8941: Add NULL check in wled_configure()
(git-fixes).
- bus: fsl-mc: fix GET/SET_TAILDROP command ids (git-fixes).
- bus: fsl-mc: do not add a device-link for the UAPI used DPMCP
device (git-fixes).
- bus: fsl-mc: fix double-free on mc_dev (git-fixes).
- Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect
devices first" (stable-fixes).
- Bluetooth: MGMT: iterate over mesh commands in
mgmt_mesh_foreach() (git-fixes).
- ASoC: qcom: sdm845: Add error handling in
sdm845_slim_snd_hw_params() (git-fixes).
- ASoC: apple: mca: Constrain channels according to TDM mask
(git-fixes).
- ASoC: SOF: ipc4-pcm: Adjust pipeline_list->pipelines allocation
type (git-fixes).
- crypto: sun8i-ce-cipher - fix error handling in
sun8i_ce_cipher_prepare() (git-fixes).
- crypto: qat - add shutdown handler to qat_420xx (git-fixes).
- crypto: qat - add shutdown handler to qat_4xxx (git-fixes).
- crypto: octeontx2 - suppress auth failure screaming due to
negative tests (stable-fixes).
- crypto: lzo - Fix compression buffer overrun (stable-fixes).
- crypto: skcipher - Zap type in crypto_alloc_sync_skcipher
(stable-fixes).
- can: c_can: Use of_property_present() to test existence of DT
property (stable-fixes).
- commit 595e083
- ASoC: meson: meson-card-utils: use of_property_present()
for DT parsing (git-fixes).
- ASoC: tas2764: Enable main IRQs (git-fixes).
- ASoC: tas2764: Reinit cache on part reset (git-fixes).
- ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013
(stable-fixes).
- ASoC: imx-card: Adjust over allocation of memory in
imx_card_parse_of() (stable-fixes).
- ASoC: mediatek: mt6359: Add stub for
mt6359_accdet_enable_jack_detect (stable-fixes).
- ASoC: sun4i-codec: support hp-det-gpios property (stable-fixes).
- ASoC: qcom: sm8250: explicitly set format in
sm8250_be_hw_params_fixup() (stable-fixes).
- ASoC: mediatek: mt8188: Treat DMIC_GAINx_CUR as non-volatile
(stable-fixes).
- ASoC: mediatek: mt8188: Add reference for dmic clocks
(stable-fixes).
- commit 255f2cb
- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14ASP10
(stable-fixes).
- ALSA: pcm: Fix race of buffer access at PCM OSS layer
(stable-fixes).
- ALSA: hda/realtek: Add quirk for HP Spectre x360 15-df1xxx
(stable-fixes).
- ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot()
(stable-fixes).
- ASoC: tas2764: Add reg defaults for TAS2764_INT_CLK_CFG
(stable-fixes).
- ASoC: tas2764: Mark SW_RESET as volatile (stable-fixes).
- ASoC: tas2764: Power up/down amp on mute ops (stable-fixes).
- ASoC: ops: Enforce platform maximum on initial value
(stable-fixes).
- ASoC: codecs: pcm3168a: Allow for 24-bit in provider mode
(stable-fixes).
- ASoC: rt722-sdca: Add some missing readable registers
(stable-fixes).
- commit ab5fcf6
- kABI workaround for hda_codec.beep_just_power_on flag
(git-fixes).
- commit 11aaa35
- acpi-cpufreq: Fix nominal_freq units to KHz in
get_max_boost_ratio() (git-fixes).
- ACPICA: Utilities: Fix spelling mistake "Incremement" ->
"Increment" (git-fixes).
- ACPICA: exserial: don't forget to handle FFixedHW opregions
for reading (git-fixes).
- ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions"
(git-fixes).
- ACPI: PNP: Add Intel OC Watchdog IDs to non-PNP device list
(stable-fixes).
- accel/qaic: Mask out SR-IOV PCI resources (stable-fixes).
- ALSA: seq: Improve data consistency at polling (stable-fixes).
- ALSA: hda/realtek: Enable PC beep passthrough for HP EliteBook
855 G7 (stable-fixes).
- ACPI: HED: Always initialize before evged (stable-fixes).
- commit 6ebe577
- net: ethernet: mtk-star-emac: fix spinlock recursion issues
on rx/tx poll (CVE-2025-37917 bsc#1243475).
- commit 0f659f2
- usb: typec: ucsi: limit the UCSI_NO_PARTNER_PDOS even further
(git-fixes).
- commit bae0091
- usb: typec: ucsi: allow non-partner GET_PDOS for Qualcomm
devices (git-fixes).
- commit a0506dd
- usb: typec: ucsi: Only enable supported notifications
(git-fixes).
- commit 3a52706
- usb: typec: ucsi: fix UCSI on buggy Qualcomm devices
(git-fixes).
- commit 5ca6578
- platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys
(git-fixes).
- commit 1564858
- platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS
(git-fixes).
- commit 2bfd2a7
- pstore: Change kmsg_bytes storage size to u32 (git-fixes).
- commit c964f36
- orangefs: Do not truncate file size (git-fixes).
- commit 9fbe3ae
- NFSv4: Check for delegation validity in
nfs_start_delegation_return_locked() (git-fixes).
- commit a689f10
- NFS: Don't allow waiting for exiting tasks (git-fixes).
- Refresh
patches.suse/nfs-add-missing-selections-of-CONFIG_CRC32.patch.
- commit 899f47c
- SUNRPC: Don't allow waiting for exiting tasks (git-fixes).
- commit 8b942ca
- NFSv4: Treat ENETUNREACH errors as fatal for state recovery
(git-fixes).
- commit 9139fd5
- SUNRPC: rpc_clnt_set_transport() must not change the autobind
setting (git-fixes).
- commit e2112a4
- SUNRPC: rpcbind should never reset the port to the value '0'
(git-fixes).
- commit f49c9db
- pNFS/flexfiles: Report ENETDOWN as a connection error
(git-fixes).
- commit 39e7a29
- iommu: Protect against overflow in iommu_pgsize() (git-fixes).
- commit 6adbec5
- ext4: define ext4_journal_destroy wrapper (CVE-2025-22113
bsc#1241617).
- commit 8dddf47
- ext4: ignore xattrs past end (bsc#1242846 CVE-2025-37738).
- commit 2a74454
- ext4: avoid journaling sb update on error if journal is
destroying (bsc#1241617 CVE-2025-22113).
- commit 0445179
- xhci: dbc: Avoid event polling busyloop if pending rx transfers
are inactive (git-fixes).
- commit 7bb46ec
- usb: misc: onboard_usb_dev: fix support for Cypress HX3 hubs
(git-fixes).
- commit b84bbc1
- net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving
proposal msg (CVE-2024-49568 bsc#1235728).
- commit a7c2f15
- i2c: tegra: check msg length in SMBUS block read (bsc#1242086)
- commit 625407a
- iio: light: opt3001: fix deadlock due to concurrent flag access (CVE-2025-37968 bsc#1243571)
- commit 0e5e655
- perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value (CVE-2025-37936 bsc#1243537)
- commit 2e13950
- net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY (CVE-2025-37945 bsc#1243538)
- commit efc17f3
- pds_core: Prevent possible adminq overflow/stuck condition (CVE-2025-37987 bsc#1243542)
- commit ba1ea39
- SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls
(git-fixes).
- commit dc6e86f
- Refresh
patches.suse/nfs-ignore-SB_RDONLY-when-remounting-nfs.patch.
- commit 359f356
- Refresh
patches.suse/nfs-clear-SB_RDONLY-before-getting-superblock.patch.
- commit 2697e51
- fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio()
(git-fixes).
- commit fcf1703
- powerpc/pseries/msi: Avoid reading PCI device registers in
reduced power states (bsc#1215199).
- KVM: powerpc: Enable commented out BUILD_BUG_ON() assertion
(bsc#1215199).
- commit 2d2709b
- IB/cm: Drop lockdep assert and WARN when freeing old msg (git-fixes)
- commit 80fb173
- Update patches.suse/nfsd-Fix-race-to-FREE_STATEID-and-cl_revoked.patch
(bsc#1012628 CVE-2024-50106 bsc#1232882).
- commit a87a308
- iommu/tegra241-cmdqv: Fix warnings due to dmam_free_coherent()
(CVE-2025-37837 bsc#1242952).
- commit 0f31b68
- net: ngbe: fix memory leak in ngbe_probe() error path (CVE-2025-37874 bsc#1242940)
- commit bc2e64d
- smb: client: fix hang in wait_for_response() for negproto
(bsc#1242709).
- commit 709cb2e
- net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported (CVE-2025-37865 bsc#1242954)
- commit 885d04c
- HID: pidff: Fix null pointer dereference in pidff_find_fields (CVE-2025-37862 bsc#1242982)
- commit f9d615e
- usb: chipidea: ci_hdrc_imx: fix usbmisc handling (CVE-2025-37811 bsc#1242907)
- commit 1f2ed79
- mptcp: fix 'scheduling while atomic' in
mptcp_pm_nl_append_new_local_addr (git-fixes CVE-2025-21938
bsc#1240723).
- commit 02ff1ac
- usb: typec: ucsi: displayport: Fix deadlock (bsc#1243572
CVE-2025-37967).
- commit 59ea04d
- kABI workaround for adding an header (CVE-2025-21868
bsc#1240180).
- commit 8687a45
- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes
for IO add (bsc#1243042 ltc#212167).
- commit a5aefbc
- cifs: avoid NULL pointer dereference in dbg call (CVE-2025-37844 bsc#1242946)
- commit 031bdce
- Update
patches.suse/ASoC-simple-card-utils-Fix-pointer-check-in-graph_ut.patch
(git-fixes CVE-2025-37934 bsc#1243548).
- Update
patches.suse/accel-ivpu-Fix-PM-related-deadlocks-in-MS-IOCTLs.patch
(git-fixes CVE-2025-37848 bsc#1242943).
- Update
patches.suse/accel-ivpu-Fix-deadlock-in-ivpu_ms_cleanup.patch
(git-fixes CVE-2025-37847 bsc#1242947).
- Update
patches.suse/arm64-bpf-Add-BHB-mitigation-to-the-epilogue-for-cBP.patch
(bsc#1242778 CVE-2025-37948 bsc#1243649).
- Update
patches.suse/arm64-bpf-Only-mitigate-cBPF-programs-loaded-by-unpr.patch
(bsc#1242778 CVE-2025-37963 bsc#1243660).
- Update
patches.suse/drm-imagination-fix-firmware-memory-leaks.patch
(git-fixes CVE-2025-37764 bsc#1242577).
- Update
patches.suse/drm-imagination-take-paired-job-reference.patch
(git-fixes CVE-2025-37763 bsc#1242508).
- Update
patches.suse/drm-xe-Fix-an-out-of-bounds-shift-when-invalidating-.patch
(git-fixes CVE-2025-37761 bsc#1242724).
- Update
patches.suse/drm-xe-Use-local-fence-in-error-path-of-xe_migrate_c.patch
(git-fixes CVE-2025-37869 bsc#1242967).
- Update
patches.suse/drm-xe-userptr-fix-notifier-vs-folio-deadlock.patch
(git-fixes CVE-2025-37868 bsc#1242966).
- Update
patches.suse/drm-xe-vf-Don-t-try-to-trigger-a-full-GT-reset-if-VF.patch
(stable-fixes CVE-2025-23162 bsc#1242834).
- Update
patches.suse/ethtool-cmis_cdb-use-correct-rpl-size-in-ethtool_cmi.patch
(git-fixes CVE-2025-37791 bsc#1242729).
- Update
patches.suse/mei-vsc-Fix-fortify-panic-caused-by-invalid-counted_.patch
(git-fixes CVE-2025-37816 bsc#1242863).
- Update
patches.suse/net-mlx5-Fix-null-ptr-deref-in-mlx5_create_-inner_-t.patch
(git-fixes CVE-2025-37888 bsc#1242964).
- Update
patches.suse/s390-pci-Fix-duplicate-pci_dev_put-in-disable_slot-w.patch
(git-fixes CVE-2025-37946 bsc#1243506).
- Update
patches.suse/scsi-mpi3mr-Synchronous-access-b-w-reset-and-tm-thre.patch
(bsc#1241388 CVE-2025-37861 bsc#1243055).
- Update
patches.suse/scsi-smartpqi-Use-is_kdump_kernel-to-check-for-kdump.patch
(git-fixes CVE-2025-37981 bsc#1243514).
- Update
patches.suse/tty-Require-CAP_SYS_ADMIN-for-all-usages-of-TIOCL_SE.patch
(git-fixes CVE-2025-37814 bsc#1242865).
- Update
patches.suse/usb-xhci-Don-t-skip-on-Stopped-Length-Invalid.patch
(git-fixes CVE-2025-22023 bsc#1241298).
- Update
patches.suse/usb-xhci-Fix-invalid-pointer-dereference-in-Etron-wo.patch
(git-fixes CVE-2025-37813 bsc#1242909).
- commit ba2a725
- Update
patches.suse/ALSA-ump-Fix-buffer-overflow-at-UMP-SysEx-message-co.patch
(bsc#1242044 CVE-2025-37891 bsc#1243589).
- Update
patches.suse/ASoC-Intel-avs-Fix-null-ptr-deref-in-avs_component_p.patch
(git-fixes CVE-2025-37793 bsc#1242584).
- Update
patches.suse/ASoC-imx-card-Add-NULL-check-in-imx_card_probe.patch
(git-fixes CVE-2025-22066 bsc#1241340).
- Update
patches.suse/ASoC-ops-Consistently-treat-platform_max-as-control-.patch
(git-fixes CVE-2025-37889 bsc#1242945).
- Update
patches.suse/ASoC-qcom-Fix-sc7280-lpass-potential-buffer-overflow.patch
(git-fixes CVE-2025-37979 bsc#1243545).
- Update
patches.suse/Bluetooth-btrtl-Prevent-potential-NULL-dereference.patch
(git-fixes CVE-2025-37792 bsc#1242591).
- Update
patches.suse/Bluetooth-btusb-avoid-NULL-pointer-dereference-in-sk.patch
(git-fixes CVE-2025-37918 bsc#1243476).
- Update
patches.suse/Input-mtk-pmic-keys-fix-possible-null-pointer-derefe.patch
(git-fixes CVE-2025-37972 bsc#1243573).
- Update
patches.suse/KVM-arm64-Tear-down-vGIC-on-failed-vCPU-creation.patch
(git-fixes CVE-2025-37849 bsc#1243000).
- Update
patches.suse/KVM-x86-Acquire-SRCU-in-KVM_GET_MP_STATE-to-protect-.patch
(git-fixes CVE-2025-23141 bsc#1242782).
- Update
patches.suse/PCI-Fix-reference-leak-in-pci_register_host_bridge.patch
(git-fixes CVE-2025-37836 bsc#1242957).
- Update
patches.suse/PCI-brcmstb-Fix-error-path-after-a-call-to-regulator.patch
(git-fixes CVE-2025-22095 bsc#1241519).
- Update
patches.suse/PCI-vmd-Make-vmd_dev-cfg_lock-a-raw_spinlock_t-type.patch
(stable-fixes CVE-2025-23161 bsc#1242792).
- Update
patches.suse/RDMA-cma-Fix-workqueue-crash-in-cma_netevent_work_ha.patch
(git-fixes CVE-2025-37772 bsc#1242563).
- Update
patches.suse/RDMA-core-Don-t-expose-hw_counters-outside-of-init-n.patch
(git-fixes bsc#1239925 CVE-2025-22089 bsc#1241538).
- Update
patches.suse/RDMA-core-Silence-oversized-kvmalloc-warning.patch
(git-fixes CVE-2025-37867 bsc#1242948).
- Update
patches.suse/USB-wdm-close-race-between-wdm_open-and-wdm_wwan_por.patch
(git-fixes CVE-2025-37985 bsc#1243529).
- Update
patches.suse/arm64-bpf-Add-BHB-mitigation-to-the-epilogue-for-cBPF-prog.patch
(git-fixes CVE-2025-37948 bsc#1243649).
- Update
patches.suse/arm64-bpf-Only-mitigate-cBPF-programs-loaded-by-unprivileg.patch
(git-fixes CVE-2025-37963 bsc#1243660).
- Update
patches.suse/arm64-errata-Add-missing-sentinels-to-Spectre-BHB-MIDR-arr.patch
(git-fixes CVE-2025-37929 bsc#1243624).
- Update
patches.suse/ata-pata_pxa-Fix-potential-NULL-pointer-dereference-.patch
(git-fixes CVE-2025-37758 bsc#1242514).
- Update
patches.suse/backlight-led_bl-Hold-led_access-lock-when-calling-l.patch
(git-fixes CVE-2025-23144 bsc#1242568).
- Update
patches.suse/block-fix-resource-leak-in-blk_register_queue-error-path.patch
(git-fixes CVE-2025-37980 bsc#1243522).
- Update
patches.suse/block-integrity-Do-not-call-set_page_dirty_lock.patch
(git-fixes CVE-2025-37978 bsc#1243516).
- Update
patches.suse/bnxt_en-Fix-out-of-bound-memcpy-during-ethtool-w.patch
(git-fixes CVE-2025-37911 bsc#1243469).
- Update patches.suse/bpf-Scrub-packet-on-bpf_redirect_peer.patch
(git-fixes CVE-2025-37959 bsc#1243517).
- Update
patches.suse/bpf-check-changes_pkt_data-property-for-extension-pr.patch
(bsc#1241590 CVE-2024-58100 bsc#1242564).
- Update
patches.suse/bpf-consider-that-tail-calls-invalidate-packet-point.patch
(bsc#1241590 CVE-2024-58237 bsc#1242574).
- Update
patches.suse/bpf-track-changes_pkt_data-property-for-global-funct.patch
(bsc#1241590 CVE-2024-58098 bsc#1242565).
- Update
patches.suse/btrfs-adjust-subpage-bit-start-based-on-sectorsize.patch
(bsc#1241492 CVE-2025-37931 bsc#1243626).
- Update
patches.suse/bus-mhi-host-Fix-race-between-unprepare-and-queue_bu.patch
(git-fixes CVE-2025-23151 bsc#1242512).
- Update
patches.suse/cxgb4-fix-memory-leak-in-cxgb4_init_ethtool_filters-.patch
(git-fixes CVE-2025-37788 bsc#1242766).
- Update
patches.suse/dm-bufio-don-t-schedule-in-atomic-context.patch
(git-fixes CVE-2025-37928 bsc#1243621).
- Update
patches.suse/drm-amd-display-Fix-slab-use-after-free-in-hdcp.patch
(git-fixes CVE-2025-37903 bsc#1243562).
- Update
patches.suse/drm-amd-pm-Prevent-division-by-zero-4b8c3c0.patch
(git-fixes CVE-2025-37770 bsc#1242764).
- Update
patches.suse/drm-amd-pm-Prevent-division-by-zero-4e3d950.patch
(git-fixes CVE-2025-37766 bsc#1242785).
- Update
patches.suse/drm-amd-pm-Prevent-division-by-zero-7c246a0.patch
(git-fixes CVE-2025-37768 bsc#1242567).
- Update
patches.suse/drm-amd-pm-Prevent-division-by-zero-7d641c2.patch
(git-fixes CVE-2025-37771 bsc#1242781).
- Update patches.suse/drm-amd-pm-Prevent-division-by-zero.patch
(git-fixes CVE-2025-37767 bsc#1242501).
- Update
patches.suse/drm-amd-pm-smu11-Prevent-division-by-zero.patch
(git-fixes CVE-2025-37769 bsc#1242587).
- Update
patches.suse/drm-amdgpu-Replace-Mutex-with-Spinlock-for-RLCG-regi.patch
(git-fixes CVE-2025-38104 bsc#1241635).
- Update
patches.suse/drm-amdgpu-handle-amdgpu_cgs_create_device-errors-in.patch
(stable-fixes CVE-2025-37852 bsc#1243074).
- Update patches.suse/drm-amdkfd-Fix-mode1-reset-crash-issue.patch
(stable-fixes CVE-2025-37854 bsc#1243082).
- Update
patches.suse/drm-amdkfd-debugfs-hang_hws-skip-GPU-with-MES.patch
(stable-fixes CVE-2025-37853 bsc#1243076).
- Update
patches.suse/drm-i915-huc-Fix-fence-not-released-on-early-probe-e.patch
(git-fixes CVE-2025-37754 bsc#1242524).
- Update
patches.suse/drm-mediatek-dp-drm_err-dev_err-in-HPD-path-to-avoid.patch
(git-fixes CVE-2025-38240 bsc#1241457).
- Update
patches.suse/drm-nouveau-Fix-WARN_ON-in-nouveau_fence_context_kil.patch
(git-fixes CVE-2025-37930 bsc#1243625).
- Update
patches.suse/drm-nouveau-prime-fix-ttm_bo_delayed_delete-oops.patch
(git-fixes CVE-2025-37765 bsc#1242761).
- Update
patches.suse/drm-v3d-Add-job-to-pending-list-if-the-reset-was-ski.patch
(stable-fixes CVE-2025-37951 bsc#1243659).
- Update
patches.suse/eth-bnxt-fix-missing-ring-index-trim-on-error-path.patch
(git-fixes CVE-2025-37873 bsc#1242961).
- Update patches.suse/fbdev-omapfb-Add-plane-value-check.patch
(stable-fixes CVE-2025-37851 bsc#1242977).
- Update
patches.suse/firmware-arm_scmi-Balance-device-refcount-when-destr.patch
(git-fixes CVE-2025-37905 bsc#1243456).
- Update
patches.suse/fs-jfs-Prevent-integer-overflow-in-AG-size-calculation.patch
(git-fixes CVE-2025-37858 bsc#1243049).
- Update
patches.suse/hfs-hfsplus-fix-slab-out-of-bounds-in-hfs_bnode_read_key.patch
(git-fixes CVE-2025-37782 bsc#1242770).
- Update
patches.suse/i2c-cros-ec-tunnel-defer-probe-if-parent-EC-is-not-p.patch
(git-fixes CVE-2025-37781 bsc#1242575).
- Update
patches.suse/i3c-Add-NULL-pointer-check-in-i3c_master_queue_ibi.patch
(git-fixes CVE-2025-23147 bsc#1242530).
- Update
patches.suse/ice-Check-VF-VSI-Pointer-Value-in-ice_vc_add_fdir_fl.patch
(git-fixes CVE-2025-37912 bsc#1243470).
- Update patches.suse/igc-fix-PTM-cycle-trigger-logic.patch
(git-fixes CVE-2025-37875 bsc#1242959).
- Update
patches.suse/iio-imu-st_lsm6dsx-fix-possible-lockup-in-st_lsm6dsx-8114ef8.patch
(git-fixes CVE-2025-37969 bsc#1243574).
- Update
patches.suse/iio-imu-st_lsm6dsx-fix-possible-lockup-in-st_lsm6dsx.patch
(git-fixes CVE-2025-37970 bsc#1243575).
- Update
patches.suse/iommu-Fix-two-issues-in-iommu_copy_struct_from_user.patch
(git-fixes CVE-2025-37900 bsc#1243560).
- Update
patches.suse/ipv6-Fix-memleak-of-nhc_pcpu_rth_output-in-fib_check_nh_v6_gw.patch
(git-fixes CVE-2025-22005 bsc#1240866).
- Update
patches.suse/irqchip-gic-v2m-Prevent-use-after-free-of-gicv2m_get.patch
(git-fixes CVE-2025-37819 bsc#1242873).
- Update
patches.suse/irqchip-qcom-mpm-Prevent-crash-when-trying-to-handle.patch
(git-fixes CVE-2025-37901 bsc#1243559).
- Update patches.suse/jbd2-remove-wrong-sb-s_sequence-check.patch
(bsc#1242343 CVE-2025-37839 bsc#1242990).
- Update
patches.suse/jfs-Fix-uninit-value-access-of-imap-allocated-in-the-diMount-function.patch
(git-fixes CVE-2025-37742 bsc#1243011).
- Update
patches.suse/jfs-Prevent-copying-of-nlink-with-value-0-from-disk-inode.patch
(git-fixes CVE-2025-37741 bsc#1243015).
- Update
patches.suse/jfs-add-sanity-check-for-agwidth-in-dbMount.patch
(git-fixes CVE-2025-37740 bsc#1243006).
- Update
patches.suse/jfs-fix-slab-out-of-bounds-read-in-ea_get.patch
(git-fixes CVE-2025-39735 bsc#1241625).
- Update
patches.suse/jfs-reject-on-disk-inodes-of-an-unsupported-type.patch
(git-fixes CVE-2025-37925 bsc#1241654).
- Update
patches.suse/md-md-bitmap-fix-wrong-bitmap_limit-for-clustermd-wh.patch
(bsc#1238212 CVE-2025-22124 bsc#1241595).
- Update
patches.suse/media-dw2102-Fix-null-ptr-deref-in-dw2102_i2c_transf.patch
(git-fixes CVE-2023-53146 bsc#1220112).
- Update
patches.suse/media-venus-hfi-add-a-check-to-handle-OOB-in-sfr-reg.patch
(git-fixes CVE-2025-23159 bsc#1242529).
- Update
patches.suse/media-venus-hfi-add-check-to-handle-incorrect-queue-.patch
(git-fixes CVE-2025-23158 bsc#1242531).
- Update
patches.suse/media-venus-hfi_parser-add-check-to-avoid-out-of-bou.patch
(git-fixes CVE-2025-23157 bsc#1242532).
- Update
patches.suse/media-venus-hfi_parser-refactor-hfi-packet-parsing-l.patch
(git-fixes CVE-2025-23156 bsc#1242569).
- Update
patches.suse/mfd-ene-kb3930-Fix-a-potential-NULL-pointer-derefere.patch
(git-fixes CVE-2025-23146 bsc#1242559).
- Update
patches.suse/misc-microchip-pci1xxxx-Fix-Kernel-panic-during-IRQ-.patch
(git-fixes CVE-2025-37815 bsc#1242871).
- Update
patches.suse/mtd-inftlcore-Add-error-check-for-inftl_read_oob.patch
(git-fixes CVE-2025-37892 bsc#1243536).
- Update
patches.suse/mtd-rawnand-brcmnand-fix-PM-resume-warning.patch
(git-fixes CVE-2025-37840 bsc#1242953).
- Update patches.suse/net-phy-leds-fix-memory-leak.patch
(git-fixes CVE-2025-37989 bsc#1243511).
- Update
patches.suse/net-reenable-NETIF_F_IPV6_CSUM-offload-for-BIG-TCP-p.patch
(git-fixes CVE-2025-21629 bsc#1235968).
- Update
patches.suse/net_sched-drr-Fix-double-list-add-in-class-with-nete.patch
(git-fixes CVE-2025-37915 bsc#1243473).
- Update
patches.suse/net_sched-ets-Fix-double-list-add-in-class-with-nete.patch
(git-fixes CVE-2025-37914 bsc#1243472).
- Update
patches.suse/net_sched-hfsc-Fix-a-UAF-vulnerability-in-class-with.patch
(git-fixes CVE-2025-37890 bsc#1243330).
- Update
patches.suse/net_sched-qfq-Fix-double-list-add-in-class-with-nete.patch
(git-fixes CVE-2025-37913 bsc#1243471).
- Update
patches.suse/nfsd-decrease-sc_count-directly-if-fail-to-queue-dl_recall.patch
(git-fixes CVE-2025-37871 bsc#1242949).
- Update
patches.suse/objtool-media-dib8000-Prevent-divide-by-zero-in-dib8.patch
(git-fixes CVE-2025-37937 bsc#1243540).
- Update
patches.suse/objtool-spi-amd-Fix-out-of-bounds-stack-access-in-am.patch
(git-fixes CVE-2025-40014 bsc#1241644).
- Update
patches.suse/perf-Fix-hang-while-freeing-sigtrap-event.patch
(bsc#1229491 CVE-2024-43869 CVE-2025-37747 bsc#1242520).
- Update
patches.suse/pm-cpupower-bench-Prevent-NULL-dereference-on-malloc.patch
(stable-fixes CVE-2025-37841 bsc#1242974).
- Update
patches.suse/pwm-mediatek-Prevent-divide-by-zero-in-pwm_mediatek_.patch
(git-fixes CVE-2025-37850 bsc#1242955).
- Update patches.suse/qibfs-fix-_another_-leak.patch (git-fixes
CVE-2025-37983 bsc#1243567).
- Update patches.suse/sch_htb-make-htb_deactivate-idempotent.patch
(CVE-2025-37798 bsc#1242414 CVE-2025-37953 bsc#1243543).
- Update
patches.suse/sch_htb-make-htb_qlen_notify-idempotent.patch
(CVE-2025-37798 bsc#1242414 CVE-2025-37932 bsc#1243627).
- Update
patches.suse/sctp-detect-and-prevent-references-to-a-freed-transp.patch
(git-fixes CVE-2025-23142 bsc#1242760).
- Update
patches.suse/soc-samsung-exynos-chipid-Add-NULL-pointer-check-in-.patch
(git-fixes CVE-2025-23148 bsc#1242578).
- Update
patches.suse/sound-virtio-Fix-cancel_sync-warnings-on-uninitializ.patch
(stable-fixes CVE-2025-37805 bsc#1242930).
- Update patches.suse/tpm-do-not-start-chip-while-suspended.patch
(git-fixes CVE-2025-23149 bsc#1242758).
- Update
patches.suse/usb-cdns3-Fix-deadlock-when-using-NCM-gadget.patch
(git-fixes CVE-2025-37812 bsc#1242908).
- Update
patches.suse/usb-dwc3-gadget-check-that-event-count-does-not-exce.patch
(git-fixes CVE-2025-37810 bsc#1242906).
- Update
patches.suse/usb-gadget-aspeed-Add-NULL-pointer-check-in-ast_vhub.patch
(stable-fixes CVE-2025-37881 bsc#1242973).
- Update
patches.suse/usb-typec-class-Invalidate-USB-device-pointers-on-pa.patch
(git-fixes CVE-2025-37986 bsc#1243515).
- Update
patches.suse/vmxnet3-Fix-packet-corruption-in-vmxnet3_xdp_xmit_fr.patch
(bsc#1226498 CVE-2024-58099 bsc#1242035).
- Update
patches.suse/wifi-at76c50x-fix-use-after-free-access-in-at76_disc.patch
(git-fixes CVE-2025-37796 bsc#1242727).
- Update
patches.suse/wifi-ath12k-Fix-invalid-data-access-in-ath12k_dp_rx_.patch
(stable-fixes CVE-2025-37943 bsc#1243509).
- Update
patches.suse/wifi-ath12k-Fix-invalid-entry-fetch-in-ath12k_dp_mon.patch
(stable-fixes CVE-2025-37944 bsc#1243530).
- Update
patches.suse/wifi-brcm80211-fmac-Add-error-handling-for-brcmf_usb.patch
(git-fixes CVE-2025-37990 bsc#1243528).
- Update
patches.suse/wifi-cfg80211-init-wiphy_work-before-allocating-rfki.patch
(git-fixes CVE-2025-22119 bsc#1241576).
- Update
patches.suse/wifi-mac80211-Purge-vif-txq-in-ieee80211_do_stop.patch
(git-fixes CVE-2025-37794 bsc#1242566).
- Update
patches.suse/wifi-plfxlc-Remove-erroneous-assert-in-plfxlc_mac_re.patch
(git-fixes CVE-2025-37897 bsc#1243534).
- Update
patches.suse/wifi-wl1251-fix-memory-leak-in-wl1251_tx_work.patch
(git-fixes CVE-2025-37982 bsc#1243524).
- commit 4bd69e5
- gcc14
-
- Exclude shared objects present for link editing in the GCC specific
subdirectory from provides processing via __provides_exclude_from.
[bsc#1244050][bsc#1243991]
- Make cross-*-gcc14-bootstrap package conflict with the non-bootstrap
variant conflict with the unversioned cross-*-gcc package.
- Disable build of glibc cross to loongarch64 and hppa in SLFO
and SLE15.
- Update to GCC 14.3 release, bb24b4c804f3d95b0ba95b7496, git11799
- Remove gcc14-pr120061.patch which is now included upstream.
- Add gcc14-pr120061.patch to fix the PR108900 fix instead of
reverting it.
- Remove gcc14-pr108900.patch
- Add gcc14-pr108900.patch to revert it, fixing libqt6webengine build.
- Update to gcc-14 branch head, 3418d740b344e0ba38022f3be, git11702
* Remove gcc14-pr118780.patch now on the upstream branch
- Fix build on s390x [bsc#1241549]
- Make sure link editing is done against our own shared library
copy rather than the installed system runtime. [bsc#1240788]
- Add gcc14-pr119680.patch to fix cross-compiler builds with
- -enable-host-pie.
- libevent
-
- Disable the select backend, this can be easily done by lying
to configure. This is done due to:
* using fd number > 1024 on an fd_set results in a runtime
fortify source assertion, preventing further doom.
* select will not be changed to handle fd > 1024.
* this limit is unreasonable low for this century.
- Drop insserv_prereq and fillup_prereq macros: there are no
pre-scripts that would justify these dependencies.
- Update to 2.1.12 stable
* buffer: do not pass NULL to memcpy() from evbuffer_pullup()
* http: fix undefined-shift in EVUTIL_IS*_ helpers
* Check error code of evhttp_add_header_internal() in
evhttp_parse_query_impl()
* http: fix EVHTTP_CON_AUTOFREE in case of timeout
* evdns: Add additional validation for values of dns options
* Fix memory corruption in EV_CLOSURE_EVENT_FINALIZE with debug enabled
* increase segment refcnt only if evbuffer_add_file_segment() succeeds
* evdns: fix a crash when evdns_base with waiting requests is freed
* event_base_once: fix potential null pointer threat
* http: do not assume body for CONNECT
* evbuffer_add_file: fix freeing of segment in the error path
* Fix checking return value of the evdns_base_resolv_conf_parse()
* Support EV_CLOSED on linux for poll(2)
* Parse IPv6 scope IDs.
* evutil_time: detect and use _gmtime64_s()/_gmtime64()
* bufferevent: allow setting priority on socket and openssl type
* Fix EV_CLOSED detection/reporting
* Revert "Warn if forked from the event loop during event_reinit()"
- Add upstream patches with the feature of "prepare" and "check"
watchers. That feature is needed by envoy-proxy:
* 0001-evwatch-Add-prepare-and-check-watchers.patch
* 0002-evwatch-fix-race-condition.patch
- Update to 2.1.11 stable
* Fix ABI breakage that had been introduced in 2.1.10. Strictly speaking
this release breaks ABI again to make it compatible with <= 2.1.9.
+ See git commit 18104973 for more details
* evdns: add new options -- so-rcvbuf/so-sndbuf
* various autotools and cmake build changes
* buffer: fix possible NULL dereference in evbuffer_setcb() on ENOMEM
* Warn if forked from the event loop during event_reinit()
* evutil: set the have_checked_interfaces in evutil_check_interfaces()
* https-client: correction error checking
- Use FAT LTO objects in order to provide proper static library.
- Fix name of library package (bsc#1138369)
- Update to 2.1.10 stable
* evdns: add DNS_OPTION_NAMESERVERS_NO_DEFAULT /
EVDNS_BASE_NAMESERVERS_NO_DEFAULT
* Add support for EV_TIMEOUT to event_base_active_by_fd
* kqueue: Avoid undefined behaviour.
* Prevent integer overflow in kq_build_changes_list.
* evdns: fix lock/unlock mismatch in evdns_close_server_port()
* Protect min_heap_push_ against integer overflow.
* le-proxy: initiate use of the Winsock DLL
* Fix leaks in error path of the bufferevent_init_common_()
* buffer: make evbuffer_prepend() of zero-length array no-op
* Don't loose top error in SSL
* Remove needless check for arc4_seeded_ok
* Cleanup __func__ detection
* Add convenience macros for user-triggered events
* Notify event base if there are no more events, so it can exit without
delay
* Fix base unlocking in event_del() if event_base_set() runned in another
thread
* If precise_time is false, we should not set EVENT_BASE_FLAG_PRECISE_TIMER
* Fix race in access to ev_res from event loop with event_active()
* Return from event_del() after the last event callback termination
* Preserve socket error from listen across closesocket cleanup
* fix connection retries when there more then one request for connection
* improve error path for bufferevent_{setfd,enable,disable}()
* Fix conceivable UAF of the bufferevent in evhttp_connection_free()
* Fix evhttp_connection_get_addr() fox incomming http connections
* fix leaks in evhttp_uriencode()
* CONNECT method only takes an authority
* Allow bodies for GET/DELETE/OPTIONS/CONNECT
* Do not crash when evhttp_send_reply_start() is called after a timeout.
* Fix crashing http server when callback do not reply in place
* fix handling of close_notify (ssl) in http with openssl bufferevents
* use *_new_with_arg() to match function prototype
* avoid NULL dereference on request is not EVHTTP_REQ_POST
* bufferevent_socket_connect{,_hostname}() missing event callback and use
ret code
* don't fail be_null_filter if bytes are copied
* Call underlying bev ctrl GET_FD on filtered bufferevents
* be_openssl: avoid leaking of SSL structure
* Add missing includes into openssl-compat.h
* Explicitly call SSL_clear when reseting the fd.
* sample/https-client: use host SSL certificate store by default
* ipv6only socket bind support
* evdns: handle NULL filename explicitly
* Fix assert() condition in evbuffer_drain() for IOCP
* fix incorrect unlock of the buffer mutex (for deferred callbacks)
* Fix wrong assert in evbuffer_drain()
* Port `event_rpcgen.py` and `test/check-dumpevents.py` to Python 3.
- rename python2-shebang.patch -> python3-shebang.patch following port
- Make use of %license macro
- Add devel-static package, which is needed for building Envoy
(https://www.envoyproxy.io/) and Cilium with Envoy integration
- Fix an error about /usr/bin/env shebang in event_rpcgen.py
* python2-shebang.patch
- expat
-
- version update to 2.7.1
Bug fixes:
[#980] #989 Restore event pointer behavior from Expat 2.6.4
(that the fix to CVE-2024-8176 changed in 2.7.0);
affected API functions are:
- XML_GetCurrentByteCount
- XML_GetCurrentByteIndex
- XML_GetCurrentColumnNumber
- XML_GetCurrentLineNumber
- XML_GetInputContext
Other changes:
[#976] #977 Autotools: Integrate files "fuzz/xml_lpm_fuzzer.{cpp,proto}"
with Automake that were missing from 2.7.0 release tarballs
[#983] #984 Fix printf format specifiers for 32bit Emscripten
[#992] docs: Promote OpenSSF Best Practices self-certification
[#978] tests/benchmark: Resolve mistaken double close
[#986] Address compiler warnings
[#990] #993 Version info bumped from 11:1:10 (libexpat*.so.1.10.1)
to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/
for what these numbers do
Infrastructure:
[#982] CI: Start running Perl XML::Parser integration tests
[#987] CI: Enforce Clang Static Analyzer clean code
[#991] CI: Re-enable warning clang-analyzer-valist.Uninitialized
for clang-tidy
[#981] CI: Cover compilation with musl
[#983] #984 CI: Cover compilation with 32bit Emscripten
[#976] #977 CI: Protect against fuzzer files missing from future
release archives
- version update to 2.7.0 for SLE-15-SP7 (jsc#PED-12507)
- version update to 2.7.0 (CVE-2024-8176 [bsc#1239618])
* Security fixes:
[#893] #973 CVE-2024-8176 -- Fix crash from chaining a large number
of entities caused by stack overflow by resolving use of
recursion, for all three uses of entities:
- general entities in character data ("<e>&g1;</e>")
- general entities in attribute values ("<e k1='&g1;'/>")
- parameter entities ("%p1;")
Known impact is (reliable and easy) denial of service:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C
(Base Score: 7.5, Temporal Score: 7.2)
Please note that a layer of compression around XML can
significantly reduce the minimum attack payload size.
* Other changes:
[#935] #937 Autotools: Make generated CMake files look for
libexpat.@SO_MAJOR@.dylib on macOS
[#925] Autotools: Sync CMake templates with CMake 3.29
[#945] #962 #966 CMake: Drop support for CMake <3.13
[#942] CMake: Small fuzzing related improvements
[#921] docs: Add missing documentation of error code
XML_ERROR_NOT_STARTED that was introduced with 2.6.4
[#941] docs: Document need for C++11 compiler for use from C++
[#959] tests/benchmark: Fix a (harmless) TOCTTOU
[#944] Windows: Fix installer target location of file xmlwf.xml
for CMake
[#953] Windows: Address warning -Wunknown-warning-option
about -Wno-pedantic-ms-format from LLVM MinGW
[#971] Address Cppcheck warnings
[#969] #970 Mass-migrate links from http:// to https://
[#947] #958 ..
[#974] #975 Document changes since the previous release
[#974] #975 Version info bumped from 11:0:10 (libexpat*.so.1.10.0)
to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/
for what these numbers do
- libgcrypt
-
- Security fix [bsc#1221107, CVE-2024-2236]
* Add --enable-marvin-workaround to spec to enable workaround
* Fix timing based side-channel in RSA implementation ( Marvin attack )
* Add libgcrypt-CVE-2024-2236.patch
- Fix kdf test and fail accordingly if tests fail under FIPS mode [bsc#1246934]
* Rebased patches: libgcrypt-FIPS-SLI-kdf-leylength.patch
- gnutls
-
- Fix heap buffer overread when handling the CT SCT extension during X.509
certificate parsing [bsc#1246233, CVE-2025-32989]
* Add patch gnutls-CVE-2025-32989.patch
- Fix double-free due to incorrect ownership handling in the export logic of
SAN entries containing an otherName [bsc#1246232, CVE-2025-32988]
* Add patch gnutls-CVE-2025-32988.patch
- Fix 1-byte heap buffer overflow when parsing templates with certtool
[bsc#1246267, CVE-2025-32990]
* Add patch gnutls-CVE-2025-32990.patch
- Fix NULL pointer dereference when 2nd Client Hello omits PSK
[bsc#1246299, CVE-2025-6395]
* Add patch gnutls-CVE-2025-6395.patch
- icu
-
- Add icu-CVE-2025-5222.patch:
Backport 2c667e3 from upstream, ICU-22973 Fix buffer overflow by
using CharString.
(CVE-2025-5222, bsc#1243721)
- samba
-
- Update to 4.21.7
* Windows security hardening locks out schannel'ed netlogon dc
calls like netr_DsRGetDCName; (bsc#1246431); (bso#15876);
* Trust domains are not created; (bso#15680);
* Startup messages of rpc deamons fills /var/log/messages;
(bso#15869);
- Update to 4.21.6
* Running "gpo manage motd set" twice fails with backtrace;
(bso#15774).
* samba-tool gpo backup creates entity backups it can't read;
(bso#15829).
* gp_cert_auto_enroll_ext.py has problem unpacking GUIDs with
prepended 0's; (bso#15839).
* CVE-2025-0620 [SECURITY] smbd doesn't pick up group
membership changes when re-authenticating an expired SMB
session; (bso#15707), (bsc#1244136).
* Deadlock between two smbd processes; (bso#15767).
* net ad join fails with "Failed to join domain: failed to
create kerberos keytab"; (bso#15727).
* Wide link issue in samba 4.22; (bso#15841).
* dcerpcd not able to bind to listening port; (bso#15851).
* vfs_ceph_snapshots fails to list snapshots for entries at any
level beyond share root; (bso#15819).
* CTDB does not put nodes running NFS into grace on graceful
shutdown; (bso#15858).
- Update to 4.21.5
* ldb index cache is too small on known large transactions
(schemaupgrade, provision); (bso#15795).
* Enable support for cephfs case insensitive behavior;
(bso#15822).
* Subnet based interfaces definition not listening on all
covered IP addresses; (bso#15823).
* net ad join fails with "Failed to join domain: failed to
create kerberos keytab"; (bso#15727); (bsc#1238063).
* Remove of file or directory not possible with vfs_acl_tdb;
(bso#15791).
* Unable to connect to CephFS subvolume shares with
vfs_shadow_copy2; (bso#15797).
* Add async io API from libcephfs to ceph_new VFS module;
(bso#15810).
* vfs_ceph_new module does not work with other modules for
snapshot management; (bso#15818).
* vfs_ceph_new: Add path based fallback for SMB_VFS_FCHOWN,
SMB_VFS_FCHMOD and SMB_VFS_FNTIMES; (bso#15834).
* Incorrect FSF address in ctdb pcp scripts; (bso#15820).
* "samba-tool domain backup offline" hangs; (bso#15804).
- Update to 4.21.4
* Increasing slowness of sharesec performance with high number
of registry shares; (bso#15780).
* winbindd shows memleak in kerberos_decode_pac; (bso#15782).
* Creation of GPOs applicable to more than one group is
impossible with Samba 4.20.0 and later; (bso#15738).
* Replace `crypt` module in
python/samba/netcmd/user/readpasswords/common.py;
(bso#15756).
* vfs_gpfs silently garbles timestamps > year 2106;
(bso#15151).
* Spotlight search results don't show file size and creation
date; (bso#15796).
* General improvements for vfs_ceph_new module; (bso#15703).
* net offlinejoin not working correctly; (bso#15777).
* net ads create/join/winbind producing unix dysfunctional
keytabs; (bso#15759).
* Windows Explorer crashes on S-1-22-* Unix-SIDs when accessing
security tab; (bso#14213).
* The values from hresult_errstr_const and hresult_errstr are
reversed in 4.20 and 4.21; (bso#15769).
* Kerberos referral tickets are generated for principals in our
domain if we have a trust to a top level domain; (bso#15778).
* NETLOGON_NTLMV2_ENABLED is missing in the SamLogon*
user_flags field; (bso#15783).
* Regression: stack-use-after-return in crypt_as_best_we_can();
(bso#15784).
* libreplace:readline: gcc 15 complains about incompatible
pointer types; (bso#15788).
- Update to 4.21.3
* More possible replication loops against Azure AD;
(bso#15701).
* Compound rename from Mac clients can fail with
NT_STATUS_INTERNAL_ERROR if the file has a lease;
(bso#15697).
* vfs crossrename seems not work correctly; (bso#15724).
* After 'machine password timeout' /etc/krb5.keytab is not
updated; (bso#6750).
* Memory leak wbcCtxLookupSid; (bso#15771).
* Fix heap-user-after-free with association groups;
(bso#15765).
* Segfault in vfs_btrfs; (bso#15758).
* Avoid event failure race when disabling an event script;
(bso#15755).
- nfs-utils
-
- gssd: add support for an "allowed-enctypes" option in nfs.conf
(bsc#1240899)
- add 0008-gssd-add-support-for-an-allowed-enctypes-option-in-n.patch
- openssl-1_1
-
- FIPS: Use the NID_X9_62_prime256v1 curve in ECDSA KAT test
instead of NID_secp256k1. [bsc#1246697]
* Add openssl-fips-ECDSA-KAT.patch
- openssl-3
-
- Increase limit for CRL download [bsc#1247148, bsc#1247144]
* Add openssl-3-large-CRLs.patch
- FIPS: Fix EMS in crypto-policies FIPS:NO-ENFORCE-EMS
* [bsc#1230959, bsc#1232326, bsc#1231748, bsc#1246428]
* Add patch openssl-FIPS-fix-EMS-support.patch
- Backport mdless cms signing support [jsc#PED-12895]
* Add openssl-3-support-mdless-cms.patch
- Security fix: [bsc#1240366, CVE-2025-27587]
* Minerva side channel vulnerability in P-384 on PPC arch
* Add openssl-3-p384-minerva-ppc.patch
* Add openssl-3-p384-minerva-ppc-p9.patch
- Security fix: [bsc#1236599, CVE-2024-12797]
* RFC7250 handshakes with unauthenticated servers don't abort as
expected.
* Add openssl-CVE-2024-12797.patch
- Security fix: [bsc#1236136, CVE-2024-13176]
* Fix timing side-channel in ECDSA signature computation
* Add openssl-CVE-2024-13176.patch
- polkit
-
- CVE-2025-7519: Fixed that a XML policy file with a large number of
nested elements may lead to out-of-bounds write (bsc#1246472)
added 0001-Nested-.policy-files-cause-xml-parsing-overflow-lead.patch
- libpsm2
-
- Add libpsm2-disable-AVX.patch to completely disable AVX support
and use only up to SSE4.2. (bsc#1245739)
- Use %autosetup macro. Allows to eliminate the usage of deprecated
%patchN
- python311
-
- Add CVE-2025-8194-tarfile-no-neg-offsets.patch which now
validates archives to ensure member offsets are non-negative
(gh#python/cpython#130577, CVE-2025-8194, bsc#1247249).
- Add CVE-2025-6069-quad-complex-HTMLParser.patch to avoid worst
case quadratic complexity when processing certain crafted
malformed inputs with HTMLParser (CVE-2025-6069, bsc#1244705).
- Use one core to build doc. This will make sphinx doc build
reproducible.
bsc#1243155
- Update to 3.11.13:
- Security
- gh-135034: Fixes multiple issues that allowed tarfile
extraction filters (filter="data" and filter="tar")
to be bypassed using crafted symlinks and hard links.
Addresses CVE-2024-12718 (bsc#1244056), CVE-2025-4138
(bsc#1244059), CVE-2025-4330 (bsc#1244060), and
CVE-2025-4517 (bsc#1244032). Also addresses CVE-2025-4435
(gh#135034, bsc#1244061).
- gh-133767: Fix use-after-free in the “unicode-escape”
decoder with a non-“strict” error handler (CVE-2025-4516,
bsc#1243273).
- gh-128840: Short-circuit the processing of long IPv6
addresses early in ipaddress to prevent excessive memory
consumption and a minor denial-of-service.
- Library
- gh-128840: Fix parsing long IPv6 addresses with embedded
IPv4 address.
- gh-134062: ipaddress: fix collisions in __hash__() for
IPv4Network and IPv6Network objects.
- gh-123409: Fix ipaddress.IPv6Address.reverse_pointer output
according to RFC 3596, §2.5. Patch by Bénédikt Tran.
- bpo-43633: Improve the textual representation of
IPv4-mapped IPv6 addresses (RFC 4291 Sections 2.2, 2.5.5.2)
in ipaddress. Patch by Oleksandr Pavliuk.
- Remove upstreamed patches:
- gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
- CVE-2025-4516-DecodeError-handler.patch
- Add CVE-2025-4516-DecodeError-handler.patch fixing
CVE-2025-4516 (bsc#1243273) blocking DecodeError handling
vulnerability, which could lead to DoS.
- Use extended %autopatch.
- Remove python-3.3.0b1-test-posix_fadvise.patch (not needed
since kernel 3.6-rc1)
- Update to 3.11.12:
- gh-131809: Update bundled libexpat to 2.7.1
- gh-131261: Upgrade to libexpat 2.7.0
- gh-105704: When using urllib.parse.urlsplit() and
urllib.parse.urlparse() host parsing would not reject domain
names containing square brackets ([ and ]). Square brackets
are only valid for IPv6 and IPvFuture hosts according to RFC
3986 Section 3.2.2 (bsc#1236705, CVE-2025-0938,
gh#python/cpython#105704).
- gh-121284: Fix bug in the folding of rfc2047 encoded-words
when flattening an email message using a modern email
policy. Previously when an encoded-word was too long for
a line, it would be decoded, split across lines, and
re-encoded. But commas and other special characters in the
original text could be left unencoded and unquoted. This
could theoretically be used to spoof header lines using a
carefully constructed encoded-word if the resulting rendered
email was transmitted or re-parsed.
- gh-80222: Fix bug in the folding of quoted strings
when flattening an email message using a modern email
policy. Previously when a quoted string was folded so that
it spanned more than one line, the surrounding quotes and
internal escapes would be omitted. This could theoretically
be used to spoof header lines using a carefully constructed
quoted string if the resulting rendered email was transmitted
or re-parsed.
- gh-119511: Fix a potential denial of service in the imaplib
module. When connecting to a malicious server, it could
cause an arbitrary amount of memory to be allocated. On many
systems this is harmless as unused virtual memory is only
a mapping, but if this hit a virtual address size limit
it could lead to a MemoryError or other process crash. On
unusual systems or builds where all allocated memory is
touched and backed by actual ram or storage it could’ve
consumed resources doing so until similarly crashing.
- gh-127257: In ssl, system call failures that OpenSSL reports
using ERR_LIB_SYS are now raised as OSError.
- gh-121277: Writers of CPython’s documentation can now use
next as the version for the versionchanged, versionadded,
deprecated directives.
- gh-106883: Disable GC during the _PyThread_CurrentFrames()
and _PyThread_CurrentExceptions() calls to avoid the
interpreter to deadlock.
- Remove upstreamed patch:
- CVE-2025-0938-sq-brackets-domain-names.patch
- Add gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
which makes test_ssl not to stop ThreadedEchoServer on OSError,
which makes test_ssl pass with OpenSSL 3.5 (bsc#1241067,
gh#python/cpython!126572)
- python3
-
- Add CVE-2025-8194-tarfile-no-neg-offsets.patch which now
validates archives to ensure member offsets are non-negative
(gh#python/cpython#130577, CVE-2025-8194, bsc#1247249).
- Add CVE-2025-4435-normalize-lnk-trgts-tarfile.patch
Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138,
CVE-2024-12718, CVE-2025-4435 on tarfile (bsc#1244032,
bsc#1244061, bsc#1244059, bsc#1244060, bsc#1244056).
The backported fixes do not contain changes for ntpath.py and
related tests, because the support for symlinks and junctions
were added later in Python 3.9, and it does not make sense to
backport them to 3.6 here.
The patch is contains the following changes:
- python@42deeab fixes symlink handling for tarfile.data_filter
- python@9d2c2a8 fixes handling of existing files/symlinks in tarfile
- python@00af979 adds a new "strict" argument to realpath()
- python@dd8f187 fixes mulriple CVE fixes in the tarfile module
- downstream only fixes that makes the changes work and
compatible with Python 3.6
- Add CVE-2025-6069-quad-complex-HTMLParser.patch to avoid worst
case quadratic complexity when processing certain crafted
malformed inputs with HTMLParser (CVE-2025-6069, bsc#1244705).
- Add python36-* provides/obsoletes to enable SLE-12 -> SLE-15
migration, bsc#1233012
- Add ipaddress-update-pr60.patch from gh#phihag/ipaddress!60 to
update vendored ipaddress module to 3.8 equivalent
- Add gh-128840_parse-IPv6-with-emb-IPv4.patch to limit buffer
size for IPv6 address parsing (gh#python/cpython#128840,
bsc#1244401).
- Update CVE-2025-4516-DecodeError-handler.patch not to break
_PyBytes_DecodeEscape signature.
- Add CVE-2025-4516-DecodeError-handler.patch fixing
CVE-2025-4516 (bsc#1243273) blocking DecodeError handling
vulnerability, which could lead to DoS.
- libsolv
-
- add support for product-obsoletes() provides in the product
autopackage generation code
- bump version to 0.7.34
- improve transaction ordering by allowing more uninst->uninst
edges [bsc#1243457]
- implement color filtering when adding update targets
- support orderwithrequires dependencies in susedata.xml
- bump version to 0.7.33
- sqlite3
-
- Backpatch the URLs in sqlite3.n from https to http to avoid a
file conflict with the tcl package on SLE-15-GA up to SP2. In
SP3 and onwards the Tcl package does not contain the sqlite
extension anymore.
- Sync version 3.50.2 from Factory:
* CVE-2025-6965, bsc#1246597:
Raise an error early if the number of aggregate terms in a
query exceeds the maximum number of columns, to avoid
downstream assertion faults.
* Add subpackage for the lemon parser generator.
+ sqlite-3.49.0-fix-lemon-missing-cflags.patch
+ sqlite-3.6.23-lemon-system-template.patch
- libssh
-
- Fix CVE-2025-5318: Likely read beyond bounds in sftp server handle management (bsc#1245311)
* Add patch libssh-CVE-2025-5318.patch
- Fix CVE-2025-4877: Write beyond bounds in binary to base64 conversion functions (bsc#1245309)
* Add patch libssh-CVE-2025-4877.patch
- Fix CVE-2025-4878: Use of uninitialized variable in privatekey_from_file() (bsc#1245310)
* Add patches:
- libssh-CVE-2025-4878-1.patch
- libssh-CVE-2025-4878-2.patch
- Fix CVE-2025-5372: ssh_kdf() returns a success code on certain failures (bsc#1245314)
* Add patch libssh-CVE-2025-5372.patch
- systemd
-
- triggers.systemd: skip update of hwdb, journal-catalog if executed during
an offline update.
- systemd-repart is no more considered as experimental (jsc#PED-13213)
- Import commit 130293e510ceb4d121d11823e6ebd4b1e8332ea0 (merge of v254.27)
For a complete list of changes, visit:
https://github.com/openSUSE/systemd/compare/278fb676146e35a7b4057f52f34a7bbaf1b82369...130293e510ceb4d121d11823e6ebd4b1e8332ea0
- Import commit 278fb676146e35a7b4057f52f34a7bbaf1b82369
aa12f501ae logs-show: get timestamp and boot ID only when necessary (bsc#1242827)
e8b17d11bc sd-journal: drop to use Hashmap to manage journal files per boot ID
ea80273738 tree-wide: set SD_JOURNAL_ASSUME_IMMUTABLE where appropriate
a5b3b5344f sd-journal: introduce SD_JOURNAL_ASSUME_IMMUTABLE flag
5fa0600b34 sd-journal: make journal_file_read_tail_timestamp() notify to the caller that some new journal entries added
737e8193e7 sd-journal: cache last entry offset and journal file state
057dca426f sd-journal: fix typo in function name
- Start the systemd-coredump.socket unit on systemd-coredump package
installation.
- Restore the kernel default values of the coredump sysctl settings on
systemd-coredump package removal.
- Import commit e08f49f2432509787abfb7f3fc0b2f2c459def04 (merge of v254.25)
This merge includes the following fix:
7fc7aa5a4d coredump: use %d in kernel core pattern (bsc#1243935 CVE-2025-4598)
For a complete list of changes, visit:
https://github.com/openSUSE/systemd/compare/b0ae3b6e85b6a4030cf2adb88519a6ca0ffc1343...e08f49f2432509787abfb7f3fc0b2f2c459def04
- Drop 1021-Revert-macro-terminate-the-temporary-VA_ARGS_FOREACH.patch
The SUSE specific patch has been integrated into the SUSE/v254 git
branch. Some of the imported commits from the stable tree rely on the macro
now.
- Import commit b0ae3b6e85b6a4030cf2adb88519a6ca0ffc1343
41d2be2fb5 Revert "macro: terminate the temporary VA_ARGS_FOREACH() array with a sentinel" (SUSE specific)
- libxml2
-
- security update
- added patches
CVE-2025-7425 [bsc#1246296], Heap Use-After-Free in libxslt caused by atype corruption in xmlAttrPtr
+ libxml2-CVE-2025-7425.patch
- security update
- added patches
CVE-2025-49794 [bsc#1244554], heap use after free (UAF) can lead to Denial of service (DoS)
CVE-2025-49796 [bsc#1244557], type confusion may lead to Denial of service (DoS)
+ libxml2-CVE-2025-49794,49796.patch
CVE-2025-49795 [bsc#1244555], null pointer dereference may lead to Denial of service (DoS)
+ libxml2-CVE-2025-49795.patch
- security update
- added patches
CVE-2025-6170 [bsc#1244700], stack buffer overflow may lead to a crash
CVE-2025-6021 [bsc#1244580], Integer Overflow in xmlBuildQName() Leads to Stack Buffer Overflow in libxml2
+ libxml2-CVE-2025-6170,6021.patch
- libzypp
-
- Fix evaluation of libproxy results (bsc#1247690)
- Replace URL variables inside mirrorlist/metalink files
(fixes #667)
- version 17.37.16 (35)
- Append RepoInfo::path() to the mirror URLs in Preloader
(bsc#1247054)
- version 17.37.15 (35)
- During installation indicate the backend being used (bsc#1246038)
If some package actually needs to know, it should test for
ZYPP_CLASSIC_RPMTRANS being set in the environment.
Otherwise the transaction is driven by librpm.
- version 17.37.14 (35)
- Workaround 'rpm -vv' leaving scriptlets /var/tmp (bsc#1218459)
- Verbose log libproxy results if PX_DEBUG=1 is set.
- BuildRequires: cmake >= 3.17.
- version 17.37.13 (35)
- Allow explicit request to probe an added repo's URL
(bsc#1246466)
- Fix tests with -DISABLE_MEDIABACKEND_TESTS=1 (fixes #661)
- version 17.37.12 (35)
- Add runtime check for a broken rpm-4.18.0 --runpostrans
(bsc#1246149)
- Add regression test for bsc#1245220 and some other filesize
related tests.
- version 17.37.11 (35)
- BuildRequires: %{libsolv_devel_package} >= 0.7.34 (bsc#1243486)
Newer rpm versions no longer allow a ':' in rpm package names or
obsoletes. So injecting an
Obsoletes: product:oldproductname < oldproductversion
into the -release package to indicate a product rename is no longer
possible.
Since libsolv-0.7.34 you can and should use:
Provides: product-obsoletes(oldproductname) < oldproductversion
in the -release package. libsolv will then inject the appropriate
Obsoletes into the Product.
- version 17.37.10 (35)
- Ignore DeltaRpm download errors (bsc#1245672)
DeltaRpms are in fact optional resources. In case of a failure
the full rpm is downloaded.
- Improve fix for incorrect filesize handling (bsc#1245220)
- version 17.37.9 (35)
- Do not trigger download data exceeded errors on HTTP non data
responses (bsc#1245220)
In some cases a HTTP 401 or 407 did trigger a "filesize exceeded"
error, because the response payload size was compared against the
expected filesize. This patch adds some checks if the response
code is in the success range and only then takes expected
filesize into account. Otherwise the response content-length is
used or a fallback of 2Mb if no content-length is known.
- version 17.37.8 (35)
- Fix SEGV in MediaDISK handler (bsc#1245452)
- Explicitly selecting DownloadAsNeeded also selects the
classic_rpmtrans backend.
DownloadAsNeeded can not be combined with the rpm singletrans
installer backend because a rpm transaction requires all package
headers to be available the the beginning of the transaction. So
explicitly selecting this mode also turns on the classic_rpmtrans
backend.
- Fix evaluation of libproxy results (bsc#1244710)
- version 17.37.7 (35)
- Enhancements regarding mirror handling during repo refresh.
Added means to disable the use of mirrors when downloading
security relevant files. Requires updaing zypper to 1.14.91.
- Fix autotestcase writer if ZYPP_FULLLOG=1 (bsc#1244042)
If ZYPP_FULLLOG=1 a solver testcase to
"/var/log/YaST2/autoTestcase" should be written for each solver
run. There was no testcase written for the very first solver run.
This is now fixed.
- Pass $1==2 to %posttrans script if it's an update (bsc#1243279)
- version 17.37.6 (35)
- mdadm
-
- monitor: Add MAILFROM address to email envelope to avoid smtp auth
errors (bsc#1241474)
* add 1008-mdmonitor-use-MAILFROM-to-set-sendmail-envelope-send.patch
- Allow any valid minor name in md device name (bsc#1240789)
* add 1007-mdadm-allow-any-valid-minor-number-in-md-device-name.patch
- Add dependency on suse-module-tools for SLE15 (bsc#1242696)
- mozilla-nspr
-
- update to version 4.36
* remove support for OS/2
* remove support for Unixware, Bsdi, old AIX, old HPUX9 & scoos
* remove support for Windows 16 bit
* renamed the prwin16.h header to prwin.h
* configure was updated from 2.69 to 2.71
* various build, test and automation script fixes
* major parts of the source code were reformatted
- mozilla-nss
-
- update to NSS 3.112
* bmo#1963792 - Fix alias for mac workers on try
* bmo#1966786 - ensure all options can be configured with SSL_OptionSet and SSL_OptionSetDefault
* bmo#1931930 - ABI/API break in ssl certificate processing
* bmo#1955971 - remove unnecessary assertion in sec_asn1d_init_state_based_on_template
* bmo#1965754 - update taskgraph to v14.2.1
* bmo#1964358 - Workflow for automation of the release on GitHub when pushing a tag
* bmo#1952860 - fix faulty assertions in SEC_ASN1DecoderUpdate
* bmo#1934877 - Renegotiations should use a fresh ECH GREASE buffer
* bmo#1951396 - update taskgraph to v14.1.1
* bmo#1962503 - Partial fix for ACVP build CI job
* bmo#1961827 - Initialize find in sftk_searchDatabase
* bmo#1963121 - Add clang-18 to extra builds
* bmo#1963044 - Fault tolerant git fetch for fuzzing
* bmo#1962556 - Tolerate intermittent failures in ssl_policy_pkix_ocsp
* bmo#1962770 - fix compiler warnings when DEBUG_ASN1D_STATES or CMSDEBUG are set
* bmo#1961835 - fix content type tag check in NSS_CMSMessage_ContainsCertsOrCrls
* bmo#1963102 - Remove Cryptofuzz CI version check
- update to NSS 3.111
* bmo#1930806 - FIPS changes need to be upstreamed: force ems policy
* bmo#1957685 - Turn off Websites Trust Bit from CAs
* bmo#1937338 - Update nssckbi version following April 2025 Batch of Changes
* bmo#1943135 - Disable SMIME ‘trust bit’ for GoDaddy CAs
* bmo#1874383 - Replaced deprecated sprintf function with snprintf in dbtool.c
* bmo#1954612 - Need up update NSS for PKCS 3.1
* bmo#1773374 - avoid leaking localCert if it is already set in ssl3_FillInCachedSID
* bmo#1953097 - Decrease ASAN quarantine size for Cryptofuzz in CI
* bmo#1943962 - selfserv: Add support for zlib certificate compression
- update to NSS 3.110
* bmo#1930806 - FIPS changes need to be upstreamed: force ems policy
* bmo#1954724 - Prevent excess allocations in sslBuffer_Grow
* bmo#1953429 - Remove Crl templates from ASN1 fuzz target
* bmo#1953429 - Remove CERT_CrlTemplate from ASN1 fuzz target
* bmo#1952855 - Fix memory leak in NSS_CMSMessage_IsSigned
* bmo#1930807 - NSS policy updates
* bmo#1951161 - Improve locking in nssPKIObject_GetInstances
* bmo#1951394 - Fix race in sdb_GetMetaData
* bmo#1951800 - Fix member access within null pointer
* bmo#1950077 - Increase smime fuzzer memory limit
* bmo#1949677 - Enable resumption when using custom extensions
* bmo#1952568 - change CN of server12 test certificate
* bmo#1949118 - Part 2: Add missing check in
NSS_CMSDigestContext_FinishSingle
* bmo#1949118 - Part 1: Fix smime UBSan errors
* bmo#1930806 - FIPS changes need to be upstreamed: updated key checks
* bmo#1951491 - Don't build libpkix in static builds
* bmo#1951395 - handle `-p all` in try syntax
* bmo#1951346 - fix opt-make builds to actually be opt
* bmo#1951346 - fix opt-static builds to actually be opt
* bmo#1916439 - Remove extraneous assert
- Removed upstreamed nss-fips-stricter-dh.patch
- Added bmo1962556.patch to fix test failures
- Rebased nss-fips-approved-crypto-non-ec.patch nss-fips-combined-hash-sign-dsa-ecdsa.patch
- update to NSS 3.109
* bmo#1939512 - Call BL_Init before RNG_RNGInit() so that special
SHA instructions can be used if available
* bmo#1930807 - NSS policy updates - fix inaccurate key policy issues
* bmo#1945883 - SMIME fuzz target
* bmo#1914256 - ASN1 decoder fuzz target
* bmo#1936001 - Part 2: Revert “Extract testcases from ssl gtests
for fuzzing”
* bmo#1915155 - Add fuzz/README.md
* bmo#1936001 - Part 4: Fix tstclnt arguments script
* bmo#1944545 - Extend pkcs7 fuzz target
* bmo#1912320 - Extend certDN fuzz target
* bmo#1944300 - revert changes to HACL* files from bug 1866841
* bmo#1936001 - Part 3: Package frida corpus script
- update to NSS 3.108
* bmo#1923285 - libclang-16 -> libclang-19
* bmo#1939086 - Turn off Secure Email Trust Bit for Security
Communication ECC RootCA1
* bmo#1937332 - Turn off Secure Email Trust Bit for BJCA Global Root
CA1 and BJCA Global Root CA2
* bmo#1915902 - Remove SwissSign Silver CA – G2
* bmo#1938245 - Add D-Trust 2023 TLS Roots to NSS
* bmo#1942301 - fix fips test failure on windows
* bmo#1935925 - change default sensitivity of KEM keys
* bmo#1936001 - Part 1: Introduce frida hooks and script
* bmo#1942350 - add missing arm_neon.h include to gcm.c
* bmo#1831552 - ci: update windows workers to win2022
* bmo#1831552 - strip trailing carriage returns in tools tests
* bmo#1880256 - work around unix/windows path translation issues
in cert test script
* bmo#1831552 - ci: let the windows setup script work without $m
* bmo#1880255 - detect msys
* bmo#1936680 - add a specialized CTR_Update variant for AES-GCM
* bmo#1930807 - NSS policy updates
* bmo#1930806 - FIPS changes need to be upstreamed: FIPS 140-3 RNG
* bmo#1930806 - FIPS changes need to be upstreamed: Add SafeZero
* bmo#1930806 - FIPS changes need to be upstreamed - updated POST
* bmo#1933031 - Segmentation fault in SECITEM_Hash during pkcs12 processing
* bmo#1929922 - Extending NSS with LoadModuleFromFunction functionality
* bmo#1935984 - Ensure zero-initialization of collectArgs.cert
* bmo#1934526 - pkcs7 fuzz target use CERT_DestroyCertificate
* bmo#1915898 - Fix actual underlying ODR violations issue
* bmo#1184059 - mozilla::pkix: allow reference ID labels to begin
and/or end with hyphens
* bmo#1927953 - don't look for secmod.db in nssutil_ReadSecmodDB if
NSS_DISABLE_DBM is set
* bmo#1934526 - Fix memory leak in pkcs7 fuzz target
* bmo#1934529 - Set -O2 for ASan builds in CI
* bmo#1934543 - Change branch of tlsfuzzer dependency
* bmo#1915898 - Run tests in CI for ASan builds with detect_odr_violation=1
* bmo#1934241 - Fix coverage failure in CI
* bmo#1934213 - Add fuzzing for delegated credentials, DTLS short
header and Tls13BackendEch
* bmo#1927142 - Add fuzzing for SSL_EnableTls13GreaseEch and
SSL_SetDtls13VersionWorkaround
* bmo#1913677 - Part 3: Restructure fuzz/
* bmo#1931925 - Extract testcases from ssl gtests for fuzzing
* bmo#1923037 - Force Cryptofuzz to use NSS in CI
* bmo#1923037 - Fix Cryptofuzz on 32 bit in CI
* bmo#1933154 - Update Cryptofuzz repository link
* bmo#1926256 - fix build error from 9505f79d
* bmo#1926256 - simplify error handling in get_token_objects_for_cache
* bmo#1931973 - nss doc: fix a warning
* bmo#1930797 - pkcs12 fixes from RHEL need to be picked up
- remove obsolete patches
* nss-fips-safe-memset.patch
* nss-bmo1930797.patch
- update to NSS 3.107
* bmo#1923038 - Remove MPI fuzz targets.
* bmo#1925512 - Remove globals `lockStatus` and `locksEverDisabled`.
* bmo#1919015 - Enable PKCS8 fuzz target.
* bmo#1923037 - Integrate Cryptofuzz in CI.
* bmo#1913677 - Part 2: Set tls server target socket options in config class
* bmo#1913677 - Part 1: Set tls client target socket options in config class
* bmo#1913680 - Support building with thread sanitizer.
* bmo#1922392 - set nssckbi version number to 2.72.
* bmo#1919913 - remove Websites Trust Bit from Entrust Root
Certification Authority - G4.
* bmo#1920641 - remove Security Communication RootCA3 root cert.
* bmo#1918559 - remove SecureSign RootCA11 root cert.
* bmo#1922387 - Add distrust-after for TLS to Entrust Roots.
* bmo#1927096 - update expected error code in pk12util pbmac1 tests.
* bmo#1929041 - Use random tstclnt args with handshake collection script
* bmo#1920466 - Remove extraneous assert in ssl3gthr.c.
* bmo#1928402 - Adding missing release notes for NSS_3_105.
* bmo#1874451 - Enable the disabled mlkem tests for dtls.
* bmo#1874451 - NSS gtests filter cleans up the constucted buffer
before the use.
* bmo#1925505 - Make ssl_SetDefaultsFromEnvironment thread-safe.
* bmo#1925503 - Remove short circuit test from ssl_Init.
- fix build on loongarch64 (setting it as 64bit arch)
- Remove upstreamed bmo-1400603.patch
- Added nss-bmo1930797.patch to fix failing tests in testsuite
- update to NSS 3.106
* bmo#1925975 - NSS 3.106 should be distributed with NSPR 4.36.
* bmo#1923767 - pk12util: improve error handling in p12U_ReadPKCS12File.
* bmo#1899402 - Correctly destroy bulkkey in error scenario.
* bmo#1919997 - PKCS7 fuzz target, r=djackson,nss-reviewers.
* bmo#1923002 - Extract certificates with handshake collection script.
* bmo#1923006 - Specify len_control for fuzz targets.
* bmo#1923280 - Fix memory leak in dumpCertificatePEM.
* bmo#1102981 - Fix UBSan errors for SECU_PrintCertificate and
SECU_PrintCertificateBasicInfo.
* bmo#1921528 - add new error codes to mozilla::pkix for Firefox to use.
* bmo#1921768 - allow null phKey in NSC_DeriveKey.
* bmo#1921801 - Only create seed corpus zip from existing corpus.
* bmo#1826035 - Use explicit allowlist for for KDF PRFS.
* bmo#1920138 - Increase optimization level for fuzz builds.
* bmo#1920470 - Remove incorrect assert.
* bmo#1914870 - Use libFuzzer options from fuzz/options/\*.options in CI.
* bmo#1920945 - Polish corpus collection for automation.
* bmo#1917572 - Detect new and unfuzzed SSL options.
* bmo#1804646 - PKCS12 fuzzing target.
- requires NSPR 4.36
- update to NSS 3.105
* bmo#1915792 - Allow importing PKCS#8 private EC keys missing public key
* bmo#1909768 - UBSAN fix: applying zero offset to null pointer in sslsnce.c
* bmo#1919577 - set KRML_MUSTINLINE=inline in makefile builds
* bmo#1918965 - Don't set CKA_SIGN for CKK_EC_MONTGOMERY private keys
* bmo#1918767 - override default definition of KRML_MUSTINLINE
* bmo#1916525 - libssl support for mlkem768x25519
* bmo#1916524 - support for ML-KEM-768 in softoken and pk11wrap
* bmo#1866841 - Add Libcrux implementation of ML-KEM 768 to FreeBL
* bmo#1911912 - Avoid misuse of ctype(3) functions
* bmo#1917311 - part 2: run clang-format
* bmo#1917311 - part 1: upgrade to clang-format 13
* bmo#1916953 - clang-format fuzz
* bmo#1910370 - DTLS client message buffer may not empty be on retransmit
* bmo#1916413 - Optionally print config for TLS client and server
fuzz target
* bmo#1916059 - Fix some simple documentation issues in NSS.
* bmo#1915439 - improve performance of NSC_FindObjectsInit when
template has CKA_TOKEN attr
* bmo#1912828 - define CKM_NSS_ECDHE_NO_PAIRWISE_CHECK_KEY_PAIR_GEN
- Fix build error under Leap by rebasing nss-fips-safe-memset.patch.
- update to NSS 3.104
* bmo#1910071 - Copy original corpus to heap-allocated buffer
* bmo#1910079 - Fix min ssl version for DTLS client fuzzer
* bmo#1908990 - Remove OS2 support just like we did on NSPR
* bmo#1910605 - clang-format NSS improvements
* bmo#1902078 - Adding basicutil.h to use HexString2SECItem function
* bmo#1908990 - removing dirent.c from build
* bmo#1902078 - Allow handing in keymaterial to shlibsign to make
the output reproducible
* bmo#1908990 - remove nec4.3, sunos4, riscos and SNI references
* bmo#1908990 - remove other old OS (BSDI, old HP UX, NCR,
openunix, sco, unixware or reliantUnix
* bmo#1908990 - remove mentions of WIN95
* bmo#1908990 - remove mentions of WIN16
* bmo#1913750 - More explicit directory naming
* bmo#1913755 - Add more options to TLS server fuzz target
* bmo#1913675 - Add more options to TLS client fuzz target
* bmo#1835240 - Use OSS-Fuzz corpus in NSS CI
* bmo#1908012 - set nssckbi version number to 2.70.
* bmo#1914499 - Remove Email Trust bit from ACCVRAIZ1 root cert.
* bmo#1908009 - Remove Email Trust bit from certSIGN ROOT CA.
* bmo#1908006 - Add Cybertrust Japan Roots to NSS.
* bmo#1908004 - Add Taiwan CA Roots to NSS.
* bmo#1911354 - remove search by decoded serial in
nssToken_FindCertificateByIssuerAndSerialNumber
* bmo#1913132 - Fix tstclnt CI build failure
* bmo#1913047 - vfyserv: ensure peer cert chain is in db for
CERT_VerifyCertificateNow
* bmo#1912427 - Enable all supported protocol versions for UDP
* bmo#1910361 - Actually use random PSK hash type
* bmo#1911576 - Initialize NSS DB once
* bmo#1910361 - Additional ECH cipher suites and PSK hash types
* bmo#1903604 - Automate corpus file generation for TLS client Fuzzer
* bmo#1910364 - Fix crash with UNSAFE_FUZZER_MODE
* bmo#1910605 - clang-format shlibsign.c
- remove obsolete nss-reproducible-builds.patch
- update to NSS 3.103
* bmo#1908623 - move list size check after lock acquisition in sftk_PutObjectToList.
* bmo#1899542 - Add fuzzing support for SSL_ENABLE_POST_HANDSHAKE_AUTH,
* bmo#1909638 - Follow-up to fix test for presence of file nspr.patch.
* bmo#1903783 - Adjust libFuzzer size limits
* bmo#1899542 - Add fuzzing support for SSL_SetCertificateCompressionAlgorithm,
SSL_SetClientEchConfigs, SSL_VersionRangeSet and SSL_AddExternalPsk
* bmo#1899542 - Add fuzzing support for SSL_ENABLE_GREASE and
SSL_ENABLE_CH_EXTENSION_PERMUTATION
- Add nss-reproducible-builds.patch to make the rpms reproducible,
by using a hardcoded, static key to generate the checksums (*.chk-files)
- Updated nss-fips-approved-crypto-non-ec.patch to enforce
approved curves with the CKK_EC_MONTGOMERY key type (bsc#1224113).
- update to NSS 3.102.1
* bmo#1905691 - ChaChaXor to return after the function
- update to NSS 3.102
* bmo#1880351 - Add Valgrind annotations to freebl Chacha20-Poly1305.
* bmo#1901932 - missing sqlite header.
* bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME.
* bmo#1615298 - improve certutil keyUsage, extKeyUsage, and nsCertType keyword handling.
* bmo#1660676 - correct length of raw SPKI data before printing in pp utility.
- Add nss-reproducible-chksums.patch to make NSS-build reproducible
Use key from openssl (bsc#1081723)
- Updated nss-fips-approved-crypto-non-ec.patch to exclude the
SHA-1 hash from SLI approval.
- net-tools
-
- Drop 0002-Do-not-warn-about-interface-socket-not-binded.patch. It
worked around a net-tools-1.60 specific problem, that does not
happen in net-tools-2.10. It is more harmful than useful, as it
can hide real problems. (bsc#430864#c15,
https://github.com/ecki/net-tools/issues/32#issuecomment-3265471116).
- Drop 0004-By-default-do-not-fopen-anything-in-netrom_gr.patch. It
was net-tools-1.60 specific leak fix and breaks netrom in
net-tools-2.10 (bnc#544339#c2).
- Drop old Fedora patch 0006-Allow-interface-stacking.patch. It
provided a fix for CVE-2025-46836 (bsc#142461), but it was fixes
by the upstream in 2025 in a different way. Revert interferring
net-tools-CVE-2025-46836.patch back to the upstream version.
- Fix stack buffer overflow in parse_hex (bsc#1248687,
GHSA-h667-qrp8-gj58, net-tools-parse_hex-stack-overflow.patch).
- Fix stack-based buffer overflow in proc_gen_fmt (bsc#1248687,
GHSA-w7jq-cmw2-cq59,
net-tools-proc_gen_fmt-buffer-overflow.patch).
- Avoid unsafe memcpy in ifconfig (bsc#1248687,
net-tools-ifconfig-avoid-unsafe-memcpy.patch).
- Prevent overflow in ax25 and netrom (bsc#1248687,
net-tools-ax25+netrom-overflow-1.patch,
net-tools-ax25+netrom-overflow-2.patch).
- Keep possibility to enter long interface names, even if they are
not accepted by the kernel, because it was always possible up to
CVE-2025-46836 fix. But issue a warning about an interface name
concatenation (bsc#1248410,
net-tools-ifconfig-long-name-warning.patch).
- Provide more readable error for interface name size checking
introduced by net-tools-CVE-2025-46836.patch
(bsc#1243581, net-tools-CVE-2025-46836-error-reporting.patch).
- Fix a regression in net-tools-CVE-2025-46836.patch (bsc#1246608).
- Perform bound checks when parsing interface labels in
/proc/net/dev (bsc#1243581, CVE-2025-46836, GHSA-pfwf-h6m3-63wf,
net-tools-CVE-2025-46836.patch,
net-tools-CVE-2025-46836-regression.patch).
- openssh
-
- Add openssh-scp-umask-preserve-permissions.patch (bsc#1241667).
- pam-config
-
- Stop adding pam_env in AUTH stack, and be sure to put this module at the
really end of the SESSION stack.
[bsc#1243226, CVE-2025-6018, remove-pam_env-from-auth-stack.patch]
- pam
-
- Make sure that the buffer containing encrypted passwords get's erased
bedore free.
- Replace to previous CVE fix which led to CPU performance issues.
[bsc#1246221, CVE-2024-10041,
+ libpam-introduce-secure-memory-erasure-helpers.patch
+ pam_modutil_get-overwrite-password-at-free.patch
- passverify-always-run-the-helper-to-obtain-shadow_pwd.patch]
- perl-Bootloader
-
- merge gh#openSUSE/perl-bootloader#191
- avoid spurious warning messages when parsing /etc/default/grub
(bsc#1246373, bsc#1245323)
- 1.25
- perl
-
- do not change the current directory when cloning an open
directory handle [bnc#1244079] [CVE-2025-40909]
new patch: perl-dirdup.diff
- python-instance-billing-flavor-check
-
- Update to version 1.0.1
+ Fix infinite loop (bsc#1242064)
+ Fix bug in update infrastructure request (bsc#1242064)
- python-appdirs
-
- Add python36-appdirs provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-asn1crypto
-
- Add python36-asn1crypto provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-attrs
-
- Add python36-attrs provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-certifi
-
- Add python36-certifi provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-chardet
-
- Add python36-chardet provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python3-cryptography
-
- Add python36-cryptography provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- Skipping failing test
- python-idna
-
- Add python36-idna provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-importlib-metadata
-
- Add python36-importlib-metadata provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python3-more-itertools
-
- Add python36-more-itertools provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-packaging
-
- Add python36-packaging provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python3-pyOpenSSL
-
- Add python36-pyOpenSSL provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-pyasn1
-
- Add python36-pyasn1 provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-pycparser
-
- Add python36-pycparser provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-pyparsing
-
- Add python36-pyparsing provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-pytz
-
- Add python36-pytz provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-py
-
- Add python36-py provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-requests
-
- Add python36- provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- Add CVE-2024-47081.patch upstream patch, fixes netrc credential leak
(gh#psf/requests#6965, CVE-2024-47081, bsc#1244039)
- python3-setuptools
-
- Add python36-setuptools provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-six
-
- Add python36-six provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-urllib3
-
- Add patch CVE-2025-50181-poolmanager-redirects.patch:
* Pool managers now properly control redirects when retries is passed
(CVE-2025-50181, GHSA-pq67-6m6q-mj2v, bsc#1244925)
- Add python36-urllib3 provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-zipp
-
- Add python36-zipp provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-paramiko
-
- Update to 3.5.1
* [Bug] #2490: Private key material is now explicitly ‘unpadded’ during
decryption, removing a reliance on some lax OpenSSL behavior & making
us compatible with future Cryptography releases. Patch courtesy of
Alex Gaynor.
- reenable python 313 build
- Update to 3.5.0:
* [Feature] #982: (via #2444, which was a rebase of #2157)
Add support for AES-GCM encryption ciphers (128 and 256 bit variants).
Thanks to Alex Gaynor for the report (& for cryptography review),
Shen Cheng for the original PR, and Chris Mason for the updated PR;
plus as usual to everyone who tested the patches and reported their results!
This functionality has been tested in client mode against OpenSSH 9.0, 9.2,
and 9.6, as well as against a number of proprietary appliance SSH servers.
- Update to 3.4.1:
* Fix a 64-bit-ism in the test suite so the tests don't
encounter a false negative on 32-bit systems.
* Modify a test-harness skiptest check to work with newer
versions of Cryptography.
* Massage our import of the TripleDES cipher to support
Cryptography >=43; this should prevent
CryptographyDeprecationWarning from appearing upon import.
- Remove patches that are not needed anymore since they've
been fixed upstream:
* support-pytest-8.patch
* use-64-bit-maxsize-everywhere.patch
- Add patch support-pytest-8.patch:
* Use non-deprecated setup method to support pytest >= 8.
- salt
-
- Add `minion_legacy_req_warnings` option to avoid noisy warnings
- Require M2Crypto >= 0.44.0 for SUSE Family distros
- Added:
* add-minion_legacy_req_warnings-option-to-avoid-noisy.patch
- Prevent tests failures when pygit2 is not present
- Several fixes for security issues
(bsc#1244561, CVE-2024-38822)
(bsc#1244564, CVE-2024-38823)
(bsc#1244565, CVE-2024-38824)
(bsc#1244566, CVE-2024-38825)
(bsc#1244567, CVE-2025-22240)
(bsc#1244568, CVE-2025-22236)
(bsc#1244570, CVE-2025-22241)
(bsc#1244571, CVE-2025-22237)
(bsc#1244572, CVE-2025-22238)
(bsc#1244574, CVE-2025-22239)
(bsc#1244575, CVE-2025-22242)
* Request server hardening
* Prevent traversal in local_cache::save_minions
* Add test and fix for file_recv cve
* Fix traversal in gitfs find_file
* Fix traversal in salt.utils.virt
* Fix traversal in pub_ret
* Reasonable failures when pillars timeout
* Make send_req_async wait longer
* Remove token to prevent decoding errors
* Fix checking of non-url style git remotes
* Allow subdirs in GitFS find_file check
- Add subsystem filter to udev.exportdb (bsc#1236621)
- tornado.httputil: raise errors instead of logging in
multipart/form-data parsing (CVE-2025-47287, bsc#1243268)
- Fix Ubuntu 24.04 edge-case test failures
- Fix broken tests for Ubuntu 24.04
- Fix refresh of osrelease and related grains on Python 3.10+
- Make "salt" package to obsolete "python3-salt" package on SLE15SP7+
- Fix issue requiring proper Python flavor for dependencies and recommended package
- Added:
* fix-tests-issues-in-salt-shaker-environments-721.patch
* several-fixes-for-security-issues.patch
* add-subsystem-filter-to-udev.exportdb-bsc-1236621-71.patch
* fix-of-cve-2025-47287-bsc-1243268-718.patch
* fix-ubuntu-24.04-specific-failures-716.patch
* fix-debian-tests-715.patch
* fix-refresh-of-osrelease-and-related-grains-on-pytho.patch
- regionServiceClientConfigEC2
-
- Update to version 5.0.0 (bsc#1246995)
+ SLE 16 python-requests requiers SSL v3 certificates. Update 2
region server certs to support SLE 16 when it gets released.
- Update dependency to accomodate metadata binary package name change
in SLE 16 (bsc#1243419)
- rubygem-gem2rpm
-
- update suse.patch
- use opensuse template on sles as well
- update suse.patch
- on newer rubies Kernel.open is no longer working with URIs.
use URI.open()
- also treat contributing as documentation.
- instead of using %{ruby} for the buildrequires, lets expand it
in the spec file so we do not have to use
rb_build_ruby_abis/rb_build_version
- runc
-
- Update to runc v1.2.6. Upstream changelog is available from
<https://github.com/opencontainers/runc/releases/tag/v1.2.6>.
- Update to runc v1.2.5. Upstream changelog is available from
<https://github.com/opencontainers/runc/releases/tag/v1.2.5>.
- Update to runc v1.2.4. Upstream changelog is available from
<https://github.com/opencontainers/runc/releases/tag/v1.2.4>.
- Update runc.keyring to match upstream.
- Update to runc v1.2.3. Upstream changelog is available from
<https://github.com/opencontainers/runc/releases/tag/v1.2.3>.
- Update to runc v1.2.2. Upstream changelog is available from
<https://github.com/opencontainers/runc/releases/tag/v1.2.2>.
- Update to runc v1.2.1. Upstream changelog is available from
<https://github.com/opencontainers/runc/releases/tag/v1.2.1>.
- Update to runc v1.2.0. Upstream changelog is available from
<https://github.com/opencontainers/runc/releases/tag/v1.2.0>.
- Remove upstreamed patches.
- 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch
- 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch
- 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch
- 0004-bsc1214960-nsenter-cloned_binary-remove-bindfd-logic.patch
- Update to runc v1.2.0~rc3. Upstream changelog is available from
<https://github.com/opencontainers/runc/releases/tag/v1.2.0-rc.3>.
Includes the patch for CVE-2024-45310. bsc#1230092
- sudo
-
- Fix a possible local privilege escalation via the --host option
[bsc#1245274, CVE-2025-32462]
- Fix a possible local privilege Escalation via chroot option
[bsc#1245275, CVE-2025-32463]
- suse-build-key
-
- adjust UID (name + email) of SLES16 signing key with official
names. (bsc#1245223)
- suse-module-tools
-
- Update to version 15.7.6:
* spec file: add missing util-linux requirement (bsc#1241038)
- systemd-presets-branding-SLE
-
- enable sysstat_collect.timer and sysstat_summary.timer [bsc#1244553]
and [bsc#1246835]
- modified sources
% default-SLE.preset
- systemd-rpm-macros
-
- Bump version to 16
- Introduce %udev_trigger_with_reload() for packages that need to trigger events
in theirs scriplets. The new macro automatically triggers a reload of the udev
rule files as this step is often overlooked by packages (bsc#1237143).
- vim
-
- Fix bsc#1228776 / CVE-2024-41965.
- Fix bsc#1239602 / CVE-2025-29768.
- Refresh patch:
vim-7.3-sh_is_bash.patch
- Update to 9.1.1406:
9.1.1406: crash when importing invalid tuple
9.1.1405: tests: no test for mapping with special keys in session file
9.1.1404: wrong link to Chapter 2 in new-tutor
9.1.1403: expansion of 'tabpanelopt' value adds wrong values
9.1.1402: multi-byte mappings not properly stored in session file
9.1.1401: list not materialized in prop_list()
9.1.1400: [security]: use-after-free when evaluating tuple fails
9.1.1399: tests: test_codestyle fails for auto-generated files
9.1.1398: completion: trunc does not follow Pmenu highlighting attributes
9.1.1397: tabpanel not correctly updated on :tabonly
9.1.1396: 'errorformat' is a global option
9.1.1395: search_stat not reset when pattern differs in case
9.1.1394: tabpanel not correctly redrawn on tabonly
9.1.1393: missing test for switching buffers and reusing curbuf
9.1.1392: missing patch number
9.1.1391: Vim does not have a vertical tabpanel
9.1.1390: style: more wrong indentation
9.1.1389: completion: still some issue when 'isexpand' contains a space
9.1.1388: Scrolling one line too far with 'nosmoothscroll' page scrolling
9.1.1387: memory leak when buflist_new() fails to reuse curbuf
9.1.1386: MS-Windows: some minor problems building on AARCH64
9.1.1385: inefficient loop for 'nosmoothscroll' scrolling
9.1.1384: still some problem with the new tutors filetype plugin
9.1.1383: completion: 'isexpand' option does not handle space char correct
9.1.1382: if_ruby: unused compiler warnings from ruby internals
9.1.1381: completion: cannot return to original text
9.1.1380: 'eventignorewin' only checked for current buffer
9.1.1379: MS-Windows: error when running evim when space in path
9.1.1378: sign without text overwrites number option
9.1.1377: patch v9.1.1370 causes some GTK warning messages
9.1.1376: quickfix dummy buffer may remain as dummy buffer
9.1.1375: [security]: possible heap UAF with quickfix dummy buffer
9.1.1374: completion: 'smartcase' not respected when filtering matches
9.1.1373: 'completeopt' checking logic can be simplified
9.1.1372: style: braces issues in various files
9.1.1371: style: indentation and brace issues in insexpand.c
9.1.1370: CI Tests favor GTK2 over GTK3
9.1.1369: configure still using autoconf 2.71
9.1.1368: GTK3 and GTK4 will drop numeric cursor support.
9.1.1367: too many strlen() calls in gui.c
9.1.1366: v9.1.1364 unintentionally changed sign.c and sound.c
9.1.1365: MS-Windows: compile warnings and too many strlen() calls
9.1.1364: style: more indentation issues
9.1.1363: style: inconsistent indentation in various files
9.1.1362: Vim9: type ignored when adding tuple to instance list var
9.1.1361: [security]: possible use-after-free when closing a buffer
9.1.1360: filetype: GNU Radio companion files are not recognized
9.1.1359: filetype: GNU Radio config files are not recognized
9.1.1358: if_lua: compile warnings with gcc15
9.1.1357: Vim incorrectly escapes tags with "[" in a help buffer
9.1.1356: Vim9: crash when unletting variable
9.1.1355: The pum_redraw() function is too complex
9.1.1354: tests: Test_terminalwinscroll_topline() fails on Windows
9.1.1353: missing change from v9.1.1350
9.1.1352: style: inconsistent indent in insexpand.c
9.1.1351: Return value of getcmdline() inconsistent in CmdlineLeavePre
9.1.1350: tests: typo in Test_CmdlineLeavePre_cabbr()
9.1.1349: CmdlineLeavePre may trigger twice
9.1.1348: still E315 with the terminal feature
9.1.1347: small problems with gui_w32.c
9.1.1346: missing out-of-memory check in textformat.c
9.1.1345: tests: Test_xxd_color2() test failure dump diff is misleading
9.1.1344: double free in f_complete_match() (after v9.1.1341)
9.1.1343: filetype: IPython files are not recognized
9.1.1342: Shebang filetype detection can be improved
9.1.1341: cannot define completion triggers
9.1.1340: cannot complete :filetype arguments
9.1.1339: missing out-of-memory checks for enc_to_utf16()/utf16_to_enc()
9.1.1338: Calling expand() interferes with cmdcomplete_info()
9.1.1337: Undo corrupted with 'completeopt' "preinsert" when switching buffer
9.1.1336: comment plugin does not support case-insensitive 'commentstring'
9.1.1335: Coverity complains about Null pointer dereferences
9.1.1334: Coverity complains about unchecked return value
9.1.1333: Coverity: complains about unutilized variable
9.1.1332: Vim9: segfault when using super within a lambda
9.1.1331: Leaking memory with cmdcomplete()
9.1.1330: may receive E315 in terminal
9.1.1329: cannot get information about command line completion
9.1.1328: too many strlen() calls in indent.c
9.1.1327: filetype: nroff detection can be improved
9.1.1326: invalid cursor position after 'tagfunc'
9.1.1325: tests: not checking error numbers properly
9.1.1324: undefined behaviour if X11 connection dies
9.1.1323: b:undo_ftplugin not executed when re-using buffer
9.1.1322: small delete register cannot paste multi-line correctly
9.1.1321: filetype: MS ixx and mpp files are not recognized
9.1.1320: filetype: alsoft config files are not recognized
9.1.1319: Various typos in the code, issue with test_inst_complete.vim
9.1.1318: tests: test_format fails
9.1.1317: noisy error when restoring folds from session fails
9.1.1316: missing memory allocation failure in os_mswin.c
9.1.1315: completion: issue with fuzzy completion and 'completefuzzycollect'
9.1.1314: max allowed string width too small
9.1.1313: compile warning about uninitialized value
9.1.1312: tests: Test_backupskip() fails when HOME is defined
9.1.1311: completion: not possible to limit number of matches
9.1.1310: completion: redundant check for preinsert effect
9.1.1309: tests: no test for 'pummaxwidth' with non-truncated "kind"
9.1.1308: completion: cannot order matches by distance to cursor
9.1.1307: make syntax does not reliably detect different flavors
9.1.1306: completion menu rendering can be improved
9.1.1305: completion menu active after switching windows/tabs
9.1.1304: filetype: some man files are not recognized
9.1.1303: missing out-of-memory check in linematch.c
9.1.1302: Coverity warns about using uninitialized value
9.1.1301: completion: cannot configure completion functions with 'complete'
9.1.1300: wrong detection of -inf
9.1.1299: filetype: mbsyncrc files are not recognized
9.1.1298: define_function() is too long
9.1.1297: Ctrl-D scrolling can get stuck
9.1.1296: completion: incorrect truncation logic
9.1.1295: clientserver: does not handle :stopinsert correctly
9.1.1294: gui tabline menu does not use confirm when closing tabs
9.1.1293: comment plugin does not handle 'exclusive' selection for comment object
9.1.1292: statusline not correctly evaluated
9.1.1291: too many strlen() calls in buffer.c
9.1.1290: tests: missing cleanup in test_filetype.vim
9.1.1289: tests: no test for matchparen plugin with WinScrolled event
9.1.1288: Using wrong window in ll_resize_stack()
9.1.1287: quickfix code can be further improved
9.1.1286: filetype: help files not detected when 'iskeyword' includes ":"
9.1.1285: Vim9: no error message for missing method after "super."
9.1.1284: not possible to configure pum truncation char
9.1.1283: quickfix stack is limited to 10 items
9.1.1282: Build and test failure without job feature
9.1.1281: extra newline output when editing stdin
9.1.1280: trailing additional semicolon in get_matches_in_str()
9.1.1279: Vim9: null_object and null_class are no reserved names
9.1.1278: Vim9: too long functions in vim9type.c
9.1.1277: tests: trailing comment char in test_popupwin
9.1.1276: inline word diff treats multibyte chars as word char
9.1.1275: MS-Windows: Not possible to pass additional flags to Make_mvc
9.1.1274: Vim9: no support for object<type> as variable type
9.1.1273: Coverity warns about using uninitialized value
9.1.1272: completion: in keyword completion Ctrl_P cannot go back after Ctrl_N
9.1.1271: filetype: Power Query files are not recognized
9.1.1270: missing out-of-memory checks in buffer.c
9.1.1269: completion: compl_shown_match is updated when starting keyword completion
9.1.1268: filetype: dax files are not recognized
9.1.1267: Vim9: no support for type list/dict<object<any>>
9.1.1266: MS-Windows: type conversion warnings
9.1.1265: tests: no tests for typing normal char during completion
9.1.1264: Vim9: error when comparing objects
9.1.1263: string length wrong in get_last_inserted_save()
9.1.1262: heap-buffer-overflow with narrow 'pummaxwidth' value
9.1.1261: No test for 'pummaxwidth' non-truncated items
9.1.1260: Hang when filtering buffer with NUL bytes
9.1.1259: some issues with comment package and tailing spaces
9.1.1258: regexp: max \U and \%U value is limited by INT_MAX
9.1.1257: Mixing vim_strsize() with mb_ptr2cells() in pum_redraw()
9.1.1256: if_python: duplicate tuple data entries
9.1.1255: missing test condition for 'pummaxwidth' setting
9.1.1254: need more tests for the comment plugin
9.1.1253: abort when closing window with attached quickfix data
9.1.1252: typos in code and docs related to 'diffopt' "inline:"
9.1.1251: if_python: build error with tuples and dynamic python
9.1.1250: cannot set the maximum popup menu width
9.1.1249: tests: no test that 'listchars' "eol" doesn't affect "gM"
9.1.1248: compile error when building without FEAT_QUICKFIX
9.1.1247: fragile setup to get (preferred) keys from key_name_entry
9.1.1246: coverity complains about some changes in v9.1.1243
9.1.1245: need some more tests for curly braces evaluation
9.1.1244: part of patch v9.1.1242 was wrong
9.1.1243: diff mode is lacking for changes within lines
9.1.1242: Crash when evaluating variable name
9.1.1241: wrong preprocessort indentation in term.c
9.1.1240: Regression with ic/ac text objects and comment plugin
9.1.1239: if_python: no tuple data type support
9.1.1238: wrong cursor column with 'set splitkeep=screen'
9.1.1237: Compile error with C89 compiler in term.c
9.1.1236: tests: test_comments leaves swapfiles around
9.1.1235: cproto files are outdated
9.1.1234: Compile error when SIZE_MAX is not defined
9.1.1233: Coverity warns about NULL pointer when triggering WinResized
9.1.1232: Vim script is missing the tuple data type
9.1.1231: filetype: SPA JSON files are not recognized
9.1.1230: inconsistent CTRL-C behaviour for popup windows
9.1.1229: the comment plugin can be improved
9.1.1228: completion: current position column wrong after got a match
9.1.1227: no tests for the comment package
9.1.1226: "shellcmdline" completion doesn't work with input()
9.1.1225: extra NULL check in VIM_CLEAR()
9.1.1224: cannot :put while keeping indent
9.1.1223: wrong translation used for encoding failures
9.1.1222: using wrong length for last inserted string
9.1.1221: Wrong cursor pos when leaving Insert mode just after 'autoindent'
9.1.1220: filetype: uv.lock file not recognized
9.1.1219: Strange error with wrong type for matchfuzzy() "camelcase"
9.1.1218: missing out-of-memory check in filepath.c
9.1.1217: tests: typos in test_matchfuzzy.vim
9.1.1216: Pasting the '.' register multiple times may not work
9.1.1215: Patch 9.1.1213 has some issues
9.1.1214: matchfuzzy() can be improved for camel case matches
9.1.1213: cannot :put while keeping indent
9.1.1212: too many strlen() calls in edit.c
9.1.1212: filetype: logrotate'd pacmanlogs are not recognized
9.1.1211: TabClosedPre is triggered just before the tab is being freed
9.1.1210: translation(ru): missing Russian translation for the new tutor
9.1.1209: colorcolumn not drawn after virtual text lines
9.1.1208: MS-Windows: not correctly restoring alternate screen on Win 10
9.1.1207: MS-Windows: build warning in filepath.c
9.1.1206: tests: test_filetype fails when a file is a directory
9.1.1205: completion: preinserted text not removed when closing pum
9.1.1204: MS-Windows: crash when passing long string to expand()
9.1.1203: matchparen keeps cursor on case label in sh filetype
9.1.1202: Missing TabClosedPre autocommand
9.1.1201: 'completefuzzycollect' does not handle dictionary correctly
9.1.1200: cmdline pum not cleared for input() completion
9.1.1199: gvim uses hardcoded xpm icon file
9.1.1198: [security]: potential data loss with zip.vim
9.1.1197: process_next_cpt_value() uses wrong condition
9.1.1196: filetype: config files for container tools are not recognized
9.1.1195: inside try-block: fn body executed with default arg undefined
9.1.1194: filetype: false positive help filetype detection
9.1.1193: Unnecessary use of STRCAT() in au_event_disable()
9.1.1192: Vim crashes with term response debug logging enabled
9.1.1191: tests: test for patch 9.1.1186 doesn't fail without the patch
9.1.1190: C indentation does not detect multibyte labels
9.1.1189: if_python: build error due to incompatible pointer types
9.1.1188: runtime(tera): tera support can be improved
9.1.1187: matchparen plugin wrong highlights shell case statement
9.1.1186: filetype: help files in git repos are not detected
9.1.1185: endless loop with completefuzzycollect and no match found
9.1.1184: Unnecessary use of vim_tolower() in vim_strnicmp_asc()
9.1.1083: "above" virtual text breaks cursorlineopt=number
9.1.1182: No cmdline completion for 'completefuzzycollect'
9.1.1181: Unnecessary STRLEN() calls in insexpand.c
9.1.1180: short-description
9.1.1179: too many strlen() calls in misc2.c
9.1.1178: not possible to generate completion candidates using fuzzy matching
9.1.1177: filetype: tera files not detected
- xen
-
- Upstream bug fixes (bsc#1027519)
687a40ac-x86-C6-eoi_errata-include-NEHALEM_EX.patch
68931694-x86-HPET-defer-LAPIC-EOI.patch
689b0c0c-EFI-cond-FreePages.patch
68a2e770-x86-mkelf32-pad-segment-to-2Mb.patch
68a2e7c8-x86-HVM-ioreq-inverted-condition.patch
68a6ed85-x86-setup-MMCFG-ahead-of-IOMMU.patch
68ac5f69-x86-adjustments-to-intel_init_ppin.patch
- bsc#1248807 - VUL-0: CVE-2025-27466, CVE-2025-58142,
CVE-2025-58143: xen: Mutiple vulnerabilities in the Viridian
interface (XSA-472)
xsa472-1.patch
xsa472-2.patch
xsa472-3.patch
- Update to Xen 4.20.1 bug fix release (jsc#PED-8907)
* No upstream changelog found in sources or webpage
- bsc#1246112, bsc#1238896 - VUL-0: xen: More AMD transient
execution attack (CVE-2024-36350, CVE-2024-36357, XSA-471)
Patches contained in new tarball for 4.20.1
- Drop patches contained in new tarball
67c818d4-x86-log-unhandled-mem-accesses-for-PVH-dom0.patch
67c818d5-x86-fixup-p2m-page-faults-for-PVH-dom0.patch
67c818d6-x86-PVH-dom0-correct-iomem_caps-bound.patch
67c818d7-x86-IOMMU-account-for-IOMEM-caps-when-populating.patch
67c818d8-x86-Dom0-relax-Interrupt-Address-Range.patch
67c86fc1-xl-fix-channel-configuration-setting.patch
67cb03e0-x86-vlapic-ESR-write-handling.patch
67d17edd-x86-expose-MSR_FAM10H_MMIO_CONF_BASE-on-AMD.patch
67d17ede-VT-x-PI-usage-of-msi_desc-msg-field.patch
67d2a3fe-libxl-avoid-infinite-loop-in-libxl__remove_directory.patch
67dada68-x86-mm-IS_ALIGNED-in-IS_LnE_ALIGNED.patch
67ea4268-x86-P2M-sync-fast-slow-p2m_get_page_from_gfn.patch
67ea428e-percpu-dont-init-on-resume.patch
67f8ecda-rangeset-incorrect-subtraction.patch
6800b54f-x86-HVM-update-repeat-count-upon.patch
68076044-x86emul-clip-rep-count-for-STOS.patch
6808f549-x86-Intel-work-around-MONITOR-MWAIT-errata.patch
68221f20-x86-alternative-when-feature-not-present.patch
68221f21-x86-guest-remove-Xen-hypercall_page.patch
68221f22-x86-misalign-__x86_indirect_thunk.patch
68221f23-x86-misalign-RETs-in-clear_bhb_loops.patch
68221f24-x86-stubs-introduce-place_ret.patch
68221f25-x86-build-with-Return-Thunks.patch
68221f26-x86-spec-ctrl-synthesise-ITS_NO.patch
682dff83-x86-vPCI-BAR-overlaps-with-non-holes.patch
6835a042-VMX-VMEntry-failure-on-ADL-SPR-with-shadow.patch
6835a043-x86-PV-breakpoint-reporting.patch
xsa470.patch
- bsc#1244644 - VUL-0: CVE-2025-27465: xen: x86: Incorrect stubs
exception handling for flags recovery (XSA-470)
xsa470.patch
- Upstream bug fixes (bsc#1027519)
682dff83-x86-vPCI-BAR-overlaps-with-non-holes.patch
6835a042-VMX-VMEntry-failure-on-ADL-SPR-with-shadow.patch
6835a043-x86-PV-breakpoint-reporting.patch
- bsc#1243117 - VUL-0: CVE-2024-28956: xen: Intel CPU: Indirect
Target Selection (ITS) (XSA-469)
68221f20-x86-alternative-when-feature-not-present.patch
68221f21-x86-guest-remove-Xen-hypercall_page.patch
68221f22-x86-misalign-__x86_indirect_thunk.patch
68221f23-x86-misalign-RETs-in-clear_bhb_loops.patch
68221f24-x86-stubs-introduce-place_ret.patch
68221f25-x86-build-with-Return-Thunks.patch
68221f26-x86-spec-ctrl-synthesise-ITS_NO.patch
- Upstream bug fixes (bsc#1027519)
67dada68-x86-mm-IS_ALIGNED-in-IS_LnE_ALIGNED.patch
67ea4268-x86-P2M-sync-fast-slow-p2m_get_page_from_gfn.patch
67ea428e-percpu-dont-init-on-resume.patch
67f8ecda-rangeset-incorrect-subtraction.patch
6800b54f-x86-HVM-update-repeat-count-upon.patch
68076044-x86emul-clip-rep-count-for-STOS.patch
6808f549-x86-Intel-work-around-MONITOR-MWAIT-errata.patch
- yast2-iscsi-client
-
- Fix the initialization of the valid iscsi offload cards not
bringing up the network cards with an empty iface name
(bsc#1246210).
- Ensure to hide passwords (bsc#1246833)
- 4.7.6
- yast2
-
- Do not try installing packages into the inst-sys during
installation (bsc#1240867)
- 4.7.1
- yast2-packager
-
- Fix Internal Error: Encoding::CompatibilityError when
adding SLE-HA as add-on product (bsc#1245555)
- 4.7.1
- yast2-users
-
- Add a missing require (bsc#1248291).
- zsh
-
- Update to version 5.8.1
* Dropped patches, which are included upstream now:
- CVE-2019-20044.patch
- CVE-2021-45444.patch
* See included NEWS file for complete changes
* Implements ECO PED-12771
- zypper
-
- Fix addrepo to handle explicit --check and --no-check requests
(bsc#1246466)
- Accept "show" as alias for "info" (bsc#1245985)
- version 1.14.93
- sh: Reset solver options after command (bsc#1245496)
- Explicitly selecting DownloadAsNeeded also selects the
classic_rpmtrans backend.
- version 1.14.92
- BuildRequires: libzypp-devel >= 17.37.6.
Enhancements regarding mirror handling during repo refresh. Adapt
to libzypp API changes. (bsc#1230267)
- version 1.14.91