- kernel-binary: Only apply vmlinux workaround on SLE15 and later
  To create debuginfo for vmlinux the file needs to be present even if
  it's not packaged because a compressed file is packaged insteand.
  To accomplish that the file is marked as ghost in the file list. Then
  rpm does not complain that the file exists but does not package it.
  However, rpm still reserves space for ghost files when installing a
  package. To avoid reserving space for a file that is not used the file
  is truncated.
  That works on SLE 15 but on SLE 12 rpm then fails packaging the
  debuginfo complaiing that extra debuginfo files are present. Limit the
  workaround to SLE 15 and later.
  Fixes: 222edac2a18 (kernel-binary: prevent uncompressed vmlinux from inflating rpm size requirements)
- commit 1ef7451

- scsi: target: iscsi: validate CHAP_R length before base64 decode
  (bsc#1265449).
- commit 9997c88

- net: mana: Fix crash from unvalidated SHM offset read from BAR0 during FLR (bsc#1265846).
- net: mana: remove double CQ cleanup in mana_create_rxq error path (git-fixes).
- net: mana: Skip WQ object destruction for uninitialized RXQ (git-fixes).
- net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() (git-fixes).
- RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() (git-fixes).
- RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() (git-fixes).
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (git-fixes).
- RDMA/mana: Validate rx_hash_key_len (git-fixes).
- hv_sock: fix ARM64 support (git-fixes).
- commit 18c2af9

- Kernel-binary: Do not truncate vmlinux when it's the boot image
  Some architectures use vmlinux to boot. Truncating vmlinux on those
  architectures causes signing failure during build. Also if the signing
  was disabled a brokne kernel would be produced.
  Fixes: 222edac2a18 (kernel-binary: prevent uncompressed vmlinux from inflating rpm size requirements)
- commit d3cf603

- perf: Fix __perf_event_overflow() vs perf_remove_from_context()
  race (bsc#1260018 CVE-2026-23271).
- commit d05430f

- kernel-binary: prevent uncompressed vmlinux from inflating rpm size requirements
  define %__spec_install_post to truncate the uncompressed vmlinux
  to 0 bytes after find-debuginfo.sh and brp-* scripts run. This prevents
  rpmbuild from baking the %ghost file size into the FILESIZES
  header, which can cause installation failures on smaller /boot partitions.
  Fixes: bsc#1265456
- commit 222edac

- net/rds: reset op_nents when zerocopy page pin fails
  (bsc#1265626, CVE-2026-43494).
- net/rds: reset op_nents when zerocopy page pin fails
  (bsc#1265626).
- commit b66d9fc

- perf: Make sure to use pmu_ctx->pmu for groups (bsc#1263001
  CVE-2026-31528).
- commit 2f72854

- net/sched: fix pedit partial COW leading to page cache corruption
  (bsc#1265421).
- commit a756c69

- RDMA/irdma: Fix double free related to rereg_user_mr (CVE-2026-43120)
- commit c514796

- Security fixes:
  * CVE-2026-33846: buffers: add more checks to DTLS reassembly (bsc#1263705)
  * CVE-2026-42009: lib/buffers: ensure packets have differing sequence numbers (bsc#1263708)
  * CVE-2026-33845: buffers: switch from end_offset over to frag_length (bsc#1263704)
  * CVE-2026-42010: lib/auth/rsa_psk: fix binary PSK identity lookup (bsc#1263709)
  * CVE-2026-3833: x509/name-constraints: compare domain names case-insensitive (bsc#1263707)
  * CVE-2026-42011: x509/name_constraints: fix intersecting empty constraints (bsc#1263710)
  * CVE-2026-42012: x509/hostname-verify: make URI/SRV SAN preclude CN fallback (bsc#1263711)
  * CVE-2026-42013: x509: prevent fallback on oversized SAN (bsc#1263712)
  * CVE-2026-42014: pkcs11_write: fix UAF and leak in gnutls_pkcs11_token_set_pin (bsc#1263713)
  * CVE-2026-42015: x509/pkcs12_bag: fix off-by-one in bag element bounds check (bsc#1263714)
  * CVE-2026-5260: lib/pkcs11_privkey: guard against overreading on short ciphertexts (bsc#1263715)
  * CVE-2026-5419: gnutls_cipher_decrypt3: make PKCS#7 unpadding branch free (bsc#1263716)
  * Add patches:
    gnutls-CVE-2026-33846.patch gnutls-CVE-2026-42009.patch
    gnutls-CVE-2026-33845.patch gnutls-CVE-2026-42010.patch
    gnutls-CVE-2026-3833.patch  gnutls-CVE-2026-42011.patch
    gnutls-CVE-2026-42012.patch gnutls-CVE-2026-42013.patch
    gnutls-CVE-2026-42014.patch gnutls-CVE-2026-5260.patch
    gnutls-CVE-2026-42015.patch gnutls-CVE-2026-5419.patch

- Fix buffer overflow in lzma_index_append (bsc#1261280, CVE-2026-34743)
  * CVE-2026-34743.patch
- Change SUSE-Public-Domain license to LicenseRef-SUSE-Public-Domain to
  fix rpmlint errors

- bsc#1250782 Fix 30-test_fips_sli.t fails intermittently on s390x:
  Fix AES_GCM IV test sometimes failing on s390x.
  * Add openssl-fix-fips-slitest-s390x.patch

- Add python36-certifi provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-idna provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-packaging provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-pycparser provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-py provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-six provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- CVE-2026-44431: sensitive information disclosure due to sensitive
  headers being forwarded across origins in proxied low-level redirects
  (bsc#1265267)
  Add patch CVE-2026-44431.patch

- fix regression in CVE-2025-66471.patch when downloading large files
  (bsc#1259829)

- CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
  (bso#16033); (bsc#1261161).
- CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
  (bsc#1261163).
- CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
  nbt server; (bso#16012); (bsc#1261160).
- CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
  enrollment using http:// without validation;(bso#16003);
  (bsc#1261159).
- CVE-2026-2340: vfs_worm does not block directory modification;
  (bso#15997); (bsc#1261158).