- amazon-ssm-agent
-
- Update to version 3.3.4624.0
* Bump golang.org/x/crypto from v0.51.0 to v0.52.0 (bsc#1266200, CVE-2026-39827,
CVE-2026-39828, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833,
CVE-2026-39834, CVE-2026-39835, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597,
CVE-2026-46598)
* Bump golang.org/x/net from v0.54.0 to v0.55.0
* Enforce directory boundary in BuildSafePath
* Fix visibility issue with Bottlerocket OS in document output
* Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this
also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)
- Drop CVE-2025-22869.patch, merged upstream
- Drop CVE-2025-22870.patch, merged upstream
- Drop CVE-2025-47913.patch, merged upstream
- Drop CVE-2026-25934.patch, merged upstream
- Drop CVE-2026-41506.patch, merged upstream
- Update to version 3.3.4515.0
* Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)
* Quit if sysprep failed and log its current state
* Remove attached legacy cloudwatch plugin packages
* Upgrade Go version to 1.25.10
* Use BuildSafePath wherever it is applicable
- from version 3.3.4364.0
* Add OOM killer protection to systemd service files
* Apply more sanitation to file and registry inventory gatherers
* Bump go-git to v5.17.1
* Deprecate legacy cloudwatch plugin
* Preserve network error details in credential refresher SSM API failures
* Upgrade Go version to 1.25.9
- Add CVE-2026-25934.patch to fix improper verification of data integrity
values for .pack and .idx files that can lead to the consumption of
corrupted files (bsc#1258095, CVE-2026-25934)
- Add CVE-2025-22869.patch to fix Denial of Service in the Key
Exchange of golang.org/x/crypto/ssh (bsc#1239342, CVE-2025-22869)
- Add CVE-2026-41506.patch to fix HTTP authentication credential
leak when following redirects during smart-HTTP clone and fetch
operations (bsc#1264952, CVE-2026-41506)
- Update to version 3.3.4268.0
* Add SSM Distributor support for Bottlerocket OS
* Implement flush credentials command in ssm-cli
* Log ec2messages access denied as debug instead of error to reduce log noise
* Make credential refresher refresh cache quickly in case of credential flush
* Make Greengrass component registration resilient with retry
- Update to version 3.3.4177.0
* Add EnforceWorkspaceRootOwnership configuration to support disable
hardening of agent workspace
* Add reboot comment to Windows shutdown command for SSM Agent traceability
* Update privilege access check to verify ownership and permissions
of document state files
- Update to version 3.3.4121.0
* Add read-only version check prior to install and uninstall
in case of occupied package manager locks
* Add ANSI processing for CloudWatch and S3 log
* Upgrade go-git to v5.17.0 and cloudflare/circl to v1.6.3
to fix CVE-2026-1229
- Switch to systemd-tmpfiles to store runtime data (jsc#PED-14843)
- Update to version 3.3.4108.0
* Disable Go 1.25 container-aware GOMAXPROCS to prevent holding
cgroup file descriptors open
* Upgrade Go version to 1.25.8
- from version 3.3.3883.0
* Document CommandWorkerBufferLimit config
* Include package update in Dockerfile
* Reduce CloudWatch event message length threshold
* Upgrade Go version to 1.25.7
* Update github.com/go-git/go-git/v5 to 5.16.5 (bsc#1258095, CVE-2026-25934)
* Update greengrass version
- from version 3.3.3797.0
* Update Golang version to 1.24.12
* Updating golang.org/x/crypto from v0.37.0 to v0.47.0, golang.org/x/net
from v0.39.0 to v0.48.0 and golang.org/x/sys from v0.32.0 to v0.40.0
(bsc#1253611, CVE-2025-47913)
* Categorize integration tests by adding new tags to split fast and slow ones
* Fix bug where IP field being empty string and causing UII API failure
- Drop CVE-2025-47913.patch, merged upstream
- Raise minimum Go version to 1.25.8 in BuildRequires
- Update to version 3.3.3598.0
* Allow Patch execution to persist across reboots not registered to SSM Agent
- from version 3.3.3572.0
* Fix ENV_VAR interpolation to work correctly with parameter store value
* Implement immediate retries for failed reply messages to MGS for RunCommand documents
* Improve ssm-cli get-diagnostics command log output
* Support DomainJoin endpoint for EU sovereign cloud
* Support dualstack S3 endpoint for distributor packages
* Upgrade Go version to 1.24.11
- apparmor
-
- Update apparmor-lessopen-profile.patch:
* Allow execution of /usr/bin/zstd (bsc#1265620)
- autofs
-
- Fix setting log priority for all direct mounts (bsc#1264686)
+ autofs-fix-handling-of-direct-mount-path.patch
- bind
-
- Force use of python3.11 since the required minimum version is now
3.10. This is only really relevant for the tests.
[bsc#1263494]
- Upgrade to release 9.20.23
https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
Security-Fixes:
* Amplification vulnerabilities via self-pointed glue records.
(CVE-2026-3592)
[bsc#1265592]
* server memory exhaustion during GSS-API TKEY negotiation.
(CVE-2026-3039)
[bsc#1265591]
* Unbounded resend loop in BIND 9 resolver
(CVE-2026-5950)
[bsc#1265596]
* SIG(0) validation during query flood may lead to undefined
behavior.
(CVE-2026-5947)
[bsc#1265595]
* Invalid handling of CLASS != IN.
(CVE-2026-5946)
[bsc#1265594]
- containerd
-
- Add patch for CVE-2026-34986 (bsc#1262948)
* 0003-CVE-2026-34986-Bump-go-jose-to-v3.0.5.patch
- Add patch for CVE-2026-39821 (bsc#1266640)
* 0004-CVE-2026-39821-idna-update-from-x-text-fix-ToUnicode.patch
- Add patch for CVE-2026-33814 (bsc#1265794)
* 0005-CVE-2026-33814-http2-prevent-hanging-Transport-due-t.patch
- Add patch for CVE-2026-33186 (bsc#1260296):
* 0002-CVE-2026-33186-containerd-google.golang.org-grpc-aut.patch
- coreutils
-
- proc: Use affinity mask even on systems with more than 1024 CPUs (bsc#1259327)
- add coreutils-gnulib-nproc-Use-affinity-mask-even-on-systems-with-more-th.patch
- curl
-
- Call http_size() first to prioritize Transfer-Encoding: chunked over a zero
Content-Length empty body check (bsc#1264971)
* Add patch: curl-http-prefer-chunked-encoding-over-Content-Length-0.patch
- docker
-
- Update to Docker 29.4.0. See upstream changelog online at
<https://docs.docker.com/engine/release-notes/29/#2940>
- Update to buildx 0.33.0. See upstream changelog online at
<https://github.com/docker/buildx/releases/tag/v0.33.0>
- Rebased patches:
* 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
* 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
* 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
* 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
* 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
* 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
* cli-0001-openSUSE-point-users-to-docker-buildx-package.patch
* cli-0002-SECRETS-SUSE-default-to-DOCKER_BUILDKIT-0-for-docker.patch
- Removed patch
* 0007-CVE-2025-58181-fix-vendor-crypto-ssh.patch (applicable only
when docker version < v29.1.0)
- dracut
-
- Update to version 059+suse.568.g200aa75e:
* fix(systemd): explicitly install /bin/bash (bsc#1263940)
- glibc
-
- ungetwc-byte-stream.patch: libio: Fix ungetwc operating on byte stream
(CVE-2026-5928, bsc#1262464, BZ #33998)
- scanf-mc-buffer-overflow.patch: stdio-common: Fix buffer overflow in
scanf %mc (CVE-2026-5450, bsc#1262465, BZ #34008)
- ibm139x-pending-char-state.patch: Use pending character state in
IBM1390, IBM1399 character sets (CVE-2026-4046, bsc#1261206, BZ #33980)
- hwdata
-
- update to 0.406:
* Update pci and vendor ids
- update to 0.405:
* Update pci and vendor ids
- Update to version 0.397:
* Update pci and vendor ids
- Update to version 0.395:
* Update pci and vendor ids
- iproute2
-
- add DPLL support (bsc#1255752 jsc#PED-14083)
* dpll-Add-dpll-command.patch
* dpll-Fix-missing-notifications-in-monitor-mode.patch
* dpll-Send-object-per-event-in-JSON-monitor-mode.patch
* dpll-add-client-side-filtering-for-device-show.patch
* dpll-add-client-side-filtering-for-pin-show.patch
* dpll-add-direction-and-state-filtering-for-pin-show.patch
* dpll-add-mode-setting-support.patch
* dpll-add-pin-filtering-by-parent-device-and-parent-p.patch
* dpll-add-support-for-fractional-frequency-offset-in-.patch
* dpll-fix-pin-id-get-type-filter-parsing.patch
* lib-Add-str_to_bool-helper-function.patch
* lib-Move-mnlg-to-lib-for-shared-use.patch
- refresh
* patches/ss-escape-characters-in-command-name.patch
- update sync-UAPI-header-copies-with-SLE15-SP6.patch and rename
it to sync-UAPI-header-copies-with-SLE15-SP7.patch
- kernel-default
-
- Refresh
patches.suse/team-avoid-NETDEV_CHANGEMTU-event-when-unregistering.patch.
Added missing locking in backport (bsc#1267732).
- commit 4ec6bb0
- scsi: hisi_sas: Fix NULL pointer exception during user_scan()
(CVE-2026-43413, bsc#1264671).
- commit bfe6757
- ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger
(CVE-2026-46157 bsc#1267726).
- commit f38bfb2
- Refresh
patches.suse/team-avoid-NETDEV_CHANGEMTU-event-when-unregistering.patch.
Added missing locking in backport (bsc#1267732).
- commit a8766b2
- Bluetooth: hci_conn: fix potential UAF in create_big_sync
(CVE-2026-46111 bsc#1267626).
- commit 7777a50
- nfsd: never defer requests during idmap lookup (CVE-2026-45983
bsc#1266697).
- Delete
patches.suse/nfsd-do-not-defer-requests-during-idmap-lookup-in-v4-compo.patch.
- commit 664a09a
- drm/gem: Fix inconsistent plane dimension calculation in
drm_gem_fb_init_with_funcs() (CVE-2026-46209 bsc#1267663).
- commit 2c841fc
- libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (CVE-2026-46024 bsc#1267218).
- commit e967a8f
- libceph: prevent potential out-of-bounds reads in process_message_header() (CVE-2026-43406 bsc#1265073).
- commit 79f8547
- rbd: fix null-ptr-deref when device_add_disk() fails (CVE-2026-46079 bsc#1266452).
- commit 82a7e5e
- ocfs2: handle invalid dinode in ocfs2_group_extend (CVE-2026-31596 bsc#1263319).
- commit d319998
- libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (CVE-2026-43407 bsc#1265020).
- commit d87fc06
- nfs: return EISDIR on nfs3_proc_create if d_alias is a dir
(CVE-2026-43470 bsc#1265128).
- commit 9fc75a8
- cgroup: Increment nr_dying_subsys_* from rmdir context
(git-fixes).
- Refresh patches.kabi/kabi-cgroup.stat-fixup.patch.
- commit f87663c
- af_unix: read UNIX_DIAG_VFS data under unix_state_lock
(CVE-2026-31673 bsc#1263143).
- Refresh patches.suse/vfs-add-super_operations-get_inode_dev.
- commit 00e1878
- ALSA: aloop: Fix peer runtime UAF during format-change stop
(CVE-2026-46090 bsc#1267531).
- ALSA: aloop: Use guard() for spin locks (CVE-2026-46090
bsc#1267531).
- ALSA: aloop: Fix peer runtime UAF during format-change stop
(CVE-2026-46090 bsc#1267531).
- ALSA: aloop: Use guard() for spin locks (CVE-2026-46090
bsc#1267531).
- commit d19a9e2
- drm/amdkfd: Fix watch_id bounds checking in debug address
watch v2 (CVE-2026-45878 bsc#1266767).
- commit aa9368a
- arm64: Add support for TSV110 Spectre-BHB mitigation (bsc#1264430 CVE-2026-43261)
- commit ba98a63
- perf/arm-cmn: Reject unsupported hardware configurations (bsc#1264415 CVE-2026-43150)
- commit 5c62ef4
- perf/arm-cmn: Ensure dtm_idx is big enough (bsc#1264415 CVE-2026-43150)
- commit bd77733
- ALSA: seq: dummy: fix UMP event stack overread (git-fixes).
- drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups
(git-fixes).
- accel/ivpu: Add buffer overflow check in MS get_info_ioctl
(git-fixes).
- drm/xe: Clear pending_disable before signaling suspend fence
(git-fixes).
- drm/amd/display: Bound VBIOS record-chain walk loops
(git-fixes).
- commit 3c0f3d3
- Input: atkbd - skip deactivate for HONOR BCC-N's internal
keyboard (git-fixes).
- ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain()
on linked streams (git-fixes).
- drm/imx: Fix three kernel-doc warnings in dcss-scaler.c
(git-fixes).
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore
on GFX11 (git-fixes).
- drm/amdkfd: fix NULL dereference in get_queue_ids() (git-fixes).
- drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
(git-fixes).
- drm/amd/display: Reject gpio_bitshift >= 32 in
bios_parser_get_gpio_pin_info() (git-fixes).
- drm/amd/display: Use krealloc_array() in dal_vector_reserve()
(git-fixes).
- drm/amd/display: Fix NULL deref and buffer over-read in SDP
debugfs (git-fixes).
- commit 276cfd7
- scsi: imm: Fix use-after-free bug caused by unfinished delayed
work (CVE-2025-68324 bsc#1255416).
- commit 195217b
- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (CVE-2026-43026 bsc#1263932).
- commit 059378b
- xfs: stop reclaim before pushing AIL during unmount
(CVE-2026-31455 bsc#1262615).
- commit e53a301
- xfs: save ailp before dropping the AIL lock in push callbacks
(CVE-2026-31454 bsc#1262624).
- commit 7159c4e
- packaging: Add nvidia kernel description
- commit 5f2699f
- pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724 CVE-2026-31655)
- commit 9295a19
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg
(CVE-2026-45886 bsc#1266810).
- commit 20a9956
- bpf: Fix regsafe() for pointers to packet (CVE-2026-43030
bsc#1264000).
- commit 8f3e36e
- bpf: Fix tcx/netkit detach permissions when prog fd isn't given
(CVE-2026-45932 bsc#1266827).
- commit b648f57
- spi: fix resource leaks on device setup failure (bsc#1266696 CVE-2026-46083)
- commit 742a92d
- thermal: core: Free thermal zone ID later during removal
(git-fixes).
- commit cd70ed5
- Bluetooth: MGMT: Fix backward compatibility with userspace
(git-fixes).
- Bluetooth: bnep: reject short frames before parsing (git-fixes).
- Bluetooth: hci_sync: reject oversized Broadcast Announcement
prepend (git-fixes).
- Bluetooth: RFCOMM: validate skb length in MCC handlers
(git-fixes).
- Bluetooth: MGMT: validate advertising TLV before type checks
(git-fixes).
- Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
(git-fixes).
- wifi: mac80211: limit injected antenna index in
ieee80211_parse_tx_radiotap (git-fixes).
- wifi: nl80211: reject oversized EMA RNR lists (git-fixes).
- mmc: sdhci: add signal voltage switch in sdhci_resume_host
(git-fixes).
- mmc: litex_mmc: Set mandatory idle clocks before CMD0
(git-fixes).
- mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock
calculation (git-fixes).
- mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC (git-fixes).
- mmc: core: Fix host controller programming for fixed driver type
(git-fixes).
- commit 1ef939b
- btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which
can lead to info-leak (bsc#1267652,CVE-2026-46159).
- commit 56f6424
- kabi: arm64: module: Update missing .init.text.ftrace_trampoline section message (bsc#1265579 bsc#1265170)
Message was supposed to give us a hint that these KMP's
will have issue when user try to ftrace them. But it turns out
to be just source confusion and worry.
- commit 2983ae5
- gfs2: Fix use-after-free in iomap inline data write path
(CVE-2026-45984 bsc#1267214).
- gfs2: Add metapath_dibh helper (CVE-2026-45984 bsc#1267214).
- commit 7f4705a
- mctp: route: hold key->lock in mctp_flow_prepare_output()
(CVE-2026-43455 bsc#1264765).
- net: mctp: Ensure keys maintain only one ref to corresponding
dev (CVE-2026-43455 bsc#1264765).
- commit 7c8d579
- io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs()
(CVE-2026-31774 bsc#1264040).
- commit 449403d
- rpm/mkspec: Conditionally set Rust BuildReqs (bsc#1258538)
This is a further optimization of kernel packaging rust-enablement.
Add the check of CONFIG_RUST at creating the spec for each kernel
flavor, and set BuildRequires conditionally only for archs that have
CONFIG_RUST. This avoids the unnecessary dependency chains due to
unused rust.
The main knob ENABLE_RUST is still needed because otherwise we can't
know whether to pass the dummy-tools or not at processing
run_oldconfig.
- commit ccf4b93
- rpm/check-for-config-changes: ignore Rust-related configs (bsc#1258538)
Those configs may be dynamically changed at the build time
- commit 5251980
- rpm: Add BuildRequires for Rust enablement (bsc#1258538)
Update mkspec and template to generate the spec files with
BuildRequires of Rust-related packages when ENABLE_RUST=Yes is set in
rpm/config.sh.
- commit d0f276f
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down
(CVE-2026-45970 bsc#1267205).
- commit c7c508f
- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()
(CVE-2026-46181 bsc#1266826).
- commit 971667c
- x86: shadow stacks: proper error handling for mmap lock (bsc#1264484 CVE-2026-43109).
- commit fbd32de
- ALSA: caiaq: Don't abort when no input device is available
(CVE-2026-46004 bsc#1267222).
- ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path
(CVE-2026-46004 bsc#1267222).
- commit a3abbee
- ALSA: caiaq: Handle probe errors properly (CVE-2026-46004
bsc#1267222).
- commit c42211b
- thermal: core: Fix thermal zone governor cleanup issues
(CVE-2026-46021 bsc#1267220).
- commit 5b274e1
- Bluetooth: MGMT: Fix list corruption and UAF in command complete
handlers (CVE-2026-43059 bsc#1264184).
- commit 58f5225
- Bluetooth: MGMT: fix crash in set_mesh_sync and
set_mesh_complete (CVE-2026-43059 bsc#1264184).
- Refresh patches.kabi/hci_dev-centralize-extra-lock.patch.
- commit 59594e6
- scsi: qla2xxx: Add support to report MPI FW state (git-fixes).
- dm: fix a buffer overflow in ioctl processing (git-fixes).
- scsi: ses: Handle positive SCSI error from ses_recv_diag()
(git-fixes).
- commit a7edf1f
- slip: reject VJ receive packets on instances with no rstate array (CVE-2026-45842 bsc#1266400)
- commit 9c6954f
- media: dvb-net: fix OOB access in ULE extension header tables (CVE-2026-31405 bsc#1261700)
- commit 0115edd
- usb: usbtmc: Flush anchored URBs in usbtmc_release (CVE-2026-31758 bsc#1264093)
- commit 862c169
- xfrm_user: fix info leak in build_report() (CVE-2026-31671 bsc#1263115)
- commit e993b23
- bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (CVE-2026-45846 bsc#1266394)
- commit 8489b03
- KVM: x86: Fix shadow paging use-after-free due to unexpected
GFN (CVE-2026-46113 bsc#1266969).
- commit 492a8ff
- net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak (CVE-2026-43040 bsc#1264091)
- commit afb5ee9
- nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston
OM3SGP4 (git-fixes).
- commit f7aa00d
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (CVE-2025-38549 bsc#1248235).
- commit 07594aa
- ext4: fix bounds check in check_xattrs() to prevent
out-of-bounds access (bsc#1266927 CVE-2026-46094).
- commit 7627409
- writeback: Fix use after free in inode_switch_wbs_work_fn()
(bsc#1263883 CVE-2026-31703).
- commit afdb742
- ext4: avoid allocate block from corrupted group in
ext4_mb_find_by_goal() (bsc#1264255 CVE-2026-43068).
- commit 3900419
- ext4: avoid infinite loops caused by residual data (bsc#1262622
CVE-2026-31448).
- commit 23a715f
- ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths
(bsc#1264245 CVE-2026-43066).
- commit 283732e
- ext4: always drain queued discard work in ext4_mb_release()
(bsc#1264243 CVE-2026-43065).
- commit 01e5eec
- ext4: fix use-after-free in update_super_work when racing with
umount (bsc#1262619 CVE-2026-31446).
- commit 2d5d4dc
- arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes)
- commit 0883f58
- arm64: tlb: Allow XZR argument to TLBI ops (git-fixes)
- commit a27017d
- drm/amdgpu/vpe: Force collaborate sync after TRAP
(stable-fixes).
- commit 2f6a9ab
- Bluetooth: serialize accept_q access (git-fixes).
- Refresh
patches.suse/Bluetooth-fix-UAF-in-l2cap_sock_cleanup_listen-vs-l2.patch.
- commit e766bd7
- RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (CVE-2026-46114 bsc#1266972)
- commit 76ec1c1
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856 bsc#1266720)
- commit c95a10d
- auxdisplay: line-display: fix OOB read on zero-length
message_store() (git-fixes).
- security/keys: fix missed RCU read section on lookup
(stable-fixes).
- drm/amd/display: Validate payload length and link_index in
dc_process_dmub_aux_transfer_async (stable-fixes).
- drm/amd/display: Validate GPIO pin LUT table size before
iterating (stable-fixes).
- drm/amd/display: Fix integer overflow in bios_get_image()
(stable-fixes).
- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL
register access (git-fixes).
- spi: ti-qspi: fix use-after-free after DMA setup failure
(git-fixes).
- spi: sprd: fix error pointer deref after DMA setup failure
(git-fixes).
- spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()
(git-fixes).
- ALSA: asihpi: Fix potential OOB array access at reading cache
(stable-fixes).
- net: wwan: iosm: fix potential memory leaks in ipc_imem_init()
(git-fixes).
- drivers/base/memory: fix memory block reference leak in poison
accounting (git-fixes).
- HID: quirks: really enable the intended work around for
appledisplay (git-fixes).
- HID: uclogic: Fix regression of input name assignment
(git-fixes).
- string: add mem_is_zero() helper to check if memory area is
all zeros (stable-fixes).
- commit 55d2e55
- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CVE-2026-46176 bsc#1266816)
- commit f587e2a
- net: mana: Expose hardware diagnostic info via debugfs (bsc#1266414).
- net: mana: Use kvmalloc for large RX queue and buffer allocations (bsc#1266765).
- net: mana: Use per-queue allocation for tx_qp to reduce allocation size (bsc#1266765).
- net: mana: hardening: Reject zero max_num_queues from GDMA_QUERY_MAX_RESOURCES (git-fixes).
- drm/hyperv: validate VMBus packet size in receive callback (git-fixes).
- drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes).
- net: mana: Skip redundant detach on already-detached port (git-fixes).
- net: mana: Add NULL guards in teardown path to prevent panic on attach failure (git-fixes).
- RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port (git-fixes).
- net: mana: validate rx_req_idx to prevent out-of-bounds array access (bsc#1266402).
- net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (bsc#1265928).
- commit 81225ae
- net: mvpp2: guard flow control update with global_tx_fc in buffer switching (CVE-2026-23438 bsc#1261619)
- commit c2bc3dd
- net: bonding: fix NULL deref in bond_debug_rlb_hash_show (CVE-2026-31546 bsc#1263006)
- commit ec64778
- 9p/xen: protect xen_9pfs_front_free against concurrent calls
(bsc#1264476 CVE-2026-43249).
- commit efe84aa
- net: macb: fix use-after-free access to PTP clock (CVE-2026-31396 bsc#1261791)
- commit a390b05
- sched/rt: Skip currently executing CPU in rto_next_cpu()
(bsc#1262649).
- commit 239586c
- RDMA/rxe: Fix race condition in QP timer handlers (CVE-2026-45910 bsc#1266889)
- commit d80968b
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CVE-2026-45898 bsc#1266888)
- commit 683ea89
- RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852 bsc#1266711)
- commit 16dd3c8
- cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() (CVE-2026-23327 bsc#1260548)
- commit 27dbf08
- nfc: llcp: add missing return after LLCP_CLOSED checks (CVE-2026-31629 bsc#1263790)
- commit db86873
- smb: client: Don't log plaintext credentials in cifs_set_cifscreds (CVE-2026-23303 bsc#1260502)
- commit 53c0ff0
- kabi fix after rtmutex_api: provide correct extern functions
(bsc#1263122 CVE-2026-31591).
- commit 8c82223
- team: avoid NETDEV_CHANGEMTU event when unregistering slave
(CVE-2026-43234 bsc#1264409).
- commit 6b7c409
- tipc: fix divide-by-zero in tipc_sk_filter_connect() (CVE-2026-43411 bsc#1264672)
- commit 32611e5
- net: stmmac: Prevent NULL deref when RX memory exhausted
(CVE-2026-46110 bsc#1266759).
- net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY()
(CVE-2026-46110 bsc#1266759).
- net/mlx5: lag: Check for LAG device before creating debugfs
(CVE-2026-43013 bsc#1264011).
- commit b15f093
- RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043 bsc#1266901)
- commit 909d78b
- esp: fix skb leak with espintcp and async crypto (CVE-2026-31518 bsc#1262606)
- commit f42cbf9
- packaging: Replace compute-PATCHVERSION with python implementation
This script is copied by kkspec to the package directory and called from
there. That means that libraries from kernel-source cannot be loaded,
and that's the reason why the script is appended to the library that is
most useful for it. compute-PATCHVERSION and mkspec are no longer
shipped in rpm packages which means compute-PATCHVERSION could be folded
into mkspec, and that in turn into tar-up. However, these are all
written in different languages.
- commit de458e0
- kabi: arm: io: Export ioremap_prot() symbol v2 (CVE-2026-23346 bsc#1260529 bsc#1266993)
First version of this kABI fix missed that ioremap_prot() now
accept only user-space mappings which breaks any out of tree
KMP's which used the function for legitimate kernel IO mappings.
Lets fix this by allowing kernel mappings and at same time
properly handle user-space mappings
[1] 9625623795d3 ("kabi: arm: io: Export ioremap_prot() symbol (CVE-2026-23346 bsc#1260529)")
- commit 223d255
- btrfs: reserve enough transaction items for qgroup ioctls
(CVE-2026-43338 bsc#1264716).
- commit 9eef1bf
- rtmutex_api: provide correct extern functions (bsc#1263122
CVE-2026-31591).
- commit fa571c2
- btrfs: fix transaction abort on set received ioctl due to item
overflow (CVE-2026-43359 bsc#1264719).
- commit 847b693
- kABI fix after locking/mutex: implement
mutex_lock_killable_nest_lock (bsc#1263122 CVE-2026-31591).
- commit f2aebfb
- Input: ims-pcu - fix usb_free_coherent() size in
ims_pcu_buffers_free() (git-fixes).
- Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
(git-fixes).
- Input: xpad - fix out-of-bounds access for Share button
(git-fixes).
- Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB
buffer size (git-fixes).
- commit f75d3d9
- usb: typec: tcpm: improve handling of DISCOVER_MODES failures
(git-fixes).
- commit 9d7793b
- USB: serial: cypress_m8: validate interrupt packet headers
(git-fixes).
- USB: serial: safe_serial: fix memory corruption with small
endpoint (git-fixes).
- USB: serial: omninet: fix memory corruption with small endpoint
(git-fixes).
- USB: serial: mxuport: fix memory corruption with small endpoint
(git-fixes).
- USB: serial: option: add missing RSVD(5) flag for Rolling
RW135R-GL (git-fixes).
- USB: serial: mct_u232: fix missing interrupt-in transfer sanity
check (git-fixes).
- USB: serial: keyspan: fix missing indat transfer sanity check
(git-fixes).
- USB: serial: belkin_sa: validate interrupt status length
(git-fixes).
- USB: cdc-acm: Fix bit overlap and move quirk definitions to
header (git-fixes).
- usb: dwc2: Fix use after free in debug code (git-fixes).
- usb: chipidea: core: convert ci_role_switch to local variable
(git-fixes).
- usb: gadget: f_fs: copy only received bytes on short ep0 read
(git-fixes).
- usb: gadget: dummy_hcd: Reject hub port requests for
non-existent ports (git-fixes).
- usbip: vudc: Fix use after free bug in vudc_remove due to race
condition (git-fixes).
- usb: usbtmc: reject interrupt endpoints with small
wMaxPacketSize (git-fixes).
- usb: usbtmc: check URB actual_length for interrupt-IN
notifications (git-fixes).
- usb: gadget: net2280: Fix double free in probe error path
(git-fixes).
- usb: gadget: f_hid: fix device reference leak in hidg_alloc()
(git-fixes).
- usb: cdns3: gadget: fix request skipping after clearing halt
(git-fixes).
- usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call
permanently leaks the runtime PM usage counter across
bind/unbind cycles (git-fixes).
- usb: gadget: composite: fix integer underflow in WebUSB GET_URL
handling (git-fixes).
- tty: serial: pch_uart: add check for dma_alloc_coherent()
(git-fixes).
- commit 2bf3f1e
- thunderbolt: property: Reject dir_len < 4 to prevent size_t
underflow (git-fixes).
- thunderbolt: property: Reject u32 wrap in
tb_property_entry_valid() (git-fixes).
- serial: fsl_lpuart: fix rx buffer and DMA map leaks in
start_rx_dma (git-fixes).
- serial: qcom-geni: fix UART_RX_PAR_EN bit position (git-fixes).
- parport: Fix race between port and client registration
(git-fixes).
- comedi: comedi_test: fix check for valid scan_begin_src in
waveform_ai_cmdtest() (git-fixes).
- comedi: comedi_test: Fix limiting of convert_arg in
waveform_ai_cmdtest() (git-fixes).
- iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
(git-fixes).
- iio: gyro: itg3200: fix i2c read into the wrong stack location
(git-fixes).
- iio: dac: ad5686: acquire lock when doing powerdown control
(git-fixes).
- iio: temperature: tsys01: fix broken PROM checksum validation
(git-fixes).
- iio: buffer: hw-consumer: fix use-after-free in error path
(git-fixes).
- iio: dac: ad5686: fix input raw value check (git-fixes).
- iio: ssp_sensors: cancel delayed work_refresh on remove
(git-fixes).
- iio: dac: max5821: fix return value check in powerdown sync
(git-fixes).
- iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
(git-fixes).
- iio: light: cm3323: fix reg_conf not being initialized correctly
(git-fixes).
- iio: magnetometer: st_magn: fix default DRDY pin selection
for LIS2MDL (git-fixes).
- iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for
dual mux (git-fixes).
- drm/hyperv: validate VMBus packet size in receive callback
(git-fixes).
- drm/hyperv: validate resolution_count and fix WIN8 fallback
(git-fixes).
- drm/amd/pm/si: Disregard vblank time when no displays are
connected (git-fixes).
- drm/i915: Fix potential UAF in TTM object purge (git-fixes).
- commit 129155c
- Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
(git-fixes).
- ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
(git-fixes).
- ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware
2417 (git-fixes).
- ALSA: pcm: oss: Fix setup list UAF on proc write error
(git-fixes).
- commit 42ae3f2
- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device
close (git-fixes).
- Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
(git-fixes).
- Bluetooth: ISO: fix UAF in iso_recv_frame (git-fixes).
- Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
(git-fixes).
- Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration
success (git-fixes).
- Bluetooth: 6lowpan: check skb_clone() return value in
send_mcast_pkt() (git-fixes).
- Bluetooth: btusb: Allow firmware re-download when version
matches (git-fixes).
- Bluetooth: HIDP: fix missing length checks in
hidp_input_report() (git-fixes).
- Bluetooth: L2CAP: use chan timer to close channels in
cleanup_listen() (git-fixes).
- Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout()
on !conn (git-fixes).
- ASoC: codecs: simple-mux: Fix enum control bounds check
(git-fixes).
- ASoC: qcom: q6asm-dai: fix error handling in prepare and
set_params (git-fixes).
- ASoC: qcom: q6asm-dai: close stream only when running
(git-fixes).
- ASoC: qcom: q6asm-dai: do not set stream state in event and
trigger callbacks (git-fixes).
- HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
(git-fixes).
- commit 5cccd97
- btrfs: fix transaction abort when snapshotting received
subvolumes (CVE-2026-43361 bsc#1264722).
- commit 68eb967
- btrfs: fix transaction abort on file creation due to name hash
collision (CVE-2026-43360 bsc#1264720).
- commit 335b528
- locking/mutex: implement mutex_trylock_nested (bsc#1263122
CVE-2026-31591).
- commit f61110c
- wifi: iwlwifi: mvm: don't send a 6E related command when not
supported (CVE-2026-43325 bsc#1265110).
- commit 3c8b5bc
- locking/mutex: implement mutex_lock_killable_nest_lock
(bsc#1263122 CVE-2026-31591).
- commit c8f7fd9
- Delete patches.suse/wifi-mac80211-Remove-generic-.ndo_get_stats64.patch (bsc#1266036)
The patch slipped in the backport series although the assumption there
isn't applied to SLE15-SP7 kernel base, which resulted in the bogus wifi
statistics. Drop the patch to fix it.
- commit 18311a2
- KVM: add kvm_lock_all_vcpus and kvm_trylock_all_vcpus
(bsc#1263122 CVE-2026-31591).
- commit d85a03e
- smb: client: reject userspace cifs.spnego descriptions
(bsc#1266238).
- commit b2ca6ab
- KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch
finish (bsc#1263122 CVE-2026-31591).
- commit f3989e6
- drm/i915/dsi: Don't do DSC horizontal timing adjustments in
command mode (CVE-2026-31767 bsc#1264124).
- commit f45f094
- KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with
in-kernel APIC (git-fixes).
- commit 671dbfb
- KVM: X86: Fix array_index_nospec protection in __pv_send_ipi
(git-fixes).
- commit ef45aed
- Refresh patches.suse/selftests-bpf-Add-more-precision-tracking-tests-for-.patch. (CVE-2026-43009 bsc#1264014)
- commit 1de8df8
- selftests/bpf: add test for nullable PTR_TO_BUF access
(CVE-2026-43333 bsc#1264726).
- commit 9b6669a
- bpf: reject direct access to nullable PTR_TO_BUF pointers
(CVE-2026-43333 bsc#1264726).
- commit 8b12683
- xfrm: prevent policy_hthresh.work from racing with netns
teardown (CVE-2026-31516 bsc#1262755).
- commit 5ec6779
- mptcp: pm: in-kernel: always set ID as avail when rm endp
(CVE-2026-43252 bsc#1264300).
- commit f1372d7
- net/ipv6: ioam6: prevent schema length wraparound in trace fill
(CVE-2026-43341 bsc#1265044).
- commit 26ee766
- slip: bound decode() reads against the compressed packet length
(CVE-2026-45843 bsc#1266395).
- commit c9770c0
- s390/entry: Scrub r12 register on kernel entry (bsc#1263068).
- s390/syscalls: Add spectre boundary for syscall dispatch table
(bsc#1263068).
- s390/barrier: Make array_index_mask_nospec() __always_inline
(bsc#1263068).
- commit f6cfac6
- s390/entry: Scrub r12 register on kernel entry (bsc#1261591).
- s390/syscalls: Add spectre boundary for syscall dispatch table
(bsc#1261591).
- s390/barrier: Make array_index_mask_nospec() __always_inline
(bsc#1261591).
- s390/mm: Add missing secure storage access fixups for donated
memory (bsc#1264835).
- commit ade4cd0
- tracing: Fix potential deadlock in cpu hotplug with osnoise
(CVE-2026-31480 bsc#1262634).
- tracing: Switch trace_osnoise.c code over to use guard()
and __free() (bsc#1262634).
- commit 6db35fe
- bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584
CVE-2026-23359).
- commit 0fb7dc1
- wifi: mac80211: always free skb on ieee80211_tx_prepare_skb()
failure (CVE-2026-23444 bsc#1266307).
- commit a948d1e
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()
(CVE-2026-43206 bsc#1264551).
- commit 7f880f2
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky
(CVE-2026-43296 bsc#1264805).
- commit f336a2d
- bcache: fix uninitialized closure object (git-fixes).
- commit d35dc31
- bcache: fix cached_dev.sb_bio use-after-free and crash
(CVE-2026-3150 bsc#1263169).
- scsi: target: tcm_loop: Drain commands in target_reset handler
(CVE-2026-43054 bsc#1264063).
- scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()
(CVE-2026-31464 bsc#1262656).
- scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414
bsc#1264669).
- commit b1bc3f3
- rtmutex: Use waiter::task instead of current in remove_waiter()
(bsc#1266001 CVE-2026-43499).
- commit f92fa24
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
(CVE-2026-43501 bsc#1266009).
- commit d86aabe
- ip6_tunnel: clear skb2->cb in ip4ip6_err() (CVE-2026-43037
bsc#1263995).
- commit 60e0626
- Improve compatibility with awk 2.4.0 (bsc#1266214)
This was meant to match the literal '+', so it needs to be backslashed
not a repetition of the '^' symbol.
- commit fbbce3e
- media: mc, v4l2: serialize REINIT and REQBUFS with
req_queue_mutex (CVE-2026-31473 bsc#1262663).
- commit 3f03cf7
- Update
patches.suse/net-skbuff-propagate-shared-frag-marker-through-frag-trans.patch
(CVE-2026-43503 bsc#1265960 CVE-2026-43284 bsc#1264449).
- Update
patches.suse/xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch
(CVE-2026-43284 bsc#1264449).
Add references and move to the sorted section.
- commit 83a3405
- RDMA/efa: Fix possible deadlock (git-fixes)
- commit b9b2bbf
- RDMA/efa: Fix use of completion ctx after free (CVE-2026-31493 bsc#1262668)
- commit 3fa0669
- RDMA/efa: Improve admin completion context state machine (git-fixes)
- commit 8e8c981
- RDMA/efa: Extend admin timeout error print (git-fixes)
- commit 4d9f061
- RDMA/efa: Check stored completion CTX command ID with received one (git-fixes)
- commit f0e6a90
- wifi: mac80211: check tdls flag in ieee80211_tdls_oper
(CVE-2026-43052 bsc#1263945).
- commit e6ee8c1
- KVM: SEV: Drop WARN on large size for
KVM_MEMORY_ENCRYPT_REG_REGION (CVE-2026-31590 bsc#1263152).
- commit 4957e7f
- openvswitch: vport: fix self-deadlock on release of tunnel ports
(CVE-2026-31678 bsc#1263562).
- commit 7eb6b28
- KVM: SVM: Set/clear CR8 write interception when AVIC is
(de)activated (CVE-2026-43483 bsc#1265240).
- commit de0bf57
- smb: client: fix in-place encryption corruption in SMB2_write()
(bsc#1264989 CVE-2026-43362)
- commit 2633e79
- compute-PATCHVERSION: Do not append .. to default patch directories
All the callers are either using . or a specific patch directory.
If a caller really needs to load patches from .. it should be passed as
parameter.
- commit d383394
- compute-PATCHVERSION: Remove unpack logic
This used to be needed when compute-PATCHVERSION was shipped as part of
the rpm package where unpacked patches are not available.
It is not done annymore, and the unpackinng is not needed.
- commit 9a8fa0e
- openvswitch: defer tunnel netdev_put to RCU release
(CVE-2026-31678 bsc#1263562).
- commit c40a933
- KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested
[#]VMEXIT (git-fixes).
- commit ec599f4
- KVM: x86: Fix Xen hypercall tracepoint argument assignment
(git-fixes).
- commit bee29ed
- packaging: Rip out extra symbols support
Extra symbols are not supported for a long time.
The oldest branch we maintain is SLE 11 SP1 and it does not use patch
guards to select patches.
- commit 7b3d5b0
- drm/amdgpu: update the handle ptr in early_init (stable-fixes).
- Refresh
patches.suse/drm-amdgpu-mes11-implement-detect-and-reset-callback.patch.
- Refresh
patches.suse/drm-amdgpu-mes12-implement-detect-and-reset-callback.patch.
- commit c261344
- drm/xe/oa: Fix exec_queue leak on width check in stream open
(git-fixes).
- drm/xe: Define CACHE_MODE_1 as MCR register (git-fixes).
- drm/xe/pf: Fix CFI failure in debugfs access (git-fixes).
- drm/xe/vf: Fix signature of print functions (git-fixes).
- drm/xe/gsc: Fix double-free of managed BO in error path
(git-fixes).
- drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP
(git-fixes).
- ALSA: seq: Serialize UMP output teardown with event_input
(git-fixes).
- ALSA: seq: avoid past-the-end iterator in snd_seq_create_port()
(git-fixes).
- ALSA: timer: avoid past-the-end iterator in
snd_timer_dev_register() (git-fixes).
- ALSA: pcm: Don't setup bogus iov_iter for silencing (git-fixes).
- Bluetooth: btmtk: fix urb->setup_packet leak in error paths
(git-fixes).
- Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not
stack pointer (git-fixes).
- drm/amdgpu/uvd4.2: Don't initialize UVD 4.2 when DPM is disabled
(git-fixes).
- ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver
(git-fixes).
- ACPI: x86: cmos_rtc: Clean up address space handler driver
(stable-fixes).
- soundwire: debugfs: initialize firmware_file to empty string
(git-fixes).
- drm/amdgpu: update the handle ptr in dump_ip_state
(stable-fixes).
- drm/amdgpu: add amdgpu_device reference in ip block
(stable-fixes).
- commit 8df2a77
- batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).
- commit f65d5f2
- hwmon: (pmbus/adm1266) register the nvmem device after
pmbus_do_probe() (git-fixes).
- hwmon: (pmbus/adm1266) register the gpio_chip after
pmbus_do_probe() (git-fixes).
- hwmon: (pmbus/adm1266) reject short block-read responses in
the GPIO accessors (git-fixes).
- hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO
read in get_multiple (git-fixes).
- hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at
ADM1266_PDIO_NR (git-fixes).
- hwmon: (pmbus/adm1266) bounce blackbox records through a
protocol-sized buffer (git-fixes).
- hwmon: (pmbus/adm1266) include adapter number in GPIO line label
(git-fixes).
- hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer
read buffer (git-fixes).
- hwmon: (pmbus/adm1266) reject implausible blackbox record_count
(git-fixes).
- hwmon: (pmbus/adm1266) widen blackbox-info buffer to
I2C_SMBUS_BLOCK_MAX (git-fixes).
- hwmon: (pmbus/adm1266) seed timestamp from the real-time clock
(git-fixes).
- drm/virtio: use uninterruptible resv lock for plane updates
(git-fixes).
- drm/bridge: megachips: remove bridge when irq request fails
(git-fixes).
- drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c
probe (git-fixes).
- drm/bridge: it66121: acquire reset GPIO in probe (git-fixes).
- drm/radeon/evergreen_cs: Add missing NULL prefix check in
surface check (git-fixes).
- drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets
(git-fixes).
- drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets
(git-fixes).
- drm/msm/snapshot: fix dumping of the unaligned regions
(git-fixes).
- drm/msm/dsi: don't dump registers past the mapped region
(git-fixes).
- platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL
(git-fixes).
- platform/x86: intel-hid: Check ACPI_HANDLE() against NULL
(git-fixes).
- platform/x86: hp_accel: Check ACPI_COMPANION() against NULL
(git-fixes).
- platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL
(git-fixes).
- wifi: ath11k: clear shared SRNG pointer state on restart
(git-fixes).
- wifi: ath11k: fix use after free in ath11k_dp_rx_msdu_coalesce()
(git-fixes).
- wifi: ath11k: fix peer resolution on rx path when peer_id=0
(git-fixes).
- wifi: ath10k: skip WMI and beacon transmission when device is
wedged (git-fixes).
- wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm()
(git-fixes).
- wifi: ath11k: fix error path leaks in some WMI calls
(git-fixes).
- wifi: ath11k: fix error path leaks in some WMI WOW calls
(git-fixes).
- wifi: mac80211: consume only present negotiated TTLM maps
(git-fixes).
- wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
(git-fixes).
- efi: Allocate runtime workqueue before ACPI init (git-fixes).
- firmware: arm_ffa: Skip free_pages on RX buffer alloc failure
(git-fixes).
- firmware: arm_ffa: Check for NULL FF-A ID table while driver
registration (git-fixes).
- drm/amdgpu/uvd3.1: Don't validate the firmware when already
validated (git-fixes).
- r8152: fix incorrect register write to USB_UPHY_XTAL
(git-fixes).
- drm/amdgpu: fix spelling typos (stable-fixes).
- drm/i915: Loop over all active pipes in intel_mbus_dbox_update
(stable-fixes).
- spi: st-ssc4: switch to use modern name (stable-fixes).
- commit 8b80180
- device property: set fwnode->secondary to NULL in fwnode_init()
(git-fixes).
- ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()
(git-fixes).
- ALSA: ua101: Reject too-short USB descriptors (git-fixes).
- batman-adv: bla: fix report_work leak on backbone_gw purge
(git-fixes).
- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs
l2cap_conn_del() (git-fixes).
- Bluetooth: hci_uart: fix UAFs and race conditions in close
and init paths (git-fixes).
- Bluetooth: MGMT: validate Add Extended Advertising Data length
(git-fixes).
- Bluetooth: ISO: drop ISO_END frames received without prior
ISO_START (git-fixes).
- Bluetooth: bnep: Fix UAF read of dev->name (git-fixes).
- batman-adv: frag: disallow unicast fragment in fragment
(git-fixes).
- batman-adv: tp_meter: avoid use of uninit sender vars
(git-fixes).
- batman-adv: dat: handle forward allocation error (git-fixes).
- batman-adv: clear current gateway during teardown (git-fixes).
- batman-adv: fix fragment reassembly length accounting
(git-fixes).
- batman-adv: tt: fix negative last_changeset_len (git-fixes).
- batman-adv: tt: fix negative tt_buff_len (git-fixes).
- batman-adv: fix tp_meter counter underflow during shutdown
(git-fixes).
- ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans
(git-fixes).
- ALSA: usb-audio: Bound MIDI endpoint descriptor scans
(git-fixes).
- ALSA: sc6000: Keep the programmed board state in card-private
data (git-fixes).
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference
(stable-fixes).
- ALSA: hda/conexant: Renaming the codec with device ID 0x1f86
and 0x1f87 (stable-fixes).
- ALSA: sc6000: Use standard print API (stable-fixes).
- drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update()
(stable-fixes).
- ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond
HDAudio (stable-fixes).
- ASoC: SOF: Intel: hda-dai: remove dspless special case
(stable-fixes).
- commit b214d9a
- gve: Enable reading max ring size from the device in DQO-QPL
mode (bsc#1265925).
- gve: Update QPL page registration logic (bsc#1265925).
- gve: add XDP DROP and PASS support for DQ (bsc#1265925).
- gve: update XDP allocation path support RX buffer posting
(bsc#1265925).
- gve: merge packet buffer size fields (bsc#1265925).
- gve: update GQ RX to use buf_size (bsc#1265925).
- gve: introduce config-based allocation for XDP (bsc#1265925).
- gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics
(bsc#1265925).
- gve: Add RSS cache for non RSS device option scenario
(bsc#1265925).
- gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup
(bsc#1265925).
- gve: process XSK TX descriptors as part of RX NAPI
(bsc#1265925).
- commit a95e7b7
- Fix the wrong kabi patch order at merging from SLE15-SP6-LTSS
No functional changes
- commit edd353b
- net: gro: don't merge zcopy skbs (git-fixes).
- net: skbuff: propagate shared-frag marker through frag-transfer
helpers (CVE-2026-43503 bsc#1265960).
- net: skbuff: preserve shared-frag marker during coalescing
(CVE-2026-46300 bsc#1265209).
- net: gro: don't merge zcopy skbs (git-fixes).
- net: skbuff: propagate shared-frag marker through frag-transfer
helpers (CVE-2026-43503 bsc#1265960).
- net: skbuff: preserve shared-frag marker during coalescing
(CVE-2026-46300 bsc#1265209).
- commit 17348bf
- Revert "net: skbuff: propagate shared-frag marker through pskb_copy()"
This reverts commit 7d64bf1e8cbaf1eb308d2e84a0475b85e0129adc.
- commit 44dd5e4
- packaging: compute-PATCHVERSION.sh -> compute-PATCHVERSION
- commit fc624df
- Fix errors in prior merge from fixes/linux-6.4:
- Adjust ptrace-slightly-saner-get_dumpable-logic-kabi-assert.patch
(kabi fixup) so 'task_struct_orig' matches SP7 task_struct layout.
- Fix ordering of ptrace kabi fixup patches in series.conf to match
SLE15-SP6-LTSS [no functional difference].
- commit 46dfb5c
- kernel-binary: Only apply vmlinux workaround on SLE15 and later
To create debuginfo for vmlinux the file needs to be present even if
it's not packaged because a compressed file is packaged insteand.
To accomplish that the file is marked as ghost in the file list. Then
rpm does not complain that the file exists but does not package it.
However, rpm still reserves space for ghost files when installing a
package. To avoid reserving space for a file that is not used the file
is truncated.
That works on SLE 15 but on SLE 12 rpm then fails packaging the
debuginfo complaiing that extra debuginfo files are present. Limit the
workaround to SLE 15 and later.
Fixes: 222edac2a18 (kernel-binary: prevent uncompressed vmlinux from inflating rpm size requirements)
- commit 1ef7451
- scsi: target: iscsi: validate CHAP_R length before base64 decode
(bsc#1265449).
- commit 9997c88
- net: mana: Fix crash from unvalidated SHM offset read from BAR0 during FLR (bsc#1265846).
- net: mana: remove double CQ cleanup in mana_create_rxq error path (git-fixes).
- net: mana: Skip WQ object destruction for uninitialized RXQ (git-fixes).
- net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() (git-fixes).
- RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() (git-fixes).
- RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() (git-fixes).
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (git-fixes).
- RDMA/mana: Validate rx_hash_key_len (git-fixes).
- hv_sock: fix ARM64 support (git-fixes).
- commit 18c2af9
- Kernel-binary: Do not truncate vmlinux when it's the boot image
Some architectures use vmlinux to boot. Truncating vmlinux on those
architectures causes signing failure during build. Also if the signing
was disabled a brokne kernel would be produced.
Fixes: 222edac2a18 (kernel-binary: prevent uncompressed vmlinux from inflating rpm size requirements)
- commit d3cf603
- perf: Fix __perf_event_overflow() vs perf_remove_from_context()
race (bsc#1260018 CVE-2026-23271).
- commit d05430f
- xfs: avoid dereferencing log items after push callbacks
(CVE-2026-31404 bsc#1261628).
- commit bed0ec1
- kernel-binary: prevent uncompressed vmlinux from inflating rpm size requirements
define %__spec_install_post to truncate the uncompressed vmlinux
to 0 bytes after find-debuginfo.sh and brp-* scripts run. This prevents
rpmbuild from baking the %ghost file size into the FILESIZES
header, which can cause installation failures on smaller /boot partitions.
Fixes: bsc#1265456
- commit 222edac
- net/rds: reset op_nents when zerocopy page pin fails
(bsc#1265626, CVE-2026-43494).
- net/rds: reset op_nents when zerocopy page pin fails
(bsc#1265626).
- commit b66d9fc
- perf: Make sure to use pmu_ctx->pmu for groups (bsc#1263001
CVE-2026-31528).
- commit 2f72854
- RDMA/irdma: Fix deadlock during netdev reset with active connections (CVE-2026-31565 bsc#1263064)
- commit e3d01c8
- net/sched: fix pedit partial COW leading to page cache corruption
(bsc#1265421).
- commit a756c69
- RDMA/irdma: Fix double free related to rereg_user_mr (CVE-2026-43120)
- commit c514796
- drm/amdkfd: Make all TLB-flushes heavy-weight (stable-fixes).
- commit be16332
- ALSA: hda: Fix NULL pointer dereference in snd_hda_ctl_add()
(git-fixes).
- ALSA: scarlett2: Add missing error check when initialise
Autogain Status (git-fixes).
- ALSA: hda: cs35l41: Put ACPI device on missing physical node
(git-fixes).
- ALSA: hda: cs35l56: Put ACPI device after setting companion
(git-fixes).
- ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans
(git-fixes).
- ALSA: usb-audio: Bound MIDI endpoint descriptor scans
(git-fixes).
- drm/amdgpu: gate VM CPU HDP flush on reset lock (stable-fixes).
- drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower
count (stable-fixes).
- leds: qcom-lpg: Check for array overflow when selecting the
high resolution (stable-fixes).
- commit 219e1c4
- spi: zynq-qspi: switch to use modern name (stable-fixes).
- Refresh
patches.suse/spi-zynq-qspi-Add-check-for-clk_enable.patch.
- commit 79d17cd
- USB: serial: option: add Telit Cinterion LE910Cx compositions
(stable-fixes).
- usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl
(stable-fixes).
- usb: usblp: fix heap leak in IEEE 1284 device ID via short
response (stable-fixes).
- platform/x86: hp-wmi: Ignore backlight and FnLock events
(stable-fixes).
- mtd: spi-nor: sst: Fix write enable before AAI sequence
(git-fixes).
- mtd: docg3: fix use-after-free in docg3_release() (git-fixes).
- spi: uniphier: fix controller deregistration (git-fixes).
- spi: syncuacer: fix controller deregistration (git-fixes).
- spi: sun4i: fix controller deregistration (git-fixes).
- spi: omap2-mcspi: fix controller deregistration (git-fixes).
- spi: mtk-nor: fix controller deregistration (git-fixes).
- spi: microchip-core-qspi: fix controller deregistration
(git-fixes).
- spi: uniphier: Simplify clock handling with
devm_clk_get_enabled() (stable-fixes).
- wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling
(git-fixes).
- wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor
(stable-fixes).
- mtd: spi-nor: sst: Fix SST write failure (git-fixes).
- mtd: spi-nor: sst: Factor out common write operation to
`sst_nor_write_data()` (stable-fixes).
- spi: uniphier: switch to use modern name (stable-fixes).
- spi: synquacer: switch to use modern name (stable-fixes).
- spi: sun4i: switch to use modern name (stable-fixes).
- spi: spi-ti-qspi: Convert to platform remove callback returning
void (stable-fixes).
- spi: microchip-core-qspi: Use helper function
devm_clk_get_enabled() (stable-fixes).
- commit 401263c
- drm/amdkfd: Add upper bound check for num_of_nodes
(stable-fixes).
- commit 46b01e2
- HID: playstation: Clamp num_touch_reports (git-fixes).
- drm/amdgpu: zero-initialize GART table on allocation
(stable-fixes).
- drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in
KIQ (stable-fixes).
- fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent
use-after-free (stable-fixes).
- ipmi: Add limits to event and receive message requests
(git-fixes).
- crypto: authencesn - reject short ahash digests during instance
creation (git-fixes).
- drm/amdgpu/vcn4: Avoid overflow on msg bound check (git-fixes).
- drm/amdgpu/vcn3: Avoid overflow on msg bound check (git-fixes).
- drm/amdkfd: validate SVM ioctl nattr against buffer size
(stable-fixes).
- drm/amdgpu: fix zero-size GDS range init on RDNA4
(stable-fixes).
- drm/amdkfd: Clear VRAM on allocation to prevent stale data
exposure (stable-fixes).
- drm/amdgpu/vcn4: Prevent OOB reads when parsing IB
(stable-fixes).
- drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg
(stable-fixes).
- drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg
(stable-fixes).
- drm/amdgpu/vce: Prevent partial address patches (stable-fixes).
- drm/amdgpu: Add bounds checking to ib_{get,set}_value
(stable-fixes).
- mtd: docg3: Convert to platform remove callback returning void
(stable-fixes).
- commit 8bb0040
- ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product
line in quirk table (stable-fixes).
- ALSA: core: Serialize deferred fasync state checks (git-fixes).
- ACPI: video: force native backlight on HP OMEN 16 (8A44)
(stable-fixes).
- ACPI: scan: Use acpi_dev_put() in object add error paths
(git-fixes).
- ALSA: aoa: i2sbus: clear stale prepared state (git-fixes).
- ALSA: seq_oss: return full count for successful SEQ_FULLSIZE
writes (stable-fixes).
- ALSA: aoa: Skip devices with no codecs in i2sbus_resume()
(git-fixes).
- crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated
as 64-bit (git-fixes).
- ALSA: misc: Use guard() for spin locks (stable-fixes).
- ALSA: aoa: Use guard() for mutex locks (stable-fixes).
- ALSA: seq: Notify client and port info changes (stable-fixes).
- commit fd79ce9
- drm/loongson: Use managed KMS polling (git-fixes).
- drm/xe/dma-buf: handle empty bo and UAF races (git-fixes).
- commit 6307785
- drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init
(git-fixes).
- drm/gma500/oaktrail_lvds: fix hang on init failure (git-fixes).
- drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup
(git-fixes).
- accel/qaic: Add overflow check to remap_pfn_range during mmap
(git-fixes).
- drm/panfrost: Fix wait_bo ioctl leaking positive return from
dma_resv_wait_timeout() (git-fixes).
- drm/i915/dp: Fix VSC dynamic range signaling for RGB formats
(git-fixes).
- drm/i915: skip __i915_request_skip() for already signaled
requests (git-fixes).
- commit a143ec8
- avahi
-
- Add avahi-CVE-2026-34933.patch: refuse to accept publish flags
where both wide_area and multicast are set.
(CVE-2026-34933, bsc#1261546)
- util-linux
-
- loopdev: Prevent unauthorized read access to symlinked filesystem
images (bsc#1261606, CVE-2026-27456,
util-linux-CVE-2026-27456.patch).
- mozilla-nss
-
- update to NSS 3.112.5
* bmo#2033783 - reject DTLS 1.3 Server Hello after HVR without capping ss->vrange.max.
* bmo#2034185 - update to version 2.84 of builtins module.
- Added "Suggests: p11-kit-nss-trust" to favor over mozilla-nss-certs
(Jira: PED-15633)
- graphite2
-
- added patches
CVE-2026-50593: Out-of-bounds write via Graphite actions [bsc#1267733]
* graphite2-CVE-2026-50593.patch
- openssl-1_1
-
- Security fixes:
* CVE-2026-42766: Possible NULL Dereference in Password-Based CMS
Decryption (bsc#1266349)
* CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption
(bsc#1266341)
* CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String
Conversion (bsc#1266340)
* CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing
(bsc#1266342)
* CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357)
* Add patches:
openssl-CVE-2026-42766.patch openssl-CVE-2026-9076.patch
openssl-CVE-2026-7383.patch openssl-CVE-2026-34180.patch
openssl-CVE-2026-45447.patch
- openssl-3
-
- Security fix:
* CVE-2026-42767 NULL Pointer Dereference in CRMF EncryptedValue Decryption
(bsc#1266350)
* Add patch: openssl-CVE-2026-42767.patch
- Security fixes:
* CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357)
* CVE-2026-45446: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (bsc#1266356)
* CVE-2026-42770: FFC-DH Peer Validation Uses Attacker-Supplied q (bsc#1266353)
* CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path (bsc#1266355)
* CVE-2026-42768: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (bsc#1266351)
* CVE-2026-42769: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (bsc#1266352)
* CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349)
* CVE-2026-34183: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (bsc#1266345)
* CVE-2026-34181: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (bsc#1266343)
* CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341)
* CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340)
* CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342)
* Add patches:
openssl-CVE-2026-34180.patch openssl-CVE-2026-34181.patch
openssl-CVE-2026-34183.patch openssl-CVE-2026-42766.patch
openssl-CVE-2026-42768.patch openssl-CVE-2026-42769.patch
openssl-CVE-2026-42770.patch openssl-CVE-2026-45445.patch
openssl-CVE-2026-45446.patch openssl-CVE-2026-45447.patch
openssl-CVE-2026-7383.patch openssl-CVE-2026-9076.patch
- python311
-
- Add CVE-2026-3446-base64-padding.patch preventing ignoring
excess Base64 data after the first padded quad (bsc#1261970,
CVE-2026-3446, gh#python/cpython#145264).
- Rewrite structure of Python interpreter packages.
`python3*` symbols should be now provided by real python3
packages and its subpackages instead of the virtual provides
(bsc#1258364).
- libsolv
-
- fix solv_chksum_free segfault when called with a NULL pointer
- bump version to 0.7.39
- made repo_add_solv more robust against corrupt files
[bsc#1265935] [CVE-2026-9149]
- fix potential buffer overflow when verifying EdDSA signatures
[bsc#1266039] [CVE-2026-48863]
- added limit checks in multiple places to catch overflows
- reduce the size of the language id cache
- fixed Debian canon selection
- fixed dbpath detection in repo_rpmdb_librpm
- reduced stack usage in repo page compression (needed for musl)
- bump version to 0.7.38
- fix parsing of sha512 checksums in debian repositories
[bsc#1265938] [CVE-2026-9150]
- improve speed of dirpool_add_dir makeing parsing of filelists.xml
twice as fast
- fix parsing of recommends in the old Mandriva synthesis format
- bump version to 0.7.37
- respect the "default" attribute in environment optionlist in
the comps parser
- support suse namespace deps in boolean dependencies [bsc#1258193]
- support for the Elbrus2000 (e2k) architecture
- support language() suse namespace rewriting
- bump version to 0.7.36
- sqlite3
-
- Sync version 3.53.2 from Factory:
* bsc#1268013, CVE-2026-11824: heap-based buffer overflow
vulnerability in the FTS5 full-text search extension.
* bsc#1268012, CVE-2026-11822: memory corruption vulnerabilities
in the FTS5 full-text search extension.
- libzypp
-
- A .repo files "path=" entry must not refer to a location
outside the repo (bsc#1267874, CVE-2026-44942)
A "path=" entry may solely denote a sub-directory of the baseurl
where the metadata are located. A relative path trying to access
data outside the baseurl is reported and sanitized.
- version 17.38.13 (35)
- Repo "keyhint" must denote a filename, no path (bsc#1267426,
CVE-2026-44941)
- version 17.38.12 (35)
- Fix potential crash on malformed or malicious repository
metadata (fixes #740)
- version 17.38.11 (35)
- Repo metadata: discard entries referring to a location outside
the repo (bsc#1259802, CVE-2026-25707)
Mirroring those data locally would refer to a location outside
the repo's local cache directory. Those data entries are reported
and discarded.
- zypp.conf: Allow [env] section to add environment variables.
This feature is designed to enable environment-specific settings
or debugging options over an extended period. See zypp.conf(5).
- version 17.38.10 (35)
- Prevent configured scripts from escaping the sigcheck directory
(bsc#1265223, CVE-2026-44933)
- StringV: guard hasPrefix/hasPrefixCI against reading past the
view end (fixes #735)
- version 17.38.9 (35)
- Mandatory signature verification plugin support (PED#11922)
- version 17.38.8 (35)
- Fix purge-kernel -rc kernel handling (bsc#1239718)
- Explicitly_set_pool_DISTTYPE_RPM (fixes #726)
- version 17.38.7 (35)
- Check for trusted key updates when updating the general keyring
(bsc#1259706)
- Support multiple MirroredOrigin authorities (bsc#1253193)
- Workaround doxygen bug: doxygen/doxygen#12057
- libzypp.spec: Add missing graphviz-gd BuildRequires (boo#1259842)
- version 17.38.6 (35)
- Fix preloader not caching packages from arch specific subrepos
(bsc#1253740)
- Deprioritize invalid mirrors (fixes openSUSE/zypper#636)
- version 17.38.5 (35)
- Fix Product::referencePackage lookup (bsc#1259311)
Use a provided autoproduct() as hint to the package name of the
release package. It might be that not just multiple versions of
the same release package provide the same product version, but
also different release packages.
- version 17.38.4 (35)
- specfile: on fedora use %{_prefix}/share as zyppconfdir if
%{_distconfdir} is undefined (fixes #693)
This will set '-DZYPPCONFDIR=%{zyppconfdir}' for cmake.
- Fall back to a writable location when precaching packages
without root (bsc#1247948)
- version 17.38.3 (35)
- Prepare a legacy /etc/zypp/zypp.conf to be installed on old distros.
See the ZYPP.CONF(5) man page for details.
- Fix runtime check for broken rpm --runposttrans (bsc#1257068)
- version 17.38.2 (35)
- Avoid libcurl-mini4 when building as it does not support ftp
protocol.
- Translation: updated .pot file.
- version 17.38.1 (35)
- zypp.conf: follow the UAPI configuration file specification
(PED-14658)
In short terms it means we will no longer ship an
/etc/zypp/zypp.conf, but store our own defaults in
/usr/etc/zypp/zypp.conf. The systems administrator may choose to
keep a full copy in /etc/zypp/zypp.conf ignoring our config file
settings completely, or - the preferred way - to overwrite
specific settings via /etc/zypp/zypp.conf.d/*.conf overlay files.
See the ZYPP.CONF(5) man page for details.
- cmake: correctly detect rpm6 (fixes #689)
- Use 'zypp.tmp' as temp directory component to ease setting up
SELinux policies (bsc#1249435)
- zyppng: Update Provider to current MediaCurl2 download
approach, drop Metalink ( fixes #682 )
- version 17.38.0 (35)
- openssh
-
- Add patch rebased from upstream to add missing askpass check for
proxy-mode multiplexing sessions (CVE-2026-35388, bsc#1261441):
* openssh-cve-2026-35388-askpass-multiplexing.patch
- Update patch to fix a possible information disclosure or denial
of service due to uninitialized variables in gssapi patches
(CVE-2026-3497, bsc#1259642) :
* openssh-8.0p1-gssapi-keyex.patch
- Add patch to fix a potential issue when validating mac or ciphers
(bsc#1264568):
* fix-mac-validation-strsep-logic-bug.patch
- Improve %prep LDAP regex to preserve subdirectories (e.g., ope-
nbsd-compat/) and handle optional [ab]/ prefixes.
- perl-XML-LibXML
-
- added patches
CVE-2026-8177: versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte sequences [bsc#1264715]
* perl-XML-LibXML-CVE-2026-8177.patch
- python-certifi
-
- Add python36-certifi provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-idna
-
- Add python36-idna provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-packaging
-
- Add python36-packaging provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python3-pyOpenSSL
-
- CVE-2026-40475: improper input handling of null bytes can lead to
silent data truncation and security-state inconsistency (bsc#1262803)
* CVE-2026-40475.patch
- python-pycparser
-
- Add python36-pycparser provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-py
-
- Add python36-py provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-six
-
- Add python36-six provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-urllib3
-
- CVE-2026-44431: sensitive information disclosure due to sensitive
headers being forwarded across origins in proxied low-level redirects
(bsc#1265267)
Add patch CVE-2026-44431.patch
- fix regression in CVE-2025-66471.patch when downloading large files
(bsc#1259829)
- python-PyJWT
-
- CVE-2026-48526: JWK JSON accepted as HMAC secret (algorithm confusion)
(bsc#1266802)
- CVE-2026-48523: Algorithm allow-list bypass with PyJWK / PyJWKClient
(bsc#1266799)
- CVE-2026-48525: DoS via base64 decode of unused payload segment when b64=false
(bsc#1266801)
- CVE-2026-48522: PyJWKClient accepts non-HTTP(S) URIs (bsc#1266798)
- CVE-2026-48524: PyJWKClient cache wiped on fetch error (bsc#1266800)
- added security-fixes.patch to fix above vulnerabilities
- python-pyOpenSSL
-
- CVE-2026-40475: improper input handling of null bytes can lead to
silent data truncation and security-state inconsistency (bsc#1262803)
* CVE-2026-40475.patch
- salt
-
- Use non vendored tornado with Python 3.11 (bsc#1257583, bsc#1259700)
- Added:
* use-non-vendored-tornado-with-python-3.11.patch
- BDSA-2025-60810: Harden Tornado from invalid HTTP reason phrases
- Read full URI from ldap pillar config (bsc#1254900)
- Added:
* bdsa-2025-60810-harden-against-invalid-http-reason-p.patch
* read-full-uri-from-ldap-pillar-config-753.patch
- Fix testsuite failures
- Backport of the CVE-2026-31958 fix (bsc#1259554)
- Add x86_64_v2 as a possible rpm package architecture
- Make users with backslash working for salt-ssh (bsc#1254629)
- Fix ansible.playbooks extra-vars quoting (bsc#1257831)
- Fix virtualenv call in test helper to use proper python version
- Added:
* fix-test-failures-754.patch
* backport-of-the-cve-2026-31958-fix-bsc-1259554.patch
* add-x86_64_v2-as-a-possible-rpm-package-architecture.patch
* make-users-with-backslash-working-for-salt-ssh-bsc-1.patch
* fix-ansible.playbooks-extra-vars-quoting-bsc-1257831.patch
* fix-virtualenv-call-in-test-helper-to-use-proper-pyt.patch
- python-typing_extensions
-
- Drop fix-ann_module-import-path.patch, fixed upstream
- update to 4.12.2:
* Fix regression in v4.12.0 where specialization of certain
* generics with an overridden `__eq__` method would raise
errors.
* Fix tests so they pass on 3.13.0b2
* Preliminary changes for compatibility with the draft
implementation of PEP 649 in Python 3.14.
* Fix regression in v4.12.0 where nested `Annotated` types
would cause `TypeError` to be raised if the nested
`Annotated` type had unhashable metadata.
* Fix incorrect behaviour of `typing_extensions.ParamSpec` on
Python 3.8 and 3.9 that meant that
`isinstance(typing_extensions.ParamSpec("P"),
typing.TypeVar)` would have a different result in some
situations depending on whether or not a profiling
function had been set using `sys.setprofile`.
* This release focuses on compatibility with the upcoming
release of Python 3.13. Most changes are related to the
implementation of type parameter defaults (PEP 696).
- Add patch to fix import path for ann_module, ann_module2 and ann_module3
* fix-ann_module-import-path.patch
- update to 4.11.0:
* Fix tests on Python 3.13.0a5. Patch by Jelle Zijlstra.
* Fix the runtime behavior of type parameters with defaults
* Fix minor discrepancy between error messages produced by
`typing` and `typing_extensions` on Python 3.10.
* When `include_extra=False`, `get_type_hints()` now strips
`ReadOnly` from the annotation.
- update to 4.10.0:
This feature release adds support for PEP 728 (TypedDict with extra
items) and PEP 742 (``TypeIs``).
- Add support for PEP 728, supporting the `closed` keyword argument and the
special `__extra_items__` key for TypedDict. Patch by Zixuan James Li.
- Add support for PEP 742, adding `typing_extensions.TypeIs`. Patch
by Jelle Zijlstra.
- Drop runtime error when a read-only `TypedDict` item overrides a mutable
one. Type checkers should still flag this as an error. Patch by Jelle
Zijlstra.
- Speedup `issubclass()` checks against simple runtime-checkable protocols by
around 6% (backporting https://github.com/python/cpython/pull/112717, by Alex
Waygood).
- Fix a regression in the implementation of protocols where `typing.Protocol`
classes that were not marked as `@runtime_checkable` would be unnecessarily
introspected, potentially causing exceptions to be raised if the protocol had
problematic members. Patch by Alex Waygood, backporting
https://github.com/python/cpython/pull/113401.
- obsoletes backport-recent-implementation-of-protocol.patch
- Add backport-recent-implementation-of-protocol.patch upstream patch
gh#python/typing_extensions@004b893ddce2
- timezone
-
- Update to 2026b:
* British Columbia moved to permanent -07 on 2026-03-09. (bsc#1264965)
* Some more overflow bugs have been fixed in zic.
- Refresh revert-philippines-historical-data.patch
- Change SUSE-Public-Domain license to LicenseRef-SUSE-Public-Domain to
fix rpmlint errors
- Update to 2026a:
* Moldova has used EU transition times since 2022.
* The "right" TZif files are no longer installed by default.
* -DTZ_RUNTIME_LEAPS=0 disables runtime support for leap seconds.
* TZif files are no longer limited to 50 bytes of abbreviations.
* zic is no longer limited to 50 leap seconds.
* Several integer overflow bugs have been fixed.
- Changes from 2025c:
* update Baja California DST rules in 1953, 1961-1975
* An unset TZ is no longer invalid when /etc/localtime is
missing, and is abbreviated "UTC" not "-00". This reverts to
2024b behavior
* tzset etc. are now more cautious about questionable TZ settings.
* tzset etc. now treat ' ' like '_' in time zone abbreviations
* tzfree now preserves errno, consistently with POSIX.1-2024 ‘free’.
* zic has new options inspired by FreeBSD. ‘-D’ skips creation of
output ancestor directories, ‘-m MODE’ sets output files’ mode,
and ‘-u OWNER[:GROUP]’ sets output files’ owner and group.
* multiple changes visible to developers
- Use "REDO=posix_right" to keep installing "right" TZif files.
- vim
-
- Update to v9.2.0530.
- Fix for SG#71948, bsc#1262395:
* vim-9.1.1732-fix-inc-detection.patch: Fix for incorrectly detecting
- Upstream fixed the following bugs / CVEs:
* bsc#1264706 CVE-2026-42307
* bsc#1265360 CVE-2026-46483
* bsc#1264708 CVE-2026-45130
* bsc#1264707 CVE-2026-44656
* bsc#1265349 CVE-2026-43961
- Changes:
* 9.2.0530: WinBar row vertical separator not refreshed on window change
* 9.2.0529: GTK4: clipboard returns empty after a foreign app takes the selection
* 9.2.0528: possible overflow in XIM resource handling
* 9.2.0527: Possible double free in fill_partial_and_closure()
* 9.2.0526: missing out-of-memory check in ex_substitute()
* 9.2.0525: spell: memory leak in spell_read_dic()
* 9.2.0524: spell: buffer overflow with many affix or compound flags
* 9.2.0523: tests: no test for using shellescape() in combination with :!
* 9.2.0522: event_nr2name() in autocmd.c can be improved
* 9.2.0521: GTK4: cannot resize shell after the window is shown
* 9.2.0520: Reversed text opacity in popup when termguicolor is set
* 9.2.0519: GTK4: GUI tabline is not displayed correctly
* 9.2.0518: GTK4: input method cannot compose text
* 9.2.0517: quickfix: can set quickfixtextfunc in restricted/sandbox mode
* 9.2.0516: socketserver: spurious error when servername is taken
* 9.2.0515: virtualedit=insert doesn't work during change operation
* 9.2.0514: GTK4: build errors when socketserver is enabled
* 9.2.0513: [security]: memory safety issues in spellfile.c
* 9.2.0512: clientserver uses binary protocol
* 9.2.0511: configure: when GTK4 is used also links in X11 libs
* 9.2.0510: setline() mapping may trigger autoindent
* 9.2.0509: term.c: compile error when LOG_TRN is enabled
* 9.2.0508: completion: cannot complete user cmd :K with 'ignorecase'
* 9.2.0507: Vim9 class: public/protected member name clash uses same error
* 9.2.0506: home_replace() function can be improved
* 9.2.0505: GTK4: text looks blurry on HiDPI displays
* 9.2.0504: configure: requires X11 libraries for GTK4 build
* 9.2.0503: Makefile: Missing dependencies for new GTK4 source files
* 9.2.0502: runtime(netrw): bookmark handling can be improved
* 9.2.0501: GTK4: there is no GTK4 UI available
* 9.2.0500: filetype: some html files wrongly recognized as htmlangular
* 9.2.0499: modeline: allow to disable modelines with modelinestrict
* 9.2.0498: potential heap buffer overflow in if_xcmdsrv.c
* 9.2.0497: Cannot jump to remote tags
* 9.2.0496: [security]: Code Injection in cucumber filetype plugin
* 9.2.0495: [security]: runtime(netrw): code injection via NetrwBookHistSave()
* 9.2.0494: User commands cannot handle single args with spaces
* 9.2.0493: popup: missing Popup, PopupBorder and PopupTitle hi groups
* 9.2.0492: popup: decoration wrongly drawn with clipping on border
* 9.2.0491: VMS: various build issues
* 9.2.0490: matchfuzzy() can crash on long multi-word patterns
* 9.2.0489: filetype: some Objective-C files are not recognized
* 9.2.0488: statusline: status line highlight blends into adjacent vsep cells
* 9.2.0487: viminfo: possible signed int overflow in register array
* 9.2.0486: out-of-bound read when recovering swap files
* 9.2.0485: clipboard provider callback can be called recursively
* 9.2.0484: TextPutPre triggers clipboard provider callback twice
* 9.2.0483: popup: terminal embedded in an opacity popup freezes Vim on input
* 9.2.0482: runtime(osc52): triggered twice with TextPutPoste autocmd
* 9.2.0481: runtime(netrw): command injection possible via maps
* 9.2.0480: [security]: runtime(netrw): code injection via mf command
* 9.2.0479: [security]: runtime(tar): command injection in tar plugin
* 9.2.0478: channel: redundant str/length assignments in channel_part_info()
* 9.2.0477: popup: leftover content after popup_free under layout change
* 9.2.0476: pattern completion leaks memory on alloc failures
* 9.2.0475: runtime(netrw): bookmark paths not normalized
* 9.2.0474: MS-Windows: hard to tell which Visual Studio version was selected with MSVC
* 9.2.0473: Pasting ". register without autocommands breaks TextPut*
* 9.2.0472: popup: column jitters when scrolled outside viewport
* 9.2.0471: vimvars di_key initialized at runtime
* 9.2.0470: No way to hook into put commands
* 9.2.0469: popup: textprop-anchored popups bleed past host window edges
* 9.2.0468: popups: not correctly updated from a CmdlineChanged autocommand
* 9.2.0467: multi-line statusline loses highlighting attributes
* 9.2.0466: popup: redraw can use stale blended cells
* 9.2.0465: modeline: foldmarker cannot be set with modelinestrict
* 9.2.0464: runtime(netrw): bookmarking directory uses current dir
* 9.2.0463: Not able to use legacy expression evaluation in a vim9script maps
* 9.2.0462: MS-Windows: workaround for assert error on GUI
* 9.2.0461: Corrupted undofile causes use-after-free
* 9.2.0460: did_set_shellpipe_redir() in wrong file
* 9.2.0459: tests: test_termcodes fails (after v9.2.0456)
* 9.2.0458: Crash with invalid shellredir/shellpipe value
* 9.2.0457: Compile warning about unused variable
* 9.2.0456: stray p character displayed on some terms
* 9.2.0455: 'findfunc' only allows extra info for cmdline completion
* 9.2.0454: tests: no test that "abbr" in customlist completion is shown
* 9.2.0453: vertical separator of statusline blend into active statusline
* 9.2.0452: screen.c popup opacity blend logic is duplicated
* 9.2.0451: 'findfunc' can't return extra info for cmdline completion
* 9.2.0450: [security]: heap buffer overflow in spellfile.c read_compound()
* 9.2.0449: Make proto fails in non GTK builds
* 9.2.0448: Vim9: dangling cmdline pointer after skip_expr_cctx()
* 9.2.0447: cindent does not ignore comments
* 9.2.0446: runtime(netrw): off-by-one bug in s:NetrwUnMarkFile()
* 9.2.0445: win_fix_scroll() called before win_comp_pos() in command_height()
* 9.2.0444: Cannot set 'path' option via modeline
* 9.2.0443: GUI: cancelling save dialog overwrites or discards unnamed buffer
* 9.2.0442: completion: i_CTRL-X_CTRL-V doesn't use dict from customlist
* 9.2.0441: statusline: click handler not called on multi-line statusline
* 9.2.0440: MS-Windows: cursor flicker during update_screen()
* 9.2.0439: completion: info popup not removed in cmdline mode
* 9.2.0438: tests: test_plugin_termdebug is flaky
* 9.2.0437: MS-Windows: cursor flicker in vtp mode
* 9.2.0436: Buffer overflow when parsing overlong errorformat lines
* 9.2.0435: [security]: backticks in 'path' may cause shell execution on completion
* 9.2.0434: cscope: filename interpreted by /bin/sh
* 9.2.0433: customlist completion cannot supply pum metadata
* 9.2.0432: blob to string conversion can be improved
* 9.2.0431: blob encoding can be improved
* 9.2.0430: tests: Test_shortmess_F3() is flaky on MS-Windows
* 9.2.0429: tests: flaky screendump Test_smoothscroll_incsearch()
* 9.2.0428: popup: no opacity support for completepopup/previewpopup
* 9.2.0427: popup: opacity blend may leaks white bg color
* 9.2.0426: tests: still some flaky screendump tests
* 9.2.0425: Cannot silence undo/redo messages
* 9.2.0424: popup: flicker when wildtrigger() refreshes the popup menu
* 9.2.0423: popup: wrapped cmdline truncated with wildoptions=pum
* 9.2.0422: popup: leave stray char when scrollbar changes
* 9.2.0421: vimball: can smuggle Vimscript into VimballRecord file
* 9.2.0420: channel: cannot handle binary data via channel callbacks
* 9.2.0419: popup: rendering issues
* 9.2.0418: wildcards in expanded env vars reinterpreted by glob
* 9.2.0417: completion: no support for "noinsert" with 'wildmode'
* 9.2.0416: Unix: filename completion splits at space for single-file Ex commands
* 9.2.0415: Wrong behavior when executing register that ends in Insert mode
* 9.2.0414: Flicker when drawing window separator and pum is shown
* 9.2.0413: Scrolling wrong with 'splitkeep' when changing 'cmdheight'
* 9.2.0412: channel: term_start() out_cb/err_cb no longer deliver raw chunks
* 9.2.0411: tabpanel: no Vim script functions for the tabpanel
* 9.2.0410: test suite races when run with parallel make
* 9.2.0409: memory leaks in copy_substring_from_pos()
* 9.2.0408: Insert-mode <Cmd> edits can corrupt undo
* 9.2.0407: tabpanel: A few issues with the tabpanel
* 9.2.0406: VisualNOS not used when Wayland selection ownership lost
* 9.2.0405: when jumping to tags, will open URLs
* 9.2.0404: redraw_listener_add() does not check secure flag
* 9.2.0403: Vim9: def function sandbox bypass
* 9.2.0402: pum: opacity not applied to wildmenu pum
* 9.2.0401: tests: still a few flaky tests
* 9.2.0400: sandbox callbacks selected through 'complete'
* 9.2.0399: MS-Windows: compile warning in strptime.c
- wicked
-
- Update to version 0.6.79
- Fix an indirect remote shell command injection via unsanitized
dhcp strings and leaseinfo dump (bsc#1265221,CVE-2026-44932):
- Fix to escape single-quotes in leaseinfo dump output used by the
`wicked test dhcp4` and `wicked test dhcp6` and written to the
/run/wicked/leaseinfo.* files, e.g. to pass them to netconfig.
A netconfig modify filtered for strict key='value' lines without
any escaped quotes and discarded these lines already before.
- Fix posix-tz-dbname and tz-string option processing checks to
permit only valid characters according to RFC4833.
- Discard string values containing single-quotes in other options.
- Trigger to regenerate initrd that may contain wicked binaries on
updates from wicked versions <= 0.6.78.
- xen
-
- bsc#1266952 - VUL-0: CVE-2026-42487: xen: x86 HVM I/O port list
traversal (XSA-491)
xsa491.patch
- bsc#1266953 - VUL-0: CVE-2026-42489,CVE-2026-42490: xen: domctl
lock open to abuse (XSA-492)
xsa492-01.patch
xsa492-02.patch
xsa492-03.patch
xsa492-04.patch
xsa492-05.patch
xsa492-06.patch
xsa492-07.patch
xsa492-08.patch
xsa492-09.patch
xsa492-10.patch
xsa492-11.patch
xsa492-12.patch
xsa492-13.patch
xsa492-14.patch
xsa492-15.patch
xsa492-16.patch
xsa492-17.patch
xsa492-18.patch
- bsc#1266955 - VUL-0: CVE-2026-42488: xen: x86: mismatched
mapcache metadata (XSA-494)
xsa494.patch
- zypper
-
- Transactional systems: Delegate rw-commands to
transactional-wrapper if available (jsc#PED-13680, jsc#PED-15607)
On a transactional system where the root filesystem is mounted
read-only, zypper commands that modify the system cannot be
executed directly.
If the system provides a transactional-wrapper utility, zypper
will automatically attempt to invoke it. The wrapper
transparently executes the zypper command within a new, writable
snapshot and manages the lifecycle of that snapshot based on the
command's exit status.
On transactional systems lacking a transactional-wrapper, users
must manually invoke specialized tools -such as
transactional-update- to install, update, or remove software.
- version 1.14.98
- Add --filter-version-change to zypper lu.
Adds filtering by version change significance to reduce noise in
update listings. Supports levels: rebuild (hides rebuild-only
changes) and package (hides all release-only changes).
- version 1.14.97
- Autorefresh ris-services the way as plugin-services (bsc#1246504)
It's actually wrong to treat service refreshes different
depending on the service type. For the purpose of a service it
makes no difference how the data about the repos to use are
acquired.
- version 1.14.96
- Report download progress for command line rpms (fixes #613)
- Hint to '-vv ref' to see the mirrors used to download the
metadata (bsc#1257882)
- Service: Allow "zypper ls SERVICE ..." to test whether a
service with this alias is defined (bsc#1252744)
The command prints an abstract of all services passed on the
command line. It returns 3-ZYPPER_EXIT_ERR_INVALID_ARGS if some
argument does not name an existing service.
- Keep repo data when updating the service settings (bsc#1252744)
- info: Enhance pattern content table (bsc#1158038)
Alternatives (multiple packages providing the same requirement)
are now listed as a single entry in the content table. The entry
shows either the installed package which satisfies the
requirement or the requirement itself as type 'Provides'.
Listing all potential alternatives was miss leading, especially
if the alternatives were mutual exclusive. It looked like an
installed pattern had not-installed requirements and it was not
possible to install all requirements at the same time.
- version 1.14.95