suse-sle-micro-5-5-v20250724-x86_64-llc Package Source Changes

coreutils

- coreutils-9.7-sort-CVE-2025-5278.patch: Add upstream patch:
  sort with key character offsets of SIZE_MAX, could induce
  a read of 1 byte before an allocated heap buffer.
  (CVE-2025-5278, bsc#1243767)

docker

[ This update is a no-op, only needed to work around unfortunate automated
  packaging script behaviour on SLES. ]
- The following patches were removed in openSUSE in the Docker 28.1.1-ce
  update, but the patch names were later renamed in a SLES-only update before
  Docker 28.1.1-ce was submitted to SLES.
  This causes the SLES build scripts to refuse the update because the patches
  are not referenced in the changelog. There is no obvious place to put the
  patch removals (the 28.1.1-ce update removing the patches chronologically
  predates their renaming in SLES), so they are included here a dummy changelog
  entry to work around the issue.
  - 0007-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
  - 0008-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch

- Update to docker-buildx v0.25.0. Upstream changelog:
  <https://github.com/docker/buildx/releases/tag/v0.25.0>

- Do not try to inject SUSEConnect secrets when in Rootless Docker mode, as
  Docker does not have permission to access the host zypper credentials in this
  mode (and unprivileged users cannot disable the feature using
  /etc/docker/suse-secrets-enable.) bsc#1240150
  * 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
- Rebase patches:
  * 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
  * 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch

- Always clear SUSEConnect suse_* secrets when starting containers regardless
  of whether the daemon was built with SUSEConnect support. Not doing this
  causes containers from SUSEConnect-enabled daemons to fail to start when
  running with SUSEConnect-disabled (i.e. upstream) daemons.
  This was a long-standing issue with our secrets support but until recently
  this would've required migrating from SLE packages to openSUSE packages
  (which wasn't supported). However, as SLE Micro 6.x and SLES 16 will move
  away from in-built SUSEConnect support, this is now a practical issue users
  will run into. bsc#1244035
  + 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
- Rearrange patches:
  - 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  + 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  - 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  + 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch

[NOTE: This update was only ever released in SLES and Leap.]
- Always clear SUSEConnect suse_* secrets when starting containers regardless
  of whether the daemon was built with SUSEConnect support. Not doing this
  causes containers from SUSEConnect-enabled daemons to fail to start when
  running with SUSEConnect-disabled (i.e. upstream) daemons.
  This was a long-standing issue with our secrets support but until recently
  this would've required migrating from SLE packages to openSUSE packages
  (which wasn't supported). However, as SLE Micro 6.x and SLES 16 will move
  away from in-built SUSEConnect support, this is now a practical issue users
  will run into. bsc#1244035
  + 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
- Rearrange patches:
  - 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  + 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  - 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  + 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  - 0006-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
  + 0007-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
  - 0007-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch
  + 0008-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch

- Update to Docker 28.2.2-ce. See upstream changelog online at
  <https://github.com/moby/moby/releases/tag/v28.2.2>
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch

- Update to Docker 28.2.1-ce. See upstream changelog online at
  <https://docs.docker.com/engine/release-notes/28/#2820> bsc#1243833
  <https://github.com/moby/moby/releases/tag/v28.2.1>
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch

- Update to docker-buildx v0.24.0. Upstream changelog:
  <https://github.com/docker/buildx/releases/tag/v0.24.0>

- Update to Docker 28.1.1-ce. See upstream changelog online at
  <https://docs.docker.com/engine/release-notes/28/#2811> bsc#1242114
  Includes upstream fixes:
  - CVE-2025-22872 bsc#1241830
- Remove long-outdated build handling for deprecated and unsupported
  devicemapper and AUFS storage drivers. AUFS was removed in v24, and
  devicemapper was removed in v25.
  <https://docs.docker.com/engine/deprecated/#aufs-storage-driver>
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Remove upstreamed patches:
  - 0006-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
  - 0007-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch
  - cli-0001-docs-include-required-tools-in-source-tree.patch

- Update to docker-buildx v0.23.0. Upstream changelog:
  <https://github.com/docker/buildx/releases/tag/v0.23.0>

- Update to docker-buildx v0.22.0. Upstream changelog:
  <https://github.com/docker/buildx/releases/tag/v0.22.0>
  * Includes fixes for CVE-2025-0495. bsc#1239765

- Disable transparent SUSEConnect support for SLE-16. PED-12534
  When this patchset was first added in 2013 (and rewritten over the years),
  there was no upstream way to easily provide SLE customers with a way to build
  container images based on SLE using the host subscription. However, with
  docker-buildx you can now define secrets for builds (this is not entirely
  transparent, but we can easily document this new requirement for SLE-16).
  Users should use
    RUN --mount=type=secret,id=SCCcredentials zypper -n ...
  in their Dockerfiles, and
    docker buildx build --secret id=SCCcredentials,src=/etc/zypp/credentials.d/SCCcredentials,type=file .
  when doing their builds.
- Now that the only blocker for docker-buildx support was removed for SLE-16,
  enable docker-buildx for SLE-16 as well. PED-8905

transactional-update

- Build with PIE enabled [bsc#1239954]

glib2

- Add glib2-CVE-2025-4373.patch: carefully handle gssize parameters
  (bsc#1242844 CVE-2025-4373 glgo#GNOME/glib#3677).

iputils

- Security fix [bsc#1243772, CVE-2025-48964]
  * Fix  integer overflow in ping statistics via zero timestamp
  * Add iputils-CVE-2025-48964_01.patch
  * Add iputils-CVE-2025-48964_02.patch
  * Add iputils-CVE-2025-48964_03.patch
  * Add iputils-CVE-2025-48964_04.patch
  * Add iputils-CVE-2025-48964_regression.patch

kernel-default

- scsi: storvsc: Increase the timeouts to storvsc_timeout (bsc#1245455).
- scsi: storvsc: Don't report the host packet status as the hv status (git-fixes).
- commit 509c9eb

- KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest
  memory accesses (bsc#1242782 CVE-2025-23141).
- commit c01b303

- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
  (bsc#1245431).
- commit 5ac7828

- mm/hugetlb: unshare page tables during VMA split, not before
  (bsc#1245431).
- commit 16c03c2

- hugetlb: unshare some PMDs when splitting VMAs (bsc#1245431).
- commit 42d0bfa

- Update
  patches.suse/0081-drm-meson-Fix-refcount-leak-in-meson_encoder_hdmi_in.patch
  (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218
  jsc#PED-1220 jsc#PED-1222 jsc#PED-1223 jsc#PED-1225 jsc#PED-2849
  CVE-2022-50188 bsc#1244892).
- Update
  patches.suse/0155-drm-meson-encoder_cvbs-Fix-refcount-leak-in-meson_en.patch
  (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218
  jsc#PED-1220 jsc#PED-1222 jsc#PED-1223 jsc#PED-1225 jsc#PED-2849
  CVE-2022-50183 bsc#1244893).
- Update
  patches.suse/0156-drm-meson-encoder_hdmi-Fix-refcount-leak-in-meson_en.patch
  (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218
  jsc#PED-1220 jsc#PED-1222 jsc#PED-1223 jsc#PED-1225 jsc#PED-2849
  CVE-2022-50184 bsc#1244898).
- Update
  patches.suse/0365-drm-fb-helper-Fix-out-of-bounds-access.patch
  (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218
  jsc#PED-1220 jsc#PED-1222 jsc#PED-1223 jsc#PED-1225 jsc#PED-2849
  CVE-2022-50221 bsc#1244858).
- Update
  patches.suse/1392-drm-i915-ttm-don-t-leak-the-ccs-state.patch
  (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218
  jsc#PED-1220 jsc#PED-1222 jsc#PED-1223 jsc#PED-1225 jsc#PED-2849
  CVE-2022-50037 bsc#1244953).
- Update
  patches.suse/1454-drm-amd-pm-Fix-a-potential-gpu_metrics_table-memory-.patch
  (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218
  jsc#PED-1220 jsc#PED-1222 jsc#PED-1223 jsc#PED-1225 jsc#PED-2849
  CVE-2022-49971 bsc#1245070).
- Update
  patches.suse/1461-drm-amd-pm-add-missing-fini_xxxx-interfaces-for-some.patch
  (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218
  jsc#PED-1220 jsc#PED-1222 jsc#PED-1223 jsc#PED-1225 jsc#PED-2849
  CVE-2022-49965 bsc#1245063).
- Update
  patches.suse/1496-drm-amdgpu-Fix-use-after-free-on-amdgpu_bo_list-mute.patch
  (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218
  jsc#PED-1220 jsc#PED-1222 jsc#PED-1223 jsc#PED-1225 jsc#PED-2849
  CVE-2022-50035 bsc#1244955).
- Update patches.suse/1535-drm-i915-ttm-fix-CCS-handling.patch
  (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218
  jsc#PED-1220 jsc#PED-1222 jsc#PED-1223 jsc#PED-1225 jsc#PED-2849
  CVE-2022-49963 bsc#1244914).
- Update
  patches.suse/1541-dma-buf-dma-resv-check-if-the-new-fence-is-really-la.patch
  (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218
  jsc#PED-1220 jsc#PED-1222 jsc#PED-1223 jsc#PED-1225 jsc#PED-2849
  CVE-2022-49935 bsc#1245052).
- Update
  patches.suse/ASoC-DPCM-Don-t-pick-up-BE-without-substream.patch
  (jsc#PED-850 CVE-2022-50049 bsc#1244973).
- Update
  patches.suse/ASoC-Intel-avs-Fix-potential-buffer-overflow-by-snpr.patch
  (jsc#PED-850 CVE-2022-50052 bsc#1245048).
- Update
  patches.suse/ASoC-SOF-Intel-cnl-Do-not-process-IPC-reply-before-f.patch
  (jsc#PED-850 CVE-2022-50016 bsc#1245340).
- Update
  patches.suse/ASoC-SOF-Intel-hda-Fix-potential-buffer-overflow-by-.patch
  (jsc#PED-850 CVE-2022-50050 bsc#1244987).
- Update
  patches.suse/ASoC-SOF-Intel-hda-ipc-Do-not-process-IPC-reply-befo.patch
  (jsc#PED-850 CVE-2022-50015 bsc#1245094).
- Update
  patches.suse/ASoC-SOF-ipc3-topology-Prevent-double-freeing-of-ipc.patch
  (jsc#PED-850 CVE-2022-50115 bsc#1244827).
- Update
  patches.suse/Bluetooth-Fix-race-condition-in-hci_cmd_sync_clear.patch
  (git-fixes CVE-2023-53046 bsc#1244180).
- Update
  patches.suse/Bluetooth-When-HCI-work-queue-is-drained-only-queue-.patch
  (jsc#PED-1407 CVE-2022-50166 bsc#1244772).
- Update
  patches.suse/RDMA-rxe-Fix-BUG-KASAN-null-ptr-deref-in-rxe_qp_do_c.patch
  (jsc#PED-1111 CVE-2022-50135 bsc#1244805).
- Update
  patches.suse/Revert-usb-typec-ucsi-add-a-common-function-ucsi_unr.patch
  (git-fixes CVE-2022-49944 bsc#1244905).
- Update
  patches.suse/USB-gadget-Fix-obscure-lockdep-violation-for-udc_mut.patch
  (git-fixes CVE-2022-49943 bsc#1244904).
- Update
  patches.suse/USB-gadget-Fix-use-after-free-Read-in-usb_udc_uevent.patch
  (git-fixes CVE-2022-49980 bsc#1245111).
- Update
  patches.suse/arm64-bpf-Add-BHB-mitigation-to-the-epilogue-for-cBP.patch
  (bsc#1242778 CVE-2025-37948 bsc#1243649).
- Update
  patches.suse/arm64-bpf-Only-mitigate-cBPF-programs-loaded-by-unpr.patch
  (bsc#1242778 CVE-2025-37963 bsc#1243660).
- Update
  patches.suse/ath11k-fix-missing-skb-drop-on-htc_tx_completion-err.patch
  (bsc#1206451 CVE-2022-50186 bsc#1244888).
- Update
  patches.suse/block-don-t-allow-the-same-type-rq_qos-add-more-than-once-14a6.patch
  (git-fixes CVE-2022-50086 bsc#1245116).
- Update
  patches.suse/firmware_loader-Fix-memory-leak-in-firmware-upload.patch
  (jsc#PED-1263 CVE-2022-49949 bsc#1244928).
- Update
  patches.suse/firmware_loader-Fix-use-after-free-during-unregister.patch
  (jsc#PED-1263 CVE-2022-49951 bsc#1244940).
- Update
  patches.suse/iavf-Fix-NULL-pointer-dereference-in-iavf_get_link_k.patch
  (jsc#PED-835 CVE-2022-50054 bsc#1245040).
- Update
  patches.suse/ice-Fix-call-trace-with-null-VSI-during-VF-reset.patch
  (jsc#PED-376 CVE-2022-50041 bsc#1244957).
- Update
  patches.suse/ice-xsk-prohibit-usage-of-non-balanced-queue-id.patch
  (jsc#PED-376 CVE-2022-50003 bsc#1245015).
- Update
  patches.suse/net-mlx5-LAG-fix-logic-over-MLX5_LAG_FLAG_NDEVS_READ.patch
  (jsc#PED-1549 CVE-2022-50002 bsc#1245023).
- Update
  patches.suse/net-qrtr-start-MHI-channel-after-endpoit-creation.patch
  (git-fixes CVE-2022-50044 bsc#1244961).
- Update
  patches.suse/powerpc-pseries-iommu-IOMMU-incorrectly-marks-MMIO-r.patch
  (bsc#1218470 ltc#204531 CVE-2024-57999 bsc#1238526).
- Update
  patches.suse/soundwire-revisit-driver-bind-unbind-and-callbacks.patch
  (jsc#PED-850 CVE-2022-50144 bsc#1244791).
- Update
  patches.suse/usb-xhci_plat_remove-avoid-NULL-dereference.patch
  (git-fixes CVE-2022-50133 bsc#1244806).
- Update
  patches.suse/vfio-Split-migration-ops-from-main-device-ops
  (bsc#1205701 CVE-2022-50117 bsc#1244826).
- Update
  patches.suse/xhci-Fix-null-pointer-dereference-in-remove-if-xHC-h.patch
  (git-fixes CVE-2022-49962 bsc#1244912).
- Update
  patches.suse/xsk-Fix-corrupted-packets-for-XDP_SHARED_UMEM.patch
  (git-fixes CVE-2022-49972 bsc#1244960).
- commit dbcd12d

- Update
  patches.suse/0012-dm-thin-fix-use-after-free-crash-in-dm_sm_register_t.patch
  (git-fixes CVE-2022-50092 bsc#1244848).
- Update
  patches.suse/0023-dm-raid-fix-address-sanitizer-warning-in-raid_status.patch
  (git-fixes CVE-2022-50084 bsc#1245117).
- Update
  patches.suse/0024-dm-raid-fix-address-sanitizer-warning-in-raid_resume.patch
  (git-fixes CVE-2022-50085 bsc#1245147).
- Update
  patches.suse/0027-drivers-md-fix-a-potential-use-after-free-bug.patch
  (git-fixes CVE-2022-50022 bsc#1245131).
- Update
  patches.suse/ALSA-bcd2000-Fix-a-UAF-bug-on-the-error-path-of-prob.patch
  (git-fixes CVE-2022-50229 bsc#1244856).
- Update
  patches.suse/ARM-OMAP2-Fix-refcount-leak-in-omap3xxx_prm_late_ini.patch
  (git-fixes CVE-2022-50198 bsc#1244872).
- Update
  patches.suse/ARM-OMAP2-Fix-refcount-leak-in-omapdss_init_of.patch
  (git-fixes CVE-2022-50199 bsc#1244873).
- Update
  patches.suse/ARM-OMAP2-display-Fix-refcount-leak-bug.patch
  (git-fixes CVE-2022-50203 bsc#1245189).
- Update
  patches.suse/ARM-OMAP2-pdata-quirks-Fix-refcount-leak-bug.patch
  (git-fixes CVE-2022-50204 bsc#1245191).
- Update
  patches.suse/ARM-bcm-Fix-refcount-leak-in-bcm_kona_smc_init.patch
  (git-fixes CVE-2022-50207 bsc#1244871).
- Update
  patches.suse/ASoC-SOF-debug-Fix-potential-buffer-overflow-by-snpr.patch
  (git-fixes CVE-2022-50051 bsc#1245041).
- Update
  patches.suse/ASoC-cros_ec_codec-Fix-refcount-leak-in-cros_ec_code.patch
  (git-fixes CVE-2022-50125 bsc#1244814).
- Update patches.suse/ASoC-mt6359-Fix-refcount-leak-bug.patch
  (git-fixes CVE-2022-50111 bsc#1244831).
- Update
  patches.suse/ASoC-mt6797-mt6351-Fix-refcount-leak-in-mt6797_mt635.patch
  (git-fixes CVE-2022-50124 bsc#1244816).
- Update
  patches.suse/HID-cp2112-prevent-a-buffer-overflow-in-cp2112_xfer.patch
  (git-fixes CVE-2022-50156 bsc#1244782).
- Update
  patches.suse/HID-hidraw-fix-memory-leak-in-hidraw_release.patch
  (git-fixes CVE-2022-49981 bsc#1245072).
- Update
  patches.suse/HID-mcp2221-prevent-a-buffer-overflow-in-mcp_smbus_w.patch
  (git-fixes CVE-2022-50131 bsc#1244807).
- Update
  patches.suse/HID-steam-Prevent-NULL-pointer-dereference-in-steam_.patch
  (git-fies CVE-2022-49984 bsc#1244950).
- Update
  patches.suse/Input-iforce-wake-up-after-clearing-IFORCE_XMIT_RUNN.patch
  (git-fixes CVE-2022-49954 bsc#1244976).
- Update
  patches.suse/KVM-SVM-Don-t-BUG-if-userspace-injects-an-interrupt-.patch
  (git-fixes CVE-2022-50228 bsc#1244854).
- Update
  patches.suse/NFSv4-pnfs-Fix-a-use-after-free-bug-in-open.patch
  (git-fixes CVE-2022-50072 bsc#1244979).
- Update
  patches.suse/NFSv4.2-fix-problems-with-__nfs42_ssc_open.patch
  (git-fixes CVE-2022-50006 bsc#1245018).
- Update
  patches.suse/PCI-dwc-Deallocate-EPC-memory-on-dw_pcie_ep_init-err.patch
  (git-fixes CVE-2022-50146 bsc#1244788).
- Update
  patches.suse/PCI-mediatek-gen3-Fix-refcount-leak-in-mtk_pcie_init.patch
  (git-fixes CVE-2022-50154 bsc#1244784).
- Update
  patches.suse/PCI-microchip-Fix-refcount-leak-in-mc_pcie_init_irq_.patch
  (git-fixes CVE-2022-50157 bsc#1244780).
- Update
  patches.suse/PM-hibernate-defer-device-probing-when-resuming-from.patch
  (git-fixes CVE-2022-50202 bsc#1245154).
- Update
  patches.suse/RDMA-hfi1-fix-potential-memory-leak-in-setup_base_ct.patch
  (git-fixes CVE-2022-50134 bsc#1244802).
- Update
  patches.suse/RDMA-irdma-Fix-a-window-for-use-after-free.patch
  (git-fixes CVE-2022-50137 bsc#1244800).
- Update
  patches.suse/RDMA-qedr-Fix-potential-memory-leak-in-__qedr_alloc_.patch
  (git-fixes CVE-2022-50138 bsc#1244797).
- Update
  patches.suse/RDMA-rxe-Fix-error-unwind-in-rxe_create_qp.patch
  (git-fixes CVE-2022-50127 bsc#1244815).
- Update
  patches.suse/RDMA-siw-Fix-duplicated-reported-IW_CM_EVENT_CONNECT.patch
  (git-fixes CVE-2022-50136 bsc#1244804).
- Update patches.suse/RDMA-srpt-Fix-a-use-after-free.patch
  (git-fixes CVE-2022-50129 bsc#1244811).
- Update
  patches.suse/USB-core-Prevent-nested-device-reset-calls.patch
  (git-fixes bsc#1206664 CVE-2022-4662 CVE-2022-49936
  bsc#1244984).
- Update
  patches.suse/apparmor-Fix-memleak-in-aa_simple_write_to_buffer.patch
  (git-fixes CVE-2022-50074 bsc#1244965).
- Update
  patches.suse/apparmor-fix-reference-count-leak-in-aa_pivotroot.patch
  (git-fixes CVE-2022-50077 bsc#1244977).
- Update
  patches.suse/arm64-cacheinfo-Fix-incorrect-assignment-of-signed-error-value-to-unsigned-fw_level.patch
  (git-fixes CVE-2022-49964 bsc#1245064).
- Update
  patches.suse/arm64-fix-oops-in-concurrently-setting-insn_emulatio.patch
  (git-fixes CVE-2022-50206 bsc#1245152).
- Update patches.suse/ath11k-fix-netdev-open-race.patch (git-fixes
  CVE-2022-50187 bsc#1244890).
- Update
  patches.suse/ath9k-fix-use-after-free-in-ath9k_hif_usb_rx_cb.patch
  (CVE-2022-1679 bsc#1199487 CVE-2022-50179 bsc#1244886).
- Update
  patches.suse/bpf-Adjust-insufficient-default-bpf_jit_limit.patch
  (bsc#1218234 git-fixes CVE-2023-53076 bsc#1242221).
- Update
  patches.suse/bpf-Don-t-use-tnum_range-on-array-range-checking-for.patch
  (bsc#1202564 bsc#1202860 CVE-2022-2905 CVE-2022-49985
  bsc#1244956).
- Update
  patches.suse/btrfs-fix-space-cache-corruption-and-potential-doubl.patch
  (bsc#1203361 CVE-2022-49999 bsc#1245019).
- Update
  patches.suse/btrfs-unset-reloc-control-if-transaction-commit-fail.patch
  (bsc#1212051 CVE-2023-3111 CVE-2022-50067 bsc#1245047).
- Update
  patches.suse/ceph-don-t-leak-snap_rwsem-in-handle_cap_grant.patch
  (bsc#1202823 CVE-2022-50059 bsc#1245031).
- Update
  patches.suse/cifs-Fix-memory-leak-on-the-deferred-close.patch
  (bsc#1193629 CVE-2022-50076 bsc#1244983).
- Update
  patches.suse/cifs-fix-small-mempool-leak-in-SMB2_negotiate-.patch
  (bsc#1193629 CVE-2022-49938 bsc#1244820).
- Update
  patches.suse/clk-bcm-rpi-Prevent-out-of-bounds-access.patch
  (git-fixes CVE-2022-49946 bsc#1244944).
- Update
  patches.suse/clk-qcom-ipq8074-dont-disable-gcc_sleep_clk_src.patch
  (git-fixes CVE-2022-50029 bsc#1245146).
- Update
  patches.suse/cpufreq-zynq-Fix-refcount-leak-in-zynq_get_revision.patch
  (git-fixes CVE-2022-50197 bsc#1244876).
- Update
  patches.suse/crypto-arm64-poly1305-fix-a-read-out-of-bound.patch
  (git-fixes CVE-2022-50231 bsc#1244853).
- Update
  patches.suse/crypto-ccp-Use-kzalloc-for-sev-ioctl-interfaces-to-p.patch
  (git-fixes CVE-2022-50226 bsc#1244860).
- Update
  patches.suse/crypto-hisilicon-sec-don-t-sleep-when-in-softirq.patch
  (git-fixes CVE-2022-50171 bsc#1244765).
- Update
  patches.suse/dmaengine-dw-axi-dmac-do-not-print-NULL-LLI-during-e.patch
  (git-fixes CVE-2022-50024 bsc#1245133).
- Update
  patches.suse/dmaengine-dw-axi-dmac-ignore-interrupt-if-no-descrip.patch
  (git-fixes CVE-2022-50023 bsc#1245134).
- Update
  patches.suse/dmaengine-sf-pdma-Add-multithread-support-for-a-DMA-.patch
  (git-fixes CVE-2022-50145 bsc#1244787).
- Update
  patches.suse/driver-core-fix-potential-deadlock-in-__driver_attac.patch
  (git-fixes CVE-2022-50149 bsc#1244883).
- Update
  patches.suse/drm-amd-display-Check-correct-bounds-for-stream-enco.patch
  (git-fixes CVE-2022-50079 bsc#1244970).
- Update
  patches.suse/drm-amd-display-clear-optc-underflow-before-turn-off.patch
  (git-fixes CVE-2022-49969 bsc#1245060).
- Update
  patches.suse/drm-amd-pm-add-missing-fini_microcode-interface-for-.patch
  (git-fixes CVE-2022-49966 bsc#1245062).
- Update patches.suse/drm-i915-fix-null-pointer-dereference.patch
  (git-fixes CVE-2022-49960 bsc#1244911).
- Update
  patches.suse/drm-mcde-Fix-refcount-leak-in-mcde_dsi_bind.patch
  (git-fixes CVE-2022-50176 bsc#1244902).
- Update
  patches.suse/drm-meson-Fix-refcount-bugs-in-meson_vpu_has_availab.patch
  (git-fixes CVE-2022-50038 bsc#1244943).
- Update
  patches.suse/drm-msm-mdp5-Fix-global-state-lock-backoff.patch
  (git-fixes CVE-2022-50173 bsc#1244992).
- Update
  patches.suse/drm-radeon-fix-potential-buffer-overflow-in-ni_set_m.patch
  (git-fixes CVE-2022-50185 bsc#1244887).
- Update
  patches.suse/drm-sun4i-dsi-Prevent-underflow-when-computing-packe.patch
  (git-fixes CVE-2022-50036 bsc#1244941).
- Update
  patches.suse/drm-ttm-Fix-dummy-res-NULL-ptr-deref-bug.patch
  (git-fixes CVE-2022-50068 bsc#1245142).
- Update
  patches.suse/ext4-add-EXT4_INODE_HAS_XATTR_SPACE-macro-in-xattr.h.patch
  (bsc#1206878 CVE-2022-50083 bsc#1244968).
- Update
  patches.suse/ext4-avoid-resizing-to-a-partial-cluster-size.patch
  (bsc#1206880 CVE-2022-50020 bsc#1245129).
- Update
  patches.suse/ext4-block-range-must-be-validated-before-use-in-ext.patch
  (bsc#1213090 CVE-2022-50021 bsc#1245180).
- Update
  patches.suse/fbdev-fb_pm2fb-Avoid-potential-divide-by-zero-error.patch
  (git-fixes CVE-2022-49978 bsc#1245195).
- Update
  patches.suse/firmware-arm_scpi-Ensure-scpi_info-is-not-assigned-i.patch
  (git-fixes CVE-2022-50087 bsc#1245119).
- Update
  patches.suse/ftrace-Fix-NULL-pointer-dereference-in-is_ftrace_trampoline-when-ftrace-is-dead.patch
  (git-fixes CVE-2022-49977 bsc#1244936).
- Update patches.suse/gadgetfs-ep_io-wait-until-IRQ-finishes.patch
  (git-fixes CVE-2022-50028 bsc#1245135).
- Update
  patches.suse/habanalabs-gaudi-fix-shift-out-of-bounds.patch
  (git-fixes CVE-2022-50026 bsc#1245088).
- Update
  patches.suse/hwmon-gpio-fan-Fix-array-out-of-bounds-access.patch
  (git-fixes CVE-2022-49945 bsc#1244908).
- Update patches.suse/iavf-Fix-adminq-error-handling.patch
  (git-fixes CVE-2022-50055 bsc#1245039).
- Update patches.suse/iavf-Fix-reset-error-handling.patch
  (git-fixes CVE-2022-50053 bsc#1245038).
- Update
  patches.suse/ieee802154-adf7242-defer-destroy_workqueue-call.patch
  (git-fixes CVE-2022-49968 bsc#1244959).
- Update
  patches.suse/iio-light-isl29028-Fix-the-warning-in-isl29028_remov.patch
  (git-fixes CVE-2022-50218 bsc#1244861).
- Update
  patches.suse/intel_th-Fix-a-resource-leak-in-an-error-handling-pa.patch
  (git-fixes CVE-2022-50143 bsc#1244790).
- Update patches.suse/intel_th-msu-Fix-vmalloced-buffers.patch
  (git-fixes CVE-2022-50142 bsc#1244796).
- Update
  patches.suse/iommu-vt-d-avoid-invalid-memory-access-via-node_online-NUMA_NO_N
  (git-fixes CVE-2022-50093 bsc#1244849).
- Update
  patches.suse/jbd2-fix-assertion-jh-b_frozen_data-NULL-failure-whe.patch
  (bsc#1202716 CVE-2022-50126 bsc#1244813).
- Update patches.suse/kcm-fix-strp_init-order-and-cleanup.patch
  (git-fies CVE-2022-49957 bsc#1244966).
- Update
  patches.suse/kprobes-don-t-call-disarm_kprobe-for-disabled-kprobes.patch
  (git-fixes CVE-2022-50008 bsc#1245009).
- Update
  patches.suse/loop-Check-for-overflow-while-configuring-loop.patch
  (git-fies CVE-2022-49993 bsc#1245121).
- Update patches.suse/md-call-__md_stop_writes-in-md_stop.patch
  (git-fixes CVE-2022-49987 bsc#1245024).
- Update patches.suse/md-raid10-fix-KASAN-warning.patch (git-fixes
  CVE-2022-50211 bsc#1245140).
- Update
  patches.suse/media-mceusb-Use-new-usb_control_msg_-routines.patch
  (CVE-2022-3903 bsc#1205220 CVE-2022-49937 bsc#1245057).
- Update
  patches.suse/media-pvrusb2-fix-memory-leak-in-pvr_probe.patch
  (git-fixes CVE-2022-49982 bsc#1245069).
- Update
  patches.suse/media-tw686x-Fix-memory-leak-in-tw686x_video_init.patch
  (git-fixes CVE-2022-50175 bsc#1244903).
- Update patches.suse/memstick-ms_block-Fix-a-memory-leak.patch
  (git-fixes CVE-2022-50140 bsc#1244793).
- Update
  patches.suse/meson-mx-socinfo-Fix-refcount-leak-in-meson_mx_socin.patch
  (git-fixes CVE-2022-50209 bsc#1244868).
- Update
  patches.suse/mfd-max77620-Fix-refcount-leak-in-max77620_initialis.patch
  (git-fixes CVE-2022-50108 bsc#1244834).
- Update
  patches.suse/misc-fastrpc-fix-memory-corruption-on-open.patch
  (git-fixes CVE-2022-49950 bsc#1244958).
- Update
  patches.suse/misc-fastrpc-fix-memory-corruption-on-probe.patch
  (git-fixes CVE-2022-49952 bsc#1244945).
- Update
  patches.suse/mmc-sdhci-of-esdhc-Fix-refcount-leak-in-esdhc_signal.patch
  (git-fixes CVE-2022-50141 bsc#1244794).
- Update
  patches.suse/mptcp-use-OPTION_MPTCP_MPJ_SYNACK-in-subflow_finish_.patch
  (CVE-2025-23145 bsc#1242596 CVE-2024-35840 bsc#1224597).
- Update
  patches.suse/msft-hv-2639-scsi-storvsc-Remove-WQ_MEM_RECLAIM-from-storvsc_erro.patch
  (git-fixes CVE-2022-49986 bsc#1244948).
- Update
  patches.suse/mt76-mt76x02u-fix-possible-memory-leak-in-__mt76x02u.patch
  (git-fixes CVE-2022-50172 bsc#1244764).
- Update
  patches.suse/mtd-maps-Fix-refcount-leak-in-ap_flash_init.patch
  (git-fixes CVE-2022-50160 bsc#1244776).
- Update
  patches.suse/mtd-maps-Fix-refcount-leak-in-of_flash_probe_versati.patch
  (git-fixes CVE-2022-50161 bsc#1244774).
- Update
  patches.suse/mtd-parsers-ofpart-Fix-refcount-leak-in-bcm4908_part.patch
  (git-fixes CVE-2022-50155 bsc#1244781).
- Update
  patches.suse/mtd-partitions-Fix-refcount-leak-in-parse_redboot_of.patch
  (git-fixes CVE-2022-50158 bsc#1244779).
- Update
  patches.suse/net-atlantic-fix-aq_vec-index-out-of-range-error.patch
  (git-fixes CVE-2022-50066 bsc#1244985).
- Update
  patches.suse/net-bgmac-Fix-a-BUG-triggered-by-wrong-bytes_compl.patch
  (git-fixes CVE-2022-50062 bsc#1245028).
- Update
  patches.suse/net-dsa-mv88e6060-prevent-crash-on-an-unused-port.patch
  (git-fixes CVE-2022-50047 bsc#1244993).
- Update
  patches.suse/net-dsa-sja1105-fix-buffer-overflow-in-sja1105_setup.patch
  (git-fixes CVE-2022-50040 bsc#1244949).
- Update
  patches.suse/net-sched-fix-netdevice-reference-leaks-in-attach_de.patch
  (git-fixes CVE-2022-49958 bsc#1244974).
- Update
  patches.suse/net-sunrpc-fix-potential-memory-leaks-in-rpc_sysfs_x.patch
  (git-fixes CVE-2022-50046 bsc#1244991).
- Update
  patches.suse/net-tap-NULL-pointer-derefence-in-dev_parse_header_p.patch
  (git-fixes CVE-2022-50073 bsc#1244978).
- Update
  patches.suse/netfilter-nf_tables-do-not-allow-CHAIN_ID-to-refer-t.patch
  (CVE-2022-2586 bsc#1202095 CVE-2022-50212 bsc#1244869).
- Update
  patches.suse/netfilter-nf_tables-do-not-allow-SET_ID-to-refer-to-.patch
  (CVE-2022-2586 bsc#1202095 CVE-2022-50213 bsc#1244867).
- Update
  patches.suse/nfc-pn533-Fix-use-after-free-bugs-caused-by-pn532_cm.patch
  (git-fixes CVE-2022-50005 bsc#1245011).
- Update
  patches.suse/octeontx2-af-Fix-mcam-entry-resource-leak.patch
  (git-fixes CVE-2022-50060 bsc#1245032).
- Update
  patches.suse/pinctrl-nomadik-Fix-refcount-leak-in-nmk_pinctrl_dt_.patch
  (git-fixes CVE-2022-50061 bsc#1245033).
- Update
  patches.suse/posix-cpu-timers-Cleanup-CPU-timers-before-freeing-t.patch
  (CVE-2022-2585 bsc#1202094 CVE-2022-50095 bsc#1244846).
- Update
  patches.suse/powerpc-64-Init-jump-labels-before-parse_early_param.patch
  (bsc#1065729 CVE-2022-50012 bsc#1245125).
- Update
  patches.suse/powerpc-iommu-fix-memory-leak-with-using-debugfs_loo.patch
  (bsc#1194869 CVE-2023-53097 bsc#1244114).
- Update patches.suse/powerpc-pci-Fix-get_phb_number-locking.patch
  (bsc#1065729 CVE-2022-50045 bsc#1244967).
- Update
  patches.suse/powerpc-perf-Optimize-clearing-the-pending-PMI-and-r.patch
  (bsc#1156395 CVE-2022-50118 bsc#1244825).
- Update
  patches.suse/powerpc-xive-Fix-refcount-leak-in-xive_get_max_prio.patch
  (fate#322438 git-fixess CVE-2022-50104 bsc#1244836).
- Update
  patches.suse/regulator-of-Fix-refcount-leak-bug-in-of_get_regulat.patch
  (git-fixes CVE-2022-50191 bsc#1244899).
- Update
  patches.suse/remoteproc-imx_rproc-Fix-refcount-leak-in-imx_rproc_.patch
  (git-fixes CVE-2022-50120 bsc#1244819).
- Update
  patches.suse/remoteproc-k3-r5-Fix-refcount-leak-in-k3_r5_cluster_.patch
  (git-fixes CVE-2022-50121 bsc#1244823).
- Update
  patches.suse/rpmsg-qcom_smd-Fix-refcount-leak-in-qcom_smd_parse_e.patch
  (git-fixes CVE-2022-50112 bsc#1244832).
- Update
  patches.suse/s390-fix-double-free-of-GS-and-RI-CBs-on-fork-failure
  (bsc#1203197 LTC#199895 CVE-2022-49990 bsc#1245006).
- Update patches.suse/sch_htb-make-htb_deactivate-idempotent.patch
  (CVE-2025-37798 bsc#1242414 CVE-2025-37953 bsc#1243543).
- Update
  patches.suse/sch_htb-make-htb_qlen_notify-idempotent.patch
  (CVE-2025-37798 bsc#1242414 CVE-2025-37932 bsc#1243627).
- Update
  patches.suse/sched-core-Do-not-requeue-task-on-CPU-excluded-from-cpus_mask.patch
  (bnc#1199356 CVE-2022-50100 bsc#1244843).
- Update
  patches.suse/sched-cpuset-Fix-dl_cpu_busy-panic-due-to-empty-cs-c.patch
  (git-fixes CVE-2022-50103 bsc#1244840).
- Update
  patches.suse/scsi-core-Fix-unremoved-procfs-host-directory-regression.patch
  (git-fixes CVE-2024-26935 bsc#1223675).
- Update
  patches.suse/scsi-iscsi-Fix-HW-conn-removal-use-after-free.patch
  (bsc#1198410 CVE-2022-50031 bsc#1245118).
- Update
  patches.suse/scsi-lpfc-Fix-possible-memory-leak-when-failing-to-i.patch
  (bsc#1201956 CVE-2022-50027 bsc#1245073).
- Update
  patches.suse/scsi-lpfc-Prevent-buffer-overflow-crashes-in-debugfs.patch
  (bsc#1201956 CVE-2022-50030 bsc#1245265).
- Update
  patches.suse/scsi-qla2xxx-fix-crash-due-to-stale-srb-access-around-i-o-timeouts.patch
  (bsc#1201160 CVE-2022-50098 bsc#1244841).
- Update
  patches.suse/scsi-sg-Allow-waiting-for-commands-to-complete-on-removed-device.patch
  (git-fixes CVE-2022-50215 bsc#1245138).
- Update
  patches.suse/selinux-Add-boundary-check-in-put_entry.patch
  (git-fixes CVE-2022-50200 bsc#1245149).
- Update
  patches.suse/selinux-fix-memleak-in-security_read_state_kernel.patch
  (git-fixes CVE-2022-50201 bsc#1245197).
- Update
  patches.suse/soc-amlogic-Fix-refcount-leak-in-meson-secure-pwrc.c.patch
  (git-fixes CVE-2022-50208 bsc#1244870).
- Update
  patches.suse/soc-qcom-aoss-Fix-refcount-leak-in-qmp_cooling_devic.patch
  (git-fixes CVE-2022-50194 bsc#1244878).
- Update
  patches.suse/soc-qcom-ocmem-Fix-refcount-leak-in-of_get_ocmem.patch
  (git-fixes CVE-2022-50196 bsc#1244875).
- Update
  patches.suse/spi-Fix-simplification-of-devm_spi_register_controll.patch
  (git-fixes CVE-2022-50190 bsc#1244895).
- Update
  patches.suse/spi-tegra20-slink-fix-UAF-in-tegra_slink_remove.patch
  (git-fixes CVE-2022-50192 bsc#1244879).
- Update
  patches.suse/spmi-trace-fix-stack-out-of-bound-access-in-SPMI-tracing-functions.patch
  (git-fixes CVE-2022-50094 bsc#1244851).
- Update
  patches.suse/staging-rtl8712-fix-use-after-free-bugs.patch
  (CVE-2022-4095 bsc#1205514 CVE-2022-49956 bsc#1244969).
- Update
  patches.suse/stmmac-intel-Add-a-missing-clk_disable_unprepare-cal.patch
  (git-fixes CVE-2022-50039 bsc#1244942).
- Update
  patches.suse/tty-n_gsm-add-sanity-check-for-gsm-receive-in-gsm_re.patch
  (git-fixes CVE-2022-49940 bsc#1244866).
- Update
  patches.suse/tty-n_gsm-fix-deadlock-and-link-starvation-in-outgoi.patch
  (git-fixes CVE-2022-50116 bsc#1244824).
- Update
  patches.suse/tty-serial-Fix-refcount-leak-bug-in-ucc_uart.c.patch
  (git-fixes CVE-2022-50019 bsc#1245098).
- Update
  patches.suse/tty-vt-initialize-unicode-screen-buffer.patch
  (git-fixes CVE-2022-50222 bsc#1245136).
- Update
  patches.suse/udmabuf-Set-the-DMA-mask-for-the-udmabuf-device-v2.patch
  (git-fixes CVE-2022-49983 bsc#1245092).
- Update
  patches.suse/usb-aspeed-vhub-Fix-refcount-leak-bug-in-ast_vhub_in.patch
  (git-fixes CVE-2022-50139 bsc#1244798).
- Update
  patches.suse/usb-cdns3-change-place-of-priv_ep-assignment-in-cdns.patch
  (git-fixes CVE-2022-50132 bsc#1244808).
- Update
  patches.suse/usb-cdns3-fix-random-warning-message-when-driver-loa.patch
  (git-fixes CVE-2022-50151 bsc#1245093).
- Update
  patches.suse/usb-cdns3-fix-use-after-free-at-workaround-2.patch
  (git-fixes CVE-2022-50034 bsc#1245089).
- Update
  patches.suse/usb-host-Fix-refcount-leak-in-ehci_hcd_ppc_of_probe.patch
  (git-fixes CVE-2022-50153 bsc#1244786).
- Update
  patches.suse/usb-host-ohci-ppc-of-Fix-refcount-leak-bug.patch
  (git-fixes CVE-2022-50033 bsc#1245139).
- Update
  patches.suse/usb-ohci-nxp-Fix-refcount-leak-in-ohci_hcd_nxp_probe.patch
  (git-fixes CVE-2022-50152 bsc#1244783).
- Update patches.suse/usb-renesas-Fix-refcount-leak-bug.patch
  (git-fixes CVE-2022-50032 bsc#1245103).
- Update
  patches.suse/usb-typec-tcpm-fix-warning-when-handle-discover_iden.patch
  (git-fixes CVE-2023-53048 bsc#1244179).
- Update
  patches.suse/usbnet-Fix-linkwatch-use-after-free-on-disconnect.patch
  (git-fixes CVE-2022-50220 bsc#1245348).
- Update
  patches.suse/venus-pm_helpers-Fix-warning-in-OPP-during-probe.patch
  (git-fixes CVE-2022-50011 bsc#1244915).
- Update
  patches.suse/video-fbdev-amba-clcd-Fix-refcount-leak-bugs.patch
  (git-fixes CVE-2022-50109 bsc#1244884).
- Update
  patches.suse/video-fbdev-arkfb-Check-the-size-of-screen-before-me.patch
  (git-fixes CVE-2022-50099 bsc#1244842).
- Update
  patches.suse/video-fbdev-arkfb-Fix-a-divide-by-zero-bug-in-ark_se.patch
  (git-fixes CVE-2022-50102 bsc#1244838).
- Update
  patches.suse/video-fbdev-i740fb-Check-the-argument-of-i740_calc_v.patch
  (git-fixes CVE-2022-50010 bsc#1245122).
- Update
  patches.suse/video-fbdev-s3fb-Check-the-size-of-screen-before-mem.patch
  (git-fixes CVE-2022-50097 bsc#1244845).
- Update
  patches.suse/video-fbdev-vt8623fb-Check-the-size-of-screen-before.patch
  (git-fixes CVE-2022-50101 bsc#1244839).
- Update
  patches.suse/virtio-gpu-fix-a-missing-check-to-avoid-NULL-derefer.patch
  (git-fixes CVE-2022-50181 bsc#1244901).
- Update
  patches.suse/virtio_net-fix-memory-leak-inside-XPD_TX-with-mergea.patch
  (git-fixes CVE-2022-50065 bsc#1244986).
- Update
  patches.suse/vt-Clear-selection-before-changing-the-font.patch
  (git-fixes CVE-2022-49948 bsc#1245058).
- Update
  patches.suse/watchdog-sp5100_tco-Fix-a-memory-leak-of-EFCH-MMIO-r.patch
  (git-fixes CVE-2022-50110 bsc#1244830).
- Update
  patches.suse/wifi-iwlwifi-mvm-fix-double-list_add-at-iwl_mvm_mac_.patch
  (git-fixes CVE-2022-50164 bsc#1244770).
- Update
  patches.suse/wifi-libertas-Fix-possible-refcount-leak-in-if_usb_p.patch
  (git-fixes CVE-2022-50162 bsc#1244773).
- Update
  patches.suse/wifi-mac80211-Don-t-finalize-CSA-in-IBSS-mode-if-sta.patch
  (git-fixes CVE-2022-49942 bsc#1244881).
- Update
  patches.suse/wifi-mac80211-Fix-UAF-in-ieee80211_scan_rx.patch
  (git-fixes CVE-2022-49934 bsc#1245051).
- Update
  patches.suse/wifi-rtw89-8852a-rfk-fix-div-0-exception.patch
  (git-fixes CVE-2022-50178 bsc#1244900).
- Update
  patches.suse/wifi-wil6210-debugfs-fix-info-leak-in-wil_write_file.patch
  (git-fixes CVE-2022-50169 bsc#1244767).
- Update
  patches.suse/wifi-wil6210-debugfs-fix-uninitialized-variable-use-.patch
  (git-fixes CVE-2022-50165 bsc#1244771).
- Update
  patches.suse/writeback-avoid-use-after-free-after-removing-device.patch
  (bsc#1207638 CVE-2022-49995 bsc#1245012).
- Update
  patches.suse/xen-privcmd-fix-error-exit-of-privcmd_ioctl_dm_op.patch
  (git-fixes CVE-2022-49989 bsc#1245007).
- commit 7202356

- bpf: abort verification if env->cur_state->loop_entry != NULL
  (CVE-2025-38060 bsc#1245155).
- Refresh patches.kabi/bpf-callback-fixes-kABI-workaround.patch.
- commit 7231f0c

- bpf: copy_verifier_state() should copy 'loop_entry' field
  (CVE-2025-38060 bsc#1245155).
- Refresh patches.kabi/bpf-callback-fixes-kABI-workaround.patch.
- commit 5ab8be4

- net_sched: prio: fix a race in prio_tune() (CVE-2025-38083
  bsc#1245183).
- commit 2221c2d

- dmaengine: idxd: Refactor remove call with idxd_cleanup()
  helper (CVE-2025-38014 bsc#1244732).
- commit c97ce5d

- Refresh patches.suse/netfilter-nf_tables-use-timestamp-to-check-for-set-element.patch.
  The gc path is async therefore it shouldn't use the timestamp but the
  current time instead.
- commit 7fca653

mozilla-nss

- update to NSS 3.112
  * bmo#1963792 - Fix alias for mac workers on try
  * bmo#1966786 - ensure all options can be configured with SSL_OptionSet and SSL_OptionSetDefault
  * bmo#1931930 - ABI/API break in ssl certificate processing
  * bmo#1955971 - remove unnecessary assertion in sec_asn1d_init_state_based_on_template
  * bmo#1965754 - update taskgraph to v14.2.1
  * bmo#1964358 - Workflow for automation of the release on GitHub when pushing a tag
  * bmo#1952860 - fix faulty assertions in SEC_ASN1DecoderUpdate
  * bmo#1934877 - Renegotiations should use a fresh ECH GREASE buffer
  * bmo#1951396 - update taskgraph to v14.1.1
  * bmo#1962503 - Partial fix for ACVP build CI job
  * bmo#1961827 - Initialize find in sftk_searchDatabase
  * bmo#1963121 - Add clang-18 to extra builds
  * bmo#1963044 - Fault tolerant git fetch for fuzzing
  * bmo#1962556 - Tolerate intermittent failures in ssl_policy_pkix_ocsp
  * bmo#1962770 - fix compiler warnings when DEBUG_ASN1D_STATES or CMSDEBUG are set
  * bmo#1961835 - fix content type tag check in NSS_CMSMessage_ContainsCertsOrCrls
  * bmo#1963102 - Remove Cryptofuzz CI version check

- update to NSS 3.111
  * bmo#1930806 - FIPS changes need to be upstreamed: force ems policy
  * bmo#1957685 - Turn off Websites Trust Bit from CAs
  * bmo#1937338 - Update nssckbi version following April 2025 Batch of Changes
  * bmo#1943135 - Disable SMIME ‘trust bit’ for GoDaddy CAs
  * bmo#1874383 - Replaced deprecated sprintf function with snprintf in dbtool.c
  * bmo#1954612 - Need up update NSS for PKCS 3.1
  * bmo#1773374 - avoid leaking localCert if it is already set in ssl3_FillInCachedSID
  * bmo#1953097 - Decrease ASAN quarantine size for Cryptofuzz in CI
  * bmo#1943962 - selfserv: Add support for zlib certificate compression

- update to NSS 3.110
  * bmo#1930806 - FIPS changes need to be upstreamed: force ems policy
  * bmo#1954724 - Prevent excess allocations in sslBuffer_Grow
  * bmo#1953429 - Remove Crl templates from ASN1 fuzz target
  * bmo#1953429 - Remove CERT_CrlTemplate from ASN1 fuzz target
  * bmo#1952855 - Fix memory leak in NSS_CMSMessage_IsSigned
  * bmo#1930807 - NSS policy updates
  * bmo#1951161 - Improve locking in nssPKIObject_GetInstances
  * bmo#1951394 - Fix race in sdb_GetMetaData
  * bmo#1951800 - Fix member access within null pointer
  * bmo#1950077 - Increase smime fuzzer memory limit
  * bmo#1949677 - Enable resumption when using custom extensions
  * bmo#1952568 - change CN of server12 test certificate
  * bmo#1949118 - Part 2: Add missing check in
    NSS_CMSDigestContext_FinishSingle
  * bmo#1949118 - Part 1: Fix smime UBSan errors
  * bmo#1930806 - FIPS changes need to be upstreamed: updated key checks
  * bmo#1951491 - Don't build libpkix in static builds
  * bmo#1951395 - handle `-p all` in try syntax
  * bmo#1951346 - fix opt-make builds to actually be opt
  * bmo#1951346 - fix opt-static builds to actually be opt
  * bmo#1916439 - Remove extraneous assert
- Removed upstreamed nss-fips-stricter-dh.patch
- Added bmo1962556.patch to fix test failures
- Rebased nss-fips-approved-crypto-non-ec.patch nss-fips-combined-hash-sign-dsa-ecdsa.patch
- update to NSS 3.109
  * bmo#1939512 - Call BL_Init before RNG_RNGInit() so that special
    SHA instructions can be used if available
  * bmo#1930807 - NSS policy updates - fix inaccurate key policy issues
  * bmo#1945883 - SMIME fuzz target
  * bmo#1914256 - ASN1 decoder fuzz target
  * bmo#1936001 - Part 2: Revert “Extract testcases from ssl gtests
    for fuzzing”
  * bmo#1915155 - Add fuzz/README.md
  * bmo#1936001 - Part 4: Fix tstclnt arguments script
  * bmo#1944545 - Extend pkcs7 fuzz target
  * bmo#1912320 - Extend certDN fuzz target
  * bmo#1944300 - revert changes to HACL* files from bug 1866841
  * bmo#1936001 - Part 3: Package frida corpus script
- update to NSS 3.108
  * bmo#1923285 - libclang-16 -> libclang-19
  * bmo#1939086 - Turn off Secure Email Trust Bit for Security
    Communication ECC RootCA1
  * bmo#1937332 - Turn off Secure Email Trust Bit for BJCA Global Root
    CA1 and BJCA Global Root CA2
  * bmo#1915902 - Remove SwissSign Silver CA – G2
  * bmo#1938245 - Add D-Trust 2023 TLS Roots to NSS
  * bmo#1942301 - fix fips test failure on windows
  * bmo#1935925 - change default sensitivity of KEM keys
  * bmo#1936001 - Part 1: Introduce frida hooks and script
  * bmo#1942350 - add missing arm_neon.h include to gcm.c
  * bmo#1831552 - ci: update windows workers to win2022
  * bmo#1831552 - strip trailing carriage returns in tools tests
  * bmo#1880256 - work around unix/windows path translation issues
    in cert test script
  * bmo#1831552 - ci: let the windows setup script work without $m
  * bmo#1880255 - detect msys
  * bmo#1936680 - add a specialized CTR_Update variant for AES-GCM
  * bmo#1930807 - NSS policy updates
  * bmo#1930806 - FIPS changes need to be upstreamed: FIPS 140-3 RNG
  * bmo#1930806 - FIPS changes need to be upstreamed: Add SafeZero
  * bmo#1930806 - FIPS changes need to be upstreamed - updated POST
  * bmo#1933031 - Segmentation fault in SECITEM_Hash during pkcs12 processing
  * bmo#1929922 - Extending NSS with LoadModuleFromFunction functionality
  * bmo#1935984 - Ensure zero-initialization of collectArgs.cert
  * bmo#1934526 - pkcs7 fuzz target use CERT_DestroyCertificate
  * bmo#1915898 - Fix actual underlying ODR violations issue
  * bmo#1184059 - mozilla::pkix: allow reference ID labels to begin
    and/or end with hyphens
  * bmo#1927953 - don't look for secmod.db in nssutil_ReadSecmodDB if
    NSS_DISABLE_DBM is set
  * bmo#1934526 - Fix memory leak in pkcs7 fuzz target
  * bmo#1934529 - Set -O2 for ASan builds in CI
  * bmo#1934543 - Change branch of tlsfuzzer dependency
  * bmo#1915898 - Run tests in CI for ASan builds with detect_odr_violation=1
  * bmo#1934241 - Fix coverage failure in CI
  * bmo#1934213 - Add fuzzing for delegated credentials, DTLS short
    header and Tls13BackendEch
  * bmo#1927142 - Add fuzzing for SSL_EnableTls13GreaseEch and
    SSL_SetDtls13VersionWorkaround
  * bmo#1913677 - Part 3: Restructure fuzz/
  * bmo#1931925 - Extract testcases from ssl gtests for fuzzing
  * bmo#1923037 - Force Cryptofuzz to use NSS in CI
  * bmo#1923037 - Fix Cryptofuzz on 32 bit in CI
  * bmo#1933154 - Update Cryptofuzz repository link
  * bmo#1926256 - fix build error from 9505f79d
  * bmo#1926256 - simplify error handling in get_token_objects_for_cache
  * bmo#1931973 - nss doc: fix a warning
  * bmo#1930797 - pkcs12 fixes from RHEL need to be picked up
- remove obsolete patches
  * nss-fips-safe-memset.patch
  * nss-bmo1930797.patch
- update to NSS 3.107
  * bmo#1923038 - Remove MPI fuzz targets.
  * bmo#1925512 - Remove globals `lockStatus` and `locksEverDisabled`.
  * bmo#1919015 - Enable PKCS8 fuzz target.
  * bmo#1923037 - Integrate Cryptofuzz in CI.
  * bmo#1913677 - Part 2: Set tls server target socket options in config class
  * bmo#1913677 - Part 1: Set tls client target socket options in config class
  * bmo#1913680 - Support building with thread sanitizer.
  * bmo#1922392 - set nssckbi version number to 2.72.
  * bmo#1919913 - remove Websites Trust Bit from Entrust Root
    Certification Authority - G4.
  * bmo#1920641 - remove Security Communication RootCA3 root cert.
  * bmo#1918559 - remove SecureSign RootCA11 root cert.
  * bmo#1922387 - Add distrust-after for TLS to Entrust Roots.
  * bmo#1927096 - update expected error code in pk12util pbmac1 tests.
  * bmo#1929041 - Use random tstclnt args with handshake collection script
  * bmo#1920466 - Remove extraneous assert in ssl3gthr.c.
  * bmo#1928402 - Adding missing release notes for NSS_3_105.
  * bmo#1874451 - Enable the disabled mlkem tests for dtls.
  * bmo#1874451 - NSS gtests filter cleans up the constucted buffer
    before the use.
  * bmo#1925505 - Make ssl_SetDefaultsFromEnvironment thread-safe.
  * bmo#1925503 - Remove short circuit test from ssl_Init.
- fix build on loongarch64 (setting it as 64bit arch)
- Remove upstreamed bmo-1400603.patch
- Added nss-bmo1930797.patch to fix failing tests in testsuite
- update to NSS 3.106
  * bmo#1925975 - NSS 3.106 should be distributed with NSPR 4.36.
  * bmo#1923767 - pk12util: improve error handling in p12U_ReadPKCS12File.
  * bmo#1899402 - Correctly destroy bulkkey in error scenario.
  * bmo#1919997 - PKCS7 fuzz target, r=djackson,nss-reviewers.
  * bmo#1923002 - Extract certificates with handshake collection script.
  * bmo#1923006 - Specify len_control for fuzz targets.
  * bmo#1923280 - Fix memory leak in dumpCertificatePEM.
  * bmo#1102981 - Fix UBSan errors for SECU_PrintCertificate and
    SECU_PrintCertificateBasicInfo.
  * bmo#1921528 - add new error codes to mozilla::pkix for Firefox to use.
  * bmo#1921768 - allow null phKey in NSC_DeriveKey.
  * bmo#1921801 - Only create seed corpus zip from existing corpus.
  * bmo#1826035 - Use explicit allowlist for for KDF PRFS.
  * bmo#1920138 - Increase optimization level for fuzz builds.
  * bmo#1920470 - Remove incorrect assert.
  * bmo#1914870 - Use libFuzzer options from fuzz/options/\*.options in CI.
  * bmo#1920945 - Polish corpus collection for automation.
  * bmo#1917572 - Detect new and unfuzzed SSL options.
  * bmo#1804646 - PKCS12 fuzzing target.
- requires NSPR 4.36
- update to NSS 3.105
  * bmo#1915792 - Allow importing PKCS#8 private EC keys missing public key
  * bmo#1909768 - UBSAN fix: applying zero offset to null pointer in sslsnce.c
  * bmo#1919577 - set KRML_MUSTINLINE=inline in makefile builds
  * bmo#1918965 - Don't set CKA_SIGN for CKK_EC_MONTGOMERY private keys
  * bmo#1918767 - override default definition of KRML_MUSTINLINE
  * bmo#1916525 - libssl support for mlkem768x25519
  * bmo#1916524 - support for ML-KEM-768 in softoken and pk11wrap
  * bmo#1866841 - Add Libcrux implementation of ML-KEM 768 to FreeBL
  * bmo#1911912 - Avoid misuse of ctype(3) functions
  * bmo#1917311 - part 2: run clang-format
  * bmo#1917311 - part 1: upgrade to clang-format 13
  * bmo#1916953 - clang-format fuzz
  * bmo#1910370 - DTLS client message buffer may not empty be on retransmit
  * bmo#1916413 - Optionally print config for TLS client and server
    fuzz target
  * bmo#1916059 - Fix some simple documentation issues in NSS.
  * bmo#1915439 - improve performance of NSC_FindObjectsInit when
    template has CKA_TOKEN attr
  * bmo#1912828 - define CKM_NSS_ECDHE_NO_PAIRWISE_CHECK_KEY_PAIR_GEN
- Fix build error under Leap by rebasing nss-fips-safe-memset.patch.
- update to NSS 3.104
  * bmo#1910071 - Copy original corpus to heap-allocated buffer
  * bmo#1910079 - Fix min ssl version for DTLS client fuzzer
  * bmo#1908990 - Remove OS2 support just like we did on NSPR
  * bmo#1910605 - clang-format NSS improvements
  * bmo#1902078 - Adding basicutil.h to use HexString2SECItem function
  * bmo#1908990 - removing dirent.c from build
  * bmo#1902078 - Allow handing in keymaterial to shlibsign to make
    the output reproducible
  * bmo#1908990 - remove nec4.3, sunos4, riscos and SNI references
  * bmo#1908990 - remove other old OS (BSDI, old HP UX, NCR,
    openunix, sco, unixware or reliantUnix
  * bmo#1908990 - remove mentions of WIN95
  * bmo#1908990 - remove mentions of WIN16
  * bmo#1913750 - More explicit directory naming
  * bmo#1913755 - Add more options to TLS server fuzz target
  * bmo#1913675 - Add more options to TLS client fuzz target
  * bmo#1835240 - Use OSS-Fuzz corpus in NSS CI
  * bmo#1908012 - set nssckbi version number to 2.70.
  * bmo#1914499 - Remove Email Trust bit from ACCVRAIZ1 root cert.
  * bmo#1908009 - Remove Email Trust bit from certSIGN ROOT CA.
  * bmo#1908006 - Add Cybertrust Japan Roots to NSS.
  * bmo#1908004 - Add Taiwan CA Roots to NSS.
  * bmo#1911354 - remove search by decoded serial in
    nssToken_FindCertificateByIssuerAndSerialNumber
  * bmo#1913132 - Fix tstclnt CI build failure
  * bmo#1913047 - vfyserv: ensure peer cert chain is in db for
    CERT_VerifyCertificateNow
  * bmo#1912427 - Enable all supported protocol versions for UDP
  * bmo#1910361 - Actually use random PSK hash type
  * bmo#1911576 - Initialize NSS DB once
  * bmo#1910361 - Additional ECH cipher suites and PSK hash types
  * bmo#1903604 - Automate corpus file generation for TLS client Fuzzer
  * bmo#1910364 - Fix crash with UNSAFE_FUZZER_MODE
  * bmo#1910605 - clang-format shlibsign.c
- remove obsolete nss-reproducible-builds.patch
- update to NSS 3.103
  * bmo#1908623 - move list size check after lock acquisition in sftk_PutObjectToList.
  * bmo#1899542 - Add fuzzing support for SSL_ENABLE_POST_HANDSHAKE_AUTH,
  * bmo#1909638 - Follow-up to fix test for presence of file nspr.patch.
  * bmo#1903783 - Adjust libFuzzer size limits
  * bmo#1899542 - Add fuzzing support for SSL_SetCertificateCompressionAlgorithm,
    SSL_SetClientEchConfigs, SSL_VersionRangeSet and SSL_AddExternalPsk
  * bmo#1899542 - Add fuzzing support for SSL_ENABLE_GREASE and
    SSL_ENABLE_CH_EXTENSION_PERMUTATION
- Add nss-reproducible-builds.patch to make the rpms reproducible,
  by using a hardcoded, static key to generate the checksums (*.chk-files)
- Updated nss-fips-approved-crypto-non-ec.patch to enforce
  approved curves with the CKK_EC_MONTGOMERY key type (bsc#1224113).
- update to NSS 3.102.1
  * bmo#1905691 - ChaChaXor to return after the function
- update to NSS 3.102
  * bmo#1880351 - Add Valgrind annotations to freebl Chacha20-Poly1305.
  * bmo#1901932 - missing sqlite header.
  * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME.
  * bmo#1615298 - improve certutil keyUsage, extKeyUsage, and nsCertType keyword handling.
  * bmo#1660676 - correct length of raw SPKI data before printing in pp utility.

- Add nss-reproducible-chksums.patch to make NSS-build reproducible
  Use key from openssl (bsc#1081723)

- Updated nss-fips-approved-crypto-non-ec.patch to exclude the
  SHA-1 hash from SLI approval.

libssh

- Fix CVE-2025-5318: Likely read beyond bounds in sftp server handle management (bsc#1245311)
  * Add patch libssh-CVE-2025-5318.patch
- Fix CVE-2025-4877: Write beyond bounds in binary to base64 conversion functions (bsc#1245309)
  * Add patch libssh-CVE-2025-4877.patch
- Fix CVE-2025-4878: Use of uninitialized variable in privatekey_from_file() (bsc#1245310)
  * Add patches:
  - libssh-CVE-2025-4878-1.patch
  - libssh-CVE-2025-4878-2.patch
- Fix CVE-2025-5372: ssh_kdf() returns a success code on certain failures (bsc#1245314)
  * Add patch libssh-CVE-2025-5372.patch

libxml2

- security update
- added patches
  CVE-2025-49794 [bsc#1244554], heap use after free (UAF) can lead to Denial of service (DoS)
  CVE-2025-49796 [bsc#1244557], type confusion may lead to Denial of service (DoS)
  + libxml2-CVE-2025-49794,49796.patch
  CVE-2025-49795 [bsc#1244555], null pointer dereference may lead to Denial of service (DoS)
  + libxml2-CVE-2025-49795.patch

- security update
- added patches
  CVE-2025-6170 [bsc#1244700], stack buffer overflow may lead to a crash
  CVE-2025-6021 [bsc#1244580], Integer Overflow in xmlBuildQName() Leads to Stack Buffer Overflow in libxml2
  + libxml2-CVE-2025-6170,6021.patch

mozilla-nspr

- update to version 4.36
  * remove support for OS/2
  * remove support for Unixware, Bsdi, old AIX, old HPUX9 & scoos
  * remove support for Windows 16 bit
  * renamed the prwin16.h header to prwin.h
  * configure was updated from 2.69 to 2.71
  * various build, test and automation script fixes
  * major parts of the source code were reformatted

python-azure-agent

- Set AutoUpdate.UpdateToLatestVersion=n in /etc/waagent.conf
  (bsc#1244933)

- Fix %suse_version conditional in spec file so package is built
  using python2 in SLE 12 (bsc#1240385)

salt

- Add `minion_legacy_req_warnings` option to avoid noisy warnings
- Require M2Crypto >= 0.44.0 for SUSE Family distros
- Added:
  * add-minion_legacy_req_warnings-option-to-avoid-noisy.patch

- Prevent tests failures when pygit2 is not present
- Several fixes for security issues
  (bsc#1244561, CVE-2024-38822)
  (bsc#1244564, CVE-2024-38823)
  (bsc#1244565, CVE-2024-38824)
  (bsc#1244566, CVE-2024-38825)
  (bsc#1244567, CVE-2025-22240)
  (bsc#1244568, CVE-2025-22236)
  (bsc#1244570, CVE-2025-22241)
  (bsc#1244571, CVE-2025-22237)
  (bsc#1244572, CVE-2025-22238)
  (bsc#1244574, CVE-2025-22239)
  (bsc#1244575, CVE-2025-22242)
  * Request server hardening
  * Prevent traversal in local_cache::save_minions
  * Add test and fix for file_recv cve
  * Fix traversal in gitfs find_file
  * Fix traversal in salt.utils.virt
  * Fix traversal in pub_ret
  * Reasonable failures when pillars timeout
  * Make send_req_async wait longer
  * Remove token to prevent decoding errors
  * Fix checking of non-url style git remotes
  * Allow subdirs in GitFS find_file check
- Add subsystem filter to udev.exportdb (bsc#1236621)
- tornado.httputil: raise errors instead of logging in
  multipart/form-data parsing (CVE-2025-47287, bsc#1243268)
- Fix Ubuntu 24.04 edge-case test failures
- Fix broken tests for Ubuntu 24.04
- Fix refresh of osrelease and related grains on Python 3.10+
- Make "salt" package to obsolete "python3-salt" package on SLE15SP7+
- Fix issue requiring proper Python flavor for dependencies and recommended package
- Added:
  * fix-tests-issues-in-salt-shaker-environments-721.patch
  * several-fixes-for-security-issues.patch
  * add-subsystem-filter-to-udev.exportdb-bsc-1236621-71.patch
  * fix-of-cve-2025-47287-bsc-1243268-718.patch
  * fix-ubuntu-24.04-specific-failures-716.patch
  * fix-debian-tests-715.patch
  * fix-refresh-of-osrelease-and-related-grains-on-pytho.patch

xen

- bsc#1246112, bsc#1238896 - VUL-0: xen: More AMD transient
  execution attack (CVE-2024-36350, CVE-2024-36357, XSA-471)
  xsa471-01.patch
  xsa471-02.patch
  xsa471-03.patch
  xsa471-04.patch
  xsa471-05.patch
  xsa471-06.patch
  xsa471-07.patch
  xsa471-08.patch
  xsa471-09.patch
  xsa471-10.patch
  xsa471-11.patch
  xsa471-12.patch
  xsa471-13.patch
  xsa471-14.patch
  xsa471-15.patch
  xsa471-16.patch
  xsa471-17.patch
  xsa471-18.patch
  xsa471-19.patch
  xsa471-20.patch
  xsa471-21.patch
  xsa471-22.patch

- bsc#1244644 - VUL-0: CVE-2025-27465: xen: x86: Incorrect stubs
  exception handling for flags recovery (XSA-470)
  xsa470.patch