- apparmor
-
- Update apparmor-lessopen-profile.patch:
* Allow execution of /usr/bin/zstd (bsc#1265620)
- bind
-
- Force use of python3.11 since the required minimum version is now
3.10. This is only really relevant for the tests.
[bsc#1263494]
- Upgrade to release 9.20.23
https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
Security-Fixes:
* Amplification vulnerabilities via self-pointed glue records.
(CVE-2026-3592)
[bsc#1265592]
* server memory exhaustion during GSS-API TKEY negotiation.
(CVE-2026-3039)
[bsc#1265591]
* Unbounded resend loop in BIND 9 resolver
(CVE-2026-5950)
[bsc#1265596]
* SIG(0) validation during query flood may lead to undefined
behavior.
(CVE-2026-5947)
[bsc#1265595]
* Invalid handling of CLASS != IN.
(CVE-2026-5946)
[bsc#1265594]
- cifs-utils
-
- CVE-2026-12505: cifs.upcall: remove getpwuid() dependency
(bsc#1267389)
* add cifs.upcall-remove-getpwuid-dependency.patch
- containerd
-
- Add patch for CVE-2026-34986 (bsc#1262948)
* 0003-CVE-2026-34986-Bump-go-jose-to-v3.0.5.patch
- Add patch for CVE-2026-39821 (bsc#1266640)
* 0004-CVE-2026-39821-idna-update-from-x-text-fix-ToUnicode.patch
- Add patch for CVE-2026-33814 (bsc#1265794)
* 0005-CVE-2026-33814-http2-prevent-hanging-Transport-due-t.patch
- Add patch for CVE-2026-33186 (bsc#1260296):
* 0002-CVE-2026-33186-containerd-google.golang.org-grpc-aut.patch
- coreutils
-
- proc: Use affinity mask even on systems with more than 1024 CPUs (bsc#1259327)
- add coreutils-gnulib-nproc-Use-affinity-mask-even-on-systems-with-more-th.patch
- curl
-
- Call http_size() first to prioritize Transfer-Encoding: chunked over a zero
Content-Length empty body check (bsc#1264971)
* Add patch: curl-http-prefer-chunked-encoding-over-Content-Length-0.patch
- dracut
-
- Update to version 059+suse.568.g200aa75e:
* fix(systemd): explicitly install /bin/bash (bsc#1263940)
- glibc
-
- ungetwc-byte-stream.patch: libio: Fix ungetwc operating on byte stream
(CVE-2026-5928, bsc#1262464, BZ #33998)
- scanf-mc-buffer-overflow.patch: stdio-common: Fix buffer overflow in
scanf %mc (CVE-2026-5450, bsc#1262465, BZ #34008)
- ibm139x-pending-char-state.patch: Use pending character state in
IBM1390, IBM1399 character sets (CVE-2026-4046, bsc#1261206, BZ #33980)
- hwdata
-
- update to 0.406:
* Update pci and vendor ids
- update to 0.405:
* Update pci and vendor ids
- Update to version 0.397:
* Update pci and vendor ids
- Update to version 0.395:
* Update pci and vendor ids
- iproute2
-
- add DPLL support (bsc#1255752 jsc#PED-14083)
* dpll-Add-dpll-command.patch
* dpll-Fix-missing-notifications-in-monitor-mode.patch
* dpll-Send-object-per-event-in-JSON-monitor-mode.patch
* dpll-add-client-side-filtering-for-device-show.patch
* dpll-add-client-side-filtering-for-pin-show.patch
* dpll-add-direction-and-state-filtering-for-pin-show.patch
* dpll-add-mode-setting-support.patch
* dpll-add-pin-filtering-by-parent-device-and-parent-p.patch
* dpll-add-support-for-fractional-frequency-offset-in-.patch
* dpll-fix-pin-id-get-type-filter-parsing.patch
* lib-Add-str_to_bool-helper-function.patch
* lib-Move-mnlg-to-lib-for-shared-use.patch
- refresh
* patches/ss-escape-characters-in-command-name.patch
- update sync-UAPI-header-copies-with-SLE15-SP6.patch and rename
it to sync-UAPI-header-copies-with-SLE15-SP7.patch
- jq
-
- Add patch CVE-2026-33948.patch (CVE-2026-33948, bsc#1262043)
- kernel-default
-
- xfs: fix a resource leak in xfs_alloc_buftarg() (CVE-2026-46005
bsc#1267431).
- commit 08b4554
- EFI/CPER: don't dump the entire memory region (bsc#1264549
CVE-2026-43171).
- commit 0b53ad7
- ASoC: mediatek: mt8192: Release reserved memory on cleanup
(git-fixes).
- ASoC: mediatek: mt8183: Release reserved memory on cleanup
(git-fixes).
- ALSA: seq: Fix kernel heap address leak in bounce_error_event()
(git-fixes).
- ALSA: hda/cs35l41: Fix firmware load work teardown (git-fixes).
- drm/amdkfd: always resume_all after suspend_all (git-fixes).
- drm/syncobj: Fix memory leak in drm_syncobj_find_fence()
(git-fixes).
- drm/amd/pm: remove trailing semicolon from AMDGPU_PM_POLICY_ATTR
macro (git-fixes).
- drm/gpuvm: Do not prepare NULL objects (git-fixes).
- drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay
(git-fixes).
- drm/imagination: Fit paired fragment job in the correct CCCB
(git-fixes).
- drm/imagination: Count paired job fence as dependency in
prepare_job() (git-fixes).
- drm/panthor: Fix kernel-doc warning in panthor_sched.c
(git-fixes).
- Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path
(git-fixes).
- Bluetooth: hci_qca: fix NULL pointer dereference in
qca_dmp_hdr() for non-serdev device (git-fixes).
- commit 52f8808
- of: cpu: add check in __of_find_n_match_cpu_property()
(git-fixes).
- hwrng: virtio: clamp device-reported used.len at copy_data()
(git-fixes).
- soc: ti: k3-ringacc: Fix access mode for
k3_ringacc_ring_pop_tail_io/proxy (git-fixes).
- soc: fsl: qe: panic on ioremap() failure in qe_reset()
(git-fixes).
- gpu: host1x: Fix iommu_map_sgtable() return value check
(git-fixes).
- wifi: wcn36xx: fix OOB read from short trigger BA firmware
response (git-fixes).
- wifi: wcn36xx: fix OOB read from firmware count in
PRINT_REG_INFO indication (git-fixes).
- wifi: wcn36xx: fix heap overflow from oversized firmware HAL
response (git-fixes).
- wifi: mt76: mt7996: fix potential tx_retries underflow
(git-fixes).
- wifi: mt76: mt7925: fix potential tx_retries underflow
(git-fixes).
- wifi: mt76: mt7921: fix potential tx_retries underflow
(git-fixes).
- wifi: mt76: mt7915: fix potential tx_retries underflow
(git-fixes).
- wifi: mt76: fix argument to ieee80211_is_first_frag()
(git-fixes).
- wifi: mt76: mt7925: clean up DMA on probe failure (git-fixes).
- wifi: mac80211: fix monitor mode frame capture for real chanctx
drivers (git-fixes).
- wifi: rtw88: usb: fix memory leaks on USB write failures
(git-fixes).
- wifi: rtw88: increase TX report timeout to fix race condition
(git-fixes).
- wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor
(git-fixes).
- wifi: rtw88: fix OOB read from firmware RX descriptor exceeding
DMA buffer (git-fixes).
- wifi: rtw89: Correct data type for scan index to avoid infinite
loop (git-fixes).
- wifi: ath11k: fix warning when unbinding (git-fixes).
- wifi: ath9k: fix OOB access from firmware tx status queue ID
(git-fixes).
- wifi: cfg80211: fix grammar in MLO group key error message
(git-fixes).
- commit f3af1ec
- firmware: arm_scmi: Fix OOB in scmi_power_name_get()
(git-fixes).
- firmware: arm_scmi: Read sensor config as 32-bit value
(git-fixes).
- drm/amdgpu: set sub_block_index for mca ras sub-blocks
(git-fixes).
- drm/amd/display: Add missing kdoc for ALLM parameters
(git-fixes).
- drm/msm/dp: Fix the ISR_* enum values (git-fixes).
- drm/msm/dp: fix HPD state status bit shift value (git-fixes).
- drm/nouveau/bios: specify correct display fuse register for
Ampere and Ada (git-fixes).
- drm/tegra: Fix iommu_map_sgtable() return value check
(git-fixes).
- drm/tegra: dc: Fix device node reference leak in
tegra_dc_has_output() (git-fixes).
- gpu: host1x: Allow entries in BO caches to be freed (git-fixes).
- drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply
parsers (git-fixes).
- drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply
parsers (git-fixes).
- drm/hisilicon/hibmc: use clock to look up the PLL value
(git-fixes).
- drm/hisilicon/hibmc: move display contrl config to hibmc_probe()
(git-fixes).
- drm/dp/mst: fix buffer overflows in sideband chunk accumulation
(git-fixes).
- drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS()
(git-fixes).
- drm/hyperv: use VMBUS_RING_SIZE() (git-fixes).
- drm/amdkfd: Validate CRIU-restored IDs before idr_alloc
(git-fixes).
- commit 4affa42
- ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset
GPIO (git-fixes).
- ASoC: topology: Check PCM and DAI name strings before use
(git-fixes).
- ASoC: tegra: tegra210_ahub: Validate written enum value
(git-fixes).
- ASoC: fsl: fsl_audmix: Validate written enum values (git-fixes).
- ASoC: meson: aiu: Validate written enum values (git-fixes).
- ASoC: codecs: hdac_hdmi: Validate written enum value
(git-fixes).
- ASoC: SOF: topology: validate vendor array size before parsing
(git-fixes).
- ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend
fails (git-fixes).
- ASoC: cs35l56: Cleanup if component_probe fails (git-fixes).
- ASoC: cs35l56: Fix missing calls to wm_adsp2_remove()
(git-fixes).
- ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get
(git-fixes).
- ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get
(git-fixes).
- ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control
(git-fixes).
- ASoC: SOF: ipc3-control: Use overflow checks in control_update
size calc (git-fixes).
- ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put
(git-fixes).
- ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait()
(git-fixes).
- ALSA: aloop: Drop superfluous break (git-fixes).
- ALSA: seq: Clear variable event pointer on read (git-fixes).
- ALSA: seq: Fix partial userptr event expansion (git-fixes).
- ALSA: cmipci: check snd_ctl_new1() return value (git-fixes).
- ALSA: ymfpci: check snd_ctl_new1() return value (git-fixes).
- ALSA: ice1712: check snd_ctl_new1() return value (git-fixes).
- ALSA: gus: check snd_ctl_new1() return value (git-fixes).
- ALSA: es1938: check snd_ctl_new1() return value (git-fixes).
- ALSA: seq: midi: Serialize output teardown with event_input
(git-fixes).
- ALSA: virtio: Add missing 384 kHz PCM rate mapping (git-fixes).
- ALSA: usb-audio: Update Babyface Pro control caches only after
successful writes (git-fixes).
- ALSA: usb-audio: Roll back quirk control caches on write errors
(git-fixes).
- ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after
successful writes (git-fixes).
- ALSA: usb-audio: Propagate US-16x08 write errors in route/mix
EQ-switch put callbacks (git-fixes).
- ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()
(git-fixes).
- agp/amd64: Fix broken error propagation in agp_amd64_probe()
(git-fixes).
- drm/radeon: fix memory leak in radeon_ring_restore() on lock
failure (git-fixes).
- drm/radeon: fix integer overflow in radeon_align_pitch()
(git-fixes).
- drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch()
(git-fixes).
- drm/tidss: Fix missing drm_bridge_add() call (git-fixes).
- drm/tidss: Drop extra drm_mode_config_reset() call (git-fixes).
- drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video()
(git-fixes).
- Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()
(git-fixes).
- Bluetooth: vhci: validate devcoredump state before side effects
(git-fixes).
- Bluetooth: hci: validate codec capability element length
(git-fixes).
- Bluetooth: btusb: fix wakeup irq devres lifetime (git-fixes).
- Bluetooth: btusb: fix wakeup source leak on probe failure
(git-fixes).
- Bluetooth: btusb: fix use-after-free on marvell probe failure
(git-fixes).
- Bluetooth: btusb: fix use-after-free on registration failure
(git-fixes).
- Bluetooth: eir: Fix stack OOB write when prepending the Flags AD
(git-fixes).
- batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE
(git-fixes).
- batman-adv: tp_meter: add only finished tp_vars to lists
(git-fixes).
- batman-adv: tp_meter: handle seqno wrap-around for fast recovery
detection (git-fixes).
- batman-adv: tp_meter: fix fast recovery precondition
(git-fixes).
- batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd
(git-fixes).
- batman-adv: tp_meter: avoid window underflow (git-fixes).
- batman-adv: tp_meter: initialize dec_cwnd explicitly
(git-fixes).
- batman-adv: tp_meter: initialize dup_acks explicitly
(git-fixes).
- batman-adv: tp_meter: keep unacked list in ascending ordered
(git-fixes).
- commit 17b623a
- scripts/submit_branch: add SLE15-SP7 submission script
- commit 7ec25f3
- futex: Clear stale exiting pointer in futex_lock_pi() retry path
(CVE-2026-31555 bsc#1263178).
- commit bd7cbb0
- KVM: arm64: PMU: Preserve AArch32 counter low bits (git-fixes).
- commit 5901e22
- KVM: arm64: vgic-its: Reject restored DTE with out-of-range
num_eventid_bits (git-fixes).
- commit 66e5da3
- KVM: arm64: Guard against NULL vcpu on VHE hyp panic path
(git-fixes).
- commit f01d5d2
- KVM: arm64: Wake-up from WFI when iqrchip is in userspace
(git-fixes).
- commit ef45687
- KVM: arm64: Treat vCPU with pending SError as runnable
(git-fixes).
- commit 63eecf3
- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong
value (git-fixes).
- commit aa1b279
- KVM: arm64: Discard PC update state on vcpu reset (git-fixes).
- commit d16e788
- KVM: SEV: Ignore Port I/O requests of length '0' (git-fixes).
- commit 0709065
- KVM: SEV: Ignore MMIO requests of length '0' (git-fixes).
- commit 932a965
- ext4: convert inline data to extents when truncate exceeds inline size (CVE-2026-31452 bsc#1262620).
- commit 2076b97
- apparmor: fix invalid deref of rawdata when export_binary is unset (CVE-2026-45965 bsc#1267208).
- commit f325213
- libceph: Fix slab-out-of-bounds access in auth message processing (CVE-2026-46119 bsc#1267628).
- commit 9f3128e
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259 bsc#1267685).
- commit 6e9cb04
- cifs: some missing initializations on replay (bsc#1267744
CVE-2026-31693).
- commit b3b9535
- HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure (CVE-2026-43049 bsc#1264080)
- commit 40b2786
- bridge: br_nd_send: validate ND option lengths (CVE-2026-31752 bsc#1264045)
- commit 31bc659
- net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak (CVE-2026-43035 bsc#1263996)
- commit 155d3bd
- ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()
(CVE-2026-46172 bsc#1266903).
- openvswitch: cap upcall PID array size and pre-size vport
replies (CVE-2026-45840 bsc#1266397).
- ipv6: ioam: fix potential NULL dereferences in
__ioam6_fill_trace_data() (CVE-2026-43101 bsc#1264239).
- net: ipv6: flowlabel: defer exclusive option free until RCU
teardown (CVE-2026-31680 bsc#1263563).
- net: use skb_header_pointer() for TCPv4 GSO frag_off check
(CVE-2026-43036 bsc#1263993).
- commit 17a97e7
- iommu/vt-d: Flush cache for PASID table before using it
(CVE-2026-45862 bsc#1266705).
- commit 6d37ad7
- crypto: rng - Free default RNG on module exit (git-fixes).
- hwrng: jh7110 - fix refcount leak in starfive_trng_read()
(git-fixes).
- crypto: cavium/cpt - fix DMA cleanup using wrong loop index
(git-fixes).
- crypto: marvell/octeontx - fix DMA cleanup using wrong loop
index (git-fixes).
- crypto: qat - validate RSA CRT component lengths (git-fixes).
- crypto: pcrypt - restore callback for non-parallel fallback
(git-fixes).
- crypto: qat - protect service table iterations with service_lock
(git-fixes).
- crypto: hisilicon/qm - disable error report before flr
(git-fixes).
- X.509: Fix validation of ASN.1 certificate header (git-fixes).
- crypto: ecc - Fix carry overflow in vli multiplication
(git-fixes).
- crypto: amlogic - avoid double cleanup in meson_crypto_probe()
(git-fixes).
- crypto: af_alg - Cap AEAD AD length to 0x80000000 (git-fixes).
- crypto: ccp - Treat zero-length cert chain as query for blob
lengths (git-fixes).
- crypto: asymmetric_keys - fix OOB read in
pefile_digest_pe_contents (git-fixes).
- crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve
(git-fixes).
- crypto: atmel-sha204a - fix blocking and non-blocking rng logic
(git-fixes).
- crypto: drbg - Fix the fips_enabled priority boost (git-fixes).
- crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels
(git-fixes).
- crypto: drbg - Fix returning success on failure in CTR_DRBG
(git-fixes).
- crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one
(git-fixes).
- fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode
(git-fixes).
- fbdev: sm501fb: Fix buffer errors in OF binding code
(git-fixes).
- fbdev: sm712: Fix operator precedence in big_swap macro
(git-fixes).
- fbdev: vesafb: fix memory leak in vesafb_probe() (git-fixes).
- commit f4cdb00
- fbdev: uvesafb: fix potential memory leak in uvesafb_probe()
(git-fixes).
- fbdev: tridentfb: fix potential memory leak in
trident_pci_probe() (git-fixes).
- fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()
(git-fixes).
- fbdev: s3fb: fix potential memory leak in s3_pci_probe()
(git-fixes).
- fbdev: nvidia: fix potential memory leak in nvidiafb_probe()
(git-fixes).
- fbdev: i740fb: fix potential memory leak in i740fb_probe()
(git-fixes).
- fbdev: radeon: fix potential memory leak in
radeonfb_pci_register() (git-fixes).
- fbdev: metronomefb: fix potential memory leak in
metronomefb_probe() (git-fixes).
- fbdev: broadsheetfb: fix potential memory leak in
broadsheetfb_probe() (git-fixes).
- fbdev: hecubafb: fix potential memory leak in hecubafb_probe()
(git-fixes).
- hwmon: (it87) Clamp negative values to zero in set_fan()
(git-fixes).
- watchdog: unregister PM notifier on watchdog unregister
(git-fixes).
- watchdog: apple: Add "apple,t8103-wdt" compatible (git-fixes).
- watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on
register failure (git-fixes).
- watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH
(git-fixes).
- spi: xilinx: use FIFO occupancy register to determine buffer
size (git-fixes).
- spi: meson-spifc: fix runtime PM leak on remove (git-fixes).
- spi: ep93xx: fix double-free of zeropage on DMA setup failure
(git-fixes).
- spi: fsl-lpspi: terminate the RX channel on TX prepare failure
path (git-fixes).
- spi: fsl-lpspi: replace dmaengine_terminate_all() with
dmaengine_terminate_sync() (git-fixes).
- spi: at91-usart: drop dead runtime pm support (git-fixes).
- i2c: core: fix irq domain leak on adapter registration failure
(git-fixes).
- firmware_loader: Fix recursive lock in device_cache_fw_images()
(git-fixes).
- firmware_loader: fix device reference leak in
firmware_upload_register() (git-fixes).
- driver core: reject devices with unregistered buses (git-fixes).
- driver core: use READ_ONCE() for dev->driver in
dev_has_sync_state() (git-fixes).
- PM: sleep: Use complete() in device_pm_sleep_init() (git-fixes).
- thermal: hwmon: Fix critical temperature attribute removal
(git-fixes).
- ACPI: CPPC: Suppress UBSAN warning caused by field misuse
(git-fixes).
- ACPI: IPMI: Fix message kref handling on dead device
(git-fixes).
- ACPI: NFIT: core: Fix possible NULL pointer dereference
(git-fixes).
- commit a9dcc0a
- serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq()
(git-fixes).
- serial: 8250: dispatch SysRq character in
serial8250_handle_irq() (git-fixes).
- commit 186a2e0
- netfilter: nf_conntrack_expect: use expect->helper
(CVE-2026-31414 bsc#1262085).
- Refresh
patches.suse/netfilter-ctnetlink-ignore-explicit-helper-on-new-expectat.patch.
- commit 99ec017
- spi: spi-dw-dma: fix print error log when wait finish transaction (CVE-2026-31560 bsc#1263057)
- commit c37fb19
- KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock (CVE-2026-31592 bsc#1263123)
- commit a27f5df
- kABI: netfilter: nft_ct: fix use-after-free in timeout object
destroy (bsc#1263137 CVE-2026-31665).
- commit 852b745
- netfilter: nft_ct: fix use-after-free in timeout object destroy
(CVE-2026-31665 bsc#1263137).
- commit 6829bf4
- xprtrdma: Decrement re_receiving on the early exit paths (CVE-2026-43469 bsc#1265143).
- commit f6ecb8c
- KVM: x86/mmu: Fix UBSAN warning when reading nx_huge_pages
parameter (git-fixes).
- commit c1a8431
- KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to
guest mode (git-fixes).
- commit 504cc97
- KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state
(git-fixes).
- commit 8e02e91
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation
(git-fixes).
- commit 233e411
- KVM: SVM: Allow KVM_SET_NESTED_STATE to clear GIF when SVME==0
(git-fixes).
- commit 11a6b9c
- KVM: SVM: Don't set GIF when clearing EFER.SVME (git-fixes).
- commit e8d7f01
- KVM: SVM: Flush the current TLB when transitioning from xAVIC =>
x2AVIC (git-fixes).
- commit 92eed6c
- KVM: SVM: check validity of VMCB controls when returning from
SMM (git-fixes).
- commit 9ab2ff1
- RDMA/irdma: Initialize free_qp completion before using it (CVE-2026-31492 bsc#1262748)
- commit 992fcda
- i2c: tegra: Fix NOIRQ suspend/resume (git-fixes).
- i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()
(git-fixes).
- i2c: stm32f7: fix timing computation ignoring i2c-analog-filter
(git-fixes).
- commit 1fefba4
- accel/ivpu: Fix signed integer truncation in IPC receive
(git-fixes).
- drm/xe: fix refcount leak in xe_range_fence_insert()
(git-fixes).
- commit d8be26f
- drm/vc4: fix krealloc() memory leak (git-fixes).
- drm/virtio: Fix driver removal with disabled KMS (git-fixes).
- drm/virtio: fix dma_fence refcount leak on error in
virtio_gpu_dma_fence_wait() (git-fixes).
- drm/i915/gem: Fix phys BO pread/pwrite with offset (git-fixes).
- USB: serial: kl5kusb105: fix bulk-out buffer overflow
(git-fixes).
- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()
(git-fixes).
- USB: serial: io_ti: fix heap overflow in get_manuf_info()
(git-fixes).
- thunderbolt: Limit XDomain response copy to actual frame size
(git-fixes).
- thunderbolt: Validate XDomain request packet size before type
cast (git-fixes).
- thunderbolt: Clamp XDomain response data copy to allocation size
(git-fixes).
- thunderbolt: Bound root directory content to block size
(git-fixes).
- thunderbolt: Reject zero-length property entries in validator
(git-fixes).
- misc: fastrpc: fix use-after-free race in fastrpc_map_create
(git-fixes).
- misc: fastrpc: Fix NULL pointer dereference in rpmsg callback
(git-fixes).
- misc: fastrpc: fix DMA address corruption due to find_vma misuse
(git-fixes).
- misc: fastrpc: fix use-after-free of fastrpc_user in workqueue
context (git-fixes).
- slimbus: qcom-ngd-ctrl: fix OF node refcount (git-fixes).
- ASoC: wm_adsp: Fix NULL dereference when removing firmware
controls (git-fixes).
- commit ac4853c
- gpio: mvebu: fix NULL pointer dereference in suspend/resume
(git-fixes).
- commit c9de88e
- crypto: algif_aead - Fix minimum RX size check for decryption
(CVE-2026-43077 bsc#1264470).
- commit a2c5d8a
- Input: alps - fix use-after-free bugs caused by
dev3_register_work (git-fixes CVE-2025-68822 bsc#1256668).
- commit aadcd5f
- iommu/vt-d: Clear Present bit before tearing down PASID entry
(CVE-2026-45894 bsc#1266895).
- commit d16973c
- ibmveth: Disable GSO for packets with small MSS (CVE-2026-46273
bsc#1267651 bsc#1265211).
- commit 0ebaf44
- ice: ptp: don't WARN when controlling PF is unavailable
(bsc#1267251).
- commit 631ade0
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath
(bsc#1264437 CVE-2026-43112).
- commit 9c7b554
- smb: client: prevent races in ->query_interfaces() (bsc#1264444
CVE-2026-43239).
- commit 6565bdf
- iommu/vt-d: Clear Present bit before tearing down PASID entry
(CVE-2026-45894 bsc#1266895).
- commit ec9091b
- netfilter: nf_tables: release flowtable after rcu grace period
on error (CVE-2026-23392 bsc#1260531).
- commit ac2b5d0
- Bluetooth: btintel: serialize btintel_hw_error() with
hci_req_sync_lock (CVE-2026-31500 bsc#1262993).
- Bluetooth: hci_sync: Remove remaining dependencies of
hci_request (CVE-2026-31500 bsc#1262993).
- commit d8d0a21
- virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (CVE-2026-31469 bsc#1267816)
- commit 72f6530
- net: skb: fix cross-cache free of KFENCE-allocated skb head (CVE-2026-31429 bsc#1262392)
- commit c65b0a2
- kabi: revert kabi breaking changes from bsc#1264610 fix
(CVE-2026-43198 bsc#1264610).
- tcp: fix potential race in tcp_v6_syn_recv_sock()
(CVE-2026-43198 bsc#1264610).
- commit 8603fd2
- Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()
(CVE-2026-31499 bsc#1262674).
- commit db804b6
- netfilter: nft_inner: Fix IPv6 inner_thoff desync
(CVE-2026-46244 bsc#1267654).
- commit 7d565d3
- Fixup bugzilla reference in
patches.suse/fanotify-fix-false-positive-on-permission-events.patch
(bsc#1267387 CVE-2026-46150).
- commit 95ca9eb
- netfilter: reject zero shift in nft_bitwise (CVE-2026-46101
bsc#1266878).
- commit 1f577bf
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO
(CVE-2026-45841 bsc#1266390).
- commit 28279a1
- net: qrtr: ns: Limit the maximum server registration per node
(CVE-2026-43491 bsc#1265628).
- commit 34ca9be
- Bluetooth: virtio_bt: clamp rx length before skb_put
(CVE-2026-46123 bsc#1267621).
- commit 5f859e1
- netfilter: x_tables: ensure names are nul-terminated
(CVE-2026-43028 bsc#1263934).
- commit 86e008b
- netfilter: ctnetlink: use netlink policy range checks
(CVE-2026-31495 bsc#1262798).
- commit 8fd7248
- ipv4: icmp: validate reply type before using icmp_pointers
(CVE-2026-46037 bsc#1267361).
- commit f16567d
- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
(CVE-2026-31674 bsc#1263568).
- commit 14ef35f
- netfilter: nf_tables: reject immediate NF_QUEUE verdict
(CVE-2026-43024 bsc#1263930).
- commit b9b3d82
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path
(CVE-2026-45964 bsc#1266698).
- commit c35ac40
- fanotify: fix false positive on permission events (bsc#1267388
CVE-2026-46150).
- commit cb980a6
- libceph: Use u32 for non-negative values in ceph_monmap_decode() (CVE-2026-43405 bsc#1264741).
- commit 6169499
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (CVE-2026-45974 bsc#1266922).
- commit 2435899
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths
(CVE-2026-45870 bsc#1266704).
- commit 2615535
- usb: ulpi: fix memory leak on ulpi_register() error paths
(CVE-2026-31759 bsc#1264076).
- commit a4d2e1d
- Bluetooth: SCO: fix race conditions in sco_sock_connect()
(CVE-2026-43023 bsc#1264137).
- commit e99ef79
- Bluetooth: hci_sync: annotate data-races around hdev->req_status
(CVE-2026-43119 bsc#1264561).
- commit 1f0b9c9
- usb: ulpi: fix double free in ulpi_register_interface() error
path (CVE-2026-31759 bsc#1264076).
- commit 38bc056
- gfs2: fix memory leaks in gfs2_fill_super error path
(CVE-2026-45961 bsc#1266933).
- commit 1135f65
- xfs: fix freemap adjustments when adding xattrs to leaf blocks
(CVE-2026-43158 bsc#1264595).
- commit 2670466
- xfs: delete attr leaf freemap entries when empty (CVE-2026-43187
bsc#1264603).
- commit fa80c64
- btrfs: fix missing last_unlink_trans update when removing a
directory (CVE-2026-46160 bsc#1267624).
- commit f0782dc
- Update
patches.suse/xfs-avoid-dereferencing-log-items-after-push-callbacks.patch
(CVE-2026-31453 bsc#1262617).
- commit 3a4eb40
- Update
patches.suse/xfs-avoid-dereferencing-log-items-after-push-callbacks.patch
(CVE-2026-31453 bsc#1262617).
- commit 570e724
- net: ipa: fix event ring index not programmed for IPA v5.0+
(CVE-2026-43345 bsc#1265103).
- net: ioam6: fix OOB and missing lock (CVE-2026-43083
bsc#1264266).
- xfrm: clear trailing padding in build_polexpire() (CVE-2026-31664
bsc#1263578).
- ipv6: prevent possible UaF in addrconf_permanent_addr()
(CVE-2026-43339 bsc#1264763).
- net: stmmac: fix oops when split header is enabled
(CVE-2026-45940 bsc#1266916).
- commit 075c4e7
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1266290 CVE-2025-10263)
Enable workaround for this errata.
- commit ea6e24e
- arm64: cputype: Add C1-Premium definitions (bsc#1266290 CVE-2025-10263)
- commit ca04e04
- arm64: cputype: Add C1-Ultra definitions (bsc#1266290 CVE-2025-10263)
- commit c45105c
- Refresh
patches.suse/team-avoid-NETDEV_CHANGEMTU-event-when-unregistering.patch.
Added missing locking in backport (bsc#1267732).
- commit 4ec6bb0
- scsi: hisi_sas: Fix NULL pointer exception during user_scan()
(CVE-2026-43413, bsc#1264671).
- commit bfe6757
- ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger
(CVE-2026-46157 bsc#1267726).
- commit f38bfb2
- Refresh
patches.suse/team-avoid-NETDEV_CHANGEMTU-event-when-unregistering.patch.
Added missing locking in backport (bsc#1267732).
- commit a8766b2
- Bluetooth: hci_conn: fix potential UAF in create_big_sync
(CVE-2026-46111 bsc#1267626).
- commit 7777a50
- nfsd: never defer requests during idmap lookup (CVE-2026-45983
bsc#1266697).
- Delete
patches.suse/nfsd-do-not-defer-requests-during-idmap-lookup-in-v4-compo.patch.
- commit 664a09a
- ice: fix double free in ice_sf_eth_activate() error path
(CVE-2026-46162 bsc#1266840).
- commit 0a58452
- drm/gem: Fix inconsistent plane dimension calculation in
drm_gem_fb_init_with_funcs() (CVE-2026-46209 bsc#1267663).
- commit 2c841fc
- libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (CVE-2026-46024 bsc#1267218).
- commit e967a8f
- libceph: prevent potential out-of-bounds reads in process_message_header() (CVE-2026-43406 bsc#1265073).
- commit 79f8547
- rbd: fix null-ptr-deref when device_add_disk() fails (CVE-2026-46079 bsc#1266452).
- commit 82a7e5e
- ocfs2: handle invalid dinode in ocfs2_group_extend (CVE-2026-31596 bsc#1263319).
- commit d319998
- libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (CVE-2026-43407 bsc#1265020).
- commit d87fc06
- nfs: return EISDIR on nfs3_proc_create if d_alias is a dir
(CVE-2026-43470 bsc#1265128).
- commit 9fc75a8
- cgroup: Increment nr_dying_subsys_* from rmdir context
(git-fixes).
- Refresh patches.kabi/kabi-cgroup.stat-fixup.patch.
- commit f87663c
- af_unix: read UNIX_DIAG_VFS data under unix_state_lock
(CVE-2026-31673 bsc#1263143).
- Refresh patches.suse/vfs-add-super_operations-get_inode_dev.
- commit 00e1878
- ALSA: aloop: Fix peer runtime UAF during format-change stop
(CVE-2026-46090 bsc#1267531).
- ALSA: aloop: Use guard() for spin locks (CVE-2026-46090
bsc#1267531).
- ALSA: aloop: Fix peer runtime UAF during format-change stop
(CVE-2026-46090 bsc#1267531).
- ALSA: aloop: Use guard() for spin locks (CVE-2026-46090
bsc#1267531).
- commit d19a9e2
- drm/amdkfd: Fix watch_id bounds checking in debug address
watch v2 (CVE-2026-45878 bsc#1266767).
- commit aa9368a
- arm64: Add support for TSV110 Spectre-BHB mitigation (bsc#1264430 CVE-2026-43261)
- commit ba98a63
- perf/arm-cmn: Reject unsupported hardware configurations (bsc#1264415 CVE-2026-43150)
- commit 5c62ef4
- perf/arm-cmn: Ensure dtm_idx is big enough (bsc#1264415 CVE-2026-43150)
- commit bd77733
- ALSA: seq: dummy: fix UMP event stack overread (git-fixes).
- drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups
(git-fixes).
- accel/ivpu: Add buffer overflow check in MS get_info_ioctl
(git-fixes).
- drm/xe: Clear pending_disable before signaling suspend fence
(git-fixes).
- drm/amd/display: Bound VBIOS record-chain walk loops
(git-fixes).
- commit 3c0f3d3
- Input: atkbd - skip deactivate for HONOR BCC-N's internal
keyboard (git-fixes).
- ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain()
on linked streams (git-fixes).
- drm/imx: Fix three kernel-doc warnings in dcss-scaler.c
(git-fixes).
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore
on GFX11 (git-fixes).
- drm/amdkfd: fix NULL dereference in get_queue_ids() (git-fixes).
- drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
(git-fixes).
- drm/amd/display: Reject gpio_bitshift >= 32 in
bios_parser_get_gpio_pin_info() (git-fixes).
- drm/amd/display: Use krealloc_array() in dal_vector_reserve()
(git-fixes).
- drm/amd/display: Fix NULL deref and buffer over-read in SDP
debugfs (git-fixes).
- commit 276cfd7
- scsi: imm: Fix use-after-free bug caused by unfinished delayed
work (CVE-2025-68324 bsc#1255416).
- commit 195217b
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (CVE-2026-43026 bsc#1263932).
- commit 059378b
- xfs: stop reclaim before pushing AIL during unmount
(CVE-2026-31455 bsc#1262615).
- commit e53a301
- xfs: save ailp before dropping the AIL lock in push callbacks
(CVE-2026-31454 bsc#1262624).
- commit 7159c4e
- packaging: Add nvidia kernel description
- commit 5f2699f
- pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724 CVE-2026-31655)
- commit 9295a19
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg
(CVE-2026-45886 bsc#1266810).
- commit 20a9956
- bpf: Fix regsafe() for pointers to packet (CVE-2026-43030
bsc#1264000).
- commit 8f3e36e
- bpf: Fix tcx/netkit detach permissions when prog fd isn't given
(CVE-2026-45932 bsc#1266827).
- commit b648f57
- spi: fix resource leaks on device setup failure (bsc#1266696 CVE-2026-46083)
- commit 742a92d
- thermal: core: Free thermal zone ID later during removal
(git-fixes).
- commit cd70ed5
- Bluetooth: MGMT: Fix backward compatibility with userspace
(git-fixes).
- Bluetooth: bnep: reject short frames before parsing (git-fixes).
- Bluetooth: hci_sync: reject oversized Broadcast Announcement
prepend (git-fixes).
- Bluetooth: RFCOMM: validate skb length in MCC handlers
(git-fixes).
- Bluetooth: MGMT: validate advertising TLV before type checks
(git-fixes).
- Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
(git-fixes).
- wifi: mac80211: limit injected antenna index in
ieee80211_parse_tx_radiotap (git-fixes).
- wifi: nl80211: reject oversized EMA RNR lists (git-fixes).
- mmc: sdhci: add signal voltage switch in sdhci_resume_host
(git-fixes).
- mmc: litex_mmc: Set mandatory idle clocks before CMD0
(git-fixes).
- mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock
calculation (git-fixes).
- mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC (git-fixes).
- mmc: core: Fix host controller programming for fixed driver type
(git-fixes).
- commit 1ef939b
- btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which
can lead to info-leak (bsc#1267652,CVE-2026-46159).
- commit 56f6424
- kabi: arm64: module: Update missing .init.text.ftrace_trampoline section message (bsc#1265579 bsc#1265170)
Message was supposed to give us a hint that these KMP's
will have issue when user try to ftrace them. But it turns out
to be just source confusion and worry.
- commit 2983ae5
- gfs2: Fix use-after-free in iomap inline data write path
(CVE-2026-45984 bsc#1267214).
- gfs2: Add metapath_dibh helper (CVE-2026-45984 bsc#1267214).
- commit 7f4705a
- mctp: route: hold key->lock in mctp_flow_prepare_output()
(CVE-2026-43455 bsc#1264765).
- net: mctp: Ensure keys maintain only one ref to corresponding
dev (CVE-2026-43455 bsc#1264765).
- commit 7c8d579
- io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs()
(CVE-2026-31774 bsc#1264040).
- commit 449403d
- rpm/mkspec: Conditionally set Rust BuildReqs (bsc#1258538)
This is a further optimization of kernel packaging rust-enablement.
Add the check of CONFIG_RUST at creating the spec for each kernel
flavor, and set BuildRequires conditionally only for archs that have
CONFIG_RUST. This avoids the unnecessary dependency chains due to
unused rust.
The main knob ENABLE_RUST is still needed because otherwise we can't
know whether to pass the dummy-tools or not at processing
run_oldconfig.
- commit ccf4b93
- rpm/check-for-config-changes: ignore Rust-related configs (bsc#1258538)
Those configs may be dynamically changed at the build time
- commit 5251980
- rpm: Add BuildRequires for Rust enablement (bsc#1258538)
Update mkspec and template to generate the spec files with
BuildRequires of Rust-related packages when ENABLE_RUST=Yes is set in
rpm/config.sh.
- commit d0f276f
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down
(CVE-2026-45970 bsc#1267205).
- commit c7c508f
- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()
(CVE-2026-46181 bsc#1266826).
- commit 971667c
- x86: shadow stacks: proper error handling for mmap lock (bsc#1264484 CVE-2026-43109).
- commit fbd32de
- ALSA: caiaq: Don't abort when no input device is available
(CVE-2026-46004 bsc#1267222).
- ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path
(CVE-2026-46004 bsc#1267222).
- commit a3abbee
- ALSA: caiaq: Handle probe errors properly (CVE-2026-46004
bsc#1267222).
- commit c42211b
- thermal: core: Fix thermal zone governor cleanup issues
(CVE-2026-46021 bsc#1267220).
- commit 5b274e1
- Bluetooth: MGMT: Fix list corruption and UAF in command complete
handlers (CVE-2026-43059 bsc#1264184).
- commit 58f5225
- Bluetooth: MGMT: fix crash in set_mesh_sync and
set_mesh_complete (CVE-2026-43059 bsc#1264184).
- Refresh patches.kabi/hci_dev-centralize-extra-lock.patch.
- commit 59594e6
- scsi: qla2xxx: Add support to report MPI FW state (git-fixes).
- dm: fix a buffer overflow in ioctl processing (git-fixes).
- scsi: ses: Handle positive SCSI error from ses_recv_diag()
(git-fixes).
- commit a7edf1f
- slip: reject VJ receive packets on instances with no rstate array (CVE-2026-45842 bsc#1266400)
- commit 9c6954f
- media: dvb-net: fix OOB access in ULE extension header tables (CVE-2026-31405 bsc#1261700)
- commit 0115edd
- usb: usbtmc: Flush anchored URBs in usbtmc_release (CVE-2026-31758 bsc#1264093)
- commit 862c169
- KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (CVE-2026-31593 bsc#1263124)
- Refresh: patches.suse/KVM-SEV-Lock-all-vCPUs-when-synchronzing-VMSAs-for-S.patch
- commit 21df875
- xfrm_user: fix info leak in build_report() (CVE-2026-31671 bsc#1263115)
- commit e993b23
- bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (CVE-2026-45846 bsc#1266394)
- commit 8489b03
- KVM: x86: Fix shadow paging use-after-free due to unexpected
GFN (CVE-2026-46113 bsc#1266969).
- commit 492a8ff
- net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak (CVE-2026-43040 bsc#1264091)
- commit afb5ee9
- nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston
OM3SGP4 (git-fixes).
- commit f7aa00d
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (CVE-2025-38549 bsc#1248235).
- commit 07594aa
- ext4: fix bounds check in check_xattrs() to prevent
out-of-bounds access (bsc#1266927 CVE-2026-46094).
- commit 7627409
- writeback: Fix use after free in inode_switch_wbs_work_fn()
(bsc#1263883 CVE-2026-31703).
- commit afdb742
- ext4: avoid allocate block from corrupted group in
ext4_mb_find_by_goal() (bsc#1264255 CVE-2026-43068).
- commit 3900419
- ext4: avoid infinite loops caused by residual data (bsc#1262622
CVE-2026-31448).
- commit 23a715f
- ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths
(bsc#1264245 CVE-2026-43066).
- commit 283732e
- ext4: always drain queued discard work in ext4_mb_release()
(bsc#1264243 CVE-2026-43065).
- commit 01e5eec
- ext4: fix use-after-free in update_super_work when racing with
umount (bsc#1262619 CVE-2026-31446).
- commit 2d5d4dc
- arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes)
- commit 0883f58
- arm64: tlb: Allow XZR argument to TLBI ops (git-fixes)
- commit a27017d
- drm/amdgpu/vpe: Force collaborate sync after TRAP
(stable-fixes).
- commit 2f6a9ab
- Bluetooth: serialize accept_q access (git-fixes).
- Refresh
patches.suse/Bluetooth-fix-UAF-in-l2cap_sock_cleanup_listen-vs-l2.patch.
- commit e766bd7
- RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (CVE-2026-46114 bsc#1266972)
- commit 76ec1c1
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856 bsc#1266720)
- commit c95a10d
- auxdisplay: line-display: fix OOB read on zero-length
message_store() (git-fixes).
- security/keys: fix missed RCU read section on lookup
(stable-fixes).
- drm/amd/display: Validate payload length and link_index in
dc_process_dmub_aux_transfer_async (stable-fixes).
- drm/amd/display: Validate GPIO pin LUT table size before
iterating (stable-fixes).
- drm/amd/display: Fix integer overflow in bios_get_image()
(stable-fixes).
- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL
register access (git-fixes).
- spi: ti-qspi: fix use-after-free after DMA setup failure
(git-fixes).
- spi: sprd: fix error pointer deref after DMA setup failure
(git-fixes).
- spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()
(git-fixes).
- ALSA: asihpi: Fix potential OOB array access at reading cache
(stable-fixes).
- net: wwan: iosm: fix potential memory leaks in ipc_imem_init()
(git-fixes).
- drivers/base/memory: fix memory block reference leak in poison
accounting (git-fixes).
- HID: quirks: really enable the intended work around for
appledisplay (git-fixes).
- HID: uclogic: Fix regression of input name assignment
(git-fixes).
- string: add mem_is_zero() helper to check if memory area is
all zeros (stable-fixes).
- commit 55d2e55
- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CVE-2026-46176 bsc#1266816)
- commit f587e2a
- net: mana: Expose hardware diagnostic info via debugfs (bsc#1266414).
- net: mana: Use kvmalloc for large RX queue and buffer allocations (bsc#1266765).
- net: mana: Use per-queue allocation for tx_qp to reduce allocation size (bsc#1266765).
- net: mana: hardening: Reject zero max_num_queues from GDMA_QUERY_MAX_RESOURCES (git-fixes).
- drm/hyperv: validate VMBus packet size in receive callback (git-fixes).
- drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes).
- net: mana: Skip redundant detach on already-detached port (git-fixes).
- net: mana: Add NULL guards in teardown path to prevent panic on attach failure (git-fixes).
- RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port (git-fixes).
- net: mana: validate rx_req_idx to prevent out-of-bounds array access (bsc#1266402).
- net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (bsc#1265928).
- commit 81225ae
- net: mvpp2: guard flow control update with global_tx_fc in buffer switching (CVE-2026-23438 bsc#1261619)
- commit c2bc3dd
- net: bonding: fix NULL deref in bond_debug_rlb_hash_show (CVE-2026-31546 bsc#1263006)
- commit ec64778
- 9p/xen: protect xen_9pfs_front_free against concurrent calls
(bsc#1264476 CVE-2026-43249).
- commit efe84aa
- net: macb: fix use-after-free access to PTP clock (CVE-2026-31396 bsc#1261791)
- commit a390b05
- sched/rt: Skip currently executing CPU in rto_next_cpu()
(bsc#1262649).
- commit 239586c
- RDMA/rxe: Fix race condition in QP timer handlers (CVE-2026-45910 bsc#1266889)
- commit d80968b
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CVE-2026-45898 bsc#1266888)
- commit 683ea89
- RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852 bsc#1266711)
- commit 16dd3c8
- cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() (CVE-2026-23327 bsc#1260548)
- commit 27dbf08
- nfc: llcp: add missing return after LLCP_CLOSED checks (CVE-2026-31629 bsc#1263790)
- commit db86873
- smb: client: Don't log plaintext credentials in cifs_set_cifscreds (CVE-2026-23303 bsc#1260502)
- commit 53c0ff0
- kabi fix after rtmutex_api: provide correct extern functions
(bsc#1263122 CVE-2026-31591).
- commit 8c82223
- team: avoid NETDEV_CHANGEMTU event when unregistering slave
(CVE-2026-43234 bsc#1264409).
- commit 6b7c409
- tipc: fix divide-by-zero in tipc_sk_filter_connect() (CVE-2026-43411 bsc#1264672)
- commit 32611e5
- net: stmmac: Prevent NULL deref when RX memory exhausted
(CVE-2026-46110 bsc#1266759).
- net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY()
(CVE-2026-46110 bsc#1266759).
- net/mlx5: lag: Check for LAG device before creating debugfs
(CVE-2026-43013 bsc#1264011).
- commit b15f093
- RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043 bsc#1266901)
- commit 909d78b
- esp: fix skb leak with espintcp and async crypto (CVE-2026-31518 bsc#1262606)
- commit f42cbf9
- packaging: Replace compute-PATCHVERSION with python implementation
This script is copied by kkspec to the package directory and called from
there. That means that libraries from kernel-source cannot be loaded,
and that's the reason why the script is appended to the library that is
most useful for it. compute-PATCHVERSION and mkspec are no longer
shipped in rpm packages which means compute-PATCHVERSION could be folded
into mkspec, and that in turn into tar-up. However, these are all
written in different languages.
- commit de458e0
- kabi: arm: io: Export ioremap_prot() symbol v2 (CVE-2026-23346 bsc#1260529 bsc#1266993)
First version of this kABI fix missed that ioremap_prot() now
accept only user-space mappings which breaks any out of tree
KMP's which used the function for legitimate kernel IO mappings.
Lets fix this by allowing kernel mappings and at same time
properly handle user-space mappings
[1] 9625623795d3 ("kabi: arm: io: Export ioremap_prot() symbol (CVE-2026-23346 bsc#1260529)")
- commit 223d255
- btrfs: reserve enough transaction items for qgroup ioctls
(CVE-2026-43338 bsc#1264716).
- commit 9eef1bf
- rtmutex_api: provide correct extern functions (bsc#1263122
CVE-2026-31591).
- commit fa571c2
- btrfs: fix transaction abort on set received ioctl due to item
overflow (CVE-2026-43359 bsc#1264719).
- commit 847b693
- kABI fix after locking/mutex: implement
mutex_lock_killable_nest_lock (bsc#1263122 CVE-2026-31591).
- commit f2aebfb
- Input: ims-pcu - fix usb_free_coherent() size in
ims_pcu_buffers_free() (git-fixes).
- Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
(git-fixes).
- Input: xpad - fix out-of-bounds access for Share button
(git-fixes).
- Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB
buffer size (git-fixes).
- commit f75d3d9
- usb: typec: tcpm: improve handling of DISCOVER_MODES failures
(git-fixes).
- commit 9d7793b
- USB: serial: cypress_m8: validate interrupt packet headers
(git-fixes).
- USB: serial: safe_serial: fix memory corruption with small
endpoint (git-fixes).
- USB: serial: omninet: fix memory corruption with small endpoint
(git-fixes).
- USB: serial: mxuport: fix memory corruption with small endpoint
(git-fixes).
- USB: serial: option: add missing RSVD(5) flag for Rolling
RW135R-GL (git-fixes).
- USB: serial: mct_u232: fix missing interrupt-in transfer sanity
check (git-fixes).
- USB: serial: keyspan: fix missing indat transfer sanity check
(git-fixes).
- USB: serial: belkin_sa: validate interrupt status length
(git-fixes).
- USB: cdc-acm: Fix bit overlap and move quirk definitions to
header (git-fixes).
- usb: dwc2: Fix use after free in debug code (git-fixes).
- usb: chipidea: core: convert ci_role_switch to local variable
(git-fixes).
- usb: gadget: f_fs: copy only received bytes on short ep0 read
(git-fixes).
- usb: gadget: dummy_hcd: Reject hub port requests for
non-existent ports (git-fixes).
- usbip: vudc: Fix use after free bug in vudc_remove due to race
condition (git-fixes).
- usb: usbtmc: reject interrupt endpoints with small
wMaxPacketSize (git-fixes).
- usb: usbtmc: check URB actual_length for interrupt-IN
notifications (git-fixes).
- usb: gadget: net2280: Fix double free in probe error path
(git-fixes).
- usb: gadget: f_hid: fix device reference leak in hidg_alloc()
(git-fixes).
- usb: cdns3: gadget: fix request skipping after clearing halt
(git-fixes).
- usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call
permanently leaks the runtime PM usage counter across
bind/unbind cycles (git-fixes).
- usb: gadget: composite: fix integer underflow in WebUSB GET_URL
handling (git-fixes).
- tty: serial: pch_uart: add check for dma_alloc_coherent()
(git-fixes).
- commit 2bf3f1e
- thunderbolt: property: Reject dir_len < 4 to prevent size_t
underflow (git-fixes).
- thunderbolt: property: Reject u32 wrap in
tb_property_entry_valid() (git-fixes).
- serial: fsl_lpuart: fix rx buffer and DMA map leaks in
start_rx_dma (git-fixes).
- serial: qcom-geni: fix UART_RX_PAR_EN bit position (git-fixes).
- parport: Fix race between port and client registration
(git-fixes).
- comedi: comedi_test: fix check for valid scan_begin_src in
waveform_ai_cmdtest() (git-fixes).
- comedi: comedi_test: Fix limiting of convert_arg in
waveform_ai_cmdtest() (git-fixes).
- iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
(git-fixes).
- iio: gyro: itg3200: fix i2c read into the wrong stack location
(git-fixes).
- iio: dac: ad5686: acquire lock when doing powerdown control
(git-fixes).
- iio: temperature: tsys01: fix broken PROM checksum validation
(git-fixes).
- iio: buffer: hw-consumer: fix use-after-free in error path
(git-fixes).
- iio: dac: ad5686: fix input raw value check (git-fixes).
- iio: ssp_sensors: cancel delayed work_refresh on remove
(git-fixes).
- iio: dac: max5821: fix return value check in powerdown sync
(git-fixes).
- iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
(git-fixes).
- iio: light: cm3323: fix reg_conf not being initialized correctly
(git-fixes).
- iio: magnetometer: st_magn: fix default DRDY pin selection
for LIS2MDL (git-fixes).
- iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for
dual mux (git-fixes).
- drm/hyperv: validate VMBus packet size in receive callback
(git-fixes).
- drm/hyperv: validate resolution_count and fix WIN8 fallback
(git-fixes).
- drm/amd/pm/si: Disregard vblank time when no displays are
connected (git-fixes).
- drm/i915: Fix potential UAF in TTM object purge (git-fixes).
- commit 129155c
- Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
(git-fixes).
- ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
(git-fixes).
- ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware
2417 (git-fixes).
- ALSA: pcm: oss: Fix setup list UAF on proc write error
(git-fixes).
- commit 42ae3f2
- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device
close (git-fixes).
- Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
(git-fixes).
- Bluetooth: ISO: fix UAF in iso_recv_frame (git-fixes).
- Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
(git-fixes).
- Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration
success (git-fixes).
- Bluetooth: 6lowpan: check skb_clone() return value in
send_mcast_pkt() (git-fixes).
- Bluetooth: btusb: Allow firmware re-download when version
matches (git-fixes).
- Bluetooth: HIDP: fix missing length checks in
hidp_input_report() (git-fixes).
- Bluetooth: L2CAP: use chan timer to close channels in
cleanup_listen() (git-fixes).
- Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout()
on !conn (git-fixes).
- ASoC: codecs: simple-mux: Fix enum control bounds check
(git-fixes).
- ASoC: qcom: q6asm-dai: fix error handling in prepare and
set_params (git-fixes).
- ASoC: qcom: q6asm-dai: close stream only when running
(git-fixes).
- ASoC: qcom: q6asm-dai: do not set stream state in event and
trigger callbacks (git-fixes).
- HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
(git-fixes).
- commit 5cccd97
- btrfs: fix transaction abort when snapshotting received
subvolumes (CVE-2026-43361 bsc#1264722).
- commit 68eb967
- btrfs: fix transaction abort on file creation due to name hash
collision (CVE-2026-43360 bsc#1264720).
- commit 335b528
- locking/mutex: implement mutex_trylock_nested (bsc#1263122
CVE-2026-31591).
- commit f61110c
- wifi: iwlwifi: mvm: don't send a 6E related command when not
supported (CVE-2026-43325 bsc#1265110).
- commit 3c8b5bc
- locking/mutex: implement mutex_lock_killable_nest_lock
(bsc#1263122 CVE-2026-31591).
- commit c8f7fd9
- Delete patches.suse/wifi-mac80211-Remove-generic-.ndo_get_stats64.patch (bsc#1266036)
The patch slipped in the backport series although the assumption there
isn't applied to SLE15-SP7 kernel base, which resulted in the bogus wifi
statistics. Drop the patch to fix it.
- commit 18311a2
- KVM: add kvm_lock_all_vcpus and kvm_trylock_all_vcpus
(bsc#1263122 CVE-2026-31591).
- commit d85a03e
- smb: client: reject userspace cifs.spnego descriptions
(bsc#1266238).
- commit b2ca6ab
- KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch
finish (bsc#1263122 CVE-2026-31591).
- commit f3989e6
- drm/i915/dsi: Don't do DSC horizontal timing adjustments in
command mode (CVE-2026-31767 bsc#1264124).
- commit f45f094
- KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with
in-kernel APIC (git-fixes).
- commit 671dbfb
- KVM: X86: Fix array_index_nospec protection in __pv_send_ipi
(git-fixes).
- commit ef45aed
- Refresh patches.suse/selftests-bpf-Add-more-precision-tracking-tests-for-.patch. (CVE-2026-43009 bsc#1264014)
- commit 1de8df8
- selftests/bpf: add test for nullable PTR_TO_BUF access
(CVE-2026-43333 bsc#1264726).
- commit 9b6669a
- bpf: reject direct access to nullable PTR_TO_BUF pointers
(CVE-2026-43333 bsc#1264726).
- commit 8b12683
- xfrm: prevent policy_hthresh.work from racing with netns
teardown (CVE-2026-31516 bsc#1262755).
- commit 5ec6779
- mptcp: pm: in-kernel: always set ID as avail when rm endp
(CVE-2026-43252 bsc#1264300).
- commit f1372d7
- net/ipv6: ioam6: prevent schema length wraparound in trace fill
(CVE-2026-43341 bsc#1265044).
- commit 26ee766
- slip: bound decode() reads against the compressed packet length
(CVE-2026-45843 bsc#1266395).
- commit c9770c0
- s390/entry: Scrub r12 register on kernel entry (bsc#1263068).
- s390/syscalls: Add spectre boundary for syscall dispatch table
(bsc#1263068).
- s390/barrier: Make array_index_mask_nospec() __always_inline
(bsc#1263068).
- commit f6cfac6
- s390/entry: Scrub r12 register on kernel entry (bsc#1261591).
- s390/syscalls: Add spectre boundary for syscall dispatch table
(bsc#1261591).
- s390/barrier: Make array_index_mask_nospec() __always_inline
(bsc#1261591).
- s390/mm: Add missing secure storage access fixups for donated
memory (bsc#1264835).
- commit ade4cd0
- tracing: Fix potential deadlock in cpu hotplug with osnoise
(CVE-2026-31480 bsc#1262634).
- tracing: Switch trace_osnoise.c code over to use guard()
and __free() (bsc#1262634).
- commit 6db35fe
- bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584
CVE-2026-23359).
- commit 0fb7dc1
- wifi: mac80211: always free skb on ieee80211_tx_prepare_skb()
failure (CVE-2026-23444 bsc#1266307).
- commit a948d1e
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()
(CVE-2026-43206 bsc#1264551).
- commit 7f880f2
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky
(CVE-2026-43296 bsc#1264805).
- commit f336a2d
- bcache: fix uninitialized closure object (git-fixes).
- commit d35dc31
- bcache: fix cached_dev.sb_bio use-after-free and crash
(CVE-2026-3150 bsc#1263169).
- scsi: target: tcm_loop: Drain commands in target_reset handler
(CVE-2026-43054 bsc#1264063).
- scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()
(CVE-2026-31464 bsc#1262656).
- scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414
bsc#1264669).
- commit b1bc3f3
- rtmutex: Use waiter::task instead of current in remove_waiter()
(bsc#1266001 CVE-2026-43499).
- commit f92fa24
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
(CVE-2026-43501 bsc#1266009).
- commit d86aabe
- ip6_tunnel: clear skb2->cb in ip4ip6_err() (CVE-2026-43037
bsc#1263995).
- commit 60e0626
- Improve compatibility with awk 2.4.0 (bsc#1266214)
This was meant to match the literal '+', so it needs to be backslashed
not a repetition of the '^' symbol.
- commit fbbce3e
- media: mc, v4l2: serialize REINIT and REQBUFS with
req_queue_mutex (CVE-2026-31473 bsc#1262663).
- commit 3f03cf7
- Update
patches.suse/net-skbuff-propagate-shared-frag-marker-through-frag-trans.patch
(CVE-2026-43503 bsc#1265960 CVE-2026-43284 bsc#1264449).
- Update
patches.suse/xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch
(CVE-2026-43284 bsc#1264449).
Add references and move to the sorted section.
- commit 83a3405
- RDMA/efa: Fix possible deadlock (git-fixes)
- commit b9b2bbf
- RDMA/efa: Fix use of completion ctx after free (CVE-2026-31493 bsc#1262668)
- commit 3fa0669
- RDMA/efa: Improve admin completion context state machine (git-fixes)
- commit 8e8c981
- RDMA/efa: Extend admin timeout error print (git-fixes)
- commit 4d9f061
- RDMA/efa: Check stored completion CTX command ID with received one (git-fixes)
- commit f0e6a90
- wifi: mac80211: check tdls flag in ieee80211_tdls_oper
(CVE-2026-43052 bsc#1263945).
- commit e6ee8c1
- KVM: SEV: Drop WARN on large size for
KVM_MEMORY_ENCRYPT_REG_REGION (CVE-2026-31590 bsc#1263152).
- commit 4957e7f
- openvswitch: vport: fix self-deadlock on release of tunnel ports
(CVE-2026-31678 bsc#1263562).
- commit 7eb6b28
- KVM: SVM: Set/clear CR8 write interception when AVIC is
(de)activated (CVE-2026-43483 bsc#1265240).
- commit de0bf57
- smb: client: fix in-place encryption corruption in SMB2_write()
(bsc#1264989 CVE-2026-43362)
- commit 2633e79
- compute-PATCHVERSION: Do not append .. to default patch directories
All the callers are either using . or a specific patch directory.
If a caller really needs to load patches from .. it should be passed as
parameter.
- commit d383394
- compute-PATCHVERSION: Remove unpack logic
This used to be needed when compute-PATCHVERSION was shipped as part of
the rpm package where unpacked patches are not available.
It is not done annymore, and the unpackinng is not needed.
- commit 9a8fa0e
- openvswitch: defer tunnel netdev_put to RCU release
(CVE-2026-31678 bsc#1263562).
- commit c40a933
- KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested
[#]VMEXIT (git-fixes).
- commit ec599f4
- KVM: x86: Fix Xen hypercall tracepoint argument assignment
(git-fixes).
- commit bee29ed
- packaging: Rip out extra symbols support
Extra symbols are not supported for a long time.
The oldest branch we maintain is SLE 11 SP1 and it does not use patch
guards to select patches.
- commit 7b3d5b0
- drm/amdgpu: update the handle ptr in early_init (stable-fixes).
- Refresh
patches.suse/drm-amdgpu-mes11-implement-detect-and-reset-callback.patch.
- Refresh
patches.suse/drm-amdgpu-mes12-implement-detect-and-reset-callback.patch.
- commit c261344
- drm/xe/oa: Fix exec_queue leak on width check in stream open
(git-fixes).
- drm/xe: Define CACHE_MODE_1 as MCR register (git-fixes).
- drm/xe/pf: Fix CFI failure in debugfs access (git-fixes).
- drm/xe/vf: Fix signature of print functions (git-fixes).
- drm/xe/gsc: Fix double-free of managed BO in error path
(git-fixes).
- drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP
(git-fixes).
- ALSA: seq: Serialize UMP output teardown with event_input
(git-fixes).
- ALSA: seq: avoid past-the-end iterator in snd_seq_create_port()
(git-fixes).
- ALSA: timer: avoid past-the-end iterator in
snd_timer_dev_register() (git-fixes).
- ALSA: pcm: Don't setup bogus iov_iter for silencing (git-fixes).
- Bluetooth: btmtk: fix urb->setup_packet leak in error paths
(git-fixes).
- Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not
stack pointer (git-fixes).
- drm/amdgpu/uvd4.2: Don't initialize UVD 4.2 when DPM is disabled
(git-fixes).
- ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver
(git-fixes).
- ACPI: x86: cmos_rtc: Clean up address space handler driver
(stable-fixes).
- soundwire: debugfs: initialize firmware_file to empty string
(git-fixes).
- drm/amdgpu: update the handle ptr in dump_ip_state
(stable-fixes).
- drm/amdgpu: add amdgpu_device reference in ip block
(stable-fixes).
- commit 8df2a77
- batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).
- commit f65d5f2
- hwmon: (pmbus/adm1266) register the nvmem device after
pmbus_do_probe() (git-fixes).
- hwmon: (pmbus/adm1266) register the gpio_chip after
pmbus_do_probe() (git-fixes).
- hwmon: (pmbus/adm1266) reject short block-read responses in
the GPIO accessors (git-fixes).
- hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO
read in get_multiple (git-fixes).
- hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at
ADM1266_PDIO_NR (git-fixes).
- hwmon: (pmbus/adm1266) bounce blackbox records through a
protocol-sized buffer (git-fixes).
- hwmon: (pmbus/adm1266) include adapter number in GPIO line label
(git-fixes).
- hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer
read buffer (git-fixes).
- hwmon: (pmbus/adm1266) reject implausible blackbox record_count
(git-fixes).
- hwmon: (pmbus/adm1266) widen blackbox-info buffer to
I2C_SMBUS_BLOCK_MAX (git-fixes).
- hwmon: (pmbus/adm1266) seed timestamp from the real-time clock
(git-fixes).
- drm/virtio: use uninterruptible resv lock for plane updates
(git-fixes).
- drm/bridge: megachips: remove bridge when irq request fails
(git-fixes).
- drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c
probe (git-fixes).
- drm/bridge: it66121: acquire reset GPIO in probe (git-fixes).
- drm/radeon/evergreen_cs: Add missing NULL prefix check in
surface check (git-fixes).
- drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets
(git-fixes).
- drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets
(git-fixes).
- drm/msm/snapshot: fix dumping of the unaligned regions
(git-fixes).
- drm/msm/dsi: don't dump registers past the mapped region
(git-fixes).
- platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL
(git-fixes).
- platform/x86: intel-hid: Check ACPI_HANDLE() against NULL
(git-fixes).
- platform/x86: hp_accel: Check ACPI_COMPANION() against NULL
(git-fixes).
- platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL
(git-fixes).
- wifi: ath11k: clear shared SRNG pointer state on restart
(git-fixes).
- wifi: ath11k: fix use after free in ath11k_dp_rx_msdu_coalesce()
(git-fixes).
- wifi: ath11k: fix peer resolution on rx path when peer_id=0
(git-fixes).
- wifi: ath10k: skip WMI and beacon transmission when device is
wedged (git-fixes).
- wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm()
(git-fixes).
- wifi: ath11k: fix error path leaks in some WMI calls
(git-fixes).
- wifi: ath11k: fix error path leaks in some WMI WOW calls
(git-fixes).
- wifi: mac80211: consume only present negotiated TTLM maps
(git-fixes).
- wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
(git-fixes).
- efi: Allocate runtime workqueue before ACPI init (git-fixes).
- firmware: arm_ffa: Skip free_pages on RX buffer alloc failure
(git-fixes).
- firmware: arm_ffa: Check for NULL FF-A ID table while driver
registration (git-fixes).
- drm/amdgpu/uvd3.1: Don't validate the firmware when already
validated (git-fixes).
- r8152: fix incorrect register write to USB_UPHY_XTAL
(git-fixes).
- drm/amdgpu: fix spelling typos (stable-fixes).
- drm/i915: Loop over all active pipes in intel_mbus_dbox_update
(stable-fixes).
- spi: st-ssc4: switch to use modern name (stable-fixes).
- commit 8b80180
- device property: set fwnode->secondary to NULL in fwnode_init()
(git-fixes).
- ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()
(git-fixes).
- ALSA: ua101: Reject too-short USB descriptors (git-fixes).
- batman-adv: bla: fix report_work leak on backbone_gw purge
(git-fixes).
- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs
l2cap_conn_del() (git-fixes).
- Bluetooth: hci_uart: fix UAFs and race conditions in close
and init paths (git-fixes).
- Bluetooth: MGMT: validate Add Extended Advertising Data length
(git-fixes).
- Bluetooth: ISO: drop ISO_END frames received without prior
ISO_START (git-fixes).
- Bluetooth: bnep: Fix UAF read of dev->name (git-fixes).
- batman-adv: frag: disallow unicast fragment in fragment
(git-fixes).
- batman-adv: tp_meter: avoid use of uninit sender vars
(git-fixes).
- batman-adv: dat: handle forward allocation error (git-fixes).
- batman-adv: clear current gateway during teardown (git-fixes).
- batman-adv: fix fragment reassembly length accounting
(git-fixes).
- batman-adv: tt: fix negative last_changeset_len (git-fixes).
- batman-adv: tt: fix negative tt_buff_len (git-fixes).
- batman-adv: fix tp_meter counter underflow during shutdown
(git-fixes).
- ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans
(git-fixes).
- ALSA: usb-audio: Bound MIDI endpoint descriptor scans
(git-fixes).
- ALSA: sc6000: Keep the programmed board state in card-private
data (git-fixes).
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference
(stable-fixes).
- ALSA: hda/conexant: Renaming the codec with device ID 0x1f86
and 0x1f87 (stable-fixes).
- ALSA: sc6000: Use standard print API (stable-fixes).
- drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update()
(stable-fixes).
- ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond
HDAudio (stable-fixes).
- ASoC: SOF: Intel: hda-dai: remove dspless special case
(stable-fixes).
- commit b214d9a
- gve: Enable reading max ring size from the device in DQO-QPL
mode (bsc#1265925).
- gve: Update QPL page registration logic (bsc#1265925).
- gve: add XDP DROP and PASS support for DQ (bsc#1265925).
- gve: update XDP allocation path support RX buffer posting
(bsc#1265925).
- gve: merge packet buffer size fields (bsc#1265925).
- gve: update GQ RX to use buf_size (bsc#1265925).
- gve: introduce config-based allocation for XDP (bsc#1265925).
- gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics
(bsc#1265925).
- gve: Add RSS cache for non RSS device option scenario
(bsc#1265925).
- gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup
(bsc#1265925).
- gve: process XSK TX descriptors as part of RX NAPI
(bsc#1265925).
- commit a95e7b7
- Fix the wrong kabi patch order at merging from SLE15-SP6-LTSS
No functional changes
- commit edd353b
- net: gro: don't merge zcopy skbs (git-fixes).
- net: skbuff: propagate shared-frag marker through frag-transfer
helpers (CVE-2026-43503 bsc#1265960).
- net: skbuff: preserve shared-frag marker during coalescing
(CVE-2026-46300 bsc#1265209).
- net: gro: don't merge zcopy skbs (git-fixes).
- net: skbuff: propagate shared-frag marker through frag-transfer
helpers (CVE-2026-43503 bsc#1265960).
- net: skbuff: preserve shared-frag marker during coalescing
(CVE-2026-46300 bsc#1265209).
- commit 17348bf
- Revert "net: skbuff: propagate shared-frag marker through pskb_copy()"
This reverts commit 7d64bf1e8cbaf1eb308d2e84a0475b85e0129adc.
- commit 44dd5e4
- packaging: compute-PATCHVERSION.sh -> compute-PATCHVERSION
- commit fc624df
- Fix errors in prior merge from fixes/linux-6.4:
- Adjust ptrace-slightly-saner-get_dumpable-logic-kabi-assert.patch
(kabi fixup) so 'task_struct_orig' matches SP7 task_struct layout.
- Fix ordering of ptrace kabi fixup patches in series.conf to match
SLE15-SP6-LTSS [no functional difference].
- commit 46dfb5c
- kernel-binary: Only apply vmlinux workaround on SLE15 and later
To create debuginfo for vmlinux the file needs to be present even if
it's not packaged because a compressed file is packaged insteand.
To accomplish that the file is marked as ghost in the file list. Then
rpm does not complain that the file exists but does not package it.
However, rpm still reserves space for ghost files when installing a
package. To avoid reserving space for a file that is not used the file
is truncated.
That works on SLE 15 but on SLE 12 rpm then fails packaging the
debuginfo complaiing that extra debuginfo files are present. Limit the
workaround to SLE 15 and later.
Fixes: 222edac2a18 (kernel-binary: prevent uncompressed vmlinux from inflating rpm size requirements)
- commit 1ef7451
- scsi: target: iscsi: validate CHAP_R length before base64 decode
(bsc#1265449).
- commit 9997c88
- net: mana: Fix crash from unvalidated SHM offset read from BAR0 during FLR (bsc#1265846).
- net: mana: remove double CQ cleanup in mana_create_rxq error path (git-fixes).
- net: mana: Skip WQ object destruction for uninitialized RXQ (git-fixes).
- net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() (git-fixes).
- RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() (git-fixes).
- RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() (git-fixes).
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (git-fixes).
- RDMA/mana: Validate rx_hash_key_len (git-fixes).
- hv_sock: fix ARM64 support (git-fixes).
- commit 18c2af9
- Kernel-binary: Do not truncate vmlinux when it's the boot image
Some architectures use vmlinux to boot. Truncating vmlinux on those
architectures causes signing failure during build. Also if the signing
was disabled a brokne kernel would be produced.
Fixes: 222edac2a18 (kernel-binary: prevent uncompressed vmlinux from inflating rpm size requirements)
- commit d3cf603
- perf: Fix __perf_event_overflow() vs perf_remove_from_context()
race (bsc#1260018 CVE-2026-23271).
- commit d05430f
- xfs: avoid dereferencing log items after push callbacks
(CVE-2026-31404 bsc#1261628).
- commit bed0ec1
- kernel-binary: prevent uncompressed vmlinux from inflating rpm size requirements
define %__spec_install_post to truncate the uncompressed vmlinux
to 0 bytes after find-debuginfo.sh and brp-* scripts run. This prevents
rpmbuild from baking the %ghost file size into the FILESIZES
header, which can cause installation failures on smaller /boot partitions.
Fixes: bsc#1265456
- commit 222edac
- net/rds: reset op_nents when zerocopy page pin fails
(bsc#1265626, CVE-2026-43494).
- net/rds: reset op_nents when zerocopy page pin fails
(bsc#1265626).
- commit b66d9fc
- perf: Make sure to use pmu_ctx->pmu for groups (bsc#1263001
CVE-2026-31528).
- commit 2f72854
- RDMA/irdma: Fix deadlock during netdev reset with active connections (CVE-2026-31565 bsc#1263064)
- commit e3d01c8
- net/sched: fix pedit partial COW leading to page cache corruption
(bsc#1265421).
- commit a756c69
- RDMA/irdma: Fix double free related to rereg_user_mr (CVE-2026-43120)
- commit c514796
- drm/amdkfd: Make all TLB-flushes heavy-weight (stable-fixes).
- commit be16332
- ALSA: hda: Fix NULL pointer dereference in snd_hda_ctl_add()
(git-fixes).
- ALSA: scarlett2: Add missing error check when initialise
Autogain Status (git-fixes).
- ALSA: hda: cs35l41: Put ACPI device on missing physical node
(git-fixes).
- ALSA: hda: cs35l56: Put ACPI device after setting companion
(git-fixes).
- ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans
(git-fixes).
- ALSA: usb-audio: Bound MIDI endpoint descriptor scans
(git-fixes).
- drm/amdgpu: gate VM CPU HDP flush on reset lock (stable-fixes).
- drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower
count (stable-fixes).
- leds: qcom-lpg: Check for array overflow when selecting the
high resolution (stable-fixes).
- commit 219e1c4
- spi: zynq-qspi: switch to use modern name (stable-fixes).
- Refresh
patches.suse/spi-zynq-qspi-Add-check-for-clk_enable.patch.
- commit 79d17cd
- USB: serial: option: add Telit Cinterion LE910Cx compositions
(stable-fixes).
- usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl
(stable-fixes).
- usb: usblp: fix heap leak in IEEE 1284 device ID via short
response (stable-fixes).
- platform/x86: hp-wmi: Ignore backlight and FnLock events
(stable-fixes).
- mtd: spi-nor: sst: Fix write enable before AAI sequence
(git-fixes).
- mtd: docg3: fix use-after-free in docg3_release() (git-fixes).
- spi: uniphier: fix controller deregistration (git-fixes).
- spi: syncuacer: fix controller deregistration (git-fixes).
- spi: sun4i: fix controller deregistration (git-fixes).
- spi: omap2-mcspi: fix controller deregistration (git-fixes).
- spi: mtk-nor: fix controller deregistration (git-fixes).
- spi: microchip-core-qspi: fix controller deregistration
(git-fixes).
- spi: uniphier: Simplify clock handling with
devm_clk_get_enabled() (stable-fixes).
- wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling
(git-fixes).
- wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor
(stable-fixes).
- mtd: spi-nor: sst: Fix SST write failure (git-fixes).
- mtd: spi-nor: sst: Factor out common write operation to
`sst_nor_write_data()` (stable-fixes).
- spi: uniphier: switch to use modern name (stable-fixes).
- spi: synquacer: switch to use modern name (stable-fixes).
- spi: sun4i: switch to use modern name (stable-fixes).
- spi: spi-ti-qspi: Convert to platform remove callback returning
void (stable-fixes).
- spi: microchip-core-qspi: Use helper function
devm_clk_get_enabled() (stable-fixes).
- commit 401263c
- drm/amdkfd: Add upper bound check for num_of_nodes
(stable-fixes).
- commit 46b01e2
- HID: playstation: Clamp num_touch_reports (git-fixes).
- drm/amdgpu: zero-initialize GART table on allocation
(stable-fixes).
- drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in
KIQ (stable-fixes).
- fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent
use-after-free (stable-fixes).
- ipmi: Add limits to event and receive message requests
(git-fixes).
- crypto: authencesn - reject short ahash digests during instance
creation (git-fixes).
- drm/amdgpu/vcn4: Avoid overflow on msg bound check (git-fixes).
- drm/amdgpu/vcn3: Avoid overflow on msg bound check (git-fixes).
- drm/amdkfd: validate SVM ioctl nattr against buffer size
(stable-fixes).
- drm/amdgpu: fix zero-size GDS range init on RDNA4
(stable-fixes).
- drm/amdkfd: Clear VRAM on allocation to prevent stale data
exposure (stable-fixes).
- drm/amdgpu/vcn4: Prevent OOB reads when parsing IB
(stable-fixes).
- drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg
(stable-fixes).
- drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg
(stable-fixes).
- drm/amdgpu/vce: Prevent partial address patches (stable-fixes).
- drm/amdgpu: Add bounds checking to ib_{get,set}_value
(stable-fixes).
- mtd: docg3: Convert to platform remove callback returning void
(stable-fixes).
- commit 8bb0040
- ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product
line in quirk table (stable-fixes).
- ALSA: core: Serialize deferred fasync state checks (git-fixes).
- ACPI: video: force native backlight on HP OMEN 16 (8A44)
(stable-fixes).
- ACPI: scan: Use acpi_dev_put() in object add error paths
(git-fixes).
- ALSA: aoa: i2sbus: clear stale prepared state (git-fixes).
- ALSA: seq_oss: return full count for successful SEQ_FULLSIZE
writes (stable-fixes).
- ALSA: aoa: Skip devices with no codecs in i2sbus_resume()
(git-fixes).
- crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated
as 64-bit (git-fixes).
- ALSA: misc: Use guard() for spin locks (stable-fixes).
- ALSA: aoa: Use guard() for mutex locks (stable-fixes).
- ALSA: seq: Notify client and port info changes (stable-fixes).
- commit fd79ce9
- drm/loongson: Use managed KMS polling (git-fixes).
- drm/xe/dma-buf: handle empty bo and UAF races (git-fixes).
- commit 6307785
- drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init
(git-fixes).
- drm/gma500/oaktrail_lvds: fix hang on init failure (git-fixes).
- drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup
(git-fixes).
- accel/qaic: Add overflow check to remap_pfn_range during mmap
(git-fixes).
- drm/panfrost: Fix wait_bo ioctl leaking positive return from
dma_resv_wait_timeout() (git-fixes).
- drm/i915/dp: Fix VSC dynamic range signaling for RGB formats
(git-fixes).
- drm/i915: skip __i915_request_skip() for already signaled
requests (git-fixes).
- commit a143ec8
- avahi
-
- Add avahi-CVE-2026-34933.patch: refuse to accept publish flags
where both wide_area and multicast are set.
(CVE-2026-34933, bsc#1261546)
- util-linux
-
- loopdev: Prevent unauthorized read access to symlinked filesystem
images (bsc#1261606, CVE-2026-27456,
util-linux-CVE-2026-27456.patch).
- gnutls
-
- Security fixes:
* CVE-2026-33846: buffers: add more checks to DTLS reassembly (bsc#1263705)
* CVE-2026-42009: lib/buffers: ensure packets have differing sequence numbers (bsc#1263708)
* CVE-2026-33845: buffers: switch from end_offset over to frag_length (bsc#1263704)
* CVE-2026-42010: lib/auth/rsa_psk: fix binary PSK identity lookup (bsc#1263709)
* CVE-2026-3833: x509/name-constraints: compare domain names case-insensitive (bsc#1263707)
* CVE-2026-42011: x509/name_constraints: fix intersecting empty constraints (bsc#1263710)
* CVE-2026-42012: x509/hostname-verify: make URI/SRV SAN preclude CN fallback (bsc#1263711)
* CVE-2026-42013: x509: prevent fallback on oversized SAN (bsc#1263712)
* CVE-2026-42014: pkcs11_write: fix UAF and leak in gnutls_pkcs11_token_set_pin (bsc#1263713)
* CVE-2026-42015: x509/pkcs12_bag: fix off-by-one in bag element bounds check (bsc#1263714)
* CVE-2026-5260: lib/pkcs11_privkey: guard against overreading on short ciphertexts (bsc#1263715)
* CVE-2026-5419: gnutls_cipher_decrypt3: make PKCS#7 unpadding branch free (bsc#1263716)
* Add patches:
gnutls-CVE-2026-33846.patch gnutls-CVE-2026-42009.patch
gnutls-CVE-2026-33845.patch gnutls-CVE-2026-42010.patch
gnutls-CVE-2026-3833.patch gnutls-CVE-2026-42011.patch
gnutls-CVE-2026-42012.patch gnutls-CVE-2026-42013.patch
gnutls-CVE-2026-42014.patch gnutls-CVE-2026-5260.patch
gnutls-CVE-2026-42015.patch gnutls-CVE-2026-5419.patch
- samba
-
- CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
(bso#16033); (bsc#1261161).
- CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
(bsc#1261163).
- CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
nbt server; (bso#16012); (bsc#1261160).
- CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
enrollment using http:// without validation;(bso#16003);
(bsc#1261159).
- CVE-2026-1933: Fix missing access check on reparse point
operations; (bso#15992); (bsc#1261188).
- CVE-2026-2340: vfs_worm does not block directory modification;
(bso#15997); (bsc#1261158).
- Fix rpc workers with long living clients from growing server
memory keytab and increasing memory used by workers;
(bso#16042); (bsc#1257200).
- Generated dynamic profile based on path to special 'printers'
share. (bsc#1259441).
- Fix regression "use-kerberos=desired" broken doesn't even try
to authenticate with kerberos and instead fallsback to NTLM;
(bsc#1255755); (bso#15789).
- Fix memory leak using cups parsed options and from filename
allocated when processing end of printing job; (bso#15979);
(bsc#1257200).
- fix manpage for "net offlinejoin requestodj"; (bso#15964)
- fix "ctdbd socket" documentation in manpage for smb.conf;
(bso#15977)
- Fix memory leak opening local named pipe; (bso#15979);
(bsc#1257200).
- xz
-
- Fix buffer overflow in lzma_index_append (bsc#1261280, CVE-2026-34743)
* CVE-2026-34743.patch
- Change SUSE-Public-Domain license to LicenseRef-SUSE-Public-Domain to
fix rpmlint errors
- openssl-1_1
-
- Security fixes:
* CVE-2026-42766: Possible NULL Dereference in Password-Based CMS
Decryption (bsc#1266349)
* CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption
(bsc#1266341)
* CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String
Conversion (bsc#1266340)
* CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing
(bsc#1266342)
* CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357)
* Add patches:
openssl-CVE-2026-42766.patch openssl-CVE-2026-9076.patch
openssl-CVE-2026-7383.patch openssl-CVE-2026-34180.patch
openssl-CVE-2026-45447.patch
- bsc#1250782 Fix 30-test_fips_sli.t fails intermittently on s390x
Fix AES_GCM IV test sometimes failing on s390x.
* Add openssl-fix-fips-slitest-s390x.patch
- openssl-3
-
- Security fix:
* CVE-2026-42767 NULL Pointer Dereference in CRMF EncryptedValue Decryption
(bsc#1266350)
* Add patch: openssl-CVE-2026-42767.patch
- Security fixes:
* CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357)
* CVE-2026-45446: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (bsc#1266356)
* CVE-2026-42770: FFC-DH Peer Validation Uses Attacker-Supplied q (bsc#1266353)
* CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path (bsc#1266355)
* CVE-2026-42768: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (bsc#1266351)
* CVE-2026-42769: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (bsc#1266352)
* CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349)
* CVE-2026-34183: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (bsc#1266345)
* CVE-2026-34181: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (bsc#1266343)
* CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341)
* CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340)
* CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342)
* Add patches:
openssl-CVE-2026-34180.patch openssl-CVE-2026-34181.patch
openssl-CVE-2026-34183.patch openssl-CVE-2026-42766.patch
openssl-CVE-2026-42768.patch openssl-CVE-2026-42769.patch
openssl-CVE-2026-42770.patch openssl-CVE-2026-45445.patch
openssl-CVE-2026-45446.patch openssl-CVE-2026-45447.patch
openssl-CVE-2026-7383.patch openssl-CVE-2026-9076.patch
- python311
-
- Add CVE-2026-3446-base64-padding.patch preventing ignoring
excess Base64 data after the first padded quad (bsc#1261970,
CVE-2026-3446, gh#python/cpython#145264).
- Rewrite structure of Python interpreter packages.
`python3*` symbols should be now provided by real python3
packages and its subpackages instead of the virtual provides
(bsc#1258364).
- libsolv
-
- fix solv_chksum_free segfault when called with a NULL pointer
- bump version to 0.7.39
- made repo_add_solv more robust against corrupt files
[bsc#1265935] [CVE-2026-9149]
- fix potential buffer overflow when verifying EdDSA signatures
[bsc#1266039] [CVE-2026-48863]
- added limit checks in multiple places to catch overflows
- reduce the size of the language id cache
- fixed Debian canon selection
- fixed dbpath detection in repo_rpmdb_librpm
- reduced stack usage in repo page compression (needed for musl)
- bump version to 0.7.38
- fix parsing of sha512 checksums in debian repositories
[bsc#1265938] [CVE-2026-9150]
- improve speed of dirpool_add_dir makeing parsing of filelists.xml
twice as fast
- fix parsing of recommends in the old Mandriva synthesis format
- bump version to 0.7.37
- respect the "default" attribute in environment optionlist in
the comps parser
- support suse namespace deps in boolean dependencies [bsc#1258193]
- support for the Elbrus2000 (e2k) architecture
- support language() suse namespace rewriting
- bump version to 0.7.36
- sqlite3
-
- Sync version 3.53.2 from Factory:
* bsc#1268013, CVE-2026-11824: heap-based buffer overflow
vulnerability in the FTS5 full-text search extension.
* bsc#1268012, CVE-2026-11822: memory corruption vulnerabilities
in the FTS5 full-text search extension.
- libzypp
-
- A .repo files "path=" entry must not refer to a location
outside the repo (bsc#1267874, CVE-2026-44942)
A "path=" entry may solely denote a sub-directory of the baseurl
where the metadata are located. A relative path trying to access
data outside the baseurl is reported and sanitized.
- version 17.38.13 (35)
- Repo "keyhint" must denote a filename, no path (bsc#1267426,
CVE-2026-44941)
- version 17.38.12 (35)
- Fix potential crash on malformed or malicious repository
metadata (fixes #740)
- version 17.38.11 (35)
- Repo metadata: discard entries referring to a location outside
the repo (bsc#1259802, CVE-2026-25707)
Mirroring those data locally would refer to a location outside
the repo's local cache directory. Those data entries are reported
and discarded.
- zypp.conf: Allow [env] section to add environment variables.
This feature is designed to enable environment-specific settings
or debugging options over an extended period. See zypp.conf(5).
- version 17.38.10 (35)
- Prevent configured scripts from escaping the sigcheck directory
(bsc#1265223, CVE-2026-44933)
- StringV: guard hasPrefix/hasPrefixCI against reading past the
view end (fixes #735)
- version 17.38.9 (35)
- Mandatory signature verification plugin support (PED#11922)
- version 17.38.8 (35)
- Fix purge-kernel -rc kernel handling (bsc#1239718)
- Explicitly_set_pool_DISTTYPE_RPM (fixes #726)
- version 17.38.7 (35)
- Check for trusted key updates when updating the general keyring
(bsc#1259706)
- Support multiple MirroredOrigin authorities (bsc#1253193)
- Workaround doxygen bug: doxygen/doxygen#12057
- libzypp.spec: Add missing graphviz-gd BuildRequires (boo#1259842)
- version 17.38.6 (35)
- Fix preloader not caching packages from arch specific subrepos
(bsc#1253740)
- Deprioritize invalid mirrors (fixes openSUSE/zypper#636)
- version 17.38.5 (35)
- Fix Product::referencePackage lookup (bsc#1259311)
Use a provided autoproduct() as hint to the package name of the
release package. It might be that not just multiple versions of
the same release package provide the same product version, but
also different release packages.
- version 17.38.4 (35)
- specfile: on fedora use %{_prefix}/share as zyppconfdir if
%{_distconfdir} is undefined (fixes #693)
This will set '-DZYPPCONFDIR=%{zyppconfdir}' for cmake.
- Fall back to a writable location when precaching packages
without root (bsc#1247948)
- version 17.38.3 (35)
- Prepare a legacy /etc/zypp/zypp.conf to be installed on old distros.
See the ZYPP.CONF(5) man page for details.
- Fix runtime check for broken rpm --runposttrans (bsc#1257068)
- version 17.38.2 (35)
- Avoid libcurl-mini4 when building as it does not support ftp
protocol.
- Translation: updated .pot file.
- version 17.38.1 (35)
- zypp.conf: follow the UAPI configuration file specification
(PED-14658)
In short terms it means we will no longer ship an
/etc/zypp/zypp.conf, but store our own defaults in
/usr/etc/zypp/zypp.conf. The systems administrator may choose to
keep a full copy in /etc/zypp/zypp.conf ignoring our config file
settings completely, or - the preferred way - to overwrite
specific settings via /etc/zypp/zypp.conf.d/*.conf overlay files.
See the ZYPP.CONF(5) man page for details.
- cmake: correctly detect rpm6 (fixes #689)
- Use 'zypp.tmp' as temp directory component to ease setting up
SELinux policies (bsc#1249435)
- zyppng: Update Provider to current MediaCurl2 download
approach, drop Metalink ( fixes #682 )
- version 17.38.0 (35)
- openssh
-
- Add patch rebased from upstream to add missing askpass check for
proxy-mode multiplexing sessions (CVE-2026-35388, bsc#1261441):
* openssh-cve-2026-35388-askpass-multiplexing.patch
- Update patch to fix a possible information disclosure or denial
of service due to uninitialized variables in gssapi patches
(CVE-2026-3497, bsc#1259642) :
* openssh-8.0p1-gssapi-keyex.patch
- Add patch to fix a potential issue when validating mac or ciphers
(bsc#1264568):
* fix-mac-validation-strsep-logic-bug.patch
- Improve %prep LDAP regex to preserve subdirectories (e.g., ope-
nbsd-compat/) and handle optional [ab]/ prefixes.
- python-PyJWT
-
- CVE-2026-48526: JWK JSON accepted as HMAC secret (algorithm confusion)
(bsc#1266802)
- CVE-2026-48523: Algorithm allow-list bypass with PyJWK / PyJWKClient
(bsc#1266799)
- CVE-2026-48525: DoS via base64 decode of unused payload segment when b64=false
(bsc#1266801)
- CVE-2026-48522: PyJWKClient accepts non-HTTP(S) URIs (bsc#1266798)
- CVE-2026-48524: PyJWKClient cache wiped on fetch error (bsc#1266800)
- added security-fixes.patch to fix above vulnerabilities
- python-pyOpenSSL
-
- CVE-2026-40475: improper input handling of null bytes can lead to
silent data truncation and security-state inconsistency (bsc#1262803)
* CVE-2026-40475.patch
- python-typing_extensions
-
- Drop fix-ann_module-import-path.patch, fixed upstream
- update to 4.12.2:
* Fix regression in v4.12.0 where specialization of certain
* generics with an overridden `__eq__` method would raise
errors.
* Fix tests so they pass on 3.13.0b2
* Preliminary changes for compatibility with the draft
implementation of PEP 649 in Python 3.14.
* Fix regression in v4.12.0 where nested `Annotated` types
would cause `TypeError` to be raised if the nested
`Annotated` type had unhashable metadata.
* Fix incorrect behaviour of `typing_extensions.ParamSpec` on
Python 3.8 and 3.9 that meant that
`isinstance(typing_extensions.ParamSpec("P"),
typing.TypeVar)` would have a different result in some
situations depending on whether or not a profiling
function had been set using `sys.setprofile`.
* This release focuses on compatibility with the upcoming
release of Python 3.13. Most changes are related to the
implementation of type parameter defaults (PEP 696).
- Add patch to fix import path for ann_module, ann_module2 and ann_module3
* fix-ann_module-import-path.patch
- update to 4.11.0:
* Fix tests on Python 3.13.0a5. Patch by Jelle Zijlstra.
* Fix the runtime behavior of type parameters with defaults
* Fix minor discrepancy between error messages produced by
`typing` and `typing_extensions` on Python 3.10.
* When `include_extra=False`, `get_type_hints()` now strips
`ReadOnly` from the annotation.
- update to 4.10.0:
This feature release adds support for PEP 728 (TypedDict with extra
items) and PEP 742 (``TypeIs``).
- Add support for PEP 728, supporting the `closed` keyword argument and the
special `__extra_items__` key for TypedDict. Patch by Zixuan James Li.
- Add support for PEP 742, adding `typing_extensions.TypeIs`. Patch
by Jelle Zijlstra.
- Drop runtime error when a read-only `TypedDict` item overrides a mutable
one. Type checkers should still flag this as an error. Patch by Jelle
Zijlstra.
- Speedup `issubclass()` checks against simple runtime-checkable protocols by
around 6% (backporting https://github.com/python/cpython/pull/112717, by Alex
Waygood).
- Fix a regression in the implementation of protocols where `typing.Protocol`
classes that were not marked as `@runtime_checkable` would be unnecessarily
introspected, potentially causing exceptions to be raised if the protocol had
problematic members. Patch by Alex Waygood, backporting
https://github.com/python/cpython/pull/113401.
- obsoletes backport-recent-implementation-of-protocol.patch
- Add backport-recent-implementation-of-protocol.patch upstream patch
gh#python/typing_extensions@004b893ddce2
- python-urllib3
-
- CVE-2026-44431: sensitive information disclosure due to sensitive
headers being forwarded across origins in proxied low-level redirects
(bsc#1265267)
Add patch CVE-2026-44431.patch
- tar
-
- Fix CVE-2026-5704.patch causing errors when extracting certain archives
generated by rpm2archive which contain hard links
- Refresh fix-dereference.patch
- Fix tar changing dir permissions temporarily even when using --no-overwrite-dir
* no-overwrite-dir-fix.patch
- Fix CVE-2026-5704, crafted archives can be used to to hide file injection
(bsc#1261900)
* CVE-2026-5704.patch
- Fix --dereference/-h not working properly after CVE-2025-45582 fix (bsc#1265450)
* fix-dereference.patch
- Fix extraction failure for paths like "a/./b" caused by the gnulib openat2
implementation (bsc#1267189)
* openat2-fix-dotlike-failure.patch
- timezone
-
- Update to 2026b:
* British Columbia moved to permanent -07 on 2026-03-09. (bsc#1264965)
* Some more overflow bugs have been fixed in zic.
- Refresh revert-philippines-historical-data.patch
- Change SUSE-Public-Domain license to LicenseRef-SUSE-Public-Domain to
fix rpmlint errors
- Update to 2026a:
* Moldova has used EU transition times since 2022.
* The "right" TZif files are no longer installed by default.
* -DTZ_RUNTIME_LEAPS=0 disables runtime support for leap seconds.
* TZif files are no longer limited to 50 bytes of abbreviations.
* zic is no longer limited to 50 leap seconds.
* Several integer overflow bugs have been fixed.
- Changes from 2025c:
* update Baja California DST rules in 1953, 1961-1975
* An unset TZ is no longer invalid when /etc/localtime is
missing, and is abbreviated "UTC" not "-00". This reverts to
2024b behavior
* tzset etc. are now more cautious about questionable TZ settings.
* tzset etc. now treat ' ' like '_' in time zone abbreviations
* tzfree now preserves errno, consistently with POSIX.1-2024 ‘free’.
* zic has new options inspired by FreeBSD. ‘-D’ skips creation of
output ancestor directories, ‘-m MODE’ sets output files’ mode,
and ‘-u OWNER[:GROUP]’ sets output files’ owner and group.
* multiple changes visible to developers
- Use "REDO=posix_right" to keep installing "right" TZif files.
- vim
-
- Update to v9.2.0530.
- Fix for SG#71948, bsc#1262395:
* vim-9.1.1732-fix-inc-detection.patch: Fix for incorrectly detecting
- Upstream fixed the following bugs / CVEs:
* bsc#1264706 CVE-2026-42307
* bsc#1265360 CVE-2026-46483
* bsc#1264708 CVE-2026-45130
* bsc#1264707 CVE-2026-44656
* bsc#1265349 CVE-2026-43961
- Changes:
* 9.2.0530: WinBar row vertical separator not refreshed on window change
* 9.2.0529: GTK4: clipboard returns empty after a foreign app takes the selection
* 9.2.0528: possible overflow in XIM resource handling
* 9.2.0527: Possible double free in fill_partial_and_closure()
* 9.2.0526: missing out-of-memory check in ex_substitute()
* 9.2.0525: spell: memory leak in spell_read_dic()
* 9.2.0524: spell: buffer overflow with many affix or compound flags
* 9.2.0523: tests: no test for using shellescape() in combination with :!
* 9.2.0522: event_nr2name() in autocmd.c can be improved
* 9.2.0521: GTK4: cannot resize shell after the window is shown
* 9.2.0520: Reversed text opacity in popup when termguicolor is set
* 9.2.0519: GTK4: GUI tabline is not displayed correctly
* 9.2.0518: GTK4: input method cannot compose text
* 9.2.0517: quickfix: can set quickfixtextfunc in restricted/sandbox mode
* 9.2.0516: socketserver: spurious error when servername is taken
* 9.2.0515: virtualedit=insert doesn't work during change operation
* 9.2.0514: GTK4: build errors when socketserver is enabled
* 9.2.0513: [security]: memory safety issues in spellfile.c
* 9.2.0512: clientserver uses binary protocol
* 9.2.0511: configure: when GTK4 is used also links in X11 libs
* 9.2.0510: setline() mapping may trigger autoindent
* 9.2.0509: term.c: compile error when LOG_TRN is enabled
* 9.2.0508: completion: cannot complete user cmd :K with 'ignorecase'
* 9.2.0507: Vim9 class: public/protected member name clash uses same error
* 9.2.0506: home_replace() function can be improved
* 9.2.0505: GTK4: text looks blurry on HiDPI displays
* 9.2.0504: configure: requires X11 libraries for GTK4 build
* 9.2.0503: Makefile: Missing dependencies for new GTK4 source files
* 9.2.0502: runtime(netrw): bookmark handling can be improved
* 9.2.0501: GTK4: there is no GTK4 UI available
* 9.2.0500: filetype: some html files wrongly recognized as htmlangular
* 9.2.0499: modeline: allow to disable modelines with modelinestrict
* 9.2.0498: potential heap buffer overflow in if_xcmdsrv.c
* 9.2.0497: Cannot jump to remote tags
* 9.2.0496: [security]: Code Injection in cucumber filetype plugin
* 9.2.0495: [security]: runtime(netrw): code injection via NetrwBookHistSave()
* 9.2.0494: User commands cannot handle single args with spaces
* 9.2.0493: popup: missing Popup, PopupBorder and PopupTitle hi groups
* 9.2.0492: popup: decoration wrongly drawn with clipping on border
* 9.2.0491: VMS: various build issues
* 9.2.0490: matchfuzzy() can crash on long multi-word patterns
* 9.2.0489: filetype: some Objective-C files are not recognized
* 9.2.0488: statusline: status line highlight blends into adjacent vsep cells
* 9.2.0487: viminfo: possible signed int overflow in register array
* 9.2.0486: out-of-bound read when recovering swap files
* 9.2.0485: clipboard provider callback can be called recursively
* 9.2.0484: TextPutPre triggers clipboard provider callback twice
* 9.2.0483: popup: terminal embedded in an opacity popup freezes Vim on input
* 9.2.0482: runtime(osc52): triggered twice with TextPutPoste autocmd
* 9.2.0481: runtime(netrw): command injection possible via maps
* 9.2.0480: [security]: runtime(netrw): code injection via mf command
* 9.2.0479: [security]: runtime(tar): command injection in tar plugin
* 9.2.0478: channel: redundant str/length assignments in channel_part_info()
* 9.2.0477: popup: leftover content after popup_free under layout change
* 9.2.0476: pattern completion leaks memory on alloc failures
* 9.2.0475: runtime(netrw): bookmark paths not normalized
* 9.2.0474: MS-Windows: hard to tell which Visual Studio version was selected with MSVC
* 9.2.0473: Pasting ". register without autocommands breaks TextPut*
* 9.2.0472: popup: column jitters when scrolled outside viewport
* 9.2.0471: vimvars di_key initialized at runtime
* 9.2.0470: No way to hook into put commands
* 9.2.0469: popup: textprop-anchored popups bleed past host window edges
* 9.2.0468: popups: not correctly updated from a CmdlineChanged autocommand
* 9.2.0467: multi-line statusline loses highlighting attributes
* 9.2.0466: popup: redraw can use stale blended cells
* 9.2.0465: modeline: foldmarker cannot be set with modelinestrict
* 9.2.0464: runtime(netrw): bookmarking directory uses current dir
* 9.2.0463: Not able to use legacy expression evaluation in a vim9script maps
* 9.2.0462: MS-Windows: workaround for assert error on GUI
* 9.2.0461: Corrupted undofile causes use-after-free
* 9.2.0460: did_set_shellpipe_redir() in wrong file
* 9.2.0459: tests: test_termcodes fails (after v9.2.0456)
* 9.2.0458: Crash with invalid shellredir/shellpipe value
* 9.2.0457: Compile warning about unused variable
* 9.2.0456: stray p character displayed on some terms
* 9.2.0455: 'findfunc' only allows extra info for cmdline completion
* 9.2.0454: tests: no test that "abbr" in customlist completion is shown
* 9.2.0453: vertical separator of statusline blend into active statusline
* 9.2.0452: screen.c popup opacity blend logic is duplicated
* 9.2.0451: 'findfunc' can't return extra info for cmdline completion
* 9.2.0450: [security]: heap buffer overflow in spellfile.c read_compound()
* 9.2.0449: Make proto fails in non GTK builds
* 9.2.0448: Vim9: dangling cmdline pointer after skip_expr_cctx()
* 9.2.0447: cindent does not ignore comments
* 9.2.0446: runtime(netrw): off-by-one bug in s:NetrwUnMarkFile()
* 9.2.0445: win_fix_scroll() called before win_comp_pos() in command_height()
* 9.2.0444: Cannot set 'path' option via modeline
* 9.2.0443: GUI: cancelling save dialog overwrites or discards unnamed buffer
* 9.2.0442: completion: i_CTRL-X_CTRL-V doesn't use dict from customlist
* 9.2.0441: statusline: click handler not called on multi-line statusline
* 9.2.0440: MS-Windows: cursor flicker during update_screen()
* 9.2.0439: completion: info popup not removed in cmdline mode
* 9.2.0438: tests: test_plugin_termdebug is flaky
* 9.2.0437: MS-Windows: cursor flicker in vtp mode
* 9.2.0436: Buffer overflow when parsing overlong errorformat lines
* 9.2.0435: [security]: backticks in 'path' may cause shell execution on completion
* 9.2.0434: cscope: filename interpreted by /bin/sh
* 9.2.0433: customlist completion cannot supply pum metadata
* 9.2.0432: blob to string conversion can be improved
* 9.2.0431: blob encoding can be improved
* 9.2.0430: tests: Test_shortmess_F3() is flaky on MS-Windows
* 9.2.0429: tests: flaky screendump Test_smoothscroll_incsearch()
* 9.2.0428: popup: no opacity support for completepopup/previewpopup
* 9.2.0427: popup: opacity blend may leaks white bg color
* 9.2.0426: tests: still some flaky screendump tests
* 9.2.0425: Cannot silence undo/redo messages
* 9.2.0424: popup: flicker when wildtrigger() refreshes the popup menu
* 9.2.0423: popup: wrapped cmdline truncated with wildoptions=pum
* 9.2.0422: popup: leave stray char when scrollbar changes
* 9.2.0421: vimball: can smuggle Vimscript into VimballRecord file
* 9.2.0420: channel: cannot handle binary data via channel callbacks
* 9.2.0419: popup: rendering issues
* 9.2.0418: wildcards in expanded env vars reinterpreted by glob
* 9.2.0417: completion: no support for "noinsert" with 'wildmode'
* 9.2.0416: Unix: filename completion splits at space for single-file Ex commands
* 9.2.0415: Wrong behavior when executing register that ends in Insert mode
* 9.2.0414: Flicker when drawing window separator and pum is shown
* 9.2.0413: Scrolling wrong with 'splitkeep' when changing 'cmdheight'
* 9.2.0412: channel: term_start() out_cb/err_cb no longer deliver raw chunks
* 9.2.0411: tabpanel: no Vim script functions for the tabpanel
* 9.2.0410: test suite races when run with parallel make
* 9.2.0409: memory leaks in copy_substring_from_pos()
* 9.2.0408: Insert-mode <Cmd> edits can corrupt undo
* 9.2.0407: tabpanel: A few issues with the tabpanel
* 9.2.0406: VisualNOS not used when Wayland selection ownership lost
* 9.2.0405: when jumping to tags, will open URLs
* 9.2.0404: redraw_listener_add() does not check secure flag
* 9.2.0403: Vim9: def function sandbox bypass
* 9.2.0402: pum: opacity not applied to wildmenu pum
* 9.2.0401: tests: still a few flaky tests
* 9.2.0400: sandbox callbacks selected through 'complete'
* 9.2.0399: MS-Windows: compile warning in strptime.c
- wicked
-
- Update to version 0.6.79
- Fix an indirect remote shell command injection via unsanitized
dhcp strings and leaseinfo dump (bsc#1265221,CVE-2026-44932):
- Fix to escape single-quotes in leaseinfo dump output used by the
`wicked test dhcp4` and `wicked test dhcp6` and written to the
/run/wicked/leaseinfo.* files, e.g. to pass them to netconfig.
A netconfig modify filtered for strict key='value' lines without
any escaped quotes and discarded these lines already before.
- Fix posix-tz-dbname and tz-string option processing checks to
permit only valid characters according to RFC4833.
- Discard string values containing single-quotes in other options.
- Trigger to regenerate initrd that may contain wicked binaries on
updates from wicked versions <= 0.6.78.
- xen
-
- bsc#1266952 - VUL-0: CVE-2026-42487: xen: x86 HVM I/O port list
traversal (XSA-491)
xsa491.patch
- bsc#1266953 - VUL-0: CVE-2026-42489,CVE-2026-42490: xen: domctl
lock open to abuse (XSA-492)
xsa492-01.patch
xsa492-02.patch
xsa492-03.patch
xsa492-04.patch
xsa492-05.patch
xsa492-06.patch
xsa492-07.patch
xsa492-08.patch
xsa492-09.patch
xsa492-10.patch
xsa492-11.patch
xsa492-12.patch
xsa492-13.patch
xsa492-14.patch
xsa492-15.patch
xsa492-16.patch
xsa492-17.patch
xsa492-18.patch
- bsc#1266955 - VUL-0: CVE-2026-42488: xen: x86: mismatched
mapcache metadata (XSA-494)
xsa494.patch
- zypper
-
- Transactional systems: Delegate rw-commands to
transactional-wrapper if available (jsc#PED-13680, jsc#PED-15607)
On a transactional system where the root filesystem is mounted
read-only, zypper commands that modify the system cannot be
executed directly.
If the system provides a transactional-wrapper utility, zypper
will automatically attempt to invoke it. The wrapper
transparently executes the zypper command within a new, writable
snapshot and manages the lifecycle of that snapshot based on the
command's exit status.
On transactional systems lacking a transactional-wrapper, users
must manually invoke specialized tools -such as
transactional-update- to install, update, or remove software.
- version 1.14.98
- Add --filter-version-change to zypper lu.
Adds filtering by version change significance to reduce noise in
update listings. Supports levels: rebuild (hides rebuild-only
changes) and package (hides all release-only changes).
- version 1.14.97
- Autorefresh ris-services the way as plugin-services (bsc#1246504)
It's actually wrong to treat service refreshes different
depending on the service type. For the purpose of a service it
makes no difference how the data about the repos to use are
acquired.
- version 1.14.96
- Report download progress for command line rpms (fixes #613)
- Hint to '-vv ref' to see the mirrors used to download the
metadata (bsc#1257882)
- Service: Allow "zypper ls SERVICE ..." to test whether a
service with this alias is defined (bsc#1252744)
The command prints an abstract of all services passed on the
command line. It returns 3-ZYPPER_EXIT_ERR_INVALID_ARGS if some
argument does not name an existing service.
- Keep repo data when updating the service settings (bsc#1252744)
- info: Enhance pattern content table (bsc#1158038)
Alternatives (multiple packages providing the same requirement)
are now listed as a single entry in the content table. The entry
shows either the installed package which satisfies the
requirement or the requirement itself as type 'Provides'.
Listing all potential alternatives was miss leading, especially
if the alternatives were mutual exclusive. It looked like an
installed pattern had not-installed requirements and it was not
possible to install all requirements at the same time.
- version 1.14.95