- glibc
-
- ungetwc-byte-stream.patch: libio: Fix ungetwc operating on byte stream
(CVE-2026-5928, bsc#1262464, BZ #33998)
- scanf-mc-buffer-overflow.patch: stdio-common: Fix buffer overflow in
scanf %mc (CVE-2026-5450, bsc#1262465, BZ #34008)
- ibm139x-pending-char-state.patch: Use pending character state in
IBM1390, IBM1399 character sets (CVE-2026-4046, bsc#1261206, BZ #33980)
- kernel-default
-
- kernel-binary: Only apply vmlinux workaround on SLE15 and later
To create debuginfo for vmlinux the file needs to be present even if
it's not packaged because a compressed file is packaged insteand.
To accomplish that the file is marked as ghost in the file list. Then
rpm does not complain that the file exists but does not package it.
However, rpm still reserves space for ghost files when installing a
package. To avoid reserving space for a file that is not used the file
is truncated.
That works on SLE 15 but on SLE 12 rpm then fails packaging the
debuginfo complaiing that extra debuginfo files are present. Limit the
workaround to SLE 15 and later.
Fixes: 222edac2a18 (kernel-binary: prevent uncompressed vmlinux from inflating rpm size requirements)
- commit 1ef7451
- scsi: target: iscsi: validate CHAP_R length before base64 decode
(bsc#1265449).
- commit 9997c88
- net: mana: Fix crash from unvalidated SHM offset read from BAR0 during FLR (bsc#1265846).
- net: mana: remove double CQ cleanup in mana_create_rxq error path (git-fixes).
- net: mana: Skip WQ object destruction for uninitialized RXQ (git-fixes).
- net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() (git-fixes).
- RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() (git-fixes).
- RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() (git-fixes).
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (git-fixes).
- RDMA/mana: Validate rx_hash_key_len (git-fixes).
- hv_sock: fix ARM64 support (git-fixes).
- commit 18c2af9
- Kernel-binary: Do not truncate vmlinux when it's the boot image
Some architectures use vmlinux to boot. Truncating vmlinux on those
architectures causes signing failure during build. Also if the signing
was disabled a brokne kernel would be produced.
Fixes: 222edac2a18 (kernel-binary: prevent uncompressed vmlinux from inflating rpm size requirements)
- commit d3cf603
- perf: Fix __perf_event_overflow() vs perf_remove_from_context()
race (bsc#1260018 CVE-2026-23271).
- commit d05430f
- kernel-binary: prevent uncompressed vmlinux from inflating rpm size requirements
define %__spec_install_post to truncate the uncompressed vmlinux
to 0 bytes after find-debuginfo.sh and brp-* scripts run. This prevents
rpmbuild from baking the %ghost file size into the FILESIZES
header, which can cause installation failures on smaller /boot partitions.
Fixes: bsc#1265456
- commit 222edac
- net/rds: reset op_nents when zerocopy page pin fails
(bsc#1265626, CVE-2026-43494).
- net/rds: reset op_nents when zerocopy page pin fails
(bsc#1265626).
- commit b66d9fc
- perf: Make sure to use pmu_ctx->pmu for groups (bsc#1263001
CVE-2026-31528).
- commit 2f72854
- net/sched: fix pedit partial COW leading to page cache corruption
(bsc#1265421).
- commit a756c69
- RDMA/irdma: Fix double free related to rereg_user_mr (CVE-2026-43120)
- commit c514796
- gnutls
-
- Security fixes:
* CVE-2026-33846: buffers: add more checks to DTLS reassembly (bsc#1263705)
* CVE-2026-42009: lib/buffers: ensure packets have differing sequence numbers (bsc#1263708)
* CVE-2026-33845: buffers: switch from end_offset over to frag_length (bsc#1263704)
* CVE-2026-42010: lib/auth/rsa_psk: fix binary PSK identity lookup (bsc#1263709)
* CVE-2026-3833: x509/name-constraints: compare domain names case-insensitive (bsc#1263707)
* CVE-2026-42011: x509/name_constraints: fix intersecting empty constraints (bsc#1263710)
* CVE-2026-42012: x509/hostname-verify: make URI/SRV SAN preclude CN fallback (bsc#1263711)
* CVE-2026-42013: x509: prevent fallback on oversized SAN (bsc#1263712)
* CVE-2026-42014: pkcs11_write: fix UAF and leak in gnutls_pkcs11_token_set_pin (bsc#1263713)
* CVE-2026-42015: x509/pkcs12_bag: fix off-by-one in bag element bounds check (bsc#1263714)
* CVE-2026-5260: lib/pkcs11_privkey: guard against overreading on short ciphertexts (bsc#1263715)
* CVE-2026-5419: gnutls_cipher_decrypt3: make PKCS#7 unpadding branch free (bsc#1263716)
* Add patches:
gnutls-CVE-2026-33846.patch gnutls-CVE-2026-42009.patch
gnutls-CVE-2026-33845.patch gnutls-CVE-2026-42010.patch
gnutls-CVE-2026-3833.patch gnutls-CVE-2026-42011.patch
gnutls-CVE-2026-42012.patch gnutls-CVE-2026-42013.patch
gnutls-CVE-2026-42014.patch gnutls-CVE-2026-5260.patch
gnutls-CVE-2026-42015.patch gnutls-CVE-2026-5419.patch
- xz
-
- Fix buffer overflow in lzma_index_append (bsc#1261280, CVE-2026-34743)
* CVE-2026-34743.patch
- Change SUSE-Public-Domain license to LicenseRef-SUSE-Public-Domain to
fix rpmlint errors
- openssl-1_1
-
- bsc#1250782 Fix 30-test_fips_sli.t fails intermittently on s390x:
Fix AES_GCM IV test sometimes failing on s390x.
* Add openssl-fix-fips-slitest-s390x.patch
- python-urllib3
-
- CVE-2026-44431: sensitive information disclosure due to sensitive
headers being forwarded across origins in proxied low-level redirects
(bsc#1265267)
Add patch CVE-2026-44431.patch
- samba
-
- CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
(bso#16033); (bsc#1261161).
- CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
(bsc#1261163).
- CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
nbt server; (bso#16012); (bsc#1261160).
- CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
enrollment using http:// without validation;(bso#16003);
(bsc#1261159).
- CVE-2026-2340: vfs_worm does not block directory modification;
(bso#15997); (bsc#1261158).
- vim
-
- Update to v9.2.0530.
- Fix for SG#71948, bsc#1262395:
* vim-9.1.1732-fix-inc-detection.patch: Fix for incorrectly detecting
- Upstream fixed the following bugs / CVEs:
* bsc#1264706 CVE-2026-42307
* bsc#1265360 CVE-2026-46483
* bsc#1264708 CVE-2026-45130
* bsc#1264707 CVE-2026-44656
* bsc#1265349 CVE-2026-43961
- Changes:
* 9.2.0530: WinBar row vertical separator not refreshed on window change
* 9.2.0529: GTK4: clipboard returns empty after a foreign app takes the selection
* 9.2.0528: possible overflow in XIM resource handling
* 9.2.0527: Possible double free in fill_partial_and_closure()
* 9.2.0526: missing out-of-memory check in ex_substitute()
* 9.2.0525: spell: memory leak in spell_read_dic()
* 9.2.0524: spell: buffer overflow with many affix or compound flags
* 9.2.0523: tests: no test for using shellescape() in combination with :!
* 9.2.0522: event_nr2name() in autocmd.c can be improved
* 9.2.0521: GTK4: cannot resize shell after the window is shown
* 9.2.0520: Reversed text opacity in popup when termguicolor is set
* 9.2.0519: GTK4: GUI tabline is not displayed correctly
* 9.2.0518: GTK4: input method cannot compose text
* 9.2.0517: quickfix: can set quickfixtextfunc in restricted/sandbox mode
* 9.2.0516: socketserver: spurious error when servername is taken
* 9.2.0515: virtualedit=insert doesn't work during change operation
* 9.2.0514: GTK4: build errors when socketserver is enabled
* 9.2.0513: [security]: memory safety issues in spellfile.c
* 9.2.0512: clientserver uses binary protocol
* 9.2.0511: configure: when GTK4 is used also links in X11 libs
* 9.2.0510: setline() mapping may trigger autoindent
* 9.2.0509: term.c: compile error when LOG_TRN is enabled
* 9.2.0508: completion: cannot complete user cmd :K with 'ignorecase'
* 9.2.0507: Vim9 class: public/protected member name clash uses same error
* 9.2.0506: home_replace() function can be improved
* 9.2.0505: GTK4: text looks blurry on HiDPI displays
* 9.2.0504: configure: requires X11 libraries for GTK4 build
* 9.2.0503: Makefile: Missing dependencies for new GTK4 source files
* 9.2.0502: runtime(netrw): bookmark handling can be improved
* 9.2.0501: GTK4: there is no GTK4 UI available
* 9.2.0500: filetype: some html files wrongly recognized as htmlangular
* 9.2.0499: modeline: allow to disable modelines with modelinestrict
* 9.2.0498: potential heap buffer overflow in if_xcmdsrv.c
* 9.2.0497: Cannot jump to remote tags
* 9.2.0496: [security]: Code Injection in cucumber filetype plugin
* 9.2.0495: [security]: runtime(netrw): code injection via NetrwBookHistSave()
* 9.2.0494: User commands cannot handle single args with spaces
* 9.2.0493: popup: missing Popup, PopupBorder and PopupTitle hi groups
* 9.2.0492: popup: decoration wrongly drawn with clipping on border
* 9.2.0491: VMS: various build issues
* 9.2.0490: matchfuzzy() can crash on long multi-word patterns
* 9.2.0489: filetype: some Objective-C files are not recognized
* 9.2.0488: statusline: status line highlight blends into adjacent vsep cells
* 9.2.0487: viminfo: possible signed int overflow in register array
* 9.2.0486: out-of-bound read when recovering swap files
* 9.2.0485: clipboard provider callback can be called recursively
* 9.2.0484: TextPutPre triggers clipboard provider callback twice
* 9.2.0483: popup: terminal embedded in an opacity popup freezes Vim on input
* 9.2.0482: runtime(osc52): triggered twice with TextPutPoste autocmd
* 9.2.0481: runtime(netrw): command injection possible via maps
* 9.2.0480: [security]: runtime(netrw): code injection via mf command
* 9.2.0479: [security]: runtime(tar): command injection in tar plugin
* 9.2.0478: channel: redundant str/length assignments in channel_part_info()
* 9.2.0477: popup: leftover content after popup_free under layout change
* 9.2.0476: pattern completion leaks memory on alloc failures
* 9.2.0475: runtime(netrw): bookmark paths not normalized
* 9.2.0474: MS-Windows: hard to tell which Visual Studio version was selected with MSVC
* 9.2.0473: Pasting ". register without autocommands breaks TextPut*
* 9.2.0472: popup: column jitters when scrolled outside viewport
* 9.2.0471: vimvars di_key initialized at runtime
* 9.2.0470: No way to hook into put commands
* 9.2.0469: popup: textprop-anchored popups bleed past host window edges
* 9.2.0468: popups: not correctly updated from a CmdlineChanged autocommand
* 9.2.0467: multi-line statusline loses highlighting attributes
* 9.2.0466: popup: redraw can use stale blended cells
* 9.2.0465: modeline: foldmarker cannot be set with modelinestrict
* 9.2.0464: runtime(netrw): bookmarking directory uses current dir
* 9.2.0463: Not able to use legacy expression evaluation in a vim9script maps
* 9.2.0462: MS-Windows: workaround for assert error on GUI
* 9.2.0461: Corrupted undofile causes use-after-free
* 9.2.0460: did_set_shellpipe_redir() in wrong file
* 9.2.0459: tests: test_termcodes fails (after v9.2.0456)
* 9.2.0458: Crash with invalid shellredir/shellpipe value
* 9.2.0457: Compile warning about unused variable
* 9.2.0456: stray p character displayed on some terms
* 9.2.0455: 'findfunc' only allows extra info for cmdline completion
* 9.2.0454: tests: no test that "abbr" in customlist completion is shown
* 9.2.0453: vertical separator of statusline blend into active statusline
* 9.2.0452: screen.c popup opacity blend logic is duplicated
* 9.2.0451: 'findfunc' can't return extra info for cmdline completion
* 9.2.0450: [security]: heap buffer overflow in spellfile.c read_compound()
* 9.2.0449: Make proto fails in non GTK builds
* 9.2.0448: Vim9: dangling cmdline pointer after skip_expr_cctx()
* 9.2.0447: cindent does not ignore comments
* 9.2.0446: runtime(netrw): off-by-one bug in s:NetrwUnMarkFile()
* 9.2.0445: win_fix_scroll() called before win_comp_pos() in command_height()
* 9.2.0444: Cannot set 'path' option via modeline
* 9.2.0443: GUI: cancelling save dialog overwrites or discards unnamed buffer
* 9.2.0442: completion: i_CTRL-X_CTRL-V doesn't use dict from customlist
* 9.2.0441: statusline: click handler not called on multi-line statusline
* 9.2.0440: MS-Windows: cursor flicker during update_screen()
* 9.2.0439: completion: info popup not removed in cmdline mode
* 9.2.0438: tests: test_plugin_termdebug is flaky
* 9.2.0437: MS-Windows: cursor flicker in vtp mode
* 9.2.0436: Buffer overflow when parsing overlong errorformat lines
* 9.2.0435: [security]: backticks in 'path' may cause shell execution on completion
* 9.2.0434: cscope: filename interpreted by /bin/sh
* 9.2.0433: customlist completion cannot supply pum metadata
* 9.2.0432: blob to string conversion can be improved
* 9.2.0431: blob encoding can be improved
* 9.2.0430: tests: Test_shortmess_F3() is flaky on MS-Windows
* 9.2.0429: tests: flaky screendump Test_smoothscroll_incsearch()
* 9.2.0428: popup: no opacity support for completepopup/previewpopup
* 9.2.0427: popup: opacity blend may leaks white bg color
* 9.2.0426: tests: still some flaky screendump tests
* 9.2.0425: Cannot silence undo/redo messages
* 9.2.0424: popup: flicker when wildtrigger() refreshes the popup menu
* 9.2.0423: popup: wrapped cmdline truncated with wildoptions=pum
* 9.2.0422: popup: leave stray char when scrollbar changes
* 9.2.0421: vimball: can smuggle Vimscript into VimballRecord file
* 9.2.0420: channel: cannot handle binary data via channel callbacks
* 9.2.0419: popup: rendering issues
* 9.2.0418: wildcards in expanded env vars reinterpreted by glob
* 9.2.0417: completion: no support for "noinsert" with 'wildmode'
* 9.2.0416: Unix: filename completion splits at space for single-file Ex commands
* 9.2.0415: Wrong behavior when executing register that ends in Insert mode
* 9.2.0414: Flicker when drawing window separator and pum is shown
* 9.2.0413: Scrolling wrong with 'splitkeep' when changing 'cmdheight'
* 9.2.0412: channel: term_start() out_cb/err_cb no longer deliver raw chunks
* 9.2.0411: tabpanel: no Vim script functions for the tabpanel
* 9.2.0410: test suite races when run with parallel make
* 9.2.0409: memory leaks in copy_substring_from_pos()
* 9.2.0408: Insert-mode <Cmd> edits can corrupt undo
* 9.2.0407: tabpanel: A few issues with the tabpanel
* 9.2.0406: VisualNOS not used when Wayland selection ownership lost
* 9.2.0405: when jumping to tags, will open URLs
* 9.2.0404: redraw_listener_add() does not check secure flag
* 9.2.0403: Vim9: def function sandbox bypass
* 9.2.0402: pum: opacity not applied to wildmenu pum
* 9.2.0401: tests: still a few flaky tests
* 9.2.0400: sandbox callbacks selected through 'complete'
* 9.2.0399: MS-Windows: compile warning in strptime.c