- 000release-packages:SLES_SAP-release
-
n/a
- azure-cli
-
- Add azure-storage-azcopy to Recommends (bsc#1245160, jsc#PED-13198)
- bind
-
- ensure file descriptors 0-2 are in use before using libuv (bsc#1230649)
* bind-ensure-file-descriptors-0-2-are-in-use-before-using-.patch
- boost
-
- CVE-2016-9840: fixed out-of-bounds pointer arithmetic in zlib in beast
(bsc#1245936)
- adds patch boost-zlib.patch
- branding-SLE
-
- Update plymouth theme to fix splash screen element placement issue.
(bsc#1236818)
- cloud-regionsrv-client
-
- Update version to 10.5.2 (bsc#1247539)
+ When an instance fails verification server side the default credentials
were left behind requireing manual intervantion prior to the next
registration attempt.
+ Fix issue triggered when using instance-billing-flavor-check due to
IP address handling as object rather than string introduced 10.5.0
- Update version to 10.5.1
+ Fix issue with picking up configured server names from the
regionsrv config file. Previously only IP addresses were collected
+ Update scriptlet for package uninstall to avoid issues in the
build service
- Update version to 10.5.0
+ Use region server IP addresses to determine Internet access rather
than a generic address. Region server IP addresses may not be blocked
in the network construct. (bsc#1245305)
- kernel-default
-
- netfilter: nft_objref: validate objref and objrefmap expressions
(bsc#1250237).
No CVE available yet, please see the bugzilla ticket referenced.
- commit 4f0eb33
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (CVE-2025-39797
bsc#1249608).
- commit 159b5f2
- xfrm: Duplicate SPI Handling (CVE-2025-39797 bsc#1249608).
- commit be6d0eb
- rpl: Fix use-after-free in rpl_do_srh_inline() (CVE-2025-38476
bsc#1247317).
- commit a8ae790
- KVM: x86: Reset IRTE to host control if *new* route isn't postable (bsc#1242960, CVE-2025-37885).
- commit d2a1295
- net/sched: ets: use old 'nbands' while purging unused classes
(git-fixes).
- commit b4fe27e
- README.BRANCH: Add Lidong Zhong as a SLE15-SP4-LTSS co-maintainer.
- commit ea9aaf3
- net: If sock is dead don't access sock's sk_wq in
sk_stream_wait_memory (CVE-2022-50409 bsc#1250392).
- commit 89e3be4
- net/mdiobus: Fix potential out-of-bounds read/write access
(CVE-2025-38111 bsc#1245666).
- igb: Do not free q_vector unless new one was allocated
(CVE-2022-50252 bsc#1249846).
- commit ce67a8c
- Update
patches.suse/0001-mm-mempolicy-fix-memory-leak-in-set_mempolicy_home_n.patch
(bsc#1206468 CVE-2022-50391 bsc#1250138).
- Update
patches.suse/0001-ubi-ensure-that-VID-header-offset-VID-header-size-al.patch
(bsc#1210584 CVE-2023-53265 bsc#1249908).
- Update
patches.suse/0014-md-Replace-snprintf-with-scnprintf.patch
(git-fixes bsc#1164051 CVE-2022-50299 bsc#1249734).
- Update
patches.suse/0054-block-bfq-fix-uaf-for-bfqq-in-bfq_exit_icq_bfqq.patch
(git-fixes CVE-2022-50329 bsc#1249699).
- Update
patches.suse/ACPI-tables-FPDT-Don-t-call-acpi_os_map_memory-on-in.patch
(git-fixes CVE-2022-50320 bsc#1249858).
- Update
patches.suse/ACPICA-Add-AML_NO_OPERAND_RESOLVE-flag-to-Timer.patch
(git-fixes CVE-2023-53395 bsc#1250358).
- Update
patches.suse/ACPICA-Avoid-undefined-behavior-applying-zero-offset.patch
(git-fixes CVE-2023-53182 bsc#1250010).
- Update
patches.suse/ACPICA-Fix-error-code-path-in-acpi_ds_call_control_m.patch
(git-fixes CVE-2022-50411 bsc#1250393).
- Update
patches.suse/ACPICA-Fix-use-after-free-in-acpi_ut_copy_ipackage_t.patch
(git-fixes CVE-2022-50423 bsc#1250784).
- Update
patches.suse/ALSA-ac97-fix-possible-memory-leak-in-snd_ac97_dev_r.patch
(git-fixes CVE-2022-50427 bsc#1250787).
- Update
patches.suse/ALSA-aoa-i2sbus-fix-possible-memory-leak-in-i2sbus_a.patch
(git-fixes CVE-2022-50431 bsc#1250790).
- Update
patches.suse/ALSA-hda-Fix-Oops-by-9.1-surround-channel-names.patch
(git-fixes CVE-2023-53400 bsc#1250328).
- Update
patches.suse/ALSA-hda-fix-a-possible-null-pointer-dereference-due.patch
(git-fixes CVE-2023-53275 bsc#1250459).
- Update
patches.suse/ASoC-fsl_mqs-move-of_node_put-to-the-correct-locatio.patch
(git-fixes CVE-2023-53268 bsc#1249914).
- Update
patches.suse/ASoC-mediatek-mt8173-Enable-IRQ-when-pdata-is-ready.patch
(git-fixes CVE-2022-50439 bsc#1250948).
- Update
patches.suse/ASoC-mediatek-mt8183-fix-refcount-leak-in-mt8183_mt6.patch
(git-fixes CVE-2022-50392 bsc#1250105).
- Update patches.suse/ASoC-qcom-Add-checks-for-devm_kcalloc.patch
(git-fixes CVE-2022-50308 bsc#1249722).
- Update
patches.suse/Bluetooth-Fix-potential-use-after-free-when-clear-ke.patch
(git-fixes CVE-2023-53386 bsc#1250106).
- Update patches.suse/Bluetooth-L2CAP-Fix-use-after-free.patch
(git-fixes CVE-2023-53305 bsc#1250049).
- Update patches.suse/Bluetooth-L2CAP-Fix-user-after-free.patch
(git-fixes CVE-2022-50386 bsc#1250301).
- Update
patches.suse/Bluetooth-L2CAP-fix-bad-unlock-balance-in-l2cap_disc.patch
(git-fixes CVE-2023-53297 bsc#1250322).
- Update
patches.suse/Bluetooth-hci_-ldisc-serdev-check-percpu_init_rwsem-.patch
(git-fixes CVE-2022-50374 bsc#1250060).
- Update
patches.suse/Bluetooth-hci_sysfs-Fix-attempting-to-call-device_ad.patch
(git-fixes CVE-2022-50419 bsc#1250394).
- Update
patches.suse/FS-JFS-Fix-null-ptr-deref-Read-in-txBegin.patch
(git-fixes CVE-2023-53457 bsc#1250763).
- Update
patches.suse/HID-multitouch-Correct-devm-device-reference-for-hid.patch
(git-fixes CVE-2023-53454 bsc#1250759).
- Update
patches.suse/IB-hfi1-Fix-possible-panic-during-hotplug-remove.patch
(git-fixes CVE-2023-53488 bsc#1250825).
- Update
patches.suse/KVM-s390-diag-fix-racy-access-of-physical-cpu-number-in-diag-9c-handler.patch
(git-fixes bsc#1215911 CVE-2023-53205 bsc#1249677).
- Update patches.suse/NFS-Fix-an-Oops-in-nfs_d_automount.patch
(git-fixes CVE-2022-50385 bsc#1250131).
- Update
patches.suse/NFSD-Protect-against-send-buffer-overflow-in-NFSv2-R.patch
(bsc#1205128 CVE-2022-43945 CVE-2022-50410 bsc#1250187).
- Update
patches.suse/NFSD-Protect-against-send-buffer-overflow-in-NFSv2-Rdir.patch
(bsc#1205128 CVE-2022-43945 CVE-2022-50235 bsc#1249667).
- Update
patches.suse/NFSD-fix-leaked-reference-count-of-nfsd4_ssc_umount_.patch
(git-fixes CVE-2023-53381 bsc#1250118).
- Update
patches.suse/NFSD-fix-use-after-free-on-source-server-when-doing-.patch
(git-fixes CVE-2022-50241 bsc#1249691).
- Update
patches.suse/PCI-ASPM-Disable-ASPM-on-MFD-function-removal-to-avo.patch
(git-fixes CVE-2023-53446 bsc#1250145).
- Update
patches.suse/PM-devfreq-Fix-leak-in-devfreq_dev_release.patch
(git-fixes CVE-2023-53518 bsc#1250923).
- Update
patches.suse/PNP-fix-name-memory-leak-in-pnp_alloc_dev.patch
(git-fixes CVE-2022-50278 bsc#1249715).
- Update
patches.suse/RDMA-bnxt_re-wraparound-mbox-producer-index.patch
(git-fixes CVE-2023-53201 bsc#1249687).
- Update
patches.suse/RDMA-cma-Allow-UD-qp_type-to-join-multicast-only.patch
(git-fixes CVE-2023-53525 bsc#1250927).
- Update
patches.suse/RDMA-cxgb4-Fix-potential-null-ptr-deref-in-pass_esta.patch
(git-fixes CVE-2023-53335 bsc#1250072).
- Update
patches.suse/RDMA-mlx5-Fix-mlx5_ib_get_hw_stats-when-used-for-dev.patch
(git-fixes CVE-2023-53393 bsc#1250114).
- Update
patches.suse/RDMA-mlx5-Return-the-firmware-result-upon-destroying.patch
(git-fixes CVE-2023-53286 bsc#1250325).
- Update
patches.suse/USB-chipidea-fix-memory-leak-with-using-debugfs_look.patch
(git-fixes CVE-2023-53334 bsc#1250077).
- Update
patches.suse/USB-dwc3-fix-memory-leak-with-using-debugfs_lookup.patch
(git-fixes CVE-2023-53415 bsc#1250412).
- Update
patches.suse/USB-fix-memory-leak-with-using-debugfs_lookup.patch
(git-fixes CVE-2023-53359 bsc#1250316).
- Update
patches.suse/USB-fotg210-fix-memory-leak-with-using-debugfs_looku.patch
(git-fixes CVE-2023-53404 bsc#1250331).
- Update
patches.suse/USB-gadget-gr_udc-fix-memory-leak-with-using-debugfs.patch
(git-fixes CVE-2023-53405 bsc#1250454).
- Update
patches.suse/USB-gadget-pxa25x_udc-fix-memory-leak-with-using-deb.patch
(git-fixes CVE-2023-53406 bsc#1250362).
- Update
patches.suse/USB-isp116x-fix-memory-leak-with-using-debugfs_looku.patch
(git-fixes CVE-2023-53413 bsc#1250370).
- Update
patches.suse/USB-isp1362-fix-memory-leak-with-using-debugfs_looku.patch
(git-fixes CVE-2023-53416 bsc#1250428).
- Update
patches.suse/USB-uhci-fix-memory-leak-with-using-debugfs_lookup.patch
(git-fixes CVE-2023-53197 bsc#1249791).
- Update
patches.suse/VMCI-check-context-notify_page-after-call-to-get_use.patch
(git-fixes CVE-2023-53259 bsc#1249767).
- Update
patches.suse/arm64-efi-Make-efi_rt_lock-a-raw_spinlock.patch
(git-fixes CVE-2023-53216 bsc#1249669).
- Update
patches.suse/blk-mq-fix-possible-memleak-when-register-hctx-failed-4b7a.patch
(git-fixes CVE-2022-50434 bsc#1250792).
- Update
patches.suse/brcmfmac-return-error-when-getting-invalid-max_flowr.patch
(git-fixes CVE-2022-50358 bsc#1250264).
- Update
patches.suse/btrfs-fix-race-between-quota-enable-and-quota-rescan.patch
(bsc#1207158 CVE-2022-50379 bsc#1250245).
- Update
patches.suse/btrfs-fix-resolving-backrefs-for-inline-extent-follo.patch
(bsc#1206456 CVE-2022-50456 bsc#1250856).
- Update
patches.suse/caif-fix-memory-leak-in-cfctrl_linkup_request.patch
(git-fixes CVE-2023-53330 bsc#1249954).
- Update
patches.suse/can-bcm-bcm_tx_setup-fix-KMSAN-uninit-value-in-vfs_w.patch
(git-fixes CVE-2023-53344 bsc#1250023).
- Update
patches.suse/cassini-Fix-a-memory-leak-in-the-error-handling-path.patch
(git-fixes CVE-2023-53435 bsc#1250159).
- Update
patches.suse/chardev-fix-error-handling-in-cdev_device_add.patch
(git-fixes CVE-2022-50282 bsc#1249739).
- Update
patches.suse/cifs-Fix-memory-leak-when-build-ntlmssp-negotiate-blob-failed.patch
(bsc#1193629 CVE-2022-50372 bsc#1250052).
- Update
patches.suse/cifs-Fix-warning-and-UAF-when-destroy-the-MR-list.patch
(git-fixes CVE-2023-53427 bsc#1250168).
- Update patches.suse/cifs-Fix-xid-leak-in-cifs_create-.patch
(bsc#1193629 CVE-2022-50351 bsc#1249925).
- Update patches.suse/cifs-Fix-xid-leak-in-cifs_flock-.patch
(bsc#1193629 CVE-2022-50460 bsc#1250879).
- Update
patches.suse/cifs-fix-DFS-traversal-oops-without-CONFIG_CIFS_DFS_UPCALL.patch
(bsc#1193629 CVE-2023-53246 bsc#1249867).
- Update
patches.suse/cifs-prevent-use-after-free-by-freeing-the-cfile-later.patch
(bsc#1193629 CVE-2023-53377 bsc#1250161).
- Update
patches.suse/clk-imx-clk-imx8mn-fix-memory-leak-in-imx8mn_clocks_.patch
(git-fixes CVE-2023-53249 bsc#1249642).
- Update
patches.suse/clk-samsung-Fix-memory-leak-in-_samsung_clk_register.patch
(git-fixes CVE-2022-50449 bsc#1250889).
- Update
patches.suse/clk-socfpga-Fix-memory-leak-in-socfpga_gate_init.patch
(git-fixes CVE-2022-50264 bsc#1249685).
- Update
patches.suse/clk-tegra-Fix-refcount-leak-in-tegra210_clock_init.patch
(git-fixes CVE-2022-50458 bsc#1250891).
- Update
patches.suse/clk-tegra-tegra124-emc-Fix-potential-memory-leak.patch
(git-fixes CVE-2023-53505 bsc#1250807).
- Update
patches.suse/clk-tegra20-Fix-refcount-leak-in-tegra20_clock_init.patch
(git-fixes CVE-2022-50444 bsc#1250767).
- Update
patches.suse/cpufreq-qcom-fix-writes-in-read-only-memory-region.patch
(git-fixes CVE-2022-50239 bsc#1249836).
- Update
patches.suse/crypto-cavium-prevent-integer-overflow-loading-firmw.patch
(git-fixes CVE-2022-50330 bsc#1249700).
- Update patches.suse/crypto-seqiv-Handle-EBUSY-correctly.patch
(git-fixes CVE-2023-53373 bsc#1250137).
- Update patches.suse/crypto-xts-Handle-EBUSY-correctly.patch
(git-fixes CVE-2023-53494 bsc#1250822).
- Update
patches.suse/dmaengine-hisilicon-Add-multi-thread-support-for-a-D.patch
(git-fixes CVE-2022-50362 bsc#1250039).
- Update
patches.suse/drivers-base-component-fix-memory-leak-with-using-de.patch
(git-fixes CVE-2023-53409 bsc#1250418).
- Update
patches.suse/drivers-base-dd-fix-memory-leak-with-using-debugfs_l.patch
(git-fixes CVE-2023-53390 bsc#1250453).
- Update
patches.suse/drivers-md-md-bitmap-check-the-return-value-of-md_bitmap_get_counter-3bd5.patch
(git-fixes CVE-2022-50402 bsc#1250363).
- Update
patches.suse/drivers-serial-jsm-fix-some-leaks-in-probe.patch
(git-fixes CVE-2022-50312 bsc#1249716).
- Update
patches.suse/drivers-staging-rtl8723bs-Fix-locking-in-_rtw_join_t.patch
(git-fixes CVE-2023-53281 bsc#1249939).
- Update
patches.suse/drm-amd-display-Fix-potential-null-dereference.patch
(git-fixes CVE-2023-53498 bsc#1250819).
- Update
patches.suse/drm-amdgpu-gfx-disable-gfx9-cp_ecc_error_irq-only-wh.patch
(git-fixes CVE-2023-53471 bsc#1250866).
- Update
patches.suse/drm-bridge-megachips-Fix-a-null-pointer-dereference-.patch
(git-fixes CVE-2022-50317 bsc#1249713).
- Update
patches.suse/drm-client-Fix-memory-leak-in-drm_client_modeset_pro.patch
(git-fixes CVE-2023-53288 bsc#1250058).
- Update
patches.suse/drm-mediatek-Clean-dangling-pointer-on-bind-error-pa.patch
(git-fixes CVE-2023-53388 bsc#1250191).
- Update
patches.suse/drm-msm-Make-.remove-and-.shutdown-HW-shutdown-consi.patch
(git-fixes CVE-2022-50260 bsc#1249885).
- Update
patches.suse/drm-msm-dp-Free-resources-after-unregistering-them.patch
(git-fixes CVE-2023-53316 bsc#1250066).
- Update
patches.suse/drm-msm-dsi-Add-missing-check-for-alloc_ordered_work.patch
(git-fixes CVE-2023-53223 bsc#1250080).
- Update
patches.suse/drm-msm-dsi-fix-memory-corruption-with-too-many-brid.patch
(git-fixes CVE-2022-50368 bsc#1250009).
- Update
patches.suse/drm-msm-hdmi-fix-memory-corruption-with-too-many-bri.patch
(git-fixes CVE-2022-50437 bsc#1250797).
- Update patches.suse/drm-msm-mdp5-Add-check-for-kzalloc.patch
(git-fixes CVE-2023-53239 bsc#1249781).
- Update
patches.suse/drm-msm-mdp5-Don-t-leak-some-plane-state.patch
(git-fixes CVE-2023-53324 bsc#1250070).
- Update
patches.suse/drm-nouveau-fix-a-use-after-free-in-nouveau_gem_prim.patch
(git-fixes CVE-2022-50454 bsc#1250890).
- Update
patches.suse/drm-panfrost-Fix-GEM-handle-creation-ref-counting.patch
(git-fixes CVE-2022-50417 bsc#1250184).
- Update
patches.suse/drm-radeon-Add-the-missed-acpi_put_table-to-fix-memo.patch
(git-fixes CVE-2022-50275 bsc#1249705).
- Update
patches.suse/drm-radeon-Fix-integer-overflow-in-radeon_cs_parser_.patch
(git-fixes CVE-2023-53309 bsc#1250055).
- Update
patches.suse/drm-radeon-free-iio-for-atombios-when-driver-shutdow.patch
(git-fixes CVE-2023-53453 bsc#1250761).
- Update
patches.suse/drm-rockchip-lvds-fix-PM-usage-counter-unbalance-in-.patch
(git-fixes CVE-2022-50443 bsc#1250768).
- Update
patches.suse/drm-sti-Fix-return-type-of-sti_-dvo-hda-hdmi-_connec.patch
(git-fixes CVE-2022-50261 bsc#1249742).
- Update
patches.suse/drm-ttm-check-null-pointer-before-accessing-when-swa.patch
(git-fixes CVE-2023-53352 bsc#1250006).
- Update patches.suse/drm-vkms-Fix-memory-leak-in-vkms_init.patch
(git-fixes CVE-2022-50269 bsc#1249777).
- Update
patches.suse/drm-vkms-Fix-null-ptr-deref-in-vkms_release.patch
(git-fixes CVE-2022-50369 bsc#1250026).
- Update
patches.suse/drm-vmwgfx-Validate-the-box-size-for-the-snooped-cur.patch
(bsc#1203332 CVE-2022-36280 git-fixes CVE-2022-50440
bsc#1250853).
- Update
patches.suse/ext4-avoid-crash-when-inline-data-creation-follows-D.patch
(bsc#1206883 CVE-2022-50435 bsc#1250799).
- Update
patches.suse/ext4-avoid-deadlock-in-fs-reclaim-with-page-writebac.patch
(bsc#1213016 CVE-2023-53149 bsc#1249882).
- Update
patches.suse/ext4-don-t-allow-journal-inode-to-have-encrypt-flag.patch
(bsc#1207621 CVE-2022-50277 bsc#1249750).
- Update
patches.suse/ext4-don-t-set-up-encryption-key-during-jbd2-transac.patch
(bsc#1207624 CVE-2022-50436 bsc#1250846).
- Update patches.suse/ext4-fix-WARNING-in-mb_find_extent.patch
(bsc#1213099 CVE-2023-53317 bsc#1250081).
- Update
patches.suse/ext4-fix-delayed-allocation-bug-in-ext4_clu_mapped-f.patch
(bsc#1207631 CVE-2022-50286 bsc#1249753).
- Update
patches.suse/ext4-fix-i_disksize-exceeding-i_size-problem-in-pari.patch
(bsc#1213015 CVE-2023-53270 bsc#1249872).
- Update
patches.suse/ext4-fix-leaking-uninitialized-memory-in-fast-commit.patch
(bsc#1207625 CVE-2022-50465 bsc#1250883).
- Update
patches.suse/ext4-fix-null-ptr-deref-in-ext4_write_info.patch
(bsc#1206884 CVE-2022-50344 bsc#1250014).
- Update
patches.suse/ext4-fix-off-by-one-errors-in-fast-commit-block-fill.patch
(bsc#1207628 CVE-2022-50428 bsc#1250786).
- Update
patches.suse/ext4-improve-error-handling-from-ext4_dirhash.patch
(bsc#1213104 CVE-2023-53473 bsc#1250848).
- Update
patches.suse/ext4-init-quota-for-old.inode-in-ext4_rename.patch
(bsc#1207629 CVE-2022-50346 bsc#1250044).
- Update
patches.suse/fbdev-ep93xx-fb-Do-not-assign-to-struct-fb_info.dev.patch
(git-fixes CVE-2023-53314 bsc#1250065).
- Update
patches.suse/fbdev-fbcon-release-buffer-when-fbcon_do_set_font-fa.patch
(git-fixes CVE-2022-50404 bsc#1250153).
- Update
patches.suse/firmware-dmi-sysfs-Fix-null-ptr-deref-in-dmi_sysfs_r.patch
(git-fixes CVE-2023-53250 bsc#1249727).
- Update
patches.suse/firmware-stratix10-svc-Fix-a-potential-resource-leak.patch
(git-fixes CVE-2023-53255 bsc#1249762).
- Update
patches.suse/floppy-Fix-memory-leak-in-do_floppy_init.patch
(git-fixes CVE-2022-50342 bsc#1249890).
- Update
patches.suse/fs-binfmt_elf-Fix-memory-leak-in-load_elf_binary.patch
(git-fixes CVE-2022-50466 bsc#1250875).
- Update patches.suse/fs-dlm-fix-race-in-lowcomms.patch (git-fixes
CVE-2022-50373 bsc#1250287).
- Update
patches.suse/fs-fix-UAF-GPF-bug-in-nilfs_mdt_destroy.patch
(CVE-2022-2978 bsc#1202700 CVE-2022-50367 bsc#1250277).
- Update
patches.suse/fs-jfs-Fix-UBSAN-array-index-out-of-bounds-in-dbAllocDmapLev.patch
(git-fixes CVE-2023-53485 bsc#1250872).
- Update
patches.suse/fs-jfs-fix-shift-out-of-bounds-in-dbDiscardAG.patch
(git-fixes CVE-2022-50333 bsc#1249860).
- Update
patches.suse/gpiolib-cdev-fix-NULL-pointer-dereferences.patch
(git-fixes CVE-2022-50453 bsc#1250887).
- Update
patches.suse/i2c-designware-Fix-handling-of-real-but-unexpected-d.patch
(git-fixes CVE-2022-50370 bsc#1250011).
- Update
patches.suse/i2c-ismt-Fix-an-out-of-bounds-bug-in-ismt_access.patch
(git-fixes CVE-2022-50394 bsc#1250107).
- Update
patches.suse/i2c-mux-reg-check-return-value-after-calling-platfor.patch
(git-fixes CVE-2022-50364 bsc#1250083).
- Update
patches.suse/ibmvnic-Do-not-reset-dql-stats-on-NON_FATAL-err.patch
(bsc#1212603 ltc#202604 CVE-2023-53463 bsc#1250867).
- Update
patches.suse/integrity-Fix-memory-leakage-in-keyring-allocation-e.patch
(git-fixes CVE-2022-50395 bsc#1250211).
- Update
patches.suse/io_uring-af_unix-defer-registered-files-gc-to-io_uri.patch
(bsc#1204228 CVE-2022-2602 CVE-2022-50234 bsc#1249664).
- Update patches.suse/iommu-omap-Fix-buffer-overflow-in-debugfs
(git-fixes CVE-2022-50301 bsc#1249733).
- Update
patches.suse/iw_cxgb4-Fix-potential-NULL-dereference-in-c4iw_fill.patch
(git-fixes CVE-2023-53476 bsc#1250839).
- Update
patches.suse/jbd2-check-jh-b_transaction-before-removing-it-from-.patch
(bsc#1214953 CVE-2023-53526 bsc#1250928).
- Update
patches.suse/jbd2-fix-potential-use-after-free-in-jbd2_fc_wait_bu.patch
(bsc#1207645 CVE-2022-50328 bsc#1250181).
- Update
patches.suse/jfs-jfs_dmap-Validate-db_l2nbperpage-while-mounting.patch
(git-fixes CVE-2023-53222 bsc#1249864).
- Update
patches.suse/kernfs-fix-use-after-free-in-__kernfs_remove.patch
(git-fixes CVE-2022-50432 bsc#1250851).
- Update
patches.suse/kprobes-Fix-check-for-probe-enabled-in-kill_kprobe.patch
(git-fixes CVE-2022-50266 bsc#1249810).
- Update patches.suse/md-fix-a-crash-in-mempool_free-3410.patch
(git-fixes CVE-2022-50381 bsc#1250257).
- Update
patches.suse/md-raid10-fix-leak-of-r10bio-remaining-for-recovery-2620.patch
(git-fixes CVE-2023-53299 bsc#1249927).
- Update
patches.suse/md-raid10-fix-null-ptr-deref-of-mreplace-in-raid10_s-3481.patch
(git-fixes CVE-2023-53380 bsc#1250198).
- Update
patches.suse/md-raid10-fix-wrong-setting-of-max_corr_read_errors-f8b2.patch
(git-fixes CVE-2023-53313 bsc#1249911).
- Update
patches.suse/md-raid10-prevent-soft-lockup-while-flush-writes-0104.patch
(git-fixes CVE-2023-53151 bsc#1249865).
- Update
patches.suse/media-atomisp-prevent-integer-overflow-in-sh_css_set.patch
(git-fixes CVE-2022-50399 bsc#1250108).
- Update
patches.suse/media-cx23885-Fix-a-null-ptr-deref-bug-in-buffer_pre.patch
(git-fixes CVE-2023-53458 bsc#1250864).
- Update
patches.suse/media-cx88-Fix-a-null-ptr-deref-bug-in-buffer_prepar.patch
(git-fixes CVE-2022-50359 bsc#1250269).
- Update
patches.suse/media-dvb-usb-az6027-fix-null-ptr-deref-in-az6027_i2.patch
(git-fixes bsc#1209291 CVE-2023-28328 CVE-2022-50272
bsc#1249808).
- Update
patches.suse/media-netup_unidvb-fix-use-after-free-at-del_timer.patch
(git-fixes CVE-2023-53219 bsc#1249661).
- Update
patches.suse/media-ov2740-Fix-memleak-in-ov2740_init_controls.patch
(git-fixes CVE-2023-53349 bsc#1250015).
- Update
patches.suse/media-pci-tw68-Fix-null-ptr-deref-bug-in-buf-prepare.patch
(git-fixes CVE-2023-53244 bsc#1249868).
- Update
patches.suse/media-uvcvideo-Handle-cameras-with-invalid-descripto.patch
(git-fixes CVE-2023-53437 bsc#1250178).
- Update
patches.suse/media-v4l2-mem2mem-add-lock-to-protect-parameter-num.patch
(git-fixes CVE-2023-53519 bsc#1250964).
- Update
patches.suse/media-vimc-Fix-wrong-function-called-when-vimc_init-.patch
(git-fixes CVE-2022-50340 bsc#1249892).
- Update
patches.suse/media-xilinx-vipp-Fix-refcount-leak-in-xvip_graph_dm.patch
(git-fixes CVE-2022-50309 bsc#1249718).
- Update
patches.suse/memory-of-Fix-refcount-leak-bug-in-of_get_ddr_timing.patch
(git-fixes CVE-2022-50249 bsc#1249747).
- Update
patches.suse/memory-of-Fix-refcount-leak-bug-in-of_lpddr3_get_ddr.patch
(git-fixes CVE-2022-50429 bsc#1250811).
- Update
patches.suse/mfd-arizona-Use-pm_runtime_resume_and_get-to-prevent.patch
(git-fixes CVE-2023-53443 bsc#1250457).
- Update
patches.suse/misc-tifm-fix-possible-memory-leak-in-tifm_7xx1_swit.patch
(git-fixes CVE-2022-50349 bsc#1249920).
- Update
patches.suse/mmc-moxart-fix-return-value-check-of-mmc_add_host.patch
(git-fixes CVE-2022-50268 bsc#1249741).
- Update
patches.suse/mmc-rtsx_pci-fix-return-value-check-of-mmc_add_host.patch
(git-fixes CVE-2022-50267 bsc#1249749).
- Update
patches.suse/mmc-rtsx_usb_sdmmc-fix-return-value-check-of-mmc_add.patch
(git-fixes CVE-2022-50347 bsc#1249928).
- Update
patches.suse/mmc-vub300-fix-return-value-check-of-mmc_add_host.patch
(git-fixes CVE-2022-50251 bsc#1249745).
- Update
patches.suse/mmc-vub300-fix-warning-do-not-call-blocking-ops-when.patch
(git-fixes CVE-2022-50430 bsc#1250791).
- Update
patches.suse/mmc-wmt-sdmmc-fix-return-value-check-of-mmc_add_host.patch
(git-fixes CVE-2022-50353 bsc#1250047).
- Update
patches.suse/msft-hv-2770-Drivers-vmbus-Check-for-channel-allocation-before-lo.patch
(git-fixes CVE-2023-53273 bsc#1249930).
- Update
patches.suse/msft-hv-2841-scsi-storvsc-Fix-handling-of-virtual-Fibre-Channel-t.patch
(git-fixes CVE-2023-53245 bsc#1249641).
- Update
patches.suse/mtd-maps-pxa2xx-flash-fix-memory-leak-in-probe.patch
(git-fixes CVE-2022-50324 bsc#1249701).
- Update
patches.suse/net-ena-fix-shift-out-of-bounds-in-exponential-backo.patch
(git-fixes CVE-2023-53272 bsc#1249917).
- Update
patches.suse/netfilter-conntrack-dccp-copy-entire-header-to-stack.patch
(CVE-2023-39197 bsc#1216976 CVE-2023-53333 bsc#1249949).
- Update
patches.suse/netfilter-ipset-add-the-missing-IP_SET_HASH_WITH_NET.patch
(CVE-2023-42753 bsc#1215150 CVE-2023-53179 bsc#1249825).
- Update
patches.suse/netfilter-nf_tables-do-not-ignore-genmask-when-looki.patch
(CVE-2023-31248 bsc#1213061 CVE-2023-53492 bsc#1250823).
- Update
patches.suse/netfilter-nft_set_rbtree-fix-overlap-expiration-walk.patch
(CVE-2023-52923 bsc#1236104 CVE-2023-53304 bsc#1249923).
- Update
patches.suse/nfc-fix-memory-leak-of-se_io-context-in-nfc_genl_se_.patch
(git-fixes CVE-2023-53298 bsc#1249944).
- Update
patches.suse/nfsd-Fix-a-memory-leak-in-an-error-handling-path.patch
(git-fixes CVE-2022-50348 bsc#1249924).
- Update
patches.suse/nfsd-call-op_release-even-when-op_func-returns-an-er.patch
(git-fixes CVE-2023-53241 bsc#1249638).
- Update
patches.suse/nfsd-under-NFSv4.1-fix-double-svc_xprt_put-on-rpc_cr.patch
(git-fixes CVE-2022-50401 bsc#1250140).
- Update
patches.suse/nilfs2-do-not-write-dirty-data-after-degenerating-to.patch
(git-fixes CVE-2023-53337 bsc#1250315).
- Update patches.suse/nilfs2-fix-sysfs-interface-lifetime.patch
(git-fixes CVE-2023-53440 bsc#1250151).
- Update
patches.suse/nilfs2-fix-use-after-free-of-nilfs_root-in-dirtying-.patch
(git-fixes CVE-2023-53311 bsc#1250062).
- Update
patches.suse/nvme-fix-multipath-crash-caused-by-flush-request-whe.patch
(git-fixes CVE-2022-50388 bsc#1250293).
- Update
patches.suse/ocfs2-fix-memory-leak-in-ocfs2_stack_glue_init.patch
(bsc#1207651 CVE-2022-50289 bsc#1249981).
- Update
patches.suse/orangefs-Fix-kmemleak-in-orangefs_-kernel-client-_debug_init.patch
(git-fixes CVE-2022-50376 bsc#1250209).
- Update
patches.suse/perf-x86-intel-uncore-Fix-reference-count-leak-in-hswep_has_limit_sbox.patch
(git fixes CVE-2022-50318 bsc#1249709).
- Update
patches.suse/phy-hisilicon-Fix-an-out-of-bounds-check-in-hisi_inn.patch
(git-fixes CVE-2023-53238 bsc#1249707).
- Update
patches.suse/platform-chrome-cros_usbpd_notify-Fix-error-handling.patch
(git-fixes CVE-2022-50468 bsc#1250877).
- Update
patches.suse/power-supply-fix-null-pointer-dereferencing-in-power.patch
(git-fixes CVE-2022-50276 bsc#1249651).
- Update
patches.suse/powerpc-Don-t-try-to-copy-PPR-for-task-with-NULL-pt_.patch
(bsc#1065729 CVE-2023-53326 bsc#1250071).
- Update
patches.suse/powerpc-rtas_flash-allow-user-copy-to-flash-block-ca.patch
(bsc#1194869 CVE-2023-53487 bsc#1250830).
- Update
patches.suse/pstore-ram-Check-start-of-empty-przs-during-init.patch
(git-fixes CVE-2023-53331 bsc#1249950).
- Update
patches.suse/pwm-lpc32xx-Remove-handling-of-PWM-channels.patch
(git-fixes CVE-2023-53472 bsc#1250841).
- Update patches.suse/qed-allow-sleep-in-qed_mcp_trace_dump.patch
(jsc#SLE-19001 CVE-2023-53509 bsc#1250810).
- Update
patches.suse/regulator-core-fix-use_count-leakage-when-handling-b.patch
(git-fixes CVE-2022-50250 bsc#1249844).
- Update
patches.suse/s390-dasd-Fix-potential-memleak-in-dasd_eckd_init.patch
(git-fixes CVE-2023-53449 bsc#1250874).
- Update
patches.suse/scsi-core-Fix-possible-memory-leak-if-device_add-fails.patch
(git-fixes CVE-2023-53174 bsc#1250024).
- Update
patches.suse/scsi-fcoe-Fix-transport-not-deattached-when-fcoe_if_init-fails.patch
(git-fixes CVE-2022-50414 bsc#1250183).
- Update
patches.suse/scsi-iscsi-iscsi_tcp-Fix-null-ptr-deref-while-calling-getpeername.patch
(git-fixes CVE-2022-50459 bsc#1250850).
- Update
patches.suse/scsi-iscsi_tcp-Check-that-sock-is-valid-before-iscsi_set_param.patch
(git-fixes CVE-2023-53464 bsc#1250868).
- Update
patches.suse/scsi-libsas-Fix-use-after-free-bug-in-smp_execute_task_sg.patch
(git-fixes CVE-2022-50422 bsc#1250774).
- Update
patches.suse/scsi-lpfc-Fix-null-ndlp-ptr-dereference-in-abnormal-.patch
(bsc#1203063 CVE-2022-50467 bsc#1250847).
- Update
patches.suse/scsi-lpfc-Fix-use-after-free-KFENCE-violation-during.patch
(bsc#1208607 CVE-2023-53282 bsc#1250311).
- Update patches.suse/scsi-mpt3sas-Fix-a-memory-leak.patch
(git-fixes CVE-2023-53512 bsc#1250915).
- Update
patches.suse/scsi-qla2xxx-Fix-potential-NULL-pointer-dereference.patch
(bsc#1213747 CVE-2023-53451 bsc#1250831).
- Update
patches.suse/scsi-qla2xxx-Pointer-may-be-dereferenced.patch
(bsc#1213747 CVE-2023-53150 bsc#1249853).
- Update
patches.suse/scsi-qla2xxx-Remove-unused-nvme_ls_waitq-wait-queue.patch
(bsc#1213747 CVE-2023-53280 bsc#1249938).
- Update
patches.suse/scsi-qla2xxx-Use-raw_smp_processor_id-instead-of-smp.patch
(git-fixes CVE-2023-53530 bsc#1250949).
- Update
patches.suse/scsi-qla2xxx-Wait-for-io-return-on-terminate-rport.patch
(bsc#1211960 CVE-2023-53322 bsc#1250323).
- Update
patches.suse/scsi-ses-Fix-slab-out-of-bounds-in-ses_intf_remove.patch
(git-fixes CVE-2023-53521 bsc#1250965).
- Update
patches.suse/scsi-ses-Handle-enclosure-with-just-a-primary-component-gracefully.patch
(git-fixes CVE-2023-53431 bsc#1250374).
- Update
patches.suse/scsi-snic-Fix-memory-leak-with-using-debugfs_lookup.patch
(git-fixes CVE-2023-53414 bsc#1250425).
- Update
patches.suse/scsi-snic-Fix-possible-memory-leak-if-device_add-fails.patch
(git-fixes CVE-2023-53436 bsc#1250156).
- Update
patches.suse/serial-8250-Reinit-port-pm-on-port-specific-driver-u.patch
(git-fixes CVE-2023-53176 bsc#1249991).
- Update
patches.suse/slimbus-qcom-ngd-cleanup-in-probe-error-path.patch
(git-fixes CVE-2022-50298 bsc#1249934).
- Update
patches.suse/smb-client-fix-warning-in-cifs_smb3_do_mount-.patch
(bsc#1193629 CVE-2023-53230 bsc#1249866).
- Update
patches.suse/soundwire-qcom-fix-storing-port-config-out-of-bounds.patch
(git-fixes CVE-2023-53465 bsc#1250863).
- Update
patches.suse/staging-rtl8723bs-fix-potential-memory-leak-in-rtw_i.patch
(git-fixes CVE-2022-50469 bsc#1250824).
- Update
patches.suse/staging-vt6655-fix-some-erroneous-memory-clean-up-lo.patch
(git-fixes CVE-2022-50355 bsc#1250041).
- Update
patches.suse/thermal-drivers-hisi-Drop-second-sensor-hi3660.patch
(git-fixes CVE-2023-53242 bsc#1249639).
- Update
patches.suse/tls-separate-no-async-decryption-request-handling-fr.patch
(CVE-2024-26583 CVE-2024-26584 bsc#1220185 bsc#1220186
CVE-2024-58240 bsc#1248847).
- Update
patches.suse/tpm-tpm_crb-Add-the-missed-acpi_put_table-to-fix-mem.patch
(git-fixes CVE-2022-50389 bsc#1250121).
- Update
patches.suse/tracing-Fix-null-pointer-dereference-in-tracing_err_log_open.patch
(git-fixes CVE-2023-53167 bsc#1249712).
- Update
patches.suse/tracing-Fix-race-issue-between-cpu-buffer-write-and-swap.patch
(git-fixes CVE-2023-53368 bsc#1249979).
- Update
patches.suse/tracing-Fix-reading-strings-from-synthetic-events.patch
(git-fixes CVE-2022-50255 bsc#1249910).
- Update
patches.suse/tracing-Free-error-logs-of-tracing-instances.patch
(git-fixes CVE-2023-53375 bsc#1250197).
- Update
patches.suse/tty-serial-fsl_lpuart-disable-dma-rx-tx-use-flags-in.patch
(git-fixes CVE-2022-50375 bsc#1250132).
- Update patches.suse/ubifs-Fix-memory-leak-in-alloc_wbufs.patch
(git-fixes CVE-2023-53468 bsc#1250888).
- Update patches.suse/ubifs-Fix-memory-leak-in-do_rename.patch
(git-fixes CVE-2023-53396 bsc#1250200).
- Update patches.suse/ubifs-Free-memory-for-tmpfile-name.patch
(git-fixes CVE-2023-53276 bsc#1250309).
- Update
patches.suse/udf-Do-not-bother-merging-very-long-extents.patch
(bsc#1213040 CVE-2023-53506 bsc#1250963).
- Update
patches.suse/udf-Do-not-update-file-length-for-failed-writes-to-i.patch
(bsc#1213041 CVE-2023-53295 bsc#1250324).
- Update
patches.suse/udf-Fix-uninitialized-array-access-for-some-pathname.patch
(bsc#1214967 CVE-2023-53165 bsc#1250395).
- Update
patches.suse/usb-dwc3-qcom-Fix-potential-memory-leak.patch
(git-fixes CVE-2023-53196 bsc#1249758).
- Update
patches.suse/usb-gadget-u_serial-Add-null-pointer-check-in-gseria-2f6ecb89fe8f.patch
(git-fixes CVE-2023-53356 bsc#1249997).
- Update
patches.suse/usb-phy-phy-tahvo-fix-memory-leak-in-tahvo_usb_probe.patch
(git-fixes CVE-2023-53379 bsc#1250128).
- Update
patches.suse/usb-typec-tcpci-fix-of-node-refcount-leak-in-tcpci_r.patch
(git-fixes CVE-2022-50246 bsc#1249746).
- Update
patches.suse/usb-xhci-mtk-fix-leakage-of-shared-hcd-when-fail-to-.patch
(git-fixes CVE-2022-50247 bsc#1249681).
- Update
patches.suse/usb-xhci-tegra-fix-sleep-in-atomic-call.patch
(git-fixes CVE-2023-53475 bsc#1250843).
- Update
patches.suse/vfio-type1-prevent-underflow-of-locked_vm-via-exec.patch
(git-fixes CVE-2023-53171 bsc#1249933).
- Update
patches.suse/vhost-vsock-Use-kvmalloc-kvfree-for-larger-packets.patch
(git-fixes CVE-2022-50271 bsc#1249740).
- Update
patches.suse/virtio-mmio-don-t-break-lifecycle-of-vm_dev.patch
(git-fixes CVE-2023-53515 bsc#1250917).
- Update
patches.suse/virtio_net-Fix-error-unwinding-of-XDP-initialization.patch
(git-fixes CVE-2023-53499 bsc#1250818).
- Update
patches.suse/watchdog-Fix-kmemleak-in-watchdog_cdev_register.patch
(git-fixes CVE-2023-53234 bsc#1249784).
- Update
patches.suse/wifi-ath11k-Fix-SKB-corruption-in-REO-destination-ri.patch
(git-fixes CVE-2023-53315 bsc#1250303).
- Update
patches.suse/wifi-ath9k-don-t-allow-to-overwrite-ENDPOINT0-attrib.patch
(git-fixes CVE-2023-53185 bsc#1249820).
- Update
patches.suse/wifi-ath9k-hif_usb-clean-up-skbs-if-ath9k_hif_usb_rx.patch
(git-fixes CVE-2023-53199 bsc#1249683).
- Update
patches.suse/wifi-ath9k-verify-the-expected-usb_endpoints-are-pre.patch
(git-fixes CVE-2022-50297 bsc#1250250).
- Update
patches.suse/wifi-brcmfmac-Fix-potential-stack-out-of-bounds-in-b.patch
(git-fixes CVE-2022-50258 bsc#1249947).
- Update
patches.suse/wifi-brcmfmac-fix-potential-memory-leak-in-brcmf_net.patch
(git-fixes CVE-2022-50321 bsc#1249706).
- Update
patches.suse/wifi-brcmfmac-fix-use-after-free-bug-in-brcmf_netdev.patch
(git-fixes CVE-2022-50408 bsc#1250391).
- Update
patches.suse/wifi-brcmfmac-slab-out-of-bounds-read-in-brcmf_get_a.patch
(git-fixes bsc#1209287 CVE-2023-1380 CVE-2023-53213
bsc#1249918).
- Update
patches.suse/wifi-cfg80211-Fix-use-after-free-for-wext.patch
(git-fixes CVE-2023-53153 bsc#1249877).
- Update
patches.suse/wifi-iwl3945-Add-missing-check-for-create_singlethre.patch
(git-fixes CVE-2023-53277 bsc#1249936).
- Update
patches.suse/wifi-iwl4965-Add-missing-check-for-create_singlethre.patch
(git-fixes CVE-2023-53302 bsc#1249958).
- Update
patches.suse/wifi-iwlwifi-fw-fix-memory-leak-in-debugfs.patch
(git-fixes CVE-2023-53422 bsc#1250182).
- Update
patches.suse/wifi-iwlwifi-mvm-fix-double-free-on-tx-path.patch
(git-fixes CVE-2022-50248 bsc#1249840).
- Update
patches.suse/wifi-iwlwifi-pcie-Fix-integer-overflow-in-iwl_write_.patch
(git-fixes CVE-2023-53524 bsc#1250953).
- Update
patches.suse/wifi-iwlwifi-pcie-fix-NULL-pointer-dereference-in-iw.patch
(git-fixes CVE-2023-53251 bsc#1249730).
- Update
patches.suse/wifi-libertas-fix-memory-leak-in-lbs_init_adapter.patch
(git-fixes CVE-2022-50294 bsc#1249799).
- Update
patches.suse/wifi-mac80211-fix-invalid-drv_sta_pre_rcu_remove-cal.patch
(git-fixes CVE-2023-53229 bsc#1249650).
- Update
patches.suse/wifi-mwifiex-Fix-OOB-and-integer-underflow-when-rx-p.patch
(git-fixes CVE-2023-53226 bsc#1249658).
- Update
patches.suse/wifi-mwifiex-avoid-possible-NULL-skb-pointer-derefer.patch
(git-fixes CVE-2023-53384 bsc#1250127).
- Update
patches.suse/wifi-rtlwifi-Fix-global-out-of-bounds-bug-in-_rtl881.patch
(git-fixes CVE-2022-50279 bsc#1249751).
- Update
patches.suse/wifi-rtw89-fix-potential-race-condition-between-napi.patch
(git-fixes CVE-2023-53452 bsc#1250762).
- Update
patches.suse/wwan_hwsim-fix-possible-memory-leak-in-wwan_hwsim_de.patch
(git-fixes CVE-2022-50331 bsc#1249695).
- Update
patches.suse/x86-fpu-fix-copy_xstate_to_uabi-to-copy-init-states-correctly.patch
(git-fixes CVE-2022-50425 bsc#1250781).
- Update patches.suse/x86-mce-amd-use-an-u64-for-bank_map.patch
(git-fixes CVE-2023-53474 bsc#1250842).
- Update
patches.suse/x86-platform-uv-Use-alternate-source-for-socket-to-n.patch
(bsc#1215696 bsc#1217790 CVE-2023-53496 bsc#1250905).
- Update patches.suse/xen-gntdev-Prevent-leaking-grants.patch
(git-fixes CVE-2022-50257 bsc#1249743).
- Update
patches.suse/xfrm-add-NULL-check-in-xfrm_update_ae_params.patch
(bsc#1213666 CVE-2023-3772 CVE-2023-53147 bsc#1249880).
- commit 3e8722f
- Update
patches.suse/nbd-fix-incomplete-validation-of-ioctl-arg-5579.patch
(git-fixes CVE-2023-53513 bsc#1250955).
- Update
patches.suse/rbd-avoid-use-after-free-in-do_rbd_add-when-rbd_dev_-f7c4.patch
(git-fixes CVE-2023-53307 bsc#1250043).
- commit 1c510bb
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
(CVE-2025-39860 bsc#1250247).
- commit a1c6acf
- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
(CVE-2025-38085 bsc#1245499).
- commit 5c79076
- mm/hugetlb: unshare page tables during VMA split, not before
(CVE-2025-38084 bsc#1245498).
- commit d3bed21
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation
(CVE-2025-39824 bsc#1250007).
- commit 4aec876
- hugetlb: unshare some PMDs when splitting VMAs (CVE-2025-38084
bsc#1245498).
- commit c029b9b
- net: stmmac: Fix accessing freed irq affinity_hint
(CVE-2025-23155 bsc#1242573).
- commit c6366be
- net/smc: fix UAF on smcsk after smc_listen_out() (CVE-2025-38734
bsc#1249324).
- commit fe18faf
- s390/ism: fix concurrency management in ism_cmd() (git-fixes
bsc#1249266 CVE-2025-39726).
- commit ac040b4
- dmaengine: ti: edma: Fix memory allocation size for
queue_priority_map (CVE-2025-39869 bsc#1250406).
- commit 9685491
- KVM: x86: use array_index_nospec with indices that come from
guest (CVE-2025-39823 bsc#1250002).
- commit d9de1fd
- mm/huge_memory: fix dereferencing invalid pmd migration entry
(CVE-2025-37958 bsc#1243539).
- commit 521422d
- ext4: ignore xattrs past end (bsc#1242846 CVE-2025-37738).
- commit 4630cc6
- fs/buffer: fix use-after-free when call bh_read() helper
(bsc#1249374 CVE-2025-39691).
- commit 996c520
- Bluetooth: eir: Fix using strlen with
hdev->{dev_name,short_name} (CVE-2022-50233 bsc#1246968).
- commit 2e1f686
- mm: fix zswap writeback race condition (CVE-2023-53178
bsc#1249827).
- Refresh
patches.suse/mm-zswap-properly-synchronize-freeing-resources-duri.patch.
- commit 42ab563
- mm: zswap: fix missing folio cleanup in writeback race path
(CVE-2023-53178 bsc#1249827 git-fix).
- commit ccc740f
- wifi: mac80211_hwsim: drop short frames (CVE-2023-53321
bsc#1250313).
- commit 19db60e
- x86/MCE: Always save CS register on AMD Zen IF Poison errors
(CVE-2023-53438 bsc#1250180).
- commit b12ae2d
- kernel-source.spec: Depend on python3-base for build
Both kernel-binary and kernel-docs already have this dependency.
Adding it to kernel-source makes it possible to use python in shared
build scripts.
- commit 72fdedd
- kernel-source: Do not list mkspec and its inputs as sources
(bsc#1250522).
This excludes the files from the src.rpm. The next step is to remove
these files in tar-up so that they do not get uploaded to OBS either.
As there is only one version of tar-up these files need to be removed
from all kernels.
- commit e72b8a2
- rpm: Link arch-symbols script from scripts directory.
- commit 90b2abb
- use uniform permission checks for all mount propagation changes
(git-fixes).
- commit 7dba905
- rpm: Link guards script from scripts directory.
- commit e19a893
- kABI fix for net: vlan: fix VLAN 0 refcount imbalance of
toggling filtering during runtime (CVE-2025-38470 bsc#1247288).
- commit 8551218
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering
during runtime (CVE-2025-38470 bsc#1247288).
- commit 05f6c5a
- Delete ARMv7 configs.
There is no longer a 5.14 based Leap.
- commit c9e0295
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
(bsc#1249200 CVE-2025-38713).
- commit 0f4fe03
- Revert backported patches for bsc#1238160 because the CVSS less than 7.0
- Delete
patches.suse/Bluetooth-hci_event-Fix-checking-conn-for-le_conn_co.patch.
- Delete
patches.suse/Bluetooth-hci_event-Fix-checking-for-invalid-handle-.patch.
- Delete
patches.suse/Bluetooth-hci_event-Ignore-multiple-conn-complete-ev.patch.
(bsc#1238160 CVE-2022-49138)
- commit 58636bb
- Update config files. (bsc#1249186)
Enable where we define KABI refs + rely on Kconfig deps.
- commit 40e5ff4
- ASoC: core: Check for rtd == NULL in
snd_soc_remove_pcm_runtime() (CVE-2025-38706 bsc#1249195).
- commit 00df3f7
- net, hsr: reject HSR frame if skb can't hold tag (CVE-2025-39703
bsc#1249315).
- commit 4aa620b
- i2c/designware: Fix an initialization issue (git-fixes
CVE-2025-38380 bsc#1247028).
- commit 3969bae
- kabi/severities: ignore kABI for atheros helper modules
The symbols are used only internally by atheros drivers.
- commit 35d7d9d
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control
(CVE-2025-39751 bsc#1249538).
- commit 2fa5c70
- wifi: ath10k: shutdown driver when hardware is unreliable
(CVE-2025-39746 bsc#1249516).
- commit b79070e
- bus: mhi: host: Detect events pointing to unexpected TREs
(CVE-2025-39790 bsc#1249548).
- commit 8f23ea7
- netfilter: nf_tables: reject duplicate device on updates
(CVE-2025-38678 bsc#1249126).
- commit ed53d59
- dmaengine: idxd: Fix refcount underflow on module unload
(CVE-2025-38014 bsc#1244732).
- commit 7288c92
- Limit patch filenames to 100 characters (bsc#1249604).
- commit 864f4b6
- kernel-subpackage-build: Decompress ghost file when compressed version exists (bsc#1249346)
- commit 40606b5
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220 CVE-2025-38685)
- commit 92b9def
- btrfs: avoid NULL pointer dereference if no valid extent tree
(bsc#1249158).
- commit 6c3a163
- smb: client: fix use-after-free in crypt_message when using
async crypto (bsc#1247239, CVE-2025-38488).
- commit 03f19df
- ipv6: reject malicious packets in ipv6_gso_segment()
(CVE-2025-38572 bsc#1248399).
- net/sched: Restrict conditions for adding duplicating netems
to qdisc tree (CVE-2025-38553 bsc#1248255).
- commit 27382a9
- rpm: Configure KABI checkingness macro (bsc#1249186)
The value of the config should match presence of KABI reference data. If
it mismatches:
- !CONFIG & reference -> this is bug, immediate fail
- CONFIG & no reference -> OK temporarily, must be resolved eventually
- commit 23c1536
- Kconfig.suse: Add KABI checkiness macro (config) (bsc#1249186)
The motivation: there are patches.kabi/ patches that restore KABI and
they check validity of the approach with static_assert()s to prevent
accidental KABI breakage.
These asserts are invoked on each arch-flavor and they may signal false
negatives -- that is KABI restoration patch could break KABI but the
given arch-flavor defines no KABI.
The intended use is to disable the compile time checks in patches.kabi/
(but not to be confused with __GENKSYMS__ that affects how reference is
calculated).
The name is chosen so that it mimics HAVE_* macros that are not
configured manually (but is selected by an arch). In our case it's
(un)selected by build script depending on whether KABI reference is
defined for given arch-flavor and whether check is really requested by
the user. Default value is 'n' so that people building merely via
Makefile (not RPM with KABI checking) obtain consistent config.
- commit a007049
- gfs2: No more self recovery (bsc#1248639 CVE-2025-38659).
- gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw
(bsc#1248639 CVE-2025-38659).
- commit d2aba16
- usb: gadget: udc: core: Offload usb_udc_vbus_handler processing
(CVE-2022-49980 bsc#1245110).
- commit b9c8803
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg()
(CVE-2025-38664 bsc#1248628).
- commit 5eff097
- wifi: mac80211: reject TDLS operations when station is not
associated (CVE-2025-38644 bsc#1248748).
- commit a8c476b
- vsock: Do not allow binding to VMADDR_PORT_ANY (bsc#1248511
CVE-2025-38618).
- commit 33452e8
- USB: gadget: Fix obscure lockdep violation for udc_mutex
(CVE-2022-49980 bsc#1245110).
- commit 25d2f46
- usb: gadget: core: do not try to disconnect gadget if it is
not connected (CVE-2022-49980 bsc#1245110).
- commit a760fdc
- tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (CVE-2025-38184 bsc#1245956)
- commit 9365d7a
- kernel-binary: Another installation ordering fix (bsc#1241353).
- commit fe14ab5
- USB: gadget: Fix use-after-free Read in usb_udc_uevent()
(CVE-2022-49980 bsc#1245110).
- commit dffc69a
- atm: clip: Fix memory leak of struct clip_vcc (CVE-2025-38546
bsc#1248223).
- atm: clip: Fix potential null-ptr-deref in to_atmarpd()
(CVE-2025-38460 bsc#1247143).
- tls: stop recv() if initial process_rx_list gave us non-DATA
(CVE-2024-58239 bsc#1248614).
- tls: rx: drop pointless else after goto (CVE-2024-58239
bsc#1248614).
- commit 47416a2
- x86/sev: Evict cache lines during SNP memory validation
(CVE-2025-38560 bsc#1248312).
- commit 766631f
- selftests/perf_events: Add a mmap() correctness test
(CVE-2025-38563 bsc#1248306 selftest).
- commit b58bec8
- perf/core: Prevent VMA split of buffer mappings (CVE-2025-38563
bsc#1248306).
- commit 30b2db8
- perf/core: Exit early on perf_mmap() fail (CVE-2025-38563
bsc#1248306 dependency).
- commit 037df8e
- perf/core: Don't leak AUX buffer refcount on allocation failure
(CVE-2025-38563 bsc#1248306 dependency).
- commit 4273af9
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data()
in ktls (bsc#1248338 CVE-2025-38608).
- commit 43a92df
- build_bug.h: Add KABI assert (bsc#1249186).
- commit 6e38849
- usb: gadget : fix use-after-free in composite_dev_cleanup()
(CVE-2025-38555 bsc#1248297).
- commit d29d36a
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (CVE-2025-38499 bsc#1247976)
- commit 767ab57
- net/packet: fix a race in packet_set_ring() and
packet_notifier() (CVE-2025-38617 bsc#1248621).
- commit a477bef
- Update config files. Disable N_GSM (jsc#PED-8240, bsc#1244824, CVE-2022-50116)
- commit 98bb21f
- Move pesign-obs-integration requirement from kernel-syms to kernel devel
subpackage (bsc#1248108).
- commit e707e41
- NFSv4.1: fix backchannel max_resp_sz verification check
(bsc#1247518).
- commit c2874ca
- smb: prevent use-after-free due to open_cached_dir error paths
(bsc#1234896, CVE-2024-53177).
- commit 99ad7d6
- posix-cpu-timers: fix race between handle_posix_cpu_timers()
and posix_cpu_timer_del() (bsc#1246911 CVE-2025-38352).
- commit 5c74715
- do_change_type(): refuse to operate on unmounted/not ours mounts (CVE-2025-38498 bsc#1247374)
- commit 16fc04a
- net: atm: fix /proc/net/atm/lec handling (CVE-2025-38180
bsc#1245970).
- net: atm: add lec_mutex (CVE-2025-38323 bsc#1246473).
- commit d88adbc
- protect the fetch of ->fd[fd] in do_dup2() from mispredictions
(bsc#1229334 CVE-2024-42265).
- fs: prevent out-of-bounds array speculation when closing a
file descriptor (CVE-2023-53117 bsc#1242780).
- commit 832757a
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic
context in qfq_delete_class (CVE-2025-38477 bsc#1247314).
- net/sched: Return NULL when htb_lookup_leaf encounters an
empty rbtree (CVE-2025-38468 bsc#1247437).
- net/sched: sch_qfq: Fix race condition on qfq_aggregate
(CVE-2025-38477 bsc#1247314).
- net/sched: Always pass notifications when child class becomes
empty (CVE-2025-38350 bsc#1246781).
- commit 03528bf
- net_sched: Prevent creation of classes with TC_H_ROOT
(CVE-2025-21971 bsc#1240799).
- commit c846a50
- kernel-syms.spec: Drop old rpm release number hack (bsc#1247172).
- commit b4fa2d1
- Update
patches.suse/netfilter-nf_set_pipapo_avx2-fix-initial-map-fill.patch
(git-fixes CVE-2024-57947 bsc#1236333 CVE-2025-38120
bsc#1245711).
- Update
patches.suse/powerpc-powernv-memtrace-Fix-out-of-bounds-issue-in-.patch
(bsc#1244309 ltc#213790 CVE-2025-38088 bsc#1245506).
- Update
patches.suse/sch_hfsc-make-hfsc_qlen_notify-idempotent.patch
(CVE-2025-37798 bsc#1242414 CVE-2025-38177 bsc#1245986).
- commit c5b1aff
- HID: core: do not bypass hid_hw_raw_request (CVE-2025-38494
bsc#1247349).
- HID: core: ensure the allocated report buffer can contain the
reserved report ID (CVE-2025-38495 bsc#1247348).
- commit 8b00261
- usb: gadget: configfs: Fix OOB read on empty string write
(CVE-2025-38497 bsc#1247347).
- commit 2908061
- rpm/kernel-subpackage-spec: Skip brp-strip-debug to avoid file truncation (bsc#1246879)
Put the same workaround to avoid file truncation of vmlinux and co in
kernel-default-base package, too.
- commit 2329734
- rpm/kernel-binary.spec.in: Ignore return code from ksymtypes compare
When using suse-kabi-tools, the RPM build invokes 'ksymvers compare' to
compare the resulting symbol CRCs with the reference data. If the values
differ, it then invokes 'ksymtypes compare' to provide a detailed report
explaining why the symbols differ. The build expects the latter
'ksymtypes compare' command to always return zero, even if the two
compared kABI corpuses are different.
This is currently the case for 'ksymtypes compare'. However, I plan to
update the command to return a non-zero code when the comparison detects
any differences. This should ensure consistent behavior with 'ksymvers
compare'.
Since the build uses 'ksymtypes compare' only for more detailed
diagnostics, ignore its return code.
- commit 5ac1381
- netfilter: nf_tables: mark set as dead when unbinding anonymous
set with timeout (CVE-2024-26643 bsc#1221829).
- commit 4daa764
- netfilter: allow exp not to be removed in nf_ct_find_expectation
(CVE-2023-52927 bsc#1239644).
- commit b3f811c
- netfilter: nf_tables: split async and sync catchall in two
functions (CVE-2023-52923 bsc#1236104).
- Refresh
patches.suse/netfilter-nf_tables-use-timestamp-to-check-for-set-element.patch.
- commit 11c8f5d
- netfilter: nft_set_hash: unaligned atomic read on struct
nft_set_ext (CVE-2023-52923 bsc#1236104).
- commit 81059b2
- netfilter: nft_set_rbtree: skip end interval element from gc
(CVE-2023-52923 bsc#1236104).
- commit f47327b
- netfilter: nf_tables: remove catchall element in GC sync path
(CVE-2023-52923 bsc#1236104).
- Refresh
patches.suse/netfilter-nf_tables-use-timestamp-to-check-for-set-element.patch.
- commit 9970986
- netfilter: nf_tables: nft_set_rbtree: fix spurious insertion
failure (CVE-2023-52923 bsc#1236104).
- commit e63b022
- netfilter: nft_set_hash: skip duplicated elements pending gc
run (CVE-2023-52923 bsc#1236104).
- commit 828ecf9
- netfilter: nft_set_pipapo: prefer gfp_kernel allocation
(CVE-2023-52923 bsc#1236104).
- commit 65fa0d6
- netfilter: nft_set_hash: try later when GC hits EAGAIN on
iteration (CVE-2023-52923 bsc#1236104).
- commit 10f2b11
- netfilter: nft_set_pipapo: call nft_trans_gc_queue_sync()
in catchall GC (CVE-2023-52923 bsc#1236104).
- Refresh
patches.suse/netfilter-nf_tables-use-timestamp-to-check-for-set-element.patch.
- commit 01a51e7
- netfilter: nft_set_rbtree: use read spinlock to avoid datapath
contention (CVE-2023-52923 bsc#1236104).
- commit 3a9efbc
- netfilter: nft_set_rbtree: skip sync GC for new elements in
this transaction (CVE-2023-52923 bsc#1236104).
- commit 20a6d45
- netfilter: nf_tables: defer gc run if previous batch is still
pending (CVE-2023-52923 bsc#1236104).
- commit 8c98aa6
- netfilter: nf_tables: adapt set backend to use GC transaction
API (CVE-2023-52923 bsc#1236104).
- Refresh
patches.suse/netfilter-nf_tables-check-if-catch-all-set-element-i.patch.
- Refresh
patches.suse/netfilter-nf_tables-don-t-fail-inserts-if-duplicate-has-ex.patch.
- Refresh
patches.suse/netfilter-nf_tables-fix-kdoc-warnings-after-gc-rewor.patch.
- Refresh
patches.suse/netfilter-nf_tables-use-timestamp-to-check-for-set-element.patch.
- commit 84a46c0
- netfilter: nft_set_rbtree: fix overlap expiration walk
(CVE-2023-52923 bsc#1236104).
- commit 314088b
- netfilter: nft_set_rbtree: fix null deref on element insertion
(CVE-2023-52923 bsc#1236104).
- commit 5658720
- netfilter: nft_set_rbtree: skip elements in transaction from
garbage collection (CVE-2023-52923 bsc#1236104).
- commit da32326
- netfilter: nft_set_rbtree: Switch to node list walk for overlap
detection (CVE-2023-52923 bsc#1236104).
- Refresh
patches.suse/netfilter-nf_tables-use-timestamp-to-check-for-set-element.patch.
- commit fb97724
- netfilter: nft_set_rbtree: overlap detection with element
re-addition after deletion (CVE-2023-52923 bsc#1236104).
- commit 043eda8
- uprobes: Reject the shared zeropage in uprobe_write_opcode() (CVE-2025-21881 bsc#1240185)
- commit b93487d
- net: sched: fix ordering of qlen adjustment (CVE-2024-53164 bsc#1234863)
- commit 40219c0
- ipc: fix to protect IPCS lookups using RCU (CVE-2025-38212
bsc#1246029).
- commit d87772b
- s390/pkey: Prevent overflow in size calculation for
memdup_user() (git-fixes CVE-2025-38257 bsc#1246186).
- commit 95d7e4c
- i40e: fix MMIO write access to an invalid page in i40e_clear_hw
(CVE-2025-38200 bsc#1246045).
- commit 1f55e7a
- Revert "hugetlb: unshare some PMDs when splitting VMAs (bsc#1245431)."
This reverts commit 42d0bfa0c264cdd972320d70cf30244e83ed6d45.
Fix requires more work.
- commit bd9ff6c
- Revert "mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race"
This reverts commit 5ac7828c47ade79e31bb3a63af46f7ba40385d3c.
Fix requires more work.
Conflicts:
series.conf
- commit b735458
- Revert "mm/hugetlb: unshare page tables during VMA split, not before"
This reverts commit 16c03c20551418e44e64746e1adb153a94eb8624.
Fix requires more work.
Conflicts:
series.conf
- commit 6f94b5c
- calipso: Fix null-ptr-deref in calipso_req_{set,del}attr()
(CVE-2025-38181 bsc#1246000).
- commit 84f7580
- vgacon: Add check for vc_origin address range in vgacon_scroll()
(CVE-2025-38213 bsc#1246037).
- commit 8cddace
- rpm/mkspec: Fix missing kernel-syms-rt creation (bsc#1244337)
- commit 630f139
- exfat: fix double free in delayed_free (bsc#1246073
CVE-2025-38206).
- commit e34f200
- Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt
(bsc#1238160 CVE-2022-49138).
- commit 5955361
- Bluetooth: hci_event: Fix checking for invalid handle on error
status (bsc#1238160 CVE-2022-49138).
- commit bf7f8a7
- Bluetooth: hci_event: Ignore multiple conn complete events
(bsc#1238160 CVE-2022-49138).
- commit fa787ad
- crypto: algif_hash - fix double free in hash_accept
(CVE-2025-38079 bsc#1245217).
- commit 6c6cb3d
- net_sched: hfsc: Fix a UAF vulnerability in class handling
(CVE-2025-37797 bsc#1242417).
- commit 3ddb4b2
- net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
(CVE-2024-53057 bsc#1233551).
- commit 1066e4f
- netfilter: nf_set_pipapo_avx2: fix initial map fill (git-fixes
CVE-2024-57947 bsc#1236333).
- commit 1758014
- netfilter: nf_set_pipapo: fix initial map fill (CVE-2024-57947
bsc#1236333).
- commit 233ce6a
- rpm: Drop support for kabi/arch/ignore-flavor (bsc#1249186)
It's not used in any active branches and it cannot solve contemporary
problems.
- commit f86a16a
- scsi: storvsc: Increase the timeouts to storvsc_timeout (bsc#1245455).
- scsi: storvsc: Don't report the host packet status as the hv status (git-fixes).
- commit 48c2b90
- kernel-obs-qa: Do not depend on srchash when qemu emulation is used
In this case the dependency is never fulfilled
Fixes: 485ae1da2b88 ("kernel-obs-qa: Use srchash for dependency as well")
- commit a840f87
- KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest
memory accesses (bsc#1242782 CVE-2025-23141).
- commit c01b303
- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
(bsc#1245431).
- commit 5ac7828
- mm/hugetlb: unshare page tables during VMA split, not before
(bsc#1245431).
- commit 16c03c2
- hugetlb: unshare some PMDs when splitting VMAs (bsc#1245431).
- commit 42d0bfa
- Update
patches.suse/0012-dm-thin-fix-use-after-free-crash-in-dm_sm_register_t.patch
(git-fixes CVE-2022-50092 bsc#1244848).
- Update
patches.suse/0023-dm-raid-fix-address-sanitizer-warning-in-raid_status.patch
(git-fixes CVE-2022-50084 bsc#1245117).
- Update
patches.suse/0024-dm-raid-fix-address-sanitizer-warning-in-raid_resume.patch
(git-fixes CVE-2022-50085 bsc#1245147).
- Update
patches.suse/0027-drivers-md-fix-a-potential-use-after-free-bug.patch
(git-fixes CVE-2022-50022 bsc#1245131).
- Update
patches.suse/ALSA-bcd2000-Fix-a-UAF-bug-on-the-error-path-of-prob.patch
(git-fixes CVE-2022-50229 bsc#1244856).
- Update
patches.suse/ARM-OMAP2-Fix-refcount-leak-in-omap3xxx_prm_late_ini.patch
(git-fixes CVE-2022-50198 bsc#1244872).
- Update
patches.suse/ARM-OMAP2-Fix-refcount-leak-in-omapdss_init_of.patch
(git-fixes CVE-2022-50199 bsc#1244873).
- Update
patches.suse/ARM-OMAP2-display-Fix-refcount-leak-bug.patch
(git-fixes CVE-2022-50203 bsc#1245189).
- Update
patches.suse/ARM-OMAP2-pdata-quirks-Fix-refcount-leak-bug.patch
(git-fixes CVE-2022-50204 bsc#1245191).
- Update
patches.suse/ARM-bcm-Fix-refcount-leak-in-bcm_kona_smc_init.patch
(git-fixes CVE-2022-50207 bsc#1244871).
- Update
patches.suse/ASoC-SOF-debug-Fix-potential-buffer-overflow-by-snpr.patch
(git-fixes CVE-2022-50051 bsc#1245041).
- Update
patches.suse/ASoC-cros_ec_codec-Fix-refcount-leak-in-cros_ec_code.patch
(git-fixes CVE-2022-50125 bsc#1244814).
- Update patches.suse/ASoC-mt6359-Fix-refcount-leak-bug.patch
(git-fixes CVE-2022-50111 bsc#1244831).
- Update
patches.suse/ASoC-mt6797-mt6351-Fix-refcount-leak-in-mt6797_mt635.patch
(git-fixes CVE-2022-50124 bsc#1244816).
- Update
patches.suse/HID-cp2112-prevent-a-buffer-overflow-in-cp2112_xfer.patch
(git-fixes CVE-2022-50156 bsc#1244782).
- Update
patches.suse/HID-hidraw-fix-memory-leak-in-hidraw_release.patch
(git-fixes CVE-2022-49981 bsc#1245072).
- Update
patches.suse/HID-mcp2221-prevent-a-buffer-overflow-in-mcp_smbus_w.patch
(git-fixes CVE-2022-50131 bsc#1244807).
- Update
patches.suse/HID-steam-Prevent-NULL-pointer-dereference-in-steam_.patch
(git-fies CVE-2022-49984 bsc#1244950).
- Update
patches.suse/Input-iforce-wake-up-after-clearing-IFORCE_XMIT_RUNN.patch
(git-fixes CVE-2022-49954 bsc#1244976).
- Update
patches.suse/KVM-SVM-Don-t-BUG-if-userspace-injects-an-interrupt-.patch
(git-fixes CVE-2022-50228 bsc#1244854).
- Update
patches.suse/NFSv4-pnfs-Fix-a-use-after-free-bug-in-open.patch
(git-fixes CVE-2022-50072 bsc#1244979).
- Update
patches.suse/NFSv4.2-fix-problems-with-__nfs42_ssc_open.patch
(git-fixes CVE-2022-50006 bsc#1245018).
- Update
patches.suse/PCI-dwc-Deallocate-EPC-memory-on-dw_pcie_ep_init-err.patch
(git-fixes CVE-2022-50146 bsc#1244788).
- Update
patches.suse/PCI-mediatek-gen3-Fix-refcount-leak-in-mtk_pcie_init.patch
(git-fixes CVE-2022-50154 bsc#1244784).
- Update
patches.suse/PCI-microchip-Fix-refcount-leak-in-mc_pcie_init_irq_.patch
(git-fixes CVE-2022-50157 bsc#1244780).
- Update
patches.suse/PM-hibernate-defer-device-probing-when-resuming-from.patch
(git-fixes CVE-2022-50202 bsc#1245154).
- Update
patches.suse/RDMA-hfi1-fix-potential-memory-leak-in-setup_base_ct.patch
(git-fixes CVE-2022-50134 bsc#1244802).
- Update
patches.suse/RDMA-irdma-Fix-a-window-for-use-after-free.patch
(git-fixes CVE-2022-50137 bsc#1244800).
- Update
patches.suse/RDMA-qedr-Fix-potential-memory-leak-in-__qedr_alloc_.patch
(git-fixes CVE-2022-50138 bsc#1244797).
- Update
patches.suse/RDMA-rxe-Fix-error-unwind-in-rxe_create_qp.patch
(git-fixes CVE-2022-50127 bsc#1244815).
- Update
patches.suse/RDMA-siw-Fix-duplicated-reported-IW_CM_EVENT_CONNECT.patch
(git-fixes CVE-2022-50136 bsc#1244804).
- Update patches.suse/RDMA-srpt-Fix-a-use-after-free.patch
(git-fixes CVE-2022-50129 bsc#1244811).
- Update
patches.suse/USB-core-Prevent-nested-device-reset-calls.patch
(git-fixes bsc#1206664 CVE-2022-4662 CVE-2022-49936
bsc#1244984).
- Update
patches.suse/apparmor-Fix-memleak-in-aa_simple_write_to_buffer.patch
(git-fixes CVE-2022-50074 bsc#1244965).
- Update
patches.suse/apparmor-fix-reference-count-leak-in-aa_pivotroot.patch
(git-fixes CVE-2022-50077 bsc#1244977).
- Update
patches.suse/arm64-cacheinfo-Fix-incorrect-assignment-of-signed-error-value-to-unsigned-fw_level.patch
(git-fixes CVE-2022-49964 bsc#1245064).
- Update
patches.suse/arm64-fix-oops-in-concurrently-setting-insn_emulatio.patch
(git-fixes CVE-2022-50206 bsc#1245152).
- Update patches.suse/ath11k-fix-netdev-open-race.patch (git-fixes
CVE-2022-50187 bsc#1244890).
- Update
patches.suse/ath9k-fix-use-after-free-in-ath9k_hif_usb_rx_cb.patch
(CVE-2022-1679 bsc#1199487 CVE-2022-50179 bsc#1244886).
- Update
patches.suse/bpf-Adjust-insufficient-default-bpf_jit_limit.patch
(bsc#1218234 git-fixes CVE-2023-53076 bsc#1242221).
- Update
patches.suse/bpf-Don-t-use-tnum_range-on-array-range-checking-for.patch
(bsc#1202564 bsc#1202860 CVE-2022-2905 CVE-2022-49985
bsc#1244956).
- Update
patches.suse/btrfs-fix-space-cache-corruption-and-potential-doubl.patch
(bsc#1203361 CVE-2022-49999 bsc#1245019).
- Update
patches.suse/btrfs-unset-reloc-control-if-transaction-commit-fail.patch
(bsc#1212051 CVE-2023-3111 CVE-2022-50067 bsc#1245047).
- Update
patches.suse/ceph-don-t-leak-snap_rwsem-in-handle_cap_grant.patch
(bsc#1202823 CVE-2022-50059 bsc#1245031).
- Update
patches.suse/cifs-Fix-memory-leak-on-the-deferred-close.patch
(bsc#1193629 CVE-2022-50076 bsc#1244983).
- Update
patches.suse/cifs-fix-small-mempool-leak-in-SMB2_negotiate-.patch
(bsc#1193629 CVE-2022-49938 bsc#1244820).
- Update
patches.suse/clk-bcm-rpi-Prevent-out-of-bounds-access.patch
(git-fixes CVE-2022-49946 bsc#1244944).
- Update
patches.suse/clk-qcom-ipq8074-dont-disable-gcc_sleep_clk_src.patch
(git-fixes CVE-2022-50029 bsc#1245146).
- Update
patches.suse/cpufreq-zynq-Fix-refcount-leak-in-zynq_get_revision.patch
(git-fixes CVE-2022-50197 bsc#1244876).
- Update
patches.suse/crypto-arm64-poly1305-fix-a-read-out-of-bound.patch
(git-fixes CVE-2022-50231 bsc#1244853).
- Update
patches.suse/crypto-ccp-Use-kzalloc-for-sev-ioctl-interfaces-to-p.patch
(git-fixes CVE-2022-50226 bsc#1244860).
- Update
patches.suse/crypto-hisilicon-sec-don-t-sleep-when-in-softirq.patch
(git-fixes CVE-2022-50171 bsc#1244765).
- Update
patches.suse/dmaengine-dw-axi-dmac-do-not-print-NULL-LLI-during-e.patch
(git-fixes CVE-2022-50024 bsc#1245133).
- Update
patches.suse/dmaengine-dw-axi-dmac-ignore-interrupt-if-no-descrip.patch
(git-fixes CVE-2022-50023 bsc#1245134).
- Update
patches.suse/dmaengine-sf-pdma-Add-multithread-support-for-a-DMA-.patch
(git-fixes CVE-2022-50145 bsc#1244787).
- Update
patches.suse/driver-core-fix-potential-deadlock-in-__driver_attac.patch
(git-fixes CVE-2022-50149 bsc#1244883).
- Update
patches.suse/drm-amd-display-Check-correct-bounds-for-stream-enco.patch
(git-fixes CVE-2022-50079 bsc#1244970).
- Update
patches.suse/drm-amd-display-clear-optc-underflow-before-turn-off.patch
(git-fixes CVE-2022-49969 bsc#1245060).
- Update
patches.suse/drm-amd-pm-add-missing-fini_microcode-interface-for-.patch
(git-fixes CVE-2022-49966 bsc#1245062).
- Update patches.suse/drm-i915-fix-null-pointer-dereference.patch
(git-fixes CVE-2022-49960 bsc#1244911).
- Update
patches.suse/drm-mcde-Fix-refcount-leak-in-mcde_dsi_bind.patch
(git-fixes CVE-2022-50176 bsc#1244902).
- Update
patches.suse/drm-meson-Fix-refcount-bugs-in-meson_vpu_has_availab.patch
(git-fixes CVE-2022-50038 bsc#1244943).
- Update
patches.suse/drm-msm-mdp5-Fix-global-state-lock-backoff.patch
(git-fixes CVE-2022-50173 bsc#1244992).
- Update
patches.suse/drm-radeon-fix-potential-buffer-overflow-in-ni_set_m.patch
(git-fixes CVE-2022-50185 bsc#1244887).
- Update
patches.suse/drm-sun4i-dsi-Prevent-underflow-when-computing-packe.patch
(git-fixes CVE-2022-50036 bsc#1244941).
- Update
patches.suse/drm-ttm-Fix-dummy-res-NULL-ptr-deref-bug.patch
(git-fixes CVE-2022-50068 bsc#1245142).
- Update
patches.suse/ext4-add-EXT4_INODE_HAS_XATTR_SPACE-macro-in-xattr.h.patch
(bsc#1206878 CVE-2022-50083 bsc#1244968).
- Update
patches.suse/ext4-avoid-resizing-to-a-partial-cluster-size.patch
(bsc#1206880 CVE-2022-50020 bsc#1245129).
- Update
patches.suse/ext4-block-range-must-be-validated-before-use-in-ext.patch
(bsc#1213090 CVE-2022-50021 bsc#1245180).
- Update
patches.suse/fbdev-fb_pm2fb-Avoid-potential-divide-by-zero-error.patch
(git-fixes CVE-2022-49978 bsc#1245195).
- Update
patches.suse/firmware-arm_scpi-Ensure-scpi_info-is-not-assigned-i.patch
(git-fixes CVE-2022-50087 bsc#1245119).
- Update
patches.suse/ftrace-Fix-NULL-pointer-dereference-in-is_ftrace_trampoline-when-ftrace-is-dead.patch
(git-fixes CVE-2022-49977 bsc#1244936).
- Update patches.suse/gadgetfs-ep_io-wait-until-IRQ-finishes.patch
(git-fixes CVE-2022-50028 bsc#1245135).
- Update
patches.suse/habanalabs-gaudi-fix-shift-out-of-bounds.patch
(git-fixes CVE-2022-50026 bsc#1245088).
- Update
patches.suse/hwmon-gpio-fan-Fix-array-out-of-bounds-access.patch
(git-fixes CVE-2022-49945 bsc#1244908).
- Update patches.suse/iavf-Fix-adminq-error-handling.patch
(git-fixes CVE-2022-50055 bsc#1245039).
- Update patches.suse/iavf-Fix-reset-error-handling.patch
(git-fixes CVE-2022-50053 bsc#1245038).
- Update
patches.suse/ieee802154-adf7242-defer-destroy_workqueue-call.patch
(git-fixes CVE-2022-49968 bsc#1244959).
- Update
patches.suse/iio-light-isl29028-Fix-the-warning-in-isl29028_remov.patch
(git-fixes CVE-2022-50218 bsc#1244861).
- Update
patches.suse/intel_th-Fix-a-resource-leak-in-an-error-handling-pa.patch
(git-fixes CVE-2022-50143 bsc#1244790).
- Update patches.suse/intel_th-msu-Fix-vmalloced-buffers.patch
(git-fixes CVE-2022-50142 bsc#1244796).
- Update
patches.suse/iommu-vt-d-avoid-invalid-memory-access-via-node_online-NUMA_NO_N
(git-fixes CVE-2022-50093 bsc#1244849).
- Update
patches.suse/jbd2-fix-assertion-jh-b_frozen_data-NULL-failure-whe.patch
(bsc#1202716 CVE-2022-50126 bsc#1244813).
- Update patches.suse/kcm-fix-strp_init-order-and-cleanup.patch
(git-fies CVE-2022-49957 bsc#1244966).
- Update
patches.suse/kprobes-don-t-call-disarm_kprobe-for-disabled-kprobes.patch
(git-fixes CVE-2022-50008 bsc#1245009).
- Update
patches.suse/loop-Check-for-overflow-while-configuring-loop.patch
(git-fies CVE-2022-49993 bsc#1245121).
- Update patches.suse/md-call-__md_stop_writes-in-md_stop.patch
(git-fixes CVE-2022-49987 bsc#1245024).
- Update patches.suse/md-raid10-fix-KASAN-warning.patch (git-fixes
CVE-2022-50211 bsc#1245140).
- Update
patches.suse/media-mceusb-Use-new-usb_control_msg_-routines.patch
(CVE-2022-3903 bsc#1205220 CVE-2022-49937 bsc#1245057).
- Update
patches.suse/media-pvrusb2-fix-memory-leak-in-pvr_probe.patch
(git-fixes CVE-2022-49982 bsc#1245069).
- Update
patches.suse/media-tw686x-Fix-memory-leak-in-tw686x_video_init.patch
(git-fixes CVE-2022-50175 bsc#1244903).
- Update patches.suse/memstick-ms_block-Fix-a-memory-leak.patch
(git-fixes CVE-2022-50140 bsc#1244793).
- Update
patches.suse/meson-mx-socinfo-Fix-refcount-leak-in-meson_mx_socin.patch
(git-fixes CVE-2022-50209 bsc#1244868).
- Update
patches.suse/mfd-max77620-Fix-refcount-leak-in-max77620_initialis.patch
(git-fixes CVE-2022-50108 bsc#1244834).
- Update
patches.suse/misc-fastrpc-fix-memory-corruption-on-open.patch
(git-fixes CVE-2022-49950 bsc#1244958).
- Update
patches.suse/misc-fastrpc-fix-memory-corruption-on-probe.patch
(git-fixes CVE-2022-49952 bsc#1244945).
- Update
patches.suse/mmc-sdhci-of-esdhc-Fix-refcount-leak-in-esdhc_signal.patch
(git-fixes CVE-2022-50141 bsc#1244794).
- Update
patches.suse/mptcp-use-OPTION_MPTCP_MPJ_SYNACK-in-subflow_finish_.patch
(CVE-2025-23145 bsc#1242596 CVE-2024-35840 bsc#1224597).
- Update
patches.suse/msft-hv-2639-scsi-storvsc-Remove-WQ_MEM_RECLAIM-from-storvsc_erro.patch
(git-fixes CVE-2022-49986 bsc#1244948).
- Update
patches.suse/mt76-mt76x02u-fix-possible-memory-leak-in-__mt76x02u.patch
(git-fixes CVE-2022-50172 bsc#1244764).
- Update
patches.suse/mtd-maps-Fix-refcount-leak-in-ap_flash_init.patch
(git-fixes CVE-2022-50160 bsc#1244776).
- Update
patches.suse/mtd-maps-Fix-refcount-leak-in-of_flash_probe_versati.patch
(git-fixes CVE-2022-50161 bsc#1244774).
- Update
patches.suse/mtd-parsers-ofpart-Fix-refcount-leak-in-bcm4908_part.patch
(git-fixes CVE-2022-50155 bsc#1244781).
- Update
patches.suse/mtd-partitions-Fix-refcount-leak-in-parse_redboot_of.patch
(git-fixes CVE-2022-50158 bsc#1244779).
- Update
patches.suse/net-atlantic-fix-aq_vec-index-out-of-range-error.patch
(git-fixes CVE-2022-50066 bsc#1244985).
- Update
patches.suse/net-bgmac-Fix-a-BUG-triggered-by-wrong-bytes_compl.patch
(git-fixes CVE-2022-50062 bsc#1245028).
- Update
patches.suse/net-dsa-mv88e6060-prevent-crash-on-an-unused-port.patch
(git-fixes CVE-2022-50047 bsc#1244993).
- Update
patches.suse/net-dsa-sja1105-fix-buffer-overflow-in-sja1105_setup.patch
(git-fixes CVE-2022-50040 bsc#1244949).
- Update
patches.suse/net-sched-fix-netdevice-reference-leaks-in-attach_de.patch
(git-fixes CVE-2022-49958 bsc#1244974).
- Update
patches.suse/net-sunrpc-fix-potential-memory-leaks-in-rpc_sysfs_x.patch
(git-fixes CVE-2022-50046 bsc#1244991).
- Update
patches.suse/net-tap-NULL-pointer-derefence-in-dev_parse_header_p.patch
(git-fixes CVE-2022-50073 bsc#1244978).
- Update
patches.suse/netfilter-nf_tables-do-not-allow-CHAIN_ID-to-refer-t.patch
(CVE-2022-2586 bsc#1202095 CVE-2022-50212 bsc#1244869).
- Update
patches.suse/netfilter-nf_tables-do-not-allow-SET_ID-to-refer-to-.patch
(CVE-2022-2586 bsc#1202095 CVE-2022-50213 bsc#1244867).
- Update
patches.suse/nfc-pn533-Fix-use-after-free-bugs-caused-by-pn532_cm.patch
(git-fixes CVE-2022-50005 bsc#1245011).
- Update
patches.suse/octeontx2-af-Fix-mcam-entry-resource-leak.patch
(git-fixes CVE-2022-50060 bsc#1245032).
- Update
patches.suse/pinctrl-nomadik-Fix-refcount-leak-in-nmk_pinctrl_dt_.patch
(git-fixes CVE-2022-50061 bsc#1245033).
- Update
patches.suse/posix-cpu-timers-Cleanup-CPU-timers-before-freeing-t.patch
(CVE-2022-2585 bsc#1202094 CVE-2022-50095 bsc#1244846).
- Update
patches.suse/powerpc-64-Init-jump-labels-before-parse_early_param.patch
(bsc#1065729 CVE-2022-50012 bsc#1245125).
- Update
patches.suse/powerpc-iommu-fix-memory-leak-with-using-debugfs_loo.patch
(bsc#1194869 CVE-2023-53097 bsc#1244114).
- Update patches.suse/powerpc-pci-Fix-get_phb_number-locking.patch
(bsc#1065729 CVE-2022-50045 bsc#1244967).
- Update
patches.suse/powerpc-perf-Optimize-clearing-the-pending-PMI-and-r.patch
(bsc#1156395 CVE-2022-50118 bsc#1244825).
- Update
patches.suse/powerpc-xive-Fix-refcount-leak-in-xive_get_max_prio.patch
(fate#322438 git-fixess CVE-2022-50104 bsc#1244836).
- Update
patches.suse/regulator-of-Fix-refcount-leak-bug-in-of_get_regulat.patch
(git-fixes CVE-2022-50191 bsc#1244899).
- Update
patches.suse/remoteproc-imx_rproc-Fix-refcount-leak-in-imx_rproc_.patch
(git-fixes CVE-2022-50120 bsc#1244819).
- Update
patches.suse/remoteproc-k3-r5-Fix-refcount-leak-in-k3_r5_cluster_.patch
(git-fixes CVE-2022-50121 bsc#1244823).
- Update
patches.suse/rpmsg-qcom_smd-Fix-refcount-leak-in-qcom_smd_parse_e.patch
(git-fixes CVE-2022-50112 bsc#1244832).
- Update
patches.suse/s390-fix-double-free-of-GS-and-RI-CBs-on-fork-failure
(bsc#1203197 LTC#199895 CVE-2022-49990 bsc#1245006).
- Update patches.suse/sch_htb-make-htb_deactivate-idempotent.patch
(CVE-2025-37798 bsc#1242414 CVE-2025-37953 bsc#1243543).
- Update
patches.suse/sch_htb-make-htb_qlen_notify-idempotent.patch
(CVE-2025-37798 bsc#1242414 CVE-2025-37932 bsc#1243627).
- Update
patches.suse/sched-core-Do-not-requeue-task-on-CPU-excluded-from-cpus_mask.patch
(bnc#1199356 CVE-2022-50100 bsc#1244843).
- Update
patches.suse/sched-cpuset-Fix-dl_cpu_busy-panic-due-to-empty-cs-c.patch
(git-fixes CVE-2022-50103 bsc#1244840).
- Update
patches.suse/scsi-core-Fix-unremoved-procfs-host-directory-regression.patch
(git-fixes CVE-2024-26935 bsc#1223675).
- Update
patches.suse/scsi-iscsi-Fix-HW-conn-removal-use-after-free.patch
(bsc#1198410 CVE-2022-50031 bsc#1245118).
- Update
patches.suse/scsi-lpfc-Fix-possible-memory-leak-when-failing-to-i.patch
(bsc#1201956 CVE-2022-50027 bsc#1245073).
- Update
patches.suse/scsi-lpfc-Prevent-buffer-overflow-crashes-in-debugfs.patch
(bsc#1201956 CVE-2022-50030 bsc#1245265).
- Update
patches.suse/scsi-qla2xxx-fix-crash-due-to-stale-srb-access-around-i-o-timeouts.patch
(bsc#1201160 CVE-2022-50098 bsc#1244841).
- Update
patches.suse/scsi-sg-Allow-waiting-for-commands-to-complete-on-removed-device.patch
(git-fixes CVE-2022-50215 bsc#1245138).
- Update
patches.suse/selinux-Add-boundary-check-in-put_entry.patch
(git-fixes CVE-2022-50200 bsc#1245149).
- Update
patches.suse/selinux-fix-memleak-in-security_read_state_kernel.patch
(git-fixes CVE-2022-50201 bsc#1245197).
- Update
patches.suse/soc-amlogic-Fix-refcount-leak-in-meson-secure-pwrc.c.patch
(git-fixes CVE-2022-50208 bsc#1244870).
- Update
patches.suse/soc-qcom-aoss-Fix-refcount-leak-in-qmp_cooling_devic.patch
(git-fixes CVE-2022-50194 bsc#1244878).
- Update
patches.suse/soc-qcom-ocmem-Fix-refcount-leak-in-of_get_ocmem.patch
(git-fixes CVE-2022-50196 bsc#1244875).
- Update
patches.suse/spi-Fix-simplification-of-devm_spi_register_controll.patch
(git-fixes CVE-2022-50190 bsc#1244895).
- Update
patches.suse/spi-tegra20-slink-fix-UAF-in-tegra_slink_remove.patch
(git-fixes CVE-2022-50192 bsc#1244879).
- Update
patches.suse/spmi-trace-fix-stack-out-of-bound-access-in-SPMI-tracing-functions.patch
(git-fixes CVE-2022-50094 bsc#1244851).
- Update
patches.suse/staging-rtl8712-fix-use-after-free-bugs.patch
(CVE-2022-4095 bsc#1205514 CVE-2022-49956 bsc#1244969).
- Update
patches.suse/stmmac-intel-Add-a-missing-clk_disable_unprepare-cal.patch
(git-fixes CVE-2022-50039 bsc#1244942).
- Update
patches.suse/tty-n_gsm-add-sanity-check-for-gsm-receive-in-gsm_re.patch
(git-fixes CVE-2022-49940 bsc#1244866).
- Update
patches.suse/tty-n_gsm-fix-deadlock-and-link-starvation-in-outgoi.patch
(git-fixes CVE-2022-50116 bsc#1244824).
- Update
patches.suse/tty-serial-Fix-refcount-leak-bug-in-ucc_uart.c.patch
(git-fixes CVE-2022-50019 bsc#1245098).
- Update
patches.suse/tty-vt-initialize-unicode-screen-buffer.patch
(git-fixes CVE-2022-50222 bsc#1245136).
- Update
patches.suse/udmabuf-Set-the-DMA-mask-for-the-udmabuf-device-v2.patch
(git-fixes CVE-2022-49983 bsc#1245092).
- Update
patches.suse/usb-aspeed-vhub-Fix-refcount-leak-bug-in-ast_vhub_in.patch
(git-fixes CVE-2022-50139 bsc#1244798).
- Update
patches.suse/usb-cdns3-change-place-of-priv_ep-assignment-in-cdns.patch
(git-fixes CVE-2022-50132 bsc#1244808).
- Update
patches.suse/usb-cdns3-fix-random-warning-message-when-driver-loa.patch
(git-fixes CVE-2022-50151 bsc#1245093).
- Update
patches.suse/usb-cdns3-fix-use-after-free-at-workaround-2.patch
(git-fixes CVE-2022-50034 bsc#1245089).
- Update
patches.suse/usb-host-Fix-refcount-leak-in-ehci_hcd_ppc_of_probe.patch
(git-fixes CVE-2022-50153 bsc#1244786).
- Update
patches.suse/usb-host-ohci-ppc-of-Fix-refcount-leak-bug.patch
(git-fixes CVE-2022-50033 bsc#1245139).
- Update
patches.suse/usb-ohci-nxp-Fix-refcount-leak-in-ohci_hcd_nxp_probe.patch
(git-fixes CVE-2022-50152 bsc#1244783).
- Update patches.suse/usb-renesas-Fix-refcount-leak-bug.patch
(git-fixes CVE-2022-50032 bsc#1245103).
- Update
patches.suse/usb-typec-tcpm-fix-warning-when-handle-discover_iden.patch
(git-fixes CVE-2023-53048 bsc#1244179).
- Update
patches.suse/usbnet-Fix-linkwatch-use-after-free-on-disconnect.patch
(git-fixes CVE-2022-50220 bsc#1245348).
- Update
patches.suse/venus-pm_helpers-Fix-warning-in-OPP-during-probe.patch
(git-fixes CVE-2022-50011 bsc#1244915).
- Update
patches.suse/video-fbdev-amba-clcd-Fix-refcount-leak-bugs.patch
(git-fixes CVE-2022-50109 bsc#1244884).
- Update
patches.suse/video-fbdev-arkfb-Check-the-size-of-screen-before-me.patch
(git-fixes CVE-2022-50099 bsc#1244842).
- Update
patches.suse/video-fbdev-arkfb-Fix-a-divide-by-zero-bug-in-ark_se.patch
(git-fixes CVE-2022-50102 bsc#1244838).
- Update
patches.suse/video-fbdev-i740fb-Check-the-argument-of-i740_calc_v.patch
(git-fixes CVE-2022-50010 bsc#1245122).
- Update
patches.suse/video-fbdev-s3fb-Check-the-size-of-screen-before-mem.patch
(git-fixes CVE-2022-50097 bsc#1244845).
- Update
patches.suse/video-fbdev-vt8623fb-Check-the-size-of-screen-before.patch
(git-fixes CVE-2022-50101 bsc#1244839).
- Update
patches.suse/virtio-gpu-fix-a-missing-check-to-avoid-NULL-derefer.patch
(git-fixes CVE-2022-50181 bsc#1244901).
- Update
patches.suse/virtio_net-fix-memory-leak-inside-XPD_TX-with-mergea.patch
(git-fixes CVE-2022-50065 bsc#1244986).
- Update
patches.suse/vt-Clear-selection-before-changing-the-font.patch
(git-fixes CVE-2022-49948 bsc#1245058).
- Update
patches.suse/watchdog-sp5100_tco-Fix-a-memory-leak-of-EFCH-MMIO-r.patch
(git-fixes CVE-2022-50110 bsc#1244830).
- Update
patches.suse/wifi-iwlwifi-mvm-fix-double-list_add-at-iwl_mvm_mac_.patch
(git-fixes CVE-2022-50164 bsc#1244770).
- Update
patches.suse/wifi-libertas-Fix-possible-refcount-leak-in-if_usb_p.patch
(git-fixes CVE-2022-50162 bsc#1244773).
- Update
patches.suse/wifi-mac80211-Don-t-finalize-CSA-in-IBSS-mode-if-sta.patch
(git-fixes CVE-2022-49942 bsc#1244881).
- Update
patches.suse/wifi-mac80211-Fix-UAF-in-ieee80211_scan_rx.patch
(git-fixes CVE-2022-49934 bsc#1245051).
- Update
patches.suse/wifi-rtw89-8852a-rfk-fix-div-0-exception.patch
(git-fixes CVE-2022-50178 bsc#1244900).
- Update
patches.suse/wifi-wil6210-debugfs-fix-info-leak-in-wil_write_file.patch
(git-fixes CVE-2022-50169 bsc#1244767).
- Update
patches.suse/wifi-wil6210-debugfs-fix-uninitialized-variable-use-.patch
(git-fixes CVE-2022-50165 bsc#1244771).
- Update
patches.suse/writeback-avoid-use-after-free-after-removing-device.patch
(bsc#1207638 CVE-2022-49995 bsc#1245012).
- Update
patches.suse/xen-privcmd-fix-error-exit-of-privcmd_ioctl_dm_op.patch
(git-fixes CVE-2022-49989 bsc#1245007).
- commit 7202356
- Update
patches.suse/powerpc-pseries-iommu-IOMMU-incorrectly-marks-MMIO-r.patch
(bsc#1218470 ltc#204531 CVE-2024-57999 bsc#1238526).
- commit 12e737a
- net_sched: prio: fix a race in prio_tune() (CVE-2025-38083
bsc#1245183).
- commit 2221c2d
- dmaengine: idxd: Refactor remove call with idxd_cleanup()
helper (CVE-2025-38014 bsc#1244732).
- commit c97ce5d
- Remove host-memcpy-hack.h
This might have been usefult at some point but we have more things that
depend on specific library versions today.
- commit 0396c23
- Remove compress-vmlinux.sh
/usr/lib/rpm/brp-suse.d/brp-99-compress-vmlinux was added in
pesign-obs-integration during SLE12 RC. This workaround can be removed.
- commit 19caac0
- Remove try-disable-staging-driver
The config for linux-next is autogenerated from master config, and
defaults filled for missing options. This is unlikely to enable any
staging driver in the first place.
- commit a6f21ed
- Refresh patches.suse/netfilter-nf_tables-use-timestamp-to-check-for-set-element.patch.
The gc path is async therefore it shouldn't use the timestamp but the
current time instead.
- commit 7fca653
- net_sched: hfsc: Address reentrant enqueue adding class to
eltree twice (CVE-2025-38001 bsc#1244234).
- commit 47685d0
- net/sched: sch_ets: don't remove idle classes from the
round-robin list (bsc#1207361 CVE-2021-47595 bsc#1226552).
- net/sched: sch_ets: don't peek at classes beyond 'nbands'
(bsc#1207361 bsc#1225468 CVE-2021-47557).
- commit 6b479ec
- sch_htb: make htb_deactivate() idempotent (CVE-2025-37798
bsc#1242414).
- codel: remove sch->q.qlen check before
qdisc_tree_reduce_backlog() (CVE-2025-37798 bsc#1242414).
- sch_ets: make est_qlen_notify() idempotent (CVE-2025-37798
bsc#1242414).
- sch_qfq: make qfq_qlen_notify() idempotent (CVE-2025-37798
bsc#1242414).
- sch_hfsc: make hfsc_qlen_notify() idempotent (CVE-2025-37798
bsc#1242414).
- sch_drr: make drr_qlen_notify() idempotent (CVE-2025-37798
bsc#1242414).
- sch_htb: make htb_qlen_notify() idempotent (CVE-2025-37798
bsc#1242414).
- commit 4e7c132
- netfilter: nf_tables: use timestamp to check for set element
timeout (CVE-2024-27397 bsc#1224095).
- commit 0345626
- packaging: Add support for suse-kabi-tools
The current workflow to check kABI stability during the RPM build of SUSE
kernels consists of the following steps:
* The downstream script rpm/modversions unpacks the consolidated kABI
symtypes reference data from kabi/<arch>/symtypes-<flavor> and creates
individual symref files.
* The build performs a regular kernel make. During this operation, genksyms
is invoked for each source file. The tool determines type signatures of
all exports within the file, reports any differences compared to the
associated symref reference, calculates symbol CRCs from the signatures
and writes new type data into a symtypes file.
* The script rpm/modversions is invoked again, this time it packs all new
symtypes files to a consolidated kABI file.
* The downstream script rpm/kabi.pl checks symbol CRCs in the new build and
compares them to a reference from kabi/<arch>/symvers-<flavor>, taking
kabi/severities into account.
suse-kabi-tools is a new set of tools to improve the kABI checking process.
The suite includes two tools, ksymtypes and ksymvers, which replace the
existing scripts rpm/modversions and rpm/kabi.pl, as well as the comparison
functionality previously provided by genksyms. The tools have their own
source repository and package.
The tools provide faster operation and more detailed, unified output. In
addition, they allow the use of the new upstream tool gendwarfksyms, which
lacks any built-in comparison functionality.
The updated workflow is as follows:
* The build performs a regular kernel make. During this operation, genksyms
(gendwarfksyms) is invoked as usual, determinining signatures and CRCs of
all exports and writing the type data to symtypes files. However,
genksyms no longer performs any comparison.
* 'ksymtypes consolidate' packs all new symtypes files to a consolidated
kABI file.
* 'ksymvers compare' checks symbol CRCs in the new build and compares them
to a reference from kabi/<arch>/symvers-<flavor>, taking kabi/severities
into account. The tool writes its result in a human-readable form on
standard output and also writes a list of all changed exports (not
ignored by kabi/severities) to the changed-exports file.
* 'ksymtypes compare' takes the changed-exports file, the consolidated kABI
symtypes reference data from kabi/<arch>/symtypes-<flavor> and the new
consolidated data. Based on this data, it produces a detailed report
explaining why the symbols changed.
The patch enables the use of suse-kabi-tools via rpm/config.sh, providing
explicit control to each branch. To enable the support, set
USE_SUSE_KABI_TOOLS=Yes in the config file.
- commit a2c6f89
- netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for
inet/ingress basechain (CVE-2024-26808 bsc#1222634).
- commit 8ae94b6
- netfilter: nft_set_rbtree: .deactivate fails if element has
expired (CVE-2024-27397 bsc#1224095).
- commit 544c57e
- kernel-source: Remove log.sh from sources
- commit 96bd779
- netfilter: ipset: add missing range check in bitmap_ip_uadt (CVE-2024-53141 bsc#1234381)
- commit 6255020
- net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too
(CVE-2025-37823 bsc#1242924).
- commit 10fd231
- net: sched: sch_multiq: fix possible OOB write in multiq_tune()
(CVE-2024-36978 bsc#1226514).
- commit 6416785
- sch_hfsc: Fix qlen accounting bug when using peek in
hfsc_enqueue() (CVE-2025-38000 bsc#1244277).
- commit 411bb06
- net_sched: hfsc: Fix a UAF vulnerability in class with netem
as child qdisc (CVE-2025-37890 bsc#1243330).
- commit 33c0be8
- netfilter: ipset: fix region locking in hash types
(CVE-2025-37997 bsc#1243832).
- commit e26a95e
- netfilter: nf_tables: don't fail inserts if duplicate has
expired (git-fixes CVE-2023-52925 bsc#1236822).
- commit cd97e1a
- netfilter: nf_tables: don't skip expired elements during walk
(CVE-2023-52924 bsc#1236821).
- Refresh
patches.suse/netfilter-nft_set_pipapo-skip-inactive-elements-duri.patch.
- commit 6faff42
- bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156
CVE-2024-53125).
- commit 29ff5bf
- net: sched: Disallow replacing of child qdisc from one parent
to another (CVE-2025-21700 bsc#1237159).
- commit 7b38bc0
- vsock: Orphan socket after transport release (bsc#1238876
CVE-2025-21756).
- commit 7e39328
- vsock: Keep the binding until socket destruction (bsc#1238876
CVE-2025-21756).
- commit a3adf03
- netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()
(git-fixes CVE-2025-21703 bsc#1237313).
- commit 6fdf91c
- pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (CVE-2025-21702 bsc#1237312)
- commit 874558c
- net_sched: sch_fifo: implement lockless __fifo_dump() (bsc#1237312)
- commit a5fc425
- netfilter: nft_set_pipapo: do not free live element
(CVE-2024-26924 bsc#1223387).
- commit b8b066b
- net/sched: netem: account for backlog updates from child qdisc
(CVE-2024-56770 bsc#1235637).
- sch/netem: fix use after free in netem_dequeue (CVE-2024-56770
bsc#1235637 CVE-2024-46800 bsc#1230827).
- commit a31493e
- mkspec: Exclude rt flavor from kernel-syms dependencies (bsc#1244337).
- commit 7c95ae0
- powerpc/vas: Return -EINVAL if the offset is non-zero in mmap()
(bsc#1244309 ltc#213790).
- powerpc/powernv/memtrace: Fix out of bounds issue in memtrace
mmap (bsc#1244309 ltc#213790).
- commit 85e9dad
- MyBS: Do not build kernel-obs-qa with limit_packages
Fixes: 58e3f8c34b2b ("bs-upload-kernel: Pass limit_packages also on multibuild")
- commit f4c6047
- MyBS: Simplify qa_expr generation
Start with a 0 which makes the expression valid even if there are no QA
repositories (currently does not happen). Then separator is always
needed.
- commit e4c2851
- MyBS: Correctly generate build flags for non-multibuild package limit
(bsc# 1244241)
Fixes: 0999112774fc ("MyBS: Use buildflags to set which package to build")
- commit 27588c9
- bs-upload-kernel: Pass limit_packages also on multibuild
Fixes: 0999112774fc ("MyBS: Use buildflags to set which package to build")
Fixes: 747f601d4156 ("bs-upload-kernel, MyBS, Buildresults: Support multibuild (JSC-SLE#5501, boo#1211226, bsc#1218184)")
- commit 8ef486c
- wifi: cfg80211: fix certs build to not depend on file order
(bsc#1243001).
- wifi: cfg80211: Add my certificate (bsc#1243001).
- commit 3b8f8fd
- kernel-source: Do not use multiple -r in sed parameters
This usage is enabled in commit b18d64d
(sed: allow multiple (non-conflicting) -E/-r parameters, 2016-07-31)
only available since sed 4.3
Fixes: dc2037cd8f94 ("kernel-source: Also replace bin/env"
- commit 91ad98e
- coreutils
-
- coreutils-9.7-sort-CVE-2025-5278.patch: Add upstream patch:
sort with key character offsets of SIZE_MAX, could induce
a read of 1 byte before an allocated heap buffer.
(CVE-2025-5278, bsc#1243767)
- samba
-
- CVE-2025-9640: fix vfs_streams_xattr uninitialized memory write;
(bsc#1251279);(bso#15885).
- CVE-2025-10230: fix command Injection in WINS Server Hook Script;
(bsc#1251280);(bso#15903).
- Windows security hardening locks out schannel'ed netlogon dc
calls like netr_DsRGetDCName; (bsc#1246431); (bso#15876).
- Update shipped /etc/samba/smb.conf to point to smb.conf
man page;(bsc#1233880).
- cups
-
- cups-2.2.7-CVE-2024-47175.patch is based on
https://github.com/OpenPrinting/libppd/commit/d681747ebf12602cb426725eb8ce2753211e2477
backported to CUPS 2.2.7 to fix CVE-2024-47175
"lack of input sanitization in _ppdCreateFromIPP()"
(bsc#1230932 and bsc#1246533)
- In general regarding CUPS and cups-browsed security issues see
https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings
- cups-2.2.7-CVE-2025-58364.patch is derived
from the upstream patch to fix CVE-2025-58364
"Remote DoS via null dereference"
https://github.com/OpenPrinting/cups/security/advisories/GHSA-7qx3-r744-6qv4
bsc#1249128
- cups-2.2.7-CVE-2025-58060.patch is derived
from the upstream patch against CUPS 2.4
to fix CVE-2025-58060
"Authentication bypass with AuthType Negotiate"
https://github.com/OpenPrinting/cups/security/advisories/GHSA-4c68-qgrh-rmmq
bsc#1249049
- Removed the obsoleted cups-2.1.0-cups-systemd-socket.patch
see the below entry dated "Fri Jun 2 10:32:33 CEST 2017"
- curl
-
- tool_operate: fix return code when --retry is used but not
triggered [bsc#1249367]
* Add curl-tool_operate-fix-return-code-when-retry-is-used.patch
- Security fixes:
* [bsc#1249191, CVE-2025-9086] Out of bounds read for cookie path
* [bsc#1249348, CVE-2025-10148] Predictable WebSocket mask
* Add patches:
- curl-CVE-2025-9086.patch
- curl-CVE-2025-10148.patch
- Fix the --ftp-pasv option in curl v8.14.1 [bsc#1246197]
* tool_getparam: fix --ftp-pasv [5f805ee]
* Add curl-fix--ftp-pasv.patch
- Update to 8.14.1: [jsc#PED-13055, jsc#PED-13056]
* Add _multibuild
* Rebase patches:
- curl-disabled-redirect-protocol-message.patch
- curl-secure-getenv.patch
- dont-mess-with-rpmoptflags.patch
- libcurl-ocloexec.patch
* Remove patches fixed in the update:
- curl-CVE-2023-28319.patch
- curl-CVE-2023-28320.patch
- curl-CVE-2023-28321.patch
- curl-CVE-2023-28322.patch
- curl-CVE-2023-32001.patch
- curl-CVE-2023-38039.patch
- curl-CVE-2023-38545.patch
- curl-CVE-2023-38546.patch
- curl-CVE-2023-46218.patch
- curl-CVE-2023-46219.patch
- curl-CVE-2024-11053.patch
- curl-CVE-2024-2004.patch
- curl-CVE-2024-2398.patch
- curl-CVE-2024-7264.patch
- curl-CVE-2024-8096.patch
- curl-CVE-2024-9681.patch
- curl-CVE-2025-0167.patch
- curl-CVE-2025-0725.patch
- curl-aws_sigv4-canonicalise-valueless-query-params.patch
- curl-aws_sigv4-canonicalize-the-query.patch
- curl-aws_sigv4-skip-the-op-if-the-query-pair-is-zero-bytes.patch
- curl-aws_sigv4-the-query-canon-code-miscounted-url-encoded-input.patch
- curl-aws_sigv4-url-encode-the-canonical-path.patch
- curl-aws_sigv4-verify-query-canonization.patch
- curl-libssh_Implement_SFTP_packet_size_limit.patch
- Sync spec file with SLE codestreams: [jsc#PED-13055, jsc#PED-13056]
* Add curl-mini.rpmlintrc to avoid rpmlint shlib-policy-name-error
when building the curl-mini package in SLE.
* Add libssh minimum version requirements.
* Use ldconfig_scriptlets when available.
* Remove unused option --disable-ntlm-wb.
- docker
-
- Update to Docker 28.3.3-ce. See upstream changelog online at
<https://docs.docker.com/engine/release-notes/28/#2833>
CVE-2025-54388 bsc#1247367
- Update to docker-buildx v0.26.1. Upstream changelog:
<https://github.com/docker/buildx/releases/tag/v0.26.1>
- Update to docker-buildx v0.26.0. Upstream changelog:
<https://github.com/docker/buildx/releases/tag/v0.26.0>
- Update to Go 1.24 for builds, to match upstream.
- Update to Docker 28.3.2-ce. See upstream changelog online at
<https://docs.docker.com/engine/release-notes/28/#2832>
- Update to Docker 28.3.1-ce. See upstream changelog online at
<https://docs.docker.com/engine/release-notes/28/#2831>
- Update to Docker 28.3.0-ce. See upstream changelog online at
<https://docs.docker.com/engine/release-notes/28/#2830>
bsc#1246556
- Rebase patches:
* 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
* 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
* 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
* 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
* 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
* 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- dracut
-
- Update to version 055+suse.361.g448229ea:
* fix(dracut-util): crash if CMDLINE ends with quotation mark (bsc#1247819)
* fix(rngd): adjust license to match the license of the whole project
- expat
-
- Fix CVE-2025-59375 / bsc#1249584.
- Add patch file:
* CVE-2025-59375.patch
- gdk-pixbuf
-
- Add gdk-pixbuf-jpeg-icc-data.patch: be more careful with icc data
(bsc#1246114 CVE-2025-7345 glgo@GNOME/gdk-pixbuf!217).
- Add gdk-pixbuf-fix-decoder-written-bytes-reporting.patch: Fix
memory leak caused by wrong written bytes reported by decoder
(CVE-2025-6199, glgo#GNOME/gdk-pixbuf#257, bsc#1245227).
- glib2
-
- Add glib2-CVE-2025-4373.patch: carefully handle gssize parameters
(bsc#1242844 CVE-2025-4373 glgo#GNOME/glib#3677).
- gnutls
-
- Fix heap buffer overread when handling the CT SCT extension during X.509
certificate parsing [bsc#1246233, CVE-2025-32989]
* Add patch gnutls-CVE-2025-32989.patch
- Fix double-free due to incorrect ownership handling in the export logic of
SAN entries containing an otherName [bsc#1246232, CVE-2025-32988]
* Add patch gnutls-CVE-2025-32988.patch
- Fix 1-byte heap buffer overflow when parsing templates with certtool
[bsc#1246267, CVE-2025-32990]
* Add patch gnutls-CVE-2025-32990.patch
- Fix NULL pointer dereference when 2nd Client Hello omits PSK
[bsc#1246299, CVE-2025-6395]
* Add patch gnutls-CVE-2025-6395.patch
- grub2
-
- Fix CVE-2024-56738: side-channel attack due to not constant-time
algorithm in grub_crypto_memcmp (bsc#1234959)
* grub2-constant-time-grub_crypto_memcmp.patch
- hwinfo
-
- merge gh#openSUSE/hwinfo#168
- fix usb network card detection (bsc#1245950)
- 21.89
- hyper-v
-
- fcopy: Fix irregularities with size of ring buffer (a4131a50)
- fcopy: Fix incorrect file path conversion (0d86a8d6)
- Enable debug logs for hv_kvp_daemon (a9c0b33e) (bsc#1244154)
- update route parsing in kvp daemon (9bbb8a07)
- reduce resource usage in hv_kvp_daemon (175c71c2)
- reduce resouce usage in hv_get_dns_info helper (a4d024fe)
- hv_kvp_daemon: Pass NIC name to hv_get_dns_info as well (07dfa6e8)
- terminate fcopy daemon if read from uio fails (a9640fcd)
- change permissions of NetworkManager configuration file (91ae69c7)
- Fix a complier warning in the fcopy uio daemon (cb1b78f1)
- remove obsolete kvptest.ps1.txt which failed since a decade
- remove obsolete rpm postinstall code for SLE11SP2
- Add memory allocation check in hv_fcopy_start (94e86b17)
- suppress the invalid warning for packed member alignment (207e03b0)
- Add new fcopy application based on uio driver (82b0945c)
- Add vmbus_bufring (45bab4d7)
- kvp: Handle IPv4 and Ipv6 combination for keyfile format (f971f6dd)
- kvp: Some small fixes for handling NM keyfiles (c3803203)
- kvp: Support for keyfile based connection profile (42999c90)
- kvp: remove unnecessary (void*) conversions (22589542)
- Remove an extraneous "the" (f15f39fa)
- change http to https in hv_kvp_daemon.c (fa52a4b2)
- replace the copy of include/linux/hyperv.h with include/uapi/linux/hyperv.h (6de74d10)
- merge individual udev rules files into a single rules file
- package only files, not directories already owned by filesystem.rpm
- remove braces from rpm spec macros
- remove obsolete Group tag
- replace RPM_BUILD_ROOT with buildroot
- use a meaningful name for the UAPI include file
- use a meaningful variable name for ifcfg in hv_set_ifconfig.sh
- remove dependency on /usr/bin/python3 using
%python3_fix_shebang macro, [bsc#1212476]
- Use %patch -P N instead of deprecated %patchN.
- iputils
-
- Security fix [bsc#1243772, CVE-2025-48964]
* Fix integer overflow in ping statistics via zero timestamp
* Add iputils-CVE-2025-48964_01.patch
* Add iputils-CVE-2025-48964_02.patch
* Add iputils-CVE-2025-48964_03.patch
* Add iputils-CVE-2025-48964_regression.patch
- gcc14
-
- Exclude shared objects present for link editing in the GCC specific
subdirectory from provides processing via __provides_exclude_from.
[bsc#1244050][bsc#1243991]
- Make cross-*-gcc14-bootstrap package conflict with the non-bootstrap
variant conflict with the unversioned cross-*-gcc package.
- Disable build of glibc cross to loongarch64 and hppa in SLFO
and SLE15.
- Update to GCC 14.3 release, bb24b4c804f3d95b0ba95b7496, git11799
- Remove gcc14-pr120061.patch which is now included upstream.
- Add gcc14-pr120061.patch to fix the PR108900 fix instead of
reverting it.
- Remove gcc14-pr108900.patch
- Add gcc14-pr108900.patch to revert it, fixing libqt6webengine build.
- Update to gcc-14 branch head, 3418d740b344e0ba38022f3be, git11702
* Remove gcc14-pr118780.patch now on the upstream branch
- Fix build on s390x [bsc#1241549]
- Make sure link editing is done against our own shared library
copy rather than the installed system runtime. [bsc#1240788]
- Add gcc14-pr119680.patch to fix cross-compiler builds with
- -enable-host-pie.
- avahi
-
- Add avahi-CVE-2024-52615.patch:
Backport 4e2e1ea from upstream, Resolve fixed source ports for
wide-area DNS queries cause DNS responses be injected.
(CVE-2024-52615, bsc#1233421)
- cairo
-
- Add cairo-CVE-2025-50422.patch:
Backport from William Bader's request 621, Fix NULL access
in active_edges_to_traps().
https://gitlab.freedesktop.org/cairo/cairo/-/merge_requests/621/diffs
https://gitlab.freedesktop.org/williamb/cairo/-/commit/b5752618
(CVE-2025-50422, bsc#1247589)
- Add cairo-CVE-2019-6461.patch: avoid assert when drawing arcs
with NaN angles (bsc#1122338 CVE_2019-6461 glfo@cairo/cairo#352).
- libgcrypt
-
- Security fix [bsc#1221107, CVE-2024-2236]
* Add --enable-marvin-workaround to spec to enable workaround
* Fix timing based side-channel in RSA implementation ( Marvin attack )
* Add libgcrypt-CVE-2024-2236_01.patch
* Add libgcrypt-CVE-2024-2236_02.patch
* Add libgcrypt-CVE-2024-2236_03.patch
- openssl-1_1
-
- Security fix: [bsc#1250232 CVE-2025-9230]
* Fix out-of-bounds read & write in RFC 3211 KEK unwrap
* Add patch openssl3-CVE-2025-9230.patch
- FIPS: Use the NID_X9_62_prime256v1 curve in ECDSA KAT test
instead of NID_secp256k1. [bsc#1246697]
* Add openssl-fips-ECDSA-KAT.patch
- polkit
-
- CVE-2025-7519: Fixed that a XML policy file with a large number of
nested elements may lead to out-of-bounds write (bsc#1246472)
added 0001-Nested-.policy-files-cause-xml-parsing-overflow-lead.patch
- python311
-
- Add CVE-2025-8194-tarfile-no-neg-offsets.patch which now
validates archives to ensure member offsets are non-negative
(gh#python/cpython#130577, CVE-2025-8194, bsc#1247249).
- python3
-
- Add CVE-2025-8194-tarfile-no-neg-offsets.patch which now
validates archives to ensure member offsets are non-negative
(gh#python/cpython#130577, CVE-2025-8194, bsc#1247249).
- Add CVE-2025-4435-normalize-lnk-trgts-tarfile.patch
Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138,
CVE-2024-12718, CVE-2025-4435 on tarfile (bsc#1244032,
bsc#1244061, bsc#1244059, bsc#1244060, bsc#1244056).
The backported fixes do not contain changes for ntpath.py and
related tests, because the support for symlinks and junctions
were added later in Python 3.9, and it does not make sense to
backport them to 3.6 here.
The patch is contains the following changes:
- python@42deeab fixes symlink handling for tarfile.data_filter
- python@9d2c2a8 fixes handling of existing files/symlinks in tarfile
- python@00af979 adds a new "strict" argument to realpath()
- python@dd8f187 fixes mulriple CVE fixes in the tarfile module
- downstream only fixes that makes the changes work and
compatible with Python 3.6
- Add CVE-2025-6069-quad-complex-HTMLParser.patch to avoid worst
case quadratic complexity when processing certain crafted
malformed inputs with HTMLParser (CVE-2025-6069, bsc#1244705).
- Add python36-* provides/obsoletes to enable SLE-12 -> SLE-15
migration, bsc#1233012
- Add ipaddress-update-pr60.patch from gh#phihag/ipaddress!60 to
update vendored ipaddress module to 3.8 equivalent
- Add gh-128840_parse-IPv6-with-emb-IPv4.patch to limit buffer
size for IPv6 address parsing (gh#python/cpython#128840,
bsc#1244401).
- Update CVE-2025-4516-DecodeError-handler.patch not to break
_PyBytes_DecodeEscape signature.
- Add CVE-2025-4516-DecodeError-handler.patch fixing
CVE-2025-4516 (bsc#1243273) blocking DecodeError handling
vulnerability, which could lead to DoS.
- ruby2.5
-
- update suse.patch to 3f3682bf07fcd4f2fa875958853d3843ee7dcdb9
- fix remote DoS via YAML manifest
bsc#1225905 CVE-2024-35221
- update suse.patch to c76fb820676cfded16c697a62281a3bfeb8e4bb1
- fix webrick: Ruby WEBrick read_header HTTP Request Smuggling Vulnerability
bsc#1245254 CVE-2025-6442
- update suse.patch to 5d79fc609c5761864aec47e1ae4796b93db99104
- fix ruby: userinfo leakage in URI#join, URI#merge and URI#+
bsc#1237805 CVE-2025-27221
- libsolv
-
- add support for product-obsoletes() provides in the product
autopackage generation code
- bump version to 0.7.34
- improve transaction ordering by allowing more uninst->uninst
edges [bsc#1243457]
- implement color filtering when adding update targets
- support orderwithrequires dependencies in susedata.xml
- bump version to 0.7.33
- sqlite3
-
- Backpatch the URLs in sqlite3.n from https to http to avoid a
file conflict with the tcl package on SLE-15-GA up to SP2. In
SP3 and onwards the Tcl package does not contain the sqlite
extension anymore.
- Sync version 3.50.2 from Factory:
* CVE-2025-6965, bsc#1246597:
Raise an error early if the number of aggregate terms in a
query exceeds the maximum number of columns, to avoid
downstream assertion faults.
* Add subpackage for the lemon parser generator.
+ sqlite-3.49.0-fix-lemon-missing-cflags.patch
+ sqlite-3.6.23-lemon-system-template.patch
- systemd
-
- Start the systemd-coredump.socket unit on systemd-coredump package
installation.
- Restore the kernel default values of the coredump sysctl settings on
systemd-coredump package removal.
- Import commit 6b9681f9bb313728baa3ff0c16814eb33516cd54
a474df9866 coredump: get rid of a bogus assertion
d4546562f8 coredump: use %d in kernel core pattern (bsc#1243935 CVE-2025-4598)
a5784c2856 coredump: get rid of _META_MANDATORY_MAX
dbaa7bc4bd coredump: restore compatibility with older patterns
32b6cd311f basic/macro: add macro to iterate variadic args
- Apply coredump sysctl settings on systemd-coredump updates/removals
- tiff
-
- security update:
* CVE-2025-8961 [bsc#1248117]
Fix segmentation fault via main function of tiffcrop utility
+ tiff-CVE-2025-8961.patch
- security update:
* CVE-2025-8534 [bsc#1247582]
Fix null pointer dereference in function PS_Lvl2page
+ tiff-CVE-2025-8534.patch
* CVE-2025-9165 [bsc#1248330]
Fix local execution manipulation can lead to memory leak
+ tiff-CVE-2025-9165.patch
- security update:
* CVE-2025-8176 [bsc#1247108]
Fix heap use-after-free in tools/tiffmedian.c
+ tiff-CVE-2025-8176.patch
* CVE-2025-8177 [bsc#1247106]
Fix possible buffer overflow in tools/thumbnail.c:setrow()
+ tiff-CVE-2025-8177.patch
- libxml2
-
- security update
- added patches
CVE-2025-7425 [bsc#1246296], Heap Use-After-Free in libxslt caused by atype corruption in xmlAttrPtr
+ libxml2-CVE-2025-7425.patch
- libzypp
-
- runposttrans: strip root prefix from tmppath (bsc#1250343)
- fixup! Make ld.so ignore the subarch packages during install
(bsc#1246912)
- version 17.37.18 (35)
- Make ld.so ignore the subarch packages during install
(bsc#1246912)
- version 17.37.17 (35)
- Fix evaluation of libproxy results (bsc#1247690)
- Replace URL variables inside mirrorlist/metalink files
(fixes #667)
- version 17.37.16 (35)
- Append RepoInfo::path() to the mirror URLs in Preloader
(bsc#1247054)
- version 17.37.15 (35)
- During installation indicate the backend being used (bsc#1246038)
If some package actually needs to know, it should test for
ZYPP_CLASSIC_RPMTRANS being set in the environment.
Otherwise the transaction is driven by librpm.
- version 17.37.14 (35)
- Workaround 'rpm -vv' leaving scriptlets /var/tmp (bsc#1218459)
- Verbose log libproxy results if PX_DEBUG=1 is set.
- BuildRequires: cmake >= 3.17.
- version 17.37.13 (35)
- Allow explicit request to probe an added repo's URL
(bsc#1246466)
- Fix tests with -DISABLE_MEDIABACKEND_TESTS=1 (fixes #661)
- version 17.37.12 (35)
- Add runtime check for a broken rpm-4.18.0 --runpostrans
(bsc#1246149)
- Add regression test for bsc#1245220 and some other filesize
related tests.
- version 17.37.11 (35)
- BuildRequires: %{libsolv_devel_package} >= 0.7.34 (bsc#1243486)
Newer rpm versions no longer allow a ':' in rpm package names or
obsoletes. So injecting an
Obsoletes: product:oldproductname < oldproductversion
into the -release package to indicate a product rename is no longer
possible.
Since libsolv-0.7.34 you can and should use:
Provides: product-obsoletes(oldproductname) < oldproductversion
in the -release package. libsolv will then inject the appropriate
Obsoletes into the Product.
- version 17.37.10 (35)
- Ignore DeltaRpm download errors (bsc#1245672)
DeltaRpms are in fact optional resources. In case of a failure
the full rpm is downloaded.
- Improve fix for incorrect filesize handling (bsc#1245220)
- version 17.37.9 (35)
- Do not trigger download data exceeded errors on HTTP non data
responses (bsc#1245220)
In some cases a HTTP 401 or 407 did trigger a "filesize exceeded"
error, because the response payload size was compared against the
expected filesize. This patch adds some checks if the response
code is in the success range and only then takes expected
filesize into account. Otherwise the response content-length is
used or a fallback of 2Mb if no content-length is known.
- version 17.37.8 (35)
- Fix SEGV in MediaDISK handler (bsc#1245452)
- Explicitly selecting DownloadAsNeeded also selects the
classic_rpmtrans backend.
DownloadAsNeeded can not be combined with the rpm singletrans
installer backend because a rpm transaction requires all package
headers to be available the the beginning of the transaction. So
explicitly selecting this mode also turns on the classic_rpmtrans
backend.
- Fix evaluation of libproxy results (bsc#1244710)
- version 17.37.7 (35)
- Enhancements regarding mirror handling during repo refresh.
Added means to disable the use of mirrors when downloading
security relevant files. Requires updaing zypper to 1.14.91.
- Fix autotestcase writer if ZYPP_FULLLOG=1 (bsc#1244042)
If ZYPP_FULLLOG=1 a solver testcase to
"/var/log/YaST2/autoTestcase" should be written for each solver
run. There was no testcase written for the very first solver run.
This is now fixed.
- Pass $1==2 to %posttrans script if it's an update (bsc#1243279)
- version 17.37.6 (35)
- lifecycle-data-sle-module-live-patching
-
- Added data for 5_14_21-150400_24_167, 5_14_21-150400_24_170,
5_14_21-150500_55_110, 5_14_21-150500_55_113,
5_14_21-150500_55_116, 5_3_18-150300_59_207,
5_3_18-150300_59_211, 6_4_0-150600_23_53,
6_4_0-150600_23_60, 6_4_0-150700_51,
6_4_0-150700_53_3, 6_4_0-150700_53_6,
+kernel-livepatch-6_4_0-150600_10_39-rt,*,+kernel-livepatch-6_4_0-150600_10_44-rt,*,+kernel-livepatch-6_4_0-150700_5-rt,*,+kernel-livepatch-6_4_0-150700_7_3-rt,*,+kernel-livepatch-6_4_0-150700_7_8-rt,*. (bsc#1020320)
- net-tools
-
- Drop 0002-Do-not-warn-about-interface-socket-not-binded.patch. It
worked around a net-tools-1.60 specific problem, that does not
happen in net-tools-2.10. It is more harmful than useful, as it
can hide real problems. (bsc#430864#c15,
https://github.com/ecki/net-tools/issues/32#issuecomment-3265471116).
- Drop 0004-By-default-do-not-fopen-anything-in-netrom_gr.patch. It
was net-tools-1.60 specific leak fix and breaks netrom in
net-tools-2.10 (bnc#544339#c2).
- Drop old Fedora patch 0006-Allow-interface-stacking.patch. It
provided a fix for CVE-2025-46836 (bsc#142461), but it was fixes
by the upstream in 2025 in a different way. Revert interferring
net-tools-CVE-2025-46836.patch back to the upstream version.
- Fix stack buffer overflow in parse_hex (bsc#1248687,
GHSA-h667-qrp8-gj58, net-tools-parse_hex-stack-overflow.patch).
- Fix stack-based buffer overflow in proc_gen_fmt (bsc#1248687,
GHSA-w7jq-cmw2-cq59,
net-tools-proc_gen_fmt-buffer-overflow.patch).
- Avoid unsafe memcpy in ifconfig (bsc#1248687,
net-tools-ifconfig-avoid-unsafe-memcpy.patch).
- Prevent overflow in ax25 and netrom (bsc#1248687,
net-tools-ax25+netrom-overflow-1.patch,
net-tools-ax25+netrom-overflow-2.patch).
- Keep possibility to enter long interface names, even if they are
not accepted by the kernel, because it was always possible up to
CVE-2025-46836 fix. But issue a warning about an interface name
concatenation (bsc#1248410,
net-tools-ifconfig-long-name-warning.patch).
- Provide more readable error for interface name size checking
introduced by net-tools-CVE-2025-46836.patch
(bsc#1243581, net-tools-CVE-2025-46836-error-reporting.patch).
- Fix a regression in net-tools-CVE-2025-46836.patch (bsc#1246608).
- Perform bound checks when parsing interface labels in
/proc/net/dev (bsc#1243581, CVE-2025-46836, GHSA-pfwf-h6m3-63wf,
net-tools-CVE-2025-46836.patch,
net-tools-CVE-2025-46836-regression.patch).
- pam
-
- Make sure that the buffer containing encrypted passwords get's erased
bedore free.
- Replace to previous CVE fix which led to CPU performance issues.
[bsc#1246221, CVE-2024-10041,
+ libpam-introduce-secure-memory-erasure-helpers.patch
+ pam_modutil_get-overwrite-password-at-free.patch
- passverify-always-run-the-helper-to-obtain-shadow_pwd.patch]
- permissions
-
- Update to version 20201225:
* permissions: remove unnecessary static dirs and devices (bsc#1235873)
- Update to version 20201225:
* nvidia-modprobe: SLE-15-SP4 backport (bsc#1246776)
- python-appdirs
-
- Add python36-appdirs provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-asn1crypto
-
- Add python36-asn1crypto provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-certifi
-
- Add python36-certifi provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python3-cryptography
-
- Add python36-cryptography provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- Skipping failing test
- python-decorator
-
- Add python36-decorator provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-idna
-
- Add python36-idna provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-importlib-metadata
-
- Add python36-importlib-metadata provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python3-more-itertools
-
- Add python36-more-itertools provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-packaging
-
- Add python36-packaging provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-ply
-
- Add python36-ply provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python3-pyOpenSSL
-
- Add python36-pyOpenSSL provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-pyasn1
-
- Add python36-pyasn1 provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-pycparser
-
- Add python36-pycparser provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-pyparsing
-
- Add python36-pyparsing provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-python-dateutil
-
- Add python36-python-dateutil provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-pytz
-
- Add python36-pytz provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-py
-
- Add python36-py provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-requests
-
- Add python36- provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python3-setuptools
-
- Add python36-setuptools provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-six
-
- Add python36-six provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-urllib3
-
- Add patch CVE-2025-50181-poolmanager-redirects.patch:
* Pool managers now properly control redirects when retries is passed
(CVE-2025-50181, GHSA-pq67-6m6q-mj2v, bsc#1244925)
- Add python36-urllib3 provides/obsoletes to enable SLE-12 ->
SLE-15 migration, bsc#1233012
- python-aiohttp
-
- Add CVE-2025-53643.patch to fix CVE-2025-53643 (bsc#1246517)
- python-azure-multiapi-storage
-
- Downgrade upstream version to 1.3.0 to address compatibility
issues with azure-cli 2.66.0 in SLE-15-SP4 (bsc#1247261)
- Override upstream version with 1.4.0.really.1.3.0
- python-xmltodict
-
- Cherry-pick security-fix-prereqs.patch to allow backport of CVE fix
- Cherry-pick CVE-2025-9375.patch to fix multiple XML Injection
vulnerabilities in XML parser (bsc#1249036, CVE-2025-9375)
- regionServiceClientConfigAzure
-
- Update to version 3.0.0 (bsc#1246995)
+ SLE 16 python-requests requiers SSL v3 certificates. Update 2
region server certs to support SLE 16 when it gets released.
- Update dependency name for metadata package, name change in SLE 16
(bsc#1243419)
- rubygem-puma
-
- update to version 5.6.9 (bsc#1218638)
This update includes fixed for CVE-2024-21647
as well as for CVE-2024-45614, CVE-2024-21647, CVE-2023-40175
- Remove CVE-2024-45614.patch
- Remove CVE-2024-21647.patch
- Remove CVE-2023-40175.patch
- saptune
-
- Fix missing build parameter for saptune 3.2.0, was removed by
accident
(bsc#1246999)
- update package version of saptune to 3.2.0
* saptune version 3.2
new features and SLE16 support
(jsc#PED-8163)
* SLE16 - Optimized out-of-the-box experience for SAP workloads
SLES for SAP Applications should have by default all tunings
enabled and packages started that are common for SAP workloads.
(jsc#PED-10984)
* SLE16 - Tune common values for SAP workloads per default
(jsc#PED-10072)
* SLE16 - OS tuning for SAP with saptune on SLE 16
(jsc#SAPSOL-526)
* SLE16 - preparing a SAP Solution 'SAP_Base' with one
Note '1275776' to support base tuning on SLES and SLES4SAP 16.
(jsc#SAPSOL-530)
* SLE16 - implement new start behavior for saptune on 16.
If the saptune package gets installed (by pattern or manually)
it calls 'saptune solution apply SAP_Base' to initiate the
base tuning.
A customer can change this base tuning after package
installation by 'saptune solution change <New_Solution>' or by
'saptune revert all' and 'saptune solution apply <New_Sol>'
See man page saptune(7) for details
(jsc#SAPSOL-533)
* SLE16 - remove saptune-migrate man page
(jsc#SAPSOL-347)
* SLE16 - remove saptune daemon commands
(jsc#SAPSOL-343)
* SLE16 - remove saptune simulate commands
(jsc#SAPSOL-345)
* SLE16 - remove support for setting PAM limits
(jsc#TEAM-10049, jsc#TEAM-8744)
* SLE16 - Support dot releases for os tags and rpm version check
(jsc#SAPSOL-568)
* SLE16 - remove support for the v1 Custom Note name format
(jsc#SAPSOL-532)
* SLE16 - remove support for the comment-style version header
format in vendor/custom Notes
(jsc#SAPSOL-604)
* SLE16 - drop support for the comment-style version headers
(jsc#SAPSOL-605)
* SLE16 - adapt saptune_check script to the new main
configuration file location
(bsc#1244077)
* Enhanced the saptune supportconfig plugin,
added 'saptune status', 'saptune note verify', /var/log/zypp,
'saptune note list', 'saptune solution list',
'saptune --format json saptune check',
'saptune --format json note list',
'saptune --format json solution list',
'saptune --format json status' and
'saptune --format json note verify'
(jsc#SAPSOL-169)
* Refresh changed Note parameter.
This action is currently in state 'experimental'
(jsc#TEAM-3943)
* Add detection of offline CPUs when setting/verify governor or
force_latency settings
(bsc#1221020, jsc#TEAM-8427)
* Enhance CPU handling with additional warnings and skip governor
settings, if intel_idle and intel_pstate are disabled
(jsc#TEAM-3759, jsc#TEAM-8427)
* Set energy perf bias (EPB) even if secure boot is enabled, if
the used cpupower command supports the operation.
(bsc#1224801)
* Fix Nvme disk detection
(bsc#1233126)
* Fix an index error in the rpm section code and explain the
compliance/uncompliance state of a rpm version in the man page
(bsc#1239841)
* Check if orphaned overwrites exist.
If an override file exists in /etc/saptune/override, but no
related Note definition file or solution definition can be
found in the working area /var/lib/saptune/working/ or in the
custom/vendor directory /etc/saptune/extra, a warning message
is printed and logged.
Additional a line about orphaned overrides is added to the
bottom of the 'saptune status' output.
(jsc#TEAM-6598)
* saptune alternatives should not listed as non-compliant
(jsc#TEAM-8719)
* Remove '(no change)' leftover for 'saptune note verify'
(jsc#TEAM-9136)
* Add json support to 'saptune check'
Enhance json schema and update to version 1.1
(jsc#TEAM-8959)
* Force colored output by using the global option '--force-color'
With that it will be possible to override the color-suppressing,
if a pipe has been detected as there are use cases
(e.g. piping into less) where the color codes can be useful.
(jsc#TEAM-9205)
* Add new command 'saptune configure <parameter> <value>' to
change values in the saptune config file.
(jsc#TEAM-8703)
* Add new command 'saptune configure reset' to reset the saptune
configuration.
This will revert the tuning (revert all) and reset the saptune
configuration file back to the installation default.
(jsc#SAPSOL-331)
* Add new command 'saptune configure TrentoASDP <value>' to
configure the discovery interval for saptune on Trento.
(jsc#SAPSOL-117)
* Tag handling clarification in the man page.
The same tag cannot be used multiple times with different
values in one section of a Note definition file, because all
tags of a section are concatenated by AND (and not OR).
(jsc#TEAM-9243)
* Add new tag 'pmu_name' for CPU platform selection.
May be helpful for special FORCE_LATENCY settings depending on
the used CPU platform to get optimal performance.
As the values are taken from /sys/devices/cpu/caps/pmu_name,
it's an Intel CPU only feature for now.
(jsc#TEAM-7073)
* Add new tag 'virt' for virtualization type selection.
Valid values are 'vm', 'chroot' and 'container' as reported by
'/usr/bin/systemd-detect-virt -v|-c|-r'
(jsc#TEAM-6070)
* Add IBM Cloud VPC (not IBM Cloud Classic) detection used for
tag 'csp'
(jsc#SAPSOL-224)
* Add additional actions for 'verify'
'saptune note verify applied' and 'saptune verify applied'
(jsc#TEAM-9204)
* For internal used calculations increase the logging information
for the used parameters, values and results
(jsc#SAPSOL-168)
* Adjust return code from 1 to 128 if a wrong saptune version is
detected.
(jsc#SAPSOL-209)
* Add systemd hardening to the saptune systemd service file
starting 15SP4
(jsc#TEAM-7425)
* Add new global option '--fun'. If set, the 'yes', 'no' in the
compliant column of 'saptune note verify' is replaced by a
smiley.
(jsc#SAPSOL-236)
* start reducing duplicate warning and info messages
(jsc#SAPSOL-669)
* Adapt man page and help output for global option '--fun'
(jsc#SAPSOL-272)
* Add list of exit codes to man page saptune(8)
(jsc#TEAM-9836)
* man pages - add warning about race condition of systemd units
during system boot.
saptune-note.5 already contained a description, now saptune.8
was enhanced as well.
(bsc#1190508)
* Add new man page saptune-solution(5)
(jsc#TEAM-9870)
* Add new man page saptune(7) describing the new tuning behavior
during package installation
(jsc#SAPSOL-533)
* SLE16 - add new SAP Note 3565382 and 3577842
* SLE16 - add Note 3577842 to all HANA related solutions
(bsc#1240598)
* SLE16 - remove Note 1771258
(jsc#TEAM-10049)
* SLE16 - remove ASE Solution and Notes 1680803 and 1805750
(jsc#SAPSOL-531)
* SLE12/15 - deprecate Notes 1680803,1805750 and Solution SAP-ASE
The Note and the Solution might get removed in a future saptune
version
(jsc#SAPSOL-419)
* SLE12/15 - deprecate Note 1771258
(jsc#TEAM-8744)
* SAP Note 2684254 and 2205917
Intel architecture related settings (currently section 'cpu'
and 'grub') are now tagged with 'arch=x86_64' in the Note
definition file to no longer confuse customers on other
architectures with 'useless' warnings and footnotes.
And by adding the additional tag 'virt=bare-metal' users of
virtual machines will also no longer be confused by these
footnotes and warnings.
(jsc#TEAM-9235)
* SAP Note 1984787 updated to Version 43
SAP Note 2578899 updated to Version 53
SAP Note 3024346 updated to Version 14
but without parameter value changes, only house keeping of the
version section and comment updates
- add obsoletes/provides for sapconf to support the update/move
from sapconf to saptune on plain SLES
- change Requires: /usr/bin/cpupower to Requires: cpupower
and Requires: /usr/bin/md5sum to Requires: coreutils
(jsc#TEAM-8743)
- add support for SLE16
Installation and activation of SAP base tuning
Update to SLE16
- scap-security-guide
-
- buildrequire cmake3 on older SLES versions for build
- updated to 0.1.77 (jsc#ECO-3319)
- Introduce Architecture Decisions Records
- Move stablization to the third Monday of the second month
- Remove CCI References
- Remove macOS content
- removed ssg-fix-python.patch: upstream
- Added support for tencentos4
- ssg-fix-python.patch: fix build with older python3.
- Add -DCMAKE_POLICY_VERSION_MINIMUM=3.5 to fix FTBFS with cmake4
- Remove Group: declarations, no longer used
- 000release-packages:sle-ha-release
-
n/a
- 000release-packages:sle-module-basesystem-release
-
n/a
- 000release-packages:sle-module-containers-release
-
n/a
- 000release-packages:sle-module-desktop-applications-release
-
n/a
- 000release-packages:sle-module-development-tools-release
-
n/a
- 000release-packages:sle-module-live-patching-release
-
n/a
- 000release-packages:sle-module-public-cloud-release
-
n/a
- 000release-packages:sle-module-python3-release
-
n/a
- 000release-packages:sle-module-sap-applications-release
-
n/a
- 000release-packages:sle-module-server-applications-release
-
n/a
- 000release-packages:sle-module-web-scripting-release
-
n/a
- suse-build-key
-
- adjust UID (name + email) of SLES16 signing key with official
names. (bsc#1245223)
- suse-module-tools
-
- Update to version 15.4.20:
* add blacklist entry for reiserfs (jsc#PED-6167)
* Add more modules to file system blacklist (jsc#PED-6167)
* Add hfsplus to file system blacklist (bsc#1240950, jsc#PED-12632)
- sysconfig
-
- version 0.85.10
* codespell run for all repository files and changes file
* spec: define permissions for ghost file attrs to avoid
rpm --restore resets them to 0 (bsc#1237595).
* spec: fix name-repeated-in-summary rpmlint warning
- sysstat
-
- Still related to bsc#1244553, removal of broken symlinks
during the post-install phase.
- rename services to allow preset in systemd-presets-branding-SLE to work
[bsc#1244553], [bsc#1246835]
- fix argument order of find [bsc#1246852]
- modified patches
% sysstat-PED-12914.patch (amended)
- added patches (bsc#1244553)
% sysstat-bsc-1244553.patch
- deleted sources
- 90-sysstat.preset (not needed)
- systemd-presets-branding-SLE
-
- enable sysstat_collect.timer and sysstat_summary.timer [bsc#1244553]
and [bsc#1246835]
- modified sources
% default-SLE.preset
- systemd-rpm-macros
-
- Bump version to 16
- Introduce %udev_trigger_with_reload() for packages that need to trigger events
in theirs scriplets. The new macro automatically triggers a reload of the udev
rule files as this step is often overlooked by packages (bsc#1237143).
- vim
-
- Refresh patch:
* vim-8.2.2411-globalvimrc.patch
- Add patch:
* reorder-exit-raw-mode.patch
- Fix the following CVEs and bugs:
* bsc#1246602 (CVE-2025-53906)
* bsc#1246604 (CVE-2025-53905)
* bsc#1247939 (CVE-2025-55158)
* bsc#1247938 (CVE-2025-55157)
- Update to 9.1.1629:
9.1.1629: Vim9: Not able to use more than 10 type arguments in a generic function
9.1.1628: fuzzy.c has a few issues
9.1.1627: fuzzy matching can be improved
9.1.1626: cindent: does not handle compound literals
9.1.1625: Autocompletion slow with include- and tag-completion
9.1.1624: Cscope not enabled on MacOS
9.1.1623: Buffer menu does not handle unicode names correctly
9.1.1622: Patch v9.1.1432 causes performance regressions
9.1.1621: flicker in popup menu during cmdline autocompletion
9.1.1620: filetype: composer.lock and symfony.lock files not recognized
9.1.1619: Incorrect E535 error message
9.1.1618: completion: incorrect selected index returned from complete_info()
9.1.1617: Vim9: some error messages can be improved
9.1.1616: xxd: possible buffer overflow with bitwise output
9.1.1615: diff format erroneously detected
9.1.1614: Vim9: possible variable type change
9.1.1613: tests: test_search leaves a few swapfiles behind
9.1.1612: Ctrl-G/Ctrl-T do not ignore the end search delimiter
9.1.1611: possible undefined behaviour in mb_decompose()
9.1.1610: completion: hang or E684 when 'tagfunc' calls complete()
9.1.1609: complete: Heap-buffer overflow with complete function
9.1.1608: No command-line completion for :unsilent {command}
9.1.1607: :apple command detected as :append
9.1.1606: filetype: a few more files are not recognized
9.1.1605: cannot specify scope for chdir()
9.1.1604: completion: incsearch highlight might be lost
9.1.1603: completion: cannot use autoloaded funcs in 'complete' F{func}
9.1.1602: filetype: requirements-*.txt files are not recognized
9.1.1601: Patch v8.1.0425 was wrong
9.1.1600: using diff anchors with hidden buffers fails silently
9.1.1599: :bnext doesn't go to unlisted help buffers
9.1.1598: filetype: waybar config file is not recognized
9.1.1597: CI reports leaks in libgtk3 library
9.1.1596: tests: Test_search_wildmenu_iminsert() depends on help file
9.1.1595: Wayland: non-portable use of select()
9.1.1594: completion: search completion throws errors
9.1.1593: Confusing error when compiling incomplete try block
9.1.1592: Vim9: crash with classes and garbage collection
9.1.1591: VMS support can be improved
9.1.1590: cannot perform autocompletion
9.1.1589: Cannot disable cscope interface using configure
9.1.1588: Vim9: cannot split dict inside command block
9.1.1587: Wayland: timeout not updated before select()
9.1.1586: Vim9: can define an enum/interface in a function
9.1.1585: Wayland: gvim still needs GVIM_ENABLE_WAYLAND
9.1.1584: using ints as boolean type
9.1.1583: gvim window lost its icons
9.1.1582: style issue in vim9type.c and vim9generics.c
9.1.1581: possible memory leak in vim9generics.c
9.1.1580: possible memory leak in vim9type.c
9.1.1579: Coverity complains about unchecked return value
9.1.1578: configure: comment still mentions autoconf 2.71
9.1.1577: Vim9: no generic support yet
9.1.1576: cannot easily trigger wildcard expansion
9.1.1575: tabpanel not drawn correctly with wrapped lines
9.1.1574: Dead code in mbyte.c
9.1.1573: Memory leak when pressing Ctrl-D in cmdline mode
9.1.1572: expanding $var does not escape whitespace for 'path'
9.1.1571: CmdlineChanged triggered to often
9.1.1570: Copilot suggested some improvements in cmdexpand.c
9.1.1569: tests: Vim9 tests can be improved
9.1.1568: need a few more default highlight groups
9.1.1567: crash when using inline diff mode
9.1.1566: self-referenced enum may not get freed
9.1.1565: configure: does not consider tiny version for wayland
9.1.1564: crash when opening popup to closing buffer
9.1.1563: completion: ruler may disappear
9.1.1562: close button always visible in the 'tabline'
9.1.1561: configure: wayland test can be improved
9.1.1560: configure: uses $PKG_CONFIG before it is defined
9.1.1559: tests: Test_popup_complete_info_01() fails when run alone
9.1.1558: str2blob() treats NULL string and empty string differently
9.1.1557: not possible to anchor specific lines in difff mode
9.1.1556: string handling in cmdexpand.c can be improved
9.1.1555: completion: repeated insertion of leader
9.1.1554: crash when omni-completion opens command-line window
9.1.1553: Vim9: crash when accessing a variable in if condition
9.1.1552: [security]: path traversal issue in tar.vim
9.1.1551: [security]: path traversal issue in zip.vim
9.1.1550: defaults: 'showcmd' is not enabled in non-compatible mode on Unix
9.1.1549: filetype: pkl files are not recognized
9.1.1548: filetype: OpenFGA files are not recognized
9.1.1547: Wayland: missing ifdef
9.1.1546: Vim9: error with has() and short circuit evaluation
9.1.1545: typo in os_unix.c
9.1.1544: :retab cannot be limited to indentation only
9.1.1543: Wayland: clipboard appears to not be working
9.1.1542: Coverity complains about uninitialized variable
9.1.1541: Vim9: error when last enum value ends with a comma
9.1.1540: completion: menu state wrong on interruption
9.1.1539: completion: messages don't respect 'shm' setting
9.1.1537: helptoc: still some issues when markdown code blocks
9.1.1536: tests: test_plugin_comment uses wrong :Check command
9.1.1535: the maximum search count uses hard-coded value 99
9.1.1534: unnecessary code in tabpanel.c
9.1.1533: helptoc: does not handle code sections in markdown well
9.1.1532: termdebug: not enough ways to configure breakpoints
9.1.1531: confusing error with nested legacy function
9.1.1530: Missing version change in v9.1.1529
9.1.1529: Win32: the toolbar in the GUI is old and dated
9.1.1528: completion: crash with getcompletion()
9.1.1527: Vim9: Crash with string compound assignment
9.1.1526: completion: search completion match may differ in case
9.1.1525: tests: testdir/ is a bit messy
9.1.1524: tests: too many imports in the test suite
9.1.1523: tests: test_clipmethod fails in non X11 environment
9.1.1522: tests: still some ANSI escape sequences in test output
9.1.1521: completion: pum does not reset scroll pos on reopen with 'noselect'
9.1.1520: completion: search completion doesn't handle 'smartcase' well
9.1.1519: tests: Test_termdebug_decimal_breakpoints() may fail
9.1.1518: getcompletiontype() may crash
9.1.1517: filetype: autopkgtest files are not recognized
9.1.1516: tests: no test that 'incsearch' is updated after search completion
9.1.1515: Coverity complains about potential unterminated strings
9.1.1514: Coverity complains about the use of tmpfile()
9.1.1513: resizing Vim window causes unexpected internal window width
9.1.1512: completion: can only complete from keyword characters
9.1.1511: tests: two edit tests change v:testing from 1 to 0
9.1.1510: Search completion may use invalid memory
9.1.1509: patch 9.1.1505 was not good
9.1.1508: string manipulation can be improved in cmdexpand.c
9.1.1507: symlinks are resolved on :cd commands
9.1.1506: tests: missing cleanup in Test_search_cmdline_incsearch_highlight()
9.1.1505: not possible to return completion type for :ex command
9.1.1504: filetype: numbat files are not recognized
9.1.1503: filetype: haxe files are not recognized
9.1.1502: filetype: quickbms files are not recognized
9.1.1501: filetype: flix files are not recognized
9.1.1500: if_python: typo in python error variable
9.1.1499: MS-Windows: no indication of ARM64 architecture
9.1.1498: completion: 'complete' funcs behave different to 'omnifunc'
9.1.1497: Link error with shm_open()
9.1.1496: terminal: still not highlighting empty cells correctly
9.1.1495: Wayland: uses $XDG_SEAT to determine seat
9.1.1494: runtime(tutor): no French translation for Chapter 2
9.1.1493: manually comparing positions on buffer
9.1.1492: tests: failure when Wayland compositor fails to start
9.1.1491: missing out-of-memory checks in cmdexpand.c
9.1.1490: 'wildchar' does not work in search contexts
9.1.1489: terminal: no visual highlight of empty cols with empty 'listchars'
9.1.1488: configure: using obsolete macro AC_PROG_GCC_TRADITIONAL
9.1.1487: :cl doesn't invoke :clist
9.1.1486: documentation issues with Wayland
9.1.1485: missing Wayland clipboard support
9.1.1484: tests: Turkish locale tests fails on Mac
9.1.1483: not possible to translation position in buffer
9.1.1482: scrolling with 'splitkeep' and line()
9.1.1481: gcc complains about uninitialized variable
9.1.1480: Turkish translation outdated
9.1.1479: regression when displaying localized percentage position
9.1.1478: Unused assignment in ex_uniq()
9.1.1476: no easy way to deduplicate text
9.1.1476: missing out-of-memory checks in cmdexpand.c
9.1.1475: completion: regression when "nearest" in 'completeopt'
9.1.1474: missing out-of-memory check in mark.c
9.1.1473: inconsistent range arg for :diffget/diffput
9.1.1472: if_python: PySequence_Fast_{GET_SIZE,GET_ITEM} removed
9.1.1471: completion: inconsistent ordering with CTRL-P
9.1.1470: use-after-free with popup callback on error
9.1.1469: potential buffer-underflow with invalid hl_id
9.1.1468: filetype: bright(er)script files are not recognized
9.1.1467: too many strlen() calls
9.1.1466: filetype: not all lex files are recognized
9.1.1465: tabpanel: not correctly drawn with 'equalalways'
9.1.1464: gv does not work in operator-pending mode
9.1.1463: Integer overflow in getmarklist() after linewise operation
9.1.1462: missing change from patch v9.1.1461
9.1.1461: tabpanel: tabpanel vanishes with popup menu
9.1.1460: MS-Windows: too many strlen() calls in os_win32.c
9.1.1459: xxd: coloring output is inefficient
9.1.1458: tabpanel: tabs not properly updated with 'stpl'
9.1.1457: compile warning with tabpanelopt
9.1.1456: comment plugin fails toggling if 'cms' contains \
9.1.1455: Haiku: dailog objects created with no reference
9.1.1454: tests: no test for pum at line break position
9.1.1453: tests: Test_geometry() may fail
9.1.1452: completion: redundant check for completion flags
9.1.1451: tabpanel rendering artifacts when scrolling
9.1.1450: Session has wrong arglist with :tcd and :arglocal
9.1.1449: typo in pum_display()
9.1.1448: tabpanel is not displayed correctly when msg_scrolled
9.1.1447: completion: crash when backspacing with fuzzy completion
9.1.1446: filetype: cuda-gdb config files are not recognized
9.1.1445: negative matchfuzzy scores although there is a match
9.1.1444: Unused assignment in set_fuzzy_score()
9.1.1443: potential buffer underflow in insertchar()
9.1.1442: tests: Test_diff_fold_redraw() is insufficient
9.1.1441: completion: code can be improved
9.1.1440: too many strlen() calls in os_win32.c
9.1.1439: Last diff folds not merged
9.1.1438: tests: Test_breakindent_list_split() fails
9.1.1437: MS-Windows: internal compile error in uc_list()
9.1.1436: GUI control code is displayed on the console on startup
9.1.1435: completion: various flaws in fuzzy completion
9.1.1434: MS-Windows: missing out-of-memory checks in os_win32.c
9.1.1433: Unnecessary :if when writing session
9.1.1432: GTK GUI: Buffer menu does not handle unicode correctly
9.1.1431: Hit-Enter Prompt when loading session files
9.1.1430: tabpanel may flicker in the GUI
9.1.1429: dragging outside the tabpanel changes tabpagenr
9.1.1428: completion: register completion needs cleanup
9.1.1427: rendering artifacts with the tabpanel
9.1.1426: completion: register contents not completed
9.1.1425: tabpanel: there are still some problems with the tabpanel
9.1.1424: PMenu selection broken with multi-line selection and limits
9.1.1423: :tag command not working correctly using Vim9 Script
9.1.1422: scheduling of complete function can be improved
9.1.1421: tests: need a test for the new-style tutor.tutor
9.1.1420: tests: could need some more tests for shebang lines
9.1.1419: It is difficult to ignore all but some events
9.1.1418: configures GUI auto detection favors GTK2
9.1.1417: missing info about register completion in complete_info()
9.1.1416: completion limits not respected for fuzzy completions
9.1.1415: potential use-after free when there is an error in 'tabpanel'
9.1.1414: MS-Windows: compile warnings in os_win32.c
9.1.1413: spurious CursorHold triggered in GUI on startup
9.1.1412: tests: Test_tabpanel_tabonly() fails on larger screens
9.1.1411: crash when calling non-existing function for tabpanel
9.1.1410: out-of-bounds access with 'completefunc'
9.1.1409: using f-flag in 'complete' conflicts with Neovim
9.1.1408: not easily possible to complete from register content
9.1.1407: Can't use getpos('v') in OptionSet when using setbufvar()
- zypper
-
- Fixed `bash-completion`: `zypper refresh` now ignores
repository priority lines.
- Changes to support building against restructured libzypp in
stack build (bsc#1230267)
- version 1.14.94
- Fix addrepo to handle explicit --check and --no-check requests
(bsc#1246466)
- Accept "show" as alias for "info" (bsc#1245985)
- version 1.14.93
- sh: Reset solver options after command (bsc#1245496)
- Explicitly selecting DownloadAsNeeded also selects the
classic_rpmtrans backend.
- version 1.14.92
- BuildRequires: libzypp-devel >= 17.37.6.
Enhancements regarding mirror handling during repo refresh. Adapt
to libzypp API changes. (bsc#1230267)
- version 1.14.91