suse-sles-sap-12-sp5-v20260622-hvm-ssd-x86

kernel-default

- hfsplus: fix uninit-value by validating catalog record size (CVE-2026-46169 bsc#1267713).
- commit db783c5

- ext4: convert inline data to extents when truncate exceeds inline size (CVE-2026-31452 bsc#1262620).
- commit ad1fbe8

- ext4: reject mount if bigalloc with s_first_data_block != 0 (CVE-2026-31447 bsc#1262614).
- commit d61eb9b

- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259 bsc#1267685).
- commit 7d325be

- Revert "Merge remote-tracking branch 'remotes/origin/users/nikborisov/SLE12-SP5/for-next' into sle12sp5-for-merge"
  This reverts commit 5aeae9bf0fdda1eac3e5b2cd5878750266c20f8b, reversing
  changes made to 76b45cc61d0af160b229837764829fbb2fda239f.
- commit 98952d9

- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116 bsc#1267369)
- commit b2d004f

- crypto: algif_aead - Fix minimum RX size check for decryption
  (CVE-2026-43077 bsc#1264470).
- commit 2f7660a

- Input: alps - fix use-after-free bugs caused by
  dev3_register_work (git-fixes CVE-2025-68822 bsc#1256668).
- commit 13a9cd2

- kABI fix after KVM: x86: Use scratch field in MMIO fragment
  to hold small write values (CVE-2026-31588 bsc#1263165).
- commit e1386d7

- KVM: x86: Use scratch field in MMIO fragment to hold small
  write values (CVE-2026-31588 bsc#1263165).
- commit 8af2184

- kabi: revert kabi breaking changes from bsc#1264610 fix
  (CVE-2026-43198 bsc#1264610).
- tcp: fix potential race in tcp_v6_syn_recv_sock()
  (CVE-2026-43198 bsc#1264610).
- commit 0a3a3c1

- Bluetooth: btintel: serialize btintel_hw_error() with
  hci_req_sync_lock (CVE-2026-31500 bsc#1262993).
- commit d2e7910

- virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (CVE-2026-31469 bsc#1267816)
- commit 96b9559

- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO
  (CVE-2026-45841 bsc#1266390).
- commit 1c52576

- netfilter: x_tables: ensure names are nul-terminated
  (CVE-2026-43028 bsc#1263934).
- commit 413df52

- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
  (CVE-2026-31674 bsc#1263568).
- commit 121769c

- netfilter: nf_tables: reject immediate NF_QUEUE verdict
  (CVE-2026-43024 bsc#1263930).
- commit 99d1baf

- Fix build failure with lockdep enabled
  Our 4.12 kernel doesn't have the upstream rw_semaphore rework of the
  pernet operations, instead it relies on the net_mutex. Reflect this in
  the respective patches are otherwise the build fails with lockdep
  enabled as pernet_ops_rwsem doesn't exist.
- Refresh
  patches.suse/net-fix-UAF-issue-in-nfqnl_nf_hook_drop-when-ops_init-fail.patch.
- Refresh
  patches.suse/net-fix-UaF-in-netns-ops-registration-error-path.patch.
- commit 8b1c5ac

- fanotify: fix false positive on permission events (bsc#1267387
  CVE-2026-46150).
- commit c0f675e

- arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1266290 CVE-2025-10263)
- commit 2054d1e

- arm64: Add workaround for Cortex-A76 erratum 1286807 (bsc#1266290 CVE-2025-10263)
- commit d0dc00c

- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths
  (CVE-2026-45870 bsc#1266704).
- commit e9250a8

- can: raw: fix ro->uniq use-after-free in raw_rcv()
  (CVE-2026-31532 bsc#1262757).
- xfrm: clear trailing padding in build_polexpire() (CVE-2026-31664
  bsc#1263578).
- seg6: separate dst_cache for input and output paths in seg6
  lwtunnel (CVE-2026-31668 bsc#1263140).
- ipv6: prevent possible UaF in addrconf_permanent_addr()
  (CVE-2026-43339 bsc#1264763).
- ipv6: icmp: clear skb2->cb in ip6_err_gen_icmpv6_unreach()
  (CVE-2026-43038 bsc#1264097).
- string.h: Introduce memset_after() for wiping trailing
  members/padding (CVE-2026-31664 bsc#1263578).
- can: af_can: export can_sock_destruct() (CVE-2026-31532
  bsc#1262757).
- commit d7a48a3

- usb: ulpi: fix memory leak on ulpi_register() error paths
  (CVE-2026-31759 bsc#1264076).
- commit febb05c

- usb: ulpi: fix double free in ulpi_register_interface() error
  path (CVE-2026-31759 bsc#1264076).
- commit 9a138e3

- xfs: fix freemap adjustments when adding xattrs to leaf blocks
  (CVE-2026-43158 bsc#1264595).
- commit 83ebab2

- xfs: delete attr leaf freemap entries when empty (CVE-2026-43187
  bsc#1264603).
- commit 7e6da62

- btrfs: fix missing last_unlink_trans update when removing a
  directory (CVE-2026-46160 bsc#1267624).
- commit da3cff0

- libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (CVE-2026-46024 bsc#1267218).
- commit 69798b5

- ocfs2: handle invalid dinode in ocfs2_group_extend (CVE-2026-31596 bsc#1263319).
- commit 0c86c19

- libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (CVE-2026-43407 bsc#1265020).
- commit 55db24c

- scsi: hisi_sas: Fix NULL pointer exception during user_scan()
  (CVE-2026-43413, bsc#1264671).
- commit 59e6dcd

- ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger
  (CVE-2026-46157 bsc#1267726).
- commit eb211f4

- nfsd: never defer requests during idmap lookup (CVE-2026-45983
  bsc#1266697).
- commit dcfdbd4

- Refresh
  patches.suse/team-avoid-NETDEV_CHANGEMTU-event-when-unregistering.patch.
  Added missing locking in backport (bsc#1267732).
- commit 7cd10b8

- ibmveth: Disable GSO for packets with small MSS (CVE-2026-46273
  bsc#1267651).
- commit 215c233

- af_unix: read UNIX_DIAG_VFS data under unix_state_lock
  (CVE-2026-31673 bsc#1263143).
- Refresh patches.suse/vfs-add-super_operations-get_inode_dev.
- commit 91357ca

- ALSA: aloop: Fix peer runtime UAF during format-change stop
  (CVE-2026-46090 bsc#1267531).
- commit 2d04862

- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (CVE-2026-43026 bsc#1263932).
- commit 6130310

- Update
  patches.suse/scsi-imm-Fix-use-after-free-bug-caused-by-unfinished-delay.patch
  (CVE-2025-68324 bsc#1255416).
  Fixed incorrect CVE reference (two numbers were transposed)
- commit f7ef5e0

- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CVE-2026-45835 bsc1266411).
- commit d1adee0

- packaging: Add nvidia kernel description
- commit 5f2699f

- btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which
  can lead  to info-leak (bsc#1267652,CVE-2026-46159).
- commit e43ac5f

- KVM: x86: Handle PKU CPUID adjustment in VMX code (bsc#1263887).
- Refresh
  patches.suse/x86-bugs-Use-ALTERNATIVE-instead-of-mds_user_clear-static-.patch.
- commit 7e1c168

- kvm/svm: PKU not currently supported (bsc#1263887).
- commit ebf2842

- rpm/mkspec: Conditionally set Rust BuildReqs (bsc#1258538)
  This is a further optimization of kernel packaging rust-enablement.
  Add the check of CONFIG_RUST at creating the spec for each kernel
  flavor, and set BuildRequires conditionally only for archs that have
  CONFIG_RUST.  This avoids the unnecessary dependency chains due to
  unused rust.
  The main knob ENABLE_RUST is still needed because otherwise we can't
  know whether to pass the dummy-tools or not at processing
  run_oldconfig.
- commit ccf4b93

- rpm/check-for-config-changes: ignore Rust-related configs (bsc#1258538)
  Those configs may be dynamically changed at the build time
- commit 5251980

- rpm: Add BuildRequires for Rust enablement (bsc#1258538)
  Update mkspec and template to generate the spec files with
  BuildRequires of Rust-related packages when ENABLE_RUST=Yes is set in
  rpm/config.sh.
- commit d0f276f

- arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes)
- commit bd5825a

- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()
  (CVE-2026-46181 bsc#1266826).
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down
  (CVE-2026-45970 bsc#1267205).
- commit 8a5179a

- arm64: tlb: Allow XZR argument to TLBI ops (git-fixes)
- commit ce6ab40

- thermal: core: Fix thermal zone governor cleanup issues
  (CVE-2026-46021 bsc#1267220).
- commit 7b30f02

- KVM: x86: Fix shadow paging use-after-free due to unexpected
  GFN (CVE-2026-46113 bsc#1266969).
- commit 4193651

- slip: reject VJ receive packets on instances with no rstate array (CVE-2026-45842 bsc#1266400)
- commit b0021eb

- media: dvb-net: fix OOB access in ULE extension header tables (CVE-2026-31405 bsc#1261700)
- commit 84a8ba3

- drm/i915/gt: Check set_default_submission() before deferencing (CVE-2026-31540 bsc#1263011)
- commit a330a74

- xfrm_user: fix info leak in build_report() (CVE-2026-31671 bsc#1263115).
- commit 95d57ab

- net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak (CVE-2026-43040 bsc#1264091)
- commit 4a2ab4e

- kabi: hide work_disabled flag in struct xfrm_policy_hthresh
  (CVE-2026-31516 bsc#1262755).
- commit bb6328a

- xfrm: prevent policy_hthresh.work from racing with netns
  teardown (CVE-2026-31516 bsc#1262755).
- commit be36548

- btrfs: reserve enough transaction items for qgroup ioctls
  (CVE-2026-43338 bsc#1264716).
- commit cd46988

- btrfs: fix transaction abort on set received ioctl due to item
  overflow (CVE-2026-43359 bsc#1264719).
- commit 33778aa

- net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check (CVE-2026-23448 bsc#1261750)
- commit 716c257

- wifi: radiotap: reject radiotap with unknown bits (CVE-2026-23367 bsc#1260731)
- commit cfba6bc

- net: bonding: fix NULL deref in bond_debug_rlb_hash_show (CVE-2026-31546 bsc#1263006)
- commit 1254e27

- wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() (CVE-2026-23279 bsc#1260468)
- commit d1f8b24

- wifi: mac80211: fix NULL deref in mesh_matches_local() (CVE-2026-23396 bsc#1260729)
- commit 53cbe8a

- btrfs: fix transaction abort when snapshotting received
  subvolumes (CVE-2026-43361 bsc#1264722).
- commit cf9f0ed

- RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852 bsc#1266711)
- commit 8ec6a57

- nfc: llcp: add missing return after LLCP_CLOSED checks (CVE-2026-31629 bsc#1263790)
- commit 79d2353

- smb: client: Don't log plaintext credentials in cifs_set_cifscreds (CVE-2026-23303 bsc#1260502)
- commit 0889025

- team: avoid NETDEV_CHANGEMTU event when unregistering slave
  (CVE-2026-43234 bsc#1264409).
- commit 4afd4ae

- HID: magicmouse: Do not crash on missing msc->input (CVE-2026-43140 bsc#1264630)
- commit d7d6327

- RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043 bsc#1266901)
- commit f743cca

- packaging: Replace compute-PATCHVERSION with python implementation
  This script is copied by kkspec to the package directory and called from
  there. That means that libraries from kernel-source cannot be loaded,
  and that's the reason why the script is appended to the library that is
  most useful for it. compute-PATCHVERSION and mkspec are no longer
  shipped in rpm packages which means compute-PATCHVERSION could be folded
  into mkspec, and that in turn into tar-up. However, these are all
  written in different languages.
- commit de458e0

- bcache: fix uninitialized closure object (git-fixes).
- bcache: fix cached_dev.sb_bio use-after-free and crash
  (CVE-2026-3150 bsc#1263169).
- scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()
  (CVE-2026-31464 bsc#1262656).
- scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414
  bsc#1264669).
- commit 6ee47dc

- Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020
  bsc#1264006).
- commit 27b72bf

- slip: bound decode() reads against the compressed packet length
  (CVE-2026-45843 bsc#1266395).
- commit b03c861

- s390/ctcm: Fix double-kfree (CVE-2025-40253 bsc#1255084).
- commit 8f92322

- wifi: mac80211: always free skb on ieee80211_tx_prepare_skb()
  failure (CVE-2026-23444 bsc#1266307).
- commit 0442e2c

- Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite
  loop (CVE-2026-31498 bsc#1262751).
- commit 4910d82

- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()
  (CVE-2026-43206 bsc#1264551).
- commit 5933e85

- rtmutex: Use waiter::task instead of current in remove_waiter()
  (bsc#1266001 CVE-2026-43499).
- commit 56d8801

- Improve compatibility with awk 2.4.0 (bsc#1266214)
  This was meant to match the literal '+', so it needs to be backslashed
  not a repetition of the '^' symbol.
- commit fbbce3e

- blacklist.conf: add CVE-2026-31519
- Delete
  patches.suse/btrfs-set-BTRFS_ROOT_ORPHAN_CLEANUP-during-subvol-create.patch.
  The infrastructure in SLE12-SP5 kernel is very different from the
  upstream, which will cause false alerts during send:
  https://bugzilla.suse.com/show_bug.cgi?id=1266367
- commit d190c43

- smb: client: reject userspace cifs.spnego descriptions
  (bsc#1266238).
- commit 0358ad3

- wifi: mac80211: check tdls flag in ieee80211_tdls_oper
  (CVE-2026-43052 bsc#1263945).
- commit f4ac921

- KVM: SEV: Drop WARN on large size for
  KVM_MEMORY_ENCRYPT_REG_REGION (CVE-2026-31590 bsc#1263152).
- commit de4bae7

- openvswitch: vport: fix self-deadlock on release of tunnel ports
  (CVE-2026-31678 bsc#1263562).
- net/sched: cls_fw: fix NULL dereference of "old" filters before
  change() (git-fixes).
- commit 5399dc1

- compute-PATCHVERSION: Do not append .. to default patch directories
  All the callers are either using . or a specific patch directory.
  If a caller really needs to load patches from .. it should be passed as
  parameter.
- commit d383394

- compute-PATCHVERSION: Remove unpack logic
  This used to be needed when compute-PATCHVERSION was shipped as part of
  the rpm package where unpacked patches are not available.
  It is not done annymore, and the unpackinng is not needed.
- commit 9a8fa0e

- ipv6: avoid overflows in ip6_datagram_send_ctl() (CVE-2026-31415
  bsc#1262099).
- net/sched: cls_fw: fix NULL pointer dereference on shared blocks
  (CVE-2026-31421 bsc#1262061).
- ip6_tunnel: clear skb2->cb in ip4ip6_err() (CVE-2026-43037
  bsc#1263995).
- af_key: validate families in pfkey_send_migrate() (CVE-2026-31515
  bsc#1262752).
- openvswitch: defer tunnel netdev_put to RCU release
  (CVE-2026-31678 bsc#1263562).
- commit 7ed179d

- packaging: Rip out extra symbols support
  Extra symbols are not supported for a long time.
  The oldest branch we maintain is SLE 11 SP1 and it does not use patch
  guards to select patches.
- commit 7b3d5b0

- ALSA: caiaq: fix stack out-of-bounds read in init_card
  (CVE-2026-31778 bsc#1263923).
- commit c06f4a6

- Refresh patches.suse/ALSA-pcm-fix-use-after-free-on-linked-stream-runtime.patch
  Fix the incorrect backport that overlooked the usage of runtime->rate.
- commit fa06069

- net: skbuff: propagate shared-frag marker through frag-transfer
  helpers (CVE-2026-43503 bsc#1265960).
- net: skbuff: preserve shared-frag marker during coalescing
  (CVE-2026-46300 bsc#1265209).
- commit b20d602

- Revert "net: skbuff: propagate shared-frag marker through pskb_copy()"
  This reverts commit 7b5cf8f48d8bb2b991b3ac698cf6e4f740e96440.
- commit 193d08f

- packaging: compute-PATCHVERSION.sh -> compute-PATCHVERSION
- commit fc624df

- perf: Fix __perf_event_overflow() vs perf_remove_from_context()
  race (bsc#1260018 CVE-2026-23271).
- commit fbf4763

- kernel-binary: Only apply vmlinux workaround on SLE15 and later
  To create debuginfo for vmlinux the file needs to be present even if
  it's not packaged because a compressed file is packaged insteand.
  To accomplish that the file is marked as ghost in the file list. Then
  rpm does not complain that the file exists but does not package it.
  However, rpm still reserves space for ghost files when installing a
  package. To avoid reserving space for a file that is not used the file
  is truncated.
  That works on SLE 15 but on SLE 12 rpm then fails packaging the
  debuginfo complaiing that extra debuginfo files are present. Limit the
  workaround to SLE 15 and later.
  Fixes: 222edac2a18 (kernel-binary: prevent uncompressed vmlinux from inflating rpm size requirements)
- commit 1ef7451

- Kernel-binary: Do not truncate vmlinux when it's the boot image
  Some architectures use vmlinux to boot. Truncating vmlinux on those
  architectures causes signing failure during build. Also if the signing
  was disabled a brokne kernel would be produced.
  Fixes: 222edac2a18 (kernel-binary: prevent uncompressed vmlinux from inflating rpm size requirements)
- commit d3cf603

- kernel-binary: prevent uncompressed vmlinux from inflating rpm size requirements
  define %__spec_install_post to truncate the uncompressed vmlinux
  to 0 bytes after find-debuginfo.sh and brp-* scripts run. This prevents
  rpmbuild from baking the %ghost file size into the FILESIZES
  header, which can cause installation failures on smaller /boot partitions.
  Fixes: bsc#1265456
- commit 222edac

- Update
  patches.kabi/ptrace-slightly-saner-get_dumpable-logic-kabi-assert.patch
  (bsc#1265308 CVE-2026-46333).
- Update
  patches.kabi/ptrace-slightly-saner-get_dumpable-logic-kabi.patch
  (bsc#1265308 CVE-2026-46333).
- Update
  patches.suse/ptrace-slightly-saner-get_dumpable-logic.patch
  (bsc#1265308 CVE-2026-46333).
  Add CVE reference.
- commit 21df793

- list: add "list_del_init_careful()" to go with
  "list_empty_careful()" (bsc#1262778).
- commit ec428ba

- blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function
  race (CVE-2024-50082 bsc#1232500 bsc#1262778).
- blacklist.conf: Remove e972b08b91ef from blacklist
- commit d3d6332

openssh

- Update patch to fix a possible information disclosure or denial
  of service due to uninitialized variables in gssapi patches
  (CVE-2026-3497, bsc#1259642) :
  * openssh-7.2p2-gssapi_key_exchange.patch

- Add patch to fix a potential issue when validating mac or ciphers
  (bsc#1264568):
  * fix-mac-validation-strsep-logic-bug.patch

- Improve %prep LDAP regex to preserve subdirectories (e.g., ope-
  nbsd-compat/) and handle optional [ab]/ prefixes.

- Added openssh-cve-2026-35385-scp-setuid-modes.patch
  (CVE-2026-35385, bsc#1261427), ensuring setuid bits default to
  being masked out by scp.
- Added openssh-cve-2026-35414-mishandled-ca-commas.patch
  (CVE-2026-35414, bsc#1261430), fixing mishandling of comma
  characters in CA in certain situations.

timezone

- Update to 2026b:
  * British Columbia moved to permanent -07 on 2026-03-09. (bsc#1264965)
  * Some more overflow bugs have been fixed in zic.
- Refresh revert-philippines-historical-data.patch

- Update to 2026a:
  * Moldova has used EU transition times since 2022.
  * The "right" TZif files are no longer installed by default.
  * -DTZ_RUNTIME_LEAPS=0 disables runtime support for leap seconds.
  * TZif files are no longer limited to 50 bytes of abbreviations.
  * zic is no longer limited to 50 leap seconds.
  * Several integer overflow bugs have been fixed.
- Changes from 2025c:
  * update Baja California DST rules in 1953, 1961-1975
  * An unset TZ is no longer invalid when /etc/localtime is
    missing, and is abbreviated "UTC" not "-00".  This reverts to
    2024b behavior
  * tzset etc. are now more cautious about questionable TZ settings.
  * tzset etc. now treat ' ' like '_' in time zone abbreviations
  * tzfree now preserves errno, consistently with POSIX.1-2024 ‘free’.
  * zic has new options inspired by FreeBSD.  ‘-D’ skips creation of
    output ancestor directories, ‘-m MODE’ sets output files’ mode,
    and ‘-u OWNER[:GROUP]’ sets output files’ owner and group.
  * multiple changes visible to developers
- Use "REDO=posix_right" to keep installing "right" TZif files.

avahi

- Add avahi-CVE-2026-34933.patch: refuse to accept publish flags
  where both wide_area and multicast are set.
  (CVE-2026-34933, bsc#1261546)

lifecycle-data-sle-live-patching

- Added data for 4_12_14-122_296. (bsc#1020320)

bind

- Security Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592, bind-9.11-CVE-2026-3592.patch]
  * Server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591, bind-9.11-CVE-2026-3039.patch]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594, bind-9.11-CVE-2026-5946.patch]

perl-HTTP-Daemon

- added patches
  CVE-2026-8450: HTTP:Daemon versions before 6.17 for Perl allow OS command injection via send_file() [bsc#1266370]
  * perl-HTTP-Daemon-CVE-2026-8450.patch

wicked

- Update to version 0.6.79
  - Fix an indirect remote shell command injection via unsanitized
    dhcp strings and leaseinfo dump (bsc#1265221,CVE-2026-44932):
  - Fix to escape single-quotes in leaseinfo dump output used by the
    `wicked test dhcp4` and `wicked test dhcp6` and written to the
    /run/wicked/leaseinfo.* files, e.g. to pass them to netconfig.
    A netconfig modify filtered for strict key='value' lines without
    any escaped quotes and discarded these lines already before.
  - Fix posix-tz-dbname and tz-string option processing checks to
    permit only valid characters according to RFC4833.
  - Discard string values containing single-quotes in other options.
  - Trigger to regenerate initrd that may contain wicked binaries on
    updates from wicked versions <= 0.6.78.

- Update to version 0.6.78
  - man: small fixes in wireless manpage (gh#opensuse/wicked#1053)
  - rtnetlink: fix RTM_NEWLINK name resolution in debug (gh#opensuse/wicked#1052)
  - Add support for IPVLAN/IPVTAP (jsc#PED-1942, gh#opensuse/wicked#1050, gh#opensuse/wicked#1051)
  - fsm: remove children reference array from worker (gh#opensuse/wicked#1049)
  - ifxml: migrate and generate lower configs/policies (gh#opensuse/wicked#1048)
  - fsm: use refcount and array macros in worker and policy (gh#opensuse/wicked#1047)
  - route: use refcounted array and fix error leaks (gh#opensuse/wicked#1046)
  - utils: add support for refcounted objects in generic array (gh#openSUSE/wicked#1045)

openssl-1_1

- Security fixes:
  * CVE-2026-42766: Possible NULL Dereference in Password-Based CMS
    Decryption (bsc#1266349)
  * CVE-2026-9076:  Out-of-Bounds Read in CMS Password-Based Decryption
    (bsc#1266341)
  * CVE-2026-7383:  Possible Heap Buffer Overflow in ASN.1 Multibyte String
    Conversion (bsc#1266340)
  * CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing
    (bsc#1266342)
  * CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357)
  * Add patches:
    openssl-CVE-2026-42766.patch openssl-CVE-2026-9076.patch
    openssl-CVE-2026-7383.patch openssl-CVE-2026-34180.patch
    openssl-CVE-2026-45447.patch

_product:sle-sdk-release

n/a

perl-XML-LibXML

- added patches
  CVE-2026-8177: versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte sequences [bsc#1264715]
  * perl-XML-LibXML-CVE-2026-8177.patch

openssl-1_0_0

- Security fixes:
  * CVE-2026-42766: Possible NULL Dereference in Password-Based CMS
    Decryption (bsc#1266349)
  * CVE-2026-9076:  Out-of-Bounds Read in CMS Password-Based Decryption
    (bsc#1266341)
  * CVE-2026-7383:  Possible Heap Buffer Overflow in ASN.1 Multibyte String
    Conversion (bsc#1266340)
  * CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing
    (bsc#1266342)
  * CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357)
  * Add patches:
    openssl-CVE-2026-42766.patch openssl-CVE-2026-9076.patch
    openssl-CVE-2026-7383.patch openssl-CVE-2026-34180.patch
    openssl-CVE-2026-45447.patch

mutt

- Add upstream commits as patches (boo#1264047)
  * boo1263892-ebfa2969.patch (boo#1263892 CVE-2026-43864)
  * boo1263893-fdc04a17.patch (boo#1263893 CVE-2026-43863)
  * boo1263894-f547a849.patch (boo#1263894 CVE-2026-43862)
  * boo1263895-12f54fe3.patch (boo#1263895 CVE-2026-43861)
  * boo1263896-834c5a2e.patch (boo#1263896 CVE-2026-43860,
    boo#1263897 CVE-2026-43859)

_product:sle-live-patching-release

n/a

samba

- CVE-2026-2340: vfs_worm does not block directory modification;
  (bso#15997); (bsc#1261158).

- CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
  (bso#16033); (bsc#1261161).
- CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
  (bsc#1261163).
- CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
  nbt server; (bso#16012); (bsc#1261160).

vim

- Update to v9.2.0530.
- Fix for SG#71948, bsc#1262395:
  * vim-9.1.1732-fix-inc-detection.patch: Fix for incorrectly detecting
    scientific parameter files as bitbake recipies.
- Upstream fixed the following bugs / CVEs:
  * bsc#1264706 CVE-2026-42307
  * bsc#1265360 CVE-2026-46483
  * bsc#1264708 CVE-2026-45130
  * bsc#1264707 CVE-2026-44656
  * bsc#1265349 CVE-2026-43961
- Changes:
  * 9.2.0530: WinBar row vertical separator not refreshed on window change
  * 9.2.0529: GTK4: clipboard returns empty after a foreign app takes the selection
  * 9.2.0528: possible overflow in XIM resource handling
  * 9.2.0527: Possible double free in fill_partial_and_closure()
  * 9.2.0526: missing out-of-memory check in ex_substitute()
  * 9.2.0525: spell: memory leak in spell_read_dic()
  * 9.2.0524: spell: buffer overflow with many affix or compound flags
  * 9.2.0523: tests: no test for using shellescape() in combination with :!
  * 9.2.0522: event_nr2name() in autocmd.c can be improved
  * 9.2.0521: GTK4: cannot resize shell after the window is shown
  * 9.2.0520: Reversed text opacity in popup when termguicolor is set
  * 9.2.0519: GTK4: GUI tabline is not displayed correctly
  * 9.2.0518: GTK4: input method cannot compose text
  * 9.2.0517: quickfix: can set quickfixtextfunc in restricted/sandbox mode
  * 9.2.0516: socketserver: spurious error when servername is taken
  * 9.2.0515: virtualedit=insert doesn't work during change operation
  * 9.2.0514: GTK4: build errors when socketserver is enabled
  * 9.2.0513: [security]: memory safety issues in spellfile.c
  * 9.2.0512: clientserver uses binary protocol
  * 9.2.0511: configure: when GTK4 is used also links in X11 libs
  * 9.2.0510: setline() mapping may trigger autoindent
  * 9.2.0509: term.c: compile error when LOG_TRN is enabled
  * 9.2.0508: completion: cannot complete user cmd :K with 'ignorecase'
  * 9.2.0507: Vim9 class: public/protected member name clash uses same error
  * 9.2.0506: home_replace() function can be improved
  * 9.2.0505: GTK4: text looks blurry on HiDPI displays
  * 9.2.0504: configure: requires X11 libraries for GTK4 build
  * 9.2.0503: Makefile: Missing dependencies for new GTK4 source files
  * 9.2.0502: runtime(netrw): bookmark handling can be improved
  * 9.2.0501: GTK4: there is no GTK4 UI available
  * 9.2.0500: filetype: some html files wrongly recognized as htmlangular
  * 9.2.0499: modeline: allow to disable modelines with modelinestrict
  * 9.2.0498: potential heap buffer overflow in if_xcmdsrv.c
  * 9.2.0497: Cannot jump to remote tags
  * 9.2.0496: [security]: Code Injection in cucumber filetype plugin
  * 9.2.0495: [security]: runtime(netrw): code injection via NetrwBookHistSave()
  * 9.2.0494: User commands cannot handle single args with spaces
  * 9.2.0493: popup: missing  Popup, PopupBorder and PopupTitle hi groups
  * 9.2.0492: popup: decoration wrongly drawn with clipping on border
  * 9.2.0491: VMS: various build issues
  * 9.2.0490: matchfuzzy() can crash on long multi-word patterns
  * 9.2.0489: filetype: some Objective-C files are not recognized
  * 9.2.0488: statusline: status line highlight blends into adjacent vsep cells
  * 9.2.0487: viminfo: possible signed int overflow in register array
  * 9.2.0486: out-of-bound read when recovering swap files
  * 9.2.0485: clipboard provider callback can be called recursively
  * 9.2.0484: TextPutPre triggers clipboard provider callback twice
  * 9.2.0483: popup: terminal embedded in an opacity popup freezes Vim on input
  * 9.2.0482: runtime(osc52): triggered twice with TextPutPoste autocmd
  * 9.2.0481: runtime(netrw): command injection possible via maps
  * 9.2.0480: [security]: runtime(netrw): code injection via mf command
  * 9.2.0479: [security]: runtime(tar): command injection in tar plugin
  * 9.2.0478: channel: redundant str/length assignments in channel_part_info()
  * 9.2.0477: popup: leftover content after popup_free under layout change
  * 9.2.0476: pattern completion leaks memory on alloc failures
  * 9.2.0475: runtime(netrw): bookmark paths not normalized
  * 9.2.0474: MS-Windows: hard to tell which Visual Studio version was selected with MSVC
  * 9.2.0473: Pasting ". register without autocommands breaks TextPut*
  * 9.2.0472: popup: column jitters when scrolled outside viewport
  * 9.2.0471: vimvars di_key initialized at runtime
  * 9.2.0470: No way to hook into put commands
  * 9.2.0469: popup: textprop-anchored popups bleed past host window edges
  * 9.2.0468: popups: not correctly updated from a CmdlineChanged autocommand
  * 9.2.0467: multi-line statusline loses highlighting attributes
  * 9.2.0466: popup: redraw can use stale blended cells
  * 9.2.0465: modeline: foldmarker cannot be set with modelinestrict
  * 9.2.0464: runtime(netrw): bookmarking directory uses current dir
  * 9.2.0463: Not able to use legacy expression evaluation in a vim9script maps
  * 9.2.0462: MS-Windows: workaround for assert error on GUI
  * 9.2.0461: Corrupted undofile causes use-after-free
  * 9.2.0460: did_set_shellpipe_redir() in wrong file
  * 9.2.0459: tests: test_termcodes fails (after v9.2.0456)
  * 9.2.0458: Crash with invalid shellredir/shellpipe value
  * 9.2.0457: Compile warning about unused variable
  * 9.2.0456: stray p character displayed on some terms
  * 9.2.0455: 'findfunc' only allows extra info for cmdline completion
  * 9.2.0454: tests: no test that "abbr" in customlist completion is shown
  * 9.2.0453: vertical separator of statusline blend into active statusline
  * 9.2.0452: screen.c popup opacity blend logic is duplicated
  * 9.2.0451: 'findfunc' can't return extra info for cmdline completion
  * 9.2.0450: [security]: heap buffer overflow in spellfile.c read_compound()
  * 9.2.0449: Make proto fails in non GTK builds
  * 9.2.0448: Vim9: dangling cmdline pointer after skip_expr_cctx()
  * 9.2.0447: cindent does not ignore comments
  * 9.2.0446: runtime(netrw): off-by-one bug in s:NetrwUnMarkFile()
  * 9.2.0445: win_fix_scroll() called before win_comp_pos() in command_height()
  * 9.2.0444: Cannot set 'path' option via modeline
  * 9.2.0443: GUI: cancelling save dialog overwrites or discards unnamed buffer
  * 9.2.0442: completion: i_CTRL-X_CTRL-V doesn't use dict from customlist
  * 9.2.0441: statusline: click handler not called on multi-line statusline
  * 9.2.0440: MS-Windows: cursor flicker during update_screen()
  * 9.2.0439: completion: info popup not removed in cmdline mode
  * 9.2.0438: tests: test_plugin_termdebug is flaky
  * 9.2.0437: MS-Windows: cursor flicker in vtp mode
  * 9.2.0436: Buffer overflow when parsing overlong errorformat lines
  * 9.2.0435: [security]: backticks in 'path' may cause shell execution on completion
  * 9.2.0434: cscope: filename interpreted by /bin/sh
  * 9.2.0433: customlist completion cannot supply pum metadata
  * 9.2.0432: blob to string conversion can be improved
  * 9.2.0431: blob encoding can be improved
  * 9.2.0430: tests: Test_shortmess_F3() is flaky on MS-Windows
  * 9.2.0429: tests: flaky screendump Test_smoothscroll_incsearch()
  * 9.2.0428: popup: no opacity support for completepopup/previewpopup
  * 9.2.0427: popup: opacity blend may leaks white bg color
  * 9.2.0426: tests: still some flaky screendump tests
  * 9.2.0425: Cannot silence undo/redo messages
  * 9.2.0424: popup: flicker when wildtrigger() refreshes the popup menu
  * 9.2.0423: popup: wrapped cmdline truncated with wildoptions=pum
  * 9.2.0422: popup: leave stray char when scrollbar changes
  * 9.2.0421: vimball: can smuggle Vimscript into VimballRecord file
  * 9.2.0420: channel: cannot handle binary data via channel callbacks
  * 9.2.0419: popup: rendering issues
  * 9.2.0418: wildcards in expanded env vars reinterpreted by glob
  * 9.2.0417: completion: no support for "noinsert" with 'wildmode'
  * 9.2.0416: Unix: filename completion splits at space for single-file Ex commands
  * 9.2.0415: Wrong behavior when executing register that ends in Insert mode
  * 9.2.0414: Flicker when drawing window separator and pum is shown
  * 9.2.0413: Scrolling wrong with 'splitkeep' when changing 'cmdheight'
  * 9.2.0412: channel: term_start() out_cb/err_cb no longer deliver raw chunks
  * 9.2.0411: tabpanel: no Vim script functions for the tabpanel
  * 9.2.0410: test suite races when run with parallel make
  * 9.2.0409: memory leaks in copy_substring_from_pos()
  * 9.2.0408: Insert-mode <Cmd> edits can corrupt undo
  * 9.2.0407: tabpanel: A few issues with the tabpanel
  * 9.2.0406: VisualNOS not used when Wayland selection ownership lost
  * 9.2.0405: when jumping to tags, will open URLs
  * 9.2.0404: redraw_listener_add() does not check secure flag
  * 9.2.0403: Vim9: def function sandbox bypass
  * 9.2.0402: pum: opacity not applied to wildmenu pum
  * 9.2.0401: tests: still a few flaky tests
  * 9.2.0400: sandbox callbacks selected through 'complete'
  * 9.2.0399: MS-Windows: compile warning in strptime.c

amazon-ssm-agent

- Update to version 3.3.4624.0
  * Bump golang.org/x/crypto from v0.51.0 to v0.52.0 (bsc#1266200, CVE-2026-39827,
    CVE-2026-39828, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833,
    CVE-2026-39834, CVE-2026-39835, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597,
    CVE-2026-46598)
  * Bump golang.org/x/net from v0.54.0 to v0.55.0
  * Enforce directory boundary in BuildSafePath
  * Fix visibility issue with Bottlerocket OS in document output
  * Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this
    also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)
- Drop CVE-2025-22869.patch, merged upstream
- Drop CVE-2025-22870.patch, merged upstream
- Drop CVE-2025-47913.patch, merged upstream
- Drop CVE-2026-25934.patch, merged upstream
- Drop CVE-2026-41506.patch, merged upstream

- Update to version 3.3.4515.0
  * Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)
  * Quit if sysprep failed and log its current state
  * Remove attached legacy cloudwatch plugin packages
  * Upgrade Go version to 1.25.10
  * Use BuildSafePath wherever it is applicable
- from version 3.3.4364.0
  * Add OOM killer protection to systemd service files
  * Apply more sanitation to file and registry inventory gatherers
  * Bump go-git to v5.17.1
  * Deprecate legacy cloudwatch plugin
  * Preserve network error details in credential refresher SSM API failures
  * Upgrade Go version to 1.25.9

- Add CVE-2026-25934.patch to fix improper verification of data integrity
  values for .pack and .idx files that can lead to the consumption of
  corrupted files (bsc#1258095, CVE-2026-25934)

- Add CVE-2025-22869.patch to fix Denial of Service in the Key
  Exchange of golang.org/x/crypto/ssh (bsc#1239342, CVE-2025-22869)

- Add CVE-2026-41506.patch to fix HTTP authentication credential
  leak when following redirects during smart-HTTP clone and fetch
  operations (bsc#1264952, CVE-2026-41506)

- Update to version 3.3.4268.0
  * Add SSM Distributor support for Bottlerocket OS
  * Implement flush credentials command in ssm-cli
  * Log ec2messages access denied as debug instead of error to reduce log noise
  * Make credential refresher refresh cache quickly in case of credential flush
  * Make Greengrass component registration resilient with retry

- Update to version 3.3.4177.0
  * Add EnforceWorkspaceRootOwnership configuration to support disable
    hardening of agent workspace
  * Add reboot comment to Windows shutdown command for SSM Agent traceability
  * Update privilege access check to verify ownership and permissions
    of document state files

- Update to version 3.3.4121.0
  * Add read-only version check prior to install and uninstall
    in case of occupied package manager locks
  * Add ANSI processing for CloudWatch and S3 log
  * Upgrade go-git to v5.17.0 and cloudflare/circl to v1.6.3
    to fix CVE-2026-1229
- Switch to systemd-tmpfiles to store runtime data (jsc#PED-14843)

- Update to version 3.3.4108.0
  * Disable Go 1.25 container-aware GOMAXPROCS to prevent holding
    cgroup file descriptors open
  * Upgrade Go version to 1.25.8
- from version 3.3.3883.0
  * Document CommandWorkerBufferLimit config
  * Include package update in Dockerfile
  * Reduce CloudWatch event message length threshold
  * Upgrade Go version to 1.25.7
  * Update github.com/go-git/go-git/v5 to 5.16.5 (bsc#1258095, CVE-2026-25934)
  * Update greengrass version
- from version 3.3.3797.0
  * Update Golang version to 1.24.12
  * Updating golang.org/x/crypto from v0.37.0 to v0.47.0, golang.org/x/net
    from v0.39.0 to v0.48.0 and golang.org/x/sys from v0.32.0 to v0.40.0
    (bsc#1253611, CVE-2025-47913)
  * Categorize integration tests by adding new tags to split fast and slow ones
  * Fix bug where IP field being empty string and causing UII API failure
- Drop CVE-2025-47913.patch, merged upstream
- Raise minimum Go version to 1.25.8 in BuildRequires

- Update to version 3.3.3598.0
  * Allow Patch execution to persist across reboots not registered to SSM Agent
- from version 3.3.3572.0
  * Fix ENV_VAR interpolation to work correctly with parameter store value
  * Implement immediate retries for failed reply messages to MGS for RunCommand documents
  * Improve ssm-cli get-diagnostics command log output
  * Support DomainJoin endpoint for EU sovereign cloud
  * Support dualstack S3 endpoint for distributor packages
  * Upgrade Go version to 1.24.11

python-pyOpenSSL

- CVE-2026-40475: improper input handling of null bytes can lead to
  silent data truncation and security-state inconsistency (bsc#1262803)
  * CVE-2026-40475.patch

rsync

- Added rsync-provide-xfer-sum-len.patch to support some hardening patches.
- Security update:
  - bsc#1234100, CVE-2024-12084: Heap Buffer Overflow in Checksum Parsing
  - bsc#1234101, CVE-2024-12085: Info Leak via uninitialized Stack contents defeats ASLR
  - bsc#1234102, CVE-2024-12086: server leaks arbitrary client files
  - bsc#1234103, CVE-2024-12087: server can make client write files outside of destination directory using symbolic links
  - bsc#1234104, CVE-2024-12088: --safe-links bypass
  - bsc#1235475, CVE-2024-12747: Race Condition in rsync Handling Symbolic Links
  - bsc#1254441, CVE-2025-10158: Out of bounds array access via negative index
  - bsc#1262223, CVE-2026-41035: Count of entries mismatch can lead to a use-after-free
  - bsc#1264511, CVE-2026-29518: Symlink-Race TOCTOU in Daemon (use chroot = no)
  - bsc#1264515, CVE-2026-43617: Authorization Bypass via Hostname Resolution
  - bsc#1264512, CVE-2026-43618: Integer Overflow Information Disclosure
  - bsc#1264513, CVE-2026-43620: Out-of-Bounds Array Read via recv_files()
  - bsc#1265296, CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing
- With the big security update above-mentioned, we received a big amount of harderning
  patches that are pre-requisitoes that we added to this version:
  - rsync-hardening-0001-Fix-warning-about-conflicting-lseek-lseek64-prototyp.patch
  - rsync-hardening-0002-hlink-Fix-function-pointer-cast-in-qsort.patch
  - rsync-hardening-0003-bool-is-a-keyword-in-C23.patch
  - rsync-hardening-0005-CVE-2024-12084-Some-checksum-buffer-fixes.patch
    (replaces: rsync-CVE-2024-12084-overflow-01.patch)
  - rsync-hardening-0006-CVE-2024-12084-Another-cast-when-multiplying-integers.patch
    (replaces: rsync-CVE-2024-12084-overflow-02.patch)
  - rsync-hardening-0007-CVE-2024-12085-prevent-information-leak-off-the-stack.patch
    (replaces: rsync-CVE-2024-12085.patch)
  - rsync-hardening-0008-CVE-2024-12086-refuse-fuzzy-options-when-fuzzy-not-selected.patch
    (replaces: rsync-CVE-2024-12086_01.patch)
  - rsync-hardening-0009-added-secure_relative_open.patch
    (replaces: rsync-CVE-2024-12086_02.patch)
  - rsync-hardening-0010-receiver-use-secure_relative_open-for-basis-file.patch
    (replaces: rsync-CVE-2024-12086_03.patch)
  - rsync-hardening-0011-disallow-.-elements-in-relpath-for-secure_relative_o.patch
    (replaces: rsync-CVE-2024-12086_04.patch)
  - rsync-hardening-0012-CVE-2024-12087-Refuse-a-duplicate-dirlist.patch
    (replaces: rsync-CVE-2024-12087_01.patch)
  - rsync-hardening-0013-CVE-2024-12087-range-check-dir_ndx-before-use.patch
    (replaces:: rsync-CVE-2024-12087_02.patch)
  - rsync-hardening-0014-CVE-2024-12088-make-safe-links-stricter.patch
    (replaces: rsync-CVE-2024-12088.patch)
  - rsync-hardening-0015-CVE-2024-12747-fixed-symlink-race-condition-in-sender.patch
    (replaces: rsync-CVE-2024-12747.patch)
  - rsync-hardening-0017-options.c-Fix-segv-if-poptGetContext-returns-NULL.patch
  - rsync-hardening-0018-Using-a-correct-time-in-log-file.patch
  - rsync-hardening-0019-configure.ac-check-for-xattr-support-both-in-libc-an.patch
    (replaces: rsync-no-libattr.patch)
  - rsync-hardening-0020-util-fixed-issue-in-clean_fname.patch
  - rsync-hardening-0021-testsuite-added-clean-fname-underflow-test.patch
  - rsync-hardening-0022-CVE-2025-10158-fixed-an-invalid-access-to-files-array.patch
    (replaces: rsync-CVE-2025-10158.patch)
  - rsync-hardening-0023-fix-uninitialized-buf1-in-get_checksum2-MD4-path.patch
  - rsync-hardening-0024-reject-negative-token-values-in-compressed-stream-re.patch
  - rsync-hardening-0025-acl-fixed-ACL-ID-mapping-for-non-root.patch
  - rsync-hardening-0030-zero-all-new-memory-from-allocations.patch
  - rsync-hardening-0031-CVE-2026-41035-xattrs-fixed-count-in-qsort.patch
  - rsync-hardening-0032-call-tzset-before-chroot-to-cache-timezone-data.patch
  - rsync-hardening-0033-testsuite-xattrs-ignore-SUNWattr_-in-the-Solaris-xls.patch
  - rsync-hardening-0044-CVE-2026-43618-token-harden-compressed-token-decoding-against-integ.patch
  - rsync-hardening-0045-CVE-2026-43618-testsuite-cover-refuse-options-compress-for-the-daem.patch
  - rsync-hardening-0046-CVE-2026-43620-receiver-add-parent_ndx-0-guard-mirroring-797e17f.patch
  - rsync-hardening-0047-CVE-2026-43617-clientserver-fix-hostname-ACL-bypass-when-using-daem.patch
  - rsync-hardening-0048-CVE-2026-43618-defence-in-depth-bound-wire-supplied-counts-and-leng.patch
  - rsync-hardening-0049-CVE-2026-43618-defence-in-depth-guard-cumulative-snprintf-against-l.patch
  - rsync-hardening-0050-CVE-2026-43620-defence-in-depth-receiver-block-index-bounds-read_de.patch
  - rsync-hardening-0052-exclude-fix-crashes-with-fortified-strlcpy.patch
    (replaces: rsync-fortified-strlcpy-fix.patch)
  - rsync-hardening-0053-testsuite-use-integer-sleep-in-clean-fname-underflow.patch
  - rsync-hardening-0055-popt-fix-poptDupArgv-strlcpy-size-argument.patch
  - rsync-hardening-0056-testsuite-fixes-for-3.2.7-backport.patch
  - rsync-hardening-0057-rsync.h-lower-MAX_WIRE_DEL_STAT-to-avoid-signed-int-.patch
  - rsync-hardening-0058-CVE-2026-45232-socket-reject-over-long-proxy-response-line.patch
  - rsync-hardening-0059-main-reject-hyphen-prefixed-remote-shell-hostnames.patch
  - rsync-hardening-0060-util1-handle-out-of-range-times-in-timestring.patch
- A few hardening patches were discarded, as the don't affect SUSE distributions:
  - rsync-hardening-0028-zlib-convert-K-R-function-definitions-to-ANSI-style
    (we don't bundle zlib, nothing to patch)
  - rsync-hardening-0051-CI-added-workflows-from-master-for-backport-testing
    (fixes CI Github Actions, not present in release tarballs)
  - rsync-hardening-0054-ci-update-RSYNC_EXPECT_SKIPPED-for-3.2.7-backport-ba
    (fixes CI Github Actions, not present in release tarballs)
  - rsync-hardening-0016-syscall-fix-a-Y2038-bug-by-replacing-Int32x32To64-wi
    (following only affects cygwin and 3.1.3 does not ship the code it fixes)
- All other patches are pending backport.
- Rename rsync-fix-FLAG_GOT_DIR_FLIST.patch to rsync-fix-duplicate.patch to align codestreams.

- Security update (CVE-2026-41035, bsc#1262223): rsync: count of
  entries mismatch can lead to a use-after-free
  - Add rsync-CVE-2026-41035.patch

glibc

- ungetwc-byte-stream.patch: libio: Fix ungetwc operating on byte stream
  (CVE-2026-5928, bsc#1262464, BZ #33998)
- scanf-mc-buffer-overflow.patch: stdio-common: Fix buffer overflow in
  scanf %mc (CVE-2026-5450, bsc#1262465, BZ #34008)

- ibm139x-pending-char-state.patch: Use pending character state in
  IBM1390, IBM1399 character sets (CVE-2026-4046, bsc#1261206, BZ #33980)

xz

- Fix buffer overflow in lzma_index_append (bsc#1261280, CVE-2026-34743)
  * CVE-2026-34743.patch

gnutls

- Fix bsc#1263704 / CVE-2026-33845.
- Fix bsc#1263705 / CVE-2026-33846.
- Add patch files:
  * gnutls-CVE-2026-33845.patch
  * gnutls-CVE-2026-33846.patch

- Apply "gnutls-CVE-2026-42009.patch" to ensure that packets have
  differing sequence numbers. Without this check, received DTLS
  packets with duplicate sequence numbers could lead to unstable
  ordering or undefined behaviour. [CVE-2026-42009, bsc#1263708]

xen

- bsc#1264066 - VUL-0: CVE-2025-54518: xen: AMD-SN-7052: CPU OP
  Cache Corruption
  xsa490-1.patch
  xsa490-2.patch

- bsc#1262428 - VUL-0: CVE-2025-54505: xen: Floating Point Divider
  State Sampling on AMD CPUs AMD-SN-7053 (XSA-488)
  xsa488.patch

- bsc#1262178 - VUL-0: CVE-2026-23557: xen: Xenstored DoS via
  XS_RESET_WATCHES command (XSA-484)
  xsa484.patch
- bsc#1262180 - VUL-0: CVE-2026-23558: xen: grant table v2 race in
  status page mapping (XSA-486)
  xsa486.patch

python-urllib3

- CVE-2026-44431: sensitive information disclosure due to sensitive
  headers being forwarded across origins in proxied low-level redirects
  (bsc#1265267)
  Add patch CVE-2026-44431.patch