------------------------------------------------------------------ --- Changelog.all ----------- Wed Oct 28 01:07:00 UTC 2026 ------ ------------------------------------------------------------------ ------------------------------------------------------------------ ------------------ 2026-10-23 - Oct 23 2026 ------------------- ------------------------------------------------------------------ ++++ libX11: - now add and apply the security fix * u_xkb-Check-the-keysym-range-in-_XkbReadKeyActions-CVE.patch for real (CVE-2026-88806, ZDI-CAN-32061, bsc#1280910) ------------------------------------------------------------------ ------------------ 2026-10-20 - Oct 20 2026 ------------------- ------------------------------------------------------------------ ++++ ca-certificates-mozilla: - Updated to 2.92 state (bsc#1286261) - Removed: - emSign ECC Root CA - C3 - emSign ECC Root CA - G3 - emSign Root CA - C1 ++++ openssh: - Backport CVE fixes: Tue Jul 28 07:58:50 UTC 2026 - Antonio Larrosa - Properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server (bsc#1271044, CVE-2026-59995): * 0001-cve-2026-59995-upstream-avoid-download-to-server-controlled-path-when.patch - scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations (bsc#1271046, CVE-2026-59996): * 0001-cve-2026-59996-upstream-resist-that-return-__-via-remote-glob-during.patch - Fix internal-sftp commandlines being silently truncated after the 9th argument (bsc#1271048, CVE-2026-59997): * 0001-cve-2026-59997-upstream-pass-gt9-commandline-arguments-to-the-internal-sftp.patch - Properly document security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory (bsc#1271049, CVE-2026-59998): * 0001-cve-2026-59998-upstream-mention-a-caveat-regarding.patch - Fix DisableForwarding=yes correctly override PermitTunnel=yes as expected (bsc#1271052, CVE-2026-59999): * 0001-cve-2026-59999-upstream-DisableForwarding-didnt-override.patch - Fix remote attackers being able to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication (bsc#1271053, CVE-2026-60000): * 0001-cve-2026-60000-upstream-Fix-multiple-RFC-4462-GSSAPIAuthentication.patch - Properly honor the minimum authentication delay (bsc#1271054, CVE-2026-60001): * 0001-cve-2026-60001-upstream-Fix-cases-in-GSSAPI-and-keyboard-interactive.patch - Fix a use-after-free (on the client side) when a server changes its host key during a key re-exchange (bsc#1271055, CVE-2026-60002): * 0001-cve-2026-60002-upstream-fix-ownership-and-lifetime-of-several-bits-of.patch ------------------------------------------------------------------ ------------------ 2026-10-19 - Oct 19 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - rpm/config.sh: drop NOEXEC option agin We went out of the hybrid workflow, and now it's git-only - commit ca962b5 - vsock/virtio: read virtqueues under worker locks (CVE-2026-74614 bsc#1277931). - commit 76b1ff6 - isofs: fix out-of-bounds page array access on empty zisofs block (bsc#1280966 CVE-2026-89778). - commit 273ad18 - crypto: algif_skcipher - force synchronous processing on trees without ctx->state (CVE-2026-74578 bsc#1275564). - commit 3f03bc5 - ipv4: validate checksum_start before completing checksum (bsc#1285684 CVE-2026-99999). - netfilter: nfnetlink_queue: unbreak SCTP traffic (bsc#1285684). - commit f6749a8 - NFSD: Never decrement pending_async_copies on error (CVE-2026-89706 bsc#1280477). - commit b1bf6ab - NFSD: Initialize struct nfsd4_copy earlier (CVE-2026-89706 bsc#1280477). - commit c6ed75a - nfsd: Reset write verifier when async COPY writeback fails (CVE-2026-89706 bsc#1280477). - commit 4a1c33e - NFSD: Limit the number of concurrent async COPY operations (CVE-2026-89706 bsc#1280477). - commit 0b28a4c - PCI: hv: Warn when wait_for_response() waits indefinitely (git-fixes). - PCI: hv: Probe vPCI buses asynchronously (git-fixes). - tools/hv: fix typo "retrive" in comment (git-fixes). - Drivers: hv: vmbus: fix typo "substract" in comment (git-fixes). - Drivers: hv: Don't reset VMBus connection state on error/exit paths (git-fixes). - Drivers: hv: Avoid infinite retry loop in init_vp_index() (git-fixes). - commit 3b97ec5 - Add Reviewed-by to patches.suse/fbdev-clear-fb_info-mode-before-deleting-a-videomode.patch - commit 130579d ++++ kernel-rt: - rpm/config.sh: drop NOEXEC option agin We went out of the hybrid workflow, and now it's git-only - commit ca962b5 - vsock/virtio: read virtqueues under worker locks (CVE-2026-74614 bsc#1277931). - commit 76b1ff6 - isofs: fix out-of-bounds page array access on empty zisofs block (bsc#1280966 CVE-2026-89778). - commit 273ad18 - crypto: algif_skcipher - force synchronous processing on trees without ctx->state (CVE-2026-74578 bsc#1275564). - commit 3f03bc5 - ipv4: validate checksum_start before completing checksum (bsc#1285684 CVE-2026-99999). - netfilter: nfnetlink_queue: unbreak SCTP traffic (bsc#1285684). - commit f6749a8 - NFSD: Never decrement pending_async_copies on error (CVE-2026-89706 bsc#1280477). - commit b1bf6ab - NFSD: Initialize struct nfsd4_copy earlier (CVE-2026-89706 bsc#1280477). - commit c6ed75a - nfsd: Reset write verifier when async COPY writeback fails (CVE-2026-89706 bsc#1280477). - commit 4a1c33e - NFSD: Limit the number of concurrent async COPY operations (CVE-2026-89706 bsc#1280477). - commit 0b28a4c - PCI: hv: Warn when wait_for_response() waits indefinitely (git-fixes). - PCI: hv: Probe vPCI buses asynchronously (git-fixes). - tools/hv: fix typo "retrive" in comment (git-fixes). - Drivers: hv: vmbus: fix typo "substract" in comment (git-fixes). - Drivers: hv: Don't reset VMBus connection state on error/exit paths (git-fixes). - Drivers: hv: Avoid infinite retry loop in init_vp_index() (git-fixes). - commit 3b97ec5 - Add Reviewed-by to patches.suse/fbdev-clear-fb_info-mode-before-deleting-a-videomode.patch - commit 130579d ++++ kernel-rt_debug: - rpm/config.sh: drop NOEXEC option agin We went out of the hybrid workflow, and now it's git-only - commit ca962b5 - vsock/virtio: read virtqueues under worker locks (CVE-2026-74614 bsc#1277931). - commit 76b1ff6 - isofs: fix out-of-bounds page array access on empty zisofs block (bsc#1280966 CVE-2026-89778). - commit 273ad18 - crypto: algif_skcipher - force synchronous processing on trees without ctx->state (CVE-2026-74578 bsc#1275564). - commit 3f03bc5 - ipv4: validate checksum_start before completing checksum (bsc#1285684 CVE-2026-99999). - netfilter: nfnetlink_queue: unbreak SCTP traffic (bsc#1285684). - commit f6749a8 - NFSD: Never decrement pending_async_copies on error (CVE-2026-89706 bsc#1280477). - commit b1bf6ab - NFSD: Initialize struct nfsd4_copy earlier (CVE-2026-89706 bsc#1280477). - commit c6ed75a - nfsd: Reset write verifier when async COPY writeback fails (CVE-2026-89706 bsc#1280477). - commit 4a1c33e - NFSD: Limit the number of concurrent async COPY operations (CVE-2026-89706 bsc#1280477). - commit 0b28a4c - PCI: hv: Warn when wait_for_response() waits indefinitely (git-fixes). - PCI: hv: Probe vPCI buses asynchronously (git-fixes). - tools/hv: fix typo "retrive" in comment (git-fixes). - Drivers: hv: vmbus: fix typo "substract" in comment (git-fixes). - Drivers: hv: Don't reset VMBus connection state on error/exit paths (git-fixes). - Drivers: hv: Avoid infinite retry loop in init_vp_index() (git-fixes). - commit 3b97ec5 - Add Reviewed-by to patches.suse/fbdev-clear-fb_info-mode-before-deleting-a-videomode.patch - commit 130579d ------------------------------------------------------------------ ------------------ 2026-10-18 - Oct 18 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr (git-fixes). - drm/amdgpu/uvd3.1: Fix checking whether UVD firmware keyselect was already set (git-fixes). - ASoC: nau8822: Fix the 128x oversampling switch bits (git-fixes). - ASoC: wm8978: Fix the 128x oversampling switch bits (git-fixes). - ASoC: max98371: Fix the Speaker DHT Min Volume bits (git-fixes). - ASoC: pcm3168a: Fix the DAC zero flag polarity bit (git-fixes). - ASoC: cs42l52: Fix the NG Type Switch bit (git-fixes). - ASoC: cs42l56: Put the Limiter Cushion control on the limiter register (git-fixes). - ASoC: stm32: spdifrx: fix synchronization state check (git-fixes). - ASoC: Intel: avs: Reset the stream unless it is already prepared (git-fixes). - pinctrl: amd: Clear S4 wake bits when firmware has _AEI (git-fixes). - tools: gpio: fix building from the top level with O= (git-fixes). - commit 08091dc ++++ kernel-rt: - drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr (git-fixes). - drm/amdgpu/uvd3.1: Fix checking whether UVD firmware keyselect was already set (git-fixes). - ASoC: nau8822: Fix the 128x oversampling switch bits (git-fixes). - ASoC: wm8978: Fix the 128x oversampling switch bits (git-fixes). - ASoC: max98371: Fix the Speaker DHT Min Volume bits (git-fixes). - ASoC: pcm3168a: Fix the DAC zero flag polarity bit (git-fixes). - ASoC: cs42l52: Fix the NG Type Switch bit (git-fixes). - ASoC: cs42l56: Put the Limiter Cushion control on the limiter register (git-fixes). - ASoC: stm32: spdifrx: fix synchronization state check (git-fixes). - ASoC: Intel: avs: Reset the stream unless it is already prepared (git-fixes). - pinctrl: amd: Clear S4 wake bits when firmware has _AEI (git-fixes). - tools: gpio: fix building from the top level with O= (git-fixes). - commit 08091dc ++++ kernel-rt_debug: - drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr (git-fixes). - drm/amdgpu/uvd3.1: Fix checking whether UVD firmware keyselect was already set (git-fixes). - ASoC: nau8822: Fix the 128x oversampling switch bits (git-fixes). - ASoC: wm8978: Fix the 128x oversampling switch bits (git-fixes). - ASoC: max98371: Fix the Speaker DHT Min Volume bits (git-fixes). - ASoC: pcm3168a: Fix the DAC zero flag polarity bit (git-fixes). - ASoC: cs42l52: Fix the NG Type Switch bit (git-fixes). - ASoC: cs42l56: Put the Limiter Cushion control on the limiter register (git-fixes). - ASoC: stm32: spdifrx: fix synchronization state check (git-fixes). - ASoC: Intel: avs: Reset the stream unless it is already prepared (git-fixes). - pinctrl: amd: Clear S4 wake bits when firmware has _AEI (git-fixes). - tools: gpio: fix building from the top level with O= (git-fixes). - commit 08091dc ------------------------------------------------------------------ ------------------ 2026-10-16 - Oct 16 2026 ------------------- ------------------------------------------------------------------ ++++ containerd: - Bound user-database file reads in openBoundedUserFile [CVE-2026-47262, bsc#1268441] * 0008-CVE-2026-47262-Bound-user-database-file-reads-in-ope.patch - limit response body size for OTLP HTTP exporters [CVE-2026-39882, bsc#1274214] * 0009-CVE-2026-39882-go.opentelemetry.io-otel-limit-respon.patch - cancel ExecSync IO drain on context cancellation [CVE-2026-53495, bsc#1280007] * 0010-CVE-2026-53495-cri-cancel-ExecSync-IO-drain-on-conte.patch - Bound Dispatch concurrency and references [CVE-2026-53493, bsc#1282669] * 0011-CVE-2026-53493-Bound-Dispatch-concurrency-and-refere.patch - skip redundant opaque whiteout walks [CVE-2026-95838, bsc#1285124] * 0012-CVE-2026-95838-archive-skip-redundant-opaque-whiteou.patch ++++ kernel-default: - fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (bsc#1276791 CVE-2026-72015). - commit 2555dac - Rename patches.suse/x86-mm-Fix-pmd_modify-dropping-the-dirty-bit.patch to patches.suse/x86-mm-Fix-user-space-data-loss-with-MADV_FREE-and-THP.patch. - replace with mainline version and update References (CVE-2026-97945 bsc#1283144) - commit 7a51cdd - drm/i915/gt: Fix NULL deref on sched_engine alloc failure (bsc#1275786 CVE-2026-68242). - commit 40c5731 - drm/i915/mst: limit DP MST ESI service loop (bsc#1275785 CVE-2026-68241). - commit 054ebdc - drm/vc4: Shut down BO cache timer before teardown (bsc#1275644 CVE-2026-68233). - commit 4f65672 - wifi: cfg80211: validate assoc response length before status and IE access (CVE-2026-93806 bsc#1283037). - commit 5c72273 - net: skmsg: preserve sg.copy across SG transforms (CVE-2026-63830 bsc#1272178). - bpf, sockmap: Several fixes to bpf_msg_push_data (CVE-2026-63830 bsc#1272178). - commit f32d261 ++++ kernel-rt: - fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (bsc#1276791 CVE-2026-72015). - commit 2555dac - Rename patches.suse/x86-mm-Fix-pmd_modify-dropping-the-dirty-bit.patch to patches.suse/x86-mm-Fix-user-space-data-loss-with-MADV_FREE-and-THP.patch. - replace with mainline version and update References (CVE-2026-97945 bsc#1283144) - commit 7a51cdd - drm/i915/gt: Fix NULL deref on sched_engine alloc failure (bsc#1275786 CVE-2026-68242). - commit 40c5731 - drm/i915/mst: limit DP MST ESI service loop (bsc#1275785 CVE-2026-68241). - commit 054ebdc - drm/vc4: Shut down BO cache timer before teardown (bsc#1275644 CVE-2026-68233). - commit 4f65672 - wifi: cfg80211: validate assoc response length before status and IE access (CVE-2026-93806 bsc#1283037). - commit 5c72273 - scripts/kernel_repos: Add debug logging - commit 0e385c5 - net: skmsg: preserve sg.copy across SG transforms (CVE-2026-63830 bsc#1272178). - bpf, sockmap: Several fixes to bpf_msg_push_data (CVE-2026-63830 bsc#1272178). - commit f32d261 ++++ kernel-rt_debug: - fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (bsc#1276791 CVE-2026-72015). - commit 2555dac - Rename patches.suse/x86-mm-Fix-pmd_modify-dropping-the-dirty-bit.patch to patches.suse/x86-mm-Fix-user-space-data-loss-with-MADV_FREE-and-THP.patch. - replace with mainline version and update References (CVE-2026-97945 bsc#1283144) - commit 7a51cdd - drm/i915/gt: Fix NULL deref on sched_engine alloc failure (bsc#1275786 CVE-2026-68242). - commit 40c5731 - drm/i915/mst: limit DP MST ESI service loop (bsc#1275785 CVE-2026-68241). - commit 054ebdc - drm/vc4: Shut down BO cache timer before teardown (bsc#1275644 CVE-2026-68233). - commit 4f65672 - wifi: cfg80211: validate assoc response length before status and IE access (CVE-2026-93806 bsc#1283037). - commit 5c72273 - scripts/kernel_repos: Add debug logging - commit 0e385c5 - net: skmsg: preserve sg.copy across SG transforms (CVE-2026-63830 bsc#1272178). - bpf, sockmap: Several fixes to bpf_msg_push_data (CVE-2026-63830 bsc#1272178). - commit f32d261 ------------------------------------------------------------------ ------------------ 2026-10-15 - Oct 15 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - Refresh patches.suse/fpga-dfl-afu-validate-DMA-mapping-length-in-afu_dma_map_re.patch. Takashi's AI found an issue in this backport. We need to bail out before afu_dma_map_region to avoid a resource leak. - commit a62c7cf - netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() (CVE-2026-98077 bsc#1283979). - commit ab9dcbf - mm/huge_memory: transfer the pmd dirty bit to the folio on zap (CVE-2026-89987 bsc#1281819). - commit 9f4116c - net/sched: cls_route: fix fastmap use-after-free on filter (CVE-2026-74583 bsc#1277889). Cherry-pick resolved automatically by custom merge drivers: - series.conf: series_merge_tool - commit 34b43e0 - Add Reviewed-by to patches.suse/sctp-fix-use-after-free-of-cached-ASCONF-chunk.patch - commit 43107be - Add Reviewed-by to patches.suse/tls-rx-restore-msg_iter-before-TLS-1.3-optimistic-retry.patch - commit 9a6e7be - serial: 8250: dispatch SysRq character in serial8250_handle_irq() (git-fixes). - commit bf4eac6 ++++ kernel-rt: - Refresh patches.suse/fpga-dfl-afu-validate-DMA-mapping-length-in-afu_dma_map_re.patch. Takashi's AI found an issue in this backport. We need to bail out before afu_dma_map_region to avoid a resource leak. - commit a62c7cf - netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() (CVE-2026-98077 bsc#1283979). - commit ab9dcbf - mm/huge_memory: transfer the pmd dirty bit to the folio on zap (CVE-2026-89987 bsc#1281819). - commit 9f4116c - net/sched: cls_route: fix fastmap use-after-free on filter (CVE-2026-74583 bsc#1277889). Cherry-pick resolved automatically by custom merge drivers: - series.conf: series_merge_tool - commit 34b43e0 - Add Reviewed-by to patches.suse/sctp-fix-use-after-free-of-cached-ASCONF-chunk.patch - commit 43107be - Add Reviewed-by to patches.suse/tls-rx-restore-msg_iter-before-TLS-1.3-optimistic-retry.patch - commit 9a6e7be - serial: 8250: dispatch SysRq character in serial8250_handle_irq() (git-fixes). - commit bf4eac6 ++++ kernel-rt_debug: - Refresh patches.suse/fpga-dfl-afu-validate-DMA-mapping-length-in-afu_dma_map_re.patch. Takashi's AI found an issue in this backport. We need to bail out before afu_dma_map_region to avoid a resource leak. - commit a62c7cf - netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() (CVE-2026-98077 bsc#1283979). - commit ab9dcbf - mm/huge_memory: transfer the pmd dirty bit to the folio on zap (CVE-2026-89987 bsc#1281819). - commit 9f4116c - net/sched: cls_route: fix fastmap use-after-free on filter (CVE-2026-74583 bsc#1277889). Cherry-pick resolved automatically by custom merge drivers: - series.conf: series_merge_tool - commit 34b43e0 - Add Reviewed-by to patches.suse/sctp-fix-use-after-free-of-cached-ASCONF-chunk.patch - commit 43107be - Add Reviewed-by to patches.suse/tls-rx-restore-msg_iter-before-TLS-1.3-optimistic-retry.patch - commit 9a6e7be - serial: 8250: dispatch SysRq character in serial8250_handle_irq() (git-fixes). - commit bf4eac6 ------------------------------------------------------------------ ------------------ 2026-10-14 - Oct 14 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START (CVE-2026-98130 bsc#1283835). - commit 6fdf934 - vhost/vdpa: validate virtqueue index in mmap and fault paths (CVE-2026-74312 bsc#1276873). - commit 9767417 - VDUSE: avoid leaking information to userspace (CVE-2026-72305 bsc#1277747). - commit 9e15021 - power: supply: generic-adc-battery: Fix temperature IIO channel conversion (git-fixes). - power: supply: ds2780: Fix ds2780_get_capacity() returning raw value (git-fixes). - power: supply: Fix maintenance charge table kernel-doc (git-fixes). - commit dc0b03e - net: skbuff: don't touch shared zerocopy state in skb_tx_error() (CVE-2026-80977 bsc#1280259). Cherry-pick resolved automatically by custom merge drivers: - series.conf: series_merge_tool - commit 1e31af2 - drm/amd/display: Resize MST HDCP per-connector arrays to 32 (bsc#1281726 CVE-2026-90289) - commit cd5ca21 - net: serialize netif_running() check in enqueue_to_backlog() (CVE-2026-72493 bsc#1276951). - commit ef42fd9 - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (bsc#1281144 CVE-2026-89811) - commit bea9303 - serial: introduce uart_port_lock() guard()s (CVE-2026-74653 bsc#1277310). - commit 1863bdf - serial: 8250: Add serial8250_handle_irq_locked() (CVE-2026-74653 bsc#1277310). - commit c6e57e3 - serial: core: introduce guard(uart_port_lock_check_sysrq_irqsave) (CVE-2026-74653 bsc#1277310). - commit 0c0bf79 - serial: 8250: introduce RPM guard()s (CVE-2026-74653 bsc#1277310). - commit a3d0cd9 - serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx (CVE-2026-74653 bsc#1277310). - PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers (CVE-2026-90315 bsc#1281865). - commit 1957551 - Add Reviewed-by tag to patches.suse/scsi-target-iscsi-Reserve-a-terminator-byte-for-the-login-.patch. - commit 24be2ad - btrfs: lzo: reject inline extents without valid headers (CVE-2026-74723 bsc#1276562). - commit 8b2c6e6 - svcrdma: Reject Read lists that exceed the page budget (CVE-2026-89528 bsc#1280743). - commit 6b7a79c ++++ kernel-rt: - sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START (CVE-2026-98130 bsc#1283835). - commit 6fdf934 - vhost/vdpa: validate virtqueue index in mmap and fault paths (CVE-2026-74312 bsc#1276873). - commit 9767417 - VDUSE: avoid leaking information to userspace (CVE-2026-72305 bsc#1277747). - commit 9e15021 - power: supply: generic-adc-battery: Fix temperature IIO channel conversion (git-fixes). - power: supply: ds2780: Fix ds2780_get_capacity() returning raw value (git-fixes). - power: supply: Fix maintenance charge table kernel-doc (git-fixes). - commit dc0b03e - net: skbuff: don't touch shared zerocopy state in skb_tx_error() (CVE-2026-80977 bsc#1280259). Cherry-pick resolved automatically by custom merge drivers: - series.conf: series_merge_tool - commit 1e31af2 - scripts/sha2series: fix patch matching for single multiversion postings $ scripts/sha2series de845981da67 https://patch.msgid.link/20260803014823.68623-1-juny24602@gmail.com Found 2 patches on the ML fatal: bad revision 'Subject: [PATCH] vhost: reset the vring metadata cache on vring reconfiguration' This fails because our pattern expects a single version numbered patches. Here we have Subject: [PATCH] vhost: reset the vring metadata cache on vring reconfiguration Subject: [PATCH v2] vhost: reset the vring metadata cache on vring reconfiguration Fix that by relaxing the patch subject parsing and use sort -u to drop different versions of the same patch. Not super robust and we might need more refinemens based on creativity we meet in the future. With the patch applied we have $ scripts/sha2series de845981da67 https://patch.msgid.link/20260804025621.16580-1-juny24602@gmail.com - commit a5ee48a - drm/amd/display: Resize MST HDCP per-connector arrays to 32 (bsc#1281726 CVE-2026-90289) - commit cd5ca21 - net: serialize netif_running() check in enqueue_to_backlog() (CVE-2026-72493 bsc#1276951). - commit ef42fd9 - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (bsc#1281144 CVE-2026-89811) - commit bea9303 - serial: introduce uart_port_lock() guard()s (CVE-2026-74653 bsc#1277310). - commit 1863bdf - serial: 8250: Add serial8250_handle_irq_locked() (CVE-2026-74653 bsc#1277310). - commit c6e57e3 - serial: core: introduce guard(uart_port_lock_check_sysrq_irqsave) (CVE-2026-74653 bsc#1277310). - commit 0c0bf79 - serial: 8250: introduce RPM guard()s (CVE-2026-74653 bsc#1277310). - commit a3d0cd9 - serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx (CVE-2026-74653 bsc#1277310). - PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers (CVE-2026-90315 bsc#1281865). - commit 1957551 - Add Reviewed-by tag to patches.suse/scsi-target-iscsi-Reserve-a-terminator-byte-for-the-login-.patch. - commit 24be2ad - btrfs: lzo: reject inline extents without valid headers (CVE-2026-74723 bsc#1276562). - commit 8b2c6e6 - svcrdma: Reject Read lists that exceed the page budget (CVE-2026-89528 bsc#1280743). - commit 6b7a79c ++++ kernel-rt_debug: - sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START (CVE-2026-98130 bsc#1283835). - commit 6fdf934 - vhost/vdpa: validate virtqueue index in mmap and fault paths (CVE-2026-74312 bsc#1276873). - commit 9767417 - VDUSE: avoid leaking information to userspace (CVE-2026-72305 bsc#1277747). - commit 9e15021 - power: supply: generic-adc-battery: Fix temperature IIO channel conversion (git-fixes). - power: supply: ds2780: Fix ds2780_get_capacity() returning raw value (git-fixes). - power: supply: Fix maintenance charge table kernel-doc (git-fixes). - commit dc0b03e - net: skbuff: don't touch shared zerocopy state in skb_tx_error() (CVE-2026-80977 bsc#1280259). Cherry-pick resolved automatically by custom merge drivers: - series.conf: series_merge_tool - commit 1e31af2 - scripts/sha2series: fix patch matching for single multiversion postings $ scripts/sha2series de845981da67 https://patch.msgid.link/20260803014823.68623-1-juny24602@gmail.com Found 2 patches on the ML fatal: bad revision 'Subject: [PATCH] vhost: reset the vring metadata cache on vring reconfiguration' This fails because our pattern expects a single version numbered patches. Here we have Subject: [PATCH] vhost: reset the vring metadata cache on vring reconfiguration Subject: [PATCH v2] vhost: reset the vring metadata cache on vring reconfiguration Fix that by relaxing the patch subject parsing and use sort -u to drop different versions of the same patch. Not super robust and we might need more refinemens based on creativity we meet in the future. With the patch applied we have $ scripts/sha2series de845981da67 https://patch.msgid.link/20260804025621.16580-1-juny24602@gmail.com - commit a5ee48a - drm/amd/display: Resize MST HDCP per-connector arrays to 32 (bsc#1281726 CVE-2026-90289) - commit cd5ca21 - net: serialize netif_running() check in enqueue_to_backlog() (CVE-2026-72493 bsc#1276951). - commit ef42fd9 - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (bsc#1281144 CVE-2026-89811) - commit bea9303 - serial: introduce uart_port_lock() guard()s (CVE-2026-74653 bsc#1277310). - commit 1863bdf - serial: 8250: Add serial8250_handle_irq_locked() (CVE-2026-74653 bsc#1277310). - commit c6e57e3 - serial: core: introduce guard(uart_port_lock_check_sysrq_irqsave) (CVE-2026-74653 bsc#1277310). - commit 0c0bf79 - serial: 8250: introduce RPM guard()s (CVE-2026-74653 bsc#1277310). - commit a3d0cd9 - serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx (CVE-2026-74653 bsc#1277310). - PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers (CVE-2026-90315 bsc#1281865). - commit 1957551 - Add Reviewed-by tag to patches.suse/scsi-target-iscsi-Reserve-a-terminator-byte-for-the-login-.patch. - commit 24be2ad - btrfs: lzo: reject inline extents without valid headers (CVE-2026-74723 bsc#1276562). - commit 8b2c6e6 - svcrdma: Reject Read lists that exceed the page budget (CVE-2026-89528 bsc#1280743). - commit 6b7a79c ------------------------------------------------------------------ ------------------ 2026-10-13 - Oct 13 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - exec: Cleanup POSIX timers right after de_thread() (CVE-2026-98260 bsc#1284408) - commit 6c4859a - nfsd: initialize copy-notify stateid before publishing it (CVE-2026-89669 bsc#1280251). - commit 1e7d935 - nfsd: fix cpntf publish race in nfs4_init_cp_state (CVE-2026-89669 bsc#1280251). - commit 9ba0a0a - ipvs: ensure inner headers in ICMP errors are in headroom (CVE-2026-72319 bsc#1275964). - refresh - patches.suse/ipvs-clear-IPv4-options-after-rebasing-tunnel-ICMP-e.patch - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CVE-2026-72319 bsc#1275964). - commit 415c235 - espintcp: use sk_msg_free_partial to fix partial send (CVE-2026-72041 bsc#1275510). - commit f55430a - KVM: PPC: Book3S HV: Free the queue pages in error path (bsc#1215199). - KVM: PPC: Book3S HV: Add missing mappings for tracing exits (bsc#1215199). - powerpc/interrupt: Use early_radix_enabled() in NMI real-mode guard (bsc#1215199). - KVM: PPC: Fix get_d_signext() 12-bit displacement for paired-single D-form (bsc#1215199). - KVM: PPC: Book3S HV: Add preempt_disable() around virtual-mode HPTE bit-lock users (bsc#1215199). - KVM: PPC: Book3S HV: Add SRCU protection for virtual-mode HPT hcalls (bsc#1215199). - KVM: PPC: Book3S HV: Add H_VIRT mapping for tracing exits (bsc#1215199). - commit b37f5f2 - Update patches.suse/PCI-altera-Protect-root-bus-removal-with-rescan-lock.patch (stable-fixes CVE-2026-93821 bsc#1282761). - Update patches.suse/PCI-iproc-Protect-root-bus-removal-with-rescan-lock.patch (stable-fixes CVE-2026-93822 bsc#1282762). - Update patches.suse/PCI-rockchip-Protect-root-bus-removal-with-rescan-lo.patch (stable-fixes CVE-2026-93820 bsc#1282755). - commit 8f06d6a - pseries/plpks: make narrowing conversions explicit (bsc#1215199). - pseries/plpks: clear SED key data after use (bsc#1215199). - pseries/plpks: clear signed update authentication buffer (bsc#1215199). - pseries/plpks: clear sensitive PLPKS buffers (bsc#1215199). - pseries/plpks: validate input to plpks_signed_update_var() (bsc#1215199). - pseries/plpks: fix error handling in plpks_read_var() (bsc#1215199). - commit b51e9f3 - ocfs2: make ocfs2_calc_xattr_init() return void (CVE-2026-93252 bsc#1282784). - commit 679555e - ocfs2: fix circular locking dependency in ocfs2_init_acl() (CVE-2026-93252 bsc#1282784). - commit 457c90a ++++ kernel-rt: - exec: Cleanup POSIX timers right after de_thread() (CVE-2026-98260 bsc#1284408) - commit 6c4859a - fetch-todo-cves: use LDAP auth when fetching c-k-f files - Stop running remote commands as the shared 'sles' account. SSH now connects as the caller's own LDAP user, which defaults to $USER. Set KSS_REMOTE_USER when the local and LDAP usernames differ: KSS_REMOTE_USER=jsmith ./fetch-todo-cves -d ./cves - Replace /home/sles/scripts/rank_order_cves.py with the permanent installation at /usr/local/bin/cve-reserve. show_help now runs 'cve-reserve --help' on the remote host, so backend options are documented in one place only. - Deprecate --ai-rank. The remote script default sorting already blends AI security review scores with CVSS. - Forward the new --wont-fix flag to the backend. - cve-reserve splits CVEs into team-exclusive pools so that specialized teams and general triage don't overlap. Use -s to select a pool: * KSS_EXCLUSIVE (default): only CVEs not reserved for any team * _EXCLUSIVE: that team's pool, e.g. NETWORKING_EXCLUSIVE * ALL: every CVE, regardless of team exclusivity Use -h to list available teams. Examples: [#] Networking team's CVEs ./fetch-todo-cves -d ./net-cves -s NETWORKING_EXCLUSIVE [#] List the top 20 networking CVEs without downloading ./fetch-todo-cves -n 20 --ls -s NETWORKING_EXCLUSIVE [#] CVEs from all pools ./fetch-todo-cves -d ./all-cves -s ALL - commit be9bbec - nfsd: initialize copy-notify stateid before publishing it (CVE-2026-89669 bsc#1280251). - commit 1e7d935 - nfsd: fix cpntf publish race in nfs4_init_cp_state (CVE-2026-89669 bsc#1280251). - commit 9ba0a0a - ipvs: ensure inner headers in ICMP errors are in headroom (CVE-2026-72319 bsc#1275964). - refresh - patches.suse/ipvs-clear-IPv4-options-after-rebasing-tunnel-ICMP-e.patch - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CVE-2026-72319 bsc#1275964). - commit 415c235 - espintcp: use sk_msg_free_partial to fix partial send (CVE-2026-72041 bsc#1275510). - commit f55430a - KVM: PPC: Book3S HV: Free the queue pages in error path (bsc#1215199). - KVM: PPC: Book3S HV: Add missing mappings for tracing exits (bsc#1215199). - powerpc/interrupt: Use early_radix_enabled() in NMI real-mode guard (bsc#1215199). - KVM: PPC: Fix get_d_signext() 12-bit displacement for paired-single D-form (bsc#1215199). - KVM: PPC: Book3S HV: Add preempt_disable() around virtual-mode HPTE bit-lock users (bsc#1215199). - KVM: PPC: Book3S HV: Add SRCU protection for virtual-mode HPT hcalls (bsc#1215199). - KVM: PPC: Book3S HV: Add H_VIRT mapping for tracing exits (bsc#1215199). - commit b37f5f2 - Update patches.suse/PCI-altera-Protect-root-bus-removal-with-rescan-lock.patch (stable-fixes CVE-2026-93821 bsc#1282761). - Update patches.suse/PCI-iproc-Protect-root-bus-removal-with-rescan-lock.patch (stable-fixes CVE-2026-93822 bsc#1282762). - Update patches.suse/PCI-rockchip-Protect-root-bus-removal-with-rescan-lo.patch (stable-fixes CVE-2026-93820 bsc#1282755). - commit 8f06d6a - pseries/plpks: make narrowing conversions explicit (bsc#1215199). - pseries/plpks: clear SED key data after use (bsc#1215199). - pseries/plpks: clear signed update authentication buffer (bsc#1215199). - pseries/plpks: clear sensitive PLPKS buffers (bsc#1215199). - pseries/plpks: validate input to plpks_signed_update_var() (bsc#1215199). - pseries/plpks: fix error handling in plpks_read_var() (bsc#1215199). - commit b51e9f3 - scripts/addpatches: Fix option parsing - commit 31c298c - scripts: grep_branches.sh compatibility symlink - commit fdd2147 - scripts: Document grep_branches grep_branches is intended to be usable as standalone script. - Document in README.scripts - grep_branches.sh -> grep_branches - commit acc0812 - ocfs2: make ocfs2_calc_xattr_init() return void (CVE-2026-93252 bsc#1282784). - commit 679555e - ocfs2: fix circular locking dependency in ocfs2_init_acl() (CVE-2026-93252 bsc#1282784). - commit 457c90a - check-kernel-fix: limit git grep thread count Branches are checked in parallel and each git grep starts one thread per cpu by default. This leads to thread oversubscription on systems with few resources and harms performance when running multiple c-k-f processes. git grep operations done during parallel branch processing are limited to 2 threads, across multiple configs on machines with different resources this was the most balanced option by far. Greps on a single file (config.conf, blacklist.conf, ...) are left unchanged, git grep splits work per file so threads have no effect there. grep_branches.sh processes branches sequentially so thread count is increased to 4. Higher counts did not offer a meaningful improvement. There is a small improvement in wall and cpu times, even when running in a system with high core count. - commit fe00180 ++++ kernel-rt_debug: - exec: Cleanup POSIX timers right after de_thread() (CVE-2026-98260 bsc#1284408) - commit 6c4859a - fetch-todo-cves: use LDAP auth when fetching c-k-f files - Stop running remote commands as the shared 'sles' account. SSH now connects as the caller's own LDAP user, which defaults to $USER. Set KSS_REMOTE_USER when the local and LDAP usernames differ: KSS_REMOTE_USER=jsmith ./fetch-todo-cves -d ./cves - Replace /home/sles/scripts/rank_order_cves.py with the permanent installation at /usr/local/bin/cve-reserve. show_help now runs 'cve-reserve --help' on the remote host, so backend options are documented in one place only. - Deprecate --ai-rank. The remote script default sorting already blends AI security review scores with CVSS. - Forward the new --wont-fix flag to the backend. - cve-reserve splits CVEs into team-exclusive pools so that specialized teams and general triage don't overlap. Use -s to select a pool: * KSS_EXCLUSIVE (default): only CVEs not reserved for any team * _EXCLUSIVE: that team's pool, e.g. NETWORKING_EXCLUSIVE * ALL: every CVE, regardless of team exclusivity Use -h to list available teams. Examples: [#] Networking team's CVEs ./fetch-todo-cves -d ./net-cves -s NETWORKING_EXCLUSIVE [#] List the top 20 networking CVEs without downloading ./fetch-todo-cves -n 20 --ls -s NETWORKING_EXCLUSIVE [#] CVEs from all pools ./fetch-todo-cves -d ./all-cves -s ALL - commit be9bbec - nfsd: initialize copy-notify stateid before publishing it (CVE-2026-89669 bsc#1280251). - commit 1e7d935 - nfsd: fix cpntf publish race in nfs4_init_cp_state (CVE-2026-89669 bsc#1280251). - commit 9ba0a0a - ipvs: ensure inner headers in ICMP errors are in headroom (CVE-2026-72319 bsc#1275964). - refresh - patches.suse/ipvs-clear-IPv4-options-after-rebasing-tunnel-ICMP-e.patch - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CVE-2026-72319 bsc#1275964). - commit 415c235 - espintcp: use sk_msg_free_partial to fix partial send (CVE-2026-72041 bsc#1275510). - commit f55430a - KVM: PPC: Book3S HV: Free the queue pages in error path (bsc#1215199). - KVM: PPC: Book3S HV: Add missing mappings for tracing exits (bsc#1215199). - powerpc/interrupt: Use early_radix_enabled() in NMI real-mode guard (bsc#1215199). - KVM: PPC: Fix get_d_signext() 12-bit displacement for paired-single D-form (bsc#1215199). - KVM: PPC: Book3S HV: Add preempt_disable() around virtual-mode HPTE bit-lock users (bsc#1215199). - KVM: PPC: Book3S HV: Add SRCU protection for virtual-mode HPT hcalls (bsc#1215199). - KVM: PPC: Book3S HV: Add H_VIRT mapping for tracing exits (bsc#1215199). - commit b37f5f2 - Update patches.suse/PCI-altera-Protect-root-bus-removal-with-rescan-lock.patch (stable-fixes CVE-2026-93821 bsc#1282761). - Update patches.suse/PCI-iproc-Protect-root-bus-removal-with-rescan-lock.patch (stable-fixes CVE-2026-93822 bsc#1282762). - Update patches.suse/PCI-rockchip-Protect-root-bus-removal-with-rescan-lo.patch (stable-fixes CVE-2026-93820 bsc#1282755). - commit 8f06d6a - pseries/plpks: make narrowing conversions explicit (bsc#1215199). - pseries/plpks: clear SED key data after use (bsc#1215199). - pseries/plpks: clear signed update authentication buffer (bsc#1215199). - pseries/plpks: clear sensitive PLPKS buffers (bsc#1215199). - pseries/plpks: validate input to plpks_signed_update_var() (bsc#1215199). - pseries/plpks: fix error handling in plpks_read_var() (bsc#1215199). - commit b51e9f3 - scripts/addpatches: Fix option parsing - commit 31c298c - scripts: grep_branches.sh compatibility symlink - commit fdd2147 - scripts: Document grep_branches grep_branches is intended to be usable as standalone script. - Document in README.scripts - grep_branches.sh -> grep_branches - commit acc0812 - ocfs2: make ocfs2_calc_xattr_init() return void (CVE-2026-93252 bsc#1282784). - commit 679555e - ocfs2: fix circular locking dependency in ocfs2_init_acl() (CVE-2026-93252 bsc#1282784). - commit 457c90a - check-kernel-fix: limit git grep thread count Branches are checked in parallel and each git grep starts one thread per cpu by default. This leads to thread oversubscription on systems with few resources and harms performance when running multiple c-k-f processes. git grep operations done during parallel branch processing are limited to 2 threads, across multiple configs on machines with different resources this was the most balanced option by far. Greps on a single file (config.conf, blacklist.conf, ...) are left unchanged, git grep splits work per file so threads have no effect there. grep_branches.sh processes branches sequentially so thread count is increased to 4. Higher counts did not offer a meaningful improvement. There is a small improvement in wall and cpu times, even when running in a system with high core count. - commit fe00180 ------------------------------------------------------------------ ------------------ 2026-10-12 - Oct 12 2026 ------------------- ------------------------------------------------------------------ ++++ containerd: - Add patch to fix build on aarm64 for codestream in GO 1.23+ * 0007-cpuid-fix-build-on-arm64-with-Go-1.23.patch - Remove invalid patch * 0002-CVE-2026-33186-containerd-google.golang.org-grpc-aut.patch - Rename/Rebase patches * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch * 0002-CVE-2026-34986-Bump-go-jose-to-v3.0.5.patch * 0003-CVE-2026-39821-idna-update-from-x-text-fix-ToUnicode.patch * 0004-CVE-2026-33814-http2-prevent-hanging-Transport-due-t.patch * 0005-CVE-2026-35469-Update-spdystream-to-0.5.1.patch * 0006-CVE-2026-53488-Do-not-propagate-reserved-labels-from.patch ++++ docker: - Ship the SELinux CIL policies from contrib/selinux/, loading docker-af-alg-deny.cil (mitigates CVE-2026-31431) via semodule when SELinux is enabled (bsc#1278193). - Update to Docker 29.7.2. See upstream changelog online at fixes(bsc#1268280, bsc#1268359, bsc#1271209, bsc#1266176) - Update to buildx 0.36.1. See upstream changelog online at - Rebased patches: * 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch * 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch (renamed from 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch) * cli-0001-openSUSE-point-users-to-docker-buildx-package.patch * cli-0002-SECRETS-SUSE-default-to-DOCKER_BUILDKIT-0-for-docker.patch - Remove patches now fixed upstream: - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch (bsc#1099277, superseded by upstream commit 528a806141 "daemon: Always reload AppArmor profile at daemon startup", which fixes the same root cause: the daemon no longer skips reinstalling the docker-default profile on upgrade) - 0007-CVE-2026-39984-Ensure-correct-certificate-is-used-fo.patch (bsc#1262346, CVE-2026-39984 fixed upstream via vendored sigstore/timestamp-authority v2.1.2) - 0008-CVE-2026-33814-http2-prevent-hanging-Transport-due-t.patch (bsc#1265782, CVE-2026-33814 fixed upstream via vendored golang.org/x/net v0.57.0) - 0009-CVE-2026-39821-idna-update-from-x-text-fix-ToUnicode.patch (bsc#1266625, CVE-2026-39821 fixed upstream via vendored golang.org/x/net v0.57.0) - 0010-CVE-2026-41567-daemon-Decompress-archives-before-ent.patch (bsc#1267827, CVE-2026-41567 fixed upstream directly in moby/moby via commit 2022313ffe) ++++ kernel-default: - kABI fix for RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted (CVE-2026-98352 bsc#1284647) - commit 71358e6 - btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631 CVE-2025-71183). - commit 883b6a2 - IB/isert: wait for deferred control PDU completions before releasing the connection (CVE-2026-98357 bsc#1284791) - commit 6686257 - RDMA/ucma: Serialize join and leave on copy_to_user failure (CVE-2026-98253 bsc#1284790) - commit 41455ca - RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted (CVE-2026-98352 bsc#1284647) - commit 2e63b9e - net/rds: Don't sleep inside rds_ib_conn_path_shutdown (CVE-2026-97491 bsc#1283142) - commit 0fa1206 - btrfs: abort transaction on failure to update inode for hole punching and reflinking (CVE-2026-98269 bsc#1284606). - commit e741ac5 - x86/kprobes: Fix crash when probing CS CALL instructions (bsc#1284462 CVE-2026-98273). - commit 7b37c97 - ipmi: fix refcount leak in i_ipmi_request() (bsc#1276836 CVE-2026-72040) - commit d760dc8 - Update patches.suse/arm64-percpu-Fix-LSE-operations-on-8-16-bit-types.patch (git-fixes bsc#1284518 CVE-2026-98248) - commit 46eac7a - regulator: ltc3676: don't read the write-only HRST and CLIRQ registers (git-fixes). - commit bf3aa59 - RDMA/rxe: validate access flags before swapping the MR's PD (CVE-2026-98366 bsc#1284655) - commit 90e243f - RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds (CVE-2026-98360 bsc#1284649) - commit aa56b46 - RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() (CVE-2026-98252 bsc#1284581) - commit 5638faf - IB/hfi1: Fix the PIO_CRED credit-return mmap (CVE-2026-98216 bsc#1284559) - commit c7ad577 - IB/hfi1: Resolve the credit-return buffer through the send context's node (git-fixes) - commit e9e348b - RDMA/core: Reject unregistering netdevs in ib_get_eth_speed (CVE-2026-98359 bsc#1284746) - commit 8acedb5 - RDMA/siw: Bound fragmented header copies by the remaining length (CVE-2026-98323 bsc#1284713) - commit 4207305 - net: mana: reserve RX buffer headroom to fix forwarding performance (git-fixes). - commit 9be16a0 ++++ kernel-rt: - check-kernel-fix: speed up sha/reference/blacklist lookups - Use LC_CTYPE=C for git greps. shas, references and CVE ids are ASCII, so a byte-wise match is enough and avoids slow multibyte case-insensitive matching. - grep_branches.sh will also be patched to use LC_CTYPE=C when possible, so we do not need to enforce that behaviour in c-k-f. Wall time and memory halve with this change when git commit-graph is being used for the linux Linus tree (tested 32 runs, different CVEs). When not using a commit-graph there is a 23% wall time decrease, memory use is unchanged. - commit d36ca33 - kABI fix for RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted (CVE-2026-98352 bsc#1284647) - commit 71358e6 - btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631 CVE-2025-71183). - commit 883b6a2 - scripts/grep_branches.sh: improve git grep performance without multibytes With LC_CTYPE="en_US.utf8" and case insensitive regexps git grep is much faster with LC_CTYPE=C so if we are not searching for multibytes enforce this behavior time ./scripts/grep_branches.sh -i "^reference.*CVE-2026-53116" real 0m24.445s user 1m18.920s sys 0m23.621s Without the patch time ./scripts/grep_branches.sh -i "^reference.*CVE-2026-53116" real 0m33.517s user 2m13.100s sys 0m23.965s - commit 6926b85 - IB/isert: wait for deferred control PDU completions before releasing the connection (CVE-2026-98357 bsc#1284791) - commit 6686257 - RDMA/ucma: Serialize join and leave on copy_to_user failure (CVE-2026-98253 bsc#1284790) - commit 41455ca - RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted (CVE-2026-98352 bsc#1284647) - commit 2e63b9e - net/rds: Don't sleep inside rds_ib_conn_path_shutdown (CVE-2026-97491 bsc#1283142) - commit 0fa1206 - btrfs: abort transaction on failure to update inode for hole punching and reflinking (CVE-2026-98269 bsc#1284606). - commit e741ac5 - x86/kprobes: Fix crash when probing CS CALL instructions (bsc#1284462 CVE-2026-98273). - commit 7b37c97 - ipmi: fix refcount leak in i_ipmi_request() (bsc#1276836 CVE-2026-72040) - commit d760dc8 - scripts/cve_tools/kpm-bot: fix_merged - fix multi-sha check if we do not have a CVE reference we need to match all shas associated with the CVE. - commit ad02364 - Update patches.suse/arm64-percpu-Fix-LSE-operations-on-8-16-bit-types.patch (git-fixes bsc#1284518 CVE-2026-98248) - commit 46eac7a - regulator: ltc3676: don't read the write-only HRST and CLIRQ registers (git-fixes). - commit bf3aa59 - RDMA/rxe: validate access flags before swapping the MR's PD (CVE-2026-98366 bsc#1284655) - commit 90e243f - RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds (CVE-2026-98360 bsc#1284649) - commit aa56b46 - RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() (CVE-2026-98252 bsc#1284581) - commit 5638faf - IB/hfi1: Fix the PIO_CRED credit-return mmap (CVE-2026-98216 bsc#1284559) - commit c7ad577 - IB/hfi1: Resolve the credit-return buffer through the send context's node (git-fixes) - commit e9e348b - RDMA/core: Reject unregistering netdevs in ib_get_eth_speed (CVE-2026-98359 bsc#1284746) - commit 8acedb5 - RDMA/siw: Bound fragmented header copies by the remaining length (CVE-2026-98323 bsc#1284713) - commit 4207305 - net: mana: reserve RX buffer headroom to fix forwarding performance (git-fixes). - commit 9be16a0 ++++ kernel-rt_debug: - check-kernel-fix: speed up sha/reference/blacklist lookups - Use LC_CTYPE=C for git greps. shas, references and CVE ids are ASCII, so a byte-wise match is enough and avoids slow multibyte case-insensitive matching. - grep_branches.sh will also be patched to use LC_CTYPE=C when possible, so we do not need to enforce that behaviour in c-k-f. Wall time and memory halve with this change when git commit-graph is being used for the linux Linus tree (tested 32 runs, different CVEs). When not using a commit-graph there is a 23% wall time decrease, memory use is unchanged. - commit d36ca33 - kABI fix for RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted (CVE-2026-98352 bsc#1284647) - commit 71358e6 - btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631 CVE-2025-71183). - commit 883b6a2 - scripts/grep_branches.sh: improve git grep performance without multibytes With LC_CTYPE="en_US.utf8" and case insensitive regexps git grep is much faster with LC_CTYPE=C so if we are not searching for multibytes enforce this behavior time ./scripts/grep_branches.sh -i "^reference.*CVE-2026-53116" real 0m24.445s user 1m18.920s sys 0m23.621s Without the patch time ./scripts/grep_branches.sh -i "^reference.*CVE-2026-53116" real 0m33.517s user 2m13.100s sys 0m23.965s - commit 6926b85 - IB/isert: wait for deferred control PDU completions before releasing the connection (CVE-2026-98357 bsc#1284791) - commit 6686257 - RDMA/ucma: Serialize join and leave on copy_to_user failure (CVE-2026-98253 bsc#1284790) - commit 41455ca - RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted (CVE-2026-98352 bsc#1284647) - commit 2e63b9e - net/rds: Don't sleep inside rds_ib_conn_path_shutdown (CVE-2026-97491 bsc#1283142) - commit 0fa1206 - btrfs: abort transaction on failure to update inode for hole punching and reflinking (CVE-2026-98269 bsc#1284606). - commit e741ac5 - x86/kprobes: Fix crash when probing CS CALL instructions (bsc#1284462 CVE-2026-98273). - commit 7b37c97 - ipmi: fix refcount leak in i_ipmi_request() (bsc#1276836 CVE-2026-72040) - commit d760dc8 - scripts/cve_tools/kpm-bot: fix_merged - fix multi-sha check if we do not have a CVE reference we need to match all shas associated with the CVE. - commit ad02364 - Update patches.suse/arm64-percpu-Fix-LSE-operations-on-8-16-bit-types.patch (git-fixes bsc#1284518 CVE-2026-98248) - commit 46eac7a - regulator: ltc3676: don't read the write-only HRST and CLIRQ registers (git-fixes). - commit bf3aa59 - RDMA/rxe: validate access flags before swapping the MR's PD (CVE-2026-98366 bsc#1284655) - commit 90e243f - RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds (CVE-2026-98360 bsc#1284649) - commit aa56b46 - RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() (CVE-2026-98252 bsc#1284581) - commit 5638faf - IB/hfi1: Fix the PIO_CRED credit-return mmap (CVE-2026-98216 bsc#1284559) - commit c7ad577 - IB/hfi1: Resolve the credit-return buffer through the send context's node (git-fixes) - commit e9e348b - RDMA/core: Reject unregistering netdevs in ib_get_eth_speed (CVE-2026-98359 bsc#1284746) - commit 8acedb5 - RDMA/siw: Bound fragmented header copies by the remaining length (CVE-2026-98323 bsc#1284713) - commit 4207305 - net: mana: reserve RX buffer headroom to fix forwarding performance (git-fixes). - commit 9be16a0 ------------------------------------------------------------------ ------------------ 2026-10-11 - Oct 11 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - drm/gud: don't keep a connector without a CRTC as connector_state (git-fixes). - drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info (git-fixes). - drm/amdkfd: align SDMA doorbell base for shader doorbell writes (git-fixes). - drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks (git-fixes). - drm/i915/gt: Unmask interrupts only when ACTIVE is true (git-fixes). - drm/i915/gem: Prevent overstepping exec array boundary (git-fixes). - drm/vc4: Free the BO cache size list on teardown (git-fixes). - drm/aspeed: Balance the display clock enable on teardown (git-fixes). - drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN (git-fixes). - drm/dp: don't mark the AUX backlight enabled when enabling failed (git-fixes). - drm/vc4: drain the hangcheck timer and works on V3D unbind (git-fixes). - commit 9feb5fe ++++ kernel-rt: - scripts/cve_tools/kpm-bot: always handle details for dependencies even if patch applies with fuzz and the branch is tracked as user branch rather than its base which is used for dependencies tracking. - commit de6e780 - drm/gud: don't keep a connector without a CRTC as connector_state (git-fixes). - drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info (git-fixes). - drm/amdkfd: align SDMA doorbell base for shader doorbell writes (git-fixes). - drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks (git-fixes). - drm/i915/gt: Unmask interrupts only when ACTIVE is true (git-fixes). - drm/i915/gem: Prevent overstepping exec array boundary (git-fixes). - drm/vc4: Free the BO cache size list on teardown (git-fixes). - drm/aspeed: Balance the display clock enable on teardown (git-fixes). - drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN (git-fixes). - drm/dp: don't mark the AUX backlight enabled when enabling failed (git-fixes). - drm/vc4: drain the hangcheck timer and works on V3D unbind (git-fixes). - commit 9feb5fe ++++ kernel-rt_debug: - scripts/cve_tools/kpm-bot: always handle details for dependencies even if patch applies with fuzz and the branch is tracked as user branch rather than its base which is used for dependencies tracking. - commit de6e780 - drm/gud: don't keep a connector without a CRTC as connector_state (git-fixes). - drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info (git-fixes). - drm/amdkfd: align SDMA doorbell base for shader doorbell writes (git-fixes). - drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks (git-fixes). - drm/i915/gt: Unmask interrupts only when ACTIVE is true (git-fixes). - drm/i915/gem: Prevent overstepping exec array boundary (git-fixes). - drm/vc4: Free the BO cache size list on teardown (git-fixes). - drm/aspeed: Balance the display clock enable on teardown (git-fixes). - drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN (git-fixes). - drm/dp: don't mark the AUX backlight enabled when enabling failed (git-fixes). - drm/vc4: drain the hangcheck timer and works on V3D unbind (git-fixes). - commit 9feb5fe ------------------------------------------------------------------ ------------------ 2026-10-10 - Oct 10 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - memstick: rtsx_usb_ms: complete requests after eject instead of dropping them (git-fixes). - memstick: core: wait for request completion before freeing card (git-fixes). - mmc: cavium-thunderx: destroy slot platform devices on remove (git-fixes). - mmc: cavium-octeon: destroy slot platform devices on remove (git-fixes). - mmc: sdhci-sprd: disable runtime PM on remove (git-fixes). - mmc: mtk-sd: Cancel request timeout work on remove (git-fixes). - ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM (git-fixes). - ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes (git-fixes). - ASoC: adau1372: allow sleepy powerdown GPIOs (git-fixes). - net: usb: ax88179_178a: fix rx frame length for non-last packets (git-fixes). - wifi: brcmfmac: fix P2P device removal race in brcmf_detach() (git-fixes). - wifi: mt76: mt792x: pick the SAR table layout from the table itself (git-fixes). - wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit (git-fixes). - Bluetooth: hci_sock: Serialize dead-device detachment (git-fixes). - Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown (git-fixes). - Bluetooth: MGMT: Fix status of pending commands flushed on power off (git-fixes). - Bluetooth: RFCOMM: free the skb when the DLC has no owner (git-fixes). - commit ef08c20 ++++ kernel-rt: - scripts/cve_tools/kpm-bot: check full failed state before transitioning from .in to .in.done This only matters when reruning a subset of branches after previous full run. E.g. when a new feature is added. Typically you just put new list of braches into cve.in file and update other state files. Comparing to .in.done will give incorrect result for the new batch as it compares previous batch as well. - commit 402bf8d - memstick: rtsx_usb_ms: complete requests after eject instead of dropping them (git-fixes). - memstick: core: wait for request completion before freeing card (git-fixes). - mmc: cavium-thunderx: destroy slot platform devices on remove (git-fixes). - mmc: cavium-octeon: destroy slot platform devices on remove (git-fixes). - mmc: sdhci-sprd: disable runtime PM on remove (git-fixes). - mmc: mtk-sd: Cancel request timeout work on remove (git-fixes). - ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM (git-fixes). - ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes (git-fixes). - ASoC: adau1372: allow sleepy powerdown GPIOs (git-fixes). - net: usb: ax88179_178a: fix rx frame length for non-last packets (git-fixes). - wifi: brcmfmac: fix P2P device removal race in brcmf_detach() (git-fixes). - wifi: mt76: mt792x: pick the SAR table layout from the table itself (git-fixes). - wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit (git-fixes). - Bluetooth: hci_sock: Serialize dead-device detachment (git-fixes). - Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown (git-fixes). - Bluetooth: MGMT: Fix status of pending commands flushed on power off (git-fixes). - Bluetooth: RFCOMM: free the skb when the DLC has no owner (git-fixes). - commit ef08c20 ++++ kernel-rt_debug: - scripts/cve_tools/kpm-bot: check full failed state before transitioning from .in to .in.done This only matters when reruning a subset of branches after previous full run. E.g. when a new feature is added. Typically you just put new list of braches into cve.in file and update other state files. Comparing to .in.done will give incorrect result for the new batch as it compares previous batch as well. - commit 402bf8d - memstick: rtsx_usb_ms: complete requests after eject instead of dropping them (git-fixes). - memstick: core: wait for request completion before freeing card (git-fixes). - mmc: cavium-thunderx: destroy slot platform devices on remove (git-fixes). - mmc: cavium-octeon: destroy slot platform devices on remove (git-fixes). - mmc: sdhci-sprd: disable runtime PM on remove (git-fixes). - mmc: mtk-sd: Cancel request timeout work on remove (git-fixes). - ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM (git-fixes). - ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes (git-fixes). - ASoC: adau1372: allow sleepy powerdown GPIOs (git-fixes). - net: usb: ax88179_178a: fix rx frame length for non-last packets (git-fixes). - wifi: brcmfmac: fix P2P device removal race in brcmf_detach() (git-fixes). - wifi: mt76: mt792x: pick the SAR table layout from the table itself (git-fixes). - wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit (git-fixes). - Bluetooth: hci_sock: Serialize dead-device detachment (git-fixes). - Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown (git-fixes). - Bluetooth: MGMT: Fix status of pending commands flushed on power off (git-fixes). - Bluetooth: RFCOMM: free the skb when the DLC has no owner (git-fixes). - commit ef08c20 ------------------------------------------------------------------ ------------------ 2026-10-9 - Oct 9 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - Update patches.suse/ASoC-SOF-ipc3-control-Fix-TOCTOU-in-bytes_put-and-by.patch (git-fixes CVE-2026-72301 bsc#1277742). - commit de23812 - gpio: exar: initialize the ID before registering its cleanup (git-fixes). - gpio: xilinx: fix runtime PM leak on request error path (git-fixes). - mac802154: fix use-after-free of sdata via queued RX frames (CVE-2026-97595 bsc#1283736). - commit acd84ac - RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept (CVE-2026-98367 bsc#1284424) - commit 5b063b4 - IB/IPoIB: Avoid restoring OPER_UP after multicast flush (CVE-2026-98347 bsc#1284295) - commit a5635f1 - IB/iser: reject a remote invalidation of an unregistered direction (CVE-2026-98358 bsc#1284289) - commit fdb7f1c ++++ kernel-rt: - Update patches.suse/ASoC-SOF-ipc3-control-Fix-TOCTOU-in-bytes_put-and-by.patch (git-fixes CVE-2026-72301 bsc#1277742). - commit de23812 - gpio: exar: initialize the ID before registering its cleanup (git-fixes). - gpio: xilinx: fix runtime PM leak on request error path (git-fixes). - mac802154: fix use-after-free of sdata via queued RX frames (CVE-2026-97595 bsc#1283736). - commit acd84ac - RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept (CVE-2026-98367 bsc#1284424) - commit 5b063b4 - IB/IPoIB: Avoid restoring OPER_UP after multicast flush (CVE-2026-98347 bsc#1284295) - commit a5635f1 - IB/iser: reject a remote invalidation of an unregistered direction (CVE-2026-98358 bsc#1284289) - commit fdb7f1c ++++ kernel-rt_debug: - Update patches.suse/ASoC-SOF-ipc3-control-Fix-TOCTOU-in-bytes_put-and-by.patch (git-fixes CVE-2026-72301 bsc#1277742). - commit de23812 - gpio: exar: initialize the ID before registering its cleanup (git-fixes). - gpio: xilinx: fix runtime PM leak on request error path (git-fixes). - mac802154: fix use-after-free of sdata via queued RX frames (CVE-2026-97595 bsc#1283736). - commit acd84ac - RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept (CVE-2026-98367 bsc#1284424) - commit 5b063b4 - IB/IPoIB: Avoid restoring OPER_UP after multicast flush (CVE-2026-98347 bsc#1284295) - commit a5635f1 - IB/iser: reject a remote invalidation of an unregistered direction (CVE-2026-98358 bsc#1284289) - commit fdb7f1c ------------------------------------------------------------------ ------------------ 2026-10-8 - Oct 8 2026 ------------------- ------------------------------------------------------------------ ++++ containerd: - Add patch for CVE-2026-53488 (bsc#1268430) * 0007-CVE-2026-53488-Do-not-propagate-reserved-labels-from.patch - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch * 0002-CVE-2026-33186-containerd-google.golang.org-grpc-aut.patch * 0003-CVE-2026-34986-Bump-go-jose-to-v3.0.5.patch * 0004-CVE-2026-39821-idna-update-from-x-text-fix-ToUnicode.patch * 0005-CVE-2026-33814-http2-prevent-hanging-Transport-due-t.patch * 0006-CVE-2026-35469-Update-spdystream-to-0.5.1.patch ++++ cyrus-sasl: - Fix heap-based buffer overflow in DIGEST-MD5 add_to_challenge(): buffer size was not recomputed after quoting expanded the value, allowing a malicious server to overflow the client heap. (bsc#1284687) CVE-2026-107161 * add cyrus-sasl-digestmd5-quote-overflow.patch ++++ kernel-default: - smb: client: fix use-after-free of iface in cifs_try_adding_channels() (bsc#1284415 CVE-2026-98173). - commit 6cb567c - smb: client: fix heap overflow in DACL owner/group rewrite (bsc#1283851 CVE-2026-97555). - commit 87be676 - smb: client: reject userspace cifs.idmap descriptions (bsc#1283946 CVE-2026-97564). - commit 525a3f9 - smb: client: bound dirent name against end of SMB response in cifs_filldir (bsc#1282932 CVE-2026-93787). - commit 8e1486e - powerpc/64s: Fix unmap race with PMD migration entries (CVE-2026-53108 bsc#1269561). - commit 708bea4 - RDMA/mad: Fix receive buffer leak when PKey enforcement fails (CVE-2026-98354 bsc#1284291) - commit c6cbe47 - kabi/severities: drop nfsd4_ssc_init_umount_work symbol This is an internal function that could never be used externally, but was priorly accidentally exported. Upstream has since removed the export annotation, and we similarly follow that here (along with a backport that does exactly that). - commit 16c266d - Add Reviewed-by to patches.suse/hugetlbfs-release-subpool-on-fill_super-failure.patch - commit eeed30f ++++ kernel-rt: - smb: client: fix use-after-free of iface in cifs_try_adding_channels() (bsc#1284415 CVE-2026-98173). - commit 6cb567c - smb: client: fix heap overflow in DACL owner/group rewrite (bsc#1283851 CVE-2026-97555). - commit 87be676 - smb: client: reject userspace cifs.idmap descriptions (bsc#1283946 CVE-2026-97564). - commit 525a3f9 - smb: client: bound dirent name against end of SMB response in cifs_filldir (bsc#1282932 CVE-2026-93787). - commit 8e1486e - powerpc/64s: Fix unmap race with PMD migration entries (CVE-2026-53108 bsc#1269561). - commit 708bea4 - RDMA/mad: Fix receive buffer leak when PKey enforcement fails (CVE-2026-98354 bsc#1284291) - commit c6cbe47 - kabi/severities: drop nfsd4_ssc_init_umount_work symbol This is an internal function that could never be used externally, but was priorly accidentally exported. Upstream has since removed the export annotation, and we similarly follow that here (along with a backport that does exactly that). - commit 16c266d - Add Reviewed-by to patches.suse/hugetlbfs-release-subpool-on-fill_super-failure.patch - commit eeed30f ++++ kernel-rt_debug: - smb: client: fix use-after-free of iface in cifs_try_adding_channels() (bsc#1284415 CVE-2026-98173). - commit 6cb567c - smb: client: fix heap overflow in DACL owner/group rewrite (bsc#1283851 CVE-2026-97555). - commit 87be676 - smb: client: reject userspace cifs.idmap descriptions (bsc#1283946 CVE-2026-97564). - commit 525a3f9 - smb: client: bound dirent name against end of SMB response in cifs_filldir (bsc#1282932 CVE-2026-93787). - commit 8e1486e - powerpc/64s: Fix unmap race with PMD migration entries (CVE-2026-53108 bsc#1269561). - commit 708bea4 - RDMA/mad: Fix receive buffer leak when PKey enforcement fails (CVE-2026-98354 bsc#1284291) - commit c6cbe47 - kabi/severities: drop nfsd4_ssc_init_umount_work symbol This is an internal function that could never be used externally, but was priorly accidentally exported. Upstream has since removed the export annotation, and we similarly follow that here (along with a backport that does exactly that). - commit 16c266d - Add Reviewed-by to patches.suse/hugetlbfs-release-subpool-on-fill_super-failure.patch - commit eeed30f ------------------------------------------------------------------ ------------------ 2026-10-7 - Oct 7 2026 ------------------- ------------------------------------------------------------------ ++++ busybox: - Fix pre-authentication heap buffer overflow in TLS caused by unit confusion in the Montgomery reduction buffer allocation (CVE-2026-88830, bsc#1282575) * 0001-tls-fix-undersized-buffer-calculation.patch - Fix httpd silently failing open when IP deny rules contain an invalid CIDR prefix length (CVE-2026-88831, bsc#1282550) * 0001-httpd-fix-handling-of-D-1.2.3-999.patch - Fix heap buffer overflow when parsing the volume ID of crafted romfs filesystem images (CVE-2026-88832, bsc#1282576) * 0001-volume_id-romfs-limit-the-maximum-size-of-label-to-V.patch - Fix out-of-bounds read in dpkg read_package_field() stepping past the NUL terminator on malformed .deb packages (CVE-2026-88835, bsc#1282551) * 0001-dpkg-free-results-of-read_package_field-preliminary-.patch * 0002-dpkg-reformat-code-in-read_package_field-exposing-wh.patch * 0003-dpkg-fix-cases-where-read_package_field-returns-offs.patch - Fix out-of-bounds read and silent corruption of the dpkg status file caused by write_status_file() not resetting the field_start cursor between package stanzas (CVE-2026-88841, bsc#1282653) * 0004-dpkg-fix-field-handling-in-write_status_file.patch - Fix httpd misidentifying yescrypt password hashes as plaintext (CVE-2026-88837, bsc#1282552) * 0001-httpd-allow-yescrypt-passwords-y.patch - Fix out-of-bounds write of heap pointers in the passwd/group parser due to a stale tokenize() endpoint (CVE-2026-88839, bsc#1282568) * 0001-libpwdgrp-tokenizer-fix-for-trailing-whitespace-remo.patch ++++ kernel-default: - tipc: serialize udp bearer replicast list updates (CVE-2026-68323 bsc#1274653). - commit c176ede - netpoll: fix a use-after-free on shutdown path (CVE-2026-64424 bsc#1274256). - commit 1acb49b - nfsd: don't EXPORT_SYMBOL nfsd4_ssc_init_umount_work() (CVE-2026-89685 bsc#1280179). - commit 10abc51 - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked (CVE-2026-64012 bsc#1273764). - commit c7ebf5f - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() (CVE-2026-64116 bsc#1273751). - commit 9ba794e - PCI: mediatek: Fix IRQ domain leak when port fails to enable (CVE-2026-64461 bsc#1273865). - commit 6824f83 - wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure (CVE-2026-64568 bsc#1274008). - commit d34e649 - net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds (CVE-2026-74544 bsc#1277894). - commit d3eeb7f - signal: avoid shared siginfo namespace rewrites (CVE-2026-93222 bsc#1282742). - commit 1eec1f7 - ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (CVE-2026-72301 bsc#1277742). - commit 1cb42e4 - RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access (CVE-2026-98365 bsc#1284288) - commit e8e659d - bonding: alb: fix uninitialized transport header access in alb_determine_nd() (CVE-2026-98089 bsc#1283936) - commit 2336ec2 - mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE (CVE-2026-72172 bsc#1277691). - commit 5b01fda - dax/kmem: account for partial discontiguous resource upon removal (CVE-2026-74379 bsc#1278232). - commit 83e5a97 - net/mlx5e: Fix use-after-free race in sample_restore_put() (CVE-2026-98016 bsc#1283894). - commit cb02e1e - net/sched: drr: clamp quantum in change class (CVE-2026-98010 bsc#1283823). - commit f24e0ec - hugetlbfs: release subpool on fill_super failure (CVE-2026-90283 bsc#1281771). - commit ece943a - bnxt_en: Fix call to hardware monitoring event handler (CVE-2026-90101 bsc#1281525) - commit fae7d0e - mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch (CVE-2026-72213 bsc#1277603). - commit f40be82 - Add Reviewed-by to patches.suse/mm-hugetlb-fix-swap-entry-corruption-when-clearing-uffd-wp.patch - commit 8bbe0b2 - btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (CVE-2026-43299 bsc#1264851). - commit 2d5a0cc - btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (CVE-2025-68358 bsc#1255531). - commit ddb87ed ++++ kernel-rt: - tipc: serialize udp bearer replicast list updates (CVE-2026-68323 bsc#1274653). - commit c176ede - netpoll: fix a use-after-free on shutdown path (CVE-2026-64424 bsc#1274256). - commit 1acb49b - nfsd: don't EXPORT_SYMBOL nfsd4_ssc_init_umount_work() (CVE-2026-89685 bsc#1280179). - commit 10abc51 - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked (CVE-2026-64012 bsc#1273764). - commit c7ebf5f - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() (CVE-2026-64116 bsc#1273751). - commit 9ba794e - PCI: mediatek: Fix IRQ domain leak when port fails to enable (CVE-2026-64461 bsc#1273865). - commit 6824f83 - wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure (CVE-2026-64568 bsc#1274008). - commit d34e649 - net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds (CVE-2026-74544 bsc#1277894). - commit d3eeb7f - signal: avoid shared siginfo namespace rewrites (CVE-2026-93222 bsc#1282742). - commit 1eec1f7 - ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (CVE-2026-72301 bsc#1277742). - commit 1cb42e4 - RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access (CVE-2026-98365 bsc#1284288) - commit e8e659d - bonding: alb: fix uninitialized transport header access in alb_determine_nd() (CVE-2026-98089 bsc#1283936) - commit 2336ec2 - mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE (CVE-2026-72172 bsc#1277691). - commit 5b01fda - dax/kmem: account for partial discontiguous resource upon removal (CVE-2026-74379 bsc#1278232). - commit 83e5a97 - net/mlx5e: Fix use-after-free race in sample_restore_put() (CVE-2026-98016 bsc#1283894). - commit cb02e1e - net/sched: drr: clamp quantum in change class (CVE-2026-98010 bsc#1283823). - commit f24e0ec - hugetlbfs: release subpool on fill_super failure (CVE-2026-90283 bsc#1281771). - commit ece943a - bnxt_en: Fix call to hardware monitoring event handler (CVE-2026-90101 bsc#1281525) - commit fae7d0e - mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch (CVE-2026-72213 bsc#1277603). - commit f40be82 - Add Reviewed-by to patches.suse/mm-hugetlb-fix-swap-entry-corruption-when-clearing-uffd-wp.patch - commit 8bbe0b2 - btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (CVE-2026-43299 bsc#1264851). - commit 2d5a0cc - btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (CVE-2025-68358 bsc#1255531). - commit ddb87ed ++++ kernel-rt_debug: - tipc: serialize udp bearer replicast list updates (CVE-2026-68323 bsc#1274653). - commit c176ede - netpoll: fix a use-after-free on shutdown path (CVE-2026-64424 bsc#1274256). - commit 1acb49b - nfsd: don't EXPORT_SYMBOL nfsd4_ssc_init_umount_work() (CVE-2026-89685 bsc#1280179). - commit 10abc51 - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked (CVE-2026-64012 bsc#1273764). - commit c7ebf5f - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() (CVE-2026-64116 bsc#1273751). - commit 9ba794e - PCI: mediatek: Fix IRQ domain leak when port fails to enable (CVE-2026-64461 bsc#1273865). - commit 6824f83 - wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure (CVE-2026-64568 bsc#1274008). - commit d34e649 - net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds (CVE-2026-74544 bsc#1277894). - commit d3eeb7f - signal: avoid shared siginfo namespace rewrites (CVE-2026-93222 bsc#1282742). - commit 1eec1f7 - ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (CVE-2026-72301 bsc#1277742). - commit 1cb42e4 - RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access (CVE-2026-98365 bsc#1284288) - commit e8e659d - bonding: alb: fix uninitialized transport header access in alb_determine_nd() (CVE-2026-98089 bsc#1283936) - commit 2336ec2 - mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE (CVE-2026-72172 bsc#1277691). - commit 5b01fda - dax/kmem: account for partial discontiguous resource upon removal (CVE-2026-74379 bsc#1278232). - commit 83e5a97 - net/mlx5e: Fix use-after-free race in sample_restore_put() (CVE-2026-98016 bsc#1283894). - commit cb02e1e - net/sched: drr: clamp quantum in change class (CVE-2026-98010 bsc#1283823). - commit f24e0ec - hugetlbfs: release subpool on fill_super failure (CVE-2026-90283 bsc#1281771). - commit ece943a - bnxt_en: Fix call to hardware monitoring event handler (CVE-2026-90101 bsc#1281525) - commit fae7d0e - mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch (CVE-2026-72213 bsc#1277603). - commit f40be82 - Add Reviewed-by to patches.suse/mm-hugetlb-fix-swap-entry-corruption-when-clearing-uffd-wp.patch - commit 8bbe0b2 - btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (CVE-2026-43299 bsc#1264851). - commit 2d5a0cc - btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (CVE-2025-68358 bsc#1255531). - commit ddb87ed ++++ expat: - security update: * CVE-2026-77214: expat: Out-of-bounds read in XML_ParseBuffer when len exceeds buffer capacity (bsc#1284334) - Added patch expat-CVE-2026-77214.patch ------------------------------------------------------------------ ------------------ 2026-10-6 - Oct 6 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - powerpc/hv-gpci: fix preempt count leak in sysfs show paths (CVE-2026-64070 bsc#1273116). - commit 750fba4 - btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() (CVE-2026-93800 bsc#1282808). - commit 204c0a9 - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (CVE-2026-64422 bsc#1273290). - commit 92f9f98 - net/sched: fix packet loop on netem when duplicate is on (CVE-2026-63983 bsc#1273040). - commit 3811410 - kabi: hide tc_depth bitfield in struct sk_buff (CVE-2026-63983 bsc#1273040). - net: Introduce skb tc depth field to track packet loops (CVE-2026-63983 bsc#1273040). - commit 02ebbc5 - RDMA/erdma: complete object teardown when the destroy command fails (CVE-2026-92488 bsc#1281979) Refresh: - patches.suse/RDMA-erdma-Hold-CQ-references-when-processing-EQ-eve.patch - patches.suse/RDMA-erdma-Hold-QP-references-for-AE-and-CM-processi.patch - commit 8a877c7 - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit (bsc#1264267) - commit 38a59f5 - nfsd: fix clock domain mismatch in clients_still_reclaiming() (CVE-2026-89685 bsc#1280179). - commit 6da7bb3 - KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy (git-fixes). - commit 1258220 - KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails (git-fixes). - commit 37fabf9 - kernel-binary.spec.in: Fix syntax error - commit 319cf6a - kernel-binary.spec.in: Do not disable SUSE_HAVE_STABLE_KABI Currently when the option to ignore ABI errors is enabled the kernel config SUSE_HAVE_STABLE_KABI is disabled. However, ABI workarounds may depend on this option, and disabling it may cause false positives when examining the build result. Disableing the config option is wrong. Ignoring ABI errors does not necessarily mean that the kernel does not have stable ABI, only that in this particular build failure to adhere to the ABI specification does not result in a build failure. - commit 8c0ce5c - btrfs: only release the dirty pages io tree after successful writes (CVE-2026-53284 bsc#1269816). - commit 1521a8e - btrfs: lzo: reject compressed segment that overflows the compressed input (CVE-2026-80631 bsc#1277558). - commit 1401fd7 - btrfs: tree-checker: validate INODE_REF's namelen (CVE-2026-93813 bsc#1282767). - commit 661a75f - drm/amdkfd: Add bounds check for CRAT subtype length (bsc#1279536 CVE-2026-80747) - commit e38b91c - NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers (CVE-2026-90149 bsc#1281955). - commit d859e91 ++++ kernel-rt: - powerpc/hv-gpci: fix preempt count leak in sysfs show paths (CVE-2026-64070 bsc#1273116). - commit 750fba4 - btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() (CVE-2026-93800 bsc#1282808). - commit 204c0a9 - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (CVE-2026-64422 bsc#1273290). - commit 92f9f98 - net/sched: fix packet loop on netem when duplicate is on (CVE-2026-63983 bsc#1273040). - commit 3811410 - kabi: hide tc_depth bitfield in struct sk_buff (CVE-2026-63983 bsc#1273040). - net: Introduce skb tc depth field to track packet loops (CVE-2026-63983 bsc#1273040). - commit 02ebbc5 - RDMA/erdma: complete object teardown when the destroy command fails (CVE-2026-92488 bsc#1281979) Refresh: - patches.suse/RDMA-erdma-Hold-CQ-references-when-processing-EQ-eve.patch - patches.suse/RDMA-erdma-Hold-QP-references-for-AE-and-CM-processi.patch - commit 8a877c7 - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit (bsc#1264267) - commit 38a59f5 - nfsd: fix clock domain mismatch in clients_still_reclaiming() (CVE-2026-89685 bsc#1280179). - commit 6da7bb3 - KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy (git-fixes). - commit 1258220 - KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails (git-fixes). - commit 37fabf9 - kernel-binary.spec.in: Fix syntax error - commit 319cf6a - kernel-binary.spec.in: Do not disable SUSE_HAVE_STABLE_KABI Currently when the option to ignore ABI errors is enabled the kernel config SUSE_HAVE_STABLE_KABI is disabled. However, ABI workarounds may depend on this option, and disabling it may cause false positives when examining the build result. Disableing the config option is wrong. Ignoring ABI errors does not necessarily mean that the kernel does not have stable ABI, only that in this particular build failure to adhere to the ABI specification does not result in a build failure. - commit 8c0ce5c - btrfs: only release the dirty pages io tree after successful writes (CVE-2026-53284 bsc#1269816). - commit 1521a8e - btrfs: lzo: reject compressed segment that overflows the compressed input (CVE-2026-80631 bsc#1277558). - commit 1401fd7 - btrfs: tree-checker: validate INODE_REF's namelen (CVE-2026-93813 bsc#1282767). - commit 661a75f - drm/amdkfd: Add bounds check for CRAT subtype length (bsc#1279536 CVE-2026-80747) - commit e38b91c - NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers (CVE-2026-90149 bsc#1281955). - commit d859e91 ++++ kernel-rt_debug: - powerpc/hv-gpci: fix preempt count leak in sysfs show paths (CVE-2026-64070 bsc#1273116). - commit 750fba4 - btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() (CVE-2026-93800 bsc#1282808). - commit 204c0a9 - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (CVE-2026-64422 bsc#1273290). - commit 92f9f98 - net/sched: fix packet loop on netem when duplicate is on (CVE-2026-63983 bsc#1273040). - commit 3811410 - kabi: hide tc_depth bitfield in struct sk_buff (CVE-2026-63983 bsc#1273040). - net: Introduce skb tc depth field to track packet loops (CVE-2026-63983 bsc#1273040). - commit 02ebbc5 - RDMA/erdma: complete object teardown when the destroy command fails (CVE-2026-92488 bsc#1281979) Refresh: - patches.suse/RDMA-erdma-Hold-CQ-references-when-processing-EQ-eve.patch - patches.suse/RDMA-erdma-Hold-QP-references-for-AE-and-CM-processi.patch - commit 8a877c7 - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit (bsc#1264267) - commit 38a59f5 - nfsd: fix clock domain mismatch in clients_still_reclaiming() (CVE-2026-89685 bsc#1280179). - commit 6da7bb3 - KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy (git-fixes). - commit 1258220 - KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails (git-fixes). - commit 37fabf9 - kernel-binary.spec.in: Fix syntax error - commit 319cf6a - kernel-binary.spec.in: Do not disable SUSE_HAVE_STABLE_KABI Currently when the option to ignore ABI errors is enabled the kernel config SUSE_HAVE_STABLE_KABI is disabled. However, ABI workarounds may depend on this option, and disabling it may cause false positives when examining the build result. Disableing the config option is wrong. Ignoring ABI errors does not necessarily mean that the kernel does not have stable ABI, only that in this particular build failure to adhere to the ABI specification does not result in a build failure. - commit 8c0ce5c - btrfs: only release the dirty pages io tree after successful writes (CVE-2026-53284 bsc#1269816). - commit 1521a8e - btrfs: lzo: reject compressed segment that overflows the compressed input (CVE-2026-80631 bsc#1277558). - commit 1401fd7 - btrfs: tree-checker: validate INODE_REF's namelen (CVE-2026-93813 bsc#1282767). - commit 661a75f - drm/amdkfd: Add bounds check for CRAT subtype length (bsc#1279536 CVE-2026-80747) - commit e38b91c - NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers (CVE-2026-90149 bsc#1281955). - commit d859e91 ++++ python-PyJWT: - CVE-2026-101917: attacker traffic can amplify outbound requests to the configured JWKS endpoint (bsc#1283060) * CVE-2026-101917.patch - CVE-2026-101918: unauthenticated request can raise an exception that may produce an HTTP 500 response (bsc#1283061) * CVE-2026-101918.patch - CVE-2026-102267: forwarded credentials may be disclosed or verification keys may be substituted (bsc#1283064) * CVE-2026-102267.patch - CVE-2026-102268: an attacker who knows the public key can forge authenticated HMAC tokens (bsc#1283065) * CVE-2026-102268.patch - CVE-2026-102269: raw-token revocation checks can fail to recognize an equivalent modified token (bsc#1283066) * CVE-2026-102269.patch - CVE-2026-102270: an attacker can cause intensive CPU consumption. (bsc#1283067) * also fixed by CVE-2026-102268.patch - CVE-2026-102271: an attacker who knows the public key can forge authenticated HMAC tokens (bsc#1283068) * CVE-2026-102271.patch - CVE-2026-102274: Malformed RSA JWK aborts parsing of an entire JWK Set (bsc#1283071) * CVE-2026-102274.patch - CVE-2026-102275: an attacker may use a stolen sender-constrained token without the legitimate private key (bsc#1283072) * CVE-2026-102275.patch - CVE-2026-103001: reused mutable options mapping can cause verification checks bypass on subsequent decode calls (bsc#1283829) * CVE-2026-103001.patch ------------------------------------------------------------------ ------------------ 2026-10-5 - Oct 5 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - lockd: pin next file across nlm_inspect_file lock-drop (CVE-2026-89485 bsc#1280456). - commit 414d1b3 - inode: make __iget() a static inline (bsc#1282383). - commit b61fda0 - blk-iocost: clear delay state when freeing policy data (CVE-2026-90182 bsc#1281644). - commit 6ad5256 - drm/i915/hdcp: check streams[] bounds before overflow (CVE-2026-68253 bsc#1275156). - Refresh patches.suse/serial-qcom_geni-fix-kfifo-underflow-when-flush-prec.patch. - commit 4d3e8c9 - Refresh patches.suse/SUNRPC-check-rpc_sockaddr2uaddr-return-value-in-rpcb_regis.patch. - commit 422336a - Disable CONFIG_CAN (jsc#PED-16993) CAN has received loads of CVEs in the recent time, so we decided to remove it from our kernels. - commit 7b3e0da - sctp: fix addr_wq_timer race in sctp_free_addr_wq() (CVE-2026-72383 bsc#1277857). - commit 73c67ed - blk-iolatency: clear delay state when freeing policy data (CVE-2026-90183 bsc#1281964). - commit 8e3fdfd - futex: Prevent rcuwait use-after-free during requeue PI (CVE-2026-90003 bsc#1281295). - commit 02487e7 - SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (CVE-2026-89784 bsc#1281224). - commit 2a45597 - vhost-scsi: flush backend after device ioctls (CVE-2026-93782 bsc#1282906). - commit 2a9529b - vhost_iotlb: bound map allocation in add_range (CVE-2026-74713 bsc#1276570). - commit 33e3920 - KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (CVE-2026-64283 bsc#1273870). - commit d8e30ad ++++ kernel-rt: - lockd: pin next file across nlm_inspect_file lock-drop (CVE-2026-89485 bsc#1280456). - commit 414d1b3 - inode: make __iget() a static inline (bsc#1282383). - commit b61fda0 - blk-iocost: clear delay state when freeing policy data (CVE-2026-90182 bsc#1281644). - commit 6ad5256 - drm/i915/hdcp: check streams[] bounds before overflow (CVE-2026-68253 bsc#1275156). - Refresh patches.suse/serial-qcom_geni-fix-kfifo-underflow-when-flush-prec.patch. - commit 4d3e8c9 - Refresh patches.suse/SUNRPC-check-rpc_sockaddr2uaddr-return-value-in-rpcb_regis.patch. - commit 422336a - Disable CONFIG_CAN (jsc#PED-16993) CAN has received loads of CVEs in the recent time, so we decided to remove it from our kernels. - commit 7b3e0da - sctp: fix addr_wq_timer race in sctp_free_addr_wq() (CVE-2026-72383 bsc#1277857). - commit 73c67ed - blk-iolatency: clear delay state when freeing policy data (CVE-2026-90183 bsc#1281964). - commit 8e3fdfd - futex: Prevent rcuwait use-after-free during requeue PI (CVE-2026-90003 bsc#1281295). - commit 02487e7 - SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (CVE-2026-89784 bsc#1281224). - commit 2a45597 - vhost-scsi: flush backend after device ioctls (CVE-2026-93782 bsc#1282906). - commit 2a9529b - vhost_iotlb: bound map allocation in add_range (CVE-2026-74713 bsc#1276570). - commit 33e3920 - KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (CVE-2026-64283 bsc#1273870). - commit d8e30ad ++++ kernel-rt_debug: - lockd: pin next file across nlm_inspect_file lock-drop (CVE-2026-89485 bsc#1280456). - commit 414d1b3 - inode: make __iget() a static inline (bsc#1282383). - commit b61fda0 - blk-iocost: clear delay state when freeing policy data (CVE-2026-90182 bsc#1281644). - commit 6ad5256 - drm/i915/hdcp: check streams[] bounds before overflow (CVE-2026-68253 bsc#1275156). - Refresh patches.suse/serial-qcom_geni-fix-kfifo-underflow-when-flush-prec.patch. - commit 4d3e8c9 - Refresh patches.suse/SUNRPC-check-rpc_sockaddr2uaddr-return-value-in-rpcb_regis.patch. - commit 422336a - Disable CONFIG_CAN (jsc#PED-16993) CAN has received loads of CVEs in the recent time, so we decided to remove it from our kernels. - commit 7b3e0da - sctp: fix addr_wq_timer race in sctp_free_addr_wq() (CVE-2026-72383 bsc#1277857). - commit 73c67ed - blk-iolatency: clear delay state when freeing policy data (CVE-2026-90183 bsc#1281964). - commit 8e3fdfd - futex: Prevent rcuwait use-after-free during requeue PI (CVE-2026-90003 bsc#1281295). - commit 02487e7 - SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (CVE-2026-89784 bsc#1281224). - commit 2a45597 - vhost-scsi: flush backend after device ioctls (CVE-2026-93782 bsc#1282906). - commit 2a9529b - vhost_iotlb: bound map allocation in add_range (CVE-2026-74713 bsc#1276570). - commit 33e3920 - KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (CVE-2026-64283 bsc#1273870). - commit d8e30ad ------------------------------------------------------------------ ------------------ 2026-10-4 - Oct 4 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages (bsc#1284146). - commit 96f54af - drm/amdkfd: Remove arbitrary timeout for hmm_range_fault (stable-fixes). - Refresh patches.suse/drm-amdgpu-fix-amdgpu_hmm_range_get_pages.patch. - commit 197e9bf - drm/amdgpu: make an improvement on amdgpu_hmm_range_get_pages (stable-fixes). - Refresh patches.suse/drm-amdgpu-fix-amdgpu_hmm_range_get_pages.patch. - commit ac93acb - drm/amdgpu: increase hmm range get pages timeout (stable-fixes). - commit f949604 - Drop patches.suse/wifi-libertas-reject-short-monitor-TX-frames.patch AI review detected a bad spinlock unbalance (also found in the upstream) - commit 83a880d - Drop a couple of ASUS BT pathes (git-fixes) Deleted, reverted on upstream stable trees: patches.suse/Bluetooth-btusb-Add-ASUS-USB-BT540-for-Realtek-8761C.patch patches.suse/Bluetooth-btusb-Add-ASUS-USB-BT600-for-Realtek-8761C.patch - commit 582726b - Input: synaptics - limit T440p InterTouch quirk to LEN0036 (git-fixes). - drm/amd/pm/si: Fix updating clock limits on AC/DC (git-fixes). - drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC (git-fixes). - commit f8f3824 - wifi: rsi: fix heap OOB write on key removal (git-fixes). - wifi: ath9k_htc: don't store usb_device_id (stable-fixes). - wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() (stable-fixes). - wifi: iwlwifi: acpi: validate WGDS table revision index (stable-fixes). - wifi: iwlwifi: bound aligned TLV advance in FW parser (stable-fixes). - wifi: iwlwifi: mvm: fix a possible underflow (stable-fixes). - wifi: iwlwifi: mvm: add a check on the tid coming from the firmware (stable-fixes). - wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif (stable-fixes). - wifi: iwlwifi: mvm: fix sched scan IE sizing (stable-fixes). - wifi: iwlwifi: mvm: validate sta_id in BA window status notif (stable-fixes). - wifi: iwlwifi: mvm: fix an off-by-1 boundary check (stable-fixes). - wifi: mwifiex: replace one-element arrays with flexible array members (stable-fixes). - wifi: cfg80211: validate rx/tx MLME callback frame lengths before access (stable-fixes). - wifi: mac80211: validate deauth frame length before reason access (stable-fixes). - wifi: rsi: validate beacon length before fixed buffer copy (stable-fixes). - wifi: libipw: fix key index receive bound checks (stable-fixes). - wifi: libertas: reject short monitor TX frames (stable-fixes). - wifi: ralink: RT2X00: init EEPROM properly (stable-fixes). - wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers (stable-fixes). - xhci: Prevent queuing new commands if xhci is inaccessible (stable-fixes). - wifi: mt76: transform aspm_conf for pci_disable_link_state (stable-fixes). - wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi (stable-fixes). - wifi: rtw89: pci: enable LTR based on pcie control register (stable-fixes). - wifi: rtw89: phy: check length before parsing PHY status IE (stable-fixes). - wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result() (stable-fixes). - wifi: mac80211: always allow transmitting null-data on TXQs (stable-fixes). - wifi: nl80211: reject beacons with bad HE operation (stable-fixes). - wifi: rtw88: TX QOS Null data the same way as Null data (stable-fixes). - wifi: rtw88: Fix the random "error beacon valid" messages for USB (stable-fixes). - commit e67ef0d - USB: gadget: dummy-hcd: Fix wait for outstanding request completions (git-fixes). - usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe (git-fixes). - usb: typec: ucsi: Get the connector fwnode based on reg value (git-fixes). - usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd (git-fixes). - usb: core: clear both ep_in and ep_out for non-ep0 control endpoints (git-fixes). - USB: cdc-acm: skip URB restart in port_shutdown if disconnected (git-fixes). - usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC (git-fixes). - usb: gadget: aspeed-vhub: cancel wake work on device removal (git-fixes). - USB: serial: quatech2: fix baud rate overflow (git-fixes). - USB: serial: ssu100: fix baud rate overflow (git-fixes). - usb: typec: ucsi: displayport: Current CAM OOB index fixup (git-fixes). - usb: ohci-st: disable controller wakeup on removal (git-fixes). - usb: ohci-s3c2410: disable controller wakeup on removal (git-fixes). - usb: ohci-da8xx: disable controller wakeup on cleanup (git-fixes). - usb: cdns3: fix use-after-free in cdns3_gadget_exit() (git-fixes). - usb: chipidea: tegra: disable runtime PM on resume failure (git-fixes). - usb: typec: anx7411 - stop the IRQ before destroying the workqueue (git-fixes). - USB: serial: fix driver deregistration order (git-fixes). - USB: serial: fix dynamic id driver deregistration race (git-fixes). - usbip: vhci_hcd: fix NULL deref in status_show_vhci (stable-fixes). - commit 9a4fea3 - tty: serial: qcom_geni_serial: Keep console RX functional after deep idle (git-fixes). - tty: vt: fix memory leak in vc_allocate() (git-fixes). - thunderbolt: Reject oversized XDomain properties responses (git-fixes). - USB: serial: fix port tear down use-after-free (git-fixes). - USB: cdc-acm: fix racy TIOCMIWAIT implementation (git-fixes). - usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() (git-fixes). - usb: storage: sierra_ms: reject short SWoC info transfers (git-fixes). - usb: typec: tcpm: recover after failure to start the frs ams (git-fixes). - usb: dwc3: am62: Fix runtime PM usage count leak on probe error path (git-fixes). - usb: octeon-hcd: fix the FIFO-flush timeout computation (git-fixes). - usb: hub: use shorter 120ms post resume hold for SS root hubs (git-fixes). - usb: typec: ucsi: glink: fix use-after-free of ucsi on remove (git-fixes). - thunderbolt: Fix KASAN reported use-after-free when request is canceled (git-fixes). - usb: xusbatm: don't rely on id table pointer arithmetic (stable-fixes). - usb: serial: spcp8x5: don't store usb_device_id (stable-fixes). - usb: usbtmc: don't store usb_device_id (stable-fixes). - thunderbolt: Increase timeout for Configuration Ready bit (stable-fixes). - thunderbolt: Verify Router Ready bit is set after router enumeration (stable-fixes). - thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host() (stable-fixes). - thunderbolt: Improve multi-display DisplayPort tunnel allocation (stable-fixes). - usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue (stable-fixes). - usb: host: add ARCH_AIROHA in XHCI MTK dependency (stable-fixes). - USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set (stable-fixes). - usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log (stable-fixes). - usb: core: hcd: fix possible deadlock in rh control transfers (stable-fixes). - usb: gadget: udc: skip pullup() if already connected (stable-fixes). - usb: xhci: use cached HCSPARAMS1 value (stable-fixes). - commit 8c080f1 - serial: tegra: don't clear the Tx FIFO on an Rx-only reset (git-fixes). - soc: qcom: geni-se: Correct QUP Core ICC vote constants (git-fixes). - serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() (git-fixes). - serial: vt8500: Fix clock reference leak in vt8500_serial_probe() (git-fixes). - spi: dw: fix wrong RX_SAMPLE_DLY setting after resume (stable-fixes). - spi: dw-dma: Wait for controller idle before completing Tx (stable-fixes). - spi: core: Abort active target transfer on controller suspend (stable-fixes). - rtc: bq32000: add delay between RTC reads (stable-fixes). - rtc: aspeed: add AST2700 compatible (stable-fixes). - spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data() (stable-fixes). - PCI: rockchip: Protect root bus removal with rescan lock (stable-fixes). - PCI: mediatek: Protect root bus removal with rescan lock (stable-fixes). - PCI: iproc: Protect root bus removal with rescan lock (stable-fixes). - PCI: altera: Protect root bus removal with rescan lock (stable-fixes). - PCI: switchtec: Add Gen6 Device IDs (stable-fixes). - soundwire: dmi-quirks: Disable ghost Realtek devices (stable-fixes). - soundwire: only handle alert events when the peripheral is attached (stable-fixes). - soundwire: validate DT compatible before parsing it (stable-fixes). - platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table (stable-fixes). - platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table (stable-fixes). - thunderbolt: Keep XDomain reference during the lifetime of a service (stable-fixes). - thunderbolt: Set tb->root_switch to NULL when domain is stopped (stable-fixes). - thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() (stable-fixes). - thunderbolt: Keep the domain reference while processing hotplug (stable-fixes). - serial: 8250: fix possible ISR soft lockup (stable-fixes). - spi: xilinx: let transfers timeout in case of no IRQ (stable-fixes). - spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM (stable-fixes). - thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries (stable-fixes). - thermal/drivers/tegra/soctherma: Switch to devm cooling device registration (stable-fixes). - commit e3fae4b - net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist (stable-fixes). - mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 (stable-fixes). - net: usb: pegasus: don't rely on id table pointer arithmetic (stable-fixes). - PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems (stable-fixes). - PCI: Wait for device readiness after D3hot -> D0uninitialized transition (stable-fixes). - PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device() (stable-fixes). - PCI: Stop setting cached power state to 'unknown' on unbind (stable-fixes). - net: wwan: t7xx: Add delay between MD and SAP suspend (stable-fixes). - net: usb: qmi_wwan: add MeiG SRM813Q (stable-fixes). - mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC (stable-fixes). - commit ee279e5 - Input: s6sy761 - fix resume ordering and restore sensing (git-fixes). - Input: xpad - add support for Victrix Pro BFG Controller (stable-fixes). - Input: xpad - add support for Azeron devices (stable-fixes). - Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P (stable-fixes). - Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) (stable-fixes). - integrity: Check for NULL returned by asymmetric_key_public_key (stable-fixes). - media: imon: Add iMON VFD HID OEM v1.2 key mappings (stable-fixes). - media: video-i2c: fix buffer queue ordering (stable-fixes). - media: video-i2c: use vb2_video_unregister_device on driver removal (stable-fixes). - media: em28xx-video: fix missing res_free() on init_usb_xfer failure (stable-fixes). - media: dm1105: fix missing error check for dma_alloc_coherent (stable-fixes). - media: rc: mceusb: Add support for 04eb:e033 (stable-fixes). - leds: uleds: Return -EFAULT on copy_to_user() failure (stable-fixes). - leds: pca9532: Don't stop blinking for non-zero brightness (stable-fixes). - mfd: rsmu: Add 8a34002 support (stable-fixes). - mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC (stable-fixes). - mmc: davinci: fix mmc_add_host order in probe (stable-fixes). - mmc: davinci: avoid NULL deref of host->data in IRQ handler (stable-fixes). - mmc: core: Add validation for host-provided max_segs (stable-fixes). - mfd: db8500-prcmu: Remove needless return in three void APIs (stable-fixes). - commit 9353f15 - iio: accel: kxcjk-1013: reject duplicate event disable (git-fixes). - iio: buffer: serialize buffer teardown with mode claims (git-fixes). - iio: adc: stm32-adc: fix check on internal channel availability (git-fixes). - iio: proximity: isl29501: Fix return type of isl29501_register_write (git-fixes). - iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler (git-fixes). - iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure (git-fixes). - iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls (git-fixes). - iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure (git-fixes). - iio: trigger: cancel reenable_work before freeing trigger (git-fixes). - iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw() (git-fixes). - iio: accel: sca3000: fix frequency divider condition check (git-fixes). - iio: gyro: adis16136: fix unprotected debugfs reads (git-fixes). - iio: imu: adis16400: fix unprotected debugfs reads (git-fixes). - iio: imu: adis16480: fix unprotected debugfs reads (git-fixes). - iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind (git-fixes). - iio: buffer: Ensure bounce buffer used for unaligned case is zeroed (git-fixes). - iio: proximity: sx9324: Correct proximity channel resolution (git-fixes). - iio: accel: kionix-kx022a: Fix array boundary check (git-fixes). - iio: adc: max1363: sign-extend bipolar differential channel reads (git-fixes). - iio: light: gp2ap020a00f: drain irq_work after free_irq (git-fixes). - iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup (git-fixes). - iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind (stable-fixes). - iio: accel: mma8452: switch to non-devm request_threaded_irq() (stable-fixes). - iio: light: stk3310: Deal with the ps interrupt issue in PM (stable-fixes). - i3c: mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA (stable-fixes). - host1x: bus: Fix missing ops null check in error teardown (stable-fixes). - hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i (stable-fixes). - hwmon: (adt7462) Add of_match_table to support devicetree (stable-fixes). - commit d7cb25f - drm/radeon: Read the VRAM VBIOS signature with readb() (git-fixes). - drm/amdgpu: fix ACP MFD device leak on init failure (git-fixes). - drm/amdgpu: fix IP instance memory leak on kobject add failure (git-fixes). - drm/mediatek: Fix ovl adaptor platform device leak (git-fixes). - drm/mediatek: Fix pdev reference leak in mtk_drm_bind() (git-fixes). - drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device (git-fixes). - HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard (stable-fixes). - drm/vc4: Use managed KMS polling to fix UAF on unbind (git-fixes). - firmware: stratix10-svc: fix FCS SMC call kernel-doc (git-fixes). - drm/gma500: return errors from Oaktrail HDMI I2C reads (stable-fixes). - drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized (stable-fixes). - gpio: dwapb: Mask interrupts at hardware initialization (stable-fixes). - drm/arm/komeda: fix error handling for clk_prepare_enable() and callers (stable-fixes). - drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend (stable-fixes). - fbdev: pm2fb: unwind WC setup on probe failure (stable-fixes). - gpio: pisosr: Read "ngpios" as u32 (stable-fixes). - firmware: stratix10-svc: change get provision data to async SMC call (stable-fixes). - firmware: arm_scmi: Validate SENSOR_UPDATE payload size (stable-fixes). - firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size (stable-fixes). - HID: logitech-hidpp: fix race condition when accessing stale stack pointer (stable-fixes). - commit 7468c7a - drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl (stable-fixes). - commit 2b8135d - drm/amdgpu: flush pending RCU callbacks on module unload (stable-fixes). - drm/amdgpu: Use system unbound workqueue for soft IH ring (stable-fixes). - drm/amdkfd: check find_first_zero_bit before __set_bit on kfd->doorbell_bitmap (stable-fixes). - drm/amdkfd: Unwind debug trap enable on copy_to_user failure (stable-fixes). - drm/amd/pm: bound pp_dpm_set_pp_table() memcpy (stable-fixes). - drm/amdgpu: fix buffer overflow during vBIOS update (stable-fixes). - drm/amdkfd: fix UAF race in destroy_queue_cpsch (stable-fixes). - drm/amd/pm/si: Fix updating clock limits from power states (stable-fixes). - drm/panel: simple: Add AM-1280800W8TZQW-T00H (stable-fixes). - drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id (stable-fixes). - drm/amdkfd: Check bounds on allocate_doorbell (stable-fixes). - drm/gud: Add RCade Display Adapter VID/PID pair (stable-fixes). - drm/amd/display: Fix CRC open failure during active rendering (stable-fixes). - drm/bridge: tc358768: Set pre_enable_prev_first for reverse order (stable-fixes). - drm/amd/pm: Check SMUv13.0.6/12 metrics integrity (stable-fixes). - drm/amd/display: Fix DPMS using partially updated pipe context (stable-fixes). - drm/panel: jadard-jd9365da-h3: set prepare_prev_first (stable-fixes). - drm/gem: Consider GEM object reclaimable if shrinking fails (stable-fixes). - drm/cirrus: Use video aperture helpers (stable-fixes). - commit 0b614dc - Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() (git-fixes). - Bluetooth: btusb: fix NXP IW610 composite device handling (stable-fixes). - Bluetooth: btintel: validate version TLV value lengths (git-fixes). - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (stable-fixes). - dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc (stable-fixes). - char/nvram: Remove redundant nvram_mutex (stable-fixes). - bus: fsl-mc: wait for the MC firmware to complete its boot (stable-fixes). - driver core: Make dev_err_probe() silent for -ENOMEM (stable-fixes). - drm/ast: Automatically clean up poll helper (stable-fixes). - driver core: Better advertise dev_err_probe() (stable-fixes). - commit 4e439d6 - Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV (stable-fixes). - Refresh patches.suse/Bluetooth-btusb-Add-ASUS-USB-BT540-for-Realtek-8761C.patch. - commit 6093cdc - Bluetooth: btintel: Export few static functions (stable-fixes). - Refresh patches.suse/Bluetooth-btintel-serialize-btintel_hw_error-with-hc.patch. - commit 89cb14f - ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments (git-fixes). - ASoC: ux500: Program the MSP FIFO watermarks (git-fixes). - ASoC: ux500: Validate MSP DAI configuration (git-fixes). - ASoC: ux500: Correct MSP frame and bit clock setup (git-fixes). - ASoC: ux500: Propagate MSP setup errors (git-fixes). - ASoC: ux500: Fix MSP stream lifecycle handling (git-fixes). - ASoC: rt5645: Perform the initial jack detect at probe (stable-fixes). - ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx (stable-fixes). - ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx (stable-fixes). - ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table (stable-fixes). - ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt (stable-fixes). - ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure (stable-fixes). - ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence (stable-fixes). - Bluetooth: L2CAP: validate connectionless PSM length (stable-fixes). - Bluetooth: btusb: Add support for TP-Link TL-UB250 (stable-fixes). - Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV (stable-fixes). - Bluetooth: btintel: Fix compiler warning for multi_v7_defconfig config (git-fixes). - Bluetooth: btintel: Print firmware SHA1 (stable-fixes). - commit 6051396 - ALSA: hda: trace PCM open only after assigning a stream (git-fixes). - ALSA: 6fire: fix OOB write from device-reported iso length (git-fixes). - ALSA: usb: 6fire: Avoid embedded URBs (stable-fixes). - ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) (stable-fixes). - ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx (stable-fixes). - ASoC: codecs: rk3328: Use managed GPIO and clock helpers (stable-fixes). - ASoC: qcom: q6apm: return error code to consumers on failures (stable-fixes). - ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive (stable-fixes). - ASoC: Intel: catpt: Complete coredump handling (stable-fixes). - ASoC: ti: omap3pandora: update board check to use DT compatible (stable-fixes). - commit 7d64a66 - ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4 (stable-fixes). - ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless (stable-fixes). - ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs (stable-fixes). - ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series (stable-fixes). - ALSA: usb-audio: caiaq: validate EP1 reply lengths (stable-fixes). - ALSA: usb-audio: Add quirk for YAMAHA CDS3000 (stable-fixes). - ALSA: usb-audio: Add quirk flags for SC13A (stable-fixes). - ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 (stable-fixes). - commit 3bde0f3 - ALSA: hda/core: Use guard() for mutex locks (stable-fixes). - Refresh patches.suse/ALSA-hda-restore-MFG-widget-enumeration-after-core-s.patch. - commit 96d2a36 - ALSA: hda/common: Use guard() for mutex locks (stable-fixes). - Refresh patches.suse/ALSA-hda-Report-a-change-when-only-the-channel-statu.patch. - commit 4e1afe9 - ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT (stable-fixes). - ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC (stable-fixes). - ALSA: es18xx: check control allocation before private data setup (stable-fixes). - ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP (stable-fixes). - ALSA: seq: oss: Reject reads that cannot fit the next event (stable-fixes). - ALSA: usb-audio: Add quirk for Novation Mininova (stable-fixes). - ALSA: usx2y: Drain pending US-428 pipe-4 output commands (stable-fixes). - commit cee820a - ALSA: 6fire: Clean ups with guard() (stable-fixes). - Refresh patches.suse/ALSA-6fire-fix-use-after-free-on-disconnect.patch. - commit cc78194 - ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach (stable-fixes). - ACPICA: add boundary checks in two places (stable-fixes). - ACPICA: Add package limit checks in parser functions (stable-fixes). - ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() (stable-fixes). - ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() (stable-fixes). - ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() (stable-fixes). - ACPICA: Add validation for node in acpi_ns_build_normalized_path() (stable-fixes). - ACPICA: validate handler object type in two places (stable-fixes). - ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() (stable-fixes). - ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) (stable-fixes). - ACPICA: Prevent adding invalid references (stable-fixes). - ACPICA: add boundary checks in acpi_ps_get_next_field() (stable-fixes). - ACPICA: validate byte_count in acpi_ps_get_next_package_length() (stable-fixes). - ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() (stable-fixes). - ACPICA: Fix condition check in acpi_ps_parse_loop() (stable-fixes). - ALSA: hda/common: Use cleanup macros for PM controls (stable-fixes). - ALSA: hda: Introduce auto cleanup macros for PM (stable-fixes). - commit a9d1e6a - Drop a couple of hwmon emc1403 patches (git-fixes) Deleted, as they were reverted in the upstream stable trees, too: patches.suse/hwmon-emc1403-Drop-hysteresis-for-low-limit-temperat.patch patches.suse/hwmon-emc1403-Rely-on-subsystem-locking.patch - commit 207a507 - Update config files: Disable CONFIG_BATMAN_ADV (jsc#PED-16892 Disable in remaining configs, too - commit c75b6e5 - vsock/virtio: flush works in dependency order (CVE-2026-80932 bsc#1280143). - commit cf9064d - vhost: reset the vring metadata cache on vring reconfiguration (CVE-2026-74580 bsc#1277885). - commit 512c066 - vhost/net: complete zerocopy ubufs only once (CVE-2026-74310 bsc#1276891). - commit 5ad2b25 ++++ kernel-rt: - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages (bsc#1284146). - commit 96f54af - drm/amdkfd: Remove arbitrary timeout for hmm_range_fault (stable-fixes). - Refresh patches.suse/drm-amdgpu-fix-amdgpu_hmm_range_get_pages.patch. - commit 197e9bf - drm/amdgpu: make an improvement on amdgpu_hmm_range_get_pages (stable-fixes). - Refresh patches.suse/drm-amdgpu-fix-amdgpu_hmm_range_get_pages.patch. - commit ac93acb - drm/amdgpu: increase hmm range get pages timeout (stable-fixes). - commit f949604 - Drop patches.suse/wifi-libertas-reject-short-monitor-TX-frames.patch AI review detected a bad spinlock unbalance (also found in the upstream) - commit 83a880d - Drop a couple of ASUS BT pathes (git-fixes) Deleted, reverted on upstream stable trees: patches.suse/Bluetooth-btusb-Add-ASUS-USB-BT540-for-Realtek-8761C.patch patches.suse/Bluetooth-btusb-Add-ASUS-USB-BT600-for-Realtek-8761C.patch - commit 582726b - Input: synaptics - limit T440p InterTouch quirk to LEN0036 (git-fixes). - drm/amd/pm/si: Fix updating clock limits on AC/DC (git-fixes). - drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC (git-fixes). - commit f8f3824 - wifi: rsi: fix heap OOB write on key removal (git-fixes). - wifi: ath9k_htc: don't store usb_device_id (stable-fixes). - wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() (stable-fixes). - wifi: iwlwifi: acpi: validate WGDS table revision index (stable-fixes). - wifi: iwlwifi: bound aligned TLV advance in FW parser (stable-fixes). - wifi: iwlwifi: mvm: fix a possible underflow (stable-fixes). - wifi: iwlwifi: mvm: add a check on the tid coming from the firmware (stable-fixes). - wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif (stable-fixes). - wifi: iwlwifi: mvm: fix sched scan IE sizing (stable-fixes). - wifi: iwlwifi: mvm: validate sta_id in BA window status notif (stable-fixes). - wifi: iwlwifi: mvm: fix an off-by-1 boundary check (stable-fixes). - wifi: mwifiex: replace one-element arrays with flexible array members (stable-fixes). - wifi: cfg80211: validate rx/tx MLME callback frame lengths before access (stable-fixes). - wifi: mac80211: validate deauth frame length before reason access (stable-fixes). - wifi: rsi: validate beacon length before fixed buffer copy (stable-fixes). - wifi: libipw: fix key index receive bound checks (stable-fixes). - wifi: libertas: reject short monitor TX frames (stable-fixes). - wifi: ralink: RT2X00: init EEPROM properly (stable-fixes). - wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers (stable-fixes). - xhci: Prevent queuing new commands if xhci is inaccessible (stable-fixes). - wifi: mt76: transform aspm_conf for pci_disable_link_state (stable-fixes). - wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi (stable-fixes). - wifi: rtw89: pci: enable LTR based on pcie control register (stable-fixes). - wifi: rtw89: phy: check length before parsing PHY status IE (stable-fixes). - wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result() (stable-fixes). - wifi: mac80211: always allow transmitting null-data on TXQs (stable-fixes). - wifi: nl80211: reject beacons with bad HE operation (stable-fixes). - wifi: rtw88: TX QOS Null data the same way as Null data (stable-fixes). - wifi: rtw88: Fix the random "error beacon valid" messages for USB (stable-fixes). - commit e67ef0d - USB: gadget: dummy-hcd: Fix wait for outstanding request completions (git-fixes). - usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe (git-fixes). - usb: typec: ucsi: Get the connector fwnode based on reg value (git-fixes). - usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd (git-fixes). - usb: core: clear both ep_in and ep_out for non-ep0 control endpoints (git-fixes). - USB: cdc-acm: skip URB restart in port_shutdown if disconnected (git-fixes). - usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC (git-fixes). - usb: gadget: aspeed-vhub: cancel wake work on device removal (git-fixes). - USB: serial: quatech2: fix baud rate overflow (git-fixes). - USB: serial: ssu100: fix baud rate overflow (git-fixes). - usb: typec: ucsi: displayport: Current CAM OOB index fixup (git-fixes). - usb: ohci-st: disable controller wakeup on removal (git-fixes). - usb: ohci-s3c2410: disable controller wakeup on removal (git-fixes). - usb: ohci-da8xx: disable controller wakeup on cleanup (git-fixes). - usb: cdns3: fix use-after-free in cdns3_gadget_exit() (git-fixes). - usb: chipidea: tegra: disable runtime PM on resume failure (git-fixes). - usb: typec: anx7411 - stop the IRQ before destroying the workqueue (git-fixes). - USB: serial: fix driver deregistration order (git-fixes). - USB: serial: fix dynamic id driver deregistration race (git-fixes). - usbip: vhci_hcd: fix NULL deref in status_show_vhci (stable-fixes). - commit 9a4fea3 - tty: serial: qcom_geni_serial: Keep console RX functional after deep idle (git-fixes). - tty: vt: fix memory leak in vc_allocate() (git-fixes). - thunderbolt: Reject oversized XDomain properties responses (git-fixes). - USB: serial: fix port tear down use-after-free (git-fixes). - USB: cdc-acm: fix racy TIOCMIWAIT implementation (git-fixes). - usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() (git-fixes). - usb: storage: sierra_ms: reject short SWoC info transfers (git-fixes). - usb: typec: tcpm: recover after failure to start the frs ams (git-fixes). - usb: dwc3: am62: Fix runtime PM usage count leak on probe error path (git-fixes). - usb: octeon-hcd: fix the FIFO-flush timeout computation (git-fixes). - usb: hub: use shorter 120ms post resume hold for SS root hubs (git-fixes). - usb: typec: ucsi: glink: fix use-after-free of ucsi on remove (git-fixes). - thunderbolt: Fix KASAN reported use-after-free when request is canceled (git-fixes). - usb: xusbatm: don't rely on id table pointer arithmetic (stable-fixes). - usb: serial: spcp8x5: don't store usb_device_id (stable-fixes). - usb: usbtmc: don't store usb_device_id (stable-fixes). - thunderbolt: Increase timeout for Configuration Ready bit (stable-fixes). - thunderbolt: Verify Router Ready bit is set after router enumeration (stable-fixes). - thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host() (stable-fixes). - thunderbolt: Improve multi-display DisplayPort tunnel allocation (stable-fixes). - usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue (stable-fixes). - usb: host: add ARCH_AIROHA in XHCI MTK dependency (stable-fixes). - USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set (stable-fixes). - usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log (stable-fixes). - usb: core: hcd: fix possible deadlock in rh control transfers (stable-fixes). - usb: gadget: udc: skip pullup() if already connected (stable-fixes). - usb: xhci: use cached HCSPARAMS1 value (stable-fixes). - commit 8c080f1 - serial: tegra: don't clear the Tx FIFO on an Rx-only reset (git-fixes). - soc: qcom: geni-se: Correct QUP Core ICC vote constants (git-fixes). - serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() (git-fixes). - serial: vt8500: Fix clock reference leak in vt8500_serial_probe() (git-fixes). - spi: dw: fix wrong RX_SAMPLE_DLY setting after resume (stable-fixes). - spi: dw-dma: Wait for controller idle before completing Tx (stable-fixes). - spi: core: Abort active target transfer on controller suspend (stable-fixes). - rtc: bq32000: add delay between RTC reads (stable-fixes). - rtc: aspeed: add AST2700 compatible (stable-fixes). - spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data() (stable-fixes). - PCI: rockchip: Protect root bus removal with rescan lock (stable-fixes). - PCI: mediatek: Protect root bus removal with rescan lock (stable-fixes). - PCI: iproc: Protect root bus removal with rescan lock (stable-fixes). - PCI: altera: Protect root bus removal with rescan lock (stable-fixes). - PCI: switchtec: Add Gen6 Device IDs (stable-fixes). - soundwire: dmi-quirks: Disable ghost Realtek devices (stable-fixes). - soundwire: only handle alert events when the peripheral is attached (stable-fixes). - soundwire: validate DT compatible before parsing it (stable-fixes). - platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table (stable-fixes). - platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table (stable-fixes). - thunderbolt: Keep XDomain reference during the lifetime of a service (stable-fixes). - thunderbolt: Set tb->root_switch to NULL when domain is stopped (stable-fixes). - thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() (stable-fixes). - thunderbolt: Keep the domain reference while processing hotplug (stable-fixes). - serial: 8250: fix possible ISR soft lockup (stable-fixes). - spi: xilinx: let transfers timeout in case of no IRQ (stable-fixes). - spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM (stable-fixes). - thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries (stable-fixes). - thermal/drivers/tegra/soctherma: Switch to devm cooling device registration (stable-fixes). - commit e3fae4b - net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist (stable-fixes). - mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 (stable-fixes). - net: usb: pegasus: don't rely on id table pointer arithmetic (stable-fixes). - PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems (stable-fixes). - PCI: Wait for device readiness after D3hot -> D0uninitialized transition (stable-fixes). - PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device() (stable-fixes). - PCI: Stop setting cached power state to 'unknown' on unbind (stable-fixes). - net: wwan: t7xx: Add delay between MD and SAP suspend (stable-fixes). - net: usb: qmi_wwan: add MeiG SRM813Q (stable-fixes). - mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC (stable-fixes). - commit ee279e5 - Input: s6sy761 - fix resume ordering and restore sensing (git-fixes). - Input: xpad - add support for Victrix Pro BFG Controller (stable-fixes). - Input: xpad - add support for Azeron devices (stable-fixes). - Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P (stable-fixes). - Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) (stable-fixes). - integrity: Check for NULL returned by asymmetric_key_public_key (stable-fixes). - media: imon: Add iMON VFD HID OEM v1.2 key mappings (stable-fixes). - media: video-i2c: fix buffer queue ordering (stable-fixes). - media: video-i2c: use vb2_video_unregister_device on driver removal (stable-fixes). - media: em28xx-video: fix missing res_free() on init_usb_xfer failure (stable-fixes). - media: dm1105: fix missing error check for dma_alloc_coherent (stable-fixes). - media: rc: mceusb: Add support for 04eb:e033 (stable-fixes). - leds: uleds: Return -EFAULT on copy_to_user() failure (stable-fixes). - leds: pca9532: Don't stop blinking for non-zero brightness (stable-fixes). - mfd: rsmu: Add 8a34002 support (stable-fixes). - mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC (stable-fixes). - mmc: davinci: fix mmc_add_host order in probe (stable-fixes). - mmc: davinci: avoid NULL deref of host->data in IRQ handler (stable-fixes). - mmc: core: Add validation for host-provided max_segs (stable-fixes). - mfd: db8500-prcmu: Remove needless return in three void APIs (stable-fixes). - commit 9353f15 - iio: accel: kxcjk-1013: reject duplicate event disable (git-fixes). - iio: buffer: serialize buffer teardown with mode claims (git-fixes). - iio: adc: stm32-adc: fix check on internal channel availability (git-fixes). - iio: proximity: isl29501: Fix return type of isl29501_register_write (git-fixes). - iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler (git-fixes). - iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure (git-fixes). - iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls (git-fixes). - iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure (git-fixes). - iio: trigger: cancel reenable_work before freeing trigger (git-fixes). - iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw() (git-fixes). - iio: accel: sca3000: fix frequency divider condition check (git-fixes). - iio: gyro: adis16136: fix unprotected debugfs reads (git-fixes). - iio: imu: adis16400: fix unprotected debugfs reads (git-fixes). - iio: imu: adis16480: fix unprotected debugfs reads (git-fixes). - iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind (git-fixes). - iio: buffer: Ensure bounce buffer used for unaligned case is zeroed (git-fixes). - iio: proximity: sx9324: Correct proximity channel resolution (git-fixes). - iio: accel: kionix-kx022a: Fix array boundary check (git-fixes). - iio: adc: max1363: sign-extend bipolar differential channel reads (git-fixes). - iio: light: gp2ap020a00f: drain irq_work after free_irq (git-fixes). - iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup (git-fixes). - iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind (stable-fixes). - iio: accel: mma8452: switch to non-devm request_threaded_irq() (stable-fixes). - iio: light: stk3310: Deal with the ps interrupt issue in PM (stable-fixes). - i3c: mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA (stable-fixes). - host1x: bus: Fix missing ops null check in error teardown (stable-fixes). - hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i (stable-fixes). - hwmon: (adt7462) Add of_match_table to support devicetree (stable-fixes). - commit d7cb25f - drm/radeon: Read the VRAM VBIOS signature with readb() (git-fixes). - drm/amdgpu: fix ACP MFD device leak on init failure (git-fixes). - drm/amdgpu: fix IP instance memory leak on kobject add failure (git-fixes). - drm/mediatek: Fix ovl adaptor platform device leak (git-fixes). - drm/mediatek: Fix pdev reference leak in mtk_drm_bind() (git-fixes). - drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device (git-fixes). - HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard (stable-fixes). - drm/vc4: Use managed KMS polling to fix UAF on unbind (git-fixes). - firmware: stratix10-svc: fix FCS SMC call kernel-doc (git-fixes). - drm/gma500: return errors from Oaktrail HDMI I2C reads (stable-fixes). - drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized (stable-fixes). - gpio: dwapb: Mask interrupts at hardware initialization (stable-fixes). - drm/arm/komeda: fix error handling for clk_prepare_enable() and callers (stable-fixes). - drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend (stable-fixes). - fbdev: pm2fb: unwind WC setup on probe failure (stable-fixes). - gpio: pisosr: Read "ngpios" as u32 (stable-fixes). - firmware: stratix10-svc: change get provision data to async SMC call (stable-fixes). - firmware: arm_scmi: Validate SENSOR_UPDATE payload size (stable-fixes). - firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size (stable-fixes). - HID: logitech-hidpp: fix race condition when accessing stale stack pointer (stable-fixes). - commit 7468c7a - drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl (stable-fixes). - commit 2b8135d - drm/amdgpu: flush pending RCU callbacks on module unload (stable-fixes). - drm/amdgpu: Use system unbound workqueue for soft IH ring (stable-fixes). - drm/amdkfd: check find_first_zero_bit before __set_bit on kfd->doorbell_bitmap (stable-fixes). - drm/amdkfd: Unwind debug trap enable on copy_to_user failure (stable-fixes). - drm/amd/pm: bound pp_dpm_set_pp_table() memcpy (stable-fixes). - drm/amdgpu: fix buffer overflow during vBIOS update (stable-fixes). - drm/amdkfd: fix UAF race in destroy_queue_cpsch (stable-fixes). - drm/amd/pm/si: Fix updating clock limits from power states (stable-fixes). - drm/panel: simple: Add AM-1280800W8TZQW-T00H (stable-fixes). - drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id (stable-fixes). - drm/amdkfd: Check bounds on allocate_doorbell (stable-fixes). - drm/gud: Add RCade Display Adapter VID/PID pair (stable-fixes). - drm/amd/display: Fix CRC open failure during active rendering (stable-fixes). - drm/bridge: tc358768: Set pre_enable_prev_first for reverse order (stable-fixes). - drm/amd/pm: Check SMUv13.0.6/12 metrics integrity (stable-fixes). - drm/amd/display: Fix DPMS using partially updated pipe context (stable-fixes). - drm/panel: jadard-jd9365da-h3: set prepare_prev_first (stable-fixes). - drm/gem: Consider GEM object reclaimable if shrinking fails (stable-fixes). - drm/cirrus: Use video aperture helpers (stable-fixes). - commit 0b614dc - Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() (git-fixes). - Bluetooth: btusb: fix NXP IW610 composite device handling (stable-fixes). - Bluetooth: btintel: validate version TLV value lengths (git-fixes). - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (stable-fixes). - dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc (stable-fixes). - char/nvram: Remove redundant nvram_mutex (stable-fixes). - bus: fsl-mc: wait for the MC firmware to complete its boot (stable-fixes). - driver core: Make dev_err_probe() silent for -ENOMEM (stable-fixes). - drm/ast: Automatically clean up poll helper (stable-fixes). - driver core: Better advertise dev_err_probe() (stable-fixes). - commit 4e439d6 - Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV (stable-fixes). - Refresh patches.suse/Bluetooth-btusb-Add-ASUS-USB-BT540-for-Realtek-8761C.patch. - commit 6093cdc - Bluetooth: btintel: Export few static functions (stable-fixes). - Refresh patches.suse/Bluetooth-btintel-serialize-btintel_hw_error-with-hc.patch. - commit 89cb14f - ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments (git-fixes). - ASoC: ux500: Program the MSP FIFO watermarks (git-fixes). - ASoC: ux500: Validate MSP DAI configuration (git-fixes). - ASoC: ux500: Correct MSP frame and bit clock setup (git-fixes). - ASoC: ux500: Propagate MSP setup errors (git-fixes). - ASoC: ux500: Fix MSP stream lifecycle handling (git-fixes). - ASoC: rt5645: Perform the initial jack detect at probe (stable-fixes). - ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx (stable-fixes). - ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx (stable-fixes). - ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table (stable-fixes). - ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt (stable-fixes). - ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure (stable-fixes). - ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence (stable-fixes). - Bluetooth: L2CAP: validate connectionless PSM length (stable-fixes). - Bluetooth: btusb: Add support for TP-Link TL-UB250 (stable-fixes). - Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV (stable-fixes). - Bluetooth: btintel: Fix compiler warning for multi_v7_defconfig config (git-fixes). - Bluetooth: btintel: Print firmware SHA1 (stable-fixes). - commit 6051396 - ALSA: hda: trace PCM open only after assigning a stream (git-fixes). - ALSA: 6fire: fix OOB write from device-reported iso length (git-fixes). - ALSA: usb: 6fire: Avoid embedded URBs (stable-fixes). - ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) (stable-fixes). - ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx (stable-fixes). - ASoC: codecs: rk3328: Use managed GPIO and clock helpers (stable-fixes). - ASoC: qcom: q6apm: return error code to consumers on failures (stable-fixes). - ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive (stable-fixes). - ASoC: Intel: catpt: Complete coredump handling (stable-fixes). - ASoC: ti: omap3pandora: update board check to use DT compatible (stable-fixes). - commit 7d64a66 - ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4 (stable-fixes). - ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless (stable-fixes). - ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs (stable-fixes). - ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series (stable-fixes). - ALSA: usb-audio: caiaq: validate EP1 reply lengths (stable-fixes). - ALSA: usb-audio: Add quirk for YAMAHA CDS3000 (stable-fixes). - ALSA: usb-audio: Add quirk flags for SC13A (stable-fixes). - ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 (stable-fixes). - commit 3bde0f3 - ALSA: hda/core: Use guard() for mutex locks (stable-fixes). - Refresh patches.suse/ALSA-hda-restore-MFG-widget-enumeration-after-core-s.patch. - commit 96d2a36 - ALSA: hda/common: Use guard() for mutex locks (stable-fixes). - Refresh patches.suse/ALSA-hda-Report-a-change-when-only-the-channel-statu.patch. - commit 4e1afe9 - ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT (stable-fixes). - ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC (stable-fixes). - ALSA: es18xx: check control allocation before private data setup (stable-fixes). - ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP (stable-fixes). - ALSA: seq: oss: Reject reads that cannot fit the next event (stable-fixes). - ALSA: usb-audio: Add quirk for Novation Mininova (stable-fixes). - ALSA: usx2y: Drain pending US-428 pipe-4 output commands (stable-fixes). - commit cee820a - ALSA: 6fire: Clean ups with guard() (stable-fixes). - Refresh patches.suse/ALSA-6fire-fix-use-after-free-on-disconnect.patch. - commit cc78194 - ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach (stable-fixes). - ACPICA: add boundary checks in two places (stable-fixes). - ACPICA: Add package limit checks in parser functions (stable-fixes). - ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() (stable-fixes). - ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() (stable-fixes). - ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() (stable-fixes). - ACPICA: Add validation for node in acpi_ns_build_normalized_path() (stable-fixes). - ACPICA: validate handler object type in two places (stable-fixes). - ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() (stable-fixes). - ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) (stable-fixes). - ACPICA: Prevent adding invalid references (stable-fixes). - ACPICA: add boundary checks in acpi_ps_get_next_field() (stable-fixes). - ACPICA: validate byte_count in acpi_ps_get_next_package_length() (stable-fixes). - ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() (stable-fixes). - ACPICA: Fix condition check in acpi_ps_parse_loop() (stable-fixes). - ALSA: hda/common: Use cleanup macros for PM controls (stable-fixes). - ALSA: hda: Introduce auto cleanup macros for PM (stable-fixes). - commit a9d1e6a - Drop a couple of hwmon emc1403 patches (git-fixes) Deleted, as they were reverted in the upstream stable trees, too: patches.suse/hwmon-emc1403-Drop-hysteresis-for-low-limit-temperat.patch patches.suse/hwmon-emc1403-Rely-on-subsystem-locking.patch - commit 207a507 - Update config files: Disable CONFIG_BATMAN_ADV (jsc#PED-16892 Disable in remaining configs, too - commit c75b6e5 - vsock/virtio: flush works in dependency order (CVE-2026-80932 bsc#1280143). - commit cf9064d - vhost: reset the vring metadata cache on vring reconfiguration (CVE-2026-74580 bsc#1277885). - commit 512c066 - vhost/net: complete zerocopy ubufs only once (CVE-2026-74310 bsc#1276891). - commit 5ad2b25 ++++ kernel-rt_debug: - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages (bsc#1284146). - commit 96f54af - drm/amdkfd: Remove arbitrary timeout for hmm_range_fault (stable-fixes). - Refresh patches.suse/drm-amdgpu-fix-amdgpu_hmm_range_get_pages.patch. - commit 197e9bf - drm/amdgpu: make an improvement on amdgpu_hmm_range_get_pages (stable-fixes). - Refresh patches.suse/drm-amdgpu-fix-amdgpu_hmm_range_get_pages.patch. - commit ac93acb - drm/amdgpu: increase hmm range get pages timeout (stable-fixes). - commit f949604 - Drop patches.suse/wifi-libertas-reject-short-monitor-TX-frames.patch AI review detected a bad spinlock unbalance (also found in the upstream) - commit 83a880d - Drop a couple of ASUS BT pathes (git-fixes) Deleted, reverted on upstream stable trees: patches.suse/Bluetooth-btusb-Add-ASUS-USB-BT540-for-Realtek-8761C.patch patches.suse/Bluetooth-btusb-Add-ASUS-USB-BT600-for-Realtek-8761C.patch - commit 582726b - Input: synaptics - limit T440p InterTouch quirk to LEN0036 (git-fixes). - drm/amd/pm/si: Fix updating clock limits on AC/DC (git-fixes). - drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC (git-fixes). - commit f8f3824 - wifi: rsi: fix heap OOB write on key removal (git-fixes). - wifi: ath9k_htc: don't store usb_device_id (stable-fixes). - wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() (stable-fixes). - wifi: iwlwifi: acpi: validate WGDS table revision index (stable-fixes). - wifi: iwlwifi: bound aligned TLV advance in FW parser (stable-fixes). - wifi: iwlwifi: mvm: fix a possible underflow (stable-fixes). - wifi: iwlwifi: mvm: add a check on the tid coming from the firmware (stable-fixes). - wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif (stable-fixes). - wifi: iwlwifi: mvm: fix sched scan IE sizing (stable-fixes). - wifi: iwlwifi: mvm: validate sta_id in BA window status notif (stable-fixes). - wifi: iwlwifi: mvm: fix an off-by-1 boundary check (stable-fixes). - wifi: mwifiex: replace one-element arrays with flexible array members (stable-fixes). - wifi: cfg80211: validate rx/tx MLME callback frame lengths before access (stable-fixes). - wifi: mac80211: validate deauth frame length before reason access (stable-fixes). - wifi: rsi: validate beacon length before fixed buffer copy (stable-fixes). - wifi: libipw: fix key index receive bound checks (stable-fixes). - wifi: libertas: reject short monitor TX frames (stable-fixes). - wifi: ralink: RT2X00: init EEPROM properly (stable-fixes). - wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers (stable-fixes). - xhci: Prevent queuing new commands if xhci is inaccessible (stable-fixes). - wifi: mt76: transform aspm_conf for pci_disable_link_state (stable-fixes). - wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi (stable-fixes). - wifi: rtw89: pci: enable LTR based on pcie control register (stable-fixes). - wifi: rtw89: phy: check length before parsing PHY status IE (stable-fixes). - wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result() (stable-fixes). - wifi: mac80211: always allow transmitting null-data on TXQs (stable-fixes). - wifi: nl80211: reject beacons with bad HE operation (stable-fixes). - wifi: rtw88: TX QOS Null data the same way as Null data (stable-fixes). - wifi: rtw88: Fix the random "error beacon valid" messages for USB (stable-fixes). - commit e67ef0d - USB: gadget: dummy-hcd: Fix wait for outstanding request completions (git-fixes). - usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe (git-fixes). - usb: typec: ucsi: Get the connector fwnode based on reg value (git-fixes). - usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd (git-fixes). - usb: core: clear both ep_in and ep_out for non-ep0 control endpoints (git-fixes). - USB: cdc-acm: skip URB restart in port_shutdown if disconnected (git-fixes). - usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC (git-fixes). - usb: gadget: aspeed-vhub: cancel wake work on device removal (git-fixes). - USB: serial: quatech2: fix baud rate overflow (git-fixes). - USB: serial: ssu100: fix baud rate overflow (git-fixes). - usb: typec: ucsi: displayport: Current CAM OOB index fixup (git-fixes). - usb: ohci-st: disable controller wakeup on removal (git-fixes). - usb: ohci-s3c2410: disable controller wakeup on removal (git-fixes). - usb: ohci-da8xx: disable controller wakeup on cleanup (git-fixes). - usb: cdns3: fix use-after-free in cdns3_gadget_exit() (git-fixes). - usb: chipidea: tegra: disable runtime PM on resume failure (git-fixes). - usb: typec: anx7411 - stop the IRQ before destroying the workqueue (git-fixes). - USB: serial: fix driver deregistration order (git-fixes). - USB: serial: fix dynamic id driver deregistration race (git-fixes). - usbip: vhci_hcd: fix NULL deref in status_show_vhci (stable-fixes). - commit 9a4fea3 - tty: serial: qcom_geni_serial: Keep console RX functional after deep idle (git-fixes). - tty: vt: fix memory leak in vc_allocate() (git-fixes). - thunderbolt: Reject oversized XDomain properties responses (git-fixes). - USB: serial: fix port tear down use-after-free (git-fixes). - USB: cdc-acm: fix racy TIOCMIWAIT implementation (git-fixes). - usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() (git-fixes). - usb: storage: sierra_ms: reject short SWoC info transfers (git-fixes). - usb: typec: tcpm: recover after failure to start the frs ams (git-fixes). - usb: dwc3: am62: Fix runtime PM usage count leak on probe error path (git-fixes). - usb: octeon-hcd: fix the FIFO-flush timeout computation (git-fixes). - usb: hub: use shorter 120ms post resume hold for SS root hubs (git-fixes). - usb: typec: ucsi: glink: fix use-after-free of ucsi on remove (git-fixes). - thunderbolt: Fix KASAN reported use-after-free when request is canceled (git-fixes). - usb: xusbatm: don't rely on id table pointer arithmetic (stable-fixes). - usb: serial: spcp8x5: don't store usb_device_id (stable-fixes). - usb: usbtmc: don't store usb_device_id (stable-fixes). - thunderbolt: Increase timeout for Configuration Ready bit (stable-fixes). - thunderbolt: Verify Router Ready bit is set after router enumeration (stable-fixes). - thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host() (stable-fixes). - thunderbolt: Improve multi-display DisplayPort tunnel allocation (stable-fixes). - usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue (stable-fixes). - usb: host: add ARCH_AIROHA in XHCI MTK dependency (stable-fixes). - USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set (stable-fixes). - usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log (stable-fixes). - usb: core: hcd: fix possible deadlock in rh control transfers (stable-fixes). - usb: gadget: udc: skip pullup() if already connected (stable-fixes). - usb: xhci: use cached HCSPARAMS1 value (stable-fixes). - commit 8c080f1 - serial: tegra: don't clear the Tx FIFO on an Rx-only reset (git-fixes). - soc: qcom: geni-se: Correct QUP Core ICC vote constants (git-fixes). - serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() (git-fixes). - serial: vt8500: Fix clock reference leak in vt8500_serial_probe() (git-fixes). - spi: dw: fix wrong RX_SAMPLE_DLY setting after resume (stable-fixes). - spi: dw-dma: Wait for controller idle before completing Tx (stable-fixes). - spi: core: Abort active target transfer on controller suspend (stable-fixes). - rtc: bq32000: add delay between RTC reads (stable-fixes). - rtc: aspeed: add AST2700 compatible (stable-fixes). - spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data() (stable-fixes). - PCI: rockchip: Protect root bus removal with rescan lock (stable-fixes). - PCI: mediatek: Protect root bus removal with rescan lock (stable-fixes). - PCI: iproc: Protect root bus removal with rescan lock (stable-fixes). - PCI: altera: Protect root bus removal with rescan lock (stable-fixes). - PCI: switchtec: Add Gen6 Device IDs (stable-fixes). - soundwire: dmi-quirks: Disable ghost Realtek devices (stable-fixes). - soundwire: only handle alert events when the peripheral is attached (stable-fixes). - soundwire: validate DT compatible before parsing it (stable-fixes). - platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table (stable-fixes). - platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table (stable-fixes). - thunderbolt: Keep XDomain reference during the lifetime of a service (stable-fixes). - thunderbolt: Set tb->root_switch to NULL when domain is stopped (stable-fixes). - thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() (stable-fixes). - thunderbolt: Keep the domain reference while processing hotplug (stable-fixes). - serial: 8250: fix possible ISR soft lockup (stable-fixes). - spi: xilinx: let transfers timeout in case of no IRQ (stable-fixes). - spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM (stable-fixes). - thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries (stable-fixes). - thermal/drivers/tegra/soctherma: Switch to devm cooling device registration (stable-fixes). - commit e3fae4b - net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist (stable-fixes). - mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 (stable-fixes). - net: usb: pegasus: don't rely on id table pointer arithmetic (stable-fixes). - PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems (stable-fixes). - PCI: Wait for device readiness after D3hot -> D0uninitialized transition (stable-fixes). - PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device() (stable-fixes). - PCI: Stop setting cached power state to 'unknown' on unbind (stable-fixes). - net: wwan: t7xx: Add delay between MD and SAP suspend (stable-fixes). - net: usb: qmi_wwan: add MeiG SRM813Q (stable-fixes). - mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC (stable-fixes). - commit ee279e5 - Input: s6sy761 - fix resume ordering and restore sensing (git-fixes). - Input: xpad - add support for Victrix Pro BFG Controller (stable-fixes). - Input: xpad - add support for Azeron devices (stable-fixes). - Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P (stable-fixes). - Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) (stable-fixes). - integrity: Check for NULL returned by asymmetric_key_public_key (stable-fixes). - media: imon: Add iMON VFD HID OEM v1.2 key mappings (stable-fixes). - media: video-i2c: fix buffer queue ordering (stable-fixes). - media: video-i2c: use vb2_video_unregister_device on driver removal (stable-fixes). - media: em28xx-video: fix missing res_free() on init_usb_xfer failure (stable-fixes). - media: dm1105: fix missing error check for dma_alloc_coherent (stable-fixes). - media: rc: mceusb: Add support for 04eb:e033 (stable-fixes). - leds: uleds: Return -EFAULT on copy_to_user() failure (stable-fixes). - leds: pca9532: Don't stop blinking for non-zero brightness (stable-fixes). - mfd: rsmu: Add 8a34002 support (stable-fixes). - mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC (stable-fixes). - mmc: davinci: fix mmc_add_host order in probe (stable-fixes). - mmc: davinci: avoid NULL deref of host->data in IRQ handler (stable-fixes). - mmc: core: Add validation for host-provided max_segs (stable-fixes). - mfd: db8500-prcmu: Remove needless return in three void APIs (stable-fixes). - commit 9353f15 - iio: accel: kxcjk-1013: reject duplicate event disable (git-fixes). - iio: buffer: serialize buffer teardown with mode claims (git-fixes). - iio: adc: stm32-adc: fix check on internal channel availability (git-fixes). - iio: proximity: isl29501: Fix return type of isl29501_register_write (git-fixes). - iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler (git-fixes). - iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure (git-fixes). - iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls (git-fixes). - iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure (git-fixes). - iio: trigger: cancel reenable_work before freeing trigger (git-fixes). - iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw() (git-fixes). - iio: accel: sca3000: fix frequency divider condition check (git-fixes). - iio: gyro: adis16136: fix unprotected debugfs reads (git-fixes). - iio: imu: adis16400: fix unprotected debugfs reads (git-fixes). - iio: imu: adis16480: fix unprotected debugfs reads (git-fixes). - iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind (git-fixes). - iio: buffer: Ensure bounce buffer used for unaligned case is zeroed (git-fixes). - iio: proximity: sx9324: Correct proximity channel resolution (git-fixes). - iio: accel: kionix-kx022a: Fix array boundary check (git-fixes). - iio: adc: max1363: sign-extend bipolar differential channel reads (git-fixes). - iio: light: gp2ap020a00f: drain irq_work after free_irq (git-fixes). - iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup (git-fixes). - iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind (stable-fixes). - iio: accel: mma8452: switch to non-devm request_threaded_irq() (stable-fixes). - iio: light: stk3310: Deal with the ps interrupt issue in PM (stable-fixes). - i3c: mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA (stable-fixes). - host1x: bus: Fix missing ops null check in error teardown (stable-fixes). - hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i (stable-fixes). - hwmon: (adt7462) Add of_match_table to support devicetree (stable-fixes). - commit d7cb25f - drm/radeon: Read the VRAM VBIOS signature with readb() (git-fixes). - drm/amdgpu: fix ACP MFD device leak on init failure (git-fixes). - drm/amdgpu: fix IP instance memory leak on kobject add failure (git-fixes). - drm/mediatek: Fix ovl adaptor platform device leak (git-fixes). - drm/mediatek: Fix pdev reference leak in mtk_drm_bind() (git-fixes). - drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device (git-fixes). - HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard (stable-fixes). - drm/vc4: Use managed KMS polling to fix UAF on unbind (git-fixes). - firmware: stratix10-svc: fix FCS SMC call kernel-doc (git-fixes). - drm/gma500: return errors from Oaktrail HDMI I2C reads (stable-fixes). - drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized (stable-fixes). - gpio: dwapb: Mask interrupts at hardware initialization (stable-fixes). - drm/arm/komeda: fix error handling for clk_prepare_enable() and callers (stable-fixes). - drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend (stable-fixes). - fbdev: pm2fb: unwind WC setup on probe failure (stable-fixes). - gpio: pisosr: Read "ngpios" as u32 (stable-fixes). - firmware: stratix10-svc: change get provision data to async SMC call (stable-fixes). - firmware: arm_scmi: Validate SENSOR_UPDATE payload size (stable-fixes). - firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size (stable-fixes). - HID: logitech-hidpp: fix race condition when accessing stale stack pointer (stable-fixes). - commit 7468c7a - drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl (stable-fixes). - commit 2b8135d - drm/amdgpu: flush pending RCU callbacks on module unload (stable-fixes). - drm/amdgpu: Use system unbound workqueue for soft IH ring (stable-fixes). - drm/amdkfd: check find_first_zero_bit before __set_bit on kfd->doorbell_bitmap (stable-fixes). - drm/amdkfd: Unwind debug trap enable on copy_to_user failure (stable-fixes). - drm/amd/pm: bound pp_dpm_set_pp_table() memcpy (stable-fixes). - drm/amdgpu: fix buffer overflow during vBIOS update (stable-fixes). - drm/amdkfd: fix UAF race in destroy_queue_cpsch (stable-fixes). - drm/amd/pm/si: Fix updating clock limits from power states (stable-fixes). - drm/panel: simple: Add AM-1280800W8TZQW-T00H (stable-fixes). - drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id (stable-fixes). - drm/amdkfd: Check bounds on allocate_doorbell (stable-fixes). - drm/gud: Add RCade Display Adapter VID/PID pair (stable-fixes). - drm/amd/display: Fix CRC open failure during active rendering (stable-fixes). - drm/bridge: tc358768: Set pre_enable_prev_first for reverse order (stable-fixes). - drm/amd/pm: Check SMUv13.0.6/12 metrics integrity (stable-fixes). - drm/amd/display: Fix DPMS using partially updated pipe context (stable-fixes). - drm/panel: jadard-jd9365da-h3: set prepare_prev_first (stable-fixes). - drm/gem: Consider GEM object reclaimable if shrinking fails (stable-fixes). - drm/cirrus: Use video aperture helpers (stable-fixes). - commit 0b614dc - Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() (git-fixes). - Bluetooth: btusb: fix NXP IW610 composite device handling (stable-fixes). - Bluetooth: btintel: validate version TLV value lengths (git-fixes). - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (stable-fixes). - dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc (stable-fixes). - char/nvram: Remove redundant nvram_mutex (stable-fixes). - bus: fsl-mc: wait for the MC firmware to complete its boot (stable-fixes). - driver core: Make dev_err_probe() silent for -ENOMEM (stable-fixes). - drm/ast: Automatically clean up poll helper (stable-fixes). - driver core: Better advertise dev_err_probe() (stable-fixes). - commit 4e439d6 - Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV (stable-fixes). - Refresh patches.suse/Bluetooth-btusb-Add-ASUS-USB-BT540-for-Realtek-8761C.patch. - commit 6093cdc - Bluetooth: btintel: Export few static functions (stable-fixes). - Refresh patches.suse/Bluetooth-btintel-serialize-btintel_hw_error-with-hc.patch. - commit 89cb14f - ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments (git-fixes). - ASoC: ux500: Program the MSP FIFO watermarks (git-fixes). - ASoC: ux500: Validate MSP DAI configuration (git-fixes). - ASoC: ux500: Correct MSP frame and bit clock setup (git-fixes). - ASoC: ux500: Propagate MSP setup errors (git-fixes). - ASoC: ux500: Fix MSP stream lifecycle handling (git-fixes). - ASoC: rt5645: Perform the initial jack detect at probe (stable-fixes). - ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx (stable-fixes). - ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx (stable-fixes). - ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table (stable-fixes). - ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt (stable-fixes). - ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure (stable-fixes). - ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence (stable-fixes). - Bluetooth: L2CAP: validate connectionless PSM length (stable-fixes). - Bluetooth: btusb: Add support for TP-Link TL-UB250 (stable-fixes). - Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV (stable-fixes). - Bluetooth: btintel: Fix compiler warning for multi_v7_defconfig config (git-fixes). - Bluetooth: btintel: Print firmware SHA1 (stable-fixes). - commit 6051396 - ALSA: hda: trace PCM open only after assigning a stream (git-fixes). - ALSA: 6fire: fix OOB write from device-reported iso length (git-fixes). - ALSA: usb: 6fire: Avoid embedded URBs (stable-fixes). - ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) (stable-fixes). - ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx (stable-fixes). - ASoC: codecs: rk3328: Use managed GPIO and clock helpers (stable-fixes). - ASoC: qcom: q6apm: return error code to consumers on failures (stable-fixes). - ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive (stable-fixes). - ASoC: Intel: catpt: Complete coredump handling (stable-fixes). - ASoC: ti: omap3pandora: update board check to use DT compatible (stable-fixes). - commit 7d64a66 - ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4 (stable-fixes). - ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless (stable-fixes). - ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs (stable-fixes). - ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series (stable-fixes). - ALSA: usb-audio: caiaq: validate EP1 reply lengths (stable-fixes). - ALSA: usb-audio: Add quirk for YAMAHA CDS3000 (stable-fixes). - ALSA: usb-audio: Add quirk flags for SC13A (stable-fixes). - ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 (stable-fixes). - commit 3bde0f3 - ALSA: hda/core: Use guard() for mutex locks (stable-fixes). - Refresh patches.suse/ALSA-hda-restore-MFG-widget-enumeration-after-core-s.patch. - commit 96d2a36 - ALSA: hda/common: Use guard() for mutex locks (stable-fixes). - Refresh patches.suse/ALSA-hda-Report-a-change-when-only-the-channel-statu.patch. - commit 4e1afe9 - ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT (stable-fixes). - ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC (stable-fixes). - ALSA: es18xx: check control allocation before private data setup (stable-fixes). - ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP (stable-fixes). - ALSA: seq: oss: Reject reads that cannot fit the next event (stable-fixes). - ALSA: usb-audio: Add quirk for Novation Mininova (stable-fixes). - ALSA: usx2y: Drain pending US-428 pipe-4 output commands (stable-fixes). - commit cee820a - ALSA: 6fire: Clean ups with guard() (stable-fixes). - Refresh patches.suse/ALSA-6fire-fix-use-after-free-on-disconnect.patch. - commit cc78194 - ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach (stable-fixes). - ACPICA: add boundary checks in two places (stable-fixes). - ACPICA: Add package limit checks in parser functions (stable-fixes). - ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() (stable-fixes). - ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() (stable-fixes). - ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() (stable-fixes). - ACPICA: Add validation for node in acpi_ns_build_normalized_path() (stable-fixes). - ACPICA: validate handler object type in two places (stable-fixes). - ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() (stable-fixes). - ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) (stable-fixes). - ACPICA: Prevent adding invalid references (stable-fixes). - ACPICA: add boundary checks in acpi_ps_get_next_field() (stable-fixes). - ACPICA: validate byte_count in acpi_ps_get_next_package_length() (stable-fixes). - ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() (stable-fixes). - ACPICA: Fix condition check in acpi_ps_parse_loop() (stable-fixes). - ALSA: hda/common: Use cleanup macros for PM controls (stable-fixes). - ALSA: hda: Introduce auto cleanup macros for PM (stable-fixes). - commit a9d1e6a - Drop a couple of hwmon emc1403 patches (git-fixes) Deleted, as they were reverted in the upstream stable trees, too: patches.suse/hwmon-emc1403-Drop-hysteresis-for-low-limit-temperat.patch patches.suse/hwmon-emc1403-Rely-on-subsystem-locking.patch - commit 207a507 - Update config files: Disable CONFIG_BATMAN_ADV (jsc#PED-16892 Disable in remaining configs, too - commit c75b6e5 - vsock/virtio: flush works in dependency order (CVE-2026-80932 bsc#1280143). - commit cf9064d - vhost: reset the vring metadata cache on vring reconfiguration (CVE-2026-74580 bsc#1277885). - commit 512c066 - vhost/net: complete zerocopy ubufs only once (CVE-2026-74310 bsc#1276891). - commit 5ad2b25 ------------------------------------------------------------------ ------------------ 2026-10-3 - Oct 3 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - PCI: Accept AtomicOps already enabled by the hypervisor (git-fixes). - ASoC: qcom: lpass-cpu: use DAI table index for playback constraints (git-fixes). - ASoC: codecs: rt274: Fix format setting for 44100 rate (git-fixes). - ASoC: codecs: rt286: Revert delay value for jack setup (git-fixes). - ASoC: tegra: Fix ASRC Stream6 input threshold control (git-fixes). - ASoC: wm8903: Move the DRC QR threshold to the register that holds it (git-fixes). - ASoC: codecs: max98363: fix uninitialized stream_config->type (git-fixes). - ALSA: hda/tegra: Re-enable SDO workaround for Tegra194 (git-fixes). - ALSA: caiaq: unregister the input device when probe fails (git-fixes). - ALSA: line6: reject oversized playback packets (git-fixes). - ALSA: ua101: reject mismatched capture/playback packet sizes (git-fixes). - ALSA: seq: Serialize compat port-info ioctls (git-fixes). - commit 3785ff2 - btrfs: do not force reloc root creation during qgroup_account_snapshot() (CVE-2026-98080 bsc#1283973). - commit b16c38c ++++ kernel-rt: - PCI: Accept AtomicOps already enabled by the hypervisor (git-fixes). - ASoC: qcom: lpass-cpu: use DAI table index for playback constraints (git-fixes). - ASoC: codecs: rt274: Fix format setting for 44100 rate (git-fixes). - ASoC: codecs: rt286: Revert delay value for jack setup (git-fixes). - ASoC: tegra: Fix ASRC Stream6 input threshold control (git-fixes). - ASoC: wm8903: Move the DRC QR threshold to the register that holds it (git-fixes). - ASoC: codecs: max98363: fix uninitialized stream_config->type (git-fixes). - ALSA: hda/tegra: Re-enable SDO workaround for Tegra194 (git-fixes). - ALSA: caiaq: unregister the input device when probe fails (git-fixes). - ALSA: line6: reject oversized playback packets (git-fixes). - ALSA: ua101: reject mismatched capture/playback packet sizes (git-fixes). - ALSA: seq: Serialize compat port-info ioctls (git-fixes). - commit 3785ff2 - btrfs: do not force reloc root creation during qgroup_account_snapshot() (CVE-2026-98080 bsc#1283973). - commit b16c38c ++++ kernel-rt_debug: - PCI: Accept AtomicOps already enabled by the hypervisor (git-fixes). - ASoC: qcom: lpass-cpu: use DAI table index for playback constraints (git-fixes). - ASoC: codecs: rt274: Fix format setting for 44100 rate (git-fixes). - ASoC: codecs: rt286: Revert delay value for jack setup (git-fixes). - ASoC: tegra: Fix ASRC Stream6 input threshold control (git-fixes). - ASoC: wm8903: Move the DRC QR threshold to the register that holds it (git-fixes). - ASoC: codecs: max98363: fix uninitialized stream_config->type (git-fixes). - ALSA: hda/tegra: Re-enable SDO workaround for Tegra194 (git-fixes). - ALSA: caiaq: unregister the input device when probe fails (git-fixes). - ALSA: line6: reject oversized playback packets (git-fixes). - ALSA: ua101: reject mismatched capture/playback packet sizes (git-fixes). - ALSA: seq: Serialize compat port-info ioctls (git-fixes). - commit 3785ff2 - btrfs: do not force reloc root creation during qgroup_account_snapshot() (CVE-2026-98080 bsc#1283973). - commit b16c38c ------------------------------------------------------------------ ------------------ 2026-10-2 - Oct 2 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - EDAC/mc: Fix error path ordering in edac_mc_alloc() (CVE-2026-31689 bsc#1263602). - commit ae7e69e - configfs: pin the symlink target's dirent instead of chasing - >ci_dentry (CVE-2026-97950 bsc#1283121). - commit f3dfa45 - ima: Instantiate file_truncate and path_truncate hooks (CVE-2026-74592 bsc#1277900). - commit 0508757 - ext4: use fsdata to track inline data write state and fix race (CVE-2026-92500 bsc#1282193). - commit 2c9befd - ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() (CVE-2026-92503 bsc#1282383). - commit 11e56e6 - ext4: fix circular lock dependency in ext4_ext_migrate (CVE-2026-93269 bsc#1282810). - commit 71e0f82 - cachefiles: Fix double fput (CVE-2026-93810 bsc#1283213). - commit 8ecf2fd - udf: reject VAT indexes equal to the entry count (CVE-2026-89525 bsc#1282288). - commit d66915b - isofs: release zisofs block pointer buffer head (CVE-2026-90434 bsc#1281993). - commit 9e9fbc8 - ecryptfs: hold msg ctx list lock when cleaning daemon queue (CVE-2026-89609 bsc#1281793). - commit 7706547 - PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() (bsc#1283500 CVE-2026-97505). - commit 0053429 - btrfs: detach failed sprout device from transaction update list (CVE-2026-98091 bsc#1283805). - commit 37f2085 - net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put (CVE-2026-98015 bsc#1283963). - commit ff5f3be - perf/x86/intel: Fix kernel address leakages in LBR stack (bsc#1281273 CVE-2026-89984). - commit f3a0231 - KVM: x86/mmu: Check write tracking in all address spaces (CVE-2026-98164 bsc#1283935). - commit 1d78c6d - iommu/amd: Do not reallocate GA log buffers on resume (CVE-2026-98003 bsc#1283312). - commit bcf4600 - Bluetooth: hci_conn: fix the SCO setup context lifetime (CVE-2026-90255 bsc#1281694). - commit 0e43039 - hwmon: (lm90) Add lock protection to lm90_alert (CVE-2026-64213 bsc#1272793). - hwmon: (lm90) Stop work before releasing hwmon device (CVE-2026-64038 bsc#1273750). - commit 2c44061 - Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition (bsc#1281514 CVE-2026-90097). - commit 78341d7 ++++ kernel-rt: - EDAC/mc: Fix error path ordering in edac_mc_alloc() (CVE-2026-31689 bsc#1263602). - commit ae7e69e - configfs: pin the symlink target's dirent instead of chasing - >ci_dentry (CVE-2026-97950 bsc#1283121). - commit f3dfa45 - ima: Instantiate file_truncate and path_truncate hooks (CVE-2026-74592 bsc#1277900). - commit 0508757 - ext4: use fsdata to track inline data write state and fix race (CVE-2026-92500 bsc#1282193). - commit 2c9befd - ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() (CVE-2026-92503 bsc#1282383). - commit 11e56e6 - ext4: fix circular lock dependency in ext4_ext_migrate (CVE-2026-93269 bsc#1282810). - commit 71e0f82 - cachefiles: Fix double fput (CVE-2026-93810 bsc#1283213). - commit 8ecf2fd - udf: reject VAT indexes equal to the entry count (CVE-2026-89525 bsc#1282288). - commit d66915b - isofs: release zisofs block pointer buffer head (CVE-2026-90434 bsc#1281993). - commit 9e9fbc8 - ecryptfs: hold msg ctx list lock when cleaning daemon queue (CVE-2026-89609 bsc#1281793). - commit 7706547 - PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() (bsc#1283500 CVE-2026-97505). - commit 0053429 - btrfs: detach failed sprout device from transaction update list (CVE-2026-98091 bsc#1283805). - commit 37f2085 - net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put (CVE-2026-98015 bsc#1283963). - commit ff5f3be - perf/x86/intel: Fix kernel address leakages in LBR stack (bsc#1281273 CVE-2026-89984). - commit f3a0231 - KVM: x86/mmu: Check write tracking in all address spaces (CVE-2026-98164 bsc#1283935). - commit 1d78c6d - iommu/amd: Do not reallocate GA log buffers on resume (CVE-2026-98003 bsc#1283312). - commit bcf4600 - Bluetooth: hci_conn: fix the SCO setup context lifetime (CVE-2026-90255 bsc#1281694). - commit 0e43039 - hwmon: (lm90) Add lock protection to lm90_alert (CVE-2026-64213 bsc#1272793). - hwmon: (lm90) Stop work before releasing hwmon device (CVE-2026-64038 bsc#1273750). - commit 2c44061 - Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition (bsc#1281514 CVE-2026-90097). - commit 78341d7 ++++ kernel-rt_debug: - EDAC/mc: Fix error path ordering in edac_mc_alloc() (CVE-2026-31689 bsc#1263602). - commit ae7e69e - configfs: pin the symlink target's dirent instead of chasing - >ci_dentry (CVE-2026-97950 bsc#1283121). - commit f3dfa45 - ima: Instantiate file_truncate and path_truncate hooks (CVE-2026-74592 bsc#1277900). - commit 0508757 - ext4: use fsdata to track inline data write state and fix race (CVE-2026-92500 bsc#1282193). - commit 2c9befd - ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() (CVE-2026-92503 bsc#1282383). - commit 11e56e6 - ext4: fix circular lock dependency in ext4_ext_migrate (CVE-2026-93269 bsc#1282810). - commit 71e0f82 - cachefiles: Fix double fput (CVE-2026-93810 bsc#1283213). - commit 8ecf2fd - udf: reject VAT indexes equal to the entry count (CVE-2026-89525 bsc#1282288). - commit d66915b - isofs: release zisofs block pointer buffer head (CVE-2026-90434 bsc#1281993). - commit 9e9fbc8 - ecryptfs: hold msg ctx list lock when cleaning daemon queue (CVE-2026-89609 bsc#1281793). - commit 7706547 - PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() (bsc#1283500 CVE-2026-97505). - commit 0053429 - btrfs: detach failed sprout device from transaction update list (CVE-2026-98091 bsc#1283805). - commit 37f2085 - net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put (CVE-2026-98015 bsc#1283963). - commit ff5f3be - perf/x86/intel: Fix kernel address leakages in LBR stack (bsc#1281273 CVE-2026-89984). - commit f3a0231 - KVM: x86/mmu: Check write tracking in all address spaces (CVE-2026-98164 bsc#1283935). - commit 1d78c6d - iommu/amd: Do not reallocate GA log buffers on resume (CVE-2026-98003 bsc#1283312). - commit bcf4600 - Bluetooth: hci_conn: fix the SCO setup context lifetime (CVE-2026-90255 bsc#1281694). - commit 0e43039 - hwmon: (lm90) Add lock protection to lm90_alert (CVE-2026-64213 bsc#1272793). - hwmon: (lm90) Stop work before releasing hwmon device (CVE-2026-64038 bsc#1273750). - commit 2c44061 - Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition (bsc#1281514 CVE-2026-90097). - commit 78341d7 ++++ python311-core: - Update to 3.11.17: - Security - gh-158446: Fix a crash or incorrect output that could occur when formatting a float or complex with a precision close to the platform’s INT_MAX. PyOS_double_to_string() now raises ValueError for any precision of that magnitude, regardless of presentation type or value, as the format string parsers already did for precisions above INT_MAX. - gh-157190: Fixed a vulnerability in the tarfile data and tar extraction filters where a crafted archive using a hard link to a symbolic link could change the permissions and modification time of a file outside the destination directory, and expose its contents inside the extracted tree. This addresses CVE 2026-82049. (bsc#1280459, CVE-2026-82049) - gh-156793: asyncio: loop.start_tls() and loop.create_connection() now validate the server_hostname argument if an ssl.SSLContext is passed with check_hostname set to True, emitting DeprecationWarning if server_hostname is missing. (This will raise ValueError in Python 3.13 and later.) (bsc#1283826, CVE-2026-19553) - gh-156793: ssl.SSLContext.wrap_bio() now validates its server_side, server_hostname and session arguments similar to ssl.SSLContext.wrap_socket(), but for backward compatiblity reasons emits DeprecationWarning instead of ValueError. In particular, a context with check_hostname enabled and no server_hostname passed to wrap_bio() now emits DeprecationWarning to indicate the hostname wasn’t checked. (In Python 3.13 and later, this raises ValueError.) - gh-157265: In tarfile, when extracting a link falls back to extracting a member of the archive, skip the member when the filter function returns None when called with the extracted member’s name replaced with the link’s. - gh-157190: Fixed a vulnerability in the tarfile data and tar extraction filters where a crafted archive using a hard link to a symbolic link could change the permissions and modification time of a file outside the destination directory, and expose its contents inside the extracted tree. This addresses CVE 2026-82049. (bsc#1280459, CVE-2026-82049) - gh-157953: Update bundled libexpat to version 2.8.5. - gh-156002: Bound the amount of data zipfile decompresses per read for members compressed with bzip2, LZMA, or Zstandard, matching the existing limit for deflate. A small archive member could previously expand into an unbounded allocation even when read in small chunks. (bsc#1277111, CVE-2026-15310) - gh-155999: Fix the tarfile tar and data extraction filters creating directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. (bsc#1276227, CVE-2026-19672) - gh-156293: Fix a crash in ssl when an sni_callback switches a connection to another SSLContext and the context that carries the callback is no longer referenced by the application. Servers that keep their sni_callback context alive (the usual case when it wraps the listening socket or is stored on the server object) were not affected. This addresses CVE-2026-19445. (bsc#1283969, CVE-2026-19445) - gh-155292: Change the stringprep module and encodings.idna codec to not consider Unicode codepoint attributes beyond those defined in RFC 3454. (bsc#1276226, CVE-2026-17084) - gh-155694: Fix CVE-2026-15806 by scoping HTTPPasswordMgr credentials to the URL scheme, preventing credentials stored for an HTTPS URL from being used for a matching HTTP URL, while URIs without a scheme continue to match any scheme. (bsc#1276223, CVE-2026-15806) - Library - gh-156002: zipfile again reads members through a third-party decompressor installed by monkey-patching the private _get_decompressor() to return an object that only implements old BZ2Decompressor API from Python 3.3. Note that decompressors without needs_input and two-argument decompress() are vulnerable to CVE 2026-15310. - gh-156353: Fix configparser parsing when using whitespace in delimiters. - Build - gh-155757: Set the --argv0 argument to wasmtime for WASI builds so the test suite passes. Otherwise the calculated paths to the stdlib for frozen modules is incorrect. - Removed upstreamed patches: * CVE-2026-15806-HTTPPasswordMgr-scheme.patch * CVE-2026-17084-stringprep-rfc3454.patch * CVE-2026-19672-tarfile-outside-dirs.patch * CVE-2026-15310-bound-zipfile-decompression.patch ++++ python311: - Update to 3.11.17: - Security - gh-158446: Fix a crash or incorrect output that could occur when formatting a float or complex with a precision close to the platform’s INT_MAX. PyOS_double_to_string() now raises ValueError for any precision of that magnitude, regardless of presentation type or value, as the format string parsers already did for precisions above INT_MAX. - gh-157190: Fixed a vulnerability in the tarfile data and tar extraction filters where a crafted archive using a hard link to a symbolic link could change the permissions and modification time of a file outside the destination directory, and expose its contents inside the extracted tree. This addresses CVE 2026-82049. (bsc#1280459, CVE-2026-82049) - gh-156793: asyncio: loop.start_tls() and loop.create_connection() now validate the server_hostname argument if an ssl.SSLContext is passed with check_hostname set to True, emitting DeprecationWarning if server_hostname is missing. (This will raise ValueError in Python 3.13 and later.) (bsc#1283826, CVE-2026-19553) - gh-156793: ssl.SSLContext.wrap_bio() now validates its server_side, server_hostname and session arguments similar to ssl.SSLContext.wrap_socket(), but for backward compatiblity reasons emits DeprecationWarning instead of ValueError. In particular, a context with check_hostname enabled and no server_hostname passed to wrap_bio() now emits DeprecationWarning to indicate the hostname wasn’t checked. (In Python 3.13 and later, this raises ValueError.) - gh-157265: In tarfile, when extracting a link falls back to extracting a member of the archive, skip the member when the filter function returns None when called with the extracted member’s name replaced with the link’s. - gh-157190: Fixed a vulnerability in the tarfile data and tar extraction filters where a crafted archive using a hard link to a symbolic link could change the permissions and modification time of a file outside the destination directory, and expose its contents inside the extracted tree. This addresses CVE 2026-82049. (bsc#1280459, CVE-2026-82049) - gh-157953: Update bundled libexpat to version 2.8.5. - gh-156002: Bound the amount of data zipfile decompresses per read for members compressed with bzip2, LZMA, or Zstandard, matching the existing limit for deflate. A small archive member could previously expand into an unbounded allocation even when read in small chunks. (bsc#1277111, CVE-2026-15310) - gh-155999: Fix the tarfile tar and data extraction filters creating directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. (bsc#1276227, CVE-2026-19672) - gh-156293: Fix a crash in ssl when an sni_callback switches a connection to another SSLContext and the context that carries the callback is no longer referenced by the application. Servers that keep their sni_callback context alive (the usual case when it wraps the listening socket or is stored on the server object) were not affected. This addresses CVE-2026-19445. (bsc#1283969, CVE-2026-19445) - gh-155292: Change the stringprep module and encodings.idna codec to not consider Unicode codepoint attributes beyond those defined in RFC 3454. (bsc#1276226, CVE-2026-17084) - gh-155694: Fix CVE-2026-15806 by scoping HTTPPasswordMgr credentials to the URL scheme, preventing credentials stored for an HTTPS URL from being used for a matching HTTP URL, while URIs without a scheme continue to match any scheme. (bsc#1276223, CVE-2026-15806) - Library - gh-156002: zipfile again reads members through a third-party decompressor installed by monkey-patching the private _get_decompressor() to return an object that only implements old BZ2Decompressor API from Python 3.3. Note that decompressors without needs_input and two-argument decompress() are vulnerable to CVE 2026-15310. - gh-156353: Fix configparser parsing when using whitespace in delimiters. - Build - gh-155757: Set the --argv0 argument to wasmtime for WASI builds so the test suite passes. Otherwise the calculated paths to the stdlib for frozen modules is incorrect. - Removed upstreamed patches: * CVE-2026-15806-HTTPPasswordMgr-scheme.patch * CVE-2026-17084-stringprep-rfc3454.patch * CVE-2026-19672-tarfile-outside-dirs.patch * CVE-2026-15310-bound-zipfile-decompression.patch ------------------------------------------------------------------ ------------------ 2026-10-1 - Oct 1 2026 ------------------- ------------------------------------------------------------------ ++++ glibc: - resolv-search-list-trunc.patch: resolv: Fix assertion failure on search list truncation (CVE-2026-8674, bsc#1281297, BZ #31026) - elf-origin-open-normalized.patch: elf: Open the normalized $ORIGIN rpath in AT_SECURE programs (CVE-2026-86805, bsc#1282509, BZ #34360) - nscd-unbound-alloca.patch: nscd: replace alloca with malloc in aicache, hstcache (CVE-2026-89092, bsc#1282449, BZ #34624) - power8-strncasecmp-overread.patch: powerpc: Fix one byte overread in strncasecmp (CVE-2026-97399, bsc#1283147, BZ #34683) ++++ kernel-default: - gpio: tegra: do not call pinctrl for GPIO direction (CVE-2026-72063 bsc#1277148). - commit 11ddafa - nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229 CVE-2026-89968). - commit 87e55a3 - nvme-tcp: fix host memory disclosure on R2T for a read command (bsc#1280451 CVE-2026-89481). - commit 2591dfc - nvme-tcp: reject a read that transferred too few bytes (bsc#1280449 CVE-2026-89480). Refresh: - patches.suse/nvme-tcp-delay-error-recovery-until-the-next-kato.patch - patches.suse/nvme-tcp-make-err_work-a-delayed-work.patch - commit 0c19d01 - btrfs: defrag: fix deadlock between defrag and delalloc space reservation (CVE-2026-90265 bsc#1282054). - commit 94ece83 - iommu/dma: Check atomic pool allocation result directly (CVE-2026-90388 bsc#1282197). - commit c7015b4 - smb: client: fix races in cifsd thread creation (bsc#1282803, CVE-2026-93829). - commit 891d3f7 - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (bsc#1283201, CVE-2026-97557). - commit 8030c11 - smb/client: flush dirty data before punching a hole (bsc#1283154, CVE-2026-93794). - commit 925580e - i2c: core: fix adapter deregistration race (CVE-2026-64279 bsc#1273953). - i2c: core: fix adapter registration race (CVE-2026-53400 bsc#1271906). - i2c: core: fix irq domain leak on adapter registration failure (git-fixes). - commit 9de31c7 - RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() (CVE-2026-97421 bsc#1283176) - commit b5a7605 - RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup (git-fixes) - commit 870fe72 - RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() (CVE-2026-97477 bsc#1283230) - commit 4bf471d - ipv6: fix fib6 walker UAF on seq stop (CVE-2026-97940 bsc#1283163). - commit 72bdf35 - net/smc: fix socket refcount leak in smc_switch_conns() (CVE-2026-80983 bsc#1280296). - commit 9bacebf ++++ kernel-rt: - gpio: tegra: do not call pinctrl for GPIO direction (CVE-2026-72063 bsc#1277148). - commit 11ddafa - nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229 CVE-2026-89968). - commit 87e55a3 - nvme-tcp: fix host memory disclosure on R2T for a read command (bsc#1280451 CVE-2026-89481). - commit 2591dfc - nvme-tcp: reject a read that transferred too few bytes (bsc#1280449 CVE-2026-89480). Refresh: - patches.suse/nvme-tcp-delay-error-recovery-until-the-next-kato.patch - patches.suse/nvme-tcp-make-err_work-a-delayed-work.patch - commit 0c19d01 - btrfs: defrag: fix deadlock between defrag and delalloc space reservation (CVE-2026-90265 bsc#1282054). - commit 94ece83 - iommu/dma: Check atomic pool allocation result directly (CVE-2026-90388 bsc#1282197). - commit c7015b4 - smb: client: fix races in cifsd thread creation (bsc#1282803, CVE-2026-93829). - commit 891d3f7 - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (bsc#1283201, CVE-2026-97557). - commit 8030c11 - smb/client: flush dirty data before punching a hole (bsc#1283154, CVE-2026-93794). - commit 925580e - i2c: core: fix adapter deregistration race (CVE-2026-64279 bsc#1273953). - i2c: core: fix adapter registration race (CVE-2026-53400 bsc#1271906). - i2c: core: fix irq domain leak on adapter registration failure (git-fixes). - commit 9de31c7 - RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() (CVE-2026-97421 bsc#1283176) - commit b5a7605 - RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup (git-fixes) - commit 870fe72 - RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() (CVE-2026-97477 bsc#1283230) - commit 4bf471d - ipv6: fix fib6 walker UAF on seq stop (CVE-2026-97940 bsc#1283163). - commit 72bdf35 - net/smc: fix socket refcount leak in smc_switch_conns() (CVE-2026-80983 bsc#1280296). - commit 9bacebf ++++ kernel-rt_debug: - gpio: tegra: do not call pinctrl for GPIO direction (CVE-2026-72063 bsc#1277148). - commit 11ddafa - nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229 CVE-2026-89968). - commit 87e55a3 - nvme-tcp: fix host memory disclosure on R2T for a read command (bsc#1280451 CVE-2026-89481). - commit 2591dfc - nvme-tcp: reject a read that transferred too few bytes (bsc#1280449 CVE-2026-89480). Refresh: - patches.suse/nvme-tcp-delay-error-recovery-until-the-next-kato.patch - patches.suse/nvme-tcp-make-err_work-a-delayed-work.patch - commit 0c19d01 - btrfs: defrag: fix deadlock between defrag and delalloc space reservation (CVE-2026-90265 bsc#1282054). - commit 94ece83 - iommu/dma: Check atomic pool allocation result directly (CVE-2026-90388 bsc#1282197). - commit c7015b4 - smb: client: fix races in cifsd thread creation (bsc#1282803, CVE-2026-93829). - commit 891d3f7 - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (bsc#1283201, CVE-2026-97557). - commit 8030c11 - smb/client: flush dirty data before punching a hole (bsc#1283154, CVE-2026-93794). - commit 925580e - i2c: core: fix adapter deregistration race (CVE-2026-64279 bsc#1273953). - i2c: core: fix adapter registration race (CVE-2026-53400 bsc#1271906). - i2c: core: fix irq domain leak on adapter registration failure (git-fixes). - commit 9de31c7 - RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() (CVE-2026-97421 bsc#1283176) - commit b5a7605 - RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup (git-fixes) - commit 870fe72 - RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() (CVE-2026-97477 bsc#1283230) - commit 4bf471d - ipv6: fix fib6 walker UAF on seq stop (CVE-2026-97940 bsc#1283163). - commit 72bdf35 - net/smc: fix socket refcount leak in smc_switch_conns() (CVE-2026-80983 bsc#1280296). - commit 9bacebf ------------------------------------------------------------------ ------------------ 2026-9-30 - Sep 30 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - net/packet: defer vmalloc TX_RING free until skbs finish (CVE-2026-80841 bsc#1279835). - commit dc321c0 - tracing: Fix memory corruption from a "STACKTRACE" histogram key (CVE-2026-97934 bsc#1282997). - commit b0222a7 - crypto: virtio - bound the akcipher result length (CVE-2026-80836 bsc#1279819). - commit fe2463a - sctp: stop processing a packet once its association is deleted (CVE-2026-89479 bsc#1280786). - commit b01f325 - net: tls: prevent chain-after-chain in plain text SG (CVE-2026-64046 bsc#1273059). - commit 954ca46 - add bug number to existing pci-hyperv patch (bsc#1282648). - commit 48ff6be - selinux: do not cancel a policy conversion that never started (CVE-2026-80756 bsc#1278708). - commit 751330d - netfilter: bridge: release template ct on non-IP path (CVE-2026-74625 bsc#1277036). - commit ee567bc - 9p: avoid putting oldfid in p9_client_walk() error path (CVE-2026-63795 bsc#1271955). - commit 2f4e518 - entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603 bsc#1280923). - commit 36f7164 - Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync (CVE-2026-64405 bsc#1273512). - commit 87ed7aa - Add Reviewed-by to patches.suse/Bluetooth-RFCOMM-Validate-MTU-in-rfcomm_apply_pn-to-preven.patch - commit b363ac0 - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() (CVE-2026-64405 bsc#1273512). - commit cf35d93 - media: cec: disable delayed work before freeing an interrupted transmit (CVE-2026-89899 bsc#1281383). - commit 5825388 - btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk() (CVE-2026-97416 bsc#1282770). - commit 31673ce - RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (CVE-2026-100075 bsc#1282881) - commit 6c7dc01 - bpf, x86: Fix trampoline stack size for 128-bit arguments (bsc#1281825 CVE-2026-90358). - commit bcbf99e - mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ (git-fixes). - mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB (git-fixes). - mtd: spinand: fix zero oobavail when no ECC engine is used (git-fixes). - commit 269a3fa - RDMA/efa: Fix PBL chunk length computation (CVE-2026-93264 bsc#1282812) - commit d7dae57 - RDMA/hfi1: Align probe error unwinding with device removal (git-fixes) - commit 4a83d40 - RDMA/hfi1: Initialize debugfs after probe completes (git-fixes) - commit f5126a2 - RDMA/hfi1: Defer device creation until probe succeeds (git-fixes) - commit 02bb520 - RDMA/hfi1: Stop flushing the global IB workqueue (git-fixes) - commit f0938e0 - RDMA/hfi1: Remove redundant NULL checks in create_workqueues() (git-fixes) - commit 6ba447a - RDMA/hfi1: Allocate device data after PCI initialization (git-fixes) - commit 2c2da5a - RDMA/hfi1: Free RX data on late probe failure (CVE-2026-93102 bsc#1282170) - commit 10f0bd7 - RDMA/hfi1: Create workqueues before device initialization (git-fixes) - commit 33f0df5 - RDMA/hfi1: Drop device data from hfi1_validate_rcvhdrcnt() (git-fixes) - commit 5662a51 - RDMA/hfi1: Pass PCI device to hfi1_pcie_init() (git-fixes) - commit cd91976 - RDMA/hfi1: Remove redundant PCI device ID validation (git-fixes) - commit d281088 - RDMA/hfi1: Preserve unit 0 on (CVE-2026-93103 bsc#1282286) - commit 19c6e63 - RDMA/cxgb4: free STAG index when TPT entry write fails (CVE-2026-90415 bsc#1282143) - commit 2dad58f - RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap (CVE-2026-92495 bsc#1282072) - commit aebfe9f - RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ (CVE-2026-90307 bsc#1282050) - commit 3a9db56 - RDMA/hfi1: Propagate sdma_txinit_ahg() errors (CVE-2026-93037 bsc#1282020) - commit aa36622 - RDMA/core: Fix potential use after free in ib_dealloc_pd_user() (CVE-2026-92507 bsc#1281988) - commit 7339075 - RDMA/core: Fix potential use after free in ib_free_cq() (CVE-2026-92508 bsc#1282034) - commit 1f04e20 - drm/amdkfd: Check bounds on CRIU restore queue type and mqd size (bsc#1275866 CVE-2026-68258) - commit 67a10ca - RDMA/core: Fix potential use after free in counter_release() (CVE-2026-92509 bsc#1282040) - commit e86682d - RDMA/core: Fix potential use after free in ib_destroy_srq_user() (CVE-2026-92510 bsc#1282041) - commit eb6b624 - RDMA/core: Fix potential use after free in ib_destroy_cq_user() (CVE-2026-92511 bsc#1282042) - commit c71257d - RDMA/core: Fix use after free in ib_query_qp() (CVE-2026-92512 bsc#1281995) - commit e6be419 - RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations (git-fixes) - commit 4e495d4 - RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() (CVE-2026-90417 bsc#1281973) - commit 60413d2 ++++ kernel-rt: - net/packet: defer vmalloc TX_RING free until skbs finish (CVE-2026-80841 bsc#1279835). - commit dc321c0 - tracing: Fix memory corruption from a "STACKTRACE" histogram key (CVE-2026-97934 bsc#1282997). - commit b0222a7 - crypto: virtio - bound the akcipher result length (CVE-2026-80836 bsc#1279819). - commit fe2463a - sctp: stop processing a packet once its association is deleted (CVE-2026-89479 bsc#1280786). - commit b01f325 - net: tls: prevent chain-after-chain in plain text SG (CVE-2026-64046 bsc#1273059). - commit 954ca46 - add bug number to existing pci-hyperv patch (bsc#1282648). - commit 48ff6be - selinux: do not cancel a policy conversion that never started (CVE-2026-80756 bsc#1278708). - commit 751330d - netfilter: bridge: release template ct on non-IP path (CVE-2026-74625 bsc#1277036). - commit ee567bc - 9p: avoid putting oldfid in p9_client_walk() error path (CVE-2026-63795 bsc#1271955). - commit 2f4e518 - entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603 bsc#1280923). - commit 36f7164 - Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync (CVE-2026-64405 bsc#1273512). - commit 87ed7aa - Add Reviewed-by to patches.suse/Bluetooth-RFCOMM-Validate-MTU-in-rfcomm_apply_pn-to-preven.patch - commit b363ac0 - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() (CVE-2026-64405 bsc#1273512). - commit cf35d93 - media: cec: disable delayed work before freeing an interrupted transmit (CVE-2026-89899 bsc#1281383). - commit 5825388 - btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk() (CVE-2026-97416 bsc#1282770). - commit 31673ce - RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (CVE-2026-100075 bsc#1282881) - commit 6c7dc01 - bpf, x86: Fix trampoline stack size for 128-bit arguments (bsc#1281825 CVE-2026-90358). - commit bcbf99e - mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ (git-fixes). - mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB (git-fixes). - mtd: spinand: fix zero oobavail when no ECC engine is used (git-fixes). - commit 269a3fa - RDMA/efa: Fix PBL chunk length computation (CVE-2026-93264 bsc#1282812) - commit d7dae57 - RDMA/hfi1: Align probe error unwinding with device removal (git-fixes) - commit 4a83d40 - RDMA/hfi1: Initialize debugfs after probe completes (git-fixes) - commit f5126a2 - RDMA/hfi1: Defer device creation until probe succeeds (git-fixes) - commit 02bb520 - RDMA/hfi1: Stop flushing the global IB workqueue (git-fixes) - commit f0938e0 - RDMA/hfi1: Remove redundant NULL checks in create_workqueues() (git-fixes) - commit 6ba447a - RDMA/hfi1: Allocate device data after PCI initialization (git-fixes) - commit 2c2da5a - RDMA/hfi1: Free RX data on late probe failure (CVE-2026-93102 bsc#1282170) - commit 10f0bd7 - RDMA/hfi1: Create workqueues before device initialization (git-fixes) - commit 33f0df5 - RDMA/hfi1: Drop device data from hfi1_validate_rcvhdrcnt() (git-fixes) - commit 5662a51 - RDMA/hfi1: Pass PCI device to hfi1_pcie_init() (git-fixes) - commit cd91976 - RDMA/hfi1: Remove redundant PCI device ID validation (git-fixes) - commit d281088 - RDMA/hfi1: Preserve unit 0 on (CVE-2026-93103 bsc#1282286) - commit 19c6e63 - RDMA/cxgb4: free STAG index when TPT entry write fails (CVE-2026-90415 bsc#1282143) - commit 2dad58f - RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap (CVE-2026-92495 bsc#1282072) - commit aebfe9f - RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ (CVE-2026-90307 bsc#1282050) - commit 3a9db56 - RDMA/hfi1: Propagate sdma_txinit_ahg() errors (CVE-2026-93037 bsc#1282020) - commit aa36622 - RDMA/core: Fix potential use after free in ib_dealloc_pd_user() (CVE-2026-92507 bsc#1281988) - commit 7339075 - RDMA/core: Fix potential use after free in ib_free_cq() (CVE-2026-92508 bsc#1282034) - commit 1f04e20 - drm/amdkfd: Check bounds on CRIU restore queue type and mqd size (bsc#1275866 CVE-2026-68258) - commit 67a10ca - RDMA/core: Fix potential use after free in counter_release() (CVE-2026-92509 bsc#1282040) - commit e86682d - RDMA/core: Fix potential use after free in ib_destroy_srq_user() (CVE-2026-92510 bsc#1282041) - commit eb6b624 - RDMA/core: Fix potential use after free in ib_destroy_cq_user() (CVE-2026-92511 bsc#1282042) - commit c71257d - RDMA/core: Fix use after free in ib_query_qp() (CVE-2026-92512 bsc#1281995) - commit e6be419 - RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations (git-fixes) - commit 4e495d4 - RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() (CVE-2026-90417 bsc#1281973) - commit 60413d2 ++++ kernel-rt_debug: - net/packet: defer vmalloc TX_RING free until skbs finish (CVE-2026-80841 bsc#1279835). - commit dc321c0 - tracing: Fix memory corruption from a "STACKTRACE" histogram key (CVE-2026-97934 bsc#1282997). - commit b0222a7 - crypto: virtio - bound the akcipher result length (CVE-2026-80836 bsc#1279819). - commit fe2463a - sctp: stop processing a packet once its association is deleted (CVE-2026-89479 bsc#1280786). - commit b01f325 - net: tls: prevent chain-after-chain in plain text SG (CVE-2026-64046 bsc#1273059). - commit 954ca46 - add bug number to existing pci-hyperv patch (bsc#1282648). - commit 48ff6be - selinux: do not cancel a policy conversion that never started (CVE-2026-80756 bsc#1278708). - commit 751330d - netfilter: bridge: release template ct on non-IP path (CVE-2026-74625 bsc#1277036). - commit ee567bc - 9p: avoid putting oldfid in p9_client_walk() error path (CVE-2026-63795 bsc#1271955). - commit 2f4e518 - entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603 bsc#1280923). - commit 36f7164 - Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync (CVE-2026-64405 bsc#1273512). - commit 87ed7aa - Add Reviewed-by to patches.suse/Bluetooth-RFCOMM-Validate-MTU-in-rfcomm_apply_pn-to-preven.patch - commit b363ac0 - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() (CVE-2026-64405 bsc#1273512). - commit cf35d93 - media: cec: disable delayed work before freeing an interrupted transmit (CVE-2026-89899 bsc#1281383). - commit 5825388 - btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk() (CVE-2026-97416 bsc#1282770). - commit 31673ce - RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (CVE-2026-100075 bsc#1282881) - commit 6c7dc01 - bpf, x86: Fix trampoline stack size for 128-bit arguments (bsc#1281825 CVE-2026-90358). - commit bcbf99e - mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ (git-fixes). - mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB (git-fixes). - mtd: spinand: fix zero oobavail when no ECC engine is used (git-fixes). - commit 269a3fa - RDMA/efa: Fix PBL chunk length computation (CVE-2026-93264 bsc#1282812) - commit d7dae57 - RDMA/hfi1: Align probe error unwinding with device removal (git-fixes) - commit 4a83d40 - RDMA/hfi1: Initialize debugfs after probe completes (git-fixes) - commit f5126a2 - RDMA/hfi1: Defer device creation until probe succeeds (git-fixes) - commit 02bb520 - RDMA/hfi1: Stop flushing the global IB workqueue (git-fixes) - commit f0938e0 - RDMA/hfi1: Remove redundant NULL checks in create_workqueues() (git-fixes) - commit 6ba447a - RDMA/hfi1: Allocate device data after PCI initialization (git-fixes) - commit 2c2da5a - RDMA/hfi1: Free RX data on late probe failure (CVE-2026-93102 bsc#1282170) - commit 10f0bd7 - RDMA/hfi1: Create workqueues before device initialization (git-fixes) - commit 33f0df5 - RDMA/hfi1: Drop device data from hfi1_validate_rcvhdrcnt() (git-fixes) - commit 5662a51 - RDMA/hfi1: Pass PCI device to hfi1_pcie_init() (git-fixes) - commit cd91976 - RDMA/hfi1: Remove redundant PCI device ID validation (git-fixes) - commit d281088 - RDMA/hfi1: Preserve unit 0 on (CVE-2026-93103 bsc#1282286) - commit 19c6e63 - RDMA/cxgb4: free STAG index when TPT entry write fails (CVE-2026-90415 bsc#1282143) - commit 2dad58f - RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap (CVE-2026-92495 bsc#1282072) - commit aebfe9f - RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ (CVE-2026-90307 bsc#1282050) - commit 3a9db56 - RDMA/hfi1: Propagate sdma_txinit_ahg() errors (CVE-2026-93037 bsc#1282020) - commit aa36622 - RDMA/core: Fix potential use after free in ib_dealloc_pd_user() (CVE-2026-92507 bsc#1281988) - commit 7339075 - RDMA/core: Fix potential use after free in ib_free_cq() (CVE-2026-92508 bsc#1282034) - commit 1f04e20 - drm/amdkfd: Check bounds on CRIU restore queue type and mqd size (bsc#1275866 CVE-2026-68258) - commit 67a10ca - RDMA/core: Fix potential use after free in counter_release() (CVE-2026-92509 bsc#1282040) - commit e86682d - RDMA/core: Fix potential use after free in ib_destroy_srq_user() (CVE-2026-92510 bsc#1282041) - commit eb6b624 - RDMA/core: Fix potential use after free in ib_destroy_cq_user() (CVE-2026-92511 bsc#1282042) - commit c71257d - RDMA/core: Fix use after free in ib_query_qp() (CVE-2026-92512 bsc#1281995) - commit e6be419 - RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations (git-fixes) - commit 4e495d4 - RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() (CVE-2026-90417 bsc#1281973) - commit 60413d2 ++++ expat: - security update: * CVE-2026-102633: expat: Denial of Service via integer overflow in expat_realloc (bsc#1283493) - Added patch expat-CVE-2026-102633.patch ++++ openssh: - Add openssh-cve-2026-73281-locked-binding.patch (bsc#1275075, CVE-2026-73281), fixing local ssh-agent operations being available remotely. - Add openssh-cve-2026-73282-realloc-oob.patch (bsc#1275074, CVE-2026-73282), fixing a use-after-free. - Add openssh-cve-2026-73283-tunnel-restrict.patch (bsc#1275079, CVE-2026-73283), making the authorized_keys "restrict" option apply to tunnel forwarding. - Update openssh-8.4p1-ssh_config_d.patch to include mentions of the configuration drop-in directories (bsc#1259462). ------------------------------------------------------------------ ------------------ 2026-9-29 - Sep 29 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - rpm/package-descriptions: Add nvidia64kb flavor - commit 7873939 - btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF (CVE-2026-97415 bsc#1282768). - commit 2ecd036 - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207 bsc#1282672). - commit 417b81f - nfsd: guard nfsd_serv deref in nfsd_file_net_dispose (CVE-2026-93212 bsc#1282774). - commit 6d6b862 - kABI fix for vfio/pci: Latch disable_idle_d3 per device (CVE-2026-64476 bsc#1274245). - commit e729195 - HID: hidpp: fix potential UAF in hidpp_connect_event() (CVE-2026-93826 bsc#1282891). - commit 709eee1 - Bluetooth: RFCOMM: serialize security confirmation handling (CVE-2026-89569 bsc#1280733). - commit dd28ca9 - KVM: arm64: vgic: Free gic_kvm_info on initialization failure (git-fixes). - commit 43c0536 - Refresh patches.suse/Bluetooth-ISO-fix-leaking-sk-after-socket-release.patch. (CVE-2026-74536 bsc#1275799) due to mismerge - commit a00b44e - RDMA/erdma: Fix CEQ tasklet use-after-free on removal (CVE-2026-92514 bsc#1281997) - commit 50ade2c - x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size (bsc#1260474 CVE-2026-23352). - commit 9528592 - x86/efi: defer freeing of boot services memory (bsc#1260474 CVE-2026-23352). - commit 482e5b1 ++++ kernel-rt: - rpm/package-descriptions: Add nvidia64kb flavor - commit 7873939 - btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF (CVE-2026-97415 bsc#1282768). - commit 2ecd036 - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207 bsc#1282672). - commit 417b81f - nfsd: guard nfsd_serv deref in nfsd_file_net_dispose (CVE-2026-93212 bsc#1282774). - commit 6d6b862 - kABI fix for vfio/pci: Latch disable_idle_d3 per device (CVE-2026-64476 bsc#1274245). - commit e729195 - HID: hidpp: fix potential UAF in hidpp_connect_event() (CVE-2026-93826 bsc#1282891). - commit 709eee1 - Bluetooth: RFCOMM: serialize security confirmation handling (CVE-2026-89569 bsc#1280733). - commit dd28ca9 - KVM: arm64: vgic: Free gic_kvm_info on initialization failure (git-fixes). - commit 43c0536 - Refresh patches.suse/Bluetooth-ISO-fix-leaking-sk-after-socket-release.patch. (CVE-2026-74536 bsc#1275799) due to mismerge - commit a00b44e - RDMA/erdma: Fix CEQ tasklet use-after-free on removal (CVE-2026-92514 bsc#1281997) - commit 50ade2c - x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size (bsc#1260474 CVE-2026-23352). - commit 9528592 - x86/efi: defer freeing of boot services memory (bsc#1260474 CVE-2026-23352). - commit 482e5b1 ++++ kernel-rt_debug: - rpm/package-descriptions: Add nvidia64kb flavor - commit 7873939 - btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF (CVE-2026-97415 bsc#1282768). - commit 2ecd036 - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207 bsc#1282672). - commit 417b81f - nfsd: guard nfsd_serv deref in nfsd_file_net_dispose (CVE-2026-93212 bsc#1282774). - commit 6d6b862 - kABI fix for vfio/pci: Latch disable_idle_d3 per device (CVE-2026-64476 bsc#1274245). - commit e729195 - HID: hidpp: fix potential UAF in hidpp_connect_event() (CVE-2026-93826 bsc#1282891). - commit 709eee1 - Bluetooth: RFCOMM: serialize security confirmation handling (CVE-2026-89569 bsc#1280733). - commit dd28ca9 - KVM: arm64: vgic: Free gic_kvm_info on initialization failure (git-fixes). - commit 43c0536 - Refresh patches.suse/Bluetooth-ISO-fix-leaking-sk-after-socket-release.patch. (CVE-2026-74536 bsc#1275799) due to mismerge - commit a00b44e - RDMA/erdma: Fix CEQ tasklet use-after-free on removal (CVE-2026-92514 bsc#1281997) - commit 50ade2c - x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size (bsc#1260474 CVE-2026-23352). - commit 9528592 - x86/efi: defer freeing of boot services memory (bsc#1260474 CVE-2026-23352). - commit 482e5b1 ++++ wpa_supplicant: - Add RADIUS-Fix-Message-Authenticator-attribute-validatio.patch https://w1.fi/security/2026-5/ ------------------------------------------------------------------ ------------------ 2026-9-28 - Sep 28 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - Refresh patches.suse/Bluetooth-ISO-fix-CONNECTED-CLOSED-transition-on-shu.patch (CVE-2026-74541 bsc#1275694) There was a line that should have been dropped, which may lead to the refcount unbalance. Fix it. - commit cb4281b - Add Reviewed-by to patches.suse/drm-vc4-Prevent-shader-BO-mappings-from-becoming-writable.patch - commit 5e98ca7 - arm64: Set __nocfi on swsusp_arch_resume() (bsc#1258298 CVE-2026-23128) - commit 1f11d8b - drm/amdgpu: Fix UVD decode image min size calculation (bsc#1277590 CVE-2026-80540) - commit a46cbeb - sctp: add INIT verification after cookie unpacking (CVE-2026-72398 bsc#1276381). - commit a341e02 - seg6: reset IP6CB after IPv6 decapsulation (CVE-2026-80976 bsc#1280298). - ipv6: seg6: clear IPv4 control block on IPIP decapsulation (CVE-2026-80840 bsc#1279875). - xfrm: ah6: validate routing header segments_left (CVE-2026-80844 bsc#1279786). - net: tun: bound receive headroom (CVE-2026-81000 bsc#1280263). - tipc: read le->link under the node lock in tipc_node_link_down() (CVE-2026-74609 bsc#1277906). - net: smc: fix splice entry lifetime imbalance in smc_rx_splice (CVE-2026-74631 bsc#1278195). - veth: convert frag_list skbs before running XDP (CVE-2026-74476 bsc#1276341). - tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283 bsc#1276475). - commit 0325eb5 - Add Reviewed-by to patches.suse/nvmet-rdma-handle-inline-data-with-a-nonzero-offset.patch - commit 899f38e - bonding: crypto offload enabled, non-offload slave failover, rekey failed (bsc#1282823). - commit f1bfa68 - wifi: brcmsmac: fix UAF in brcms_free_timer() (git-fixes). - wifi: brcmfmac: fix lost 802.1x TX completion wakeup (git-fixes). - wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() (git-fixes). - wifi: virt_wifi: don't transfer operstate before register (git-fixes). - wifi: mac80211: set up the TX info early to fix failure paths (git-fixes). - wifi: mac80211: mesh: release the channel if start fails (git-fixes). - wifi: mac80211: add HE 6 GHz capability in the scan elems len (git-fixes). - wifi: mac80211: don't access the TSF of a down interface (git-fixes). - wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set (git-fixes). - wifi: mac80211: don't allow link changes when iface is down (git-fixes). - wifi: mac80211: require a peer station for TDLS setup confirm (git-fixes). - wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown (git-fixes). - wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() (git-fixes). - wifi: mac80211: unlist vifs when their netdev is unregistered (git-fixes). - wifi: mac80211: only operate on TDLS peers in the TDLS code (git-fixes). - wifi: mac80211: reset state when starting AP fails (git-fixes). - wifi: mac80211: suppress chanctx warning for debugfs reset (git-fixes). - commit e6b6d3b - watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes). - watchdog: da9062: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes). - wifi: mac80211: don't offload TC setup on AP_VLAN interfaces (git-fixes). - wifi: mac80211: don't start a ROC while scanning (git-fixes). - wifi: cfg80211: don't filter by BSS type when removing stale entries (git-fixes). - wifi: cfg80211: only group hidden BSSes with beacon entries (git-fixes). - wifi: cfg80211: check IP header size in cfg80211_classify8021d() (git-fixes). - wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver (git-fixes). - wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST (git-fixes). - wifi: p54: validate curve data length in the calibration curve converters (git-fixes). - wifi: libipw: reject too-short association responses (git-fixes). - wifi: libipw: reject too-short beacon and probe responses (git-fixes). - wifi: mwifiex: validate scan response extents (git-fixes). - wifi: mwifiex: validate action frame fixed fields (git-fixes). - wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length (git-fixes). - wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path (git-fixes). - wifi: virt_wifi: free skb when disconnected (git-fixes). - wifi: wilc1000: fix out-of-bounds read in P2P public action frames (git-fixes). - wifi: wlcore: release runtime PM ref on regdomain config failure (git-fixes). - wifi: iwlegacy: fix broadcast stations deallocation (git-fixes). - commit 9bee6d9 - nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() (git-fixes). - nfc: llcp: fix slab-out-of-bounds reads when logging service names (git-fixes). - nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() (git-fixes). - nfc: llcp: fix -ENOMEM on connect with zero-length service name (git-fixes). - nfc: st21nfca: validate ISO15693 inventory length (git-fixes). - nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure (git-fixes). - nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() (git-fixes). - nfc: virtual_ncidev: Add missing ioctl compat handler (git-fixes). - nfc: llcp: Fix race condition in accept_queue lifecycle (git-fixes). - pinctrl: single: free the IRQ on domain creation failure (git-fixes). - pinctrl: meson: Fix typo in s4 group name (git-fixes). - phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting (git-fixes). - phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow (git-fixes). - soundwire: cadence_master: wait and cancel cdns->work before clock stop (git-fixes). - watchdog: msc313e: Fix premature reset during timeout update (git-fixes). - watchdog: msc313e: Propagate error code in resume() (git-fixes). - watchdog: rtd119x: Avoid division by zero (git-fixes). - watchdog: digicolor: Avoid division by zero (git-fixes). - watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() (git-fixes). - commit 75459c6 - nfc: port100: reject frames whose declared length exceeds the received data (git-fixes). - nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() (git-fixes). - nfc: st21nfca: validate received frame size (git-fixes). - nfc: nfcmrvl: validate helper command length before pull (git-fixes). - net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs() (git-fixes). - net: usb: sr9700: include receive overhead in the length check (git-fixes). - net: usb: catc: bound the RX packet length in catc_rx_done() (git-fixes). - mmc: sdhci-of-aspeed: Remove children before releasing SDC resources (git-fixes). - mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt (git-fixes). - mmc: core: Fix OF node reference leak on card add failure (git-fixes). - mmc: sdio_uart: fix xmit_fifo leak when the port table is full (git-fixes). - mmc: spi: reset bytes_xfered before retrying CRC failures (git-fixes). - mmc: sdhci_am654: Reset command and data lines on failed tuning (git-fixes). - mmc: hsq: Fix use-after-free in retry work (git-fixes). - mmc: mxcmmc: cancel data work and watchdog on remove (git-fixes). - mmc: core: Cancel SDIO IRQ work before freeing host (git-fixes). - memstick: ms_block: destroy io_queue workqueue on removal (git-fixes). - net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() (git-fixes). - net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value (git-fixes). - net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain (git-fixes). - commit 5cca5d0 - i2c: imx: release DMA channels on probe error (git-fixes). - i2c: at91: release DMA channels on remove and probe error (git-fixes). - Input: trackpoint - fix the inertia attribute name in the ABI document (git-fixes). - Input: eeti_ts - publish the OF module alias (git-fixes). - Input: xpad - fix PDP Marvel Xbox 360 controller (git-fixes). - Input: soc_button_array - check btns_desc->package.count (git-fixes). - Input: soc_button_array - fix MS Surface Pro 11 probe failure (git-fixes). - Input: cyttsp5 - clamp the HID report size before memcpy (git-fixes). - Input: zero ff_effect before compat copy in input_ff_effect_from_user (git-fixes). - Input: evdev - zero absinfo before partial copy in EVIOCSABS (git-fixes). - Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound (git-fixes). - Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() (git-fixes). - Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 (git-fixes). - Input: adp5588-keys - cache GPIO state before registering the gpiochip (git-fixes). - hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 (git-fixes). - hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding (git-fixes). - KEYS: encrypted: fix integer overflow of datablob_len (git-fixes). - KEYS: trusted: Fix tpm2_load_cmd() boundary check (git-fixes). - keys: fix lost wakeup when reaping a dead key type (git-fixes). - commit 0e85e2f - HID: amd_sfh: Validate PCI BAR size before mapping (git-fixes). - commit dd94b00 - drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach (git-fixes). - drm/virtio: fix NULL pointer dereference on fence allocation failure (git-fixes). - drm/virtio: release the GEM object on virtio_gpu_vram_create() errors (git-fixes). - drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() (git-fixes). - drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() (git-fixes). - drm/virtio: fix object leak when drm_gem_handle_create() fails (git-fixes). - drm/virtio: fix memory leak of fence event on execbuffer failure (git-fixes). - drm/nouveau/disp: don't reject HDMI config on cards without SCDC (git-fixes). - drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() (git-fixes). - drm/nouveau/clk: don't clobber reclock status when restoring volt/fan (git-fixes). - drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update (git-fixes). - drm/nouveau: fix autosuspend cleanup during teardown (git-fixes). - drm/nouveau: fix double-free in nvif_vmm_dtor (git-fixes). - drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() (git-fixes). - drm/nouveau: Fix gem reference leak in validate_init() (git-fixes). - drm/nouveau: Fix bridge reference leak in nv1a_ram_new() (git-fixes). - drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() (git-fixes). - drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init() (git-fixes). - drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init() (git-fixes). - gpio: zynq: fix runtime PM leak on request error path (git-fixes). - gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() (git-fixes). - HID: elecom: fix bus type for M-XGL20DLBK (git-fixes). - HID: alps: fix use-after-free on input2 registration failure (git-fixes). - HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() (git-fixes). - hwmon: (w83793) release probe data through kref (git-fixes). - hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove (git-fixes). - hwmon: (gpio-fan) return IRQ_HANDLED from the shared alarm IRQ handler (git-fixes). - firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (git-fixes). - commit 4569063 - drm/amd/display: Fix dc stream excess put in dm_update_crtc_state() (git-fixes). - drm/i915: fix incorrect RCU teardown order (git-fixes). - Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO (git-fixes). - dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() (git-fixes). - dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA (git-fixes). - dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status (git-fixes). - dmaengine: sun6i: fix non-atomic read of DMA position registers (git-fixes). - dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order (git-fixes). - dmaengine: wait for RCU readers before releasing dma_device (git-fixes). - dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() (git-fixes). - dmaengine: Fix device kref underflow in dma_chan_put() (git-fixes). - dmaengine: sprd: Fix runtime PM reference leak in probe (git-fixes). - dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() (git-fixes). - drm/gud: fix out-of-bounds write in gud_plane_atomic_check() (git-fixes). - drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr (git-fixes). - drm/amdgpu: check ras and obj before dereference (git-fixes). - drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure (git-fixes). - drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL (git-fixes). - drm/msm/adreno: fix autosuspend cleanup during teardown (git-fixes). - commit aa83906 - Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough (git-fixes). - Bluetooth: L2CAP: validate frame length before control and FCS access (git-fixes). - Bluetooth: hci_sock: validate event length before filtering (git-fixes). - Bluetooth: hci_sock: reject out-of-range OCF values (git-fixes). - Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel (git-fixes). - Bluetooth: SMP: reject Security Request over BR/EDR (git-fixes). - Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup (git-fixes). - Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown (git-fixes). - Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access (git-fixes). - Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() (git-fixes). - Bluetooth: hci_sync: Serialize local codec list cleanup (git-fixes). - Bluetooth: hci_codec: validate vendor codec count length (git-fixes). - Bluetooth: coredump: Quiesce dump work on unregister (git-fixes). - Bluetooth: eir: validate service data length before reading UUID (git-fixes). - ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type (git-fixes). - ASoC: hdmi-codec: Report a change when the channel status moves (git-fixes). - ALSA: pcm: set timer->private_data before registering the PCM timer (git-fixes). - ALSA: virtio: reset device before deleting virtqueues (git-fixes). - ALSA: bcd2000: Fix race between rawmidi and disconnect (git-fixes). - commit f4ba940 - bpf: Disable preemption in __bpf_get_stack (CVE-2026-89580 bsc#1280577). - commit d167755 ++++ kernel-rt: - Refresh patches.suse/Bluetooth-ISO-fix-CONNECTED-CLOSED-transition-on-shu.patch (CVE-2026-74541 bsc#1275694) There was a line that should have been dropped, which may lead to the refcount unbalance. Fix it. - commit cb4281b - Add Reviewed-by to patches.suse/drm-vc4-Prevent-shader-BO-mappings-from-becoming-writable.patch - commit 5e98ca7 - arm64: Set __nocfi on swsusp_arch_resume() (bsc#1258298 CVE-2026-23128) - commit 1f11d8b - drm/amdgpu: Fix UVD decode image min size calculation (bsc#1277590 CVE-2026-80540) - commit a46cbeb - sctp: add INIT verification after cookie unpacking (CVE-2026-72398 bsc#1276381). - commit a341e02 - seg6: reset IP6CB after IPv6 decapsulation (CVE-2026-80976 bsc#1280298). - ipv6: seg6: clear IPv4 control block on IPIP decapsulation (CVE-2026-80840 bsc#1279875). - xfrm: ah6: validate routing header segments_left (CVE-2026-80844 bsc#1279786). - net: tun: bound receive headroom (CVE-2026-81000 bsc#1280263). - tipc: read le->link under the node lock in tipc_node_link_down() (CVE-2026-74609 bsc#1277906). - net: smc: fix splice entry lifetime imbalance in smc_rx_splice (CVE-2026-74631 bsc#1278195). - veth: convert frag_list skbs before running XDP (CVE-2026-74476 bsc#1276341). - tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283 bsc#1276475). - commit 0325eb5 - Add Reviewed-by to patches.suse/nvmet-rdma-handle-inline-data-with-a-nonzero-offset.patch - commit 899f38e - bonding: crypto offload enabled, non-offload slave failover, rekey failed (bsc#1282823). - commit f1bfa68 - wifi: brcmsmac: fix UAF in brcms_free_timer() (git-fixes). - wifi: brcmfmac: fix lost 802.1x TX completion wakeup (git-fixes). - wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() (git-fixes). - wifi: virt_wifi: don't transfer operstate before register (git-fixes). - wifi: mac80211: set up the TX info early to fix failure paths (git-fixes). - wifi: mac80211: mesh: release the channel if start fails (git-fixes). - wifi: mac80211: add HE 6 GHz capability in the scan elems len (git-fixes). - wifi: mac80211: don't access the TSF of a down interface (git-fixes). - wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set (git-fixes). - wifi: mac80211: don't allow link changes when iface is down (git-fixes). - wifi: mac80211: require a peer station for TDLS setup confirm (git-fixes). - wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown (git-fixes). - wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() (git-fixes). - wifi: mac80211: unlist vifs when their netdev is unregistered (git-fixes). - wifi: mac80211: only operate on TDLS peers in the TDLS code (git-fixes). - wifi: mac80211: reset state when starting AP fails (git-fixes). - wifi: mac80211: suppress chanctx warning for debugfs reset (git-fixes). - commit e6b6d3b - watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes). - watchdog: da9062: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes). - wifi: mac80211: don't offload TC setup on AP_VLAN interfaces (git-fixes). - wifi: mac80211: don't start a ROC while scanning (git-fixes). - wifi: cfg80211: don't filter by BSS type when removing stale entries (git-fixes). - wifi: cfg80211: only group hidden BSSes with beacon entries (git-fixes). - wifi: cfg80211: check IP header size in cfg80211_classify8021d() (git-fixes). - wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver (git-fixes). - wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST (git-fixes). - wifi: p54: validate curve data length in the calibration curve converters (git-fixes). - wifi: libipw: reject too-short association responses (git-fixes). - wifi: libipw: reject too-short beacon and probe responses (git-fixes). - wifi: mwifiex: validate scan response extents (git-fixes). - wifi: mwifiex: validate action frame fixed fields (git-fixes). - wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length (git-fixes). - wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path (git-fixes). - wifi: virt_wifi: free skb when disconnected (git-fixes). - wifi: wilc1000: fix out-of-bounds read in P2P public action frames (git-fixes). - wifi: wlcore: release runtime PM ref on regdomain config failure (git-fixes). - wifi: iwlegacy: fix broadcast stations deallocation (git-fixes). - commit 9bee6d9 - nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() (git-fixes). - nfc: llcp: fix slab-out-of-bounds reads when logging service names (git-fixes). - nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() (git-fixes). - nfc: llcp: fix -ENOMEM on connect with zero-length service name (git-fixes). - nfc: st21nfca: validate ISO15693 inventory length (git-fixes). - nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure (git-fixes). - nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() (git-fixes). - nfc: virtual_ncidev: Add missing ioctl compat handler (git-fixes). - nfc: llcp: Fix race condition in accept_queue lifecycle (git-fixes). - pinctrl: single: free the IRQ on domain creation failure (git-fixes). - pinctrl: meson: Fix typo in s4 group name (git-fixes). - phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting (git-fixes). - phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow (git-fixes). - soundwire: cadence_master: wait and cancel cdns->work before clock stop (git-fixes). - watchdog: msc313e: Fix premature reset during timeout update (git-fixes). - watchdog: msc313e: Propagate error code in resume() (git-fixes). - watchdog: rtd119x: Avoid division by zero (git-fixes). - watchdog: digicolor: Avoid division by zero (git-fixes). - watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() (git-fixes). - commit 75459c6 - nfc: port100: reject frames whose declared length exceeds the received data (git-fixes). - nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() (git-fixes). - nfc: st21nfca: validate received frame size (git-fixes). - nfc: nfcmrvl: validate helper command length before pull (git-fixes). - net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs() (git-fixes). - net: usb: sr9700: include receive overhead in the length check (git-fixes). - net: usb: catc: bound the RX packet length in catc_rx_done() (git-fixes). - mmc: sdhci-of-aspeed: Remove children before releasing SDC resources (git-fixes). - mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt (git-fixes). - mmc: core: Fix OF node reference leak on card add failure (git-fixes). - mmc: sdio_uart: fix xmit_fifo leak when the port table is full (git-fixes). - mmc: spi: reset bytes_xfered before retrying CRC failures (git-fixes). - mmc: sdhci_am654: Reset command and data lines on failed tuning (git-fixes). - mmc: hsq: Fix use-after-free in retry work (git-fixes). - mmc: mxcmmc: cancel data work and watchdog on remove (git-fixes). - mmc: core: Cancel SDIO IRQ work before freeing host (git-fixes). - memstick: ms_block: destroy io_queue workqueue on removal (git-fixes). - net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() (git-fixes). - net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value (git-fixes). - net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain (git-fixes). - commit 5cca5d0 - i2c: imx: release DMA channels on probe error (git-fixes). - i2c: at91: release DMA channels on remove and probe error (git-fixes). - Input: trackpoint - fix the inertia attribute name in the ABI document (git-fixes). - Input: eeti_ts - publish the OF module alias (git-fixes). - Input: xpad - fix PDP Marvel Xbox 360 controller (git-fixes). - Input: soc_button_array - check btns_desc->package.count (git-fixes). - Input: soc_button_array - fix MS Surface Pro 11 probe failure (git-fixes). - Input: cyttsp5 - clamp the HID report size before memcpy (git-fixes). - Input: zero ff_effect before compat copy in input_ff_effect_from_user (git-fixes). - Input: evdev - zero absinfo before partial copy in EVIOCSABS (git-fixes). - Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound (git-fixes). - Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() (git-fixes). - Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 (git-fixes). - Input: adp5588-keys - cache GPIO state before registering the gpiochip (git-fixes). - hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 (git-fixes). - hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding (git-fixes). - KEYS: encrypted: fix integer overflow of datablob_len (git-fixes). - KEYS: trusted: Fix tpm2_load_cmd() boundary check (git-fixes). - keys: fix lost wakeup when reaping a dead key type (git-fixes). - commit 0e85e2f - HID: amd_sfh: Validate PCI BAR size before mapping (git-fixes). - commit dd94b00 - drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach (git-fixes). - drm/virtio: fix NULL pointer dereference on fence allocation failure (git-fixes). - drm/virtio: release the GEM object on virtio_gpu_vram_create() errors (git-fixes). - drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() (git-fixes). - drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() (git-fixes). - drm/virtio: fix object leak when drm_gem_handle_create() fails (git-fixes). - drm/virtio: fix memory leak of fence event on execbuffer failure (git-fixes). - drm/nouveau/disp: don't reject HDMI config on cards without SCDC (git-fixes). - drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() (git-fixes). - drm/nouveau/clk: don't clobber reclock status when restoring volt/fan (git-fixes). - drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update (git-fixes). - drm/nouveau: fix autosuspend cleanup during teardown (git-fixes). - drm/nouveau: fix double-free in nvif_vmm_dtor (git-fixes). - drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() (git-fixes). - drm/nouveau: Fix gem reference leak in validate_init() (git-fixes). - drm/nouveau: Fix bridge reference leak in nv1a_ram_new() (git-fixes). - drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() (git-fixes). - drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init() (git-fixes). - drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init() (git-fixes). - gpio: zynq: fix runtime PM leak on request error path (git-fixes). - gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() (git-fixes). - HID: elecom: fix bus type for M-XGL20DLBK (git-fixes). - HID: alps: fix use-after-free on input2 registration failure (git-fixes). - HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() (git-fixes). - hwmon: (w83793) release probe data through kref (git-fixes). - hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove (git-fixes). - hwmon: (gpio-fan) return IRQ_HANDLED from the shared alarm IRQ handler (git-fixes). - firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (git-fixes). - commit 4569063 - drm/amd/display: Fix dc stream excess put in dm_update_crtc_state() (git-fixes). - drm/i915: fix incorrect RCU teardown order (git-fixes). - Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO (git-fixes). - dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() (git-fixes). - dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA (git-fixes). - dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status (git-fixes). - dmaengine: sun6i: fix non-atomic read of DMA position registers (git-fixes). - dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order (git-fixes). - dmaengine: wait for RCU readers before releasing dma_device (git-fixes). - dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() (git-fixes). - dmaengine: Fix device kref underflow in dma_chan_put() (git-fixes). - dmaengine: sprd: Fix runtime PM reference leak in probe (git-fixes). - dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() (git-fixes). - drm/gud: fix out-of-bounds write in gud_plane_atomic_check() (git-fixes). - drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr (git-fixes). - drm/amdgpu: check ras and obj before dereference (git-fixes). - drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure (git-fixes). - drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL (git-fixes). - drm/msm/adreno: fix autosuspend cleanup during teardown (git-fixes). - commit aa83906 - Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough (git-fixes). - Bluetooth: L2CAP: validate frame length before control and FCS access (git-fixes). - Bluetooth: hci_sock: validate event length before filtering (git-fixes). - Bluetooth: hci_sock: reject out-of-range OCF values (git-fixes). - Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel (git-fixes). - Bluetooth: SMP: reject Security Request over BR/EDR (git-fixes). - Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup (git-fixes). - Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown (git-fixes). - Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access (git-fixes). - Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() (git-fixes). - Bluetooth: hci_sync: Serialize local codec list cleanup (git-fixes). - Bluetooth: hci_codec: validate vendor codec count length (git-fixes). - Bluetooth: coredump: Quiesce dump work on unregister (git-fixes). - Bluetooth: eir: validate service data length before reading UUID (git-fixes). - ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type (git-fixes). - ASoC: hdmi-codec: Report a change when the channel status moves (git-fixes). - ALSA: pcm: set timer->private_data before registering the PCM timer (git-fixes). - ALSA: virtio: reset device before deleting virtqueues (git-fixes). - ALSA: bcd2000: Fix race between rawmidi and disconnect (git-fixes). - commit f4ba940 - bpf: Disable preemption in __bpf_get_stack (CVE-2026-89580 bsc#1280577). - commit d167755 ++++ kernel-rt_debug: - Refresh patches.suse/Bluetooth-ISO-fix-CONNECTED-CLOSED-transition-on-shu.patch (CVE-2026-74541 bsc#1275694) There was a line that should have been dropped, which may lead to the refcount unbalance. Fix it. - commit cb4281b - Add Reviewed-by to patches.suse/drm-vc4-Prevent-shader-BO-mappings-from-becoming-writable.patch - commit 5e98ca7 - arm64: Set __nocfi on swsusp_arch_resume() (bsc#1258298 CVE-2026-23128) - commit 1f11d8b - drm/amdgpu: Fix UVD decode image min size calculation (bsc#1277590 CVE-2026-80540) - commit a46cbeb - sctp: add INIT verification after cookie unpacking (CVE-2026-72398 bsc#1276381). - commit a341e02 - seg6: reset IP6CB after IPv6 decapsulation (CVE-2026-80976 bsc#1280298). - ipv6: seg6: clear IPv4 control block on IPIP decapsulation (CVE-2026-80840 bsc#1279875). - xfrm: ah6: validate routing header segments_left (CVE-2026-80844 bsc#1279786). - net: tun: bound receive headroom (CVE-2026-81000 bsc#1280263). - tipc: read le->link under the node lock in tipc_node_link_down() (CVE-2026-74609 bsc#1277906). - net: smc: fix splice entry lifetime imbalance in smc_rx_splice (CVE-2026-74631 bsc#1278195). - veth: convert frag_list skbs before running XDP (CVE-2026-74476 bsc#1276341). - tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283 bsc#1276475). - commit 0325eb5 - Add Reviewed-by to patches.suse/nvmet-rdma-handle-inline-data-with-a-nonzero-offset.patch - commit 899f38e - bonding: crypto offload enabled, non-offload slave failover, rekey failed (bsc#1282823). - commit f1bfa68 - wifi: brcmsmac: fix UAF in brcms_free_timer() (git-fixes). - wifi: brcmfmac: fix lost 802.1x TX completion wakeup (git-fixes). - wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() (git-fixes). - wifi: virt_wifi: don't transfer operstate before register (git-fixes). - wifi: mac80211: set up the TX info early to fix failure paths (git-fixes). - wifi: mac80211: mesh: release the channel if start fails (git-fixes). - wifi: mac80211: add HE 6 GHz capability in the scan elems len (git-fixes). - wifi: mac80211: don't access the TSF of a down interface (git-fixes). - wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set (git-fixes). - wifi: mac80211: don't allow link changes when iface is down (git-fixes). - wifi: mac80211: require a peer station for TDLS setup confirm (git-fixes). - wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown (git-fixes). - wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() (git-fixes). - wifi: mac80211: unlist vifs when their netdev is unregistered (git-fixes). - wifi: mac80211: only operate on TDLS peers in the TDLS code (git-fixes). - wifi: mac80211: reset state when starting AP fails (git-fixes). - wifi: mac80211: suppress chanctx warning for debugfs reset (git-fixes). - commit e6b6d3b - watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes). - watchdog: da9062: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes). - wifi: mac80211: don't offload TC setup on AP_VLAN interfaces (git-fixes). - wifi: mac80211: don't start a ROC while scanning (git-fixes). - wifi: cfg80211: don't filter by BSS type when removing stale entries (git-fixes). - wifi: cfg80211: only group hidden BSSes with beacon entries (git-fixes). - wifi: cfg80211: check IP header size in cfg80211_classify8021d() (git-fixes). - wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver (git-fixes). - wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST (git-fixes). - wifi: p54: validate curve data length in the calibration curve converters (git-fixes). - wifi: libipw: reject too-short association responses (git-fixes). - wifi: libipw: reject too-short beacon and probe responses (git-fixes). - wifi: mwifiex: validate scan response extents (git-fixes). - wifi: mwifiex: validate action frame fixed fields (git-fixes). - wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length (git-fixes). - wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path (git-fixes). - wifi: virt_wifi: free skb when disconnected (git-fixes). - wifi: wilc1000: fix out-of-bounds read in P2P public action frames (git-fixes). - wifi: wlcore: release runtime PM ref on regdomain config failure (git-fixes). - wifi: iwlegacy: fix broadcast stations deallocation (git-fixes). - commit 9bee6d9 - nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() (git-fixes). - nfc: llcp: fix slab-out-of-bounds reads when logging service names (git-fixes). - nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() (git-fixes). - nfc: llcp: fix -ENOMEM on connect with zero-length service name (git-fixes). - nfc: st21nfca: validate ISO15693 inventory length (git-fixes). - nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure (git-fixes). - nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() (git-fixes). - nfc: virtual_ncidev: Add missing ioctl compat handler (git-fixes). - nfc: llcp: Fix race condition in accept_queue lifecycle (git-fixes). - pinctrl: single: free the IRQ on domain creation failure (git-fixes). - pinctrl: meson: Fix typo in s4 group name (git-fixes). - phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting (git-fixes). - phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow (git-fixes). - soundwire: cadence_master: wait and cancel cdns->work before clock stop (git-fixes). - watchdog: msc313e: Fix premature reset during timeout update (git-fixes). - watchdog: msc313e: Propagate error code in resume() (git-fixes). - watchdog: rtd119x: Avoid division by zero (git-fixes). - watchdog: digicolor: Avoid division by zero (git-fixes). - watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() (git-fixes). - commit 75459c6 - nfc: port100: reject frames whose declared length exceeds the received data (git-fixes). - nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() (git-fixes). - nfc: st21nfca: validate received frame size (git-fixes). - nfc: nfcmrvl: validate helper command length before pull (git-fixes). - net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs() (git-fixes). - net: usb: sr9700: include receive overhead in the length check (git-fixes). - net: usb: catc: bound the RX packet length in catc_rx_done() (git-fixes). - mmc: sdhci-of-aspeed: Remove children before releasing SDC resources (git-fixes). - mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt (git-fixes). - mmc: core: Fix OF node reference leak on card add failure (git-fixes). - mmc: sdio_uart: fix xmit_fifo leak when the port table is full (git-fixes). - mmc: spi: reset bytes_xfered before retrying CRC failures (git-fixes). - mmc: sdhci_am654: Reset command and data lines on failed tuning (git-fixes). - mmc: hsq: Fix use-after-free in retry work (git-fixes). - mmc: mxcmmc: cancel data work and watchdog on remove (git-fixes). - mmc: core: Cancel SDIO IRQ work before freeing host (git-fixes). - memstick: ms_block: destroy io_queue workqueue on removal (git-fixes). - net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() (git-fixes). - net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value (git-fixes). - net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain (git-fixes). - commit 5cca5d0 - i2c: imx: release DMA channels on probe error (git-fixes). - i2c: at91: release DMA channels on remove and probe error (git-fixes). - Input: trackpoint - fix the inertia attribute name in the ABI document (git-fixes). - Input: eeti_ts - publish the OF module alias (git-fixes). - Input: xpad - fix PDP Marvel Xbox 360 controller (git-fixes). - Input: soc_button_array - check btns_desc->package.count (git-fixes). - Input: soc_button_array - fix MS Surface Pro 11 probe failure (git-fixes). - Input: cyttsp5 - clamp the HID report size before memcpy (git-fixes). - Input: zero ff_effect before compat copy in input_ff_effect_from_user (git-fixes). - Input: evdev - zero absinfo before partial copy in EVIOCSABS (git-fixes). - Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound (git-fixes). - Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() (git-fixes). - Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 (git-fixes). - Input: adp5588-keys - cache GPIO state before registering the gpiochip (git-fixes). - hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 (git-fixes). - hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding (git-fixes). - KEYS: encrypted: fix integer overflow of datablob_len (git-fixes). - KEYS: trusted: Fix tpm2_load_cmd() boundary check (git-fixes). - keys: fix lost wakeup when reaping a dead key type (git-fixes). - commit 0e85e2f - HID: amd_sfh: Validate PCI BAR size before mapping (git-fixes). - commit dd94b00 - drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach (git-fixes). - drm/virtio: fix NULL pointer dereference on fence allocation failure (git-fixes). - drm/virtio: release the GEM object on virtio_gpu_vram_create() errors (git-fixes). - drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() (git-fixes). - drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() (git-fixes). - drm/virtio: fix object leak when drm_gem_handle_create() fails (git-fixes). - drm/virtio: fix memory leak of fence event on execbuffer failure (git-fixes). - drm/nouveau/disp: don't reject HDMI config on cards without SCDC (git-fixes). - drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() (git-fixes). - drm/nouveau/clk: don't clobber reclock status when restoring volt/fan (git-fixes). - drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update (git-fixes). - drm/nouveau: fix autosuspend cleanup during teardown (git-fixes). - drm/nouveau: fix double-free in nvif_vmm_dtor (git-fixes). - drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() (git-fixes). - drm/nouveau: Fix gem reference leak in validate_init() (git-fixes). - drm/nouveau: Fix bridge reference leak in nv1a_ram_new() (git-fixes). - drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() (git-fixes). - drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init() (git-fixes). - drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init() (git-fixes). - gpio: zynq: fix runtime PM leak on request error path (git-fixes). - gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() (git-fixes). - HID: elecom: fix bus type for M-XGL20DLBK (git-fixes). - HID: alps: fix use-after-free on input2 registration failure (git-fixes). - HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() (git-fixes). - hwmon: (w83793) release probe data through kref (git-fixes). - hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove (git-fixes). - hwmon: (gpio-fan) return IRQ_HANDLED from the shared alarm IRQ handler (git-fixes). - firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (git-fixes). - commit 4569063 - drm/amd/display: Fix dc stream excess put in dm_update_crtc_state() (git-fixes). - drm/i915: fix incorrect RCU teardown order (git-fixes). - Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO (git-fixes). - dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() (git-fixes). - dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA (git-fixes). - dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status (git-fixes). - dmaengine: sun6i: fix non-atomic read of DMA position registers (git-fixes). - dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order (git-fixes). - dmaengine: wait for RCU readers before releasing dma_device (git-fixes). - dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() (git-fixes). - dmaengine: Fix device kref underflow in dma_chan_put() (git-fixes). - dmaengine: sprd: Fix runtime PM reference leak in probe (git-fixes). - dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() (git-fixes). - drm/gud: fix out-of-bounds write in gud_plane_atomic_check() (git-fixes). - drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr (git-fixes). - drm/amdgpu: check ras and obj before dereference (git-fixes). - drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure (git-fixes). - drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL (git-fixes). - drm/msm/adreno: fix autosuspend cleanup during teardown (git-fixes). - commit aa83906 - Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough (git-fixes). - Bluetooth: L2CAP: validate frame length before control and FCS access (git-fixes). - Bluetooth: hci_sock: validate event length before filtering (git-fixes). - Bluetooth: hci_sock: reject out-of-range OCF values (git-fixes). - Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel (git-fixes). - Bluetooth: SMP: reject Security Request over BR/EDR (git-fixes). - Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup (git-fixes). - Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown (git-fixes). - Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access (git-fixes). - Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() (git-fixes). - Bluetooth: hci_sync: Serialize local codec list cleanup (git-fixes). - Bluetooth: hci_codec: validate vendor codec count length (git-fixes). - Bluetooth: coredump: Quiesce dump work on unregister (git-fixes). - Bluetooth: eir: validate service data length before reading UUID (git-fixes). - ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type (git-fixes). - ASoC: hdmi-codec: Report a change when the channel status moves (git-fixes). - ALSA: pcm: set timer->private_data before registering the PCM timer (git-fixes). - ALSA: virtio: reset device before deleting virtqueues (git-fixes). - ALSA: bcd2000: Fix race between rawmidi and disconnect (git-fixes). - commit f4ba940 - bpf: Disable preemption in __bpf_get_stack (CVE-2026-89580 bsc#1280577). - commit d167755 ++++ unbound: - Update to 1.26.1: * Fix CVE-2026-81642, Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY. [bsc#1280411] * Fix CVE-2026-81634, Possible heap buffer overflow during DNSSEC canonicalization. [bsc#1280409] * Fix CVE-2026-82717, CNAME synthesis could lead to heap corruption. [bsc#1280412] * Fix CVE-2026-77955, Possible ZONEMD verification bypass window. [bsc#1280404] * Fix CVE-2026-78227, Use-after-free in DoQ stream output buffer on reset re-transmission. [bsc#1280405] * Fix CVE-2026-80225, Possible degradation of service from continuous queries on the same TCP/DoT connection. [bsc#1280406] * Fix CVE-2026-82720, Use-after-free in DoH stream cleanup code path. [bsc#1280413] * Fix CVE-2026-85501, Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC. [bsc#1280414] * Fix CVE-2026-77860, 'serve-expired' can bypass Unbound 'wait-limit'. [bsc#1280403] ------------------------------------------------------------------ ------------------ 2026-9-27 - Sep 27 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - bpf: Reject legacy packet loads from callbacks (CVE-2026-53090 bsc#1269532). - commit e6a7830 - bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge (CVE-2026-53090 bsc#1269532). - commit 8d4968f ++++ kernel-rt: - bpf: Reject legacy packet loads from callbacks (CVE-2026-53090 bsc#1269532). - commit e6a7830 - bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge (CVE-2026-53090 bsc#1269532). - commit 8d4968f ++++ kernel-rt_debug: - bpf: Reject legacy packet loads from callbacks (CVE-2026-53090 bsc#1269532). - commit e6a7830 - bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge (CVE-2026-53090 bsc#1269532). - commit 8d4968f ------------------------------------------------------------------ ------------------ 2026-9-25 - Sep 25 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - perf/core: Fix group leader use-after-free after sibling detach (bsc#1277372 CVE-2026-74637). - perf: Fix dangling cgroup pointer in cpuctx (bsc#1277372 CVE-2026-74637). - commit 9b5b33c - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (CVE-2026-63883 bsc#1272572). - commit 68a0f73 - mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE (CVE-2026-80686 bsc#1278245). - commit 6b980ae - ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() (CVE-2026-72321 bsc#1277143). - commit 5564ec6 - mm/huge_memory: fix huge_zero_pfn race (CVE-2026-74632 bsc#1278199). - commit 00fef75 - igc: remove napi_synchronize() in igc_down() (CVE-2026-80715 bsc#1277840). - tcp: clear sock_ops cb flags before force-closing a child socket (CVE-2026-74268 bsc#1276508). - commit 877422a - xfrm: drop ESP-in-TCP packets with no ingress device (CVE-2026-80846 bsc#1279878). - commit 72f2bbd - sctp: fix NULL deref on untransmitted RECONF completion (CVE-2026-89477 bsc#1280338). - commit a298bf4 - ip: orphan prefetched skbs before multicast forwarding (CVE-2026-89564 bsc#1280797). - commit 07d7c2e - gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free (CVE-2026-89789 bsc#1281226). - commit d1143a0 - net/sched: fq_pie: clamp default quantum to avoid signed overflow (CVE-2026-90074 bsc#1281496). - commit e98a973 - net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (CVE-2026-80842 bsc#1279888). - commit f71111c - xfrm: espintcp: fix UAF during close (CVE-2026-80848 bsc#1279581). - commit 2adb235 - veth: fix NAPI leak in XDP enable error path (CVE-2026-80613 bsc#1278205). - commit f201e4c - Also reflect disabled BATMAN in supported.conf Fixes: 4058797e93cc ("Disable CONFIG_BATMAN_ADV (jsc#PED-16892)") - commit 51f09b2 - mm/page_table_check: skip special zero mappings (CVE-2026-74600 bsc#1277640). - commit 523043f - KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit (CVE-2026-89931 bsc#1281427). - commit 0538601 - l2tp: fix tunnel and session refcount leak on seq_file release (CVE-2026-74735 bsc#1277030). - packet: synchronize pressure clearing with ring reconfiguration (CVE-2026-74666 bsc#1277032). - net/packet: reset the MAC header on the packet-socket transmit path (CVE-2026-74667 bsc#1277396). - commit 3d04598 - kABI fix for: net/sched: reject overly deep qdisc hierarchies (CVE-2026-74663 bsc#1278311). - commit 888b718 ++++ kernel-rt: - perf/core: Fix group leader use-after-free after sibling detach (bsc#1277372 CVE-2026-74637). - perf: Fix dangling cgroup pointer in cpuctx (bsc#1277372 CVE-2026-74637). - commit 9b5b33c - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (CVE-2026-63883 bsc#1272572). - commit 68a0f73 - mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE (CVE-2026-80686 bsc#1278245). - commit 6b980ae - ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() (CVE-2026-72321 bsc#1277143). - commit 5564ec6 - mm/huge_memory: fix huge_zero_pfn race (CVE-2026-74632 bsc#1278199). - commit 00fef75 - igc: remove napi_synchronize() in igc_down() (CVE-2026-80715 bsc#1277840). - tcp: clear sock_ops cb flags before force-closing a child socket (CVE-2026-74268 bsc#1276508). - commit 877422a - xfrm: drop ESP-in-TCP packets with no ingress device (CVE-2026-80846 bsc#1279878). - commit 72f2bbd - sctp: fix NULL deref on untransmitted RECONF completion (CVE-2026-89477 bsc#1280338). - commit a298bf4 - ip: orphan prefetched skbs before multicast forwarding (CVE-2026-89564 bsc#1280797). - commit 07d7c2e - gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free (CVE-2026-89789 bsc#1281226). - commit d1143a0 - net/sched: fq_pie: clamp default quantum to avoid signed overflow (CVE-2026-90074 bsc#1281496). - commit e98a973 - net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (CVE-2026-80842 bsc#1279888). - commit f71111c - xfrm: espintcp: fix UAF during close (CVE-2026-80848 bsc#1279581). - commit 2adb235 - veth: fix NAPI leak in XDP enable error path (CVE-2026-80613 bsc#1278205). - commit f201e4c - Also reflect disabled BATMAN in supported.conf Fixes: 4058797e93cc ("Disable CONFIG_BATMAN_ADV (jsc#PED-16892)") - commit 51f09b2 - mm/page_table_check: skip special zero mappings (CVE-2026-74600 bsc#1277640). - commit 523043f - KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit (CVE-2026-89931 bsc#1281427). - commit 0538601 - l2tp: fix tunnel and session refcount leak on seq_file release (CVE-2026-74735 bsc#1277030). - packet: synchronize pressure clearing with ring reconfiguration (CVE-2026-74666 bsc#1277032). - net/packet: reset the MAC header on the packet-socket transmit path (CVE-2026-74667 bsc#1277396). - commit 3d04598 - kABI fix for: net/sched: reject overly deep qdisc hierarchies (CVE-2026-74663 bsc#1278311). - commit 888b718 ++++ kernel-rt_debug: - perf/core: Fix group leader use-after-free after sibling detach (bsc#1277372 CVE-2026-74637). - perf: Fix dangling cgroup pointer in cpuctx (bsc#1277372 CVE-2026-74637). - commit 9b5b33c - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (CVE-2026-63883 bsc#1272572). - commit 68a0f73 - mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE (CVE-2026-80686 bsc#1278245). - commit 6b980ae - ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() (CVE-2026-72321 bsc#1277143). - commit 5564ec6 - mm/huge_memory: fix huge_zero_pfn race (CVE-2026-74632 bsc#1278199). - commit 00fef75 - igc: remove napi_synchronize() in igc_down() (CVE-2026-80715 bsc#1277840). - tcp: clear sock_ops cb flags before force-closing a child socket (CVE-2026-74268 bsc#1276508). - commit 877422a - xfrm: drop ESP-in-TCP packets with no ingress device (CVE-2026-80846 bsc#1279878). - commit 72f2bbd - sctp: fix NULL deref on untransmitted RECONF completion (CVE-2026-89477 bsc#1280338). - commit a298bf4 - ip: orphan prefetched skbs before multicast forwarding (CVE-2026-89564 bsc#1280797). - commit 07d7c2e - gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free (CVE-2026-89789 bsc#1281226). - commit d1143a0 - net/sched: fq_pie: clamp default quantum to avoid signed overflow (CVE-2026-90074 bsc#1281496). - commit e98a973 - net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (CVE-2026-80842 bsc#1279888). - commit f71111c - xfrm: espintcp: fix UAF during close (CVE-2026-80848 bsc#1279581). - commit 2adb235 - veth: fix NAPI leak in XDP enable error path (CVE-2026-80613 bsc#1278205). - commit f201e4c - Also reflect disabled BATMAN in supported.conf Fixes: 4058797e93cc ("Disable CONFIG_BATMAN_ADV (jsc#PED-16892)") - commit 51f09b2 - mm/page_table_check: skip special zero mappings (CVE-2026-74600 bsc#1277640). - commit 523043f - KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit (CVE-2026-89931 bsc#1281427). - commit 0538601 - l2tp: fix tunnel and session refcount leak on seq_file release (CVE-2026-74735 bsc#1277030). - packet: synchronize pressure clearing with ring reconfiguration (CVE-2026-74666 bsc#1277032). - net/packet: reset the MAC header on the packet-socket transmit path (CVE-2026-74667 bsc#1277396). - commit 3d04598 - kABI fix for: net/sched: reject overly deep qdisc hierarchies (CVE-2026-74663 bsc#1278311). - commit 888b718 ++++ openssl-3: - Security fixes: * CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing (bsc#1280589) * CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves (bsc#1280591) * CVE-2026-77696: Timing Side-Channel in SM2 Signature Generation (bsc#1280598) * CVE-2026-75805: NULL Pointer Dereference in CMP Client Revocation Response Handling (bsc#1280596) * CVE-2026-75806: Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS (bsc#1280597) * CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (bsc#1280587) * Add patches: - openssl-CVE-2026-35189.patch - openssl-CVE-2026-54872-CVE-2026-77696-value_barrier_bn.patch - openssl-CVE-2026-54872-CVE-2026-77696.patch - openssl-CVE-2026-75805.patch - openssl-CVE-2026-75806.patch - openssl-CVE-2026-84782.patch ------------------------------------------------------------------ ------------------ 2026-9-24 - Sep 24 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - Squashfs: check block offset is not negative (CVE-2026-90203 bsc#1281808). - commit 7193887 - sctp: clear new_transport when removing a peer (CVE-2026-74586 bsc#1277820). - commit 71ce2de - sctp: prevent peer transport count overflow (CVE-2026-74469 bsc#1277792). - commit 841e965 - RDMA/irdma: Add refcounting to user ring MRs (CVE-2026-93154 bsc#1282104) - commit 7679a19 - RDMA/irdma: Add irdma_cq fields to track pbl allocations (git-fixes) - commit 9d87c1c - RDMA/irdma: Add a refcount to track user ring MR associations (git-fixes) - commit 6c29cf5 - RDMA/irdma: Deduplicate the irdma_del_memlist logic (git-fixes) - commit 4582d88 - nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() (CVE-2026-90228 bsc#1281717). - commit 94baee4 - Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (CVE-2026-90088 bsc#1281397). - commit ac34b98 - scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011 bsc#1281280). - commit bcce4b2 - fbdev: clear fb_info->mode before deleting a videomode (CVE-2026-80579 bsc#1277260). - commit dc815fb - sctp: hold socket lock when dumping endpoints in sctp_diag (CVE-2026-72447 bsc#1277109). - commit a068482 - RDMA/nldev: validate dynamic counter attribute length (CVE-2026-92523 bsc#1282271) - commit 6839fdd - RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[] (CVE-2026-92525 bsc#1282270) - commit 85b5565 - RDMA/rvt: Return NULL after port allocation failure (CVE-2026-93104 bsc#1282284) - commit 4a5ffa6 - RDMA/rvt: Return NULL after port allocation failure (CVE-2026-93104 bsc#1282284) - commit cd866a4 - IB/isert: reject login PDUs declaring more data than was received (CVE-2026-90413 bsc#1282113) - commit 7bde4c3 - IB/isert: reject PDUs declaring more data than (CVE-2026-90414 bsc#1282110) - commit 0c6af2a - sctp: fix use-after-free of cached ASCONF chunk (CVE-2026-74587 bsc#1277821). - commit 917bd29 - sctp: validate cookie AUTH state before use (CVE-2026-74752 bsc#1278315). - commit d2da870 - net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (CVE-2026-74700 bsc#1277626). - commit 6d191d9 - vhost: fix vhost_get_avail_idx for a non empty ring (bsc#1278063 CVE-2026-74356). - commit 82bf600 - vhost: move smp_rmb() into vhost_get_avail_idx() (bsc#1278063 CVE-2026-74356). - commit c692745 - tools/power/x86/intel-speed-select: Harden daemon pidfile open (CVE-2026-80663 bsc#1278335) - commit 55714f2 - KVM: s390: pci: Fix handling of AIF enable without AISB (CVE-2026-68454 bsc#1276388) - commit 58829dd - s390/zcrypt: Validate length for CCA AES cipher key requests (CVE-2026-68452 bsc#1276295) - commit 63df415 - s390/zcrypt: Validate length for CCA ECC private key requests (CVE-2026-68451 bsc#1276287) - commit 428e36f - s390/dasd: Fix potential NULL pointer dereference (CVE-2026-80679 bsc#1277557) - commit 675f0da - md/raid10: reset read_slot when reusing r10bio for discard (CVE-2026-74376 bsc#1277401) - commit 90bbac1 - s390/monwriter: Reject buffer reuse with different data length (CVE-2026-72025 bsc#1276923) - commit e1efab9 - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CVE-2026-74515 bsc#1275953) - commit a04275d - hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 (CVE-2026-74553 bsc#1275684) - commit 8da484a - hwmon: (nct6775) Fix access to temperature configuration registers (CVE-2024-26730 bsc#1222538) - commit a70fc85 - perf/x86/amd/brs: Fix kernel address leakage (bsc#1277615 CVE-2026-72237). - commit a0d8318 - i2c: core: fix NULL-deref on adapter registration failure (CVE-2026-64589 bsc#1274494). - i2c: core: fix hang on adapter registration failure (CVE-2026-64589 bsc#1274494). - commit 22b9b3a - lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure (CVE-2026-72218 bsc#1277218). - commit f9a9241 - lockd: Plug nlm_file leak when nlm_do_fopen() fails (CVE-2026-72219 bsc#1277217). - commit ed8b904 - net: sungem: fix probe error cleanup (CVE-2026-72406 bsc#1278035). - commit 11a48db - ipv4: fib: Don't dump dying fib_info in fib_leaf_notify() (CVE-2026-74289 bsc#1276461). - commit 1029cc4 - ptp: ocp: Fix board ID over-read (CVE-2026-74603 bsc#1277915). - commit 5a4f3d0 - net/openvswitch: check Ethernet header length in key_extract() (CVE-2026-74701 bsc#1276921). - commit f3b7afc - devlink: fix net namespace reference leak in reload (CVE-2026-74718 bsc#1276573). - commit 7b0e540 - bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor (CVE-2026-74726 bsc#1276565). - commit 062ab8d - enic: fix tx_hang_reset use-after-free on device removal (CVE-2026-74725 bsc#1276563). - commit 4692ce4 - net: gro: properly validate BIG TCP aggregation criteria (CVE-2026-80725 bsc#1277452). - commit 26a989f - ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (CVE-2026-74398 bsc#1277410). - commit 4bbb6e0 ++++ kernel-rt: - Squashfs: check block offset is not negative (CVE-2026-90203 bsc#1281808). - commit 7193887 - sctp: clear new_transport when removing a peer (CVE-2026-74586 bsc#1277820). - commit 71ce2de - sctp: prevent peer transport count overflow (CVE-2026-74469 bsc#1277792). - commit 841e965 - RDMA/irdma: Add refcounting to user ring MRs (CVE-2026-93154 bsc#1282104) - commit 7679a19 - RDMA/irdma: Add irdma_cq fields to track pbl allocations (git-fixes) - commit 9d87c1c - RDMA/irdma: Add a refcount to track user ring MR associations (git-fixes) - commit 6c29cf5 - RDMA/irdma: Deduplicate the irdma_del_memlist logic (git-fixes) - commit 4582d88 - nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() (CVE-2026-90228 bsc#1281717). - commit 94baee4 - Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (CVE-2026-90088 bsc#1281397). - commit ac34b98 - scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011 bsc#1281280). - commit bcce4b2 - fbdev: clear fb_info->mode before deleting a videomode (CVE-2026-80579 bsc#1277260). - commit dc815fb - sctp: hold socket lock when dumping endpoints in sctp_diag (CVE-2026-72447 bsc#1277109). - commit a068482 - RDMA/nldev: validate dynamic counter attribute length (CVE-2026-92523 bsc#1282271) - commit 6839fdd - RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[] (CVE-2026-92525 bsc#1282270) - commit 85b5565 - RDMA/rvt: Return NULL after port allocation failure (CVE-2026-93104 bsc#1282284) - commit 4a5ffa6 - RDMA/rvt: Return NULL after port allocation failure (CVE-2026-93104 bsc#1282284) - commit cd866a4 - IB/isert: reject login PDUs declaring more data than was received (CVE-2026-90413 bsc#1282113) - commit 7bde4c3 - IB/isert: reject PDUs declaring more data than (CVE-2026-90414 bsc#1282110) - commit 0c6af2a - sctp: fix use-after-free of cached ASCONF chunk (CVE-2026-74587 bsc#1277821). - commit 917bd29 - sctp: validate cookie AUTH state before use (CVE-2026-74752 bsc#1278315). - commit d2da870 - net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (CVE-2026-74700 bsc#1277626). - commit 6d191d9 - vhost: fix vhost_get_avail_idx for a non empty ring (bsc#1278063 CVE-2026-74356). - commit 82bf600 - vhost: move smp_rmb() into vhost_get_avail_idx() (bsc#1278063 CVE-2026-74356). - commit c692745 - tools/power/x86/intel-speed-select: Harden daemon pidfile open (CVE-2026-80663 bsc#1278335) - commit 55714f2 - KVM: s390: pci: Fix handling of AIF enable without AISB (CVE-2026-68454 bsc#1276388) - commit 58829dd - s390/zcrypt: Validate length for CCA AES cipher key requests (CVE-2026-68452 bsc#1276295) - commit 63df415 - s390/zcrypt: Validate length for CCA ECC private key requests (CVE-2026-68451 bsc#1276287) - commit 428e36f - s390/dasd: Fix potential NULL pointer dereference (CVE-2026-80679 bsc#1277557) - commit 675f0da - md/raid10: reset read_slot when reusing r10bio for discard (CVE-2026-74376 bsc#1277401) - commit 90bbac1 - s390/monwriter: Reject buffer reuse with different data length (CVE-2026-72025 bsc#1276923) - commit e1efab9 - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CVE-2026-74515 bsc#1275953) - commit a04275d - hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 (CVE-2026-74553 bsc#1275684) - commit 8da484a - hwmon: (nct6775) Fix access to temperature configuration registers (CVE-2024-26730 bsc#1222538) - commit a70fc85 - perf/x86/amd/brs: Fix kernel address leakage (bsc#1277615 CVE-2026-72237). - commit a0d8318 - i2c: core: fix NULL-deref on adapter registration failure (CVE-2026-64589 bsc#1274494). - i2c: core: fix hang on adapter registration failure (CVE-2026-64589 bsc#1274494). - commit 22b9b3a - lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure (CVE-2026-72218 bsc#1277218). - commit f9a9241 - lockd: Plug nlm_file leak when nlm_do_fopen() fails (CVE-2026-72219 bsc#1277217). - commit ed8b904 - net: sungem: fix probe error cleanup (CVE-2026-72406 bsc#1278035). - commit 11a48db - ipv4: fib: Don't dump dying fib_info in fib_leaf_notify() (CVE-2026-74289 bsc#1276461). - commit 1029cc4 - ptp: ocp: Fix board ID over-read (CVE-2026-74603 bsc#1277915). - commit 5a4f3d0 - net/openvswitch: check Ethernet header length in key_extract() (CVE-2026-74701 bsc#1276921). - commit f3b7afc - devlink: fix net namespace reference leak in reload (CVE-2026-74718 bsc#1276573). - commit 7b0e540 - bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor (CVE-2026-74726 bsc#1276565). - commit 062ab8d - enic: fix tx_hang_reset use-after-free on device removal (CVE-2026-74725 bsc#1276563). - commit 4692ce4 - net: gro: properly validate BIG TCP aggregation criteria (CVE-2026-80725 bsc#1277452). - commit 26a989f - ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (CVE-2026-74398 bsc#1277410). - commit 4bbb6e0 ++++ kernel-rt_debug: - Squashfs: check block offset is not negative (CVE-2026-90203 bsc#1281808). - commit 7193887 - sctp: clear new_transport when removing a peer (CVE-2026-74586 bsc#1277820). - commit 71ce2de - sctp: prevent peer transport count overflow (CVE-2026-74469 bsc#1277792). - commit 841e965 - RDMA/irdma: Add refcounting to user ring MRs (CVE-2026-93154 bsc#1282104) - commit 7679a19 - RDMA/irdma: Add irdma_cq fields to track pbl allocations (git-fixes) - commit 9d87c1c - RDMA/irdma: Add a refcount to track user ring MR associations (git-fixes) - commit 6c29cf5 - RDMA/irdma: Deduplicate the irdma_del_memlist logic (git-fixes) - commit 4582d88 - nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() (CVE-2026-90228 bsc#1281717). - commit 94baee4 - Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (CVE-2026-90088 bsc#1281397). - commit ac34b98 - scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011 bsc#1281280). - commit bcce4b2 - fbdev: clear fb_info->mode before deleting a videomode (CVE-2026-80579 bsc#1277260). - commit dc815fb - sctp: hold socket lock when dumping endpoints in sctp_diag (CVE-2026-72447 bsc#1277109). - commit a068482 - RDMA/nldev: validate dynamic counter attribute length (CVE-2026-92523 bsc#1282271) - commit 6839fdd - RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[] (CVE-2026-92525 bsc#1282270) - commit 85b5565 - RDMA/rvt: Return NULL after port allocation failure (CVE-2026-93104 bsc#1282284) - commit 4a5ffa6 - RDMA/rvt: Return NULL after port allocation failure (CVE-2026-93104 bsc#1282284) - commit cd866a4 - IB/isert: reject login PDUs declaring more data than was received (CVE-2026-90413 bsc#1282113) - commit 7bde4c3 - IB/isert: reject PDUs declaring more data than (CVE-2026-90414 bsc#1282110) - commit 0c6af2a - sctp: fix use-after-free of cached ASCONF chunk (CVE-2026-74587 bsc#1277821). - commit 917bd29 - sctp: validate cookie AUTH state before use (CVE-2026-74752 bsc#1278315). - commit d2da870 - net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (CVE-2026-74700 bsc#1277626). - commit 6d191d9 - vhost: fix vhost_get_avail_idx for a non empty ring (bsc#1278063 CVE-2026-74356). - commit 82bf600 - vhost: move smp_rmb() into vhost_get_avail_idx() (bsc#1278063 CVE-2026-74356). - commit c692745 - tools/power/x86/intel-speed-select: Harden daemon pidfile open (CVE-2026-80663 bsc#1278335) - commit 55714f2 - KVM: s390: pci: Fix handling of AIF enable without AISB (CVE-2026-68454 bsc#1276388) - commit 58829dd - s390/zcrypt: Validate length for CCA AES cipher key requests (CVE-2026-68452 bsc#1276295) - commit 63df415 - s390/zcrypt: Validate length for CCA ECC private key requests (CVE-2026-68451 bsc#1276287) - commit 428e36f - s390/dasd: Fix potential NULL pointer dereference (CVE-2026-80679 bsc#1277557) - commit 675f0da - md/raid10: reset read_slot when reusing r10bio for discard (CVE-2026-74376 bsc#1277401) - commit 90bbac1 - s390/monwriter: Reject buffer reuse with different data length (CVE-2026-72025 bsc#1276923) - commit e1efab9 - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CVE-2026-74515 bsc#1275953) - commit a04275d - hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 (CVE-2026-74553 bsc#1275684) - commit 8da484a - hwmon: (nct6775) Fix access to temperature configuration registers (CVE-2024-26730 bsc#1222538) - commit a70fc85 - perf/x86/amd/brs: Fix kernel address leakage (bsc#1277615 CVE-2026-72237). - commit a0d8318 - i2c: core: fix NULL-deref on adapter registration failure (CVE-2026-64589 bsc#1274494). - i2c: core: fix hang on adapter registration failure (CVE-2026-64589 bsc#1274494). - commit 22b9b3a - lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure (CVE-2026-72218 bsc#1277218). - commit f9a9241 - lockd: Plug nlm_file leak when nlm_do_fopen() fails (CVE-2026-72219 bsc#1277217). - commit ed8b904 - net: sungem: fix probe error cleanup (CVE-2026-72406 bsc#1278035). - commit 11a48db - ipv4: fib: Don't dump dying fib_info in fib_leaf_notify() (CVE-2026-74289 bsc#1276461). - commit 1029cc4 - ptp: ocp: Fix board ID over-read (CVE-2026-74603 bsc#1277915). - commit 5a4f3d0 - net/openvswitch: check Ethernet header length in key_extract() (CVE-2026-74701 bsc#1276921). - commit f3b7afc - devlink: fix net namespace reference leak in reload (CVE-2026-74718 bsc#1276573). - commit 7b0e540 - bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor (CVE-2026-74726 bsc#1276565). - commit 062ab8d - enic: fix tx_hang_reset use-after-free on device removal (CVE-2026-74725 bsc#1276563). - commit 4692ce4 - net: gro: properly validate BIG TCP aggregation criteria (CVE-2026-80725 bsc#1277452). - commit 26a989f - ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (CVE-2026-74398 bsc#1277410). - commit 4bbb6e0 ++++ rpcbind: - - Bound stats lists in rpcbs_getaddr() and rpcbs_rmtcall() (bsc#1282326, CVE-2026-94640) * add 0001-rpcbind-bound-stats-lists-in-rpcbs_getaddr-and-rpcbs.patch ------------------------------------------------------------------ ------------------ 2026-9-23 - Sep 23 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen (CVE-2026-74267 bsc#1276519). - commit 7e2f2db - net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480 bsc#1276353). - commit b38738e - ALSA: core: Fix use-after-free in snd_card_do_free() (CVE-2026-90198 bsc#1281818) - commit 0a9bebf - drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (CVE-2026-72449 bsc#1278108) - commit 8c433de - gue: validate REMCSUM private option length (CVE-2026-72351 bsc#1276009) - commit b001306 - dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098 bsc#1275543) - commit 0cd8a88 - wifi: mac80211: fix fils_discovery double free on alloc failure (CVE-2026-64570 bsc#1274010) - commit 6a5b3f0 - btrfs: fix extent map leak in NOCOW direct I/O write (CVE-2026-89644 bsc#1281054). - commit 8e1ec88 - ring-buffer: Use current_context for safe per-CPU buffer swap (CVE-2026-74601 bsc#1277896). - commit f8244b9 - ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() (bsc#1277896). - commit 1d7e2dc - ipv6: mcast: Fix potential UAF in MLD delayed work (CVE-2026-72322 bsc#1275972). - commit f1d4991 - RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables (git-fixes) - commit fa3bbc0 - Add Reviewed-by to patches.suse/Bluetooth-L2CAP-fix-UAF-in-l2cap_le_connect_rsp.patch - commit 257d71e - KVM: nVMX: Service local TLB flushes on failed nested VM-Enter (CVE-2026-89930 bsc#1281359). - commit 1a1852a - KVM: arm64: vgic: Don't leak the SPI array when init is retried (git-fixes). - commit 42f9a20 - KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save (CVE-2026-89912 bsc#1281201). - commit 4a347a6 - KVM: nVMX: Always flush vpid02 on first use (git-fixes). - commit 6f40531 - RDMA/erdma: Hold QP references for AE and CM processing (CVE-2026-90308 bsc#1281786) - commit c0ab2c1 - RDMA/erdma: Hold CQ references when processing EQ events (CVE-2026-90309 bsc#1281789) - commit 7029edb - RDMA/cma: Fix WARNING in res_to_rt (CVE-2026-90218 bsc#1281795) - commit 9d4a505 - RDMA/siw: Fix use-after-free in siw_accept() (CVE-2026-90292 bsc#1281777) - commit 53e2e55 - IB/isert: post the full-feature receive buffers after session registration (CVE-2026-90293 bsc#1281778) - commit 0e8e547 - IB/isert: delay the final Login Response until the session is registered (CVE-2026-90294 bsc#1281732) - commit 787e6d0 - btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() (bsc#1281680 CVE-2026-90259). - commit 3acec13 ++++ kernel-rt: - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen (CVE-2026-74267 bsc#1276519). - commit 7e2f2db - net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480 bsc#1276353). - commit b38738e - ALSA: core: Fix use-after-free in snd_card_do_free() (CVE-2026-90198 bsc#1281818) - commit 0a9bebf - drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (CVE-2026-72449 bsc#1278108) - commit 8c433de - gue: validate REMCSUM private option length (CVE-2026-72351 bsc#1276009) - commit b001306 - dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098 bsc#1275543) - commit 0cd8a88 - wifi: mac80211: fix fils_discovery double free on alloc failure (CVE-2026-64570 bsc#1274010) - commit 6a5b3f0 - btrfs: fix extent map leak in NOCOW direct I/O write (CVE-2026-89644 bsc#1281054). - commit 8e1ec88 - ring-buffer: Use current_context for safe per-CPU buffer swap (CVE-2026-74601 bsc#1277896). - commit f8244b9 - ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() (bsc#1277896). - commit 1d7e2dc - ipv6: mcast: Fix potential UAF in MLD delayed work (CVE-2026-72322 bsc#1275972). - commit f1d4991 - RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables (git-fixes) - commit fa3bbc0 - Add Reviewed-by to patches.suse/Bluetooth-L2CAP-fix-UAF-in-l2cap_le_connect_rsp.patch - commit 257d71e - KVM: nVMX: Service local TLB flushes on failed nested VM-Enter (CVE-2026-89930 bsc#1281359). - commit 1a1852a - KVM: arm64: vgic: Don't leak the SPI array when init is retried (git-fixes). - commit 42f9a20 - KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save (CVE-2026-89912 bsc#1281201). - commit 4a347a6 - KVM: nVMX: Always flush vpid02 on first use (git-fixes). - commit 6f40531 - RDMA/erdma: Hold QP references for AE and CM processing (CVE-2026-90308 bsc#1281786) - commit c0ab2c1 - RDMA/erdma: Hold CQ references when processing EQ events (CVE-2026-90309 bsc#1281789) - commit 7029edb - RDMA/cma: Fix WARNING in res_to_rt (CVE-2026-90218 bsc#1281795) - commit 9d4a505 - RDMA/siw: Fix use-after-free in siw_accept() (CVE-2026-90292 bsc#1281777) - commit 53e2e55 - IB/isert: post the full-feature receive buffers after session registration (CVE-2026-90293 bsc#1281778) - commit 0e8e547 - IB/isert: delay the final Login Response until the session is registered (CVE-2026-90294 bsc#1281732) - commit 787e6d0 - btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() (bsc#1281680 CVE-2026-90259). - commit 3acec13 ++++ kernel-rt_debug: - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen (CVE-2026-74267 bsc#1276519). - commit 7e2f2db - net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480 bsc#1276353). - commit b38738e - ALSA: core: Fix use-after-free in snd_card_do_free() (CVE-2026-90198 bsc#1281818) - commit 0a9bebf - drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (CVE-2026-72449 bsc#1278108) - commit 8c433de - gue: validate REMCSUM private option length (CVE-2026-72351 bsc#1276009) - commit b001306 - dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098 bsc#1275543) - commit 0cd8a88 - wifi: mac80211: fix fils_discovery double free on alloc failure (CVE-2026-64570 bsc#1274010) - commit 6a5b3f0 - btrfs: fix extent map leak in NOCOW direct I/O write (CVE-2026-89644 bsc#1281054). - commit 8e1ec88 - ring-buffer: Use current_context for safe per-CPU buffer swap (CVE-2026-74601 bsc#1277896). - commit f8244b9 - ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() (bsc#1277896). - commit 1d7e2dc - ipv6: mcast: Fix potential UAF in MLD delayed work (CVE-2026-72322 bsc#1275972). - commit f1d4991 - RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables (git-fixes) - commit fa3bbc0 - Add Reviewed-by to patches.suse/Bluetooth-L2CAP-fix-UAF-in-l2cap_le_connect_rsp.patch - commit 257d71e - KVM: nVMX: Service local TLB flushes on failed nested VM-Enter (CVE-2026-89930 bsc#1281359). - commit 1a1852a - KVM: arm64: vgic: Don't leak the SPI array when init is retried (git-fixes). - commit 42f9a20 - KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save (CVE-2026-89912 bsc#1281201). - commit 4a347a6 - KVM: nVMX: Always flush vpid02 on first use (git-fixes). - commit 6f40531 - RDMA/erdma: Hold QP references for AE and CM processing (CVE-2026-90308 bsc#1281786) - commit c0ab2c1 - RDMA/erdma: Hold CQ references when processing EQ events (CVE-2026-90309 bsc#1281789) - commit 7029edb - RDMA/cma: Fix WARNING in res_to_rt (CVE-2026-90218 bsc#1281795) - commit 9d4a505 - RDMA/siw: Fix use-after-free in siw_accept() (CVE-2026-90292 bsc#1281777) - commit 53e2e55 - IB/isert: post the full-feature receive buffers after session registration (CVE-2026-90293 bsc#1281778) - commit 0e8e547 - IB/isert: delay the final Login Response until the session is registered (CVE-2026-90294 bsc#1281732) - commit 787e6d0 - btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() (bsc#1281680 CVE-2026-90259). - commit 3acec13 ++++ libX11: - 0001-1281653_CVE-2026-94283_ximcp-bound-XIM_OPEN_REPLY-attribute-lengths-to-the-.patch * Out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser (boo#1281653, CVE-2026-94283) - 0002-1281657_CVE-2026-94284_ximcp-bound-XIM_REGISTER_TRIGGERKEYS-keylist-lengths.patch * Out-of-bounds read vulnerability in libX11's XIM trigger-keyregistration parser.registration parser (boo#1281657, CVE-2026-94284) - 0003-1281661_CVE-2026-94285_lcGenConv-bound-byteM_parse_codeset-reads-to-remaini.patch * Out-of-bounds read in libX11's byte-oriented codeset parser (boo#1281661, CVE-2026-94285) ------------------------------------------------------------------ ------------------ 2026-9-22 - Sep 22 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - NFSv4: remove callback IDR entry on client allocation failure (CVE-2026-90151 bsc#1281599). - commit effdd01 - NFSv4.1: zero referring call lists before decoding (CVE-2026-90104 bsc#1281546). - commit 836f548 - drm/vc4: Zero the tile state data array before each BIN job (CVE-2026-74453 bsc#1278178). - commit 7064782 - svcrdma: Reject connection when transport allocation fails (CVE-2026-89531 bsc#1281738). - commit ceb04e7 - smb: client: harden DFS cache against invalid target hints (git-fixes). - commit 6503dc9 - KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU (CVE-2026-89929 bsc#1281358). - commit d7399bb - KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 (CVE-2026-89929 bsc#1281358). - commit d81abd4 - KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables (CVE-2026-89913 bsc#1281202). - commit 3f4be75 - Refresh patches.suse/smb-client-clear-setuid-setgid-bit-on-write-with-cifsacl-modefroms.patch. - commit e937836 - HID: bpf: Fix hid_bpf_get_data() range check (CVE-2026-72352 bsc#1277823). - commit 9a08d29 - smb: client: reject a tree connect response whose byte count is too small (bsc#1280496 CVE-2026-89631). - commit dd24277 - smb: client: clear ce->tgthint in free_tgts() (bsc#1281042 CVE-2026-89636). - commit 2790072 - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (bsc#1281046 CVE-2026-89638). - commit 9ba20ad - btrfs: check if root is readonly when setting posix acl (CVE-2026-90263 bsc#1281922). - commit 8ce751c - drm/amd/pm: fix pptable use-after-free (CVE-2026-74450 bsc#1278216). - commit 91f5f5d - Fif selftests build failure caused by jsc#PED-16401 backport (bsc#1281927). - selftests: tls: add getsockopt test (bsc#1267564 jsc#PED-16401). - Refresh patches.suse/selftests-tls-add-key_generation-argument-to-tls_cry.patch. - Refresh patches.suse/selftests-tls-add-rekey-tests.patch. - commit 08972aa - nvmet-auth: Synchronize timeout work during SQ teardown (bsc#1281231 CVE-2026-89970). - nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350 CVE-2026-89482). - nvmet-auth: reject short AUTH_RECEIVE buffers (bsc#1275549 CVE-2026-72130). - nvdimm/btt: Handle preemption in BTT lane acquisition (bsc#1278225 CVE-2026-74365). - nvmet-tcp: fix page fragment cache leak in error path (bsc#1277098 CVE-2026-74386). - nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985 CVE-2026-46304). - nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807 CVE-2026-43448). - nvmet: Introduce nvmet_req_transfer_len() (bsc#1275549 CVE-2026-72130). - commit b833fdc - nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350 CVE-2026-89482). - commit 7a2ae4a - nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke (CVE-2026-89686 bsc#1280184). - commit 7f7f72e - SUNRPC: Check svc pool percpu counter allocation (CVE-2026-89547 bsc#1280548). - commit 399a8fe - NFSD: check truncate permission under inode lock (CVE-2026-89713 bsc#1280872). - commit ced8349 - tcp: fix TFO max_qlen accounting across reuseport migration (CVE-2026-74696 bsc#1276930). - commit 0db8078 - nvmet-tcp: check return value of nvmet_tcp_set_queue_sock (CVE-2026-74385 bsc#1278255) - commit cea45fd - nvme-multipath: fix flex array size in struct nvme_ns_head (CVE-2026-74384 bsc#1277405) - commit 826ad80 ++++ kernel-rt: - NFSv4: remove callback IDR entry on client allocation failure (CVE-2026-90151 bsc#1281599). - commit effdd01 - NFSv4.1: zero referring call lists before decoding (CVE-2026-90104 bsc#1281546). - commit 836f548 - drm/vc4: Zero the tile state data array before each BIN job (CVE-2026-74453 bsc#1278178). - commit 7064782 - svcrdma: Reject connection when transport allocation fails (CVE-2026-89531 bsc#1281738). - commit ceb04e7 - smb: client: harden DFS cache against invalid target hints (git-fixes). - commit 6503dc9 - KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU (CVE-2026-89929 bsc#1281358). - commit d7399bb - KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 (CVE-2026-89929 bsc#1281358). - commit d81abd4 - KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables (CVE-2026-89913 bsc#1281202). - commit 3f4be75 - Refresh patches.suse/smb-client-clear-setuid-setgid-bit-on-write-with-cifsacl-modefroms.patch. - commit e937836 - HID: bpf: Fix hid_bpf_get_data() range check (CVE-2026-72352 bsc#1277823). - commit 9a08d29 - smb: client: reject a tree connect response whose byte count is too small (bsc#1280496 CVE-2026-89631). - commit dd24277 - smb: client: clear ce->tgthint in free_tgts() (bsc#1281042 CVE-2026-89636). - commit 2790072 - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (bsc#1281046 CVE-2026-89638). - commit 9ba20ad - btrfs: check if root is readonly when setting posix acl (CVE-2026-90263 bsc#1281922). - commit 8ce751c - drm/amd/pm: fix pptable use-after-free (CVE-2026-74450 bsc#1278216). - commit 91f5f5d - Fif selftests build failure caused by jsc#PED-16401 backport (bsc#1281927). - selftests: tls: add getsockopt test (bsc#1267564 jsc#PED-16401). - Refresh patches.suse/selftests-tls-add-key_generation-argument-to-tls_cry.patch. - Refresh patches.suse/selftests-tls-add-rekey-tests.patch. - commit 08972aa - nvmet-auth: Synchronize timeout work during SQ teardown (bsc#1281231 CVE-2026-89970). - nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350 CVE-2026-89482). - nvmet-auth: reject short AUTH_RECEIVE buffers (bsc#1275549 CVE-2026-72130). - nvdimm/btt: Handle preemption in BTT lane acquisition (bsc#1278225 CVE-2026-74365). - nvmet-tcp: fix page fragment cache leak in error path (bsc#1277098 CVE-2026-74386). - nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985 CVE-2026-46304). - nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807 CVE-2026-43448). - nvmet: Introduce nvmet_req_transfer_len() (bsc#1275549 CVE-2026-72130). - commit b833fdc - nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350 CVE-2026-89482). - commit 7a2ae4a - nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke (CVE-2026-89686 bsc#1280184). - commit 7f7f72e - SUNRPC: Check svc pool percpu counter allocation (CVE-2026-89547 bsc#1280548). - commit 399a8fe - NFSD: check truncate permission under inode lock (CVE-2026-89713 bsc#1280872). - commit ced8349 - tcp: fix TFO max_qlen accounting across reuseport migration (CVE-2026-74696 bsc#1276930). - commit 0db8078 - nvmet-tcp: check return value of nvmet_tcp_set_queue_sock (CVE-2026-74385 bsc#1278255) - commit cea45fd - nvme-multipath: fix flex array size in struct nvme_ns_head (CVE-2026-74384 bsc#1277405) - commit 826ad80 ++++ kernel-rt_debug: - NFSv4: remove callback IDR entry on client allocation failure (CVE-2026-90151 bsc#1281599). - commit effdd01 - NFSv4.1: zero referring call lists before decoding (CVE-2026-90104 bsc#1281546). - commit 836f548 - drm/vc4: Zero the tile state data array before each BIN job (CVE-2026-74453 bsc#1278178). - commit 7064782 - svcrdma: Reject connection when transport allocation fails (CVE-2026-89531 bsc#1281738). - commit ceb04e7 - smb: client: harden DFS cache against invalid target hints (git-fixes). - commit 6503dc9 - KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU (CVE-2026-89929 bsc#1281358). - commit d7399bb - KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 (CVE-2026-89929 bsc#1281358). - commit d81abd4 - KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables (CVE-2026-89913 bsc#1281202). - commit 3f4be75 - Refresh patches.suse/smb-client-clear-setuid-setgid-bit-on-write-with-cifsacl-modefroms.patch. - commit e937836 - HID: bpf: Fix hid_bpf_get_data() range check (CVE-2026-72352 bsc#1277823). - commit 9a08d29 - smb: client: reject a tree connect response whose byte count is too small (bsc#1280496 CVE-2026-89631). - commit dd24277 - smb: client: clear ce->tgthint in free_tgts() (bsc#1281042 CVE-2026-89636). - commit 2790072 - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (bsc#1281046 CVE-2026-89638). - commit 9ba20ad - btrfs: check if root is readonly when setting posix acl (CVE-2026-90263 bsc#1281922). - commit 8ce751c - drm/amd/pm: fix pptable use-after-free (CVE-2026-74450 bsc#1278216). - commit 91f5f5d - Fif selftests build failure caused by jsc#PED-16401 backport (bsc#1281927). - selftests: tls: add getsockopt test (bsc#1267564 jsc#PED-16401). - Refresh patches.suse/selftests-tls-add-key_generation-argument-to-tls_cry.patch. - Refresh patches.suse/selftests-tls-add-rekey-tests.patch. - commit 08972aa - nvmet-auth: Synchronize timeout work during SQ teardown (bsc#1281231 CVE-2026-89970). - nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350 CVE-2026-89482). - nvmet-auth: reject short AUTH_RECEIVE buffers (bsc#1275549 CVE-2026-72130). - nvdimm/btt: Handle preemption in BTT lane acquisition (bsc#1278225 CVE-2026-74365). - nvmet-tcp: fix page fragment cache leak in error path (bsc#1277098 CVE-2026-74386). - nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985 CVE-2026-46304). - nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807 CVE-2026-43448). - nvmet: Introduce nvmet_req_transfer_len() (bsc#1275549 CVE-2026-72130). - commit b833fdc - nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350 CVE-2026-89482). - commit 7a2ae4a - nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke (CVE-2026-89686 bsc#1280184). - commit 7f7f72e - SUNRPC: Check svc pool percpu counter allocation (CVE-2026-89547 bsc#1280548). - commit 399a8fe - NFSD: check truncate permission under inode lock (CVE-2026-89713 bsc#1280872). - commit ced8349 - tcp: fix TFO max_qlen accounting across reuseport migration (CVE-2026-74696 bsc#1276930). - commit 0db8078 - nvmet-tcp: check return value of nvmet_tcp_set_queue_sock (CVE-2026-74385 bsc#1278255) - commit cea45fd - nvme-multipath: fix flex array size in struct nvme_ns_head (CVE-2026-74384 bsc#1277405) - commit 826ad80 ++++ expat: - update to 2.8.5 (bsc#1282347, CVE-2026-93990, jsc#PED-16154): * Security fixes: * CVE-2026-93990: reject high surrogates not followed by a low surrogate during UTF-16 decoding; malformed UTF-16 could be smuggled into the application (CVSS 9.8) * Bug fixes: * Fix an OOM-related memory leak on a failed overflow check * Fix memory alignment for architectures with 128bit pointers * Mark XML_SetHashSalt deprecated * drop expat-CVE-2026-32776.patch, expat-CVE-2026-32777.patch and expat-CVE-2026-32778.patch, fixed upstream in 2.7.5 ------------------------------------------------------------------ ------------------ 2026-9-21 - Sep 21 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - ipv6: prevent in6_dev_get() from resurrecting inet6_dev (CVE-2026-74630 bsc#1278191). - commit 684542a - net/smc: fix socket use-after-free during link group termination (CVE-2026-74493 bsc#1276338). - commit c07d43c - vxlan: use pskb_network_may_pull() in route_shortcircuit() (CVE-2026-74473 bsc#1276340). - commit c26fefa - sctp: clear control chunk transport if it is being removed (CVE-2026-74688 bsc#1277489). - commit 3f1d079 - ip6_tunnel: clear skb2->cb in ip6ip6_err() (CVE-2026-74597 bsc#1277493). - commit 66d9fbc - sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588 bsc#1277766). - commit 3796623 - bpf, sockmap: Fix sk_redir use-after-free in send verdict (CVE-2026-74589 bsc#1277904). - commit f29c89a - qede: Fix NULL pointer dereference in TPA fragment processing (CVE-2026-89511 bsc#1280508). - tcp: clamp route advmss to TCP_MIN_MSS (CVE-2026-80847 bsc#1279850). - bnxt_en: Disable EOP for TPA on all chips to prevent data corruption (CVE-2026-74697 bsc#1277897). - bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips (CVE-2026-74697 bsc#1277897). - commit d6657b1 - netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (CVE-2026-72348 bsc#1276007). - commit 896d9ed - s390/qeth: Check CAP_NET_ADMIN for private ioctls (CVE-2026-74467 bsc#1277805). - commit dbbc138 - net/9p: fix infinite loop in p9_client_rpc on fatal signal (CVE-2026-72166 bsc#1277556). - commit 2d43178 - netfilter: xt_cluster: reject template conntracks in hash match (CVE-2026-72256 bsc#1277674). - commit ad78049 - netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (CVE-2026-72435 bsc#1278056). - commit 4694d6e - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (CVE-2026-72433 bsc#1278053). - commit 5d4d7b7 - tipc: restrict socket queue dumps in enqueue tracepoints (CVE-2026-72299 bsc#1275924). - commit d9f6c93 - tipc: avoid use-after-free in poll trace queue dumps (CVE-2026-74490 bsc#1276352). - commit 0ca6ab3 - net: fib_rules: Don't dump dying fib_rule in fib_rules_dump() (CVE-2026-74288 bsc#1276460). - commit 99720cb - net/sched: cls_flow: Dont expose folded kernel pointers (CVE-2026-74290 bsc#1276462). - commit 87d06f1 - sockmap: Fix use-after-free in udp_bpf_recvmsg() (CVE-2026-74257 bsc#1276532). - commit b0a3ef5 - sctp: fix err_chunk memory leaks in INIT handling (CVE-2026-72413 bsc#1277122). - commit cc3e677 - netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types (CVE-2026-72436 bsc#1277245). - netfilter: ipset: annotate "pos" for concurrent readers/writers (CVE-2026-72436 bsc#1277245). - netfilter: ipset: Fix data race between add and dump in all hash types (CVE-2026-72436 bsc#1277245). - commit 044aa5b - flow_dissector: check device type before reading ETH_ADDRS (CVE-2026-72444 bsc#1278100). - commit 9a30132 - bpf: Add missing access_ok call to copy_user_syms (CVE-2026-80865 bsc#1279527). - commit 6425918 - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() (CVE-2026-74689 bsc#1278314). - commit 2329bbc - ima: fix out-of-bounds read in xattr_verify() (CVE-2026-74671 bsc#1277392). - commit 790d267 - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers (CVE-2026-64528 bsc#1272847). - commit 86a3cb3 - RDMA/ipoib: Drain RCU callbacks during module teardown (CVE-2026-93108 bsc#1281408) - commit 16e56fd - RDMA/mlx5: Drain RCU callbacks during module teardown (CVE-2026-93109 bsc#1281379) - commit fef8bfb - RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state (CVE-2026-93107 bsc#1281399) - commit 7939dc6 - RDMA/core: Wait for RCU callbacks before unloading ib_core (CVE-2026-93110 bsc#1281387) - commit a5746d1 - nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE (CVE-2026-89665 bsc#1281057). - commit 85cdc75 - Fix logic error in users of mana_gd_alloc_memory - add bugreference to existing mana changes (bsc#1281085, bsc#1281010). - net: mana: restore the XDP program pointer when pre-allocation fails (git-fixes). - net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() (git-fixes). - net: mana: Reserve extra CQ slot for the fence completion CQE (git-fixes). - commit cfe6256 - tipc: reject inverted service ranges from peer bindings (CVE-2026-74281 bsc#1276474). - commit 3c68ca4 - svcrdma: Fix offset arithmetic in read_chunk_range (CVE-2026-89533 bsc#1280993). - commit 05d353b - nfsd: validate symlink target length in NFSv4 CREATE (CVE-2026-89699 bsc#1281077). - commit 359e306 - Add Reviewed-by to patches.suse/xfrm6-clear-dst.dev-on-error-to-avoid-double-netdev_put-in.patch - commit 8cea71d - firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (git-fixes) - commit 9aaf119 - arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation (git-fixes) - commit c7c83de - arm64: percpu: Fix this_cpu_write() casting (git-fixes) - commit da647c4 - arm64: percpu: Fix this_cpu_and() mask generation (git-fixes) - commit 4ae7aab - arm64: percpu: Fix LSE operations on {8,16}-bit types (git-fixes) - commit fb18931 - arm64: Use load LSE atomics for the non-return per-CPU atomic operations (git-fixes) - commit 06c9a3e - arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc (git-fixes) - commit 238a3fb ++++ kernel-rt: - ipv6: prevent in6_dev_get() from resurrecting inet6_dev (CVE-2026-74630 bsc#1278191). - commit 684542a - net/smc: fix socket use-after-free during link group termination (CVE-2026-74493 bsc#1276338). - commit c07d43c - vxlan: use pskb_network_may_pull() in route_shortcircuit() (CVE-2026-74473 bsc#1276340). - commit c26fefa - sctp: clear control chunk transport if it is being removed (CVE-2026-74688 bsc#1277489). - commit 3f1d079 - ip6_tunnel: clear skb2->cb in ip6ip6_err() (CVE-2026-74597 bsc#1277493). - commit 66d9fbc - sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588 bsc#1277766). - commit 3796623 - bpf, sockmap: Fix sk_redir use-after-free in send verdict (CVE-2026-74589 bsc#1277904). - commit f29c89a - qede: Fix NULL pointer dereference in TPA fragment processing (CVE-2026-89511 bsc#1280508). - tcp: clamp route advmss to TCP_MIN_MSS (CVE-2026-80847 bsc#1279850). - bnxt_en: Disable EOP for TPA on all chips to prevent data corruption (CVE-2026-74697 bsc#1277897). - bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips (CVE-2026-74697 bsc#1277897). - commit d6657b1 - netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (CVE-2026-72348 bsc#1276007). - commit 896d9ed - s390/qeth: Check CAP_NET_ADMIN for private ioctls (CVE-2026-74467 bsc#1277805). - commit dbbc138 - net/9p: fix infinite loop in p9_client_rpc on fatal signal (CVE-2026-72166 bsc#1277556). - commit 2d43178 - netfilter: xt_cluster: reject template conntracks in hash match (CVE-2026-72256 bsc#1277674). - commit ad78049 - netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (CVE-2026-72435 bsc#1278056). - commit 4694d6e - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (CVE-2026-72433 bsc#1278053). - commit 5d4d7b7 - tipc: restrict socket queue dumps in enqueue tracepoints (CVE-2026-72299 bsc#1275924). - commit d9f6c93 - tipc: avoid use-after-free in poll trace queue dumps (CVE-2026-74490 bsc#1276352). - commit 0ca6ab3 - net: fib_rules: Don't dump dying fib_rule in fib_rules_dump() (CVE-2026-74288 bsc#1276460). - commit 99720cb - net/sched: cls_flow: Dont expose folded kernel pointers (CVE-2026-74290 bsc#1276462). - commit 87d06f1 - sockmap: Fix use-after-free in udp_bpf_recvmsg() (CVE-2026-74257 bsc#1276532). - commit b0a3ef5 - sctp: fix err_chunk memory leaks in INIT handling (CVE-2026-72413 bsc#1277122). - commit cc3e677 - netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types (CVE-2026-72436 bsc#1277245). - netfilter: ipset: annotate "pos" for concurrent readers/writers (CVE-2026-72436 bsc#1277245). - netfilter: ipset: Fix data race between add and dump in all hash types (CVE-2026-72436 bsc#1277245). - commit 044aa5b - flow_dissector: check device type before reading ETH_ADDRS (CVE-2026-72444 bsc#1278100). - commit 9a30132 - bpf: Add missing access_ok call to copy_user_syms (CVE-2026-80865 bsc#1279527). - commit 6425918 - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() (CVE-2026-74689 bsc#1278314). - commit 2329bbc - ima: fix out-of-bounds read in xattr_verify() (CVE-2026-74671 bsc#1277392). - commit 790d267 - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers (CVE-2026-64528 bsc#1272847). - commit 86a3cb3 - RDMA/ipoib: Drain RCU callbacks during module teardown (CVE-2026-93108 bsc#1281408) - commit 16e56fd - RDMA/mlx5: Drain RCU callbacks during module teardown (CVE-2026-93109 bsc#1281379) - commit fef8bfb - RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state (CVE-2026-93107 bsc#1281399) - commit 7939dc6 - RDMA/core: Wait for RCU callbacks before unloading ib_core (CVE-2026-93110 bsc#1281387) - commit a5746d1 - nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE (CVE-2026-89665 bsc#1281057). - commit 85cdc75 - Fix logic error in users of mana_gd_alloc_memory - add bugreference to existing mana changes (bsc#1281085, bsc#1281010). - net: mana: restore the XDP program pointer when pre-allocation fails (git-fixes). - net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() (git-fixes). - net: mana: Reserve extra CQ slot for the fence completion CQE (git-fixes). - commit cfe6256 - tipc: reject inverted service ranges from peer bindings (CVE-2026-74281 bsc#1276474). - commit 3c68ca4 - svcrdma: Fix offset arithmetic in read_chunk_range (CVE-2026-89533 bsc#1280993). - commit 05d353b - nfsd: validate symlink target length in NFSv4 CREATE (CVE-2026-89699 bsc#1281077). - commit 359e306 - Add Reviewed-by to patches.suse/xfrm6-clear-dst.dev-on-error-to-avoid-double-netdev_put-in.patch - commit 8cea71d - firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (git-fixes) - commit 9aaf119 - arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation (git-fixes) - commit c7c83de - arm64: percpu: Fix this_cpu_write() casting (git-fixes) - commit da647c4 - arm64: percpu: Fix this_cpu_and() mask generation (git-fixes) - commit 4ae7aab - arm64: percpu: Fix LSE operations on {8,16}-bit types (git-fixes) - commit fb18931 - arm64: Use load LSE atomics for the non-return per-CPU atomic operations (git-fixes) - commit 06c9a3e - arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc (git-fixes) - commit 238a3fb ++++ kernel-rt_debug: - ipv6: prevent in6_dev_get() from resurrecting inet6_dev (CVE-2026-74630 bsc#1278191). - commit 684542a - net/smc: fix socket use-after-free during link group termination (CVE-2026-74493 bsc#1276338). - commit c07d43c - vxlan: use pskb_network_may_pull() in route_shortcircuit() (CVE-2026-74473 bsc#1276340). - commit c26fefa - sctp: clear control chunk transport if it is being removed (CVE-2026-74688 bsc#1277489). - commit 3f1d079 - ip6_tunnel: clear skb2->cb in ip6ip6_err() (CVE-2026-74597 bsc#1277493). - commit 66d9fbc - sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588 bsc#1277766). - commit 3796623 - bpf, sockmap: Fix sk_redir use-after-free in send verdict (CVE-2026-74589 bsc#1277904). - commit f29c89a - qede: Fix NULL pointer dereference in TPA fragment processing (CVE-2026-89511 bsc#1280508). - tcp: clamp route advmss to TCP_MIN_MSS (CVE-2026-80847 bsc#1279850). - bnxt_en: Disable EOP for TPA on all chips to prevent data corruption (CVE-2026-74697 bsc#1277897). - bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips (CVE-2026-74697 bsc#1277897). - commit d6657b1 - netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (CVE-2026-72348 bsc#1276007). - commit 896d9ed - s390/qeth: Check CAP_NET_ADMIN for private ioctls (CVE-2026-74467 bsc#1277805). - commit dbbc138 - net/9p: fix infinite loop in p9_client_rpc on fatal signal (CVE-2026-72166 bsc#1277556). - commit 2d43178 - netfilter: xt_cluster: reject template conntracks in hash match (CVE-2026-72256 bsc#1277674). - commit ad78049 - netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (CVE-2026-72435 bsc#1278056). - commit 4694d6e - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (CVE-2026-72433 bsc#1278053). - commit 5d4d7b7 - tipc: restrict socket queue dumps in enqueue tracepoints (CVE-2026-72299 bsc#1275924). - commit d9f6c93 - tipc: avoid use-after-free in poll trace queue dumps (CVE-2026-74490 bsc#1276352). - commit 0ca6ab3 - net: fib_rules: Don't dump dying fib_rule in fib_rules_dump() (CVE-2026-74288 bsc#1276460). - commit 99720cb - net/sched: cls_flow: Dont expose folded kernel pointers (CVE-2026-74290 bsc#1276462). - commit 87d06f1 - sockmap: Fix use-after-free in udp_bpf_recvmsg() (CVE-2026-74257 bsc#1276532). - commit b0a3ef5 - sctp: fix err_chunk memory leaks in INIT handling (CVE-2026-72413 bsc#1277122). - commit cc3e677 - netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types (CVE-2026-72436 bsc#1277245). - netfilter: ipset: annotate "pos" for concurrent readers/writers (CVE-2026-72436 bsc#1277245). - netfilter: ipset: Fix data race between add and dump in all hash types (CVE-2026-72436 bsc#1277245). - commit 044aa5b - flow_dissector: check device type before reading ETH_ADDRS (CVE-2026-72444 bsc#1278100). - commit 9a30132 - bpf: Add missing access_ok call to copy_user_syms (CVE-2026-80865 bsc#1279527). - commit 6425918 - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() (CVE-2026-74689 bsc#1278314). - commit 2329bbc - ima: fix out-of-bounds read in xattr_verify() (CVE-2026-74671 bsc#1277392). - commit 790d267 - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers (CVE-2026-64528 bsc#1272847). - commit 86a3cb3 - RDMA/ipoib: Drain RCU callbacks during module teardown (CVE-2026-93108 bsc#1281408) - commit 16e56fd - RDMA/mlx5: Drain RCU callbacks during module teardown (CVE-2026-93109 bsc#1281379) - commit fef8bfb - RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state (CVE-2026-93107 bsc#1281399) - commit 7939dc6 - RDMA/core: Wait for RCU callbacks before unloading ib_core (CVE-2026-93110 bsc#1281387) - commit a5746d1 - nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE (CVE-2026-89665 bsc#1281057). - commit 85cdc75 - Fix logic error in users of mana_gd_alloc_memory - add bugreference to existing mana changes (bsc#1281085, bsc#1281010). - net: mana: restore the XDP program pointer when pre-allocation fails (git-fixes). - net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() (git-fixes). - net: mana: Reserve extra CQ slot for the fence completion CQE (git-fixes). - commit cfe6256 - tipc: reject inverted service ranges from peer bindings (CVE-2026-74281 bsc#1276474). - commit 3c68ca4 - svcrdma: Fix offset arithmetic in read_chunk_range (CVE-2026-89533 bsc#1280993). - commit 05d353b - nfsd: validate symlink target length in NFSv4 CREATE (CVE-2026-89699 bsc#1281077). - commit 359e306 - Add Reviewed-by to patches.suse/xfrm6-clear-dst.dev-on-error-to-avoid-double-netdev_put-in.patch - commit 8cea71d - firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (git-fixes) - commit 9aaf119 - arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation (git-fixes) - commit c7c83de - arm64: percpu: Fix this_cpu_write() casting (git-fixes) - commit da647c4 - arm64: percpu: Fix this_cpu_and() mask generation (git-fixes) - commit 4ae7aab - arm64: percpu: Fix LSE operations on {8,16}-bit types (git-fixes) - commit fb18931 - arm64: Use load LSE atomics for the non-return per-CPU atomic operations (git-fixes) - commit 06c9a3e - arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc (git-fixes) - commit 238a3fb ------------------------------------------------------------------ ------------------ 2026-9-18 - Sep 18 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - wifi: ieee80211: validate MLE common info length (CVE-2026-68471 bsc#1276504). - commit 6b62b27 - smb: client: Fix use-after-free in cifs_try_adding_channels() (bsc#1277796 CVE-2026-74608). - commit 443e6c0 - svcrdma: Fix pcl_for_each_segment for empty chunks (CVE-2026-89532 bsc#1280985). - commit 4f7c679 - ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump (CVE-2026-72392 bsc#1277128). - commit 1999559 - SUNRPC: fix gssx_dec_option_array error path bugs (CVE-2026-89544 bsc#1280758). - commit d0ad67a ++++ kernel-rt: - wifi: ieee80211: validate MLE common info length (CVE-2026-68471 bsc#1276504). - commit 6b62b27 - smb: client: Fix use-after-free in cifs_try_adding_channels() (bsc#1277796 CVE-2026-74608). - commit 443e6c0 - svcrdma: Fix pcl_for_each_segment for empty chunks (CVE-2026-89532 bsc#1280985). - commit 4f7c679 - ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump (CVE-2026-72392 bsc#1277128). - commit 1999559 - SUNRPC: fix gssx_dec_option_array error path bugs (CVE-2026-89544 bsc#1280758). - commit d0ad67a ++++ kernel-rt_debug: - wifi: ieee80211: validate MLE common info length (CVE-2026-68471 bsc#1276504). - commit 6b62b27 - smb: client: Fix use-after-free in cifs_try_adding_channels() (bsc#1277796 CVE-2026-74608). - commit 443e6c0 - svcrdma: Fix pcl_for_each_segment for empty chunks (CVE-2026-89532 bsc#1280985). - commit 4f7c679 - ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump (CVE-2026-72392 bsc#1277128). - commit 1999559 - SUNRPC: fix gssx_dec_option_array error path bugs (CVE-2026-89544 bsc#1280758). - commit d0ad67a ++++ libX11: - u_xkb-Check-the-keysym-range-in-_XkbReadKeyActions-CVE.patch * libX11 XkbGetMap Reply Heap-based Buffer Overflow (CVE-2026-88806, ZDI-CAN-32061, bsc#1280910) ++++ libtpms: - CVE-2026-85769: Fixed heap out-of-bounds read in TPM2 state unmarshalling via unchecked block_skip_read() blocksize (bsc#1279628) - libtpms-CVE-2026-85769.patch ++++ swtpm: - CVE-2026-75900: Fixed Out-of-bounds read in SWTPM_NVRAM_CheckHeader due to sizeof(pointer) vs sizeof(struct) mismatch (bsc#1275653) Added: 0001-swtpm-Fix-length-check-in-SWTPM_NVRAM_CheckHeader.patch ------------------------------------------------------------------ ------------------ 2026-9-17 - Sep 17 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - RDMA/hns: Fix log flood after cmd_mbox failure (CVE-2026-74389 bsc#1278087) - commit abb35da - iommu/vt-d: Force requesting ACS when tboot is enabled (CVE-2026-89448 bsc#1280379). - commit b1082d9 - wifi: ath11k: fix stride mismatch in mac_phy_caps_parse() (git-fixes). - wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() (git-fixes). - commit 9350897 - netfilter: nf_conncount: fix zone comparison in tuple dedup (CVE-2026-72247 bsc#1277662). - commit 7ec3d97 - net: bridge: mrp: fix uninitialised bytes on the wire (CVE-2026-74659 bsc#1277296). - commit 6cbc431 - rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (CVE-2025-38704 bsc#1254408) - commit fb6e2de - netfilter: ebt_nflog: pin the NFLOG backend (CVE-2026-74660 bsc#1277272). - commit 97adcd3 - SUNRPC: svcauth_gss: enforce krb5 token minimum length (CVE-2026-89550 bsc#1280726). - commit 56718d7 - ipmi:ssif: NULL thread on error (git-fixes). - commit 3471a0c - SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (CVE-2026-89551 bsc#1280727). - commit 2cb717a - SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (CVE-2026-89538 bsc#1280716). - commit 7ace303 - IB/mlx5: Properly support implicit ODP rereg_mr (CVE-2026-80880 bsc#1279497) - commit 6b8698f - net/sched: reject overly deep qdisc hierarchies (CVE-2026-74663 bsc#1278311). - net/sched: cls_u32: skip hash tables in u32_bind_class() (CVE-2026-74739 bsc#1278247). - net: openvswitch: fix potential UAF on meter attach failure (CVE-2026-74465 bsc#1277801). - tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283 bsc#1276475). - commit 5426c50 - SUNRPC: reject duplicate CREDS_VALUE options (CVE-2026-89539 bsc#1280717). - commit 88ac089 - sunrpc: init gssp_lock before publishing proc entry (CVE-2026-89540 bsc#1280719). - commit 53e6c16 - NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock (CVE-2026-89712 bsc#1280870). - commit 228011b - SUNRPC: wait for in-flight client TLS handshake callback (CVE-2026-89536 bsc#1280711). - commit 0559bcc - sctp: fix auth_hmacs array size in struct sctp_cookie (CVE-2026-68376 bsc#1274836). Cherry-pick resolved automatically by custom merge drivers: - series.conf: series_merge_tool - commit 50f0a10 - iommu/sva: Set handle->dev before the SVA handle is visible (CVE-2026-89451 bsc#1280383). - commit 7bf8953 - slip: fix use-after-free in sl_sync() (CVE-2026-81001 bsc#1280375). - commit d3dfc4d - mptcp: fastopen: only mark MPTFO subflows with SYN data (CVE-2026-80585 bsc#1277342). - commit 73404d3 - xsk: require at least 16 bytes of TX metadata (CVE-2026-74710 bsc#1276579). - commit e5bd36b - netfilter: xt_nat: reject unsupported target families (CVE-2026-80664 bsc#1277555). - commit 2488196 - ipv4: reject undersized MTUs in ip_do_fragment() (CVE-2026-80793 bsc#1279799). - commit 12af8a4 - nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (CVE-2026-80799 bsc#1279811). - commit 4346f89 - ipmi:ssif: Clean up kthread on errors (CVE-2026-46044 bsc#1267464). - commit e90e98b - bnxt_en: use irq_update_affinity_hint() (bsc#1280750). - commit ee522a1 - sctp: avoid auth_enable sysctl UAF during netns teardown (git-fixes CVE-2026-68162 bsc#1274920). - commit bc542e1 - nfsd: size fh_verify server sockaddr slot by xpt_locallen (CVE-2026-89702 bsc#1280487). - commit 64f3d19 ++++ kernel-rt: - RDMA/hns: Fix log flood after cmd_mbox failure (CVE-2026-74389 bsc#1278087) - commit abb35da - iommu/vt-d: Force requesting ACS when tboot is enabled (CVE-2026-89448 bsc#1280379). - commit b1082d9 - wifi: ath11k: fix stride mismatch in mac_phy_caps_parse() (git-fixes). - wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() (git-fixes). - commit 9350897 - netfilter: nf_conncount: fix zone comparison in tuple dedup (CVE-2026-72247 bsc#1277662). - commit 7ec3d97 - net: bridge: mrp: fix uninitialised bytes on the wire (CVE-2026-74659 bsc#1277296). - commit 6cbc431 - rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (CVE-2025-38704 bsc#1254408) - commit fb6e2de - netfilter: ebt_nflog: pin the NFLOG backend (CVE-2026-74660 bsc#1277272). - commit 97adcd3 - SUNRPC: svcauth_gss: enforce krb5 token minimum length (CVE-2026-89550 bsc#1280726). - commit 56718d7 - ipmi:ssif: NULL thread on error (git-fixes). - commit 3471a0c - SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (CVE-2026-89551 bsc#1280727). - commit 2cb717a - SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (CVE-2026-89538 bsc#1280716). - commit 7ace303 - IB/mlx5: Properly support implicit ODP rereg_mr (CVE-2026-80880 bsc#1279497) - commit 6b8698f - net/sched: reject overly deep qdisc hierarchies (CVE-2026-74663 bsc#1278311). - net/sched: cls_u32: skip hash tables in u32_bind_class() (CVE-2026-74739 bsc#1278247). - net: openvswitch: fix potential UAF on meter attach failure (CVE-2026-74465 bsc#1277801). - tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283 bsc#1276475). - commit 5426c50 - SUNRPC: reject duplicate CREDS_VALUE options (CVE-2026-89539 bsc#1280717). - commit 88ac089 - sunrpc: init gssp_lock before publishing proc entry (CVE-2026-89540 bsc#1280719). - commit 53e6c16 - NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock (CVE-2026-89712 bsc#1280870). - commit 228011b - SUNRPC: wait for in-flight client TLS handshake callback (CVE-2026-89536 bsc#1280711). - commit 0559bcc - sctp: fix auth_hmacs array size in struct sctp_cookie (CVE-2026-68376 bsc#1274836). Cherry-pick resolved automatically by custom merge drivers: - series.conf: series_merge_tool - commit 50f0a10 - iommu/sva: Set handle->dev before the SVA handle is visible (CVE-2026-89451 bsc#1280383). - commit 7bf8953 - slip: fix use-after-free in sl_sync() (CVE-2026-81001 bsc#1280375). - commit d3dfc4d - mptcp: fastopen: only mark MPTFO subflows with SYN data (CVE-2026-80585 bsc#1277342). - commit 73404d3 - xsk: require at least 16 bytes of TX metadata (CVE-2026-74710 bsc#1276579). - commit e5bd36b - netfilter: xt_nat: reject unsupported target families (CVE-2026-80664 bsc#1277555). - commit 2488196 - ipv4: reject undersized MTUs in ip_do_fragment() (CVE-2026-80793 bsc#1279799). - commit 12af8a4 - nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (CVE-2026-80799 bsc#1279811). - commit 4346f89 - ipmi:ssif: Clean up kthread on errors (CVE-2026-46044 bsc#1267464). - commit e90e98b - bnxt_en: use irq_update_affinity_hint() (bsc#1280750). - commit ee522a1 - sctp: avoid auth_enable sysctl UAF during netns teardown (git-fixes CVE-2026-68162 bsc#1274920). - commit bc542e1 - nfsd: size fh_verify server sockaddr slot by xpt_locallen (CVE-2026-89702 bsc#1280487). - commit 64f3d19 ++++ kernel-rt_debug: - RDMA/hns: Fix log flood after cmd_mbox failure (CVE-2026-74389 bsc#1278087) - commit abb35da - iommu/vt-d: Force requesting ACS when tboot is enabled (CVE-2026-89448 bsc#1280379). - commit b1082d9 - wifi: ath11k: fix stride mismatch in mac_phy_caps_parse() (git-fixes). - wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() (git-fixes). - commit 9350897 - netfilter: nf_conncount: fix zone comparison in tuple dedup (CVE-2026-72247 bsc#1277662). - commit 7ec3d97 - net: bridge: mrp: fix uninitialised bytes on the wire (CVE-2026-74659 bsc#1277296). - commit 6cbc431 - rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (CVE-2025-38704 bsc#1254408) - commit fb6e2de - netfilter: ebt_nflog: pin the NFLOG backend (CVE-2026-74660 bsc#1277272). - commit 97adcd3 - SUNRPC: svcauth_gss: enforce krb5 token minimum length (CVE-2026-89550 bsc#1280726). - commit 56718d7 - ipmi:ssif: NULL thread on error (git-fixes). - commit 3471a0c - SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (CVE-2026-89551 bsc#1280727). - commit 2cb717a - SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (CVE-2026-89538 bsc#1280716). - commit 7ace303 - IB/mlx5: Properly support implicit ODP rereg_mr (CVE-2026-80880 bsc#1279497) - commit 6b8698f - net/sched: reject overly deep qdisc hierarchies (CVE-2026-74663 bsc#1278311). - net/sched: cls_u32: skip hash tables in u32_bind_class() (CVE-2026-74739 bsc#1278247). - net: openvswitch: fix potential UAF on meter attach failure (CVE-2026-74465 bsc#1277801). - tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283 bsc#1276475). - commit 5426c50 - SUNRPC: reject duplicate CREDS_VALUE options (CVE-2026-89539 bsc#1280717). - commit 88ac089 - sunrpc: init gssp_lock before publishing proc entry (CVE-2026-89540 bsc#1280719). - commit 53e6c16 - NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock (CVE-2026-89712 bsc#1280870). - commit 228011b - SUNRPC: wait for in-flight client TLS handshake callback (CVE-2026-89536 bsc#1280711). - commit 0559bcc - sctp: fix auth_hmacs array size in struct sctp_cookie (CVE-2026-68376 bsc#1274836). Cherry-pick resolved automatically by custom merge drivers: - series.conf: series_merge_tool - commit 50f0a10 - iommu/sva: Set handle->dev before the SVA handle is visible (CVE-2026-89451 bsc#1280383). - commit 7bf8953 - slip: fix use-after-free in sl_sync() (CVE-2026-81001 bsc#1280375). - commit d3dfc4d - mptcp: fastopen: only mark MPTFO subflows with SYN data (CVE-2026-80585 bsc#1277342). - commit 73404d3 - xsk: require at least 16 bytes of TX metadata (CVE-2026-74710 bsc#1276579). - commit e5bd36b - netfilter: xt_nat: reject unsupported target families (CVE-2026-80664 bsc#1277555). - commit 2488196 - ipv4: reject undersized MTUs in ip_do_fragment() (CVE-2026-80793 bsc#1279799). - commit 12af8a4 - nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (CVE-2026-80799 bsc#1279811). - commit 4346f89 - ipmi:ssif: Clean up kthread on errors (CVE-2026-46044 bsc#1267464). - commit e90e98b - bnxt_en: use irq_update_affinity_hint() (bsc#1280750). - commit ee522a1 - sctp: avoid auth_enable sysctl UAF during netns teardown (git-fixes CVE-2026-68162 bsc#1274920). - commit bc542e1 - nfsd: size fh_verify server sockaddr slot by xpt_locallen (CVE-2026-89702 bsc#1280487). - commit 64f3d19 ++++ python311-core: - CVE-2026-15310: bound zipfile decompression for bzip2/LZMA (bsc#1277111, gh#python/cpython#156002) CVE-2026-15310-bound-zipfile-decompression.patch ++++ python311: - CVE-2026-15310: bound zipfile decompression for bzip2/LZMA (bsc#1277111, gh#python/cpython#156002) CVE-2026-15310-bound-zipfile-decompression.patch ------------------------------------------------------------------ ------------------ 2026-9-16 - Sep 16 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (CVE-2026-89542 bsc#1280387). - commit ccf9291 - NFSD: Prevent lock owner use-after-free during client teardown (CVE-2026-89662 bsc#1280509). - commit 6e2e774 - nfsd: revoke copy-notify stateids before dropping their reference (CVE-2026-89663 bsc#1280518). - commit e59abd6 - NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path (CVE-2026-89710 bsc#1280455). - commit c08c0d2 - nfsd: sample writeback error cursor before async COPY loop (CVE-2026-89704 bsc#1280490). - commit a2e50e6 - nfsd: release path refs on follow_down() error (CVE-2026-89707 bsc#1280468). - commit 2b5b99d - SUNRPC: always drain cache_cleaner before destroying a cache_detail (CVE-2026-89548 bsc#1280546). - commit c82c291 - SUNRPC: harden gss_unwrap_resp_priv length checks (CVE-2026-89541 bsc#1280388). - commit 2a02265 - RDMA/cxgb4: Cancel reg_work before freeing device on remove (CVE-2026-89510 bsc#1280551) - commit bcf91bc - RDMA/ucma: Lock the handler in ucma_set_ib_path() (CVE-2026-89508 bsc#1280544) - commit 503c4ef - netfilter: ipset: do not update comments from kernel-side hash adds (CVE-2026-74492 bsc#1276337). - commit 5e1a3d5 - netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH (CVE-2026-74564 bsc#1275567). - commit 907d2c3 - netfilter: nft_payload: fix mask build for partial field offload (CVE-2026-74579 bsc#1275559). - commit b29536e - kabi: nvdimm/btt: kABI fixup for BTT lane acquisition preemption handling (CVE-2026-74365 bsc#1278225). - commit a512c7d - Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release (CVE-2026-74541 bsc#1275694). - Refresh patches.suse/Bluetooth-ISO-hold-sk-properly-in-iso_conn_ready.patch. - commit a7aaa9b - Bluetooth: ISO: clear iso_data always when detaching conn from hcon (CVE-2026-74541 bsc#1275694). - commit cd93cb0 - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (CVE-2026-63963 bsc#1272471) - commit 10f6e38 - USB: serial: cypress_m8: fix memory corruption with small endpoint (CVE-2026-63956 bsc#1272473) - commit d462ba9 - kprobes: avoid crash when rmmod/insmod after ftrace killed (CVE-2026-43409 bsc#1264747). - commit 0aed5a3 - i2c: i801: fix hardware state machine corruption in error path (CVE-2026-64205 bsc#1272215) - commit 43f8ce6 - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (CVE-2026-53384 bsc#1271817) - commit 5d74040 - ipvs: fix more places with wrong ipv6 transport offsets (CVE-2026-68477 bsc#1275495). - commit 2d4609a - net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains (CVE-2026-68441 bsc#1274776). - commit 177c9f9 - drm/v3d: Serialize the scheduler timeout handlers (bsc#1277374 CVE-2026-74638) - commit b173f36 - xfrm: Check for underflow in xfrm_state_mtu (CVE-2026-64009 bsc#1273879). - commit 5215d17 ++++ kernel-rt: - SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (CVE-2026-89542 bsc#1280387). - commit ccf9291 - NFSD: Prevent lock owner use-after-free during client teardown (CVE-2026-89662 bsc#1280509). - commit 6e2e774 - nfsd: revoke copy-notify stateids before dropping their reference (CVE-2026-89663 bsc#1280518). - commit e59abd6 - NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path (CVE-2026-89710 bsc#1280455). - commit c08c0d2 - nfsd: sample writeback error cursor before async COPY loop (CVE-2026-89704 bsc#1280490). - commit a2e50e6 - nfsd: release path refs on follow_down() error (CVE-2026-89707 bsc#1280468). - commit 2b5b99d - SUNRPC: always drain cache_cleaner before destroying a cache_detail (CVE-2026-89548 bsc#1280546). - commit c82c291 - SUNRPC: harden gss_unwrap_resp_priv length checks (CVE-2026-89541 bsc#1280388). - commit 2a02265 - RDMA/cxgb4: Cancel reg_work before freeing device on remove (CVE-2026-89510 bsc#1280551) - commit bcf91bc - RDMA/ucma: Lock the handler in ucma_set_ib_path() (CVE-2026-89508 bsc#1280544) - commit 503c4ef - netfilter: ipset: do not update comments from kernel-side hash adds (CVE-2026-74492 bsc#1276337). - commit 5e1a3d5 - netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH (CVE-2026-74564 bsc#1275567). - commit 907d2c3 - netfilter: nft_payload: fix mask build for partial field offload (CVE-2026-74579 bsc#1275559). - commit b29536e - kabi: nvdimm/btt: kABI fixup for BTT lane acquisition preemption handling (CVE-2026-74365 bsc#1278225). - commit a512c7d - Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release (CVE-2026-74541 bsc#1275694). - Refresh patches.suse/Bluetooth-ISO-hold-sk-properly-in-iso_conn_ready.patch. - commit a7aaa9b - Bluetooth: ISO: clear iso_data always when detaching conn from hcon (CVE-2026-74541 bsc#1275694). - commit cd93cb0 - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (CVE-2026-63963 bsc#1272471) - commit 10f6e38 - USB: serial: cypress_m8: fix memory corruption with small endpoint (CVE-2026-63956 bsc#1272473) - commit d462ba9 - kprobes: avoid crash when rmmod/insmod after ftrace killed (CVE-2026-43409 bsc#1264747). - commit 0aed5a3 - i2c: i801: fix hardware state machine corruption in error path (CVE-2026-64205 bsc#1272215) - commit 43f8ce6 - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (CVE-2026-53384 bsc#1271817) - commit 5d74040 - ipvs: fix more places with wrong ipv6 transport offsets (CVE-2026-68477 bsc#1275495). - commit 2d4609a - net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains (CVE-2026-68441 bsc#1274776). - commit 177c9f9 - drm/v3d: Serialize the scheduler timeout handlers (bsc#1277374 CVE-2026-74638) - commit b173f36 - xfrm: Check for underflow in xfrm_state_mtu (CVE-2026-64009 bsc#1273879). - commit 5215d17 ++++ kernel-rt_debug: - SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (CVE-2026-89542 bsc#1280387). - commit ccf9291 - NFSD: Prevent lock owner use-after-free during client teardown (CVE-2026-89662 bsc#1280509). - commit 6e2e774 - nfsd: revoke copy-notify stateids before dropping their reference (CVE-2026-89663 bsc#1280518). - commit e59abd6 - NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path (CVE-2026-89710 bsc#1280455). - commit c08c0d2 - nfsd: sample writeback error cursor before async COPY loop (CVE-2026-89704 bsc#1280490). - commit a2e50e6 - nfsd: release path refs on follow_down() error (CVE-2026-89707 bsc#1280468). - commit 2b5b99d - SUNRPC: always drain cache_cleaner before destroying a cache_detail (CVE-2026-89548 bsc#1280546). - commit c82c291 - SUNRPC: harden gss_unwrap_resp_priv length checks (CVE-2026-89541 bsc#1280388). - commit 2a02265 - RDMA/cxgb4: Cancel reg_work before freeing device on remove (CVE-2026-89510 bsc#1280551) - commit bcf91bc - RDMA/ucma: Lock the handler in ucma_set_ib_path() (CVE-2026-89508 bsc#1280544) - commit 503c4ef - netfilter: ipset: do not update comments from kernel-side hash adds (CVE-2026-74492 bsc#1276337). - commit 5e1a3d5 - netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH (CVE-2026-74564 bsc#1275567). - commit 907d2c3 - netfilter: nft_payload: fix mask build for partial field offload (CVE-2026-74579 bsc#1275559). - commit b29536e - kabi: nvdimm/btt: kABI fixup for BTT lane acquisition preemption handling (CVE-2026-74365 bsc#1278225). - commit a512c7d - Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release (CVE-2026-74541 bsc#1275694). - Refresh patches.suse/Bluetooth-ISO-hold-sk-properly-in-iso_conn_ready.patch. - commit a7aaa9b - Bluetooth: ISO: clear iso_data always when detaching conn from hcon (CVE-2026-74541 bsc#1275694). - commit cd93cb0 - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (CVE-2026-63963 bsc#1272471) - commit 10f6e38 - USB: serial: cypress_m8: fix memory corruption with small endpoint (CVE-2026-63956 bsc#1272473) - commit d462ba9 - kprobes: avoid crash when rmmod/insmod after ftrace killed (CVE-2026-43409 bsc#1264747). - commit 0aed5a3 - i2c: i801: fix hardware state machine corruption in error path (CVE-2026-64205 bsc#1272215) - commit 43f8ce6 - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (CVE-2026-53384 bsc#1271817) - commit 5d74040 - ipvs: fix more places with wrong ipv6 transport offsets (CVE-2026-68477 bsc#1275495). - commit 2d4609a - net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains (CVE-2026-68441 bsc#1274776). - commit 177c9f9 - drm/v3d: Serialize the scheduler timeout handlers (bsc#1277374 CVE-2026-74638) - commit b173f36 - xfrm: Check for underflow in xfrm_state_mtu (CVE-2026-64009 bsc#1273879). - commit 5215d17 ++++ libsoup: - Add libsoup-CVE-2026-85534.patch: Never send more body bytes than nghttp2 requested (bsc#1279239, CVE-2026-85534) - Add libsoup-CVE-2026-85197.patch: fix crash in on_data_read after connection has been destroyed (bsc#1279238, CVE-2026-85197) ------------------------------------------------------------------ ------------------ 2026-9-15 - Sep 15 2026 ------------------- ------------------------------------------------------------------ ++++ grub2: - Add SBAT Provides to support shim SBAT dependency checks (bsc#1278729) ++++ kernel-default: - nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo (CVE-2026-89673 bsc#1280237). - commit f4a952e - nfsd: fix nfsd_file leak on inter-server COPY setup failure (CVE-2026-89680 bsc#1280206). - commit 452f3b7 - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CVE-2026-63913 bsc#1272890). - commit 02bba06 - netfilter: ipset: make sure gc is properly stopped (CVE-2026-72434 bsc#1278054). - commit 752425d - nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (CVE-2026-89674 bsc#1280243). - commit 1397312 - nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() (CVE-2026-89697 bsc#1280148). - commit 17ecd59 - nfsd: check client ownership when cancelling a copy-notify stateid (CVE-2026-89694 bsc#1280151). - commit 200cccc - nfsd: gate nfs2 setacl by argp->mask (CVE-2026-89672 bsc#1280235). - commit 66662e7 - nfsd: gate nfs3 setacl by argp->mask (CVE-2026-89671 bsc#1280252). - commit 081b90d - nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (CVE-2026-89696 bsc#1280146). - commit 7095b22 - nfsd: fix cpntf publish race in nfs4_init_cp_state (CVE-2026-89684 bsc#1280178). - commit 10bd036 - Refresh patches.suse/sched-psi-Shut-down-rtpoll_timer-in-psi_cgroup_free.patch. - commit 86e8ea6 - Refresh patches.suse/drm-vmwgfx-bound-DMA-command-body-size-against-suffix-poin.patch. - commit b93cd80 - RDMA/rxe: Fix OOB in free_rd_atomic_resources() (CVE-2026-80863 bsc#1279535) - commit 3df2201 - RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (CVE-2026-80864 bsc#1279525) - commit 93acd3b - sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (CVE-2026-74594 bsc#1277843). - commit 84d30ef - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (CVE-2026-45836 bsc#1266410). - commit 5a9b164 - tls: device: fix out-of-bounds write in tls_append_frag() (CVE-2026-80852 bsc#1279532). - commit b5d8815 - Bluetooth: ISO: fix leaking sk after socket release (CVE-2026-74536 bsc#1275799). - commit 5e38f0b - rds: tcp: unregister sysctl before tearing down listen socket (CVE-2026-68290 bsc#1275977) - commit 6a7c7e9 - net: thunderbolt: Fix frags[] overflow by bounding frame_count (CVE-2026-72157 bsc#1277544) - commit 5f6de60 - fbdev: serialize mode sysfs access with lock_fb_info() (bsc#1279619 CVE-2026-80785) - commit 5d11647 - i3c: mipi-i3c-hci: Fix number of DAT/DCT entries for HCI versions < 1.1 (git-fixes). - commit 76a94b8 - usb-storage: ene_ub6250: fix race between scan work and probe (stable-fixes). - USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() (stable-fixes). - usb: image: mdc800: change kmalloc() to kzalloc() (stable-fixes). - of: fix out-of-bounds read in of_alias_scan() stem parser (git-fixes). - usb: gadget: aspeed_udc: check endpoint DMA allocation (git-fixes). - PCI: xgene: Drop unnecessary OF node reference (git-fixes). - PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses (stable-fixes). - PCI/proc: Use file_ns_capable() when checking config space read access (stable-fixes). - PCI/proc: Warn on writes to kernel-exclusive config space regions (stable-fixes). - PCI/proc: Avoid spurious runtime PM wakeup on config space accesses (stable-fixes). - power: supply: sc2731_charger: cancel work on remove (git-fixes). - PCI/MSI: Enable memory decoding before restoring MSI-X messages (git-fixes). - wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event() (git-fixes). - wifi: rtl818x: initialize eeprom_93cx6 struct to zero (git-fixes). - wifi: mt76: mt7915: report RX chain signal for all RX paths (git-fixes). - wifi: mt76: mt7915: fix chainmask handling for non-dbdc phys on band 1 (git-fixes). - wifi: iwlwifi: mei: check SAP message length before reading it (git-fixes). - PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN (stable-fixes). - wifi: iwlwifi: mei: add support for SAP version 4 (stable-fixes). - wifi: ath11k: Fix error handling in ath11k_wmi_p2p_noa_event() (git-fixes). - wifi: ath11k: implement handling of P2P NoA event (stable-fixes). - usb: gadget: aspeed_udc: Convert to platform remove callback returning void (stable-fixes). - power: supply: sc2731_charger: Convert to platform remove callback returning void (stable-fixes). - commit 7bc5ebb - fbdev: vfb: defer cleanup until the last reference (git-fixes). - drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT (stable-fixes). - drm/i915: Guard against NULL driver_data in i915_pci_probe() (stable-fixes). - ALSA: pcm: Fix race between non-atomic ops and trigger-start (stable-fixes). - drm/amdkfd: Reject zero-sized AQL queue allocations after size halving (stable-fixes). - drm/amdgpu: check thunderbolt before switcheroo registration (stable-fixes). - efi: fix stale reference to efi_recover_from_page_fault() (git-fixes). - fbdev: pvr2fb: correct user pointer annotation and sentinel initializer (stable-fixes). - drm/omap: dsi: Do not copy isr table (git-fixes). - net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition (stable-fixes). - Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU (stable-fixes). - Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU (stable-fixes). - Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices (git-fixes). - Bluetooth: btusb: Record matched usb_device_id into btusb_data (stable-fixes). - ALSA: portman2x4: Check card index validity at probe (stable-fixes). - ALSA: mts64: Check card index validity at probe (stable-fixes). - ALSA: virmidi: Check card index validity at probe (stable-fixes). - ALSA: serial-u16550: Check card index validity at probe (stable-fixes). - ALSA: mpu401: Check card index validity at probe (stable-fixes). - ALSA: aloop: Check card index validity at probe (stable-fixes). - HID: core: quiesce input in hid_hw_stop() to prevent use-after-free (stable-fixes). - HID: i2c-hid: Fix "(null)" output when reading report descriptor fails (git-fixes). - HID: mcp2221: stop device IO before hid_hw_stop (git-fixes). - hwmon: (emc1403) Drop hysteresis for low limit temperature (git-fixes). - Input: aiptek - validate raw macro indices before updating state (stable-fixes). - Bluetooth: btusb: refactor endpoint lookup (stable-fixes). - i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() (stable-fixes). - hwmon: (emc1403) Rely on subsystem locking (stable-fixes). - hwmon: (emc1403) Add support for EMC1428 and EMC1438 (stable-fixes). - hwmon: (emc1403) Support 11 bit accuracy (stable-fixes). - hwmon: (emc1403) Convert to with_info API (stable-fixes). - HID: i2c-hid: Revert to await reset ACK before reading report descriptor (git-fixes). - of: property: add missing kerneldoc for of_graph_get_endpoint_count() (stable-fixes). - HID: i2c-hid: Move i2c_hid_finish_hwreset() to after reading the report-descriptor (stable-fixes). - HID: i2c-hid: Switch i2c_hid_parse() to goto style error handling (stable-fixes). - HID: i2c-hid: Split i2c_hid_hwreset() in start() and finish() functions (stable-fixes). - HID: i2c-hid: Fold i2c_hid_execute_reset() into i2c_hid_hwreset() (stable-fixes). - hwmon: (emc1403) Add support for EMC1442 (stable-fixes). - i3c: mipi-i3c-hci: Fix DAT/DCT entry sizes (stable-fixes). - commit 6d57d1e ++++ kernel-rt: - nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo (CVE-2026-89673 bsc#1280237). - commit f4a952e - nfsd: fix nfsd_file leak on inter-server COPY setup failure (CVE-2026-89680 bsc#1280206). - commit 452f3b7 - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CVE-2026-63913 bsc#1272890). - commit 02bba06 - netfilter: ipset: make sure gc is properly stopped (CVE-2026-72434 bsc#1278054). - commit 752425d - nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (CVE-2026-89674 bsc#1280243). - commit 1397312 - nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() (CVE-2026-89697 bsc#1280148). - commit 17ecd59 - nfsd: check client ownership when cancelling a copy-notify stateid (CVE-2026-89694 bsc#1280151). - commit 200cccc - nfsd: gate nfs2 setacl by argp->mask (CVE-2026-89672 bsc#1280235). - commit 66662e7 - nfsd: gate nfs3 setacl by argp->mask (CVE-2026-89671 bsc#1280252). - commit 081b90d - nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (CVE-2026-89696 bsc#1280146). - commit 7095b22 - nfsd: fix cpntf publish race in nfs4_init_cp_state (CVE-2026-89684 bsc#1280178). - commit 10bd036 - Refresh patches.suse/sched-psi-Shut-down-rtpoll_timer-in-psi_cgroup_free.patch. - commit 86e8ea6 - Refresh patches.suse/drm-vmwgfx-bound-DMA-command-body-size-against-suffix-poin.patch. - commit b93cd80 - RDMA/rxe: Fix OOB in free_rd_atomic_resources() (CVE-2026-80863 bsc#1279535) - commit 3df2201 - RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (CVE-2026-80864 bsc#1279525) - commit 93acd3b - sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (CVE-2026-74594 bsc#1277843). - commit 84d30ef - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (CVE-2026-45836 bsc#1266410). - commit 5a9b164 - tls: device: fix out-of-bounds write in tls_append_frag() (CVE-2026-80852 bsc#1279532). - commit b5d8815 - Bluetooth: ISO: fix leaking sk after socket release (CVE-2026-74536 bsc#1275799). - commit 5e38f0b - rds: tcp: unregister sysctl before tearing down listen socket (CVE-2026-68290 bsc#1275977) - commit 6a7c7e9 - net: thunderbolt: Fix frags[] overflow by bounding frame_count (CVE-2026-72157 bsc#1277544) - commit 5f6de60 - fbdev: serialize mode sysfs access with lock_fb_info() (bsc#1279619 CVE-2026-80785) - commit 5d11647 - i3c: mipi-i3c-hci: Fix number of DAT/DCT entries for HCI versions < 1.1 (git-fixes). - commit 76a94b8 - usb-storage: ene_ub6250: fix race between scan work and probe (stable-fixes). - USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() (stable-fixes). - usb: image: mdc800: change kmalloc() to kzalloc() (stable-fixes). - of: fix out-of-bounds read in of_alias_scan() stem parser (git-fixes). - usb: gadget: aspeed_udc: check endpoint DMA allocation (git-fixes). - PCI: xgene: Drop unnecessary OF node reference (git-fixes). - PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses (stable-fixes). - PCI/proc: Use file_ns_capable() when checking config space read access (stable-fixes). - PCI/proc: Warn on writes to kernel-exclusive config space regions (stable-fixes). - PCI/proc: Avoid spurious runtime PM wakeup on config space accesses (stable-fixes). - power: supply: sc2731_charger: cancel work on remove (git-fixes). - PCI/MSI: Enable memory decoding before restoring MSI-X messages (git-fixes). - wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event() (git-fixes). - wifi: rtl818x: initialize eeprom_93cx6 struct to zero (git-fixes). - wifi: mt76: mt7915: report RX chain signal for all RX paths (git-fixes). - wifi: mt76: mt7915: fix chainmask handling for non-dbdc phys on band 1 (git-fixes). - wifi: iwlwifi: mei: check SAP message length before reading it (git-fixes). - PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN (stable-fixes). - wifi: iwlwifi: mei: add support for SAP version 4 (stable-fixes). - wifi: ath11k: Fix error handling in ath11k_wmi_p2p_noa_event() (git-fixes). - wifi: ath11k: implement handling of P2P NoA event (stable-fixes). - usb: gadget: aspeed_udc: Convert to platform remove callback returning void (stable-fixes). - power: supply: sc2731_charger: Convert to platform remove callback returning void (stable-fixes). - commit 7bc5ebb - fbdev: vfb: defer cleanup until the last reference (git-fixes). - drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT (stable-fixes). - drm/i915: Guard against NULL driver_data in i915_pci_probe() (stable-fixes). - ALSA: pcm: Fix race between non-atomic ops and trigger-start (stable-fixes). - drm/amdkfd: Reject zero-sized AQL queue allocations after size halving (stable-fixes). - drm/amdgpu: check thunderbolt before switcheroo registration (stable-fixes). - efi: fix stale reference to efi_recover_from_page_fault() (git-fixes). - fbdev: pvr2fb: correct user pointer annotation and sentinel initializer (stable-fixes). - drm/omap: dsi: Do not copy isr table (git-fixes). - net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition (stable-fixes). - Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU (stable-fixes). - Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU (stable-fixes). - Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices (git-fixes). - Bluetooth: btusb: Record matched usb_device_id into btusb_data (stable-fixes). - ALSA: portman2x4: Check card index validity at probe (stable-fixes). - ALSA: mts64: Check card index validity at probe (stable-fixes). - ALSA: virmidi: Check card index validity at probe (stable-fixes). - ALSA: serial-u16550: Check card index validity at probe (stable-fixes). - ALSA: mpu401: Check card index validity at probe (stable-fixes). - ALSA: aloop: Check card index validity at probe (stable-fixes). - HID: core: quiesce input in hid_hw_stop() to prevent use-after-free (stable-fixes). - HID: i2c-hid: Fix "(null)" output when reading report descriptor fails (git-fixes). - HID: mcp2221: stop device IO before hid_hw_stop (git-fixes). - hwmon: (emc1403) Drop hysteresis for low limit temperature (git-fixes). - Input: aiptek - validate raw macro indices before updating state (stable-fixes). - Bluetooth: btusb: refactor endpoint lookup (stable-fixes). - i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() (stable-fixes). - hwmon: (emc1403) Rely on subsystem locking (stable-fixes). - hwmon: (emc1403) Add support for EMC1428 and EMC1438 (stable-fixes). - hwmon: (emc1403) Support 11 bit accuracy (stable-fixes). - hwmon: (emc1403) Convert to with_info API (stable-fixes). - HID: i2c-hid: Revert to await reset ACK before reading report descriptor (git-fixes). - of: property: add missing kerneldoc for of_graph_get_endpoint_count() (stable-fixes). - HID: i2c-hid: Move i2c_hid_finish_hwreset() to after reading the report-descriptor (stable-fixes). - HID: i2c-hid: Switch i2c_hid_parse() to goto style error handling (stable-fixes). - HID: i2c-hid: Split i2c_hid_hwreset() in start() and finish() functions (stable-fixes). - HID: i2c-hid: Fold i2c_hid_execute_reset() into i2c_hid_hwreset() (stable-fixes). - hwmon: (emc1403) Add support for EMC1442 (stable-fixes). - i3c: mipi-i3c-hci: Fix DAT/DCT entry sizes (stable-fixes). - commit 6d57d1e ++++ kernel-rt_debug: - nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo (CVE-2026-89673 bsc#1280237). - commit f4a952e - nfsd: fix nfsd_file leak on inter-server COPY setup failure (CVE-2026-89680 bsc#1280206). - commit 452f3b7 - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CVE-2026-63913 bsc#1272890). - commit 02bba06 - netfilter: ipset: make sure gc is properly stopped (CVE-2026-72434 bsc#1278054). - commit 752425d - nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (CVE-2026-89674 bsc#1280243). - commit 1397312 - nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() (CVE-2026-89697 bsc#1280148). - commit 17ecd59 - nfsd: check client ownership when cancelling a copy-notify stateid (CVE-2026-89694 bsc#1280151). - commit 200cccc - nfsd: gate nfs2 setacl by argp->mask (CVE-2026-89672 bsc#1280235). - commit 66662e7 - nfsd: gate nfs3 setacl by argp->mask (CVE-2026-89671 bsc#1280252). - commit 081b90d - nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (CVE-2026-89696 bsc#1280146). - commit 7095b22 - nfsd: fix cpntf publish race in nfs4_init_cp_state (CVE-2026-89684 bsc#1280178). - commit 10bd036 - Refresh patches.suse/sched-psi-Shut-down-rtpoll_timer-in-psi_cgroup_free.patch. - commit 86e8ea6 - Refresh patches.suse/drm-vmwgfx-bound-DMA-command-body-size-against-suffix-poin.patch. - commit b93cd80 - RDMA/rxe: Fix OOB in free_rd_atomic_resources() (CVE-2026-80863 bsc#1279535) - commit 3df2201 - RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (CVE-2026-80864 bsc#1279525) - commit 93acd3b - sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (CVE-2026-74594 bsc#1277843). - commit 84d30ef - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (CVE-2026-45836 bsc#1266410). - commit 5a9b164 - tls: device: fix out-of-bounds write in tls_append_frag() (CVE-2026-80852 bsc#1279532). - commit b5d8815 - Bluetooth: ISO: fix leaking sk after socket release (CVE-2026-74536 bsc#1275799). - commit 5e38f0b - rds: tcp: unregister sysctl before tearing down listen socket (CVE-2026-68290 bsc#1275977) - commit 6a7c7e9 - net: thunderbolt: Fix frags[] overflow by bounding frame_count (CVE-2026-72157 bsc#1277544) - commit 5f6de60 - fbdev: serialize mode sysfs access with lock_fb_info() (bsc#1279619 CVE-2026-80785) - commit 5d11647 - i3c: mipi-i3c-hci: Fix number of DAT/DCT entries for HCI versions < 1.1 (git-fixes). - commit 76a94b8 - usb-storage: ene_ub6250: fix race between scan work and probe (stable-fixes). - USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() (stable-fixes). - usb: image: mdc800: change kmalloc() to kzalloc() (stable-fixes). - of: fix out-of-bounds read in of_alias_scan() stem parser (git-fixes). - usb: gadget: aspeed_udc: check endpoint DMA allocation (git-fixes). - PCI: xgene: Drop unnecessary OF node reference (git-fixes). - PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses (stable-fixes). - PCI/proc: Use file_ns_capable() when checking config space read access (stable-fixes). - PCI/proc: Warn on writes to kernel-exclusive config space regions (stable-fixes). - PCI/proc: Avoid spurious runtime PM wakeup on config space accesses (stable-fixes). - power: supply: sc2731_charger: cancel work on remove (git-fixes). - PCI/MSI: Enable memory decoding before restoring MSI-X messages (git-fixes). - wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event() (git-fixes). - wifi: rtl818x: initialize eeprom_93cx6 struct to zero (git-fixes). - wifi: mt76: mt7915: report RX chain signal for all RX paths (git-fixes). - wifi: mt76: mt7915: fix chainmask handling for non-dbdc phys on band 1 (git-fixes). - wifi: iwlwifi: mei: check SAP message length before reading it (git-fixes). - PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN (stable-fixes). - wifi: iwlwifi: mei: add support for SAP version 4 (stable-fixes). - wifi: ath11k: Fix error handling in ath11k_wmi_p2p_noa_event() (git-fixes). - wifi: ath11k: implement handling of P2P NoA event (stable-fixes). - usb: gadget: aspeed_udc: Convert to platform remove callback returning void (stable-fixes). - power: supply: sc2731_charger: Convert to platform remove callback returning void (stable-fixes). - commit 7bc5ebb - fbdev: vfb: defer cleanup until the last reference (git-fixes). - drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT (stable-fixes). - drm/i915: Guard against NULL driver_data in i915_pci_probe() (stable-fixes). - ALSA: pcm: Fix race between non-atomic ops and trigger-start (stable-fixes). - drm/amdkfd: Reject zero-sized AQL queue allocations after size halving (stable-fixes). - drm/amdgpu: check thunderbolt before switcheroo registration (stable-fixes). - efi: fix stale reference to efi_recover_from_page_fault() (git-fixes). - fbdev: pvr2fb: correct user pointer annotation and sentinel initializer (stable-fixes). - drm/omap: dsi: Do not copy isr table (git-fixes). - net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition (stable-fixes). - Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU (stable-fixes). - Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU (stable-fixes). - Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices (git-fixes). - Bluetooth: btusb: Record matched usb_device_id into btusb_data (stable-fixes). - ALSA: portman2x4: Check card index validity at probe (stable-fixes). - ALSA: mts64: Check card index validity at probe (stable-fixes). - ALSA: virmidi: Check card index validity at probe (stable-fixes). - ALSA: serial-u16550: Check card index validity at probe (stable-fixes). - ALSA: mpu401: Check card index validity at probe (stable-fixes). - ALSA: aloop: Check card index validity at probe (stable-fixes). - HID: core: quiesce input in hid_hw_stop() to prevent use-after-free (stable-fixes). - HID: i2c-hid: Fix "(null)" output when reading report descriptor fails (git-fixes). - HID: mcp2221: stop device IO before hid_hw_stop (git-fixes). - hwmon: (emc1403) Drop hysteresis for low limit temperature (git-fixes). - Input: aiptek - validate raw macro indices before updating state (stable-fixes). - Bluetooth: btusb: refactor endpoint lookup (stable-fixes). - i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() (stable-fixes). - hwmon: (emc1403) Rely on subsystem locking (stable-fixes). - hwmon: (emc1403) Add support for EMC1428 and EMC1438 (stable-fixes). - hwmon: (emc1403) Support 11 bit accuracy (stable-fixes). - hwmon: (emc1403) Convert to with_info API (stable-fixes). - HID: i2c-hid: Revert to await reset ACK before reading report descriptor (git-fixes). - of: property: add missing kerneldoc for of_graph_get_endpoint_count() (stable-fixes). - HID: i2c-hid: Move i2c_hid_finish_hwreset() to after reading the report-descriptor (stable-fixes). - HID: i2c-hid: Switch i2c_hid_parse() to goto style error handling (stable-fixes). - HID: i2c-hid: Split i2c_hid_hwreset() in start() and finish() functions (stable-fixes). - HID: i2c-hid: Fold i2c_hid_execute_reset() into i2c_hid_hwreset() (stable-fixes). - hwmon: (emc1403) Add support for EMC1442 (stable-fixes). - i3c: mipi-i3c-hci: Fix DAT/DCT entry sizes (stable-fixes). - commit 6d57d1e ++++ freeipmi: * bsc#1278719 - CVE-2026-85504 stack-based buffer overflow via malformed Fujitsu SEL long-text responses. A libfreeipmi-bound-Fujitsu-SEL-long-text-responses.patch * bsc#1278721 CVE-2026-85506 Arbitrary code execution via stack-based buffer overflow in ipmi-oem A ipmi-oem-bound-Dell-iDRAC-info-accumulation-loop-against-buffer-size.patch * bsc#1278722 CVE-2026-85505 Denial of Service via stack-based buffer over-read in ipmi-oem A ipmi-oem-clamp-Fujitsu-SEL-long-text-truncate-copy-to-actual-data.patch * bsc#1278724 CVE-2026-85507 stack-based buffer overflow in _output_dell_system_info_cmc_info A ipmi-oem-bound-Dell-CMC-info-accumulation-loop-against-buffer-size.patch * bsc#1278726 CVE-2026-85508 stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info A ipmi-oem-bound-Dell-CMC-IPv6-info-accumulation-loop-against-buffer-size.patch * bsc#1278727 CVE-2026-85509 stack-based buffer overflow when a BMC returns more bytes than requested A libfreeipmi-clamp-count_returned-in-_read_fru_data-before-memcpy.patch ++++ python311-core: - CVE-2026-19672: in tarfile, handle a member that leaves the destination and comes back (bsc#1276227, gh#python/cpython#156000) CVE-2026-19672-tarfile-outside-dirs.patch ++++ python311: - CVE-2026-19672: in tarfile, handle a member that leaves the destination and comes back (bsc#1276227, gh#python/cpython#156000) CVE-2026-19672-tarfile-outside-dirs.patch ------------------------------------------------------------------ ------------------ 2026-9-14 - Sep 14 2026 ------------------- ------------------------------------------------------------------ ++++ cups: - cups-2.4.19-CVE-2026-87875.patch is based on https://github.com/OpenPrinting/cups/commit/2b1dc178a2d2325135b855142e384f4e8c42d8e4 adapted to CUPS 2.4.19 to fix CVE-2026-87875 "Heap out-of-bounds read in cupsUTF32ToUTF8() via missing source-length bound - reachable from SNMP supply-description parsing (backend/snmp-supplies.c)" https://github.com/OpenPrinting/cups/security/advisories/GHSA-559w-7676-3xrq bsc#1279945 "heap out-of-bounds read in `cupsUTF32ToUTF8()` due to missing source-length bound can be reached via the SNMP supply-description parsing" ++++ kernel-default: - slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139). - commit 0fdf24e - default_gfp(): avoid using the "newfangled" __VA_OPT__ trick (bsc#1280139). - commit ac4c450 - add default_gfp() helper macro and use it in the new * alloc_obj() helpers (bsc#1280139). - commit 6f081c1 - slab.h: disable completely broken overflow handling in flex allocations (bsc#1280139). - commit 599003a - slab: Introduce kmalloc_flex() and family (bsc#1280139). - commit 54c1af2 - compiler_types: Introduce __flex_counter() and family (bsc#1280139). - commit b16b162 - slab: Introduce kmalloc_obj() and family (bsc#1280139). - commit 5944147 - powerpc/crash: stop watchdogs before booting kdump kernel (bsc#1277705 ltc#220979). - powerpc/pseries: Handle and log pseries-wdt registration failures (bsc#1277705 ltc#220979). - powerpc/pseries: Move H_WATCHDOG definitions to a common header (bsc#1277705 ltc#220979). - commit a489f26 - configfs: fix lockless traversals of ->s_children (bsc#1277129 CVE-2026-74330). - commit 3e426ec - binfmt_misc: restore write access when removing an entry (bsc#1276349 CVE-2026-74487). - commit fb8e61a - binfmt_misc: reject a flag character as the field delimiter (bsc#1277892 CVE-2026-74485). - commit 08b8acf - configfs_lookup(): don't leave ->s_dentry dangling on failure (bsc#1278067 CVE-2026-74359). - commit f54028f - tracing: Fix race between update_event_fields and, event_define_fields (CVE-2026-74636 bsc#1277371). - commit 0ddb893 - README.BRANCH: Luis is taking over Tom As Tom Abraham is moving to different tasks, we welcome Luis Galdos in the team of kernel branch maintainers. - commit 8cd5b5e - tracing/osnoise: Call synchronize_rcu() when unregistering (CVE-2026-72012 bsc#1276783). - commit 4f3bcf0 - ftrace: Add global mutex to serialize trace_parser access (CVE-2026-68146 bsc#1274890). - commit e874c18 - tracing: Prevent out-of-bounds read in glob matching (CVE-2026-64299 bsc#1273976). - commit d47b1b3 - module: decompress: check return value of module_extend_max_pages() (CVE-2026-64297 bsc#1273938). - commit e22890e - tracing: Bound synthetic-field strings with seq_buf (CVE-2026-74391 bsc#1278091). - commit 81de215 - tracing: Do not call map->ops->elt_free() if elt_alloc() fails (CVE-2026-64173 bsc#1272145). - commit 999c4a5 - tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (CVE-2026-46196 bsc#1266848). - commit 902fe26 - net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72051 bsc#1276801). - commit 886f172 - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744 bsc#1278094). - commit 0b6bfbc - net: enetc: check the number of BDs needed for xdp_frame (CVE-2026-72399 bsc#1276553). - commit 4a5d3f6 - net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() (CVE-2026-74719 bsc#1276572). - commit 8e5b627 - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052 bsc#1276803). - commit b42b7dd - net: ipip: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72053 bsc#1276814). - commit 7f8cc2d - net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72054 bsc#1276818). - commit ce6e604 - net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72055 bsc#1276821). - commit 8ee03c7 - net: sit: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72061 bsc#1277249). - commit c4f2ba0 - xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72136 bsc#1277574). - commit 66f4b8d - vxlan: re-fetch eth header after route_shortcircuit() (CVE-2026-80681 bsc#1278416). - commit f68e75a - qede: sync udp_tunnel ports outside qede_lock in the recovery path (CVE-2026-74523 bsc#1275802). - vxlan: use neigh_ha_snapshot() in route_shortcircuit() (CVE-2026-74475 bsc#1276339). - vxlan: unclone skb head before modifying eth header in route_shortcircuit() (CVE-2026-74475 bsc#1276339). - octeontx2-pf: fix SQB pointer leak on init failure (CVE-2026-72023 bsc#1276793). - ixgbe: do not configure xps for XDP queues (CVE-2026-74317 bsc#1276866). - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (CVE-2026-63993 bsc#1279847). - commit cfc6ca6 - net/sched: sch_hfsc: Don't make class passive twice (CVE-2026-74284 bsc#1276468). - commit c6b8e61 - tipc: prevent snt_unacked underflow on CONN_ACK (CVE-2026-74282 bsc#1276473). - commit e98e739 - handshake: Require admin permission for DONE command (CVE-2026-74270 bsc#1276512). - commit 9dc5c23 - macsec: don't read an unset MAC header in macsec_encrypt() (CVE-2026-72019 bsc#1276865). - commit c161274 - vduse: hold vduse_lock across IDR lookup in open path (CVE-2026-74313 bsc#1276876). - commit a466344 - net: openvswitch: fix skb leak on flow key update failure during ct (CVE-2026-74464 bsc#1277070). - commit b7b476e - octeontx2-pf: Fix leak of SQ timestamp buffer on teardown (CVE-2026-72448 bsc#1277108). - commit 7bca00b - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (CVE-2026-72425 bsc#1277120). - commit 0a4c90c - netfilter: xt_connmark: reject invalid shift parameters (CVE-2026-72347 bsc#1277783). - commit d7669c8 - netfilter: xt_u32: reject invalid shift counts (CVE-2026-72350 bsc#1277822). - commit 8a12b11 - ipv6: fix Route Information option length validation (CVE-2026-74598 bsc#1277918). - commit 862aa6e - net: atlantic: free RX pages of consumed but not refilled buffers (CVE-2026-74622 bsc#1277862). - commit 3576668 - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (CVE-2026-80731 bsc#1278716). - commit 521c06f - wifi: mt76: mt7921: skip unknown CLC firmware records (git-fixes). - commit a3f6435 ++++ kernel-rt: - slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139). - commit 0fdf24e - default_gfp(): avoid using the "newfangled" __VA_OPT__ trick (bsc#1280139). - commit ac4c450 - add default_gfp() helper macro and use it in the new * alloc_obj() helpers (bsc#1280139). - commit 6f081c1 - slab.h: disable completely broken overflow handling in flex allocations (bsc#1280139). - commit 599003a - slab: Introduce kmalloc_flex() and family (bsc#1280139). - commit 54c1af2 - compiler_types: Introduce __flex_counter() and family (bsc#1280139). - commit b16b162 - slab: Introduce kmalloc_obj() and family (bsc#1280139). - commit 5944147 - powerpc/crash: stop watchdogs before booting kdump kernel (bsc#1277705 ltc#220979). - powerpc/pseries: Handle and log pseries-wdt registration failures (bsc#1277705 ltc#220979). - powerpc/pseries: Move H_WATCHDOG definitions to a common header (bsc#1277705 ltc#220979). - commit a489f26 - configfs: fix lockless traversals of ->s_children (bsc#1277129 CVE-2026-74330). - commit 3e426ec - binfmt_misc: restore write access when removing an entry (bsc#1276349 CVE-2026-74487). - commit fb8e61a - binfmt_misc: reject a flag character as the field delimiter (bsc#1277892 CVE-2026-74485). - commit 08b8acf - configfs_lookup(): don't leave ->s_dentry dangling on failure (bsc#1278067 CVE-2026-74359). - commit f54028f - tracing: Fix race between update_event_fields and, event_define_fields (CVE-2026-74636 bsc#1277371). - commit 0ddb893 - README.BRANCH: Luis is taking over Tom As Tom Abraham is moving to different tasks, we welcome Luis Galdos in the team of kernel branch maintainers. - commit 8cd5b5e - tracing/osnoise: Call synchronize_rcu() when unregistering (CVE-2026-72012 bsc#1276783). - commit 4f3bcf0 - ftrace: Add global mutex to serialize trace_parser access (CVE-2026-68146 bsc#1274890). - commit e874c18 - tracing: Prevent out-of-bounds read in glob matching (CVE-2026-64299 bsc#1273976). - commit d47b1b3 - module: decompress: check return value of module_extend_max_pages() (CVE-2026-64297 bsc#1273938). - commit e22890e - tracing: Bound synthetic-field strings with seq_buf (CVE-2026-74391 bsc#1278091). - commit 81de215 - tracing: Do not call map->ops->elt_free() if elt_alloc() fails (CVE-2026-64173 bsc#1272145). - commit 999c4a5 - tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (CVE-2026-46196 bsc#1266848). - commit 902fe26 - net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72051 bsc#1276801). - commit 886f172 - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744 bsc#1278094). - commit 0b6bfbc - net: enetc: check the number of BDs needed for xdp_frame (CVE-2026-72399 bsc#1276553). - commit 4a5d3f6 - net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() (CVE-2026-74719 bsc#1276572). - commit 8e5b627 - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052 bsc#1276803). - commit b42b7dd - net: ipip: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72053 bsc#1276814). - commit 7f8cc2d - net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72054 bsc#1276818). - commit ce6e604 - net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72055 bsc#1276821). - commit 8ee03c7 - net: sit: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72061 bsc#1277249). - commit c4f2ba0 - xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72136 bsc#1277574). - commit 66f4b8d - vxlan: re-fetch eth header after route_shortcircuit() (CVE-2026-80681 bsc#1278416). - commit f68e75a - qede: sync udp_tunnel ports outside qede_lock in the recovery path (CVE-2026-74523 bsc#1275802). - vxlan: use neigh_ha_snapshot() in route_shortcircuit() (CVE-2026-74475 bsc#1276339). - vxlan: unclone skb head before modifying eth header in route_shortcircuit() (CVE-2026-74475 bsc#1276339). - octeontx2-pf: fix SQB pointer leak on init failure (CVE-2026-72023 bsc#1276793). - ixgbe: do not configure xps for XDP queues (CVE-2026-74317 bsc#1276866). - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (CVE-2026-63993 bsc#1279847). - commit cfc6ca6 - net/sched: sch_hfsc: Don't make class passive twice (CVE-2026-74284 bsc#1276468). - commit c6b8e61 - tipc: prevent snt_unacked underflow on CONN_ACK (CVE-2026-74282 bsc#1276473). - commit e98e739 - handshake: Require admin permission for DONE command (CVE-2026-74270 bsc#1276512). - commit 9dc5c23 - macsec: don't read an unset MAC header in macsec_encrypt() (CVE-2026-72019 bsc#1276865). - commit c161274 - vduse: hold vduse_lock across IDR lookup in open path (CVE-2026-74313 bsc#1276876). - commit a466344 - net: openvswitch: fix skb leak on flow key update failure during ct (CVE-2026-74464 bsc#1277070). - commit b7b476e - octeontx2-pf: Fix leak of SQ timestamp buffer on teardown (CVE-2026-72448 bsc#1277108). - commit 7bca00b - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (CVE-2026-72425 bsc#1277120). - commit 0a4c90c - netfilter: xt_connmark: reject invalid shift parameters (CVE-2026-72347 bsc#1277783). - commit d7669c8 - netfilter: xt_u32: reject invalid shift counts (CVE-2026-72350 bsc#1277822). - commit 8a12b11 - ipv6: fix Route Information option length validation (CVE-2026-74598 bsc#1277918). - commit 862aa6e - net: atlantic: free RX pages of consumed but not refilled buffers (CVE-2026-74622 bsc#1277862). - commit 3576668 - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (CVE-2026-80731 bsc#1278716). - commit 521c06f - wifi: mt76: mt7921: skip unknown CLC firmware records (git-fixes). - commit a3f6435 ++++ kernel-rt_debug: - slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139). - commit 0fdf24e - default_gfp(): avoid using the "newfangled" __VA_OPT__ trick (bsc#1280139). - commit ac4c450 - add default_gfp() helper macro and use it in the new * alloc_obj() helpers (bsc#1280139). - commit 6f081c1 - slab.h: disable completely broken overflow handling in flex allocations (bsc#1280139). - commit 599003a - slab: Introduce kmalloc_flex() and family (bsc#1280139). - commit 54c1af2 - compiler_types: Introduce __flex_counter() and family (bsc#1280139). - commit b16b162 - slab: Introduce kmalloc_obj() and family (bsc#1280139). - commit 5944147 - powerpc/crash: stop watchdogs before booting kdump kernel (bsc#1277705 ltc#220979). - powerpc/pseries: Handle and log pseries-wdt registration failures (bsc#1277705 ltc#220979). - powerpc/pseries: Move H_WATCHDOG definitions to a common header (bsc#1277705 ltc#220979). - commit a489f26 - configfs: fix lockless traversals of ->s_children (bsc#1277129 CVE-2026-74330). - commit 3e426ec - binfmt_misc: restore write access when removing an entry (bsc#1276349 CVE-2026-74487). - commit fb8e61a - binfmt_misc: reject a flag character as the field delimiter (bsc#1277892 CVE-2026-74485). - commit 08b8acf - configfs_lookup(): don't leave ->s_dentry dangling on failure (bsc#1278067 CVE-2026-74359). - commit f54028f - tracing: Fix race between update_event_fields and, event_define_fields (CVE-2026-74636 bsc#1277371). - commit 0ddb893 - README.BRANCH: Luis is taking over Tom As Tom Abraham is moving to different tasks, we welcome Luis Galdos in the team of kernel branch maintainers. - commit 8cd5b5e - tracing/osnoise: Call synchronize_rcu() when unregistering (CVE-2026-72012 bsc#1276783). - commit 4f3bcf0 - ftrace: Add global mutex to serialize trace_parser access (CVE-2026-68146 bsc#1274890). - commit e874c18 - tracing: Prevent out-of-bounds read in glob matching (CVE-2026-64299 bsc#1273976). - commit d47b1b3 - module: decompress: check return value of module_extend_max_pages() (CVE-2026-64297 bsc#1273938). - commit e22890e - tracing: Bound synthetic-field strings with seq_buf (CVE-2026-74391 bsc#1278091). - commit 81de215 - tracing: Do not call map->ops->elt_free() if elt_alloc() fails (CVE-2026-64173 bsc#1272145). - commit 999c4a5 - tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (CVE-2026-46196 bsc#1266848). - commit 902fe26 - net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72051 bsc#1276801). - commit 886f172 - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744 bsc#1278094). - commit 0b6bfbc - net: enetc: check the number of BDs needed for xdp_frame (CVE-2026-72399 bsc#1276553). - commit 4a5d3f6 - net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() (CVE-2026-74719 bsc#1276572). - commit 8e5b627 - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052 bsc#1276803). - commit b42b7dd - net: ipip: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72053 bsc#1276814). - commit 7f8cc2d - net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72054 bsc#1276818). - commit ce6e604 - net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72055 bsc#1276821). - commit 8ee03c7 - net: sit: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72061 bsc#1277249). - commit c4f2ba0 - xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72136 bsc#1277574). - commit 66f4b8d - vxlan: re-fetch eth header after route_shortcircuit() (CVE-2026-80681 bsc#1278416). - commit f68e75a - qede: sync udp_tunnel ports outside qede_lock in the recovery path (CVE-2026-74523 bsc#1275802). - vxlan: use neigh_ha_snapshot() in route_shortcircuit() (CVE-2026-74475 bsc#1276339). - vxlan: unclone skb head before modifying eth header in route_shortcircuit() (CVE-2026-74475 bsc#1276339). - octeontx2-pf: fix SQB pointer leak on init failure (CVE-2026-72023 bsc#1276793). - ixgbe: do not configure xps for XDP queues (CVE-2026-74317 bsc#1276866). - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (CVE-2026-63993 bsc#1279847). - commit cfc6ca6 - net/sched: sch_hfsc: Don't make class passive twice (CVE-2026-74284 bsc#1276468). - commit c6b8e61 - tipc: prevent snt_unacked underflow on CONN_ACK (CVE-2026-74282 bsc#1276473). - commit e98e739 - handshake: Require admin permission for DONE command (CVE-2026-74270 bsc#1276512). - commit 9dc5c23 - macsec: don't read an unset MAC header in macsec_encrypt() (CVE-2026-72019 bsc#1276865). - commit c161274 - vduse: hold vduse_lock across IDR lookup in open path (CVE-2026-74313 bsc#1276876). - commit a466344 - net: openvswitch: fix skb leak on flow key update failure during ct (CVE-2026-74464 bsc#1277070). - commit b7b476e - octeontx2-pf: Fix leak of SQ timestamp buffer on teardown (CVE-2026-72448 bsc#1277108). - commit 7bca00b - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (CVE-2026-72425 bsc#1277120). - commit 0a4c90c - netfilter: xt_connmark: reject invalid shift parameters (CVE-2026-72347 bsc#1277783). - commit d7669c8 - netfilter: xt_u32: reject invalid shift counts (CVE-2026-72350 bsc#1277822). - commit 8a12b11 - ipv6: fix Route Information option length validation (CVE-2026-74598 bsc#1277918). - commit 862aa6e - net: atlantic: free RX pages of consumed but not refilled buffers (CVE-2026-74622 bsc#1277862). - commit 3576668 - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (CVE-2026-80731 bsc#1278716). - commit 521c06f - wifi: mt76: mt7921: skip unknown CLC firmware records (git-fixes). - commit a3f6435 ------------------------------------------------------------------ ------------------ 2026-9-12 - Sep 12 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - dm/amdgpu: fix malformed link_settings debugfs output (git-fixes). - drm/i915: Fix memory leak in query_perf_config_list() (git-fixes). - drm/drm_exec: fix up contended obj when num_objects is 0 (git-fixes). - ASoC: mt6351: Publish the OF module alias (git-fixes). - ASoC: Intel: SST: Publish the PCI module aliases (git-fixes). - ASoC: bcm: bcm63xx: Publish the OF module aliases (git-fixes). - ASoC: Intel: avs: Clean up streams if their initialization fails (git-fixes). - ASoC: Intel: avs: Clean up the bus when fetching ML caps fails (git-fixes). - ASoC: ux500: Request the MSP MMIO resource (git-fixes). - ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close() (git-fixes). - ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits (git-fixes). - ASoC: sprd: validate compress buffer sizes against fixed allocations (git-fixes). - ASoC: ab8500: Validate and program TDM slots correctly (git-fixes). - ASoC: ab8500: Correct digital interface format setup (git-fixes). - ASoC: ab8500: Repair the DAPM capture graph (git-fixes). - ASoC: ab8500: Reset the audio block before configuring it (git-fixes). - ASoC: sti: initialize IRQ lock before requesting IRQ (git-fixes). - ALSA: hda: Report a change when only the channel status bytes move (git-fixes). - ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf (git-fixes). - ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough (git-fixes). - ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev (git-fixes). - media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity (git-fixes). - media: hevc: add bounded tile-count helpers (git-fixes). - media: v4l2-ctrls: validate AV1 tile counts (git-fixes). - media: v4l2-ctrls: validate HEVC tile counts (git-fixes). - media: v4l2-h264: Fix memcmp() size in B1 reference list comparison (git-fixes). - commit eefc1e3 ++++ kernel-rt: - dm/amdgpu: fix malformed link_settings debugfs output (git-fixes). - drm/i915: Fix memory leak in query_perf_config_list() (git-fixes). - drm/drm_exec: fix up contended obj when num_objects is 0 (git-fixes). - ASoC: mt6351: Publish the OF module alias (git-fixes). - ASoC: Intel: SST: Publish the PCI module aliases (git-fixes). - ASoC: bcm: bcm63xx: Publish the OF module aliases (git-fixes). - ASoC: Intel: avs: Clean up streams if their initialization fails (git-fixes). - ASoC: Intel: avs: Clean up the bus when fetching ML caps fails (git-fixes). - ASoC: ux500: Request the MSP MMIO resource (git-fixes). - ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close() (git-fixes). - ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits (git-fixes). - ASoC: sprd: validate compress buffer sizes against fixed allocations (git-fixes). - ASoC: ab8500: Validate and program TDM slots correctly (git-fixes). - ASoC: ab8500: Correct digital interface format setup (git-fixes). - ASoC: ab8500: Repair the DAPM capture graph (git-fixes). - ASoC: ab8500: Reset the audio block before configuring it (git-fixes). - ASoC: sti: initialize IRQ lock before requesting IRQ (git-fixes). - ALSA: hda: Report a change when only the channel status bytes move (git-fixes). - ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf (git-fixes). - ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough (git-fixes). - ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev (git-fixes). - media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity (git-fixes). - media: hevc: add bounded tile-count helpers (git-fixes). - media: v4l2-ctrls: validate AV1 tile counts (git-fixes). - media: v4l2-ctrls: validate HEVC tile counts (git-fixes). - media: v4l2-h264: Fix memcmp() size in B1 reference list comparison (git-fixes). - commit eefc1e3 ++++ kernel-rt_debug: - dm/amdgpu: fix malformed link_settings debugfs output (git-fixes). - drm/i915: Fix memory leak in query_perf_config_list() (git-fixes). - drm/drm_exec: fix up contended obj when num_objects is 0 (git-fixes). - ASoC: mt6351: Publish the OF module alias (git-fixes). - ASoC: Intel: SST: Publish the PCI module aliases (git-fixes). - ASoC: bcm: bcm63xx: Publish the OF module aliases (git-fixes). - ASoC: Intel: avs: Clean up streams if their initialization fails (git-fixes). - ASoC: Intel: avs: Clean up the bus when fetching ML caps fails (git-fixes). - ASoC: ux500: Request the MSP MMIO resource (git-fixes). - ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close() (git-fixes). - ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits (git-fixes). - ASoC: sprd: validate compress buffer sizes against fixed allocations (git-fixes). - ASoC: ab8500: Validate and program TDM slots correctly (git-fixes). - ASoC: ab8500: Correct digital interface format setup (git-fixes). - ASoC: ab8500: Repair the DAPM capture graph (git-fixes). - ASoC: ab8500: Reset the audio block before configuring it (git-fixes). - ASoC: sti: initialize IRQ lock before requesting IRQ (git-fixes). - ALSA: hda: Report a change when only the channel status bytes move (git-fixes). - ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf (git-fixes). - ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough (git-fixes). - ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev (git-fixes). - media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity (git-fixes). - media: hevc: add bounded tile-count helpers (git-fixes). - media: v4l2-ctrls: validate AV1 tile counts (git-fixes). - media: v4l2-ctrls: validate HEVC tile counts (git-fixes). - media: v4l2-h264: Fix memcmp() size in B1 reference list comparison (git-fixes). - commit eefc1e3 ------------------------------------------------------------------ ------------------ 2026-9-11 - Sep 11 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - md/raid1,raid10: fix deadlock in read error recovery path (CVE-2026-74375 bsc#1277649). - commit b94c0e7 - md: replace wait loop with wait_event() in md_handle_request() (CVE-2026-74375 bsc#1277649). - commit ebe45b2 - fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() (CVE-2026-74595 bsc#1277910). - commit c13169b - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (CVE-2026-74444 bsc#1278211). - commit 128996c - xfs: validate attr entry pointer before field access (CVE-2026-80805 bsc#1279580). - commit 53bffc7 - hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors (git-fixes). - hwmon: (gpio-fan) take fan_data->lock in gpio_fan_shutdown() (git-fixes). - hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS (git-fixes). - hwmon: (applesmc) fix key backlight workqueue leak on register failure (git-fixes). - hwmon: (gpio-fan) Fix use-after-free in alarm work (git-fixes). - Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 (git-fixes). - Bluetooth: btusb: Fix UAF of btusb_data by rx_work (git-fixes). - net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow (git-fixes). - ieee802154: hwsim: serialize pib updates to fix double-free (git-fixes). - ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink (git-fixes). - ieee802154: cc2520: fix FIFOP work use-after-free (git-fixes). - watchdog: msc313e: Sync timeout value if WDT was running at boot (git-fixes). - watchdog: msc313e: Fix undefined behavior (git-fixes). - watchdog: msc313e: Fix spurious reset on suspend (git-fixes). - watchdog: msc313e: Enable clock before accessing hardware registers (git-fixes). - watchdog: msc313e: Fix clock leak and spurious timer in settimeout() (git-fixes). - watchdog: msc313e: Avoid division by zero (git-fixes). - watchdog: fix hrtimer start when pretimeout is zero (git-fixes). - watchdog: msc313e: Fix NULL pointer dereference in PM callbacks (git-fixes). - watchdog: sunxi_wdt: preserve boot-enabled watchdog (git-fixes). - commit 5603861 ++++ kernel-rt: - md/raid1,raid10: fix deadlock in read error recovery path (CVE-2026-74375 bsc#1277649). - commit b94c0e7 - md: replace wait loop with wait_event() in md_handle_request() (CVE-2026-74375 bsc#1277649). - commit ebe45b2 - fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() (CVE-2026-74595 bsc#1277910). - commit c13169b - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (CVE-2026-74444 bsc#1278211). - commit 128996c - xfs: validate attr entry pointer before field access (CVE-2026-80805 bsc#1279580). - commit 53bffc7 - hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors (git-fixes). - hwmon: (gpio-fan) take fan_data->lock in gpio_fan_shutdown() (git-fixes). - hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS (git-fixes). - hwmon: (applesmc) fix key backlight workqueue leak on register failure (git-fixes). - hwmon: (gpio-fan) Fix use-after-free in alarm work (git-fixes). - Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 (git-fixes). - Bluetooth: btusb: Fix UAF of btusb_data by rx_work (git-fixes). - net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow (git-fixes). - ieee802154: hwsim: serialize pib updates to fix double-free (git-fixes). - ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink (git-fixes). - ieee802154: cc2520: fix FIFOP work use-after-free (git-fixes). - watchdog: msc313e: Sync timeout value if WDT was running at boot (git-fixes). - watchdog: msc313e: Fix undefined behavior (git-fixes). - watchdog: msc313e: Fix spurious reset on suspend (git-fixes). - watchdog: msc313e: Enable clock before accessing hardware registers (git-fixes). - watchdog: msc313e: Fix clock leak and spurious timer in settimeout() (git-fixes). - watchdog: msc313e: Avoid division by zero (git-fixes). - watchdog: fix hrtimer start when pretimeout is zero (git-fixes). - watchdog: msc313e: Fix NULL pointer dereference in PM callbacks (git-fixes). - watchdog: sunxi_wdt: preserve boot-enabled watchdog (git-fixes). - commit 5603861 ++++ kernel-rt_debug: - md/raid1,raid10: fix deadlock in read error recovery path (CVE-2026-74375 bsc#1277649). - commit b94c0e7 - md: replace wait loop with wait_event() in md_handle_request() (CVE-2026-74375 bsc#1277649). - commit ebe45b2 - fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() (CVE-2026-74595 bsc#1277910). - commit c13169b - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (CVE-2026-74444 bsc#1278211). - commit 128996c - xfs: validate attr entry pointer before field access (CVE-2026-80805 bsc#1279580). - commit 53bffc7 - hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors (git-fixes). - hwmon: (gpio-fan) take fan_data->lock in gpio_fan_shutdown() (git-fixes). - hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS (git-fixes). - hwmon: (applesmc) fix key backlight workqueue leak on register failure (git-fixes). - hwmon: (gpio-fan) Fix use-after-free in alarm work (git-fixes). - Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 (git-fixes). - Bluetooth: btusb: Fix UAF of btusb_data by rx_work (git-fixes). - net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow (git-fixes). - ieee802154: hwsim: serialize pib updates to fix double-free (git-fixes). - ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink (git-fixes). - ieee802154: cc2520: fix FIFOP work use-after-free (git-fixes). - watchdog: msc313e: Sync timeout value if WDT was running at boot (git-fixes). - watchdog: msc313e: Fix undefined behavior (git-fixes). - watchdog: msc313e: Fix spurious reset on suspend (git-fixes). - watchdog: msc313e: Enable clock before accessing hardware registers (git-fixes). - watchdog: msc313e: Fix clock leak and spurious timer in settimeout() (git-fixes). - watchdog: msc313e: Avoid division by zero (git-fixes). - watchdog: fix hrtimer start when pretimeout is zero (git-fixes). - watchdog: msc313e: Fix NULL pointer dereference in PM callbacks (git-fixes). - watchdog: sunxi_wdt: preserve boot-enabled watchdog (git-fixes). - commit 5603861 ++++ pcre2: - Fix bsc#1277707 / bsc#1280053 / CVE-2026-89157. - Fix bsc#1277708 / bsc#1280054 / CVE-2026-89156. - Fix bsc#1277709 / bsc#1280052 / CVE-2026-89158. - Fix bsc#1277710 / bsc#1280051 / CVE-2026-89160. - Fix bsc#1277711 / bsc#1280050 / CVE-2026-89161. - Fix bsc#1277713 / bsc#1279893 / CVE-2026-86145. - Add patches: * pcre2-jit-match-copied-subject.patch * pcre2-jit-extuni-backchar-bound.patch * pcre2-dfa-match-check-subject.patch * pcre2-bsc1277710-GHSA-9qww-pwc4-77qq.patch * pcre2-bsc1277709-GHSA-fmgr-6ggq-9859.patch * pcre2-bsc1277708-GHSA-2p8c-ff85-vh9x.patch * pcre2-bsc1277707-GHSA-q8g2-wprr-34m9.patch * pcre2-CVE-2026-86145.patch ++++ python311-core: CVE-2026-17084: Don't consider Unicode codepoint attributes outside RFC 3454 (bsc#1276226) CVE-2026-17084-stringprep-rfc3454.patch ++++ python311: CVE-2026-17084: Don't consider Unicode codepoint attributes outside RFC 3454 (bsc#1276226) CVE-2026-17084-stringprep-rfc3454.patch ------------------------------------------------------------------ ------------------ 2026-9-10 - Sep 10 2026 ------------------- ------------------------------------------------------------------ ++++ ca-certificates-mozilla: - Updated to 2.90 state (bsc#1279961) - Removed: - AffirmTrust Commercial - AffirmTrust Networking - AffirmTrust Premium - AffirmTrust Premium ECC - certSIGN ROOT CA - Entrust Root Certification Authority - PKI Root Certification Authority - FIRMAPROFESIONAL CA ROOT-A WEB - GLOBALTRUST 2020 - Secure Global CA - SecureSign Root CA12 - SecureTrust CA - TeliaSonera Root CA v1 - Trustwave Global Certification Authority - Trustwave Global ECC P256 Certification Authority - Trustwave Global ECC P384 Certification Authority - XRamp Global Certification Authority - Added: - SECOM SMIME RSA Root CA 2024 - SECOM TLS ECC Root CA 2024 - SECOM TLS RSA Root CA 2024 - SecureSign Root CA16 - Telia EC Email Root CA v3 - Telia EC TLS Root CA v3 - Telia RSA Email Root CA v3 - Telia RSA TLS Root CA v3 ++++ kernel-default: - mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() (CVE-2026-80893 bsc#1279706). - commit c816cec - Refresh patches.suse/dm-era-fix-out-of-bounds-memory-access-for-non-zero-start-.patch. - commit d69bc33 - Refresh patches.suse/dm-ioctl-fix-a-possible-overflow-in-list_version_get_info.patch. - commit a8e0f98 - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149 bsc#1267648). - commit 3300758 - Update patches.suse/powerpc-rtas_pci-No-hotplug-on-permanently-removed-device-on-pSeries.patch (bsc#1263865 ltc#214502). - commit ab9843b - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs (CVE-2026-74363 bsc#1278070). - commit 20d29ae ++++ kernel-rt: - mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() (CVE-2026-80893 bsc#1279706). - commit c816cec - Refresh patches.suse/dm-era-fix-out-of-bounds-memory-access-for-non-zero-start-.patch. - commit d69bc33 - Refresh patches.suse/dm-ioctl-fix-a-possible-overflow-in-list_version_get_info.patch. - commit a8e0f98 - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149 bsc#1267648). - commit 3300758 - Update patches.suse/powerpc-rtas_pci-No-hotplug-on-permanently-removed-device-on-pSeries.patch (bsc#1263865 ltc#214502). - commit ab9843b - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs (CVE-2026-74363 bsc#1278070). - commit 20d29ae ++++ kernel-rt_debug: - mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() (CVE-2026-80893 bsc#1279706). - commit c816cec - Refresh patches.suse/dm-era-fix-out-of-bounds-memory-access-for-non-zero-start-.patch. - commit d69bc33 - Refresh patches.suse/dm-ioctl-fix-a-possible-overflow-in-list_version_get_info.patch. - commit a8e0f98 - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149 bsc#1267648). - commit 3300758 - Update patches.suse/powerpc-rtas_pci-No-hotplug-on-permanently-removed-device-on-pSeries.patch (bsc#1263865 ltc#214502). - commit ab9843b - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs (CVE-2026-74363 bsc#1278070). - commit 20d29ae ++++ python311-core: - CVE-2026-15806: Scope HTTPPasswordMgr credentials by URL scheme (bsc#1276223) * Add CVE-2026-15806-HTTPPasswordMgr-scheme.patch ++++ python311: - CVE-2026-15806: Scope HTTPPasswordMgr credentials by URL scheme (bsc#1276223) * Add CVE-2026-15806-HTTPPasswordMgr-scheme.patch ------------------------------------------------------------------ ------------------ 2026-9-9 - Sep 9 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - tracing: Check return value of __register_event() in trace_module_add_events() (CVE-2026-74471 bsc#1277781). - commit abd891d - ocfs2: reject FITRIM ranges shorter than a cluster (CVE-2026-74349 bsc#1278180). - commit f17effa - selinux: check connect-related permissions on TCP Fast Open (CVE-2026-72243 bsc#1277656). - commit 7ea719d - libceph: fix OOB read in decode_watchers() via missing bounds check (CVE-2026-80557 bsc#1277268). - commit 30f3ebb - md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry (CVE-2026-72437 bsc#1277874). - commit e1e4a3c - dm thin metadata: fix metadata snapshot consistency on commit failure (CVE-2026-72108 bsc#1277350). - commit d2be2d9 - nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621 CVE-2026-80789). diff --git a/patches.suse/nvmet-tcp-bound-SGL-data-length-before-allocating-co.patch b/patches.suse/nvmet-tcp-bound-SGL-data-length-before-allocating-co.patch new file mode 100644 index 000000000000..2025e98e9983 - -- /dev/null +++ b/patches.suse/nvmet-tcp-bound-SGL-data-length-before-allocating-co.patch @@ -0,0 +1,83 @@ +From: Ibrahim Hashimov +Date: Thu, 9 Jul 2026 15:25:33 +0200 +Subject: nvmet-tcp: bound SGL data length before allocating command buffers +Patch-mainline: v7.3-rc1 +Git-commit: 4a3f00262a044e8e15064b1a6860968bf0500bf4 +References: bsc#1279621 CVE-2026-80789 + +nvmet_tcp_map_data() reads the host-controlled 32-bit sgl->length +and, for the in-capsule offset descriptor (type 0x01), checks it +against port->inline_data_size before use. Any other SGL descriptor +type -- including the non-inline transport SGL data-block descriptor +(type (NVME_TRANSPORT_SGL_DATA_DESC << 4) | NVME_SGL_FMT_TRANSPORT_A, +the type a real host uses for out-of-capsule writes) skips that check +entirely and falls straight through to: + + cmd->req.sg = sgl_alloc(len, GFP_KERNEL, &cmd->req.sg_cnt); + +with len taken directly from the wire, unbounded up to 4 GiB. + +nvmet_req_init() only parses the command and never inspects +sgl->length, and nvmet_check_transfer_len() -- the only other place +transfer_len is validated -- runs later, from req->execute(), after +the allocation has already happened. For a write command the target +responds with an R2T and parks the command waiting for the host to +send the data; if the host (or an unauthenticated peer that simply +never follows up) never does, the sgl_alloc() buffer stays resident +for the life of the command. NVMe/TCP has no mandatory authentication +in the default configuration, so any peer able to reach the target +portal and complete a Fabrics connect can drive this with a single +crafted command, repeatable across queues and connections for +amplification. This is unbounded kernel memory allocation +triggered by a remote, effectively unauthenticated peer. + +Validate len against the same NVMET_TCP_MAXH2CDATA ceiling this file +already uses to bound per-PDU H2C data, for every SGL descriptor type, +before doing any allocation. This closes the gap for the non-inline +descriptor while leaving the existing, tighter inline_data_size check +in place for the in-capsule case. + +Runtime-verified on a v6.19 KASAN stand: with this bound in place, a +crafted write command carrying an oversized non-inline SGL length is +rejected before sgl_alloc() runs, where the same request previously +drove an unbounded ~256 MiB kernel allocation (up to 4 GiB) that +stayed resident pending an R2T the host never satisfies. + +Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver") +Cc: stable@vger.kernel.org +Reviewed-by: Christoph Hellwig +Signed-off-by: Ibrahim Hashimov +Assisted-by: AuditCode-AI:2026.07 +Signed-off-by: Keith Busch +Acked-by: Daniel Wagner +--- + drivers/nvme/target/tcp.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c +index cb6d37798d74..e4f603b2ace7 100644 +--- a/drivers/nvme/target/tcp.c ++++ b/drivers/nvme/target/tcp.c +@@ -422,6 +422,19 @@ static int nvmet_tcp_map_data(struct nvmet_tcp_cmd *cmd) + if (!len) + return 0; + ++ /* ++ * inline_data_size only bounds the in-capsule (type 0x01) SGL ++ * descriptor below. A non-inline transport SGL data-block ++ * descriptor skips that check entirely and would otherwise reach ++ * sgl_alloc() with an attacker-controlled len of up to 4 GiB, ++ * pinning that much kernel memory for a command that may never ++ * complete. Bound every descriptor type here, before allocating ++ * anything, using the same ceiling this file already applies to ++ * per-PDU H2C data. ++ */ ++ if (len > NVMET_TCP_MAXH2CDATA) ++ return NVME_SC_SGL_INVALID_DATA | NVME_SC_DNR; ++ + if (sgl->type == ((NVME_SGL_FMT_DATA_DESC << 4) | + NVME_SGL_FMT_OFFSET)) { + if (!nvme_is_write(cmd->req.cmd)) +-- +2.55.0 + diff --git a/series.conf b/series.conf index 4bddff66cc0a..161f788a55a4 100644 - -- a/series.conf +++ b/series.conf @@ -36328,6 +36328,7 @@ patches.suse/msft-hv-3712-net-mana-Extend-RX-CQE-coalescing-up-to-8-packets.patch patches.suse/msft-hv-3714-net-mana-Route-ring-buffer-access-through-offset-bas.patch patches.suse/msft-hv-3715-net-mana-Fall-back-to-scattered-pages-for-GDMA-queue.patch + patches.suse/nvmet-tcp-bound-SGL-data-length-before-allocating-co.patch patches.suse/msft-hv-3711-scsi-storvsc-Support-manual-scans-for-all-Hyper-V-ta.patch patches.suse/msft-hv-3700-RDMA-mana_ib-drain-QP-references-after-partial-table.patch patches.suse/msft-hv-3708-RDMA-mana_ib-unify-QP-lookup-table.patch - commit f6f127f - net/rds: handle zerocopy send cleanup before the message is queued (CVE-2026-43502 bsc#1266008). - commit 06484e0 - KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock (git-fixes). - commit 23dbbf0 - KVM: x86/hyperv: Ensure vCPU's Hyper-V object is initialized on cross-vCPU accesses (git-fixes). - commit 638e5d4 - KVM: x86/hyperv: Check for NULL vCPU Hyper-V object in kvm_hv_get_tlb_flush_fifo() (git-fixes). - commit a0fcedb - KVM: x86/hyperv: Get target FIFO in hv_tlb_flush_enqueue(), not caller (git-fixes). - commit f8b7bd6 - KVM: VMX: Prioritize DR7.GD=1 #DB over CPL>0 #GP on Intel (git-fixes). - commit adac121 - KVM: x86: Prioritize #UD on MOV DR over #GP due to non-zero CPL (git-fixes). - commit bea421d - KVM: x86: Manually check DR4/5 write values to fix SVM intercept priority (git-fixes). - commit d3238c6 - KVM: x86: Prioritize DR7.GD #DB over #GP due to illegal DR6/7 value (git-fixes). - commit bb924b7 - KVM: x86: Treat any non-zero return from set_dr() as a faulting condition (git-fixes). - commit 804266a - KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit (git-fixes). - commit bd7845d - kabi/severities: add SCTP symbols to severities - commit 140d2e7 - vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive() (CVE-2026-74406 bsc#1276395). - commit 8929f1c - md/raid10: fix writes_pending leak on write request failures (CVE-2026-72439 bsc#1277876). mwilck: adapted because we don't have commit 4cf58d952909 ("md/raid10: Handle bio_split() errors") - commit e181e7b - md/raid10: fix writes_pending and barrier reference leaks on discard failures (CVE-2026-72438 bsc#1277115). mwilck: adapted because we don't have commit 4cf58d952909 ("md/raid10: Handle bio_split() errors") - commit 5029bbf - net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock (CVE-2026-80739 bsc#1278733). - idpf: bound interrupt-vector register fill to the allocated array (CVE-2026-80693 bsc#1278395). - RDMA/hns: Fix warning in poll cq direct mode (CVE-2026-80647 bsc#1278331). - vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter (CVE-2026-72306 bsc#1277748). - vduse: Requeue failed read to send_list head (CVE-2026-72306 bsc#1277748). - net/mlx5e: xsk: Fix unlocked writing to ICOSQ (CVE-2026-64210 bsc#1273899). - commit f3aefea - net: macb: drop in-flight Tx SKBs on close (CVE-2026-72017 bsc#1276840). - commit 8319b22 - powerpc/kexec_file: Use inclusive range checks in add_usable_mem() (git-fixes). - powerpc/rtas_pci: No hotplug on permanently removed device on pSeries (git-fixes). - powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver (bsc#1215199 CVE-2025-38576 bsc#1248354 git-fixes). - commit 428de03 - ALSA: seq: Don't leak the extension cell pointer in the bounce payload (CVE-2026-74278 bsc#1278132). - commit c1782ec - Bluetooth: hci_core: Fix UAF in hci_unregister_dev() (CVE-2026-74302 bsc#1276445). - commit a2a3ae7 - ALSA: seq: Fix kernel heap address leak in bounce_error_event() (CVE-2026-74278 bsc#1278132). - commit 701e711 - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() (git-fixes). - commit f05490b - serial: amba-pl011: synchronize DMA teardown (CVE-2026-80737 bsc#1279487). - commit d692fa4 ++++ kernel-rt: - tracing: Check return value of __register_event() in trace_module_add_events() (CVE-2026-74471 bsc#1277781). - commit abd891d - ocfs2: reject FITRIM ranges shorter than a cluster (CVE-2026-74349 bsc#1278180). - commit f17effa - selinux: check connect-related permissions on TCP Fast Open (CVE-2026-72243 bsc#1277656). - commit 7ea719d - libceph: fix OOB read in decode_watchers() via missing bounds check (CVE-2026-80557 bsc#1277268). - commit 30f3ebb - md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry (CVE-2026-72437 bsc#1277874). - commit e1e4a3c - dm thin metadata: fix metadata snapshot consistency on commit failure (CVE-2026-72108 bsc#1277350). - commit d2be2d9 - nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621 CVE-2026-80789). diff --git a/patches.suse/nvmet-tcp-bound-SGL-data-length-before-allocating-co.patch b/patches.suse/nvmet-tcp-bound-SGL-data-length-before-allocating-co.patch new file mode 100644 index 000000000000..2025e98e9983 - -- /dev/null +++ b/patches.suse/nvmet-tcp-bound-SGL-data-length-before-allocating-co.patch @@ -0,0 +1,83 @@ +From: Ibrahim Hashimov +Date: Thu, 9 Jul 2026 15:25:33 +0200 +Subject: nvmet-tcp: bound SGL data length before allocating command buffers +Patch-mainline: v7.3-rc1 +Git-commit: 4a3f00262a044e8e15064b1a6860968bf0500bf4 +References: bsc#1279621 CVE-2026-80789 + +nvmet_tcp_map_data() reads the host-controlled 32-bit sgl->length +and, for the in-capsule offset descriptor (type 0x01), checks it +against port->inline_data_size before use. Any other SGL descriptor +type -- including the non-inline transport SGL data-block descriptor +(type (NVME_TRANSPORT_SGL_DATA_DESC << 4) | NVME_SGL_FMT_TRANSPORT_A, +the type a real host uses for out-of-capsule writes) skips that check +entirely and falls straight through to: + + cmd->req.sg = sgl_alloc(len, GFP_KERNEL, &cmd->req.sg_cnt); + +with len taken directly from the wire, unbounded up to 4 GiB. + +nvmet_req_init() only parses the command and never inspects +sgl->length, and nvmet_check_transfer_len() -- the only other place +transfer_len is validated -- runs later, from req->execute(), after +the allocation has already happened. For a write command the target +responds with an R2T and parks the command waiting for the host to +send the data; if the host (or an unauthenticated peer that simply +never follows up) never does, the sgl_alloc() buffer stays resident +for the life of the command. NVMe/TCP has no mandatory authentication +in the default configuration, so any peer able to reach the target +portal and complete a Fabrics connect can drive this with a single +crafted command, repeatable across queues and connections for +amplification. This is unbounded kernel memory allocation +triggered by a remote, effectively unauthenticated peer. + +Validate len against the same NVMET_TCP_MAXH2CDATA ceiling this file +already uses to bound per-PDU H2C data, for every SGL descriptor type, +before doing any allocation. This closes the gap for the non-inline +descriptor while leaving the existing, tighter inline_data_size check +in place for the in-capsule case. + +Runtime-verified on a v6.19 KASAN stand: with this bound in place, a +crafted write command carrying an oversized non-inline SGL length is +rejected before sgl_alloc() runs, where the same request previously +drove an unbounded ~256 MiB kernel allocation (up to 4 GiB) that +stayed resident pending an R2T the host never satisfies. + +Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver") +Cc: stable@vger.kernel.org +Reviewed-by: Christoph Hellwig +Signed-off-by: Ibrahim Hashimov +Assisted-by: AuditCode-AI:2026.07 +Signed-off-by: Keith Busch +Acked-by: Daniel Wagner +--- + drivers/nvme/target/tcp.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c +index cb6d37798d74..e4f603b2ace7 100644 +--- a/drivers/nvme/target/tcp.c ++++ b/drivers/nvme/target/tcp.c +@@ -422,6 +422,19 @@ static int nvmet_tcp_map_data(struct nvmet_tcp_cmd *cmd) + if (!len) + return 0; + ++ /* ++ * inline_data_size only bounds the in-capsule (type 0x01) SGL ++ * descriptor below. A non-inline transport SGL data-block ++ * descriptor skips that check entirely and would otherwise reach ++ * sgl_alloc() with an attacker-controlled len of up to 4 GiB, ++ * pinning that much kernel memory for a command that may never ++ * complete. Bound every descriptor type here, before allocating ++ * anything, using the same ceiling this file already applies to ++ * per-PDU H2C data. ++ */ ++ if (len > NVMET_TCP_MAXH2CDATA) ++ return NVME_SC_SGL_INVALID_DATA | NVME_SC_DNR; ++ + if (sgl->type == ((NVME_SGL_FMT_DATA_DESC << 4) | + NVME_SGL_FMT_OFFSET)) { + if (!nvme_is_write(cmd->req.cmd)) +-- +2.55.0 + diff --git a/series.conf b/series.conf index 4bddff66cc0a..161f788a55a4 100644 - -- a/series.conf +++ b/series.conf @@ -36328,6 +36328,7 @@ patches.suse/msft-hv-3712-net-mana-Extend-RX-CQE-coalescing-up-to-8-packets.patch patches.suse/msft-hv-3714-net-mana-Route-ring-buffer-access-through-offset-bas.patch patches.suse/msft-hv-3715-net-mana-Fall-back-to-scattered-pages-for-GDMA-queue.patch + patches.suse/nvmet-tcp-bound-SGL-data-length-before-allocating-co.patch patches.suse/msft-hv-3711-scsi-storvsc-Support-manual-scans-for-all-Hyper-V-ta.patch patches.suse/msft-hv-3700-RDMA-mana_ib-drain-QP-references-after-partial-table.patch patches.suse/msft-hv-3708-RDMA-mana_ib-unify-QP-lookup-table.patch - commit f6f127f - net/rds: handle zerocopy send cleanup before the message is queued (CVE-2026-43502 bsc#1266008). - commit 06484e0 - KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock (git-fixes). - commit 23dbbf0 - KVM: x86/hyperv: Ensure vCPU's Hyper-V object is initialized on cross-vCPU accesses (git-fixes). - commit 638e5d4 - KVM: x86/hyperv: Check for NULL vCPU Hyper-V object in kvm_hv_get_tlb_flush_fifo() (git-fixes). - commit a0fcedb - KVM: x86/hyperv: Get target FIFO in hv_tlb_flush_enqueue(), not caller (git-fixes). - commit f8b7bd6 - KVM: VMX: Prioritize DR7.GD=1 #DB over CPL>0 #GP on Intel (git-fixes). - commit adac121 - KVM: x86: Prioritize #UD on MOV DR over #GP due to non-zero CPL (git-fixes). - commit bea421d - KVM: x86: Manually check DR4/5 write values to fix SVM intercept priority (git-fixes). - commit d3238c6 - KVM: x86: Prioritize DR7.GD #DB over #GP due to illegal DR6/7 value (git-fixes). - commit bb924b7 - KVM: x86: Treat any non-zero return from set_dr() as a faulting condition (git-fixes). - commit 804266a - KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit (git-fixes). - commit bd7845d - kabi/severities: add SCTP symbols to severities - commit 140d2e7 - vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive() (CVE-2026-74406 bsc#1276395). - commit 8929f1c - md/raid10: fix writes_pending leak on write request failures (CVE-2026-72439 bsc#1277876). mwilck: adapted because we don't have commit 4cf58d952909 ("md/raid10: Handle bio_split() errors") - commit e181e7b - md/raid10: fix writes_pending and barrier reference leaks on discard failures (CVE-2026-72438 bsc#1277115). mwilck: adapted because we don't have commit 4cf58d952909 ("md/raid10: Handle bio_split() errors") - commit 5029bbf - net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock (CVE-2026-80739 bsc#1278733). - idpf: bound interrupt-vector register fill to the allocated array (CVE-2026-80693 bsc#1278395). - RDMA/hns: Fix warning in poll cq direct mode (CVE-2026-80647 bsc#1278331). - vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter (CVE-2026-72306 bsc#1277748). - vduse: Requeue failed read to send_list head (CVE-2026-72306 bsc#1277748). - net/mlx5e: xsk: Fix unlocked writing to ICOSQ (CVE-2026-64210 bsc#1273899). - commit f3aefea - net: macb: drop in-flight Tx SKBs on close (CVE-2026-72017 bsc#1276840). - commit 8319b22 - powerpc/kexec_file: Use inclusive range checks in add_usable_mem() (git-fixes). - powerpc/rtas_pci: No hotplug on permanently removed device on pSeries (git-fixes). - powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver (bsc#1215199 CVE-2025-38576 bsc#1248354 git-fixes). - commit 428de03 - ALSA: seq: Don't leak the extension cell pointer in the bounce payload (CVE-2026-74278 bsc#1278132). - commit c1782ec - Bluetooth: hci_core: Fix UAF in hci_unregister_dev() (CVE-2026-74302 bsc#1276445). - commit a2a3ae7 - ALSA: seq: Fix kernel heap address leak in bounce_error_event() (CVE-2026-74278 bsc#1278132). - commit 701e711 - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() (git-fixes). - commit f05490b - serial: amba-pl011: synchronize DMA teardown (CVE-2026-80737 bsc#1279487). - commit d692fa4 ++++ kernel-rt_debug: - tracing: Check return value of __register_event() in trace_module_add_events() (CVE-2026-74471 bsc#1277781). - commit abd891d - ocfs2: reject FITRIM ranges shorter than a cluster (CVE-2026-74349 bsc#1278180). - commit f17effa - selinux: check connect-related permissions on TCP Fast Open (CVE-2026-72243 bsc#1277656). - commit 7ea719d - libceph: fix OOB read in decode_watchers() via missing bounds check (CVE-2026-80557 bsc#1277268). - commit 30f3ebb - md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry (CVE-2026-72437 bsc#1277874). - commit e1e4a3c - dm thin metadata: fix metadata snapshot consistency on commit failure (CVE-2026-72108 bsc#1277350). - commit d2be2d9 - nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621 CVE-2026-80789). diff --git a/patches.suse/nvmet-tcp-bound-SGL-data-length-before-allocating-co.patch b/patches.suse/nvmet-tcp-bound-SGL-data-length-before-allocating-co.patch new file mode 100644 index 000000000000..2025e98e9983 - -- /dev/null +++ b/patches.suse/nvmet-tcp-bound-SGL-data-length-before-allocating-co.patch @@ -0,0 +1,83 @@ +From: Ibrahim Hashimov +Date: Thu, 9 Jul 2026 15:25:33 +0200 +Subject: nvmet-tcp: bound SGL data length before allocating command buffers +Patch-mainline: v7.3-rc1 +Git-commit: 4a3f00262a044e8e15064b1a6860968bf0500bf4 +References: bsc#1279621 CVE-2026-80789 + +nvmet_tcp_map_data() reads the host-controlled 32-bit sgl->length +and, for the in-capsule offset descriptor (type 0x01), checks it +against port->inline_data_size before use. Any other SGL descriptor +type -- including the non-inline transport SGL data-block descriptor +(type (NVME_TRANSPORT_SGL_DATA_DESC << 4) | NVME_SGL_FMT_TRANSPORT_A, +the type a real host uses for out-of-capsule writes) skips that check +entirely and falls straight through to: + + cmd->req.sg = sgl_alloc(len, GFP_KERNEL, &cmd->req.sg_cnt); + +with len taken directly from the wire, unbounded up to 4 GiB. + +nvmet_req_init() only parses the command and never inspects +sgl->length, and nvmet_check_transfer_len() -- the only other place +transfer_len is validated -- runs later, from req->execute(), after +the allocation has already happened. For a write command the target +responds with an R2T and parks the command waiting for the host to +send the data; if the host (or an unauthenticated peer that simply +never follows up) never does, the sgl_alloc() buffer stays resident +for the life of the command. NVMe/TCP has no mandatory authentication +in the default configuration, so any peer able to reach the target +portal and complete a Fabrics connect can drive this with a single +crafted command, repeatable across queues and connections for +amplification. This is unbounded kernel memory allocation +triggered by a remote, effectively unauthenticated peer. + +Validate len against the same NVMET_TCP_MAXH2CDATA ceiling this file +already uses to bound per-PDU H2C data, for every SGL descriptor type, +before doing any allocation. This closes the gap for the non-inline +descriptor while leaving the existing, tighter inline_data_size check +in place for the in-capsule case. + +Runtime-verified on a v6.19 KASAN stand: with this bound in place, a +crafted write command carrying an oversized non-inline SGL length is +rejected before sgl_alloc() runs, where the same request previously +drove an unbounded ~256 MiB kernel allocation (up to 4 GiB) that +stayed resident pending an R2T the host never satisfies. + +Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver") +Cc: stable@vger.kernel.org +Reviewed-by: Christoph Hellwig +Signed-off-by: Ibrahim Hashimov +Assisted-by: AuditCode-AI:2026.07 +Signed-off-by: Keith Busch +Acked-by: Daniel Wagner +--- + drivers/nvme/target/tcp.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c +index cb6d37798d74..e4f603b2ace7 100644 +--- a/drivers/nvme/target/tcp.c ++++ b/drivers/nvme/target/tcp.c +@@ -422,6 +422,19 @@ static int nvmet_tcp_map_data(struct nvmet_tcp_cmd *cmd) + if (!len) + return 0; + ++ /* ++ * inline_data_size only bounds the in-capsule (type 0x01) SGL ++ * descriptor below. A non-inline transport SGL data-block ++ * descriptor skips that check entirely and would otherwise reach ++ * sgl_alloc() with an attacker-controlled len of up to 4 GiB, ++ * pinning that much kernel memory for a command that may never ++ * complete. Bound every descriptor type here, before allocating ++ * anything, using the same ceiling this file already applies to ++ * per-PDU H2C data. ++ */ ++ if (len > NVMET_TCP_MAXH2CDATA) ++ return NVME_SC_SGL_INVALID_DATA | NVME_SC_DNR; ++ + if (sgl->type == ((NVME_SGL_FMT_DATA_DESC << 4) | + NVME_SGL_FMT_OFFSET)) { + if (!nvme_is_write(cmd->req.cmd)) +-- +2.55.0 + diff --git a/series.conf b/series.conf index 4bddff66cc0a..161f788a55a4 100644 - -- a/series.conf +++ b/series.conf @@ -36328,6 +36328,7 @@ patches.suse/msft-hv-3712-net-mana-Extend-RX-CQE-coalescing-up-to-8-packets.patch patches.suse/msft-hv-3714-net-mana-Route-ring-buffer-access-through-offset-bas.patch patches.suse/msft-hv-3715-net-mana-Fall-back-to-scattered-pages-for-GDMA-queue.patch + patches.suse/nvmet-tcp-bound-SGL-data-length-before-allocating-co.patch patches.suse/msft-hv-3711-scsi-storvsc-Support-manual-scans-for-all-Hyper-V-ta.patch patches.suse/msft-hv-3700-RDMA-mana_ib-drain-QP-references-after-partial-table.patch patches.suse/msft-hv-3708-RDMA-mana_ib-unify-QP-lookup-table.patch - commit f6f127f - net/rds: handle zerocopy send cleanup before the message is queued (CVE-2026-43502 bsc#1266008). - commit 06484e0 - KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock (git-fixes). - commit 23dbbf0 - KVM: x86/hyperv: Ensure vCPU's Hyper-V object is initialized on cross-vCPU accesses (git-fixes). - commit 638e5d4 - KVM: x86/hyperv: Check for NULL vCPU Hyper-V object in kvm_hv_get_tlb_flush_fifo() (git-fixes). - commit a0fcedb - KVM: x86/hyperv: Get target FIFO in hv_tlb_flush_enqueue(), not caller (git-fixes). - commit f8b7bd6 - KVM: VMX: Prioritize DR7.GD=1 #DB over CPL>0 #GP on Intel (git-fixes). - commit adac121 - KVM: x86: Prioritize #UD on MOV DR over #GP due to non-zero CPL (git-fixes). - commit bea421d - KVM: x86: Manually check DR4/5 write values to fix SVM intercept priority (git-fixes). - commit d3238c6 - KVM: x86: Prioritize DR7.GD #DB over #GP due to illegal DR6/7 value (git-fixes). - commit bb924b7 - KVM: x86: Treat any non-zero return from set_dr() as a faulting condition (git-fixes). - commit 804266a - KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit (git-fixes). - commit bd7845d - kabi/severities: add SCTP symbols to severities - commit 140d2e7 - vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive() (CVE-2026-74406 bsc#1276395). - commit 8929f1c - md/raid10: fix writes_pending leak on write request failures (CVE-2026-72439 bsc#1277876). mwilck: adapted because we don't have commit 4cf58d952909 ("md/raid10: Handle bio_split() errors") - commit e181e7b - md/raid10: fix writes_pending and barrier reference leaks on discard failures (CVE-2026-72438 bsc#1277115). mwilck: adapted because we don't have commit 4cf58d952909 ("md/raid10: Handle bio_split() errors") - commit 5029bbf - net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock (CVE-2026-80739 bsc#1278733). - idpf: bound interrupt-vector register fill to the allocated array (CVE-2026-80693 bsc#1278395). - RDMA/hns: Fix warning in poll cq direct mode (CVE-2026-80647 bsc#1278331). - vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter (CVE-2026-72306 bsc#1277748). - vduse: Requeue failed read to send_list head (CVE-2026-72306 bsc#1277748). - net/mlx5e: xsk: Fix unlocked writing to ICOSQ (CVE-2026-64210 bsc#1273899). - commit f3aefea - net: macb: drop in-flight Tx SKBs on close (CVE-2026-72017 bsc#1276840). - commit 8319b22 - powerpc/kexec_file: Use inclusive range checks in add_usable_mem() (git-fixes). - powerpc/rtas_pci: No hotplug on permanently removed device on pSeries (git-fixes). - powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver (bsc#1215199 CVE-2025-38576 bsc#1248354 git-fixes). - commit 428de03 - ALSA: seq: Don't leak the extension cell pointer in the bounce payload (CVE-2026-74278 bsc#1278132). - commit c1782ec - Bluetooth: hci_core: Fix UAF in hci_unregister_dev() (CVE-2026-74302 bsc#1276445). - commit a2a3ae7 - ALSA: seq: Fix kernel heap address leak in bounce_error_event() (CVE-2026-74278 bsc#1278132). - commit 701e711 - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() (git-fixes). - commit f05490b - serial: amba-pl011: synchronize DMA teardown (CVE-2026-80737 bsc#1279487). - commit d692fa4 ++++ libpcap: - Security fixes: * CVE-2026-0799: Access M[] safely in the BPF interpreter (bsc#1279782) * CVE-2026-6244: Avoid division by zero via pcap_offline_filter() (bsc#1279595) * CVE-2026-18238: Fix RPCAP_MSG_PACKET validation (bsc#1279783) * CVE-2026-31911: Fail opcodes safely in the BPF interpreter (bsc#1279588) * CVE-2026-31912: Mind the program bounds in pcap_offline_filter() (bsc#1279593) * CVE-2026-6554: Limit "ja L" looping in pcap_offline_filter() (bsc#1279584) * CVE-2026-18313: Fix a memory leak in rpcapd (bsc#1279784) * Rebase libpcap-1.0.0-ppp.patch * Add patches: - libpcap-CVE-2026-0799.patch - libpcap-CVE-2026-6244.patch - libpcap-CVE-2026-18238.patch - libpcap-CVE-2026-31911.patch - libpcap-CVE-2026-31912.patch - libpcap-CVE-2026-6554.patch - libpcap-CVE-2026-18313.patch ------------------------------------------------------------------ ------------------ 2026-9-8 - Sep 8 2026 ------------------- ------------------------------------------------------------------ ++++ jq: - Add patch CVE-2026-43895.patch (CVE-2026-43895, bsc#1265071) - Add patch CVE-2026-47770.patch (CVE-2026-47770, bsc#1269221) ++++ kernel-default: - md/raid1: fix writes_pending and barrier reference leaks on write failures (CVE-2026-72440 bsc#1277114). mwilck: adapted for some missing previous commits: b1a7ad8b5c4f ("md/raid1: Handle bio_split() errors") 88ed59c4cc6c ("md/raid1: factor out helper to handle blocked rdev from raid1_write_request()") - commit eb68573 - dm cache: fix dirty mapping checking in passthrough mode switching (CVE-2026-53061 bsc#1269685). mwilck: minor adaptation because we don't have commit c2662b1544cb ("dm cache: support shrinking the origin device") - commit f7a3df4 - Update patches.kabi/kabi-move-skb_dev-out-of-struct-nf_queue_entry.patch (bsc#1279813) - handle also the allocation and freeing in nf_queue_entry_dup() - commit 709bec4 - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (CVE-2026-45872 bsc#1266735). - commit ed61e09 - bpf: Guard __get_user acesss with access_ok for uprobe_multi data (CVE-2026-74258 bsc#1276538). - commit 19810f7 - ALSA: seq: avoid stale FIFO cells during resize (CVE-2026-74261 bsc#1276528). - commit 9aae7c6 - soundwire: fix bug in sdw_add_element_group_count found by syzkaller (CVE-2026-72488 bsc#1276766). - commit 6a3ef53 - Disable CONFIG_BATMAN_ADV (jsc#PED-16892) - commit 4058797 - vfio/pci: Latch disable_idle_d3 per device (CVE-2026-64476 bsc#1274245). - commit 445f745 - drm/amdgpu: Fix context pstate override handling (bsc#1275129 CVE-2026-68273) - commit 606cebd - net/sched: cls_bpf: prevent unbounded recursion in offload rollback (CVE-2026-74382 bsc#1278240). - commit 5f65b7a ++++ kernel-rt: - md/raid1: fix writes_pending and barrier reference leaks on write failures (CVE-2026-72440 bsc#1277114). mwilck: adapted for some missing previous commits: b1a7ad8b5c4f ("md/raid1: Handle bio_split() errors") 88ed59c4cc6c ("md/raid1: factor out helper to handle blocked rdev from raid1_write_request()") - commit eb68573 - dm cache: fix dirty mapping checking in passthrough mode switching (CVE-2026-53061 bsc#1269685). mwilck: minor adaptation because we don't have commit c2662b1544cb ("dm cache: support shrinking the origin device") - commit f7a3df4 - Update patches.kabi/kabi-move-skb_dev-out-of-struct-nf_queue_entry.patch (bsc#1279813) - handle also the allocation and freeing in nf_queue_entry_dup() - commit 709bec4 - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (CVE-2026-45872 bsc#1266735). - commit ed61e09 - bpf: Guard __get_user acesss with access_ok for uprobe_multi data (CVE-2026-74258 bsc#1276538). - commit 19810f7 - ALSA: seq: avoid stale FIFO cells during resize (CVE-2026-74261 bsc#1276528). - commit 9aae7c6 - soundwire: fix bug in sdw_add_element_group_count found by syzkaller (CVE-2026-72488 bsc#1276766). - commit 6a3ef53 - Disable CONFIG_BATMAN_ADV (jsc#PED-16892) - commit 4058797 - vfio/pci: Latch disable_idle_d3 per device (CVE-2026-64476 bsc#1274245). - commit 445f745 - drm/amdgpu: Fix context pstate override handling (bsc#1275129 CVE-2026-68273) - commit 606cebd - net/sched: cls_bpf: prevent unbounded recursion in offload rollback (CVE-2026-74382 bsc#1278240). - commit 5f65b7a ++++ kernel-rt_debug: - md/raid1: fix writes_pending and barrier reference leaks on write failures (CVE-2026-72440 bsc#1277114). mwilck: adapted for some missing previous commits: b1a7ad8b5c4f ("md/raid1: Handle bio_split() errors") 88ed59c4cc6c ("md/raid1: factor out helper to handle blocked rdev from raid1_write_request()") - commit eb68573 - dm cache: fix dirty mapping checking in passthrough mode switching (CVE-2026-53061 bsc#1269685). mwilck: minor adaptation because we don't have commit c2662b1544cb ("dm cache: support shrinking the origin device") - commit f7a3df4 - Update patches.kabi/kabi-move-skb_dev-out-of-struct-nf_queue_entry.patch (bsc#1279813) - handle also the allocation and freeing in nf_queue_entry_dup() - commit 709bec4 - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (CVE-2026-45872 bsc#1266735). - commit ed61e09 - bpf: Guard __get_user acesss with access_ok for uprobe_multi data (CVE-2026-74258 bsc#1276538). - commit 19810f7 - ALSA: seq: avoid stale FIFO cells during resize (CVE-2026-74261 bsc#1276528). - commit 9aae7c6 - soundwire: fix bug in sdw_add_element_group_count found by syzkaller (CVE-2026-72488 bsc#1276766). - commit 6a3ef53 - Disable CONFIG_BATMAN_ADV (jsc#PED-16892) - commit 4058797 - vfio/pci: Latch disable_idle_d3 per device (CVE-2026-64476 bsc#1274245). - commit 445f745 - drm/amdgpu: Fix context pstate override handling (bsc#1275129 CVE-2026-68273) - commit 606cebd - net/sched: cls_bpf: prevent unbounded recursion in offload rollback (CVE-2026-74382 bsc#1278240). - commit 5f65b7a ++++ sg3_utils: - Update to version 1.48~20221101+3.9463741: * sg_inq: avoid including 0-bytes in SCSI name strings (bsc#1277106) ++++ selinux-policy: - Update to version 20241031+git24.fd2ea411a: * named filetrans for netconfig (bsc#1275219) * Revert "Apply fix_unconfined.patch" (bsc#1275219) * Allow cloud init to domtrans into ssh keygen (bsc#1249964) * Make stalld stalld_var_run_t labeling rules more generic (bsc#1259438) ------------------------------------------------------------------ ------------------ 2026-9-7 - Sep 7 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() (CVE-2026-72349 bsc#1277784). - commit 29b5d43 - s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() (CVE-2026-72236 bsc#1277614). - commit c05d45a - nvdimm/btt: Free arenas on btt_init() error paths (CVE-2026-72224 bsc#1277215). - commit e5f2d77 - dm era: fix out-of-bounds memory access for non-zero start sector (CVE-2026-72107 bsc#1277349). - commit 1e1dfcc - dm-ioctl: fix a possible overflow in list_version_get_info (CVE-2026-72106 bsc#1277321). - commit 7ae1fa7 - dm_early_create: fix freeing used table on dm_resume failure (CVE-2026-72102 bsc#1277314). - commit 55e35e5 - KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers (CVE-2026-72282 bsc#1277728). - commit 4ff29a0 - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (CVE-2026-74743 bsc#1277908). - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (CVE-2026-72323 bsc#1275985). - commit 99a8661 - Refresh patches.suse/vxlan-do-not-arm-the-ageing-timer-on-a-device-that-is-down.patch. - commit 4210e8c - Refresh patches.suse/ipvs-do-not-propagate-one-packet-flag-to-synced-conns.patch. - commit 9ef1455 - Refresh patches.suse/xdp-reject-clones-that-overrun-skb_shared_info-tailroom.patch. - commit ffa1ef6 - Refresh patches.suse/net-ethernet-ti-am65-cpsw-nuss-Fix-port_id-extraction-from.patch. - commit 03bac5c - Refresh patches.suse/netfilter-nf_conntrack_irc-fix-parse_dcc-off-by-one-OOB-re.patch. - commit d6029ac - Refresh patches.suse/xfrm-validate-selector-family-and-prefixlen-during-match.patch. - commit 6298b0b - Refresh patches.suse/tipc-fix-UAF-in-tipc_l2_send_msg.patch. - commit ffe48a0 - Refresh patches.suse/ipv6-guard-against-possible-NULL-deref-in-__in6_dev_stats_.patch. - commit 5ed63f0 - Refresh patches.suse/net-atm-reject-out-of-range-traffic-classes-in-QoS-validat.patch. - commit 401cab5 - Refresh patches.suse/net-tls-Consume-empty-data-records-in-tls_sw_read_sock.patch. - commit 9558a5d - drm/amdgpu: Reject UVD message with invalid number of h265 refs (bsc#1279422 CVE-2026-80909) - commit 559fca3 - cpu: hotplug: Bound hotplug states sysfs output (CVE-2026-72066 bsc#1277149). - commit b5ec6ee - fbdev: bound mode sysfs output to the sysfs buffer (bsc#1278294 CVE-2026-80580) - commit 351700a - net/mlx5: LAG, MPESW, Fix missing complete() on devcom error (CVE-2026-80667 bsc#1278324) - commit a5ee6b4 - RDMA/irdma: Fix OOB read during CQ MR registration (CVE-2026-74346 bsc#1278155) - commit e788401 - staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() (git-fixes). - staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() (git-fixes). - usb: gadget: fix null pointer dereference in usb_put_function_instance() (git-fixes). - usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() (git-fixes). - usb: typec: ucsi: displayport: Fix OOB altmode array index (git-fixes). - commit bb5e4a0 ++++ kernel-rt: - netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() (CVE-2026-72349 bsc#1277784). - commit 29b5d43 - s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() (CVE-2026-72236 bsc#1277614). - commit c05d45a - nvdimm/btt: Free arenas on btt_init() error paths (CVE-2026-72224 bsc#1277215). - commit e5f2d77 - dm era: fix out-of-bounds memory access for non-zero start sector (CVE-2026-72107 bsc#1277349). - commit 1e1dfcc - dm-ioctl: fix a possible overflow in list_version_get_info (CVE-2026-72106 bsc#1277321). - commit 7ae1fa7 - dm_early_create: fix freeing used table on dm_resume failure (CVE-2026-72102 bsc#1277314). - commit 55e35e5 - KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers (CVE-2026-72282 bsc#1277728). - commit 4ff29a0 - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (CVE-2026-74743 bsc#1277908). - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (CVE-2026-72323 bsc#1275985). - commit 99a8661 - Refresh patches.suse/vxlan-do-not-arm-the-ageing-timer-on-a-device-that-is-down.patch. - commit 4210e8c - Refresh patches.suse/ipvs-do-not-propagate-one-packet-flag-to-synced-conns.patch. - commit 9ef1455 - Refresh patches.suse/xdp-reject-clones-that-overrun-skb_shared_info-tailroom.patch. - commit ffa1ef6 - Refresh patches.suse/net-ethernet-ti-am65-cpsw-nuss-Fix-port_id-extraction-from.patch. - commit 03bac5c - Refresh patches.suse/netfilter-nf_conntrack_irc-fix-parse_dcc-off-by-one-OOB-re.patch. - commit d6029ac - Refresh patches.suse/xfrm-validate-selector-family-and-prefixlen-during-match.patch. - commit 6298b0b - Refresh patches.suse/tipc-fix-UAF-in-tipc_l2_send_msg.patch. - commit ffe48a0 - Refresh patches.suse/ipv6-guard-against-possible-NULL-deref-in-__in6_dev_stats_.patch. - commit 5ed63f0 - Refresh patches.suse/net-atm-reject-out-of-range-traffic-classes-in-QoS-validat.patch. - commit 401cab5 - Refresh patches.suse/net-tls-Consume-empty-data-records-in-tls_sw_read_sock.patch. - commit 9558a5d - drm/amdgpu: Reject UVD message with invalid number of h265 refs (bsc#1279422 CVE-2026-80909) - commit 559fca3 - cpu: hotplug: Bound hotplug states sysfs output (CVE-2026-72066 bsc#1277149). - commit b5ec6ee - fbdev: bound mode sysfs output to the sysfs buffer (bsc#1278294 CVE-2026-80580) - commit 351700a - net/mlx5: LAG, MPESW, Fix missing complete() on devcom error (CVE-2026-80667 bsc#1278324) - commit a5ee6b4 - RDMA/irdma: Fix OOB read during CQ MR registration (CVE-2026-74346 bsc#1278155) - commit e788401 - staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() (git-fixes). - staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() (git-fixes). - usb: gadget: fix null pointer dereference in usb_put_function_instance() (git-fixes). - usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() (git-fixes). - usb: typec: ucsi: displayport: Fix OOB altmode array index (git-fixes). - commit bb5e4a0 ++++ kernel-rt_debug: - netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() (CVE-2026-72349 bsc#1277784). - commit 29b5d43 - s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() (CVE-2026-72236 bsc#1277614). - commit c05d45a - nvdimm/btt: Free arenas on btt_init() error paths (CVE-2026-72224 bsc#1277215). - commit e5f2d77 - dm era: fix out-of-bounds memory access for non-zero start sector (CVE-2026-72107 bsc#1277349). - commit 1e1dfcc - dm-ioctl: fix a possible overflow in list_version_get_info (CVE-2026-72106 bsc#1277321). - commit 7ae1fa7 - dm_early_create: fix freeing used table on dm_resume failure (CVE-2026-72102 bsc#1277314). - commit 55e35e5 - KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers (CVE-2026-72282 bsc#1277728). - commit 4ff29a0 - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (CVE-2026-74743 bsc#1277908). - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (CVE-2026-72323 bsc#1275985). - commit 99a8661 - Refresh patches.suse/vxlan-do-not-arm-the-ageing-timer-on-a-device-that-is-down.patch. - commit 4210e8c - Refresh patches.suse/ipvs-do-not-propagate-one-packet-flag-to-synced-conns.patch. - commit 9ef1455 - Refresh patches.suse/xdp-reject-clones-that-overrun-skb_shared_info-tailroom.patch. - commit ffa1ef6 - Refresh patches.suse/net-ethernet-ti-am65-cpsw-nuss-Fix-port_id-extraction-from.patch. - commit 03bac5c - Refresh patches.suse/netfilter-nf_conntrack_irc-fix-parse_dcc-off-by-one-OOB-re.patch. - commit d6029ac - Refresh patches.suse/xfrm-validate-selector-family-and-prefixlen-during-match.patch. - commit 6298b0b - Refresh patches.suse/tipc-fix-UAF-in-tipc_l2_send_msg.patch. - commit ffe48a0 - Refresh patches.suse/ipv6-guard-against-possible-NULL-deref-in-__in6_dev_stats_.patch. - commit 5ed63f0 - Refresh patches.suse/net-atm-reject-out-of-range-traffic-classes-in-QoS-validat.patch. - commit 401cab5 - Refresh patches.suse/net-tls-Consume-empty-data-records-in-tls_sw_read_sock.patch. - commit 9558a5d - drm/amdgpu: Reject UVD message with invalid number of h265 refs (bsc#1279422 CVE-2026-80909) - commit 559fca3 - cpu: hotplug: Bound hotplug states sysfs output (CVE-2026-72066 bsc#1277149). - commit b5ec6ee - fbdev: bound mode sysfs output to the sysfs buffer (bsc#1278294 CVE-2026-80580) - commit 351700a - net/mlx5: LAG, MPESW, Fix missing complete() on devcom error (CVE-2026-80667 bsc#1278324) - commit a5ee6b4 - RDMA/irdma: Fix OOB read during CQ MR registration (CVE-2026-74346 bsc#1278155) - commit e788401 - staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() (git-fixes). - staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() (git-fixes). - usb: gadget: fix null pointer dereference in usb_put_function_instance() (git-fixes). - usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() (git-fixes). - usb: typec: ucsi: displayport: Fix OOB altmode array index (git-fixes). - commit bb5e4a0 ------------------------------------------------------------------ ------------------ 2026-9-6 - Sep 6 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - ALSA: pcm: wake linked drain waiters on unlink (CVE-2026-80716 bsc#1277837). - commit 85bdb8c - ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (CVE-2026-74388 bsc#1278253). - commit 0ebd963 - drm/amd/display: fix division by zero in get_estimated_bw() (git-fixes). - drm/nouveau: Use write-combined maps for coherent (git-fixes). - drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE (git-fixes). - drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE (git-fixes). - drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op (git-fixes). - drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used (git-fixes). - drm/gud: validate TV mode names before creating enum property (git-fixes). - drm/gud: NUL-terminate TV mode names read from the device (git-fixes). - accel/qaic: Address potential out-of-bounds read in resp_worker() (git-fixes). - drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() (git-fixes). - HID: rmi: fix OOB access with undersized RMI reports (git-fixes). - HID: wacom: validate report length in wacom_intuos_pro2_bt_irq (git-fixes). - ALSA: caiaq: Fix potential double-free at error path (git-fixes). - selftests/alsa: Fix the step check for INTEGER controls (git-fixes). - ALSA: rawmidi: Return the error from snd_rawmidi_input_params() (git-fixes). - ALSA: dummy: Report a change when one capture switch channel moves (git-fixes). - ALSA: hda: restore MFG widget enumeration after core split (git-fixes). - ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() (git-fixes). - ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF (git-fixes). - ALSA: harmony: initialize locks before requesting IRQ (git-fixes). - ata: ahci: work around lost interrupts on Marvell 88SE61xx (git-fixes). - commit 9508b01 ++++ kernel-rt: - ALSA: pcm: wake linked drain waiters on unlink (CVE-2026-80716 bsc#1277837). - commit 85bdb8c - ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (CVE-2026-74388 bsc#1278253). - commit 0ebd963 - drm/amd/display: fix division by zero in get_estimated_bw() (git-fixes). - drm/nouveau: Use write-combined maps for coherent (git-fixes). - drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE (git-fixes). - drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE (git-fixes). - drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op (git-fixes). - drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used (git-fixes). - drm/gud: validate TV mode names before creating enum property (git-fixes). - drm/gud: NUL-terminate TV mode names read from the device (git-fixes). - accel/qaic: Address potential out-of-bounds read in resp_worker() (git-fixes). - drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() (git-fixes). - HID: rmi: fix OOB access with undersized RMI reports (git-fixes). - HID: wacom: validate report length in wacom_intuos_pro2_bt_irq (git-fixes). - ALSA: caiaq: Fix potential double-free at error path (git-fixes). - selftests/alsa: Fix the step check for INTEGER controls (git-fixes). - ALSA: rawmidi: Return the error from snd_rawmidi_input_params() (git-fixes). - ALSA: dummy: Report a change when one capture switch channel moves (git-fixes). - ALSA: hda: restore MFG widget enumeration after core split (git-fixes). - ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() (git-fixes). - ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF (git-fixes). - ALSA: harmony: initialize locks before requesting IRQ (git-fixes). - ata: ahci: work around lost interrupts on Marvell 88SE61xx (git-fixes). - commit 9508b01 ++++ kernel-rt_debug: - ALSA: pcm: wake linked drain waiters on unlink (CVE-2026-80716 bsc#1277837). - commit 85bdb8c - ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (CVE-2026-74388 bsc#1278253). - commit 0ebd963 - drm/amd/display: fix division by zero in get_estimated_bw() (git-fixes). - drm/nouveau: Use write-combined maps for coherent (git-fixes). - drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE (git-fixes). - drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE (git-fixes). - drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op (git-fixes). - drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used (git-fixes). - drm/gud: validate TV mode names before creating enum property (git-fixes). - drm/gud: NUL-terminate TV mode names read from the device (git-fixes). - accel/qaic: Address potential out-of-bounds read in resp_worker() (git-fixes). - drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() (git-fixes). - HID: rmi: fix OOB access with undersized RMI reports (git-fixes). - HID: wacom: validate report length in wacom_intuos_pro2_bt_irq (git-fixes). - ALSA: caiaq: Fix potential double-free at error path (git-fixes). - selftests/alsa: Fix the step check for INTEGER controls (git-fixes). - ALSA: rawmidi: Return the error from snd_rawmidi_input_params() (git-fixes). - ALSA: dummy: Report a change when one capture switch channel moves (git-fixes). - ALSA: hda: restore MFG widget enumeration after core split (git-fixes). - ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() (git-fixes). - ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF (git-fixes). - ALSA: harmony: initialize locks before requesting IRQ (git-fixes). - ata: ahci: work around lost interrupts on Marvell 88SE61xx (git-fixes). - commit 9508b01 ------------------------------------------------------------------ ------------------ 2026-9-5 - Sep 5 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - perf: Reject exited events as group leaders (git-fixes). - perf/core: Detach event groups during remove_on_exec (CVE-2026-64556 bsc#1273251). - commit e10a3aa ++++ kernel-rt: - perf: Reject exited events as group leaders (git-fixes). - perf/core: Detach event groups during remove_on_exec (CVE-2026-64556 bsc#1273251). - commit e10a3aa ++++ kernel-rt_debug: - perf: Reject exited events as group leaders (git-fixes). - perf/core: Detach event groups during remove_on_exec (CVE-2026-64556 bsc#1273251). - commit e10a3aa ------------------------------------------------------------------ ------------------ 2026-9-4 - Sep 4 2026 ------------------- ------------------------------------------------------------------ ++++ transactional-update: - Version 4.8.4 - libtukit: Fix --drop-if-no-change after `apply` [bsc#1276847] ++++ kernel-default: - xfrm: validate selector family and prefixlen during match (CVE-2026-72450 bsc#1278113). - commit 609278f - netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read (CVE-2026-80603 bsc#1278293). - commit 11104a2 - xen/gntdev: fix error handling in ioctl (bsc#1277235 CVE-2026-72138). - commit 79eee73 - scsi: xen: scsiback: Free the command tag on the TMR submit-failure path (bsc#1277179 CVE-2026-72086). - commit 10d307b - add bug reference to existing mana patch (bsc#1277254). - commit 1791cde - tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() (CVE-2026-72404 bsc#1278031). - commit 2204ac0 - wifi: ath6kl: fix use-after-free in aggr_reset_state() (bsc#1274803 CVE-2026-68198). - commit bce0396 - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path (CVE-2026-74377 bsc#1278236) - commit 26869b7 - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe (CVE-2026-74378 bsc#1278233) - commit 2342d3f - RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs (CVE-2026-74390 bsc#1278088) - commit e711146 - perf/x86/amd/core: Avoid enabling BRS from the SVM reload path (bsc#1277761 CVE-2026-72325). - commit 076690b - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path (CVE-2026-74377 bsc#1278236) - commit ffbe021 - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe (CVE-2026-74378 bsc#1278233) - commit 3b77115 - IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier (CVE-2026-74397 bsc#1278098) - commit 33d4fb9 - wifi: mac80211: validate individual TWT params before driver setup (CVE-2026-80722 bsc#1277860). - commit 36bf39a - Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout() (git-fixes). - Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM (git-fixes). - Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan (git-fixes). - commit c6f8417 - PCI: Check ROM header and data structure addr before accessing (CVE-2026-72487 bsc#1276767). - PCI: Introduce named defines for PCI ROM (CVE-2026-72487 bsc#1276767). - commit 2dbdd3c ++++ kernel-rt: - xfrm: validate selector family and prefixlen during match (CVE-2026-72450 bsc#1278113). - commit 609278f - netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read (CVE-2026-80603 bsc#1278293). - commit 11104a2 - xen/gntdev: fix error handling in ioctl (bsc#1277235 CVE-2026-72138). - commit 79eee73 - scsi: xen: scsiback: Free the command tag on the TMR submit-failure path (bsc#1277179 CVE-2026-72086). - commit 10d307b - add bug reference to existing mana patch (bsc#1277254). - commit 1791cde - tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() (CVE-2026-72404 bsc#1278031). - commit 2204ac0 - wifi: ath6kl: fix use-after-free in aggr_reset_state() (bsc#1274803 CVE-2026-68198). - commit bce0396 - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path (CVE-2026-74377 bsc#1278236) - commit 26869b7 - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe (CVE-2026-74378 bsc#1278233) - commit 2342d3f - RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs (CVE-2026-74390 bsc#1278088) - commit e711146 - perf/x86/amd/core: Avoid enabling BRS from the SVM reload path (bsc#1277761 CVE-2026-72325). - commit 076690b - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path (CVE-2026-74377 bsc#1278236) - commit ffbe021 - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe (CVE-2026-74378 bsc#1278233) - commit 3b77115 - IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier (CVE-2026-74397 bsc#1278098) - commit 33d4fb9 - wifi: mac80211: validate individual TWT params before driver setup (CVE-2026-80722 bsc#1277860). - commit 36bf39a - Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout() (git-fixes). - Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM (git-fixes). - Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan (git-fixes). - commit c6f8417 - PCI: Check ROM header and data structure addr before accessing (CVE-2026-72487 bsc#1276767). - PCI: Introduce named defines for PCI ROM (CVE-2026-72487 bsc#1276767). - commit 2dbdd3c ++++ kernel-rt_debug: - xfrm: validate selector family and prefixlen during match (CVE-2026-72450 bsc#1278113). - commit 609278f - netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read (CVE-2026-80603 bsc#1278293). - commit 11104a2 - xen/gntdev: fix error handling in ioctl (bsc#1277235 CVE-2026-72138). - commit 79eee73 - scsi: xen: scsiback: Free the command tag on the TMR submit-failure path (bsc#1277179 CVE-2026-72086). - commit 10d307b - add bug reference to existing mana patch (bsc#1277254). - commit 1791cde - tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() (CVE-2026-72404 bsc#1278031). - commit 2204ac0 - wifi: ath6kl: fix use-after-free in aggr_reset_state() (bsc#1274803 CVE-2026-68198). - commit bce0396 - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path (CVE-2026-74377 bsc#1278236) - commit 26869b7 - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe (CVE-2026-74378 bsc#1278233) - commit 2342d3f - RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs (CVE-2026-74390 bsc#1278088) - commit e711146 - perf/x86/amd/core: Avoid enabling BRS from the SVM reload path (bsc#1277761 CVE-2026-72325). - commit 076690b - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path (CVE-2026-74377 bsc#1278236) - commit ffbe021 - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe (CVE-2026-74378 bsc#1278233) - commit 3b77115 - IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier (CVE-2026-74397 bsc#1278098) - commit 33d4fb9 - wifi: mac80211: validate individual TWT params before driver setup (CVE-2026-80722 bsc#1277860). - commit 36bf39a - Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout() (git-fixes). - Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM (git-fixes). - Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan (git-fixes). - commit c6f8417 - PCI: Check ROM header and data structure addr before accessing (CVE-2026-72487 bsc#1276767). - PCI: Introduce named defines for PCI ROM (CVE-2026-72487 bsc#1276767). - commit 2dbdd3c ++++ expat: - update to 2.8.4: * Security fixes: * CVE-2026-66046, bsc#1275732: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c * CVE-2026-76641, bsc#1275915: out-of-bounds read vulnerability that allows attackers to trigger memory corruption * CVE-2026-76957, bsc#1275859: lacks handler call depth tracking with custom encoding callbacks, use-after-free can occur * CVE-2026-76956, bsc#1275860: misinterpretation of getentropy's return code leads to insufficient entropy, vulnerable to hash flooding denial of service * Other fixes: * CMake: only add /source-charset:utf-8 when /utf-8 is not present * lib: resolve undefined behavior from overshifting a signed int * lib: support read-only hash table lookup with non-zero-terminated keys * lib: use a C99 bool for ENTITY.open * version info bumped from 13:3:12 to 13:4:12 - update to 2.8.3: * Security fixes: * CVE-2026-72522, bsc#1275594: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same as high surrogates during Unicode processing * Other fixes: * fix support for 2+ GiB documents (regression from 2.8.2) * reject empty version in the XML declaration * fix printf format for AIX * CMake|AIX: enable EXPAT_DEV_URANDOM by default * version info bumped from 13:2:12 to 13:3:12 ++++ python311-core: - Update to 3.11.16: - Build - gh-153438: Update Windows build and installer tooling and documentation to use the current download URL for nuget.exe. - Library - gh-109638: Fix exponential time in csv.Sniffer.sniff() for a sample which contains many quote characters. A doubled quote character is now also detected in a field which contains the delimiter or a line break. - gh-98820: Fix quadratic time in csv.Sniffer.sniff() for a sample which contains quoted fields, in particular for a single column of quoted fields. - gh-149231: In tomllib, the number of parts in TOML keys is now limited. - gh-146083: Update bundled libexpat to version 2.7.5. - gh-141707: Don’t change tarfile.TarInfo type from AREGTYPE to DIRTYPE when parsing GNU long name or link headers (bsc#1259611, CVE-2025-13462). - gh-90949: Add SetBillionLaughsAttackProtectionActivationThreshold() and SetBillionLaughsAttackProtectionMaximumAmplification() to xmlparser objects to tune protections against billion laughs attacks. Patch by Bénédikt Tran. - gh-100372: ssl.SSLContext.load_verify_locations() no longer incorrectly accepts some cases of trailing data when parsing DER. - Security - gh-155558: Update bundled libexpat to version 2.8.3 for the fix to CVE-2026-72522. - gh-153030: Fixed quadratic complexity in incremental parsing of long unterminated constructs (such as tags or comments) in html.parser.HTMLParser, which could be exploited for a denial of service (bsc#1271192, CVE-2026-15308). - gh-152674: The xml.etree.ElementTree.Element methods findall(), iterfind() and find() avoid quadratic behavior when using XPath index predicates ([1], [last()], [last()-N]) on XML documents with many same-tag siblings. - gh-152216: Update bundled libexpat to version 2.8.2. - gh-151987: The tarfile.TarFile.extract() method now applies the given filter when it extracts a link target from the archive as a fallback (bsc#1269959, CVE-2026-4360). - gh-151981: In tarfile, seeking a stream now stops when end of the stream is reached (bsc#1269788, CVE-2026-11972). - gh-151544: Modules/Setup.local is no longer used as a landmark to discover whether Python is running in a source tree, as it could potentially affect actual installs. The pybuilddir.txt file is now the sole indicator of running in a source tree. - gh-151558: Fixed an vulnerability in the tarfile data and tar extraction filters where crafted archives could create a symlink pointing outside the destination directory. This was a bypass of CVE-2025-4330 (bsc#1268977, CVE-2026-11940). - gh-150599: Fix a possible stack buffer overflow in bz2 when a bz2.BZ2Decompressor is reused after a decompression error. The decompressor now becomes unusable after libbz2 reports an error (bsc#1267974, CVE-2026-9669). - gh-150743: http.client now limits the number of chunked-response trailer lines it will read to 100, and the number of interim (1xx) responses it will skip to 100. A malicious or broken server could previously stream trailer lines or 100 Continue responses forever, hanging the client even when a socket timeout was in use. Reported by @YLChen-007 via GHSA-w4q2-g22w-6fr4. - gh-149698: Update bundled libexpat to version 2.8.1 for the fix for CVE-2026-45186. - gh-87451: The ftplib module’s undocumented ftpcp function no longer trusts the IPv4 address value returned from the source server in response to the PASV command by default, completing the fix for CVE-2021-4189. As with ftplib.FTP, the former behavior can be re-enabled by setting the trust_server_pasv_ipv4_address attribute on the source ftplib.FTP instance to True. Thanks to Qi Deng at Aurascape AI for the report (bsc#1265268, CVE-2026-8328). - gh-149486: tarfile.data_filter() now validates link targets using the same normalised value that is written to disk, strips trailing separators from the member name when resolving a symlink’s directory, and rejects link members that would replace the destination directory itself. This closes several path-traversal bypasses of the data extraction filter (bsc#1267821, CVE-2026-7774). - gh-149079: Fix a potential denial of service in unicodedata.normalize(). The canonical ordering step of Unicode normalization used a quadratic-time insertion sort for reordering combining characters, which could be exploited with crafted input containing many combining characters in non-canonical order. Replaced with a linear-time counting sort for long runs (bsc#1267581, CVE-2026-3276). - gh-149018: Improved protection against XML hash-flooding attacks in xml.parsers.expat and xml.etree.ElementTree when Python is compiled with libExpat 2.8.0 or later (bsc#1264962, CVE-2026-7210). - gh-149017: Update bundled libexpat to version 2.8.0. - gh-148808: Added buffer boundary check when using nbytes parameter with asyncio.AbstractEventLoop.sock_recvfrom_into(). Only relevant for Windows and the asyncio.ProactorEventLoop. - gh-148395: Fix a dangling input pointer in lzma.LZMADecompressor, and bz2.BZ2Decompressor when memory allocation fails with MemoryError, which could let a subsequent decompress() call read or write through a stale pointer to the already-released caller buffer (bsc#1262098, CVE-2026-6100). - gh-148169: A bypass in webbrowser allowed URLs prefixed with %action to pass the dash-prefix safety check (bsc#1262319, CVE-2026-4786). - gh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows which allowed to write files outside of the destination tree if the patch in the archive contains a Windows drive prefix. Now such invalid paths will be skipped. Files containing “..” in the name (like “foo..bar”) are no longer skipped. - gh-146333: Fix quadratic backtracking in configparser.RawConfigParser option parsing regexes (OPTCRE and OPTCRE_NV). A crafted configuration line with many whitespace characters could cause excessive CPU usage. - gh-146211: Reject CR/LF characters in tunnel request headers for the HTTPConnection.set_tunnel() method (bsc#1261969, CVE-2026-1502). - gh-145986: xml.parsers.expat: Fixed a crash caused by unbounded C recursion when converting deeply nested XML content models with ElementDeclHandler(). This addresses CVE-2026-4224 (bsc#1259735, CVE-2026-4224). - gh-145599: Reject control characters in http.cookies.Morsel update() and js_output(). This addresses CVE-2026-3644 (bsc#1259734, CVE-2026-3644). - gh-145506: Fixes CVE-2026-2297 by ensuring that SourcelessFileLoader uses io.open_code() when opening .pyc files (bsc#1259240, CVE-2026-2297). - gh-144370: Disallow usage of control characters in status in wsgiref.handlers to prevent HTTP header injections. Patch by Benedikt Johannes. - gh-143930: Reject leading dashes in URLs passed to webbrowser.open() (bsc#1260026, CVE-2026-4519). - gh-143927: Normalize all line endings (CR, CRLF, and LF) to LF+TAB when writing multi-line configparser values (bsc#1269066, CVE-2026-0864). - Tests - gh-149776: Fix test_socket on Linux kernel 7.1 and newer: skip UDP Lite tests if it’s not supported. Patch by Victor Stinner. - Removed upstreamed patches: - CVE-2025-13462-tarinfo-header-parse.patch - CVE-2026-0864-normalize-LFTAB-configparser.patch - CVE-2026-11940-tarfile-escape.patch - CVE-2026-11972-tarfile-Stream-seek-EOF.patch - CVE-2026-1502-reject-CRLF-HTTP-tunnel.patch - CVE-2026-15308-HTMLParser-CPU-exhaust.patch - CVE-2026-2297-SourcelessFileLoader-io_open_code.patch - CVE-2026-3276-On2-unicodedata-normalize.patch - CVE-2026-3644-cookies-Morsel-update-II.patch - CVE-2026-4224-expat-unbound-C-recursion.patch - CVE-2026-4360-filter_function-TarFile-extractone.patch - CVE-2026-4519-webbrowser-open-dashes.patch - CVE-2026-4786-webbrowser-open-action.patch - CVE-2026-6100-use-after-free-decompression.patch - CVE-2026-7210-pyexpat-entropy-hash-flooding.patch - CVE-2026-7774-tarfile-data_filter-symlink.patch - CVE-2026-8328-ftplib-no-trust-PASV-resp.patch - test_UDPLITE_support.patch ++++ libzypp: - Prevent libgpgme from launching gpg-agents; we don't need them. - defaultLoadSystem: Hand out the ZYpp::Ptr as return value. - Log all solver problem rules (bsc#1277790) The log contains the most relevant problem rule, but sometimes it helps to know all rules associated with this problem. zypper shows them on demand as 'detail'. The log now remembers them as well. - Replace popen cat/zcat with solv_xfopen for testcase loaders (fixes #749) - repoGpgCheck: Strictly follow the repo_gpgcheck setting (bsc#1274625) There's been a legacy exception for unsigned repositories which were explicitly accepted in the past. After switching the repo_gpgcheck from off to on, they were allowed to stay unsigned until a first signed version was retrieved. From there on the handling was strict. Now the handling is strict as soon as the repo_gpgcheck turned on. The next set of metadata retrieved must be signed. - Iniparser: each new file starts in the unnamed section (bsc#1272534) - Fix hasCredentials() to require both username AND password to be non-empty (bsc#1273242) This avoids an unnecessary 2nd 401 response sending just the username in case the username but no password is known. Now it immediately fetches the credentials from disk if no password is known. - GPG Key hints in repoindex.xml require at least a long id to allow auto-import (bsc#1271730) The short Id (32bit/8byte) is not considered to be a safe identifier for a gpg key. A long id (64bit/16byte) or even better the full fingerprint is needed to identify the key. - zypp: Improve Testcase Loading for MCP Tools. - spec: Remove useless %bcond visibility_hidden (is always ON in cmake) - version 17.38.15 (35) ++++ opensc: - CVE-2026-40510 opensc: stack buffer overflow in `piv_process_history()` allows physically present attackers to trigger memory corruption bsc#1266964 * Add opensc-CVE-2026-40510.patch ++++ python311: - Update to 3.11.16: - Build - gh-153438: Update Windows build and installer tooling and documentation to use the current download URL for nuget.exe. - Library - gh-109638: Fix exponential time in csv.Sniffer.sniff() for a sample which contains many quote characters. A doubled quote character is now also detected in a field which contains the delimiter or a line break. - gh-98820: Fix quadratic time in csv.Sniffer.sniff() for a sample which contains quoted fields, in particular for a single column of quoted fields. - gh-149231: In tomllib, the number of parts in TOML keys is now limited. - gh-146083: Update bundled libexpat to version 2.7.5. - gh-141707: Don’t change tarfile.TarInfo type from AREGTYPE to DIRTYPE when parsing GNU long name or link headers (bsc#1259611, CVE-2025-13462). - gh-90949: Add SetBillionLaughsAttackProtectionActivationThreshold() and SetBillionLaughsAttackProtectionMaximumAmplification() to xmlparser objects to tune protections against billion laughs attacks. Patch by Bénédikt Tran. - gh-100372: ssl.SSLContext.load_verify_locations() no longer incorrectly accepts some cases of trailing data when parsing DER. - Security - gh-155558: Update bundled libexpat to version 2.8.3 for the fix to CVE-2026-72522. - gh-153030: Fixed quadratic complexity in incremental parsing of long unterminated constructs (such as tags or comments) in html.parser.HTMLParser, which could be exploited for a denial of service (bsc#1271192, CVE-2026-15308). - gh-152674: The xml.etree.ElementTree.Element methods findall(), iterfind() and find() avoid quadratic behavior when using XPath index predicates ([1], [last()], [last()-N]) on XML documents with many same-tag siblings. - gh-152216: Update bundled libexpat to version 2.8.2. - gh-151987: The tarfile.TarFile.extract() method now applies the given filter when it extracts a link target from the archive as a fallback (bsc#1269959, CVE-2026-4360). - gh-151981: In tarfile, seeking a stream now stops when end of the stream is reached (bsc#1269788, CVE-2026-11972). - gh-151544: Modules/Setup.local is no longer used as a landmark to discover whether Python is running in a source tree, as it could potentially affect actual installs. The pybuilddir.txt file is now the sole indicator of running in a source tree. - gh-151558: Fixed an vulnerability in the tarfile data and tar extraction filters where crafted archives could create a symlink pointing outside the destination directory. This was a bypass of CVE-2025-4330 (bsc#1268977, CVE-2026-11940). - gh-150599: Fix a possible stack buffer overflow in bz2 when a bz2.BZ2Decompressor is reused after a decompression error. The decompressor now becomes unusable after libbz2 reports an error (bsc#1267974, CVE-2026-9669). - gh-150743: http.client now limits the number of chunked-response trailer lines it will read to 100, and the number of interim (1xx) responses it will skip to 100. A malicious or broken server could previously stream trailer lines or 100 Continue responses forever, hanging the client even when a socket timeout was in use. Reported by @YLChen-007 via GHSA-w4q2-g22w-6fr4. - gh-149698: Update bundled libexpat to version 2.8.1 for the fix for CVE-2026-45186. - gh-87451: The ftplib module’s undocumented ftpcp function no longer trusts the IPv4 address value returned from the source server in response to the PASV command by default, completing the fix for CVE-2021-4189. As with ftplib.FTP, the former behavior can be re-enabled by setting the trust_server_pasv_ipv4_address attribute on the source ftplib.FTP instance to True. Thanks to Qi Deng at Aurascape AI for the report (bsc#1265268, CVE-2026-8328). - gh-149486: tarfile.data_filter() now validates link targets using the same normalised value that is written to disk, strips trailing separators from the member name when resolving a symlink’s directory, and rejects link members that would replace the destination directory itself. This closes several path-traversal bypasses of the data extraction filter (bsc#1267821, CVE-2026-7774). - gh-149079: Fix a potential denial of service in unicodedata.normalize(). The canonical ordering step of Unicode normalization used a quadratic-time insertion sort for reordering combining characters, which could be exploited with crafted input containing many combining characters in non-canonical order. Replaced with a linear-time counting sort for long runs (bsc#1267581, CVE-2026-3276). - gh-149018: Improved protection against XML hash-flooding attacks in xml.parsers.expat and xml.etree.ElementTree when Python is compiled with libExpat 2.8.0 or later (bsc#1264962, CVE-2026-7210). - gh-149017: Update bundled libexpat to version 2.8.0. - gh-148808: Added buffer boundary check when using nbytes parameter with asyncio.AbstractEventLoop.sock_recvfrom_into(). Only relevant for Windows and the asyncio.ProactorEventLoop. - gh-148395: Fix a dangling input pointer in lzma.LZMADecompressor, and bz2.BZ2Decompressor when memory allocation fails with MemoryError, which could let a subsequent decompress() call read or write through a stale pointer to the already-released caller buffer (bsc#1262098, CVE-2026-6100). - gh-148169: A bypass in webbrowser allowed URLs prefixed with %action to pass the dash-prefix safety check (bsc#1262319, CVE-2026-4786). - gh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows which allowed to write files outside of the destination tree if the patch in the archive contains a Windows drive prefix. Now such invalid paths will be skipped. Files containing “..” in the name (like “foo..bar”) are no longer skipped. - gh-146333: Fix quadratic backtracking in configparser.RawConfigParser option parsing regexes (OPTCRE and OPTCRE_NV). A crafted configuration line with many whitespace characters could cause excessive CPU usage. - gh-146211: Reject CR/LF characters in tunnel request headers for the HTTPConnection.set_tunnel() method (bsc#1261969, CVE-2026-1502). - gh-145986: xml.parsers.expat: Fixed a crash caused by unbounded C recursion when converting deeply nested XML content models with ElementDeclHandler(). This addresses CVE-2026-4224 (bsc#1259735, CVE-2026-4224). - gh-145599: Reject control characters in http.cookies.Morsel update() and js_output(). This addresses CVE-2026-3644 (bsc#1259734, CVE-2026-3644). - gh-145506: Fixes CVE-2026-2297 by ensuring that SourcelessFileLoader uses io.open_code() when opening .pyc files (bsc#1259240, CVE-2026-2297). - gh-144370: Disallow usage of control characters in status in wsgiref.handlers to prevent HTTP header injections. Patch by Benedikt Johannes. - gh-143930: Reject leading dashes in URLs passed to webbrowser.open() (bsc#1260026, CVE-2026-4519). - gh-143927: Normalize all line endings (CR, CRLF, and LF) to LF+TAB when writing multi-line configparser values (bsc#1269066, CVE-2026-0864). - Tests - gh-149776: Fix test_socket on Linux kernel 7.1 and newer: skip UDP Lite tests if it’s not supported. Patch by Victor Stinner. - Removed upstreamed patches: - CVE-2025-13462-tarinfo-header-parse.patch - CVE-2026-0864-normalize-LFTAB-configparser.patch - CVE-2026-11940-tarfile-escape.patch - CVE-2026-11972-tarfile-Stream-seek-EOF.patch - CVE-2026-1502-reject-CRLF-HTTP-tunnel.patch - CVE-2026-15308-HTMLParser-CPU-exhaust.patch - CVE-2026-2297-SourcelessFileLoader-io_open_code.patch - CVE-2026-3276-On2-unicodedata-normalize.patch - CVE-2026-3644-cookies-Morsel-update-II.patch - CVE-2026-4224-expat-unbound-C-recursion.patch - CVE-2026-4360-filter_function-TarFile-extractone.patch - CVE-2026-4519-webbrowser-open-dashes.patch - CVE-2026-4786-webbrowser-open-action.patch - CVE-2026-6100-use-after-free-decompression.patch - CVE-2026-7210-pyexpat-entropy-hash-flooding.patch - CVE-2026-7774-tarfile-data_filter-symlink.patch - CVE-2026-8328-ftplib-no-trust-PASV-resp.patch - test_UDPLITE_support.patch ++++ zypper: - Show solver problem details per default in not-interactive mode (bsc#1277790) This way they see all details when capturing zypper's output because the (d)etail button can't be pressed in not-interactive mode. - version 1.14.101 ------------------------------------------------------------------ ------------------ 2026-9-3 - Sep 3 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - vxlan: do not arm the ageing timer on a device that is down (CVE-2026-74615 bsc#1277901). - commit 6969818 - net/tls: Consume empty data records in tls_sw_read_sock() (CVE-2026-72330 bsc#1277764). - commit 872a52f - net: atm: reject out-of-range traffic classes in QoS validation (CVE-2026-72297 bsc#1277738). - commit c37be99 - fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid (CVE-2026-72379 bsc#1277818). - commit 149eb98 - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CVE-2026-72242 bsc#1277655). - commit 60b645a - ocfs2: add journal NULL check in ocfs2_checkpoint_inode() (CVE-2026-72161 bsc#1277233). - commit b58ef57 - ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits (CVE-2026-72163 bsc#1277231). - commit cc02a5c - apparmor: check label build before no_new_privs test (CVE-2026-72460 bsc#1277229). - commit 3bfd8a6 - apparmor: aa_label_alloc use aa_label_free on alloc failure (CVE-2026-72459 bsc#1277092). - commit 6329e4f - ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT (CVE-2026-74307 bsc#1276905). - commit 8317ed1 - ext4: fix kernel BUG in ext4_write_inline_data_end (CVE-2026-74308 bsc#1276880). - commit 54df5a7 - scsi: target: core: Generate correct identifiers for PR OUT transport IDs (CVE-2026-72084 bsc#1275540). - Refresh patches.suse/scsi-target-Bound-PR-OUT-TransportID-parsing-to-the-receiv.patch. - commit d58264e - x86/mm: Fix pmd_modify() dropping the dirty bit (bsc#1275455). - commit 57fc210 - scsi: libsas: fix sas_resume_ha_no_sync removal (CVE-2026-74555 bsc#1275690). - scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race (CVE-2026-74555 bsc#1275690). - commit e820c25 - net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG (CVE-2026-74737 bsc#1277898). - commit dae4a5c - xdp: reject clones that overrun skb_shared_info tailroom (CVE-2026-74616 bsc#1277813). - commit 871fdf3 - tls: rx: restore msg_iter before TLS 1.3 optimistic retry (CVE-2026-74611 bsc#1277804). - commit fd12786 - drm/vmwgfx: bound DMA command body size against suffix pointer (CVE-2026-74443 bsc#1278210). - commit 2efa415 - block: stop the timeout timer when releasing a never added disk (bsc#1277335 CVE-2026-80589). - commit de1b738 - audit: fix recursive locking deadlock in audit_dupe_exe() (bsc#1274730 CVE-2026-68096). Refresh patches.suse/vfs-add-super_operations-get_inode_dev - commit 71ba209 - fscrypt: Add missing superblock check in find_or_insert_direct_key() (bsc#1275588 CVE-2026-68148). - commit ca8af88 - ovl: check access to copy_file_range source with src mounter creds (CVE-2026-68448 bsc#1274838). - commit dafddd9 - Refresh patches.suse/qede-fix-off-by-one-in-BD-ring-consumption-on-build_skb-fa.patch. - commit ecd63e3 - Refresh patches.suse/veth-fix-skb-length-accounting-after-XDP-frag-adjustment.patch. - commit b694eca - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (CVE-2026-72045 bsc#1277078). - octeontx2-af: npc: Fix size of entry2cntr_map (CVE-2026-80629 bsc#1277308). - commit a2d3c3f - Refresh patches.suse/ipv6-ndisc-fix-NULL-deref-in-accept_untracked_na.patch. - commit ab6cd83 - Refresh patches.suse/xfrm-policy-preallocate-inexact-bins-before-xfrm_hash_rebu.patch. - commit 87d20f7 - Refresh patches.suse/net-af_iucv-fix-NULL-deref-in-afiucv_hs_callback_syn.patch. - commit 2a20d28 - net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294 bsc#1275092). - commit 4093fe9 - Refresh patches.suse/net-packet-avoid-fanout-hook-re-registration-after-unregis.patch. - commit 1e5c976 - Refresh patches.suse/ipv4-fib-Don-t-ignore-error-route-in-local-main-tables.patch. - commit 4050a39 - Refresh patches.suse/mptcp-options-reset-DSS-fields-in-case-of-unexpected-size.patch. - commit 37a4acb - Refresh patches.suse/udp-fix-potential-use-after-free-in-tunnel-segmentation.patch. - commit 16a1bee - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277391 CVE-2026-74669). - commit 93ff3a5 - usb: usbtest: disable dynamic ID support (stable-fixes). - usb: core: Strengthen error handling in hub_hub_status() (stable-fixes). - usb: core: Add lock to usb_wakeup_notification() (stable-fixes). - Bluetooth: hci_sync: Fix accept list UAF during suspend (git-fixes). - HID: ft260: fix stack-use-after-return write in I2C read race (git-fixes). - HID: ft260: validate i2c input report length (stable-fixes). - can: j1939: add missing calls in NETDEV_UNREGISTER notification handler (git-fixes). - Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync() (stable-fixes). - media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() (stable-fixes). - HID: pidff: Support device error response from PID_BLOCK_LOAD (stable-fixes). - commit 33b2a5c - Delete patches.suse/PM-sleep-Use-complete-in-device_pm_sleep_init.patch It may lead to a regression, reverted in the stable upstream. - commit 38e271c ++++ kernel-rt: - vxlan: do not arm the ageing timer on a device that is down (CVE-2026-74615 bsc#1277901). - commit 6969818 - net/tls: Consume empty data records in tls_sw_read_sock() (CVE-2026-72330 bsc#1277764). - commit 872a52f - net: atm: reject out-of-range traffic classes in QoS validation (CVE-2026-72297 bsc#1277738). - commit c37be99 - fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid (CVE-2026-72379 bsc#1277818). - commit 149eb98 - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CVE-2026-72242 bsc#1277655). - commit 60b645a - ocfs2: add journal NULL check in ocfs2_checkpoint_inode() (CVE-2026-72161 bsc#1277233). - commit b58ef57 - ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits (CVE-2026-72163 bsc#1277231). - commit cc02a5c - apparmor: check label build before no_new_privs test (CVE-2026-72460 bsc#1277229). - commit 3bfd8a6 - apparmor: aa_label_alloc use aa_label_free on alloc failure (CVE-2026-72459 bsc#1277092). - commit 6329e4f - ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT (CVE-2026-74307 bsc#1276905). - commit 8317ed1 - ext4: fix kernel BUG in ext4_write_inline_data_end (CVE-2026-74308 bsc#1276880). - commit 54df5a7 - scsi: target: core: Generate correct identifiers for PR OUT transport IDs (CVE-2026-72084 bsc#1275540). - Refresh patches.suse/scsi-target-Bound-PR-OUT-TransportID-parsing-to-the-receiv.patch. - commit d58264e - x86/mm: Fix pmd_modify() dropping the dirty bit (bsc#1275455). - commit 57fc210 - scsi: libsas: fix sas_resume_ha_no_sync removal (CVE-2026-74555 bsc#1275690). - scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race (CVE-2026-74555 bsc#1275690). - commit e820c25 - net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG (CVE-2026-74737 bsc#1277898). - commit dae4a5c - xdp: reject clones that overrun skb_shared_info tailroom (CVE-2026-74616 bsc#1277813). - commit 871fdf3 - tls: rx: restore msg_iter before TLS 1.3 optimistic retry (CVE-2026-74611 bsc#1277804). - commit fd12786 - drm/vmwgfx: bound DMA command body size against suffix pointer (CVE-2026-74443 bsc#1278210). - commit 2efa415 - block: stop the timeout timer when releasing a never added disk (bsc#1277335 CVE-2026-80589). - commit de1b738 - audit: fix recursive locking deadlock in audit_dupe_exe() (bsc#1274730 CVE-2026-68096). Refresh patches.suse/vfs-add-super_operations-get_inode_dev - commit 71ba209 - fscrypt: Add missing superblock check in find_or_insert_direct_key() (bsc#1275588 CVE-2026-68148). - commit ca8af88 - ovl: check access to copy_file_range source with src mounter creds (CVE-2026-68448 bsc#1274838). - commit dafddd9 - Refresh patches.suse/qede-fix-off-by-one-in-BD-ring-consumption-on-build_skb-fa.patch. - commit ecd63e3 - Refresh patches.suse/veth-fix-skb-length-accounting-after-XDP-frag-adjustment.patch. - commit b694eca - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (CVE-2026-72045 bsc#1277078). - octeontx2-af: npc: Fix size of entry2cntr_map (CVE-2026-80629 bsc#1277308). - commit a2d3c3f - Refresh patches.suse/ipv6-ndisc-fix-NULL-deref-in-accept_untracked_na.patch. - commit ab6cd83 - Refresh patches.suse/xfrm-policy-preallocate-inexact-bins-before-xfrm_hash_rebu.patch. - commit 87d20f7 - Refresh patches.suse/net-af_iucv-fix-NULL-deref-in-afiucv_hs_callback_syn.patch. - commit 2a20d28 - net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294 bsc#1275092). - commit 4093fe9 - Refresh patches.suse/net-packet-avoid-fanout-hook-re-registration-after-unregis.patch. - commit 1e5c976 - Refresh patches.suse/ipv4-fib-Don-t-ignore-error-route-in-local-main-tables.patch. - commit 4050a39 - Refresh patches.suse/mptcp-options-reset-DSS-fields-in-case-of-unexpected-size.patch. - commit 37a4acb - Refresh patches.suse/udp-fix-potential-use-after-free-in-tunnel-segmentation.patch. - commit 16a1bee - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277391 CVE-2026-74669). - commit 93ff3a5 - usb: usbtest: disable dynamic ID support (stable-fixes). - usb: core: Strengthen error handling in hub_hub_status() (stable-fixes). - usb: core: Add lock to usb_wakeup_notification() (stable-fixes). - Bluetooth: hci_sync: Fix accept list UAF during suspend (git-fixes). - HID: ft260: fix stack-use-after-return write in I2C read race (git-fixes). - HID: ft260: validate i2c input report length (stable-fixes). - can: j1939: add missing calls in NETDEV_UNREGISTER notification handler (git-fixes). - Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync() (stable-fixes). - media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() (stable-fixes). - HID: pidff: Support device error response from PID_BLOCK_LOAD (stable-fixes). - commit 33b2a5c - Delete patches.suse/PM-sleep-Use-complete-in-device_pm_sleep_init.patch It may lead to a regression, reverted in the stable upstream. - commit 38e271c ++++ kernel-rt_debug: - vxlan: do not arm the ageing timer on a device that is down (CVE-2026-74615 bsc#1277901). - commit 6969818 - net/tls: Consume empty data records in tls_sw_read_sock() (CVE-2026-72330 bsc#1277764). - commit 872a52f - net: atm: reject out-of-range traffic classes in QoS validation (CVE-2026-72297 bsc#1277738). - commit c37be99 - fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid (CVE-2026-72379 bsc#1277818). - commit 149eb98 - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CVE-2026-72242 bsc#1277655). - commit 60b645a - ocfs2: add journal NULL check in ocfs2_checkpoint_inode() (CVE-2026-72161 bsc#1277233). - commit b58ef57 - ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits (CVE-2026-72163 bsc#1277231). - commit cc02a5c - apparmor: check label build before no_new_privs test (CVE-2026-72460 bsc#1277229). - commit 3bfd8a6 - apparmor: aa_label_alloc use aa_label_free on alloc failure (CVE-2026-72459 bsc#1277092). - commit 6329e4f - ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT (CVE-2026-74307 bsc#1276905). - commit 8317ed1 - ext4: fix kernel BUG in ext4_write_inline_data_end (CVE-2026-74308 bsc#1276880). - commit 54df5a7 - scsi: target: core: Generate correct identifiers for PR OUT transport IDs (CVE-2026-72084 bsc#1275540). - Refresh patches.suse/scsi-target-Bound-PR-OUT-TransportID-parsing-to-the-receiv.patch. - commit d58264e - x86/mm: Fix pmd_modify() dropping the dirty bit (bsc#1275455). - commit 57fc210 - scsi: libsas: fix sas_resume_ha_no_sync removal (CVE-2026-74555 bsc#1275690). - scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race (CVE-2026-74555 bsc#1275690). - commit e820c25 - net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG (CVE-2026-74737 bsc#1277898). - commit dae4a5c - xdp: reject clones that overrun skb_shared_info tailroom (CVE-2026-74616 bsc#1277813). - commit 871fdf3 - tls: rx: restore msg_iter before TLS 1.3 optimistic retry (CVE-2026-74611 bsc#1277804). - commit fd12786 - drm/vmwgfx: bound DMA command body size against suffix pointer (CVE-2026-74443 bsc#1278210). - commit 2efa415 - block: stop the timeout timer when releasing a never added disk (bsc#1277335 CVE-2026-80589). - commit de1b738 - audit: fix recursive locking deadlock in audit_dupe_exe() (bsc#1274730 CVE-2026-68096). Refresh patches.suse/vfs-add-super_operations-get_inode_dev - commit 71ba209 - fscrypt: Add missing superblock check in find_or_insert_direct_key() (bsc#1275588 CVE-2026-68148). - commit ca8af88 - ovl: check access to copy_file_range source with src mounter creds (CVE-2026-68448 bsc#1274838). - commit dafddd9 - Refresh patches.suse/qede-fix-off-by-one-in-BD-ring-consumption-on-build_skb-fa.patch. - commit ecd63e3 - Refresh patches.suse/veth-fix-skb-length-accounting-after-XDP-frag-adjustment.patch. - commit b694eca - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (CVE-2026-72045 bsc#1277078). - octeontx2-af: npc: Fix size of entry2cntr_map (CVE-2026-80629 bsc#1277308). - commit a2d3c3f - Refresh patches.suse/ipv6-ndisc-fix-NULL-deref-in-accept_untracked_na.patch. - commit ab6cd83 - Refresh patches.suse/xfrm-policy-preallocate-inexact-bins-before-xfrm_hash_rebu.patch. - commit 87d20f7 - Refresh patches.suse/net-af_iucv-fix-NULL-deref-in-afiucv_hs_callback_syn.patch. - commit 2a20d28 - net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294 bsc#1275092). - commit 4093fe9 - Refresh patches.suse/net-packet-avoid-fanout-hook-re-registration-after-unregis.patch. - commit 1e5c976 - Refresh patches.suse/ipv4-fib-Don-t-ignore-error-route-in-local-main-tables.patch. - commit 4050a39 - Refresh patches.suse/mptcp-options-reset-DSS-fields-in-case-of-unexpected-size.patch. - commit 37a4acb - Refresh patches.suse/udp-fix-potential-use-after-free-in-tunnel-segmentation.patch. - commit 16a1bee - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277391 CVE-2026-74669). - commit 93ff3a5 - usb: usbtest: disable dynamic ID support (stable-fixes). - usb: core: Strengthen error handling in hub_hub_status() (stable-fixes). - usb: core: Add lock to usb_wakeup_notification() (stable-fixes). - Bluetooth: hci_sync: Fix accept list UAF during suspend (git-fixes). - HID: ft260: fix stack-use-after-return write in I2C read race (git-fixes). - HID: ft260: validate i2c input report length (stable-fixes). - can: j1939: add missing calls in NETDEV_UNREGISTER notification handler (git-fixes). - Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync() (stable-fixes). - media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() (stable-fixes). - HID: pidff: Support device error response from PID_BLOCK_LOAD (stable-fixes). - commit 33b2a5c - Delete patches.suse/PM-sleep-Use-complete-in-device_pm_sleep_init.patch It may lead to a regression, reverted in the stable upstream. - commit 38e271c ------------------------------------------------------------------ ------------------ 2026-9-2 - Sep 2 2026 ------------------- ------------------------------------------------------------------ ++++ NetworkManager: - Add NetworkManager-CVE-2026-10805.patch: dhclient: reject unsafe characters in URLs and hostnames (bsc#1267696, CVE-2026-10805, glfd#NetworkManager/NetworkManager!2426). - Add NetworkManager-CVE-2026-19685.patch: core: 802.1x: reject ca-path for private connections (bsc#1276764, CVE-2026-19685, glfd#NetworkManager/NetworkManager!2513). ++++ kernel-default: - kabi: drop new skb drop reason SKB_BAD_GSO (CVE-2026-53091 bsc#1269530). - xfrm: Don't clobber inner headers when already set (CVE-2026-53091 bsc#1269530). - net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091 bsc#1269530). - net: qdisc_pkt_len_segs_init() cleanup (CVE-2026-53091 bsc#1269530). - net: account for encap headers in qdisc pkt len (CVE-2026-53091 bsc#1269530). - commit 3b63553 - md-cluster: fix NULL pointer dereference in process_metadata_update (CVE-2026-43271 bsc#1264587). - commit 65dc322 - scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer (CVE-2026-74557 bsc#1275685). - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it (CVE-2026-72085 bsc#1275542). - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (CVE-2026-63890 bsc#1272426). - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (CVE-2026-64003 bsc#1273782). - scsi: isci: Fix use-after-free in device removal path (CVE-2026-64103 bsc#1273759). - commit e311368 - md/raid1: create serial pool adding rdev to array with serialize_policy=1 (bsc#1272261). - commit b6ccdad - kabi: move skb_dev out of struct nf_queue_entry (CVE-2026-52912 bsc#1269000). - netfilter: nf_queue: hold bridge skb->dev while queued (CVE-2026-52912 bsc#1269000). - commit 977ba2c - mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() (CVE-2026-72308 bsc#1277159) - commit 2fd2205 - Drop patches.suse/wifi-mt76-mt7915-unwind-state-on-add_interface-failu.patch This turned out to be an incorrect backport, which doesn't actually fit with 6.4-based kernels. - commit 7cba3ca - rpm/kernel-obs-build.spec.in: Add more nft modules for docker nft_compat and nft_chain_nat this time. - commit 50912bc - net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked (CVE-2026-72036 bsc#1277034). - net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked (CVE-2026-72035 bsc#1276961). - commit e712169 - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres (CVE-2026-64463 bsc#1273273). - commit 4c1ccf2 - mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() (CVE-2026-72307 bsc#1277160) - commit 6ca16b7 - rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() (CVE-2026-74563 bsc#1275574). - commit a28b6fa - mm/page_reporting: use system_freezable_wq to fix UAF during suspend (CVE-2026-74481 bsc#1276355). - commit dd7ae57 - soc: xilinx: Shutdown and free rx mailbox channel (CVE-2026-80654 bsc#1277516) - commit 5db63c1 - net/mlx5e: Fix publication race for priv->channel_stats[] (CVE-2026-72341 bsc#1277660) - commit 968624d - net/mlx5e: Fix HV VHCA stats agent registration race (CVE-2026-72342 bsc#1277775) - commit 605af0b - net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation (CVE-2026-72343 bsc#1277776) - commit 2bd4503 - net/smc: fix TOCTOU race between smc_listen_out() and listener close (CVE-2026-74692 bsc#1276927). - net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (CVE-2026-74694 bsc#1277625). - commit f36a3ba - drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO (bsc#1277073 CVE-2026-74454) - commit 6ae624a - xfrm: Fix dev use-after-free in xfrm async resumption (git-fixes CVE-2026-72463 bsc#1277064 bsc#1268276). - commit b2879a3 - tls: don't leave a full plaintext sk_msg ring unpushed (CVE-2026-74610 bsc#1277054). - vxlan: use pskb_network_may_pull() for transmit path header pulls (CVE-2026-74474 bsc#1276335). - net: do not send ICMP/NDISC Redirects when peer allocation fails (CVE-2026-74550 bsc#1275688). - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CVE-2026-68377 bsc#1274831). - netfilter: nft_fib: reject fib expression on the netdev egress hook (CVE-2026-72254 bsc#1277204). - xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663 bsc#1263133). - xfrm: Skip redundant replay recheck for the hardware offload path (CVE-2026-31663 bsc#1263133). - xfrm: Refactor xfrm_input lock to reduce contention with RSS (CVE-2026-31663 bsc#1263133). - xfrm: hold device only for the asynchronous decryption (CVE-2026-31663 bsc#1263133). - commit a778bbd - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262 bsc#1277678). - commit 5aba127 - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CVE-2026-72123 bsc#1277523). - commit a3ab58d ++++ kernel-rt: - kabi: drop new skb drop reason SKB_BAD_GSO (CVE-2026-53091 bsc#1269530). - xfrm: Don't clobber inner headers when already set (CVE-2026-53091 bsc#1269530). - net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091 bsc#1269530). - net: qdisc_pkt_len_segs_init() cleanup (CVE-2026-53091 bsc#1269530). - net: account for encap headers in qdisc pkt len (CVE-2026-53091 bsc#1269530). - commit 3b63553 - md-cluster: fix NULL pointer dereference in process_metadata_update (CVE-2026-43271 bsc#1264587). - commit 65dc322 - scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer (CVE-2026-74557 bsc#1275685). - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it (CVE-2026-72085 bsc#1275542). - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (CVE-2026-63890 bsc#1272426). - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (CVE-2026-64003 bsc#1273782). - scsi: isci: Fix use-after-free in device removal path (CVE-2026-64103 bsc#1273759). - commit e311368 - md/raid1: create serial pool adding rdev to array with serialize_policy=1 (bsc#1272261). - commit b6ccdad - kabi: move skb_dev out of struct nf_queue_entry (CVE-2026-52912 bsc#1269000). - netfilter: nf_queue: hold bridge skb->dev while queued (CVE-2026-52912 bsc#1269000). - commit 977ba2c - mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() (CVE-2026-72308 bsc#1277159) - commit 2fd2205 - Drop patches.suse/wifi-mt76-mt7915-unwind-state-on-add_interface-failu.patch This turned out to be an incorrect backport, which doesn't actually fit with 6.4-based kernels. - commit 7cba3ca - rpm/kernel-obs-build.spec.in: Add more nft modules for docker nft_compat and nft_chain_nat this time. - commit 50912bc - net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked (CVE-2026-72036 bsc#1277034). - net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked (CVE-2026-72035 bsc#1276961). - commit e712169 - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres (CVE-2026-64463 bsc#1273273). - commit 4c1ccf2 - mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() (CVE-2026-72307 bsc#1277160) - commit 6ca16b7 - rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() (CVE-2026-74563 bsc#1275574). - commit a28b6fa - mm/page_reporting: use system_freezable_wq to fix UAF during suspend (CVE-2026-74481 bsc#1276355). - commit dd7ae57 - soc: xilinx: Shutdown and free rx mailbox channel (CVE-2026-80654 bsc#1277516) - commit 5db63c1 - net/mlx5e: Fix publication race for priv->channel_stats[] (CVE-2026-72341 bsc#1277660) - commit 968624d - net/mlx5e: Fix HV VHCA stats agent registration race (CVE-2026-72342 bsc#1277775) - commit 605af0b - net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation (CVE-2026-72343 bsc#1277776) - commit 2bd4503 - net/smc: fix TOCTOU race between smc_listen_out() and listener close (CVE-2026-74692 bsc#1276927). - net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (CVE-2026-74694 bsc#1277625). - commit f36a3ba - drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO (bsc#1277073 CVE-2026-74454) - commit 6ae624a - xfrm: Fix dev use-after-free in xfrm async resumption (git-fixes CVE-2026-72463 bsc#1277064 bsc#1268276). - commit b2879a3 - tls: don't leave a full plaintext sk_msg ring unpushed (CVE-2026-74610 bsc#1277054). - vxlan: use pskb_network_may_pull() for transmit path header pulls (CVE-2026-74474 bsc#1276335). - net: do not send ICMP/NDISC Redirects when peer allocation fails (CVE-2026-74550 bsc#1275688). - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CVE-2026-68377 bsc#1274831). - netfilter: nft_fib: reject fib expression on the netdev egress hook (CVE-2026-72254 bsc#1277204). - xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663 bsc#1263133). - xfrm: Skip redundant replay recheck for the hardware offload path (CVE-2026-31663 bsc#1263133). - xfrm: Refactor xfrm_input lock to reduce contention with RSS (CVE-2026-31663 bsc#1263133). - xfrm: hold device only for the asynchronous decryption (CVE-2026-31663 bsc#1263133). - commit a778bbd - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262 bsc#1277678). - commit 5aba127 - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CVE-2026-72123 bsc#1277523). - commit a3ab58d ++++ kernel-rt_debug: - kabi: drop new skb drop reason SKB_BAD_GSO (CVE-2026-53091 bsc#1269530). - xfrm: Don't clobber inner headers when already set (CVE-2026-53091 bsc#1269530). - net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091 bsc#1269530). - net: qdisc_pkt_len_segs_init() cleanup (CVE-2026-53091 bsc#1269530). - net: account for encap headers in qdisc pkt len (CVE-2026-53091 bsc#1269530). - commit 3b63553 - md-cluster: fix NULL pointer dereference in process_metadata_update (CVE-2026-43271 bsc#1264587). - commit 65dc322 - scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer (CVE-2026-74557 bsc#1275685). - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it (CVE-2026-72085 bsc#1275542). - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (CVE-2026-63890 bsc#1272426). - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (CVE-2026-64003 bsc#1273782). - scsi: isci: Fix use-after-free in device removal path (CVE-2026-64103 bsc#1273759). - commit e311368 - md/raid1: create serial pool adding rdev to array with serialize_policy=1 (bsc#1272261). - commit b6ccdad - kabi: move skb_dev out of struct nf_queue_entry (CVE-2026-52912 bsc#1269000). - netfilter: nf_queue: hold bridge skb->dev while queued (CVE-2026-52912 bsc#1269000). - commit 977ba2c - mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() (CVE-2026-72308 bsc#1277159) - commit 2fd2205 - Drop patches.suse/wifi-mt76-mt7915-unwind-state-on-add_interface-failu.patch This turned out to be an incorrect backport, which doesn't actually fit with 6.4-based kernels. - commit 7cba3ca - rpm/kernel-obs-build.spec.in: Add more nft modules for docker nft_compat and nft_chain_nat this time. - commit 50912bc - net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked (CVE-2026-72036 bsc#1277034). - net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked (CVE-2026-72035 bsc#1276961). - commit e712169 - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres (CVE-2026-64463 bsc#1273273). - commit 4c1ccf2 - mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() (CVE-2026-72307 bsc#1277160) - commit 6ca16b7 - rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() (CVE-2026-74563 bsc#1275574). - commit a28b6fa - mm/page_reporting: use system_freezable_wq to fix UAF during suspend (CVE-2026-74481 bsc#1276355). - commit dd7ae57 - soc: xilinx: Shutdown and free rx mailbox channel (CVE-2026-80654 bsc#1277516) - commit 5db63c1 - net/mlx5e: Fix publication race for priv->channel_stats[] (CVE-2026-72341 bsc#1277660) - commit 968624d - net/mlx5e: Fix HV VHCA stats agent registration race (CVE-2026-72342 bsc#1277775) - commit 605af0b - net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation (CVE-2026-72343 bsc#1277776) - commit 2bd4503 - net/smc: fix TOCTOU race between smc_listen_out() and listener close (CVE-2026-74692 bsc#1276927). - net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (CVE-2026-74694 bsc#1277625). - commit f36a3ba - drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO (bsc#1277073 CVE-2026-74454) - commit 6ae624a - xfrm: Fix dev use-after-free in xfrm async resumption (git-fixes CVE-2026-72463 bsc#1277064 bsc#1268276). - commit b2879a3 - tls: don't leave a full plaintext sk_msg ring unpushed (CVE-2026-74610 bsc#1277054). - vxlan: use pskb_network_may_pull() for transmit path header pulls (CVE-2026-74474 bsc#1276335). - net: do not send ICMP/NDISC Redirects when peer allocation fails (CVE-2026-74550 bsc#1275688). - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CVE-2026-68377 bsc#1274831). - netfilter: nft_fib: reject fib expression on the netdev egress hook (CVE-2026-72254 bsc#1277204). - xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663 bsc#1263133). - xfrm: Skip redundant replay recheck for the hardware offload path (CVE-2026-31663 bsc#1263133). - xfrm: Refactor xfrm_input lock to reduce contention with RSS (CVE-2026-31663 bsc#1263133). - xfrm: hold device only for the asynchronous decryption (CVE-2026-31663 bsc#1263133). - commit a778bbd - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262 bsc#1277678). - commit 5aba127 - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CVE-2026-72123 bsc#1277523). - commit a3ab58d ++++ python-tornado6: - CVE-2026-82397: an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection (bsc#1277725) - Add patch CVE-2026-82397.patch ------------------------------------------------------------------ ------------------ 2026-9-1 - Sep 1 2026 ------------------- ------------------------------------------------------------------ ++++ curl: - Security fixes: * CVE-2026-13608: OpenLDAP SASL authentication bypass (bsc#1277476) * CVE-2026-80229: OpenSSL provider use-after-free (bsc#1277479) * CVE-2026-80230: OpenSSL pinning bypass (bsc#1277480) * Add patches: - curl-CVE-2026-13608.patch - curl-CVE-2026-80229.patch - curl-CVE-2026-80230.patch ++++ kernel-default: - NFS: Charge unstable writes by request size, not folio size (CVE-2026-72132 bsc#1277551). - commit 5e5ef88 - ipv6: guard against possible NULL deref in __in6_dev_stats_get() (CVE-2026-80646 bsc#1277513). - commit e73a36c - RDMA/srpt: fix integer overflow in immediate data length check (CVE-2026-74394 bsc#1277408) - commit cf133c7 - RDMA/siw: Fix endpoint/socket association handling (CVE-2026-74345 bsc#1277285) - commit f03bb87 - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (CVE-2026-72072 bsc#1277155) - commit 5bfed09 - RDMA/bnxt_re: zero shared page before exposing to userspace (CVE-2026-74584 bsc#1277066) - commit c4fb735 - bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check (CVE-2026-74256 bsc#1276535). - commit 2d795c1 - tipc: fix UAF in tipc_l2_send_msg() (CVE-2026-74255 bsc#1276547). - commit 2bc5320 - xfs: don't swallow dquot recovery verification errors (CVE-2026-80529 bsc#1277688). - commit 4bcaa34 - btrfs: fix memory leak in btrfs_do_encoded_write() (CVE-2026-74722 bsc#1276561). - commit 892c444 - ipvs: do not propagate one-packet flag to synced conns (CVE-2026-80714 bsc#1277561). - commit 024b8a5 - veth: fix skb length accounting after XDP frag adjustment (CVE-2026-74612 bsc#1277505). - commit 9d4be15 - ocfs2: avoid moving extents to occupied clusters (CVE-2026-72164 bsc#1277553). - commit 4279e98 - btrfs: fix deadlock cloning inline extent when using flushoncommit (CVE-2026-74318 bsc#1276864). - commit af8d3e6 - tpm: Make the TPM character devices non-seekable (CVE-2026-72135 bsc#1277571). - commit edb2507 - btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() (CVE-2026-74321 bsc#1277202). - commit dc557bd - netfilter: xtables: restrict several matches to inet family (CVE-2026-53001 bsc#1269114). - commit b18c544 - userfaultfd: prevent registration of special VMAs (CVE-2026-68166 bsc#1274930). - commit 4581a94 - netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920 bsc#1269013). - commit 11cdfcb - netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() (CVE-2026-74695 bsc#1276931). - commit 701e238 - xprtrdma: Decouple req recycling from RPC completion (CVE-2026-72473 bsc#1277037). - commit b0e5284 - xprtrdma: Use sendctx DMA state for Send signaling (CVE-2026-72473 bsc#1277037). - commit c1fe1a2 - xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot (CVE-2026-72473 bsc#1277037). - commit 3535354 - xprtrdma: Avoid 250 ms delay on backlog wakeup (CVE-2026-72473 bsc#1277037). - commit 47f26e2 - Refresh patches.suse/Bluetooth-L2CAP-Fix-UAF-in-channel-timeout-by-holdin.patch Address a potential NULL dereference in the downstream patch. - commit 053e6c7 - sctp: auth: verify auth requirement when auth_chunk is NULL (CVE-2026-68300 bsc#1275083). - sctp: validate stream count in sctp_process_strreset_inreq() (CVE-2026-68315 bsc#1274662). - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid (CVE-2026-68320 bsc#1274659). - sctp: validate STALE_COOKIE cause length before reading staleness (CVE-2026-64551 bsc#1273813). - commit f75229c - xprtrdma: Fix ep kref imbalance on ADDR_CHANGE (CVE-2026-72469 bsc#1277047). - commit dd9fa1c - kABI workaround for missing v4l2_async_register_subdev_sensor symbol (CVE-2026-68205 bsc#1274934). - commit d063d2c - ABI workaround for missing v4l2_async_register_subdev symbol (CVE-2026-68205 bsc#1274934). - commit 3c6189d - media: v4l: async: Set owner for async sub-devices (CVE-2026-68205 bsc#1274934). - commit 2e16432 - Bluetooth: hci_sync: Fix advertising data UAFs (CVE-2026-74509 bsc#1275946). - commit 8716d66 - media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() (CVE-2026-68205 bsc#1274934). - commit 824a936 - kABI workaround for wireless_dev.pmsr_free_wk wiphy_work convert (CVE-2026-68408 bsc#1274709). - commit 87c085d - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (CVE-2026-68408 bsc#1274709). - commit 617b21e - net: mana: Cap MSI-X vectors to the device MSI-X table size (git-fixes). - PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip (git-fixes). - RDMA/mana_ib: unify QP lookup table (git-fixes). - RDMA/mana_ib: drain QP references after partial table insertion (git-fixes). - scsi: storvsc: Support manual scans for all Hyper-V targets (git-fixes). - net: mana: Fall back to scattered pages for GDMA queues (git-fixes). - net: mana: Route ring-buffer access through offset-based helpers (git-fixes). - net: mana: Extend RX CQE coalescing up to 8 packets (git-fixes). - net: mana: force full-page RX buffers via ethtool private flag (bsc#1269792). - net: mana: refactor mana_get_strings() and mana_get_sset_count() to use switch (bsc#1269792). - net: mana: Add handler for sriov configure (bsc#1272756). - net: mana: Add debug knob to skip TX timeout recovery reset (git-fixes). - add mainline tag to existing mana patch - commit af333e4 - net: pktgen: fix proc entry use-after-free (CVE-2026-74479 bsc#1276354). - commit 86c3279 ++++ kernel-rt: - NFS: Charge unstable writes by request size, not folio size (CVE-2026-72132 bsc#1277551). - commit 5e5ef88 - ipv6: guard against possible NULL deref in __in6_dev_stats_get() (CVE-2026-80646 bsc#1277513). - commit e73a36c - RDMA/srpt: fix integer overflow in immediate data length check (CVE-2026-74394 bsc#1277408) - commit cf133c7 - RDMA/siw: Fix endpoint/socket association handling (CVE-2026-74345 bsc#1277285) - commit f03bb87 - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (CVE-2026-72072 bsc#1277155) - commit 5bfed09 - RDMA/bnxt_re: zero shared page before exposing to userspace (CVE-2026-74584 bsc#1277066) - commit c4fb735 - bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check (CVE-2026-74256 bsc#1276535). - commit 2d795c1 - tipc: fix UAF in tipc_l2_send_msg() (CVE-2026-74255 bsc#1276547). - commit 2bc5320 - xfs: don't swallow dquot recovery verification errors (CVE-2026-80529 bsc#1277688). - commit 4bcaa34 - btrfs: fix memory leak in btrfs_do_encoded_write() (CVE-2026-74722 bsc#1276561). - commit 892c444 - ipvs: do not propagate one-packet flag to synced conns (CVE-2026-80714 bsc#1277561). - commit 024b8a5 - veth: fix skb length accounting after XDP frag adjustment (CVE-2026-74612 bsc#1277505). - commit 9d4be15 - ocfs2: avoid moving extents to occupied clusters (CVE-2026-72164 bsc#1277553). - commit 4279e98 - btrfs: fix deadlock cloning inline extent when using flushoncommit (CVE-2026-74318 bsc#1276864). - commit af8d3e6 - tpm: Make the TPM character devices non-seekable (CVE-2026-72135 bsc#1277571). - commit edb2507 - btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() (CVE-2026-74321 bsc#1277202). - commit dc557bd - netfilter: xtables: restrict several matches to inet family (CVE-2026-53001 bsc#1269114). - commit b18c544 - userfaultfd: prevent registration of special VMAs (CVE-2026-68166 bsc#1274930). - commit 4581a94 - netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920 bsc#1269013). - commit 11cdfcb - netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() (CVE-2026-74695 bsc#1276931). - commit 701e238 - xprtrdma: Decouple req recycling from RPC completion (CVE-2026-72473 bsc#1277037). - commit b0e5284 - xprtrdma: Use sendctx DMA state for Send signaling (CVE-2026-72473 bsc#1277037). - commit c1fe1a2 - xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot (CVE-2026-72473 bsc#1277037). - commit 3535354 - xprtrdma: Avoid 250 ms delay on backlog wakeup (CVE-2026-72473 bsc#1277037). - commit 47f26e2 - Refresh patches.suse/Bluetooth-L2CAP-Fix-UAF-in-channel-timeout-by-holdin.patch Address a potential NULL dereference in the downstream patch. - commit 053e6c7 - sctp: auth: verify auth requirement when auth_chunk is NULL (CVE-2026-68300 bsc#1275083). - sctp: validate stream count in sctp_process_strreset_inreq() (CVE-2026-68315 bsc#1274662). - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid (CVE-2026-68320 bsc#1274659). - sctp: validate STALE_COOKIE cause length before reading staleness (CVE-2026-64551 bsc#1273813). - commit f75229c - xprtrdma: Fix ep kref imbalance on ADDR_CHANGE (CVE-2026-72469 bsc#1277047). - commit dd9fa1c - kABI workaround for missing v4l2_async_register_subdev_sensor symbol (CVE-2026-68205 bsc#1274934). - commit d063d2c - ABI workaround for missing v4l2_async_register_subdev symbol (CVE-2026-68205 bsc#1274934). - commit 3c6189d - media: v4l: async: Set owner for async sub-devices (CVE-2026-68205 bsc#1274934). - commit 2e16432 - Bluetooth: hci_sync: Fix advertising data UAFs (CVE-2026-74509 bsc#1275946). - commit 8716d66 - media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() (CVE-2026-68205 bsc#1274934). - commit 824a936 - kABI workaround for wireless_dev.pmsr_free_wk wiphy_work convert (CVE-2026-68408 bsc#1274709). - commit 87c085d - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (CVE-2026-68408 bsc#1274709). - commit 617b21e - net: mana: Cap MSI-X vectors to the device MSI-X table size (git-fixes). - PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip (git-fixes). - RDMA/mana_ib: unify QP lookup table (git-fixes). - RDMA/mana_ib: drain QP references after partial table insertion (git-fixes). - scsi: storvsc: Support manual scans for all Hyper-V targets (git-fixes). - net: mana: Fall back to scattered pages for GDMA queues (git-fixes). - net: mana: Route ring-buffer access through offset-based helpers (git-fixes). - net: mana: Extend RX CQE coalescing up to 8 packets (git-fixes). - net: mana: force full-page RX buffers via ethtool private flag (bsc#1269792). - net: mana: refactor mana_get_strings() and mana_get_sset_count() to use switch (bsc#1269792). - net: mana: Add handler for sriov configure (bsc#1272756). - net: mana: Add debug knob to skip TX timeout recovery reset (git-fixes). - add mainline tag to existing mana patch - commit af333e4 - net: pktgen: fix proc entry use-after-free (CVE-2026-74479 bsc#1276354). - commit 86c3279 ++++ kernel-rt_debug: - NFS: Charge unstable writes by request size, not folio size (CVE-2026-72132 bsc#1277551). - commit 5e5ef88 - ipv6: guard against possible NULL deref in __in6_dev_stats_get() (CVE-2026-80646 bsc#1277513). - commit e73a36c - RDMA/srpt: fix integer overflow in immediate data length check (CVE-2026-74394 bsc#1277408) - commit cf133c7 - RDMA/siw: Fix endpoint/socket association handling (CVE-2026-74345 bsc#1277285) - commit f03bb87 - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (CVE-2026-72072 bsc#1277155) - commit 5bfed09 - RDMA/bnxt_re: zero shared page before exposing to userspace (CVE-2026-74584 bsc#1277066) - commit c4fb735 - bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check (CVE-2026-74256 bsc#1276535). - commit 2d795c1 - tipc: fix UAF in tipc_l2_send_msg() (CVE-2026-74255 bsc#1276547). - commit 2bc5320 - xfs: don't swallow dquot recovery verification errors (CVE-2026-80529 bsc#1277688). - commit 4bcaa34 - btrfs: fix memory leak in btrfs_do_encoded_write() (CVE-2026-74722 bsc#1276561). - commit 892c444 - ipvs: do not propagate one-packet flag to synced conns (CVE-2026-80714 bsc#1277561). - commit 024b8a5 - veth: fix skb length accounting after XDP frag adjustment (CVE-2026-74612 bsc#1277505). - commit 9d4be15 - ocfs2: avoid moving extents to occupied clusters (CVE-2026-72164 bsc#1277553). - commit 4279e98 - btrfs: fix deadlock cloning inline extent when using flushoncommit (CVE-2026-74318 bsc#1276864). - commit af8d3e6 - tpm: Make the TPM character devices non-seekable (CVE-2026-72135 bsc#1277571). - commit edb2507 - btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() (CVE-2026-74321 bsc#1277202). - commit dc557bd - netfilter: xtables: restrict several matches to inet family (CVE-2026-53001 bsc#1269114). - commit b18c544 - userfaultfd: prevent registration of special VMAs (CVE-2026-68166 bsc#1274930). - commit 4581a94 - netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920 bsc#1269013). - commit 11cdfcb - netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() (CVE-2026-74695 bsc#1276931). - commit 701e238 - xprtrdma: Decouple req recycling from RPC completion (CVE-2026-72473 bsc#1277037). - commit b0e5284 - xprtrdma: Use sendctx DMA state for Send signaling (CVE-2026-72473 bsc#1277037). - commit c1fe1a2 - xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot (CVE-2026-72473 bsc#1277037). - commit 3535354 - xprtrdma: Avoid 250 ms delay on backlog wakeup (CVE-2026-72473 bsc#1277037). - commit 47f26e2 - Refresh patches.suse/Bluetooth-L2CAP-Fix-UAF-in-channel-timeout-by-holdin.patch Address a potential NULL dereference in the downstream patch. - commit 053e6c7 - sctp: auth: verify auth requirement when auth_chunk is NULL (CVE-2026-68300 bsc#1275083). - sctp: validate stream count in sctp_process_strreset_inreq() (CVE-2026-68315 bsc#1274662). - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid (CVE-2026-68320 bsc#1274659). - sctp: validate STALE_COOKIE cause length before reading staleness (CVE-2026-64551 bsc#1273813). - commit f75229c - xprtrdma: Fix ep kref imbalance on ADDR_CHANGE (CVE-2026-72469 bsc#1277047). - commit dd9fa1c - kABI workaround for missing v4l2_async_register_subdev_sensor symbol (CVE-2026-68205 bsc#1274934). - commit d063d2c - ABI workaround for missing v4l2_async_register_subdev symbol (CVE-2026-68205 bsc#1274934). - commit 3c6189d - media: v4l: async: Set owner for async sub-devices (CVE-2026-68205 bsc#1274934). - commit 2e16432 - Bluetooth: hci_sync: Fix advertising data UAFs (CVE-2026-74509 bsc#1275946). - commit 8716d66 - media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() (CVE-2026-68205 bsc#1274934). - commit 824a936 - kABI workaround for wireless_dev.pmsr_free_wk wiphy_work convert (CVE-2026-68408 bsc#1274709). - commit 87c085d - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (CVE-2026-68408 bsc#1274709). - commit 617b21e - net: mana: Cap MSI-X vectors to the device MSI-X table size (git-fixes). - PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip (git-fixes). - RDMA/mana_ib: unify QP lookup table (git-fixes). - RDMA/mana_ib: drain QP references after partial table insertion (git-fixes). - scsi: storvsc: Support manual scans for all Hyper-V targets (git-fixes). - net: mana: Fall back to scattered pages for GDMA queues (git-fixes). - net: mana: Route ring-buffer access through offset-based helpers (git-fixes). - net: mana: Extend RX CQE coalescing up to 8 packets (git-fixes). - net: mana: force full-page RX buffers via ethtool private flag (bsc#1269792). - net: mana: refactor mana_get_strings() and mana_get_sset_count() to use switch (bsc#1269792). - net: mana: Add handler for sriov configure (bsc#1272756). - net: mana: Add debug knob to skip TX timeout recovery reset (git-fixes). - add mainline tag to existing mana patch - commit af333e4 - net: pktgen: fix proc entry use-after-free (CVE-2026-74479 bsc#1276354). - commit 86c3279 ++++ multipath-tools: - Update to version 0.10.8+212+suse.3dc4ecc: - Upstream fixes for vulnerabilities: * DoS on mulipathd socket by blocking IPC send operations (GHSA-hmcm-9cq4-r2xm bsc#1277199) * DoS on multipathd socket by exhausting connections (GHSA-pvp6-c9p3-25fp bsc#1277203) * Heap Out-of-Bounds Read in Custom Format String Parser via Trailing `%` (GHSA-g5mh-253r-jjw5 bsc#1277205) * Heap out-of-bounds read in device-mapper-multipath ALUA RTPG parsing (GHSA-pxwh-g75c-95pc bsc#1277208) * kpartx: Heap Out-of-Bounds Read in GPT Header Validation (GHSA-p6rh-9x9j-3hvx, bsc#1277209) * Path traversal in device-mapper-multipath failed_wwids management (GHSA-gr7q-prfc-q636 bsc#1277210) * libmpathpersist PRIN READ FULL STATUS parser — unbounded descriptor rewrite causes root heap overflow (GHSA-hj7j-qr9h-5fv6 bsc#1277212) - Bug fixes: * Add missing NULL check in DM parser (gh#opensvc/multipath-tools#155) ++++ libtirpc: - fix memory leak in destroy addr (bsc#1274740) * add 0001-rpcb_clnt.c-memory-leak-in-destroy_addr.patch ------------------------------------------------------------------ ------------------ 2026-8-31 - Aug 31 2026 ------------------- ------------------------------------------------------------------ ++++ dracut: - Update to version 059+suse.649.g0274006: * fix(network-legacy): sanitize values written to /tmp/net.${netif}.override * fix(network-legacy): sanitize values written to /tmp/net.${netif}.gw * fix(network-legacy): sanitize values written to /tmp/net.${netif}.hostname * fix(network-legacy): strip DHCP-supplied domain to a safe charset - CVE-2026-6893: root code execution via dhcp options command injection (bsc#1268322, follow-up fixes recently merged) ++++ glibc: - strfmon-right-just.patch: stdlib: Fix right-justification in strfmon (CVE-2026-19499, bsc#1276892, BZ #34510) - tdelete-oob-write.patch: misc: Fix out-of-bounds array write in tdelete (CVE-2026-19542, bsc#1276946, BZ #34506) - sjisx-pending-char-reset.patch: iconvdata: SHIFT_JISX0213 decoding lacks pending character reset (CVE-2026-77117, bsc#1277921, BZ #34556) - eucjisx-pending-char-reset.patch: iconvdata: EUC_JISX0213 decoding lacks pending character reset (CVE-2026-80489, bsc#1277922, BZ #34568) - libio-fopen-ccs.patch: libio: Fix CVE-2026-18374 heap buffer overflow in ccs= handling (CVE-2026-18374, bsc#1277262, BZ #34574) ++++ kbd: - Fix potential local root privilege escalation (bsc#1275441 kbd-openvt-CVE-2026-72693.patch). - libkfont: Fix potential buffer overflow (bsc#1275441, kbd-libkfont-buffer-overflow-1.patch, kbd-libkfont-buffer-overflow-2.patch). - Prevent integer overflow in libkfont (bsc#1275441, kbd-libkfont-buffer-validation.patch). ++++ kernel-default: - Update patches.suse/KVM-x86-Fix-VM-hard-lockup-after-prolonged-inactivit.patch (git-fixes CVE-2025-71104 bsc#1256708). - Update patches.suse/KVM-x86-hyper-v-Bound-the-bank-index-when-querying-s.patch (git-fixes CVE-2026-64247 bsc#1273903). - Update patches.suse/KVM-x86-mmu-Fix-use-after-free-on-vendor-module-relo.patch (git-fixes CVE-2026-68428 bsc#1274699). - Update patches.suse/KVM-x86-xen-Fix-cleanup-logic-in-emulation-of-Xen-sc.patch (git-fixes CVE-2025-38469 bsc#1247455). - Update patches.suse/crypto-af_alg-Fix-incorrect-boolean-values-in-af_alg.patch (bsc#1251966 CVE-2025-39964 CVE-2025-40022 bsc#1252682). - Update patches.suse/fuse-re-lock-request-before-returning-from-fuse_ref_.patch (CVE-2026-53388 bsc#1271825 CVE-2026-64266 bsc#1273555). - Update patches.suse/ice-Fix-PTP-NULL-pointer-dereference-during-VSI-rebu.patch (bsc#1269981 CVE-2026-23210 bsc#1258517). - Update patches.suse/ice-fix-PTP-Call-Trace-during-PTP-release.patch (bsc#1269981 CVE-2026-68133 bsc#1275555). - Update patches.suse/ipv4-account-for-fraggap-on-the-paged-allocation-path.patch (git-fixes CVE-2026-53366 bsc#1271366). - Update patches.suse/msft-hv-3523-net-mana-fix-use-after-free-in-mana_hwc_destroy_chan.patch (git-fixes CVE-2026-23454 bsc#1261780). - Update patches.suse/msft-hv-3581-net-mana-Fix-TOCTOU-double-fetch-of-hwc_msg_id-from-.patch (bsc#1265928 CVE-2026-64034 bsc#1273054). - Update patches.suse/msft-hv-3583-net-mana-validate-rx_req_idx-to-prevent-out-of-bound.patch (bsc#1266402 CVE-2026-64018 bsc#1273053). - Update patches.suse/msft-hv-3585-drm-hyperv-validate-resolution_count-and-fix-WIN8-fa.patch (git-fixes CVE-2026-64524 bsc#1273578). - Update patches.suse/msft-hv-3586-drm-hyperv-validate-VMBus-packet-size-in-receive-cal.patch (git-fixes CVE-2026-64527 bsc#1274226). - Update patches.suse/msft-hv-3587-net-mana-Add-NULL-guards-in-teardown-path-to-prevent.patch (git-fixes CVE-2026-63973 bsc#1272682). - Update patches.suse/msft-hv-3588-net-mana-Skip-redundant-detach-on-already-detached-p.patch (git-fixes CVE-2026-63972 bsc#1272680). - Update patches.suse/s390-Disable-ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP.patch (bsc#1254306 CVE-2025-68179 bsc#1255250). - Update patches.suse/scsi-target-iscsi-validate-CHAP_R-length-before-base.patch (bsc#1265449 CVE-2026-63886 bsc#1272381). - Update patches.suse/smb-client-split-cached_fid-bitfields-to-avoid-shared-byte-RMW-rac.patch (bsc#1250748 bsc#1257154 CVE-2026-23230 bsc#1258430). - Update patches.suse/workqueue-Fix-UBSAN-subtraction-overflow-error-in-shift_an.patch (bsc#1260522 CVE-2024-44981 bsc#1230238). - commit 059f170 - Update patches.suse/ACPI-CPPC-Suppress-UBSAN-warning-caused-by-field-mis.patch (git-fixes CVE-2026-64512 bsc#1273597). - Update patches.suse/ACPI-NFIT-core-Fix-possible-NULL-pointer-dereference.patch (git-fixes CVE-2026-64511 bsc#1273796). - Update patches.suse/ALSA-asihpi-Fix-potential-OOB-array-access-at-readin.patch (stable-fixes CVE-2026-64133 bsc#1274065). - Update patches.suse/ALSA-caiaq-fix-out-of-bounds-read-in-the-Traktor-Kon.patch (git-fixes CVE-2026-64487 bsc#1273506). - Update patches.suse/ALSA-cmipci-check-snd_ctl_new1-return-value.patch (git-fixes CVE-2026-64486 bsc#1274243). - Update patches.suse/ALSA-es1938-check-snd_ctl_new1-return-value.patch (git-fixes CVE-2026-64484 bsc#1274573). - Update patches.suse/ALSA-firewire-isight-bound-the-sample-count-to-the-p.patch (git-fixes CVE-2026-64483 bsc#1273991). - Update patches.suse/ALSA-gus-check-snd_ctl_new1-return-value.patch (git-fixes CVE-2026-64482 bsc#1273790). - Update patches.suse/ALSA-hda-cs35l41-validate-and-free-ACPI-mute-object.patch (git-fixes CVE-2026-68346 bsc#1274622). - Update patches.suse/ALSA-ice1712-check-snd_ctl_new1-return-value.patch (git-fixes CVE-2026-64480 bsc#1274239). - Update patches.suse/ALSA-seq-Fix-uninitialised-heap-leak-in-snd_seq_even.patch (git-fixes CVE-2026-64479 bsc#1273890). - Update patches.suse/ALSA-usb-audio-avoid-kobject-path-lookup-in-DualSens.patch (git-fixes CVE-2026-64478 bsc#1274321). - Update patches.suse/ALSA-ymfpci-check-snd_ctl_new1-return-value.patch (git-fixes CVE-2026-64489 bsc#1274281). - Update patches.suse/ASoC-codecs-simple-mux-Fix-enum-control-bounds-check.patch (git-fixes CVE-2026-64243 bsc#1273838). - Update patches.suse/ASoC-tas2781-bound-firmware-description-string-parsi.patch (git-fixes CVE-2026-68348 bsc#1274624). - Update patches.suse/Bluetooth-ISO-drop-ISO_END-frames-received-without-p.patch (git-fixes CVE-2026-64128 bsc#1274067). - Update patches.suse/Bluetooth-L2CAP-validate-option-length-before-readin.patch (git-fixes CVE-2026-64403 bsc#1274076). - Update patches.suse/Bluetooth-MGMT-Fix-UAF-of-hci_conn_params-in-add_dev.patch (git-fixes CVE-2026-64433 bsc#1274283). - Update patches.suse/Bluetooth-MGMT-validate-Add-Extended-Advertising-Dat.patch (git-fixes CVE-2026-64126 bsc#1273765). - Update patches.suse/Bluetooth-RFCOMM-Fix-session-UAF-in-set_termios.patch (git-fixes CVE-2026-68188 bsc#1274953). - Update patches.suse/Bluetooth-bnep-Fix-UAF-read-of-dev-name.patch (git-fixes CVE-2026-64178 bsc#1273946). - Update patches.suse/Bluetooth-bnep-pin-L2CAP-connection-during-netdev-re.patch (git-fixes CVE-2026-64408 bsc#1273778). - Update patches.suse/Bluetooth-bpa10x-avoid-OOB-read-of-revision-string-i.patch (git-fixes CVE-2026-64549 bsc#1273341). - Update patches.suse/Bluetooth-btmtksdio-fix-infinite-loop-in-btmtksdio_t.patch (git-fixes CVE-2026-64409 bsc#1273862). - Update patches.suse/Bluetooth-btusb-fix-use-after-free-on-marvell-probe-.patch (git-fixes CVE-2026-64470 bsc#1273892). - Update patches.suse/Bluetooth-btusb-fix-use-after-free-on-registration-f.patch (git-fixes CVE-2026-64471 bsc#1274278). - Update patches.suse/Bluetooth-btusb-validate-Realtek-vendor-event-length.patch (git-fixes CVE-2026-68339 bsc#1274636). - Update patches.suse/Bluetooth-eir-Fix-stack-OOB-write-when-prepending-th.patch (git-fixes CVE-2026-64539 bsc#1273338). - Update patches.suse/Bluetooth-fix-UAF-in-bt_accept_dequeue.patch (git-fixes CVE-2026-64406 bsc#1273579). - Update patches.suse/Bluetooth-hci_sync-Protect-UUID-list-traversal.patch (git-fixes CVE-2026-68189 bsc#1274945). - Update patches.suse/Bluetooth-hci_uart-clear-HCI_UART_SENDING-when-write.patch (git-fixes CVE-2026-68085 bsc#1274702). - Update patches.suse/Bluetooth-mgmt-fix-locking-in-unpair_device-disconne.patch (git-fixes CVE-2026-68392 bsc#1274907). - Update patches.suse/Bluetooth-mgmt-hold-reference-for-hci_conn-in-mgmt_p.patch (git-fixes CVE-2026-68391 bsc#1274899). - Update patches.suse/Bluetooth-qca-fix-NVM-tag-length-underflow-in-TLV-pa.patch (git-fixes CVE-2026-64573 bsc#1274017). - Update patches.suse/HID-letsketch-fix-UAF-on-inrange_timer-at-driver-unb.patch (git-fixes CVE-2026-64365 bsc#1273310). - Update patches.suse/HID-lg-g15-cancel-pending-work-on-remove-to-fix-a-us.patch (git-fixes CVE-2026-64362 bsc#1274078). - Update patches.suse/HID-logitech-dj-Fix-maxfield-check-in-DJ-short-repor.patch (git-fixes CVE-2026-64427 bsc#1273281). - Update patches.suse/HID-wacom-stop-hardware-after-post-start-probe-failu.patch (git-fixes CVE-2026-68091 bsc#1274721). - Update patches.suse/Input-elan_i2c-prevent-division-by-zero-and-arithmet.patch (git-fixes CVE-2026-64275 bsc#1273876). - Update patches.suse/Input-elan_i2c-validate-firmware-size-before-use.patch (stable-fixes CVE-2026-64237 bsc#1273739). - Update patches.suse/Input-goodix-clamp-the-device-reported-contact-count.patch (git-fixes CVE-2026-64274 bsc#1273542). - Update patches.suse/Input-iforce-bound-the-device-reported-force-feedbac.patch (git-fixes CVE-2026-64273 bsc#1273941). - Update patches.suse/Input-ims-pcu-fix-heap-buffer-overflow-in-ims_pcu_pr.patch (git-fixes CVE-2026-64565 bsc#1274001). - Update patches.suse/Input-synaptics-rmi4-bound-the-F30-keymap-to-the-GPI.patch (git-fixes CVE-2026-64276 bsc#1273877). - Update patches.suse/Input-synaptics-rmi4-bound-the-F3A-keymap-to-the-GPI.patch (git-fixes CVE-2026-64277 bsc#1274035). - Update patches.suse/Input-touchwin-reset-the-packet-index-on-every-compl.patch (git-fixes CVE-2026-64271 bsc#1273935). - Update patches.suse/Input-usbtouchscreen-clamp-NEXIO-data_len-x_len-to-U.patch (git-fixes CVE-2026-64014 bsc#1273769). - Update patches.suse/KVM-SVM-Bump-asid_generation-on-CPU-online-to-avoid-.patch (git-fixes CVE-2026-68093 bsc#1274725). - Update patches.suse/KVM-VMX-Grab-vmcs12-on-CR8-interception-update-iff-v.patch (git-fixes CVE-2026-64604 bsc#1274286). - Update patches.suse/KVM-x86-Unconditionally-recompute-CR8-intercept-on-P.patch (git-fixes CVE-2026-64513 bsc#1273327). - Update patches.suse/USB-chaoskey-Fix-slab-use-after-free-in-chaoskey_rel.patch (git-fixes CVE-2026-64455 bsc#1273844). - Update patches.suse/USB-idmouse-fix-use-after-free-on-disconnect-race.patch (git-fixes CVE-2026-64344 bsc#1274019). - Update patches.suse/USB-iowarrior-fix-use-after-free-on-disconnect-race.patch (git-fixes CVE-2026-64341 bsc#1273895). - Update patches.suse/USB-iowarrior-fix-use-after-free-on-disconnect.patch (git-fixes CVE-2026-64342 bsc#1274011). - Update patches.suse/USB-ldusb-fix-use-after-free-on-disconnect-race.patch (git-fixes CVE-2026-64343 bsc#1273974). - Update patches.suse/USB-legousbtower-fix-use-after-free-on-disconnect-ra.patch (git-fixes CVE-2026-64340 bsc#1274003). - Update patches.suse/USB-misc-uss720-unregister-parport-on-probe-failure.patch (git-fixes CVE-2026-64338 bsc#1273990). - Update patches.suse/USB-serial-digi_acceleport-fix-broken-rx-after-throt.patch (git-fixes CVE-2026-64335 bsc#1273977). - Update patches.suse/USB-serial-digi_acceleport-fix-hard-lockup-on-discon.patch (git-fixes CVE-2026-64334 bsc#1273942). - Update patches.suse/USB-serial-digi_acceleport-fix-write-buffer-corrupti.patch (git-fixes CVE-2026-64333 bsc#1273933). - Update patches.suse/USB-serial-io_edgeport-cap-received-transmit-credits.patch (git-fixes CVE-2026-68365 bsc#1276257). - Update patches.suse/USB-serial-mct_u232-fix-memory-corruption-with-small.patch (CVE-2026-63928 bsc#1272891 CVE-2026-63898 bsc#1272643). - Update patches.suse/USB-ulpi-fix-memory-leak-on-registration-failure.patch (git-fixes CVE-2026-64332 bsc#1273285). - Update patches.suse/accel-qaic-Add-overflow-check-to-remap_pfn_range-dur.patch (git-fixes CVE-2026-64051 bsc#1273482). - Update patches.suse/batman-adv-bla-fix-report_work-leak-on-backbone_gw-p.patch (git-fixes CVE-2026-64218 bsc#1273832). - Update patches.suse/batman-adv-tt-fix-negative-tt_buff_len.patch (git-fixes CVE-2026-64088 bsc#1273463). - Update patches.suse/can-esd_usb-kill-anchored-URBs-before-freeing-netdev.patch (git-fixes CVE-2026-64585 bsc#1274491). - Update patches.suse/cdrom-fix-stack-out-of-bounds-read-in-CDROMVOLCTRL.patch (git-fixes CVE-2026-68184 bsc#1274981). - Update patches.suse/comedi-comedi_parport-deal-with-premature-interrupt.patch (git-fixes CVE-2026-68182 bsc#1274958). - Update patches.suse/crypto-amlogic-avoid-double-cleanup-in-meson_crypto_.patch (git-fixes CVE-2026-64599 bsc#1274314). - Update patches.suse/crypto-asymmetric_keys-fix-OOB-read-in-pefile_digest.patch (git-fixes CVE-2026-64544 bsc#1273316). - Update patches.suse/crypto-drbg-Fix-returning-success-on-failure-in-CTR_.patch (git-fixes CVE-2026-64306 bsc#1273939). - Update patches.suse/crypto-ecc-Fix-carry-overflow-in-vli-multiplication.patch (git-fixes CVE-2026-64313 bsc#1273940). - Update patches.suse/crypto-qat-protect-service-table-iterations-with-ser.patch (git-fixes CVE-2026-64305 bsc#1273294). - Update patches.suse/drm-amd-display-Validate-GPIO-pin-LUT-table-size-bef.patch (stable-fixes CVE-2026-64097 bsc#1273480). - Update patches.suse/drm-amd-display-Validate-payload-length-and-link_ind.patch (stable-fixes CVE-2026-64219 bsc#1273811). - Update patches.suse/drm-amd-display-detect_link_and_local_sink-DP-alt-mo.patch (git-fixes CVE-2026-68256 bsc#1275152). - Update patches.suse/drm-amd-display-set-new_stream-to-NULL-after-release.patch (git-fixes CVE-2026-68236 bsc#1275659). - Update patches.suse/drm-amdgpu-fix-aperture-mapping-leak.patch (git-fixes CVE-2026-68102 bsc#1274764). - Update patches.suse/drm-amdgpu-fix-bo-pin-leaking-in-amdgpu_bo_create_re.patch (stable-fixes CVE-2026-68234 bsc#1275650). - Update patches.suse/drm-amdgpu-fix-division-by-zero-with-invalid-uvd-dim.patch (stable-fixes CVE-2026-68106 bsc#1274853). - Update patches.suse/drm-amdgpu-gfx10-replace-BUG_ON-with-WARN_ON.patch (stable-fixes CVE-2026-68115 bsc#1274879). - Update patches.suse/drm-amdgpu-gfx11-replace-BUG_ON-with-WARN_ON.patch (stable-fixes CVE-2026-68246 bsc#1275790). - Update patches.suse/drm-amdgpu-gfx8-drop-unecessary-BUG_ON.patch (stable-fixes CVE-2026-68430 bsc#1276273). - Update patches.suse/drm-amdgpu-gfx9-replace-BUG_ON-with-WARN_ON.patch (stable-fixes CVE-2026-68111 bsc#1274873). - Update patches.suse/drm-amdgpu-gfx9.4.3-replace-BUG_ON-with-WARN_ON.patch (stable-fixes CVE-2026-68112 bsc#1274874). - Update patches.suse/drm-amdgpu-invoke-pm_genpd_remove-before-freeing-gen.patch (stable-fixes CVE-2026-68104 bsc#1274847). - Update patches.suse/drm-amdgpu-sdma4.4.2-replace-BUG_ON-with-WARN_ON.patch (stable-fixes CVE-2026-68110 bsc#1274872). - Update patches.suse/drm-amdgpu-sdma5.0-replace-BUG_ON-with-WARN_ON.patch (stable-fixes CVE-2026-68249 bsc#1275819). - Update patches.suse/drm-amdgpu-sdma5.2-replace-BUG_ON-with-WARN_ON.patch (stable-fixes CVE-2026-68250 bsc#1275820). - Update patches.suse/drm-amdgpu-sdma6.0-replace-BUG_ON-with-WARN_ON.patch (stable-fixes CVE-2026-68251 bsc#1275821). - Update patches.suse/drm-amdgpu-validate-CP_GFX_SHADOW-chunk-size-in-CS-p.patch (git-fixes CVE-2026-68272 bsc#1275126). - Update patches.suse/drm-amdgpu-vce-fix-integer-overflow-in-image-size.patch (stable-fixes CVE-2026-68108 bsc#1274869). - Update patches.suse/drm-amdgpu-vcn4-avoid-rereading-IB-param-length.patch (stable-fixes CVE-2026-68107 bsc#1274868). - Update patches.suse/drm-amdkfd-Check-bounds-in-allocate_event_notificati.patch (stable-fixes CVE-2026-68259 bsc#1275869). - Update patches.suse/drm-bridge-cdns-dsi-Replace-deprecated-UNIVERSAL_DEV.patch (git-fixes CVE-2026-68280 bsc#1275872). - Update patches.suse/drm-dp-mst-fix-OOB-reads-in-remote-DPCD-I2C-sideband.patch (git-fixes CVE-2026-68279 bsc#1275871). - Update patches.suse/drm-dp-mst-fix-OOB-reads-on-2-byte-fields-in-sideban.patch (git-fixes CVE-2026-68277 bsc#1275125). - Update patches.suse/drm-dp-mst-fix-buffer-overflows-in-sideband-chunk-ac.patch (git-fixes CVE-2026-68278 bsc#1275870). - Update patches.suse/drm-dp_mst-Handle-torn-down-topology-gracefully-in-d.patch (git-fixes CVE-2026-68429 bsc#1274802). - Update patches.suse/drm-edid-fix-OOB-read-in-drm_parse_tiled_block.patch (git-fixes CVE-2026-64546 bsc#1273334). - Update patches.suse/drm-hyperv-validate-VMBus-packet-size-in-receive-cal.patch (git-fixes CVE-2026-64527 bsc#1274226). - Update patches.suse/drm-hyperv-validate-resolution_count-and-fix-WIN8-fa.patch (git-fixes CVE-2026-64524 bsc#1273578). - Update patches.suse/drm-i915-Return-NULL-on-error-in-active_instance.patch (git-fixes CVE-2026-68248 bsc#1275818). - Update patches.suse/drm-i915-gem-Add-missing-nospec-on-parallel-submit-s.patch (git-fixes CVE-2026-68269 bsc#1275131). - Update patches.suse/drm-i915-gem-Do-not-leak-siblings-on-proto-context-e.patch (git-fixes CVE-2026-68244 bsc#1275788). - Update patches.suse/drm-i915-gem-Fix-NULL-deref-in-I915_CONTEXT_PARAM_SS.patch (git-fixes CVE-2026-68243 bsc#1275787). - Update patches.suse/drm-msm-snapshot-fix-dumping-of-the-unaligned-region.patch (git-fixes CVE-2026-64039 bsc#1273755). - Update patches.suse/drm-nouveau-fix-reversed-error-cleanup-order-in-ucop.patch (git-fixes CVE-2026-68271 bsc#1275132). - Update patches.suse/drm-vc4-Prevent-shader-BO-mappings-from-becoming-wri.patch (git-fixes CVE-2026-68445 bsc#1276277). - Update patches.suse/drm-vc4-hvs-v3d-Fix-null-dereference-in-unbind.patch (git-fixes CVE-2026-68303 bsc#1275080). - Update patches.suse/drm-virtio-bound-EDID-block-reads-to-the-response-bu.patch (git-fixes CVE-2026-68255 bsc#1275154). - Update patches.suse/drm-vmwgfx-Validate-vmw_surface_metadata-array_size.patch (git-fixes CVE-2026-68446 bsc#1274770). - Update patches.suse/firewire-net-Fix-fragmented-datagram-reassembly.patch (git-fixes CVE-2026-68354 bsc#1274738). - Update patches.suse/firmware-arm_ffa-Check-for-NULL-FF-A-ID-table-while-.patch (git-fixes CVE-2026-64166 bsc#1273822). - Update patches.suse/firmware-arm_ffa-Fix-NULL-dereference-in-ffa_partiti.patch (git-fixes CVE-2026-68444 bsc#1274768). - Update patches.suse/firmware_loader-fix-device-reference-leak-in-firmwar.patch (git-fixes CVE-2026-64376 bsc#1273817). - Update patches.suse/fpga-region-fix-use-after-free-in-child_regions_with.patch (git-fixes CVE-2026-64249 bsc#1273810). - Update patches.suse/gpio-eic-sprd-use-raw_spinlock_t-in-the-irq-startup-.patch (git-fixes CVE-2026-64429 bsc#1273501). - Update patches.suse/gpu-host1x-Fix-use-after-free-in-host1x_bo_clear_cac.patch (stable-fixes CVE-2026-68427 bsc#1276270). - Update patches.suse/hwmon-corsair-cpro-Stop-device-IO-before-calling-hid.patch (git-fixes CVE-2026-68360 bsc#1275176). - Update patches.suse/hwmon-corsair-psu-Stop-device-IO-before-calling-hid_.patch (git-fixes CVE-2026-68361 bsc#1275185). - Update patches.suse/hwmon-nzxt-smart2-Stop-device-IO-before-calling-hid_.patch (git-fixes CVE-2026-68359 bsc#1274670). - Update patches.suse/hwmon-occ-validate-poll-response-sensor-blocks.patch (git-fixes CVE-2026-68340 bsc#1274632). - Update patches.suse/hwmon-pmbus-adm1266-bounce-blackbox-records-through-.patch (git-fixes CVE-2026-64085 bsc#1273468). - Update patches.suse/hwmon-pmbus-adm1266-cap-PDIO-scan-in-get_multiple-at.patch (git-fixes CVE-2026-64084 bsc#1273471). - Update patches.suse/hwmon-pmbus-adm1266-include-PEC-byte-in-pmbus_block_.patch (git-fixes CVE-2026-64086 bsc#1273469). - Update patches.suse/hwmon-pmbus-adm1266-reject-implausible-blackbox-reco.patch (git-fixes CVE-2026-64087 bsc#1273274). - Update patches.suse/hwmon-pmbus-adm1266-reject-short-block-read-response.patch (git-fixes CVE-2026-64083 bsc#1273479). - Update patches.suse/hwmon-pmbus-adm1266-widen-blackbox-info-buffer-to-I2.patch (git-fixes CVE-2026-64135 bsc#1273967). - Update patches.suse/iio-accel-bmc150-clamp-the-device-reported-FIFO-fram.patch (git-fixes CVE-2026-64504 bsc#1273988). - Update patches.suse/iio-accel-kxsd9-fix-runtime-PM-imbalance-on-write_ra.patch (git-fixes CVE-2026-64503 bsc#1273596). - Update patches.suse/iio-adc-lpc32xx-Initialize-completion-before-request.patch (git-fixes CVE-2026-64500 bsc#1273533). - Update patches.suse/iio-adc-spear-Initialize-completion-before-requestin.patch (git-fixes CVE-2026-64602 bsc#1274294). - Update patches.suse/iio-chemical-scd30-Cleanup-initializations-and-fix-s.patch (git-fixes CVE-2026-64497 bsc#1273536). - Update patches.suse/iio-event-Fix-event-FIFO-reset-race.patch (git-fixes CVE-2026-64496 bsc#1273600). - Update patches.suse/iio-gyro-bmg160-bail-out-when-bandwidth-filter-is-no.patch (git-fixes CVE-2026-64495 bsc#1273972). - Update patches.suse/iio-light-gp2ap002-fix-runtime-PM-leak-on-read-error.patch (git-fixes CVE-2026-64494 bsc#1273602). - Update patches.suse/intel_th-fix-MSC-output-device-reference-leak.patch (git-fixes CVE-2026-68180 bsc#1274968). - Update patches.suse/mac802154-hold-an-interface-reference-across-the-sca.patch (git-fixes CVE-2026-68126 bsc#1275236). - Update patches.suse/mac802154-llsec-reject-frames-shorter-than-the-authe.patch (git-fixes CVE-2026-68125 bsc#1275239). - Update patches.suse/media-airspy-Return-queued-buffers-on-start_streamin.patch (git-fixes CVE-2026-68231 bsc#1275636). - Update patches.suse/media-cedrus-skip-invalid-H.264-reference-list-entri.patch (git-fixes CVE-2026-68229 bsc#1275633). - Update patches.suse/media-cx231xx-fix-devres-lifetime.patch (git-fixes CVE-2026-68227 bsc#1275595). - Update patches.suse/media-cx23885-add-ioremap-return-check-and-cleanup.patch (git-fixes CVE-2026-68226 bsc#1275591). - Update patches.suse/media-meson-vdec-Fix-memory-leak-in-error-path-of-vd.patch (git-fixes CVE-2026-68223 bsc#1275511). - Update patches.suse/media-msi2500-Return-queued-buffers-on-start_streami.patch (git-fixes CVE-2026-68222 bsc#1275509). - Update patches.suse/media-mtk-jpeg-cancel-workqueue-on-release-for-suppo.patch (git-fixes CVE-2026-64358 bsc#1273601). - Update patches.suse/media-nxp-imx8-isi-Add-missing-v4l2_subdev_cleanup-i.patch (git-fixes CVE-2026-68220 bsc#1275487). - Update patches.suse/media-nxp-imx8-isi-Fix-potential-out-of-bounds-issue.patch (git-fixes CVE-2026-68219 bsc#1275486). - Update patches.suse/media-nxp-imx8-isi-Fix-use-after-free-on-remove.patch (git-fixes CVE-2026-64421 bsc#1273582). - Update patches.suse/media-pci-dm1105-Free-allocated-workqueue.patch (git-fixes CVE-2026-68218 bsc#1275483). - Update patches.suse/media-pwc-Drain-fill_buf-on-start_streaming-failure.patch (git-fixes CVE-2026-68217 bsc#1274886). - Update patches.suse/media-pwc-Return-queued-buffers-on-start_streaming-f.patch (git-fixes CVE-2026-68216 bsc#1274883). - Update patches.suse/media-radio-si476x-Unregister-v4l2_device-on-probe-f.patch (git-fixes CVE-2026-68215 bsc#1274893). - Update patches.suse/media-rtl2832-fix-use-after-free-in-rtl2832_remove.patch (git-fixes CVE-2026-68214 bsc#1274894). - Update patches.suse/media-rtl2832_sdr-Return-queued-buffers-on-start_str.patch (git-fixes CVE-2026-68213 bsc#1274891). - Update patches.suse/media-saa7134-Fix-a-possible-memory-leak-in-saa7134_.patch (git-fixes CVE-2026-68212 bsc#1274924). - Update patches.suse/media-stm32-dcmi-unregister-notifier-on-probe-failur.patch (git-fixes CVE-2026-68210 bsc#1274921). - Update patches.suse/media-sun4i-csi-Return-queued-buffers-on-start_strea.patch (git-fixes CVE-2026-68209 bsc#1274929). - Update patches.suse/media-ti-vpe-unwind-v4l2-device-registration-on-prob.patch (git-fixes CVE-2026-68207 bsc#1274925). - Update patches.suse/media-v4l2-ctrls-validate-HEVC-active-reference-coun.patch (git-fixes CVE-2026-68206 bsc#1274935). - Update patches.suse/media-vivid-check-for-vb2_is_busy-when-toggling-caps.patch (git-fixes CVE-2026-68204 bsc#1274933). - Update patches.suse/mei-bus-access-mei_device-under-device_lock-on-clean.patch (git-fixes CVE-2026-68181 bsc#1274951). - Update patches.suse/mfd-cros_ec-Delay-dev_set_drvdata-until-probe-succes.patch (git-fixes CVE-2026-64420 bsc#1273260). - Update patches.suse/net-usb-kalmia-bound-RX-frame-length-in-kalmia_rx_fi.patch (git-fixes CVE-2026-64351 bsc#1274057). - Update patches.suse/net-usb-net1080-validate-packet_len-before-pad-byte-.patch (git-fixes CVE-2026-64547 bsc#1273319). - Update patches.suse/net-x25-fix-use-after-free-in-x25_kill_by_neigh.patch (git-fixes CVE-2026-68137 bsc#1275479). - Update patches.suse/power-reset-linkstation-poweroff-fix-use-after-free-.patch (git-fixes CVE-2026-64246 bsc#1273945). - Update patches.suse/sctp-avoid-auth_enable-sysctl-UAF-during-netns-teard.patch (git-fixes CVE-2026-68162 bsc#1274920). - Update patches.suse/serial-8250_mid-Fix-NULL-function-pointer-dereferenc.patch (git-fixes CVE-2026-68434 bsc#1274787). - Update patches.suse/smb-client-reject-overlapping-data-areas-in-SMB2-responses.patch (git-fixes CVE-2026-64257 bsc#1273250). - Update patches.suse/smb-client-require-net-admin-for-CIFS-SWN-netlink.patch (bsc#1273966 CVE-2026-64137). - Update patches.suse/smb-client-resolve-SWN-tcon-from-live-registrations.patch (bsc#1273872 CVE-2026-64401). - Update patches.suse/spi-fsl-lpspi-terminate-the-RX-channel-on-TX-prepare.patch (git-fixes CVE-2026-64303 bsc#1273284). - Update patches.suse/spi-sprd-fix-error-pointer-deref-after-DMA-setup-fai.patch (git-fixes CVE-2026-64168 bsc#1273504). - Update patches.suse/staging-rtl8723bs-fix-OOB-read-in-OnAssocRsp-IE-loop.patch (git-fixes CVE-2026-64444 bsc#1274265). - Update patches.suse/staging-rtl8723bs-fix-OOB-read-in-update_beacon_info.patch (git-fixes CVE-2026-64443 bsc#1273249). - Update patches.suse/staging-rtl8723bs-fix-OOB-reads-in-IE-loops-in-issue.patch (git-fixes CVE-2026-64442 bsc#1273849). - Update patches.suse/staging-rtl8723bs-fix-OOB-reads-in-is_ap_in_tkip-IE-.patch (git-fixes CVE-2026-64536 bsc#1273346). - Update patches.suse/staging-rtl8723bs-fix-OOB-write-in-HT_caps_handler.patch (git-fixes CVE-2026-64440 bsc#1274258). - Update patches.suse/staging-rtl8723bs-fix-WEP-length-underflow-and-OOB-r.patch (git-fixes CVE-2026-64445 bsc#1274290). - Update patches.suse/usb-cdnsp-fix-stream-context-array-leak-in-cdnsp_all.patch (git-fixes CVE-2026-64350 bsc#1273867). - Update patches.suse/usb-core-port-Deattach-Type-C-connector-on-component.patch (git-fixes CVE-2026-68372 bsc#1275155). - Update patches.suse/usb-dwc3-run-gadget-disconnect-from-sleepable-suspen.patch (git-fixes CVE-2026-64454 bsc#1273503). - Update patches.suse/usb-free-iso-schedules-on-failed-submit.patch (git-fixes CVE-2026-64348 bsc#1274026). - Update patches.suse/usb-gadget-dummy_hcd-prevent-fifo_req-reuse-during-g.patch (git-fixes CVE-2026-68370 bsc#1276263). - Update patches.suse/usb-gadget-f_midi-cancel-pending-IN-work-before-free.patch (git-fixes CVE-2026-64584 bsc#1274296). - Update patches.suse/usb-gadget-f_ncm-validate-datagram-bounds-in-ncm_unw.patch (git-fixes CVE-2026-68368 bsc#1275158). - Update patches.suse/usb-gadget-function-rndis-add-length-check-for-heade.patch (stable-fixes CVE-2026-64505 bsc#1273443). - Update patches.suse/usb-gadget-function-rndis-add-length-check-to-respon.patch (stable-fixes CVE-2026-68088 bsc#1274716). - Update patches.suse/usb-gadget-printer-fix-infinite-loop-in-printer_read.patch (git-fixes CVE-2026-68369 bsc#1275163). - Update patches.suse/usb-gadget-udc-Fix-use-after-free-in-gadget_match_dr.patch (stable-fixes CVE-2026-64346 bsc#1273896). - Update patches.suse/usb-gadget-udc-bdc-free-IRQ-and-drain-func_wake_noti.patch (git-fixes CVE-2026-64583 bsc#1274578). - Update patches.suse/usb-gadget-uvc-clamp-SEND_RESPONSE-length-to-the-res.patch (git-fixes CVE-2026-68366 bsc#1275173). - Update patches.suse/usb-mtu3-unmap-request-DMA-on-queue-failure.patch (git-fixes CVE-2026-64337 bsc#1273738). - Update patches.suse/usb-typec-ucsi-ccg-Fix-use-after-free-of-ucsi-on-rem.patch (git-fixes CVE-2026-64329 bsc#1273934). - Update patches.suse/usbip-vudc-fix-NULL-deref-in-vep_dequeue.patch (git-fixes CVE-2026-64331 bsc#1273824). - Update patches.suse/usbnet-gl620a-fix-out-of-bounds-read-in-genelink_rx_.patch (git-fixes CVE-2026-64540 bsc#1273302). - Update patches.suse/wan-wanxl-Only-reset-hardware-after-BAR-mapping.patch (git-fixes CVE-2026-68327 bsc#1276029). - Update patches.suse/watchdog-pretimeout-Fix-UAF-in-watchdog_unregister_g.patch (git-fixes CVE-2026-68357 bsc#1274737). - Update patches.suse/wifi-at76c50x-usb-avoid-length-underflow-in-at76_gue.patch (git-fixes CVE-2026-68373 bsc#1275157). - Update patches.suse/wifi-ath11k-fix-NULL-pointer-dereference-in-ath11k_h.patch (git-fixes CVE-2026-68362 bsc#1275190). - Update patches.suse/wifi-ath11k-fix-error-path-leaks-in-some-WMI-WOW-cal.patch (git-fixes CVE-2026-64155 bsc#1273682). - Update patches.suse/wifi-ath11k-fix-potential-buffer-underflow-in-ath11k.patch (git-fixes CVE-2026-68355 bsc#1274675). - Update patches.suse/wifi-ath6kl-fix-OOB-access-from-firmware-ADDBA-windo.patch (git-fixes CVE-2026-68199 bsc#1274947). - Update patches.suse/wifi-ath6kl-fix-OOB-read-from-firmware-IE-lengths-in.patch (git-fixes CVE-2026-68352 bsc#1274679). - Update patches.suse/wifi-ath6kl-fix-OOB-read-from-firmware-num_msg-in-TX.patch (git-fixes CVE-2026-68353 bsc#1274677). - Update patches.suse/wifi-ath9k-hif_usb-don-t-dereference-hif_dev-after-r.patch (git-fixes CVE-2026-68363 bsc#1275164). - Update patches.suse/wifi-brcmfmac-fix-802.1X-SHA256-call-trace-warning.patch (git-fixes CVE-2026-68304 bsc#1275076). - Update patches.suse/wifi-brcmfmac-initialize-SDIO-data-work-before-clean.patch (git-fixes CVE-2026-68403 bsc#1274901). - Update patches.suse/wifi-brcmfmac-make-release_scratchbuffers-idempotent.patch (git-fixes CVE-2026-68192 bsc#1274813). - Update patches.suse/wifi-carl9170-bound-memcpy-length-in-cmd-callback-to.patch (git-fixes CVE-2026-68351 bsc#1274678). - Update patches.suse/wifi-carl9170-fix-OOB-read-from-off-by-two-in-TX-sta.patch (git-fixes CVE-2026-68350 bsc#1274682). - Update patches.suse/wifi-carl9170-fix-buffer-overflow-in-rx_stream-failo.patch (git-fixes CVE-2026-68349 bsc#1274681). - Update patches.suse/wifi-cfg80211-bound-element-ID-read-when-checking-no.patch (git-fixes CVE-2026-68402 bsc#1274914). - Update patches.suse/wifi-cfg80211-cancel-sched-scan-results-work-on-unre.patch (git-fixes CVE-2026-68414 bsc#1274703). - Update patches.suse/wifi-cfg80211-validate-PMSR-FTM-preamble-range.patch (git-fixes CVE-2026-68406 bsc#1274913). - Update patches.suse/wifi-ipw2100-fix-potential-memory-leak-in-ipw2100_pc.patch (git-fixes CVE-2026-68413 bsc#1274694). - Update patches.suse/wifi-libertas-fix-memory-leak-in-helper_firmware_cb.patch (git-fixes CVE-2026-68410 bsc#1274710). - Update patches.suse/wifi-mac80211-free-AP_VLAN-bc_buf-SKBs-outside-IRQ-l.patch (git-fixes CVE-2026-68405 bsc#1274896). - Update patches.suse/wifi-mac80211-tear-down-new-links-on-vif-update-erro.patch (git-fixes CVE-2026-64574 bsc#1274020). - Update patches.suse/wifi-mt76-connac-fix-possible-NULL-pointer-deref-in-.patch (git-fixes CVE-2026-68309 bsc#1275073). - Update patches.suse/wifi-mt76-mt7615-drop-TXRX_NOTIFY-on-non-mmio-buses.patch (git-fixes CVE-2026-68195 bsc#1274808). - Update patches.suse/wifi-mt76-mt7915-guard-HE-capability-lookups.patch (git-fixes CVE-2026-68310 bsc#1274667). - Update patches.suse/wifi-mt76-mt7921-drop-TXRX_NOTIFY-on-non-mmio-buses.patch (git-fixes CVE-2026-68194 bsc#1274807). - Update patches.suse/wifi-mt76-mt7925-drop-TXRX_NOTIFY-on-non-mmio-buses.patch (git-fixes CVE-2026-68193 bsc#1274811). - Update patches.suse/wifi-mt76-mt7996-check-pointer-returned-by-mt76_conn.patch (git-fixes CVE-2026-68308 bsc#1275071). - Update patches.suse/wifi-mt76-mt7996-fix-possible-NULL-pointer-deref-in-.patch (git-fixes CVE-2026-68306 bsc#1275069). - Update patches.suse/wifi-mwifiex-bound-uAP-association-event-IEs-to-the-.patch (git-fixes CVE-2026-68326 bsc#1274650). - Update patches.suse/wifi-mwifiex-fix-NULL-dereference-when-the-AP-has-HT.patch (git-fixes CVE-2026-68197 bsc#1274804). - Update patches.suse/wifi-nl80211-free-RNR-data-on-MBSSID-mismatch.patch (git-fixes CVE-2026-68407 bsc#1274905). - Update patches.suse/wifi-p54-validate-RX-frame-length-in-p54_rx_eeprom_r.patch (git-fixes CVE-2026-64571 bsc#1274012). - Update patches.suse/wifi-wilc1000-validate-assoc-response-length-before-.patch (git-fixes CVE-2026-68196 bsc#1274805). - commit 0152c90 - powerpc, perf: Check that current->mm is alive before getting user callchain (CVE-2026-43416 bsc#1265121). - commit 30d07db - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CVE-2026-68159 bsc#1275470). - commit b274ee3 - libceph: Fix multiplication overflow in decode_new_up_state_weight() (CVE-2026-68158 bsc#1275307). - commit 3944e1b - libceph: Reject monmaps advertising zero monitors (CVE-2026-68155 bsc#1275304). - commit 8f405ff - netfs: Fix overrun check in netfs_extract_user_iter() (CVE-2026-64217 bsc#1272798). - commit 0184f90 - proc: protect ptrace_may_access() with exec_update_lock (FD links) (CVE-2026-64375 bsc#1273868). - Refresh patches.suse/procfs-add-tunable-for-fd-fdinfo-dentry-retention.patch. - commit e73212f - udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705 bsc#1276922). - commit f71b300 - RDMA/nldev: Fix locking when accessing mr->pd (CVE-2026-74334 bsc#1277095) - commit bca8056 - media: rc: igorplugusb: fix control request setup packet (CVE-2026-46091 bsc#1267238). - commit a080e85 - bpf: Prefer dirty packs for eBPF allocations (bsc#1273999 CVE-2026-64507). - commit 0b19182 - bpf: Prefer packs that won't trigger an IBPB flush on allocation (bsc#1273999 CVE-2026-64507). - commit c9a5eb9 - bpf: Skip redundant IBPB in pack allocator (bsc#1273999 CVE-2026-64507). - commit f2d936c - bpf: Restrict JIT predictor flush to cBPF (bsc#1273999 CVE-2026-64507). - commit 727de37 - mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586 bsc#1277328). - commit a7942a9 - x86/bugs: Enable IBPB flush on BPF JIT allocation (bsc#1273999 CVE-2026-64507). - commit 9d43fdd - bpf: Support for hardening against JIT spraying (bsc#1273999 CVE-2026-64507). - commit c529a15 - xprtrdma: Resize reply buffers before reposting receives (CVE-2026-72464 bsc#1277069). - commit 82e5914 - xprtrdma: Sanitize the reply credit grant after parsing (CVE-2026-72464 bsc#1277069). - commit c8fdcd5 - xprtrdma: Repost Receive buffers for malformed replies (CVE-2026-72464 bsc#1277069). - commit e0fa638 - xprtrdma: Post receive buffers after RPC completion (CVE-2026-72464 bsc#1277069). - commit 618a504 - xprtrdma: Remove temp allocation of rpcrdma_rep objects (CVE-2026-72464 bsc#1277069). - Refresh patches.suse/xprtrdma-Decrement-re_receiving-on-the-early-exit-paths.patch. - commit e7b43d2 - gve: fix Rx queue stall on alloc failure (CVE-2026-68129 bsc#1275517). - bnxt: fix head underflow on XDP head-grow (CVE-2026-74269 bsc#1276507). - commit eebdc00 - xprtrdma: Fix bcall rep leak and unbounded peek (CVE-2026-72466 bsc#1277057). - commit 476fc8d - xprtrdma: Check frwr_wp_create() during connect (CVE-2026-72467 bsc#1277059). - commit 6e39351 - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CVE-2026-72069 bsc#1275528). - commit b0dfdea - netfilter: nf_nat_sip: reload possible stale data pointer (CVE-2026-72251 bsc#1275827). - commit 4fa58ba - netfilter: nf_tables: fix dst corruption in same register operation (CVE-2026-64006 bsc#1273834). - Refresh patches.suse/netfilter-nf_tables-fix-64-bit-load-issue-in-nft_byt.patch. - commit 1c844e0 - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CVE-2026-53163 bsc#1269306). - commit 783829d - RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference (CVE-2026-74395 bsc#1277077) - commit db63a2b - media: rc: igorplugusb: heed coherency rules (CVE-2026-46091 bsc#1267238). - commit 26da9df - xfs: fix ilock leak on error in xfs_dq_get_next_id (CVE-2026-80534 bsc#1277022). - commit e6f4b4d - tpm: st33zp24: Validate locality read result (git-fixes). - tpm: st33zp24: Return zero on status read failure (git-fixes). - tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout (git-fixes). - commit 445c757 - i2c: mux: Fix channel node leak on adapter add failure (git-fixes). - drm/amdgpu: Fix VCE 3 ring align_mask (git-fixes). - drm/msm/dsi: Drop dev_pm_opp_set_rate(0) (git-fixes). - drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0) (git-fixes). - drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value (git-fixes). - drm/amd/display: avoid divide-by-zero in __is_lut_linear() (git-fixes). - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (git-fixes). - drm/amdgpu: fix autosuspend cleanup during removal (git-fixes). - ipmi: si: Fix NULL pointer dereference after failed registration (git-fixes). - ipmi: ipmb: validate write message length (git-fixes). - ASoC: dapm: Fix off-by-one check on the second enum channel (git-fixes). - ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC (git-fixes). - ASoC: fix unmet dependencies on PPC_BESTCOMM and SND_SOC_AC97_BUS (git-fixes). - ASoC: tegra: Sort MBDRC register defaults (git-fixes). - ASoC: tegra: Fix the MIXER enable default value (git-fixes). - ALSA: usb-audio: Complete cleanup after system-resume errors (git-fixes). - ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (git-fixes). - ALSA: pcxhr: initialize mutexes before requesting threaded IRQ (git-fixes). - rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers (git-fixes). - rtc: rzn1: Fix weekday underflow when alarm crosses month boundary (git-fixes). - rtc: pcf85363: Add error checking to regmap calls in probe() (git-fixes). - rtc: gamecube: check return value of devm_rtc_register_device() (git-fixes). - rtc: zynqmp: Return optional clock lookup errors (git-fixes). - rtc: pcf8563: fix clock provider leak on unbind (git-fixes). - commit 59e5f97 - bpf: Free reuseport cBPF prog after RCU grace period (CVE-2026-52910 bsc#1268659). - commit 84562a7 - bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks (CVE-2026-63865 bsc#1272486). - commit 7737058 ++++ kernel-rt: - Update patches.suse/KVM-x86-Fix-VM-hard-lockup-after-prolonged-inactivit.patch (git-fixes CVE-2025-71104 bsc#1256708). - Update patches.suse/KVM-x86-hyper-v-Bound-the-bank-index-when-querying-s.patch (git-fixes CVE-2026-64247 bsc#1273903). - Update patches.suse/KVM-x86-mmu-Fix-use-after-free-on-vendor-module-relo.patch (git-fixes CVE-2026-68428 bsc#1274699). - Update patches.suse/KVM-x86-xen-Fix-cleanup-logic-in-emulation-of-Xen-sc.patch (git-fixes CVE-2025-38469 bsc#1247455). - Update patches.suse/crypto-af_alg-Fix-incorrect-boolean-values-in-af_alg.patch (bsc#1251966 CVE-2025-39964 CVE-2025-40022 bsc#1252682). - Update patches.suse/fuse-re-lock-request-before-returning-from-fuse_ref_.patch (CVE-2026-53388 bsc#1271825 CVE-2026-64266 bsc#1273555). - Update patches.suse/ice-Fix-PTP-NULL-pointer-dereference-during-VSI-rebu.patch (bsc#1269981 CVE-2026-23210 bsc#1258517). - Update patches.suse/ice-fix-PTP-Call-Trace-during-PTP-release.patch (bsc#1269981 CVE-2026-68133 bsc#1275555). - Update patches.suse/ipv4-account-for-fraggap-on-the-paged-allocation-path.patch (git-fixes CVE-2026-53366 bsc#1271366). - Update patches.suse/msft-hv-3523-net-mana-fix-use-after-free-in-mana_hwc_destroy_chan.patch (git-fixes CVE-2026-23454 bsc#1261780). - Update patches.suse/msft-hv-3581-net-mana-Fix-TOCTOU-double-fetch-of-hwc_msg_id-from-.patch (bsc#1265928 CVE-2026-64034 bsc#1273054). - Update patches.suse/msft-hv-3583-net-mana-validate-rx_req_idx-to-prevent-out-of-bound.patch (bsc#1266402 CVE-2026-64018 bsc#1273053). - Update patches.suse/msft-hv-3585-drm-hyperv-validate-resolution_count-and-fix-WIN8-fa.patch (git-fixes CVE-2026-64524 bsc#1273578). - Update patches.suse/msft-hv-3586-drm-hyperv-validate-VMBus-packet-size-in-receive-cal.patch (git-fixes CVE-2026-64527 bsc#1274226). - Update patches.suse/msft-hv-3587-net-mana-Add-NULL-guards-in-teardown-path-to-prevent.patch (git-fixes CVE-2026-63973 bsc#1272682). - Update patches.suse/msft-hv-3588-net-mana-Skip-redundant-detach-on-already-detached-p.patch (git-fixes CVE-2026-63972 bsc#1272680). - Update patches.suse/s390-Disable-ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP.patch (bsc#1254306 CVE-2025-68179 bsc#1255250). - Update patches.suse/scsi-target-iscsi-validate-CHAP_R-length-before-base.patch (bsc#1265449 CVE-2026-63886 bsc#1272381). - Update patches.suse/smb-client-split-cached_fid-bitfields-to-avoid-shared-byte-RMW-rac.patch (bsc#1250748 bsc#1257154 CVE-2026-23230 bsc#1258430). - Update patches.suse/workqueue-Fix-UBSAN-subtraction-overflow-error-in-shift_an.patch (bsc#1260522 CVE-2024-44981 bsc#1230238). - commit 059f170 - Update patches.suse/ACPI-CPPC-Suppress-UBSAN-warning-caused-by-field-mis.patch (git-fixes CVE-2026-64512 bsc#1273597). - Update patches.suse/ACPI-NFIT-core-Fix-possible-NULL-pointer-dereference.patch (git-fixes CVE-2026-64511 bsc#1273796). - Update patches.suse/ALSA-asihpi-Fix-potential-OOB-array-access-at-readin.patch (stable-fixes CVE-2026-64133 bsc#1274065). - Update patches.suse/ALSA-caiaq-fix-out-of-bounds-read-in-the-Traktor-Kon.patch (git-fixes CVE-2026-64487 bsc#1273506). - Update patches.suse/ALSA-cmipci-check-snd_ctl_new1-return-value.patch (git-fixes CVE-2026-64486 bsc#1274243). - Update patches.suse/ALSA-es1938-check-snd_ctl_new1-return-value.patch (git-fixes CVE-2026-64484 bsc#1274573). - Update patches.suse/ALSA-firewire-isight-bound-the-sample-count-to-the-p.patch (git-fixes CVE-2026-64483 bsc#1273991). - Update patches.suse/ALSA-gus-check-snd_ctl_new1-return-value.patch (git-fixes CVE-2026-64482 bsc#1273790). - Update patches.suse/ALSA-hda-cs35l41-validate-and-free-ACPI-mute-object.patch (git-fixes CVE-2026-68346 bsc#1274622). - Update patches.suse/ALSA-ice1712-check-snd_ctl_new1-return-value.patch (git-fixes CVE-2026-64480 bsc#1274239). - Update patches.suse/ALSA-seq-Fix-uninitialised-heap-leak-in-snd_seq_even.patch (git-fixes CVE-2026-64479 bsc#1273890). - Update patches.suse/ALSA-usb-audio-avoid-kobject-path-lookup-in-DualSens.patch (git-fixes CVE-2026-64478 bsc#1274321). - Update patches.suse/ALSA-ymfpci-check-snd_ctl_new1-return-value.patch (git-fixes CVE-2026-64489 bsc#1274281). - Update patches.suse/ASoC-codecs-simple-mux-Fix-enum-control-bounds-check.patch (git-fixes CVE-2026-64243 bsc#1273838). - Update patches.suse/ASoC-tas2781-bound-firmware-description-string-parsi.patch (git-fixes CVE-2026-68348 bsc#1274624). - Update patches.suse/Bluetooth-ISO-drop-ISO_END-frames-received-without-p.patch (git-fixes CVE-2026-64128 bsc#1274067). - Update patches.suse/Bluetooth-L2CAP-validate-option-length-before-readin.patch (git-fixes CVE-2026-64403 bsc#1274076). - Update patches.suse/Bluetooth-MGMT-Fix-UAF-of-hci_conn_params-in-add_dev.patch (git-fixes CVE-2026-64433 bsc#1274283). - Update patches.suse/Bluetooth-MGMT-validate-Add-Extended-Advertising-Dat.patch (git-fixes CVE-2026-64126 bsc#1273765). - Update patches.suse/Bluetooth-RFCOMM-Fix-session-UAF-in-set_termios.patch (git-fixes CVE-2026-68188 bsc#1274953). - Update patches.suse/Bluetooth-bnep-Fix-UAF-read-of-dev-name.patch (git-fixes CVE-2026-64178 bsc#1273946). - Update patches.suse/Bluetooth-bnep-pin-L2CAP-connection-during-netdev-re.patch (git-fixes CVE-2026-64408 bsc#1273778). - Update patches.suse/Bluetooth-bpa10x-avoid-OOB-read-of-revision-string-i.patch (git-fixes CVE-2026-64549 bsc#1273341). - Update patches.suse/Bluetooth-btmtksdio-fix-infinite-loop-in-btmtksdio_t.patch (git-fixes CVE-2026-64409 bsc#1273862). - Update patches.suse/Bluetooth-btusb-fix-use-after-free-on-marvell-probe-.patch (git-fixes CVE-2026-64470 bsc#1273892). - Update patches.suse/Bluetooth-btusb-fix-use-after-free-on-registration-f.patch (git-fixes CVE-2026-64471 bsc#1274278). - Update patches.suse/Bluetooth-btusb-validate-Realtek-vendor-event-length.patch (git-fixes CVE-2026-68339 bsc#1274636). - Update patches.suse/Bluetooth-eir-Fix-stack-OOB-write-when-prepending-th.patch (git-fixes CVE-2026-64539 bsc#1273338). - Update patches.suse/Bluetooth-fix-UAF-in-bt_accept_dequeue.patch (git-fixes CVE-2026-64406 bsc#1273579). - Update patches.suse/Bluetooth-hci_sync-Protect-UUID-list-traversal.patch (git-fixes CVE-2026-68189 bsc#1274945). - Update patches.suse/Bluetooth-hci_uart-clear-HCI_UART_SENDING-when-write.patch (git-fixes CVE-2026-68085 bsc#1274702). - Update patches.suse/Bluetooth-mgmt-fix-locking-in-unpair_device-disconne.patch (git-fixes CVE-2026-68392 bsc#1274907). - Update patches.suse/Bluetooth-mgmt-hold-reference-for-hci_conn-in-mgmt_p.patch (git-fixes CVE-2026-68391 bsc#1274899). - Update patches.suse/Bluetooth-qca-fix-NVM-tag-length-underflow-in-TLV-pa.patch (git-fixes CVE-2026-64573 bsc#1274017). - Update patches.suse/HID-letsketch-fix-UAF-on-inrange_timer-at-driver-unb.patch (git-fixes CVE-2026-64365 bsc#1273310). - Update patches.suse/HID-lg-g15-cancel-pending-work-on-remove-to-fix-a-us.patch (git-fixes CVE-2026-64362 bsc#1274078). - Update patches.suse/HID-logitech-dj-Fix-maxfield-check-in-DJ-short-repor.patch (git-fixes CVE-2026-64427 bsc#1273281). - Update patches.suse/HID-wacom-stop-hardware-after-post-start-probe-failu.patch (git-fixes CVE-2026-68091 bsc#1274721). - Update patches.suse/Input-elan_i2c-prevent-division-by-zero-and-arithmet.patch (git-fixes CVE-2026-64275 bsc#1273876). - Update patches.suse/Input-elan_i2c-validate-firmware-size-before-use.patch (stable-fixes CVE-2026-64237 bsc#1273739). - Update patches.suse/Input-goodix-clamp-the-device-reported-contact-count.patch (git-fixes CVE-2026-64274 bsc#1273542). - Update patches.suse/Input-iforce-bound-the-device-reported-force-feedbac.patch (git-fixes CVE-2026-64273 bsc#1273941). - Update patches.suse/Input-ims-pcu-fix-heap-buffer-overflow-in-ims_pcu_pr.patch (git-fixes CVE-2026-64565 bsc#1274001). - Update patches.suse/Input-synaptics-rmi4-bound-the-F30-keymap-to-the-GPI.patch (git-fixes CVE-2026-64276 bsc#1273877). - Update patches.suse/Input-synaptics-rmi4-bound-the-F3A-keymap-to-the-GPI.patch (git-fixes CVE-2026-64277 bsc#1274035). - Update patches.suse/Input-touchwin-reset-the-packet-index-on-every-compl.patch (git-fixes CVE-2026-64271 bsc#1273935). - Update patches.suse/Input-usbtouchscreen-clamp-NEXIO-data_len-x_len-to-U.patch (git-fixes CVE-2026-64014 bsc#1273769). - Update patches.suse/KVM-SVM-Bump-asid_generation-on-CPU-online-to-avoid-.patch (git-fixes CVE-2026-68093 bsc#1274725). - Update patches.suse/KVM-VMX-Grab-vmcs12-on-CR8-interception-update-iff-v.patch (git-fixes CVE-2026-64604 bsc#1274286). - Update patches.suse/KVM-x86-Unconditionally-recompute-CR8-intercept-on-P.patch (git-fixes CVE-2026-64513 bsc#1273327). - Update patches.suse/USB-chaoskey-Fix-slab-use-after-free-in-chaoskey_rel.patch (git-fixes CVE-2026-64455 bsc#1273844). - Update patches.suse/USB-idmouse-fix-use-after-free-on-disconnect-race.patch (git-fixes CVE-2026-64344 bsc#1274019). - Update patches.suse/USB-iowarrior-fix-use-after-free-on-disconnect-race.patch (git-fixes CVE-2026-64341 bsc#1273895). - Update patches.suse/USB-iowarrior-fix-use-after-free-on-disconnect.patch (git-fixes CVE-2026-64342 bsc#1274011). - Update patches.suse/USB-ldusb-fix-use-after-free-on-disconnect-race.patch (git-fixes CVE-2026-64343 bsc#1273974). - Update patches.suse/USB-legousbtower-fix-use-after-free-on-disconnect-ra.patch (git-fixes CVE-2026-64340 bsc#1274003). - Update patches.suse/USB-misc-uss720-unregister-parport-on-probe-failure.patch (git-fixes CVE-2026-64338 bsc#1273990). - Update patches.suse/USB-serial-digi_acceleport-fix-broken-rx-after-throt.patch (git-fixes CVE-2026-64335 bsc#1273977). - Update patches.suse/USB-serial-digi_acceleport-fix-hard-lockup-on-discon.patch (git-fixes CVE-2026-64334 bsc#1273942). - Update patches.suse/USB-serial-digi_acceleport-fix-write-buffer-corrupti.patch (git-fixes CVE-2026-64333 bsc#1273933). - Update patches.suse/USB-serial-io_edgeport-cap-received-transmit-credits.patch (git-fixes CVE-2026-68365 bsc#1276257). - Update patches.suse/USB-serial-mct_u232-fix-memory-corruption-with-small.patch (CVE-2026-63928 bsc#1272891 CVE-2026-63898 bsc#1272643). - Update patches.suse/USB-ulpi-fix-memory-leak-on-registration-failure.patch (git-fixes CVE-2026-64332 bsc#1273285). - Update patches.suse/accel-qaic-Add-overflow-check-to-remap_pfn_range-dur.patch (git-fixes CVE-2026-64051 bsc#1273482). - Update patches.suse/batman-adv-bla-fix-report_work-leak-on-backbone_gw-p.patch (git-fixes CVE-2026-64218 bsc#1273832). - Update patches.suse/batman-adv-tt-fix-negative-tt_buff_len.patch (git-fixes CVE-2026-64088 bsc#1273463). - Update patches.suse/can-esd_usb-kill-anchored-URBs-before-freeing-netdev.patch (git-fixes CVE-2026-64585 bsc#1274491). - Update patches.suse/cdrom-fix-stack-out-of-bounds-read-in-CDROMVOLCTRL.patch (git-fixes CVE-2026-68184 bsc#1274981). - Update patches.suse/comedi-comedi_parport-deal-with-premature-interrupt.patch (git-fixes CVE-2026-68182 bsc#1274958). - Update patches.suse/crypto-amlogic-avoid-double-cleanup-in-meson_crypto_.patch (git-fixes CVE-2026-64599 bsc#1274314). - Update patches.suse/crypto-asymmetric_keys-fix-OOB-read-in-pefile_digest.patch (git-fixes CVE-2026-64544 bsc#1273316). - Update patches.suse/crypto-drbg-Fix-returning-success-on-failure-in-CTR_.patch (git-fixes CVE-2026-64306 bsc#1273939). - Update patches.suse/crypto-ecc-Fix-carry-overflow-in-vli-multiplication.patch (git-fixes CVE-2026-64313 bsc#1273940). - Update patches.suse/crypto-qat-protect-service-table-iterations-with-ser.patch (git-fixes CVE-2026-64305 bsc#1273294). - Update patches.suse/drm-amd-display-Validate-GPIO-pin-LUT-table-size-bef.patch (stable-fixes CVE-2026-64097 bsc#1273480). - Update patches.suse/drm-amd-display-Validate-payload-length-and-link_ind.patch (stable-fixes CVE-2026-64219 bsc#1273811). - Update patches.suse/drm-amd-display-detect_link_and_local_sink-DP-alt-mo.patch (git-fixes CVE-2026-68256 bsc#1275152). - Update patches.suse/drm-amd-display-set-new_stream-to-NULL-after-release.patch (git-fixes CVE-2026-68236 bsc#1275659). - Update patches.suse/drm-amdgpu-fix-aperture-mapping-leak.patch (git-fixes CVE-2026-68102 bsc#1274764). - Update patches.suse/drm-amdgpu-fix-bo-pin-leaking-in-amdgpu_bo_create_re.patch (stable-fixes CVE-2026-68234 bsc#1275650). - Update patches.suse/drm-amdgpu-fix-division-by-zero-with-invalid-uvd-dim.patch (stable-fixes CVE-2026-68106 bsc#1274853). - Update patches.suse/drm-amdgpu-gfx10-replace-BUG_ON-with-WARN_ON.patch (stable-fixes CVE-2026-68115 bsc#1274879). - Update patches.suse/drm-amdgpu-gfx11-replace-BUG_ON-with-WARN_ON.patch (stable-fixes CVE-2026-68246 bsc#1275790). - Update patches.suse/drm-amdgpu-gfx8-drop-unecessary-BUG_ON.patch (stable-fixes CVE-2026-68430 bsc#1276273). - Update patches.suse/drm-amdgpu-gfx9-replace-BUG_ON-with-WARN_ON.patch (stable-fixes CVE-2026-68111 bsc#1274873). - Update patches.suse/drm-amdgpu-gfx9.4.3-replace-BUG_ON-with-WARN_ON.patch (stable-fixes CVE-2026-68112 bsc#1274874). - Update patches.suse/drm-amdgpu-invoke-pm_genpd_remove-before-freeing-gen.patch (stable-fixes CVE-2026-68104 bsc#1274847). - Update patches.suse/drm-amdgpu-sdma4.4.2-replace-BUG_ON-with-WARN_ON.patch (stable-fixes CVE-2026-68110 bsc#1274872). - Update patches.suse/drm-amdgpu-sdma5.0-replace-BUG_ON-with-WARN_ON.patch (stable-fixes CVE-2026-68249 bsc#1275819). - Update patches.suse/drm-amdgpu-sdma5.2-replace-BUG_ON-with-WARN_ON.patch (stable-fixes CVE-2026-68250 bsc#1275820). - Update patches.suse/drm-amdgpu-sdma6.0-replace-BUG_ON-with-WARN_ON.patch (stable-fixes CVE-2026-68251 bsc#1275821). - Update patches.suse/drm-amdgpu-validate-CP_GFX_SHADOW-chunk-size-in-CS-p.patch (git-fixes CVE-2026-68272 bsc#1275126). - Update patches.suse/drm-amdgpu-vce-fix-integer-overflow-in-image-size.patch (stable-fixes CVE-2026-68108 bsc#1274869). - Update patches.suse/drm-amdgpu-vcn4-avoid-rereading-IB-param-length.patch (stable-fixes CVE-2026-68107 bsc#1274868). - Update patches.suse/drm-amdkfd-Check-bounds-in-allocate_event_notificati.patch (stable-fixes CVE-2026-68259 bsc#1275869). - Update patches.suse/drm-bridge-cdns-dsi-Replace-deprecated-UNIVERSAL_DEV.patch (git-fixes CVE-2026-68280 bsc#1275872). - Update patches.suse/drm-dp-mst-fix-OOB-reads-in-remote-DPCD-I2C-sideband.patch (git-fixes CVE-2026-68279 bsc#1275871). - Update patches.suse/drm-dp-mst-fix-OOB-reads-on-2-byte-fields-in-sideban.patch (git-fixes CVE-2026-68277 bsc#1275125). - Update patches.suse/drm-dp-mst-fix-buffer-overflows-in-sideband-chunk-ac.patch (git-fixes CVE-2026-68278 bsc#1275870). - Update patches.suse/drm-dp_mst-Handle-torn-down-topology-gracefully-in-d.patch (git-fixes CVE-2026-68429 bsc#1274802). - Update patches.suse/drm-edid-fix-OOB-read-in-drm_parse_tiled_block.patch (git-fixes CVE-2026-64546 bsc#1273334). - Update patches.suse/drm-hyperv-validate-VMBus-packet-size-in-receive-cal.patch (git-fixes CVE-2026-64527 bsc#1274226). - Update patches.suse/drm-hyperv-validate-resolution_count-and-fix-WIN8-fa.patch (git-fixes CVE-2026-64524 bsc#1273578). - Update patches.suse/drm-i915-Return-NULL-on-error-in-active_instance.patch (git-fixes CVE-2026-68248 bsc#1275818). - Update patches.suse/drm-i915-gem-Add-missing-nospec-on-parallel-submit-s.patch (git-fixes CVE-2026-68269 bsc#1275131). - Update patches.suse/drm-i915-gem-Do-not-leak-siblings-on-proto-context-e.patch (git-fixes CVE-2026-68244 bsc#1275788). - Update patches.suse/drm-i915-gem-Fix-NULL-deref-in-I915_CONTEXT_PARAM_SS.patch (git-fixes CVE-2026-68243 bsc#1275787). - Update patches.suse/drm-msm-snapshot-fix-dumping-of-the-unaligned-region.patch (git-fixes CVE-2026-64039 bsc#1273755). - Update patches.suse/drm-nouveau-fix-reversed-error-cleanup-order-in-ucop.patch (git-fixes CVE-2026-68271 bsc#1275132). - Update patches.suse/drm-vc4-Prevent-shader-BO-mappings-from-becoming-wri.patch (git-fixes CVE-2026-68445 bsc#1276277). - Update patches.suse/drm-vc4-hvs-v3d-Fix-null-dereference-in-unbind.patch (git-fixes CVE-2026-68303 bsc#1275080). - Update patches.suse/drm-virtio-bound-EDID-block-reads-to-the-response-bu.patch (git-fixes CVE-2026-68255 bsc#1275154). - Update patches.suse/drm-vmwgfx-Validate-vmw_surface_metadata-array_size.patch (git-fixes CVE-2026-68446 bsc#1274770). - Update patches.suse/firewire-net-Fix-fragmented-datagram-reassembly.patch (git-fixes CVE-2026-68354 bsc#1274738). - Update patches.suse/firmware-arm_ffa-Check-for-NULL-FF-A-ID-table-while-.patch (git-fixes CVE-2026-64166 bsc#1273822). - Update patches.suse/firmware-arm_ffa-Fix-NULL-dereference-in-ffa_partiti.patch (git-fixes CVE-2026-68444 bsc#1274768). - Update patches.suse/firmware_loader-fix-device-reference-leak-in-firmwar.patch (git-fixes CVE-2026-64376 bsc#1273817). - Update patches.suse/fpga-region-fix-use-after-free-in-child_regions_with.patch (git-fixes CVE-2026-64249 bsc#1273810). - Update patches.suse/gpio-eic-sprd-use-raw_spinlock_t-in-the-irq-startup-.patch (git-fixes CVE-2026-64429 bsc#1273501). - Update patches.suse/gpu-host1x-Fix-use-after-free-in-host1x_bo_clear_cac.patch (stable-fixes CVE-2026-68427 bsc#1276270). - Update patches.suse/hwmon-corsair-cpro-Stop-device-IO-before-calling-hid.patch (git-fixes CVE-2026-68360 bsc#1275176). - Update patches.suse/hwmon-corsair-psu-Stop-device-IO-before-calling-hid_.patch (git-fixes CVE-2026-68361 bsc#1275185). - Update patches.suse/hwmon-nzxt-smart2-Stop-device-IO-before-calling-hid_.patch (git-fixes CVE-2026-68359 bsc#1274670). - Update patches.suse/hwmon-occ-validate-poll-response-sensor-blocks.patch (git-fixes CVE-2026-68340 bsc#1274632). - Update patches.suse/hwmon-pmbus-adm1266-bounce-blackbox-records-through-.patch (git-fixes CVE-2026-64085 bsc#1273468). - Update patches.suse/hwmon-pmbus-adm1266-cap-PDIO-scan-in-get_multiple-at.patch (git-fixes CVE-2026-64084 bsc#1273471). - Update patches.suse/hwmon-pmbus-adm1266-include-PEC-byte-in-pmbus_block_.patch (git-fixes CVE-2026-64086 bsc#1273469). - Update patches.suse/hwmon-pmbus-adm1266-reject-implausible-blackbox-reco.patch (git-fixes CVE-2026-64087 bsc#1273274). - Update patches.suse/hwmon-pmbus-adm1266-reject-short-block-read-response.patch (git-fixes CVE-2026-64083 bsc#1273479). - Update patches.suse/hwmon-pmbus-adm1266-widen-blackbox-info-buffer-to-I2.patch (git-fixes CVE-2026-64135 bsc#1273967). - Update patches.suse/iio-accel-bmc150-clamp-the-device-reported-FIFO-fram.patch (git-fixes CVE-2026-64504 bsc#1273988). - Update patches.suse/iio-accel-kxsd9-fix-runtime-PM-imbalance-on-write_ra.patch (git-fixes CVE-2026-64503 bsc#1273596). - Update patches.suse/iio-adc-lpc32xx-Initialize-completion-before-request.patch (git-fixes CVE-2026-64500 bsc#1273533). - Update patches.suse/iio-adc-spear-Initialize-completion-before-requestin.patch (git-fixes CVE-2026-64602 bsc#1274294). - Update patches.suse/iio-chemical-scd30-Cleanup-initializations-and-fix-s.patch (git-fixes CVE-2026-64497 bsc#1273536). - Update patches.suse/iio-event-Fix-event-FIFO-reset-race.patch (git-fixes CVE-2026-64496 bsc#1273600). - Update patches.suse/iio-gyro-bmg160-bail-out-when-bandwidth-filter-is-no.patch (git-fixes CVE-2026-64495 bsc#1273972). - Update patches.suse/iio-light-gp2ap002-fix-runtime-PM-leak-on-read-error.patch (git-fixes CVE-2026-64494 bsc#1273602). - Update patches.suse/intel_th-fix-MSC-output-device-reference-leak.patch (git-fixes CVE-2026-68180 bsc#1274968). - Update patches.suse/mac802154-hold-an-interface-reference-across-the-sca.patch (git-fixes CVE-2026-68126 bsc#1275236). - Update patches.suse/mac802154-llsec-reject-frames-shorter-than-the-authe.patch (git-fixes CVE-2026-68125 bsc#1275239). - Update patches.suse/media-airspy-Return-queued-buffers-on-start_streamin.patch (git-fixes CVE-2026-68231 bsc#1275636). - Update patches.suse/media-cedrus-skip-invalid-H.264-reference-list-entri.patch (git-fixes CVE-2026-68229 bsc#1275633). - Update patches.suse/media-cx231xx-fix-devres-lifetime.patch (git-fixes CVE-2026-68227 bsc#1275595). - Update patches.suse/media-cx23885-add-ioremap-return-check-and-cleanup.patch (git-fixes CVE-2026-68226 bsc#1275591). - Update patches.suse/media-meson-vdec-Fix-memory-leak-in-error-path-of-vd.patch (git-fixes CVE-2026-68223 bsc#1275511). - Update patches.suse/media-msi2500-Return-queued-buffers-on-start_streami.patch (git-fixes CVE-2026-68222 bsc#1275509). - Update patches.suse/media-mtk-jpeg-cancel-workqueue-on-release-for-suppo.patch (git-fixes CVE-2026-64358 bsc#1273601). - Update patches.suse/media-nxp-imx8-isi-Add-missing-v4l2_subdev_cleanup-i.patch (git-fixes CVE-2026-68220 bsc#1275487). - Update patches.suse/media-nxp-imx8-isi-Fix-potential-out-of-bounds-issue.patch (git-fixes CVE-2026-68219 bsc#1275486). - Update patches.suse/media-nxp-imx8-isi-Fix-use-after-free-on-remove.patch (git-fixes CVE-2026-64421 bsc#1273582). - Update patches.suse/media-pci-dm1105-Free-allocated-workqueue.patch (git-fixes CVE-2026-68218 bsc#1275483). - Update patches.suse/media-pwc-Drain-fill_buf-on-start_streaming-failure.patch (git-fixes CVE-2026-68217 bsc#1274886). - Update patches.suse/media-pwc-Return-queued-buffers-on-start_streaming-f.patch (git-fixes CVE-2026-68216 bsc#1274883). - Update patches.suse/media-radio-si476x-Unregister-v4l2_device-on-probe-f.patch (git-fixes CVE-2026-68215 bsc#1274893). - Update patches.suse/media-rtl2832-fix-use-after-free-in-rtl2832_remove.patch (git-fixes CVE-2026-68214 bsc#1274894). - Update patches.suse/media-rtl2832_sdr-Return-queued-buffers-on-start_str.patch (git-fixes CVE-2026-68213 bsc#1274891). - Update patches.suse/media-saa7134-Fix-a-possible-memory-leak-in-saa7134_.patch (git-fixes CVE-2026-68212 bsc#1274924). - Update patches.suse/media-stm32-dcmi-unregister-notifier-on-probe-failur.patch (git-fixes CVE-2026-68210 bsc#1274921). - Update patches.suse/media-sun4i-csi-Return-queued-buffers-on-start_strea.patch (git-fixes CVE-2026-68209 bsc#1274929). - Update patches.suse/media-ti-vpe-unwind-v4l2-device-registration-on-prob.patch (git-fixes CVE-2026-68207 bsc#1274925). - Update patches.suse/media-v4l2-ctrls-validate-HEVC-active-reference-coun.patch (git-fixes CVE-2026-68206 bsc#1274935). - Update patches.suse/media-vivid-check-for-vb2_is_busy-when-toggling-caps.patch (git-fixes CVE-2026-68204 bsc#1274933). - Update patches.suse/mei-bus-access-mei_device-under-device_lock-on-clean.patch (git-fixes CVE-2026-68181 bsc#1274951). - Update patches.suse/mfd-cros_ec-Delay-dev_set_drvdata-until-probe-succes.patch (git-fixes CVE-2026-64420 bsc#1273260). - Update patches.suse/net-usb-kalmia-bound-RX-frame-length-in-kalmia_rx_fi.patch (git-fixes CVE-2026-64351 bsc#1274057). - Update patches.suse/net-usb-net1080-validate-packet_len-before-pad-byte-.patch (git-fixes CVE-2026-64547 bsc#1273319). - Update patches.suse/net-x25-fix-use-after-free-in-x25_kill_by_neigh.patch (git-fixes CVE-2026-68137 bsc#1275479). - Update patches.suse/power-reset-linkstation-poweroff-fix-use-after-free-.patch (git-fixes CVE-2026-64246 bsc#1273945). - Update patches.suse/sctp-avoid-auth_enable-sysctl-UAF-during-netns-teard.patch (git-fixes CVE-2026-68162 bsc#1274920). - Update patches.suse/serial-8250_mid-Fix-NULL-function-pointer-dereferenc.patch (git-fixes CVE-2026-68434 bsc#1274787). - Update patches.suse/smb-client-reject-overlapping-data-areas-in-SMB2-responses.patch (git-fixes CVE-2026-64257 bsc#1273250). - Update patches.suse/smb-client-require-net-admin-for-CIFS-SWN-netlink.patch (bsc#1273966 CVE-2026-64137). - Update patches.suse/smb-client-resolve-SWN-tcon-from-live-registrations.patch (bsc#1273872 CVE-2026-64401). - Update patches.suse/spi-fsl-lpspi-terminate-the-RX-channel-on-TX-prepare.patch (git-fixes CVE-2026-64303 bsc#1273284). - Update patches.suse/spi-sprd-fix-error-pointer-deref-after-DMA-setup-fai.patch (git-fixes CVE-2026-64168 bsc#1273504). - Update patches.suse/staging-rtl8723bs-fix-OOB-read-in-OnAssocRsp-IE-loop.patch (git-fixes CVE-2026-64444 bsc#1274265). - Update patches.suse/staging-rtl8723bs-fix-OOB-read-in-update_beacon_info.patch (git-fixes CVE-2026-64443 bsc#1273249). - Update patches.suse/staging-rtl8723bs-fix-OOB-reads-in-IE-loops-in-issue.patch (git-fixes CVE-2026-64442 bsc#1273849). - Update patches.suse/staging-rtl8723bs-fix-OOB-reads-in-is_ap_in_tkip-IE-.patch (git-fixes CVE-2026-64536 bsc#1273346). - Update patches.suse/staging-rtl8723bs-fix-OOB-write-in-HT_caps_handler.patch (git-fixes CVE-2026-64440 bsc#1274258). - Update patches.suse/staging-rtl8723bs-fix-WEP-length-underflow-and-OOB-r.patch (git-fixes CVE-2026-64445 bsc#1274290). - Update patches.suse/usb-cdnsp-fix-stream-context-array-leak-in-cdnsp_all.patch (git-fixes CVE-2026-64350 bsc#1273867). - Update patches.suse/usb-core-port-Deattach-Type-C-connector-on-component.patch (git-fixes CVE-2026-68372 bsc#1275155). - Update patches.suse/usb-dwc3-run-gadget-disconnect-from-sleepable-suspen.patch (git-fixes CVE-2026-64454 bsc#1273503). - Update patches.suse/usb-free-iso-schedules-on-failed-submit.patch (git-fixes CVE-2026-64348 bsc#1274026). - Update patches.suse/usb-gadget-dummy_hcd-prevent-fifo_req-reuse-during-g.patch (git-fixes CVE-2026-68370 bsc#1276263). - Update patches.suse/usb-gadget-f_midi-cancel-pending-IN-work-before-free.patch (git-fixes CVE-2026-64584 bsc#1274296). - Update patches.suse/usb-gadget-f_ncm-validate-datagram-bounds-in-ncm_unw.patch (git-fixes CVE-2026-68368 bsc#1275158). - Update patches.suse/usb-gadget-function-rndis-add-length-check-for-heade.patch (stable-fixes CVE-2026-64505 bsc#1273443). - Update patches.suse/usb-gadget-function-rndis-add-length-check-to-respon.patch (stable-fixes CVE-2026-68088 bsc#1274716). - Update patches.suse/usb-gadget-printer-fix-infinite-loop-in-printer_read.patch (git-fixes CVE-2026-68369 bsc#1275163). - Update patches.suse/usb-gadget-udc-Fix-use-after-free-in-gadget_match_dr.patch (stable-fixes CVE-2026-64346 bsc#1273896). - Update patches.suse/usb-gadget-udc-bdc-free-IRQ-and-drain-func_wake_noti.patch (git-fixes CVE-2026-64583 bsc#1274578). - Update patches.suse/usb-gadget-uvc-clamp-SEND_RESPONSE-length-to-the-res.patch (git-fixes CVE-2026-68366 bsc#1275173). - Update patches.suse/usb-mtu3-unmap-request-DMA-on-queue-failure.patch (git-fixes CVE-2026-64337 bsc#1273738). - Update patches.suse/usb-typec-ucsi-ccg-Fix-use-after-free-of-ucsi-on-rem.patch (git-fixes CVE-2026-64329 bsc#1273934). - Update patches.suse/usbip-vudc-fix-NULL-deref-in-vep_dequeue.patch (git-fixes CVE-2026-64331 bsc#1273824). - Update patches.suse/usbnet-gl620a-fix-out-of-bounds-read-in-genelink_rx_.patch (git-fixes CVE-2026-64540 bsc#1273302). - Update patches.suse/wan-wanxl-Only-reset-hardware-after-BAR-mapping.patch (git-fixes CVE-2026-68327 bsc#1276029). - Update patches.suse/watchdog-pretimeout-Fix-UAF-in-watchdog_unregister_g.patch (git-fixes CVE-2026-68357 bsc#1274737). - Update patches.suse/wifi-at76c50x-usb-avoid-length-underflow-in-at76_gue.patch (git-fixes CVE-2026-68373 bsc#1275157). - Update patches.suse/wifi-ath11k-fix-NULL-pointer-dereference-in-ath11k_h.patch (git-fixes CVE-2026-68362 bsc#1275190). - Update patches.suse/wifi-ath11k-fix-error-path-leaks-in-some-WMI-WOW-cal.patch (git-fixes CVE-2026-64155 bsc#1273682). - Update patches.suse/wifi-ath11k-fix-potential-buffer-underflow-in-ath11k.patch (git-fixes CVE-2026-68355 bsc#1274675). - Update patches.suse/wifi-ath6kl-fix-OOB-access-from-firmware-ADDBA-windo.patch (git-fixes CVE-2026-68199 bsc#1274947). - Update patches.suse/wifi-ath6kl-fix-OOB-read-from-firmware-IE-lengths-in.patch (git-fixes CVE-2026-68352 bsc#1274679). - Update patches.suse/wifi-ath6kl-fix-OOB-read-from-firmware-num_msg-in-TX.patch (git-fixes CVE-2026-68353 bsc#1274677). - Update patches.suse/wifi-ath9k-hif_usb-don-t-dereference-hif_dev-after-r.patch (git-fixes CVE-2026-68363 bsc#1275164). - Update patches.suse/wifi-brcmfmac-fix-802.1X-SHA256-call-trace-warning.patch (git-fixes CVE-2026-68304 bsc#1275076). - Update patches.suse/wifi-brcmfmac-initialize-SDIO-data-work-before-clean.patch (git-fixes CVE-2026-68403 bsc#1274901). - Update patches.suse/wifi-brcmfmac-make-release_scratchbuffers-idempotent.patch (git-fixes CVE-2026-68192 bsc#1274813). - Update patches.suse/wifi-carl9170-bound-memcpy-length-in-cmd-callback-to.patch (git-fixes CVE-2026-68351 bsc#1274678). - Update patches.suse/wifi-carl9170-fix-OOB-read-from-off-by-two-in-TX-sta.patch (git-fixes CVE-2026-68350 bsc#1274682). - Update patches.suse/wifi-carl9170-fix-buffer-overflow-in-rx_stream-failo.patch (git-fixes CVE-2026-68349 bsc#1274681). - Update patches.suse/wifi-cfg80211-bound-element-ID-read-when-checking-no.patch (git-fixes CVE-2026-68402 bsc#1274914). - Update patches.suse/wifi-cfg80211-cancel-sched-scan-results-work-on-unre.patch (git-fixes CVE-2026-68414 bsc#1274703). - Update patches.suse/wifi-cfg80211-validate-PMSR-FTM-preamble-range.patch (git-fixes CVE-2026-68406 bsc#1274913). - Update patches.suse/wifi-ipw2100-fix-potential-memory-leak-in-ipw2100_pc.patch (git-fixes CVE-2026-68413 bsc#1274694). - Update patches.suse/wifi-libertas-fix-memory-leak-in-helper_firmware_cb.patch (git-fixes CVE-2026-68410 bsc#1274710). - Update patches.suse/wifi-mac80211-free-AP_VLAN-bc_buf-SKBs-outside-IRQ-l.patch (git-fixes CVE-2026-68405 bsc#1274896). - Update patches.suse/wifi-mac80211-tear-down-new-links-on-vif-update-erro.patch (git-fixes CVE-2026-64574 bsc#1274020). - Update patches.suse/wifi-mt76-connac-fix-possible-NULL-pointer-deref-in-.patch (git-fixes CVE-2026-68309 bsc#1275073). - Update patches.suse/wifi-mt76-mt7615-drop-TXRX_NOTIFY-on-non-mmio-buses.patch (git-fixes CVE-2026-68195 bsc#1274808). - Update patches.suse/wifi-mt76-mt7915-guard-HE-capability-lookups.patch (git-fixes CVE-2026-68310 bsc#1274667). - Update patches.suse/wifi-mt76-mt7921-drop-TXRX_NOTIFY-on-non-mmio-buses.patch (git-fixes CVE-2026-68194 bsc#1274807). - Update patches.suse/wifi-mt76-mt7925-drop-TXRX_NOTIFY-on-non-mmio-buses.patch (git-fixes CVE-2026-68193 bsc#1274811). - Update patches.suse/wifi-mt76-mt7996-check-pointer-returned-by-mt76_conn.patch (git-fixes CVE-2026-68308 bsc#1275071). - Update patches.suse/wifi-mt76-mt7996-fix-possible-NULL-pointer-deref-in-.patch (git-fixes CVE-2026-68306 bsc#1275069). - Update patches.suse/wifi-mwifiex-bound-uAP-association-event-IEs-to-the-.patch (git-fixes CVE-2026-68326 bsc#1274650). - Update patches.suse/wifi-mwifiex-fix-NULL-dereference-when-the-AP-has-HT.patch (git-fixes CVE-2026-68197 bsc#1274804). - Update patches.suse/wifi-nl80211-free-RNR-data-on-MBSSID-mismatch.patch (git-fixes CVE-2026-68407 bsc#1274905). - Update patches.suse/wifi-p54-validate-RX-frame-length-in-p54_rx_eeprom_r.patch (git-fixes CVE-2026-64571 bsc#1274012). - Update patches.suse/wifi-wilc1000-validate-assoc-response-length-before-.patch (git-fixes CVE-2026-68196 bsc#1274805). - commit 0152c90 - powerpc, perf: Check that current->mm is alive before getting user callchain (CVE-2026-43416 bsc#1265121). - commit 30d07db - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CVE-2026-68159 bsc#1275470). - commit b274ee3 - libceph: Fix multiplication overflow in decode_new_up_state_weight() (CVE-2026-68158 bsc#1275307). - commit 3944e1b - libceph: Reject monmaps advertising zero monitors (CVE-2026-68155 bsc#1275304). - commit 8f405ff - netfs: Fix overrun check in netfs_extract_user_iter() (CVE-2026-64217 bsc#1272798). - commit 0184f90 - proc: protect ptrace_may_access() with exec_update_lock (FD links) (CVE-2026-64375 bsc#1273868). - Refresh patches.suse/procfs-add-tunable-for-fd-fdinfo-dentry-retention.patch. - commit e73212f - udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705 bsc#1276922). - commit f71b300 - RDMA/nldev: Fix locking when accessing mr->pd (CVE-2026-74334 bsc#1277095) - commit bca8056 - media: rc: igorplugusb: fix control request setup packet (CVE-2026-46091 bsc#1267238). - commit a080e85 - bpf: Prefer dirty packs for eBPF allocations (bsc#1273999 CVE-2026-64507). - commit 0b19182 - bpf: Prefer packs that won't trigger an IBPB flush on allocation (bsc#1273999 CVE-2026-64507). - commit c9a5eb9 - bpf: Skip redundant IBPB in pack allocator (bsc#1273999 CVE-2026-64507). - commit f2d936c - bpf: Restrict JIT predictor flush to cBPF (bsc#1273999 CVE-2026-64507). - commit 727de37 - mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586 bsc#1277328). - commit a7942a9 - x86/bugs: Enable IBPB flush on BPF JIT allocation (bsc#1273999 CVE-2026-64507). - commit 9d43fdd - bpf: Support for hardening against JIT spraying (bsc#1273999 CVE-2026-64507). - commit c529a15 - xprtrdma: Resize reply buffers before reposting receives (CVE-2026-72464 bsc#1277069). - commit 82e5914 - xprtrdma: Sanitize the reply credit grant after parsing (CVE-2026-72464 bsc#1277069). - commit c8fdcd5 - xprtrdma: Repost Receive buffers for malformed replies (CVE-2026-72464 bsc#1277069). - commit e0fa638 - xprtrdma: Post receive buffers after RPC completion (CVE-2026-72464 bsc#1277069). - commit 618a504 - xprtrdma: Remove temp allocation of rpcrdma_rep objects (CVE-2026-72464 bsc#1277069). - Refresh patches.suse/xprtrdma-Decrement-re_receiving-on-the-early-exit-paths.patch. - commit e7b43d2 - gve: fix Rx queue stall on alloc failure (CVE-2026-68129 bsc#1275517). - bnxt: fix head underflow on XDP head-grow (CVE-2026-74269 bsc#1276507). - commit eebdc00 - xprtrdma: Fix bcall rep leak and unbounded peek (CVE-2026-72466 bsc#1277057). - commit 476fc8d - xprtrdma: Check frwr_wp_create() during connect (CVE-2026-72467 bsc#1277059). - commit 6e39351 - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CVE-2026-72069 bsc#1275528). - commit b0dfdea - netfilter: nf_nat_sip: reload possible stale data pointer (CVE-2026-72251 bsc#1275827). - commit 4fa58ba - netfilter: nf_tables: fix dst corruption in same register operation (CVE-2026-64006 bsc#1273834). - Refresh patches.suse/netfilter-nf_tables-fix-64-bit-load-issue-in-nft_byt.patch. - commit 1c844e0 - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CVE-2026-53163 bsc#1269306). - commit 783829d - RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference (CVE-2026-74395 bsc#1277077) - commit db63a2b - media: rc: igorplugusb: heed coherency rules (CVE-2026-46091 bsc#1267238). - commit 26da9df - xfs: fix ilock leak on error in xfs_dq_get_next_id (CVE-2026-80534 bsc#1277022). - commit e6f4b4d - tpm: st33zp24: Validate locality read result (git-fixes). - tpm: st33zp24: Return zero on status read failure (git-fixes). - tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout (git-fixes). - commit 445c757 - i2c: mux: Fix channel node leak on adapter add failure (git-fixes). - drm/amdgpu: Fix VCE 3 ring align_mask (git-fixes). - drm/msm/dsi: Drop dev_pm_opp_set_rate(0) (git-fixes). - drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0) (git-fixes). - drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value (git-fixes). - drm/amd/display: avoid divide-by-zero in __is_lut_linear() (git-fixes). - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (git-fixes). - drm/amdgpu: fix autosuspend cleanup during removal (git-fixes). - ipmi: si: Fix NULL pointer dereference after failed registration (git-fixes). - ipmi: ipmb: validate write message length (git-fixes). - ASoC: dapm: Fix off-by-one check on the second enum channel (git-fixes). - ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC (git-fixes). - ASoC: fix unmet dependencies on PPC_BESTCOMM and SND_SOC_AC97_BUS (git-fixes). - ASoC: tegra: Sort MBDRC register defaults (git-fixes). - ASoC: tegra: Fix the MIXER enable default value (git-fixes). - ALSA: usb-audio: Complete cleanup after system-resume errors (git-fixes). - ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (git-fixes). - ALSA: pcxhr: initialize mutexes before requesting threaded IRQ (git-fixes). - rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers (git-fixes). - rtc: rzn1: Fix weekday underflow when alarm crosses month boundary (git-fixes). - rtc: pcf85363: Add error checking to regmap calls in probe() (git-fixes). - rtc: gamecube: check return value of devm_rtc_register_device() (git-fixes). - rtc: zynqmp: Return optional clock lookup errors (git-fixes). - rtc: pcf8563: fix clock provider leak on unbind (git-fixes). - commit 59e5f97 - bpf: Free reuseport cBPF prog after RCU grace period (CVE-2026-52910 bsc#1268659). - commit 84562a7 - bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks (CVE-2026-63865 bsc#1272486). - commit 7737058 ++++ kernel-rt_debug: - Update patches.suse/KVM-x86-Fix-VM-hard-lockup-after-prolonged-inactivit.patch (git-fixes CVE-2025-71104 bsc#1256708). - Update patches.suse/KVM-x86-hyper-v-Bound-the-bank-index-when-querying-s.patch (git-fixes CVE-2026-64247 bsc#1273903). - Update patches.suse/KVM-x86-mmu-Fix-use-after-free-on-vendor-module-relo.patch (git-fixes CVE-2026-68428 bsc#1274699). - Update patches.suse/KVM-x86-xen-Fix-cleanup-logic-in-emulation-of-Xen-sc.patch (git-fixes CVE-2025-38469 bsc#1247455). - Update patches.suse/crypto-af_alg-Fix-incorrect-boolean-values-in-af_alg.patch (bsc#1251966 CVE-2025-39964 CVE-2025-40022 bsc#1252682). - Update patches.suse/fuse-re-lock-request-before-returning-from-fuse_ref_.patch (CVE-2026-53388 bsc#1271825 CVE-2026-64266 bsc#1273555). - Update patches.suse/ice-Fix-PTP-NULL-pointer-dereference-during-VSI-rebu.patch (bsc#1269981 CVE-2026-23210 bsc#1258517). - Update patches.suse/ice-fix-PTP-Call-Trace-during-PTP-release.patch (bsc#1269981 CVE-2026-68133 bsc#1275555). - Update patches.suse/ipv4-account-for-fraggap-on-the-paged-allocation-path.patch (git-fixes CVE-2026-53366 bsc#1271366). - Update patches.suse/msft-hv-3523-net-mana-fix-use-after-free-in-mana_hwc_destroy_chan.patch (git-fixes CVE-2026-23454 bsc#1261780). - Update patches.suse/msft-hv-3581-net-mana-Fix-TOCTOU-double-fetch-of-hwc_msg_id-from-.patch (bsc#1265928 CVE-2026-64034 bsc#1273054). - Update patches.suse/msft-hv-3583-net-mana-validate-rx_req_idx-to-prevent-out-of-bound.patch (bsc#1266402 CVE-2026-64018 bsc#1273053). - Update patches.suse/msft-hv-3585-drm-hyperv-validate-resolution_count-and-fix-WIN8-fa.patch (git-fixes CVE-2026-64524 bsc#1273578). - Update patches.suse/msft-hv-3586-drm-hyperv-validate-VMBus-packet-size-in-receive-cal.patch (git-fixes CVE-2026-64527 bsc#1274226). - Update patches.suse/msft-hv-3587-net-mana-Add-NULL-guards-in-teardown-path-to-prevent.patch (git-fixes CVE-2026-63973 bsc#1272682). - Update patches.suse/msft-hv-3588-net-mana-Skip-redundant-detach-on-already-detached-p.patch (git-fixes CVE-2026-63972 bsc#1272680). - Update patches.suse/s390-Disable-ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP.patch (bsc#1254306 CVE-2025-68179 bsc#1255250). - Update patches.suse/scsi-target-iscsi-validate-CHAP_R-length-before-base.patch (bsc#1265449 CVE-2026-63886 bsc#1272381). - Update patches.suse/smb-client-split-cached_fid-bitfields-to-avoid-shared-byte-RMW-rac.patch (bsc#1250748 bsc#1257154 CVE-2026-23230 bsc#1258430). - Update patches.suse/workqueue-Fix-UBSAN-subtraction-overflow-error-in-shift_an.patch (bsc#1260522 CVE-2024-44981 bsc#1230238). - commit 059f170 - Update patches.suse/ACPI-CPPC-Suppress-UBSAN-warning-caused-by-field-mis.patch (git-fixes CVE-2026-64512 bsc#1273597). - Update patches.suse/ACPI-NFIT-core-Fix-possible-NULL-pointer-dereference.patch (git-fixes CVE-2026-64511 bsc#1273796). - Update patches.suse/ALSA-asihpi-Fix-potential-OOB-array-access-at-readin.patch (stable-fixes CVE-2026-64133 bsc#1274065). - Update patches.suse/ALSA-caiaq-fix-out-of-bounds-read-in-the-Traktor-Kon.patch (git-fixes CVE-2026-64487 bsc#1273506). - Update patches.suse/ALSA-cmipci-check-snd_ctl_new1-return-value.patch (git-fixes CVE-2026-64486 bsc#1274243). - Update patches.suse/ALSA-es1938-check-snd_ctl_new1-return-value.patch (git-fixes CVE-2026-64484 bsc#1274573). - Update patches.suse/ALSA-firewire-isight-bound-the-sample-count-to-the-p.patch (git-fixes CVE-2026-64483 bsc#1273991). - Update patches.suse/ALSA-gus-check-snd_ctl_new1-return-value.patch (git-fixes CVE-2026-64482 bsc#1273790). - Update patches.suse/ALSA-hda-cs35l41-validate-and-free-ACPI-mute-object.patch (git-fixes CVE-2026-68346 bsc#1274622). - Update patches.suse/ALSA-ice1712-check-snd_ctl_new1-return-value.patch (git-fixes CVE-2026-64480 bsc#1274239). - Update patches.suse/ALSA-seq-Fix-uninitialised-heap-leak-in-snd_seq_even.patch (git-fixes CVE-2026-64479 bsc#1273890). - Update patches.suse/ALSA-usb-audio-avoid-kobject-path-lookup-in-DualSens.patch (git-fixes CVE-2026-64478 bsc#1274321). - Update patches.suse/ALSA-ymfpci-check-snd_ctl_new1-return-value.patch (git-fixes CVE-2026-64489 bsc#1274281). - Update patches.suse/ASoC-codecs-simple-mux-Fix-enum-control-bounds-check.patch (git-fixes CVE-2026-64243 bsc#1273838). - Update patches.suse/ASoC-tas2781-bound-firmware-description-string-parsi.patch (git-fixes CVE-2026-68348 bsc#1274624). - Update patches.suse/Bluetooth-ISO-drop-ISO_END-frames-received-without-p.patch (git-fixes CVE-2026-64128 bsc#1274067). - Update patches.suse/Bluetooth-L2CAP-validate-option-length-before-readin.patch (git-fixes CVE-2026-64403 bsc#1274076). - Update patches.suse/Bluetooth-MGMT-Fix-UAF-of-hci_conn_params-in-add_dev.patch (git-fixes CVE-2026-64433 bsc#1274283). - Update patches.suse/Bluetooth-MGMT-validate-Add-Extended-Advertising-Dat.patch (git-fixes CVE-2026-64126 bsc#1273765). - Update patches.suse/Bluetooth-RFCOMM-Fix-session-UAF-in-set_termios.patch (git-fixes CVE-2026-68188 bsc#1274953). - Update patches.suse/Bluetooth-bnep-Fix-UAF-read-of-dev-name.patch (git-fixes CVE-2026-64178 bsc#1273946). - Update patches.suse/Bluetooth-bnep-pin-L2CAP-connection-during-netdev-re.patch (git-fixes CVE-2026-64408 bsc#1273778). - Update patches.suse/Bluetooth-bpa10x-avoid-OOB-read-of-revision-string-i.patch (git-fixes CVE-2026-64549 bsc#1273341). - Update patches.suse/Bluetooth-btmtksdio-fix-infinite-loop-in-btmtksdio_t.patch (git-fixes CVE-2026-64409 bsc#1273862). - Update patches.suse/Bluetooth-btusb-fix-use-after-free-on-marvell-probe-.patch (git-fixes CVE-2026-64470 bsc#1273892). - Update patches.suse/Bluetooth-btusb-fix-use-after-free-on-registration-f.patch (git-fixes CVE-2026-64471 bsc#1274278). - Update patches.suse/Bluetooth-btusb-validate-Realtek-vendor-event-length.patch (git-fixes CVE-2026-68339 bsc#1274636). - Update patches.suse/Bluetooth-eir-Fix-stack-OOB-write-when-prepending-th.patch (git-fixes CVE-2026-64539 bsc#1273338). - Update patches.suse/Bluetooth-fix-UAF-in-bt_accept_dequeue.patch (git-fixes CVE-2026-64406 bsc#1273579). - Update patches.suse/Bluetooth-hci_sync-Protect-UUID-list-traversal.patch (git-fixes CVE-2026-68189 bsc#1274945). - Update patches.suse/Bluetooth-hci_uart-clear-HCI_UART_SENDING-when-write.patch (git-fixes CVE-2026-68085 bsc#1274702). - Update patches.suse/Bluetooth-mgmt-fix-locking-in-unpair_device-disconne.patch (git-fixes CVE-2026-68392 bsc#1274907). - Update patches.suse/Bluetooth-mgmt-hold-reference-for-hci_conn-in-mgmt_p.patch (git-fixes CVE-2026-68391 bsc#1274899). - Update patches.suse/Bluetooth-qca-fix-NVM-tag-length-underflow-in-TLV-pa.patch (git-fixes CVE-2026-64573 bsc#1274017). - Update patches.suse/HID-letsketch-fix-UAF-on-inrange_timer-at-driver-unb.patch (git-fixes CVE-2026-64365 bsc#1273310). - Update patches.suse/HID-lg-g15-cancel-pending-work-on-remove-to-fix-a-us.patch (git-fixes CVE-2026-64362 bsc#1274078). - Update patches.suse/HID-logitech-dj-Fix-maxfield-check-in-DJ-short-repor.patch (git-fixes CVE-2026-64427 bsc#1273281). - Update patches.suse/HID-wacom-stop-hardware-after-post-start-probe-failu.patch (git-fixes CVE-2026-68091 bsc#1274721). - Update patches.suse/Input-elan_i2c-prevent-division-by-zero-and-arithmet.patch (git-fixes CVE-2026-64275 bsc#1273876). - Update patches.suse/Input-elan_i2c-validate-firmware-size-before-use.patch (stable-fixes CVE-2026-64237 bsc#1273739). - Update patches.suse/Input-goodix-clamp-the-device-reported-contact-count.patch (git-fixes CVE-2026-64274 bsc#1273542). - Update patches.suse/Input-iforce-bound-the-device-reported-force-feedbac.patch (git-fixes CVE-2026-64273 bsc#1273941). - Update patches.suse/Input-ims-pcu-fix-heap-buffer-overflow-in-ims_pcu_pr.patch (git-fixes CVE-2026-64565 bsc#1274001). - Update patches.suse/Input-synaptics-rmi4-bound-the-F30-keymap-to-the-GPI.patch (git-fixes CVE-2026-64276 bsc#1273877). - Update patches.suse/Input-synaptics-rmi4-bound-the-F3A-keymap-to-the-GPI.patch (git-fixes CVE-2026-64277 bsc#1274035). - Update patches.suse/Input-touchwin-reset-the-packet-index-on-every-compl.patch (git-fixes CVE-2026-64271 bsc#1273935). - Update patches.suse/Input-usbtouchscreen-clamp-NEXIO-data_len-x_len-to-U.patch (git-fixes CVE-2026-64014 bsc#1273769). - Update patches.suse/KVM-SVM-Bump-asid_generation-on-CPU-online-to-avoid-.patch (git-fixes CVE-2026-68093 bsc#1274725). - Update patches.suse/KVM-VMX-Grab-vmcs12-on-CR8-interception-update-iff-v.patch (git-fixes CVE-2026-64604 bsc#1274286). - Update patches.suse/KVM-x86-Unconditionally-recompute-CR8-intercept-on-P.patch (git-fixes CVE-2026-64513 bsc#1273327). - Update patches.suse/USB-chaoskey-Fix-slab-use-after-free-in-chaoskey_rel.patch (git-fixes CVE-2026-64455 bsc#1273844). - Update patches.suse/USB-idmouse-fix-use-after-free-on-disconnect-race.patch (git-fixes CVE-2026-64344 bsc#1274019). - Update patches.suse/USB-iowarrior-fix-use-after-free-on-disconnect-race.patch (git-fixes CVE-2026-64341 bsc#1273895). - Update patches.suse/USB-iowarrior-fix-use-after-free-on-disconnect.patch (git-fixes CVE-2026-64342 bsc#1274011). - Update patches.suse/USB-ldusb-fix-use-after-free-on-disconnect-race.patch (git-fixes CVE-2026-64343 bsc#1273974). - Update patches.suse/USB-legousbtower-fix-use-after-free-on-disconnect-ra.patch (git-fixes CVE-2026-64340 bsc#1274003). - Update patches.suse/USB-misc-uss720-unregister-parport-on-probe-failure.patch (git-fixes CVE-2026-64338 bsc#1273990). - Update patches.suse/USB-serial-digi_acceleport-fix-broken-rx-after-throt.patch (git-fixes CVE-2026-64335 bsc#1273977). - Update patches.suse/USB-serial-digi_acceleport-fix-hard-lockup-on-discon.patch (git-fixes CVE-2026-64334 bsc#1273942). - Update patches.suse/USB-serial-digi_acceleport-fix-write-buffer-corrupti.patch (git-fixes CVE-2026-64333 bsc#1273933). - Update patches.suse/USB-serial-io_edgeport-cap-received-transmit-credits.patch (git-fixes CVE-2026-68365 bsc#1276257). - Update patches.suse/USB-serial-mct_u232-fix-memory-corruption-with-small.patch (CVE-2026-63928 bsc#1272891 CVE-2026-63898 bsc#1272643). - Update patches.suse/USB-ulpi-fix-memory-leak-on-registration-failure.patch (git-fixes CVE-2026-64332 bsc#1273285). - Update patches.suse/accel-qaic-Add-overflow-check-to-remap_pfn_range-dur.patch (git-fixes CVE-2026-64051 bsc#1273482). - Update patches.suse/batman-adv-bla-fix-report_work-leak-on-backbone_gw-p.patch (git-fixes CVE-2026-64218 bsc#1273832). - Update patches.suse/batman-adv-tt-fix-negative-tt_buff_len.patch (git-fixes CVE-2026-64088 bsc#1273463). - Update patches.suse/can-esd_usb-kill-anchored-URBs-before-freeing-netdev.patch (git-fixes CVE-2026-64585 bsc#1274491). - Update patches.suse/cdrom-fix-stack-out-of-bounds-read-in-CDROMVOLCTRL.patch (git-fixes CVE-2026-68184 bsc#1274981). - Update patches.suse/comedi-comedi_parport-deal-with-premature-interrupt.patch (git-fixes CVE-2026-68182 bsc#1274958). - Update patches.suse/crypto-amlogic-avoid-double-cleanup-in-meson_crypto_.patch (git-fixes CVE-2026-64599 bsc#1274314). - Update patches.suse/crypto-asymmetric_keys-fix-OOB-read-in-pefile_digest.patch (git-fixes CVE-2026-64544 bsc#1273316). - Update patches.suse/crypto-drbg-Fix-returning-success-on-failure-in-CTR_.patch (git-fixes CVE-2026-64306 bsc#1273939). - Update patches.suse/crypto-ecc-Fix-carry-overflow-in-vli-multiplication.patch (git-fixes CVE-2026-64313 bsc#1273940). - Update patches.suse/crypto-qat-protect-service-table-iterations-with-ser.patch (git-fixes CVE-2026-64305 bsc#1273294). - Update patches.suse/drm-amd-display-Validate-GPIO-pin-LUT-table-size-bef.patch (stable-fixes CVE-2026-64097 bsc#1273480). - Update patches.suse/drm-amd-display-Validate-payload-length-and-link_ind.patch (stable-fixes CVE-2026-64219 bsc#1273811). - Update patches.suse/drm-amd-display-detect_link_and_local_sink-DP-alt-mo.patch (git-fixes CVE-2026-68256 bsc#1275152). - Update patches.suse/drm-amd-display-set-new_stream-to-NULL-after-release.patch (git-fixes CVE-2026-68236 bsc#1275659). - Update patches.suse/drm-amdgpu-fix-aperture-mapping-leak.patch (git-fixes CVE-2026-68102 bsc#1274764). - Update patches.suse/drm-amdgpu-fix-bo-pin-leaking-in-amdgpu_bo_create_re.patch (stable-fixes CVE-2026-68234 bsc#1275650). - Update patches.suse/drm-amdgpu-fix-division-by-zero-with-invalid-uvd-dim.patch (stable-fixes CVE-2026-68106 bsc#1274853). - Update patches.suse/drm-amdgpu-gfx10-replace-BUG_ON-with-WARN_ON.patch (stable-fixes CVE-2026-68115 bsc#1274879). - Update patches.suse/drm-amdgpu-gfx11-replace-BUG_ON-with-WARN_ON.patch (stable-fixes CVE-2026-68246 bsc#1275790). - Update patches.suse/drm-amdgpu-gfx8-drop-unecessary-BUG_ON.patch (stable-fixes CVE-2026-68430 bsc#1276273). - Update patches.suse/drm-amdgpu-gfx9-replace-BUG_ON-with-WARN_ON.patch (stable-fixes CVE-2026-68111 bsc#1274873). - Update patches.suse/drm-amdgpu-gfx9.4.3-replace-BUG_ON-with-WARN_ON.patch (stable-fixes CVE-2026-68112 bsc#1274874). - Update patches.suse/drm-amdgpu-invoke-pm_genpd_remove-before-freeing-gen.patch (stable-fixes CVE-2026-68104 bsc#1274847). - Update patches.suse/drm-amdgpu-sdma4.4.2-replace-BUG_ON-with-WARN_ON.patch (stable-fixes CVE-2026-68110 bsc#1274872). - Update patches.suse/drm-amdgpu-sdma5.0-replace-BUG_ON-with-WARN_ON.patch (stable-fixes CVE-2026-68249 bsc#1275819). - Update patches.suse/drm-amdgpu-sdma5.2-replace-BUG_ON-with-WARN_ON.patch (stable-fixes CVE-2026-68250 bsc#1275820). - Update patches.suse/drm-amdgpu-sdma6.0-replace-BUG_ON-with-WARN_ON.patch (stable-fixes CVE-2026-68251 bsc#1275821). - Update patches.suse/drm-amdgpu-validate-CP_GFX_SHADOW-chunk-size-in-CS-p.patch (git-fixes CVE-2026-68272 bsc#1275126). - Update patches.suse/drm-amdgpu-vce-fix-integer-overflow-in-image-size.patch (stable-fixes CVE-2026-68108 bsc#1274869). - Update patches.suse/drm-amdgpu-vcn4-avoid-rereading-IB-param-length.patch (stable-fixes CVE-2026-68107 bsc#1274868). - Update patches.suse/drm-amdkfd-Check-bounds-in-allocate_event_notificati.patch (stable-fixes CVE-2026-68259 bsc#1275869). - Update patches.suse/drm-bridge-cdns-dsi-Replace-deprecated-UNIVERSAL_DEV.patch (git-fixes CVE-2026-68280 bsc#1275872). - Update patches.suse/drm-dp-mst-fix-OOB-reads-in-remote-DPCD-I2C-sideband.patch (git-fixes CVE-2026-68279 bsc#1275871). - Update patches.suse/drm-dp-mst-fix-OOB-reads-on-2-byte-fields-in-sideban.patch (git-fixes CVE-2026-68277 bsc#1275125). - Update patches.suse/drm-dp-mst-fix-buffer-overflows-in-sideband-chunk-ac.patch (git-fixes CVE-2026-68278 bsc#1275870). - Update patches.suse/drm-dp_mst-Handle-torn-down-topology-gracefully-in-d.patch (git-fixes CVE-2026-68429 bsc#1274802). - Update patches.suse/drm-edid-fix-OOB-read-in-drm_parse_tiled_block.patch (git-fixes CVE-2026-64546 bsc#1273334). - Update patches.suse/drm-hyperv-validate-VMBus-packet-size-in-receive-cal.patch (git-fixes CVE-2026-64527 bsc#1274226). - Update patches.suse/drm-hyperv-validate-resolution_count-and-fix-WIN8-fa.patch (git-fixes CVE-2026-64524 bsc#1273578). - Update patches.suse/drm-i915-Return-NULL-on-error-in-active_instance.patch (git-fixes CVE-2026-68248 bsc#1275818). - Update patches.suse/drm-i915-gem-Add-missing-nospec-on-parallel-submit-s.patch (git-fixes CVE-2026-68269 bsc#1275131). - Update patches.suse/drm-i915-gem-Do-not-leak-siblings-on-proto-context-e.patch (git-fixes CVE-2026-68244 bsc#1275788). - Update patches.suse/drm-i915-gem-Fix-NULL-deref-in-I915_CONTEXT_PARAM_SS.patch (git-fixes CVE-2026-68243 bsc#1275787). - Update patches.suse/drm-msm-snapshot-fix-dumping-of-the-unaligned-region.patch (git-fixes CVE-2026-64039 bsc#1273755). - Update patches.suse/drm-nouveau-fix-reversed-error-cleanup-order-in-ucop.patch (git-fixes CVE-2026-68271 bsc#1275132). - Update patches.suse/drm-vc4-Prevent-shader-BO-mappings-from-becoming-wri.patch (git-fixes CVE-2026-68445 bsc#1276277). - Update patches.suse/drm-vc4-hvs-v3d-Fix-null-dereference-in-unbind.patch (git-fixes CVE-2026-68303 bsc#1275080). - Update patches.suse/drm-virtio-bound-EDID-block-reads-to-the-response-bu.patch (git-fixes CVE-2026-68255 bsc#1275154). - Update patches.suse/drm-vmwgfx-Validate-vmw_surface_metadata-array_size.patch (git-fixes CVE-2026-68446 bsc#1274770). - Update patches.suse/firewire-net-Fix-fragmented-datagram-reassembly.patch (git-fixes CVE-2026-68354 bsc#1274738). - Update patches.suse/firmware-arm_ffa-Check-for-NULL-FF-A-ID-table-while-.patch (git-fixes CVE-2026-64166 bsc#1273822). - Update patches.suse/firmware-arm_ffa-Fix-NULL-dereference-in-ffa_partiti.patch (git-fixes CVE-2026-68444 bsc#1274768). - Update patches.suse/firmware_loader-fix-device-reference-leak-in-firmwar.patch (git-fixes CVE-2026-64376 bsc#1273817). - Update patches.suse/fpga-region-fix-use-after-free-in-child_regions_with.patch (git-fixes CVE-2026-64249 bsc#1273810). - Update patches.suse/gpio-eic-sprd-use-raw_spinlock_t-in-the-irq-startup-.patch (git-fixes CVE-2026-64429 bsc#1273501). - Update patches.suse/gpu-host1x-Fix-use-after-free-in-host1x_bo_clear_cac.patch (stable-fixes CVE-2026-68427 bsc#1276270). - Update patches.suse/hwmon-corsair-cpro-Stop-device-IO-before-calling-hid.patch (git-fixes CVE-2026-68360 bsc#1275176). - Update patches.suse/hwmon-corsair-psu-Stop-device-IO-before-calling-hid_.patch (git-fixes CVE-2026-68361 bsc#1275185). - Update patches.suse/hwmon-nzxt-smart2-Stop-device-IO-before-calling-hid_.patch (git-fixes CVE-2026-68359 bsc#1274670). - Update patches.suse/hwmon-occ-validate-poll-response-sensor-blocks.patch (git-fixes CVE-2026-68340 bsc#1274632). - Update patches.suse/hwmon-pmbus-adm1266-bounce-blackbox-records-through-.patch (git-fixes CVE-2026-64085 bsc#1273468). - Update patches.suse/hwmon-pmbus-adm1266-cap-PDIO-scan-in-get_multiple-at.patch (git-fixes CVE-2026-64084 bsc#1273471). - Update patches.suse/hwmon-pmbus-adm1266-include-PEC-byte-in-pmbus_block_.patch (git-fixes CVE-2026-64086 bsc#1273469). - Update patches.suse/hwmon-pmbus-adm1266-reject-implausible-blackbox-reco.patch (git-fixes CVE-2026-64087 bsc#1273274). - Update patches.suse/hwmon-pmbus-adm1266-reject-short-block-read-response.patch (git-fixes CVE-2026-64083 bsc#1273479). - Update patches.suse/hwmon-pmbus-adm1266-widen-blackbox-info-buffer-to-I2.patch (git-fixes CVE-2026-64135 bsc#1273967). - Update patches.suse/iio-accel-bmc150-clamp-the-device-reported-FIFO-fram.patch (git-fixes CVE-2026-64504 bsc#1273988). - Update patches.suse/iio-accel-kxsd9-fix-runtime-PM-imbalance-on-write_ra.patch (git-fixes CVE-2026-64503 bsc#1273596). - Update patches.suse/iio-adc-lpc32xx-Initialize-completion-before-request.patch (git-fixes CVE-2026-64500 bsc#1273533). - Update patches.suse/iio-adc-spear-Initialize-completion-before-requestin.patch (git-fixes CVE-2026-64602 bsc#1274294). - Update patches.suse/iio-chemical-scd30-Cleanup-initializations-and-fix-s.patch (git-fixes CVE-2026-64497 bsc#1273536). - Update patches.suse/iio-event-Fix-event-FIFO-reset-race.patch (git-fixes CVE-2026-64496 bsc#1273600). - Update patches.suse/iio-gyro-bmg160-bail-out-when-bandwidth-filter-is-no.patch (git-fixes CVE-2026-64495 bsc#1273972). - Update patches.suse/iio-light-gp2ap002-fix-runtime-PM-leak-on-read-error.patch (git-fixes CVE-2026-64494 bsc#1273602). - Update patches.suse/intel_th-fix-MSC-output-device-reference-leak.patch (git-fixes CVE-2026-68180 bsc#1274968). - Update patches.suse/mac802154-hold-an-interface-reference-across-the-sca.patch (git-fixes CVE-2026-68126 bsc#1275236). - Update patches.suse/mac802154-llsec-reject-frames-shorter-than-the-authe.patch (git-fixes CVE-2026-68125 bsc#1275239). - Update patches.suse/media-airspy-Return-queued-buffers-on-start_streamin.patch (git-fixes CVE-2026-68231 bsc#1275636). - Update patches.suse/media-cedrus-skip-invalid-H.264-reference-list-entri.patch (git-fixes CVE-2026-68229 bsc#1275633). - Update patches.suse/media-cx231xx-fix-devres-lifetime.patch (git-fixes CVE-2026-68227 bsc#1275595). - Update patches.suse/media-cx23885-add-ioremap-return-check-and-cleanup.patch (git-fixes CVE-2026-68226 bsc#1275591). - Update patches.suse/media-meson-vdec-Fix-memory-leak-in-error-path-of-vd.patch (git-fixes CVE-2026-68223 bsc#1275511). - Update patches.suse/media-msi2500-Return-queued-buffers-on-start_streami.patch (git-fixes CVE-2026-68222 bsc#1275509). - Update patches.suse/media-mtk-jpeg-cancel-workqueue-on-release-for-suppo.patch (git-fixes CVE-2026-64358 bsc#1273601). - Update patches.suse/media-nxp-imx8-isi-Add-missing-v4l2_subdev_cleanup-i.patch (git-fixes CVE-2026-68220 bsc#1275487). - Update patches.suse/media-nxp-imx8-isi-Fix-potential-out-of-bounds-issue.patch (git-fixes CVE-2026-68219 bsc#1275486). - Update patches.suse/media-nxp-imx8-isi-Fix-use-after-free-on-remove.patch (git-fixes CVE-2026-64421 bsc#1273582). - Update patches.suse/media-pci-dm1105-Free-allocated-workqueue.patch (git-fixes CVE-2026-68218 bsc#1275483). - Update patches.suse/media-pwc-Drain-fill_buf-on-start_streaming-failure.patch (git-fixes CVE-2026-68217 bsc#1274886). - Update patches.suse/media-pwc-Return-queued-buffers-on-start_streaming-f.patch (git-fixes CVE-2026-68216 bsc#1274883). - Update patches.suse/media-radio-si476x-Unregister-v4l2_device-on-probe-f.patch (git-fixes CVE-2026-68215 bsc#1274893). - Update patches.suse/media-rtl2832-fix-use-after-free-in-rtl2832_remove.patch (git-fixes CVE-2026-68214 bsc#1274894). - Update patches.suse/media-rtl2832_sdr-Return-queued-buffers-on-start_str.patch (git-fixes CVE-2026-68213 bsc#1274891). - Update patches.suse/media-saa7134-Fix-a-possible-memory-leak-in-saa7134_.patch (git-fixes CVE-2026-68212 bsc#1274924). - Update patches.suse/media-stm32-dcmi-unregister-notifier-on-probe-failur.patch (git-fixes CVE-2026-68210 bsc#1274921). - Update patches.suse/media-sun4i-csi-Return-queued-buffers-on-start_strea.patch (git-fixes CVE-2026-68209 bsc#1274929). - Update patches.suse/media-ti-vpe-unwind-v4l2-device-registration-on-prob.patch (git-fixes CVE-2026-68207 bsc#1274925). - Update patches.suse/media-v4l2-ctrls-validate-HEVC-active-reference-coun.patch (git-fixes CVE-2026-68206 bsc#1274935). - Update patches.suse/media-vivid-check-for-vb2_is_busy-when-toggling-caps.patch (git-fixes CVE-2026-68204 bsc#1274933). - Update patches.suse/mei-bus-access-mei_device-under-device_lock-on-clean.patch (git-fixes CVE-2026-68181 bsc#1274951). - Update patches.suse/mfd-cros_ec-Delay-dev_set_drvdata-until-probe-succes.patch (git-fixes CVE-2026-64420 bsc#1273260). - Update patches.suse/net-usb-kalmia-bound-RX-frame-length-in-kalmia_rx_fi.patch (git-fixes CVE-2026-64351 bsc#1274057). - Update patches.suse/net-usb-net1080-validate-packet_len-before-pad-byte-.patch (git-fixes CVE-2026-64547 bsc#1273319). - Update patches.suse/net-x25-fix-use-after-free-in-x25_kill_by_neigh.patch (git-fixes CVE-2026-68137 bsc#1275479). - Update patches.suse/power-reset-linkstation-poweroff-fix-use-after-free-.patch (git-fixes CVE-2026-64246 bsc#1273945). - Update patches.suse/sctp-avoid-auth_enable-sysctl-UAF-during-netns-teard.patch (git-fixes CVE-2026-68162 bsc#1274920). - Update patches.suse/serial-8250_mid-Fix-NULL-function-pointer-dereferenc.patch (git-fixes CVE-2026-68434 bsc#1274787). - Update patches.suse/smb-client-reject-overlapping-data-areas-in-SMB2-responses.patch (git-fixes CVE-2026-64257 bsc#1273250). - Update patches.suse/smb-client-require-net-admin-for-CIFS-SWN-netlink.patch (bsc#1273966 CVE-2026-64137). - Update patches.suse/smb-client-resolve-SWN-tcon-from-live-registrations.patch (bsc#1273872 CVE-2026-64401). - Update patches.suse/spi-fsl-lpspi-terminate-the-RX-channel-on-TX-prepare.patch (git-fixes CVE-2026-64303 bsc#1273284). - Update patches.suse/spi-sprd-fix-error-pointer-deref-after-DMA-setup-fai.patch (git-fixes CVE-2026-64168 bsc#1273504). - Update patches.suse/staging-rtl8723bs-fix-OOB-read-in-OnAssocRsp-IE-loop.patch (git-fixes CVE-2026-64444 bsc#1274265). - Update patches.suse/staging-rtl8723bs-fix-OOB-read-in-update_beacon_info.patch (git-fixes CVE-2026-64443 bsc#1273249). - Update patches.suse/staging-rtl8723bs-fix-OOB-reads-in-IE-loops-in-issue.patch (git-fixes CVE-2026-64442 bsc#1273849). - Update patches.suse/staging-rtl8723bs-fix-OOB-reads-in-is_ap_in_tkip-IE-.patch (git-fixes CVE-2026-64536 bsc#1273346). - Update patches.suse/staging-rtl8723bs-fix-OOB-write-in-HT_caps_handler.patch (git-fixes CVE-2026-64440 bsc#1274258). - Update patches.suse/staging-rtl8723bs-fix-WEP-length-underflow-and-OOB-r.patch (git-fixes CVE-2026-64445 bsc#1274290). - Update patches.suse/usb-cdnsp-fix-stream-context-array-leak-in-cdnsp_all.patch (git-fixes CVE-2026-64350 bsc#1273867). - Update patches.suse/usb-core-port-Deattach-Type-C-connector-on-component.patch (git-fixes CVE-2026-68372 bsc#1275155). - Update patches.suse/usb-dwc3-run-gadget-disconnect-from-sleepable-suspen.patch (git-fixes CVE-2026-64454 bsc#1273503). - Update patches.suse/usb-free-iso-schedules-on-failed-submit.patch (git-fixes CVE-2026-64348 bsc#1274026). - Update patches.suse/usb-gadget-dummy_hcd-prevent-fifo_req-reuse-during-g.patch (git-fixes CVE-2026-68370 bsc#1276263). - Update patches.suse/usb-gadget-f_midi-cancel-pending-IN-work-before-free.patch (git-fixes CVE-2026-64584 bsc#1274296). - Update patches.suse/usb-gadget-f_ncm-validate-datagram-bounds-in-ncm_unw.patch (git-fixes CVE-2026-68368 bsc#1275158). - Update patches.suse/usb-gadget-function-rndis-add-length-check-for-heade.patch (stable-fixes CVE-2026-64505 bsc#1273443). - Update patches.suse/usb-gadget-function-rndis-add-length-check-to-respon.patch (stable-fixes CVE-2026-68088 bsc#1274716). - Update patches.suse/usb-gadget-printer-fix-infinite-loop-in-printer_read.patch (git-fixes CVE-2026-68369 bsc#1275163). - Update patches.suse/usb-gadget-udc-Fix-use-after-free-in-gadget_match_dr.patch (stable-fixes CVE-2026-64346 bsc#1273896). - Update patches.suse/usb-gadget-udc-bdc-free-IRQ-and-drain-func_wake_noti.patch (git-fixes CVE-2026-64583 bsc#1274578). - Update patches.suse/usb-gadget-uvc-clamp-SEND_RESPONSE-length-to-the-res.patch (git-fixes CVE-2026-68366 bsc#1275173). - Update patches.suse/usb-mtu3-unmap-request-DMA-on-queue-failure.patch (git-fixes CVE-2026-64337 bsc#1273738). - Update patches.suse/usb-typec-ucsi-ccg-Fix-use-after-free-of-ucsi-on-rem.patch (git-fixes CVE-2026-64329 bsc#1273934). - Update patches.suse/usbip-vudc-fix-NULL-deref-in-vep_dequeue.patch (git-fixes CVE-2026-64331 bsc#1273824). - Update patches.suse/usbnet-gl620a-fix-out-of-bounds-read-in-genelink_rx_.patch (git-fixes CVE-2026-64540 bsc#1273302). - Update patches.suse/wan-wanxl-Only-reset-hardware-after-BAR-mapping.patch (git-fixes CVE-2026-68327 bsc#1276029). - Update patches.suse/watchdog-pretimeout-Fix-UAF-in-watchdog_unregister_g.patch (git-fixes CVE-2026-68357 bsc#1274737). - Update patches.suse/wifi-at76c50x-usb-avoid-length-underflow-in-at76_gue.patch (git-fixes CVE-2026-68373 bsc#1275157). - Update patches.suse/wifi-ath11k-fix-NULL-pointer-dereference-in-ath11k_h.patch (git-fixes CVE-2026-68362 bsc#1275190). - Update patches.suse/wifi-ath11k-fix-error-path-leaks-in-some-WMI-WOW-cal.patch (git-fixes CVE-2026-64155 bsc#1273682). - Update patches.suse/wifi-ath11k-fix-potential-buffer-underflow-in-ath11k.patch (git-fixes CVE-2026-68355 bsc#1274675). - Update patches.suse/wifi-ath6kl-fix-OOB-access-from-firmware-ADDBA-windo.patch (git-fixes CVE-2026-68199 bsc#1274947). - Update patches.suse/wifi-ath6kl-fix-OOB-read-from-firmware-IE-lengths-in.patch (git-fixes CVE-2026-68352 bsc#1274679). - Update patches.suse/wifi-ath6kl-fix-OOB-read-from-firmware-num_msg-in-TX.patch (git-fixes CVE-2026-68353 bsc#1274677). - Update patches.suse/wifi-ath9k-hif_usb-don-t-dereference-hif_dev-after-r.patch (git-fixes CVE-2026-68363 bsc#1275164). - Update patches.suse/wifi-brcmfmac-fix-802.1X-SHA256-call-trace-warning.patch (git-fixes CVE-2026-68304 bsc#1275076). - Update patches.suse/wifi-brcmfmac-initialize-SDIO-data-work-before-clean.patch (git-fixes CVE-2026-68403 bsc#1274901). - Update patches.suse/wifi-brcmfmac-make-release_scratchbuffers-idempotent.patch (git-fixes CVE-2026-68192 bsc#1274813). - Update patches.suse/wifi-carl9170-bound-memcpy-length-in-cmd-callback-to.patch (git-fixes CVE-2026-68351 bsc#1274678). - Update patches.suse/wifi-carl9170-fix-OOB-read-from-off-by-two-in-TX-sta.patch (git-fixes CVE-2026-68350 bsc#1274682). - Update patches.suse/wifi-carl9170-fix-buffer-overflow-in-rx_stream-failo.patch (git-fixes CVE-2026-68349 bsc#1274681). - Update patches.suse/wifi-cfg80211-bound-element-ID-read-when-checking-no.patch (git-fixes CVE-2026-68402 bsc#1274914). - Update patches.suse/wifi-cfg80211-cancel-sched-scan-results-work-on-unre.patch (git-fixes CVE-2026-68414 bsc#1274703). - Update patches.suse/wifi-cfg80211-validate-PMSR-FTM-preamble-range.patch (git-fixes CVE-2026-68406 bsc#1274913). - Update patches.suse/wifi-ipw2100-fix-potential-memory-leak-in-ipw2100_pc.patch (git-fixes CVE-2026-68413 bsc#1274694). - Update patches.suse/wifi-libertas-fix-memory-leak-in-helper_firmware_cb.patch (git-fixes CVE-2026-68410 bsc#1274710). - Update patches.suse/wifi-mac80211-free-AP_VLAN-bc_buf-SKBs-outside-IRQ-l.patch (git-fixes CVE-2026-68405 bsc#1274896). - Update patches.suse/wifi-mac80211-tear-down-new-links-on-vif-update-erro.patch (git-fixes CVE-2026-64574 bsc#1274020). - Update patches.suse/wifi-mt76-connac-fix-possible-NULL-pointer-deref-in-.patch (git-fixes CVE-2026-68309 bsc#1275073). - Update patches.suse/wifi-mt76-mt7615-drop-TXRX_NOTIFY-on-non-mmio-buses.patch (git-fixes CVE-2026-68195 bsc#1274808). - Update patches.suse/wifi-mt76-mt7915-guard-HE-capability-lookups.patch (git-fixes CVE-2026-68310 bsc#1274667). - Update patches.suse/wifi-mt76-mt7921-drop-TXRX_NOTIFY-on-non-mmio-buses.patch (git-fixes CVE-2026-68194 bsc#1274807). - Update patches.suse/wifi-mt76-mt7925-drop-TXRX_NOTIFY-on-non-mmio-buses.patch (git-fixes CVE-2026-68193 bsc#1274811). - Update patches.suse/wifi-mt76-mt7996-check-pointer-returned-by-mt76_conn.patch (git-fixes CVE-2026-68308 bsc#1275071). - Update patches.suse/wifi-mt76-mt7996-fix-possible-NULL-pointer-deref-in-.patch (git-fixes CVE-2026-68306 bsc#1275069). - Update patches.suse/wifi-mwifiex-bound-uAP-association-event-IEs-to-the-.patch (git-fixes CVE-2026-68326 bsc#1274650). - Update patches.suse/wifi-mwifiex-fix-NULL-dereference-when-the-AP-has-HT.patch (git-fixes CVE-2026-68197 bsc#1274804). - Update patches.suse/wifi-nl80211-free-RNR-data-on-MBSSID-mismatch.patch (git-fixes CVE-2026-68407 bsc#1274905). - Update patches.suse/wifi-p54-validate-RX-frame-length-in-p54_rx_eeprom_r.patch (git-fixes CVE-2026-64571 bsc#1274012). - Update patches.suse/wifi-wilc1000-validate-assoc-response-length-before-.patch (git-fixes CVE-2026-68196 bsc#1274805). - commit 0152c90 - powerpc, perf: Check that current->mm is alive before getting user callchain (CVE-2026-43416 bsc#1265121). - commit 30d07db - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CVE-2026-68159 bsc#1275470). - commit b274ee3 - libceph: Fix multiplication overflow in decode_new_up_state_weight() (CVE-2026-68158 bsc#1275307). - commit 3944e1b - libceph: Reject monmaps advertising zero monitors (CVE-2026-68155 bsc#1275304). - commit 8f405ff - netfs: Fix overrun check in netfs_extract_user_iter() (CVE-2026-64217 bsc#1272798). - commit 0184f90 - proc: protect ptrace_may_access() with exec_update_lock (FD links) (CVE-2026-64375 bsc#1273868). - Refresh patches.suse/procfs-add-tunable-for-fd-fdinfo-dentry-retention.patch. - commit e73212f - udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705 bsc#1276922). - commit f71b300 - RDMA/nldev: Fix locking when accessing mr->pd (CVE-2026-74334 bsc#1277095) - commit bca8056 - media: rc: igorplugusb: fix control request setup packet (CVE-2026-46091 bsc#1267238). - commit a080e85 - bpf: Prefer dirty packs for eBPF allocations (bsc#1273999 CVE-2026-64507). - commit 0b19182 - bpf: Prefer packs that won't trigger an IBPB flush on allocation (bsc#1273999 CVE-2026-64507). - commit c9a5eb9 - bpf: Skip redundant IBPB in pack allocator (bsc#1273999 CVE-2026-64507). - commit f2d936c - bpf: Restrict JIT predictor flush to cBPF (bsc#1273999 CVE-2026-64507). - commit 727de37 - mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586 bsc#1277328). - commit a7942a9 - x86/bugs: Enable IBPB flush on BPF JIT allocation (bsc#1273999 CVE-2026-64507). - commit 9d43fdd - bpf: Support for hardening against JIT spraying (bsc#1273999 CVE-2026-64507). - commit c529a15 - xprtrdma: Resize reply buffers before reposting receives (CVE-2026-72464 bsc#1277069). - commit 82e5914 - xprtrdma: Sanitize the reply credit grant after parsing (CVE-2026-72464 bsc#1277069). - commit c8fdcd5 - xprtrdma: Repost Receive buffers for malformed replies (CVE-2026-72464 bsc#1277069). - commit e0fa638 - xprtrdma: Post receive buffers after RPC completion (CVE-2026-72464 bsc#1277069). - commit 618a504 - xprtrdma: Remove temp allocation of rpcrdma_rep objects (CVE-2026-72464 bsc#1277069). - Refresh patches.suse/xprtrdma-Decrement-re_receiving-on-the-early-exit-paths.patch. - commit e7b43d2 - gve: fix Rx queue stall on alloc failure (CVE-2026-68129 bsc#1275517). - bnxt: fix head underflow on XDP head-grow (CVE-2026-74269 bsc#1276507). - commit eebdc00 - xprtrdma: Fix bcall rep leak and unbounded peek (CVE-2026-72466 bsc#1277057). - commit 476fc8d - xprtrdma: Check frwr_wp_create() during connect (CVE-2026-72467 bsc#1277059). - commit 6e39351 - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CVE-2026-72069 bsc#1275528). - commit b0dfdea - netfilter: nf_nat_sip: reload possible stale data pointer (CVE-2026-72251 bsc#1275827). - commit 4fa58ba - netfilter: nf_tables: fix dst corruption in same register operation (CVE-2026-64006 bsc#1273834). - Refresh patches.suse/netfilter-nf_tables-fix-64-bit-load-issue-in-nft_byt.patch. - commit 1c844e0 - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CVE-2026-53163 bsc#1269306). - commit 783829d - RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference (CVE-2026-74395 bsc#1277077) - commit db63a2b - media: rc: igorplugusb: heed coherency rules (CVE-2026-46091 bsc#1267238). - commit 26da9df - xfs: fix ilock leak on error in xfs_dq_get_next_id (CVE-2026-80534 bsc#1277022). - commit e6f4b4d - tpm: st33zp24: Validate locality read result (git-fixes). - tpm: st33zp24: Return zero on status read failure (git-fixes). - tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout (git-fixes). - commit 445c757 - i2c: mux: Fix channel node leak on adapter add failure (git-fixes). - drm/amdgpu: Fix VCE 3 ring align_mask (git-fixes). - drm/msm/dsi: Drop dev_pm_opp_set_rate(0) (git-fixes). - drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0) (git-fixes). - drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value (git-fixes). - drm/amd/display: avoid divide-by-zero in __is_lut_linear() (git-fixes). - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (git-fixes). - drm/amdgpu: fix autosuspend cleanup during removal (git-fixes). - ipmi: si: Fix NULL pointer dereference after failed registration (git-fixes). - ipmi: ipmb: validate write message length (git-fixes). - ASoC: dapm: Fix off-by-one check on the second enum channel (git-fixes). - ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC (git-fixes). - ASoC: fix unmet dependencies on PPC_BESTCOMM and SND_SOC_AC97_BUS (git-fixes). - ASoC: tegra: Sort MBDRC register defaults (git-fixes). - ASoC: tegra: Fix the MIXER enable default value (git-fixes). - ALSA: usb-audio: Complete cleanup after system-resume errors (git-fixes). - ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (git-fixes). - ALSA: pcxhr: initialize mutexes before requesting threaded IRQ (git-fixes). - rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers (git-fixes). - rtc: rzn1: Fix weekday underflow when alarm crosses month boundary (git-fixes). - rtc: pcf85363: Add error checking to regmap calls in probe() (git-fixes). - rtc: gamecube: check return value of devm_rtc_register_device() (git-fixes). - rtc: zynqmp: Return optional clock lookup errors (git-fixes). - rtc: pcf8563: fix clock provider leak on unbind (git-fixes). - commit 59e5f97 - bpf: Free reuseport cBPF prog after RCU grace period (CVE-2026-52910 bsc#1268659). - commit 84562a7 - bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks (CVE-2026-63865 bsc#1272486). - commit 7737058 ++++ libpng16: - fix src link ++++ libusb-1_0: - Fix CVE-2026-23679 (bsc#1266664), CVE-2026-47104 (bsc#1266667) * CVE-2026-23679-CVE-2026-47104.patch ++++ rpcbind: - Fix stack-based buffer overflow in rpcinfo's rpcbdump() short-mode version-list formatting (bsc#1272340, CVE-2026-16461) * add 0001-rpcinfo-fix-stack-buffer-overflow-in-rpcbdump-short-.patch ------------------------------------------------------------------ ------------------ 2026-8-29 - Aug 29 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - inet: frags: strip GSO state from fragments before reassembly (CVE-2026-80590 bsc#1277275) - commit 73c9fef ++++ kernel-rt: - inet: frags: strip GSO state from fragments before reassembly (CVE-2026-80590 bsc#1277275) - commit 73c9fef ++++ kernel-rt_debug: - inet: frags: strip GSO state from fragments before reassembly (CVE-2026-80590 bsc#1277275) - commit 73c9fef ------------------------------------------------------------------ ------------------ 2026-8-28 - Aug 28 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - dm: clear cloned request bio pointer when last clone bio completes (CVE-2026-43278 bsc#1264584). - commit c36c9f1 - md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163 bsc#1264335). - commit 4468e73 - ipv4: fib: Don't ignore error route in local/main tables (CVE-2026-72421 bsc#1277023). - commit 39b68fa - net/packet: avoid fanout hook re-registration after unregister (CVE-2026-68338 bsc#1274637). - commit c01b05b - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() (CVE-2026-68141 bsc#1275094). - commit 3e7c052 - nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339 CVE-2026-64319). - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420 CVE-2026-64320). diff --git a/patches.suse/nvmet-fix-pre-auth-out-of-bounds-heap-read-in-Discov.patch b/patches.suse/nvmet-fix-pre-auth-out-of-bounds-heap-read-in-Discov.patch new file mode 100644 index 000000000000..21c7f955109d - -- /dev/null +++ b/patches.suse/nvmet-fix-pre-auth-out-of-bounds-heap-read-in-Discov.patch @@ -0,0 +1,104 @@ +From: Bryam Vargas +Date: Wed, 27 May 2026 15:00:00 -0500 +Subject: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page +Patch-mainline: v7.2-rc1 +Git-commit: 53cd102a7a56079b11b897835bd9b94c14e6322c +References: bsc#1273420 CVE-2026-64320 + +nvmet_execute_disc_get_log_page() validates only the dword alignment +of the host-supplied Log Page Offset (lpo). The 64-bit offset is then +added to a small kzalloc'd buffer that holds the discovery log page +and the result is passed straight to nvmet_copy_to_sgl(), which +memcpy()s data_len bytes out to the host with no source-side bound +check: + + u64 offset = nvmet_get_log_page_offset(req->cmd); /* 64-bit host */ + size_t data_len = nvmet_get_log_page_len(req->cmd); /* 32-bit host */ + ... + if (offset & 0x3) { ... } /* only check */ + ... + alloc_len = sizeof(*hdr) + entry_size * discovery_log_entries(req); + buffer = kzalloc(alloc_len, GFP_KERNEL); + ... + status = nvmet_copy_to_sgl(req, 0, buffer + offset, data_len); + +The Discovery controller is unauthenticated -- nvmet_host_allowed() +returns true unconditionally for the discovery subsystem -- so the call +is reachable pre-authentication by any TCP/RDMA/FC peer that can reach +the nvmet target. With a discovery log page of ~1 KiB, an attacker +requesting up to 4 KiB starting at offset == alloc_len reads the next +slab page out and gets its content returned over the fabric (an +empirical run on a default nvmet-tcp loopback target leaked 81 +canonical kernel pointers in one Get Log Page response). Pointing the +offset at unmapped kernel memory faults the in-kernel memcpy and +crashes (or panics, on panic_on_oops=1) the target host instead. + +The attacker-controlled source-side offset pattern +"nvmet_copy_to_sgl(req, 0, buffer + ATTACKER_OFFSET, ...)" is unique +to nvmet_execute_disc_get_log_page in the entire nvmet codebase: every +other Get Log Page handler in admin-cmd.c either ignores lpo (and +silently starts every response at offset 0) or tracks a local +destination offset with a fixed source pointer. + +Validate the host-supplied offset against the log page size, cap the +copy length to what is actually available, and zero-fill any remainder +of the host transfer buffer. The zero-fill matches the existing +short-response pattern in nvmet_execute_get_log_changed_ns() +(admin-cmd.c) and prevents leaking transport SGL contents when the +host asks for more bytes than the log page contains. + +Fixes: a07b4970f464 ("nvmet: add a generic NVMe target") +Cc: stable@vger.kernel.org +Reviewed-by: Chaitanya Kulkarni +Reviewed-by: Christoph Hellwig +Signed-off-by: Bryam Vargas +Signed-off-by: Keith Busch +Acked-by: Daniel Wagner +--- + drivers/nvme/target/discovery.c | 23 ++++++++++++++++++++++- + 1 file changed, 22 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/target/discovery.c b/drivers/nvme/target/discovery.c +index e9b35549e254..114869d16a1f 100644 +--- a/drivers/nvme/target/discovery.c ++++ b/drivers/nvme/target/discovery.c +@@ -166,6 +166,7 @@ static void nvmet_execute_disc_get_log_page(struct nvmet_req *req) + u64 offset = nvmet_get_log_page_offset(req->cmd); + size_t data_len = nvmet_get_log_page_len(req->cmd); + size_t alloc_len; ++ size_t copy_len; + struct nvmet_subsys_link *p; + struct nvmet_port *r; + u32 numrec = 0; +@@ -242,7 +243,27 @@ static void nvmet_execute_disc_get_log_page(struct nvmet_req *req) + + up_read(&nvmet_config_sem); + +- status = nvmet_copy_to_sgl(req, 0, buffer + offset, data_len); ++ /* ++ * Validate the host-supplied log page offset before copying out. ++ * Without this check, the host controls a 64-bit byte offset into ++ * a small kzalloc'd buffer: a value past the log page lets the ++ * subsequent memcpy read adjacent kernel heap, and a value aimed ++ * at unmapped kernel memory faults the in-kernel copy and crashes ++ * the target host. The Discovery controller is unauthenticated, ++ * so the bug is reachable from any reachable fabric peer. ++ */ ++ if (offset > alloc_len) { ++ req->error_loc = ++ offsetof(struct nvme_get_log_page_command, lpo); ++ status = NVME_SC_INVALID_FIELD | NVME_SC_DNR; ++ goto out_free_buffer; ++ } ++ ++ copy_len = min_t(size_t, data_len, alloc_len - offset); ++ status = nvmet_copy_to_sgl(req, 0, buffer + offset, copy_len); ++ if (!status && copy_len < data_len) ++ status = nvmet_zero_sgl(req, copy_len, data_len - copy_len); ++out_free_buffer: + kfree(buffer); + out: + nvmet_req_complete(req, status); +-- +2.55.0 + diff --git a/series.conf b/series.conf index 77b855fc7608..97a64e11b8fa 100644 - -- a/series.conf +++ b/series.conf @@ -36196,6 +36196,7 @@ patches.suse/crypto-pcrypt-restore-callback-for-non-parallel-fall.patch patches.suse/crypto-qat-validate-RSA-CRT-component-lengths.patch patches.suse/btrfs-do-not-trim-a-device-which-is-not-writeable.patch + patches.suse/nvmet-fix-pre-auth-out-of-bounds-heap-read-in-Discov.patch patches.suse/msft-hv-3606-net-mana-hardening-Reject-zero-max_num_queues-from-G.patch patches.suse/msft-hv-3607-net-mana-Use-per-queue-allocation-for-tx_qp-to-reduc.patch patches.suse/msft-hv-3608-net-mana-Use-kvmalloc-for-large-RX-queue-and-buffer-.patch - nvmet-tcp: Fix potential UAF when ddgst mismatch (bsc#1267373 CVE-2026-46135). - nvmet-tcp: fix race between ICReq handling and queue teardown (bsc#1267373 CVE-2026-46135). - nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373 CVE-2026-46135). - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers (bsc#1267373 CVE-2026-46135). - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (bsc#1267373 CVE-2026-46135). - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373 CVE-2026-46135). - commit a063040 - mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios (CVE-2026-74482 bsc#1276346). - commit c89ffd5 - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert (CVE-2026-64579 bsc#1274036). - commit b5d07eb - ipv6: ndisc: fix NULL deref in accept_untracked_na() (CVE-2026-64542 bsc#1273309). - commit 55f59fd - md/raid5: validate payload size before accessing journal metadata (CVE-2026-46070 bsc#1267501). - commit d9c1897 - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (CVE-2026-64474 bsc#1274316). - commit 05d84b3 - timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225 CVE-2025-68214). - commit d281ea5 - dm-thin: fix metadata refcount underflow (CVE-2026-46107, bsc#1267612). - commit f71b5d1 - scsi: elx: efct: Fix I/O leak on unsupported additional CDB (CVE-2026-72081 bsc#1277174). - commit cf9271d - net/handshake: Use spin_lock_bh for hn_lock (CVE-2026-63980,bsc#1273028). - commit a9228f5 - drm/amdgpu: Release VFCT ACPI table reference (bsc#1275704 CVE-2026-68238) - commit ba58dc3 - usb: atm: usbatm: fix invalid ci_range initialization (git-fixes). - Bluetooth: do not leak an hci_conn when a second LE connect is rejected (git-fixes). - Bluetooth: RFCOMM: serialize security confirmation handling (git-fixes). - Bluetooth: hci_uart: Fix false success return in hci_uart_setup() (git-fixes). - Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (git-fixes). - Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready (git-fixes). - Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection (git-fixes). - Bluetooth: hci_conn: re-enable advertising only for peripheral role (git-fixes). - Bluetooth: eir: Fix OOB read in eir_get_service_data() (git-fixes). - Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path (git-fixes). - Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX (git-fixes). - Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative (git-fixes). - Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative (git-fixes). - Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative (git-fixes). - batman-adv: bla: fix freeing of claims on meshif deletion (git-fixes). - batman-adv: dat: avoid unaligned fault in IP extraction (git-fixes). - batman-adv: bla: prevent CRC corruptions after claim flush (git-fixes). - batman-adv: fix stale receive device on merged fragments (git-fixes). - net: thunderbolt: Count delivered packets in rx_packets and rx_bytes (git-fixes). - leds: pca9532: Fix phantom device registration on missing hardware (git-fixes). - leds: pca9532: Fix inverted GPIO output polarity (git-fixes). - mfd: iqs62x: Reject zero-length firmware records (git-fixes). - mfd: rave-sp: validate received frame payload lengths (git-fixes). - maple_tree: fix argument name in header (git-fixes). - ALSA: dummy: Check card index validity at probe (stable-fixes). - HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() (git-fixes). - HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID (stable-fixes). - ASoC: SOF: pcm: Move period/buffer configuration print after platform open (stable-fixes). - serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants (stable-fixes). - ASoC: sof: pcm: use snd_pcm_direction_name() (stable-fixes). - commit dac3dfe - RDMA/bnxt_re: Proper rollback if the ioremap fails (CVE-2026-72496 bsc#1276943) - commit 2970ec4 - RDMA/irdma: Replace waitqueue and flag with completion (CVE-2026-72494 bsc#1276941) - commit cf8f262 - Bluetooth: L2CAP: access chan->conn safely in get/setsockopt (CVE-2026-64434 bsc#1273880). - commit 56d0672 - RDMA/bnxt_re: Avoid repeated requests to allocate WC pages (CVE-2026-72495 bsc#1276937) - commit 6c8f2c3 - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev (CVE-2026-64434 bsc#1273880). - commit f73c57f - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref (CVE-2026-64434 bsc#1273880). - commit 4f5f66d - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (CVE-2026-74488 bsc#1276350). - commit 4f3c8f4 - Bluetooth: ISO: hold sk properly in iso_conn_ready (CVE-2026-74537 bsc#1275687). - commit f3e1b91 - wifi: mac80211: validate extension-frame layout before RX (CVE-2026-68470 bsc#1276500). - wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (CVE-2026-68470 bsc#1276500). - commit 8c6b117 - net/mlx5: fw_tracer, return NULL on create error (CVE-2026-74717 bsc#1276569) - commit bc7a298 ++++ kernel-rt: - dm: clear cloned request bio pointer when last clone bio completes (CVE-2026-43278 bsc#1264584). - commit c36c9f1 - md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163 bsc#1264335). - commit 4468e73 - ipv4: fib: Don't ignore error route in local/main tables (CVE-2026-72421 bsc#1277023). - commit 39b68fa - net/packet: avoid fanout hook re-registration after unregister (CVE-2026-68338 bsc#1274637). - commit c01b05b - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() (CVE-2026-68141 bsc#1275094). - commit 3e7c052 - nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339 CVE-2026-64319). - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420 CVE-2026-64320). diff --git a/patches.suse/nvmet-fix-pre-auth-out-of-bounds-heap-read-in-Discov.patch b/patches.suse/nvmet-fix-pre-auth-out-of-bounds-heap-read-in-Discov.patch new file mode 100644 index 000000000000..21c7f955109d - -- /dev/null +++ b/patches.suse/nvmet-fix-pre-auth-out-of-bounds-heap-read-in-Discov.patch @@ -0,0 +1,104 @@ +From: Bryam Vargas +Date: Wed, 27 May 2026 15:00:00 -0500 +Subject: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page +Patch-mainline: v7.2-rc1 +Git-commit: 53cd102a7a56079b11b897835bd9b94c14e6322c +References: bsc#1273420 CVE-2026-64320 + +nvmet_execute_disc_get_log_page() validates only the dword alignment +of the host-supplied Log Page Offset (lpo). The 64-bit offset is then +added to a small kzalloc'd buffer that holds the discovery log page +and the result is passed straight to nvmet_copy_to_sgl(), which +memcpy()s data_len bytes out to the host with no source-side bound +check: + + u64 offset = nvmet_get_log_page_offset(req->cmd); /* 64-bit host */ + size_t data_len = nvmet_get_log_page_len(req->cmd); /* 32-bit host */ + ... + if (offset & 0x3) { ... } /* only check */ + ... + alloc_len = sizeof(*hdr) + entry_size * discovery_log_entries(req); + buffer = kzalloc(alloc_len, GFP_KERNEL); + ... + status = nvmet_copy_to_sgl(req, 0, buffer + offset, data_len); + +The Discovery controller is unauthenticated -- nvmet_host_allowed() +returns true unconditionally for the discovery subsystem -- so the call +is reachable pre-authentication by any TCP/RDMA/FC peer that can reach +the nvmet target. With a discovery log page of ~1 KiB, an attacker +requesting up to 4 KiB starting at offset == alloc_len reads the next +slab page out and gets its content returned over the fabric (an +empirical run on a default nvmet-tcp loopback target leaked 81 +canonical kernel pointers in one Get Log Page response). Pointing the +offset at unmapped kernel memory faults the in-kernel memcpy and +crashes (or panics, on panic_on_oops=1) the target host instead. + +The attacker-controlled source-side offset pattern +"nvmet_copy_to_sgl(req, 0, buffer + ATTACKER_OFFSET, ...)" is unique +to nvmet_execute_disc_get_log_page in the entire nvmet codebase: every +other Get Log Page handler in admin-cmd.c either ignores lpo (and +silently starts every response at offset 0) or tracks a local +destination offset with a fixed source pointer. + +Validate the host-supplied offset against the log page size, cap the +copy length to what is actually available, and zero-fill any remainder +of the host transfer buffer. The zero-fill matches the existing +short-response pattern in nvmet_execute_get_log_changed_ns() +(admin-cmd.c) and prevents leaking transport SGL contents when the +host asks for more bytes than the log page contains. + +Fixes: a07b4970f464 ("nvmet: add a generic NVMe target") +Cc: stable@vger.kernel.org +Reviewed-by: Chaitanya Kulkarni +Reviewed-by: Christoph Hellwig +Signed-off-by: Bryam Vargas +Signed-off-by: Keith Busch +Acked-by: Daniel Wagner +--- + drivers/nvme/target/discovery.c | 23 ++++++++++++++++++++++- + 1 file changed, 22 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/target/discovery.c b/drivers/nvme/target/discovery.c +index e9b35549e254..114869d16a1f 100644 +--- a/drivers/nvme/target/discovery.c ++++ b/drivers/nvme/target/discovery.c +@@ -166,6 +166,7 @@ static void nvmet_execute_disc_get_log_page(struct nvmet_req *req) + u64 offset = nvmet_get_log_page_offset(req->cmd); + size_t data_len = nvmet_get_log_page_len(req->cmd); + size_t alloc_len; ++ size_t copy_len; + struct nvmet_subsys_link *p; + struct nvmet_port *r; + u32 numrec = 0; +@@ -242,7 +243,27 @@ static void nvmet_execute_disc_get_log_page(struct nvmet_req *req) + + up_read(&nvmet_config_sem); + +- status = nvmet_copy_to_sgl(req, 0, buffer + offset, data_len); ++ /* ++ * Validate the host-supplied log page offset before copying out. ++ * Without this check, the host controls a 64-bit byte offset into ++ * a small kzalloc'd buffer: a value past the log page lets the ++ * subsequent memcpy read adjacent kernel heap, and a value aimed ++ * at unmapped kernel memory faults the in-kernel copy and crashes ++ * the target host. The Discovery controller is unauthenticated, ++ * so the bug is reachable from any reachable fabric peer. ++ */ ++ if (offset > alloc_len) { ++ req->error_loc = ++ offsetof(struct nvme_get_log_page_command, lpo); ++ status = NVME_SC_INVALID_FIELD | NVME_SC_DNR; ++ goto out_free_buffer; ++ } ++ ++ copy_len = min_t(size_t, data_len, alloc_len - offset); ++ status = nvmet_copy_to_sgl(req, 0, buffer + offset, copy_len); ++ if (!status && copy_len < data_len) ++ status = nvmet_zero_sgl(req, copy_len, data_len - copy_len); ++out_free_buffer: + kfree(buffer); + out: + nvmet_req_complete(req, status); +-- +2.55.0 + diff --git a/series.conf b/series.conf index 77b855fc7608..97a64e11b8fa 100644 - -- a/series.conf +++ b/series.conf @@ -36196,6 +36196,7 @@ patches.suse/crypto-pcrypt-restore-callback-for-non-parallel-fall.patch patches.suse/crypto-qat-validate-RSA-CRT-component-lengths.patch patches.suse/btrfs-do-not-trim-a-device-which-is-not-writeable.patch + patches.suse/nvmet-fix-pre-auth-out-of-bounds-heap-read-in-Discov.patch patches.suse/msft-hv-3606-net-mana-hardening-Reject-zero-max_num_queues-from-G.patch patches.suse/msft-hv-3607-net-mana-Use-per-queue-allocation-for-tx_qp-to-reduc.patch patches.suse/msft-hv-3608-net-mana-Use-kvmalloc-for-large-RX-queue-and-buffer-.patch - nvmet-tcp: Fix potential UAF when ddgst mismatch (bsc#1267373 CVE-2026-46135). - nvmet-tcp: fix race between ICReq handling and queue teardown (bsc#1267373 CVE-2026-46135). - nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373 CVE-2026-46135). - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers (bsc#1267373 CVE-2026-46135). - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (bsc#1267373 CVE-2026-46135). - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373 CVE-2026-46135). - commit a063040 - mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios (CVE-2026-74482 bsc#1276346). - commit c89ffd5 - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert (CVE-2026-64579 bsc#1274036). - commit b5d07eb - ipv6: ndisc: fix NULL deref in accept_untracked_na() (CVE-2026-64542 bsc#1273309). - commit 55f59fd - md/raid5: validate payload size before accessing journal metadata (CVE-2026-46070 bsc#1267501). - commit d9c1897 - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (CVE-2026-64474 bsc#1274316). - commit 05d84b3 - timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225 CVE-2025-68214). - commit d281ea5 - dm-thin: fix metadata refcount underflow (CVE-2026-46107, bsc#1267612). - commit f71b5d1 - scsi: elx: efct: Fix I/O leak on unsupported additional CDB (CVE-2026-72081 bsc#1277174). - commit cf9271d - net/handshake: Use spin_lock_bh for hn_lock (CVE-2026-63980,bsc#1273028). - commit a9228f5 - drm/amdgpu: Release VFCT ACPI table reference (bsc#1275704 CVE-2026-68238) - commit ba58dc3 - usb: atm: usbatm: fix invalid ci_range initialization (git-fixes). - Bluetooth: do not leak an hci_conn when a second LE connect is rejected (git-fixes). - Bluetooth: RFCOMM: serialize security confirmation handling (git-fixes). - Bluetooth: hci_uart: Fix false success return in hci_uart_setup() (git-fixes). - Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (git-fixes). - Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready (git-fixes). - Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection (git-fixes). - Bluetooth: hci_conn: re-enable advertising only for peripheral role (git-fixes). - Bluetooth: eir: Fix OOB read in eir_get_service_data() (git-fixes). - Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path (git-fixes). - Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX (git-fixes). - Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative (git-fixes). - Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative (git-fixes). - Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative (git-fixes). - batman-adv: bla: fix freeing of claims on meshif deletion (git-fixes). - batman-adv: dat: avoid unaligned fault in IP extraction (git-fixes). - batman-adv: bla: prevent CRC corruptions after claim flush (git-fixes). - batman-adv: fix stale receive device on merged fragments (git-fixes). - net: thunderbolt: Count delivered packets in rx_packets and rx_bytes (git-fixes). - leds: pca9532: Fix phantom device registration on missing hardware (git-fixes). - leds: pca9532: Fix inverted GPIO output polarity (git-fixes). - mfd: iqs62x: Reject zero-length firmware records (git-fixes). - mfd: rave-sp: validate received frame payload lengths (git-fixes). - maple_tree: fix argument name in header (git-fixes). - ALSA: dummy: Check card index validity at probe (stable-fixes). - HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() (git-fixes). - HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID (stable-fixes). - ASoC: SOF: pcm: Move period/buffer configuration print after platform open (stable-fixes). - serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants (stable-fixes). - ASoC: sof: pcm: use snd_pcm_direction_name() (stable-fixes). - commit dac3dfe - RDMA/bnxt_re: Proper rollback if the ioremap fails (CVE-2026-72496 bsc#1276943) - commit 2970ec4 - RDMA/irdma: Replace waitqueue and flag with completion (CVE-2026-72494 bsc#1276941) - commit cf8f262 - Bluetooth: L2CAP: access chan->conn safely in get/setsockopt (CVE-2026-64434 bsc#1273880). - commit 56d0672 - RDMA/bnxt_re: Avoid repeated requests to allocate WC pages (CVE-2026-72495 bsc#1276937) - commit 6c8f2c3 - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev (CVE-2026-64434 bsc#1273880). - commit f73c57f - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref (CVE-2026-64434 bsc#1273880). - commit 4f5f66d - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (CVE-2026-74488 bsc#1276350). - commit 4f3c8f4 - Bluetooth: ISO: hold sk properly in iso_conn_ready (CVE-2026-74537 bsc#1275687). - commit f3e1b91 - wifi: mac80211: validate extension-frame layout before RX (CVE-2026-68470 bsc#1276500). - wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (CVE-2026-68470 bsc#1276500). - commit 8c6b117 - net/mlx5: fw_tracer, return NULL on create error (CVE-2026-74717 bsc#1276569) - commit bc7a298 ++++ kernel-rt_debug: - dm: clear cloned request bio pointer when last clone bio completes (CVE-2026-43278 bsc#1264584). - commit c36c9f1 - md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163 bsc#1264335). - commit 4468e73 - ipv4: fib: Don't ignore error route in local/main tables (CVE-2026-72421 bsc#1277023). - commit 39b68fa - net/packet: avoid fanout hook re-registration after unregister (CVE-2026-68338 bsc#1274637). - commit c01b05b - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() (CVE-2026-68141 bsc#1275094). - commit 3e7c052 - nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339 CVE-2026-64319). - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420 CVE-2026-64320). diff --git a/patches.suse/nvmet-fix-pre-auth-out-of-bounds-heap-read-in-Discov.patch b/patches.suse/nvmet-fix-pre-auth-out-of-bounds-heap-read-in-Discov.patch new file mode 100644 index 000000000000..21c7f955109d - -- /dev/null +++ b/patches.suse/nvmet-fix-pre-auth-out-of-bounds-heap-read-in-Discov.patch @@ -0,0 +1,104 @@ +From: Bryam Vargas +Date: Wed, 27 May 2026 15:00:00 -0500 +Subject: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page +Patch-mainline: v7.2-rc1 +Git-commit: 53cd102a7a56079b11b897835bd9b94c14e6322c +References: bsc#1273420 CVE-2026-64320 + +nvmet_execute_disc_get_log_page() validates only the dword alignment +of the host-supplied Log Page Offset (lpo). The 64-bit offset is then +added to a small kzalloc'd buffer that holds the discovery log page +and the result is passed straight to nvmet_copy_to_sgl(), which +memcpy()s data_len bytes out to the host with no source-side bound +check: + + u64 offset = nvmet_get_log_page_offset(req->cmd); /* 64-bit host */ + size_t data_len = nvmet_get_log_page_len(req->cmd); /* 32-bit host */ + ... + if (offset & 0x3) { ... } /* only check */ + ... + alloc_len = sizeof(*hdr) + entry_size * discovery_log_entries(req); + buffer = kzalloc(alloc_len, GFP_KERNEL); + ... + status = nvmet_copy_to_sgl(req, 0, buffer + offset, data_len); + +The Discovery controller is unauthenticated -- nvmet_host_allowed() +returns true unconditionally for the discovery subsystem -- so the call +is reachable pre-authentication by any TCP/RDMA/FC peer that can reach +the nvmet target. With a discovery log page of ~1 KiB, an attacker +requesting up to 4 KiB starting at offset == alloc_len reads the next +slab page out and gets its content returned over the fabric (an +empirical run on a default nvmet-tcp loopback target leaked 81 +canonical kernel pointers in one Get Log Page response). Pointing the +offset at unmapped kernel memory faults the in-kernel memcpy and +crashes (or panics, on panic_on_oops=1) the target host instead. + +The attacker-controlled source-side offset pattern +"nvmet_copy_to_sgl(req, 0, buffer + ATTACKER_OFFSET, ...)" is unique +to nvmet_execute_disc_get_log_page in the entire nvmet codebase: every +other Get Log Page handler in admin-cmd.c either ignores lpo (and +silently starts every response at offset 0) or tracks a local +destination offset with a fixed source pointer. + +Validate the host-supplied offset against the log page size, cap the +copy length to what is actually available, and zero-fill any remainder +of the host transfer buffer. The zero-fill matches the existing +short-response pattern in nvmet_execute_get_log_changed_ns() +(admin-cmd.c) and prevents leaking transport SGL contents when the +host asks for more bytes than the log page contains. + +Fixes: a07b4970f464 ("nvmet: add a generic NVMe target") +Cc: stable@vger.kernel.org +Reviewed-by: Chaitanya Kulkarni +Reviewed-by: Christoph Hellwig +Signed-off-by: Bryam Vargas +Signed-off-by: Keith Busch +Acked-by: Daniel Wagner +--- + drivers/nvme/target/discovery.c | 23 ++++++++++++++++++++++- + 1 file changed, 22 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/target/discovery.c b/drivers/nvme/target/discovery.c +index e9b35549e254..114869d16a1f 100644 +--- a/drivers/nvme/target/discovery.c ++++ b/drivers/nvme/target/discovery.c +@@ -166,6 +166,7 @@ static void nvmet_execute_disc_get_log_page(struct nvmet_req *req) + u64 offset = nvmet_get_log_page_offset(req->cmd); + size_t data_len = nvmet_get_log_page_len(req->cmd); + size_t alloc_len; ++ size_t copy_len; + struct nvmet_subsys_link *p; + struct nvmet_port *r; + u32 numrec = 0; +@@ -242,7 +243,27 @@ static void nvmet_execute_disc_get_log_page(struct nvmet_req *req) + + up_read(&nvmet_config_sem); + +- status = nvmet_copy_to_sgl(req, 0, buffer + offset, data_len); ++ /* ++ * Validate the host-supplied log page offset before copying out. ++ * Without this check, the host controls a 64-bit byte offset into ++ * a small kzalloc'd buffer: a value past the log page lets the ++ * subsequent memcpy read adjacent kernel heap, and a value aimed ++ * at unmapped kernel memory faults the in-kernel copy and crashes ++ * the target host. The Discovery controller is unauthenticated, ++ * so the bug is reachable from any reachable fabric peer. ++ */ ++ if (offset > alloc_len) { ++ req->error_loc = ++ offsetof(struct nvme_get_log_page_command, lpo); ++ status = NVME_SC_INVALID_FIELD | NVME_SC_DNR; ++ goto out_free_buffer; ++ } ++ ++ copy_len = min_t(size_t, data_len, alloc_len - offset); ++ status = nvmet_copy_to_sgl(req, 0, buffer + offset, copy_len); ++ if (!status && copy_len < data_len) ++ status = nvmet_zero_sgl(req, copy_len, data_len - copy_len); ++out_free_buffer: + kfree(buffer); + out: + nvmet_req_complete(req, status); +-- +2.55.0 + diff --git a/series.conf b/series.conf index 77b855fc7608..97a64e11b8fa 100644 - -- a/series.conf +++ b/series.conf @@ -36196,6 +36196,7 @@ patches.suse/crypto-pcrypt-restore-callback-for-non-parallel-fall.patch patches.suse/crypto-qat-validate-RSA-CRT-component-lengths.patch patches.suse/btrfs-do-not-trim-a-device-which-is-not-writeable.patch + patches.suse/nvmet-fix-pre-auth-out-of-bounds-heap-read-in-Discov.patch patches.suse/msft-hv-3606-net-mana-hardening-Reject-zero-max_num_queues-from-G.patch patches.suse/msft-hv-3607-net-mana-Use-per-queue-allocation-for-tx_qp-to-reduc.patch patches.suse/msft-hv-3608-net-mana-Use-kvmalloc-for-large-RX-queue-and-buffer-.patch - nvmet-tcp: Fix potential UAF when ddgst mismatch (bsc#1267373 CVE-2026-46135). - nvmet-tcp: fix race between ICReq handling and queue teardown (bsc#1267373 CVE-2026-46135). - nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373 CVE-2026-46135). - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers (bsc#1267373 CVE-2026-46135). - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (bsc#1267373 CVE-2026-46135). - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373 CVE-2026-46135). - commit a063040 - mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios (CVE-2026-74482 bsc#1276346). - commit c89ffd5 - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert (CVE-2026-64579 bsc#1274036). - commit b5d07eb - ipv6: ndisc: fix NULL deref in accept_untracked_na() (CVE-2026-64542 bsc#1273309). - commit 55f59fd - md/raid5: validate payload size before accessing journal metadata (CVE-2026-46070 bsc#1267501). - commit d9c1897 - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (CVE-2026-64474 bsc#1274316). - commit 05d84b3 - timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225 CVE-2025-68214). - commit d281ea5 - dm-thin: fix metadata refcount underflow (CVE-2026-46107, bsc#1267612). - commit f71b5d1 - scsi: elx: efct: Fix I/O leak on unsupported additional CDB (CVE-2026-72081 bsc#1277174). - commit cf9271d - net/handshake: Use spin_lock_bh for hn_lock (CVE-2026-63980,bsc#1273028). - commit a9228f5 - drm/amdgpu: Release VFCT ACPI table reference (bsc#1275704 CVE-2026-68238) - commit ba58dc3 - usb: atm: usbatm: fix invalid ci_range initialization (git-fixes). - Bluetooth: do not leak an hci_conn when a second LE connect is rejected (git-fixes). - Bluetooth: RFCOMM: serialize security confirmation handling (git-fixes). - Bluetooth: hci_uart: Fix false success return in hci_uart_setup() (git-fixes). - Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (git-fixes). - Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready (git-fixes). - Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection (git-fixes). - Bluetooth: hci_conn: re-enable advertising only for peripheral role (git-fixes). - Bluetooth: eir: Fix OOB read in eir_get_service_data() (git-fixes). - Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path (git-fixes). - Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX (git-fixes). - Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative (git-fixes). - Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative (git-fixes). - Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative (git-fixes). - batman-adv: bla: fix freeing of claims on meshif deletion (git-fixes). - batman-adv: dat: avoid unaligned fault in IP extraction (git-fixes). - batman-adv: bla: prevent CRC corruptions after claim flush (git-fixes). - batman-adv: fix stale receive device on merged fragments (git-fixes). - net: thunderbolt: Count delivered packets in rx_packets and rx_bytes (git-fixes). - leds: pca9532: Fix phantom device registration on missing hardware (git-fixes). - leds: pca9532: Fix inverted GPIO output polarity (git-fixes). - mfd: iqs62x: Reject zero-length firmware records (git-fixes). - mfd: rave-sp: validate received frame payload lengths (git-fixes). - maple_tree: fix argument name in header (git-fixes). - ALSA: dummy: Check card index validity at probe (stable-fixes). - HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() (git-fixes). - HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID (stable-fixes). - ASoC: SOF: pcm: Move period/buffer configuration print after platform open (stable-fixes). - serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants (stable-fixes). - ASoC: sof: pcm: use snd_pcm_direction_name() (stable-fixes). - commit dac3dfe - RDMA/bnxt_re: Proper rollback if the ioremap fails (CVE-2026-72496 bsc#1276943) - commit 2970ec4 - RDMA/irdma: Replace waitqueue and flag with completion (CVE-2026-72494 bsc#1276941) - commit cf8f262 - Bluetooth: L2CAP: access chan->conn safely in get/setsockopt (CVE-2026-64434 bsc#1273880). - commit 56d0672 - RDMA/bnxt_re: Avoid repeated requests to allocate WC pages (CVE-2026-72495 bsc#1276937) - commit 6c8f2c3 - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev (CVE-2026-64434 bsc#1273880). - commit f73c57f - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref (CVE-2026-64434 bsc#1273880). - commit 4f5f66d - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (CVE-2026-74488 bsc#1276350). - commit 4f3c8f4 - Bluetooth: ISO: hold sk properly in iso_conn_ready (CVE-2026-74537 bsc#1275687). - commit f3e1b91 - wifi: mac80211: validate extension-frame layout before RX (CVE-2026-68470 bsc#1276500). - wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (CVE-2026-68470 bsc#1276500). - commit 8c6b117 - net/mlx5: fw_tracer, return NULL on create error (CVE-2026-74717 bsc#1276569) - commit bc7a298 ------------------------------------------------------------------ ------------------ 2026-8-27 - Aug 27 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (CVE-2026-64402 bsc#1273258). - commit d89f535 - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (CVE-2026-74540 bsc#1275681). - commit 81de843 - qede: fix off-by-one in BD ring consumption on build_skb failure (CVE-2026-72339 bsc#1276006). - commit 21f2b79 - nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129 bsc#1275545). - commit e204e97 - drm/vc4: Prevent shader BO mappings from becoming writable (CVE-2026-68445 bsc#1276277). - commit b60eb0f - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (CVE-2026-72317 bsc#1275925). - commit 7199de9 - bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() (CVE-2026-68284 bsc#1275970). - commit 5acb386 - btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() (CVE-2026-68422 bsc#1274706). - commit 9d6bedd - af_unix: Peek the queue synchronized (CVE-2026-64109 bsc#1273748). - commit 0dc0702 - mctp i2c: initialise event handler read bytes (CVE-2026-45865 bsc#1266694) - commit ff7c3da - net: mctp-i2c: fix duplicate reception of old data (bsc#1266730) - commit 5662d18 - net: mctp: ensure our nlmsg responses are initialised (CVE-2026-45930 bsc#1266730) - commit 4414d4b - s390/bpf: Zero-extend bpf prog return values and kfunc arguments (CVE-2026-53110,bsc#1269985). - selftests/bpf: Improve test coverage for kfunc call (CVE-2026-53110,bsc#1269985). - selftests/bpf: Fix build error due to certain uninitialized variables (CVE-2026-53110,bsc#1269985). - bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (CVE-2026-53110,bsc#1269985). - selftests/bpf: Add ASSERT_OK_FD macro (CVE-2026-53110,bsc#1269985). - commit 2a06b1c - netfilter: ebtables: module names must be null-terminated (CVE-2026-64412 bsc#1273780). - commit a4cd36d - netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() (CVE-2026-64554 bsc#1273340). - commit 6bb6d59 - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889,bsc#1272423). - commit e20ba0f - net/iucv: fix locking in .getsockopt (CVE-2026-64004,bsc#1273804). - commit aa3b1f0 - block: add pgmap check to biovec_phys_mergeable (CVE-2026-46115,bsc#1266874). - commit 4d0dab7 - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() (bsc#1272799 CVE-2026-64214). - commit 18f46cb - Refresh patches.suse/fs-preserve-ACL_DONT_CACHE-state-in-forget_cached_acl.patch. - add my missing Reviewed-by: tag - commit 26b26bd - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (CVE-2026-43147 bsc#1264642). - commit c36a253 - thermal/drivers/qoriq: Disable clock on resume failure (git-fixes). - thermal/drivers/imx: Disable clock on runtime resume failure (git-fixes). - ACPI: pfr_update: fix stack buffer overflow in query_capability() (git-fixes). - ACPI: scan: fix bus ID cleanup on device_add() failures (git-fixes). - thermal/drivers/qoriq: Disable clock on resume failure (git-fixes). - thermal/drivers/imx: Disable clock on runtime resume failure (git-fixes). - ACPI: pfr_update: fix stack buffer overflow in query_capability() (git-fixes). - ACPI: scan: fix bus ID cleanup on device_add() failures (git-fixes). - commit e75cd7d - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized (CVE-2026-64192 bsc#1272213). - commit 6c9a435 ++++ kernel-rt: - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (CVE-2026-64402 bsc#1273258). - commit d89f535 - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (CVE-2026-74540 bsc#1275681). - commit 81de843 - qede: fix off-by-one in BD ring consumption on build_skb failure (CVE-2026-72339 bsc#1276006). - commit 21f2b79 - nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129 bsc#1275545). - commit e204e97 - drm/vc4: Prevent shader BO mappings from becoming writable (CVE-2026-68445 bsc#1276277). - commit b60eb0f - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (CVE-2026-72317 bsc#1275925). - commit 7199de9 - bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() (CVE-2026-68284 bsc#1275970). - commit 5acb386 - btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() (CVE-2026-68422 bsc#1274706). - commit 9d6bedd - af_unix: Peek the queue synchronized (CVE-2026-64109 bsc#1273748). - commit 0dc0702 - mctp i2c: initialise event handler read bytes (CVE-2026-45865 bsc#1266694) - commit ff7c3da - net: mctp-i2c: fix duplicate reception of old data (bsc#1266730) - commit 5662d18 - net: mctp: ensure our nlmsg responses are initialised (CVE-2026-45930 bsc#1266730) - commit 4414d4b - s390/bpf: Zero-extend bpf prog return values and kfunc arguments (CVE-2026-53110,bsc#1269985). - selftests/bpf: Improve test coverage for kfunc call (CVE-2026-53110,bsc#1269985). - selftests/bpf: Fix build error due to certain uninitialized variables (CVE-2026-53110,bsc#1269985). - bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (CVE-2026-53110,bsc#1269985). - selftests/bpf: Add ASSERT_OK_FD macro (CVE-2026-53110,bsc#1269985). - commit 2a06b1c - netfilter: ebtables: module names must be null-terminated (CVE-2026-64412 bsc#1273780). - commit a4cd36d - netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() (CVE-2026-64554 bsc#1273340). - commit 6bb6d59 - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889,bsc#1272423). - commit e20ba0f - net/iucv: fix locking in .getsockopt (CVE-2026-64004,bsc#1273804). - commit aa3b1f0 - block: add pgmap check to biovec_phys_mergeable (CVE-2026-46115,bsc#1266874). - commit 4d0dab7 - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() (bsc#1272799 CVE-2026-64214). - commit 18f46cb - Refresh patches.suse/fs-preserve-ACL_DONT_CACHE-state-in-forget_cached_acl.patch. - add my missing Reviewed-by: tag - commit 26b26bd - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (CVE-2026-43147 bsc#1264642). - commit c36a253 - thermal/drivers/qoriq: Disable clock on resume failure (git-fixes). - thermal/drivers/imx: Disable clock on runtime resume failure (git-fixes). - ACPI: pfr_update: fix stack buffer overflow in query_capability() (git-fixes). - ACPI: scan: fix bus ID cleanup on device_add() failures (git-fixes). - thermal/drivers/qoriq: Disable clock on resume failure (git-fixes). - thermal/drivers/imx: Disable clock on runtime resume failure (git-fixes). - ACPI: pfr_update: fix stack buffer overflow in query_capability() (git-fixes). - ACPI: scan: fix bus ID cleanup on device_add() failures (git-fixes). - commit e75cd7d - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized (CVE-2026-64192 bsc#1272213). - commit 6c9a435 ++++ kernel-rt_debug: - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (CVE-2026-64402 bsc#1273258). - commit d89f535 - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (CVE-2026-74540 bsc#1275681). - commit 81de843 - qede: fix off-by-one in BD ring consumption on build_skb failure (CVE-2026-72339 bsc#1276006). - commit 21f2b79 - nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129 bsc#1275545). - commit e204e97 - drm/vc4: Prevent shader BO mappings from becoming writable (CVE-2026-68445 bsc#1276277). - commit b60eb0f - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (CVE-2026-72317 bsc#1275925). - commit 7199de9 - bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() (CVE-2026-68284 bsc#1275970). - commit 5acb386 - btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() (CVE-2026-68422 bsc#1274706). - commit 9d6bedd - af_unix: Peek the queue synchronized (CVE-2026-64109 bsc#1273748). - commit 0dc0702 - mctp i2c: initialise event handler read bytes (CVE-2026-45865 bsc#1266694) - commit ff7c3da - net: mctp-i2c: fix duplicate reception of old data (bsc#1266730) - commit 5662d18 - net: mctp: ensure our nlmsg responses are initialised (CVE-2026-45930 bsc#1266730) - commit 4414d4b - s390/bpf: Zero-extend bpf prog return values and kfunc arguments (CVE-2026-53110,bsc#1269985). - selftests/bpf: Improve test coverage for kfunc call (CVE-2026-53110,bsc#1269985). - selftests/bpf: Fix build error due to certain uninitialized variables (CVE-2026-53110,bsc#1269985). - bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (CVE-2026-53110,bsc#1269985). - selftests/bpf: Add ASSERT_OK_FD macro (CVE-2026-53110,bsc#1269985). - commit 2a06b1c - netfilter: ebtables: module names must be null-terminated (CVE-2026-64412 bsc#1273780). - commit a4cd36d - netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() (CVE-2026-64554 bsc#1273340). - commit 6bb6d59 - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889,bsc#1272423). - commit e20ba0f - net/iucv: fix locking in .getsockopt (CVE-2026-64004,bsc#1273804). - commit aa3b1f0 - block: add pgmap check to biovec_phys_mergeable (CVE-2026-46115,bsc#1266874). - commit 4d0dab7 - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() (bsc#1272799 CVE-2026-64214). - commit 18f46cb - Refresh patches.suse/fs-preserve-ACL_DONT_CACHE-state-in-forget_cached_acl.patch. - add my missing Reviewed-by: tag - commit 26b26bd - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (CVE-2026-43147 bsc#1264642). - commit c36a253 - thermal/drivers/qoriq: Disable clock on resume failure (git-fixes). - thermal/drivers/imx: Disable clock on runtime resume failure (git-fixes). - ACPI: pfr_update: fix stack buffer overflow in query_capability() (git-fixes). - ACPI: scan: fix bus ID cleanup on device_add() failures (git-fixes). - thermal/drivers/qoriq: Disable clock on resume failure (git-fixes). - thermal/drivers/imx: Disable clock on runtime resume failure (git-fixes). - ACPI: pfr_update: fix stack buffer overflow in query_capability() (git-fixes). - ACPI: scan: fix bus ID cleanup on device_add() failures (git-fixes). - commit e75cd7d - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized (CVE-2026-64192 bsc#1272213). - commit 6c9a435 ++++ wget: - Fix server-controlled unbounded MD5 loop in FTP OPIE [bsc#1276962; CVE-2026-16599] * CVE-2026-16599.patch ++++ zypper: - Add --servicesd-dir global option to relocate /etc/zypp/services.d (bsc#1257249) - version 1.14.100 ------------------------------------------------------------------ ------------------ 2026-8-26 - Aug 26 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() (CVE-2026-68160 bsc#1275472). - commit 963c7cf - virtiofs: fix UAF on submount umount (CVE-2026-53381 bsc#1271830). - commit 0d527d2 - Fix incorrect bsc/CVE reference in patches.suse/bpf-Fix-UAF-in-sock-clone-early-bailouts.patch Correct is: CVE-2026-68399 bsc#1274897 - commit f292dee - mm/khugepaged: write all dirty file folios when collapsing (CVE-2026-68086 bsc#1274713). - mm: do file ownership checks with the proper mount idmap (CVE-2026-64294 bsc#1273525). - commit f51c03e - RDMA/bnxt_re: Initialize dpi variable to zero (CVE-2026-72501 bsc#1276546) - commit 96ae592 - RDMA/mlx5: Fix integer overflow of user QP buffer size (git-fixes) - commit bf319d0 - RDMA/mlx5: Fix undefined shift of user RQ WQE size (CVE-2026-74297 bsc#1276446) - commit 2405696 - tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) (CVE-2026-72502 bsc#1276542) - commit d5fcc0a - RDMA/bnxt_re: Free CQ toggle page after firmware teardown (CVE-2026-72499 bsc#1276551) - commit bc68cf8 - RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one (CVE-2026-74296 bsc#1276452) - commit 0b880c1 - drm/i915/vrr: require valid min/max vfreq for VRR (bsc#1275150 CVE-2026-68254) - commit af4efa2 - drm/i915/bios: range check LFP Data Block panel_type2 (bsc#1275817 CVE-2026-68247) - commit 7dc2646 - tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713 CVE-2026-53273) - commit 81906bc - ethtool: rss: fix hkey leak when indir_size is 0 (git-fixes). - commit 2c4a34c - nvmem: layouts: onie-tlv: fix hang on unknown types (CVE-2026-53336 bsc#1270108). - commit 399f938 - rpmsg: glink: smem: order FIFO read after availability check (git-fixes). - rpmsg: core: Fix incorrect return value documentation (git-fixes). - remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev (git-fixes). - remoteproc: qcom_q6v5_adsp: Fix reference leak for device node (git-fixes). - remoteproc: scp: Fix device reference leak on failed lookup (git-fixes). - tty: clear cdev pointer after cdev_add() failure (git-fixes). - tty: skip cdev_del() when no cdev is registered (git-fixes). - serial: core: clear freed pointers on uart_register_driver() failure (git-fixes). - serial: amba-pl011: unprepare console clock on unregister (git-fixes). - tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 (git-fixes). - usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() (git-fixes). - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (git-fixes). - usb: gadget: u_audio: Fix use-after-free on sound card disconnect (git-fixes). - USB: c67x00: fix use-after-free in c67x00_add_iso_urb() (git-fixes). - usb: gadget: snps_udc_plat: clean up PHY on probe deferral (git-fixes). - usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() (git-fixes). - usb: dwc2: gadget: Exit partial power down state when changing USB pull-up (git-fixes). - usb: gadget: f_fs: Prevent deadlock during ep0 read loop (git-fixes). - usb: xhci: Handle USB3 port events when there is one roothub (git-fixes). - xhci: dbgtty: Fix unregister on tty_alloc_driver() failure (git-fixes). - xhci: dbgtty: Fix unregister on tty_register_driver() failure (git-fixes). - USB: serial: option: fix slab OOB read in interrupt URB callback (git-fixes). - USB: serial: digi_acceleport: fix port registration order (git-fixes). - USB: serial: spcp8x5: drop broken carrier detect support (git-fixes). - USB: phy: fsl-usb: fix missing static keywords (git-fixes). - usb: gadget: f_uac1_legacy: remove broken string configfs attributes (git-fixes). - docs: admin-guide: thunderbolt: fix sentence structure (git-fixes). - usb: renesas_usbhs: Fix power-off ordering on unbind (git-fixes). - usb: mtu3: allow system suspend during active gadget connection (git-fixes). - usb: dwc2: add missing @remotewakeup kernel-doc parameter (git-fixes). - usb: gadget: pch_udc: remove excess kernel-doc member for registered (git-fixes). - usb: gadget: configfs: fix out-of-bounds read of qw_sign (git-fixes). - usb: gadget: uac: validate rate list length before storing (git-fixes). - usb: gadget: r8a66597: avoid double free of ep0_req in probe error path (git-fixes). - usb: typec: ucsi: unregister debugfs entries on teardown (git-fixes). - staging: rtl8723bs: use kfree_sensitive() for key material (git-fixes). - staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() (git-fixes). - staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown (git-fixes). - staging: fbtft: Use sysfs_emit_at() to print to sysfs file (git-fixes). - staging: sm750fb: gate dualview dataflow using g_dualview (git-fixes). - hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() (git-fixes). - interconnect: Fix use after free in icc_get() and of_icc_get_by_index() (git-fixes). - iio: light: cm32181: return zero after writing calibscale (git-fixes). - iio: light: tsl2583: return zero in write_raw() on success (git-fixes). - iio: light: isl29028: return zero in write_raw() on success (git-fixes). - iio: light: tsl2772: fix ALS calibscale readback (git-fixes). - iio: chemical: sgp30: Handle IAQ thread creation failure (git-fixes). - iio: pressure: mpl115: Fix runtime PM cleanup (git-fixes). - iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE (git-fixes). - iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure (git-fixes). - iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF (git-fixes). - iio: light: gp2ap002: re-enable irq if runtime suspend fails (git-fixes). - iio: gyro: mpu3050: fix sign of raw angular velocity readings (git-fixes). - iio: srf04: fix pm_runtime handling on probe error path (git-fixes). - iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable (git-fixes). - iio: pressure: dps310: fix NULL pointer dereference on ACPI probe (git-fixes). - iio: light: gp2ap002: Disable regulators on resume failure (git-fixes). - iio: dac: m62332: Fix regulator reference count imbalance (git-fixes). - iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() (git-fixes). - bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET (git-fixes). - bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation (git-fixes). - w1: ds2482: Fix signedness bug in ds2482_w1_triplet() (git-fixes). - w1: ds28e17: reject an oversize length on an I2C block read (git-fixes). - fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write (git-fixes). - fpga: dfl: fme: add error handling (git-fixes). - fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration (git-fixes). - misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() (git-fixes). - ppdev: prevent overflow when setting port timeout (git-fixes). - cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64) (git-fixes). - misc: rtsx: add missing write register handling (git-fixes). - misc: bcm-vk: Use acquire/release for msgq_inited (git-fixes). - accessibility: speakup: unregister tty ldisc on later init failures (git-fixes). - speakup: keyhelp: guard letter_offsets possible out-of-range indexing (git-fixes). - accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() (git-fixes). - uio: Fix stale info pointer in failed registration path (git-fixes). - tlclk: if sscanf() fails, fall back to 0, not random value (git-fixes). - commit f33c0d4 ++++ kernel-rt: - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() (CVE-2026-68160 bsc#1275472). - commit 963c7cf - virtiofs: fix UAF on submount umount (CVE-2026-53381 bsc#1271830). - commit 0d527d2 - Fix incorrect bsc/CVE reference in patches.suse/bpf-Fix-UAF-in-sock-clone-early-bailouts.patch Correct is: CVE-2026-68399 bsc#1274897 - commit f292dee - mm/khugepaged: write all dirty file folios when collapsing (CVE-2026-68086 bsc#1274713). - mm: do file ownership checks with the proper mount idmap (CVE-2026-64294 bsc#1273525). - commit f51c03e - RDMA/bnxt_re: Initialize dpi variable to zero (CVE-2026-72501 bsc#1276546) - commit 96ae592 - RDMA/mlx5: Fix integer overflow of user QP buffer size (git-fixes) - commit bf319d0 - RDMA/mlx5: Fix undefined shift of user RQ WQE size (CVE-2026-74297 bsc#1276446) - commit 2405696 - tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) (CVE-2026-72502 bsc#1276542) - commit d5fcc0a - RDMA/bnxt_re: Free CQ toggle page after firmware teardown (CVE-2026-72499 bsc#1276551) - commit bc68cf8 - RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one (CVE-2026-74296 bsc#1276452) - commit 0b880c1 - drm/i915/vrr: require valid min/max vfreq for VRR (bsc#1275150 CVE-2026-68254) - commit af4efa2 - drm/i915/bios: range check LFP Data Block panel_type2 (bsc#1275817 CVE-2026-68247) - commit 7dc2646 - tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713 CVE-2026-53273) - commit 81906bc - ethtool: rss: fix hkey leak when indir_size is 0 (git-fixes). - commit 2c4a34c - nvmem: layouts: onie-tlv: fix hang on unknown types (CVE-2026-53336 bsc#1270108). - commit 399f938 - rpmsg: glink: smem: order FIFO read after availability check (git-fixes). - rpmsg: core: Fix incorrect return value documentation (git-fixes). - remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev (git-fixes). - remoteproc: qcom_q6v5_adsp: Fix reference leak for device node (git-fixes). - remoteproc: scp: Fix device reference leak on failed lookup (git-fixes). - tty: clear cdev pointer after cdev_add() failure (git-fixes). - tty: skip cdev_del() when no cdev is registered (git-fixes). - serial: core: clear freed pointers on uart_register_driver() failure (git-fixes). - serial: amba-pl011: unprepare console clock on unregister (git-fixes). - tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 (git-fixes). - usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() (git-fixes). - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (git-fixes). - usb: gadget: u_audio: Fix use-after-free on sound card disconnect (git-fixes). - USB: c67x00: fix use-after-free in c67x00_add_iso_urb() (git-fixes). - usb: gadget: snps_udc_plat: clean up PHY on probe deferral (git-fixes). - usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() (git-fixes). - usb: dwc2: gadget: Exit partial power down state when changing USB pull-up (git-fixes). - usb: gadget: f_fs: Prevent deadlock during ep0 read loop (git-fixes). - usb: xhci: Handle USB3 port events when there is one roothub (git-fixes). - xhci: dbgtty: Fix unregister on tty_alloc_driver() failure (git-fixes). - xhci: dbgtty: Fix unregister on tty_register_driver() failure (git-fixes). - USB: serial: option: fix slab OOB read in interrupt URB callback (git-fixes). - USB: serial: digi_acceleport: fix port registration order (git-fixes). - USB: serial: spcp8x5: drop broken carrier detect support (git-fixes). - USB: phy: fsl-usb: fix missing static keywords (git-fixes). - usb: gadget: f_uac1_legacy: remove broken string configfs attributes (git-fixes). - docs: admin-guide: thunderbolt: fix sentence structure (git-fixes). - usb: renesas_usbhs: Fix power-off ordering on unbind (git-fixes). - usb: mtu3: allow system suspend during active gadget connection (git-fixes). - usb: dwc2: add missing @remotewakeup kernel-doc parameter (git-fixes). - usb: gadget: pch_udc: remove excess kernel-doc member for registered (git-fixes). - usb: gadget: configfs: fix out-of-bounds read of qw_sign (git-fixes). - usb: gadget: uac: validate rate list length before storing (git-fixes). - usb: gadget: r8a66597: avoid double free of ep0_req in probe error path (git-fixes). - usb: typec: ucsi: unregister debugfs entries on teardown (git-fixes). - staging: rtl8723bs: use kfree_sensitive() for key material (git-fixes). - staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() (git-fixes). - staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown (git-fixes). - staging: fbtft: Use sysfs_emit_at() to print to sysfs file (git-fixes). - staging: sm750fb: gate dualview dataflow using g_dualview (git-fixes). - hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() (git-fixes). - interconnect: Fix use after free in icc_get() and of_icc_get_by_index() (git-fixes). - iio: light: cm32181: return zero after writing calibscale (git-fixes). - iio: light: tsl2583: return zero in write_raw() on success (git-fixes). - iio: light: isl29028: return zero in write_raw() on success (git-fixes). - iio: light: tsl2772: fix ALS calibscale readback (git-fixes). - iio: chemical: sgp30: Handle IAQ thread creation failure (git-fixes). - iio: pressure: mpl115: Fix runtime PM cleanup (git-fixes). - iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE (git-fixes). - iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure (git-fixes). - iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF (git-fixes). - iio: light: gp2ap002: re-enable irq if runtime suspend fails (git-fixes). - iio: gyro: mpu3050: fix sign of raw angular velocity readings (git-fixes). - iio: srf04: fix pm_runtime handling on probe error path (git-fixes). - iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable (git-fixes). - iio: pressure: dps310: fix NULL pointer dereference on ACPI probe (git-fixes). - iio: light: gp2ap002: Disable regulators on resume failure (git-fixes). - iio: dac: m62332: Fix regulator reference count imbalance (git-fixes). - iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() (git-fixes). - bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET (git-fixes). - bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation (git-fixes). - w1: ds2482: Fix signedness bug in ds2482_w1_triplet() (git-fixes). - w1: ds28e17: reject an oversize length on an I2C block read (git-fixes). - fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write (git-fixes). - fpga: dfl: fme: add error handling (git-fixes). - fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration (git-fixes). - misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() (git-fixes). - ppdev: prevent overflow when setting port timeout (git-fixes). - cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64) (git-fixes). - misc: rtsx: add missing write register handling (git-fixes). - misc: bcm-vk: Use acquire/release for msgq_inited (git-fixes). - accessibility: speakup: unregister tty ldisc on later init failures (git-fixes). - speakup: keyhelp: guard letter_offsets possible out-of-range indexing (git-fixes). - accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() (git-fixes). - uio: Fix stale info pointer in failed registration path (git-fixes). - tlclk: if sscanf() fails, fall back to 0, not random value (git-fixes). - commit f33c0d4 ++++ kernel-rt_debug: - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() (CVE-2026-68160 bsc#1275472). - commit 963c7cf - virtiofs: fix UAF on submount umount (CVE-2026-53381 bsc#1271830). - commit 0d527d2 - Fix incorrect bsc/CVE reference in patches.suse/bpf-Fix-UAF-in-sock-clone-early-bailouts.patch Correct is: CVE-2026-68399 bsc#1274897 - commit f292dee - mm/khugepaged: write all dirty file folios when collapsing (CVE-2026-68086 bsc#1274713). - mm: do file ownership checks with the proper mount idmap (CVE-2026-64294 bsc#1273525). - commit f51c03e - RDMA/bnxt_re: Initialize dpi variable to zero (CVE-2026-72501 bsc#1276546) - commit 96ae592 - RDMA/mlx5: Fix integer overflow of user QP buffer size (git-fixes) - commit bf319d0 - RDMA/mlx5: Fix undefined shift of user RQ WQE size (CVE-2026-74297 bsc#1276446) - commit 2405696 - tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) (CVE-2026-72502 bsc#1276542) - commit d5fcc0a - RDMA/bnxt_re: Free CQ toggle page after firmware teardown (CVE-2026-72499 bsc#1276551) - commit bc68cf8 - RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one (CVE-2026-74296 bsc#1276452) - commit 0b880c1 - drm/i915/vrr: require valid min/max vfreq for VRR (bsc#1275150 CVE-2026-68254) - commit af4efa2 - drm/i915/bios: range check LFP Data Block panel_type2 (bsc#1275817 CVE-2026-68247) - commit 7dc2646 - tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713 CVE-2026-53273) - commit 81906bc - ethtool: rss: fix hkey leak when indir_size is 0 (git-fixes). - commit 2c4a34c - nvmem: layouts: onie-tlv: fix hang on unknown types (CVE-2026-53336 bsc#1270108). - commit 399f938 - rpmsg: glink: smem: order FIFO read after availability check (git-fixes). - rpmsg: core: Fix incorrect return value documentation (git-fixes). - remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev (git-fixes). - remoteproc: qcom_q6v5_adsp: Fix reference leak for device node (git-fixes). - remoteproc: scp: Fix device reference leak on failed lookup (git-fixes). - tty: clear cdev pointer after cdev_add() failure (git-fixes). - tty: skip cdev_del() when no cdev is registered (git-fixes). - serial: core: clear freed pointers on uart_register_driver() failure (git-fixes). - serial: amba-pl011: unprepare console clock on unregister (git-fixes). - tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 (git-fixes). - usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() (git-fixes). - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (git-fixes). - usb: gadget: u_audio: Fix use-after-free on sound card disconnect (git-fixes). - USB: c67x00: fix use-after-free in c67x00_add_iso_urb() (git-fixes). - usb: gadget: snps_udc_plat: clean up PHY on probe deferral (git-fixes). - usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() (git-fixes). - usb: dwc2: gadget: Exit partial power down state when changing USB pull-up (git-fixes). - usb: gadget: f_fs: Prevent deadlock during ep0 read loop (git-fixes). - usb: xhci: Handle USB3 port events when there is one roothub (git-fixes). - xhci: dbgtty: Fix unregister on tty_alloc_driver() failure (git-fixes). - xhci: dbgtty: Fix unregister on tty_register_driver() failure (git-fixes). - USB: serial: option: fix slab OOB read in interrupt URB callback (git-fixes). - USB: serial: digi_acceleport: fix port registration order (git-fixes). - USB: serial: spcp8x5: drop broken carrier detect support (git-fixes). - USB: phy: fsl-usb: fix missing static keywords (git-fixes). - usb: gadget: f_uac1_legacy: remove broken string configfs attributes (git-fixes). - docs: admin-guide: thunderbolt: fix sentence structure (git-fixes). - usb: renesas_usbhs: Fix power-off ordering on unbind (git-fixes). - usb: mtu3: allow system suspend during active gadget connection (git-fixes). - usb: dwc2: add missing @remotewakeup kernel-doc parameter (git-fixes). - usb: gadget: pch_udc: remove excess kernel-doc member for registered (git-fixes). - usb: gadget: configfs: fix out-of-bounds read of qw_sign (git-fixes). - usb: gadget: uac: validate rate list length before storing (git-fixes). - usb: gadget: r8a66597: avoid double free of ep0_req in probe error path (git-fixes). - usb: typec: ucsi: unregister debugfs entries on teardown (git-fixes). - staging: rtl8723bs: use kfree_sensitive() for key material (git-fixes). - staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() (git-fixes). - staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown (git-fixes). - staging: fbtft: Use sysfs_emit_at() to print to sysfs file (git-fixes). - staging: sm750fb: gate dualview dataflow using g_dualview (git-fixes). - hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() (git-fixes). - interconnect: Fix use after free in icc_get() and of_icc_get_by_index() (git-fixes). - iio: light: cm32181: return zero after writing calibscale (git-fixes). - iio: light: tsl2583: return zero in write_raw() on success (git-fixes). - iio: light: isl29028: return zero in write_raw() on success (git-fixes). - iio: light: tsl2772: fix ALS calibscale readback (git-fixes). - iio: chemical: sgp30: Handle IAQ thread creation failure (git-fixes). - iio: pressure: mpl115: Fix runtime PM cleanup (git-fixes). - iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE (git-fixes). - iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure (git-fixes). - iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF (git-fixes). - iio: light: gp2ap002: re-enable irq if runtime suspend fails (git-fixes). - iio: gyro: mpu3050: fix sign of raw angular velocity readings (git-fixes). - iio: srf04: fix pm_runtime handling on probe error path (git-fixes). - iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable (git-fixes). - iio: pressure: dps310: fix NULL pointer dereference on ACPI probe (git-fixes). - iio: light: gp2ap002: Disable regulators on resume failure (git-fixes). - iio: dac: m62332: Fix regulator reference count imbalance (git-fixes). - iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() (git-fixes). - bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET (git-fixes). - bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation (git-fixes). - w1: ds2482: Fix signedness bug in ds2482_w1_triplet() (git-fixes). - w1: ds28e17: reject an oversize length on an I2C block read (git-fixes). - fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write (git-fixes). - fpga: dfl: fme: add error handling (git-fixes). - fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration (git-fixes). - misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() (git-fixes). - ppdev: prevent overflow when setting port timeout (git-fixes). - cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64) (git-fixes). - misc: rtsx: add missing write register handling (git-fixes). - misc: bcm-vk: Use acquire/release for msgq_inited (git-fixes). - accessibility: speakup: unregister tty ldisc on later init failures (git-fixes). - speakup: keyhelp: guard letter_offsets possible out-of-range indexing (git-fixes). - accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() (git-fixes). - uio: Fix stale info pointer in failed registration path (git-fixes). - tlclk: if sscanf() fails, fall back to 0, not random value (git-fixes). - commit f33c0d4 ++++ bzip2: - Fix CVE-2026-42250, off‑by‑one error in the bzip2recover utility when processing a specially crafted file can lead to a crash (bsc#1266786) * CVE-2026-42250.patch ------------------------------------------------------------------ ------------------ 2026-8-25 - Aug 25 2026 ------------------- ------------------------------------------------------------------ ++++ busybox: - Fix stack exhaustion in the ash applet caused by unbounded shell function recursion (CVE-2026-38755, bsc#1271548) * ash-fix-evalfun.patch - Fix out-of-bounds read in the ash applet caused by stale IFS split state left behind when an expansion error longjmps out of expandarg() (CVE-2026-38754, bsc#1271547) * 0001-ash-fix-out-of-bounds-read-in-ifsbreakup.patch - Fix use-after-free in the awk applet when the regexp argument of sub()/gsub()/gensub() modifies the variable holding the replacement text (CVE-2026-38753, bsc#1271545) * awk-fix-use-after-free-sub.patch ++++ kernel-default: - smb: client: reject overlapping data areas in SMB2 responses (git-fixes). - commit 7c43787 - kernel-source: Recommend libdw-devel (bsc#1276665) - commit b0e41fa - audit: fix potential use-after-free in audit_del_rule() (CVE-2026-74512 bsc#1275954). - commit 1451136 - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (CVE-2026-64378 bsc#1273603). - commit 0f85e86 - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (bsc#1274663 CVE-2026-68312). - commit 1bf7e77 - smb: client: validate DFS referral PathConsumed (bsc#1274629 CVE-2026-68343). - commit 195e45d - smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982 CVE-2026-64448). - commit 954eb9f - smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061 CVE-2026-64388). - commit feb55be - smb: client: fix double-free in SMB2_close() replay (bsc#1274297 CVE-2026-64597). - commit 65230b6 - smb/client: Fix error code in smb2_aead_req_alloc() (bsc#1274298 CVE-2026-64598). - commit 1a11843 - smb: client: fix krb5 mount with username option (bsc#1261788 CVE-2026-31392). - commit ace8b3a - smb/client: handle overlapping allocated ranges in fallocate (bsc#1274902). - commit 8496095 - fou: Fix use-after-free in fou_create() (CVE-2026-74496 bsc#1275867). - gtp: check skb_pull_data() return in gtp1u_send_echo_resp() (CVE-2026-64577 bsc#1274031). - net/iucv: take a reference on the socket found in afiucv_hs_rcv() (CVE-2026-68397 bsc#1274898). - commit 81e7b26 - ibmvnic: Only record tx completed bytes once per handler (bsc#1274620). - commit a4bb612 - octeontx2-af: Block VFs from clobbering special CGX PKIND state (CVE-2026-74527 bsc#1275805). - keys: make keyring key-chunk byte order agree with keyring_diff_objects() (CVE-2026-74566 bsc#1275566). - keys: fix out-of-bounds read in keyring_get_key_chunk() (CVE-2026-74567 bsc#1275569). - drop_monitor: perform u64_stats updates under IRQ-disabled section (CVE-2026-68286 bsc#1275973). - net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD (CVE-2026-68288 bsc#1275975). - tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() (CVE-2026-68289 bsc#1275976). - tipc: fix u16 MTU truncation in media and bearer MTU validation (CVE-2026-68297 bsc#1275040). - ila: reload IPv6 header after pskb_may_pull in checksum adjust (CVE-2026-68127 bsc#1275237). - tipc: fix infinite loop in __tipc_nl_compat_dumpit (CVE-2026-68313 bsc#1274665). - bpf: Fix UAF in sock clone early bailouts (CVE-2026-45897 bsc#1266897). - netfilter: ebtables: terminate table name before find_table_lock() (CVE-2026-64411 bsc#1274077). - net: psample: fix info leak in PSAMPLE_ATTR_DATA (CVE-2026-64553 bsc#1273336). - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() (CVE-2026-64548 bsc#1273337). - net: ife: require ETH_HLEN to be pullable in ife_decode() (CVE-2026-72296 bsc#1275923). - crypto: caam - use print_hex_dump_devel to guard key hex dumps (CVE-2026-64315 bsc#1274028). - crypto: caam - use print_hex_dump_devel to guard key hex dumps (CVE-2026-64316 bsc#1273598). - netlabel: validate unlabeled address and mask attribute lengths (CVE-2026-53238 bsc#1269774). - pds_core: fix error handling in pdsc_devcmd_wait (CVE-2026-64148 bsc#1273956). - pds_core: check health in devcmd wait (CVE-2026-64148 bsc#1273956). - commit bb8f560 - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CVE-2026-72289 bsc#1275905). - commit ad770b0 - x86/mitigations: Fix erroneous text We still continue to not have syscall hardening but the existing text can mislead a user into thinking there is some mitigation applied even if mitigations=off. Let's just backport Josh's patch which changes the text to state that we are vulnerable by default. - x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (git-fixes). - blacklist.conf: - Refresh patches.suse/x86-bugs-Fix-BHI-retpoline-check.patch. - commit fa5789a - mm/memory: fix spurious warning when unmapping device-private/exclusive pages (CVE-2026-64131 bsc#1274063). - commit 74a59a1 - net: gro: fix double aggregation of flush-marked skbs (CVE-2026-68136 bsc#1275474). - commit fd3cbed - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (CVE-2026-72288 bsc#1275886). - commit d47e8e0 - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516 bsc#1275797). - commit a6fccc3 - packet: use consistent hard_header_len in non-ring send paths (bsc#1275784 CVE-2026-74582). - commit 876310a - Bluetooth: mgmt: fix UAF in pair command cancellation (CVE-2026-74510 bsc#1275950). - Refresh patches.kabi/hci_dev-centralize-extra-lock.patch. - commit 7329a04 - dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal (git-fixes). - dmaengine: dw-edma: Initialize IRQ data before requesting IRQs (git-fixes). - dmaengine: dw-edma: Clear stale requests on termination (git-fixes). - dmaengine: dw-edma: Serialize channel state checks (git-fixes). - dmaengine: dw-edma: Complete descriptors before pausing (git-fixes). - dmaengine: dw-edma: Serialize abort state updates (git-fixes). - dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout (git-fixes). - dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe (git-fixes). - dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers (git-fixes). - dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure (git-fixes). - phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs (git-fixes). - phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend (git-fixes). - phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table (git-fixes). - phy: sunplus: fix error handling in sp_uphy_init() (git-fixes). - soundwire: qcom: Fix port exhaustion check in stream_alloc_ports (git-fixes). - platform/x86: ISST: Just allow 2 bits for SST feature enable (git-fixes). - platform/x86: ISST: Validate logical CPU id and clos id (git-fixes). - platform/x86: ISST: Validate level in perf mask ioctls (git-fixes). - platform/x86: ISST: Validate socket ID in clos_assoc ioctl (git-fixes). - platform/x86: dell-wmi-sysman: Fix instance ID bounds (git-fixes). - platform/surface: acpi-notify: Check ACPI companion before use (git-fixes). - platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL (git-fixes). - platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path (git-fixes). - platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer (git-fixes). - platform/x86: dell-wmi-base: Fix resource leak on module load failure (git-fixes). - platform/x86: dell-privacy: Fix race condition (git-fixes). - mailbox: qcom-ipcc: fix duplicate channel allocation across holes (git-fixes). - mailbox: rockchip: disable pclk on probe failure and unbind (git-fixes). - i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure (git-fixes). - i2c: ocores: Disable clock on failed resume (git-fixes). - pinctrl: rockchip: Reset the pin count when recalculating SoC data (git-fixes). - pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip (git-fixes). - pinctrl: bcm2835: Don't remove an unregistered GPIO chip (git-fixes). - commit b2fc3ea ++++ kernel-rt: - smb: client: reject overlapping data areas in SMB2 responses (git-fixes). - commit 7c43787 - kernel-source: Recommend libdw-devel (bsc#1276665) - commit b0e41fa - audit: fix potential use-after-free in audit_del_rule() (CVE-2026-74512 bsc#1275954). - commit 1451136 - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (CVE-2026-64378 bsc#1273603). - commit 0f85e86 - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (bsc#1274663 CVE-2026-68312). - commit 1bf7e77 - smb: client: validate DFS referral PathConsumed (bsc#1274629 CVE-2026-68343). - commit 195e45d - smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982 CVE-2026-64448). - commit 954eb9f - smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061 CVE-2026-64388). - commit feb55be - smb: client: fix double-free in SMB2_close() replay (bsc#1274297 CVE-2026-64597). - commit 65230b6 - smb/client: Fix error code in smb2_aead_req_alloc() (bsc#1274298 CVE-2026-64598). - commit 1a11843 - smb: client: fix krb5 mount with username option (bsc#1261788 CVE-2026-31392). - commit ace8b3a - smb/client: handle overlapping allocated ranges in fallocate (bsc#1274902). - commit 8496095 - fou: Fix use-after-free in fou_create() (CVE-2026-74496 bsc#1275867). - gtp: check skb_pull_data() return in gtp1u_send_echo_resp() (CVE-2026-64577 bsc#1274031). - net/iucv: take a reference on the socket found in afiucv_hs_rcv() (CVE-2026-68397 bsc#1274898). - commit 81e7b26 - ibmvnic: Only record tx completed bytes once per handler (bsc#1274620). - commit a4bb612 - octeontx2-af: Block VFs from clobbering special CGX PKIND state (CVE-2026-74527 bsc#1275805). - keys: make keyring key-chunk byte order agree with keyring_diff_objects() (CVE-2026-74566 bsc#1275566). - keys: fix out-of-bounds read in keyring_get_key_chunk() (CVE-2026-74567 bsc#1275569). - drop_monitor: perform u64_stats updates under IRQ-disabled section (CVE-2026-68286 bsc#1275973). - net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD (CVE-2026-68288 bsc#1275975). - tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() (CVE-2026-68289 bsc#1275976). - tipc: fix u16 MTU truncation in media and bearer MTU validation (CVE-2026-68297 bsc#1275040). - ila: reload IPv6 header after pskb_may_pull in checksum adjust (CVE-2026-68127 bsc#1275237). - tipc: fix infinite loop in __tipc_nl_compat_dumpit (CVE-2026-68313 bsc#1274665). - bpf: Fix UAF in sock clone early bailouts (CVE-2026-45897 bsc#1266897). - netfilter: ebtables: terminate table name before find_table_lock() (CVE-2026-64411 bsc#1274077). - net: psample: fix info leak in PSAMPLE_ATTR_DATA (CVE-2026-64553 bsc#1273336). - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() (CVE-2026-64548 bsc#1273337). - net: ife: require ETH_HLEN to be pullable in ife_decode() (CVE-2026-72296 bsc#1275923). - crypto: caam - use print_hex_dump_devel to guard key hex dumps (CVE-2026-64315 bsc#1274028). - crypto: caam - use print_hex_dump_devel to guard key hex dumps (CVE-2026-64316 bsc#1273598). - netlabel: validate unlabeled address and mask attribute lengths (CVE-2026-53238 bsc#1269774). - pds_core: fix error handling in pdsc_devcmd_wait (CVE-2026-64148 bsc#1273956). - pds_core: check health in devcmd wait (CVE-2026-64148 bsc#1273956). - commit bb8f560 - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CVE-2026-72289 bsc#1275905). - commit ad770b0 - x86/mitigations: Fix erroneous text We still continue to not have syscall hardening but the existing text can mislead a user into thinking there is some mitigation applied even if mitigations=off. Let's just backport Josh's patch which changes the text to state that we are vulnerable by default. - x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (git-fixes). - blacklist.conf: - Refresh patches.suse/x86-bugs-Fix-BHI-retpoline-check.patch. - commit fa5789a - mm/memory: fix spurious warning when unmapping device-private/exclusive pages (CVE-2026-64131 bsc#1274063). - commit 74a59a1 - net: gro: fix double aggregation of flush-marked skbs (CVE-2026-68136 bsc#1275474). - commit fd3cbed - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (CVE-2026-72288 bsc#1275886). - commit d47e8e0 - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516 bsc#1275797). - commit a6fccc3 - packet: use consistent hard_header_len in non-ring send paths (bsc#1275784 CVE-2026-74582). - commit 876310a - Bluetooth: mgmt: fix UAF in pair command cancellation (CVE-2026-74510 bsc#1275950). - Refresh patches.kabi/hci_dev-centralize-extra-lock.patch. - commit 7329a04 - dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal (git-fixes). - dmaengine: dw-edma: Initialize IRQ data before requesting IRQs (git-fixes). - dmaengine: dw-edma: Clear stale requests on termination (git-fixes). - dmaengine: dw-edma: Serialize channel state checks (git-fixes). - dmaengine: dw-edma: Complete descriptors before pausing (git-fixes). - dmaengine: dw-edma: Serialize abort state updates (git-fixes). - dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout (git-fixes). - dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe (git-fixes). - dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers (git-fixes). - dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure (git-fixes). - phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs (git-fixes). - phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend (git-fixes). - phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table (git-fixes). - phy: sunplus: fix error handling in sp_uphy_init() (git-fixes). - soundwire: qcom: Fix port exhaustion check in stream_alloc_ports (git-fixes). - platform/x86: ISST: Just allow 2 bits for SST feature enable (git-fixes). - platform/x86: ISST: Validate logical CPU id and clos id (git-fixes). - platform/x86: ISST: Validate level in perf mask ioctls (git-fixes). - platform/x86: ISST: Validate socket ID in clos_assoc ioctl (git-fixes). - platform/x86: dell-wmi-sysman: Fix instance ID bounds (git-fixes). - platform/surface: acpi-notify: Check ACPI companion before use (git-fixes). - platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL (git-fixes). - platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path (git-fixes). - platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer (git-fixes). - platform/x86: dell-wmi-base: Fix resource leak on module load failure (git-fixes). - platform/x86: dell-privacy: Fix race condition (git-fixes). - mailbox: qcom-ipcc: fix duplicate channel allocation across holes (git-fixes). - mailbox: rockchip: disable pclk on probe failure and unbind (git-fixes). - i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure (git-fixes). - i2c: ocores: Disable clock on failed resume (git-fixes). - pinctrl: rockchip: Reset the pin count when recalculating SoC data (git-fixes). - pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip (git-fixes). - pinctrl: bcm2835: Don't remove an unregistered GPIO chip (git-fixes). - commit b2fc3ea ++++ kernel-rt_debug: - smb: client: reject overlapping data areas in SMB2 responses (git-fixes). - commit 7c43787 - kernel-source: Recommend libdw-devel (bsc#1276665) - commit b0e41fa - audit: fix potential use-after-free in audit_del_rule() (CVE-2026-74512 bsc#1275954). - commit 1451136 - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (CVE-2026-64378 bsc#1273603). - commit 0f85e86 - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (bsc#1274663 CVE-2026-68312). - commit 1bf7e77 - smb: client: validate DFS referral PathConsumed (bsc#1274629 CVE-2026-68343). - commit 195e45d - smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982 CVE-2026-64448). - commit 954eb9f - smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061 CVE-2026-64388). - commit feb55be - smb: client: fix double-free in SMB2_close() replay (bsc#1274297 CVE-2026-64597). - commit 65230b6 - smb/client: Fix error code in smb2_aead_req_alloc() (bsc#1274298 CVE-2026-64598). - commit 1a11843 - smb: client: fix krb5 mount with username option (bsc#1261788 CVE-2026-31392). - commit ace8b3a - smb/client: handle overlapping allocated ranges in fallocate (bsc#1274902). - commit 8496095 - fou: Fix use-after-free in fou_create() (CVE-2026-74496 bsc#1275867). - gtp: check skb_pull_data() return in gtp1u_send_echo_resp() (CVE-2026-64577 bsc#1274031). - net/iucv: take a reference on the socket found in afiucv_hs_rcv() (CVE-2026-68397 bsc#1274898). - commit 81e7b26 - ibmvnic: Only record tx completed bytes once per handler (bsc#1274620). - commit a4bb612 - octeontx2-af: Block VFs from clobbering special CGX PKIND state (CVE-2026-74527 bsc#1275805). - keys: make keyring key-chunk byte order agree with keyring_diff_objects() (CVE-2026-74566 bsc#1275566). - keys: fix out-of-bounds read in keyring_get_key_chunk() (CVE-2026-74567 bsc#1275569). - drop_monitor: perform u64_stats updates under IRQ-disabled section (CVE-2026-68286 bsc#1275973). - net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD (CVE-2026-68288 bsc#1275975). - tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() (CVE-2026-68289 bsc#1275976). - tipc: fix u16 MTU truncation in media and bearer MTU validation (CVE-2026-68297 bsc#1275040). - ila: reload IPv6 header after pskb_may_pull in checksum adjust (CVE-2026-68127 bsc#1275237). - tipc: fix infinite loop in __tipc_nl_compat_dumpit (CVE-2026-68313 bsc#1274665). - bpf: Fix UAF in sock clone early bailouts (CVE-2026-45897 bsc#1266897). - netfilter: ebtables: terminate table name before find_table_lock() (CVE-2026-64411 bsc#1274077). - net: psample: fix info leak in PSAMPLE_ATTR_DATA (CVE-2026-64553 bsc#1273336). - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() (CVE-2026-64548 bsc#1273337). - net: ife: require ETH_HLEN to be pullable in ife_decode() (CVE-2026-72296 bsc#1275923). - crypto: caam - use print_hex_dump_devel to guard key hex dumps (CVE-2026-64315 bsc#1274028). - crypto: caam - use print_hex_dump_devel to guard key hex dumps (CVE-2026-64316 bsc#1273598). - netlabel: validate unlabeled address and mask attribute lengths (CVE-2026-53238 bsc#1269774). - pds_core: fix error handling in pdsc_devcmd_wait (CVE-2026-64148 bsc#1273956). - pds_core: check health in devcmd wait (CVE-2026-64148 bsc#1273956). - commit bb8f560 - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CVE-2026-72289 bsc#1275905). - commit ad770b0 - x86/mitigations: Fix erroneous text We still continue to not have syscall hardening but the existing text can mislead a user into thinking there is some mitigation applied even if mitigations=off. Let's just backport Josh's patch which changes the text to state that we are vulnerable by default. - x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (git-fixes). - blacklist.conf: - Refresh patches.suse/x86-bugs-Fix-BHI-retpoline-check.patch. - commit fa5789a - mm/memory: fix spurious warning when unmapping device-private/exclusive pages (CVE-2026-64131 bsc#1274063). - commit 74a59a1 - net: gro: fix double aggregation of flush-marked skbs (CVE-2026-68136 bsc#1275474). - commit fd3cbed - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (CVE-2026-72288 bsc#1275886). - commit d47e8e0 - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516 bsc#1275797). - commit a6fccc3 - packet: use consistent hard_header_len in non-ring send paths (bsc#1275784 CVE-2026-74582). - commit 876310a - Bluetooth: mgmt: fix UAF in pair command cancellation (CVE-2026-74510 bsc#1275950). - Refresh patches.kabi/hci_dev-centralize-extra-lock.patch. - commit 7329a04 - dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal (git-fixes). - dmaengine: dw-edma: Initialize IRQ data before requesting IRQs (git-fixes). - dmaengine: dw-edma: Clear stale requests on termination (git-fixes). - dmaengine: dw-edma: Serialize channel state checks (git-fixes). - dmaengine: dw-edma: Complete descriptors before pausing (git-fixes). - dmaengine: dw-edma: Serialize abort state updates (git-fixes). - dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout (git-fixes). - dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe (git-fixes). - dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers (git-fixes). - dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure (git-fixes). - phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs (git-fixes). - phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend (git-fixes). - phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table (git-fixes). - phy: sunplus: fix error handling in sp_uphy_init() (git-fixes). - soundwire: qcom: Fix port exhaustion check in stream_alloc_ports (git-fixes). - platform/x86: ISST: Just allow 2 bits for SST feature enable (git-fixes). - platform/x86: ISST: Validate logical CPU id and clos id (git-fixes). - platform/x86: ISST: Validate level in perf mask ioctls (git-fixes). - platform/x86: ISST: Validate socket ID in clos_assoc ioctl (git-fixes). - platform/x86: dell-wmi-sysman: Fix instance ID bounds (git-fixes). - platform/surface: acpi-notify: Check ACPI companion before use (git-fixes). - platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL (git-fixes). - platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path (git-fixes). - platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer (git-fixes). - platform/x86: dell-wmi-base: Fix resource leak on module load failure (git-fixes). - platform/x86: dell-privacy: Fix race condition (git-fixes). - mailbox: qcom-ipcc: fix duplicate channel allocation across holes (git-fixes). - mailbox: rockchip: disable pclk on probe failure and unbind (git-fixes). - i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure (git-fixes). - i2c: ocores: Disable clock on failed resume (git-fixes). - pinctrl: rockchip: Reset the pin count when recalculating SoC data (git-fixes). - pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip (git-fixes). - pinctrl: bcm2835: Don't remove an unregistered GPIO chip (git-fixes). - commit b2fc3ea ++++ libvirt: - CVE-2026-18917: remote: Fix integer overflow in RPC handler for virNodeGetFreePages bsc#1275863 ------------------------------------------------------------------ ------------------ 2026-8-24 - Aug 24 2026 ------------------- ------------------------------------------------------------------ ++++ busybox: - Fix stack exhaustion in the awk applet caused by unbounded function call recursion (CVE-2026-38752, bsc#1271544) * awk-fix-recursion.patch - Fix heap buffer overflow in the awk applet when a regexp ends with a backslash (CVE-2023-42366, bsc#1217586) * 0001-awk.c-fix-CVE-2023-42366-bug-15874.patch ++++ cpio: - Fix CVE-2026-66484: path traversal allows creating hard links outside intended directory via malicious tar archives (bsc#1274856) * CVE-2026-66484.patch - Fix CVE-2026-66485: denial of service via uncontrolled memory allocation from crafted archives (bsc#1274857) * CVE-2026-66485.patch - Fix CVE-2026-66486: terminal control sequence injection via crafted archive member names (bsc#1274858) * CVE-2026-66486.patch - Refresh patches to apply with -p1: * cpio-close_files_after_copy.patch * cpio-default_tape_dev.patch * cpio-dev_number.patch * cpio-eof_tape_handling.patch * cpio-open_nonblock.patch * cpio-use_new_ascii_format.patch * cpio-use_sbin_rmt.patch - Reorder patches, apply with %autosetup -p1 - Add makeinfo build requirement ++++ kernel-default: - mm/hugetlb: fix list corruption in allocate_file_region_entries() (CVE-2026-74518 bsc#1275798). - commit 1128e22 - netfilter: x_tables: avoid leaking percpu counter pointers (CVE-2026-53219 bsc#1269686). - commit d7f8d5b - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data (CVE-2026-63926 bsc#1273019). - commit 77abcc7 - cpufreq: Fix hotplug-suspend race during reboot (CVE-2026-64373 bsc#1273776). - commit aeebdab - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (CVE-2026-64372 bsc#1273889). - commit 0f8df61 - sched: idle: Make skipping governor callbacks more consistent (bsc#1267023 CVE-2026-45968). - commit 8bcf7ee - bridge: stp: Fix a potential use-after-free when deleting a bridge (CVE-2026-72389 bsc#1273869). - commit cf57199 - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (CVE-2026-72020 bsc#1275506). - commit fecf702 - cpuidle: Skip governor when only one idle state is available (bsc#1267023 CVE-2026-45968). - commit b339181 - igbvf: Fix leak in TX DMA error cleanup (CVE-2026-74495 bsc#1275864). - net: slip: serialize receive against buffer reallocation (CVE-2026-68143 bsc#1275583). - vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432 bsc#1274800). - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (CVE-2026-68117 bsc#1274881). - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299 bsc#1275088). - vxlan: mdb: Fix source list corruption on a failed replace (CVE-2026-68116 bsc#1274876). - nexthop: initialize extack in nh_res_bucket_migrate() (CVE-2026-64576 bsc#1274030). - nfp: Check resource mutex allocation (CVE-2026-68328 bsc#1274646). - openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123 bsc#1275169). - qede: fix out-of-bounds check for cqe->len_list (git-fixes). - net: af_key: initialize alg_key_len for IPComp states (CVE-2026-64436 bsc#1274277). - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr (CVE-2026-63868 bsc#1272497). - macsec: fix replay protection at XPN lower-PN wrap (CVE-2026-63925 bsc#1273008). - commit 565106c - net: ipv6: clear suppressed fib6 rule result (CVE-2026-74581 bsc#1275782). - commit da69b99 - blacklist.conf: add one for PCI - Delete patches.suse/PCI-MSI-Unmap-MSI-X-region-on-error.patch. The patch is bogus and was reverted. - commit 4807f47 - i3c: master: Fix info leak and UAF in device unregister path (git-fixes). - i3c: master: Fix device_register() error path (git-fixes). - i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices (git-fixes). - i3c: master: svc: bound IBI payload to the requested max_payload_len (git-fixes). - PCI: meson: Fix GPIO state while requesting PERST# (git-fixes). - PCI: j721e: Fix incorrect max_lanes for J7200 (git-fixes). - PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (git-fixes). - PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] (git-fixes). - mtd: rawnand: validate ONFI extended parameter page sections (git-fixes). - mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() (git-fixes). - mtd: mtdoops: free page bitmap when the backing MTD is removed (git-fixes). - mtd: mtdswap: Avoid freeing registered blktrans device twice (git-fixes). - mtd: afs: validate v2 image info bounds (git-fixes). - rapidio: mport_cdev: fix use-after-free in dma_req_free() (git-fixes). - lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (git-fixes). - rapidio: clear mport->net when rio_add_net() fails (git-fixes). - lib/string: fix memchr_inv() for large ranges (git-fixes). - Input: sur40 - fix V4L error path cleanup (stable-fixes). - Input: sur40 - fix input device registration ordering (stable-fixes). - drm/amdgpu: Reject UVD message with invalid number of h265 refs (stable-fixes). - drm/amdgpu: Implement insert_end for VCE 3 (git-fixes). - drm/amdgpu: Fix UVD min buffer sizes (stable-fixes). - drm/amdgpu: Fix UVD decode image min size calculation (stable-fixes). - drm/amdgpu: Fix UVD dpb min size calculation for H264 (stable-fixes). - drm/amdgpu: Reject UVD message with dimensions above 4096 (stable-fixes). - drm/amdgpu: validate GEM_CREATE domain combinations (stable-fixes). - Input: atkbd - skip deactivate for HONOR ZQC-P (git-fixes). - Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard (stable-fixes). - Input: iforce - validate input packet lengths (stable-fixes). - Input: xpad - add support for ZENAIM LEVERLESS (stable-fixes). - i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes). - i2c: bcm-iproc: remove printout on handled timeouts (stable-fixes). - commit fc57534 ++++ kernel-rt: - mm/hugetlb: fix list corruption in allocate_file_region_entries() (CVE-2026-74518 bsc#1275798). - commit 1128e22 - netfilter: x_tables: avoid leaking percpu counter pointers (CVE-2026-53219 bsc#1269686). - commit d7f8d5b - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data (CVE-2026-63926 bsc#1273019). - commit 77abcc7 - cpufreq: Fix hotplug-suspend race during reboot (CVE-2026-64373 bsc#1273776). - commit aeebdab - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (CVE-2026-64372 bsc#1273889). - commit 0f8df61 - sched: idle: Make skipping governor callbacks more consistent (bsc#1267023 CVE-2026-45968). - commit 8bcf7ee - bridge: stp: Fix a potential use-after-free when deleting a bridge (CVE-2026-72389 bsc#1273869). - commit cf57199 - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (CVE-2026-72020 bsc#1275506). - commit fecf702 - cpuidle: Skip governor when only one idle state is available (bsc#1267023 CVE-2026-45968). - commit b339181 - igbvf: Fix leak in TX DMA error cleanup (CVE-2026-74495 bsc#1275864). - net: slip: serialize receive against buffer reallocation (CVE-2026-68143 bsc#1275583). - vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432 bsc#1274800). - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (CVE-2026-68117 bsc#1274881). - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299 bsc#1275088). - vxlan: mdb: Fix source list corruption on a failed replace (CVE-2026-68116 bsc#1274876). - nexthop: initialize extack in nh_res_bucket_migrate() (CVE-2026-64576 bsc#1274030). - nfp: Check resource mutex allocation (CVE-2026-68328 bsc#1274646). - openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123 bsc#1275169). - qede: fix out-of-bounds check for cqe->len_list (git-fixes). - net: af_key: initialize alg_key_len for IPComp states (CVE-2026-64436 bsc#1274277). - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr (CVE-2026-63868 bsc#1272497). - macsec: fix replay protection at XPN lower-PN wrap (CVE-2026-63925 bsc#1273008). - commit 565106c - net: ipv6: clear suppressed fib6 rule result (CVE-2026-74581 bsc#1275782). - commit da69b99 - blacklist.conf: add one for PCI - Delete patches.suse/PCI-MSI-Unmap-MSI-X-region-on-error.patch. The patch is bogus and was reverted. - commit 4807f47 - i3c: master: Fix info leak and UAF in device unregister path (git-fixes). - i3c: master: Fix device_register() error path (git-fixes). - i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices (git-fixes). - i3c: master: svc: bound IBI payload to the requested max_payload_len (git-fixes). - PCI: meson: Fix GPIO state while requesting PERST# (git-fixes). - PCI: j721e: Fix incorrect max_lanes for J7200 (git-fixes). - PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (git-fixes). - PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] (git-fixes). - mtd: rawnand: validate ONFI extended parameter page sections (git-fixes). - mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() (git-fixes). - mtd: mtdoops: free page bitmap when the backing MTD is removed (git-fixes). - mtd: mtdswap: Avoid freeing registered blktrans device twice (git-fixes). - mtd: afs: validate v2 image info bounds (git-fixes). - rapidio: mport_cdev: fix use-after-free in dma_req_free() (git-fixes). - lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (git-fixes). - rapidio: clear mport->net when rio_add_net() fails (git-fixes). - lib/string: fix memchr_inv() for large ranges (git-fixes). - Input: sur40 - fix V4L error path cleanup (stable-fixes). - Input: sur40 - fix input device registration ordering (stable-fixes). - drm/amdgpu: Reject UVD message with invalid number of h265 refs (stable-fixes). - drm/amdgpu: Implement insert_end for VCE 3 (git-fixes). - drm/amdgpu: Fix UVD min buffer sizes (stable-fixes). - drm/amdgpu: Fix UVD decode image min size calculation (stable-fixes). - drm/amdgpu: Fix UVD dpb min size calculation for H264 (stable-fixes). - drm/amdgpu: Reject UVD message with dimensions above 4096 (stable-fixes). - drm/amdgpu: validate GEM_CREATE domain combinations (stable-fixes). - Input: atkbd - skip deactivate for HONOR ZQC-P (git-fixes). - Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard (stable-fixes). - Input: iforce - validate input packet lengths (stable-fixes). - Input: xpad - add support for ZENAIM LEVERLESS (stable-fixes). - i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes). - i2c: bcm-iproc: remove printout on handled timeouts (stable-fixes). - commit fc57534 ++++ kernel-rt_debug: - mm/hugetlb: fix list corruption in allocate_file_region_entries() (CVE-2026-74518 bsc#1275798). - commit 1128e22 - netfilter: x_tables: avoid leaking percpu counter pointers (CVE-2026-53219 bsc#1269686). - commit d7f8d5b - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data (CVE-2026-63926 bsc#1273019). - commit 77abcc7 - cpufreq: Fix hotplug-suspend race during reboot (CVE-2026-64373 bsc#1273776). - commit aeebdab - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (CVE-2026-64372 bsc#1273889). - commit 0f8df61 - sched: idle: Make skipping governor callbacks more consistent (bsc#1267023 CVE-2026-45968). - commit 8bcf7ee - bridge: stp: Fix a potential use-after-free when deleting a bridge (CVE-2026-72389 bsc#1273869). - commit cf57199 - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (CVE-2026-72020 bsc#1275506). - commit fecf702 - cpuidle: Skip governor when only one idle state is available (bsc#1267023 CVE-2026-45968). - commit b339181 - igbvf: Fix leak in TX DMA error cleanup (CVE-2026-74495 bsc#1275864). - net: slip: serialize receive against buffer reallocation (CVE-2026-68143 bsc#1275583). - vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432 bsc#1274800). - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (CVE-2026-68117 bsc#1274881). - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299 bsc#1275088). - vxlan: mdb: Fix source list corruption on a failed replace (CVE-2026-68116 bsc#1274876). - nexthop: initialize extack in nh_res_bucket_migrate() (CVE-2026-64576 bsc#1274030). - nfp: Check resource mutex allocation (CVE-2026-68328 bsc#1274646). - openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123 bsc#1275169). - qede: fix out-of-bounds check for cqe->len_list (git-fixes). - net: af_key: initialize alg_key_len for IPComp states (CVE-2026-64436 bsc#1274277). - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr (CVE-2026-63868 bsc#1272497). - macsec: fix replay protection at XPN lower-PN wrap (CVE-2026-63925 bsc#1273008). - commit 565106c - net: ipv6: clear suppressed fib6 rule result (CVE-2026-74581 bsc#1275782). - commit da69b99 - blacklist.conf: add one for PCI - Delete patches.suse/PCI-MSI-Unmap-MSI-X-region-on-error.patch. The patch is bogus and was reverted. - commit 4807f47 - i3c: master: Fix info leak and UAF in device unregister path (git-fixes). - i3c: master: Fix device_register() error path (git-fixes). - i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices (git-fixes). - i3c: master: svc: bound IBI payload to the requested max_payload_len (git-fixes). - PCI: meson: Fix GPIO state while requesting PERST# (git-fixes). - PCI: j721e: Fix incorrect max_lanes for J7200 (git-fixes). - PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (git-fixes). - PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] (git-fixes). - mtd: rawnand: validate ONFI extended parameter page sections (git-fixes). - mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() (git-fixes). - mtd: mtdoops: free page bitmap when the backing MTD is removed (git-fixes). - mtd: mtdswap: Avoid freeing registered blktrans device twice (git-fixes). - mtd: afs: validate v2 image info bounds (git-fixes). - rapidio: mport_cdev: fix use-after-free in dma_req_free() (git-fixes). - lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (git-fixes). - rapidio: clear mport->net when rio_add_net() fails (git-fixes). - lib/string: fix memchr_inv() for large ranges (git-fixes). - Input: sur40 - fix V4L error path cleanup (stable-fixes). - Input: sur40 - fix input device registration ordering (stable-fixes). - drm/amdgpu: Reject UVD message with invalid number of h265 refs (stable-fixes). - drm/amdgpu: Implement insert_end for VCE 3 (git-fixes). - drm/amdgpu: Fix UVD min buffer sizes (stable-fixes). - drm/amdgpu: Fix UVD decode image min size calculation (stable-fixes). - drm/amdgpu: Fix UVD dpb min size calculation for H264 (stable-fixes). - drm/amdgpu: Reject UVD message with dimensions above 4096 (stable-fixes). - drm/amdgpu: validate GEM_CREATE domain combinations (stable-fixes). - Input: atkbd - skip deactivate for HONOR ZQC-P (git-fixes). - Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard (stable-fixes). - Input: iforce - validate input packet lengths (stable-fixes). - Input: xpad - add support for ZENAIM LEVERLESS (stable-fixes). - i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes). - i2c: bcm-iproc: remove printout on handled timeouts (stable-fixes). - commit fc57534 ++++ c-ares: - c-ares 1.36.8: * CVE-2026-33630: Fixes use-after-free/double-free in c-ares query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP (bsc#1270416) * CVE-2026-69184: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290) * CVE-2026-69186: Memory-amplification denial of service via unvalidated DNS header record counts (bsc#1276291) - old-gtest.patch: old gtest adaptation to run tests in SLE15:Update - README.md: Add readme with build status For details, see https://c-ares.org/changelog.html ++++ openssl-3: - Security fix: * CVE-2026-75803: openssl: AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher() (bsc#1275837) * Add openssl-CVE-2026-75803.patch ++++ ucode-intel: - Intel CPU Microcode was updated to the 20260812 release (bsc#1274785) - Removed MTL/06-aa-04/c0 due to functional issues observed when loading the MCU in some platforms. - Intel CPU Microcode was updated to the 20260811 release (bsc#1274785) - Security updates for INTEL-SA-01379 / CVE-2025-31936 - Security updates for INTEL-SA-01404 / CVE-2025-31938 - Security updates for INTEL-SA-01423 / CVE-2026-20917 - Security updates for INTEL-SA-01428 / CVE-2025-35973 - Security updates for INTEL-SA-01435 / CVE-2026-20716 - Security updates for INTEL-SA-01441 / CVE-2026-20760 - Security updates for INTEL-SA-01442 / CVE-2026-20713 / CVE-2026-20901 - Security updates for INTEL-SA-01443 / CVE-2026-20707 - Update for functional issues. ------------------------------------------------------------------ ------------------ 2026-8-23 - Aug 23 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556 bsc#1275696). - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083 bsc#1275535). - scsi: target: Bound PR-OUT TransportID parsing to the received buffer (CVE-2026-72084 bsc#1275540). - commit d1831fd ++++ kernel-rt: - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556 bsc#1275696). - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083 bsc#1275535). - scsi: target: Bound PR-OUT TransportID parsing to the received buffer (CVE-2026-72084 bsc#1275540). - commit d1831fd ++++ kernel-rt_debug: - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556 bsc#1275696). - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083 bsc#1275535). - scsi: target: Bound PR-OUT TransportID parsing to the received buffer (CVE-2026-72084 bsc#1275540). - commit d1831fd ------------------------------------------------------------------ ------------------ 2026-8-22 - Aug 22 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - iomap: fix out-of-bounds bitmap_set() with zero-length range (CVE-2026-68145 bsc#1275584). - commit 15eaf4a - super: fix emergency thaw deadlock on frozen block devices (CVE-2026-68132 bsc#1275553). - commit 840de1a - power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address (git-fixes). - power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address (git-fixes). - power: supply: bq27xxx: bq27520g4: fix REG_TTES address (git-fixes). - power: supply: max17040: synchronize work cancellation on suspend (git-fixes). - power: supply: lp8727: fix use-after-free in lp8727_release_irq() (git-fixes). - power: supply: bq256xx: drain usb_work before freeing the charger (git-fixes). - power: supply: bd99954: Drop bad register fields (git-fixes). - power: supply: ucs1002: fix use-after-free on remove (git-fixes). - power: supply: bq24257: fix use-after-free on remove (git-fixes). - power: supply: max17040: drop incorrect I2C functionality check (git-fixes). - power: supply: isp1704_charger: cancel work on remove (git-fixes). - power: supply: qcom_battmgr: terminate the strings from firmware (git-fixes). - power: supply: sbs-battery: Use a per-device serial number buffer (git-fixes). - power: supply: twl4030_charger: cancel workers via devm (git-fixes). - power: supply: bq25890: Fix power_supply reference leak (git-fixes). - power: supply: rt9455: quiesce delayed work before teardown (git-fixes). - power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS (git-fixes). - power: supply: cros_usbpd-charger: bound the EC-reported port count (git-fixes). - mmc: via-sdmmc: stop card-detect handling on probe failure (git-fixes). - gpu: host1x: Avoid stack over-read in debug output helpers (git-fixes). - gpu: host1x: Fix offset calculation in trace_write_gather (git-fixes). - nouveau/gem: reserve the bo in the info ioctl around the vma lookup (git-fixes). - commit 3a779a4 - fbdev: omapfb: panel-dsi-cm: initialize lock before registering display (git-fixes). - fbdev: ssd1307fb: defer I2C transfers from damage callbacks (git-fixes). - fbdev: kyro: Validate overlay viewport coordinates (git-fixes). - fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device() (git-fixes). - fbdev: uvesafb: unregister connector callback on init failure (git-fixes). - drm: fix race between partial drm_dev_register() failure and ioctl (git-fixes). - drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz (git-fixes). - drm/sun4i: Drop node references while building component list (git-fixes). - drm/sun4i: dw-hdmi: Drop TCON TOP port reference (git-fixes). - drm/sun4i: tcon: Drop remote endpoint reference (git-fixes). - drm/sun4i: crtc: Propagate layer initialization error (git-fixes). - drm/sun4i: tcon: Drop TCON TOP device reference (git-fixes). - drm/sun4i: tcon: Set output mux for DSI and LVDS (git-fixes). - drm/sun4i: vi scaler: Fix coefficient selection (git-fixes). - drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure (git-fixes). - drm/panel-edp: fix i2c adapter leak on probe failure (git-fixes). - drm/amdgpu/gfx6: Use PFP on the compute queues too (git-fixes). - drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets (git-fixes). - drm/amdgpu/gfx6: Fixup emit_cntxcntl() (git-fixes). - drm/tve200: add OF module alias for autoloading (git-fixes). - drm/connector: Fix epoch_counter docs to reflect reality (git-fixes). - drm/bridge: tc358767: clamp the reported AUX read size to the request (git-fixes). - drm/panel: samsung-s6d16d0: Power off on prepare failure (git-fixes). - drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup (git-fixes). - drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup (git-fixes). - drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read (git-fixes). - drm/sun4i: fix refcount leak in sun4i_backend_init_sat() (git-fixes). - drm/ssd130x: fix column and row end address in partial updates for ssd132x (git-fixes). - drm/lima: call drm_mm_init() with a valid allocation range (git-fixes). - drm/hibmc: Fix list of formats on the primary plane (git-fixes). - drm/hibmc: Use drm_atomic_helper_check_plane_state() (git-fixes). - drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure (git-fixes). - drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format (git-fixes). - drm: lcdif: Wait for vblank before disabling DMA (git-fixes). - drm/tegra: dsi: Re-add clear enable register if DSI was powered by bootloader (git-fixes). - drm: Remove unused header in drm_dumb_buffers.c (git-fixes). - commit 1e20876 ++++ kernel-rt: - iomap: fix out-of-bounds bitmap_set() with zero-length range (CVE-2026-68145 bsc#1275584). - commit 15eaf4a - super: fix emergency thaw deadlock on frozen block devices (CVE-2026-68132 bsc#1275553). - commit 840de1a - power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address (git-fixes). - power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address (git-fixes). - power: supply: bq27xxx: bq27520g4: fix REG_TTES address (git-fixes). - power: supply: max17040: synchronize work cancellation on suspend (git-fixes). - power: supply: lp8727: fix use-after-free in lp8727_release_irq() (git-fixes). - power: supply: bq256xx: drain usb_work before freeing the charger (git-fixes). - power: supply: bd99954: Drop bad register fields (git-fixes). - power: supply: ucs1002: fix use-after-free on remove (git-fixes). - power: supply: bq24257: fix use-after-free on remove (git-fixes). - power: supply: max17040: drop incorrect I2C functionality check (git-fixes). - power: supply: isp1704_charger: cancel work on remove (git-fixes). - power: supply: qcom_battmgr: terminate the strings from firmware (git-fixes). - power: supply: sbs-battery: Use a per-device serial number buffer (git-fixes). - power: supply: twl4030_charger: cancel workers via devm (git-fixes). - power: supply: bq25890: Fix power_supply reference leak (git-fixes). - power: supply: rt9455: quiesce delayed work before teardown (git-fixes). - power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS (git-fixes). - power: supply: cros_usbpd-charger: bound the EC-reported port count (git-fixes). - mmc: via-sdmmc: stop card-detect handling on probe failure (git-fixes). - gpu: host1x: Avoid stack over-read in debug output helpers (git-fixes). - gpu: host1x: Fix offset calculation in trace_write_gather (git-fixes). - nouveau/gem: reserve the bo in the info ioctl around the vma lookup (git-fixes). - commit 3a779a4 - fbdev: omapfb: panel-dsi-cm: initialize lock before registering display (git-fixes). - fbdev: ssd1307fb: defer I2C transfers from damage callbacks (git-fixes). - fbdev: kyro: Validate overlay viewport coordinates (git-fixes). - fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device() (git-fixes). - fbdev: uvesafb: unregister connector callback on init failure (git-fixes). - drm: fix race between partial drm_dev_register() failure and ioctl (git-fixes). - drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz (git-fixes). - drm/sun4i: Drop node references while building component list (git-fixes). - drm/sun4i: dw-hdmi: Drop TCON TOP port reference (git-fixes). - drm/sun4i: tcon: Drop remote endpoint reference (git-fixes). - drm/sun4i: crtc: Propagate layer initialization error (git-fixes). - drm/sun4i: tcon: Drop TCON TOP device reference (git-fixes). - drm/sun4i: tcon: Set output mux for DSI and LVDS (git-fixes). - drm/sun4i: vi scaler: Fix coefficient selection (git-fixes). - drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure (git-fixes). - drm/panel-edp: fix i2c adapter leak on probe failure (git-fixes). - drm/amdgpu/gfx6: Use PFP on the compute queues too (git-fixes). - drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets (git-fixes). - drm/amdgpu/gfx6: Fixup emit_cntxcntl() (git-fixes). - drm/tve200: add OF module alias for autoloading (git-fixes). - drm/connector: Fix epoch_counter docs to reflect reality (git-fixes). - drm/bridge: tc358767: clamp the reported AUX read size to the request (git-fixes). - drm/panel: samsung-s6d16d0: Power off on prepare failure (git-fixes). - drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup (git-fixes). - drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup (git-fixes). - drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read (git-fixes). - drm/sun4i: fix refcount leak in sun4i_backend_init_sat() (git-fixes). - drm/ssd130x: fix column and row end address in partial updates for ssd132x (git-fixes). - drm/lima: call drm_mm_init() with a valid allocation range (git-fixes). - drm/hibmc: Fix list of formats on the primary plane (git-fixes). - drm/hibmc: Use drm_atomic_helper_check_plane_state() (git-fixes). - drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure (git-fixes). - drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format (git-fixes). - drm: lcdif: Wait for vblank before disabling DMA (git-fixes). - drm/tegra: dsi: Re-add clear enable register if DSI was powered by bootloader (git-fixes). - drm: Remove unused header in drm_dumb_buffers.c (git-fixes). - commit 1e20876 ++++ kernel-rt_debug: - iomap: fix out-of-bounds bitmap_set() with zero-length range (CVE-2026-68145 bsc#1275584). - commit 15eaf4a - super: fix emergency thaw deadlock on frozen block devices (CVE-2026-68132 bsc#1275553). - commit 840de1a - power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address (git-fixes). - power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address (git-fixes). - power: supply: bq27xxx: bq27520g4: fix REG_TTES address (git-fixes). - power: supply: max17040: synchronize work cancellation on suspend (git-fixes). - power: supply: lp8727: fix use-after-free in lp8727_release_irq() (git-fixes). - power: supply: bq256xx: drain usb_work before freeing the charger (git-fixes). - power: supply: bd99954: Drop bad register fields (git-fixes). - power: supply: ucs1002: fix use-after-free on remove (git-fixes). - power: supply: bq24257: fix use-after-free on remove (git-fixes). - power: supply: max17040: drop incorrect I2C functionality check (git-fixes). - power: supply: isp1704_charger: cancel work on remove (git-fixes). - power: supply: qcom_battmgr: terminate the strings from firmware (git-fixes). - power: supply: sbs-battery: Use a per-device serial number buffer (git-fixes). - power: supply: twl4030_charger: cancel workers via devm (git-fixes). - power: supply: bq25890: Fix power_supply reference leak (git-fixes). - power: supply: rt9455: quiesce delayed work before teardown (git-fixes). - power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS (git-fixes). - power: supply: cros_usbpd-charger: bound the EC-reported port count (git-fixes). - mmc: via-sdmmc: stop card-detect handling on probe failure (git-fixes). - gpu: host1x: Avoid stack over-read in debug output helpers (git-fixes). - gpu: host1x: Fix offset calculation in trace_write_gather (git-fixes). - nouveau/gem: reserve the bo in the info ioctl around the vma lookup (git-fixes). - commit 3a779a4 - fbdev: omapfb: panel-dsi-cm: initialize lock before registering display (git-fixes). - fbdev: ssd1307fb: defer I2C transfers from damage callbacks (git-fixes). - fbdev: kyro: Validate overlay viewport coordinates (git-fixes). - fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device() (git-fixes). - fbdev: uvesafb: unregister connector callback on init failure (git-fixes). - drm: fix race between partial drm_dev_register() failure and ioctl (git-fixes). - drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz (git-fixes). - drm/sun4i: Drop node references while building component list (git-fixes). - drm/sun4i: dw-hdmi: Drop TCON TOP port reference (git-fixes). - drm/sun4i: tcon: Drop remote endpoint reference (git-fixes). - drm/sun4i: crtc: Propagate layer initialization error (git-fixes). - drm/sun4i: tcon: Drop TCON TOP device reference (git-fixes). - drm/sun4i: tcon: Set output mux for DSI and LVDS (git-fixes). - drm/sun4i: vi scaler: Fix coefficient selection (git-fixes). - drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure (git-fixes). - drm/panel-edp: fix i2c adapter leak on probe failure (git-fixes). - drm/amdgpu/gfx6: Use PFP on the compute queues too (git-fixes). - drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets (git-fixes). - drm/amdgpu/gfx6: Fixup emit_cntxcntl() (git-fixes). - drm/tve200: add OF module alias for autoloading (git-fixes). - drm/connector: Fix epoch_counter docs to reflect reality (git-fixes). - drm/bridge: tc358767: clamp the reported AUX read size to the request (git-fixes). - drm/panel: samsung-s6d16d0: Power off on prepare failure (git-fixes). - drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup (git-fixes). - drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup (git-fixes). - drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read (git-fixes). - drm/sun4i: fix refcount leak in sun4i_backend_init_sat() (git-fixes). - drm/ssd130x: fix column and row end address in partial updates for ssd132x (git-fixes). - drm/lima: call drm_mm_init() with a valid allocation range (git-fixes). - drm/hibmc: Fix list of formats on the primary plane (git-fixes). - drm/hibmc: Use drm_atomic_helper_check_plane_state() (git-fixes). - drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure (git-fixes). - drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format (git-fixes). - drm: lcdif: Wait for vblank before disabling DMA (git-fixes). - drm/tegra: dsi: Re-add clear enable register if DSI was powered by bootloader (git-fixes). - drm: Remove unused header in drm_dumb_buffers.c (git-fixes). - commit 1e20876 ------------------------------------------------------------------ ------------------ 2026-8-21 - Aug 21 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - libceph: guard missing CRUSH type name lookup (CVE-2026-68157 bsc#1275306). - commit b66d803 - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CVE-2026-68156 bsc#1275305). - commit 5c705a8 - libceph: reject zero bucket types in crush_decode (CVE-2026-68154 bsc#1275303). - commit 7826062 - libceph: remove debugfs files before client teardown (CVE-2026-68153 bsc#1275301). - commit 865ba2d - libceph: bound get_version reply decode to front len (CVE-2026-68433 bsc#1274801). - commit 1e226e0 - libceph: fix two unsafe bare decodes in decode_lockers() (CVE-2026-68082 bsc#1274581). - commit 97cb5aa - dm-log: fix a bitset_size overflow on 32bit machines (bsc#1269655 CVE-2026-53059). - commit 3bd840d - dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655 CVE-2026-53059). - commit 6c13b86 - Refresh patches.suse/ALSA-pcm-oss-Fix-setup-list-UAF-on-proc-write-error.patch (CVE-2026-64001 bsc#1273734) Fix the missing mutex unlock - commit d12351c - vsock/vmci: fix UAF when peer resets connection during handshake (CVE-2026-64115 bsc#1273745). - commit 9b53dbd - netfilter: synproxy: add mutex to guard hook reference counting (CVE-2026-53269 bsc#1269579). - commit 3455175 - forcedeth: fix UAF of txrx_stats in nv_remove (CVE-2026-74548 bsc#1275695). - geneve: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68142 bsc#1275582). - dpaa2-eth: put MAC endpoint device on disconnect (CVE-2026-68331 bsc#1274642). - dpaa2-switch: put MAC endpoint device on disconnect (CVE-2026-68333 bsc#1274644). - net, bpf: check master for NULL in xdp_master_redirect() (CVE-2026-64545 bsc#1273318). - ipv6: Fix null-ptr-deref in fib6_nh_mtu_change() (CVE-2026-64538 bsc#1273335). - bridge: cfm: reject invalid CCM interval at configuration time (CVE-2026-64537 bsc#1273289). - xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935 bsc#1268979). - hsr: Remove WARN_ONCE() in hsr_addr_is_self() (CVE-2026-53353 bsc#1270111). - ethtool: eeprom: add more safeties to EEPROM Netlink fallback (CVE-2026-63985 bsc#1272963). - ethtool: rss: fix indir_table and hkey leak on get_rxfh failure (CVE-2026-63999 bsc#1273038). - octeontx2-pf: avoid double free of pool->stack on AQ init failure (CVE-2026-64222 bsc#1272788). - commit aba2012 - iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() (CVE-2026-68329 bsc#1274645). - commit 22ce452 - wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() (git-fixes). - wifi: mac80211: skip default WMM setup for AP_VLAN links (git-fixes). - wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump (git-fixes). - wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (git-fixes). - wifi: brcmfmac: fix P2P action frame handling without device vif (git-fixes). - wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() (git-fixes). - wifi: rtlwifi: pci: fix error path in rtl_pci_probe() (git-fixes). - wifi: rtw89: fix HE extended capability length check (git-fixes). - wifi: mt76: mt7996: fix reg addr remap when addr is 0 (git-fixes). - wifi: mt76: mt7915: release hif2 reference on probe IRQ failure (git-fixes). - wifi: mt76: mt7915: fix ext PHY use-after-free on register error path (git-fixes). - wifi: mt76: mt7915: fix double hif2 init on the non-WED path (git-fixes). - wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement (git-fixes). - wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields (git-fixes). - commit 601d803 - wifi: mt76: report data NSS for STBC frames in RX rate decode (git-fixes). - wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV (git-fixes). - wifi: mt76: fix ER-SU 106-tone RU check in RX rate decode (git-fixes). - wifi: mt76: mt7915: unwind state on add_interface failure (git-fixes). - wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config (git-fixes). - wifi: mt76: fix HE DCM max-RU capability encoding (git-fixes). - wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie (git-fixes). - wifi: mt76: fix 4th chain ACK RSSI bitmask in sta_poll (git-fixes). - wifi: mt76: mt7915: write RX header translation bit to the correct register (git-fixes). - wifi: mt76: mt7996: don't report a zero TX bitrate (git-fixes). - wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss (git-fixes). - wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset (git-fixes). - wifi: mt76: mt7996: validate RX band_idx before dereferencing phys (git-fixes). - wifi: mt76: mt792x: Fix memory leak in SDIO TX path (git-fixes). - wifi: mt76: mt7925: fix msg len mismatch between driver and firmware (git-fixes). - wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb (git-fixes). - wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986 (git-fixes). - wifi: mt76: mt7921: validate CLC firmware records (git-fixes). - commit 637c169 - wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length (git-fixes). - wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (git-fixes). - wifi: mac80211: skip unused probe response countdown offsets (git-fixes). - wifi: zd1211rw: reject secondary interfaces to prevent conflicts (git-fixes). - wifi: mac80211: send TWT teardown to peer after setup TX failure (git-fixes). - wifi: mwifiex: Detach sync cmd buffer on interrupted wait (git-fixes). - wifi: iwlwifi: mei: pass correct argument to function (git-fixes). - wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments (git-fixes). - wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser (git-fixes). - wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs (git-fixes). - commit 1edf070 - nfc: microread: validate target discovery payload lengths (git-fixes). - nfc: nci: free destination parameters when closing a connection (git-fixes). - nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing (git-fixes). - nfc: pn533: purge fragmented skbs during cleanup (git-fixes). - nfc: st21nfca: validate ATR_REQ length against the received frame (git-fixes). - nfc: llcp: bound the connect_sn TLV walk to the skb (git-fixes). - nfc: llcp: reject PDUs shorter than the LLCP header (git-fixes). - nfc: digital: Do not dump a NULL response in command completion (git-fixes). - nfc: pn533: hold a reference to the request skb during send_frame (git-fixes). - nfc: nci: fix uninit-value in the RF discover/activated NTF handlers (git-fixes). - nfc: fdp: bound the device-reported read length and fix an skb leak (git-fixes). - nfc: nci: fix out-of-bounds write in nci_target_auto_activated() (git-fixes). - nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (git-fixes). - nfc: llcp: bound SNL TLV parsing to the skb and add length checks (git-fixes). - wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() (git-fixes). - wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() (git-fixes). - wifi: ath11k: Correctly copy the hint BSSID in WMI scan request (git-fixes). - wifi: ath12k: Correctly copy the hint BSSID in WMI scan request (git-fixes). - wifi: ath6kl: avoid buffer overreads in WMI event handlers (git-fixes). - wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate (git-fixes). - commit 73fed12 - nfc: digital: clamp SENSF_RES length to the destination buffer (git-fixes). - nfc: nci: fix double completion race in nci_data_exchange_complete (git-fixes). - nfc: llcp: read llcp_sock->local under the socket lock in getsockopt (git-fixes). - nfc: llcp: avoid userspace overflow on invalid optlen (git-fixes). - net: thunderbolt: Mark the connection down when bringing it up fails (git-fixes). - net: thunderbolt: Release the Rx HopID that was handed out on mismatch (git-fixes). - Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept (git-fixes). - Bluetooth: MSFT: validate evt_prefix_len against the response length (git-fixes). - Bluetooth: MGMT: free the mesh send cancel command when it is cancelled (git-fixes). - Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths (git-fixes). - Bluetooth: btintel: Fix diagnostics event detection (git-fixes). - Bluetooth: hci_event: validate LE Set CIG Parameters response (git-fixes). - Bluetooth: virtio_bt: avoid OOB read of build info string (git-fixes). - Bluetooth: hci_event: fix LE list UAF on reset (git-fixes). - Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() (git-fixes). - Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event (git-fixes). - commit 112fe29 - sctp: close UDP tunnel sockets during netns teardown (CVE-2026-68161 bsc#1274892) - commit 734559b - sctp: avoid auth_enable sysctl UAF during netns teardown (git-fixes) - commit 10b62f9 - scsi: aic94xx: fix use-after-free in device removal path (CVE-2025-71075 bsc#1256629). - commit ab0def5 ++++ kernel-rt: - libceph: guard missing CRUSH type name lookup (CVE-2026-68157 bsc#1275306). - commit b66d803 - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CVE-2026-68156 bsc#1275305). - commit 5c705a8 - libceph: reject zero bucket types in crush_decode (CVE-2026-68154 bsc#1275303). - commit 7826062 - libceph: remove debugfs files before client teardown (CVE-2026-68153 bsc#1275301). - commit 865ba2d - libceph: bound get_version reply decode to front len (CVE-2026-68433 bsc#1274801). - commit 1e226e0 - libceph: fix two unsafe bare decodes in decode_lockers() (CVE-2026-68082 bsc#1274581). - commit 97cb5aa - dm-log: fix a bitset_size overflow on 32bit machines (bsc#1269655 CVE-2026-53059). - commit 3bd840d - dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655 CVE-2026-53059). - commit 6c13b86 - Refresh patches.suse/ALSA-pcm-oss-Fix-setup-list-UAF-on-proc-write-error.patch (CVE-2026-64001 bsc#1273734) Fix the missing mutex unlock - commit d12351c - vsock/vmci: fix UAF when peer resets connection during handshake (CVE-2026-64115 bsc#1273745). - commit 9b53dbd - netfilter: synproxy: add mutex to guard hook reference counting (CVE-2026-53269 bsc#1269579). - commit 3455175 - forcedeth: fix UAF of txrx_stats in nv_remove (CVE-2026-74548 bsc#1275695). - geneve: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68142 bsc#1275582). - dpaa2-eth: put MAC endpoint device on disconnect (CVE-2026-68331 bsc#1274642). - dpaa2-switch: put MAC endpoint device on disconnect (CVE-2026-68333 bsc#1274644). - net, bpf: check master for NULL in xdp_master_redirect() (CVE-2026-64545 bsc#1273318). - ipv6: Fix null-ptr-deref in fib6_nh_mtu_change() (CVE-2026-64538 bsc#1273335). - bridge: cfm: reject invalid CCM interval at configuration time (CVE-2026-64537 bsc#1273289). - xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935 bsc#1268979). - hsr: Remove WARN_ONCE() in hsr_addr_is_self() (CVE-2026-53353 bsc#1270111). - ethtool: eeprom: add more safeties to EEPROM Netlink fallback (CVE-2026-63985 bsc#1272963). - ethtool: rss: fix indir_table and hkey leak on get_rxfh failure (CVE-2026-63999 bsc#1273038). - octeontx2-pf: avoid double free of pool->stack on AQ init failure (CVE-2026-64222 bsc#1272788). - commit aba2012 - iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() (CVE-2026-68329 bsc#1274645). - commit 22ce452 - wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() (git-fixes). - wifi: mac80211: skip default WMM setup for AP_VLAN links (git-fixes). - wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump (git-fixes). - wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (git-fixes). - wifi: brcmfmac: fix P2P action frame handling without device vif (git-fixes). - wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() (git-fixes). - wifi: rtlwifi: pci: fix error path in rtl_pci_probe() (git-fixes). - wifi: rtw89: fix HE extended capability length check (git-fixes). - wifi: mt76: mt7996: fix reg addr remap when addr is 0 (git-fixes). - wifi: mt76: mt7915: release hif2 reference on probe IRQ failure (git-fixes). - wifi: mt76: mt7915: fix ext PHY use-after-free on register error path (git-fixes). - wifi: mt76: mt7915: fix double hif2 init on the non-WED path (git-fixes). - wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement (git-fixes). - wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields (git-fixes). - commit 601d803 - wifi: mt76: report data NSS for STBC frames in RX rate decode (git-fixes). - wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV (git-fixes). - wifi: mt76: fix ER-SU 106-tone RU check in RX rate decode (git-fixes). - wifi: mt76: mt7915: unwind state on add_interface failure (git-fixes). - wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config (git-fixes). - wifi: mt76: fix HE DCM max-RU capability encoding (git-fixes). - wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie (git-fixes). - wifi: mt76: fix 4th chain ACK RSSI bitmask in sta_poll (git-fixes). - wifi: mt76: mt7915: write RX header translation bit to the correct register (git-fixes). - wifi: mt76: mt7996: don't report a zero TX bitrate (git-fixes). - wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss (git-fixes). - wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset (git-fixes). - wifi: mt76: mt7996: validate RX band_idx before dereferencing phys (git-fixes). - wifi: mt76: mt792x: Fix memory leak in SDIO TX path (git-fixes). - wifi: mt76: mt7925: fix msg len mismatch between driver and firmware (git-fixes). - wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb (git-fixes). - wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986 (git-fixes). - wifi: mt76: mt7921: validate CLC firmware records (git-fixes). - commit 637c169 - wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length (git-fixes). - wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (git-fixes). - wifi: mac80211: skip unused probe response countdown offsets (git-fixes). - wifi: zd1211rw: reject secondary interfaces to prevent conflicts (git-fixes). - wifi: mac80211: send TWT teardown to peer after setup TX failure (git-fixes). - wifi: mwifiex: Detach sync cmd buffer on interrupted wait (git-fixes). - wifi: iwlwifi: mei: pass correct argument to function (git-fixes). - wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments (git-fixes). - wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser (git-fixes). - wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs (git-fixes). - commit 1edf070 - nfc: microread: validate target discovery payload lengths (git-fixes). - nfc: nci: free destination parameters when closing a connection (git-fixes). - nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing (git-fixes). - nfc: pn533: purge fragmented skbs during cleanup (git-fixes). - nfc: st21nfca: validate ATR_REQ length against the received frame (git-fixes). - nfc: llcp: bound the connect_sn TLV walk to the skb (git-fixes). - nfc: llcp: reject PDUs shorter than the LLCP header (git-fixes). - nfc: digital: Do not dump a NULL response in command completion (git-fixes). - nfc: pn533: hold a reference to the request skb during send_frame (git-fixes). - nfc: nci: fix uninit-value in the RF discover/activated NTF handlers (git-fixes). - nfc: fdp: bound the device-reported read length and fix an skb leak (git-fixes). - nfc: nci: fix out-of-bounds write in nci_target_auto_activated() (git-fixes). - nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (git-fixes). - nfc: llcp: bound SNL TLV parsing to the skb and add length checks (git-fixes). - wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() (git-fixes). - wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() (git-fixes). - wifi: ath11k: Correctly copy the hint BSSID in WMI scan request (git-fixes). - wifi: ath12k: Correctly copy the hint BSSID in WMI scan request (git-fixes). - wifi: ath6kl: avoid buffer overreads in WMI event handlers (git-fixes). - wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate (git-fixes). - commit 73fed12 - nfc: digital: clamp SENSF_RES length to the destination buffer (git-fixes). - nfc: nci: fix double completion race in nci_data_exchange_complete (git-fixes). - nfc: llcp: read llcp_sock->local under the socket lock in getsockopt (git-fixes). - nfc: llcp: avoid userspace overflow on invalid optlen (git-fixes). - net: thunderbolt: Mark the connection down when bringing it up fails (git-fixes). - net: thunderbolt: Release the Rx HopID that was handed out on mismatch (git-fixes). - Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept (git-fixes). - Bluetooth: MSFT: validate evt_prefix_len against the response length (git-fixes). - Bluetooth: MGMT: free the mesh send cancel command when it is cancelled (git-fixes). - Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths (git-fixes). - Bluetooth: btintel: Fix diagnostics event detection (git-fixes). - Bluetooth: hci_event: validate LE Set CIG Parameters response (git-fixes). - Bluetooth: virtio_bt: avoid OOB read of build info string (git-fixes). - Bluetooth: hci_event: fix LE list UAF on reset (git-fixes). - Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() (git-fixes). - Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event (git-fixes). - commit 112fe29 - sctp: close UDP tunnel sockets during netns teardown (CVE-2026-68161 bsc#1274892) - commit 734559b - sctp: avoid auth_enable sysctl UAF during netns teardown (git-fixes) - commit 10b62f9 - scsi: aic94xx: fix use-after-free in device removal path (CVE-2025-71075 bsc#1256629). - commit ab0def5 ++++ kernel-rt_debug: - libceph: guard missing CRUSH type name lookup (CVE-2026-68157 bsc#1275306). - commit b66d803 - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CVE-2026-68156 bsc#1275305). - commit 5c705a8 - libceph: reject zero bucket types in crush_decode (CVE-2026-68154 bsc#1275303). - commit 7826062 - libceph: remove debugfs files before client teardown (CVE-2026-68153 bsc#1275301). - commit 865ba2d - libceph: bound get_version reply decode to front len (CVE-2026-68433 bsc#1274801). - commit 1e226e0 - libceph: fix two unsafe bare decodes in decode_lockers() (CVE-2026-68082 bsc#1274581). - commit 97cb5aa - dm-log: fix a bitset_size overflow on 32bit machines (bsc#1269655 CVE-2026-53059). - commit 3bd840d - dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655 CVE-2026-53059). - commit 6c13b86 - Refresh patches.suse/ALSA-pcm-oss-Fix-setup-list-UAF-on-proc-write-error.patch (CVE-2026-64001 bsc#1273734) Fix the missing mutex unlock - commit d12351c - vsock/vmci: fix UAF when peer resets connection during handshake (CVE-2026-64115 bsc#1273745). - commit 9b53dbd - netfilter: synproxy: add mutex to guard hook reference counting (CVE-2026-53269 bsc#1269579). - commit 3455175 - forcedeth: fix UAF of txrx_stats in nv_remove (CVE-2026-74548 bsc#1275695). - geneve: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68142 bsc#1275582). - dpaa2-eth: put MAC endpoint device on disconnect (CVE-2026-68331 bsc#1274642). - dpaa2-switch: put MAC endpoint device on disconnect (CVE-2026-68333 bsc#1274644). - net, bpf: check master for NULL in xdp_master_redirect() (CVE-2026-64545 bsc#1273318). - ipv6: Fix null-ptr-deref in fib6_nh_mtu_change() (CVE-2026-64538 bsc#1273335). - bridge: cfm: reject invalid CCM interval at configuration time (CVE-2026-64537 bsc#1273289). - xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935 bsc#1268979). - hsr: Remove WARN_ONCE() in hsr_addr_is_self() (CVE-2026-53353 bsc#1270111). - ethtool: eeprom: add more safeties to EEPROM Netlink fallback (CVE-2026-63985 bsc#1272963). - ethtool: rss: fix indir_table and hkey leak on get_rxfh failure (CVE-2026-63999 bsc#1273038). - octeontx2-pf: avoid double free of pool->stack on AQ init failure (CVE-2026-64222 bsc#1272788). - commit aba2012 - iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() (CVE-2026-68329 bsc#1274645). - commit 22ce452 - wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() (git-fixes). - wifi: mac80211: skip default WMM setup for AP_VLAN links (git-fixes). - wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump (git-fixes). - wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (git-fixes). - wifi: brcmfmac: fix P2P action frame handling without device vif (git-fixes). - wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() (git-fixes). - wifi: rtlwifi: pci: fix error path in rtl_pci_probe() (git-fixes). - wifi: rtw89: fix HE extended capability length check (git-fixes). - wifi: mt76: mt7996: fix reg addr remap when addr is 0 (git-fixes). - wifi: mt76: mt7915: release hif2 reference on probe IRQ failure (git-fixes). - wifi: mt76: mt7915: fix ext PHY use-after-free on register error path (git-fixes). - wifi: mt76: mt7915: fix double hif2 init on the non-WED path (git-fixes). - wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement (git-fixes). - wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields (git-fixes). - commit 601d803 - wifi: mt76: report data NSS for STBC frames in RX rate decode (git-fixes). - wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV (git-fixes). - wifi: mt76: fix ER-SU 106-tone RU check in RX rate decode (git-fixes). - wifi: mt76: mt7915: unwind state on add_interface failure (git-fixes). - wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config (git-fixes). - wifi: mt76: fix HE DCM max-RU capability encoding (git-fixes). - wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie (git-fixes). - wifi: mt76: fix 4th chain ACK RSSI bitmask in sta_poll (git-fixes). - wifi: mt76: mt7915: write RX header translation bit to the correct register (git-fixes). - wifi: mt76: mt7996: don't report a zero TX bitrate (git-fixes). - wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss (git-fixes). - wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset (git-fixes). - wifi: mt76: mt7996: validate RX band_idx before dereferencing phys (git-fixes). - wifi: mt76: mt792x: Fix memory leak in SDIO TX path (git-fixes). - wifi: mt76: mt7925: fix msg len mismatch between driver and firmware (git-fixes). - wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb (git-fixes). - wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986 (git-fixes). - wifi: mt76: mt7921: validate CLC firmware records (git-fixes). - commit 637c169 - wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length (git-fixes). - wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (git-fixes). - wifi: mac80211: skip unused probe response countdown offsets (git-fixes). - wifi: zd1211rw: reject secondary interfaces to prevent conflicts (git-fixes). - wifi: mac80211: send TWT teardown to peer after setup TX failure (git-fixes). - wifi: mwifiex: Detach sync cmd buffer on interrupted wait (git-fixes). - wifi: iwlwifi: mei: pass correct argument to function (git-fixes). - wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments (git-fixes). - wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser (git-fixes). - wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs (git-fixes). - commit 1edf070 - nfc: microread: validate target discovery payload lengths (git-fixes). - nfc: nci: free destination parameters when closing a connection (git-fixes). - nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing (git-fixes). - nfc: pn533: purge fragmented skbs during cleanup (git-fixes). - nfc: st21nfca: validate ATR_REQ length against the received frame (git-fixes). - nfc: llcp: bound the connect_sn TLV walk to the skb (git-fixes). - nfc: llcp: reject PDUs shorter than the LLCP header (git-fixes). - nfc: digital: Do not dump a NULL response in command completion (git-fixes). - nfc: pn533: hold a reference to the request skb during send_frame (git-fixes). - nfc: nci: fix uninit-value in the RF discover/activated NTF handlers (git-fixes). - nfc: fdp: bound the device-reported read length and fix an skb leak (git-fixes). - nfc: nci: fix out-of-bounds write in nci_target_auto_activated() (git-fixes). - nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (git-fixes). - nfc: llcp: bound SNL TLV parsing to the skb and add length checks (git-fixes). - wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() (git-fixes). - wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() (git-fixes). - wifi: ath11k: Correctly copy the hint BSSID in WMI scan request (git-fixes). - wifi: ath12k: Correctly copy the hint BSSID in WMI scan request (git-fixes). - wifi: ath6kl: avoid buffer overreads in WMI event handlers (git-fixes). - wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate (git-fixes). - commit 73fed12 - nfc: digital: clamp SENSF_RES length to the destination buffer (git-fixes). - nfc: nci: fix double completion race in nci_data_exchange_complete (git-fixes). - nfc: llcp: read llcp_sock->local under the socket lock in getsockopt (git-fixes). - nfc: llcp: avoid userspace overflow on invalid optlen (git-fixes). - net: thunderbolt: Mark the connection down when bringing it up fails (git-fixes). - net: thunderbolt: Release the Rx HopID that was handed out on mismatch (git-fixes). - Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept (git-fixes). - Bluetooth: MSFT: validate evt_prefix_len against the response length (git-fixes). - Bluetooth: MGMT: free the mesh send cancel command when it is cancelled (git-fixes). - Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths (git-fixes). - Bluetooth: btintel: Fix diagnostics event detection (git-fixes). - Bluetooth: hci_event: validate LE Set CIG Parameters response (git-fixes). - Bluetooth: virtio_bt: avoid OOB read of build info string (git-fixes). - Bluetooth: hci_event: fix LE list UAF on reset (git-fixes). - Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() (git-fixes). - Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event (git-fixes). - commit 112fe29 - sctp: close UDP tunnel sockets during netns teardown (CVE-2026-68161 bsc#1274892) - commit 734559b - sctp: avoid auth_enable sysctl UAF during netns teardown (git-fixes) - commit 10b62f9 - scsi: aic94xx: fix use-after-free in device removal path (CVE-2025-71075 bsc#1256629). - commit ab0def5 ++++ expat: - update to 2.8.2 ( bsc#1267631, CVE-2026-50219, bsc#1268572, CVE-2026-56131, bsc#1268573, CVE-2026-56132, bsc#1275115, CVE-2026-56403, CVE-2026-56404, CVE-2026-56405, CVE-2026-56406, CVE-2026-56407, CVE-2026-56408, CVE-2026-56409, CVE-2026-56410, CVE-2026-56411, CVE-2026-56412): * #1246 CVE-2026-50219 -- Disallow calls to functions * `XML_GetBuffer`, `XML_Parse`, `XML_ParseBuffer`, * `XML_ParserFree`, `XML_ParserReset` to guard e.g. * Expat bindings from memory corruption; * #1267 CVE-2026-56131 -- Protect XML_ResumeParser from being called from a handler, plugging a hole in the fix to CVE-2026-50219 * #1272 CVE-2026-56132 -- Fix out-of-bound scaffolding index store in `doProlog` * #1229 #1232 CVE-2026-56403 -- Integer overflow in `storeAtts` * #1249 CVE-2026-56404 -- Integer overflow in `addBinding` * #1251 CVE-2026-56405 -- Integer overflow in `getAttributeId` * #1255 CVE-2026-56406 -- Integer overflow in `XML_ParseBuffer` * #1262 CVE-2026-56407 -- Integer overflow in `textLen` handling * #565 CVE-2026-56408 -- Integer overflow in `copyString` * #1259 CVE-2026-56409 -- xmlwf: Integer overflow in output path join * #1252 CVE-2026-56410 -- xmlwf: Integer overflow in `resolveSystemId` * #1263 CVE-2026-56411 -- xmlwf: Integer overflow in notation list allocation * #1278 CVE-2026-56412 -- Guard XML_TOK_DATA_CHARS handler calls in `doCdataSection`, plugging a hole in the fix to CVE-2026-50219 ++++ salt: - Fix test failures with pytest>=8 - Fix unit tests that fail due to async Tornado usage - Stabilize testsuite tests and fix AllEventsHandler - Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286) - Support attrlist in ldap.managed (bsc#1257151) - Fix the tests failing after switching to non-vendored tornado - Fix the default group in tests for new users in SLE 15.6 - Use AsyncHTTPClient in salt.utils.http (bsc#1268325) - Fix file fetching with cp module on non-vendored tornado - Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822) - Fix ImportError during reentrant SIGTERM shutdown - Fix broken "pkg.info_installed" after migration to salt.utils.timeutil - Fix deprecation warnings when running on Python 3.13 - Calculate UUID grain for Xen PV guests (bsc#1255418) - Add missing python-rpm-macros BR (#129) - Add 'show_changes' arg to 'file.append/file.prepend" states - Added: * migrate-rest_tornado-saltnado-tests-to-pytest-774.patch * stabilize-testsuite-773.patch * stabilize-testsuite-tests-and-fix-alleventshandler-7.patch * switch-apache2ctl-to-apachectl-for-suse-oses-bsc-125.patch * support-attrlist-in-ldap.managed-746.patch * fix-the-tests-failing-after-switching-to-non-vendore.patch * fix-the-default-group-in-tests-for-new-users-in-sle-.patch * use-asynchttpclient-in-salt.utils.http-bsc-1268325.patch * fix-file-fetching-with-non-vendored-tornado.patch * decode-binary-pillars-for-salt-ssh-to-avoid-exceptio.patch * fix-importerror-during-reentrant-sigterm-shutdown.patch * fix-broken-pkg.info_installed-after-moving-to-salt.u.patch * fix-deprecation-warnings-when-running-on-python-3.13.patch * calculate-uuid-grain-for-xen-pv-guests-759.patch * add-show_changes-to-file.append-and-file.prepend-sta.patch ++++ qemu: - service: switch back to tar_scm - Bug and CVE fixes: * target/s390x: Make container ids in SysIB_15x 1-based (bsc#1275490) * target/s390x: move @deprecated-props to CpuModelExpansion Info (bsc#1273447) * target/s390x: filter deprecated properties based on model expansion type (bsc#1273447) * target/s390x: flag te and cte as deprecated (bsc#1273447) * target/s390x: report deprecated-props in cpu-model-expansion reply (bcs#1273447) * virtio-gpu: fix overflow check when allocating 2d image (bsc#1268061, CVE-2026-3886) ------------------------------------------------------------------ ------------------ 2026-8-20 - Aug 20 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - kabi: tls add counters for rekey (bsc#1267564 jsc#PED-16401). - commit 1b5cd0d - sunrpc: wait for in-flight TLS handshake callback when cancel loses race (CVE-2026-72221 bsc#1275665). - commit 97c6556 - sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (CVE-2026-72222 bsc#1275669). - commit 768b29d - udf: validate sparing table length as an entry count, not a byte count (bsc#1273958 CVE-2026-64322). - commit 0d90bd3 - nvmet: move async event work off nvmet-wq (CVE-2026-31557 bsc#1263061). - commit 3880b04 - isofs: bound Rock Ridge symlink components to the SL record (bsc#1273936 CVE-2026-64317). - commit 0d1042d - rbd: eliminate a race in lock_dwork draining on unmap (bsc#1273741 CVE-2026-64112). - commit eb603f2 - fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108 CVE-2026-52990). - commit c523655 - tls: skip setting sk_write_space on rekey (bsc#1267564 jsc#PED-16401). - selftests: tls: add rekey tests (bsc#1267564 jsc#PED-16401). - selftests: tls: add key_generation argument to tls_crypto_info_init (bsc#1267564 jsc#PED-16401). - docs: tls: document TLS1.3 key updates (bsc#1267564 jsc#PED-16401). - tls: add counters for rekey (bsc#1267564 jsc#PED-16401). - tls: implement rekey for TLS1.3 (bsc#1267564 jsc#PED-16401). - tls: block decryption when a rekey is pending (bsc#1267564 jsc#PED-16401). - net: tls: Pass union tls_crypto_context pointer to memzero_explicit (bsc#1267564 jsc#PED-16401). - commit 633f12e - iommu/amd: Bound the early ACPI HID map (CVE-2026-68325 bsc#1274651). - commit 7ae0985 - iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() (CVE-2026-68324 bsc#1274649). - commit e754326 - btrfs: skip global block reserve accounting for rescue mounts (CVE-2026-74571 bsc#1275561). - commit f3c66f4 - drm/amd/display: Fix out-of-bounds read in (bsc#1270090 CVE-2026-53330) - commit 2f57047 - platform/chrome: sensorhub: Fix dropped timestamp events and log spam (git-fixes). - commit ee95476 - software node: Fix software_node_get_reference_args() with index -1 (git-fixes). - media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks (git-fixes). - media: nxp: imx8-isi: Correct color map between V4L2 and ISI (git-fixes). - media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing (git-fixes). - media: venus: fix payload size calculation in parse_raw_formats() (git-fixes). - media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() (git-fixes). - media: em28xx: defer audio-only extension registration (git-fixes). - media: vimc: fix pixel format lookup in enum_framesizes (git-fixes). - media: cx23885: cancel NetUP CI work before teardown (git-fixes). - media: v4l2-ctrls: Allow unknown HDR10 white point and luminance (git-fixes). - media: tda18250: fix possible integer overflow (git-fixes). - media: saa7164: fix cleanup on resource allocation failure (git-fixes). - Revert "media: v4l2-dev: fix error handling in __video_register_device()" (git-fixes). - spi: img-spfi: don't disable runtime PM on DMA deferred probe (git-fixes). - spi: sprd-adi: Fix probe succeeding without registering the controller (git-fixes). - regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling (git-fixes). - regulator: core: use system_freezable_wq for init complete work (git-fixes). - regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata (git-fixes). - regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer (git-fixes). - platform/chrome: cros_ec_debugfs: Unregister panic notifier (git-fixes). - platform/chrome: cros_ec_debugfs: Clean up console log on probe failure (git-fixes). - platform/chrome: sensorhub: Fix memory overread in ring handler (git-fixes). - platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count (git-fixes). - platform/chrome: sensorhub: Bound the EC-reported sensor number (git-fixes). - vt: add permission check for KDSKBMETA ioctl (stable-fixes). - vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (stable-fixes). - Revert "thermal/drivers/hwmon: Cleanup coding style a bit" (stable-fixes). - spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers (stable-fixes). - regulator: devres: fix devm_regulator_get_enable_read_voltage() return (git-fixes). - regulator: devres: add API for reference voltage supplies (stable-fixes). - commit cc280ca - media: zoran: Avoid freeing a registered video_device twice (git-fixes). - media: s2255: bound JPEG frame size before copying into the buffer (git-fixes). - media: cedrus: fix memory leak in cedrus_init_ctrls() (git-fixes). - media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common (git-fixes). - media: s2255: check firmware size before reading trailing marker (git-fixes). - media: cobalt: Avoid freeing ALSA private data twice (git-fixes). - staging: media: tegra-video: vi: fix probe failure on skipped last port (git-fixes). - media: go7007: defer the ALSA v4l2 put until card release (git-fixes). - media: usbtv: keep device alive while ALSA card exists (git-fixes). - media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure (git-fixes). - media: em28xx: fix use-after-free of dev_next->devlist on disconnect (git-fixes). - media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link (git-fixes). - media: vicodec: fix out-of-bounds write in FWHT encoder (git-fixes). - media: cx231xx: reject geometry changes while the VBI queue is busy (git-fixes). - media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure (git-fixes). - media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref (git-fixes). - media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak (git-fixes). - media: cec: Serialize exclusive follower delivery (git-fixes). - media: i2c: ov7740: fix use-after-destroy in remove (git-fixes). - media: i2c: ov02a10: fix endpoint parsing use-after-free (git-fixes). - media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define (git-fixes). - media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define (git-fixes). - media: cec-pin: Fix event FIFO ordering (git-fixes). - media: cec: disable delayed work before freeing an interrupted transmit (git-fixes). - media: cec: stm32: prevent out-of-bounds write on RX overflow (git-fixes). - media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash (git-fixes). - media: rc: sunxi-cir: Unregister rc device on probe failure (git-fixes). - media: mc-entity: Add missing kerneldoc (git-fixes). - Input: focaltech - use signed coordinates to prevent underflow (git-fixes). - commit 9ea0859 - hwrng: ks-sa - Fix runtime PM cleanup on registration failure (git-fixes). - hwrng: omap - Fix probe error path cleanup (git-fixes). - hwmon: (max6621) fix negative temperature offset and crit readings (git-fixes). - hwmon: (max6621) fix temperature clamp range (git-fixes). - Input: iqs5xx - validate firmware record destination span (git-fixes). - Input: mms114 - fix Y-resolution configuration (git-fixes). - Input: evdev - sanitize event type index when fetching event masks (stable-fixes). - Input: evdev - fix information leak in evdev_pass_values() (stable-fixes). - commit 826af51 - firmware_loader: do not queue completed sysfs fallback requests (git-fixes). - HID: nintendo: Fix imu_timestamp_us double increment per report (git-fixes). - HID: roccat: free buffered reports when destroying device (git-fixes). - HID: roccat: bound device-supplied profile index (git-fixes). - HID: tmff: Use 64-bit arithmetic for force feedback scaling (git-fixes). - HID: sensor: custom: Fix field sysfs group cleanup on failure (git-fixes). - HID: sensor: custom: Fix use-after-free in enable_sensor (git-fixes). - HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature (git-fixes). - HID: picolcd: clamp eeprom debugfs read to bytes actually received (git-fixes). - HID: lg4ff: validate report length before fixed offsets (git-fixes). - HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure (git-fixes). - HID: hyperv: validate initial device info bounds (git-fixes). - HID: core: fix number/pointer type confusion on long items (git-fixes). - HID: core: fix OOB read of field->usage in hid_set_field() (git-fixes). - HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() (git-fixes). - HID: mcp2221: validate report size in mcp2221_raw_event() (git-fixes). - hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations (git-fixes). - drm/amdgpu: fix aperture iounmap skipped on device removal (git-fixes). - hwmon: (lm25066) Use i2c_get_match_data() (stable-fixes). - commit ad9e273 - crypto: qce - fix CCM AAD buffer underallocation (git-fixes). - crypto: hisilicon/sec2 - fix CCM algorithm long packet failure (git-fixes). - crypto: keembay - publish OF module alias for OCS AES/SM4 (git-fixes). - crypto: keembay - Initialize completion before requesting IRQ (git-fixes). - crypto: aspeed - Propagate platform_get_irq() errors (git-fixes). - crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping (git-fixes). - crypto: doc - Remove extra parenthesis (git-fixes). - driver core: soc: Unregister bus on early device registration failure (git-fixes). - device property: fix infinite loop in fwnode_for_each_child_node() (git-fixes). - Revert "drm/amdgpu: fix aperture mapping leak" (git-fixes). - commit edd19ea - crypto: ccp - Fix memory leak in SEV INIT_EX path (git-fixes). - crypto: ccp - Fix possible deadlock in SEV init failure path (git-fixes). - crypto: rk3288 - fail ahash requests on HASH idle timeout (git-fixes). - crypto: mxs-dcp - fix source scatterlist length access (git-fixes). - crypto: sa2ul - stop probe if context pool creation fails (git-fixes). - crypto: atmel-sha204a - fix heap info leak on I2C transfer failure (git-fixes). - crypto: atmel-tdes - use scatterlist length before DMA mapping (git-fixes). - crypto: qat - clear AES key schedule from stack (git-fixes). - crypto: qat - cancel work on re-enable SR-IOV timeout (git-fixes). - ALSA: hda: Fix connection list comparison in proc output (git-fixes). - ASoC: SOF: validate topology volume range before allocation (git-fixes). - ASoC: xilinx: formatter_pcm: fix stream_data leak on open error (git-fixes). - ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready (git-fixes). - ASoC: pxa: Use devm_clk_get_optional() for extclk clock (git-fixes). - ASoC: qcom: q6apm: keep the graph start count in sync with the DSP (git-fixes). - ASoC: sti-sas: sort the register default table (git-fixes). - ASoC: max9860: sort the register default table (git-fixes). - ASoC: cx2072x: sort the register default table (git-fixes). - ASoC: ml26124: sort the register default table (git-fixes). - ASoC: tegra210_mixer: sort the register default table (git-fixes). - ASoC: tegra210_i2s: sort the register default table (git-fixes). - ASoC: fsl_easrc: sort the register default table (git-fixes). - ASoC: sgtl5000: sort the register default table (git-fixes). - ASoC: tas2780: sort the register default table (git-fixes). - ASoC: tas2764: sort the register default table (git-fixes). - ASoC: tas2552: sort the register default table (git-fixes). - ASoC: pcm512x: sort the register default table (git-fixes). - ASoC: rt1318-sdw: sort the register default table (git-fixes). - ASoC: rt1316-sdw: sort the register default table (git-fixes). - ASoC: rt715-sdca: sort the register default tables (git-fixes). - ASoC: rt715-sdca: drop duplicate reg_default entries (git-fixes). - ASoC: rt715: sort the register default table (git-fixes). - ASoC: rt712-sdca-dmic: sort the register default table (git-fixes). - ASoC: rt711-sdca: sort the register default tables (git-fixes). - ASoC: rt711: sort the register default table (git-fixes). - ASoC: rt700: sort the register default table (git-fixes). - ASoC: rt700: drop duplicate reg_default entry (git-fixes). - ASoC: rt298: sort the register default table (git-fixes). - ASoC: rt286: sort the register default table (git-fixes). - ASoC: rt274: sort the register default table (git-fixes). - ASoC: adau1761: sort the register default table (git-fixes). - ASoC: meson: Keep link pointers valid on realloc failure (git-fixes). - ASoC: apple: mca: increase SERDES reset delay (git-fixes). - ASoC: cs35l34: drain threaded IRQ before runtime suspend (git-fixes). - ASoC: cs35l33: drain threaded IRQ before runtime suspend (git-fixes). - ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get (git-fixes). - ASoC: fsl_audmix: rework runtime PM handling in probe (git-fixes). - AsoC: intel: sst: fix PCI device reference leak on probe failure (git-fixes). - ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure (git-fixes). - ASoC: rt700-sdw: always drain jack work on remove (git-fixes). - ALSA: core: Fix use-after-free in snd_card_do_free() (git-fixes). - ALSA: seq: midi: Serialize input teardown with event_input (git-fixes). - ALSA: seq: midi: Optimize event_input locking with RCU (git-fixes). - ALSA: hda/ext: preserve PPLCCTL bits when clearing reset (git-fixes). - ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion (git-fixes). - ALSA: bcd2000: clear the URB pointers on disconnect (git-fixes). - ALSA: 6fire: bound the MIDI event length from the device (git-fixes). - ALSA: hpi: Check transport errors during HPI6000 adapter initialization (git-fixes). - ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() (git-fixes). - commit 9c299cd - bpf: Fix use-after-free in offloaded map/prog info fill (CVE-2026-53089 bsc#1269783). - commit 850f5b2 - bpf: Fix stale offload->prog pointer after constant blinding (CVE-2026-53094 bsc#1269965). - commit df23795 - selftests/bpf: Add selftests for the invocation of bpf_lwt_xmit_push_encap (CVE-2026-53111 bsc#1269167). - bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap (CVE-2026-53111 bsc#1269167). - commit 6ef4eb2 - xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426 bsc#1274705). - commit 1c75fed - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (CVE-2026-64581 bsc#1274041). - commit c9dc629 - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572 bsc#1274014). - commit 3d39710 ++++ kernel-rt: - kabi: tls add counters for rekey (bsc#1267564 jsc#PED-16401). - commit 1b5cd0d - sunrpc: wait for in-flight TLS handshake callback when cancel loses race (CVE-2026-72221 bsc#1275665). - commit 97c6556 - sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (CVE-2026-72222 bsc#1275669). - commit 768b29d - udf: validate sparing table length as an entry count, not a byte count (bsc#1273958 CVE-2026-64322). - commit 0d90bd3 - nvmet: move async event work off nvmet-wq (CVE-2026-31557 bsc#1263061). - commit 3880b04 - isofs: bound Rock Ridge symlink components to the SL record (bsc#1273936 CVE-2026-64317). - commit 0d1042d - rbd: eliminate a race in lock_dwork draining on unmap (bsc#1273741 CVE-2026-64112). - commit eb603f2 - fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108 CVE-2026-52990). - commit c523655 - tls: skip setting sk_write_space on rekey (bsc#1267564 jsc#PED-16401). - selftests: tls: add rekey tests (bsc#1267564 jsc#PED-16401). - selftests: tls: add key_generation argument to tls_crypto_info_init (bsc#1267564 jsc#PED-16401). - docs: tls: document TLS1.3 key updates (bsc#1267564 jsc#PED-16401). - tls: add counters for rekey (bsc#1267564 jsc#PED-16401). - tls: implement rekey for TLS1.3 (bsc#1267564 jsc#PED-16401). - tls: block decryption when a rekey is pending (bsc#1267564 jsc#PED-16401). - net: tls: Pass union tls_crypto_context pointer to memzero_explicit (bsc#1267564 jsc#PED-16401). - commit 633f12e - iommu/amd: Bound the early ACPI HID map (CVE-2026-68325 bsc#1274651). - commit 7ae0985 - iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() (CVE-2026-68324 bsc#1274649). - commit e754326 - btrfs: skip global block reserve accounting for rescue mounts (CVE-2026-74571 bsc#1275561). - commit f3c66f4 - drm/amd/display: Fix out-of-bounds read in (bsc#1270090 CVE-2026-53330) - commit 2f57047 - platform/chrome: sensorhub: Fix dropped timestamp events and log spam (git-fixes). - commit ee95476 - software node: Fix software_node_get_reference_args() with index -1 (git-fixes). - media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks (git-fixes). - media: nxp: imx8-isi: Correct color map between V4L2 and ISI (git-fixes). - media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing (git-fixes). - media: venus: fix payload size calculation in parse_raw_formats() (git-fixes). - media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() (git-fixes). - media: em28xx: defer audio-only extension registration (git-fixes). - media: vimc: fix pixel format lookup in enum_framesizes (git-fixes). - media: cx23885: cancel NetUP CI work before teardown (git-fixes). - media: v4l2-ctrls: Allow unknown HDR10 white point and luminance (git-fixes). - media: tda18250: fix possible integer overflow (git-fixes). - media: saa7164: fix cleanup on resource allocation failure (git-fixes). - Revert "media: v4l2-dev: fix error handling in __video_register_device()" (git-fixes). - spi: img-spfi: don't disable runtime PM on DMA deferred probe (git-fixes). - spi: sprd-adi: Fix probe succeeding without registering the controller (git-fixes). - regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling (git-fixes). - regulator: core: use system_freezable_wq for init complete work (git-fixes). - regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata (git-fixes). - regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer (git-fixes). - platform/chrome: cros_ec_debugfs: Unregister panic notifier (git-fixes). - platform/chrome: cros_ec_debugfs: Clean up console log on probe failure (git-fixes). - platform/chrome: sensorhub: Fix memory overread in ring handler (git-fixes). - platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count (git-fixes). - platform/chrome: sensorhub: Bound the EC-reported sensor number (git-fixes). - vt: add permission check for KDSKBMETA ioctl (stable-fixes). - vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (stable-fixes). - Revert "thermal/drivers/hwmon: Cleanup coding style a bit" (stable-fixes). - spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers (stable-fixes). - regulator: devres: fix devm_regulator_get_enable_read_voltage() return (git-fixes). - regulator: devres: add API for reference voltage supplies (stable-fixes). - commit cc280ca - media: zoran: Avoid freeing a registered video_device twice (git-fixes). - media: s2255: bound JPEG frame size before copying into the buffer (git-fixes). - media: cedrus: fix memory leak in cedrus_init_ctrls() (git-fixes). - media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common (git-fixes). - media: s2255: check firmware size before reading trailing marker (git-fixes). - media: cobalt: Avoid freeing ALSA private data twice (git-fixes). - staging: media: tegra-video: vi: fix probe failure on skipped last port (git-fixes). - media: go7007: defer the ALSA v4l2 put until card release (git-fixes). - media: usbtv: keep device alive while ALSA card exists (git-fixes). - media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure (git-fixes). - media: em28xx: fix use-after-free of dev_next->devlist on disconnect (git-fixes). - media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link (git-fixes). - media: vicodec: fix out-of-bounds write in FWHT encoder (git-fixes). - media: cx231xx: reject geometry changes while the VBI queue is busy (git-fixes). - media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure (git-fixes). - media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref (git-fixes). - media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak (git-fixes). - media: cec: Serialize exclusive follower delivery (git-fixes). - media: i2c: ov7740: fix use-after-destroy in remove (git-fixes). - media: i2c: ov02a10: fix endpoint parsing use-after-free (git-fixes). - media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define (git-fixes). - media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define (git-fixes). - media: cec-pin: Fix event FIFO ordering (git-fixes). - media: cec: disable delayed work before freeing an interrupted transmit (git-fixes). - media: cec: stm32: prevent out-of-bounds write on RX overflow (git-fixes). - media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash (git-fixes). - media: rc: sunxi-cir: Unregister rc device on probe failure (git-fixes). - media: mc-entity: Add missing kerneldoc (git-fixes). - Input: focaltech - use signed coordinates to prevent underflow (git-fixes). - commit 9ea0859 - hwrng: ks-sa - Fix runtime PM cleanup on registration failure (git-fixes). - hwrng: omap - Fix probe error path cleanup (git-fixes). - hwmon: (max6621) fix negative temperature offset and crit readings (git-fixes). - hwmon: (max6621) fix temperature clamp range (git-fixes). - Input: iqs5xx - validate firmware record destination span (git-fixes). - Input: mms114 - fix Y-resolution configuration (git-fixes). - Input: evdev - sanitize event type index when fetching event masks (stable-fixes). - Input: evdev - fix information leak in evdev_pass_values() (stable-fixes). - commit 826af51 - firmware_loader: do not queue completed sysfs fallback requests (git-fixes). - HID: nintendo: Fix imu_timestamp_us double increment per report (git-fixes). - HID: roccat: free buffered reports when destroying device (git-fixes). - HID: roccat: bound device-supplied profile index (git-fixes). - HID: tmff: Use 64-bit arithmetic for force feedback scaling (git-fixes). - HID: sensor: custom: Fix field sysfs group cleanup on failure (git-fixes). - HID: sensor: custom: Fix use-after-free in enable_sensor (git-fixes). - HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature (git-fixes). - HID: picolcd: clamp eeprom debugfs read to bytes actually received (git-fixes). - HID: lg4ff: validate report length before fixed offsets (git-fixes). - HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure (git-fixes). - HID: hyperv: validate initial device info bounds (git-fixes). - HID: core: fix number/pointer type confusion on long items (git-fixes). - HID: core: fix OOB read of field->usage in hid_set_field() (git-fixes). - HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() (git-fixes). - HID: mcp2221: validate report size in mcp2221_raw_event() (git-fixes). - hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations (git-fixes). - drm/amdgpu: fix aperture iounmap skipped on device removal (git-fixes). - hwmon: (lm25066) Use i2c_get_match_data() (stable-fixes). - commit ad9e273 - crypto: qce - fix CCM AAD buffer underallocation (git-fixes). - crypto: hisilicon/sec2 - fix CCM algorithm long packet failure (git-fixes). - crypto: keembay - publish OF module alias for OCS AES/SM4 (git-fixes). - crypto: keembay - Initialize completion before requesting IRQ (git-fixes). - crypto: aspeed - Propagate platform_get_irq() errors (git-fixes). - crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping (git-fixes). - crypto: doc - Remove extra parenthesis (git-fixes). - driver core: soc: Unregister bus on early device registration failure (git-fixes). - device property: fix infinite loop in fwnode_for_each_child_node() (git-fixes). - Revert "drm/amdgpu: fix aperture mapping leak" (git-fixes). - commit edd19ea - crypto: ccp - Fix memory leak in SEV INIT_EX path (git-fixes). - crypto: ccp - Fix possible deadlock in SEV init failure path (git-fixes). - crypto: rk3288 - fail ahash requests on HASH idle timeout (git-fixes). - crypto: mxs-dcp - fix source scatterlist length access (git-fixes). - crypto: sa2ul - stop probe if context pool creation fails (git-fixes). - crypto: atmel-sha204a - fix heap info leak on I2C transfer failure (git-fixes). - crypto: atmel-tdes - use scatterlist length before DMA mapping (git-fixes). - crypto: qat - clear AES key schedule from stack (git-fixes). - crypto: qat - cancel work on re-enable SR-IOV timeout (git-fixes). - ALSA: hda: Fix connection list comparison in proc output (git-fixes). - ASoC: SOF: validate topology volume range before allocation (git-fixes). - ASoC: xilinx: formatter_pcm: fix stream_data leak on open error (git-fixes). - ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready (git-fixes). - ASoC: pxa: Use devm_clk_get_optional() for extclk clock (git-fixes). - ASoC: qcom: q6apm: keep the graph start count in sync with the DSP (git-fixes). - ASoC: sti-sas: sort the register default table (git-fixes). - ASoC: max9860: sort the register default table (git-fixes). - ASoC: cx2072x: sort the register default table (git-fixes). - ASoC: ml26124: sort the register default table (git-fixes). - ASoC: tegra210_mixer: sort the register default table (git-fixes). - ASoC: tegra210_i2s: sort the register default table (git-fixes). - ASoC: fsl_easrc: sort the register default table (git-fixes). - ASoC: sgtl5000: sort the register default table (git-fixes). - ASoC: tas2780: sort the register default table (git-fixes). - ASoC: tas2764: sort the register default table (git-fixes). - ASoC: tas2552: sort the register default table (git-fixes). - ASoC: pcm512x: sort the register default table (git-fixes). - ASoC: rt1318-sdw: sort the register default table (git-fixes). - ASoC: rt1316-sdw: sort the register default table (git-fixes). - ASoC: rt715-sdca: sort the register default tables (git-fixes). - ASoC: rt715-sdca: drop duplicate reg_default entries (git-fixes). - ASoC: rt715: sort the register default table (git-fixes). - ASoC: rt712-sdca-dmic: sort the register default table (git-fixes). - ASoC: rt711-sdca: sort the register default tables (git-fixes). - ASoC: rt711: sort the register default table (git-fixes). - ASoC: rt700: sort the register default table (git-fixes). - ASoC: rt700: drop duplicate reg_default entry (git-fixes). - ASoC: rt298: sort the register default table (git-fixes). - ASoC: rt286: sort the register default table (git-fixes). - ASoC: rt274: sort the register default table (git-fixes). - ASoC: adau1761: sort the register default table (git-fixes). - ASoC: meson: Keep link pointers valid on realloc failure (git-fixes). - ASoC: apple: mca: increase SERDES reset delay (git-fixes). - ASoC: cs35l34: drain threaded IRQ before runtime suspend (git-fixes). - ASoC: cs35l33: drain threaded IRQ before runtime suspend (git-fixes). - ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get (git-fixes). - ASoC: fsl_audmix: rework runtime PM handling in probe (git-fixes). - AsoC: intel: sst: fix PCI device reference leak on probe failure (git-fixes). - ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure (git-fixes). - ASoC: rt700-sdw: always drain jack work on remove (git-fixes). - ALSA: core: Fix use-after-free in snd_card_do_free() (git-fixes). - ALSA: seq: midi: Serialize input teardown with event_input (git-fixes). - ALSA: seq: midi: Optimize event_input locking with RCU (git-fixes). - ALSA: hda/ext: preserve PPLCCTL bits when clearing reset (git-fixes). - ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion (git-fixes). - ALSA: bcd2000: clear the URB pointers on disconnect (git-fixes). - ALSA: 6fire: bound the MIDI event length from the device (git-fixes). - ALSA: hpi: Check transport errors during HPI6000 adapter initialization (git-fixes). - ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() (git-fixes). - commit 9c299cd - bpf: Fix use-after-free in offloaded map/prog info fill (CVE-2026-53089 bsc#1269783). - commit 850f5b2 - bpf: Fix stale offload->prog pointer after constant blinding (CVE-2026-53094 bsc#1269965). - commit df23795 - selftests/bpf: Add selftests for the invocation of bpf_lwt_xmit_push_encap (CVE-2026-53111 bsc#1269167). - bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap (CVE-2026-53111 bsc#1269167). - commit 6ef4eb2 - xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426 bsc#1274705). - commit 1c75fed - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (CVE-2026-64581 bsc#1274041). - commit c9dc629 - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572 bsc#1274014). - commit 3d39710 ++++ kernel-rt_debug: - kabi: tls add counters for rekey (bsc#1267564 jsc#PED-16401). - commit 1b5cd0d - sunrpc: wait for in-flight TLS handshake callback when cancel loses race (CVE-2026-72221 bsc#1275665). - commit 97c6556 - sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (CVE-2026-72222 bsc#1275669). - commit 768b29d - udf: validate sparing table length as an entry count, not a byte count (bsc#1273958 CVE-2026-64322). - commit 0d90bd3 - nvmet: move async event work off nvmet-wq (CVE-2026-31557 bsc#1263061). - commit 3880b04 - isofs: bound Rock Ridge symlink components to the SL record (bsc#1273936 CVE-2026-64317). - commit 0d1042d - rbd: eliminate a race in lock_dwork draining on unmap (bsc#1273741 CVE-2026-64112). - commit eb603f2 - fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108 CVE-2026-52990). - commit c523655 - tls: skip setting sk_write_space on rekey (bsc#1267564 jsc#PED-16401). - selftests: tls: add rekey tests (bsc#1267564 jsc#PED-16401). - selftests: tls: add key_generation argument to tls_crypto_info_init (bsc#1267564 jsc#PED-16401). - docs: tls: document TLS1.3 key updates (bsc#1267564 jsc#PED-16401). - tls: add counters for rekey (bsc#1267564 jsc#PED-16401). - tls: implement rekey for TLS1.3 (bsc#1267564 jsc#PED-16401). - tls: block decryption when a rekey is pending (bsc#1267564 jsc#PED-16401). - net: tls: Pass union tls_crypto_context pointer to memzero_explicit (bsc#1267564 jsc#PED-16401). - commit 633f12e - iommu/amd: Bound the early ACPI HID map (CVE-2026-68325 bsc#1274651). - commit 7ae0985 - iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() (CVE-2026-68324 bsc#1274649). - commit e754326 - btrfs: skip global block reserve accounting for rescue mounts (CVE-2026-74571 bsc#1275561). - commit f3c66f4 - drm/amd/display: Fix out-of-bounds read in (bsc#1270090 CVE-2026-53330) - commit 2f57047 - platform/chrome: sensorhub: Fix dropped timestamp events and log spam (git-fixes). - commit ee95476 - software node: Fix software_node_get_reference_args() with index -1 (git-fixes). - media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks (git-fixes). - media: nxp: imx8-isi: Correct color map between V4L2 and ISI (git-fixes). - media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing (git-fixes). - media: venus: fix payload size calculation in parse_raw_formats() (git-fixes). - media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() (git-fixes). - media: em28xx: defer audio-only extension registration (git-fixes). - media: vimc: fix pixel format lookup in enum_framesizes (git-fixes). - media: cx23885: cancel NetUP CI work before teardown (git-fixes). - media: v4l2-ctrls: Allow unknown HDR10 white point and luminance (git-fixes). - media: tda18250: fix possible integer overflow (git-fixes). - media: saa7164: fix cleanup on resource allocation failure (git-fixes). - Revert "media: v4l2-dev: fix error handling in __video_register_device()" (git-fixes). - spi: img-spfi: don't disable runtime PM on DMA deferred probe (git-fixes). - spi: sprd-adi: Fix probe succeeding without registering the controller (git-fixes). - regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling (git-fixes). - regulator: core: use system_freezable_wq for init complete work (git-fixes). - regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata (git-fixes). - regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer (git-fixes). - platform/chrome: cros_ec_debugfs: Unregister panic notifier (git-fixes). - platform/chrome: cros_ec_debugfs: Clean up console log on probe failure (git-fixes). - platform/chrome: sensorhub: Fix memory overread in ring handler (git-fixes). - platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count (git-fixes). - platform/chrome: sensorhub: Bound the EC-reported sensor number (git-fixes). - vt: add permission check for KDSKBMETA ioctl (stable-fixes). - vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (stable-fixes). - Revert "thermal/drivers/hwmon: Cleanup coding style a bit" (stable-fixes). - spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers (stable-fixes). - regulator: devres: fix devm_regulator_get_enable_read_voltage() return (git-fixes). - regulator: devres: add API for reference voltage supplies (stable-fixes). - commit cc280ca - media: zoran: Avoid freeing a registered video_device twice (git-fixes). - media: s2255: bound JPEG frame size before copying into the buffer (git-fixes). - media: cedrus: fix memory leak in cedrus_init_ctrls() (git-fixes). - media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common (git-fixes). - media: s2255: check firmware size before reading trailing marker (git-fixes). - media: cobalt: Avoid freeing ALSA private data twice (git-fixes). - staging: media: tegra-video: vi: fix probe failure on skipped last port (git-fixes). - media: go7007: defer the ALSA v4l2 put until card release (git-fixes). - media: usbtv: keep device alive while ALSA card exists (git-fixes). - media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure (git-fixes). - media: em28xx: fix use-after-free of dev_next->devlist on disconnect (git-fixes). - media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link (git-fixes). - media: vicodec: fix out-of-bounds write in FWHT encoder (git-fixes). - media: cx231xx: reject geometry changes while the VBI queue is busy (git-fixes). - media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure (git-fixes). - media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref (git-fixes). - media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak (git-fixes). - media: cec: Serialize exclusive follower delivery (git-fixes). - media: i2c: ov7740: fix use-after-destroy in remove (git-fixes). - media: i2c: ov02a10: fix endpoint parsing use-after-free (git-fixes). - media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define (git-fixes). - media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define (git-fixes). - media: cec-pin: Fix event FIFO ordering (git-fixes). - media: cec: disable delayed work before freeing an interrupted transmit (git-fixes). - media: cec: stm32: prevent out-of-bounds write on RX overflow (git-fixes). - media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash (git-fixes). - media: rc: sunxi-cir: Unregister rc device on probe failure (git-fixes). - media: mc-entity: Add missing kerneldoc (git-fixes). - Input: focaltech - use signed coordinates to prevent underflow (git-fixes). - commit 9ea0859 - hwrng: ks-sa - Fix runtime PM cleanup on registration failure (git-fixes). - hwrng: omap - Fix probe error path cleanup (git-fixes). - hwmon: (max6621) fix negative temperature offset and crit readings (git-fixes). - hwmon: (max6621) fix temperature clamp range (git-fixes). - Input: iqs5xx - validate firmware record destination span (git-fixes). - Input: mms114 - fix Y-resolution configuration (git-fixes). - Input: evdev - sanitize event type index when fetching event masks (stable-fixes). - Input: evdev - fix information leak in evdev_pass_values() (stable-fixes). - commit 826af51 - firmware_loader: do not queue completed sysfs fallback requests (git-fixes). - HID: nintendo: Fix imu_timestamp_us double increment per report (git-fixes). - HID: roccat: free buffered reports when destroying device (git-fixes). - HID: roccat: bound device-supplied profile index (git-fixes). - HID: tmff: Use 64-bit arithmetic for force feedback scaling (git-fixes). - HID: sensor: custom: Fix field sysfs group cleanup on failure (git-fixes). - HID: sensor: custom: Fix use-after-free in enable_sensor (git-fixes). - HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature (git-fixes). - HID: picolcd: clamp eeprom debugfs read to bytes actually received (git-fixes). - HID: lg4ff: validate report length before fixed offsets (git-fixes). - HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure (git-fixes). - HID: hyperv: validate initial device info bounds (git-fixes). - HID: core: fix number/pointer type confusion on long items (git-fixes). - HID: core: fix OOB read of field->usage in hid_set_field() (git-fixes). - HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() (git-fixes). - HID: mcp2221: validate report size in mcp2221_raw_event() (git-fixes). - hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations (git-fixes). - drm/amdgpu: fix aperture iounmap skipped on device removal (git-fixes). - hwmon: (lm25066) Use i2c_get_match_data() (stable-fixes). - commit ad9e273 - crypto: qce - fix CCM AAD buffer underallocation (git-fixes). - crypto: hisilicon/sec2 - fix CCM algorithm long packet failure (git-fixes). - crypto: keembay - publish OF module alias for OCS AES/SM4 (git-fixes). - crypto: keembay - Initialize completion before requesting IRQ (git-fixes). - crypto: aspeed - Propagate platform_get_irq() errors (git-fixes). - crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping (git-fixes). - crypto: doc - Remove extra parenthesis (git-fixes). - driver core: soc: Unregister bus on early device registration failure (git-fixes). - device property: fix infinite loop in fwnode_for_each_child_node() (git-fixes). - Revert "drm/amdgpu: fix aperture mapping leak" (git-fixes). - commit edd19ea - crypto: ccp - Fix memory leak in SEV INIT_EX path (git-fixes). - crypto: ccp - Fix possible deadlock in SEV init failure path (git-fixes). - crypto: rk3288 - fail ahash requests on HASH idle timeout (git-fixes). - crypto: mxs-dcp - fix source scatterlist length access (git-fixes). - crypto: sa2ul - stop probe if context pool creation fails (git-fixes). - crypto: atmel-sha204a - fix heap info leak on I2C transfer failure (git-fixes). - crypto: atmel-tdes - use scatterlist length before DMA mapping (git-fixes). - crypto: qat - clear AES key schedule from stack (git-fixes). - crypto: qat - cancel work on re-enable SR-IOV timeout (git-fixes). - ALSA: hda: Fix connection list comparison in proc output (git-fixes). - ASoC: SOF: validate topology volume range before allocation (git-fixes). - ASoC: xilinx: formatter_pcm: fix stream_data leak on open error (git-fixes). - ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready (git-fixes). - ASoC: pxa: Use devm_clk_get_optional() for extclk clock (git-fixes). - ASoC: qcom: q6apm: keep the graph start count in sync with the DSP (git-fixes). - ASoC: sti-sas: sort the register default table (git-fixes). - ASoC: max9860: sort the register default table (git-fixes). - ASoC: cx2072x: sort the register default table (git-fixes). - ASoC: ml26124: sort the register default table (git-fixes). - ASoC: tegra210_mixer: sort the register default table (git-fixes). - ASoC: tegra210_i2s: sort the register default table (git-fixes). - ASoC: fsl_easrc: sort the register default table (git-fixes). - ASoC: sgtl5000: sort the register default table (git-fixes). - ASoC: tas2780: sort the register default table (git-fixes). - ASoC: tas2764: sort the register default table (git-fixes). - ASoC: tas2552: sort the register default table (git-fixes). - ASoC: pcm512x: sort the register default table (git-fixes). - ASoC: rt1318-sdw: sort the register default table (git-fixes). - ASoC: rt1316-sdw: sort the register default table (git-fixes). - ASoC: rt715-sdca: sort the register default tables (git-fixes). - ASoC: rt715-sdca: drop duplicate reg_default entries (git-fixes). - ASoC: rt715: sort the register default table (git-fixes). - ASoC: rt712-sdca-dmic: sort the register default table (git-fixes). - ASoC: rt711-sdca: sort the register default tables (git-fixes). - ASoC: rt711: sort the register default table (git-fixes). - ASoC: rt700: sort the register default table (git-fixes). - ASoC: rt700: drop duplicate reg_default entry (git-fixes). - ASoC: rt298: sort the register default table (git-fixes). - ASoC: rt286: sort the register default table (git-fixes). - ASoC: rt274: sort the register default table (git-fixes). - ASoC: adau1761: sort the register default table (git-fixes). - ASoC: meson: Keep link pointers valid on realloc failure (git-fixes). - ASoC: apple: mca: increase SERDES reset delay (git-fixes). - ASoC: cs35l34: drain threaded IRQ before runtime suspend (git-fixes). - ASoC: cs35l33: drain threaded IRQ before runtime suspend (git-fixes). - ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get (git-fixes). - ASoC: fsl_audmix: rework runtime PM handling in probe (git-fixes). - AsoC: intel: sst: fix PCI device reference leak on probe failure (git-fixes). - ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure (git-fixes). - ASoC: rt700-sdw: always drain jack work on remove (git-fixes). - ALSA: core: Fix use-after-free in snd_card_do_free() (git-fixes). - ALSA: seq: midi: Serialize input teardown with event_input (git-fixes). - ALSA: seq: midi: Optimize event_input locking with RCU (git-fixes). - ALSA: hda/ext: preserve PPLCCTL bits when clearing reset (git-fixes). - ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion (git-fixes). - ALSA: bcd2000: clear the URB pointers on disconnect (git-fixes). - ALSA: 6fire: bound the MIDI event length from the device (git-fixes). - ALSA: hpi: Check transport errors during HPI6000 adapter initialization (git-fixes). - ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() (git-fixes). - commit 9c299cd - bpf: Fix use-after-free in offloaded map/prog info fill (CVE-2026-53089 bsc#1269783). - commit 850f5b2 - bpf: Fix stale offload->prog pointer after constant blinding (CVE-2026-53094 bsc#1269965). - commit df23795 - selftests/bpf: Add selftests for the invocation of bpf_lwt_xmit_push_encap (CVE-2026-53111 bsc#1269167). - bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap (CVE-2026-53111 bsc#1269167). - commit 6ef4eb2 - xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426 bsc#1274705). - commit 1c75fed - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (CVE-2026-64581 bsc#1274041). - commit c9dc629 - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572 bsc#1274014). - commit 3d39710 ++++ lcms2: - Enable threads support (bsc#1247985) * Drop lcms2-visibility.patch as it was causing linker errors when enabling threads ------------------------------------------------------------------ ------------------ 2026-8-19 - Aug 19 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - netfilter: revalidate bridge ports (CVE-2026-53220 bsc#1269381). - commit fc8423b - ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228 bsc#1269256). - commit 96beef5 - net/rds: Restrict use of RDS/IB to the initial network namespace (CVE-2026-53077 bsc#1269412). - commit 59b0324 - btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() (CVE-2026-64164 bsc#1273957). - commit 93a51f9 - sctp: stream: fully roll back denied add-stream state (CVE-2026-52929 bsc#1269004). - commit 15e5e0b - ipv4: igmp: remove multicast group from hash table on device destruction (CVE-2026-64423 bsc#1274274). - commit be28a18 - fs: preserve ACL_DONT_CACHE state in forget_cached_acl() (CVE-2026-68149 bsc#1275294). - commit 753a59f - vfio/pci: Release the VGA arbiter client on register_device() failure (CVE-2026-64475 bsc#1274319). - commit 55a87ff - net/mlx5e: Use sender devcom for MPV master-up (CVE-2026-68139 bsc#1275578) - commit a6b8b2a - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293 bsc#1275091) - commit 103fa5b - vfio/mlx5: Fix racy bitfields and tighten struct layout (CVE-2026-64472 bsc#1274075) - commit 5715b74 - rds: drop incoming messages that cross network namespace boundaries (CVE-2026-68335 bsc#1274640) - commit 8433034 - RDMA/irdma: Prevent rereg_mr for non-mem regions (CVE-2026-68419 bsc#1274698) - commit 389eda3 - RDMA/irdma: Prevent user-triggered null deref on QP create (CVE-2026-68418 bsc#1274690) - commit a55a12f - RDMA/irdma: Remove redundant legacy_mode checks (git-fixes) - commit 97d736d - powerpc/pseries: pci - logic bug (bsc#1274749 ltc#221282 bsc#1274755 ltc#221284 bsc#1274756 ltc#221283). - powerpc/pseries: lparcfg - fix kbuf[] underflow (bsc#1274753 ltc#221289 bsc#1274754 ltc#221288 bsc#1274752 ltc#221290). - commit 96a9aa5 - soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() (git-fixes). - soc: qcom: rpmh-rsc: manage PM notifiers with devres (git-fixes). - bus: ti-sysc: Fix /chosen node reference leak (git-fixes). - soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() (git-fixes). - firmware: arm_scmi: Fix requested device removal race (git-fixes). - firmware: arm_scmi: Drop handle on protocol bind failures (git-fixes). - firmware: arm_scmi: Protect device request lookup with RCU (git-fixes). - firmware: arm_scmi: Use channel ID for transport teardown (git-fixes). - firmware: arm_scmi: Reject out of range DT protocol IDs (git-fixes). - firmware: arm_scmi: Avoid IDR updates while cleaning channels (git-fixes). - firmware: arm_scmi: Free transport channel on IDR failure (git-fixes). - firmware: arm_scmi: Unregister device notifier before IDR teardown (git-fixes). - thermal: intel: int3400: clean up ODVP on probe failures (git-fixes). - powercap: intel_rapl_tpmi: Handle PMU registration failure during probe (git-fixes). - PM: sleep: Fix off-by-one in wakelocks number limit check (git-fixes). - ACPI: processor: idle: Expand _LPI package sanity checks (git-fixes). - ACPI: video: Release PCI device reference after lookup (git-fixes). - ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root (git-fixes). - ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer (git-fixes). - ACPI: processor: validate MADT IOAPIC entry bounds (git-fixes). - commit 13f7a76 - bpf: Fix OOB in pcpu_init_value (CVE-2026-53076 bsc#1269695). - commit 9c1eb1a - bpf, sockmap: Take state lock for af_unix iter (CVE-2026-53033 bsc#1269388). - commit c7357c4 ++++ kernel-rt: - netfilter: revalidate bridge ports (CVE-2026-53220 bsc#1269381). - commit fc8423b - ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228 bsc#1269256). - commit 96beef5 - net/rds: Restrict use of RDS/IB to the initial network namespace (CVE-2026-53077 bsc#1269412). - commit 59b0324 - btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() (CVE-2026-64164 bsc#1273957). - commit 93a51f9 - sctp: stream: fully roll back denied add-stream state (CVE-2026-52929 bsc#1269004). - commit 15e5e0b - ipv4: igmp: remove multicast group from hash table on device destruction (CVE-2026-64423 bsc#1274274). - commit be28a18 - fs: preserve ACL_DONT_CACHE state in forget_cached_acl() (CVE-2026-68149 bsc#1275294). - commit 753a59f - vfio/pci: Release the VGA arbiter client on register_device() failure (CVE-2026-64475 bsc#1274319). - commit 55a87ff - net/mlx5e: Use sender devcom for MPV master-up (CVE-2026-68139 bsc#1275578) - commit a6b8b2a - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293 bsc#1275091) - commit 103fa5b - vfio/mlx5: Fix racy bitfields and tighten struct layout (CVE-2026-64472 bsc#1274075) - commit 5715b74 - rds: drop incoming messages that cross network namespace boundaries (CVE-2026-68335 bsc#1274640) - commit 8433034 - RDMA/irdma: Prevent rereg_mr for non-mem regions (CVE-2026-68419 bsc#1274698) - commit 389eda3 - RDMA/irdma: Prevent user-triggered null deref on QP create (CVE-2026-68418 bsc#1274690) - commit a55a12f - RDMA/irdma: Remove redundant legacy_mode checks (git-fixes) - commit 97d736d - powerpc/pseries: pci - logic bug (bsc#1274749 ltc#221282 bsc#1274755 ltc#221284 bsc#1274756 ltc#221283). - powerpc/pseries: lparcfg - fix kbuf[] underflow (bsc#1274753 ltc#221289 bsc#1274754 ltc#221288 bsc#1274752 ltc#221290). - commit 96a9aa5 - soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() (git-fixes). - soc: qcom: rpmh-rsc: manage PM notifiers with devres (git-fixes). - bus: ti-sysc: Fix /chosen node reference leak (git-fixes). - soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() (git-fixes). - firmware: arm_scmi: Fix requested device removal race (git-fixes). - firmware: arm_scmi: Drop handle on protocol bind failures (git-fixes). - firmware: arm_scmi: Protect device request lookup with RCU (git-fixes). - firmware: arm_scmi: Use channel ID for transport teardown (git-fixes). - firmware: arm_scmi: Reject out of range DT protocol IDs (git-fixes). - firmware: arm_scmi: Avoid IDR updates while cleaning channels (git-fixes). - firmware: arm_scmi: Free transport channel on IDR failure (git-fixes). - firmware: arm_scmi: Unregister device notifier before IDR teardown (git-fixes). - thermal: intel: int3400: clean up ODVP on probe failures (git-fixes). - powercap: intel_rapl_tpmi: Handle PMU registration failure during probe (git-fixes). - PM: sleep: Fix off-by-one in wakelocks number limit check (git-fixes). - ACPI: processor: idle: Expand _LPI package sanity checks (git-fixes). - ACPI: video: Release PCI device reference after lookup (git-fixes). - ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root (git-fixes). - ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer (git-fixes). - ACPI: processor: validate MADT IOAPIC entry bounds (git-fixes). - commit 13f7a76 - bpf: Fix OOB in pcpu_init_value (CVE-2026-53076 bsc#1269695). - commit 9c1eb1a - bpf, sockmap: Take state lock for af_unix iter (CVE-2026-53033 bsc#1269388). - commit c7357c4 ++++ kernel-rt_debug: - netfilter: revalidate bridge ports (CVE-2026-53220 bsc#1269381). - commit fc8423b - ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228 bsc#1269256). - commit 96beef5 - net/rds: Restrict use of RDS/IB to the initial network namespace (CVE-2026-53077 bsc#1269412). - commit 59b0324 - btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() (CVE-2026-64164 bsc#1273957). - commit 93a51f9 - sctp: stream: fully roll back denied add-stream state (CVE-2026-52929 bsc#1269004). - commit 15e5e0b - ipv4: igmp: remove multicast group from hash table on device destruction (CVE-2026-64423 bsc#1274274). - commit be28a18 - fs: preserve ACL_DONT_CACHE state in forget_cached_acl() (CVE-2026-68149 bsc#1275294). - commit 753a59f - vfio/pci: Release the VGA arbiter client on register_device() failure (CVE-2026-64475 bsc#1274319). - commit 55a87ff - net/mlx5e: Use sender devcom for MPV master-up (CVE-2026-68139 bsc#1275578) - commit a6b8b2a - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293 bsc#1275091) - commit 103fa5b - vfio/mlx5: Fix racy bitfields and tighten struct layout (CVE-2026-64472 bsc#1274075) - commit 5715b74 - rds: drop incoming messages that cross network namespace boundaries (CVE-2026-68335 bsc#1274640) - commit 8433034 - RDMA/irdma: Prevent rereg_mr for non-mem regions (CVE-2026-68419 bsc#1274698) - commit 389eda3 - RDMA/irdma: Prevent user-triggered null deref on QP create (CVE-2026-68418 bsc#1274690) - commit a55a12f - RDMA/irdma: Remove redundant legacy_mode checks (git-fixes) - commit 97d736d - powerpc/pseries: pci - logic bug (bsc#1274749 ltc#221282 bsc#1274755 ltc#221284 bsc#1274756 ltc#221283). - powerpc/pseries: lparcfg - fix kbuf[] underflow (bsc#1274753 ltc#221289 bsc#1274754 ltc#221288 bsc#1274752 ltc#221290). - commit 96a9aa5 - soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() (git-fixes). - soc: qcom: rpmh-rsc: manage PM notifiers with devres (git-fixes). - bus: ti-sysc: Fix /chosen node reference leak (git-fixes). - soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() (git-fixes). - firmware: arm_scmi: Fix requested device removal race (git-fixes). - firmware: arm_scmi: Drop handle on protocol bind failures (git-fixes). - firmware: arm_scmi: Protect device request lookup with RCU (git-fixes). - firmware: arm_scmi: Use channel ID for transport teardown (git-fixes). - firmware: arm_scmi: Reject out of range DT protocol IDs (git-fixes). - firmware: arm_scmi: Avoid IDR updates while cleaning channels (git-fixes). - firmware: arm_scmi: Free transport channel on IDR failure (git-fixes). - firmware: arm_scmi: Unregister device notifier before IDR teardown (git-fixes). - thermal: intel: int3400: clean up ODVP on probe failures (git-fixes). - powercap: intel_rapl_tpmi: Handle PMU registration failure during probe (git-fixes). - PM: sleep: Fix off-by-one in wakelocks number limit check (git-fixes). - ACPI: processor: idle: Expand _LPI package sanity checks (git-fixes). - ACPI: video: Release PCI device reference after lookup (git-fixes). - ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root (git-fixes). - ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer (git-fixes). - ACPI: processor: validate MADT IOAPIC entry bounds (git-fixes). - commit 13f7a76 - bpf: Fix OOB in pcpu_init_value (CVE-2026-53076 bsc#1269695). - commit 9c1eb1a - bpf, sockmap: Take state lock for af_unix iter (CVE-2026-53033 bsc#1269388). - commit c7357c4 ++++ sssd: - Warn about ldap_sudo_search_base only if sudo target is enabled; (bsc#1273009); Add patch 0009-SDAP-Warn-about-ldap_sudo_search_base-only-if-sudo-t.patch - Fix NSS initgroups packet heap disclosure; (bsc#1273924); (CVE-2026-68744); Add patch 0010-NSS-fix-initgroups-packet-heap-disclosure.patch - Fix unvalidated address lengths in NSS responder packet parsing can cause a heap out-of-bounds read; (bsc#1273922); (CVE-2026-68742); Add patch 0011-nss-validate-addrlen-in-sss_nss_protocol_parse_addr.patch - Fix PAM responder out-of-bounds read via unchecked auth_token_length in protocol v1; (bsc#1273925); (CVE-2026-68743); Add patch 0012-pam-validate-auth_token_length-in-extract_authtok_v1.patch ------------------------------------------------------------------ ------------------ 2026-8-18 - Aug 18 2026 ------------------- ------------------------------------------------------------------ ++++ curl: - Security fixes: * CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440) * CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412) * Add patches: - curl-CVE-2026-7168.patch - curl-CVE-2026-8926.patch - Security fix: * CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633) * Add curl-CVE-2026-5773.patch - Call http_size() first to prioritize Transfer-Encoding: chunked over a zero Content-Length empty body check (bsc#1264971) * Add patch: curl-http-prefer-chunked-encoding-over-Content-Length-0.patch ++++ kernel-default: - btrfs: do not trim a device which is not writeable (CVE-2026-64593 bsc#1274497). - commit 1572884 - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item (CVE-2026-64425 bsc#1273522). - commit 2e4e8c5 - btrfs: free mapping node on duplicate reloc root insert (CVE-2026-68450 bsc#1274834). - commit 26470eb - btrfs: reject free space cache with more entries than pages (CVE-2026-64567 bsc#1274006). - commit fddef0d - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879 bsc#1272569). - commit 4ab4b6c - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (CVE-2026-63881 bsc#1272571). - commit 098c7d3 - ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202 bsc#1275161). - commit ca2d02f - selftests/bpf: Fail unbound UDP on sockmap update (CVE-2026-68386 bsc#1274814). - commit 2de4265 - selftests/bpf: Adapt sockmap update error handling (CVE-2026-68386 bsc#1274814). - commit b55a52a - bpf, sockmap: Reject unhashed UDP sockets on sockmap update (CVE-2026-68386 bsc#1274814). - commit a141471 - bonding: fix devconf_all NULL dereference when IPv6 is disabled (CVE-2026-68336 bsc#1274639). - commit f268bcf - rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled (CVE-2026-68322 bsc#1274656). - commit e70cab4 - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index (CVE-2026-64225 bsc#1272786). - commit bc3dd83 ++++ kernel-rt: - btrfs: do not trim a device which is not writeable (CVE-2026-64593 bsc#1274497). - commit 1572884 - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item (CVE-2026-64425 bsc#1273522). - commit 2e4e8c5 - btrfs: free mapping node on duplicate reloc root insert (CVE-2026-68450 bsc#1274834). - commit 26470eb - btrfs: reject free space cache with more entries than pages (CVE-2026-64567 bsc#1274006). - commit fddef0d - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879 bsc#1272569). - commit 4ab4b6c - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (CVE-2026-63881 bsc#1272571). - commit 098c7d3 - ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202 bsc#1275161). - commit ca2d02f - selftests/bpf: Fail unbound UDP on sockmap update (CVE-2026-68386 bsc#1274814). - commit 2de4265 - selftests/bpf: Adapt sockmap update error handling (CVE-2026-68386 bsc#1274814). - commit b55a52a - bpf, sockmap: Reject unhashed UDP sockets on sockmap update (CVE-2026-68386 bsc#1274814). - commit a141471 - bonding: fix devconf_all NULL dereference when IPv6 is disabled (CVE-2026-68336 bsc#1274639). - commit f268bcf - rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled (CVE-2026-68322 bsc#1274656). - commit e70cab4 - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index (CVE-2026-64225 bsc#1272786). - commit bc3dd83 ++++ kernel-rt_debug: - btrfs: do not trim a device which is not writeable (CVE-2026-64593 bsc#1274497). - commit 1572884 - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item (CVE-2026-64425 bsc#1273522). - commit 2e4e8c5 - btrfs: free mapping node on duplicate reloc root insert (CVE-2026-68450 bsc#1274834). - commit 26470eb - btrfs: reject free space cache with more entries than pages (CVE-2026-64567 bsc#1274006). - commit fddef0d - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879 bsc#1272569). - commit 4ab4b6c - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (CVE-2026-63881 bsc#1272571). - commit 098c7d3 - ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202 bsc#1275161). - commit ca2d02f - selftests/bpf: Fail unbound UDP on sockmap update (CVE-2026-68386 bsc#1274814). - commit 2de4265 - selftests/bpf: Adapt sockmap update error handling (CVE-2026-68386 bsc#1274814). - commit b55a52a - bpf, sockmap: Reject unhashed UDP sockets on sockmap update (CVE-2026-68386 bsc#1274814). - commit a141471 - bonding: fix devconf_all NULL dereference when IPv6 is disabled (CVE-2026-68336 bsc#1274639). - commit f268bcf - rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled (CVE-2026-68322 bsc#1274656). - commit e70cab4 - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index (CVE-2026-64225 bsc#1272786). - commit bc3dd83 ------------------------------------------------------------------ ------------------ 2026-8-17 - Aug 17 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - exfat: bound uniname advance in exfat_find_dir_entry() (CVE-2026-64296 bsc#1273975). - commit 14d346f - bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path (CVE-2026-53096 bsc#1269969). - commit e132f79 - netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116 bsc#1264619). - commit 9684067 - ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (CVE-2026-31531 bsc#1263004). - commit c4005dd - netfilter: ipset: drop logically empty buckets in mtype_del (CVE-2026-31418 bsc#1262073). - commit a8cbfcd - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007 bsc#1273105). - commit 7f73141 - net: hsr: fix potential OOB access in supervision frame handling (CVE-2026-64000 bsc#1273030). - commit fa5a020 - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() (CVE-2026-64280 bsc#1273599). - commit a4e22f3 - ipv6: validate extension header length before copying to cmsg (CVE-2026-63920 bsc#1272877). - commit dce0a08 - net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274941 CVE-2026-68138). - commit 3fbd71d - drm/amdgpu: check ASPM on the dGPU host link (git-fixes). - drm/radeon: fix autosuspend cleanup during teardown (git-fixes). - drm/amdgpu: disallow multiple FENCE chunks in one submit (git-fixes). - mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit (git-fixes). - mmc: sdhci: unmap the bounce buffer before device release (git-fixes). - ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers (git-fixes). - ALSA: usb: Fix UAF at delayed release of MIDI2 EPs (git-fixes). - commit 99c4ec6 - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU (CVE-2026-64286 bsc#1274058). - commit bcd6451 - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CVE-2026-64287 bsc#1273325). - commit 6f01f8a - pppoe: reload header pointer after dev_hard_header() (CVE-2026-68121 bsc#1274888). - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (CVE-2026-68398 bsc#1274908). - commit fd3d20b - net: team: fix NULL pointer dereference in team_xmit during mode change (CVE-2026-64190 bsc#1272210). - net: bcmgenet: keep RBUF EEE/PM disabled (CVE-2026-64125 bsc#1272346). - ixgbevf: fix use-after-free in VEPA multicast source pruning (CVE-2026-64113 bsc#1272262). - commit 77a1a7d - fbdev: modedb: fix a possible UAF in fb_find_mode() (CVE-2026-64245 bsc#1273905). - commit 6b0d38b - bpf: Reject fragmented frames in devmap (CVE-2026-64355 bsc#1273422). - commit 355ce54 ++++ kernel-rt: - exfat: bound uniname advance in exfat_find_dir_entry() (CVE-2026-64296 bsc#1273975). - commit 14d346f - bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path (CVE-2026-53096 bsc#1269969). - commit e132f79 - netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116 bsc#1264619). - commit 9684067 - ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (CVE-2026-31531 bsc#1263004). - commit c4005dd - netfilter: ipset: drop logically empty buckets in mtype_del (CVE-2026-31418 bsc#1262073). - commit a8cbfcd - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007 bsc#1273105). - commit 7f73141 - net: hsr: fix potential OOB access in supervision frame handling (CVE-2026-64000 bsc#1273030). - commit fa5a020 - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() (CVE-2026-64280 bsc#1273599). - commit a4e22f3 - ipv6: validate extension header length before copying to cmsg (CVE-2026-63920 bsc#1272877). - commit dce0a08 - net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274941 CVE-2026-68138). - commit 3fbd71d - drm/amdgpu: check ASPM on the dGPU host link (git-fixes). - drm/radeon: fix autosuspend cleanup during teardown (git-fixes). - drm/amdgpu: disallow multiple FENCE chunks in one submit (git-fixes). - mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit (git-fixes). - mmc: sdhci: unmap the bounce buffer before device release (git-fixes). - ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers (git-fixes). - ALSA: usb: Fix UAF at delayed release of MIDI2 EPs (git-fixes). - commit 99c4ec6 - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU (CVE-2026-64286 bsc#1274058). - commit bcd6451 - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CVE-2026-64287 bsc#1273325). - commit 6f01f8a - pppoe: reload header pointer after dev_hard_header() (CVE-2026-68121 bsc#1274888). - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (CVE-2026-68398 bsc#1274908). - commit fd3d20b - net: team: fix NULL pointer dereference in team_xmit during mode change (CVE-2026-64190 bsc#1272210). - net: bcmgenet: keep RBUF EEE/PM disabled (CVE-2026-64125 bsc#1272346). - ixgbevf: fix use-after-free in VEPA multicast source pruning (CVE-2026-64113 bsc#1272262). - commit 77a1a7d - fbdev: modedb: fix a possible UAF in fb_find_mode() (CVE-2026-64245 bsc#1273905). - commit 6b0d38b - bpf: Reject fragmented frames in devmap (CVE-2026-64355 bsc#1273422). - commit 355ce54 ++++ kernel-rt_debug: - exfat: bound uniname advance in exfat_find_dir_entry() (CVE-2026-64296 bsc#1273975). - commit 14d346f - bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path (CVE-2026-53096 bsc#1269969). - commit e132f79 - netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116 bsc#1264619). - commit 9684067 - ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (CVE-2026-31531 bsc#1263004). - commit c4005dd - netfilter: ipset: drop logically empty buckets in mtype_del (CVE-2026-31418 bsc#1262073). - commit a8cbfcd - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007 bsc#1273105). - commit 7f73141 - net: hsr: fix potential OOB access in supervision frame handling (CVE-2026-64000 bsc#1273030). - commit fa5a020 - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() (CVE-2026-64280 bsc#1273599). - commit a4e22f3 - ipv6: validate extension header length before copying to cmsg (CVE-2026-63920 bsc#1272877). - commit dce0a08 - net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274941 CVE-2026-68138). - commit 3fbd71d - drm/amdgpu: check ASPM on the dGPU host link (git-fixes). - drm/radeon: fix autosuspend cleanup during teardown (git-fixes). - drm/amdgpu: disallow multiple FENCE chunks in one submit (git-fixes). - mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit (git-fixes). - mmc: sdhci: unmap the bounce buffer before device release (git-fixes). - ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers (git-fixes). - ALSA: usb: Fix UAF at delayed release of MIDI2 EPs (git-fixes). - commit 99c4ec6 - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU (CVE-2026-64286 bsc#1274058). - commit bcd6451 - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CVE-2026-64287 bsc#1273325). - commit 6f01f8a - pppoe: reload header pointer after dev_hard_header() (CVE-2026-68121 bsc#1274888). - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (CVE-2026-68398 bsc#1274908). - commit fd3d20b - net: team: fix NULL pointer dereference in team_xmit during mode change (CVE-2026-64190 bsc#1272210). - net: bcmgenet: keep RBUF EEE/PM disabled (CVE-2026-64125 bsc#1272346). - ixgbevf: fix use-after-free in VEPA multicast source pruning (CVE-2026-64113 bsc#1272262). - commit 77a1a7d - fbdev: modedb: fix a possible UAF in fb_find_mode() (CVE-2026-64245 bsc#1273905). - commit 6b0d38b - bpf: Reject fragmented frames in devmap (CVE-2026-64355 bsc#1273422). - commit 355ce54 ++++ openssl-3: - Security fixes in August 2026 release: (bsc#1274774) * CVE-2026-54874: Excessive Memory Use Buffering DTLS Records for a Future Epoch (bsc#1274795) * CVE-2026-63072: Heap Buffer Overflow in CMS Key Unwrapping (bsc#1274788) * CVE-2026-63074: CMP Indefinite Cache Growth of ExtraCerts (bsc#1274797) * CVE-2026-63076: Invalid Pointer Dereference in CMP Server via Crafted protectionAlg (bsc#1274790) * Add patches: openssl-CVE-2026-54874.patch openssl-CVE-2026-63072.patch openssl-CVE-2026-63074.patch openssl-CVE-2026-63076.patch ++++ libvirt: - CVE-2026-63622: util: virFileChownFiles: do not follow symlinks bsc#1275264 - CVE-2026-63623: storage: create images with a private umask during qemu-img create/convert bsc#1275265 - CVE-2026-77159: qemu: tpm: Avoid following symlinks when chown'ing log file bsc#1274946 ------------------------------------------------------------------ ------------------ 2026-8-16 - Aug 16 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - mm/hugetlb: restore reservation on error in hugetlb folio copy paths (CVE-2026-53154 bsc#1269665). - commit b448699 - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison (CVE-2026-53207 bsc#1269590). - commit c759c44 ++++ kernel-rt: - mm/hugetlb: restore reservation on error in hugetlb folio copy paths (CVE-2026-53154 bsc#1269665). - commit b448699 - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison (CVE-2026-53207 bsc#1269590). - commit c759c44 ++++ kernel-rt_debug: - mm/hugetlb: restore reservation on error in hugetlb folio copy paths (CVE-2026-53154 bsc#1269665). - commit b448699 - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison (CVE-2026-53207 bsc#1269590). - commit c759c44 ++++ vim: - Updated to version 9.2.0957. - Fix bsc#1275011 CVE-2026-73078. - Fix bsc#1275012 CVE-2026-73077. - Fix bsc#1275013 CVE-2026-73076. - Fix bsc#1275014 CVE-2026-73075. - Fix bsc#1275016 CVE-2026-73072. - Fix bsc#1275015 CVE-2026-73074. - Fix bsc#1275017 CVE-2026-73071. - Fix bsc#1275018 CVE-2026-73070. - Changelog: * tests: Test_fuzzy_completion_bufname_fullpath() creates unnecessary dir (9.2.0781). * tests: missing cleanup in test_mksession.vim (9.2.0782). * tests: personal spell files leak into later tests (9.2.0783). * crash when borrowing statusline highlight in silent Ex mode (9.2.0784). * WinResized not triggered when the whole Vim is resized (9.2.0785). * filetype: containerfile is not recognized (9.2.0786). * regexp: code 0x1ecb duplicated for equivalence class (9.2.0787). * filetype: hip files are not recognized (9.2.0788). * 'statuslineopt' status line too high after a window is minimized (9.2.0789). * 'completeslash' breaks :find completion with 'findfunc' (9.2.0790). * wincol() counts from right side for 'rightleft' (9.2.0791). * runtime(netrw): explore without optional dir broken (9.2.0792). * if session restored a tiny window, restore fails (9.2.0793). * extend() and extendnew() don't handle NULL expr2 properly (9.2.0794). * popup menu shadow is not cleared when the menu shrinks (9.2.0795). * Visual block reselection wrong with 'virtualedit' (9.2.0796). * memory leak in get_qfline_items() on alloc failure (9.2.0797). * memory leak in compile_expr6() on alloc failure (9.2.0798). * memory leak in compile_def_function_body() on alloc failure (9.2.0799). * memory leak in call_func() on alloc failure (9.2.0800). * memory leak in f_getreginfo() on alloc failure (9.2.0801). * memory leak with list_append_dict/dict_add_list on alloc failure (9.2.0802). * memory leak on alloc failure with taglist/gettagstack() (9.2.0803). * wincol() is wrong for a double-wide character with 'rightleft' (9.2.0804). * screenpos() "curscol" is wrong with 'rightleft' (9.2.0805). * 'showcmd' may show internal command keys (9.2.0806). * MS-Windows: ellipsis character is garbled (9.2.0807). * getregionpos: double-free on alloc failure (9.2.0808). * getframelayout() uses wrong function to free lists (9.2.0809). * add_llist_tags() uses wrong function to free dict (9.2.0810). * mksession writes terminal command unquoted (9.2.0811). * :argdelete with pattern leads to wrong argidx() (9.2.0812). * dict_add_func() may corrupt funcref count on failure (9.2.0813). * Vim9: E1041 when reloading an autoload script with exported variables (9.2.0814). * deeply nested regexp patterns may cause stack overflow (9.2.0815). * GTK4: memory leak in gui_gtk_set_dnd_targets() (9.2.0816). * crash when building a stacktrace during an autocommand (9.2.0817). * tests: client-server test fails without X11 server (9.2.0818). * MS-Windows: sixel image shown as raw text in the console (9.2.0819). * GUI: hidden popup image is displayed and not erased (9.2.0820). * filetype: msmtp system-wide rc file not detected (9.2.0821). * GTK4: crash menu id is null in gui_mch_destroy_menu() (9.2.0822). * tests: Test_clientserver_servlist_list may fail (9.2.0823). * Makefile: make tags depends on configure (9.2.0824). * regexp: submatch in a look-behind is empty with the NFA engine (9.2.0825). * highlighting for broken terminals can be improved (9.2.0826). * :startinsert enters Insert mode in a non-modifiable buffer (9.2.0827). * GTK4: hardware rendering can be improved (9.2.0828). * sessions do not preserve script version for expression options (9.2.0829). * the completion menu is not used on terminals without colors (9.2.0830). * diff highlighting hard to read with syntax enabled (9.2.0831). * socketserver: remote commands can be processed in reverse order (9.2.0832). * GTK4: menu mnemonics do not work properly (9.2.0833). * cleared last search pattern is restored from viminfo (9.2.0834). * features in version.c are not sorted (9.2.0835). * filetype: .git-blame-ignore-revs file is not recognized (9.2.0836). * using wrong colors in hl_blend_attr() (9.2.0837). * searchcount() returns wrong cached maxcount (9.2.0838). * [security]: arbitrary code execution via keyword lookup (9.2.0839). * [security]: code injection in netrw via bookmarks (9.2.0840). * [security]: heap overflow when adding > 65535 text properties (9.2.0841). * [security]: stack buffer overflow in socket server (9.2.0842). * [security]: popup: opacity mask indexed out of bounds (9.2.0843). * [security]: use-after-free on json decode error (9.2.0844). * [security]: arbitrary Ex command execution during C omni-completion (9.2.0845). * [security]: heap buffer overflow in set_sofo() (9.2.0846). * [security]: vimball: code execution via .VimballRecord file (9.2.0847). * tagfunc "cmd" with a generic Ex command corrupts the tag entry (9.2.0848). * filetype: osquery config files are not recognized (9.2.0849). * MS-Windows: commands from a client can be lost (9.2.0850). * focus autocommands triggered inconsistently (9.2.0851). * GTK: ligatures not correctly displayed (9.2.0852). * popup: popup images do not support scaling (9.2.0853). * memory leak when reading a spell file with SN_SAL and SN_SOFO (9.2.0854). * 'showcmd' not redrawn with empty mapping triggered on timeout (9.2.0855). * GTK4: undercurl rendering is inefficient (9.2.0856). * popup: opacity popup over a terminal is not cleared when closed (9.2.0857). * MS-Windows GUI: white flash when VimEnter is slow (9.2.0858). * GTK2: link error (9.2.0859). * filetype: xilinx design constraint files are not recognized (9.2.0860). * GTK4: bleed region updates in jumps (9.2.0861). * missing test change from v9.2.0857 (9.2.0862). * MS-Windows GUI: window contents can be missing when VimEnter is slow (9.2.0863). * using some dead code in Wayland feature (9.2.0864). * GTK4: non-hardware accelerated UI is too slow (9.2.0865). * MS-Windows: ":language messages" only works once (9.2.0866). * MS-Windows: messages are not in the display language (9.2.0867). * GTK: window Manager hint prevents giving focus to dialog (9.2.0868). * buf_copy_options() can lose the P_INSECURE flag (9.2.0869). * filetype: marko files are not recognized (9.2.0870). * screen line is lost when splitting a 'winfixheight' window (9.2.0871). * popup with opacity does not use the font of the highlight group (9.2.0872). * :redrawstatus does not update the ruler of the last window (9.2.0873). * fold size is compared against 'foldminlines' of the wrong window (9.2.0874). * GTK4: GUI does not support command-line arguments (9.2.0875). * GTK4: compile error with disabled netbeans feat (9.2.0876). * Vim9: crash when a closure assigns to a variable declared in a loop (9.2.0877). * Vim9: cannot use a script variable of an enclosing block in a lambda (9.2.0878). * popup: "maxwidth" is not respected when 'wrap' is off (9.2.0879). * scroll: window scrolls when using the autocommand window (9.2.0880). * 'smoothscroll' position is lost when the window height changes (9.2.0881). * :bwipe crashes if WinLeave wipes all other buffers (9.2.0882). * scroll: 'smoothscroll' position is lost when using "|" (9.2.0883). * scroll: unreachable 'smoothscroll' code in cursor_correct() (9.2.0884). * scroll: 'smoothscroll' position is lost when the window is squeezed (9.2.0885). * :set completion works for an invalid sub-option name (9.2.0886). * scroll: jump-scrolling when moving the cursor onto a wrapping line (9.2.0887). * mapping: modifier is not recognized after a partial mapping (9.2.0888). * VMS: spurious "INVALID DECC FEATURE VALUE" message at every startup (9.2.0889). * test: test for patch v9.2.0888 can be clarified (9.2.0890). * MS-Windows: filename-modifier ":8:t" causes underflow (9.2.0891). * highlight: wrong column highlighted with 'cursorcolumn' (9.2.0892). * MS-Windows: "*.vim" also matches files with a longer extension (9.2.0893). * filetype: ed script files not recognised (9.2.0894). * test: Test_aucmd_win_scroll_multibyte() is flaky in the GUI (9.2.0895). * scroll: 'smoothscroll' position is lost when splitting a window (9.2.0896). * GTK3 X11 redraws are not coalesced (9.2.0897). * printing support is lacking (9.2.0898). * command output temporary files may collide (9.2.0899). * FocusGained still triggered when closing dialog (9.2.0900). * textprop: wrong cursor line with truncated virtual text (9.2.0901). * Vim9: iterating over a tuple leaks memory (9.2.0902). * Vim9: cannot use an exported function of an autoload import (9.2.0903). * "zb" scrolls incorrectly with cursor just above fold (9.2.0904). * MS-Windows: ghost cursor with ligatures (9.2.0905). * slow transstr() with long strings (9.2.0906). * popup: virtual text is not redrawn when a text property changes (9.2.0907). * cannot use a {} block in a nested :autocmd (9.2.0908). * insert completion is slow to collect many matches (9.2.0909). * runtime(vim): update syntax, contain Ex commands (9.2.0910). * makefiles do not build hardcopy_postscript.c (9.2.0911). * hardcopy: prototypes are hand-written instead of generated (9.2.0912). * statusline: cell below the vertical separator keeps the old highlight (9.2.0913). * diff: undo after :diffget into an empty buffer leaves a line behind (9.2.0914). * tests: two terminal tests in test_popupwin fail on FreeBSD (9.2.0915). * configure: honor `--disable-hardcopy-pango` with GTK UI (9.2.0916). * :quitall not allowed in the command-line window (9.2.0917). * screen: fill char with a zero low byte is stored as a NUL cell (9.2.0918). * screen: the wrong array is copied into ScreenCols on a resize (9.2.0919). * filetype: json-ld files are not recognized (9.2.0920). * test: terminal tests fail on FreeBSD (9.2.0921). * Wayland: modeless selection not redrawn (9.2.0922). * tabpage: closing a tab page loses the alternate tab page (9.2.0923). * tests: Test_termwinscroll() fails on FreeBSD (9.2.0924). * crash when getcompletiontype() gets a NULL string (9.2.0925). * filetype: business Central files are not recognized (9.2.0926). * curswant not set on 8g8 (9.2.0927). * MinGW: tests hang when Vim is built with coverage enabled (9.2.0928). * incorrect completion for 'pumopt' and 'pumborder' (9.2.0929). * floating point exception when displaying pum (9.2.0930). * the GTK4 GUI is still experimental and untested by CI (9.2.0931). * NFA engine fallback can double free the compiled program (9.2.0932). * u_read_undo() leaks the file name when the undo file owner differs (9.2.0933). * filetype: hlsl files are not recognized (9.2.0934). * reading an undo file is slow with many undo headers (9.2.0935). * stringifying a list or dict can free the item being iterated (9.2.0936). * sort() with a numeric option converts each item on every comparison (9.2.0937). * cursorbind: cursor in the other window is not updated after undo (9.2.0938). * mbyte: wrong cell count for an overlong UTF-8 sequence (9.2.0939). * GTK4: columns are lost when a scrollbar appears (9.2.0940). * tests: clipboard tests fail in the GUI when the terminal has no clipboard (9.2.0941). * test: test_mksession_winpos() fails on GTK4 UI (9.2.0942). * test: test_hardcopy fails on GTK4 UI (9.2.0943). * test: tests fail when checking for GTK4 feature (9.2.0944). * sort() with a numeric option can be improved (9.2.0945). * GTK2/3: mouse move starts Visual selection after a dialog (9.2.0946). * GTK4: screen is cleared when moving the mouse after startup (9.2.0947). * GTK4: mouse move starts Visual selection after a dialog (9.2.0948). * GDK_KEY_VoidSymbol might be undefined (9.2.0949). * transstr() can be improved (after 9.2.0906) (9.2.0950). * GTK3: cursor does no longer blink (9.2.0951). * locking a container while stringifying can be improved (9.2.0952). * insert completion code can be improved (9.2.0953). * u_read_undo() can be improved (after 9.2.0935) (9.2.0954). * tests: terminal tests are flaky (9.2.0955). * GTK4: crash when the window is resized while redrawing (9.2.0956). * filetype: ArgoCD config file is not recognized (9.2.0957). ------------------------------------------------------------------ ------------------ 2026-8-14 - Aug 14 2026 ------------------- ------------------------------------------------------------------ ++++ python-kiwi: - Fix spec file for SLFO 1.1 target The open-vmdk package does not exists on SLFO:1.1 ++++ kernel-default: - ALSA: pcm: oss: Fix setup list UAF on proc write error (CVE-2026-64001 bsc#1273734). - commit c07babc - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT (CVE-2026-64073 bsc#1273490). - commit 3e21b16 - RDMA/siw: publish QP after initialization (CVE-2026-68417 bsc#1274696) - commit 5c809c6 - IB/mad: Drop unmatched RMPP responses before reassembly (CVE-2026-68425 bsc#1274700) - commit 6cde82c ++++ kernel-rt: - ALSA: pcm: oss: Fix setup list UAF on proc write error (CVE-2026-64001 bsc#1273734). - commit c07babc - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT (CVE-2026-64073 bsc#1273490). - commit 3e21b16 - RDMA/siw: publish QP after initialization (CVE-2026-68417 bsc#1274696) - commit 5c809c6 - IB/mad: Drop unmatched RMPP responses before reassembly (CVE-2026-68425 bsc#1274700) - commit 6cde82c ++++ kernel-rt_debug: - ALSA: pcm: oss: Fix setup list UAF on proc write error (CVE-2026-64001 bsc#1273734). - commit c07babc - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT (CVE-2026-64073 bsc#1273490). - commit 3e21b16 - RDMA/siw: publish QP after initialization (CVE-2026-68417 bsc#1274696) - commit 5c809c6 - IB/mad: Drop unmatched RMPP responses before reassembly (CVE-2026-68425 bsc#1274700) - commit 6cde82c ++++ python311-core: - Revert be61ef9 (Wed Apr 8 16:12:36 CEST 2026) for older distros. ++++ libvirt: - CVE-2026-61477: Reject line breaks in network config bsc#1274576 ++++ python311: - Revert be61ef9 (Wed Apr 8 16:12:36 CEST 2026) for older distros. ++++ zypper: - info: check for missing positional args before systemSetup (bsc#1274091) - Remove deprecated installRecommends option from zypper.conf. The system wide default for all libzypp based applications is defined in zypp.conf(5). It is not recommended to define this in zypper exclusively. - BuildRequires: libzypp-devel >= 17.38.0. Code uses some of the new libzypp log and string tools. - version 1.14.99 ------------------------------------------------------------------ ------------------ 2026-8-13 - Aug 13 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CVE-2026-63887 bsc#1272385). - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (CVE-2026-63888 bsc#1272390). - commit 890cb6e - qed: fix double free in qed_cxt_tables_alloc() (CVE-2026-64118 bsc#1273749). - commit 02e953c - smb: client: validate dacloffset before building DACL pointers (bsc#1266860 CVE-2026-46195). - commit 27b7470 - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes). - commit a5a92fc ++++ kernel-rt: - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CVE-2026-63887 bsc#1272385). - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (CVE-2026-63888 bsc#1272390). - commit 890cb6e - qed: fix double free in qed_cxt_tables_alloc() (CVE-2026-64118 bsc#1273749). - commit 02e953c - smb: client: validate dacloffset before building DACL pointers (bsc#1266860 CVE-2026-46195). - commit 27b7470 - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes). - commit a5a92fc ++++ kernel-rt_debug: - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CVE-2026-63887 bsc#1272385). - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (CVE-2026-63888 bsc#1272390). - commit 890cb6e - qed: fix double free in qed_cxt_tables_alloc() (CVE-2026-64118 bsc#1273749). - commit 02e953c - smb: client: validate dacloffset before building DACL pointers (bsc#1266860 CVE-2026-46195). - commit 27b7470 - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes). - commit a5a92fc ------------------------------------------------------------------ ------------------ 2026-8-12 - Aug 12 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - net/smc: Do not re-initialize smc hashtables (CVE-2026-64005 bsc#1273831). - commit fa1023d - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (CVE-2026-64047 bsc#1273060). Cherry-pick resolved automatically by custom merge drivers: - series.conf: series_merge_tool - commit 1d3a151 - tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (CVE-2026-64543 bsc#1273311). Cherry-pick resolved automatically by custom merge drivers: - series.conf: series_merge_tool - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (CVE-2026-63801 bsc#1272230). Cherry-pick resolved automatically by custom merge drivers: - series.conf: series_merge_tool - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992 bsc#1272868). Cherry-pick resolved automatically by custom merge drivers: - series.conf: series_merge_tool - commit eb70d4e - apparmor: fix use-after-free in rawdata dedup loop (CVE-2026-63827 bsc#1272179). - commit 9fb6ece - Refresh patches.suse/x86-bugs-Make-Safe-RET-robust-against-interrupt-injection.patch. - commit 8b3c4a1 - ALSA: hda/cs35l41: Fix firmware load work teardown (CVE-2026-64481 bsc#1274547). - commit d9ee495 - drm/virtio: use uninterruptible resv lock for plane updates (CVE-2026-64098 bsc#1273488). - commit f0c80ab - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() (CVE-2026-63891 bsc#1272641). - commit a08dcee ++++ kernel-rt: - net/smc: Do not re-initialize smc hashtables (CVE-2026-64005 bsc#1273831). - commit fa1023d - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (CVE-2026-64047 bsc#1273060). Cherry-pick resolved automatically by custom merge drivers: - series.conf: series_merge_tool - commit 1d3a151 - tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (CVE-2026-64543 bsc#1273311). Cherry-pick resolved automatically by custom merge drivers: - series.conf: series_merge_tool - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (CVE-2026-63801 bsc#1272230). Cherry-pick resolved automatically by custom merge drivers: - series.conf: series_merge_tool - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992 bsc#1272868). Cherry-pick resolved automatically by custom merge drivers: - series.conf: series_merge_tool - commit eb70d4e - apparmor: fix use-after-free in rawdata dedup loop (CVE-2026-63827 bsc#1272179). - commit 9fb6ece - Refresh patches.suse/x86-bugs-Make-Safe-RET-robust-against-interrupt-injection.patch. - commit 8b3c4a1 - ALSA: hda/cs35l41: Fix firmware load work teardown (CVE-2026-64481 bsc#1274547). - commit d9ee495 - drm/virtio: use uninterruptible resv lock for plane updates (CVE-2026-64098 bsc#1273488). - commit f0c80ab - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() (CVE-2026-63891 bsc#1272641). - commit a08dcee ++++ kernel-rt_debug: - net/smc: Do not re-initialize smc hashtables (CVE-2026-64005 bsc#1273831). - commit fa1023d - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (CVE-2026-64047 bsc#1273060). Cherry-pick resolved automatically by custom merge drivers: - series.conf: series_merge_tool - commit 1d3a151 - tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (CVE-2026-64543 bsc#1273311). Cherry-pick resolved automatically by custom merge drivers: - series.conf: series_merge_tool - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (CVE-2026-63801 bsc#1272230). Cherry-pick resolved automatically by custom merge drivers: - series.conf: series_merge_tool - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992 bsc#1272868). Cherry-pick resolved automatically by custom merge drivers: - series.conf: series_merge_tool - commit eb70d4e - apparmor: fix use-after-free in rawdata dedup loop (CVE-2026-63827 bsc#1272179). - commit 9fb6ece - Refresh patches.suse/x86-bugs-Make-Safe-RET-robust-against-interrupt-injection.patch. - commit 8b3c4a1 - ALSA: hda/cs35l41: Fix firmware load work teardown (CVE-2026-64481 bsc#1274547). - commit d9ee495 - drm/virtio: use uninterruptible resv lock for plane updates (CVE-2026-64098 bsc#1273488). - commit f0c80ab - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() (CVE-2026-63891 bsc#1272641). - commit a08dcee ++++ unbound: - Update to 1.26.0: * Update icannbundle.pem certificates in unbound-anchor, valid for 2009-2029 and 2025-2045 * Add max-transfer-size and max-transfer-time options to limit auth-zone and rpz transfer size and time, default disabled * Overload local_data_remove in unbound-control to also remove specific records * Add local-zone types block_aaaa, block_a_wdata and block_aaaa_wdata; fix respip+dns64 to use original A records instead of ones already modified by respip * ipsecmod hook script now needs to start with '#!/bin/sh', it is executed with execv instead of system for security * Server now continues to start if a secondary zone fails to load from its zonefile, or if a primary zonefile is missing; $INCLUDE is no longer allowed in secondary zone zonefiles * Auth-zone and RPZ zones now drop out-of-zone content on load * Primary hostname for zone transfers can now use CNAME(s) * Fix windows 64bit build for libssp dependency * Update IANA portlist * Fix heap out-of-bounds write via size_t-to-int truncation in setup_if()/outside_network_create() for large num_ports values * Fix to clean up log ids after a failure to start a worker thread * Relax assertions after the TTL 0 handling change in cachedb and packet_rrset_copy_region * Fix val_find_DS to check the result of packet_rrset_copy_region before using it * Fix that dns64 answers check the AAAA query is DNSSEC validated, improving RFC6147 conformance * Fix allocation-failure hardening of rrset cache wildcard storage and canonical NSEC owner replacement * Fix DNSSEC validation and DNSKEY size calculation for noncanonical RSA DNSKEYs with leading zeroes * Fix mixed class referrals to use the query class * Fix serve-expired responses from cachedb to not store bogus data * Fix lame server detection for selfpointed glue records * Fix cleanup of DoH sessions when the same query is on multiple streams * Fix for signed same-owner CNAME and ordinary RRset responses * Fix mesh new client/callback to roll back added address, tcp mesh state and callback on initialization failure * Fix autotrust state-file line overflow that could give a hold-down bypass * Fix to limit the DSNS per-label walk in the iterator * Fix that the ratelimit is decremented on successful referrals * Fix msgencode insert_query assertion for a local_alias * Fix to reset the tcp-timeout before applying a load based reduction * Fix to correctly decrement per-netblock tcp connection limits * Fix, in depth, for respip rewrite of dns64 responses * Fix that dns64 with subnetcache does not write ECS scoped answers to the global cache * Fix ipset module name-too-long checks and race conditions on the local name buffer and socket close * Fix validator to cap the number of ANY RRsets it validates and shorten the wait timer * Fix race condition causing segfault when starting threads * Fix header_seen detection for trust anchor files to detect the id line * Fix heap use-after-free in class response processing when at least two distinct classes are configured * Fix negative cache to work with NSEC3 records without salt * Fix parse of svcbparam ech, it had an incorrect length * Fix that quotation and escaping works the same in auth-zone url content as in zonefile reads * Fix ipset module to use larger domain name buffers and check buffer lengths * Fix PROXYv2 header read and consume to check the header size * Fix negative cache NSEC3 nodata proof to use the correct message size * Fix fast_reload for when a ZONEMD lookup is in progress * Fix that validation canonicalization of domain names in rdata checks buffer bounds * Fix dump_cache to use a larger record buffer and check that an owner name does not collide with BADRR * Fix that dns64 cleans up the allocated message if the adjust routines fail, and checks for malformed A/AAAA in auth-zones * Fix pythonmod script read for numeric overflow * Fix configure to detect the correct QUIC early-data function and to check for the ngtcp2_crypto_ossl header * Fix compile with OpenSSL 4.0.1, and with OpenSSL 1.0.2 and earlier in server cleanup * Fix that auth-zone/rpz allow-notify addresses and netblocks are available from start, and fix the probe step skip * Fix to perform a full transfer periodically to stop increasing memory usage for rpz zones * Fix assertion failure for a long HTTP header that fills the buffer, and buffer overflow with lower than default size and http transfer * Fix that misconfigured iter-scrub-ns: 0 causes request failures * Fix fast_reload handling of in-progress ZONEMD lookups and of removing an auth zone while its lookups are in progress * Fix integer overflow in infra-cache-max-rtt calculation and for very high values of sock-queue-timeout * Fix erroneous DNS error report values after a bogus AAAA query * Fix fast_reload to not terminate the server on config errors for key files * Fix log of an aliased qname to not use freed region memory * Fix DNAME synthesis from cache to keep using 0TTL entries within a sliding window without surpassing RRSIG expiry * Fix that dns64 bypasses the rpz-passthru rule during synthesis * Fix to disallow $INCLUDE for secondary zones; failed loads now clear the zone data so there is no partial zone * Fix zone read to allow SVCB records in unknown format that cannot be written out * Fix that a half-written trust anchor file does not crash the server at runtime * Fix that auth-zone and RPZ zones drop out-of-zone records * Fix that dns64 honors the forward-no-cache and stub-no-cache options * Fix that a signed wildcard NSEC is checked before use, so it does not allow insecure DS proofs inappropriately * Fix several crashes after malloc failure: half-built local_alias, RPZ list, delegation point cleanup, dns64_inform_super, new_local_rrset for RPZ qname trigger, doq connection setup, ngtcp2_conn_server_new, TCP accept handling, rpz_strip_nsdname, edns subnet addrtree insert, and rpz response create * Fix that a zonefile-only zone continues server startup with a warning if the file is missing on start * Fix that dnscrypt configuration does not crash on a secret/public key mismatch, and duplicate files are skipped * Fix locking in libunbound ub_ctx_set_event * Fix that libunbound pipe functions fail with an error after an event base is set * Fix incorrect cleanup after an allocation failure for a delegation point * Fix that the server does not crash if shared memory cannot be created for shm-enable * Fix auth primary host name lookup to allow CNAMEs * Fix memory leak on DNAME 0TTL records * Fix that fast_reload disown of the auth zone transfer task cleans up the chunk list * Fix unbound-checkconf to check for auth-zone download filename collisions * Fix malloc failure in auth-zone insert rr to avoid an empty node and infinite loop * Fix that unbound-control auth_zone_reload stops answering from the zone after a read failure * Fix stats pipe draining after a malloc failure so internal messaging stays correct, and the server no longer exits on stats pipe communication failure * Fix that fast_reload does not terminate the server if random init for DNS cookies fails * Fix thread setname for dnstap and fast_reload thread start * Add libunbound/remote.h, a shared header with prototypes for remote control connections * Fix DEREF_AFTER_NULL on worker_init when stat_timer allocation fails with an out of memory error * Fix DoH POST requests missing content-length causing :status 400 from strict resolvers like Cloudflare and Mullvad * Fix randomness generation on macOS/iOS under chroot * Fix ipsecmod deref on null in ipsecmod-whitelist after OOM, and possible deref on null after reply_find_answer_rrset() * Fix that DoQ responses were never padded; pad-responses now applies to comm_doq per RFC 9250 section 5.4 * Fix log printout error in the fix for CVE-2026-50248 when the primary name is bogus * Fix NSEC3 proofs to check the b32 name matches the signer name; RRSIGs are no longer valid when this does not match * Fix aggressive negative cache to not insert NSEC records with an overreaching next owner name outside the trust anchor's bailiwick * Fix mesh cycle detection for respip CNAME loop with tagged clients * Fix unbound-anchor to check the return value of X509_NAME_get_text_by_NID for the emailaddress * Fix locking of the shared_ports structure during initialisation, and of the anchor structure when a file is set during header parsing * Fix memory leak in xfer_set_masters() error path in authzone * Fix to use tls-port after a referral when tls-upstream is set * Fix pthread detection on Solaris 11.4 * Fix to call OPENSSL_cleanup on exit when it is defined * pythonmod: check the return value after ftell() ++++ wget: - Fix segmentation fault in metalink4, bsc#1273449 * Fix-segfault-in-retrieve_from_metalink-when-a-metalink.patch ------------------------------------------------------------------ ------------------ 2026-8-11 - Aug 11 2026 ------------------- ------------------------------------------------------------------ ++++ dracut: - Update to version 059+suse.645.g79fd74d: * fix(base): sanitize message written by die() to the emergency hook * feat(base): add escape function implementing printf %q - CVE-2026-15816: root code execution via unescaped error message written to sourced emergency hook script in die() (bsc#1274432) ++++ glibc: - wordexp-wrde-append-preserve-state.patch: posix: Fix wordexp WRDE_APPEND to preserve state on non-NOSPACE errors (CVE-2026-6368, bsc#1274726, BZ [#34090]) - wordexp-tilde-stack-ovfl.patch: posix: Fix stack overflow in wordexp tilde expansion (CVE-2026-6791, bsc#1274723, BZ #34091) ++++ kernel-default: - smb: client: fix query_info() replay double-free (bsc#1274543 CVE-2026-64386). - commit a1edf77 - smb: client: fix query directory replay double-free (bsc#1274545 CVE-2026-64387). - commit 0ca99de - smb: client: fix double-free in SMB2_ioctl() replay (bsc#1274539 CVE-2026-64385). - commit cb19eca - smb: client: fix double-free in SMB2_flush() replay (bsc#1273426 CVE-2026-64383). - commit 6bdc8c1 - smb: client: fix change notify replay double-free (bsc#1274541 CVE-2026-64384). - commit d36c13b - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (CVE-2026-68081 bsc#1274580). - commit 5f7dd14 - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (CVE-2026-68081 bsc#1274580). - commit 0ef8d66 - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582 bsc#1274040) - commit a395289 - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (git-fixes bsc#1274550). - commit 8e69fd1 - xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (CVE-2026-64580 bsc#1274037). - commit 792bd9d - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (CVE-2026-52977 bsc#1269242). - commit aa8dc23 - crypto: qce - fix error path in devm_qce_register_algs (git-fixes). - crypto: ccm - Set rfc4309 maxauthsize from child (git-fixes). - commit 8963fd5 - tipc: fix out-of-bounds read in broadcast Gap ACK blocks (CVE-2026-64450 bsc#1273523). - commit de7daf4 - dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125 bsc#1264541). - commit b40fc5f ++++ kernel-rt: - smb: client: fix query_info() replay double-free (bsc#1274543 CVE-2026-64386). - commit a1edf77 - smb: client: fix query directory replay double-free (bsc#1274545 CVE-2026-64387). - commit 0ca99de - smb: client: fix double-free in SMB2_ioctl() replay (bsc#1274539 CVE-2026-64385). - commit cb19eca - smb: client: fix double-free in SMB2_flush() replay (bsc#1273426 CVE-2026-64383). - commit 6bdc8c1 - smb: client: fix change notify replay double-free (bsc#1274541 CVE-2026-64384). - commit d36c13b - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (CVE-2026-68081 bsc#1274580). - commit 5f7dd14 - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (CVE-2026-68081 bsc#1274580). - commit 0ef8d66 - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582 bsc#1274040) - commit a395289 - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (git-fixes bsc#1274550). - commit 8e69fd1 - xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (CVE-2026-64580 bsc#1274037). - commit 792bd9d - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (CVE-2026-52977 bsc#1269242). - commit aa8dc23 - crypto: qce - fix error path in devm_qce_register_algs (git-fixes). - crypto: ccm - Set rfc4309 maxauthsize from child (git-fixes). - commit 8963fd5 - tipc: fix out-of-bounds read in broadcast Gap ACK blocks (CVE-2026-64450 bsc#1273523). - commit de7daf4 - dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125 bsc#1264541). - commit b40fc5f ++++ kernel-rt_debug: - smb: client: fix query_info() replay double-free (bsc#1274543 CVE-2026-64386). - commit a1edf77 - smb: client: fix query directory replay double-free (bsc#1274545 CVE-2026-64387). - commit 0ca99de - smb: client: fix double-free in SMB2_ioctl() replay (bsc#1274539 CVE-2026-64385). - commit cb19eca - smb: client: fix double-free in SMB2_flush() replay (bsc#1273426 CVE-2026-64383). - commit 6bdc8c1 - smb: client: fix change notify replay double-free (bsc#1274541 CVE-2026-64384). - commit d36c13b - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (CVE-2026-68081 bsc#1274580). - commit 5f7dd14 - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (CVE-2026-68081 bsc#1274580). - commit 0ef8d66 - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582 bsc#1274040) - commit a395289 - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (git-fixes bsc#1274550). - commit 8e69fd1 - xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (CVE-2026-64580 bsc#1274037). - commit 792bd9d - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (CVE-2026-52977 bsc#1269242). - commit aa8dc23 - crypto: qce - fix error path in devm_qce_register_algs (git-fixes). - crypto: ccm - Set rfc4309 maxauthsize from child (git-fixes). - commit 8963fd5 - tipc: fix out-of-bounds read in broadcast Gap ACK blocks (CVE-2026-64450 bsc#1273523). - commit de7daf4 - dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125 bsc#1264541). - commit b40fc5f ++++ unbound: - Update to 1.25.2 Security Fixes: * CVE-2026-14586: Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments [bsc#1271879] * CVE-2026-32665: Remote DNS-over-QUIC denial of service due to quic-size budget bypass [bsc#1271873] * CVE-2026-40691: Packet of death for DNSCrypt over TCP [bsc#1271875] * CVE-2026-41637: Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries [bsc#1271891] * CVE-2026-42955: Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records [bsc#1271892] * CVE-2026-44621: Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abruptly terminated [bsc#1271876] * CVE-2026-44687: Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN [bsc#1271893] * CVE-2026-44690: Cross-zone wildcard cache poisoning via RRSIG.labels manipulation [bsc#1271877] * CVE-2026-46582: A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path [bsc#1271894] * CVE-2026-50045: 'max-global-quota' reset by DNSSEC validation restarts [bsc#1271878] * CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out [bsc#1271882] * CVE-2026-50243: 'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL [bsc#1271880] * CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones [bsc#1271881] * CVE-2026-50251: Attacker supplied 0.0.0.0/:: glue triggers defensive full-cache flush [bsc#1271883] * CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread [bsc#1271884] * CVE-2026-54478: DNS Cookie bypass when combined with proxy-protocol use [bsc#1271895] * CVE-2026-55708: Privacy/configuration issue when adding local data in views through 'unbound-control' [bsc#1271896] * CVE-2026-55717: 'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash [bsc#1271886] * CVE-2026-55990: Packet of death for a DNSCrypt misconfigured Unbound [bsc#1271887] * CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2 [bsc#1271888] * CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name [bsc#1271889] * CVE-2026-56444: Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configuration [bsc#1271890] For a complete list of additional changes see the changelog at https://nlnetlabs.nl/projects/unbound/download/ - Update unbound.keyring - Obsoletes unbound-1.22-CVE-2025-11411.patch and unbound-patch_combined-1.25.1_v3.diff ++++ podman: - Add patch for CVE-2026-55686 (bsc#1268579), CVE-2026-57231 (bsc#1269471): * 0009-CVE-2026-55686-CVE-2026-57231-workdir-symlink-traver.patch - Rebase patches: * 0001-CVE-2025-22869-ssh-limit-the-size-of-the-internal-pa.patch * 0002-Fix-Remove-appending-rw-as-the-default-mount-option.patch * 0003-CVE-2025-6032-machine-init-fix-tls-check.patch * 0004-CVE-2025-9566-kube-play-don-t-follow-volume-symlinks.patch * 0005-CVE-2025-52881-backport-subset-of-patch-from-runc.patch * 0006-CVE-2025-47913-CVE-2025-47914-ssh-agent-fixes.patch * 0007-CVE-2026-34986-Merge-commit-from-fork.patch * 0008-CVE-2026-39829-CVE-2026-39830-CVE-2026-42508-CVE-202.patch ------------------------------------------------------------------ ------------------ 2026-8-10 - Aug 10 2026 ------------------- ------------------------------------------------------------------ ++++ cloud-init: - Add cloud-init-tsync.patch (bsc#1274554) ++++ kernel-default: - smb: client: require net admin for CIFS SWN netlink (bsc#1273966). - commit 90b0802 - smb: client: resolve SWN tcon from live registrations (bsc#1273872). - commit f2fe4d9 - powerpc/pseries: Ensure vpa,slb_shadow & dtl are unregistered during crash (bsc#1271256). - commit 41b208f - crypto: pcrypt - restore callback for non-parallel fallback (CVE-2026-64312 bsc#1273968). - commit cab2de2 - crypto: qat - validate RSA CRT component lengths (CVE-2026-64304 bsc#1273944). - commit 1035d35 - nfc: llcp: Fix use-after-free in llcp_sock_release() (CVE-2026-64011 bsc#1273891). - commit 7136986 - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CVE-2026-63944 bsc#1272662). - commit 16a5138 - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (CVE-2026-64010 bsc#1273882). - commit 87fc1db - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (CVE-2026-64562 bsc#1273930). - commit 9724082 - ceph: supply snapshot context in ceph_zero_partial_object() (CVE-2026-43273 bsc#1264446). - commit 8eab714 - apparmor: advertise the tcp fast open fix is applied (git-fixes). - commit 565b3ed - net: ifb: report ethtool stats over num_tx_queues (CVE-2026-64121 bsc#1273743). - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CVE-2026-64048 bsc#1273484). - commit 3df99b0 - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (CVE-2026-64188 bsc#1272150). - bonding: 3ad: implement proper RCU rules for port->aggregator (CVE-2026-52975 bsc#1269234). - vrf: Fix a potential NPD when removing a port from a VRF (CVE-2026-52925 bsc#1268987). - bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (CVE-2026-52975 bsc#1269234). - commit 0a4ee3e - KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (git-fixes). - commit 3761287 - spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788 CVE-2026-43319) - commit 554c823 - usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() (git-fixes). - usb: gadget: f_ncm: Use unsigned int for ndp_index (git-fixes). - usb: cdnsp: fix incorrect endian conversions for APB timeout register (git-fixes). - thunderbolt: icm: Preserve USB4 proxy data-valid bit (git-fixes). - thunderbolt: Bound the DROM dual link port number before indexing sw->ports (git-fixes). - serial: qcom-geni: fix TX DMA buffer flush (git-fixes). - serial: 8250_dma: Clear stale RX state on shutdown (git-fixes). - staging: rtl8723bs: validate monitor transmit frame lengths (git-fixes). - staging: rtl8723bs: fix missing shared-key auth challenge length check (git-fixes). - staging: rtl8723bs: fix OOB read in WMM_param_handler() (git-fixes). - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() (git-fixes). - net: usb: ipheth: fix carrier_work UAF on disconnect (git-fixes). - net: thunderbolt: Tear down DMA paths before stopping the rings (git-fixes). - net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() (git-fixes). - USB: serial: option: add TDTECH MT5710-CN (stable-fixes). - USB: serial: ftdi_sio: add support for E+H FXA291 (stable-fixes). - USB: storage: add NO_ATA_1X quirk for Longmai USB Key (stable-fixes). - pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes). - pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes). - usb: musb: omap2430: clean up probe error handling (stable-fixes). - commit d5dcdad - ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses (git-fixes). - commit 657f5c3 - mei: pull kvfree out of spinlock (git-fixes). - misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free (git-fixes). - misc: fastrpc: fix channel ctx ref leak when session alloc fails (git-fixes). - misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke (git-fixes). - misc: fastrpc: Remove buffer from list prior to unmap operation (git-fixes). - fbdev: bitblit: bound-check glyph index in bit_cursor() (git-fixes). - fbdev: core: Fix pointer desynchronization in fb_io_read() (git-fixes). - Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue (git-fixes). - Input: synaptics-rmi4 - block s_input when F54 queue is busy (git-fixes). - Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer (git-fixes). - Input: synaptics-rmi4 - zero report size on F54 work error (git-fixes). - Input: synaptics-rmi4 - fix F55 transmitter electrode count typo (git-fixes). - Input: hynitron_cstxxx - validate touch count and finger IDs (git-fixes). - Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet (git-fixes). - Input: psxpad-spi - set driver data before use (git-fixes). - hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination (git-fixes). - hwmon: (nzxt-smart2) Check return value of init_device() in probe (git-fixes). - drm/radeon: restore hardware polling in fence_is_signaled to fix performance regression (git-fixes). - drm/bridge: ps8640: propagate AUX transfer register errors (git-fixes). - ASoC: cs4265: sort the register default table (git-fixes). - ASoC: cs35l45: sort the register default table (git-fixes). - ASoC: cs35l41: sort the register default table (git-fixes). - ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() (git-fixes). - ALSA: usx2y: bound the hwdep mmap fault offset (git-fixes). - ALSA: usb-audio: fix OOB write on Type II inbound URBs (git-fixes). - drm/amdgpu: cap GTT size to physical RAM on APUs (stable-fixes). - drm/amdgpu: restore UMD profile pstate after runtime resume (stable-fixes). - drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE (stable-fixes). - drm/amdkfd: Handle invalid event type in CRIU event restore (stable-fixes). - drm/amdkfd: fix QID bit leak in pqm_create_queue() (stable-fixes). - ALSA: 6fire: Fix UAF at error handling during probe (stable-fixes). - can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking (stable-fixes). - Bluetooth: hci_conn: hold conn reference in abort_conn_sync() (git-fixes). - HID: logitech-dj: Fix maxfield check in DJ short report validation (git-fixes). - HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report (git-fixes). - HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write (stable-fixes). - HID: logitech-dj: Standardise hid_report_enum variable nomenclature (stable-fixes). - Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists (stable-fixes). - drm/i915/fbc: Extract intel_fbc_has_fences() (stable-fixes). - commit 6949ddd - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (CVE-2026-52939 bsc#1268972) - commit 164588a - RDMA/core: Prefer NLA_NUL_STRING (CVE-2026-63860 bsc#1272429) - commit aa014d6 - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CVE-2026-64102 bsc#1272516) - commit 47a9df6 - RDMA/siw: bound Read Response placement to the RREAD length (CVE-2026-64268 bsc#1273276) - commit 7382b12 ++++ kernel-rt: - smb: client: require net admin for CIFS SWN netlink (bsc#1273966). - commit 90b0802 - smb: client: resolve SWN tcon from live registrations (bsc#1273872). - commit f2fe4d9 - powerpc/pseries: Ensure vpa,slb_shadow & dtl are unregistered during crash (bsc#1271256). - commit 41b208f - crypto: pcrypt - restore callback for non-parallel fallback (CVE-2026-64312 bsc#1273968). - commit cab2de2 - crypto: qat - validate RSA CRT component lengths (CVE-2026-64304 bsc#1273944). - commit 1035d35 - nfc: llcp: Fix use-after-free in llcp_sock_release() (CVE-2026-64011 bsc#1273891). - commit 7136986 - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CVE-2026-63944 bsc#1272662). - commit 16a5138 - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (CVE-2026-64010 bsc#1273882). - commit 87fc1db - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (CVE-2026-64562 bsc#1273930). - commit 9724082 - ceph: supply snapshot context in ceph_zero_partial_object() (CVE-2026-43273 bsc#1264446). - commit 8eab714 - apparmor: advertise the tcp fast open fix is applied (git-fixes). - commit 565b3ed - net: ifb: report ethtool stats over num_tx_queues (CVE-2026-64121 bsc#1273743). - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CVE-2026-64048 bsc#1273484). - commit 3df99b0 - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (CVE-2026-64188 bsc#1272150). - bonding: 3ad: implement proper RCU rules for port->aggregator (CVE-2026-52975 bsc#1269234). - vrf: Fix a potential NPD when removing a port from a VRF (CVE-2026-52925 bsc#1268987). - bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (CVE-2026-52975 bsc#1269234). - commit 0a4ee3e - KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (git-fixes). - commit 3761287 - spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788 CVE-2026-43319) - commit 554c823 - usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() (git-fixes). - usb: gadget: f_ncm: Use unsigned int for ndp_index (git-fixes). - usb: cdnsp: fix incorrect endian conversions for APB timeout register (git-fixes). - thunderbolt: icm: Preserve USB4 proxy data-valid bit (git-fixes). - thunderbolt: Bound the DROM dual link port number before indexing sw->ports (git-fixes). - serial: qcom-geni: fix TX DMA buffer flush (git-fixes). - serial: 8250_dma: Clear stale RX state on shutdown (git-fixes). - staging: rtl8723bs: validate monitor transmit frame lengths (git-fixes). - staging: rtl8723bs: fix missing shared-key auth challenge length check (git-fixes). - staging: rtl8723bs: fix OOB read in WMM_param_handler() (git-fixes). - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() (git-fixes). - net: usb: ipheth: fix carrier_work UAF on disconnect (git-fixes). - net: thunderbolt: Tear down DMA paths before stopping the rings (git-fixes). - net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() (git-fixes). - USB: serial: option: add TDTECH MT5710-CN (stable-fixes). - USB: serial: ftdi_sio: add support for E+H FXA291 (stable-fixes). - USB: storage: add NO_ATA_1X quirk for Longmai USB Key (stable-fixes). - pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes). - pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes). - usb: musb: omap2430: clean up probe error handling (stable-fixes). - commit d5dcdad - ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses (git-fixes). - commit 657f5c3 - mei: pull kvfree out of spinlock (git-fixes). - misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free (git-fixes). - misc: fastrpc: fix channel ctx ref leak when session alloc fails (git-fixes). - misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke (git-fixes). - misc: fastrpc: Remove buffer from list prior to unmap operation (git-fixes). - fbdev: bitblit: bound-check glyph index in bit_cursor() (git-fixes). - fbdev: core: Fix pointer desynchronization in fb_io_read() (git-fixes). - Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue (git-fixes). - Input: synaptics-rmi4 - block s_input when F54 queue is busy (git-fixes). - Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer (git-fixes). - Input: synaptics-rmi4 - zero report size on F54 work error (git-fixes). - Input: synaptics-rmi4 - fix F55 transmitter electrode count typo (git-fixes). - Input: hynitron_cstxxx - validate touch count and finger IDs (git-fixes). - Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet (git-fixes). - Input: psxpad-spi - set driver data before use (git-fixes). - hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination (git-fixes). - hwmon: (nzxt-smart2) Check return value of init_device() in probe (git-fixes). - drm/radeon: restore hardware polling in fence_is_signaled to fix performance regression (git-fixes). - drm/bridge: ps8640: propagate AUX transfer register errors (git-fixes). - ASoC: cs4265: sort the register default table (git-fixes). - ASoC: cs35l45: sort the register default table (git-fixes). - ASoC: cs35l41: sort the register default table (git-fixes). - ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() (git-fixes). - ALSA: usx2y: bound the hwdep mmap fault offset (git-fixes). - ALSA: usb-audio: fix OOB write on Type II inbound URBs (git-fixes). - drm/amdgpu: cap GTT size to physical RAM on APUs (stable-fixes). - drm/amdgpu: restore UMD profile pstate after runtime resume (stable-fixes). - drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE (stable-fixes). - drm/amdkfd: Handle invalid event type in CRIU event restore (stable-fixes). - drm/amdkfd: fix QID bit leak in pqm_create_queue() (stable-fixes). - ALSA: 6fire: Fix UAF at error handling during probe (stable-fixes). - can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking (stable-fixes). - Bluetooth: hci_conn: hold conn reference in abort_conn_sync() (git-fixes). - HID: logitech-dj: Fix maxfield check in DJ short report validation (git-fixes). - HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report (git-fixes). - HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write (stable-fixes). - HID: logitech-dj: Standardise hid_report_enum variable nomenclature (stable-fixes). - Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists (stable-fixes). - drm/i915/fbc: Extract intel_fbc_has_fences() (stable-fixes). - commit 6949ddd - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (CVE-2026-52939 bsc#1268972) - commit 164588a - RDMA/core: Prefer NLA_NUL_STRING (CVE-2026-63860 bsc#1272429) - commit aa014d6 - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CVE-2026-64102 bsc#1272516) - commit 47a9df6 - RDMA/siw: bound Read Response placement to the RREAD length (CVE-2026-64268 bsc#1273276) - commit 7382b12 ++++ kernel-rt_debug: - smb: client: require net admin for CIFS SWN netlink (bsc#1273966). - commit 90b0802 - smb: client: resolve SWN tcon from live registrations (bsc#1273872). - commit f2fe4d9 - powerpc/pseries: Ensure vpa,slb_shadow & dtl are unregistered during crash (bsc#1271256). - commit 41b208f - crypto: pcrypt - restore callback for non-parallel fallback (CVE-2026-64312 bsc#1273968). - commit cab2de2 - crypto: qat - validate RSA CRT component lengths (CVE-2026-64304 bsc#1273944). - commit 1035d35 - nfc: llcp: Fix use-after-free in llcp_sock_release() (CVE-2026-64011 bsc#1273891). - commit 7136986 - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CVE-2026-63944 bsc#1272662). - commit 16a5138 - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (CVE-2026-64010 bsc#1273882). - commit 87fc1db - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (CVE-2026-64562 bsc#1273930). - commit 9724082 - ceph: supply snapshot context in ceph_zero_partial_object() (CVE-2026-43273 bsc#1264446). - commit 8eab714 - apparmor: advertise the tcp fast open fix is applied (git-fixes). - commit 565b3ed - net: ifb: report ethtool stats over num_tx_queues (CVE-2026-64121 bsc#1273743). - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CVE-2026-64048 bsc#1273484). - commit 3df99b0 - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (CVE-2026-64188 bsc#1272150). - bonding: 3ad: implement proper RCU rules for port->aggregator (CVE-2026-52975 bsc#1269234). - vrf: Fix a potential NPD when removing a port from a VRF (CVE-2026-52925 bsc#1268987). - bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (CVE-2026-52975 bsc#1269234). - commit 0a4ee3e - KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (git-fixes). - commit 3761287 - spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788 CVE-2026-43319) - commit 554c823 - usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() (git-fixes). - usb: gadget: f_ncm: Use unsigned int for ndp_index (git-fixes). - usb: cdnsp: fix incorrect endian conversions for APB timeout register (git-fixes). - thunderbolt: icm: Preserve USB4 proxy data-valid bit (git-fixes). - thunderbolt: Bound the DROM dual link port number before indexing sw->ports (git-fixes). - serial: qcom-geni: fix TX DMA buffer flush (git-fixes). - serial: 8250_dma: Clear stale RX state on shutdown (git-fixes). - staging: rtl8723bs: validate monitor transmit frame lengths (git-fixes). - staging: rtl8723bs: fix missing shared-key auth challenge length check (git-fixes). - staging: rtl8723bs: fix OOB read in WMM_param_handler() (git-fixes). - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() (git-fixes). - net: usb: ipheth: fix carrier_work UAF on disconnect (git-fixes). - net: thunderbolt: Tear down DMA paths before stopping the rings (git-fixes). - net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() (git-fixes). - USB: serial: option: add TDTECH MT5710-CN (stable-fixes). - USB: serial: ftdi_sio: add support for E+H FXA291 (stable-fixes). - USB: storage: add NO_ATA_1X quirk for Longmai USB Key (stable-fixes). - pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes). - pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes). - usb: musb: omap2430: clean up probe error handling (stable-fixes). - commit d5dcdad - ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses (git-fixes). - commit 657f5c3 - mei: pull kvfree out of spinlock (git-fixes). - misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free (git-fixes). - misc: fastrpc: fix channel ctx ref leak when session alloc fails (git-fixes). - misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke (git-fixes). - misc: fastrpc: Remove buffer from list prior to unmap operation (git-fixes). - fbdev: bitblit: bound-check glyph index in bit_cursor() (git-fixes). - fbdev: core: Fix pointer desynchronization in fb_io_read() (git-fixes). - Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue (git-fixes). - Input: synaptics-rmi4 - block s_input when F54 queue is busy (git-fixes). - Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer (git-fixes). - Input: synaptics-rmi4 - zero report size on F54 work error (git-fixes). - Input: synaptics-rmi4 - fix F55 transmitter electrode count typo (git-fixes). - Input: hynitron_cstxxx - validate touch count and finger IDs (git-fixes). - Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet (git-fixes). - Input: psxpad-spi - set driver data before use (git-fixes). - hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination (git-fixes). - hwmon: (nzxt-smart2) Check return value of init_device() in probe (git-fixes). - drm/radeon: restore hardware polling in fence_is_signaled to fix performance regression (git-fixes). - drm/bridge: ps8640: propagate AUX transfer register errors (git-fixes). - ASoC: cs4265: sort the register default table (git-fixes). - ASoC: cs35l45: sort the register default table (git-fixes). - ASoC: cs35l41: sort the register default table (git-fixes). - ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() (git-fixes). - ALSA: usx2y: bound the hwdep mmap fault offset (git-fixes). - ALSA: usb-audio: fix OOB write on Type II inbound URBs (git-fixes). - drm/amdgpu: cap GTT size to physical RAM on APUs (stable-fixes). - drm/amdgpu: restore UMD profile pstate after runtime resume (stable-fixes). - drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE (stable-fixes). - drm/amdkfd: Handle invalid event type in CRIU event restore (stable-fixes). - drm/amdkfd: fix QID bit leak in pqm_create_queue() (stable-fixes). - ALSA: 6fire: Fix UAF at error handling during probe (stable-fixes). - can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking (stable-fixes). - Bluetooth: hci_conn: hold conn reference in abort_conn_sync() (git-fixes). - HID: logitech-dj: Fix maxfield check in DJ short report validation (git-fixes). - HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report (git-fixes). - HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write (stable-fixes). - HID: logitech-dj: Standardise hid_report_enum variable nomenclature (stable-fixes). - Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists (stable-fixes). - drm/i915/fbc: Extract intel_fbc_has_fences() (stable-fixes). - commit 6949ddd - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (CVE-2026-52939 bsc#1268972) - commit 164588a - RDMA/core: Prefer NLA_NUL_STRING (CVE-2026-63860 bsc#1272429) - commit aa014d6 - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CVE-2026-64102 bsc#1272516) - commit 47a9df6 - RDMA/siw: bound Read Response placement to the RREAD length (CVE-2026-64268 bsc#1273276) - commit 7382b12 ++++ python-cryptography: - CVE-2026-69248: distinguish NC kinds when evaluating wildcard DNS SANs Add patch CVE-2026-69248-distingush-nc-kinds-wildcard-sans.patch (bsc#1273549) - CVE-2026-69249: Add a signature validation budget during path construction Add patch CVE-2026-69249-signature-validation-budget.patch (bsc#1273516) ------------------------------------------------------------------ ------------------ 2026-8-8 - Aug 8 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - kabi: hide tc_action::tcfa_rcu into an anonymous union (CVE-2026-53264 bsc#1269238). - commit 34ff4c5 - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CVE-2026-53264 bsc#1269238). - commit c4c9b65 - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002 bsc#1273774). - commit f630a7a ++++ kernel-rt: - kabi: hide tc_action::tcfa_rcu into an anonymous union (CVE-2026-53264 bsc#1269238). - commit 34ff4c5 - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CVE-2026-53264 bsc#1269238). - commit c4c9b65 - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002 bsc#1273774). - commit f630a7a ++++ kernel-rt_debug: - kabi: hide tc_action::tcfa_rcu into an anonymous union (CVE-2026-53264 bsc#1269238). - commit 34ff4c5 - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CVE-2026-53264 bsc#1269238). - commit c4c9b65 - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002 bsc#1273774). - commit f630a7a ++++ python311-core: - noCVE: CVE-2026-6019 fix does not handle non-ascii chars correctly (bsc#1263083) (internal SUSE bug so far, no CVE yet) bsc1263083-http-cookies-atob-utf8.patch ++++ python311: - noCVE: CVE-2026-6019 fix does not handle non-ascii chars correctly (bsc#1263083) (internal SUSE bug so far, no CVE yet) bsc1263083-http-cookies-atob-utf8.patch ------------------------------------------------------------------ ------------------ 2026-8-7 - Aug 7 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (CVE-2026-64114 bsc#1273742). - commit bd8136a - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (CVE-2026-64541 bsc#1273303). - commit 290e12c - rhashtable: clear stale iter->p on table restart (CVE-2026-64563 bsc#1273995). - commit a97dbb1 - block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() (CVE-2026-64052 bsc#1272983). - commit 7b9ac94 - block: Avoid mounting the bdev pseudo-filesystem in userspace (CVE-2026-63810 bsc#1272297). - commit 9467065 - apparmor: mediate the implicit connect of TCP fast open sendmsg (CVE-2026-63828 bsc#1272175). - commit aa0fc31 - udf: validate VAT header length against the VAT inode size (CVE-2026-64323 bsc#1273305). - commit bcd3479 - smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382 bsc#1273291). - commit d2f8357 - smb: client: Fix next buffer leak in receive_encrypted_standard() (CVE-2026-64381 bsc#1273860). - commit bf02176 - exfat: fix potential use-after-free in exfat_find_dir_entry() (CVE-2026-63808 bsc#1272260). - commit 4a887a2 - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison (CVE-2026-53309 bsc#1269815). - commit 7749841 - virtio-net: fix len check in receive_big() (CVE-2026-64552 bsc#1273323). - commit 0e3f5ec - vsock/virtio: bind uarg before filling zerocopy skb (CVE-2026-63970 bsc#1272673). - commit 8076f5e - vsock/virtio: fix zerocopy completion for multi-skb sends (CVE-2026-53365 bsc#1271365). - commit 5ce7797 - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (CVE-2026-52994 bsc#1269126). - commit 5364b2d - ipv6: fix possible infinite loop in rt6_fill_node() (CVE-2026-63969 bsc#1272484). - commit e44ff46 - x86/bugs: Make Safe-RET robust against interrupt injection (bsc#1274208 CVE-2026-68480). - commit e53c705 - security/keys: fix missed RCU read section on lookup (CVE-2026-64015 bsc#1273762). - commit c2da77b - ALSA: seq: Serialize UMP output teardown with event_input (CVE-2026-64029 bsc#1273766). - commit 0e02ed1 - keys: Pin request_key_auth payload in instantiate paths (bsc#1272182 CVE-2026-63823). - commit 8dd2f49 ++++ kernel-rt: - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (CVE-2026-64114 bsc#1273742). - commit bd8136a - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (CVE-2026-64541 bsc#1273303). - commit 290e12c - rhashtable: clear stale iter->p on table restart (CVE-2026-64563 bsc#1273995). - commit a97dbb1 - block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() (CVE-2026-64052 bsc#1272983). - commit 7b9ac94 - block: Avoid mounting the bdev pseudo-filesystem in userspace (CVE-2026-63810 bsc#1272297). - commit 9467065 - apparmor: mediate the implicit connect of TCP fast open sendmsg (CVE-2026-63828 bsc#1272175). - commit aa0fc31 - udf: validate VAT header length against the VAT inode size (CVE-2026-64323 bsc#1273305). - commit bcd3479 - smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382 bsc#1273291). - commit d2f8357 - smb: client: Fix next buffer leak in receive_encrypted_standard() (CVE-2026-64381 bsc#1273860). - commit bf02176 - exfat: fix potential use-after-free in exfat_find_dir_entry() (CVE-2026-63808 bsc#1272260). - commit 4a887a2 - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison (CVE-2026-53309 bsc#1269815). - commit 7749841 - virtio-net: fix len check in receive_big() (CVE-2026-64552 bsc#1273323). - commit 0e3f5ec - vsock/virtio: bind uarg before filling zerocopy skb (CVE-2026-63970 bsc#1272673). - commit 8076f5e - vsock/virtio: fix zerocopy completion for multi-skb sends (CVE-2026-53365 bsc#1271365). - commit 5ce7797 - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (CVE-2026-52994 bsc#1269126). - commit 5364b2d - ipv6: fix possible infinite loop in rt6_fill_node() (CVE-2026-63969 bsc#1272484). - commit e44ff46 - x86/bugs: Make Safe-RET robust against interrupt injection (bsc#1274208 CVE-2026-68480). - commit e53c705 - security/keys: fix missed RCU read section on lookup (CVE-2026-64015 bsc#1273762). - commit c2da77b - ALSA: seq: Serialize UMP output teardown with event_input (CVE-2026-64029 bsc#1273766). - commit 0e02ed1 - keys: Pin request_key_auth payload in instantiate paths (bsc#1272182 CVE-2026-63823). - commit 8dd2f49 ++++ kernel-rt_debug: - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (CVE-2026-64114 bsc#1273742). - commit bd8136a - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (CVE-2026-64541 bsc#1273303). - commit 290e12c - rhashtable: clear stale iter->p on table restart (CVE-2026-64563 bsc#1273995). - commit a97dbb1 - block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() (CVE-2026-64052 bsc#1272983). - commit 7b9ac94 - block: Avoid mounting the bdev pseudo-filesystem in userspace (CVE-2026-63810 bsc#1272297). - commit 9467065 - apparmor: mediate the implicit connect of TCP fast open sendmsg (CVE-2026-63828 bsc#1272175). - commit aa0fc31 - udf: validate VAT header length against the VAT inode size (CVE-2026-64323 bsc#1273305). - commit bcd3479 - smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382 bsc#1273291). - commit d2f8357 - smb: client: Fix next buffer leak in receive_encrypted_standard() (CVE-2026-64381 bsc#1273860). - commit bf02176 - exfat: fix potential use-after-free in exfat_find_dir_entry() (CVE-2026-63808 bsc#1272260). - commit 4a887a2 - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison (CVE-2026-53309 bsc#1269815). - commit 7749841 - virtio-net: fix len check in receive_big() (CVE-2026-64552 bsc#1273323). - commit 0e3f5ec - vsock/virtio: bind uarg before filling zerocopy skb (CVE-2026-63970 bsc#1272673). - commit 8076f5e - vsock/virtio: fix zerocopy completion for multi-skb sends (CVE-2026-53365 bsc#1271365). - commit 5ce7797 - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (CVE-2026-52994 bsc#1269126). - commit 5364b2d - ipv6: fix possible infinite loop in rt6_fill_node() (CVE-2026-63969 bsc#1272484). - commit e44ff46 - x86/bugs: Make Safe-RET robust against interrupt injection (bsc#1274208 CVE-2026-68480). - commit e53c705 - security/keys: fix missed RCU read section on lookup (CVE-2026-64015 bsc#1273762). - commit c2da77b - ALSA: seq: Serialize UMP output teardown with event_input (CVE-2026-64029 bsc#1273766). - commit 0e02ed1 - keys: Pin request_key_auth payload in instantiate paths (bsc#1272182 CVE-2026-63823). - commit 8dd2f49 ------------------------------------------------------------------ ------------------ 2026-8-6 - Aug 6 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CVE-2026-64298 bsc#1273550). - commit 77b020f - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056 bsc#1267435). - commit 8c57442 - sched/psi: Create the psimon kthread outside of cgroup_mutex (bsc#1269134). - commit 49da9b8 - sctp: don't free the ASCONF's own transport in DEL-IP processing (CVE-2026-64564 bsc#1274072). - commit 8566e05 - net: bonding: fix NULL pointer dereference in bond_do_ioctl() (CVE-2026-53337 bsc#1270251). - commit f37040f - sched/psi: fix race between file release and pressure write (CVE-2026-52991 bsc#1269134). - cgroup: fix race between task migration and iteration (CVE-2026-43439 bsc#1265141). - commit f4468cc - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (CVE-2026-63962 bsc#1272482). - Refresh patches.suse/usb-typec-tcpm-Validate-SVID-index-in-svdm_consume_m.patch. - commit 7672123 - USB: serial: digi_acceleport: fix memory corruption with small endpoints (CVE-2026-63901 bsc#1272501). - commit d94d6b1 - USB: serial: mct_u232: fix memory corruption with small endpoint (CVE-2026-63928 bsc#1272891). - commit b8827af - fbdev: fix use-after-free in store_modes() (CVE-2026-63826 bsc#1272183). - commit 0291de1 ++++ kernel-rt: - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CVE-2026-64298 bsc#1273550). - commit 77b020f - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056 bsc#1267435). - commit 8c57442 - sched/psi: Create the psimon kthread outside of cgroup_mutex (bsc#1269134). - commit 49da9b8 - sctp: don't free the ASCONF's own transport in DEL-IP processing (CVE-2026-64564 bsc#1274072). - commit 8566e05 - net: bonding: fix NULL pointer dereference in bond_do_ioctl() (CVE-2026-53337 bsc#1270251). - commit f37040f - sched/psi: fix race between file release and pressure write (CVE-2026-52991 bsc#1269134). - cgroup: fix race between task migration and iteration (CVE-2026-43439 bsc#1265141). - commit f4468cc - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (CVE-2026-63962 bsc#1272482). - Refresh patches.suse/usb-typec-tcpm-Validate-SVID-index-in-svdm_consume_m.patch. - commit 7672123 - USB: serial: digi_acceleport: fix memory corruption with small endpoints (CVE-2026-63901 bsc#1272501). - commit d94d6b1 - USB: serial: mct_u232: fix memory corruption with small endpoint (CVE-2026-63928 bsc#1272891). - commit b8827af - fbdev: fix use-after-free in store_modes() (CVE-2026-63826 bsc#1272183). - commit 0291de1 ++++ kernel-rt_debug: - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CVE-2026-64298 bsc#1273550). - commit 77b020f - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056 bsc#1267435). - commit 8c57442 - sched/psi: Create the psimon kthread outside of cgroup_mutex (bsc#1269134). - commit 49da9b8 - sctp: don't free the ASCONF's own transport in DEL-IP processing (CVE-2026-64564 bsc#1274072). - commit 8566e05 - net: bonding: fix NULL pointer dereference in bond_do_ioctl() (CVE-2026-53337 bsc#1270251). - commit f37040f - sched/psi: fix race between file release and pressure write (CVE-2026-52991 bsc#1269134). - cgroup: fix race between task migration and iteration (CVE-2026-43439 bsc#1265141). - commit f4468cc - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (CVE-2026-63962 bsc#1272482). - Refresh patches.suse/usb-typec-tcpm-Validate-SVID-index-in-svdm_consume_m.patch. - commit 7672123 - USB: serial: digi_acceleport: fix memory corruption with small endpoints (CVE-2026-63901 bsc#1272501). - commit d94d6b1 - USB: serial: mct_u232: fix memory corruption with small endpoint (CVE-2026-63928 bsc#1272891). - commit b8827af - fbdev: fix use-after-free in store_modes() (CVE-2026-63826 bsc#1272183). - commit 0291de1 ++++ rpm: - harden ndb code [bsc#1269584] [CVE-2026-44605] * new patch: ndbharden.diff ------------------------------------------------------------------ ------------------ 2026-8-5 - Aug 5 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - bonding: refuse to enslave CAN devices (CVE-2026-63990 bsc#1273027). - commit ae14419 - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984 bsc#1272865). - commit e42c15c - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921 bsc#1272918). - commit bdf0f57 - ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917 bsc#1272904). - commit dc117a9 - KVM: x86: Fix SRCU list traversal in kvm_fire_mask_notifiers() (git-fixes). - commit 761b131 - KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (git-fixes). - commit 0b7a481 - KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (git-fixes). - commit 7658a65 - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (git-fixes). - commit 0497a26 - KVM: x86/mmu: Fix use-after-free on vendor module reload (git-fixes). - commit 47aedd3 - KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots (git-fixes). - commit e4eace2 - ipv6: exthdrs: recompute network header pointer once (CVE-2026-63922 CVE-2026-63924 bsc#1272855). - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63922 CVE-2026-63924 bsc#1272855). - ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922 CVE-2026-63924 bsc#1272855). - commit 918007a - scsi: qla2xxx: Fix improper freeing of purex item (CVE-2025-68741 bsc#1255703). - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (CVE-2025-68818 bsc#1256675). - commit b03a4e1 - sysfs: don't remove existing directory on update failure (CVE-2026-64185 bsc#1272200). - commit 96077f6 - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (git-fixes). - drm/amdgpu: Fix VFCT bus number matching with soft filter (stable-fixes). - drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved (stable-fixes). - gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings (stable-fixes). - wifi: cfg80211: bound element ID read when checking non-inheritance (git-fixes). - wifi: brcmfmac: initialize SDIO data work before cleanup (git-fixes). - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock (git-fixes). - wifi: cfg80211: reject unsupported PMSR FTM location requests (git-fixes). - wifi: cfg80211: validate PMSR FTM preamble range (git-fixes). - wifi: cfg80211: validate PMSR measurement type data (git-fixes). - wifi: nl80211: validate nested MBSSID IE blobs (git-fixes). - wifi: nl80211: free RNR data on MBSSID mismatch (git-fixes). - wifi: p54: validate RX frame length in p54_rx_eeprom_readback() (git-fixes). - wifi: libertas: fix memory leak in helper_firmware_cb() (git-fixes). - wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() (git-fixes). - wifi: cfg80211: cancel sched scan results work on unregister (git-fixes). - mtd: nand: mtk-ecc: stop on ECC idle timeouts (git-fixes). - mtd: mtdswap: remove debugfs stats file on teardown (git-fixes). - firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() (git-fixes). - firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context (git-fixes). - drm/amdkfd: Check bounds in allocate_event_notification_slot (stable-fixes). - drm/amdgpu: invoke pm_genpd_remove() before freeing genpd (stable-fixes). - drm/amdgpu/vce: fix integer overflow in image size (stable-fixes). - drm/amdgpu/vcn4: avoid rereading IB param length (stable-fixes). - drm/amdgpu: fix division by zero with invalid uvd dimensions (stable-fixes). - drm/amd/pm: make pp_features read-only when scpm is enabled (stable-fixes). - drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() (stable-fixes). - drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() (stable-fixes). - drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() (stable-fixes). - drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() (stable-fixes). - drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() (stable-fixes). - drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() (stable-fixes). - drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() (stable-fixes). - drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() (stable-fixes). - drm/amdgpu/gfx8: drop unecessary BUG_ON() (stable-fixes). - drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) (stable-fixes). - drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older (stable-fixes). - drm/radeon: fix r100_copy_blit for large BOs (stable-fixes). - mtd: rawnand: Pause continuous reads at block boundaries (git-fixes). - media: meson: vdec: Fix memory leak in error path of vdec_open (git-fixes). - media: cedrus: clean up media device on probe failure (git-fixes). - media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding (git-fixes). - media: nxp: imx8-isi: Fix potential out-of-bounds issues (git-fixes). - media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure (git-fixes). - media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path (git-fixes). - media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe (git-fixes). - media: vivid: check for vb2_is_busy() when toggling caps (git-fixes). - media: vivid: add vivid_update_reduced_fps() (git-fixes). - media: radio-si476x: Unregister v4l2_device on probe failure (git-fixes). - media: pwc: Drain fill_buf on start_streaming() failure (git-fixes). - media: sun4i-csi: Return queued buffers on start_streaming() failure (git-fixes). - media: rtl2832_sdr: Return queued buffers on start_streaming() failure (git-fixes). - media: pwc: Return queued buffers on start_streaming() failure (git-fixes). - media: msi2500: Return queued buffers on start_streaming() failure (git-fixes). - media: airspy: Return queued buffers on start_streaming() failure (git-fixes). - media: tegra-video: vi: fix invalid u32 return value in format lookup (git-fixes). - media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() (git-fixes). - media: rtl2832: fix use-after-free in rtl2832_remove() (git-fixes). - media: saa7134: Fix a possible memory leak in saa7134_video_init1 (git-fixes). - media: cx231xx: fix devres lifetime (git-fixes). - media: cx23885: add ioremap return check and cleanup (git-fixes). - media: stm32: dcmi: unregister notifier on probe failure (git-fixes). - fbdev: efifb: fix memory leak in efifb_probe() (git-fixes). - i2c: imx: separate atomic, dma and non-dma use case (stable-fixes). - platform/x86: dell-smbios: Move request functions for reuse (stable-fixes). - ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() (stable-fixes). - ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() (stable-fixes). - mtd: rawnand: Ensure all continuous terms are always in sync (git-fixes). - mtd: rawnand: Add a helper for calculating a page index (stable-fixes). - fbdev/efifb: Replace references to global screen_info by local pointer (stable-fixes). - commit ecd2f17 - wifi: iwlwifi: mvm: fix flushing during quiet CSA (bsc#1272600). - commit 235c15e - rpm/modversions: Allow unpacking consolidated data created by ksymtypes `scripts/sequence-patch --kabi` currently uses rpm/modversions to unpack consolidated symtypes data. This doesn't work in SL-16.1 where the data is created by ksymtypes (from suse-kabi-tools). The problem is that when ksymtypes packs individual symtypes files into a consolidated file, it uses the original '/.symtypes' filename in file separators. However, rpm/modversions expects the format to use '/.o' instead. Update rpm/modversions to recognize the '.symtypes' suffix as well. - commit 585bfaf - Update patches.suse/KVM-x86-Check-for-invalid-obsolete-root-after-making.patch (CVE-2026-64561 bsc#1273231). - commit d7ec22e - KEYS: fix overflow in keyctl_pkey_params_get_2() (bsc#1272180 CVE-2026-63824). - commit 4d61bdc - pf: Free reuseport cBPF prog after RCU grace period (CVE-2026-52910 bsc#1268659). - commit dd52946 - ALSA: hda/conexant: Fix missing error check for jack detection (CVE-2026-53291 bsc#1269697). - commit 6baac6e - Bluetooth: ISO: fix UAF in iso_recv_frame (CVE-2026-63946 bsc#1272665). - commit 9f5575b - EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418 CVE-2026-43266). - commit 700b038 ++++ kernel-rt: - bonding: refuse to enslave CAN devices (CVE-2026-63990 bsc#1273027). - commit ae14419 - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984 bsc#1272865). - commit e42c15c - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921 bsc#1272918). - commit bdf0f57 - ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917 bsc#1272904). - commit dc117a9 - KVM: x86: Fix SRCU list traversal in kvm_fire_mask_notifiers() (git-fixes). - commit 761b131 - KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (git-fixes). - commit 0b7a481 - KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (git-fixes). - commit 7658a65 - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (git-fixes). - commit 0497a26 - KVM: x86/mmu: Fix use-after-free on vendor module reload (git-fixes). - commit 47aedd3 - KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots (git-fixes). - commit e4eace2 - ipv6: exthdrs: recompute network header pointer once (CVE-2026-63922 CVE-2026-63924 bsc#1272855). - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63922 CVE-2026-63924 bsc#1272855). - ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922 CVE-2026-63924 bsc#1272855). - commit 918007a - scsi: qla2xxx: Fix improper freeing of purex item (CVE-2025-68741 bsc#1255703). - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (CVE-2025-68818 bsc#1256675). - commit b03a4e1 - sysfs: don't remove existing directory on update failure (CVE-2026-64185 bsc#1272200). - commit 96077f6 - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (git-fixes). - drm/amdgpu: Fix VFCT bus number matching with soft filter (stable-fixes). - drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved (stable-fixes). - gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings (stable-fixes). - wifi: cfg80211: bound element ID read when checking non-inheritance (git-fixes). - wifi: brcmfmac: initialize SDIO data work before cleanup (git-fixes). - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock (git-fixes). - wifi: cfg80211: reject unsupported PMSR FTM location requests (git-fixes). - wifi: cfg80211: validate PMSR FTM preamble range (git-fixes). - wifi: cfg80211: validate PMSR measurement type data (git-fixes). - wifi: nl80211: validate nested MBSSID IE blobs (git-fixes). - wifi: nl80211: free RNR data on MBSSID mismatch (git-fixes). - wifi: p54: validate RX frame length in p54_rx_eeprom_readback() (git-fixes). - wifi: libertas: fix memory leak in helper_firmware_cb() (git-fixes). - wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() (git-fixes). - wifi: cfg80211: cancel sched scan results work on unregister (git-fixes). - mtd: nand: mtk-ecc: stop on ECC idle timeouts (git-fixes). - mtd: mtdswap: remove debugfs stats file on teardown (git-fixes). - firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() (git-fixes). - firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context (git-fixes). - drm/amdkfd: Check bounds in allocate_event_notification_slot (stable-fixes). - drm/amdgpu: invoke pm_genpd_remove() before freeing genpd (stable-fixes). - drm/amdgpu/vce: fix integer overflow in image size (stable-fixes). - drm/amdgpu/vcn4: avoid rereading IB param length (stable-fixes). - drm/amdgpu: fix division by zero with invalid uvd dimensions (stable-fixes). - drm/amd/pm: make pp_features read-only when scpm is enabled (stable-fixes). - drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() (stable-fixes). - drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() (stable-fixes). - drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() (stable-fixes). - drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() (stable-fixes). - drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() (stable-fixes). - drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() (stable-fixes). - drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() (stable-fixes). - drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() (stable-fixes). - drm/amdgpu/gfx8: drop unecessary BUG_ON() (stable-fixes). - drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) (stable-fixes). - drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older (stable-fixes). - drm/radeon: fix r100_copy_blit for large BOs (stable-fixes). - mtd: rawnand: Pause continuous reads at block boundaries (git-fixes). - media: meson: vdec: Fix memory leak in error path of vdec_open (git-fixes). - media: cedrus: clean up media device on probe failure (git-fixes). - media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding (git-fixes). - media: nxp: imx8-isi: Fix potential out-of-bounds issues (git-fixes). - media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure (git-fixes). - media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path (git-fixes). - media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe (git-fixes). - media: vivid: check for vb2_is_busy() when toggling caps (git-fixes). - media: vivid: add vivid_update_reduced_fps() (git-fixes). - media: radio-si476x: Unregister v4l2_device on probe failure (git-fixes). - media: pwc: Drain fill_buf on start_streaming() failure (git-fixes). - media: sun4i-csi: Return queued buffers on start_streaming() failure (git-fixes). - media: rtl2832_sdr: Return queued buffers on start_streaming() failure (git-fixes). - media: pwc: Return queued buffers on start_streaming() failure (git-fixes). - media: msi2500: Return queued buffers on start_streaming() failure (git-fixes). - media: airspy: Return queued buffers on start_streaming() failure (git-fixes). - media: tegra-video: vi: fix invalid u32 return value in format lookup (git-fixes). - media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() (git-fixes). - media: rtl2832: fix use-after-free in rtl2832_remove() (git-fixes). - media: saa7134: Fix a possible memory leak in saa7134_video_init1 (git-fixes). - media: cx231xx: fix devres lifetime (git-fixes). - media: cx23885: add ioremap return check and cleanup (git-fixes). - media: stm32: dcmi: unregister notifier on probe failure (git-fixes). - fbdev: efifb: fix memory leak in efifb_probe() (git-fixes). - i2c: imx: separate atomic, dma and non-dma use case (stable-fixes). - platform/x86: dell-smbios: Move request functions for reuse (stable-fixes). - ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() (stable-fixes). - ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() (stable-fixes). - mtd: rawnand: Ensure all continuous terms are always in sync (git-fixes). - mtd: rawnand: Add a helper for calculating a page index (stable-fixes). - fbdev/efifb: Replace references to global screen_info by local pointer (stable-fixes). - commit ecd2f17 - wifi: iwlwifi: mvm: fix flushing during quiet CSA (bsc#1272600). - commit 235c15e - rpm/modversions: Allow unpacking consolidated data created by ksymtypes `scripts/sequence-patch --kabi` currently uses rpm/modversions to unpack consolidated symtypes data. This doesn't work in SL-16.1 where the data is created by ksymtypes (from suse-kabi-tools). The problem is that when ksymtypes packs individual symtypes files into a consolidated file, it uses the original '/.symtypes' filename in file separators. However, rpm/modversions expects the format to use '/.o' instead. Update rpm/modversions to recognize the '.symtypes' suffix as well. - commit 585bfaf - Update patches.suse/KVM-x86-Check-for-invalid-obsolete-root-after-making.patch (CVE-2026-64561 bsc#1273231). - commit d7ec22e - KEYS: fix overflow in keyctl_pkey_params_get_2() (bsc#1272180 CVE-2026-63824). - commit 4d61bdc - pf: Free reuseport cBPF prog after RCU grace period (CVE-2026-52910 bsc#1268659). - commit dd52946 - ALSA: hda/conexant: Fix missing error check for jack detection (CVE-2026-53291 bsc#1269697). - commit 6baac6e - Bluetooth: ISO: fix UAF in iso_recv_frame (CVE-2026-63946 bsc#1272665). - commit 9f5575b - EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418 CVE-2026-43266). - commit 700b038 ++++ kernel-rt_debug: - bonding: refuse to enslave CAN devices (CVE-2026-63990 bsc#1273027). - commit ae14419 - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984 bsc#1272865). - commit e42c15c - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921 bsc#1272918). - commit bdf0f57 - ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917 bsc#1272904). - commit dc117a9 - KVM: x86: Fix SRCU list traversal in kvm_fire_mask_notifiers() (git-fixes). - commit 761b131 - KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (git-fixes). - commit 0b7a481 - KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (git-fixes). - commit 7658a65 - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (git-fixes). - commit 0497a26 - KVM: x86/mmu: Fix use-after-free on vendor module reload (git-fixes). - commit 47aedd3 - KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots (git-fixes). - commit e4eace2 - ipv6: exthdrs: recompute network header pointer once (CVE-2026-63922 CVE-2026-63924 bsc#1272855). - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63922 CVE-2026-63924 bsc#1272855). - ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922 CVE-2026-63924 bsc#1272855). - commit 918007a - scsi: qla2xxx: Fix improper freeing of purex item (CVE-2025-68741 bsc#1255703). - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (CVE-2025-68818 bsc#1256675). - commit b03a4e1 - sysfs: don't remove existing directory on update failure (CVE-2026-64185 bsc#1272200). - commit 96077f6 - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (git-fixes). - drm/amdgpu: Fix VFCT bus number matching with soft filter (stable-fixes). - drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved (stable-fixes). - gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings (stable-fixes). - wifi: cfg80211: bound element ID read when checking non-inheritance (git-fixes). - wifi: brcmfmac: initialize SDIO data work before cleanup (git-fixes). - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock (git-fixes). - wifi: cfg80211: reject unsupported PMSR FTM location requests (git-fixes). - wifi: cfg80211: validate PMSR FTM preamble range (git-fixes). - wifi: cfg80211: validate PMSR measurement type data (git-fixes). - wifi: nl80211: validate nested MBSSID IE blobs (git-fixes). - wifi: nl80211: free RNR data on MBSSID mismatch (git-fixes). - wifi: p54: validate RX frame length in p54_rx_eeprom_readback() (git-fixes). - wifi: libertas: fix memory leak in helper_firmware_cb() (git-fixes). - wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() (git-fixes). - wifi: cfg80211: cancel sched scan results work on unregister (git-fixes). - mtd: nand: mtk-ecc: stop on ECC idle timeouts (git-fixes). - mtd: mtdswap: remove debugfs stats file on teardown (git-fixes). - firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() (git-fixes). - firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context (git-fixes). - drm/amdkfd: Check bounds in allocate_event_notification_slot (stable-fixes). - drm/amdgpu: invoke pm_genpd_remove() before freeing genpd (stable-fixes). - drm/amdgpu/vce: fix integer overflow in image size (stable-fixes). - drm/amdgpu/vcn4: avoid rereading IB param length (stable-fixes). - drm/amdgpu: fix division by zero with invalid uvd dimensions (stable-fixes). - drm/amd/pm: make pp_features read-only when scpm is enabled (stable-fixes). - drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() (stable-fixes). - drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() (stable-fixes). - drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() (stable-fixes). - drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() (stable-fixes). - drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() (stable-fixes). - drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() (stable-fixes). - drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() (stable-fixes). - drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() (stable-fixes). - drm/amdgpu/gfx8: drop unecessary BUG_ON() (stable-fixes). - drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) (stable-fixes). - drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older (stable-fixes). - drm/radeon: fix r100_copy_blit for large BOs (stable-fixes). - mtd: rawnand: Pause continuous reads at block boundaries (git-fixes). - media: meson: vdec: Fix memory leak in error path of vdec_open (git-fixes). - media: cedrus: clean up media device on probe failure (git-fixes). - media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding (git-fixes). - media: nxp: imx8-isi: Fix potential out-of-bounds issues (git-fixes). - media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure (git-fixes). - media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path (git-fixes). - media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe (git-fixes). - media: vivid: check for vb2_is_busy() when toggling caps (git-fixes). - media: vivid: add vivid_update_reduced_fps() (git-fixes). - media: radio-si476x: Unregister v4l2_device on probe failure (git-fixes). - media: pwc: Drain fill_buf on start_streaming() failure (git-fixes). - media: sun4i-csi: Return queued buffers on start_streaming() failure (git-fixes). - media: rtl2832_sdr: Return queued buffers on start_streaming() failure (git-fixes). - media: pwc: Return queued buffers on start_streaming() failure (git-fixes). - media: msi2500: Return queued buffers on start_streaming() failure (git-fixes). - media: airspy: Return queued buffers on start_streaming() failure (git-fixes). - media: tegra-video: vi: fix invalid u32 return value in format lookup (git-fixes). - media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() (git-fixes). - media: rtl2832: fix use-after-free in rtl2832_remove() (git-fixes). - media: saa7134: Fix a possible memory leak in saa7134_video_init1 (git-fixes). - media: cx231xx: fix devres lifetime (git-fixes). - media: cx23885: add ioremap return check and cleanup (git-fixes). - media: stm32: dcmi: unregister notifier on probe failure (git-fixes). - fbdev: efifb: fix memory leak in efifb_probe() (git-fixes). - i2c: imx: separate atomic, dma and non-dma use case (stable-fixes). - platform/x86: dell-smbios: Move request functions for reuse (stable-fixes). - ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() (stable-fixes). - ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() (stable-fixes). - mtd: rawnand: Ensure all continuous terms are always in sync (git-fixes). - mtd: rawnand: Add a helper for calculating a page index (stable-fixes). - fbdev/efifb: Replace references to global screen_info by local pointer (stable-fixes). - commit ecd2f17 - wifi: iwlwifi: mvm: fix flushing during quiet CSA (bsc#1272600). - commit 235c15e - rpm/modversions: Allow unpacking consolidated data created by ksymtypes `scripts/sequence-patch --kabi` currently uses rpm/modversions to unpack consolidated symtypes data. This doesn't work in SL-16.1 where the data is created by ksymtypes (from suse-kabi-tools). The problem is that when ksymtypes packs individual symtypes files into a consolidated file, it uses the original '/.symtypes' filename in file separators. However, rpm/modversions expects the format to use '/.o' instead. Update rpm/modversions to recognize the '.symtypes' suffix as well. - commit 585bfaf - Update patches.suse/KVM-x86-Check-for-invalid-obsolete-root-after-making.patch (CVE-2026-64561 bsc#1273231). - commit d7ec22e - KEYS: fix overflow in keyctl_pkey_params_get_2() (bsc#1272180 CVE-2026-63824). - commit 4d61bdc - pf: Free reuseport cBPF prog after RCU grace period (CVE-2026-52910 bsc#1268659). - commit dd52946 - ALSA: hda/conexant: Fix missing error check for jack detection (CVE-2026-53291 bsc#1269697). - commit 6baac6e - Bluetooth: ISO: fix UAF in iso_recv_frame (CVE-2026-63946 bsc#1272665). - commit 9f5575b - EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418 CVE-2026-43266). - commit 700b038 ------------------------------------------------------------------ ------------------ 2026-8-4 - Aug 4 2026 ------------------- ------------------------------------------------------------------ ++++ cryptsetup: - Extend the password for PBKDF2 benchmarking to be more than 20 chars to meet FIPS 140-3 requirements (bsc#1229975, bsc#1268874) * Add cryptsetup-fips140-3.patch ++++ python-kiwi: - Fixed TestSystemSetup::test_cleanup unit test The test was missing proper mocking and did not work as a generic test on all archs. ++++ kernel-default: - selftests/bpf: cover short IPv4/IPv6 inputs with adjust_room (CVE-2026-53074 bsc#1269688). - commit 0dc0f85 - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb (CVE-2026-53074 bsc#1269688). - commit 43dbba9 - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx (CVE-2026-64025 bsc#1273117). - commit 2af9948 - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying (CVE-2026-53345 bsc#1270132). - commit f720db0 - posix-timers: Polish coding style in a few places (bsc#1271912). - posix-timers: Clarify posix_timer_fn() comments (bsc#1271912). - posix-timers: Document common_clock_get() correctly (bsc#1271912). - commit fc424bc - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() (CVE-2026-53126 bsc#1269635). - commit 53a3406 - netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189 bsc#1272207). - commit 91ace86 - xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919 bsc#1272907). - sctp: fix race between sctp_wait_for_connect and peeloff (CVE-2026-63971 bsc#1272678). - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp() (CVE-2026-63994 bsc#1273035). - commit c25f44b - netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131 bsc#1269773). - commit 1230134 - mptcp: allow subflow rcv wnd to shrink (CVE-2026-53183 bsc#1269376). - commit 733ee64 - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb (CVE-2026-53088 bsc#1269185). - commit a2bbd1e - xfrm: esp: restore combined single-frag length gate (CVE-2026-63912 bsc#1272836). - commit d68b0ef - netfilter: nft_ct: bail out on template ct in get eval (CVE-2026-53267 bsc#1269577). - commit 74e70a9 - memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952 bsc#1272468). - commit 4852be9 - netfilter: nf_conntrack_sip: don't use simple_strtoul (CVE-2026-52986 bsc#1269289). - commit 42f853a - netfilter: nf_tables: use list_del_rcu for netlink hooks (CVE-2026-46324 bsc#1267995). - commit 4646be4 - netfilter: nf_tables: Introduce functions freeing nft_hook objects (CVE-2026-46324 bsc#1267995). - Refresh patches.suse/netfilter-nf_tables-reject-duplicate-device-on-updates.patch. - commit 52aec2f - kABI: netfilter: nf_conncount: increase the connection clean up limit to 64 (CVE-2026-45860 bsc#1266710). - commit d378632 - wifi: libertas: don't kill URBs in interrupt context (CVE-2026-53107 bsc#1269991). - wifi: libertas: use USB anchors for tracking in-flight URBs (CVE-2026-53107 bsc#1269991). - commit 13b8836 - Update patches.suse/Bluetooth-hci_core-Fix-use-after-free-in-vhci_flush.patch (CVE-2025-38250 bsc#1246182 CVE-2026-53252 bsc#1269307). - commit 2a47213 - Fix race for duplicate reqsk on identical SYN (CVE-2026-53260 bsc#1269731). - commit 215e161 - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (CVE-2026-53260 bsc#1269731). - net: fix memory leak in tcp_conn_request() (CVE-2026-53260 bsc#1269731 CVE-2024-57841 bsc#1235944). - commit f837c0f - Fix race for duplicate reqsk on identical SYN (CVE-2026-53260 bsc#1269731). - Refresh patches.suse/tcp-Fix-use-after-free-of-nreq-in-reqsk_timer_handler.patch. - Refresh patches.suse/tcp-dccp-Don-t-use-timer_pending-in-reqsk_queue_unlink.patch. - commit b38c2c2 - x86/apic: Disable x2apic on resume if the kernel expects so (CVE-2026-43363 bsc#1265068). - commit 2318e17 - usb: dwc3: gadget: Move vbus draw to workqueue context (CVE-2026-43170 bsc#1264452). - commit 21fdf54 ++++ kernel-rt: - selftests/bpf: cover short IPv4/IPv6 inputs with adjust_room (CVE-2026-53074 bsc#1269688). - commit 0dc0f85 - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb (CVE-2026-53074 bsc#1269688). - commit 43dbba9 - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx (CVE-2026-64025 bsc#1273117). - commit 2af9948 - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying (CVE-2026-53345 bsc#1270132). - commit f720db0 - posix-timers: Polish coding style in a few places (bsc#1271912). - posix-timers: Clarify posix_timer_fn() comments (bsc#1271912). - posix-timers: Document common_clock_get() correctly (bsc#1271912). - commit fc424bc - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() (CVE-2026-53126 bsc#1269635). - commit 53a3406 - netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189 bsc#1272207). - commit 91ace86 - xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919 bsc#1272907). - sctp: fix race between sctp_wait_for_connect and peeloff (CVE-2026-63971 bsc#1272678). - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp() (CVE-2026-63994 bsc#1273035). - commit c25f44b - netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131 bsc#1269773). - commit 1230134 - mptcp: allow subflow rcv wnd to shrink (CVE-2026-53183 bsc#1269376). - commit 733ee64 - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb (CVE-2026-53088 bsc#1269185). - commit a2bbd1e - xfrm: esp: restore combined single-frag length gate (CVE-2026-63912 bsc#1272836). - commit d68b0ef - netfilter: nft_ct: bail out on template ct in get eval (CVE-2026-53267 bsc#1269577). - commit 74e70a9 - memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952 bsc#1272468). - commit 4852be9 - netfilter: nf_conntrack_sip: don't use simple_strtoul (CVE-2026-52986 bsc#1269289). - commit 42f853a - netfilter: nf_tables: use list_del_rcu for netlink hooks (CVE-2026-46324 bsc#1267995). - commit 4646be4 - netfilter: nf_tables: Introduce functions freeing nft_hook objects (CVE-2026-46324 bsc#1267995). - Refresh patches.suse/netfilter-nf_tables-reject-duplicate-device-on-updates.patch. - commit 52aec2f - kABI: netfilter: nf_conncount: increase the connection clean up limit to 64 (CVE-2026-45860 bsc#1266710). - commit d378632 - wifi: libertas: don't kill URBs in interrupt context (CVE-2026-53107 bsc#1269991). - wifi: libertas: use USB anchors for tracking in-flight URBs (CVE-2026-53107 bsc#1269991). - commit 13b8836 - Update patches.suse/Bluetooth-hci_core-Fix-use-after-free-in-vhci_flush.patch (CVE-2025-38250 bsc#1246182 CVE-2026-53252 bsc#1269307). - commit 2a47213 - Fix race for duplicate reqsk on identical SYN (CVE-2026-53260 bsc#1269731). - commit 215e161 - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (CVE-2026-53260 bsc#1269731). - net: fix memory leak in tcp_conn_request() (CVE-2026-53260 bsc#1269731 CVE-2024-57841 bsc#1235944). - commit f837c0f - Fix race for duplicate reqsk on identical SYN (CVE-2026-53260 bsc#1269731). - Refresh patches.suse/tcp-Fix-use-after-free-of-nreq-in-reqsk_timer_handler.patch. - Refresh patches.suse/tcp-dccp-Don-t-use-timer_pending-in-reqsk_queue_unlink.patch. - commit b38c2c2 - x86/apic: Disable x2apic on resume if the kernel expects so (CVE-2026-43363 bsc#1265068). - commit 2318e17 - usb: dwc3: gadget: Move vbus draw to workqueue context (CVE-2026-43170 bsc#1264452). - commit 21fdf54 ++++ kernel-rt_debug: - selftests/bpf: cover short IPv4/IPv6 inputs with adjust_room (CVE-2026-53074 bsc#1269688). - commit 0dc0f85 - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb (CVE-2026-53074 bsc#1269688). - commit 43dbba9 - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx (CVE-2026-64025 bsc#1273117). - commit 2af9948 - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying (CVE-2026-53345 bsc#1270132). - commit f720db0 - posix-timers: Polish coding style in a few places (bsc#1271912). - posix-timers: Clarify posix_timer_fn() comments (bsc#1271912). - posix-timers: Document common_clock_get() correctly (bsc#1271912). - commit fc424bc - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() (CVE-2026-53126 bsc#1269635). - commit 53a3406 - netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189 bsc#1272207). - commit 91ace86 - xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919 bsc#1272907). - sctp: fix race between sctp_wait_for_connect and peeloff (CVE-2026-63971 bsc#1272678). - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp() (CVE-2026-63994 bsc#1273035). - commit c25f44b - netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131 bsc#1269773). - commit 1230134 - mptcp: allow subflow rcv wnd to shrink (CVE-2026-53183 bsc#1269376). - commit 733ee64 - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb (CVE-2026-53088 bsc#1269185). - commit a2bbd1e - xfrm: esp: restore combined single-frag length gate (CVE-2026-63912 bsc#1272836). - commit d68b0ef - netfilter: nft_ct: bail out on template ct in get eval (CVE-2026-53267 bsc#1269577). - commit 74e70a9 - memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952 bsc#1272468). - commit 4852be9 - netfilter: nf_conntrack_sip: don't use simple_strtoul (CVE-2026-52986 bsc#1269289). - commit 42f853a - netfilter: nf_tables: use list_del_rcu for netlink hooks (CVE-2026-46324 bsc#1267995). - commit 4646be4 - netfilter: nf_tables: Introduce functions freeing nft_hook objects (CVE-2026-46324 bsc#1267995). - Refresh patches.suse/netfilter-nf_tables-reject-duplicate-device-on-updates.patch. - commit 52aec2f - kABI: netfilter: nf_conncount: increase the connection clean up limit to 64 (CVE-2026-45860 bsc#1266710). - commit d378632 - wifi: libertas: don't kill URBs in interrupt context (CVE-2026-53107 bsc#1269991). - wifi: libertas: use USB anchors for tracking in-flight URBs (CVE-2026-53107 bsc#1269991). - commit 13b8836 - Update patches.suse/Bluetooth-hci_core-Fix-use-after-free-in-vhci_flush.patch (CVE-2025-38250 bsc#1246182 CVE-2026-53252 bsc#1269307). - commit 2a47213 - Fix race for duplicate reqsk on identical SYN (CVE-2026-53260 bsc#1269731). - commit 215e161 - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (CVE-2026-53260 bsc#1269731). - net: fix memory leak in tcp_conn_request() (CVE-2026-53260 bsc#1269731 CVE-2024-57841 bsc#1235944). - commit f837c0f - Fix race for duplicate reqsk on identical SYN (CVE-2026-53260 bsc#1269731). - Refresh patches.suse/tcp-Fix-use-after-free-of-nreq-in-reqsk_timer_handler.patch. - Refresh patches.suse/tcp-dccp-Don-t-use-timer_pending-in-reqsk_queue_unlink.patch. - commit b38c2c2 - x86/apic: Disable x2apic on resume if the kernel expects so (CVE-2026-43363 bsc#1265068). - commit 2318e17 - usb: dwc3: gadget: Move vbus draw to workqueue context (CVE-2026-43170 bsc#1264452). - commit 21fdf54 ++++ libssh2_org: - Security fixes: * CVE-2026-58050: Attacker controlled attribute count from a publickey-subsystem response is used without bounds checking and can cause to a heap buffer overflow in a connecting libssh2 client (bsc#1269568) * CVE-2026-58051: Public key list is increased and does not zero-initialized new entries, which can cause an uninitialized pointer to be freed when a malformed response is sent by an SSH server (bsc#1269567) * Add patches - libssh2-CVE-2026-58050.patch - libssh2-CVE-2026-58051.patch ------------------------------------------------------------------ ------------------ 2026-8-3 - Aug 3 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - xfs: fail recovery on a committed log item with no regions (CVE-2026-64187 bsc#1272204). - commit e8d6d84 - nfsd: reset write verifier on deferred writeback errors (CVE-2026-53393 bsc#1271858). - commit 1763bfe - nfsd: Don't reset the write verifier on a commit EAGAIN (CVE-2026-53393 bsc#1271858). - commit 68cae9b - hrtimers: Introduce hrtimer_setup() to replace hrtimer_init() (bsc#1271912). - commit 954ea2d - posix-timers: Cure si_sys_private race (bsc#1271912). - posix-timers: Consolidate signal queueing (bsc#1271912). - posix-cpu-timers: Make k_itimer::it_active consistent (bsc#1271912). - posix-timers: Consolidate timer setup (bsc#1271912). - posix-timers: Clear overrun in common_timer_set() (bsc#1271912). - posix-timers: Retrieve interval in common timer_settime() code (bsc#1271912). - posix-cpu-timers: Simplify posix_cpu_timer_set() (bsc#1271912). - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (bsc#1271912). - posix-cpu-timers: Use @now instead of @val for clarity (bsc#1271912). - posix-cpu-timers: Do not arm SIGEV_NONE timers (bsc#1271912). - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (bsc#1271912). - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (bsc#1271912). - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (bsc#1271912). - posix-cpu-timers: Handle interval timers correctly in timer_get() (bsc#1271912). - posix-cpu-timers: Split up posix_cpu_timer_get() (bsc#1271912). - commit 5dd9a91 - KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (git-fixes). - commit d9d1342 - KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (git-fixes). - commit 10cd3e9 - KVM: x86: hyper-v: Bound the bank index when querying sparse banks (git-fixes). - commit d9f5716 - iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (CVE-2026-43161 bsc#1264333). - commit d394d06 - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (CVE-2026-43130 bsc#1264532). - commit 2a4c64e - mm: convert pagecache_isize_extended to use a folio (bsc#1272920). - commit e98ff83 - mm: zero range of eof folio exposed by inode size extension (bsc#1272920). - commit 6c8c472 - dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ (git-fixes). - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (git-fixes). - dmaengine: idxd: fix double free of wq, engine, and group structs (git-fixes). - dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA (git-fixes). - phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB (git-fixes). - phy: zynqmp: use read-modify-write for SERDES scrambler bypass (git-fixes). - phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask (git-fixes). - commit 993f7ad - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (bsc#1273231). - commit 46b2eca - add bugnumber to existing mana changes (bsc#1272693). - Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices (git-fixes). - net: mana: Return error code from mana_create_rxq() (git-fixes). - RDMA/mana_ib: initialize err for empty send WR lists (git-fixes). - commit 0994f02 ++++ kernel-rt: - xfs: fail recovery on a committed log item with no regions (CVE-2026-64187 bsc#1272204). - commit e8d6d84 - nfsd: reset write verifier on deferred writeback errors (CVE-2026-53393 bsc#1271858). - commit 1763bfe - nfsd: Don't reset the write verifier on a commit EAGAIN (CVE-2026-53393 bsc#1271858). - commit 68cae9b - hrtimers: Introduce hrtimer_setup() to replace hrtimer_init() (bsc#1271912). - commit 954ea2d - posix-timers: Cure si_sys_private race (bsc#1271912). - posix-timers: Consolidate signal queueing (bsc#1271912). - posix-cpu-timers: Make k_itimer::it_active consistent (bsc#1271912). - posix-timers: Consolidate timer setup (bsc#1271912). - posix-timers: Clear overrun in common_timer_set() (bsc#1271912). - posix-timers: Retrieve interval in common timer_settime() code (bsc#1271912). - posix-cpu-timers: Simplify posix_cpu_timer_set() (bsc#1271912). - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (bsc#1271912). - posix-cpu-timers: Use @now instead of @val for clarity (bsc#1271912). - posix-cpu-timers: Do not arm SIGEV_NONE timers (bsc#1271912). - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (bsc#1271912). - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (bsc#1271912). - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (bsc#1271912). - posix-cpu-timers: Handle interval timers correctly in timer_get() (bsc#1271912). - posix-cpu-timers: Split up posix_cpu_timer_get() (bsc#1271912). - commit 5dd9a91 - KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (git-fixes). - commit d9d1342 - KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (git-fixes). - commit 10cd3e9 - KVM: x86: hyper-v: Bound the bank index when querying sparse banks (git-fixes). - commit d9f5716 - iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (CVE-2026-43161 bsc#1264333). - commit d394d06 - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (CVE-2026-43130 bsc#1264532). - commit 2a4c64e - mm: convert pagecache_isize_extended to use a folio (bsc#1272920). - commit e98ff83 - mm: zero range of eof folio exposed by inode size extension (bsc#1272920). - commit 6c8c472 - dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ (git-fixes). - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (git-fixes). - dmaengine: idxd: fix double free of wq, engine, and group structs (git-fixes). - dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA (git-fixes). - phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB (git-fixes). - phy: zynqmp: use read-modify-write for SERDES scrambler bypass (git-fixes). - phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask (git-fixes). - commit 993f7ad - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (bsc#1273231). - commit 46b2eca - add bugnumber to existing mana changes (bsc#1272693). - Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices (git-fixes). - net: mana: Return error code from mana_create_rxq() (git-fixes). - RDMA/mana_ib: initialize err for empty send WR lists (git-fixes). - commit 0994f02 ++++ kernel-rt_debug: - xfs: fail recovery on a committed log item with no regions (CVE-2026-64187 bsc#1272204). - commit e8d6d84 - nfsd: reset write verifier on deferred writeback errors (CVE-2026-53393 bsc#1271858). - commit 1763bfe - nfsd: Don't reset the write verifier on a commit EAGAIN (CVE-2026-53393 bsc#1271858). - commit 68cae9b - hrtimers: Introduce hrtimer_setup() to replace hrtimer_init() (bsc#1271912). - commit 954ea2d - posix-timers: Cure si_sys_private race (bsc#1271912). - posix-timers: Consolidate signal queueing (bsc#1271912). - posix-cpu-timers: Make k_itimer::it_active consistent (bsc#1271912). - posix-timers: Consolidate timer setup (bsc#1271912). - posix-timers: Clear overrun in common_timer_set() (bsc#1271912). - posix-timers: Retrieve interval in common timer_settime() code (bsc#1271912). - posix-cpu-timers: Simplify posix_cpu_timer_set() (bsc#1271912). - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (bsc#1271912). - posix-cpu-timers: Use @now instead of @val for clarity (bsc#1271912). - posix-cpu-timers: Do not arm SIGEV_NONE timers (bsc#1271912). - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (bsc#1271912). - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (bsc#1271912). - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (bsc#1271912). - posix-cpu-timers: Handle interval timers correctly in timer_get() (bsc#1271912). - posix-cpu-timers: Split up posix_cpu_timer_get() (bsc#1271912). - commit 5dd9a91 - KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (git-fixes). - commit d9d1342 - KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (git-fixes). - commit 10cd3e9 - KVM: x86: hyper-v: Bound the bank index when querying sparse banks (git-fixes). - commit d9f5716 - iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (CVE-2026-43161 bsc#1264333). - commit d394d06 - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (CVE-2026-43130 bsc#1264532). - commit 2a4c64e - mm: convert pagecache_isize_extended to use a folio (bsc#1272920). - commit e98ff83 - mm: zero range of eof folio exposed by inode size extension (bsc#1272920). - commit 6c8c472 - dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ (git-fixes). - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (git-fixes). - dmaengine: idxd: fix double free of wq, engine, and group structs (git-fixes). - dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA (git-fixes). - phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB (git-fixes). - phy: zynqmp: use read-modify-write for SERDES scrambler bypass (git-fixes). - phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask (git-fixes). - commit 993f7ad - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (bsc#1273231). - commit 46b2eca - add bugnumber to existing mana changes (bsc#1272693). - Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices (git-fixes). - net: mana: Return error code from mana_create_rxq() (git-fixes). - RDMA/mana_ib: initialize err for empty send WR lists (git-fixes). - commit 0994f02 ++++ libssh2_org: - Security fixes: * CVE-2026-66032: Arbitrary code execution via double-free in SFTP session (bsc#1272737) * CVE-2026-66033: Denial of Service via integer underflow in AES-GCM cipher negotiation (bsc#1272736) * CVE-2026-66034: Information disclosure and potential arbitrary code execution via heap out-of-bounds read (bsc#1272735) * CVE-2026-66035: Arbitrary code execution via heap buffer overflow during SSH negotiation (bsc#1272734) * Add patches: - libssh2-CVE-2026-66032.patch - libssh2-CVE-2026-66033.patch - libssh2-CVE-2026-66034.patch - libssh2-CVE-2026-66035.patch - CVE-2026-7598: integer overflow in function userauth_password of file src/userauth.c (boo#1263890) libssh2-CVE-2026-7598.patch - CVE-2025-15661: out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c (boo#1268546) libssh2-CVE-2025-15661.patch ++++ pcr-oracle: - Update to 0.6.5 + Add replay tests + Add ecc-test to check for ECC P-256 support + Make .dir_list optional + Update help message and man page + Skip PCR 7 authority event synthesis for shim (bsc#1272350) - Remove test-authorized.sh from doc ++++ shim: - shim-install: Do not update fallback on sl-micro when the fallback is not in efi default boot path The SL-Micro SelfInstall image direct unpackage the raw image to the hard drive on target machine. The kiwi produced the raw image by 'shim-install --removable' command. So the raw image does NOT include fallback.efi in the EFI default boot path (aka. the removable boot path, EFI/boot/). Looks that SL-Micro does NOT care the fallback function of SUSE boot entry is lost. Normally, with or without fallback.efi should NOT case problem when booting. Also, the distro (SL-Micro in this case) does NOT care fallback function. But some issue machine's firmware can ONLY boot with the removable boot path (aka. the default boot path, /EFI/boot/bootx64.efi). And issue firmware always modified boot order or even removed SUSE boot entry. It causes that the fallback.efi always be triggered in every booting. The outward symptom is an endless cycle of rebooting and showing the fallback prompt box. The above situation NOT be found before we fix bsc#1254336. In bsc#1254336, the shim-install did NOT update the files in removable boot path. e.g. /EFI/boot/bootx64.efi or /EFI/boot/fallback.efi. So we will NOT update fallback.efi on SL-Micro when shim-install did NOT see fallback in the removable boot path (EFI/boot/fallback.efi). No fallback.efi in the removable boot path means that the target system is installed by wiki raw image. (bsc#1270036) ------------------------------------------------------------------ ------------------ 2026-8-2 - Aug 2 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - i2c: imx: Cancel hrtimer before clearing slave pointer (git-fixes). - i2c: imx: Fix slave registration race and error handling (git-fixes). - i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock (git-fixes). - i2c: amd-mp2: Unregister callback on adapter add failure (git-fixes). - commit ccb7c47 ++++ kernel-rt: - i2c: imx: Cancel hrtimer before clearing slave pointer (git-fixes). - i2c: imx: Fix slave registration race and error handling (git-fixes). - i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock (git-fixes). - i2c: amd-mp2: Unregister callback on adapter add failure (git-fixes). - commit ccb7c47 ++++ kernel-rt_debug: - i2c: imx: Cancel hrtimer before clearing slave pointer (git-fixes). - i2c: imx: Fix slave registration race and error handling (git-fixes). - i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock (git-fixes). - i2c: amd-mp2: Unregister callback on adapter add failure (git-fixes). - commit ccb7c47 ++++ rsync: - Removed SLP support: the SLP patch conflicts with and breaks the hardening patches. - Security update (bsc#1269060, rsync 3.5.0 security backports): - CVE-2026-53783, bsc#1269041: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) - CVE-2026-53784, bsc#1269042: Daemon module-root chdir escape under "use chroot = no" - CVE-2026-53785, bsc#1269043: --relative implied-parent creation escapes the destination tree - CVE-2026-53786, bsc#1269044: Daemon --filter merge file bypasses the module filter list - CVE-2026-53788, bsc#1269046: Daemon name-converter accepts newline-bearing names into its line protocol - CVE-2026-53789, bsc#1269047: Malicious sender expands --delete scope by reclassifying an implied parent - CVE-2026-53790, bsc#1269048: Command / argument injection via unquoted peer- or host-controlled values - CVE-2026-53791, bsc#1269049: PROXY-protocol mode lets a direct client spoof the daemon's source address - CVE-2026-53792, bsc#1269050: Receiver-supplied zero checksum block length drives sender matching negative - CVE-2026-53793, bsc#1269051: Chroot "/./" inner-module escape via a parent-component symlink - CVE-2026-53794, bsc#1269052: Remote peer disables the per-allocation sanity cap via --max-alloc=0 - CVE-2026-53795, bsc#1269053: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement - CVE-2026-53796, bsc#1269054: Non-daemon receiver destination-chdir symlink race (TOCTOU) - CVE-2026-53797, bsc#1269055: Sender source-tree parent-component symlink race -> out-of-tree disclosure - CVE-2026-53798, bsc#1269045: Daemon name-converter empty response maps an unknown name to uid/gid 0 - CVE-2026-53799, bsc#1269056: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (local privilege escalation) - CVE-2026-53800, bsc#1269057: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree - CVE-2026-53801, bsc#1269058: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure - CVE-2026-53802, bsc#1269039: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files - CVE-2026-53803, bsc#1269040: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths - CVE-2026-70463, bsc#1273430: "auth users" ignores documented comma-only parsing, silently skipping a deny/read-only rule - CVE-2026-70462, bsc#1273431: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (signed overflow, and a non-positive value) - CVE-2026-70461, bsc#1273432: Peer-driven one-byte heap out-of-bounds write in add_implied_include() - CVE-2026-70460, bsc#1273433: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in-module symlink - CVE-2026-70459, bsc#1273434: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root - CVE-2026-70458, bsc#1273435: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H - CVE-2026-70457, bsc#1273436: Attacker-chosen-offset write in parse_size_arg() error formatting - CVE-2026-70456, bsc#1273437: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs - CVE-2026-70454, bsc#1273439: rsync-ssl establishes an unauthenticated TLS connection (no CA verification; no stunnel hostname binding) - CVE-2026-70453, bsc#1273440: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain - CVE-2026-70464, bsc#1273429: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module - CVE-2026-70455, bsc#1273438: Peer-controlled Zstandard worker exhaustion on an rsync daemon - CVE-2026-70452, bsc#1273441: `hosts deny` fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block - Rejected CVEs (duplicates, resolved to canonical CVEs above): - CVE-2026-44507, bsc#1271931: duplicate of CVE-2026-43617 - CVE-2026-44508, bsc#1271932: duplicate of CVE-2026-43618 - CVE-2026-44509, bsc#1271933: duplicate of CVE-2026-43619 - CVE-2026-44510, bsc#1271934: duplicate of CVE-2026-43620 - List of patches added + hardening pre-requisite patches: - rsync-hardening-0044-receiver-fix-absolute-partial-dir-delta-resume-false.patch - rsync-hardening-0045-flist-accept-the-missing-args-mode-0-entry-in-recv_f.patch - rsync-hardening-0046-sender-open-a-module-root-absolute-path-for-a-path-m.patch - rsync-hardening-0047-syscall-receiver-honour-a-relative-alt-basis-dir-on-.patch - rsync-hardening-0048-generator-cap-block-s2length-at-the-negotiated-check.patch - rsync-hardening-0049-alloc-revert-zero-all-new-memory-from-allocations-95.patch - rsync-hardening-0050-build-fall-back-to-do_mknod-when-mknodat-is-unavaila.patch - rsync-hardening-0051-daemon-un-backslash-escaped-option-args-829.patch - rsync-hardening-0052-fix-install-generated-manpages-out-of-tree.patch - rsync-hardening-0053-token-drain-the-matched-block-insert-deflate-951.patch - rsync-hardening-0054-fix-daemon-upload-delete-stats.patch - rsync-hardening-0055-main-fix-mkpath-dry-run-file-to-file-copy-880.patch - rsync-hardening-0056-Always-clear-st-out-and-validate-nanoseconds-before-.patch - rsync-hardening-0057-fix-update-skips-different-file-type.patch - rsync-hardening-0058-build-openat2-autodetect-android-probe-R1-924-905-90.patch - rsync-hardening-0059-receiver-fix-NULL-deref-on-the-delta-discard-path.patch - rsync-hardening-0060-build-add-check-progs-target-for-fleettest.patch - rsync-hardening-0061-syscall-honour-open-noatime-in-do_open_nofollow.patch - rsync-hardening-0062-t_stub-give-test-helpers-an-unlimited-max_alloc.patch - rsync-hardening-0063-ci-run-the-v34-stable-testsuite-regression-suite-aga.patch - rsync-hardening-0064-CVE-2026-53788-CVE-2026-53798-clientserver-harden-daemon-name-converter-responses.patch - rsync-hardening-0065-CVE-2026-53786-CVE-2026-53789-exclude-flist-confine-daemon-filter-merge-and-implie.patch - rsync-hardening-0066-CVE-2026-53790-loadparm-shell-escape-RSYNC_-hook-expansions.patch - rsync-hardening-0067-CVE-2026-53790-CVE-2026-53794-options-bound-size-args-and-escape-remote-shell-newl.patch - rsync-hardening-0068-CVE-2026-53792-io-reject-malformed-wire-indices-and-zero-length-che.patch - rsync-hardening-0069-xattrs-cap-peer-supplied-wire-data.patch - rsync-hardening-0070-configure-detect-fdopendir-and-a-working-dirfd.patch - rsync-hardening-0071-syscall-P0-held-dirfd-scaffolding-open_dir_secure-do.patch - rsync-hardening-0072-syscall-replace-the-openat2-resolver-with-the-held-d.patch - rsync-hardening-0073-sender-follow-an-in-tree-symlink-leaf-confined-for-t.patch - rsync-hardening-0074-syscall-held_dfd_for-secure-mixed-parent-rename-and-.patch - rsync-hardening-0075-CVE-2026-53785-util1-set_times_at-make_path-parent-chain-via-do_mkd.patch - rsync-hardening-0076-rsync-generator-receiver-flist-route-attr-basis-scan.patch - rsync-hardening-0077-main-util1-keep-operator-trusted-alt-dest-basis-dirs.patch - rsync-hardening-0078-CVE-2026-53795-syscall-broaden-the-symlink-race-resolver-to-every-n.patch - rsync-hardening-0079-syscall-hold-an-ancestor-dirfd-stack-as-the-held-dir.patch - rsync-hardening-0080-syscall-close-the-chmod-leaf-race-with-a-held-fd-fch.patch - rsync-hardening-0081-CVE-2026-53795-build-add-t_rename_secure-and-t_symlink_secure-check.patch - rsync-hardening-0082-CVE-2026-53797-sender-confine-the-non-daemon-content-open-against-a.patch - rsync-hardening-0083-CVE-2026-53801-flist-clientserver-confine-the-directory-scan-enumer.patch - rsync-hardening-0084-sender-read-symlink-targets-through-scan-dirfds.patch - rsync-hardening-0085-CVE-2026-53784-CVE-2026-53802-util1-safe_open_no_attacker_symlinks-confine-daemon-module-root-chdir.patch - rsync-hardening-0086-CVE-2026-53803-CVE-2026-53802-daemon-authenticate-open-operator-supplied-paths-ref.patch - rsync-hardening-0087-syscall-resolve-the-daemon-s-served-module-anchor-vi.patch - rsync-hardening-0088-CVE-2026-53802-exclude-refuse-planted-symlinks-at-filter-merge-from.patch - rsync-hardening-0089-CVE-2026-53793-daemon-secure-inner-chroot-module-paths.patch - rsync-hardening-0090-CVE-2026-53796-util1-confine-the-non-daemon-receiver-s-destination-.patch - rsync-hardening-0091-CVE-2026-53803-log-batch-refuse-planted-symlinks-at-log-file-and-wr.patch - rsync-hardening-0092-CVE-2026-53791-daemon-bound-argument-lists-proxy-protocol-peer-leng.patch - rsync-hardening-0093-daemon-add-an-auth-digest-floor-to-refuse-weak-negot.patch - rsync-hardening-0094-CVE-2026-53790-rsync-ssl-validate-helper-hostnames-and-require-a-CA.patch - rsync-hardening-0095-CVE-2026-53783-rrsync-deny-copy-unsafe-links-in-restricted-dirs.patch - rsync-hardening-0096-CVE-2026-53783-rrsync-backport-the-full-restricted-dir-hardening.patch - rsync-hardening-0097-CVE-2026-53793-generator-confine-the-alt-dest-basis-stat-for-an-inn.patch - rsync-hardening-0098-generator-route-copy_altdest_file-failure-cleanup-th.patch - rsync-hardening-0099-token-allow-uncompressed-literal-runs-larger-than-CH.patch - rsync-hardening-0100-CVE-2026-53799-lib-acl.c-POSIX-ACL-get-set-via-fd-at-xattr-syscalls.patch - rsync-hardening-0101-CVE-2026-53799-rsync-acls-xattrs-apply-received-xattrs-and-ACLs-thr.patch - rsync-hardening-0102-CVE-2026-53799-xattrs-route-copy_xattrs-through-a-held-fd-not-lsetx.patch - rsync-hardening-0103-CVE-2026-53799-acls-keep-acls-functional-where-the-OS-lacks-a-race-.patch - rsync-hardening-0104-CVE-2026-53799-lib-acl-close-the-pre-6.13-ACL-parent-symlink-race-v.patch - rsync-hardening-0105-CVE-2026-53799-acls-route-race-safe-ACL-ops-through-libacl-_at-when.patch - rsync-hardening-0106-rsync-stat-through-the-held-dir-fd-in-set_file_attrs.patch - rsync-hardening-0107-generator-don-t-read-an-unstat-d-sx.st-when-creating.patch - rsync-hardening-0108-log-copy-forwarded-message-by-length-in-rwrite-not-s.patch - rsync-hardening-0109-wildtest-don-t-read-past-the-buffer-when-scanning-a-.patch - rsync-hardening-0110-lib-pool_alloc-fence-chunks-with-an-ASan-redzone-to-.patch - rsync-hardening-0111-hlink-reject-undeclared-cross-flist-gnum-instead-of-.patch - rsync-hardening-0112-flist-refuse-sub-flist-for-a-cleared-dir_flist-slot.patch - rsync-hardening-0113-recv_files-refuse-transfer-phase-ndx-that-targets-a-.patch - rsync-hardening-0114-flist-gate-FLAG_HLINKED-on-preserve_hard_links-in-re.patch - rsync-hardening-0115-log-do-not-dereference-F_SUM-for-C-on-a-deleted-entr.patch - rsync-hardening-0116-flist-refuse-FLAG_HLINKED-on-directory-entries.patch - rsync-hardening-0117-flist-refuse-sub-flist-after-the-final-flist-has-bee.patch - rsync-hardening-0118-exclude-cap-merge-file-include-recursion-depth.patch - rsync-hardening-0119-log-drop-receiver-side-assert-is_utf8-reachable-via-.patch - rsync-hardening-0120-options-clamp-snprintf-length-before-err_buf-len-wri.patch - rsync-hardening-0121-match-re-check-.len-l-before-substituting-want_i-in-.patch - rsync-hardening-0122-match-clamp-peer-supplied-s-flength-to-local-len-in-.patch - rsync-hardening-0123-exclude-count-trailing-backslash-in-add_implied_incl.patch - rsync-hardening-0124-io-defer-in_multiplexed-1-past-MSG_NOOP-MSG_IO_ERROR.patch - rsync-hardening-0125-io-ensure-argv-has-room-for-the-trailing-NULL-in-rea.patch - rsync-hardening-0126-io-defer-in_multiplexed-1-in-the-other-write-side-re.patch - rsync-hardening-0127-syscall-util1-race-safe-path-resolution-via-a-held-d.patch - rsync-hardening-0128-confine-operator-and-peer-supplied-paths-to-the-serv.patch - rsync-hardening-0129-daemon-treat-exclude-filter-as-a-name-filter-not-a-s.patch - rsync-hardening-0130-socket-reject-control-bytes-in-the-proxy-CONNECT-hos.patch - rsync-hardening-0131-batch-rsync-ssl-quote-replay-script-args-and-harden-.patch - rsync-hardening-0132-docs-NEWS-README-and-man-pages-for-the-3.5.0-securit.patch - rsync-hardening-0133-main-raise-the-open-file-soft-limit-so-the-resolver-.patch - rsync-hardening-0134-flist-receiver-zero-empty-the-device-symlink-extra-s.patch - rsync-hardening-0135-hlink-main-guard-the-F_SUM-checksum-slot-lifetime.patch - rsync-hardening-0136-generator-fix-off-by-one-length-in-read_delay_line.patch - rsync-hardening-0137-compat-assign-metadata-ndx-after-batch-flags-pick-ow.patch - rsync-hardening-0138-options-token-bound-the-v-repetition-output-level-an.patch - rsync-hardening-0139-io-xattrs-rsync-ssl-EOF-sentinel-guard-xattr-ndx-gua.patch - rsync-hardening-0140-syscall-do_mknod_at-must-mkfifoat-for-an-operator-pa.patch - rsync-hardening-0141-CVE-2026-43617-access-fail-closed-when-a-hosts-deny-token-can-t-be-.patch - rsync-hardening-0142-flist-xattrs-generator-uidlist-clientserver-plug-aud.patch - rsync-hardening-0143-daemon-insecure-links-opt-out-restores-legacy-symlin.patch - rsync-hardening-0144-backup-confine-cross-tree-operator-path-metadata-via.patch - rsync-hardening-0145-confine-the-remaining-cross-tree-operator-path-sysca.patch - rsync-hardening-0146-io-reject-a-non-positive-MSG_IO_TIMEOUT-from-the-pee.patch - rsync-hardening-0147-copy_file-confine-an-absolute-operator-source-via-th.patch - rsync-hardening-0148-hashtable-flist-fix-integer-overflows-in-size-comput.patch - rsync-hardening-0149-io-main-make-the-SIGUSR2-handler-async-signal-safe.patch - rsync-hardening-0150-syscall-drop-the-dead-name_is_dir-arg-from-abspath_e.patch - rsync-hardening-0151-daemon-make-insecure-links-yes-fully-restore-3.2.7-s.patch - rsync-hardening-0152-CVE-2026-53799-rsync-pin-cross-tree-fake-super-metadata-writes-to-a.patch - rsync-hardening-0153-CVE-2026-53799-xattrs-backup-read-source-metadata-through-a-held-fd.patch - rsync-hardening-0154-util1-declare-insecure_links-extern-for-the-change_d.patch - rsync-hardening-0155-CVE-2026-53799-rsync-never-path-resolve-a-confined-receiver-s-xattr.patch - rsync-hardening-0156-CVE-2026-53799-acls-implement-Solaris-facl-2-based-ACL-helpers.patch - rsync-hardening-0157-lib-sysxattrs-make-write_xattr-more-robust.patch - rsync-hardening-0158-receiver-don-t-abort-the-transfer-when-a-file-grows-.patch - rsync-hardening-0159-wildtest-use-stdbool.h-so-bool-works-from-C99-throug.patch - rsync-hardening-0161-Fix-bypass-of-safe-links-when-backup-hardlinks-a-sym.patch - rsync-hardening-0162-Fix-spurious-abort-when-CVS-.cvsignore-contains-clea.patch - rsync-hardening-0163-util1-fix-clean_fname-.-collapse-off-by-one.patch - rsync-hardening-0164-Add-escape-to-out-format-and-log-file-format-strings.patch - rsync-hardening-0165-Mask-incoming-MSG_IO_ERROR-to-defined-bits-only.patch - rsync-hardening-0166-util1-confine-operator-paths-in-the-robust_rename-EX.patch - rsync-hardening-0167-wildmatch-fold-bracket-expression-pattern-chars-unde.patch - rsync-hardening-0168-flist-mask-peer-supplied-io_error-to-defined-bits.patch - rsync-hardening-0169-backup-fail-closed-when-a-symlink-target-is-unreadab.patch - rsync-hardening-0170-util1-drop-null-tests-on-robust_rename-s-from-to-arg.patch - rsync-hardening-0171-testsuite-correct-the-ki62-comment-about-MSG_IO_ERRO.patch - rsync-hardening-0172-log-don-t-parse-the-second-of-as-a-new-format-escape.patch - rsync-hardening-0173-syscall-confine-operator-paths-in-do_symlink_at-and-.patch - rsync-hardening-0174-log-escape-control-chars-written-to-the-log-file.patch - rsync-hardening-0175-chmod-a-s-must-set-both-setuid-and-setgid.patch - rsync-hardening-0176-match-bound-the-hash_search-chain-walk-issue-217.patch - rsync-hardening-0177-io-cap-MSG_IO_TIMEOUT-value-to-prevent-signed-intege.patch - rsync-hardening-0178-io-make-set_io_timeout-arithmetic-overflow-safe.patch - rsync-hardening-0179-rsync-confine-the-daemon-files-from-open-to-the-modu.patch - rsync-hardening-0180-rsync-sanitize-the-peer-supplied-basis-xname-on-the-.patch - rsync-hardening-0181-receiver-confine-peer-selected-partial-basis-paths.patch - rsync-hardening-0182-receiver-only-reject-unconfined-partial-basis-when-i.patch - rsync-hardening-0183-flist-reject-non-directory-transfer-root-entries.patch - rsync-hardening-0184-flist-keep-synthetic-and-legacy-implied-parents-non-.patch - rsync-hardening-0185-syscall-silence-scan-build-dead-store-in-do_fchmodat.patch - rsync-hardening-0186-authenticate-build-without-O_CLOEXEC.patch - rsync-hardening-0187-receiver-do-not-acknowledge-batch-only-files-as-inst.patch - rsync-hardening-0188-receiver-retain-partial-dir-policy-across-EACCES-rec.patch - rsync-hardening-0189-syscall-honor-operator_path_resolve-in-do_chmod_at-d.patch - rsync-hardening-0190-daemon-quote-hook-expansions-for-their-shell-context.patch - rsync-hardening-0191-daemon-refuse-peer-values-holding-shell-syntax-in-sh.patch - rsync-hardening-0192-sender-allow-confined-parent-relative-copy-links-tar.patch - rsync-hardening-0193-syscall-defer-a-literal-.-to-the-walk-before-the-lea.patch - rsync-hardening-0194-sender-null-check-the-anchor-before-comparing-it-to-.patch - rsync-hardening-0195-syscall-preserve-fake-super-backups-as-placeholders.patch - rsync-hardening-0196-syscall-preserve-ordinary-mode-when-setgid-is-denied.patch - rsync-hardening-0197-exclude-path-resolving-to-operator-path-supplied-fil.patch - rsync-hardening-0198-exclude-exempt-the-daemon-s-own-filter-parameters-fr.patch - rsync-hardening-0199-auth-parse-auth-users-with-conf_strtok-so-a-leading-.patch - rsync-hardening-0200-rrsync-pass-the-files-from-stdin-sentinel-through-un.patch - rsync-hardening-0201-rrsync-pin-a-sender-argument-where-rsync-will-actual.patch - rsync-hardening-0202-rrsync-only-claim-the-inode-pin-where-the-kernel-act.patch - rsync-hardening-0203-rrsync-don-t-content-open-a-sender-leaf-rsync-will-n.patch - rsync-hardening-0204-rsync-add-drop-D-refusing-device-special-creation-on.patch - rsync-hardening-0205-rrsync-deny-device-special-creation-where-creation-h.patch - rsync-hardening-0206-options-refuse-aliases-for-exact-option-rules.patch - rsync-hardening-0207-rrsync-keep-remote-files-from-out-of-write-only-mode.patch - rsync-hardening-0208-rrsync-protect-no-overwrite-auxiliary-paths.patch - rsync-hardening-0209-daemon-reject-shell-active-hook-expansions.patch - rsync-hardening-0210-rsyncd.conf-document-that-the-hook-metacharacter-ref.patch - rsync-hardening-0211-daemon-refuse-and-braces-in-a-hook-expansion-too.patch - rsync-hardening-0212-socket-reject-shell-active-connect-hosts.patch - rsync-hardening-0213-socket-refuse-a-meaning-changing-first-character-and.patch - rsync-hardening-0214-backup-preserve-backup-dir-while-creating-it.patch - rsync-hardening-0215-rrsync-pin-receiver-option-directories-the-peer-can-.patch - rsync-hardening-0216-syscall-guard-do_mknod_atfd-s-mknodat-with-HAVE_MKNO.patch - rsync-hardening-0217-fileio-coalesce-sparse-writes-instead-of-1-KiB-dribb.patch - rsync-hardening-0218-fileio-keep-punching-interior-holes-on-the-matched-i.patch - rsync-hardening-0219-io-use-poll-instead-of-select-to-avoid-an-FD_SETSIZE.patch - rsync-hardening-0220-io-socket-address-review-of-the-poll-conversion.patch - rsync-hardening-0221-io-describe-the-timeout-guards-in-terms-of-poll-not-.patch - rsync-hardening-0222-build-require-poll.h-not-just-poll.patch - rsync-hardening-0223-rsync-ssl-testsuite-quote-paths-interpolated-into-sh.patch - rsync-hardening-0224-daemon-bound-the-pre-transfer-handshake-with-a-timeo.patch - rsync-hardening-0225-exclude-don-t-hand-a-merge-file-s-contents-back-to-t.patch - rsync-hardening-0226-rrsync-refuse-a-peer-selected-debug.patch - rsync-hardening-0227-exclude-give-the-e-self-exclude-rule-its-merge-rule-.patch - rsync-hardening-0228-rsync-add-confine-root-bounding-operator-path-resolu.patch - rsync-hardening-0229-rrsync-confine-the-server-s-path-resolution-to-the-r.patch - rsync-hardening-0230-generator-fall-back-to-a-copy-when-the-destination-c.patch - rsync-hardening-0231-simd-stop-the-AVX2-rolling-checksum-reading-past-its.patch - rsync-hardening-0232-testsuite-run-the-SIMD-checksums-against-an-unreadab.patch - rsync-hardening-0233-socket-don-t-let-socketpair_tcp-hang-in-accept.patch - rsync-hardening-0234-socket-don-t-let-open_socket_out-hang-in-connect.patch - rsync-hardening-0235-configure-avoid-runtime-IPv6-availability-probe.patch - rsync-hardening-0236-options-fix-safe_arg-uninitialized-byte-leak-in-file.patch - rsync-hardening-0237-testsuite-declare-the-newer-suite-tests-this-branch-.patch - Patches not applied/required for openSUSE (left for reference, they are NOT missing neither it was a mistake not to include them): - rsync-hardening-0160-github-gate-PR-CI-on-a-run-ci-label-to-save-CI-minut - rsync-hardening-0238-ci-overlay-the-stable-testsuite-instead-of-running-i - rsync-hardening-0239-testsuite-fix-the-two-macOS-cells-the-3.5.0-fleet-ru ------------------------------------------------------------------ ------------------ 2026-8-1 - Aug 1 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - accel/qaic: use sizeof(*trans_hdr) for transaction length check (git-fixes). - drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs (git-fixes). - drm/vc4: Zero the tile state data array before each BIN job (git-fixes). - drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size (git-fixes). - drm/vmwgfx: validate external BO copy bounds for both stride paths (git-fixes). - drm/vmwgfx: use check_add_overflow for shader size+offset bound (git-fixes). - drm/vmwgfx: bound DMA command body size against suffix pointer (git-fixes). - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (git-fixes). - drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (git-fixes). - drm/vmwgfx: reject DX_BIND_QUERY without a DX context (git-fixes). - drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size (git-fixes). - drm/amd/display: use proper context for logging (git-fixes). - drm/amdkfd: hold event_mutex while checkpointing CRIU events (git-fixes). - drm/mediatek: ovl_adaptor: balance component registrations (git-fixes). - hwmon: (npcm750-pwm-fan): stop fan timer on device detach (git-fixes). - hwmon: (pmbus) Fix return value from pmbus_update_byte_data() (git-fixes). - hwmon: (adt7470) Fix PWM auto temp state array and bounds check (git-fixes). - hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read (git-fixes). - hwmon: (adt7470) Use cached PWM frequency value (git-fixes). - hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks (git-fixes). - hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() (git-fixes). - hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread (git-fixes). - hwmon: (adt7470) Fix cache updated before hardware write on I2C error (git-fixes). - hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors (git-fixes). - hwmon: (nct6775-core) Prevent access to unsupported weight registers (git-fixes). - hwmon: (lm90) Only report alarms if driver is ready (git-fixes). - hwmon: (pmbus/core) notify on the hwmon device, not the i2c client (git-fixes). - ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes). - ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes). - ASoC: tas2562: fix broken entries in the volume lookup table (git-fixes). - ASoC: tas2562: fix DVC coefficient write order (git-fixes). - ALSA: usb-audio: Clamp frame size in implicit-feedback mode (git-fixes). - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set (git-fixes). - ALSA: pcm: wake linked drain waiters on unlink (git-fixes). - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() (git-fixes). - ALSA: ump: fix double free of out_cvts on rawmidi error (git-fixes). - ALSA: usb-audio: fix use-after-free in ump_to_endpoint() (git-fixes). - ALSA: lx6464es: fix period byte count for 16-bit streams (git-fixes). - commit b50416b ++++ kernel-rt: - accel/qaic: use sizeof(*trans_hdr) for transaction length check (git-fixes). - drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs (git-fixes). - drm/vc4: Zero the tile state data array before each BIN job (git-fixes). - drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size (git-fixes). - drm/vmwgfx: validate external BO copy bounds for both stride paths (git-fixes). - drm/vmwgfx: use check_add_overflow for shader size+offset bound (git-fixes). - drm/vmwgfx: bound DMA command body size against suffix pointer (git-fixes). - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (git-fixes). - drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (git-fixes). - drm/vmwgfx: reject DX_BIND_QUERY without a DX context (git-fixes). - drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size (git-fixes). - drm/amd/display: use proper context for logging (git-fixes). - drm/amdkfd: hold event_mutex while checkpointing CRIU events (git-fixes). - drm/mediatek: ovl_adaptor: balance component registrations (git-fixes). - hwmon: (npcm750-pwm-fan): stop fan timer on device detach (git-fixes). - hwmon: (pmbus) Fix return value from pmbus_update_byte_data() (git-fixes). - hwmon: (adt7470) Fix PWM auto temp state array and bounds check (git-fixes). - hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read (git-fixes). - hwmon: (adt7470) Use cached PWM frequency value (git-fixes). - hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks (git-fixes). - hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() (git-fixes). - hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread (git-fixes). - hwmon: (adt7470) Fix cache updated before hardware write on I2C error (git-fixes). - hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors (git-fixes). - hwmon: (nct6775-core) Prevent access to unsupported weight registers (git-fixes). - hwmon: (lm90) Only report alarms if driver is ready (git-fixes). - hwmon: (pmbus/core) notify on the hwmon device, not the i2c client (git-fixes). - ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes). - ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes). - ASoC: tas2562: fix broken entries in the volume lookup table (git-fixes). - ASoC: tas2562: fix DVC coefficient write order (git-fixes). - ALSA: usb-audio: Clamp frame size in implicit-feedback mode (git-fixes). - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set (git-fixes). - ALSA: pcm: wake linked drain waiters on unlink (git-fixes). - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() (git-fixes). - ALSA: ump: fix double free of out_cvts on rawmidi error (git-fixes). - ALSA: usb-audio: fix use-after-free in ump_to_endpoint() (git-fixes). - ALSA: lx6464es: fix period byte count for 16-bit streams (git-fixes). - commit b50416b ++++ kernel-rt_debug: - accel/qaic: use sizeof(*trans_hdr) for transaction length check (git-fixes). - drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs (git-fixes). - drm/vc4: Zero the tile state data array before each BIN job (git-fixes). - drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size (git-fixes). - drm/vmwgfx: validate external BO copy bounds for both stride paths (git-fixes). - drm/vmwgfx: use check_add_overflow for shader size+offset bound (git-fixes). - drm/vmwgfx: bound DMA command body size against suffix pointer (git-fixes). - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (git-fixes). - drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (git-fixes). - drm/vmwgfx: reject DX_BIND_QUERY without a DX context (git-fixes). - drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size (git-fixes). - drm/amd/display: use proper context for logging (git-fixes). - drm/amdkfd: hold event_mutex while checkpointing CRIU events (git-fixes). - drm/mediatek: ovl_adaptor: balance component registrations (git-fixes). - hwmon: (npcm750-pwm-fan): stop fan timer on device detach (git-fixes). - hwmon: (pmbus) Fix return value from pmbus_update_byte_data() (git-fixes). - hwmon: (adt7470) Fix PWM auto temp state array and bounds check (git-fixes). - hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read (git-fixes). - hwmon: (adt7470) Use cached PWM frequency value (git-fixes). - hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks (git-fixes). - hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() (git-fixes). - hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread (git-fixes). - hwmon: (adt7470) Fix cache updated before hardware write on I2C error (git-fixes). - hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors (git-fixes). - hwmon: (nct6775-core) Prevent access to unsupported weight registers (git-fixes). - hwmon: (lm90) Only report alarms if driver is ready (git-fixes). - hwmon: (pmbus/core) notify on the hwmon device, not the i2c client (git-fixes). - ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes). - ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes). - ASoC: tas2562: fix broken entries in the volume lookup table (git-fixes). - ASoC: tas2562: fix DVC coefficient write order (git-fixes). - ALSA: usb-audio: Clamp frame size in implicit-feedback mode (git-fixes). - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set (git-fixes). - ALSA: pcm: wake linked drain waiters on unlink (git-fixes). - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() (git-fixes). - ALSA: ump: fix double free of out_cvts on rawmidi error (git-fixes). - ALSA: usb-audio: fix use-after-free in ump_to_endpoint() (git-fixes). - ALSA: lx6464es: fix period byte count for 16-bit streams (git-fixes). - commit b50416b ------------------------------------------------------------------ ------------------ 2026-7-31 - Jul 31 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - 9p: avoid putting oldfid in p9_client_walk() error path (CVE-2026-63795 bsc#1271955). - commit 0d07395 - blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802 bsc#1272282). - commit b4cb54a - nvme-pci: ensure we're polling a polled queue (CVE-2026-31523 bsc#1263017). - commit af7d257 - btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (CVE-2026-43308 bsc#1264712) - commit 9ba82e0 - KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots (git-fixes). - commit 88c4994 - netfilter: nf_conncount: increase the connection clean up limit to 64 (CVE-2026-45860 bsc#1266710). - commit 8ee7b2b - drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884 bsc#1272573). - commit 3a042ec - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (CVE-2026-63893 bsc#1272607). - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975 bsc#1272694). - commit f1e20f8 - power: supply: bq25890: fix the -10 C NTC lookup entry (git-fixes). - can: ems_usb: validate CPC message lengths (git-fixes). - can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure (git-fixes). - can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured (git-fixes). - can: softing: fw_parse(): validate firmware record spans (git-fixes). - can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents (git-fixes). - can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() (git-fixes). - can: peak_usb: validate uCAN receive record lengths (git-fixes). - can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error (git-fixes). - can: peak_usb: add bounds check for USB channel index (git-fixes). - can: ctucanfd: add missing MODULE_DEVICE_TABLE() (git-fixes). - can: ctucanfd: use self-test mode for PRESUME_ACK (git-fixes). - can: ctucanfd: handle bus error interrupts (git-fixes). - can: ctucanfd: mark error-active controller status valid (git-fixes). - can: ctucanfd: unmap BAR0 using base address (git-fixes). - can: isotp: check register_netdevice_notifier() error in module init (git-fixes). - can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer (git-fixes). - wifi: mac80211: validate individual TWT params before driver setup (git-fixes). - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (git-fixes). - Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks (git-fixes). - Bluetooth: btintel: Validate length before parsing diagnostics TLV (git-fixes). - Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos (git-fixes). - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (git-fixes). - Bluetooth: HIDP: validate numbered report payloads (git-fixes). - Bluetooth: HIDP: reject frames without a transaction header (git-fixes). - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (git-fixes). - Bluetooth: mgmt: Translate HCI reason in Device Disconnected event (git-fixes). - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (git-fixes). - Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync (git-fixes). - Bluetooth: qca: fix NVM tag length underflow in TLV parser (git-fixes). - commit 5b7a042 ++++ kernel-rt: - 9p: avoid putting oldfid in p9_client_walk() error path (CVE-2026-63795 bsc#1271955). - commit 0d07395 - blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802 bsc#1272282). - commit b4cb54a - nvme-pci: ensure we're polling a polled queue (CVE-2026-31523 bsc#1263017). - commit af7d257 - btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (CVE-2026-43308 bsc#1264712) - commit 9ba82e0 - KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots (git-fixes). - commit 88c4994 - netfilter: nf_conncount: increase the connection clean up limit to 64 (CVE-2026-45860 bsc#1266710). - commit 8ee7b2b - drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884 bsc#1272573). - commit 3a042ec - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (CVE-2026-63893 bsc#1272607). - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975 bsc#1272694). - commit f1e20f8 - power: supply: bq25890: fix the -10 C NTC lookup entry (git-fixes). - can: ems_usb: validate CPC message lengths (git-fixes). - can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure (git-fixes). - can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured (git-fixes). - can: softing: fw_parse(): validate firmware record spans (git-fixes). - can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents (git-fixes). - can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() (git-fixes). - can: peak_usb: validate uCAN receive record lengths (git-fixes). - can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error (git-fixes). - can: peak_usb: add bounds check for USB channel index (git-fixes). - can: ctucanfd: add missing MODULE_DEVICE_TABLE() (git-fixes). - can: ctucanfd: use self-test mode for PRESUME_ACK (git-fixes). - can: ctucanfd: handle bus error interrupts (git-fixes). - can: ctucanfd: mark error-active controller status valid (git-fixes). - can: ctucanfd: unmap BAR0 using base address (git-fixes). - can: isotp: check register_netdevice_notifier() error in module init (git-fixes). - can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer (git-fixes). - wifi: mac80211: validate individual TWT params before driver setup (git-fixes). - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (git-fixes). - Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks (git-fixes). - Bluetooth: btintel: Validate length before parsing diagnostics TLV (git-fixes). - Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos (git-fixes). - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (git-fixes). - Bluetooth: HIDP: validate numbered report payloads (git-fixes). - Bluetooth: HIDP: reject frames without a transaction header (git-fixes). - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (git-fixes). - Bluetooth: mgmt: Translate HCI reason in Device Disconnected event (git-fixes). - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (git-fixes). - Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync (git-fixes). - Bluetooth: qca: fix NVM tag length underflow in TLV parser (git-fixes). - commit 5b7a042 ++++ kernel-rt_debug: - 9p: avoid putting oldfid in p9_client_walk() error path (CVE-2026-63795 bsc#1271955). - commit 0d07395 - blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802 bsc#1272282). - commit b4cb54a - nvme-pci: ensure we're polling a polled queue (CVE-2026-31523 bsc#1263017). - commit af7d257 - btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (CVE-2026-43308 bsc#1264712) - commit 9ba82e0 - KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots (git-fixes). - commit 88c4994 - netfilter: nf_conncount: increase the connection clean up limit to 64 (CVE-2026-45860 bsc#1266710). - commit 8ee7b2b - drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884 bsc#1272573). - commit 3a042ec - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (CVE-2026-63893 bsc#1272607). - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975 bsc#1272694). - commit f1e20f8 - power: supply: bq25890: fix the -10 C NTC lookup entry (git-fixes). - can: ems_usb: validate CPC message lengths (git-fixes). - can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure (git-fixes). - can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured (git-fixes). - can: softing: fw_parse(): validate firmware record spans (git-fixes). - can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents (git-fixes). - can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() (git-fixes). - can: peak_usb: validate uCAN receive record lengths (git-fixes). - can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error (git-fixes). - can: peak_usb: add bounds check for USB channel index (git-fixes). - can: ctucanfd: add missing MODULE_DEVICE_TABLE() (git-fixes). - can: ctucanfd: use self-test mode for PRESUME_ACK (git-fixes). - can: ctucanfd: handle bus error interrupts (git-fixes). - can: ctucanfd: mark error-active controller status valid (git-fixes). - can: ctucanfd: unmap BAR0 using base address (git-fixes). - can: isotp: check register_netdevice_notifier() error in module init (git-fixes). - can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer (git-fixes). - wifi: mac80211: validate individual TWT params before driver setup (git-fixes). - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (git-fixes). - Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks (git-fixes). - Bluetooth: btintel: Validate length before parsing diagnostics TLV (git-fixes). - Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos (git-fixes). - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (git-fixes). - Bluetooth: HIDP: validate numbered report payloads (git-fixes). - Bluetooth: HIDP: reject frames without a transaction header (git-fixes). - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (git-fixes). - Bluetooth: mgmt: Translate HCI reason in Device Disconnected event (git-fixes). - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (git-fixes). - Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync (git-fixes). - Bluetooth: qca: fix NVM tag length underflow in TLV parser (git-fixes). - commit 5b7a042 ++++ python311-core: - CVE-2026-3276: Fix O(n^2) canonical ordering in unicodedata.normalize() (bsc#1267581, gh#python/cpython#149079) CVE-2026-3276-On2-unicodedata-normalize.patch - CVE-2026-7774: tarfile.data_filter: validate written link target (bsc#1267821, gh#149486) CVE-2026-7774-tarfile-data_filter-symlink.patch - CVE-2026-0864: Normalize all line endings (CR, CRLF, and LF) in configparser (bsc#1269066, gh#python/cpython#143927) CVE-2026-0864-normalize-LFTAB-configparser.patch - CVE-2026-11972: Make tarfile._Stream.seek break at EOF (bsc#1269788, gh#python/cpython#151981) CVE-2026-11972-tarfile-Stream-seek-EOF.patch - CVE-2026-4360: Pass filter_function to TarFile._extract_one() during .extract() (bsc#1269959, gh#python/cpython#151987) CVE-2026-4360-filter_function-TarFile-extractone.patch - CVE-2026-15308: Fix quadratic complexity in incremental parsing in HTMLParser (bsc#1271192, gh#python/cpython#153030) CVE-2026-15308-HTMLParser-CPU-exhaust.patch ++++ python311: - CVE-2026-3276: Fix O(n^2) canonical ordering in unicodedata.normalize() (bsc#1267581, gh#python/cpython#149079) CVE-2026-3276-On2-unicodedata-normalize.patch - CVE-2026-7774: tarfile.data_filter: validate written link target (bsc#1267821, gh#149486) CVE-2026-7774-tarfile-data_filter-symlink.patch - CVE-2026-0864: Normalize all line endings (CR, CRLF, and LF) in configparser (bsc#1269066, gh#python/cpython#143927) CVE-2026-0864-normalize-LFTAB-configparser.patch - CVE-2026-11972: Make tarfile._Stream.seek break at EOF (bsc#1269788, gh#python/cpython#151981) CVE-2026-11972-tarfile-Stream-seek-EOF.patch - CVE-2026-4360: Pass filter_function to TarFile._extract_one() during .extract() (bsc#1269959, gh#python/cpython#151987) CVE-2026-4360-filter_function-TarFile-extractone.patch - CVE-2026-15308: Fix quadratic complexity in incremental parsing in HTMLParser (bsc#1271192, gh#python/cpython#153030) CVE-2026-15308-HTMLParser-CPU-exhaust.patch ------------------------------------------------------------------ ------------------ 2026-7-30 - Jul 30 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - Update patches.suse/Bluetooth-6lowpan-check-skb_clone-return-value-in-se.patch (git-fixes CVE-2026-63991 bsc#1272973). - Update patches.suse/Bluetooth-HIDP-fix-missing-length-checks-in-hidp_inp.patch (git-fixes CVE-2026-63947 bsc#1272668). - Update patches.suse/Bluetooth-ISO-fix-UAF-in-iso_recv_frame.patch (git-fixes CVE-2026-63946 bsc#1272665). - Update patches.suse/Bluetooth-ISO-serialize-iso_sock_clear_timer-with-so.patch (git-fixes CVE-2026-63945 bsc#1272664). - Update patches.suse/Bluetooth-L2CAP-Fix-possible-crash-on-l2cap_ecred_co.patch (git-fixes CVE-2026-63975 bsc#1272694). - Update patches.suse/Bluetooth-L2CAP-fix-chan-ref-leak-in-l2cap_chan_time.patch (git-fixes CVE-2026-63948 bsc#1272670). - Update patches.suse/Bluetooth-MGMT-fix-crash-in-set_mesh_sync-and-set_me.patch (CVE-2026-43059 bsc#1264184 CVE-2025-40213 bsc#1253674). - Update patches.suse/Bluetooth-hci_sync-Set-HCI_CMD_DRAIN_WORKQUEUE-durin.patch (git-fixes CVE-2026-63974 bsc#1272686). - Update patches.suse/Bluetooth-l2cap-clear-chan-ident-on-ECRED-reconfigur.patch (git-fixes CVE-2026-63976 bsc#1272706). - Update patches.suse/HID-wacom-Fix-OOB-write-in-wacom_hid_set_device_mode.patch (git-fixes CVE-2026-63916 bsc#1272903). - Update patches.suse/Input-atmel_mxt_ts-fix-boundary-check-in-mxt_prepare.patch (git-fixes CVE-2026-63908 bsc#1272690). - Update patches.suse/Input-xpad-fix-out-of-bounds-access-for-Share-button.patch (git-fixes CVE-2026-63943 bsc#1273044). - Update patches.suse/KVM-SEV-Ignore-Port-I-O-requests-of-length-0.patch (git-fixes CVE-2026-63940 bsc#1272781). - Update patches.suse/KVM-arm64-vgic-its-Reject-restored-DTE-with-out-of-r.patch (git-fixes CVE-2026-64106 bsc#1272242). - Update patches.suse/KVM-x86-mmu-Ensure-hugepage-is-in-by-slot-before-che.patch (git-fixes CVE-2026-63807 bsc#1272263). - Update patches.suse/KVM-x86-xen-Fix-cleanup-logic-in-emulation-of-Xen-sc.patch (git-fixes CVE-2025-38469 bsc#1247455). - Update patches.suse/PCI-mediatek-gen3-Prevent-leaking-IRQ-domains-when-I.patch (git-fixes CVE-2026-63862 bsc#1271813). - Update patches.suse/USB-serial-belkin_sa-validate-interrupt-status-lengt.patch (git-fixes CVE-2026-63903 bsc#1272522). - Update patches.suse/USB-serial-cypress_m8-validate-interrupt-packet-head.patch (git-fixes CVE-2026-63902 bsc#1272517). - Update patches.suse/USB-serial-keyspan-fix-missing-indat-transfer-sanity.patch (git-fixes CVE-2026-63900 bsc#1272499). - Update patches.suse/USB-serial-keyspan_pda-fix-information-leak.patch (git-fixes CVE-2026-64336 bsc#1272685). - Update patches.suse/USB-serial-mct_u232-fix-missing-interrupt-in-transfe.patch (git-fixes CVE-2026-63897 bsc#1272642). - Update patches.suse/USB-serial-mxuport-fix-memory-corruption-with-small-.patch (git-fixes CVE-2026-63899 bsc#1272494). - Update patches.suse/USB-serial-omninet-fix-memory-corruption-with-small-.patch (git-fixes CVE-2026-63928 bsc#1272891). - Update patches.suse/USB-serial-safe_serial-fix-memory-corruption-with-sm.patch (git-fixes CVE-2026-63957 bsc#1272472). - Update patches.suse/auxdisplay-line-display-fix-OOB-read-on-zero-length-.patch (git-fixes CVE-2026-63949 bsc#1272671). - Update patches.suse/batman-adv-tp_meter-avoid-divide-by-zero-for-dec_cwn.patch (git-fixes CVE-2026-63836 bsc#1272246). - Update patches.suse/batman-adv-tt-fix-negative-last_changeset_len.patch (git-fixes CVE-2026-64089 bsc#1272513). - Update patches.suse/device-property-set-fwnode-secondary-to-NULL-in-fwno.patch (git-fixes CVE-2026-64220 bsc#1272785). - Update patches.suse/dm-cache-policy-smq-check-allocation-under-invalidate-lock.patch (git-fixes CVE-2026-53265 bsc#1269734). - Update patches.suse/drivers-base-memory-fix-memory-block-reference-leak-.patch (git-fixes CVE-2026-64182 bsc#1272194). - Update patches.suse/drm-amdgpu-jpeg-set-no_user_fence-for-JPEG-v2.0-ring.patch (git-fixes CVE-2026-63848 bsc#1272380). - Update patches.suse/drm-amdgpu-jpeg-set-no_user_fence-for-JPEG-v2.5-ring.patch (git-fixes CVE-2026-63847 bsc#1272374). - Update patches.suse/drm-amdgpu-jpeg-set-no_user_fence-for-JPEG-v3.0-ring.patch (git-fixes CVE-2026-63846 bsc#1272373). - Update patches.suse/drm-amdgpu-jpeg-set-no_user_fence-for-JPEG-v4.0-ring.patch (git-fixes CVE-2026-63845 bsc#1272360). - Update patches.suse/drm-amdgpu-jpeg-set-no_user_fence-for-JPEG-v4.0.3-ri.patch (git-fixes CVE-2026-63844 bsc#1272362). - Update patches.suse/drm-amdgpu-jpeg-set-no_user_fence-for-JPEG-v4.0.5-ri.patch (git-fixes CVE-2026-63843 bsc#1272361). - Update patches.suse/drm-amdgpu-vcn-set-no_user_fence-for-VCN-v2.0-enc-de.patch (git-fixes CVE-2026-63856 bsc#1272492). - Update patches.suse/drm-amdgpu-vcn-set-no_user_fence-for-VCN-v2.5-enc-de.patch (git-fixes CVE-2026-63855 bsc#1272489). - Update patches.suse/drm-amdgpu-vcn-set-no_user_fence-for-VCN-v3.0-enc-de.patch (git-fixes CVE-2026-63854 bsc#1272406). - Update patches.suse/drm-amdgpu-vcn-set-no_user_fence-for-VCN-v4.0-enc-ri.patch (git-fixes CVE-2026-63853 bsc#1272389). - Update patches.suse/drm-amdgpu-vcn-set-no_user_fence-for-VCN-v4.0.3-enc-.patch (git-fixes CVE-2026-63852 bsc#1272387). - Update patches.suse/drm-amdgpu-vcn-set-no_user_fence-for-VCN-v4.0.5-enc-.patch (git-fixes CVE-2026-63851 bsc#1272384). - Update patches.suse/drm-amdgpu-zero-initialize-GART-table-on-allocation.patch (stable-fixes CVE-2026-53374 bsc#1271827). - Update patches.suse/drm-amdkfd-Add-upper-bound-check-for-num_of_nodes.patch (stable-fixes CVE-2026-53376 bsc#1271831). - Update patches.suse/drm-amdkfd-fix-NULL-pointer-bug-in-svm_range_set_att.patch (stable-fixes CVE-2026-63882 bsc#1271937). - Update patches.suse/drm-i915-Fix-potential-UAF-in-TTM-object-purge.patch (git-fixes CVE-2026-63884 bsc#1272573). - Update patches.suse/drm-msm-dsi-don-t-dump-registers-past-the-mapped-reg.patch (git-fixes CVE-2026-64231 bsc#1272787). - Update patches.suse/drm-radeon-delete-radeon_fence_process-in-is_signale.patch (stable-fixes CVE-2025-68223 bsc#1255357). - Update patches.suse/efi-Allocate-runtime-workqueue-before-ACPI-init.patch (git-fixes CVE-2026-64183 bsc#1272197). - Update patches.suse/fbdev-Fix-fb_new_modelist-to-prevent-null-ptr-deref-.patch (stable-fixes CVE-2026-53403 bsc#1271731). - Update patches.suse/fbdev-fix-use-after-free-in-store_modes.patch (stable-fixes CVE-2026-63826 bsc#1272183). - Update patches.suse/i2c-stub-Reject-I2C-block-transfers-with-invalid-len.patch (git-fixes CVE-2026-64191 bsc#1272211). - Update patches.suse/i3c-mipi-i3c-hci-Correct-RING_CTRL_ABORT-handling-in.patch (git-fixes CVE-2026-43352 bsc#1264793). - Update patches.suse/iio-buffer-hw-consumer-fix-use-after-free-in-error-p.patch (git-fixes CVE-2026-63930 bsc#1272850). - Update patches.suse/iio-chemical-scd30-fix-division-by-zero-in-write_raw.patch (git-fixes CVE-2026-63931 bsc#1272853). - Update patches.suse/iio-gyro-itg3200-fix-i2c-read-into-the-wrong-stack-l.patch (git-fixes CVE-2026-63934 bsc#1272863). - Update patches.suse/iio-imu-st_lsm6dsx-fix-stack-leak-in-tagged-FIFO-buf.patch (git-fixes CVE-2026-63967 bsc#1272470). - Update patches.suse/media-i2c-ov8856-free-control-handler-on-error-in-ov.patch (git-fixes CVE-2026-53379 bsc#1271833). - Update patches.suse/media-vidtv-fix-NULL-pointer-dereference-in-vidtv_mu.patch (git-fixes CVE-2026-53382 bsc#1271717). - Update patches.suse/mtd-spi-nor-sst-Fix-SST-write-failure.patch (git-fixes CVE-2025-21845 bsc#1239511). - Update patches.suse/net-wwan-iosm-fix-potential-memory-leaks-in-ipc_imem.patch (git-fixes CVE-2026-64179 bsc#1272149). - Update patches.suse/nfc-hci-fix-out-of-bounds-read-in-HCP-header-parsing.patch (git-fixes CVE-2026-63915 bsc#1272897). - Update patches.suse/parport-Fix-race-between-port-and-client-registratio.patch (git-fixes CVE-2026-63942 bsc#1273023). - Update patches.suse/slimbus-qcom-ngd-ctrl-Avoid-ABBA-on-tx_lock-ctrl-loc.patch (git-fixes CVE-2026-53331 bsc#1270113). - Update patches.suse/slimbus-qcom-ngd-ctrl-Register-callbacks-after-creat.patch (git-fixes CVE-2026-53332 bsc#1270102). - Update patches.suse/spi-mtk-snfi-unregister-ECC-engine-on-probe-failure-.patch (git-fixes CVE-2026-63861 bsc#1272434). - Update patches.suse/spi-ti-qspi-fix-use-after-free-after-DMA-setup-failu.patch (git-fixes CVE-2026-64221 bsc#1272797). - Update patches.suse/thunderbolt-property-Reject-dir_len-4-to-prevent-siz.patch (git-fixes CVE-2026-63892 bsc#1272591). - Update patches.suse/thunderbolt-property-Reject-u32-wrap-in-tb_property_.patch (git-fixes CVE-2026-63893 bsc#1272607). - Update patches.suse/tty-serial-pch_uart-add-check-for-dma_alloc_coherent.patch (git-fixes CVE-2026-64234 bsc#1272646). - Update patches.suse/usb-dwc2-Fix-use-after-free-in-debug-code.patch (git-fixes CVE-2026-63927 bsc#1272892). - Update patches.suse/usb-gadget-composite-fix-dead-empty-check-in-the-USB.patch (git-fixes CVE-2026-64347 bsc#1272807). - Update patches.suse/usb-gadget-composite-fix-integer-underflow-in-WebUSB.patch (git-fixes CVE-2026-63896 bsc#1272617). - Update patches.suse/usb-gadget-f_fs-copy-only-received-bytes-on-short-ep.patch (git-fixes CVE-2026-63895 bsc#1272614). - Update patches.suse/usb-gadget-f_printer-take-kref-only-for-successful-o.patch (git-fixes CVE-2026-64345 bsc#1272689). - Update patches.suse/usb-gadget-net2280-Fix-double-free-in-probe-error-pa.patch (git-fixes CVE-2026-64242 bsc#1272659). - Update patches.suse/usb-typec-altmodes-displayport-validate-count-before.patch (stable-fixes CVE-2026-63961 bsc#1272480). - Update patches.suse/usb-typec-tcpm-Validate-SVID-index-in-svdm_consume_m.patch (git-fixes CVE-2026-64330 bsc#1272681). - Update patches.suse/usb-typec-tcpm-tcpci_maxim-validate-header-NDO-again.patch (stable-fixes CVE-2026-63959 bsc#1272474). - Update patches.suse/usb-typec-ucsi-ccg-reject-firmware-images-without-a-.patch (stable-fixes CVE-2026-63964 bsc#1272483). - Update patches.suse/usb-typec-ucsi-validate-connector-number-in-ucsi_con.patch (stable-fixes CVE-2026-63958 bsc#1272467). - Update patches.suse/usb-typec-wcove-don-t-write-past-struct-pd_message-i.patch (stable-fixes CVE-2026-63960 bsc#1272478). - Update patches.suse/usb-usbtmc-check-URB-actual_length-for-interrupt-IN-.patch (git-fixes CVE-2026-63904 bsc#1272523). - Update patches.suse/usb-xhci-Fix-sleep-in-atomic-context-in-xhci_free_st.patch (git-fixes CVE-2026-64465 bsc#1272843). - Update patches.suse/usbip-vudc-Fix-use-after-free-bug-in-vudc_remove-due.patch (git-fixes CVE-2026-63905 bsc#1272578). - Update patches.suse/vc_screen-fix-null-ptr-deref-in-vcs_notifier-during-.patch (git-fixes CVE-2026-53385 bsc#1271834). - Update patches.suse/wifi-ath11k-fix-warning-when-unbinding.patch (git-fixes CVE-2026-63822 bsc#1272187). - Update patches.suse/wifi-cfg80211-advance-loop-vars-in-cfg80211_merge_pr.patch (git-fixes CVE-2026-64174 bsc#1272146). - Update patches.suse/wifi-mac80211-consume-only-present-negotiated-TTLM-m.patch (git-fixes CVE-2026-64223 bsc#1272800). - Update patches.suse/wifi-mac80211-limit-injected-antenna-index-in-ieee80.patch (git-fixes CVE-2026-63869 bsc#1272500). - Update patches.suse/wifi-rtw88-usb-fix-memory-leaks-on-USB-write-failure.patch (git-fixes CVE-2026-63821 bsc#1271967). - commit 1e756ae - mm/huge_memory: update file PMD counter before folio_put() (CVE-2026-53189 bsc#1269797). - commit e154937 - wifi: iwlwifi: fix 22000 series SMEM parsing (CVE-2026-43172 bsc#1264543) - commit fc0867f - bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (CVE-2026-43016 bsc#1264007) - commit 374a18a - udf: reject descriptors with oversized CRC length (bsc#1271818 CVE-2026-53369). - commit 3dbc237 - net: Drop the lock in skb_may_tx_timestamp() (CVE-2026-43216 bsc#1264319). - commit 9206404 - net/rds: Clear reconnect pending bit (CVE-2026-43230 bsc#1264539). - commit 411b319 - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114 bsc#1264601). - commit 7913fcb - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (CVE-2026-64106 bsc#1272242). - commit a07d6c6 ++++ kernel-rt: - Update patches.suse/Bluetooth-6lowpan-check-skb_clone-return-value-in-se.patch (git-fixes CVE-2026-63991 bsc#1272973). - Update patches.suse/Bluetooth-HIDP-fix-missing-length-checks-in-hidp_inp.patch (git-fixes CVE-2026-63947 bsc#1272668). - Update patches.suse/Bluetooth-ISO-fix-UAF-in-iso_recv_frame.patch (git-fixes CVE-2026-63946 bsc#1272665). - Update patches.suse/Bluetooth-ISO-serialize-iso_sock_clear_timer-with-so.patch (git-fixes CVE-2026-63945 bsc#1272664). - Update patches.suse/Bluetooth-L2CAP-Fix-possible-crash-on-l2cap_ecred_co.patch (git-fixes CVE-2026-63975 bsc#1272694). - Update patches.suse/Bluetooth-L2CAP-fix-chan-ref-leak-in-l2cap_chan_time.patch (git-fixes CVE-2026-63948 bsc#1272670). - Update patches.suse/Bluetooth-MGMT-fix-crash-in-set_mesh_sync-and-set_me.patch (CVE-2026-43059 bsc#1264184 CVE-2025-40213 bsc#1253674). - Update patches.suse/Bluetooth-hci_sync-Set-HCI_CMD_DRAIN_WORKQUEUE-durin.patch (git-fixes CVE-2026-63974 bsc#1272686). - Update patches.suse/Bluetooth-l2cap-clear-chan-ident-on-ECRED-reconfigur.patch (git-fixes CVE-2026-63976 bsc#1272706). - Update patches.suse/HID-wacom-Fix-OOB-write-in-wacom_hid_set_device_mode.patch (git-fixes CVE-2026-63916 bsc#1272903). - Update patches.suse/Input-atmel_mxt_ts-fix-boundary-check-in-mxt_prepare.patch (git-fixes CVE-2026-63908 bsc#1272690). - Update patches.suse/Input-xpad-fix-out-of-bounds-access-for-Share-button.patch (git-fixes CVE-2026-63943 bsc#1273044). - Update patches.suse/KVM-SEV-Ignore-Port-I-O-requests-of-length-0.patch (git-fixes CVE-2026-63940 bsc#1272781). - Update patches.suse/KVM-arm64-vgic-its-Reject-restored-DTE-with-out-of-r.patch (git-fixes CVE-2026-64106 bsc#1272242). - Update patches.suse/KVM-x86-mmu-Ensure-hugepage-is-in-by-slot-before-che.patch (git-fixes CVE-2026-63807 bsc#1272263). - Update patches.suse/KVM-x86-xen-Fix-cleanup-logic-in-emulation-of-Xen-sc.patch (git-fixes CVE-2025-38469 bsc#1247455). - Update patches.suse/PCI-mediatek-gen3-Prevent-leaking-IRQ-domains-when-I.patch (git-fixes CVE-2026-63862 bsc#1271813). - Update patches.suse/USB-serial-belkin_sa-validate-interrupt-status-lengt.patch (git-fixes CVE-2026-63903 bsc#1272522). - Update patches.suse/USB-serial-cypress_m8-validate-interrupt-packet-head.patch (git-fixes CVE-2026-63902 bsc#1272517). - Update patches.suse/USB-serial-keyspan-fix-missing-indat-transfer-sanity.patch (git-fixes CVE-2026-63900 bsc#1272499). - Update patches.suse/USB-serial-keyspan_pda-fix-information-leak.patch (git-fixes CVE-2026-64336 bsc#1272685). - Update patches.suse/USB-serial-mct_u232-fix-missing-interrupt-in-transfe.patch (git-fixes CVE-2026-63897 bsc#1272642). - Update patches.suse/USB-serial-mxuport-fix-memory-corruption-with-small-.patch (git-fixes CVE-2026-63899 bsc#1272494). - Update patches.suse/USB-serial-omninet-fix-memory-corruption-with-small-.patch (git-fixes CVE-2026-63928 bsc#1272891). - Update patches.suse/USB-serial-safe_serial-fix-memory-corruption-with-sm.patch (git-fixes CVE-2026-63957 bsc#1272472). - Update patches.suse/auxdisplay-line-display-fix-OOB-read-on-zero-length-.patch (git-fixes CVE-2026-63949 bsc#1272671). - Update patches.suse/batman-adv-tp_meter-avoid-divide-by-zero-for-dec_cwn.patch (git-fixes CVE-2026-63836 bsc#1272246). - Update patches.suse/batman-adv-tt-fix-negative-last_changeset_len.patch (git-fixes CVE-2026-64089 bsc#1272513). - Update patches.suse/device-property-set-fwnode-secondary-to-NULL-in-fwno.patch (git-fixes CVE-2026-64220 bsc#1272785). - Update patches.suse/dm-cache-policy-smq-check-allocation-under-invalidate-lock.patch (git-fixes CVE-2026-53265 bsc#1269734). - Update patches.suse/drivers-base-memory-fix-memory-block-reference-leak-.patch (git-fixes CVE-2026-64182 bsc#1272194). - Update patches.suse/drm-amdgpu-jpeg-set-no_user_fence-for-JPEG-v2.0-ring.patch (git-fixes CVE-2026-63848 bsc#1272380). - Update patches.suse/drm-amdgpu-jpeg-set-no_user_fence-for-JPEG-v2.5-ring.patch (git-fixes CVE-2026-63847 bsc#1272374). - Update patches.suse/drm-amdgpu-jpeg-set-no_user_fence-for-JPEG-v3.0-ring.patch (git-fixes CVE-2026-63846 bsc#1272373). - Update patches.suse/drm-amdgpu-jpeg-set-no_user_fence-for-JPEG-v4.0-ring.patch (git-fixes CVE-2026-63845 bsc#1272360). - Update patches.suse/drm-amdgpu-jpeg-set-no_user_fence-for-JPEG-v4.0.3-ri.patch (git-fixes CVE-2026-63844 bsc#1272362). - Update patches.suse/drm-amdgpu-jpeg-set-no_user_fence-for-JPEG-v4.0.5-ri.patch (git-fixes CVE-2026-63843 bsc#1272361). - Update patches.suse/drm-amdgpu-vcn-set-no_user_fence-for-VCN-v2.0-enc-de.patch (git-fixes CVE-2026-63856 bsc#1272492). - Update patches.suse/drm-amdgpu-vcn-set-no_user_fence-for-VCN-v2.5-enc-de.patch (git-fixes CVE-2026-63855 bsc#1272489). - Update patches.suse/drm-amdgpu-vcn-set-no_user_fence-for-VCN-v3.0-enc-de.patch (git-fixes CVE-2026-63854 bsc#1272406). - Update patches.suse/drm-amdgpu-vcn-set-no_user_fence-for-VCN-v4.0-enc-ri.patch (git-fixes CVE-2026-63853 bsc#1272389). - Update patches.suse/drm-amdgpu-vcn-set-no_user_fence-for-VCN-v4.0.3-enc-.patch (git-fixes CVE-2026-63852 bsc#1272387). - Update patches.suse/drm-amdgpu-vcn-set-no_user_fence-for-VCN-v4.0.5-enc-.patch (git-fixes CVE-2026-63851 bsc#1272384). - Update patches.suse/drm-amdgpu-zero-initialize-GART-table-on-allocation.patch (stable-fixes CVE-2026-53374 bsc#1271827). - Update patches.suse/drm-amdkfd-Add-upper-bound-check-for-num_of_nodes.patch (stable-fixes CVE-2026-53376 bsc#1271831). - Update patches.suse/drm-amdkfd-fix-NULL-pointer-bug-in-svm_range_set_att.patch (stable-fixes CVE-2026-63882 bsc#1271937). - Update patches.suse/drm-i915-Fix-potential-UAF-in-TTM-object-purge.patch (git-fixes CVE-2026-63884 bsc#1272573). - Update patches.suse/drm-msm-dsi-don-t-dump-registers-past-the-mapped-reg.patch (git-fixes CVE-2026-64231 bsc#1272787). - Update patches.suse/drm-radeon-delete-radeon_fence_process-in-is_signale.patch (stable-fixes CVE-2025-68223 bsc#1255357). - Update patches.suse/efi-Allocate-runtime-workqueue-before-ACPI-init.patch (git-fixes CVE-2026-64183 bsc#1272197). - Update patches.suse/fbdev-Fix-fb_new_modelist-to-prevent-null-ptr-deref-.patch (stable-fixes CVE-2026-53403 bsc#1271731). - Update patches.suse/fbdev-fix-use-after-free-in-store_modes.patch (stable-fixes CVE-2026-63826 bsc#1272183). - Update patches.suse/i2c-stub-Reject-I2C-block-transfers-with-invalid-len.patch (git-fixes CVE-2026-64191 bsc#1272211). - Update patches.suse/i3c-mipi-i3c-hci-Correct-RING_CTRL_ABORT-handling-in.patch (git-fixes CVE-2026-43352 bsc#1264793). - Update patches.suse/iio-buffer-hw-consumer-fix-use-after-free-in-error-p.patch (git-fixes CVE-2026-63930 bsc#1272850). - Update patches.suse/iio-chemical-scd30-fix-division-by-zero-in-write_raw.patch (git-fixes CVE-2026-63931 bsc#1272853). - Update patches.suse/iio-gyro-itg3200-fix-i2c-read-into-the-wrong-stack-l.patch (git-fixes CVE-2026-63934 bsc#1272863). - Update patches.suse/iio-imu-st_lsm6dsx-fix-stack-leak-in-tagged-FIFO-buf.patch (git-fixes CVE-2026-63967 bsc#1272470). - Update patches.suse/media-i2c-ov8856-free-control-handler-on-error-in-ov.patch (git-fixes CVE-2026-53379 bsc#1271833). - Update patches.suse/media-vidtv-fix-NULL-pointer-dereference-in-vidtv_mu.patch (git-fixes CVE-2026-53382 bsc#1271717). - Update patches.suse/mtd-spi-nor-sst-Fix-SST-write-failure.patch (git-fixes CVE-2025-21845 bsc#1239511). - Update patches.suse/net-wwan-iosm-fix-potential-memory-leaks-in-ipc_imem.patch (git-fixes CVE-2026-64179 bsc#1272149). - Update patches.suse/nfc-hci-fix-out-of-bounds-read-in-HCP-header-parsing.patch (git-fixes CVE-2026-63915 bsc#1272897). - Update patches.suse/parport-Fix-race-between-port-and-client-registratio.patch (git-fixes CVE-2026-63942 bsc#1273023). - Update patches.suse/slimbus-qcom-ngd-ctrl-Avoid-ABBA-on-tx_lock-ctrl-loc.patch (git-fixes CVE-2026-53331 bsc#1270113). - Update patches.suse/slimbus-qcom-ngd-ctrl-Register-callbacks-after-creat.patch (git-fixes CVE-2026-53332 bsc#1270102). - Update patches.suse/spi-mtk-snfi-unregister-ECC-engine-on-probe-failure-.patch (git-fixes CVE-2026-63861 bsc#1272434). - Update patches.suse/spi-ti-qspi-fix-use-after-free-after-DMA-setup-failu.patch (git-fixes CVE-2026-64221 bsc#1272797). - Update patches.suse/thunderbolt-property-Reject-dir_len-4-to-prevent-siz.patch (git-fixes CVE-2026-63892 bsc#1272591). - Update patches.suse/thunderbolt-property-Reject-u32-wrap-in-tb_property_.patch (git-fixes CVE-2026-63893 bsc#1272607). - Update patches.suse/tty-serial-pch_uart-add-check-for-dma_alloc_coherent.patch (git-fixes CVE-2026-64234 bsc#1272646). - Update patches.suse/usb-dwc2-Fix-use-after-free-in-debug-code.patch (git-fixes CVE-2026-63927 bsc#1272892). - Update patches.suse/usb-gadget-composite-fix-dead-empty-check-in-the-USB.patch (git-fixes CVE-2026-64347 bsc#1272807). - Update patches.suse/usb-gadget-composite-fix-integer-underflow-in-WebUSB.patch (git-fixes CVE-2026-63896 bsc#1272617). - Update patches.suse/usb-gadget-f_fs-copy-only-received-bytes-on-short-ep.patch (git-fixes CVE-2026-63895 bsc#1272614). - Update patches.suse/usb-gadget-f_printer-take-kref-only-for-successful-o.patch (git-fixes CVE-2026-64345 bsc#1272689). - Update patches.suse/usb-gadget-net2280-Fix-double-free-in-probe-error-pa.patch (git-fixes CVE-2026-64242 bsc#1272659). - Update patches.suse/usb-typec-altmodes-displayport-validate-count-before.patch (stable-fixes CVE-2026-63961 bsc#1272480). - Update patches.suse/usb-typec-tcpm-Validate-SVID-index-in-svdm_consume_m.patch (git-fixes CVE-2026-64330 bsc#1272681). - Update patches.suse/usb-typec-tcpm-tcpci_maxim-validate-header-NDO-again.patch (stable-fixes CVE-2026-63959 bsc#1272474). - Update patches.suse/usb-typec-ucsi-ccg-reject-firmware-images-without-a-.patch (stable-fixes CVE-2026-63964 bsc#1272483). - Update patches.suse/usb-typec-ucsi-validate-connector-number-in-ucsi_con.patch (stable-fixes CVE-2026-63958 bsc#1272467). - Update patches.suse/usb-typec-wcove-don-t-write-past-struct-pd_message-i.patch (stable-fixes CVE-2026-63960 bsc#1272478). - Update patches.suse/usb-usbtmc-check-URB-actual_length-for-interrupt-IN-.patch (git-fixes CVE-2026-63904 bsc#1272523). - Update patches.suse/usb-xhci-Fix-sleep-in-atomic-context-in-xhci_free_st.patch (git-fixes CVE-2026-64465 bsc#1272843). - Update patches.suse/usbip-vudc-Fix-use-after-free-bug-in-vudc_remove-due.patch (git-fixes CVE-2026-63905 bsc#1272578). - Update patches.suse/vc_screen-fix-null-ptr-deref-in-vcs_notifier-during-.patch (git-fixes CVE-2026-53385 bsc#1271834). - Update patches.suse/wifi-ath11k-fix-warning-when-unbinding.patch (git-fixes CVE-2026-63822 bsc#1272187). - Update patches.suse/wifi-cfg80211-advance-loop-vars-in-cfg80211_merge_pr.patch (git-fixes CVE-2026-64174 bsc#1272146). - Update patches.suse/wifi-mac80211-consume-only-present-negotiated-TTLM-m.patch (git-fixes CVE-2026-64223 bsc#1272800). - Update patches.suse/wifi-mac80211-limit-injected-antenna-index-in-ieee80.patch (git-fixes CVE-2026-63869 bsc#1272500). - Update patches.suse/wifi-rtw88-usb-fix-memory-leaks-on-USB-write-failure.patch (git-fixes CVE-2026-63821 bsc#1271967). - commit 1e756ae - mm/huge_memory: update file PMD counter before folio_put() (CVE-2026-53189 bsc#1269797). - commit e154937 - wifi: iwlwifi: fix 22000 series SMEM parsing (CVE-2026-43172 bsc#1264543) - commit fc0867f - bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (CVE-2026-43016 bsc#1264007) - commit 374a18a - udf: reject descriptors with oversized CRC length (bsc#1271818 CVE-2026-53369). - commit 3dbc237 - net: Drop the lock in skb_may_tx_timestamp() (CVE-2026-43216 bsc#1264319). - commit 9206404 - net/rds: Clear reconnect pending bit (CVE-2026-43230 bsc#1264539). - commit 411b319 - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114 bsc#1264601). - commit 7913fcb - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (CVE-2026-64106 bsc#1272242). - commit a07d6c6 ++++ kernel-rt_debug: - Update patches.suse/Bluetooth-6lowpan-check-skb_clone-return-value-in-se.patch (git-fixes CVE-2026-63991 bsc#1272973). - Update patches.suse/Bluetooth-HIDP-fix-missing-length-checks-in-hidp_inp.patch (git-fixes CVE-2026-63947 bsc#1272668). - Update patches.suse/Bluetooth-ISO-fix-UAF-in-iso_recv_frame.patch (git-fixes CVE-2026-63946 bsc#1272665). - Update patches.suse/Bluetooth-ISO-serialize-iso_sock_clear_timer-with-so.patch (git-fixes CVE-2026-63945 bsc#1272664). - Update patches.suse/Bluetooth-L2CAP-Fix-possible-crash-on-l2cap_ecred_co.patch (git-fixes CVE-2026-63975 bsc#1272694). - Update patches.suse/Bluetooth-L2CAP-fix-chan-ref-leak-in-l2cap_chan_time.patch (git-fixes CVE-2026-63948 bsc#1272670). - Update patches.suse/Bluetooth-MGMT-fix-crash-in-set_mesh_sync-and-set_me.patch (CVE-2026-43059 bsc#1264184 CVE-2025-40213 bsc#1253674). - Update patches.suse/Bluetooth-hci_sync-Set-HCI_CMD_DRAIN_WORKQUEUE-durin.patch (git-fixes CVE-2026-63974 bsc#1272686). - Update patches.suse/Bluetooth-l2cap-clear-chan-ident-on-ECRED-reconfigur.patch (git-fixes CVE-2026-63976 bsc#1272706). - Update patches.suse/HID-wacom-Fix-OOB-write-in-wacom_hid_set_device_mode.patch (git-fixes CVE-2026-63916 bsc#1272903). - Update patches.suse/Input-atmel_mxt_ts-fix-boundary-check-in-mxt_prepare.patch (git-fixes CVE-2026-63908 bsc#1272690). - Update patches.suse/Input-xpad-fix-out-of-bounds-access-for-Share-button.patch (git-fixes CVE-2026-63943 bsc#1273044). - Update patches.suse/KVM-SEV-Ignore-Port-I-O-requests-of-length-0.patch (git-fixes CVE-2026-63940 bsc#1272781). - Update patches.suse/KVM-arm64-vgic-its-Reject-restored-DTE-with-out-of-r.patch (git-fixes CVE-2026-64106 bsc#1272242). - Update patches.suse/KVM-x86-mmu-Ensure-hugepage-is-in-by-slot-before-che.patch (git-fixes CVE-2026-63807 bsc#1272263). - Update patches.suse/KVM-x86-xen-Fix-cleanup-logic-in-emulation-of-Xen-sc.patch (git-fixes CVE-2025-38469 bsc#1247455). - Update patches.suse/PCI-mediatek-gen3-Prevent-leaking-IRQ-domains-when-I.patch (git-fixes CVE-2026-63862 bsc#1271813). - Update patches.suse/USB-serial-belkin_sa-validate-interrupt-status-lengt.patch (git-fixes CVE-2026-63903 bsc#1272522). - Update patches.suse/USB-serial-cypress_m8-validate-interrupt-packet-head.patch (git-fixes CVE-2026-63902 bsc#1272517). - Update patches.suse/USB-serial-keyspan-fix-missing-indat-transfer-sanity.patch (git-fixes CVE-2026-63900 bsc#1272499). - Update patches.suse/USB-serial-keyspan_pda-fix-information-leak.patch (git-fixes CVE-2026-64336 bsc#1272685). - Update patches.suse/USB-serial-mct_u232-fix-missing-interrupt-in-transfe.patch (git-fixes CVE-2026-63897 bsc#1272642). - Update patches.suse/USB-serial-mxuport-fix-memory-corruption-with-small-.patch (git-fixes CVE-2026-63899 bsc#1272494). - Update patches.suse/USB-serial-omninet-fix-memory-corruption-with-small-.patch (git-fixes CVE-2026-63928 bsc#1272891). - Update patches.suse/USB-serial-safe_serial-fix-memory-corruption-with-sm.patch (git-fixes CVE-2026-63957 bsc#1272472). - Update patches.suse/auxdisplay-line-display-fix-OOB-read-on-zero-length-.patch (git-fixes CVE-2026-63949 bsc#1272671). - Update patches.suse/batman-adv-tp_meter-avoid-divide-by-zero-for-dec_cwn.patch (git-fixes CVE-2026-63836 bsc#1272246). - Update patches.suse/batman-adv-tt-fix-negative-last_changeset_len.patch (git-fixes CVE-2026-64089 bsc#1272513). - Update patches.suse/device-property-set-fwnode-secondary-to-NULL-in-fwno.patch (git-fixes CVE-2026-64220 bsc#1272785). - Update patches.suse/dm-cache-policy-smq-check-allocation-under-invalidate-lock.patch (git-fixes CVE-2026-53265 bsc#1269734). - Update patches.suse/drivers-base-memory-fix-memory-block-reference-leak-.patch (git-fixes CVE-2026-64182 bsc#1272194). - Update patches.suse/drm-amdgpu-jpeg-set-no_user_fence-for-JPEG-v2.0-ring.patch (git-fixes CVE-2026-63848 bsc#1272380). - Update patches.suse/drm-amdgpu-jpeg-set-no_user_fence-for-JPEG-v2.5-ring.patch (git-fixes CVE-2026-63847 bsc#1272374). - Update patches.suse/drm-amdgpu-jpeg-set-no_user_fence-for-JPEG-v3.0-ring.patch (git-fixes CVE-2026-63846 bsc#1272373). - Update patches.suse/drm-amdgpu-jpeg-set-no_user_fence-for-JPEG-v4.0-ring.patch (git-fixes CVE-2026-63845 bsc#1272360). - Update patches.suse/drm-amdgpu-jpeg-set-no_user_fence-for-JPEG-v4.0.3-ri.patch (git-fixes CVE-2026-63844 bsc#1272362). - Update patches.suse/drm-amdgpu-jpeg-set-no_user_fence-for-JPEG-v4.0.5-ri.patch (git-fixes CVE-2026-63843 bsc#1272361). - Update patches.suse/drm-amdgpu-vcn-set-no_user_fence-for-VCN-v2.0-enc-de.patch (git-fixes CVE-2026-63856 bsc#1272492). - Update patches.suse/drm-amdgpu-vcn-set-no_user_fence-for-VCN-v2.5-enc-de.patch (git-fixes CVE-2026-63855 bsc#1272489). - Update patches.suse/drm-amdgpu-vcn-set-no_user_fence-for-VCN-v3.0-enc-de.patch (git-fixes CVE-2026-63854 bsc#1272406). - Update patches.suse/drm-amdgpu-vcn-set-no_user_fence-for-VCN-v4.0-enc-ri.patch (git-fixes CVE-2026-63853 bsc#1272389). - Update patches.suse/drm-amdgpu-vcn-set-no_user_fence-for-VCN-v4.0.3-enc-.patch (git-fixes CVE-2026-63852 bsc#1272387). - Update patches.suse/drm-amdgpu-vcn-set-no_user_fence-for-VCN-v4.0.5-enc-.patch (git-fixes CVE-2026-63851 bsc#1272384). - Update patches.suse/drm-amdgpu-zero-initialize-GART-table-on-allocation.patch (stable-fixes CVE-2026-53374 bsc#1271827). - Update patches.suse/drm-amdkfd-Add-upper-bound-check-for-num_of_nodes.patch (stable-fixes CVE-2026-53376 bsc#1271831). - Update patches.suse/drm-amdkfd-fix-NULL-pointer-bug-in-svm_range_set_att.patch (stable-fixes CVE-2026-63882 bsc#1271937). - Update patches.suse/drm-i915-Fix-potential-UAF-in-TTM-object-purge.patch (git-fixes CVE-2026-63884 bsc#1272573). - Update patches.suse/drm-msm-dsi-don-t-dump-registers-past-the-mapped-reg.patch (git-fixes CVE-2026-64231 bsc#1272787). - Update patches.suse/drm-radeon-delete-radeon_fence_process-in-is_signale.patch (stable-fixes CVE-2025-68223 bsc#1255357). - Update patches.suse/efi-Allocate-runtime-workqueue-before-ACPI-init.patch (git-fixes CVE-2026-64183 bsc#1272197). - Update patches.suse/fbdev-Fix-fb_new_modelist-to-prevent-null-ptr-deref-.patch (stable-fixes CVE-2026-53403 bsc#1271731). - Update patches.suse/fbdev-fix-use-after-free-in-store_modes.patch (stable-fixes CVE-2026-63826 bsc#1272183). - Update patches.suse/i2c-stub-Reject-I2C-block-transfers-with-invalid-len.patch (git-fixes CVE-2026-64191 bsc#1272211). - Update patches.suse/i3c-mipi-i3c-hci-Correct-RING_CTRL_ABORT-handling-in.patch (git-fixes CVE-2026-43352 bsc#1264793). - Update patches.suse/iio-buffer-hw-consumer-fix-use-after-free-in-error-p.patch (git-fixes CVE-2026-63930 bsc#1272850). - Update patches.suse/iio-chemical-scd30-fix-division-by-zero-in-write_raw.patch (git-fixes CVE-2026-63931 bsc#1272853). - Update patches.suse/iio-gyro-itg3200-fix-i2c-read-into-the-wrong-stack-l.patch (git-fixes CVE-2026-63934 bsc#1272863). - Update patches.suse/iio-imu-st_lsm6dsx-fix-stack-leak-in-tagged-FIFO-buf.patch (git-fixes CVE-2026-63967 bsc#1272470). - Update patches.suse/media-i2c-ov8856-free-control-handler-on-error-in-ov.patch (git-fixes CVE-2026-53379 bsc#1271833). - Update patches.suse/media-vidtv-fix-NULL-pointer-dereference-in-vidtv_mu.patch (git-fixes CVE-2026-53382 bsc#1271717). - Update patches.suse/mtd-spi-nor-sst-Fix-SST-write-failure.patch (git-fixes CVE-2025-21845 bsc#1239511). - Update patches.suse/net-wwan-iosm-fix-potential-memory-leaks-in-ipc_imem.patch (git-fixes CVE-2026-64179 bsc#1272149). - Update patches.suse/nfc-hci-fix-out-of-bounds-read-in-HCP-header-parsing.patch (git-fixes CVE-2026-63915 bsc#1272897). - Update patches.suse/parport-Fix-race-between-port-and-client-registratio.patch (git-fixes CVE-2026-63942 bsc#1273023). - Update patches.suse/slimbus-qcom-ngd-ctrl-Avoid-ABBA-on-tx_lock-ctrl-loc.patch (git-fixes CVE-2026-53331 bsc#1270113). - Update patches.suse/slimbus-qcom-ngd-ctrl-Register-callbacks-after-creat.patch (git-fixes CVE-2026-53332 bsc#1270102). - Update patches.suse/spi-mtk-snfi-unregister-ECC-engine-on-probe-failure-.patch (git-fixes CVE-2026-63861 bsc#1272434). - Update patches.suse/spi-ti-qspi-fix-use-after-free-after-DMA-setup-failu.patch (git-fixes CVE-2026-64221 bsc#1272797). - Update patches.suse/thunderbolt-property-Reject-dir_len-4-to-prevent-siz.patch (git-fixes CVE-2026-63892 bsc#1272591). - Update patches.suse/thunderbolt-property-Reject-u32-wrap-in-tb_property_.patch (git-fixes CVE-2026-63893 bsc#1272607). - Update patches.suse/tty-serial-pch_uart-add-check-for-dma_alloc_coherent.patch (git-fixes CVE-2026-64234 bsc#1272646). - Update patches.suse/usb-dwc2-Fix-use-after-free-in-debug-code.patch (git-fixes CVE-2026-63927 bsc#1272892). - Update patches.suse/usb-gadget-composite-fix-dead-empty-check-in-the-USB.patch (git-fixes CVE-2026-64347 bsc#1272807). - Update patches.suse/usb-gadget-composite-fix-integer-underflow-in-WebUSB.patch (git-fixes CVE-2026-63896 bsc#1272617). - Update patches.suse/usb-gadget-f_fs-copy-only-received-bytes-on-short-ep.patch (git-fixes CVE-2026-63895 bsc#1272614). - Update patches.suse/usb-gadget-f_printer-take-kref-only-for-successful-o.patch (git-fixes CVE-2026-64345 bsc#1272689). - Update patches.suse/usb-gadget-net2280-Fix-double-free-in-probe-error-pa.patch (git-fixes CVE-2026-64242 bsc#1272659). - Update patches.suse/usb-typec-altmodes-displayport-validate-count-before.patch (stable-fixes CVE-2026-63961 bsc#1272480). - Update patches.suse/usb-typec-tcpm-Validate-SVID-index-in-svdm_consume_m.patch (git-fixes CVE-2026-64330 bsc#1272681). - Update patches.suse/usb-typec-tcpm-tcpci_maxim-validate-header-NDO-again.patch (stable-fixes CVE-2026-63959 bsc#1272474). - Update patches.suse/usb-typec-ucsi-ccg-reject-firmware-images-without-a-.patch (stable-fixes CVE-2026-63964 bsc#1272483). - Update patches.suse/usb-typec-ucsi-validate-connector-number-in-ucsi_con.patch (stable-fixes CVE-2026-63958 bsc#1272467). - Update patches.suse/usb-typec-wcove-don-t-write-past-struct-pd_message-i.patch (stable-fixes CVE-2026-63960 bsc#1272478). - Update patches.suse/usb-usbtmc-check-URB-actual_length-for-interrupt-IN-.patch (git-fixes CVE-2026-63904 bsc#1272523). - Update patches.suse/usb-xhci-Fix-sleep-in-atomic-context-in-xhci_free_st.patch (git-fixes CVE-2026-64465 bsc#1272843). - Update patches.suse/usbip-vudc-Fix-use-after-free-bug-in-vudc_remove-due.patch (git-fixes CVE-2026-63905 bsc#1272578). - Update patches.suse/vc_screen-fix-null-ptr-deref-in-vcs_notifier-during-.patch (git-fixes CVE-2026-53385 bsc#1271834). - Update patches.suse/wifi-ath11k-fix-warning-when-unbinding.patch (git-fixes CVE-2026-63822 bsc#1272187). - Update patches.suse/wifi-cfg80211-advance-loop-vars-in-cfg80211_merge_pr.patch (git-fixes CVE-2026-64174 bsc#1272146). - Update patches.suse/wifi-mac80211-consume-only-present-negotiated-TTLM-m.patch (git-fixes CVE-2026-64223 bsc#1272800). - Update patches.suse/wifi-mac80211-limit-injected-antenna-index-in-ieee80.patch (git-fixes CVE-2026-63869 bsc#1272500). - Update patches.suse/wifi-rtw88-usb-fix-memory-leaks-on-USB-write-failure.patch (git-fixes CVE-2026-63821 bsc#1271967). - commit 1e756ae - mm/huge_memory: update file PMD counter before folio_put() (CVE-2026-53189 bsc#1269797). - commit e154937 - wifi: iwlwifi: fix 22000 series SMEM parsing (CVE-2026-43172 bsc#1264543) - commit fc0867f - bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (CVE-2026-43016 bsc#1264007) - commit 374a18a - udf: reject descriptors with oversized CRC length (bsc#1271818 CVE-2026-53369). - commit 3dbc237 - net: Drop the lock in skb_may_tx_timestamp() (CVE-2026-43216 bsc#1264319). - commit 9206404 - net/rds: Clear reconnect pending bit (CVE-2026-43230 bsc#1264539). - commit 411b319 - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114 bsc#1264601). - commit 7913fcb - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (CVE-2026-64106 bsc#1272242). - commit a07d6c6 ++++ pcp: - Fix bsc#1272922 / CVE-2026-16524. - Fix bsc#1272923 / CVE-2026-16526. - Fix bsc#1272924 / CVE-2026-16527. - Fix bsc#1272925 / CVE-2026-16529. - Fix bsc#1272926 / CVE-2026-16530. - Fix bsc#1272927 / CVE-2026-16531. - Fix bsc#1272928. - Fix bsc#1272930. - Add patches: * pcp-CVE-2026-16524.patch * pcp-CVE-2026-16526.patch * pcp-CVE-2026-16527.patch * pcp-CVE-2026-16529.patch * pcp-CVE-2026-16530-1.patch * pcp-CVE-2026-16530-2.patch * pcp-CVE-2026-16530-3.patch * pcp-CVE-2026-16530-4.patch * pcp-CVE-2026-16530-5.patch * pcp-CVE-2026-16530-6.patch * pcp-CVE-2026-16531.patch * pcp-bsc-1272928.patch * pcp-bsc-1272930.patch ------------------------------------------------------------------ ------------------ 2026-7-29 - Jul 29 2026 ------------------- ------------------------------------------------------------------ ++++ glib2: - Add glib2-CVE-2026-15588.patch: gdbusauth: Limit length of lines read from client (bsc#1272206, CVE-2026-15588). ++++ grub2: - Fix crash in booting kernel on some AMD systems (bsc#1271980) * 0001-linux-allocate-EFI-kernel-buffer-as-GRUB_EFI_LOADER_.patch ++++ kernel-default: - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829 bsc#1272176). - commit eb81e79 - ipv6: fix possible infinite loop in fib6_select_path() (CVE-2026-63968 bsc#1272466). - commit 615bccb - xfs: resample the data fork mapping after cycling ILOCK (CVE-2026-64600 bsc#1271526). - commit bd06333 - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (CVE-2026-43451 bsc#1265009). - commit c2367ce - fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-53388 bsc#1271825). - fuse: re-lock request before replacing page cache folio (stable-fixes CVE-2026-53388 bsc#1271825). - commit d330cba - Bluetooth: fix memory leak in error path of hci_alloc_dev() (CVE-2026-53252 bsc#1269307). - commit 7065c2c - adaption to srcu change of hci_dev in hci_sysfs (CVE-2026-53252 bsc#1269307). - commit d291e9b - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (CVE-2026-63806 bsc#1272268). - commit 5dc37bf - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker (CVE-2026-46170 bsc#1267714). - mptcp: pm: ADD_ADDR rtx: free sk if last (CVE-2026-46170 bsc#1267714). - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (CVE-2026-46158 bsc#1266880). - mptcp: pm: ADD_ADDR rtx: fix potential data-race (CVE-2026-46137 bsc#1267570). - mptcp: pm: ADD_ADDR rtx: allow ID 0 (CVE-2026-46170 bsc#1267714). - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 (CVE-2026-46170 bsc#1267714). - mptcp: disable add_addr retransmission when timeout is 0 (CVE-2026-46170 bsc#1267714). - mptcp: pm: reuse ID 0 after delete and re-add (CVE-2026-46170 bsc#1267714). - commit 23cadd0 - mptcp: fix scheduling with atomic in timestamp sockopt (CVE-2026-46168 bsc#1266869). - mptcp: sockopt: set timestamp flags on subflow socket, not msk (CVE-2026-46168 bsc#1266869). - commit a941080 - migrate: correct lock ordering for hugetlb file folios (CVE-2026-23097 bsc#1257815). - commit 4dec86e ++++ kernel-rt: - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829 bsc#1272176). - commit eb81e79 - ipv6: fix possible infinite loop in fib6_select_path() (CVE-2026-63968 bsc#1272466). - commit 615bccb - xfs: resample the data fork mapping after cycling ILOCK (CVE-2026-64600 bsc#1271526). - commit bd06333 - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (CVE-2026-43451 bsc#1265009). - commit c2367ce - fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-53388 bsc#1271825). - fuse: re-lock request before replacing page cache folio (stable-fixes CVE-2026-53388 bsc#1271825). - commit d330cba - Bluetooth: fix memory leak in error path of hci_alloc_dev() (CVE-2026-53252 bsc#1269307). - commit 7065c2c - adaption to srcu change of hci_dev in hci_sysfs (CVE-2026-53252 bsc#1269307). - commit d291e9b - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (CVE-2026-63806 bsc#1272268). - commit 5dc37bf - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker (CVE-2026-46170 bsc#1267714). - mptcp: pm: ADD_ADDR rtx: free sk if last (CVE-2026-46170 bsc#1267714). - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (CVE-2026-46158 bsc#1266880). - mptcp: pm: ADD_ADDR rtx: fix potential data-race (CVE-2026-46137 bsc#1267570). - mptcp: pm: ADD_ADDR rtx: allow ID 0 (CVE-2026-46170 bsc#1267714). - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 (CVE-2026-46170 bsc#1267714). - mptcp: disable add_addr retransmission when timeout is 0 (CVE-2026-46170 bsc#1267714). - mptcp: pm: reuse ID 0 after delete and re-add (CVE-2026-46170 bsc#1267714). - commit 23cadd0 - mptcp: fix scheduling with atomic in timestamp sockopt (CVE-2026-46168 bsc#1266869). - mptcp: sockopt: set timestamp flags on subflow socket, not msk (CVE-2026-46168 bsc#1266869). - commit a941080 - migrate: correct lock ordering for hugetlb file folios (CVE-2026-23097 bsc#1257815). - commit 4dec86e ++++ kernel-rt_debug: - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829 bsc#1272176). - commit eb81e79 - ipv6: fix possible infinite loop in fib6_select_path() (CVE-2026-63968 bsc#1272466). - commit 615bccb - xfs: resample the data fork mapping after cycling ILOCK (CVE-2026-64600 bsc#1271526). - commit bd06333 - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (CVE-2026-43451 bsc#1265009). - commit c2367ce - fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-53388 bsc#1271825). - fuse: re-lock request before replacing page cache folio (stable-fixes CVE-2026-53388 bsc#1271825). - commit d330cba - Bluetooth: fix memory leak in error path of hci_alloc_dev() (CVE-2026-53252 bsc#1269307). - commit 7065c2c - adaption to srcu change of hci_dev in hci_sysfs (CVE-2026-53252 bsc#1269307). - commit d291e9b - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (CVE-2026-63806 bsc#1272268). - commit 5dc37bf - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker (CVE-2026-46170 bsc#1267714). - mptcp: pm: ADD_ADDR rtx: free sk if last (CVE-2026-46170 bsc#1267714). - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (CVE-2026-46158 bsc#1266880). - mptcp: pm: ADD_ADDR rtx: fix potential data-race (CVE-2026-46137 bsc#1267570). - mptcp: pm: ADD_ADDR rtx: allow ID 0 (CVE-2026-46170 bsc#1267714). - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 (CVE-2026-46170 bsc#1267714). - mptcp: disable add_addr retransmission when timeout is 0 (CVE-2026-46170 bsc#1267714). - mptcp: pm: reuse ID 0 after delete and re-add (CVE-2026-46170 bsc#1267714). - commit 23cadd0 - mptcp: fix scheduling with atomic in timestamp sockopt (CVE-2026-46168 bsc#1266869). - mptcp: sockopt: set timestamp flags on subflow socket, not msk (CVE-2026-46168 bsc#1266869). - commit a941080 - migrate: correct lock ordering for hugetlb file folios (CVE-2026-23097 bsc#1257815). - commit 4dec86e ------------------------------------------------------------------ ------------------ 2026-7-28 - Jul 28 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - bpf: Restore sysctl new-value from 1 to 0 (CVE-2026-63809 bsc#1272296). - commit 2035215 - bpf: use kvfree() for replaced sysctl write buffer (CVE-2026-63809 bsc#1272296). - commit bd4c519 - bpf: NUL-terminate replaced sysctl value (CVE-2026-63809 bsc#1272296). - commit bf470e7 - net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223 bsc#1269301). - commit 0e38456 - patches.suse/fs-fcntl-fix-SOFTIRQ-unsafe-lock-order-in-fasync-signaling.patch: (CVE-2026-52946 bsc#1269113). Cherry-pick resolved automatically by custom merge drivers: - series.conf: series_merge_tool - commit 498cd33 - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (CVE-2026-45944 bsc#1267203). - iommu/vt-d: Clear Present bit before tearing down context entry (CVE-2026-45944 bsc#1267203). - commit 16e5d13 - xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (CVE-2026-45905 bsc#1266685). - commit 2bf4dbc - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (CVE-2026-63807 bsc#1272263). - commit 1f2ff27 - mkspec-dtb: Move provides-obsoletes to package list - commit 62b3949 - mkspec-dtb: Move DTS prefix into package list - commit 225c506 - mkspec-dtb: Put per-architecture package lists into a hash - commit c4b48e1 - Input: rmi4 - tolerate short register descriptor structure (git-fixes). - commit a4b22de - mkspec-dtb: re-indent - commit 1e2a2b0 - Input: rmi4 - refactor F12 probe function (stable-fixes). - Input: synaptics-rmi4 - fix crash when DPM query is not supported (git-fixes). - Input: synaptics-rmi4 - add support for querying DPM value (F12) (stable-fixes). - commit 9f82182 - Input: rmi4 - use local presence map in rmi_read_register_desc() (stable-fixes). - Input: rmi4 - initialize attn_fifo properly (stable-fixes). - commit 7652f54 - Revert "Input: rmi4 - fix register descriptor address calculation" (stable-fixes). - commit 0ba29d4 - Input: rmi4 - refactor register descriptor parsing (git-fixes). - commit ec076fe - Input: rmi4 - fix limit in rmi_register_desc_has_subpacket() (git-fixes). - Input: rmi4 - fix bit count in bitmap_copy() (git-fixes). - Input: rmi4 - iterative IRQ handler (git-fixes). - Input: rmi4 - fix memory leak in rmi_set_attn_data() (git-fixes). - Input: rmi4 - fix num_subpackets overflow in register descriptor (git-fixes). - Input: rmi4 - fix type overflow in register counts (git-fixes). - Input: rmi4 - fix register descriptor address calculation (git-fixes). - Input: serio - define serio_pause_rx guard to pause and resume serio ports (stable-fixes). - commit 6be06aa - assoc_array: trim the final shortcut word using the current chunk end (git-fixes). - pinctrl: bm1880: add missing select GENERIC_PINCONF (git-fixes). - pinctrl-amd: Don't clear S4 wake bits at probe (git-fixes). - pinctrl: devicetree: don't free uninitialized dev_name on error path (git-fixes). - pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 (git-fixes). - commit bddb256 ++++ kernel-rt: - bpf: Restore sysctl new-value from 1 to 0 (CVE-2026-63809 bsc#1272296). - commit 2035215 - bpf: use kvfree() for replaced sysctl write buffer (CVE-2026-63809 bsc#1272296). - commit bd4c519 - bpf: NUL-terminate replaced sysctl value (CVE-2026-63809 bsc#1272296). - commit bf470e7 - net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223 bsc#1269301). - commit 0e38456 - patches.suse/fs-fcntl-fix-SOFTIRQ-unsafe-lock-order-in-fasync-signaling.patch: (CVE-2026-52946 bsc#1269113). Cherry-pick resolved automatically by custom merge drivers: - series.conf: series_merge_tool - commit 498cd33 - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (CVE-2026-45944 bsc#1267203). - iommu/vt-d: Clear Present bit before tearing down context entry (CVE-2026-45944 bsc#1267203). - commit 16e5d13 - xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (CVE-2026-45905 bsc#1266685). - commit 2bf4dbc - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (CVE-2026-63807 bsc#1272263). - commit 1f2ff27 - mkspec-dtb: Move provides-obsoletes to package list - commit 62b3949 - mkspec-dtb: Move DTS prefix into package list - commit 225c506 - mkspec-dtb: Put per-architecture package lists into a hash - commit c4b48e1 - Input: rmi4 - tolerate short register descriptor structure (git-fixes). - commit a4b22de - mkspec-dtb: re-indent - commit 1e2a2b0 - Input: rmi4 - refactor F12 probe function (stable-fixes). - Input: synaptics-rmi4 - fix crash when DPM query is not supported (git-fixes). - Input: synaptics-rmi4 - add support for querying DPM value (F12) (stable-fixes). - commit 9f82182 - Input: rmi4 - use local presence map in rmi_read_register_desc() (stable-fixes). - Input: rmi4 - initialize attn_fifo properly (stable-fixes). - commit 7652f54 - Revert "Input: rmi4 - fix register descriptor address calculation" (stable-fixes). - commit 0ba29d4 - Input: rmi4 - refactor register descriptor parsing (git-fixes). - commit ec076fe - Input: rmi4 - fix limit in rmi_register_desc_has_subpacket() (git-fixes). - Input: rmi4 - fix bit count in bitmap_copy() (git-fixes). - Input: rmi4 - iterative IRQ handler (git-fixes). - Input: rmi4 - fix memory leak in rmi_set_attn_data() (git-fixes). - Input: rmi4 - fix num_subpackets overflow in register descriptor (git-fixes). - Input: rmi4 - fix type overflow in register counts (git-fixes). - Input: rmi4 - fix register descriptor address calculation (git-fixes). - Input: serio - define serio_pause_rx guard to pause and resume serio ports (stable-fixes). - commit 6be06aa - assoc_array: trim the final shortcut word using the current chunk end (git-fixes). - pinctrl: bm1880: add missing select GENERIC_PINCONF (git-fixes). - pinctrl-amd: Don't clear S4 wake bits at probe (git-fixes). - pinctrl: devicetree: don't free uninitialized dev_name on error path (git-fixes). - pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 (git-fixes). - commit bddb256 ++++ kernel-rt_debug: - bpf: Restore sysctl new-value from 1 to 0 (CVE-2026-63809 bsc#1272296). - commit 2035215 - bpf: use kvfree() for replaced sysctl write buffer (CVE-2026-63809 bsc#1272296). - commit bd4c519 - bpf: NUL-terminate replaced sysctl value (CVE-2026-63809 bsc#1272296). - commit bf470e7 - net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223 bsc#1269301). - commit 0e38456 - patches.suse/fs-fcntl-fix-SOFTIRQ-unsafe-lock-order-in-fasync-signaling.patch: (CVE-2026-52946 bsc#1269113). Cherry-pick resolved automatically by custom merge drivers: - series.conf: series_merge_tool - commit 498cd33 - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (CVE-2026-45944 bsc#1267203). - iommu/vt-d: Clear Present bit before tearing down context entry (CVE-2026-45944 bsc#1267203). - commit 16e5d13 - xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (CVE-2026-45905 bsc#1266685). - commit 2bf4dbc - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (CVE-2026-63807 bsc#1272263). - commit 1f2ff27 - mkspec-dtb: Move provides-obsoletes to package list - commit 62b3949 - mkspec-dtb: Move DTS prefix into package list - commit 225c506 - mkspec-dtb: Put per-architecture package lists into a hash - commit c4b48e1 - Input: rmi4 - tolerate short register descriptor structure (git-fixes). - commit a4b22de - mkspec-dtb: re-indent - commit 1e2a2b0 - Input: rmi4 - refactor F12 probe function (stable-fixes). - Input: synaptics-rmi4 - fix crash when DPM query is not supported (git-fixes). - Input: synaptics-rmi4 - add support for querying DPM value (F12) (stable-fixes). - commit 9f82182 - Input: rmi4 - use local presence map in rmi_read_register_desc() (stable-fixes). - Input: rmi4 - initialize attn_fifo properly (stable-fixes). - commit 7652f54 - Revert "Input: rmi4 - fix register descriptor address calculation" (stable-fixes). - commit 0ba29d4 - Input: rmi4 - refactor register descriptor parsing (git-fixes). - commit ec076fe - Input: rmi4 - fix limit in rmi_register_desc_has_subpacket() (git-fixes). - Input: rmi4 - fix bit count in bitmap_copy() (git-fixes). - Input: rmi4 - iterative IRQ handler (git-fixes). - Input: rmi4 - fix memory leak in rmi_set_attn_data() (git-fixes). - Input: rmi4 - fix num_subpackets overflow in register descriptor (git-fixes). - Input: rmi4 - fix type overflow in register counts (git-fixes). - Input: rmi4 - fix register descriptor address calculation (git-fixes). - Input: serio - define serio_pause_rx guard to pause and resume serio ports (stable-fixes). - commit 6be06aa - assoc_array: trim the final shortcut word using the current chunk end (git-fixes). - pinctrl: bm1880: add missing select GENERIC_PINCONF (git-fixes). - pinctrl-amd: Don't clear S4 wake bits at probe (git-fixes). - pinctrl: devicetree: don't free uninitialized dev_name on error path (git-fixes). - pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 (git-fixes). - commit bddb256 ------------------------------------------------------------------ ------------------ 2026-7-27 - Jul 27 2026 ------------------- ------------------------------------------------------------------ ++++ gzip: - Fix CVE-2026-41992, global buffer overflow in the LZH decompression logic (CVE-2026-41992, bsc#1269623, bsc#1272554) * CVE-2026-41992.patch ++++ jq: - spec: use direct make invocation in favor of %make_build, which is not recognized by the rpm in SLE-15-SP3:Update ++++ kernel-default: - pkspec-dtb: Fix dtb-al rename. - commit 98ec660 - mkspec-dtb: Skip missing DTBs. - commit 133d77b - ice: fix PTP Call Trace during PTP release (bsc#1269981). - commit a23cdd0 - RDMA/hns: Fix WQ_MEM_RECLAIM warning (CVE-2026-46265 bsc#1267662) - commit b4782fa - Update patches.suse/net-sched-cls_api-Handle-TC_ACT_CONSUMED-in-tcf_qevent_han.patch (CVE-2026-64530 bsc#1271866). - commit 37abe18 - platform/x86/amd/pmc: Avoid logging "(null)" for DMI values (git-fixes). - platform/x86/amd/pmc: Don't log during intermediate wakeups (stable-fixes). - commit b240bb8 - serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms (git-fixes). - commit 97e1279 - Input: ims-pcu - fix logic error in packet reset (git-fixes). - commit 643013e - serial: sc16is7xx: implement gpio get_direction() callback (git-fixes). - USB: serial: io_edgeport: cap received transmit credits (git-fixes). - USB: serial: io_ti: reject oversized boot-mode firmware (git-fixes). - USB: serial: mxuport: validate firmware header size (git-fixes). - USB: serial: keyspan_pda: fix data loss on receive throttling (git-fixes). - usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback (git-fixes). - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (git-fixes). - usb: core: port: Deattach Type-C connector on component unbind (git-fixes). - usb: gadget: printer: fix infinite loop in printer_read() (git-fixes). - usb: gadget: f_midi: cancel pending IN work before freeing the midi object (git-fixes). - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown (git-fixes). - usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() (git-fixes). - USB: gadget: snps-udc: fix device name leak on probe failure (git-fixes). - USB: gadget: fsl-udc: fix device name leak on probe failure (git-fixes). - usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer (git-fixes). - wifi: mac80211: fix memory leak in ieee80211_register_hw() (git-fixes). - wifi: mac80211: free ack status frame on TX header build failure (git-fixes). - wifi: rt2x00: avoid full teardown before work setup in probe (git-fixes). - wifi: mwifiex: fix permanently busy scans after multiple roam iterations (git-fixes). - serial: 8250_mid: Disable DMA for selected platforms (git-fixes). - usb: gadget: udc: Fix use-after-free in gadget_match_driver (stable-fixes). - usb: gadget: function: rndis: add length check for header (stable-fixes). - usb: gadget: function: rndis: add length check to response query (stable-fixes). - USB: serial: option: add Telit Cinterion FE990D50 compositions (stable-fixes). - USB: iowarrior: fix use-after-free on disconnect race (git-fixes). - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub (stable-fixes). - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD (stable-fixes). - usb: cdc_acm: Add quirk for Uniden BC125AT scanner (stable-fixes). - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock (git-fixes). - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD (git-fixes). - slimbus: qcom-ngd-ctrl: Initialize controller resources in controller (git-fixes). - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd (git-fixes). - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership (git-fixes). - slimbus: qcom-ngd-ctrl: Fix probe error path ordering (git-fixes). - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration (git-fixes). - usb: iowarrior: remove inherent race with minor number (stable-fixes). - slimbus: Convert to platform remove callback returning void (stable-fixes). - commit cf3654b - staging: rtl8723bs: fix inverted HT40 secondary channel offset (git-fixes). - regulator: ltc3676: Fix incorrect IRQSTAT bit offsets (git-fixes). - mtd: onenand: samsung: report DMA completion timeouts (git-fixes). - mtd: rawnand: fsl_ifc: return errors for failed page reads (git-fixes). - mtd: mchp23k256: use SPI match data for chip caps (git-fixes). - mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout (git-fixes). - reset: sunxi: fix memory region leak on ioremap failure (git-fixes). - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() (git-fixes). - net: wwan: t7xx: destroy DMA pool on CLDMA late init failure (git-fixes). - net: thunderbolt: Fix frags overflow by bounding frame_count (git-fixes). - platform/x86/amd/pmc: Add delay_suspend module parameter (stable-fixes). - platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops (stable-fixes). - platform/x86/amd/pmc: Check for intermediate wakeup in function (stable-fixes). - remoteproc: qcom: Fix leak when custom dump_segments addition fails (git-fixes). - net: wwan: t7xx: check skb_clone in control TX (git-fixes). - staging: rtl8723bs: core: move constants to right side in comparison (stable-fixes). - net: usb: lan78xx: move functions to avoid forward definitions (stable-fixes). - serial: 8250_mid: Remove 8250_pci usage (stable-fixes). - commit f18f2f1 - media: rockchip: rga: fix too small buffer size (git-fixes). - commit 1cf1525 - mei: bus: access mei_device under device_lock on cleanup (git-fixes). - mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout (git-fixes). - memstick: ms_block: reject a card that reports too many blocks (git-fixes). - mmc: vub300: defer reset until cmd_mutex is unlocked (git-fixes). - media: qcom: venus: relax encoder frame/blur step size on v6 (git-fixes). - media: qcom: venus: relax encoder frame/blur dimension steps on v4 (git-fixes). - media: qcom: venus: drop extra padding in NV12 raw size calculation (git-fixes). - media: uvcvideo: Avoid partial metadata buffers (git-fixes). - media: nxp: imx8-isi: Fix use-after-free on remove (git-fixes). - staging: media: atomisp: reduce load_primary_binaries() stack usage (git-fixes). - media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() (git-fixes). - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe (git-fixes). - media: uvcvideo: Fix buffer sequence in frame gaps (git-fixes). - media: uvcvideo: Fix sequence number when no EOF (git-fixes). - mfd: tps6586x: Fix OF node refcount (git-fixes). - mfd: cros_ec: Delay dev_set_drvdata() until probe success (git-fixes). - mfd: sm501: Fix reference leak on failed device registration (git-fixes). - media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code (stable-fixes). - commit 51e03b8 - intel_th: fix MSC output device reference leak (git-fixes). - Input: maple_keyb - set driver data before registering input device (stable-fixes). - Input: maplecontrol - set driver data before registering input device (stable-fixes). - Input: maplemouse - set driver data before registering input device (stable-fixes). - Input: elan_i2c - prevent division by zero and arithmetic underflow (git-fixes). - Input: iforce - bound the device-reported force-feedback effect index (git-fixes). - Input: goodix - clamp the device-reported contact count (git-fixes). - Input: touchwin - reset the packet index on every complete packet (git-fixes). - media: nxp: imx8-isi: Convert to platform remove callback returning void (stable-fixes). - commit 4fa31b8 - Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure (git-fixes). - Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing (git-fixes). - Input: ims-pcu - add response length checks (git-fixes). - Input: ims-pcu - fix DMA mapping violation in line setup (git-fixes). - Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging (git-fixes). - Input: ims-pcu - validate control endpoint type (git-fixes). - Input: ims-pcu - fix race condition in reset_device sysfs callback (git-fixes). - Input: ims-pcu - fix firmware leak in async update (git-fixes). - Input: ims-pcu - fix type confusion in CDC union descriptor parsing (git-fixes). - Input: ims-pcu - fix use-after-free and double-free in disconnect (git-fixes). - firmware_loader: introduce __free() cleanup hanler (stable-fixes). - commit 6c6ae57 - HID: playstation: validate num_touch_reports in DualShock 4 reports (stable-fixes). - Refresh patches.suse/HID-playstation-Clamp-num_touch_reports.patch. - commit 591f337 - firewire: net: Fix fragmented datagram reassembly (git-fixes). - iio: common: st_sensors: honour channel endianness in read_axis_data (git-fixes). - hwmon: (w83627hf) remove VID sysfs files on error and remove (stable-fixes). - hwmon: (w83793) remove vrm sysfs file on probe failure (stable-fixes). - ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation (git-fixes). - ieee802154: admin-gate legacy LLSEC dump operations (git-fixes). - ieee802154: fix kernel-infoleak in dgram_recvmsg() (git-fixes). - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit (git-fixes). - ieee802154: ca8210: fix cas_ctl leak on spi_async failure (git-fixes). - ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() (git-fixes). - gpio: eic-sprd: use raw_spinlock_t in the irq startup path (git-fixes). - gpio: mlxbf3: fail probe if gpiochip registration fails (git-fixes). - Input: ims-pcu - release data interface on disconnect (git-fixes). - gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path (git-fixes). - Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() (git-fixes). - Input: atkbd - validate scancode in firmware keymap entries (git-fixes). - HID: add haptics page defines (stable-fixes). - commit 005c4de - comedi: comedi_parport: deal with premature interrupt (git-fixes). - cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (git-fixes). - drm/vc4: hvs/v3d: Fix null dereference in unbind (git-fixes). - drm/vmwgfx: Validate vmw_surface_metadata::array_size (git-fixes). - drm/vc4: Prevent shader BO mappings from becoming writable (git-fixes). - can: isotp: use unconditional synchronize_rcu() in isotp_release() (git-fixes). - can: bcm: add missing rcu list annotations and operations (git-fixes). - can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure (git-fixes). - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (git-fixes). - can: esd_usb: kill anchored URBs before freeing netdevs (git-fixes). - Bluetooth: btrtl: validate firmware patch bounds (git-fixes). - fbcon: fix NULL pointer dereference for a console without vc_data (stable-fixes). - bus: sunxi-rsb: Always check register address validity (git-fixes). - drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove (git-fixes). - drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered (stable-fixes). - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB (stable-fixes). - fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() (git-fixes). - driver core: Guard deferred probe timeout extension with delayed_work_pending() (git-fixes). - driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() (git-fixes). - driver core: Use mod_delayed_work to prevent lost deferred probe work (git-fixes). - commit 79d21f8 - batman-adv: dat: fix tie-break for candidate selection (git-fixes). - batman-adv: frag: fix primary_if leak on failed linearization (git-fixes). - batman-adv: frag: free unfragmentable packet (git-fixes). - batman-adv: tt: prevent TVLV OOB check overflow (git-fixes). - batman-adv: tt: avoid request storms during pending request (git-fixes). - batman-adv: fix VLAN priority offset (git-fixes). - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (stable-fixes). - Bluetooth: btusb: mediatek: remove the unnecessary goto tag (stable-fixes). - bitops: make BYTES_TO_BITS() treewide-available (stable-fixes). - commit e8e057f ++++ kernel-rt: - pkspec-dtb: Fix dtb-al rename. - commit 98ec660 - mkspec-dtb: Skip missing DTBs. - commit 133d77b - ice: fix PTP Call Trace during PTP release (bsc#1269981). - commit a23cdd0 - RDMA/hns: Fix WQ_MEM_RECLAIM warning (CVE-2026-46265 bsc#1267662) - commit b4782fa - Update patches.suse/net-sched-cls_api-Handle-TC_ACT_CONSUMED-in-tcf_qevent_han.patch (CVE-2026-64530 bsc#1271866). - commit 37abe18 - platform/x86/amd/pmc: Avoid logging "(null)" for DMI values (git-fixes). - platform/x86/amd/pmc: Don't log during intermediate wakeups (stable-fixes). - commit b240bb8 - serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms (git-fixes). - commit 97e1279 - Input: ims-pcu - fix logic error in packet reset (git-fixes). - commit 643013e - serial: sc16is7xx: implement gpio get_direction() callback (git-fixes). - USB: serial: io_edgeport: cap received transmit credits (git-fixes). - USB: serial: io_ti: reject oversized boot-mode firmware (git-fixes). - USB: serial: mxuport: validate firmware header size (git-fixes). - USB: serial: keyspan_pda: fix data loss on receive throttling (git-fixes). - usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback (git-fixes). - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (git-fixes). - usb: core: port: Deattach Type-C connector on component unbind (git-fixes). - usb: gadget: printer: fix infinite loop in printer_read() (git-fixes). - usb: gadget: f_midi: cancel pending IN work before freeing the midi object (git-fixes). - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown (git-fixes). - usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() (git-fixes). - USB: gadget: snps-udc: fix device name leak on probe failure (git-fixes). - USB: gadget: fsl-udc: fix device name leak on probe failure (git-fixes). - usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer (git-fixes). - wifi: mac80211: fix memory leak in ieee80211_register_hw() (git-fixes). - wifi: mac80211: free ack status frame on TX header build failure (git-fixes). - wifi: rt2x00: avoid full teardown before work setup in probe (git-fixes). - wifi: mwifiex: fix permanently busy scans after multiple roam iterations (git-fixes). - serial: 8250_mid: Disable DMA for selected platforms (git-fixes). - usb: gadget: udc: Fix use-after-free in gadget_match_driver (stable-fixes). - usb: gadget: function: rndis: add length check for header (stable-fixes). - usb: gadget: function: rndis: add length check to response query (stable-fixes). - USB: serial: option: add Telit Cinterion FE990D50 compositions (stable-fixes). - USB: iowarrior: fix use-after-free on disconnect race (git-fixes). - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub (stable-fixes). - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD (stable-fixes). - usb: cdc_acm: Add quirk for Uniden BC125AT scanner (stable-fixes). - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock (git-fixes). - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD (git-fixes). - slimbus: qcom-ngd-ctrl: Initialize controller resources in controller (git-fixes). - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd (git-fixes). - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership (git-fixes). - slimbus: qcom-ngd-ctrl: Fix probe error path ordering (git-fixes). - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration (git-fixes). - usb: iowarrior: remove inherent race with minor number (stable-fixes). - slimbus: Convert to platform remove callback returning void (stable-fixes). - commit cf3654b - staging: rtl8723bs: fix inverted HT40 secondary channel offset (git-fixes). - regulator: ltc3676: Fix incorrect IRQSTAT bit offsets (git-fixes). - mtd: onenand: samsung: report DMA completion timeouts (git-fixes). - mtd: rawnand: fsl_ifc: return errors for failed page reads (git-fixes). - mtd: mchp23k256: use SPI match data for chip caps (git-fixes). - mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout (git-fixes). - reset: sunxi: fix memory region leak on ioremap failure (git-fixes). - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() (git-fixes). - net: wwan: t7xx: destroy DMA pool on CLDMA late init failure (git-fixes). - net: thunderbolt: Fix frags overflow by bounding frame_count (git-fixes). - platform/x86/amd/pmc: Add delay_suspend module parameter (stable-fixes). - platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops (stable-fixes). - platform/x86/amd/pmc: Check for intermediate wakeup in function (stable-fixes). - remoteproc: qcom: Fix leak when custom dump_segments addition fails (git-fixes). - net: wwan: t7xx: check skb_clone in control TX (git-fixes). - staging: rtl8723bs: core: move constants to right side in comparison (stable-fixes). - net: usb: lan78xx: move functions to avoid forward definitions (stable-fixes). - serial: 8250_mid: Remove 8250_pci usage (stable-fixes). - commit f18f2f1 - media: rockchip: rga: fix too small buffer size (git-fixes). - commit 1cf1525 - mei: bus: access mei_device under device_lock on cleanup (git-fixes). - mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout (git-fixes). - memstick: ms_block: reject a card that reports too many blocks (git-fixes). - mmc: vub300: defer reset until cmd_mutex is unlocked (git-fixes). - media: qcom: venus: relax encoder frame/blur step size on v6 (git-fixes). - media: qcom: venus: relax encoder frame/blur dimension steps on v4 (git-fixes). - media: qcom: venus: drop extra padding in NV12 raw size calculation (git-fixes). - media: uvcvideo: Avoid partial metadata buffers (git-fixes). - media: nxp: imx8-isi: Fix use-after-free on remove (git-fixes). - staging: media: atomisp: reduce load_primary_binaries() stack usage (git-fixes). - media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() (git-fixes). - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe (git-fixes). - media: uvcvideo: Fix buffer sequence in frame gaps (git-fixes). - media: uvcvideo: Fix sequence number when no EOF (git-fixes). - mfd: tps6586x: Fix OF node refcount (git-fixes). - mfd: cros_ec: Delay dev_set_drvdata() until probe success (git-fixes). - mfd: sm501: Fix reference leak on failed device registration (git-fixes). - media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code (stable-fixes). - commit 51e03b8 - intel_th: fix MSC output device reference leak (git-fixes). - Input: maple_keyb - set driver data before registering input device (stable-fixes). - Input: maplecontrol - set driver data before registering input device (stable-fixes). - Input: maplemouse - set driver data before registering input device (stable-fixes). - Input: elan_i2c - prevent division by zero and arithmetic underflow (git-fixes). - Input: iforce - bound the device-reported force-feedback effect index (git-fixes). - Input: goodix - clamp the device-reported contact count (git-fixes). - Input: touchwin - reset the packet index on every complete packet (git-fixes). - media: nxp: imx8-isi: Convert to platform remove callback returning void (stable-fixes). - commit 4fa31b8 - Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure (git-fixes). - Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing (git-fixes). - Input: ims-pcu - add response length checks (git-fixes). - Input: ims-pcu - fix DMA mapping violation in line setup (git-fixes). - Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging (git-fixes). - Input: ims-pcu - validate control endpoint type (git-fixes). - Input: ims-pcu - fix race condition in reset_device sysfs callback (git-fixes). - Input: ims-pcu - fix firmware leak in async update (git-fixes). - Input: ims-pcu - fix type confusion in CDC union descriptor parsing (git-fixes). - Input: ims-pcu - fix use-after-free and double-free in disconnect (git-fixes). - firmware_loader: introduce __free() cleanup hanler (stable-fixes). - commit 6c6ae57 - HID: playstation: validate num_touch_reports in DualShock 4 reports (stable-fixes). - Refresh patches.suse/HID-playstation-Clamp-num_touch_reports.patch. - commit 591f337 - firewire: net: Fix fragmented datagram reassembly (git-fixes). - iio: common: st_sensors: honour channel endianness in read_axis_data (git-fixes). - hwmon: (w83627hf) remove VID sysfs files on error and remove (stable-fixes). - hwmon: (w83793) remove vrm sysfs file on probe failure (stable-fixes). - ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation (git-fixes). - ieee802154: admin-gate legacy LLSEC dump operations (git-fixes). - ieee802154: fix kernel-infoleak in dgram_recvmsg() (git-fixes). - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit (git-fixes). - ieee802154: ca8210: fix cas_ctl leak on spi_async failure (git-fixes). - ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() (git-fixes). - gpio: eic-sprd: use raw_spinlock_t in the irq startup path (git-fixes). - gpio: mlxbf3: fail probe if gpiochip registration fails (git-fixes). - Input: ims-pcu - release data interface on disconnect (git-fixes). - gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path (git-fixes). - Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() (git-fixes). - Input: atkbd - validate scancode in firmware keymap entries (git-fixes). - HID: add haptics page defines (stable-fixes). - commit 005c4de - comedi: comedi_parport: deal with premature interrupt (git-fixes). - cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (git-fixes). - drm/vc4: hvs/v3d: Fix null dereference in unbind (git-fixes). - drm/vmwgfx: Validate vmw_surface_metadata::array_size (git-fixes). - drm/vc4: Prevent shader BO mappings from becoming writable (git-fixes). - can: isotp: use unconditional synchronize_rcu() in isotp_release() (git-fixes). - can: bcm: add missing rcu list annotations and operations (git-fixes). - can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure (git-fixes). - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (git-fixes). - can: esd_usb: kill anchored URBs before freeing netdevs (git-fixes). - Bluetooth: btrtl: validate firmware patch bounds (git-fixes). - fbcon: fix NULL pointer dereference for a console without vc_data (stable-fixes). - bus: sunxi-rsb: Always check register address validity (git-fixes). - drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove (git-fixes). - drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered (stable-fixes). - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB (stable-fixes). - fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() (git-fixes). - driver core: Guard deferred probe timeout extension with delayed_work_pending() (git-fixes). - driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() (git-fixes). - driver core: Use mod_delayed_work to prevent lost deferred probe work (git-fixes). - commit 79d21f8 - batman-adv: dat: fix tie-break for candidate selection (git-fixes). - batman-adv: frag: fix primary_if leak on failed linearization (git-fixes). - batman-adv: frag: free unfragmentable packet (git-fixes). - batman-adv: tt: prevent TVLV OOB check overflow (git-fixes). - batman-adv: tt: avoid request storms during pending request (git-fixes). - batman-adv: fix VLAN priority offset (git-fixes). - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (stable-fixes). - Bluetooth: btusb: mediatek: remove the unnecessary goto tag (stable-fixes). - bitops: make BYTES_TO_BITS() treewide-available (stable-fixes). - commit e8e057f ++++ kernel-rt_debug: - pkspec-dtb: Fix dtb-al rename. - commit 98ec660 - mkspec-dtb: Skip missing DTBs. - commit 133d77b - ice: fix PTP Call Trace during PTP release (bsc#1269981). - commit a23cdd0 - RDMA/hns: Fix WQ_MEM_RECLAIM warning (CVE-2026-46265 bsc#1267662) - commit b4782fa - Update patches.suse/net-sched-cls_api-Handle-TC_ACT_CONSUMED-in-tcf_qevent_han.patch (CVE-2026-64530 bsc#1271866). - commit 37abe18 - platform/x86/amd/pmc: Avoid logging "(null)" for DMI values (git-fixes). - platform/x86/amd/pmc: Don't log during intermediate wakeups (stable-fixes). - commit b240bb8 - serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms (git-fixes). - commit 97e1279 - Input: ims-pcu - fix logic error in packet reset (git-fixes). - commit 643013e - serial: sc16is7xx: implement gpio get_direction() callback (git-fixes). - USB: serial: io_edgeport: cap received transmit credits (git-fixes). - USB: serial: io_ti: reject oversized boot-mode firmware (git-fixes). - USB: serial: mxuport: validate firmware header size (git-fixes). - USB: serial: keyspan_pda: fix data loss on receive throttling (git-fixes). - usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback (git-fixes). - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (git-fixes). - usb: core: port: Deattach Type-C connector on component unbind (git-fixes). - usb: gadget: printer: fix infinite loop in printer_read() (git-fixes). - usb: gadget: f_midi: cancel pending IN work before freeing the midi object (git-fixes). - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown (git-fixes). - usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() (git-fixes). - USB: gadget: snps-udc: fix device name leak on probe failure (git-fixes). - USB: gadget: fsl-udc: fix device name leak on probe failure (git-fixes). - usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer (git-fixes). - wifi: mac80211: fix memory leak in ieee80211_register_hw() (git-fixes). - wifi: mac80211: free ack status frame on TX header build failure (git-fixes). - wifi: rt2x00: avoid full teardown before work setup in probe (git-fixes). - wifi: mwifiex: fix permanently busy scans after multiple roam iterations (git-fixes). - serial: 8250_mid: Disable DMA for selected platforms (git-fixes). - usb: gadget: udc: Fix use-after-free in gadget_match_driver (stable-fixes). - usb: gadget: function: rndis: add length check for header (stable-fixes). - usb: gadget: function: rndis: add length check to response query (stable-fixes). - USB: serial: option: add Telit Cinterion FE990D50 compositions (stable-fixes). - USB: iowarrior: fix use-after-free on disconnect race (git-fixes). - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub (stable-fixes). - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD (stable-fixes). - usb: cdc_acm: Add quirk for Uniden BC125AT scanner (stable-fixes). - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock (git-fixes). - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD (git-fixes). - slimbus: qcom-ngd-ctrl: Initialize controller resources in controller (git-fixes). - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd (git-fixes). - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership (git-fixes). - slimbus: qcom-ngd-ctrl: Fix probe error path ordering (git-fixes). - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration (git-fixes). - usb: iowarrior: remove inherent race with minor number (stable-fixes). - slimbus: Convert to platform remove callback returning void (stable-fixes). - commit cf3654b - staging: rtl8723bs: fix inverted HT40 secondary channel offset (git-fixes). - regulator: ltc3676: Fix incorrect IRQSTAT bit offsets (git-fixes). - mtd: onenand: samsung: report DMA completion timeouts (git-fixes). - mtd: rawnand: fsl_ifc: return errors for failed page reads (git-fixes). - mtd: mchp23k256: use SPI match data for chip caps (git-fixes). - mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout (git-fixes). - reset: sunxi: fix memory region leak on ioremap failure (git-fixes). - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() (git-fixes). - net: wwan: t7xx: destroy DMA pool on CLDMA late init failure (git-fixes). - net: thunderbolt: Fix frags overflow by bounding frame_count (git-fixes). - platform/x86/amd/pmc: Add delay_suspend module parameter (stable-fixes). - platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops (stable-fixes). - platform/x86/amd/pmc: Check for intermediate wakeup in function (stable-fixes). - remoteproc: qcom: Fix leak when custom dump_segments addition fails (git-fixes). - net: wwan: t7xx: check skb_clone in control TX (git-fixes). - staging: rtl8723bs: core: move constants to right side in comparison (stable-fixes). - net: usb: lan78xx: move functions to avoid forward definitions (stable-fixes). - serial: 8250_mid: Remove 8250_pci usage (stable-fixes). - commit f18f2f1 - media: rockchip: rga: fix too small buffer size (git-fixes). - commit 1cf1525 - mei: bus: access mei_device under device_lock on cleanup (git-fixes). - mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout (git-fixes). - memstick: ms_block: reject a card that reports too many blocks (git-fixes). - mmc: vub300: defer reset until cmd_mutex is unlocked (git-fixes). - media: qcom: venus: relax encoder frame/blur step size on v6 (git-fixes). - media: qcom: venus: relax encoder frame/blur dimension steps on v4 (git-fixes). - media: qcom: venus: drop extra padding in NV12 raw size calculation (git-fixes). - media: uvcvideo: Avoid partial metadata buffers (git-fixes). - media: nxp: imx8-isi: Fix use-after-free on remove (git-fixes). - staging: media: atomisp: reduce load_primary_binaries() stack usage (git-fixes). - media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() (git-fixes). - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe (git-fixes). - media: uvcvideo: Fix buffer sequence in frame gaps (git-fixes). - media: uvcvideo: Fix sequence number when no EOF (git-fixes). - mfd: tps6586x: Fix OF node refcount (git-fixes). - mfd: cros_ec: Delay dev_set_drvdata() until probe success (git-fixes). - mfd: sm501: Fix reference leak on failed device registration (git-fixes). - media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code (stable-fixes). - commit 51e03b8 - intel_th: fix MSC output device reference leak (git-fixes). - Input: maple_keyb - set driver data before registering input device (stable-fixes). - Input: maplecontrol - set driver data before registering input device (stable-fixes). - Input: maplemouse - set driver data before registering input device (stable-fixes). - Input: elan_i2c - prevent division by zero and arithmetic underflow (git-fixes). - Input: iforce - bound the device-reported force-feedback effect index (git-fixes). - Input: goodix - clamp the device-reported contact count (git-fixes). - Input: touchwin - reset the packet index on every complete packet (git-fixes). - media: nxp: imx8-isi: Convert to platform remove callback returning void (stable-fixes). - commit 4fa31b8 - Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure (git-fixes). - Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing (git-fixes). - Input: ims-pcu - add response length checks (git-fixes). - Input: ims-pcu - fix DMA mapping violation in line setup (git-fixes). - Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging (git-fixes). - Input: ims-pcu - validate control endpoint type (git-fixes). - Input: ims-pcu - fix race condition in reset_device sysfs callback (git-fixes). - Input: ims-pcu - fix firmware leak in async update (git-fixes). - Input: ims-pcu - fix type confusion in CDC union descriptor parsing (git-fixes). - Input: ims-pcu - fix use-after-free and double-free in disconnect (git-fixes). - firmware_loader: introduce __free() cleanup hanler (stable-fixes). - commit 6c6ae57 - HID: playstation: validate num_touch_reports in DualShock 4 reports (stable-fixes). - Refresh patches.suse/HID-playstation-Clamp-num_touch_reports.patch. - commit 591f337 - firewire: net: Fix fragmented datagram reassembly (git-fixes). - iio: common: st_sensors: honour channel endianness in read_axis_data (git-fixes). - hwmon: (w83627hf) remove VID sysfs files on error and remove (stable-fixes). - hwmon: (w83793) remove vrm sysfs file on probe failure (stable-fixes). - ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation (git-fixes). - ieee802154: admin-gate legacy LLSEC dump operations (git-fixes). - ieee802154: fix kernel-infoleak in dgram_recvmsg() (git-fixes). - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit (git-fixes). - ieee802154: ca8210: fix cas_ctl leak on spi_async failure (git-fixes). - ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() (git-fixes). - gpio: eic-sprd: use raw_spinlock_t in the irq startup path (git-fixes). - gpio: mlxbf3: fail probe if gpiochip registration fails (git-fixes). - Input: ims-pcu - release data interface on disconnect (git-fixes). - gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path (git-fixes). - Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() (git-fixes). - Input: atkbd - validate scancode in firmware keymap entries (git-fixes). - HID: add haptics page defines (stable-fixes). - commit 005c4de - comedi: comedi_parport: deal with premature interrupt (git-fixes). - cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (git-fixes). - drm/vc4: hvs/v3d: Fix null dereference in unbind (git-fixes). - drm/vmwgfx: Validate vmw_surface_metadata::array_size (git-fixes). - drm/vc4: Prevent shader BO mappings from becoming writable (git-fixes). - can: isotp: use unconditional synchronize_rcu() in isotp_release() (git-fixes). - can: bcm: add missing rcu list annotations and operations (git-fixes). - can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure (git-fixes). - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (git-fixes). - can: esd_usb: kill anchored URBs before freeing netdevs (git-fixes). - Bluetooth: btrtl: validate firmware patch bounds (git-fixes). - fbcon: fix NULL pointer dereference for a console without vc_data (stable-fixes). - bus: sunxi-rsb: Always check register address validity (git-fixes). - drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove (git-fixes). - drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered (stable-fixes). - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB (stable-fixes). - fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() (git-fixes). - driver core: Guard deferred probe timeout extension with delayed_work_pending() (git-fixes). - driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() (git-fixes). - driver core: Use mod_delayed_work to prevent lost deferred probe work (git-fixes). - commit 79d21f8 - batman-adv: dat: fix tie-break for candidate selection (git-fixes). - batman-adv: frag: fix primary_if leak on failed linearization (git-fixes). - batman-adv: frag: free unfragmentable packet (git-fixes). - batman-adv: tt: prevent TVLV OOB check overflow (git-fixes). - batman-adv: tt: avoid request storms during pending request (git-fixes). - batman-adv: fix VLAN priority offset (git-fixes). - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (stable-fixes). - Bluetooth: btusb: mediatek: remove the unnecessary goto tag (stable-fixes). - bitops: make BYTES_TO_BITS() treewide-available (stable-fixes). - commit e8e057f ++++ util-linux-systemd: - ipcutils: Prevent using uninitialized variable (bsc#1268886#c13, util-linux-bsc1268886-ipcutil-uninitialized.patch). ++++ libarchive: - Fix file descriptor leak in mtree cleanup (bsc#1261003) * file_descriptor.patch - Fix potential memory leak in the RAR5 reader (add_new_filter) (bsc#1261002) * rar5_memory.patch - Fix NULL pointer dereference in archive_acl_from_text_w() and archive_acl_from_text_l() when parsing malformed "default" ACL prefix (bsc#1260998) * null_pointer.patch - Fix heap-use-after-free (read) in the LHA reader (archive_read_support_format_lha.c) (bsc#1254341) * out-of-bounds_buffer.patch - Fix creation of temporary files in target directory (bsc#1254340) * temporary_files.patch ++++ util-linux: - ipcutils: Prevent using uninitialized variable (bsc#1268886#c13, util-linux-bsc1268886-ipcutil-uninitialized.patch). ++++ sssd: - fix use-after-free during p11_child processing in the PAM responder; (bsc#1269807); (CVE-2026-12610); Add patch 0008-PAM-fix-use-after-free-during-p11_child-processing.patch ++++ nvidia-open-driver-G06-signed: - update CUDA variant to 580.178.04 - supersedes kernel-5.14.patch, linux-7.1.patch ------------------------------------------------------------------ ------------------ 2026-7-26 - Jul 26 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - selftests/bpf: Reject scalar store into kptr slot (CVE-2026-53032 bsc#1269138). - commit 556d979 - bpf: Fix NULL deref in map_kptr_match_type for scalar regs (CVE-2026-53032 bsc#1269138). - commit bc14322 - selftests/bpf: add test for xdp_master_redirect with bond not up (CVE-2026-53069 bsc#1269186). - commit 0863fa0 - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master (CVE-2026-53069 bsc#1269186). - commit 9ffe4e9 - bpf: Do not allow deleting local storage in NMI (CVE-2026-53106 bsc#1269990). - commit c97ea00 ++++ kernel-rt: - selftests/bpf: Reject scalar store into kptr slot (CVE-2026-53032 bsc#1269138). - commit 556d979 - bpf: Fix NULL deref in map_kptr_match_type for scalar regs (CVE-2026-53032 bsc#1269138). - commit bc14322 - selftests/bpf: add test for xdp_master_redirect with bond not up (CVE-2026-53069 bsc#1269186). - commit 0863fa0 - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master (CVE-2026-53069 bsc#1269186). - commit 9ffe4e9 - bpf: Do not allow deleting local storage in NMI (CVE-2026-53106 bsc#1269990). - commit c97ea00 ++++ kernel-rt_debug: - selftests/bpf: Reject scalar store into kptr slot (CVE-2026-53032 bsc#1269138). - commit 556d979 - bpf: Fix NULL deref in map_kptr_match_type for scalar regs (CVE-2026-53032 bsc#1269138). - commit bc14322 - selftests/bpf: add test for xdp_master_redirect with bond not up (CVE-2026-53069 bsc#1269186). - commit 0863fa0 - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master (CVE-2026-53069 bsc#1269186). - commit 9ffe4e9 - bpf: Do not allow deleting local storage in NMI (CVE-2026-53106 bsc#1269990). - commit c97ea00 ------------------------------------------------------------------ ------------------ 2026-7-24 - Jul 24 2026 ------------------- ------------------------------------------------------------------ ++++ jq: - spec: use %post and %postun instead of %ldconfig_scriptlets because the latter is not a thing in SLE 12/15. ++++ kernel-default: - dm cache: fix missing return in invalidate_committed's error path (git-fixes). - commit 02eab3a - ice: fix NULL pointer dereference in ice_reset_all_vfs() (CVE-2026-53289 bsc#1269694). - commit 4e27706 - mac802154: hold an interface reference across the scan worker (git-fixes). - mac802154: llsec: reject frames shorter than the authentication tag (git-fixes). - net/x25: fix use-after-free in x25_kill_by_neigh() (git-fixes). - Bluetooth: btusb: validate Realtek vendor event length (git-fixes). - Bluetooth: RFCOMM: Fix session UAF in set_termios (git-fixes). - Bluetooth: hci_sync: Protect UUID list traversal (git-fixes). - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning (git-fixes). - wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() (git-fixes). - wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() (git-fixes). - wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() (git-fixes). - wifi: mt76: mt7915: guard HE capability lookups (git-fixes). - wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses (git-fixes). - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (git-fixes). - wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses (git-fixes). - wifi: iwlwifi: mvm: fix read in wake packet notification handler (git-fixes). - wifi: iwlwifi: mvm: validate SAR GEO response payload size (git-fixes). - wifi: brcmfmac: make release_scratchbuffers idempotent (git-fixes). - wifi: mac80211: recalculate TIM when a station enters power save (git-fixes). - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper (git-fixes). - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() (git-fixes). - wifi: mwifiex: bound uAP association event IEs to the event buffer (git-fixes). - wifi: wilc1000: validate assoc response length before subtracting header (git-fixes). - wifi: carl9170: fix buffer overflow in rx_stream failover path (git-fixes). - wifi: carl9170: fix OOB read from off-by-two in TX status handler (git-fixes). - wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read (git-fixes). - wifi: ath6kl: fix OOB read from firmware IE lengths in connect event (git-fixes). - wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler (git-fixes). - wifi: ath6kl: fix OOB access from firmware ADDBA window size (git-fixes). - wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes). - wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes). - wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() (git-fixes). - wifi: ath10k: fix skb leak on incomplete msdu during rx pop (git-fixes). - wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin (git-fixes). - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (git-fixes). - wifi: mac80211: tear down new links on vif update error path (git-fixes). - wan: wanxl: Only reset hardware after BAR mapping (git-fixes). - commit c34cf37 ++++ kernel-rt: - dm cache: fix missing return in invalidate_committed's error path (git-fixes). - commit 02eab3a - ice: fix NULL pointer dereference in ice_reset_all_vfs() (CVE-2026-53289 bsc#1269694). - commit 4e27706 - mac802154: hold an interface reference across the scan worker (git-fixes). - mac802154: llsec: reject frames shorter than the authentication tag (git-fixes). - net/x25: fix use-after-free in x25_kill_by_neigh() (git-fixes). - Bluetooth: btusb: validate Realtek vendor event length (git-fixes). - Bluetooth: RFCOMM: Fix session UAF in set_termios (git-fixes). - Bluetooth: hci_sync: Protect UUID list traversal (git-fixes). - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning (git-fixes). - wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() (git-fixes). - wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() (git-fixes). - wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() (git-fixes). - wifi: mt76: mt7915: guard HE capability lookups (git-fixes). - wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses (git-fixes). - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (git-fixes). - wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses (git-fixes). - wifi: iwlwifi: mvm: fix read in wake packet notification handler (git-fixes). - wifi: iwlwifi: mvm: validate SAR GEO response payload size (git-fixes). - wifi: brcmfmac: make release_scratchbuffers idempotent (git-fixes). - wifi: mac80211: recalculate TIM when a station enters power save (git-fixes). - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper (git-fixes). - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() (git-fixes). - wifi: mwifiex: bound uAP association event IEs to the event buffer (git-fixes). - wifi: wilc1000: validate assoc response length before subtracting header (git-fixes). - wifi: carl9170: fix buffer overflow in rx_stream failover path (git-fixes). - wifi: carl9170: fix OOB read from off-by-two in TX status handler (git-fixes). - wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read (git-fixes). - wifi: ath6kl: fix OOB read from firmware IE lengths in connect event (git-fixes). - wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler (git-fixes). - wifi: ath6kl: fix OOB access from firmware ADDBA window size (git-fixes). - wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes). - wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes). - wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() (git-fixes). - wifi: ath10k: fix skb leak on incomplete msdu during rx pop (git-fixes). - wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin (git-fixes). - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (git-fixes). - wifi: mac80211: tear down new links on vif update error path (git-fixes). - wan: wanxl: Only reset hardware after BAR mapping (git-fixes). - commit c34cf37 ++++ kernel-rt_debug: - dm cache: fix missing return in invalidate_committed's error path (git-fixes). - commit 02eab3a - ice: fix NULL pointer dereference in ice_reset_all_vfs() (CVE-2026-53289 bsc#1269694). - commit 4e27706 - mac802154: hold an interface reference across the scan worker (git-fixes). - mac802154: llsec: reject frames shorter than the authentication tag (git-fixes). - net/x25: fix use-after-free in x25_kill_by_neigh() (git-fixes). - Bluetooth: btusb: validate Realtek vendor event length (git-fixes). - Bluetooth: RFCOMM: Fix session UAF in set_termios (git-fixes). - Bluetooth: hci_sync: Protect UUID list traversal (git-fixes). - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning (git-fixes). - wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() (git-fixes). - wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() (git-fixes). - wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() (git-fixes). - wifi: mt76: mt7915: guard HE capability lookups (git-fixes). - wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses (git-fixes). - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (git-fixes). - wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses (git-fixes). - wifi: iwlwifi: mvm: fix read in wake packet notification handler (git-fixes). - wifi: iwlwifi: mvm: validate SAR GEO response payload size (git-fixes). - wifi: brcmfmac: make release_scratchbuffers idempotent (git-fixes). - wifi: mac80211: recalculate TIM when a station enters power save (git-fixes). - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper (git-fixes). - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() (git-fixes). - wifi: mwifiex: bound uAP association event IEs to the event buffer (git-fixes). - wifi: wilc1000: validate assoc response length before subtracting header (git-fixes). - wifi: carl9170: fix buffer overflow in rx_stream failover path (git-fixes). - wifi: carl9170: fix OOB read from off-by-two in TX status handler (git-fixes). - wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read (git-fixes). - wifi: ath6kl: fix OOB read from firmware IE lengths in connect event (git-fixes). - wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler (git-fixes). - wifi: ath6kl: fix OOB access from firmware ADDBA window size (git-fixes). - wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes). - wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes). - wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() (git-fixes). - wifi: ath10k: fix skb leak on incomplete msdu during rx pop (git-fixes). - wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin (git-fixes). - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (git-fixes). - wifi: mac80211: tear down new links on vif update error path (git-fixes). - wan: wanxl: Only reset hardware after BAR mapping (git-fixes). - commit c34cf37 ++++ libpng16: - version update to 1.6.58 [jsc#PED-16190] * see rpm changelog below for CVE list fixed * see CHANGES for other upstream changes - deleted patches * libpng16-CVE-2025-28162,28164.patch (upstreamed) * libpng16-CVE-2025-64505.patch (upstreamed) * libpng16-CVE-2025-64506.patch (upstreamed) * libpng16-CVE-2025-64720.patch (upstreamed) * libpng16-CVE-2025-65018.patch (upstreamed) * libpng16-CVE-2025-66293-1.patch (upstreamed) * libpng16-CVE-2025-66293-2.patch (upstreamed) * libpng16-CVE-2026-22695.patch (upstreamed) * libpng16-CVE-2026-22801.patch (upstreamed) * libpng16-CVE-2026-25646.patch (upstreamed) * libpng16-CVE-2026-33416-1.patch (upstreamed) * libpng16-CVE-2026-33416-2.patch (upstreamed) * libpng16-CVE-2026-33416-3.patch (upstreamed) * libpng16-CVE-2026-33416-4.patch (upstreamed) * libpng16-CVE-2026-33636.patch (upstreamed) * libpng16-CVE-2026-34757.patch (upstreamed) ------------------------------------------------------------------ ------------------ 2026-7-23 - Jul 23 2026 ------------------- ------------------------------------------------------------------ ++++ ignition: - Add CVE-2026-39821.patch * Fixes [bsc#1266606] - Add CVE-2026-56852.patch * Fixes [bsc#1272059] ++++ kernel-default: - md raid: fix hang when stopping arrays with metadata through dm-raid (CVE-2026-43309 bsc#1264827). - commit fbea013 - ocfs2: fix reflink preserve cleanup issue (CVE-2026-43168 bsc#1264537). - commit 2cf917d - fat: avoid parent link count underflow in rmdir (CVE-2026-45915 bsc#1266896). - commit 64bf5e2 - dm cache: fix write hang in passthrough mode (CVE-2026-53063 bsc#1269659). - commit 4e00744 - dm cache: fix null-deref with concurrent writes in passthrough mode (CVE-2026-53064 bsc#1269132). - commit 240d70a - gfs2: fiemap page fault fix (CVE-2026-43262 bsc#1264422). - commit cecd528 - KVM: x86/mmu: Fix use-after-free on vendor module reload (git-fixes). - commit 9d0942d - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (git-fixes). - commit 3e9b7cc - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (git-fixes). - commit 0092018 - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug (git-fixes). - commit 6cb89dd - KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs (git-fixes). - commit 35b2b5c - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794 bsc#1271964). - commit e37fadd - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (CVE-2026-45873 bsc#1266715). - commit 4e7e6a6 - net: bridge: mcast: always update mdb_n_entries for vlan contexts (CVE-2026-45913 bsc#1266891). - commit fd06041 - vsock/virtio: fix skb overhead overflow on 32-bit builds (CVE-2026-53132 bsc#1269290). - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc (CVE-2026-53132 bsc#1269290). - vsock/virtio: fix potential unbounded skb queue (CVE-2026-53132 bsc#1269290). - commit 4abdbdc - NFSD: Fix SECINFO_NO_NAME decode error cleanup (CVE-2026-53398 bsc#1271870). - commit 5e66edf - ipvs: do not keep dest_dst if dev is going down (CVE-2026-45917 bsc#1266900). - commit 4346714 - netfilter: ipset: stop hash:* range iteration at end (CVE-2026-52921 bsc#1269024). - commit 16c4ac5 - xfrm: ah: account for ESN high bits in async callbacks (CVE-2026-46193 bsc#1267656). - commit 925dc95 - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() (git-fixes). - ASoC: cs35l56: Use complete_all() to signal init_completion (git-fixes). - ASoC: cs35l56: Fix potential probe() deadlock (git-fixes). - ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI (git-fixes). - ASoC: tas2781: bound firmware description string parsing (git-fixes). - ALSA: hda: codecs: hdmi: disable keep-alive before audio format change (git-fixes). - ALSA: hda: cs35l41: validate and free ACPI mute object (git-fixes). - ALSA: seq: close a re-opened queue timer in the destructor (git-fixes). - commit de83ac8 - drm/amd/display: Fix dc_link NULL handling in HPD init (bsc#1267678 CVE-2026-46245) - commit 17e0335 - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (CVE-2026-52998 bsc#1269118). - commit 2acdd19 - add bug number to existing mana change (bsc#1271349) - net: mana: Add Interrupt Moderation support (bsc#1271368). - commit 28aa8e3 ++++ kernel-rt: - md raid: fix hang when stopping arrays with metadata through dm-raid (CVE-2026-43309 bsc#1264827). - commit fbea013 - ocfs2: fix reflink preserve cleanup issue (CVE-2026-43168 bsc#1264537). - commit 2cf917d - fat: avoid parent link count underflow in rmdir (CVE-2026-45915 bsc#1266896). - commit 64bf5e2 - dm cache: fix write hang in passthrough mode (CVE-2026-53063 bsc#1269659). - commit 4e00744 - dm cache: fix null-deref with concurrent writes in passthrough mode (CVE-2026-53064 bsc#1269132). - commit 240d70a - gfs2: fiemap page fault fix (CVE-2026-43262 bsc#1264422). - commit cecd528 - KVM: x86/mmu: Fix use-after-free on vendor module reload (git-fixes). - commit 9d0942d - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (git-fixes). - commit 3e9b7cc - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (git-fixes). - commit 0092018 - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug (git-fixes). - commit 6cb89dd - KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs (git-fixes). - commit 35b2b5c - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794 bsc#1271964). - commit e37fadd - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (CVE-2026-45873 bsc#1266715). - commit 4e7e6a6 - net: bridge: mcast: always update mdb_n_entries for vlan contexts (CVE-2026-45913 bsc#1266891). - commit fd06041 - vsock/virtio: fix skb overhead overflow on 32-bit builds (CVE-2026-53132 bsc#1269290). - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc (CVE-2026-53132 bsc#1269290). - vsock/virtio: fix potential unbounded skb queue (CVE-2026-53132 bsc#1269290). - commit 4abdbdc - NFSD: Fix SECINFO_NO_NAME decode error cleanup (CVE-2026-53398 bsc#1271870). - commit 5e66edf - ipvs: do not keep dest_dst if dev is going down (CVE-2026-45917 bsc#1266900). - commit 4346714 - netfilter: ipset: stop hash:* range iteration at end (CVE-2026-52921 bsc#1269024). - commit 16c4ac5 - xfrm: ah: account for ESN high bits in async callbacks (CVE-2026-46193 bsc#1267656). - commit 925dc95 - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() (git-fixes). - ASoC: cs35l56: Use complete_all() to signal init_completion (git-fixes). - ASoC: cs35l56: Fix potential probe() deadlock (git-fixes). - ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI (git-fixes). - ASoC: tas2781: bound firmware description string parsing (git-fixes). - ALSA: hda: codecs: hdmi: disable keep-alive before audio format change (git-fixes). - ALSA: hda: cs35l41: validate and free ACPI mute object (git-fixes). - ALSA: seq: close a re-opened queue timer in the destructor (git-fixes). - commit de83ac8 - drm/amd/display: Fix dc_link NULL handling in HPD init (bsc#1267678 CVE-2026-46245) - commit 17e0335 - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (CVE-2026-52998 bsc#1269118). - commit 2acdd19 - add bug number to existing mana change (bsc#1271349) - net: mana: Add Interrupt Moderation support (bsc#1271368). - commit 28aa8e3 ++++ kernel-rt_debug: - md raid: fix hang when stopping arrays with metadata through dm-raid (CVE-2026-43309 bsc#1264827). - commit fbea013 - ocfs2: fix reflink preserve cleanup issue (CVE-2026-43168 bsc#1264537). - commit 2cf917d - fat: avoid parent link count underflow in rmdir (CVE-2026-45915 bsc#1266896). - commit 64bf5e2 - dm cache: fix write hang in passthrough mode (CVE-2026-53063 bsc#1269659). - commit 4e00744 - dm cache: fix null-deref with concurrent writes in passthrough mode (CVE-2026-53064 bsc#1269132). - commit 240d70a - gfs2: fiemap page fault fix (CVE-2026-43262 bsc#1264422). - commit cecd528 - KVM: x86/mmu: Fix use-after-free on vendor module reload (git-fixes). - commit 9d0942d - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (git-fixes). - commit 3e9b7cc - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (git-fixes). - commit 0092018 - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug (git-fixes). - commit 6cb89dd - KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs (git-fixes). - commit 35b2b5c - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794 bsc#1271964). - commit e37fadd - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (CVE-2026-45873 bsc#1266715). - commit 4e7e6a6 - net: bridge: mcast: always update mdb_n_entries for vlan contexts (CVE-2026-45913 bsc#1266891). - commit fd06041 - vsock/virtio: fix skb overhead overflow on 32-bit builds (CVE-2026-53132 bsc#1269290). - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc (CVE-2026-53132 bsc#1269290). - vsock/virtio: fix potential unbounded skb queue (CVE-2026-53132 bsc#1269290). - commit 4abdbdc - NFSD: Fix SECINFO_NO_NAME decode error cleanup (CVE-2026-53398 bsc#1271870). - commit 5e66edf - ipvs: do not keep dest_dst if dev is going down (CVE-2026-45917 bsc#1266900). - commit 4346714 - netfilter: ipset: stop hash:* range iteration at end (CVE-2026-52921 bsc#1269024). - commit 16c4ac5 - xfrm: ah: account for ESN high bits in async callbacks (CVE-2026-46193 bsc#1267656). - commit 925dc95 - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() (git-fixes). - ASoC: cs35l56: Use complete_all() to signal init_completion (git-fixes). - ASoC: cs35l56: Fix potential probe() deadlock (git-fixes). - ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI (git-fixes). - ASoC: tas2781: bound firmware description string parsing (git-fixes). - ALSA: hda: codecs: hdmi: disable keep-alive before audio format change (git-fixes). - ALSA: hda: cs35l41: validate and free ACPI mute object (git-fixes). - ALSA: seq: close a re-opened queue timer in the destructor (git-fixes). - commit de83ac8 - drm/amd/display: Fix dc_link NULL handling in HPD init (bsc#1267678 CVE-2026-46245) - commit 17e0335 - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (CVE-2026-52998 bsc#1269118). - commit 2acdd19 - add bug number to existing mana change (bsc#1271349) - net: mana: Add Interrupt Moderation support (bsc#1271368). - commit 28aa8e3 ++++ python311-core: - Add patch support-sphinx-9.patch: * Support changes required for Sphinx 9. ++++ python311: - Add patch support-sphinx-9.patch: * Support changes required for Sphinx 9. ------------------------------------------------------------------ ------------------ 2026-7-22 - Jul 22 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - nfsd: release layout stid on setlease failure (CVE-2026-53399 bsc#1271832). - commit 894f5ff - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391 bsc#1271904). - commit 226116c - NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392 bsc#1271826). - commit a486e59 - netfilter: nf_log: validate MAC header was set before dumping it (CVE-2026-52942 bsc#1268967). - commit 7058916 - netfilter: conntrack: remove sprintf usage (CVE-2026-53002 bsc#1269112). - commit ab4c172 - fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908 CVE-2026-53402) - commit 20ea755 - hwmon: occ: validate poll response sensor blocks (git-fixes). - hwmon: (asus-ec-sensors) add missed handle for ENOMEM (git-fixes). - hwmon: (asus-ec-sensors) fix EC read intervals (git-fixes). - hwmon: (asus-ec-sensors) fix looping over banks while reading from EC (git-fixes). - hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop (git-fixes). - hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop (git-fixes). - hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop (git-fixes). - commit 20039f1 - udp: clear skb->dev before running a sockmap verdict (CVE-2026-53184 bsc#1269689) - commit ad2be61 - ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275 bsc#1269810) - commit f6e6c61 - tcp: restrict SO_ATTACH_FILTER to priv users (CVE-2026-53236 bsc#1269994) - commit a1d9b37 - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR (CVE-2026-52937 bsc#1268983) - commit 36a07dd - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint (CVE-2026-52941 bsc#1268966) - commit 51e001c - netfilter: ebtables: fix OOB read in compat_mtw_from_user (CVE-2026-52927 bsc#1269027) - commit ca0f9a9 - bpf: Fix RCU stall in bpf_fd_array_map_clear() (CVE-2026-53083 bsc#1269964) - commit ac442ed - ipc/shm: serialize orphan cleanup with shm_nattch updates (CVE-2026-52930 bsc#1269003) - commit 27d8f0b ++++ kernel-rt: - nfsd: release layout stid on setlease failure (CVE-2026-53399 bsc#1271832). - commit 894f5ff - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391 bsc#1271904). - commit 226116c - NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392 bsc#1271826). - commit a486e59 - netfilter: nf_log: validate MAC header was set before dumping it (CVE-2026-52942 bsc#1268967). - commit 7058916 - netfilter: conntrack: remove sprintf usage (CVE-2026-53002 bsc#1269112). - commit ab4c172 - fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908 CVE-2026-53402) - commit 20ea755 - hwmon: occ: validate poll response sensor blocks (git-fixes). - hwmon: (asus-ec-sensors) add missed handle for ENOMEM (git-fixes). - hwmon: (asus-ec-sensors) fix EC read intervals (git-fixes). - hwmon: (asus-ec-sensors) fix looping over banks while reading from EC (git-fixes). - hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop (git-fixes). - hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop (git-fixes). - hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop (git-fixes). - commit 20039f1 - udp: clear skb->dev before running a sockmap verdict (CVE-2026-53184 bsc#1269689) - commit ad2be61 - ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275 bsc#1269810) - commit f6e6c61 - tcp: restrict SO_ATTACH_FILTER to priv users (CVE-2026-53236 bsc#1269994) - commit a1d9b37 - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR (CVE-2026-52937 bsc#1268983) - commit 36a07dd - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint (CVE-2026-52941 bsc#1268966) - commit 51e001c - netfilter: ebtables: fix OOB read in compat_mtw_from_user (CVE-2026-52927 bsc#1269027) - commit ca0f9a9 - bpf: Fix RCU stall in bpf_fd_array_map_clear() (CVE-2026-53083 bsc#1269964) - commit ac442ed - ipc/shm: serialize orphan cleanup with shm_nattch updates (CVE-2026-52930 bsc#1269003) - commit 27d8f0b ++++ kernel-rt_debug: - nfsd: release layout stid on setlease failure (CVE-2026-53399 bsc#1271832). - commit 894f5ff - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391 bsc#1271904). - commit 226116c - NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392 bsc#1271826). - commit a486e59 - netfilter: nf_log: validate MAC header was set before dumping it (CVE-2026-52942 bsc#1268967). - commit 7058916 - netfilter: conntrack: remove sprintf usage (CVE-2026-53002 bsc#1269112). - commit ab4c172 - fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908 CVE-2026-53402) - commit 20ea755 - hwmon: occ: validate poll response sensor blocks (git-fixes). - hwmon: (asus-ec-sensors) add missed handle for ENOMEM (git-fixes). - hwmon: (asus-ec-sensors) fix EC read intervals (git-fixes). - hwmon: (asus-ec-sensors) fix looping over banks while reading from EC (git-fixes). - hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop (git-fixes). - hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop (git-fixes). - hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop (git-fixes). - commit 20039f1 - udp: clear skb->dev before running a sockmap verdict (CVE-2026-53184 bsc#1269689) - commit ad2be61 - ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275 bsc#1269810) - commit f6e6c61 - tcp: restrict SO_ATTACH_FILTER to priv users (CVE-2026-53236 bsc#1269994) - commit a1d9b37 - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR (CVE-2026-52937 bsc#1268983) - commit 36a07dd - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint (CVE-2026-52941 bsc#1268966) - commit 51e001c - netfilter: ebtables: fix OOB read in compat_mtw_from_user (CVE-2026-52927 bsc#1269027) - commit ca0f9a9 - bpf: Fix RCU stall in bpf_fd_array_map_clear() (CVE-2026-53083 bsc#1269964) - commit ac442ed - ipc/shm: serialize orphan cleanup with shm_nattch updates (CVE-2026-52930 bsc#1269003) - commit 27d8f0b ++++ libssh: - Security fixes: * CVE-2026-59843: Denial of service via zero advertised channel packet size (bsc#1272164) * CVE-2026-59844: Denial of service via oversized SFTP read length (bsc#1272165) * CVE-2026-59845: Denial of service via unchecked ProxyCommand fork() failure (bsc#1272166) * CVE-2026-59846: Information disclosure via ProxyCommand %r username expansion (bsc#1272167) * CVE-2026-59847: Integrity downgrade via OpenSSL AES-GCM tag verification (bsc#1272168) * CVE-2026-59848: Denial of service via SFTP responses with unknown request IDs (bsc#1272169) * CVE-2026-59850: Use-after-free via data callbacks on closed channels (bsc#1272171) * Add patches: libssh-CVE-2026-59843.patch libssh-CVE-2026-59844.patch libssh-CVE-2026-59845.patch libssh-CVE-2026-59846-ssh_check_username_syntax.patch libssh-CVE-2026-59846.patch libssh-CVE-2026-59847.patch libssh-CVE-2026-59848.patch libssh-CVE-2026-59850.patch ++++ timezone: - Update to 2026c: * Alberta moved to permanent -06 on 2026-06-18. * Morocco moves to permanent +00 on 2026-09-20. * More integer overflow bugs have been fixed in zic. ++++ wget: - Fix metalink regression from CVE-2026-58469 fix See: commit 7b1cdecc49bc77bde220fc575c8a00386c3f3bcf from https://gitlab.com/gnuwget/wget [bsc#1272219, CVE-2026-58469] * CVE-2026-58469.patch ------------------------------------------------------------------ ------------------ 2026-7-21 - Jul 21 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397 bsc#1271869). - commit 307d387 - netfilter: nat: use kfree_rcu to release ops (CVE-2026-53000 bsc#1269117). - commit 896e79c - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (CVE-2026-52999 bsc#1269119). - commit 10c0e81 - ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270 bsc#1269240). - commit 1fbd319 - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (CVE-2026-52988 bsc#1269362). - commit 897bc30 - rculist: add list_splice_rcu() for private lists (CVE-2026-52988 bsc#1269362). - commit c893c75 - drm/amdgpu/vce: Prevent partial address patches (CVE-2026-53375 bsc#1271899). - commit 814f002 - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (CVE-2026-53134 bsc#1269819). - commit 6f4a353 - pmdomain: core: Fix detach procedure for virtual devices in genpd (CVE-2026-46292 bsc#1267943) - commit e37c2c7 - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (bsc#1271866). - commit 3cf3b58 ++++ kernel-rt: - nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397 bsc#1271869). - commit 307d387 - netfilter: nat: use kfree_rcu to release ops (CVE-2026-53000 bsc#1269117). - commit 896e79c - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (CVE-2026-52999 bsc#1269119). - commit 10c0e81 - ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270 bsc#1269240). - commit 1fbd319 - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (CVE-2026-52988 bsc#1269362). - commit 897bc30 - rculist: add list_splice_rcu() for private lists (CVE-2026-52988 bsc#1269362). - commit c893c75 - drm/amdgpu/vce: Prevent partial address patches (CVE-2026-53375 bsc#1271899). - commit 814f002 - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (CVE-2026-53134 bsc#1269819). - commit 6f4a353 - pmdomain: core: Fix detach procedure for virtual devices in genpd (CVE-2026-46292 bsc#1267943) - commit e37c2c7 - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (bsc#1271866). - commit 3cf3b58 ++++ kernel-rt_debug: - nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397 bsc#1271869). - commit 307d387 - netfilter: nat: use kfree_rcu to release ops (CVE-2026-53000 bsc#1269117). - commit 896e79c - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (CVE-2026-52999 bsc#1269119). - commit 10c0e81 - ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270 bsc#1269240). - commit 1fbd319 - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (CVE-2026-52988 bsc#1269362). - commit 897bc30 - rculist: add list_splice_rcu() for private lists (CVE-2026-52988 bsc#1269362). - commit c893c75 - drm/amdgpu/vce: Prevent partial address patches (CVE-2026-53375 bsc#1271899). - commit 814f002 - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (CVE-2026-53134 bsc#1269819). - commit 6f4a353 - pmdomain: core: Fix detach procedure for virtual devices in genpd (CVE-2026-46292 bsc#1267943) - commit e37c2c7 - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (bsc#1271866). - commit 3cf3b58 ++++ python-urllib3: - CVE-2026-9375: oversized Brotli payload via the streaming API can lead to a denial of service (bsc#1268683) * added CVE-2026-9375.patch ------------------------------------------------------------------ ------------------ 2026-7-20 - Jul 20 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185 bsc#1269660). - dm: fix a buffer overflow in ioctl processing (CVE-2026-46294 bsc#1267939). - commit 887c68f - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1271912 CVE-2026-64560 bsc#1273004). - posix-timers: Expand timer_arm() callbacks with a boolean return value (bsc#1271912). - posix-timers: Avoid direct access to hrtimer clockbase (bsc#1271912). - time: Switch to hrtimer_setup() (bsc#1271912). - posix-cpu-timers: Cleanup the firing logic (bsc#1271912). - posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del() (bsc#1271912). - posix-timers: Add proper state tracking (bsc#1271912). - commit 8edec16 - KVM: arm64: Create each pKVM hyp vcpu after its corresponding host vcpu (CVE-2026-46147 bsc#1267689). - commit 76bcefd - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CVE-2026-53230 bsc#1269270) - commit 60b0648 - RDMA/mlx5: Fix UMR hang in LAG error state unload (CVE-2026-45973 bsc#1267025) - commit 079b65a - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CVE-2026-46189 bsc#1266918) - commit b852540 - dm cache policy smq: check allocation under invalidate lock (git-fixes). - commit 0b92e17 - dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062 bsc#1269658). - commit df04273 - md: wake raid456 reshape waiters before suspend (CVE-2026-53123 bsc#1269643). - commit 4dd59b9 - KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() (CVE-2026-46147 bsc#1267689). - commit 398716c - KVM: arm64: Factor out pKVM hyp vcpu creation to separate function (CVE-2026-46147 bsc#1267689). - commit 77aa271 - l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (CVE-2026-53262 bsc#1270000). - commit 82efc48 - l2tp: refactor ppp socket/session relationship (CVE-2026-53262 bsc#1270000). - commit 3585258 - arm64: cputype: Add NVIDIA Olympus definitions (bsc#1266290 CVE-2025-10263 bsc#1270230 CVE-2026-53354) - commit 267a833 - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (bsc#1266290 CVE-2025-10263 bsc#1270230 CVE-2026-53354) - commit 912be6c - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (bsc#1266290 CVE-2025-10263 bsc#1270230 CVE-2026-53354) - commit 15d904a ++++ kernel-rt: - zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185 bsc#1269660). - dm: fix a buffer overflow in ioctl processing (CVE-2026-46294 bsc#1267939). - commit 887c68f - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1271912 CVE-2026-64560 bsc#1273004). - posix-timers: Expand timer_arm() callbacks with a boolean return value (bsc#1271912). - posix-timers: Avoid direct access to hrtimer clockbase (bsc#1271912). - time: Switch to hrtimer_setup() (bsc#1271912). - posix-cpu-timers: Cleanup the firing logic (bsc#1271912). - posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del() (bsc#1271912). - posix-timers: Add proper state tracking (bsc#1271912). - commit 8edec16 - KVM: arm64: Create each pKVM hyp vcpu after its corresponding host vcpu (CVE-2026-46147 bsc#1267689). - commit 76bcefd - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CVE-2026-53230 bsc#1269270) - commit 60b0648 - RDMA/mlx5: Fix UMR hang in LAG error state unload (CVE-2026-45973 bsc#1267025) - commit 079b65a - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CVE-2026-46189 bsc#1266918) - commit b852540 - dm cache policy smq: check allocation under invalidate lock (git-fixes). - commit 0b92e17 - dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062 bsc#1269658). - commit df04273 - md: wake raid456 reshape waiters before suspend (CVE-2026-53123 bsc#1269643). - commit 4dd59b9 - KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() (CVE-2026-46147 bsc#1267689). - commit 398716c - KVM: arm64: Factor out pKVM hyp vcpu creation to separate function (CVE-2026-46147 bsc#1267689). - commit 77aa271 - l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (CVE-2026-53262 bsc#1270000). - commit 82efc48 - l2tp: refactor ppp socket/session relationship (CVE-2026-53262 bsc#1270000). - commit 3585258 - arm64: cputype: Add NVIDIA Olympus definitions (bsc#1266290 CVE-2025-10263 bsc#1270230 CVE-2026-53354) - commit 267a833 - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (bsc#1266290 CVE-2025-10263 bsc#1270230 CVE-2026-53354) - commit 912be6c - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (bsc#1266290 CVE-2025-10263 bsc#1270230 CVE-2026-53354) - commit 15d904a ++++ kernel-rt_debug: - zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185 bsc#1269660). - dm: fix a buffer overflow in ioctl processing (CVE-2026-46294 bsc#1267939). - commit 887c68f - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1271912 CVE-2026-64560 bsc#1273004). - posix-timers: Expand timer_arm() callbacks with a boolean return value (bsc#1271912). - posix-timers: Avoid direct access to hrtimer clockbase (bsc#1271912). - time: Switch to hrtimer_setup() (bsc#1271912). - posix-cpu-timers: Cleanup the firing logic (bsc#1271912). - posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del() (bsc#1271912). - posix-timers: Add proper state tracking (bsc#1271912). - commit 8edec16 - KVM: arm64: Create each pKVM hyp vcpu after its corresponding host vcpu (CVE-2026-46147 bsc#1267689). - commit 76bcefd - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CVE-2026-53230 bsc#1269270) - commit 60b0648 - RDMA/mlx5: Fix UMR hang in LAG error state unload (CVE-2026-45973 bsc#1267025) - commit 079b65a - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CVE-2026-46189 bsc#1266918) - commit b852540 - dm cache policy smq: check allocation under invalidate lock (git-fixes). - commit 0b92e17 - dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062 bsc#1269658). - commit df04273 - md: wake raid456 reshape waiters before suspend (CVE-2026-53123 bsc#1269643). - commit 4dd59b9 - KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() (CVE-2026-46147 bsc#1267689). - commit 398716c - KVM: arm64: Factor out pKVM hyp vcpu creation to separate function (CVE-2026-46147 bsc#1267689). - commit 77aa271 - l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (CVE-2026-53262 bsc#1270000). - commit 82efc48 - l2tp: refactor ppp socket/session relationship (CVE-2026-53262 bsc#1270000). - commit 3585258 - arm64: cputype: Add NVIDIA Olympus definitions (bsc#1266290 CVE-2025-10263 bsc#1270230 CVE-2026-53354) - commit 267a833 - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (bsc#1266290 CVE-2025-10263 bsc#1270230 CVE-2026-53354) - commit 912be6c - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (bsc#1266290 CVE-2025-10263 bsc#1270230 CVE-2026-53354) - commit 15d904a ++++ openssl-3: - Security fix: (bsc#1271712) * "HollowByte" DoS via attacker-controlled memory allocation. * Grow the init_buf incrementally as we receive data. * Add openssl-HollowByte.patch ++++ runc: - update to 1.3.6 (bsc#1268275, CVE-2026-41579): * [CVE-2026-41579][] allowed a malicious image with a `/dev` symlink to have limited write access to the host filesystem in ways that our analysis indicates was too limited to be problematic in practice. This bug was very similar to those fixed in [CVE-2025-31133][], [CVE-2025-52565][], [CVE-2025-31133][] and was simply missed at the time when we hardened the rootfs preparation code. We have conducted a deeper audit and not found any other problematic cases. * Various integration test improvements. (#5222, #5237, #5226, [#5229], #5239, #5249, #5269, #5287, #5295, #5304) * When masking directories with `maskPaths`, runc will now re- use a single `tmpfs` instance (which is not writeable) to reduce the number `tmpfs` superblocks that need to be reaped when containers die (in particular, Kubernetes applies masks to per-CPU sysfs directories which get expensive quickly). - update to 1.3.5 * Recursive atime-related mount flags (rrelatime et al.) are now applied properly. (#5115, #5098) * PR #4757 caused a regression that resulted in spurious cannot start a container that has stopped errors when running runc create and has thus been reverted. (#5158, [#5153], #5151, #4645, #4757) * Updated builds to Go 1.25, libseccomp v2.6.0. (#5111, #5053) * Minor signing keyring updates. (#5146, #5139, #5144, #5148) ------------------------------------------------------------------ ------------------ 2026-7-19 - Jul 19 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - i2c: mediatek: fix WRRD for SoCs without auto_restart option (git-fixes). - i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() (git-fixes). - drm/amd/display: set new_stream to NULL after release (git-fixes). - drm/amdkfd: free MQD managers on DQM init failures (git-fixes). - drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) (git-fixes). - drm/i915/selftests: Fix GT PM sort comparators (git-fixes). - drm/i915/gt: use correct selftest config symbol (git-fixes). - drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker (git-fixes). - commit 709bfbf ++++ kernel-rt: - i2c: mediatek: fix WRRD for SoCs without auto_restart option (git-fixes). - i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() (git-fixes). - drm/amd/display: set new_stream to NULL after release (git-fixes). - drm/amdkfd: free MQD managers on DQM init failures (git-fixes). - drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) (git-fixes). - drm/i915/selftests: Fix GT PM sort comparators (git-fixes). - drm/i915/gt: use correct selftest config symbol (git-fixes). - drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker (git-fixes). - commit 709bfbf ++++ kernel-rt_debug: - i2c: mediatek: fix WRRD for SoCs without auto_restart option (git-fixes). - i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() (git-fixes). - drm/amd/display: set new_stream to NULL after release (git-fixes). - drm/amdkfd: free MQD managers on DQM init failures (git-fixes). - drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) (git-fixes). - drm/i915/selftests: Fix GT PM sort comparators (git-fixes). - drm/i915/gt: use correct selftest config symbol (git-fixes). - drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker (git-fixes). - commit 709bfbf ++++ net-tools: - Prevent denial of service via terminal escape sequences injection (bsc#1254323, gh#ecki/net-tools#57, CVE-2024-58251, net-tools-netstat-ansi-injection-1.patch, net-tools-netstat-ansi-injection-2.patch, net-tools-netstat-ansi-injection-3.patch). ------------------------------------------------------------------ ------------------ 2026-7-18 - Jul 18 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path (bsc#1264832 CVE-2026-43328). - commit 38197b6 - cpufreq: governor: Free dbs_data directly when gov->init() fails (bsc#1264832 CVE-2026-43328). - commit c8475c0 ++++ kernel-rt: - cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path (bsc#1264832 CVE-2026-43328). - commit 38197b6 - cpufreq: governor: Free dbs_data directly when gov->init() fails (bsc#1264832 CVE-2026-43328). - commit c8475c0 ++++ kernel-rt_debug: - cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path (bsc#1264832 CVE-2026-43328). - commit 38197b6 - cpufreq: governor: Free dbs_data directly when gov->init() fails (bsc#1264832 CVE-2026-43328). - commit c8475c0 ------------------------------------------------------------------ ------------------ 2026-7-17 - Jul 17 2026 ------------------- ------------------------------------------------------------------ ++++ avahi: - Add avahi-CVE-2025-59529.patch: limit the number of simple clients (bsc#1255451 CVE-2025-59529). ++++ glib2: - Add CVE fixes: + glib2-CVE-2026-58010.patch (bsc#1270009, CVE-2026-58010, glgo#GNOME/glib!5129) + glib2-CVE-2026-58011.patch (bsc#1270010, CVE-2026-58011, glgo#GNOME/glib!5131) + glib2-CVE-2026-58012-1.patch (bsc#1270016, CVE-2026-58012, glgo#GNOME/glib!5132) + glib2-CVE-2026-58012-2.patch (bsc#1270016, CVE-2026-58012, glgo#GNOME/glib!5133) + glib2-CVE-2026-58013.patch (bsc#1270018, CVE-2026-58013, glgo#GNOME/glib!5170) + glib2-CVE-2026-58014.patch (bsc#1270021, CVE-2026-58014, glgo#GNOME/glib!5171) + glib2-CVE-2026-58016.patch (bsc#1270008, CVE-2026-58016, glgo#GNOME/glib!5156) ++++ kernel-default: - i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring (git-fixes). - commit 4d0f600 - i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue (git-fixes). - commit 4132756 ++++ kernel-rt: - i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring (git-fixes). - commit 4d0f600 - i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue (git-fixes). - commit 4132756 ++++ kernel-rt_debug: - i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring (git-fixes). - commit 4d0f600 - i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue (git-fixes). - commit 4132756 ++++ multipath-tools: - Update to version 0.10.7~1+211+suse.18f1559: * Fix ALUA asymmetric access state descriptions in multipathd logs, so that the same terms are used as by the kernel ("lba-dependent", "transitioning"). * Don't set a hardware handler for bio-based multipath devices. The kernel rejects this anyway. * Fix WWID detection for legacy devices that use the older SCSI-2 VPD page 0x83 format for their device identifier. * kpartx: Fix an integer overflow in the GPT partition table size calculation. A crafted partition table with an extremely large number of partition entries could trigger the overflow. (bsc#1268145) * kpartx: Fix several issues in the DASD partition table reader that could be triggered by a maliciously crafted disk image. (bsc#1268144) * Fix duplicate "checker timed out" log messages when `log_checker_err` is set to `once`. (bsc#1254094) * Avoid potential buffer overflows in the iet and datacore prioritizers. * iet prioritizer: avoid misleading error message with systemd 256 and newer, and properly use udev to derive path parameters. (gh#opensvc/multipath-tools#145) ++++ policycoreutils: - Drop /tmp cleanup to avoid TOCTOU issues (bsc#1271645) - can be dropped once "policycoreutils/scripts/fixfiles: drop /tmp cleanup" is in the upstream release - Add patch: 1271645-drop-tmp-cleanup.patch ------------------------------------------------------------------ ------------------ 2026-7-16 - Jul 16 2026 ------------------- ------------------------------------------------------------------ ++++ gpg2: - Security fix: * CVE-2026-57062: CMS parsing in gpgsm mishandles the CMS format for AES-GCM (bsc#1269279) * Add gnupg-CVE-2026-57062.patch ++++ kernel-default: - xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (CVE-2026-53250 bsc#1269808). - commit 1b1f75e - fs/mbcache: cancel shrink work before destroying the cache (bsc#1269633 CVE-2026-53129). - commit 615aafe - Update patches.suse/bnxt_en-Fix-NULL-pointer-dereference.patch (bsc#1268307 CVE-2026-53177 bsc#1269383). - Update patches.suse/btrfs-reject-root-items-with-drop_progress-and-zero-.patch (git-fixes CVE-2026-43046 bsc#1264090). - Update patches.suse/crypto-authencesn-Do-not-place-hiseq-at-end-of-dst-f.patch (bsc#1262573 CVE-2026-31431 CVE-2026-43033 bsc#1264089). - Update patches.suse/msft-hv-3508-scsi-storvsc-Fix-scheduling-while-atomic-on-PREEMPT_.patch (git-fixes CVE-2026-43475 bsc#1264795). - Update patches.suse/msft-hv-3509-net-mana-Fix-double-destroy_workqueue-on-service-res.patch (git-fixes CVE-2026-43276 bsc#1264558). - Update patches.suse/msft-hv-3512-net-mana-Null-service_wq-on-setup-error-to-prevent-d.patch (git-fix CVE-2026-43440 bsc#1264779). - Update patches.suse/msft-hv-3525-net-mana-fix-use-after-free-in-add_adev-error-path.patch (git-fixes CVE-2026-43056 bsc#1264053). - Update patches.suse/msft-hv-3542-RDMA-mana_ib-Disable-RX-steering-on-RSS-QP-destroy.patch (bsc#1267682 CVE-2026-46084 bsc#1266758). - Update patches.suse/msft-hv-3552-net-mana-Use-pci_name-for-debugfs-directory-naming.patch (git-fixes CVE-2026-53324 bsc#1269512). - Update patches.suse/msft-hv-3566-net-mana-Guard-mana_remove-against-double-invocation.patch (git-fixes CVE-2026-53297 bsc#1269513). - Update patches.suse/msft-hv-3572-RDMA-mana-Validate-rx_hash_key_len.patch (git-fixes CVE-2026-46145 bsc#1267715). - Update patches.suse/msft-hv-3573-RDMA-mana-Remove-user-triggerable-WARN_ON-in-mana_ib.patch (git-fixes CVE-2026-46117 bsc#1267375). - Update patches.suse/msft-hv-3574-RDMA-mana-Fix-mana_destroy_wq_obj-cleanup-in-mana_ib.patch (git-fixes CVE-2026-46126 bsc#1267584). - Update patches.suse/msft-hv-3575-RDMA-mana-Fix-error-unwind-in-mana_ib_create_qp_rss.patch (git-fixes CVE-2026-46144 bsc#1266913). - Update patches.suse/net-gro-don-t-merge-zcopy-skbs.patch (git-fixes CVE-2026-46323 bsc#1268029). - Update patches.suse/ocfs2-fix-possible-deadlock-between-unlink-and-dio_e.patch (bsc#1258718 CVE-2026-31598 bsc#1263718). - Update patches.suse/ocfs2-split-transactions-in-dio-completion-to-avoid-.patch (bsc#1258718 CVE-2026-46080 bsc#1267596). - Update patches.suse/powerpc-eeh-fix-recursive-pci_lock_rescan_remove-locking-in-EEH-event-handling.patch (bsc#1253262 ltc#216029 CVE-2026-45904 bsc#1266890). - Update patches.suse/ptrace-slightly-saner-get_dumpable-logic.patch (bsc#1265308 CVE-2026-46333). - Update patches.suse/s390-entry-Scrub-r12-register-on-kernel-entry.patch (bsc#1263068 CVE-2026-31482 bsc#1262745). - Update patches.suse/s390-syscalls-Add-spectre-boundary-for-syscall-dispatch-table.patch (bsc#1263068 CVE-2026-31483 bsc#1262771). - Update patches.suse/smb-client-reject-userspace-cifs-spnego-descriptions.patch (bsc#1266238 CVE-2026-46243). - Update patches.suse/usb-ulpi-fix-memory-leak-on-ulpi_register-error-path.patch (CVE-2026-31759 bsc#1264076 CVE-2026-46109 bsc#1266850). - Update patches.suse/x86-CPU-AMD-Prevent-improper-isolation-of-shared-resources.patch (bsc#1264013 CVE-2025-54518 CVE-2026-46174 bsc#1267384). - Update patches.suse/x86-CPU-Fix-FPDSS-on-Zen1.patch (bsc#1243603 CVE-2023-2058 CVE-2026-31628 bsc#1263788). - Update patches.suse/x86-platform-uv-Handle-deconfigured-sockets.patch (bsc#1260347 CVE-2026-31542 bsc#1263010). - commit 8102903 - Update patches.suse/ACPI-processor-Fix-NULL-pointer-dereference-in-acpi_.patch (stable-fixes CVE-2026-43313 bsc#1264821). - Update patches.suse/ACPICA-Fix-NULL-pointer-dereference-in-acpi_ev_addre.patch (git-fixes CVE-2026-45982 bsc#1266872). - Update patches.suse/ALSA-6fire-fix-use-after-free-on-disconnect.patch (git-fixes CVE-2026-31581 bsc#1263167). - Update patches.suse/ALSA-PCM-Fix-wait-queue-list-corruption-in-snd_pcm_d.patch (git-fixes CVE-2026-53242 bsc#1269236). - Update patches.suse/ALSA-caiaq-fix-stack-out-of-bounds-read-in-init_card.patch (git-fixes CVE-2026-31778 bsc#1263923). - Update patches.suse/ALSA-caiaq-fix-usb_dev-refcount-leak-on-probe-failur.patch (git-fixes CVE-2026-46048 bsc#1267496). - Update patches.suse/ALSA-caiaq-take-a-reference-on-the-USB-device-in-cre.patch (git-fixes CVE-2026-31701 bsc#1263876). - Update patches.suse/ALSA-control-Validate-buf_len-before-strnlen-in-snd_.patch (git-fixes CVE-2026-46088 bsc#1267226). - Update patches.suse/ALSA-ctxfi-Add-fallback-to-default-RSR-for-S-PDIF.patch (git-fixes CVE-2026-46049 bsc#1267448). - Update patches.suse/ALSA-ctxfi-Fix-missing-SPDIFI1-index-handling.patch (stable-fixes CVE-2026-31776 bsc#1264035). - Update patches.suse/ALSA-fireworks-bound-device-supplied-status-before-s.patch (git-fixes CVE-2026-31619 bsc#1263806). - Update patches.suse/ALSA-timer-Fix-UAF-at-snd_timer_user_params.patch (stable-fixes CVE-2026-53192 bsc#1269669). - Update patches.suse/ALSA-usb-audio-Add-sanity-check-for-OOB-writes-at-si.patch (stable-fixes CVE-2026-43279 bsc#1264618). - Update patches.suse/ALSA-usb-audio-Avoid-potential-endless-loop-in-conve.patch (git-fixes CVE-2026-46146 bsc#1267571). - Update patches.suse/ALSA-usb-audio-Bound-MIDI-2.0-endpoint-descriptor-sc.patch (git-fixes CVE-2026-52964 bsc#1269178). - Update patches.suse/ALSA-usb-audio-Bound-MIDI-endpoint-descriptor-scans.patch (git-fixes CVE-2026-52963 bsc#1269177). - Update patches.suse/ALSA-usb-audio-Check-endpoint-numbers-at-parsing-Sca.patch (stable-fixes CVE-2026-43436 bsc#1264988). - Update patches.suse/ALSA-usb-audio-stop-parsing-UAC2-rates-at-MAX_NR_RAT.patch (git-fixes CVE-2026-46018 bsc#1266751). - Update patches.suse/APEI-GHES-ensure-that-won-t-go-past-CPER-allocated-r.patch (stable-fixes CVE-2026-43277 bsc#1264594). - Update patches.suse/ASoC-SOF-Don-t-allow-pointer-operations-on-unconfigu.patch (git-fixes CVE-2026-46179 bsc#1267719). - Update patches.suse/ASoC-SOF-Intel-hda-Fix-NULL-pointer-dereference.patch (stable-fixes CVE-2026-43137 bsc#1264564). - Update patches.suse/ASoC-SOF-ipc4-topology-Correct-the-allocation-size-f.patch (git-fixes CVE-2025-71286 bsc#1264615). - Update patches.suse/ASoC-amd-acp-mach-common-Add-missing-error-check-for.patch (git-fixes CVE-2026-43443 bsc#1264785). - Update patches.suse/ASoC-amd-acp3x-rt5682-max9836-Add-missing-error-chec.patch (git-fixes CVE-2026-43480 bsc#1265249). - Update patches.suse/ASoC-nau8821-Cancel-delayed-work-on-component-remove.patch (git-fixes CVE-2026-45963 bsc#1267021). - Update patches.suse/ASoC-qcom-q6apm-lpass-dai-Fix-multiple-graph-opens.patch (git-fixes CVE-2026-46143 bsc#1267712). - Update patches.suse/ASoC-qcom-q6apm-move-component-registration-to-unman.patch (git-fixes CVE-2026-31587 bsc#1263145). - Update patches.suse/ASoC-qcom-qdsp6-Fix-q6apm-remove-ordering-during-ADS.patch (git-fixes CVE-2026-43412 bsc#1265080). - Update patches.suse/ASoC-soc-core-flush-delayed-work-before-removing-DAI.patch (git-fixes CVE-2026-43459 bsc#1264768). - Update patches.suse/ASoC-sti-use-managed-regmap_field-allocations.patch (git-fixes CVE-2026-53065 bsc#1269661). - Update patches.suse/ASoC-wm_adsp-Fix-NULL-dereference-when-removing-firm.patch (git-fixes CVE-2026-53350 bsc#1270244). - Update patches.suse/Bluetooth-L2CAP-Fix-ERTM-re-init-and-zero-pdu_len-in.patch (git-fixes CVE-2026-31498 bsc#1262751). - Update patches.suse/Bluetooth-L2CAP-Fix-missing-key-size-check-for-L2CAP.patch (git-fixes CVE-2026-43134 bsc#1264308). - Update patches.suse/Bluetooth-L2CAP-Fix-null-ptr-deref-in-l2cap_sock_new.patch (git-fixes CVE-2026-45835 bsc#1266411). - Update patches.suse/Bluetooth-L2CAP-Fix-null-ptr-deref-in-l2cap_sock_sta.patch (git-fixes CVE-2026-45834 bsc#1266412). - Update patches.suse/Bluetooth-L2CAP-Fix-null-ptr-deref-on-l2cap_sock_rea.patch (git-fixes CVE-2026-31510 bsc#1262603). - Update patches.suse/Bluetooth-L2CAP-Fix-type-confusion-in-l2cap_ecred_re.patch (git-fixes CVE-2026-43062 bsc#1264197). - Update patches.suse/Bluetooth-L2CAP-reject-BR-EDR-signaling-packets-over.patch (stable-fixes CVE-2026-53208 bsc#1269899). - Update patches.suse/Bluetooth-L2CAP-use-chan-timer-to-close-channels-in-.patch (git-fixes CVE-2026-53358 bsc#1270260). - Update patches.suse/Bluetooth-MGMT-Fix-dangling-pointer-on-mgmt_add_adv_.patch (git-fixes CVE-2026-31511 bsc#1263020). - Update patches.suse/Bluetooth-MGMT-validate-LTK-enc_size-on-load.patch (git-fixes CVE-2026-43020 bsc#1264006). - Update patches.suse/Bluetooth-MGMT-validate-advertising-TLV-before-type-.patch (git-fixes CVE-2026-53255 bsc#1269378). - Update patches.suse/Bluetooth-MGMT-validate-mesh-send-advertising-payloa.patch (git-fixes CVE-2026-43017 bsc#1264009). - Update patches.suse/Bluetooth-RFCOMM-validate-skb-length-in-MCC-handlers.patch (git-fixes CVE-2026-53254 bsc#1269996). - Update patches.suse/Bluetooth-SMP-derive-legacy-responder-STK-authentica.patch (git-fixes CVE-2026-31773 bsc#1264039). - Update patches.suse/Bluetooth-btusb-clamp-SCO-altsetting-table-indices.patch (git-fixes CVE-2026-31497 bsc#1262992). - Update patches.suse/Bluetooth-hci_event-Fix-OOB-read-and-infinite-loop-i.patch (git-fixes CVE-2026-46138 bsc#1267649). - Update patches.suse/Bluetooth-hci_event-fix-potential-UAF-in-SSP-passkey.patch (git-fixes CVE-2026-46056 bsc#1267435). - Update patches.suse/Bluetooth-hci_event-fix-potential-UAF-in-hci_le_remo.patch (git-fixes CVE-2026-43018 bsc#1264008). - Update patches.suse/Bluetooth-hci_ldisc-Clear-HCI_UART_PROTO_INIT-on-err.patch (git-fixes CVE-2026-53073 bsc#1269682). - Update patches.suse/Bluetooth-hci_ll-Fix-firmware-leak-on-error-path.patch (git-fixes CVE-2026-43069 bsc#1264190). - Update patches.suse/Bluetooth-hci_sync-reject-oversized-Broadcast-Announ.patch (git-fixes CVE-2026-53209 bsc#1269304). - Update patches.suse/Bluetooth-hci_uart-fix-UAFs-and-race-conditions-in-c.patch (git-fixes CVE-2026-46275 bsc#1267968). - Update patches.suse/Bluetooth-virtio_bt-validate-rx-pkt_type-header-leng.patch (git-fixes CVE-2026-46186 bsc#1266917). - Update patches.suse/HID-alps-fix-NULL-pointer-dereference-in-alps_raw_ev.patch (git-fixes CVE-2026-31625 bsc#1263030). - Update patches.suse/HID-apple-avoid-memory-leak-in-apple_report_fixup.patch (stable-fixes CVE-2026-31520 bsc#1262653). - Update patches.suse/HID-asus-avoid-memory-leak-in-asus_report_fixup.patch (stable-fixes CVE-2026-31524 bsc#1262605). - Update patches.suse/HID-core-clamp-report_size-in-s32ton-to-avoid-undefi.patch (stable-fixes CVE-2026-31624 bsc#1263657). - Update patches.suse/HID-hid-pl-handle-probe-errors.patch (git-fixes CVE-2026-43152 bsc#1264331). - Update patches.suse/HID-logitech-hidpp-Check-maxfield-in-hidpp_get_repor.patch (stable-fixes CVE-2026-43136 bsc#1264540). - Update patches.suse/HID-magicmouse-Do-not-crash-on-missing-msc-input.patch (stable-fixes CVE-2026-43140 bsc#1264630). - Update patches.suse/HID-magicmouse-avoid-memory-leak-in-magicmouse_repor.patch (stable-fixes CVE-2026-31522 bsc#1262637). - Update patches.suse/HID-multitouch-Check-to-ensure-report-responses-matc.patch (stable-fixes CVE-2026-43047 bsc#1264073). - Update patches.suse/HID-playstation-Add-missing-check-for-input_ff_creat.patch (git-fixes CVE-2026-45969 bsc#1266743). - Update patches.suse/HID-playstation-Clamp-num_touch_reports.patch (git-fixes CVE-2026-46232 bsc#1267669). - Update patches.suse/HID-prodikeys-Check-presence-of-pm-input_ep82.patch (stable-fixes CVE-2026-43251 bsc#1264423). - Update patches.suse/HID-roccat-fix-use-after-free-in-roccat_report_event.patch (stable-fixes CVE-2026-43111 bsc#1264480). - Update patches.suse/HID-usbhid-fix-deadlock-in-hid_post_reset.patch (git-fixes CVE-2026-53037 bsc#1269081). - Update patches.suse/HID-wacom-fix-out-of-bounds-read-in-wacom_intuos_bt_.patch (stable-fixes CVE-2026-43051 bsc#1264065). - Update patches.suse/Input-uinput-fix-circular-locking-dependency-with-ff.patch (git-fixes CVE-2026-31667 bsc#1263139). - Update patches.suse/KVM-SVM-Inject-UD-for-INVLPGA-if-EFER.SVME-0.patch (git-fixes CVE-2026-46082 bsc#1267473). - Update patches.suse/KVM-nSVM-Always-use-vmcb01-in-VMLOAD-VMSAVE-emulatio.patch (git-fixes CVE-2026-43133 bsc#1264640). - Update patches.suse/KVM-x86-check-for-nEPT-nNPT-in-slow-flush-hypercalls.patch (git-fixes CVE-2026-46131 bsc#1267636). - Update patches.suse/NFC-nxp-nci-allow-GPIOs-to-sleep.patch (git-fixes CVE-2026-31545 bsc#1263013). - Update patches.suse/NFC-pn533-bound-the-UART-receive-buffer.patch (git-fixes CVE-2026-43032 bsc#1263999). - Update patches.suse/PCI-Fix-pci_slot_trylock-error-handling.patch (git-fixes CVE-2026-43211 bsc#1264387). - Update patches.suse/PCI-P2PDMA-Release-per-CPU-pgmap-ref-when-vm_insert_.patch (git-fixes CVE-2026-45880 bsc#1268223). - Update patches.suse/PCI-endpoint-Fix-swapped-parameters-in-pci_-primary-.patch (git-fixes CVE-2026-43200 bsc#1264431). - Update patches.suse/PCI-endpoint-pci-epf-ntb-Remove-duplicate-resource-t.patch (git-fixes CVE-2026-46009 bsc#1266684). - Update patches.suse/Revert-PCI-IOV-Add-PCI-rescan-remove-locking-when-en.patch (git-fixes CVE-2026-43147 bsc#1264642). - Update patches.suse/Revert-hwmon-ibmpex-fix-use-after-free-in-high-low-s.patch (git-fixes CVE-2026-45914 bsc#1266884). - Update patches.suse/USB-core-Limit-the-length-of-unkillable-synchronous-.patch (git-fixes CVE-2026-43428 bsc#1265138). - Update patches.suse/USB-dummy-hcd-Fix-interrupt-synchronization-error.patch (git-fixes CVE-2026-43324 bsc#1264803). - Update patches.suse/USB-dummy-hcd-Fix-locking-synchronization-error.patch (git-fixes CVE-2026-43327 bsc#1265078). - Update patches.suse/USB-serial-io_ti-fix-heap-overflow-in-build_i2c_fw_h.patch (git-fixes CVE-2026-53195 bsc#1269984). - Update patches.suse/USB-serial-kl5kusb105-fix-bulk-out-buffer-overflow.patch (git-fixes CVE-2026-53194 bsc#1269904). - Update patches.suse/USB-usbtmc-Use-usb_bulk_msg_killable-with-user-speci.patch (git-fixes CVE-2026-43429 bsc#1265054). - Update patches.suse/X.509-Fix-out-of-bounds-access-when-parsing-extensio.patch (git-fixes CVE-2026-31430 bsc#1262391). - Update patches.suse/accel-qaic-Handle-DBC-deactivation-if-the-owner-went.patch (git-fixes CVE-2026-43007 bsc#1264019). - Update patches.suse/agp-amd64-Fix-broken-error-propagation-in-agp_amd64_.patch (git-fixes CVE-2026-53325 bsc#1269726). - Update patches.suse/atm-fore200e-fix-use-after-free-in-tasklets-during-d.patch (git-fixes CVE-2026-43203 bsc#1264600). - Update patches.suse/batman-adv-Avoid-double-rtnl_lock-ELP-metric-worker.patch (git-fixes CVE-2026-43382 bsc#1265047). - Update patches.suse/batman-adv-bla-only-purge-non-released-claims.patch (git-fixes CVE-2026-46233 bsc#1267701). - Update patches.suse/batman-adv-bla-prevent-use-after-free-when-deleting-.patch (git-fixes CVE-2026-46212 bsc#1267693). - Update patches.suse/batman-adv-bla-put-backbone-reference-on-failed-clai.patch (git-fixes CVE-2026-46231 bsc#1267565). - Update patches.suse/batman-adv-clear-current-gateway-during-teardown.patch (git-fixes CVE-2026-52926 bsc#1269025). - Update patches.suse/batman-adv-dat-handle-forward-allocation-error.patch (git-fixes CVE-2026-52922 bsc#1269030). - Update patches.suse/batman-adv-fix-fragment-reassembly-length-accounting.patch (git-fixes CVE-2026-52914 bsc#1268986). - Update patches.suse/batman-adv-fix-integer-overflow-on-buff_pos.patch (git-fixes CVE-2026-46198 bsc#1266854). - Update patches.suse/batman-adv-fix-tp_meter-counter-underflow-during-shu.patch (git-fixes CVE-2026-52919 bsc#1269031). - Update patches.suse/batman-adv-frag-disallow-unicast-fragment-in-fragmen.patch (git-fixes CVE-2026-52916 bsc#1269002). - Update patches.suse/batman-adv-hold-claim-backbone-gateways-by-reference.patch (git-fixes CVE-2026-31657 bsc#1263175). - Update patches.suse/batman-adv-reject-new-tp_meter-sessions-during-teard.patch (git-fixes CVE-2026-46206 bsc#1266834). - Update patches.suse/batman-adv-reject-oversized-global-TT-response-buffe.patch (git-fixes CVE-2026-31659 bsc#1263495). - Update patches.suse/batman-adv-stop-caching-unowned-originator-pointers-.patch (git-fixes CVE-2026-46238 bsc#1266846). - Update patches.suse/batman-adv-tp_meter-avoid-use-of-uninit-sender-vars.patch (git-fixes CVE-2026-52931 bsc#1269008). - Update patches.suse/btrfs-fix-zero-size-inode-with-non-zero-size-after-l.patch (git-fixes CVE-2026-43118 bsc#1264417). - Update patches.suse/btrfs-tracepoints-get-correct-superblock-from-dentry-in-ev.patch (bsc#1257777 CVE-2026-43117 bsc#1264414). - Update patches.suse/can-isotp-fix-tx.buf-use-after-free-in-isotp_sendmsg.patch (git-fixes CVE-2026-31474 bsc#1262723). - Update patches.suse/can-raw-fix-ro-uniq-use-after-free-in-raw_rcv.patch (git-fixes CVE-2026-31532 bsc#1262757). - Update patches.suse/can-ucan-fix-devres-lifetime.patch (git-fixes CVE-2026-46103 bsc#1267555). - Update patches.suse/clk-qcom-gfx3d-add-parent-to-parent-request-map.patch (git-fixes CVE-2026-46247 bsc#1267666). - Update patches.suse/comedi-Reinit-dev-spinlock-between-attachments-to-lo.patch (git-fixes CVE-2026-43340 bsc#1265096). - Update patches.suse/comedi-dt2815-add-hardware-detection-to-prevent-cras.patch (stable-fixes CVE-2026-31751 bsc#1264044). - Update patches.suse/comedi-me4000-Fix-potential-overrun-of-firmware-buff.patch (git-fixes CVE-2026-31747 bsc#1264101). - Update patches.suse/comedi-me_daq-Fix-potential-overrun-of-firmware-buff.patch (git-fixes CVE-2026-31748 bsc#1264100). - Update patches.suse/comedi-ni_atmio16d-Fix-invalid-clean-up-after-failed.patch (git-fixes CVE-2026-31749 bsc#1264075). - Update patches.suse/crypto-af-alg-fix-NULL-pointer-dereference-in-scatte.patch (git-fixes CVE-2026-43043 bsc#1264088). - Update patches.suse/crypto-atmel-aes-Fix-3-page-memory-leak-in-atmel_aes.patch (git-fixes CVE-2026-46019 bsc#1266732). - Update patches.suse/crypto-atmel-sha204a-Fix-potential-UAF-and-memory-le.patch (git-fixes CVE-2026-46075 bsc#1267367). - Update patches.suse/crypto-atmel-tdes-fix-DMA-sync-direction.patch (git-fixes CVE-2026-46077 bsc#1267466). - Update patches.suse/crypto-authencesn-reject-short-ahash-digests-during-.patch (git-fixes CVE-2026-46033 bsc#1266692). - Update patches.suse/crypto-ccree-fix-a-memory-leak-in-cc_mac_digest.patch (git-fixes CVE-2026-45986 bsc#1266739). - Update patches.suse/crypto-jitterentropy-replace-long-held-spinlock-with.patch (git-fixes CVE-2026-52936 bsc#1268981). - Update patches.suse/crypto-pcrypt-Fix-handling-of-MAY_BACKLOG-requests.patch (git-fixes CVE-2026-43493 bsc#1265627). - Update patches.suse/dmaengine-idxd-Fix-leaking-event-log-memory.patch (git-fixes CVE-2026-31440 bsc#1262658). - Update patches.suse/dmaengine-idxd-Fix-memory-leak-when-a-wq-is-reset.patch (git-fixes CVE-2026-31441 bsc#1262659). - Update patches.suse/dmaengine-idxd-Fix-not-releasing-workqueue-on-.relea.patch (git-fixes CVE-2026-43064 bsc#1264189). - Update patches.suse/dmaengine-xilinx-xdma-Fix-regmap-init-error-handling.patch (git-fixes CVE-2026-31439 bsc#1262639). - Update patches.suse/drm-Account-property-blob-allocations-to-memcg.patch (stable-fixes CVE-2026-43287 bsc#1265037). - Update patches.suse/drm-amd-display-Avoid-NULL-dereference-in-dc_dmub_sr.patch (git-fixes CVE-2026-53313 bsc#1269719). - Update patches.suse/drm-amd-display-Clamp-HDMI-HDCP2-rx_id_list-read-to-.patch (git-fixes CVE-2026-53137 bsc#1269796). - Update patches.suse/drm-amd-display-Clamp-VBIOS-HDMI-retimer-register-co.patch (stable-fixes CVE-2026-53136 bsc#1269811). - Update patches.suse/drm-amd-display-Fix-NULL-deref-and-buffer-over-read-.patch (git-fixes CVE-2026-53135 bsc#1269817). - Update patches.suse/drm-amd-display-Use-krealloc_array-in-dal_vector_res.patch (git-fixes CVE-2026-53329 bsc#1270058). - Update patches.suse/drm-amdgpu-Add-bounds-checking-to-ib_-get-set-_value.patch (stable-fixes CVE-2026-46218 bsc#1267632). - Update patches.suse/drm-amdgpu-Fix-fence-put-before-wait-in-amdgpu_amdkf.patch (git-fixes CVE-2026-31566 bsc#1263055). - Update patches.suse/drm-amdgpu-Fix-memory-leak-in-amdgpu_acpi_enumerate_.patch (git-fixes CVE-2026-45947 bsc#1267198). - Update patches.suse/drm-amdgpu-Fix-memory-leak-in-amdgpu_ras_init.patch (git-fixes CVE-2026-45976 bsc#1267027). - Update patches.suse/drm-amdgpu-Fix-use-after-free-race-in-VM-acquire.patch (stable-fixes CVE-2026-43370 bsc#1264782). - Update patches.suse/drm-amdgpu-fix-AMDGPU_INFO_READ_MMR_REG.patch (git-fixes CVE-2026-53293 bsc#1269898). - Update patches.suse/drm-amdgpu-fix-sync-handling-in-amdgpu_dma_buf_move_.patch (git-fixes CVE-2026-43318 bsc#1264991). - Update patches.suse/drm-amdgpu-fix-zero-size-GDS-range-init-on-RDNA4.patch (stable-fixes CVE-2026-46276 bsc#1267922). - Update patches.suse/drm-amdgpu-sdma4-replace-BUG_ON-with-WARN_ON-in-fenc.patch (git-fixes CVE-2026-46220 bsc#1267704). - Update patches.suse/drm-amdgpu-vcn3-Prevent-OOB-reads-when-parsing-dec-m.patch (stable-fixes CVE-2026-46230 bsc#1267623). - Update patches.suse/drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-IB.patch (stable-fixes CVE-2026-46204 bsc#1267661). - Update patches.suse/drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-dec-m.patch (stable-fixes CVE-2026-46199 bsc#1267638). - Update patches.suse/drm-amdkfd-Fix-buffer-overflow-in-SDMA-queue-checkpo.patch (git-fixes CVE-2026-53143 bsc#1269652). - Update patches.suse/drm-amdkfd-fix-NULL-dereference-in-get_queue_ids.patch (git-fixes CVE-2026-53144 bsc#1269245). - Update patches.suse/drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch (stable-fixes CVE-2026-43269 bsc#1264590). - Update patches.suse/drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch (stable-fixes CVE-2026-43236 bsc#1264538). - Update patches.suse/drm-bridge-cadence-cdns-mhdp8546-core-Set-the-mhdp-c.patch (git-fixes CVE-2026-53058 bsc#1269684). - Update patches.suse/drm-bridge-samsung-dsim-Fix-memory-leak-in-error-pat.patch (git-fixes CVE-2026-43397 bsc#1264668). - Update patches.suse/drm-buddy-Prevent-BUG_ON-by-validating-rounded-alloc.patch (git-fixes CVE-2026-43169 bsc#1264379). - Update patches.suse/drm-display-dp_mst-Add-protection-against-0-vcpi.patch (stable-fixes CVE-2025-71305 bsc#1266762). - Update patches.suse/drm-gma500-oaktrail_lvds-fix-hang-on-init-failure.patch (git-fixes CVE-2026-53279 bsc#1269505). - Update patches.suse/drm-i915-gem-Fix-phys-BO-pread-pwrite-with-offset.patch (git-fixes CVE-2026-53356 bsc#1270112). - Update patches.suse/drm-i915-gt-Check-set_default_submission-before-defe.patch (git-fixes CVE-2026-31540 bsc#1263011). - Update patches.suse/drm-ioc32-stop-speculation-on-the-drm_compat_ioctl-p.patch (git-fixes CVE-2026-31781 bsc#1264033). - Update patches.suse/drm-komeda-fix-integer-overflow-in-AFBC-framebuffer-.patch (git-fixes CVE-2026-53068 bsc#1269410). - Update patches.suse/drm-msm-dpu-fix-mismatch-between-power-and-frequency.patch (git-fixes CVE-2026-53056 bsc#1269403). - Update patches.suse/drm-nouveau-fix-u32-overflow-in-pushbuf-reloc-bounds.patch (git-fixes CVE-2026-46006 bsc#1267479). - Update patches.suse/drm-sun4i-backend-fix-error-pointer-dereference.patch (git-fixes CVE-2026-53066 bsc#1269187). - Update patches.suse/drm-v3d-Set-DMA-segment-size-to-avoid-debug-warnings.patch (stable-fixes CVE-2026-43302 bsc#1265102). - Update patches.suse/drm-vc4-Fix-a-memory-leak-in-hang-state-error-path.patch (git-fixes CVE-2026-43104 bsc#1264247). - Update patches.suse/drm-vc4-Fix-memory-leak-of-BO-array-in-hang-state.patch (git-fixes CVE-2026-43105 bsc#1264237). - Update patches.suse/drm-vc4-fix-krealloc-memory-leak.patch (git-fixes CVE-2026-53213 bsc#1269283). - Update patches.suse/drm-vc4-platform_get_irq_byname-returns-an-int.patch (stable-fixes CVE-2026-43072 bsc#1264451). - Update patches.suse/drm-virtio-Fix-driver-removal-with-disabled-KMS.patch (git-fixes CVE-2026-53347 bsc#1270241). - Update patches.suse/drm-virtio-fix-dma_fence-refcount-leak-on-error-in-v.patch (git-fixes CVE-2026-53190 bsc#1269772). - Update patches.suse/efi-Fix-reservation-of-unaccepted-memory-table.patch (git-fixes CVE-2026-45851 bsc#1266688). - Update patches.suse/efi-capsule-loader-fix-incorrect-sizeof-in-phys-arra.patch (git-fixes CVE-2026-53047 bsc#1269644). - Update patches.suse/ext4-reject-mount-if-bigalloc-with-s_first_data_bloc.patch (git-fixes CVE-2026-31447 bsc#1262614). - Update patches.suse/fbcon-check-return-value-of-con2fb_acquire_newinfo.patch (git-fixes CVE-2026-43123 bsc#1264598). - Update patches.suse/fbdev-au1200fb-Fix-a-memory-leak-in-au1200fb_drv_pro.patch (git-fixes CVE-2026-45954 bsc#1266939). - Update patches.suse/fbdev-of-display_timing-fix-refcount-leak-in-of_get_.patch (git-fixes CVE-2026-43264 bsc#1264424). - Update patches.suse/fbdev-tdfxfb-avoid-divide-by-zero-on-FBIOPUT_VSCREEN.patch (stable-fixes CVE-2026-31618 bsc#1263785). - Update patches.suse/fbdev-udlfb-add-vm_ops-to-dlfb_ops_mmap-to-prevent-u.patch (stable-fixes CVE-2026-43497 bsc#1266003). - Update patches.suse/fbdev-udlfb-avoid-divide-by-zero-on-FBIOPUT_VSCREENI.patch (git-fixes CVE-2026-31605 bsc#1263493). - Update patches.suse/fbdev-vt8500lcdfb-fix-missing-dma_free_coherent.patch (git-fixes CVE-2026-43202 bsc#1264336). - Update patches.suse/gpio-mvebu-fix-NULL-pointer-dereference-in-suspend-r.patch (git-fixes CVE-2026-53237 bsc#1269131). - Update patches.suse/gpio-omap-do-not-register-driver-in-probe.patch (git-fixes CVE-2026-31687 bsc#1263598). - Update patches.suse/hwmon-occ-Fix-division-by-zero-in-occ_show_power_1.patch (git-fixes CVE-2026-31770 bsc#1264142). - Update patches.suse/hwmon-pmbus-q54sj108a2-fix-stack-overflow-in-debugfs.patch (git-fixes CVE-2026-43380 bsc#1264780). - Update patches.suse/i2c-cp2615-fix-serial-string-NULL-deref-at-probe.patch (git-fixes CVE-2026-31549 bsc#1263025). - Update patches.suse/i2c-dev-prevent-integer-overflow-in-I2C_TIMEOUT-ioct.patch (stable-fixes CVE-2026-52948 bsc#1269116). - Update patches.suse/i2c-qcom-cci-Fix-NULL-pointer-dereference-in-cci_rem.patch (git-fixes CVE-2026-53339 bsc#1270248). - Update patches.suse/i2c-s3c24xx-check-the-size-of-the-SMBUS-message-befo.patch (stable-fixes CVE-2026-31627 bsc#1263786). - Update patches.suse/iio-adc-ti-adc161s626-use-DMA-safe-memory-for-spi_re.patch (git-fixes CVE-2026-31768 bsc#1264125). - Update patches.suse/iio-chemical-sps30_i2c-fix-buffer-size-in-sps30_i2c_.patch (git-fixes CVE-2026-43476 bsc#1265257). - Update patches.suse/iio-gyro-mpu3050-Fix-incorrect-free_irq-variable.patch (git-fixes CVE-2026-31763 bsc#1263975). - Update patches.suse/iio-gyro-mpu3050-Fix-irq-resource-leak.patch (git-fixes CVE-2026-31762 bsc#1264048). - Update patches.suse/iio-gyro-mpu3050-Move-iio_device_register-to-correct.patch (git-fixes CVE-2026-31761 bsc#1264122). - Update patches.suse/iio-gyro-mpu3050-core-fix-pm_runtime-error-handling.patch (git-fixes CVE-2026-43357 bsc#1264809). - Update patches.suse/iio-sca3000-Fix-a-resource-leak-in-sca3000_probe.patch (git-fixes CVE-2026-45883 bsc#1266774). - Update patches.suse/ima-verify-the-previous-kernel-s-IMA-buffer-lies-in-a.patch (CVE-2026-43240 bsc#1264386 CVE-2026-43129 bsc#1264553). - Update patches.suse/iommu-amd-serialize-sequence-allocation-under-concur.patch (git-fixes CVE-2026-43220 bsc#1264416). - Update patches.suse/ipmi-Add-limits-to-event-and-receive-message-request.patch (git-fixes CVE-2026-46177 bsc#1267725). - Update patches.suse/ipmi-Check-event-message-buffer-response-for-bad-dat.patch (git-fixes CVE-2026-46128 bsc#1267643). - Update patches.suse/ipmi-ipmb-initialise-event-handler-read-bytes.patch (git-fixes CVE-2026-43221 bsc#1264442). - Update patches.suse/ipmi-si-Return-state-to-normal-if-message-allocation.patch (git-fixes CVE-2026-46108 bsc#1267615). - Update patches.suse/ipv4-account-for-fraggap-on-the-paged-allocation-path.patch (git-fixes CVE-2026-53366 bsc#1271366). - Update patches.suse/media-amphion-Fix-race-between-m2m-job_abort-and-dev.patch (git-fixes CVE-2026-46058 bsc#1266677). - Update patches.suse/media-as102-fix-to-not-free-memory-after-the-device-.patch (git-fixes CVE-2026-31578 bsc#1263075). - Update patches.suse/media-ccs-Avoid-possible-division-by-zero.patch (git-fixes CVE-2026-43182 bsc#1264340). - Update patches.suse/media-cx23885-Add-missing-unmap-in-snd_cx23885_hw_pa.patch (git-fixes CVE-2026-43135 bsc#1264613). - Update patches.suse/media-cx25821-Fix-a-resource-leak-in-cx25821_dev_set.patch (stable-fixes CVE-2026-43183 bsc#1264620). - Update patches.suse/media-cx88-Add-missing-unmap-in-snd_cx88_hw_params.patch (git-fixes CVE-2026-43257 bsc#1264296). - Update patches.suse/media-em28xx-fix-use-after-free-in-em28xx_v4l2_open.patch (git-fixes CVE-2026-31583 bsc#1263173). - Update patches.suse/media-hackrf-fix-to-not-free-memory-after-the-device.patch (git-fixes CVE-2026-31576 bsc#1263073). - Update patches.suse/media-i2c-ov5647-Initialize-subdev-before-controls.patch (git-fixes CVE-2026-43312 bsc#1265101). - Update patches.suse/media-i2c-tw9903-Fix-potential-memory-leak-in-tw9903.patch (git-fixes CVE-2026-43218 bsc#1264479). - Update patches.suse/media-i2c-tw9906-Fix-potential-memory-leak-in-tw9906.patch (git-fixes CVE-2026-43246 bsc#1264322). - Update patches.suse/media-mtk-jpeg-fix-use-after-free-in-release-path-du.patch (git-fixes CVE-2026-46011 bsc#1267491). - Update patches.suse/media-mtk-mdp-Fix-a-reference-leak-bug-in-mtk_mdp_re.patch (git-fixes CVE-2026-43270 bsc#1264313). - Update patches.suse/media-mtk-mdp-Fix-error-handling-in-probe-function.patch (git-fixes CVE-2026-43207 bsc#1264365). - Update patches.suse/media-pvrusb2-fix-URB-leak-in-pvr2_send_request_ex.patch (stable-fixes CVE-2026-43223 bsc#1264645). - Update patches.suse/media-qcom-camss-vfe-Fix-out-of-bounds-access-in-vfe.patch (git-fixes CVE-2026-43256 bsc#1264425). - Update patches.suse/media-radio-keene-fix-memory-leak-in-error-path.patch (git-fixes CVE-2026-43231 bsc#1264592). - Update patches.suse/media-rc-xbox_remote-heed-DMA-restrictions.patch (git-fixes CVE-2026-46236 bsc#1266910). - Update patches.suse/media-saa7164-add-ioremap-return-checks-and-cleanups.patch (git-fixes CVE-2026-46235 bsc#1267702). - Update patches.suse/media-solo6x10-Check-for-out-of-bounds-chip_id.patch (stable-fixes CVE-2026-43316 bsc#1264826). - Update patches.suse/media-videobuf2-Set-vma_flags-in-vb2_dma_sg_mmap.patch (git-fixes CVE-2026-46312 bsc#1267990). - Update patches.suse/media-vidtv-fix-NULL-pointer-dereference-in-vidtv_ch.patch (git-fixes CVE-2026-31599 bsc#1263031). - Update patches.suse/media-vidtv-fix-nfeeds-state-corruption-on-start_str.patch (git-fixes CVE-2026-31585 bsc#1263134). - Update patches.suse/media-vidtv-fix-pass-by-value-structs-causing-MSAN-w.patch (git-fixes CVE-2026-43058 bsc#1264129). - Update patches.suse/memory-tegra124-emc-Fix-dll_change-check.patch (git-fixes CVE-2026-53045 bsc#1269404). - Update patches.suse/mfd-arizona-Fix-regulator-resource-leak-on-wm5102_cl.patch (git-fixes CVE-2026-45875 bsc#1266707). - Update patches.suse/mfd-core-Add-locking-around-mfd_of_node_list.patch (git-fixes CVE-2026-43143 bsc#1264388). - Update patches.suse/misc-bcm_vk-Fix-possible-null-pointer-dereferences-i.patch (stable-fixes CVE-2025-71291 bsc#1264560). - Update patches.suse/misc-fastrpc-Fix-NULL-pointer-dereference-in-rpmsg-c.patch (git-fixes CVE-2026-53158 bsc#1269385). - Update patches.suse/misc-fastrpc-fix-DMA-address-corruption-due-to-find_.patch (git-fixes CVE-2026-53159 bsc#1269654). - Update patches.suse/misc-fastrpc-fix-use-after-free-of-fastrpc_user-in-w.patch (git-fixes CVE-2026-53161 bsc#1269255). - Update patches.suse/misc-fastrpc-fix-use-after-free-race-in-fastrpc_map_.patch (git-fixes CVE-2026-53160 bsc#1269670). - Update patches.suse/misc-fastrpc-possible-double-free-of-cctx-remote_hea.patch (git-fixes CVE-2026-31730 bsc#1264041). - Update patches.suse/mmc-vub300-fix-NULL-deref-on-disconnect.patch (git-fixes CVE-2026-31651 bsc#1263111). - Update patches.suse/mtd-docg3-fix-use-after-free-in-docg3_release.patch (git-fixes CVE-2026-46285 bsc#1267948). - Update patches.suse/mtd-parsers-Fix-memory-leak-in-mtd_parser_tplink_saf.patch (git-fixes CVE-2026-45921 bsc#1266806). - Update patches.suse/net-mlx5-Fix-crash-when-moving-to-switchdev-mode.patch (git-fixes CVE-2026-43467 bsc#1264791). - Update patches.suse/net-nfc-nci-Fix-parameter-validation-for-packet-data.patch (git-fixes CVE-2026-43291 bsc#1264819). - Update patches.suse/net-sched-cls_fw-fix-NULL-dereference-of-old-filters-befor.patch (git-fixes CVE-2026-53080 bsc#1269141). - Update patches.suse/net-usb-catc-enable-basic-endpoint-checking.patch (git-fixes CVE-2026-45923 bsc#1266894). - Update patches.suse/net-usb-cdc-phonet-fix-skb-frags-overflow-in-rx_comp.patch (git-fixes CVE-2026-31623 bsc#1263778). - Update patches.suse/net-usb-kaweth-remove-TX-queue-manipulation-in-kawet.patch (git-fixes CVE-2026-43180 bsc#1265093). - Update patches.suse/net-usb-pegasus-enable-basic-endpoint-checking.patch (git-fixes CVE-2026-43156 bsc#1265092). - Update patches.suse/net-usb-rtl8150-fix-use-after-free-in-rtl8150_start_.patch (git-fixes CVE-2026-52982 bsc#1269258). - Update patches.suse/net-wan-farsync-Fix-use-after-free-bugs-caused-by-un.patch (git-fixes CVE-2026-43232 bsc#1264633). - Update patches.suse/net-wan-fsl_ucc_hdlc-Fix-dma_free_coherent-in-uhdlc_.patch (git-fixes CVE-2026-43149 bsc#1264315). - Update patches.suse/net-x25-Fix-potential-double-free-of-skb.patch (git-fixes CVE-2026-43011 bsc#1264079). - Update patches.suse/nfc-hci-shdlc-Stop-timers-and-work-before-freeing-co.patch (git-fixes CVE-2026-46267 bsc#1267630). - Update patches.suse/nfc-nci-fix-circular-locking-dependency-in-nci_close.patch (git-fixes CVE-2026-31509 bsc#1263097). - Update patches.suse/nfc-pn533-allocate-rx-skb-before-consuming-bytes.patch (git-fixes CVE-2026-31660 bsc#1263539). - Update patches.suse/nfc-s3fwrn5-allocate-rx-skb-before-consuming-bytes.patch (git-fixes CVE-2026-43098 bsc#1264257). - Update patches.suse/nouveau-dpcd-return-EBUSY-for-aux-xfer-if-the-device.patch (git-fixes CVE-2026-43381 bsc#1265105). - Update patches.suse/ntb-ntb_hw_switchtec-Fix-array-index-out-of-bounds-a.patch (stable-fixes CVE-2026-43241 bsc#1264844). - Update patches.suse/ntb-ntb_hw_switchtec-Fix-shift-out-of-bounds-for-0-m.patch (stable-fixes CVE-2026-43141 bsc#1264626). - Update patches.suse/nvmet-tcp-propagate-nvmet_tcp_build_pdu_iovec-errors.patch (git-fixes CVE-2026-52989 bsc#1269364). - Update patches.suse/openvswitch-vport-fix-self-deadlock-on-release-of-tunnel-p.patch (CVE-2026-31678 bsc#1263562 CVE-2026-46165 bsc#1266836). - Update patches.suse/pinctrl-single-fix-refcount-leak-in-pcs_add_gpio_fun.patch (git-fixes CVE-2026-45868 bsc#1266741). - Update patches.suse/platform-x86-dell-wmi-sysman-bound-enumeration-strin.patch (git-fixes CVE-2026-53022 bsc#1269153). - Update patches.suse/power-supply-ab8500-Fix-use-after-free-in-power_supp.patch (git-fixes CVE-2026-45946 bsc#1268221). - Update patches.suse/power-supply-act8945a-Fix-use-after-free-in-power_su.patch (git-fixes CVE-2026-45867 bsc#1268220). - Update patches.suse/power-supply-bq256xx-Fix-use-after-free-in-power_sup.patch (git-fixes CVE-2026-45902 bsc#1266886). - Update patches.suse/power-supply-bq25980-Fix-use-after-free-in-power_sup.patch (git-fixes CVE-2026-45879 bsc#1266703). - Update patches.suse/power-supply-cpcap-battery-Fix-use-after-free-in-pow.patch (git-fixes CVE-2026-45885 bsc#1266780). - Update patches.suse/power-supply-goldfish-Fix-use-after-free-in-power_su.patch (git-fixes CVE-2026-45936 bsc#1266947). - Update patches.suse/power-supply-rt9455-Fix-use-after-free-in-power_supp.patch (git-fixes CVE-2026-46270 bsc#1267680). - Update patches.suse/power-supply-sbs-battery-Fix-use-after-free-in-power.patch (git-fixes CVE-2026-45916 bsc#1266679). - Update patches.suse/power-supply-wm97xx-Fix-NULL-pointer-dereference-in-.patch (git-fixes CVE-2026-45869 bsc#1266467). - Update patches.suse/rapidio-replace-rio_free_net-with-kfree-in-rio_scan_.patch (git-fixes CVE-2026-43295 bsc#1265100). - Update patches.suse/regulator-core-fix-locking-in-regulator_resolve_supp.patch (git-fixes CVE-2026-46252 bsc#1267676). - Update patches.suse/remoteproc-xlnx-Only-access-buffer-information-if-IP.patch (git-fixes CVE-2026-46016 bsc#1266729). - Update patches.suse/rpmsg-core-fix-race-in-driver_override_show-and-use-.patch (git-fixes CVE-2025-71274 bsc#1264377). - Update patches.suse/sched-rt-Skip-currently-executing-CPU-in-rto_next_cpu.patch (bsc#1262649 CVE-2026-45919 bsc#1266777). - Update patches.suse/sctp-disable-BH-before-calling-udp_tunnel_xmit_skb.patch (CVE-2026-23276 bsc#1260012 CVE-2026-53070 bsc#1269674). - Update patches.suse/serial-8250-Fix-TX-deadlock-when-using-DMA.patch (git-fixes CVE-2026-43061 bsc#1264188). - Update patches.suse/soc-mediatek-svs-Fix-memory-leak-in-svs_enable_debug.patch (git-fixes CVE-2026-45881 bsc#1266721). - Update patches.suse/soc-ti-k3-socinfo-Fix-regmap-leak-on-probe-failure.patch (git-fixes CVE-2026-43242 bsc#1264338). - Update patches.suse/soc-ti-pruss-Fix-double-free-in-pruss_clk_mux_setup.patch (git-fixes CVE-2026-43196 bsc#1264436). - Update patches.suse/sound-ua101-fix-division-by-zero-at-probe.patch (git-fixes CVE-2026-46184 bsc#1266864). - Update patches.suse/spi-imx-fix-use-after-free-on-unbind.patch (git-fixes CVE-2026-45996 bsc#1267436). - Update patches.suse/spi-mpc52xx-fix-use-after-free-on-unbind.patch (git-fixes CVE-2026-46219 bsc#1267667). - Update patches.suse/spi-rspi-fix-controller-deregistration.patch (git-fixes CVE-2026-46225 bsc#1267627). - Update patches.suse/spi-spi-fsl-lpspi-fix-teardown-order-issue-UAF.patch (git-fixes CVE-2026-31485 bsc#1262768). - Update patches.suse/spi-wpcm-fiu-Fix-potential-NULL-pointer-dereference-.patch (git-fixes CVE-2026-46261 bsc#1267646). - Update patches.suse/staging-media-atomisp-Disallow-all-private-IOCTLs.patch (git-fixes CVE-2026-46205 bsc#1266908). - Update patches.suse/staging-rtl8723bs-fix-memory-leak-on-failure-path.patch (stable-fixes CVE-2026-43225 bsc#1264526). - Update patches.suse/staging-rtl8723bs-fix-null-dereference-in-find_netwo.patch (git-fixes CVE-2026-43159 bsc#1264616). - Update patches.suse/staging-rtl8723bs-initialize-le_tmp64-in-rtw_BIP_ver.patch (git-fixes CVE-2026-31626 bsc#1263782). - Update patches.suse/staging-rtl8723bs-properly-validate-the-data-in-rtw_.patch (stable-fixes CVE-2026-43387 bsc#1265032). - Update patches.suse/staging-sm750fb-fix-division-by-zero-in-ps_to_hz.patch (git-fixes CVE-2026-31603 bsc#1263491). - Update patches.suse/thunderbolt-Bound-root-directory-content-to-block-si.patch (git-fixes CVE-2026-53149 bsc#1269733). - Update patches.suse/thunderbolt-Clamp-XDomain-response-data-copy-to-allo.patch (git-fixes CVE-2026-53148 bsc#1269786). - Update patches.suse/thunderbolt-Limit-XDomain-response-copy-to-actual-fr.patch (git-fixes CVE-2026-53146 bsc#1269826). - Update patches.suse/thunderbolt-Reject-zero-length-property-entries-in-v.patch (git-fixes CVE-2026-53150 bsc#1269386). - Update patches.suse/thunderbolt-Validate-XDomain-request-packet-size-bef.patch (git-fixes CVE-2026-53147 bsc#1269709). - Update patches.suse/tpm-st33zp24-Fix-missing-cleanup-on-get_burstcount-e.patch (git-fixes CVE-2026-45871 bsc#1266755). - Update patches.suse/tpm-tpm_i2c_infineon-Fix-locality-leak-on-get_burstc.patch (git-fixes CVE-2026-45941 bsc#1266920). - Update patches.suse/usb-cdns3-fix-role-switching-during-resume.patch (git-fixes CVE-2026-45911 bsc#1266898). - Update patches.suse/usb-cdns3-gadget-fix-NULL-pointer-dereference-in-ep_.patch (git-fixes CVE-2026-31755 bsc#1264071). - Update patches.suse/usb-cdns3-gadget-fix-state-inconsistency-on-gadget-i.patch (git-fixes CVE-2026-31754 bsc#1264074). - Update patches.suse/usb-class-cdc-wdm-fix-reordering-issue-in-read-code-.patch (git-fixes CVE-2026-43427 bsc#1264746). - Update patches.suse/usb-dwc2-gadget-Fix-spin_lock-unlock-mismatch-in-dwc.patch (git-fixes CVE-2026-31756 bsc#1264070). - Update patches.suse/usb-gadget-f_ncm-validate-minimum-block_len-in-ncm_u.patch (git-fixes CVE-2026-31617 bsc#1263780). - Update patches.suse/usb-gadget-f_phonet-fix-skb-frags-overflow-in-pn_rx_.patch (stable-fixes CVE-2026-31616 bsc#1263777). - Update patches.suse/usb-gadget-f_rndis-Protect-RNDIS-options-with-mutex.patch (git-fixes CVE-2026-43342 bsc#1264758). - Update patches.suse/usb-gadget-f_subset-Fix-unbalanced-refcnt-in-geth_fr.patch (git-fixes CVE-2026-43343 bsc#1264816). - Update patches.suse/usb-gadget-f_uac1_legacy-validate-control-request-si.patch (stable-fixes CVE-2026-31720 bsc#1264110). - Update patches.suse/usb-gadget-renesas_usb3-validate-endpoint-index-in-s.patch (git-fixes CVE-2026-31615 bsc#1263776). - Update patches.suse/usb-gadget-u_ether-Fix-NULL-pointer-deref-in-eth_get.patch (git-fixes CVE-2026-31727 bsc#1263904). - Update patches.suse/usb-gadget-u_ether-Fix-race-between-gether_disconnec.patch (git-fixes CVE-2026-31728 bsc#1263911). - Update patches.suse/usb-gadget-uvc-fix-NULL-pointer-dereference-during-u.patch (git-fixes CVE-2026-31726 bsc#1263905). - Update patches.suse/usb-image-mdc800-kill-download-URB-on-timeout.patch (stable-fixes CVE-2026-43425 bsc#1265133). - Update patches.suse/usb-renesas_usbhs-fix-use-after-free-in-ISR-during-d.patch (git-fixes CVE-2026-43426 bsc#1265074). - Update patches.suse/usb-usblp-fix-heap-leak-in-IEEE-1284-device-ID-via-s.patch (stable-fixes CVE-2026-46151 bsc#1267728). - Update patches.suse/usb-usblp-fix-uninitialized-heap-leak-via-LPGETSTATU.patch (stable-fixes CVE-2026-46167 bsc#1266832). - Update patches.suse/usb-xhci-Fix-memory-leak-in-xhci_disable_slot.patch (git-fixes CVE-2026-43432 bsc#1264783). - Update patches.suse/usb-xhci-Prevent-interrupt-storm-on-host-controller-.patch (stable-fixes CVE-2026-43488 bsc#1265264). - Update patches.suse/usb-yurex-fix-race-in-probe.patch (stable-fixes CVE-2026-43430 bsc#1264677). - Update patches.suse/wifi-ath5k-do-not-access-array-OOB.patch (git-fixes CVE-2026-46307 bsc#1267987). - Update patches.suse/wifi-b43-enforce-bounds-check-on-firmware-key-index-.patch (git-fixes CVE-2026-46122 bsc#1267583). - Update patches.suse/wifi-b43legacy-enforce-bounds-check-on-firmware-key-.patch (git-fixes CVE-2026-46163 bsc#1266863). - Update patches.suse/wifi-brcmfmac-Fix-error-pointer-dereference.patch (git-fixes CVE-2026-53093 bsc#1269414). - Update patches.suse/wifi-brcmsmac-Fix-dma_free_coherent-size.patch (git-fixes CVE-2026-31661 bsc#1263128). - Update patches.suse/wifi-cfg80211-cancel-pmsr_free_wk-in-cfg80211_pmsr_w.patch (git-fixes CVE-2026-31548 bsc#1263008). - Update patches.suse/wifi-iwlwifi-mvm-fix-potential-out-of-bounds-read-in.patch (git-fixes CVE-2026-31779 bsc#1264030). - Update patches.suse/wifi-libertas-fix-WARNING-in-usb_tx_block.patch (stable-fixes CVE-2026-43255 bsc#1264473). - Update patches.suse/wifi-mac80211-Fix-static_branch_dec-underflow-for-aq.patch (git-fixes CVE-2026-31551 bsc#1263014). - Update patches.suse/wifi-mac80211-drop-stray-static-from-fast-RX-rx_resu.patch (git-fixes CVE-2026-46152 bsc#1266855). - Update patches.suse/wifi-mac80211-remove-station-if-connection-prep-fail.patch (git-fixes CVE-2026-46125 bsc#1266879). - Update patches.suse/wifi-mt76-mt7915-fix-use-after-free-bugs-in-mt7915_m.patch (git-fixes CVE-2026-53098 bsc#1269976). - Update patches.suse/wifi-mt76-mt7921-fix-a-potential-clc-buffer-length-u.patch (git-fixes CVE-2026-46136 bsc#1266831). - Update patches.suse/wifi-rsi-fix-kthread-lifetime-race-between-self-exit.patch (git-fixes CVE-2026-46187 bsc#1266842). - Update patches.suse/wifi-rt2x00usb-fix-devres-lifetime.patch (git-fixes CVE-2026-31672 bsc#1263142). - Update patches.suse/wifi-rtlwifi-pci-fix-possible-use-after-free-caused-.patch (git-fixes CVE-2026-53112 bsc#1269998). - Update patches.suse/wifi-rtw88-8822b-Avoid-WARNING-in-rtw8822b_config_tr.patch (stable-fixes CVE-2025-71297 bsc#1264830). - Update patches.suse/wifi-rtw88-check-for-PCI-upstream-bridge-existence.patch (git-fixes CVE-2026-46092 bsc#1267595). - Update patches.suse/wifi-rtw88-fix-device-leak-on-probe-failure.patch (git-fixes CVE-2026-31604 bsc#1263045). - Update patches.suse/wifi-wilc1000-fix-u8-overflow-in-SSID-scan-buffer-si.patch (git-fixes CVE-2026-31780 bsc#1264032). - Update patches.suse/wifi-wl1251-validate-packet-IDs-before-indexing-tx_f.patch (stable-fixes CVE-2026-43113 bsc#1264637). - Update patches.suse/wifi-wlcore-Return-ENOMEM-instead-of-EAGAIN-if-there.patch (git-fixes CVE-2026-31552 bsc#1263016). - commit 9043982 - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239 bsc#1269677). - commit e28f7cf - netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268 bsc#1269257). - commit 2c13e43 - vsock/virtio: fix empty payload in tap skb for non-linear buffers (CVE-2026-46207 bsc#1267691). - commit fadb0f2 - vsock/virtio: fix length and offset in tap skb for split packets (CVE-2026-46207 bsc#1267691). - commit 1ce6ee2 - fbcon: Avoid OOB font access if console rotation fails (bsc#1267690 CVE-2026-46191) - commit e1c5dbc - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() (CVE-2026-53262 bsc#1270000). - commit a2b7211 - net: bcmgenet: move DESC_INDEX flow to ring 0 (CVE-2026-53086 bsc#1269537). - Refresh patches.suse/net-bcmgenet-fix-racing-timeout-handler.patch. - commit 21ba2b5 - net: bcmgenet: Reset RBUF on first open (CVE-2026-53086 bsc#1269537). - commit 9f413dc - net: bcmgenet: Remove TX ring full logging (CVE-2026-53086 bsc#1269537). - commit cf56f3c - netfilter: nft_ct: fix missing expect put in obj eval (CVE-2026-52970 bsc#1269229) - commit 6dc70e5 - netfilter: nft_tunnel: fix use-after-free on object destroy (CVE-2026-53212 bsc#1269672) - commit 184d0a8 - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush (CVE-2026-53175 bsc#1269714) - commit 8254a3f - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() (CVE-2026-53221 bsc#1269318) - commit f10b90f - ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006 bsc#1269104) - commit 9185932 - nexthop: fix IPv6 route referencing IPv4 nexthop (CVE-2026-53012 bsc#1269154) - commit 870437e - net: tls: fix strparser anchor skb leak on offload RX setup failure (CVE-2026-52974 bsc#1269233) - commit cbb91a9 - net/sched: netem: fix queue limit check to include reordered packets (CVE-2026-52984 bsc#1269272) - commit e5127d0 - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011 bsc#1269094) - commit 830fab6 - flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306 bsc#1267986) - commit 8b2c29d - vsock: fix buffer size clamping order (CVE-2026-46234 bsc#1266904) - commit 2c62c8b - HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (CVE-2026-45877 bsc#1266468) - commit 71aacb8 - HID: Intel-ish-hid: Ishtp: Fix sensor reads after ACPI S3 suspend (bsc#1266468) - commit 190ec15 - tcp: call sk_data_ready() after listener migration (CVE-2026-46015 bsc#1267439) - commit 869d8b9 - neigh: let neigh_xmit take skb ownership (CVE-2026-52981 bsc#1269254) - commit 97ed52e - ibmasm: fix heap over-read in ibmasm_send_i2o_message() (CVE-2026-46064 bsc#1267497) - commit a2c2ee6 - kcm: fix zero-frag skb in frag_list on partial sendmsg error (CVE-2026-43244 bsc#1264321). - commit 5b27b10 ++++ kernel-rt: - xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (CVE-2026-53250 bsc#1269808). - commit 1b1f75e - fs/mbcache: cancel shrink work before destroying the cache (bsc#1269633 CVE-2026-53129). - commit 615aafe - Update patches.suse/bnxt_en-Fix-NULL-pointer-dereference.patch (bsc#1268307 CVE-2026-53177 bsc#1269383). - Update patches.suse/btrfs-reject-root-items-with-drop_progress-and-zero-.patch (git-fixes CVE-2026-43046 bsc#1264090). - Update patches.suse/crypto-authencesn-Do-not-place-hiseq-at-end-of-dst-f.patch (bsc#1262573 CVE-2026-31431 CVE-2026-43033 bsc#1264089). - Update patches.suse/msft-hv-3508-scsi-storvsc-Fix-scheduling-while-atomic-on-PREEMPT_.patch (git-fixes CVE-2026-43475 bsc#1264795). - Update patches.suse/msft-hv-3509-net-mana-Fix-double-destroy_workqueue-on-service-res.patch (git-fixes CVE-2026-43276 bsc#1264558). - Update patches.suse/msft-hv-3512-net-mana-Null-service_wq-on-setup-error-to-prevent-d.patch (git-fix CVE-2026-43440 bsc#1264779). - Update patches.suse/msft-hv-3525-net-mana-fix-use-after-free-in-add_adev-error-path.patch (git-fixes CVE-2026-43056 bsc#1264053). - Update patches.suse/msft-hv-3542-RDMA-mana_ib-Disable-RX-steering-on-RSS-QP-destroy.patch (bsc#1267682 CVE-2026-46084 bsc#1266758). - Update patches.suse/msft-hv-3552-net-mana-Use-pci_name-for-debugfs-directory-naming.patch (git-fixes CVE-2026-53324 bsc#1269512). - Update patches.suse/msft-hv-3566-net-mana-Guard-mana_remove-against-double-invocation.patch (git-fixes CVE-2026-53297 bsc#1269513). - Update patches.suse/msft-hv-3572-RDMA-mana-Validate-rx_hash_key_len.patch (git-fixes CVE-2026-46145 bsc#1267715). - Update patches.suse/msft-hv-3573-RDMA-mana-Remove-user-triggerable-WARN_ON-in-mana_ib.patch (git-fixes CVE-2026-46117 bsc#1267375). - Update patches.suse/msft-hv-3574-RDMA-mana-Fix-mana_destroy_wq_obj-cleanup-in-mana_ib.patch (git-fixes CVE-2026-46126 bsc#1267584). - Update patches.suse/msft-hv-3575-RDMA-mana-Fix-error-unwind-in-mana_ib_create_qp_rss.patch (git-fixes CVE-2026-46144 bsc#1266913). - Update patches.suse/net-gro-don-t-merge-zcopy-skbs.patch (git-fixes CVE-2026-46323 bsc#1268029). - Update patches.suse/ocfs2-fix-possible-deadlock-between-unlink-and-dio_e.patch (bsc#1258718 CVE-2026-31598 bsc#1263718). - Update patches.suse/ocfs2-split-transactions-in-dio-completion-to-avoid-.patch (bsc#1258718 CVE-2026-46080 bsc#1267596). - Update patches.suse/powerpc-eeh-fix-recursive-pci_lock_rescan_remove-locking-in-EEH-event-handling.patch (bsc#1253262 ltc#216029 CVE-2026-45904 bsc#1266890). - Update patches.suse/ptrace-slightly-saner-get_dumpable-logic.patch (bsc#1265308 CVE-2026-46333). - Update patches.suse/s390-entry-Scrub-r12-register-on-kernel-entry.patch (bsc#1263068 CVE-2026-31482 bsc#1262745). - Update patches.suse/s390-syscalls-Add-spectre-boundary-for-syscall-dispatch-table.patch (bsc#1263068 CVE-2026-31483 bsc#1262771). - Update patches.suse/smb-client-reject-userspace-cifs-spnego-descriptions.patch (bsc#1266238 CVE-2026-46243). - Update patches.suse/usb-ulpi-fix-memory-leak-on-ulpi_register-error-path.patch (CVE-2026-31759 bsc#1264076 CVE-2026-46109 bsc#1266850). - Update patches.suse/x86-CPU-AMD-Prevent-improper-isolation-of-shared-resources.patch (bsc#1264013 CVE-2025-54518 CVE-2026-46174 bsc#1267384). - Update patches.suse/x86-CPU-Fix-FPDSS-on-Zen1.patch (bsc#1243603 CVE-2023-2058 CVE-2026-31628 bsc#1263788). - Update patches.suse/x86-platform-uv-Handle-deconfigured-sockets.patch (bsc#1260347 CVE-2026-31542 bsc#1263010). - commit 8102903 - Update patches.suse/ACPI-processor-Fix-NULL-pointer-dereference-in-acpi_.patch (stable-fixes CVE-2026-43313 bsc#1264821). - Update patches.suse/ACPICA-Fix-NULL-pointer-dereference-in-acpi_ev_addre.patch (git-fixes CVE-2026-45982 bsc#1266872). - Update patches.suse/ALSA-6fire-fix-use-after-free-on-disconnect.patch (git-fixes CVE-2026-31581 bsc#1263167). - Update patches.suse/ALSA-PCM-Fix-wait-queue-list-corruption-in-snd_pcm_d.patch (git-fixes CVE-2026-53242 bsc#1269236). - Update patches.suse/ALSA-caiaq-fix-stack-out-of-bounds-read-in-init_card.patch (git-fixes CVE-2026-31778 bsc#1263923). - Update patches.suse/ALSA-caiaq-fix-usb_dev-refcount-leak-on-probe-failur.patch (git-fixes CVE-2026-46048 bsc#1267496). - Update patches.suse/ALSA-caiaq-take-a-reference-on-the-USB-device-in-cre.patch (git-fixes CVE-2026-31701 bsc#1263876). - Update patches.suse/ALSA-control-Validate-buf_len-before-strnlen-in-snd_.patch (git-fixes CVE-2026-46088 bsc#1267226). - Update patches.suse/ALSA-ctxfi-Add-fallback-to-default-RSR-for-S-PDIF.patch (git-fixes CVE-2026-46049 bsc#1267448). - Update patches.suse/ALSA-ctxfi-Fix-missing-SPDIFI1-index-handling.patch (stable-fixes CVE-2026-31776 bsc#1264035). - Update patches.suse/ALSA-fireworks-bound-device-supplied-status-before-s.patch (git-fixes CVE-2026-31619 bsc#1263806). - Update patches.suse/ALSA-timer-Fix-UAF-at-snd_timer_user_params.patch (stable-fixes CVE-2026-53192 bsc#1269669). - Update patches.suse/ALSA-usb-audio-Add-sanity-check-for-OOB-writes-at-si.patch (stable-fixes CVE-2026-43279 bsc#1264618). - Update patches.suse/ALSA-usb-audio-Avoid-potential-endless-loop-in-conve.patch (git-fixes CVE-2026-46146 bsc#1267571). - Update patches.suse/ALSA-usb-audio-Bound-MIDI-2.0-endpoint-descriptor-sc.patch (git-fixes CVE-2026-52964 bsc#1269178). - Update patches.suse/ALSA-usb-audio-Bound-MIDI-endpoint-descriptor-scans.patch (git-fixes CVE-2026-52963 bsc#1269177). - Update patches.suse/ALSA-usb-audio-Check-endpoint-numbers-at-parsing-Sca.patch (stable-fixes CVE-2026-43436 bsc#1264988). - Update patches.suse/ALSA-usb-audio-stop-parsing-UAC2-rates-at-MAX_NR_RAT.patch (git-fixes CVE-2026-46018 bsc#1266751). - Update patches.suse/APEI-GHES-ensure-that-won-t-go-past-CPER-allocated-r.patch (stable-fixes CVE-2026-43277 bsc#1264594). - Update patches.suse/ASoC-SOF-Don-t-allow-pointer-operations-on-unconfigu.patch (git-fixes CVE-2026-46179 bsc#1267719). - Update patches.suse/ASoC-SOF-Intel-hda-Fix-NULL-pointer-dereference.patch (stable-fixes CVE-2026-43137 bsc#1264564). - Update patches.suse/ASoC-SOF-ipc4-topology-Correct-the-allocation-size-f.patch (git-fixes CVE-2025-71286 bsc#1264615). - Update patches.suse/ASoC-amd-acp-mach-common-Add-missing-error-check-for.patch (git-fixes CVE-2026-43443 bsc#1264785). - Update patches.suse/ASoC-amd-acp3x-rt5682-max9836-Add-missing-error-chec.patch (git-fixes CVE-2026-43480 bsc#1265249). - Update patches.suse/ASoC-nau8821-Cancel-delayed-work-on-component-remove.patch (git-fixes CVE-2026-45963 bsc#1267021). - Update patches.suse/ASoC-qcom-q6apm-lpass-dai-Fix-multiple-graph-opens.patch (git-fixes CVE-2026-46143 bsc#1267712). - Update patches.suse/ASoC-qcom-q6apm-move-component-registration-to-unman.patch (git-fixes CVE-2026-31587 bsc#1263145). - Update patches.suse/ASoC-qcom-qdsp6-Fix-q6apm-remove-ordering-during-ADS.patch (git-fixes CVE-2026-43412 bsc#1265080). - Update patches.suse/ASoC-soc-core-flush-delayed-work-before-removing-DAI.patch (git-fixes CVE-2026-43459 bsc#1264768). - Update patches.suse/ASoC-sti-use-managed-regmap_field-allocations.patch (git-fixes CVE-2026-53065 bsc#1269661). - Update patches.suse/ASoC-wm_adsp-Fix-NULL-dereference-when-removing-firm.patch (git-fixes CVE-2026-53350 bsc#1270244). - Update patches.suse/Bluetooth-L2CAP-Fix-ERTM-re-init-and-zero-pdu_len-in.patch (git-fixes CVE-2026-31498 bsc#1262751). - Update patches.suse/Bluetooth-L2CAP-Fix-missing-key-size-check-for-L2CAP.patch (git-fixes CVE-2026-43134 bsc#1264308). - Update patches.suse/Bluetooth-L2CAP-Fix-null-ptr-deref-in-l2cap_sock_new.patch (git-fixes CVE-2026-45835 bsc#1266411). - Update patches.suse/Bluetooth-L2CAP-Fix-null-ptr-deref-in-l2cap_sock_sta.patch (git-fixes CVE-2026-45834 bsc#1266412). - Update patches.suse/Bluetooth-L2CAP-Fix-null-ptr-deref-on-l2cap_sock_rea.patch (git-fixes CVE-2026-31510 bsc#1262603). - Update patches.suse/Bluetooth-L2CAP-Fix-type-confusion-in-l2cap_ecred_re.patch (git-fixes CVE-2026-43062 bsc#1264197). - Update patches.suse/Bluetooth-L2CAP-reject-BR-EDR-signaling-packets-over.patch (stable-fixes CVE-2026-53208 bsc#1269899). - Update patches.suse/Bluetooth-L2CAP-use-chan-timer-to-close-channels-in-.patch (git-fixes CVE-2026-53358 bsc#1270260). - Update patches.suse/Bluetooth-MGMT-Fix-dangling-pointer-on-mgmt_add_adv_.patch (git-fixes CVE-2026-31511 bsc#1263020). - Update patches.suse/Bluetooth-MGMT-validate-LTK-enc_size-on-load.patch (git-fixes CVE-2026-43020 bsc#1264006). - Update patches.suse/Bluetooth-MGMT-validate-advertising-TLV-before-type-.patch (git-fixes CVE-2026-53255 bsc#1269378). - Update patches.suse/Bluetooth-MGMT-validate-mesh-send-advertising-payloa.patch (git-fixes CVE-2026-43017 bsc#1264009). - Update patches.suse/Bluetooth-RFCOMM-validate-skb-length-in-MCC-handlers.patch (git-fixes CVE-2026-53254 bsc#1269996). - Update patches.suse/Bluetooth-SMP-derive-legacy-responder-STK-authentica.patch (git-fixes CVE-2026-31773 bsc#1264039). - Update patches.suse/Bluetooth-btusb-clamp-SCO-altsetting-table-indices.patch (git-fixes CVE-2026-31497 bsc#1262992). - Update patches.suse/Bluetooth-hci_event-Fix-OOB-read-and-infinite-loop-i.patch (git-fixes CVE-2026-46138 bsc#1267649). - Update patches.suse/Bluetooth-hci_event-fix-potential-UAF-in-SSP-passkey.patch (git-fixes CVE-2026-46056 bsc#1267435). - Update patches.suse/Bluetooth-hci_event-fix-potential-UAF-in-hci_le_remo.patch (git-fixes CVE-2026-43018 bsc#1264008). - Update patches.suse/Bluetooth-hci_ldisc-Clear-HCI_UART_PROTO_INIT-on-err.patch (git-fixes CVE-2026-53073 bsc#1269682). - Update patches.suse/Bluetooth-hci_ll-Fix-firmware-leak-on-error-path.patch (git-fixes CVE-2026-43069 bsc#1264190). - Update patches.suse/Bluetooth-hci_sync-reject-oversized-Broadcast-Announ.patch (git-fixes CVE-2026-53209 bsc#1269304). - Update patches.suse/Bluetooth-hci_uart-fix-UAFs-and-race-conditions-in-c.patch (git-fixes CVE-2026-46275 bsc#1267968). - Update patches.suse/Bluetooth-virtio_bt-validate-rx-pkt_type-header-leng.patch (git-fixes CVE-2026-46186 bsc#1266917). - Update patches.suse/HID-alps-fix-NULL-pointer-dereference-in-alps_raw_ev.patch (git-fixes CVE-2026-31625 bsc#1263030). - Update patches.suse/HID-apple-avoid-memory-leak-in-apple_report_fixup.patch (stable-fixes CVE-2026-31520 bsc#1262653). - Update patches.suse/HID-asus-avoid-memory-leak-in-asus_report_fixup.patch (stable-fixes CVE-2026-31524 bsc#1262605). - Update patches.suse/HID-core-clamp-report_size-in-s32ton-to-avoid-undefi.patch (stable-fixes CVE-2026-31624 bsc#1263657). - Update patches.suse/HID-hid-pl-handle-probe-errors.patch (git-fixes CVE-2026-43152 bsc#1264331). - Update patches.suse/HID-logitech-hidpp-Check-maxfield-in-hidpp_get_repor.patch (stable-fixes CVE-2026-43136 bsc#1264540). - Update patches.suse/HID-magicmouse-Do-not-crash-on-missing-msc-input.patch (stable-fixes CVE-2026-43140 bsc#1264630). - Update patches.suse/HID-magicmouse-avoid-memory-leak-in-magicmouse_repor.patch (stable-fixes CVE-2026-31522 bsc#1262637). - Update patches.suse/HID-multitouch-Check-to-ensure-report-responses-matc.patch (stable-fixes CVE-2026-43047 bsc#1264073). - Update patches.suse/HID-playstation-Add-missing-check-for-input_ff_creat.patch (git-fixes CVE-2026-45969 bsc#1266743). - Update patches.suse/HID-playstation-Clamp-num_touch_reports.patch (git-fixes CVE-2026-46232 bsc#1267669). - Update patches.suse/HID-prodikeys-Check-presence-of-pm-input_ep82.patch (stable-fixes CVE-2026-43251 bsc#1264423). - Update patches.suse/HID-roccat-fix-use-after-free-in-roccat_report_event.patch (stable-fixes CVE-2026-43111 bsc#1264480). - Update patches.suse/HID-usbhid-fix-deadlock-in-hid_post_reset.patch (git-fixes CVE-2026-53037 bsc#1269081). - Update patches.suse/HID-wacom-fix-out-of-bounds-read-in-wacom_intuos_bt_.patch (stable-fixes CVE-2026-43051 bsc#1264065). - Update patches.suse/Input-uinput-fix-circular-locking-dependency-with-ff.patch (git-fixes CVE-2026-31667 bsc#1263139). - Update patches.suse/KVM-SVM-Inject-UD-for-INVLPGA-if-EFER.SVME-0.patch (git-fixes CVE-2026-46082 bsc#1267473). - Update patches.suse/KVM-nSVM-Always-use-vmcb01-in-VMLOAD-VMSAVE-emulatio.patch (git-fixes CVE-2026-43133 bsc#1264640). - Update patches.suse/KVM-x86-check-for-nEPT-nNPT-in-slow-flush-hypercalls.patch (git-fixes CVE-2026-46131 bsc#1267636). - Update patches.suse/NFC-nxp-nci-allow-GPIOs-to-sleep.patch (git-fixes CVE-2026-31545 bsc#1263013). - Update patches.suse/NFC-pn533-bound-the-UART-receive-buffer.patch (git-fixes CVE-2026-43032 bsc#1263999). - Update patches.suse/PCI-Fix-pci_slot_trylock-error-handling.patch (git-fixes CVE-2026-43211 bsc#1264387). - Update patches.suse/PCI-P2PDMA-Release-per-CPU-pgmap-ref-when-vm_insert_.patch (git-fixes CVE-2026-45880 bsc#1268223). - Update patches.suse/PCI-endpoint-Fix-swapped-parameters-in-pci_-primary-.patch (git-fixes CVE-2026-43200 bsc#1264431). - Update patches.suse/PCI-endpoint-pci-epf-ntb-Remove-duplicate-resource-t.patch (git-fixes CVE-2026-46009 bsc#1266684). - Update patches.suse/Revert-PCI-IOV-Add-PCI-rescan-remove-locking-when-en.patch (git-fixes CVE-2026-43147 bsc#1264642). - Update patches.suse/Revert-hwmon-ibmpex-fix-use-after-free-in-high-low-s.patch (git-fixes CVE-2026-45914 bsc#1266884). - Update patches.suse/USB-core-Limit-the-length-of-unkillable-synchronous-.patch (git-fixes CVE-2026-43428 bsc#1265138). - Update patches.suse/USB-dummy-hcd-Fix-interrupt-synchronization-error.patch (git-fixes CVE-2026-43324 bsc#1264803). - Update patches.suse/USB-dummy-hcd-Fix-locking-synchronization-error.patch (git-fixes CVE-2026-43327 bsc#1265078). - Update patches.suse/USB-serial-io_ti-fix-heap-overflow-in-build_i2c_fw_h.patch (git-fixes CVE-2026-53195 bsc#1269984). - Update patches.suse/USB-serial-kl5kusb105-fix-bulk-out-buffer-overflow.patch (git-fixes CVE-2026-53194 bsc#1269904). - Update patches.suse/USB-usbtmc-Use-usb_bulk_msg_killable-with-user-speci.patch (git-fixes CVE-2026-43429 bsc#1265054). - Update patches.suse/X.509-Fix-out-of-bounds-access-when-parsing-extensio.patch (git-fixes CVE-2026-31430 bsc#1262391). - Update patches.suse/accel-qaic-Handle-DBC-deactivation-if-the-owner-went.patch (git-fixes CVE-2026-43007 bsc#1264019). - Update patches.suse/agp-amd64-Fix-broken-error-propagation-in-agp_amd64_.patch (git-fixes CVE-2026-53325 bsc#1269726). - Update patches.suse/atm-fore200e-fix-use-after-free-in-tasklets-during-d.patch (git-fixes CVE-2026-43203 bsc#1264600). - Update patches.suse/batman-adv-Avoid-double-rtnl_lock-ELP-metric-worker.patch (git-fixes CVE-2026-43382 bsc#1265047). - Update patches.suse/batman-adv-bla-only-purge-non-released-claims.patch (git-fixes CVE-2026-46233 bsc#1267701). - Update patches.suse/batman-adv-bla-prevent-use-after-free-when-deleting-.patch (git-fixes CVE-2026-46212 bsc#1267693). - Update patches.suse/batman-adv-bla-put-backbone-reference-on-failed-clai.patch (git-fixes CVE-2026-46231 bsc#1267565). - Update patches.suse/batman-adv-clear-current-gateway-during-teardown.patch (git-fixes CVE-2026-52926 bsc#1269025). - Update patches.suse/batman-adv-dat-handle-forward-allocation-error.patch (git-fixes CVE-2026-52922 bsc#1269030). - Update patches.suse/batman-adv-fix-fragment-reassembly-length-accounting.patch (git-fixes CVE-2026-52914 bsc#1268986). - Update patches.suse/batman-adv-fix-integer-overflow-on-buff_pos.patch (git-fixes CVE-2026-46198 bsc#1266854). - Update patches.suse/batman-adv-fix-tp_meter-counter-underflow-during-shu.patch (git-fixes CVE-2026-52919 bsc#1269031). - Update patches.suse/batman-adv-frag-disallow-unicast-fragment-in-fragmen.patch (git-fixes CVE-2026-52916 bsc#1269002). - Update patches.suse/batman-adv-hold-claim-backbone-gateways-by-reference.patch (git-fixes CVE-2026-31657 bsc#1263175). - Update patches.suse/batman-adv-reject-new-tp_meter-sessions-during-teard.patch (git-fixes CVE-2026-46206 bsc#1266834). - Update patches.suse/batman-adv-reject-oversized-global-TT-response-buffe.patch (git-fixes CVE-2026-31659 bsc#1263495). - Update patches.suse/batman-adv-stop-caching-unowned-originator-pointers-.patch (git-fixes CVE-2026-46238 bsc#1266846). - Update patches.suse/batman-adv-tp_meter-avoid-use-of-uninit-sender-vars.patch (git-fixes CVE-2026-52931 bsc#1269008). - Update patches.suse/btrfs-fix-zero-size-inode-with-non-zero-size-after-l.patch (git-fixes CVE-2026-43118 bsc#1264417). - Update patches.suse/btrfs-tracepoints-get-correct-superblock-from-dentry-in-ev.patch (bsc#1257777 CVE-2026-43117 bsc#1264414). - Update patches.suse/can-isotp-fix-tx.buf-use-after-free-in-isotp_sendmsg.patch (git-fixes CVE-2026-31474 bsc#1262723). - Update patches.suse/can-raw-fix-ro-uniq-use-after-free-in-raw_rcv.patch (git-fixes CVE-2026-31532 bsc#1262757). - Update patches.suse/can-ucan-fix-devres-lifetime.patch (git-fixes CVE-2026-46103 bsc#1267555). - Update patches.suse/clk-qcom-gfx3d-add-parent-to-parent-request-map.patch (git-fixes CVE-2026-46247 bsc#1267666). - Update patches.suse/comedi-Reinit-dev-spinlock-between-attachments-to-lo.patch (git-fixes CVE-2026-43340 bsc#1265096). - Update patches.suse/comedi-dt2815-add-hardware-detection-to-prevent-cras.patch (stable-fixes CVE-2026-31751 bsc#1264044). - Update patches.suse/comedi-me4000-Fix-potential-overrun-of-firmware-buff.patch (git-fixes CVE-2026-31747 bsc#1264101). - Update patches.suse/comedi-me_daq-Fix-potential-overrun-of-firmware-buff.patch (git-fixes CVE-2026-31748 bsc#1264100). - Update patches.suse/comedi-ni_atmio16d-Fix-invalid-clean-up-after-failed.patch (git-fixes CVE-2026-31749 bsc#1264075). - Update patches.suse/crypto-af-alg-fix-NULL-pointer-dereference-in-scatte.patch (git-fixes CVE-2026-43043 bsc#1264088). - Update patches.suse/crypto-atmel-aes-Fix-3-page-memory-leak-in-atmel_aes.patch (git-fixes CVE-2026-46019 bsc#1266732). - Update patches.suse/crypto-atmel-sha204a-Fix-potential-UAF-and-memory-le.patch (git-fixes CVE-2026-46075 bsc#1267367). - Update patches.suse/crypto-atmel-tdes-fix-DMA-sync-direction.patch (git-fixes CVE-2026-46077 bsc#1267466). - Update patches.suse/crypto-authencesn-reject-short-ahash-digests-during-.patch (git-fixes CVE-2026-46033 bsc#1266692). - Update patches.suse/crypto-ccree-fix-a-memory-leak-in-cc_mac_digest.patch (git-fixes CVE-2026-45986 bsc#1266739). - Update patches.suse/crypto-jitterentropy-replace-long-held-spinlock-with.patch (git-fixes CVE-2026-52936 bsc#1268981). - Update patches.suse/crypto-pcrypt-Fix-handling-of-MAY_BACKLOG-requests.patch (git-fixes CVE-2026-43493 bsc#1265627). - Update patches.suse/dmaengine-idxd-Fix-leaking-event-log-memory.patch (git-fixes CVE-2026-31440 bsc#1262658). - Update patches.suse/dmaengine-idxd-Fix-memory-leak-when-a-wq-is-reset.patch (git-fixes CVE-2026-31441 bsc#1262659). - Update patches.suse/dmaengine-idxd-Fix-not-releasing-workqueue-on-.relea.patch (git-fixes CVE-2026-43064 bsc#1264189). - Update patches.suse/dmaengine-xilinx-xdma-Fix-regmap-init-error-handling.patch (git-fixes CVE-2026-31439 bsc#1262639). - Update patches.suse/drm-Account-property-blob-allocations-to-memcg.patch (stable-fixes CVE-2026-43287 bsc#1265037). - Update patches.suse/drm-amd-display-Avoid-NULL-dereference-in-dc_dmub_sr.patch (git-fixes CVE-2026-53313 bsc#1269719). - Update patches.suse/drm-amd-display-Clamp-HDMI-HDCP2-rx_id_list-read-to-.patch (git-fixes CVE-2026-53137 bsc#1269796). - Update patches.suse/drm-amd-display-Clamp-VBIOS-HDMI-retimer-register-co.patch (stable-fixes CVE-2026-53136 bsc#1269811). - Update patches.suse/drm-amd-display-Fix-NULL-deref-and-buffer-over-read-.patch (git-fixes CVE-2026-53135 bsc#1269817). - Update patches.suse/drm-amd-display-Use-krealloc_array-in-dal_vector_res.patch (git-fixes CVE-2026-53329 bsc#1270058). - Update patches.suse/drm-amdgpu-Add-bounds-checking-to-ib_-get-set-_value.patch (stable-fixes CVE-2026-46218 bsc#1267632). - Update patches.suse/drm-amdgpu-Fix-fence-put-before-wait-in-amdgpu_amdkf.patch (git-fixes CVE-2026-31566 bsc#1263055). - Update patches.suse/drm-amdgpu-Fix-memory-leak-in-amdgpu_acpi_enumerate_.patch (git-fixes CVE-2026-45947 bsc#1267198). - Update patches.suse/drm-amdgpu-Fix-memory-leak-in-amdgpu_ras_init.patch (git-fixes CVE-2026-45976 bsc#1267027). - Update patches.suse/drm-amdgpu-Fix-use-after-free-race-in-VM-acquire.patch (stable-fixes CVE-2026-43370 bsc#1264782). - Update patches.suse/drm-amdgpu-fix-AMDGPU_INFO_READ_MMR_REG.patch (git-fixes CVE-2026-53293 bsc#1269898). - Update patches.suse/drm-amdgpu-fix-sync-handling-in-amdgpu_dma_buf_move_.patch (git-fixes CVE-2026-43318 bsc#1264991). - Update patches.suse/drm-amdgpu-fix-zero-size-GDS-range-init-on-RDNA4.patch (stable-fixes CVE-2026-46276 bsc#1267922). - Update patches.suse/drm-amdgpu-sdma4-replace-BUG_ON-with-WARN_ON-in-fenc.patch (git-fixes CVE-2026-46220 bsc#1267704). - Update patches.suse/drm-amdgpu-vcn3-Prevent-OOB-reads-when-parsing-dec-m.patch (stable-fixes CVE-2026-46230 bsc#1267623). - Update patches.suse/drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-IB.patch (stable-fixes CVE-2026-46204 bsc#1267661). - Update patches.suse/drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-dec-m.patch (stable-fixes CVE-2026-46199 bsc#1267638). - Update patches.suse/drm-amdkfd-Fix-buffer-overflow-in-SDMA-queue-checkpo.patch (git-fixes CVE-2026-53143 bsc#1269652). - Update patches.suse/drm-amdkfd-fix-NULL-dereference-in-get_queue_ids.patch (git-fixes CVE-2026-53144 bsc#1269245). - Update patches.suse/drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch (stable-fixes CVE-2026-43269 bsc#1264590). - Update patches.suse/drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch (stable-fixes CVE-2026-43236 bsc#1264538). - Update patches.suse/drm-bridge-cadence-cdns-mhdp8546-core-Set-the-mhdp-c.patch (git-fixes CVE-2026-53058 bsc#1269684). - Update patches.suse/drm-bridge-samsung-dsim-Fix-memory-leak-in-error-pat.patch (git-fixes CVE-2026-43397 bsc#1264668). - Update patches.suse/drm-buddy-Prevent-BUG_ON-by-validating-rounded-alloc.patch (git-fixes CVE-2026-43169 bsc#1264379). - Update patches.suse/drm-display-dp_mst-Add-protection-against-0-vcpi.patch (stable-fixes CVE-2025-71305 bsc#1266762). - Update patches.suse/drm-gma500-oaktrail_lvds-fix-hang-on-init-failure.patch (git-fixes CVE-2026-53279 bsc#1269505). - Update patches.suse/drm-i915-gem-Fix-phys-BO-pread-pwrite-with-offset.patch (git-fixes CVE-2026-53356 bsc#1270112). - Update patches.suse/drm-i915-gt-Check-set_default_submission-before-defe.patch (git-fixes CVE-2026-31540 bsc#1263011). - Update patches.suse/drm-ioc32-stop-speculation-on-the-drm_compat_ioctl-p.patch (git-fixes CVE-2026-31781 bsc#1264033). - Update patches.suse/drm-komeda-fix-integer-overflow-in-AFBC-framebuffer-.patch (git-fixes CVE-2026-53068 bsc#1269410). - Update patches.suse/drm-msm-dpu-fix-mismatch-between-power-and-frequency.patch (git-fixes CVE-2026-53056 bsc#1269403). - Update patches.suse/drm-nouveau-fix-u32-overflow-in-pushbuf-reloc-bounds.patch (git-fixes CVE-2026-46006 bsc#1267479). - Update patches.suse/drm-sun4i-backend-fix-error-pointer-dereference.patch (git-fixes CVE-2026-53066 bsc#1269187). - Update patches.suse/drm-v3d-Set-DMA-segment-size-to-avoid-debug-warnings.patch (stable-fixes CVE-2026-43302 bsc#1265102). - Update patches.suse/drm-vc4-Fix-a-memory-leak-in-hang-state-error-path.patch (git-fixes CVE-2026-43104 bsc#1264247). - Update patches.suse/drm-vc4-Fix-memory-leak-of-BO-array-in-hang-state.patch (git-fixes CVE-2026-43105 bsc#1264237). - Update patches.suse/drm-vc4-fix-krealloc-memory-leak.patch (git-fixes CVE-2026-53213 bsc#1269283). - Update patches.suse/drm-vc4-platform_get_irq_byname-returns-an-int.patch (stable-fixes CVE-2026-43072 bsc#1264451). - Update patches.suse/drm-virtio-Fix-driver-removal-with-disabled-KMS.patch (git-fixes CVE-2026-53347 bsc#1270241). - Update patches.suse/drm-virtio-fix-dma_fence-refcount-leak-on-error-in-v.patch (git-fixes CVE-2026-53190 bsc#1269772). - Update patches.suse/efi-Fix-reservation-of-unaccepted-memory-table.patch (git-fixes CVE-2026-45851 bsc#1266688). - Update patches.suse/efi-capsule-loader-fix-incorrect-sizeof-in-phys-arra.patch (git-fixes CVE-2026-53047 bsc#1269644). - Update patches.suse/ext4-reject-mount-if-bigalloc-with-s_first_data_bloc.patch (git-fixes CVE-2026-31447 bsc#1262614). - Update patches.suse/fbcon-check-return-value-of-con2fb_acquire_newinfo.patch (git-fixes CVE-2026-43123 bsc#1264598). - Update patches.suse/fbdev-au1200fb-Fix-a-memory-leak-in-au1200fb_drv_pro.patch (git-fixes CVE-2026-45954 bsc#1266939). - Update patches.suse/fbdev-of-display_timing-fix-refcount-leak-in-of_get_.patch (git-fixes CVE-2026-43264 bsc#1264424). - Update patches.suse/fbdev-tdfxfb-avoid-divide-by-zero-on-FBIOPUT_VSCREEN.patch (stable-fixes CVE-2026-31618 bsc#1263785). - Update patches.suse/fbdev-udlfb-add-vm_ops-to-dlfb_ops_mmap-to-prevent-u.patch (stable-fixes CVE-2026-43497 bsc#1266003). - Update patches.suse/fbdev-udlfb-avoid-divide-by-zero-on-FBIOPUT_VSCREENI.patch (git-fixes CVE-2026-31605 bsc#1263493). - Update patches.suse/fbdev-vt8500lcdfb-fix-missing-dma_free_coherent.patch (git-fixes CVE-2026-43202 bsc#1264336). - Update patches.suse/gpio-mvebu-fix-NULL-pointer-dereference-in-suspend-r.patch (git-fixes CVE-2026-53237 bsc#1269131). - Update patches.suse/gpio-omap-do-not-register-driver-in-probe.patch (git-fixes CVE-2026-31687 bsc#1263598). - Update patches.suse/hwmon-occ-Fix-division-by-zero-in-occ_show_power_1.patch (git-fixes CVE-2026-31770 bsc#1264142). - Update patches.suse/hwmon-pmbus-q54sj108a2-fix-stack-overflow-in-debugfs.patch (git-fixes CVE-2026-43380 bsc#1264780). - Update patches.suse/i2c-cp2615-fix-serial-string-NULL-deref-at-probe.patch (git-fixes CVE-2026-31549 bsc#1263025). - Update patches.suse/i2c-dev-prevent-integer-overflow-in-I2C_TIMEOUT-ioct.patch (stable-fixes CVE-2026-52948 bsc#1269116). - Update patches.suse/i2c-qcom-cci-Fix-NULL-pointer-dereference-in-cci_rem.patch (git-fixes CVE-2026-53339 bsc#1270248). - Update patches.suse/i2c-s3c24xx-check-the-size-of-the-SMBUS-message-befo.patch (stable-fixes CVE-2026-31627 bsc#1263786). - Update patches.suse/iio-adc-ti-adc161s626-use-DMA-safe-memory-for-spi_re.patch (git-fixes CVE-2026-31768 bsc#1264125). - Update patches.suse/iio-chemical-sps30_i2c-fix-buffer-size-in-sps30_i2c_.patch (git-fixes CVE-2026-43476 bsc#1265257). - Update patches.suse/iio-gyro-mpu3050-Fix-incorrect-free_irq-variable.patch (git-fixes CVE-2026-31763 bsc#1263975). - Update patches.suse/iio-gyro-mpu3050-Fix-irq-resource-leak.patch (git-fixes CVE-2026-31762 bsc#1264048). - Update patches.suse/iio-gyro-mpu3050-Move-iio_device_register-to-correct.patch (git-fixes CVE-2026-31761 bsc#1264122). - Update patches.suse/iio-gyro-mpu3050-core-fix-pm_runtime-error-handling.patch (git-fixes CVE-2026-43357 bsc#1264809). - Update patches.suse/iio-sca3000-Fix-a-resource-leak-in-sca3000_probe.patch (git-fixes CVE-2026-45883 bsc#1266774). - Update patches.suse/ima-verify-the-previous-kernel-s-IMA-buffer-lies-in-a.patch (CVE-2026-43240 bsc#1264386 CVE-2026-43129 bsc#1264553). - Update patches.suse/iommu-amd-serialize-sequence-allocation-under-concur.patch (git-fixes CVE-2026-43220 bsc#1264416). - Update patches.suse/ipmi-Add-limits-to-event-and-receive-message-request.patch (git-fixes CVE-2026-46177 bsc#1267725). - Update patches.suse/ipmi-Check-event-message-buffer-response-for-bad-dat.patch (git-fixes CVE-2026-46128 bsc#1267643). - Update patches.suse/ipmi-ipmb-initialise-event-handler-read-bytes.patch (git-fixes CVE-2026-43221 bsc#1264442). - Update patches.suse/ipmi-si-Return-state-to-normal-if-message-allocation.patch (git-fixes CVE-2026-46108 bsc#1267615). - Update patches.suse/ipv4-account-for-fraggap-on-the-paged-allocation-path.patch (git-fixes CVE-2026-53366 bsc#1271366). - Update patches.suse/media-amphion-Fix-race-between-m2m-job_abort-and-dev.patch (git-fixes CVE-2026-46058 bsc#1266677). - Update patches.suse/media-as102-fix-to-not-free-memory-after-the-device-.patch (git-fixes CVE-2026-31578 bsc#1263075). - Update patches.suse/media-ccs-Avoid-possible-division-by-zero.patch (git-fixes CVE-2026-43182 bsc#1264340). - Update patches.suse/media-cx23885-Add-missing-unmap-in-snd_cx23885_hw_pa.patch (git-fixes CVE-2026-43135 bsc#1264613). - Update patches.suse/media-cx25821-Fix-a-resource-leak-in-cx25821_dev_set.patch (stable-fixes CVE-2026-43183 bsc#1264620). - Update patches.suse/media-cx88-Add-missing-unmap-in-snd_cx88_hw_params.patch (git-fixes CVE-2026-43257 bsc#1264296). - Update patches.suse/media-em28xx-fix-use-after-free-in-em28xx_v4l2_open.patch (git-fixes CVE-2026-31583 bsc#1263173). - Update patches.suse/media-hackrf-fix-to-not-free-memory-after-the-device.patch (git-fixes CVE-2026-31576 bsc#1263073). - Update patches.suse/media-i2c-ov5647-Initialize-subdev-before-controls.patch (git-fixes CVE-2026-43312 bsc#1265101). - Update patches.suse/media-i2c-tw9903-Fix-potential-memory-leak-in-tw9903.patch (git-fixes CVE-2026-43218 bsc#1264479). - Update patches.suse/media-i2c-tw9906-Fix-potential-memory-leak-in-tw9906.patch (git-fixes CVE-2026-43246 bsc#1264322). - Update patches.suse/media-mtk-jpeg-fix-use-after-free-in-release-path-du.patch (git-fixes CVE-2026-46011 bsc#1267491). - Update patches.suse/media-mtk-mdp-Fix-a-reference-leak-bug-in-mtk_mdp_re.patch (git-fixes CVE-2026-43270 bsc#1264313). - Update patches.suse/media-mtk-mdp-Fix-error-handling-in-probe-function.patch (git-fixes CVE-2026-43207 bsc#1264365). - Update patches.suse/media-pvrusb2-fix-URB-leak-in-pvr2_send_request_ex.patch (stable-fixes CVE-2026-43223 bsc#1264645). - Update patches.suse/media-qcom-camss-vfe-Fix-out-of-bounds-access-in-vfe.patch (git-fixes CVE-2026-43256 bsc#1264425). - Update patches.suse/media-radio-keene-fix-memory-leak-in-error-path.patch (git-fixes CVE-2026-43231 bsc#1264592). - Update patches.suse/media-rc-xbox_remote-heed-DMA-restrictions.patch (git-fixes CVE-2026-46236 bsc#1266910). - Update patches.suse/media-saa7164-add-ioremap-return-checks-and-cleanups.patch (git-fixes CVE-2026-46235 bsc#1267702). - Update patches.suse/media-solo6x10-Check-for-out-of-bounds-chip_id.patch (stable-fixes CVE-2026-43316 bsc#1264826). - Update patches.suse/media-videobuf2-Set-vma_flags-in-vb2_dma_sg_mmap.patch (git-fixes CVE-2026-46312 bsc#1267990). - Update patches.suse/media-vidtv-fix-NULL-pointer-dereference-in-vidtv_ch.patch (git-fixes CVE-2026-31599 bsc#1263031). - Update patches.suse/media-vidtv-fix-nfeeds-state-corruption-on-start_str.patch (git-fixes CVE-2026-31585 bsc#1263134). - Update patches.suse/media-vidtv-fix-pass-by-value-structs-causing-MSAN-w.patch (git-fixes CVE-2026-43058 bsc#1264129). - Update patches.suse/memory-tegra124-emc-Fix-dll_change-check.patch (git-fixes CVE-2026-53045 bsc#1269404). - Update patches.suse/mfd-arizona-Fix-regulator-resource-leak-on-wm5102_cl.patch (git-fixes CVE-2026-45875 bsc#1266707). - Update patches.suse/mfd-core-Add-locking-around-mfd_of_node_list.patch (git-fixes CVE-2026-43143 bsc#1264388). - Update patches.suse/misc-bcm_vk-Fix-possible-null-pointer-dereferences-i.patch (stable-fixes CVE-2025-71291 bsc#1264560). - Update patches.suse/misc-fastrpc-Fix-NULL-pointer-dereference-in-rpmsg-c.patch (git-fixes CVE-2026-53158 bsc#1269385). - Update patches.suse/misc-fastrpc-fix-DMA-address-corruption-due-to-find_.patch (git-fixes CVE-2026-53159 bsc#1269654). - Update patches.suse/misc-fastrpc-fix-use-after-free-of-fastrpc_user-in-w.patch (git-fixes CVE-2026-53161 bsc#1269255). - Update patches.suse/misc-fastrpc-fix-use-after-free-race-in-fastrpc_map_.patch (git-fixes CVE-2026-53160 bsc#1269670). - Update patches.suse/misc-fastrpc-possible-double-free-of-cctx-remote_hea.patch (git-fixes CVE-2026-31730 bsc#1264041). - Update patches.suse/mmc-vub300-fix-NULL-deref-on-disconnect.patch (git-fixes CVE-2026-31651 bsc#1263111). - Update patches.suse/mtd-docg3-fix-use-after-free-in-docg3_release.patch (git-fixes CVE-2026-46285 bsc#1267948). - Update patches.suse/mtd-parsers-Fix-memory-leak-in-mtd_parser_tplink_saf.patch (git-fixes CVE-2026-45921 bsc#1266806). - Update patches.suse/net-mlx5-Fix-crash-when-moving-to-switchdev-mode.patch (git-fixes CVE-2026-43467 bsc#1264791). - Update patches.suse/net-nfc-nci-Fix-parameter-validation-for-packet-data.patch (git-fixes CVE-2026-43291 bsc#1264819). - Update patches.suse/net-sched-cls_fw-fix-NULL-dereference-of-old-filters-befor.patch (git-fixes CVE-2026-53080 bsc#1269141). - Update patches.suse/net-usb-catc-enable-basic-endpoint-checking.patch (git-fixes CVE-2026-45923 bsc#1266894). - Update patches.suse/net-usb-cdc-phonet-fix-skb-frags-overflow-in-rx_comp.patch (git-fixes CVE-2026-31623 bsc#1263778). - Update patches.suse/net-usb-kaweth-remove-TX-queue-manipulation-in-kawet.patch (git-fixes CVE-2026-43180 bsc#1265093). - Update patches.suse/net-usb-pegasus-enable-basic-endpoint-checking.patch (git-fixes CVE-2026-43156 bsc#1265092). - Update patches.suse/net-usb-rtl8150-fix-use-after-free-in-rtl8150_start_.patch (git-fixes CVE-2026-52982 bsc#1269258). - Update patches.suse/net-wan-farsync-Fix-use-after-free-bugs-caused-by-un.patch (git-fixes CVE-2026-43232 bsc#1264633). - Update patches.suse/net-wan-fsl_ucc_hdlc-Fix-dma_free_coherent-in-uhdlc_.patch (git-fixes CVE-2026-43149 bsc#1264315). - Update patches.suse/net-x25-Fix-potential-double-free-of-skb.patch (git-fixes CVE-2026-43011 bsc#1264079). - Update patches.suse/nfc-hci-shdlc-Stop-timers-and-work-before-freeing-co.patch (git-fixes CVE-2026-46267 bsc#1267630). - Update patches.suse/nfc-nci-fix-circular-locking-dependency-in-nci_close.patch (git-fixes CVE-2026-31509 bsc#1263097). - Update patches.suse/nfc-pn533-allocate-rx-skb-before-consuming-bytes.patch (git-fixes CVE-2026-31660 bsc#1263539). - Update patches.suse/nfc-s3fwrn5-allocate-rx-skb-before-consuming-bytes.patch (git-fixes CVE-2026-43098 bsc#1264257). - Update patches.suse/nouveau-dpcd-return-EBUSY-for-aux-xfer-if-the-device.patch (git-fixes CVE-2026-43381 bsc#1265105). - Update patches.suse/ntb-ntb_hw_switchtec-Fix-array-index-out-of-bounds-a.patch (stable-fixes CVE-2026-43241 bsc#1264844). - Update patches.suse/ntb-ntb_hw_switchtec-Fix-shift-out-of-bounds-for-0-m.patch (stable-fixes CVE-2026-43141 bsc#1264626). - Update patches.suse/nvmet-tcp-propagate-nvmet_tcp_build_pdu_iovec-errors.patch (git-fixes CVE-2026-52989 bsc#1269364). - Update patches.suse/openvswitch-vport-fix-self-deadlock-on-release-of-tunnel-p.patch (CVE-2026-31678 bsc#1263562 CVE-2026-46165 bsc#1266836). - Update patches.suse/pinctrl-single-fix-refcount-leak-in-pcs_add_gpio_fun.patch (git-fixes CVE-2026-45868 bsc#1266741). - Update patches.suse/platform-x86-dell-wmi-sysman-bound-enumeration-strin.patch (git-fixes CVE-2026-53022 bsc#1269153). - Update patches.suse/power-supply-ab8500-Fix-use-after-free-in-power_supp.patch (git-fixes CVE-2026-45946 bsc#1268221). - Update patches.suse/power-supply-act8945a-Fix-use-after-free-in-power_su.patch (git-fixes CVE-2026-45867 bsc#1268220). - Update patches.suse/power-supply-bq256xx-Fix-use-after-free-in-power_sup.patch (git-fixes CVE-2026-45902 bsc#1266886). - Update patches.suse/power-supply-bq25980-Fix-use-after-free-in-power_sup.patch (git-fixes CVE-2026-45879 bsc#1266703). - Update patches.suse/power-supply-cpcap-battery-Fix-use-after-free-in-pow.patch (git-fixes CVE-2026-45885 bsc#1266780). - Update patches.suse/power-supply-goldfish-Fix-use-after-free-in-power_su.patch (git-fixes CVE-2026-45936 bsc#1266947). - Update patches.suse/power-supply-rt9455-Fix-use-after-free-in-power_supp.patch (git-fixes CVE-2026-46270 bsc#1267680). - Update patches.suse/power-supply-sbs-battery-Fix-use-after-free-in-power.patch (git-fixes CVE-2026-45916 bsc#1266679). - Update patches.suse/power-supply-wm97xx-Fix-NULL-pointer-dereference-in-.patch (git-fixes CVE-2026-45869 bsc#1266467). - Update patches.suse/rapidio-replace-rio_free_net-with-kfree-in-rio_scan_.patch (git-fixes CVE-2026-43295 bsc#1265100). - Update patches.suse/regulator-core-fix-locking-in-regulator_resolve_supp.patch (git-fixes CVE-2026-46252 bsc#1267676). - Update patches.suse/remoteproc-xlnx-Only-access-buffer-information-if-IP.patch (git-fixes CVE-2026-46016 bsc#1266729). - Update patches.suse/rpmsg-core-fix-race-in-driver_override_show-and-use-.patch (git-fixes CVE-2025-71274 bsc#1264377). - Update patches.suse/sched-rt-Skip-currently-executing-CPU-in-rto_next_cpu.patch (bsc#1262649 CVE-2026-45919 bsc#1266777). - Update patches.suse/sctp-disable-BH-before-calling-udp_tunnel_xmit_skb.patch (CVE-2026-23276 bsc#1260012 CVE-2026-53070 bsc#1269674). - Update patches.suse/serial-8250-Fix-TX-deadlock-when-using-DMA.patch (git-fixes CVE-2026-43061 bsc#1264188). - Update patches.suse/soc-mediatek-svs-Fix-memory-leak-in-svs_enable_debug.patch (git-fixes CVE-2026-45881 bsc#1266721). - Update patches.suse/soc-ti-k3-socinfo-Fix-regmap-leak-on-probe-failure.patch (git-fixes CVE-2026-43242 bsc#1264338). - Update patches.suse/soc-ti-pruss-Fix-double-free-in-pruss_clk_mux_setup.patch (git-fixes CVE-2026-43196 bsc#1264436). - Update patches.suse/sound-ua101-fix-division-by-zero-at-probe.patch (git-fixes CVE-2026-46184 bsc#1266864). - Update patches.suse/spi-imx-fix-use-after-free-on-unbind.patch (git-fixes CVE-2026-45996 bsc#1267436). - Update patches.suse/spi-mpc52xx-fix-use-after-free-on-unbind.patch (git-fixes CVE-2026-46219 bsc#1267667). - Update patches.suse/spi-rspi-fix-controller-deregistration.patch (git-fixes CVE-2026-46225 bsc#1267627). - Update patches.suse/spi-spi-fsl-lpspi-fix-teardown-order-issue-UAF.patch (git-fixes CVE-2026-31485 bsc#1262768). - Update patches.suse/spi-wpcm-fiu-Fix-potential-NULL-pointer-dereference-.patch (git-fixes CVE-2026-46261 bsc#1267646). - Update patches.suse/staging-media-atomisp-Disallow-all-private-IOCTLs.patch (git-fixes CVE-2026-46205 bsc#1266908). - Update patches.suse/staging-rtl8723bs-fix-memory-leak-on-failure-path.patch (stable-fixes CVE-2026-43225 bsc#1264526). - Update patches.suse/staging-rtl8723bs-fix-null-dereference-in-find_netwo.patch (git-fixes CVE-2026-43159 bsc#1264616). - Update patches.suse/staging-rtl8723bs-initialize-le_tmp64-in-rtw_BIP_ver.patch (git-fixes CVE-2026-31626 bsc#1263782). - Update patches.suse/staging-rtl8723bs-properly-validate-the-data-in-rtw_.patch (stable-fixes CVE-2026-43387 bsc#1265032). - Update patches.suse/staging-sm750fb-fix-division-by-zero-in-ps_to_hz.patch (git-fixes CVE-2026-31603 bsc#1263491). - Update patches.suse/thunderbolt-Bound-root-directory-content-to-block-si.patch (git-fixes CVE-2026-53149 bsc#1269733). - Update patches.suse/thunderbolt-Clamp-XDomain-response-data-copy-to-allo.patch (git-fixes CVE-2026-53148 bsc#1269786). - Update patches.suse/thunderbolt-Limit-XDomain-response-copy-to-actual-fr.patch (git-fixes CVE-2026-53146 bsc#1269826). - Update patches.suse/thunderbolt-Reject-zero-length-property-entries-in-v.patch (git-fixes CVE-2026-53150 bsc#1269386). - Update patches.suse/thunderbolt-Validate-XDomain-request-packet-size-bef.patch (git-fixes CVE-2026-53147 bsc#1269709). - Update patches.suse/tpm-st33zp24-Fix-missing-cleanup-on-get_burstcount-e.patch (git-fixes CVE-2026-45871 bsc#1266755). - Update patches.suse/tpm-tpm_i2c_infineon-Fix-locality-leak-on-get_burstc.patch (git-fixes CVE-2026-45941 bsc#1266920). - Update patches.suse/usb-cdns3-fix-role-switching-during-resume.patch (git-fixes CVE-2026-45911 bsc#1266898). - Update patches.suse/usb-cdns3-gadget-fix-NULL-pointer-dereference-in-ep_.patch (git-fixes CVE-2026-31755 bsc#1264071). - Update patches.suse/usb-cdns3-gadget-fix-state-inconsistency-on-gadget-i.patch (git-fixes CVE-2026-31754 bsc#1264074). - Update patches.suse/usb-class-cdc-wdm-fix-reordering-issue-in-read-code-.patch (git-fixes CVE-2026-43427 bsc#1264746). - Update patches.suse/usb-dwc2-gadget-Fix-spin_lock-unlock-mismatch-in-dwc.patch (git-fixes CVE-2026-31756 bsc#1264070). - Update patches.suse/usb-gadget-f_ncm-validate-minimum-block_len-in-ncm_u.patch (git-fixes CVE-2026-31617 bsc#1263780). - Update patches.suse/usb-gadget-f_phonet-fix-skb-frags-overflow-in-pn_rx_.patch (stable-fixes CVE-2026-31616 bsc#1263777). - Update patches.suse/usb-gadget-f_rndis-Protect-RNDIS-options-with-mutex.patch (git-fixes CVE-2026-43342 bsc#1264758). - Update patches.suse/usb-gadget-f_subset-Fix-unbalanced-refcnt-in-geth_fr.patch (git-fixes CVE-2026-43343 bsc#1264816). - Update patches.suse/usb-gadget-f_uac1_legacy-validate-control-request-si.patch (stable-fixes CVE-2026-31720 bsc#1264110). - Update patches.suse/usb-gadget-renesas_usb3-validate-endpoint-index-in-s.patch (git-fixes CVE-2026-31615 bsc#1263776). - Update patches.suse/usb-gadget-u_ether-Fix-NULL-pointer-deref-in-eth_get.patch (git-fixes CVE-2026-31727 bsc#1263904). - Update patches.suse/usb-gadget-u_ether-Fix-race-between-gether_disconnec.patch (git-fixes CVE-2026-31728 bsc#1263911). - Update patches.suse/usb-gadget-uvc-fix-NULL-pointer-dereference-during-u.patch (git-fixes CVE-2026-31726 bsc#1263905). - Update patches.suse/usb-image-mdc800-kill-download-URB-on-timeout.patch (stable-fixes CVE-2026-43425 bsc#1265133). - Update patches.suse/usb-renesas_usbhs-fix-use-after-free-in-ISR-during-d.patch (git-fixes CVE-2026-43426 bsc#1265074). - Update patches.suse/usb-usblp-fix-heap-leak-in-IEEE-1284-device-ID-via-s.patch (stable-fixes CVE-2026-46151 bsc#1267728). - Update patches.suse/usb-usblp-fix-uninitialized-heap-leak-via-LPGETSTATU.patch (stable-fixes CVE-2026-46167 bsc#1266832). - Update patches.suse/usb-xhci-Fix-memory-leak-in-xhci_disable_slot.patch (git-fixes CVE-2026-43432 bsc#1264783). - Update patches.suse/usb-xhci-Prevent-interrupt-storm-on-host-controller-.patch (stable-fixes CVE-2026-43488 bsc#1265264). - Update patches.suse/usb-yurex-fix-race-in-probe.patch (stable-fixes CVE-2026-43430 bsc#1264677). - Update patches.suse/wifi-ath5k-do-not-access-array-OOB.patch (git-fixes CVE-2026-46307 bsc#1267987). - Update patches.suse/wifi-b43-enforce-bounds-check-on-firmware-key-index-.patch (git-fixes CVE-2026-46122 bsc#1267583). - Update patches.suse/wifi-b43legacy-enforce-bounds-check-on-firmware-key-.patch (git-fixes CVE-2026-46163 bsc#1266863). - Update patches.suse/wifi-brcmfmac-Fix-error-pointer-dereference.patch (git-fixes CVE-2026-53093 bsc#1269414). - Update patches.suse/wifi-brcmsmac-Fix-dma_free_coherent-size.patch (git-fixes CVE-2026-31661 bsc#1263128). - Update patches.suse/wifi-cfg80211-cancel-pmsr_free_wk-in-cfg80211_pmsr_w.patch (git-fixes CVE-2026-31548 bsc#1263008). - Update patches.suse/wifi-iwlwifi-mvm-fix-potential-out-of-bounds-read-in.patch (git-fixes CVE-2026-31779 bsc#1264030). - Update patches.suse/wifi-libertas-fix-WARNING-in-usb_tx_block.patch (stable-fixes CVE-2026-43255 bsc#1264473). - Update patches.suse/wifi-mac80211-Fix-static_branch_dec-underflow-for-aq.patch (git-fixes CVE-2026-31551 bsc#1263014). - Update patches.suse/wifi-mac80211-drop-stray-static-from-fast-RX-rx_resu.patch (git-fixes CVE-2026-46152 bsc#1266855). - Update patches.suse/wifi-mac80211-remove-station-if-connection-prep-fail.patch (git-fixes CVE-2026-46125 bsc#1266879). - Update patches.suse/wifi-mt76-mt7915-fix-use-after-free-bugs-in-mt7915_m.patch (git-fixes CVE-2026-53098 bsc#1269976). - Update patches.suse/wifi-mt76-mt7921-fix-a-potential-clc-buffer-length-u.patch (git-fixes CVE-2026-46136 bsc#1266831). - Update patches.suse/wifi-rsi-fix-kthread-lifetime-race-between-self-exit.patch (git-fixes CVE-2026-46187 bsc#1266842). - Update patches.suse/wifi-rt2x00usb-fix-devres-lifetime.patch (git-fixes CVE-2026-31672 bsc#1263142). - Update patches.suse/wifi-rtlwifi-pci-fix-possible-use-after-free-caused-.patch (git-fixes CVE-2026-53112 bsc#1269998). - Update patches.suse/wifi-rtw88-8822b-Avoid-WARNING-in-rtw8822b_config_tr.patch (stable-fixes CVE-2025-71297 bsc#1264830). - Update patches.suse/wifi-rtw88-check-for-PCI-upstream-bridge-existence.patch (git-fixes CVE-2026-46092 bsc#1267595). - Update patches.suse/wifi-rtw88-fix-device-leak-on-probe-failure.patch (git-fixes CVE-2026-31604 bsc#1263045). - Update patches.suse/wifi-wilc1000-fix-u8-overflow-in-SSID-scan-buffer-si.patch (git-fixes CVE-2026-31780 bsc#1264032). - Update patches.suse/wifi-wl1251-validate-packet-IDs-before-indexing-tx_f.patch (stable-fixes CVE-2026-43113 bsc#1264637). - Update patches.suse/wifi-wlcore-Return-ENOMEM-instead-of-EAGAIN-if-there.patch (git-fixes CVE-2026-31552 bsc#1263016). - commit 9043982 - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239 bsc#1269677). - commit e28f7cf - netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268 bsc#1269257). - commit 2c13e43 - vsock/virtio: fix empty payload in tap skb for non-linear buffers (CVE-2026-46207 bsc#1267691). - commit fadb0f2 - vsock/virtio: fix length and offset in tap skb for split packets (CVE-2026-46207 bsc#1267691). - commit 1ce6ee2 - fbcon: Avoid OOB font access if console rotation fails (bsc#1267690 CVE-2026-46191) - commit e1c5dbc - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() (CVE-2026-53262 bsc#1270000). - commit a2b7211 - net: bcmgenet: move DESC_INDEX flow to ring 0 (CVE-2026-53086 bsc#1269537). - Refresh patches.suse/net-bcmgenet-fix-racing-timeout-handler.patch. - commit 21ba2b5 - net: bcmgenet: Reset RBUF on first open (CVE-2026-53086 bsc#1269537). - commit 9f413dc - net: bcmgenet: Remove TX ring full logging (CVE-2026-53086 bsc#1269537). - commit cf56f3c - netfilter: nft_ct: fix missing expect put in obj eval (CVE-2026-52970 bsc#1269229) - commit 6dc70e5 - netfilter: nft_tunnel: fix use-after-free on object destroy (CVE-2026-53212 bsc#1269672) - commit 184d0a8 - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush (CVE-2026-53175 bsc#1269714) - commit 8254a3f - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() (CVE-2026-53221 bsc#1269318) - commit f10b90f - ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006 bsc#1269104) - commit 9185932 - nexthop: fix IPv6 route referencing IPv4 nexthop (CVE-2026-53012 bsc#1269154) - commit 870437e - net: tls: fix strparser anchor skb leak on offload RX setup failure (CVE-2026-52974 bsc#1269233) - commit cbb91a9 - net/sched: netem: fix queue limit check to include reordered packets (CVE-2026-52984 bsc#1269272) - commit e5127d0 - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011 bsc#1269094) - commit 830fab6 - flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306 bsc#1267986) - commit 8b2c29d - vsock: fix buffer size clamping order (CVE-2026-46234 bsc#1266904) - commit 2c62c8b - HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (CVE-2026-45877 bsc#1266468) - commit 71aacb8 - HID: Intel-ish-hid: Ishtp: Fix sensor reads after ACPI S3 suspend (bsc#1266468) - commit 190ec15 - tcp: call sk_data_ready() after listener migration (CVE-2026-46015 bsc#1267439) - commit 869d8b9 - neigh: let neigh_xmit take skb ownership (CVE-2026-52981 bsc#1269254) - commit 97ed52e - ibmasm: fix heap over-read in ibmasm_send_i2o_message() (CVE-2026-46064 bsc#1267497) - commit a2c2ee6 - kcm: fix zero-frag skb in frag_list on partial sendmsg error (CVE-2026-43244 bsc#1264321). - commit 5b27b10 ++++ kernel-rt_debug: - xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (CVE-2026-53250 bsc#1269808). - commit 1b1f75e - fs/mbcache: cancel shrink work before destroying the cache (bsc#1269633 CVE-2026-53129). - commit 615aafe - Update patches.suse/bnxt_en-Fix-NULL-pointer-dereference.patch (bsc#1268307 CVE-2026-53177 bsc#1269383). - Update patches.suse/btrfs-reject-root-items-with-drop_progress-and-zero-.patch (git-fixes CVE-2026-43046 bsc#1264090). - Update patches.suse/crypto-authencesn-Do-not-place-hiseq-at-end-of-dst-f.patch (bsc#1262573 CVE-2026-31431 CVE-2026-43033 bsc#1264089). - Update patches.suse/msft-hv-3508-scsi-storvsc-Fix-scheduling-while-atomic-on-PREEMPT_.patch (git-fixes CVE-2026-43475 bsc#1264795). - Update patches.suse/msft-hv-3509-net-mana-Fix-double-destroy_workqueue-on-service-res.patch (git-fixes CVE-2026-43276 bsc#1264558). - Update patches.suse/msft-hv-3512-net-mana-Null-service_wq-on-setup-error-to-prevent-d.patch (git-fix CVE-2026-43440 bsc#1264779). - Update patches.suse/msft-hv-3525-net-mana-fix-use-after-free-in-add_adev-error-path.patch (git-fixes CVE-2026-43056 bsc#1264053). - Update patches.suse/msft-hv-3542-RDMA-mana_ib-Disable-RX-steering-on-RSS-QP-destroy.patch (bsc#1267682 CVE-2026-46084 bsc#1266758). - Update patches.suse/msft-hv-3552-net-mana-Use-pci_name-for-debugfs-directory-naming.patch (git-fixes CVE-2026-53324 bsc#1269512). - Update patches.suse/msft-hv-3566-net-mana-Guard-mana_remove-against-double-invocation.patch (git-fixes CVE-2026-53297 bsc#1269513). - Update patches.suse/msft-hv-3572-RDMA-mana-Validate-rx_hash_key_len.patch (git-fixes CVE-2026-46145 bsc#1267715). - Update patches.suse/msft-hv-3573-RDMA-mana-Remove-user-triggerable-WARN_ON-in-mana_ib.patch (git-fixes CVE-2026-46117 bsc#1267375). - Update patches.suse/msft-hv-3574-RDMA-mana-Fix-mana_destroy_wq_obj-cleanup-in-mana_ib.patch (git-fixes CVE-2026-46126 bsc#1267584). - Update patches.suse/msft-hv-3575-RDMA-mana-Fix-error-unwind-in-mana_ib_create_qp_rss.patch (git-fixes CVE-2026-46144 bsc#1266913). - Update patches.suse/net-gro-don-t-merge-zcopy-skbs.patch (git-fixes CVE-2026-46323 bsc#1268029). - Update patches.suse/ocfs2-fix-possible-deadlock-between-unlink-and-dio_e.patch (bsc#1258718 CVE-2026-31598 bsc#1263718). - Update patches.suse/ocfs2-split-transactions-in-dio-completion-to-avoid-.patch (bsc#1258718 CVE-2026-46080 bsc#1267596). - Update patches.suse/powerpc-eeh-fix-recursive-pci_lock_rescan_remove-locking-in-EEH-event-handling.patch (bsc#1253262 ltc#216029 CVE-2026-45904 bsc#1266890). - Update patches.suse/ptrace-slightly-saner-get_dumpable-logic.patch (bsc#1265308 CVE-2026-46333). - Update patches.suse/s390-entry-Scrub-r12-register-on-kernel-entry.patch (bsc#1263068 CVE-2026-31482 bsc#1262745). - Update patches.suse/s390-syscalls-Add-spectre-boundary-for-syscall-dispatch-table.patch (bsc#1263068 CVE-2026-31483 bsc#1262771). - Update patches.suse/smb-client-reject-userspace-cifs-spnego-descriptions.patch (bsc#1266238 CVE-2026-46243). - Update patches.suse/usb-ulpi-fix-memory-leak-on-ulpi_register-error-path.patch (CVE-2026-31759 bsc#1264076 CVE-2026-46109 bsc#1266850). - Update patches.suse/x86-CPU-AMD-Prevent-improper-isolation-of-shared-resources.patch (bsc#1264013 CVE-2025-54518 CVE-2026-46174 bsc#1267384). - Update patches.suse/x86-CPU-Fix-FPDSS-on-Zen1.patch (bsc#1243603 CVE-2023-2058 CVE-2026-31628 bsc#1263788). - Update patches.suse/x86-platform-uv-Handle-deconfigured-sockets.patch (bsc#1260347 CVE-2026-31542 bsc#1263010). - commit 8102903 - Update patches.suse/ACPI-processor-Fix-NULL-pointer-dereference-in-acpi_.patch (stable-fixes CVE-2026-43313 bsc#1264821). - Update patches.suse/ACPICA-Fix-NULL-pointer-dereference-in-acpi_ev_addre.patch (git-fixes CVE-2026-45982 bsc#1266872). - Update patches.suse/ALSA-6fire-fix-use-after-free-on-disconnect.patch (git-fixes CVE-2026-31581 bsc#1263167). - Update patches.suse/ALSA-PCM-Fix-wait-queue-list-corruption-in-snd_pcm_d.patch (git-fixes CVE-2026-53242 bsc#1269236). - Update patches.suse/ALSA-caiaq-fix-stack-out-of-bounds-read-in-init_card.patch (git-fixes CVE-2026-31778 bsc#1263923). - Update patches.suse/ALSA-caiaq-fix-usb_dev-refcount-leak-on-probe-failur.patch (git-fixes CVE-2026-46048 bsc#1267496). - Update patches.suse/ALSA-caiaq-take-a-reference-on-the-USB-device-in-cre.patch (git-fixes CVE-2026-31701 bsc#1263876). - Update patches.suse/ALSA-control-Validate-buf_len-before-strnlen-in-snd_.patch (git-fixes CVE-2026-46088 bsc#1267226). - Update patches.suse/ALSA-ctxfi-Add-fallback-to-default-RSR-for-S-PDIF.patch (git-fixes CVE-2026-46049 bsc#1267448). - Update patches.suse/ALSA-ctxfi-Fix-missing-SPDIFI1-index-handling.patch (stable-fixes CVE-2026-31776 bsc#1264035). - Update patches.suse/ALSA-fireworks-bound-device-supplied-status-before-s.patch (git-fixes CVE-2026-31619 bsc#1263806). - Update patches.suse/ALSA-timer-Fix-UAF-at-snd_timer_user_params.patch (stable-fixes CVE-2026-53192 bsc#1269669). - Update patches.suse/ALSA-usb-audio-Add-sanity-check-for-OOB-writes-at-si.patch (stable-fixes CVE-2026-43279 bsc#1264618). - Update patches.suse/ALSA-usb-audio-Avoid-potential-endless-loop-in-conve.patch (git-fixes CVE-2026-46146 bsc#1267571). - Update patches.suse/ALSA-usb-audio-Bound-MIDI-2.0-endpoint-descriptor-sc.patch (git-fixes CVE-2026-52964 bsc#1269178). - Update patches.suse/ALSA-usb-audio-Bound-MIDI-endpoint-descriptor-scans.patch (git-fixes CVE-2026-52963 bsc#1269177). - Update patches.suse/ALSA-usb-audio-Check-endpoint-numbers-at-parsing-Sca.patch (stable-fixes CVE-2026-43436 bsc#1264988). - Update patches.suse/ALSA-usb-audio-stop-parsing-UAC2-rates-at-MAX_NR_RAT.patch (git-fixes CVE-2026-46018 bsc#1266751). - Update patches.suse/APEI-GHES-ensure-that-won-t-go-past-CPER-allocated-r.patch (stable-fixes CVE-2026-43277 bsc#1264594). - Update patches.suse/ASoC-SOF-Don-t-allow-pointer-operations-on-unconfigu.patch (git-fixes CVE-2026-46179 bsc#1267719). - Update patches.suse/ASoC-SOF-Intel-hda-Fix-NULL-pointer-dereference.patch (stable-fixes CVE-2026-43137 bsc#1264564). - Update patches.suse/ASoC-SOF-ipc4-topology-Correct-the-allocation-size-f.patch (git-fixes CVE-2025-71286 bsc#1264615). - Update patches.suse/ASoC-amd-acp-mach-common-Add-missing-error-check-for.patch (git-fixes CVE-2026-43443 bsc#1264785). - Update patches.suse/ASoC-amd-acp3x-rt5682-max9836-Add-missing-error-chec.patch (git-fixes CVE-2026-43480 bsc#1265249). - Update patches.suse/ASoC-nau8821-Cancel-delayed-work-on-component-remove.patch (git-fixes CVE-2026-45963 bsc#1267021). - Update patches.suse/ASoC-qcom-q6apm-lpass-dai-Fix-multiple-graph-opens.patch (git-fixes CVE-2026-46143 bsc#1267712). - Update patches.suse/ASoC-qcom-q6apm-move-component-registration-to-unman.patch (git-fixes CVE-2026-31587 bsc#1263145). - Update patches.suse/ASoC-qcom-qdsp6-Fix-q6apm-remove-ordering-during-ADS.patch (git-fixes CVE-2026-43412 bsc#1265080). - Update patches.suse/ASoC-soc-core-flush-delayed-work-before-removing-DAI.patch (git-fixes CVE-2026-43459 bsc#1264768). - Update patches.suse/ASoC-sti-use-managed-regmap_field-allocations.patch (git-fixes CVE-2026-53065 bsc#1269661). - Update patches.suse/ASoC-wm_adsp-Fix-NULL-dereference-when-removing-firm.patch (git-fixes CVE-2026-53350 bsc#1270244). - Update patches.suse/Bluetooth-L2CAP-Fix-ERTM-re-init-and-zero-pdu_len-in.patch (git-fixes CVE-2026-31498 bsc#1262751). - Update patches.suse/Bluetooth-L2CAP-Fix-missing-key-size-check-for-L2CAP.patch (git-fixes CVE-2026-43134 bsc#1264308). - Update patches.suse/Bluetooth-L2CAP-Fix-null-ptr-deref-in-l2cap_sock_new.patch (git-fixes CVE-2026-45835 bsc#1266411). - Update patches.suse/Bluetooth-L2CAP-Fix-null-ptr-deref-in-l2cap_sock_sta.patch (git-fixes CVE-2026-45834 bsc#1266412). - Update patches.suse/Bluetooth-L2CAP-Fix-null-ptr-deref-on-l2cap_sock_rea.patch (git-fixes CVE-2026-31510 bsc#1262603). - Update patches.suse/Bluetooth-L2CAP-Fix-type-confusion-in-l2cap_ecred_re.patch (git-fixes CVE-2026-43062 bsc#1264197). - Update patches.suse/Bluetooth-L2CAP-reject-BR-EDR-signaling-packets-over.patch (stable-fixes CVE-2026-53208 bsc#1269899). - Update patches.suse/Bluetooth-L2CAP-use-chan-timer-to-close-channels-in-.patch (git-fixes CVE-2026-53358 bsc#1270260). - Update patches.suse/Bluetooth-MGMT-Fix-dangling-pointer-on-mgmt_add_adv_.patch (git-fixes CVE-2026-31511 bsc#1263020). - Update patches.suse/Bluetooth-MGMT-validate-LTK-enc_size-on-load.patch (git-fixes CVE-2026-43020 bsc#1264006). - Update patches.suse/Bluetooth-MGMT-validate-advertising-TLV-before-type-.patch (git-fixes CVE-2026-53255 bsc#1269378). - Update patches.suse/Bluetooth-MGMT-validate-mesh-send-advertising-payloa.patch (git-fixes CVE-2026-43017 bsc#1264009). - Update patches.suse/Bluetooth-RFCOMM-validate-skb-length-in-MCC-handlers.patch (git-fixes CVE-2026-53254 bsc#1269996). - Update patches.suse/Bluetooth-SMP-derive-legacy-responder-STK-authentica.patch (git-fixes CVE-2026-31773 bsc#1264039). - Update patches.suse/Bluetooth-btusb-clamp-SCO-altsetting-table-indices.patch (git-fixes CVE-2026-31497 bsc#1262992). - Update patches.suse/Bluetooth-hci_event-Fix-OOB-read-and-infinite-loop-i.patch (git-fixes CVE-2026-46138 bsc#1267649). - Update patches.suse/Bluetooth-hci_event-fix-potential-UAF-in-SSP-passkey.patch (git-fixes CVE-2026-46056 bsc#1267435). - Update patches.suse/Bluetooth-hci_event-fix-potential-UAF-in-hci_le_remo.patch (git-fixes CVE-2026-43018 bsc#1264008). - Update patches.suse/Bluetooth-hci_ldisc-Clear-HCI_UART_PROTO_INIT-on-err.patch (git-fixes CVE-2026-53073 bsc#1269682). - Update patches.suse/Bluetooth-hci_ll-Fix-firmware-leak-on-error-path.patch (git-fixes CVE-2026-43069 bsc#1264190). - Update patches.suse/Bluetooth-hci_sync-reject-oversized-Broadcast-Announ.patch (git-fixes CVE-2026-53209 bsc#1269304). - Update patches.suse/Bluetooth-hci_uart-fix-UAFs-and-race-conditions-in-c.patch (git-fixes CVE-2026-46275 bsc#1267968). - Update patches.suse/Bluetooth-virtio_bt-validate-rx-pkt_type-header-leng.patch (git-fixes CVE-2026-46186 bsc#1266917). - Update patches.suse/HID-alps-fix-NULL-pointer-dereference-in-alps_raw_ev.patch (git-fixes CVE-2026-31625 bsc#1263030). - Update patches.suse/HID-apple-avoid-memory-leak-in-apple_report_fixup.patch (stable-fixes CVE-2026-31520 bsc#1262653). - Update patches.suse/HID-asus-avoid-memory-leak-in-asus_report_fixup.patch (stable-fixes CVE-2026-31524 bsc#1262605). - Update patches.suse/HID-core-clamp-report_size-in-s32ton-to-avoid-undefi.patch (stable-fixes CVE-2026-31624 bsc#1263657). - Update patches.suse/HID-hid-pl-handle-probe-errors.patch (git-fixes CVE-2026-43152 bsc#1264331). - Update patches.suse/HID-logitech-hidpp-Check-maxfield-in-hidpp_get_repor.patch (stable-fixes CVE-2026-43136 bsc#1264540). - Update patches.suse/HID-magicmouse-Do-not-crash-on-missing-msc-input.patch (stable-fixes CVE-2026-43140 bsc#1264630). - Update patches.suse/HID-magicmouse-avoid-memory-leak-in-magicmouse_repor.patch (stable-fixes CVE-2026-31522 bsc#1262637). - Update patches.suse/HID-multitouch-Check-to-ensure-report-responses-matc.patch (stable-fixes CVE-2026-43047 bsc#1264073). - Update patches.suse/HID-playstation-Add-missing-check-for-input_ff_creat.patch (git-fixes CVE-2026-45969 bsc#1266743). - Update patches.suse/HID-playstation-Clamp-num_touch_reports.patch (git-fixes CVE-2026-46232 bsc#1267669). - Update patches.suse/HID-prodikeys-Check-presence-of-pm-input_ep82.patch (stable-fixes CVE-2026-43251 bsc#1264423). - Update patches.suse/HID-roccat-fix-use-after-free-in-roccat_report_event.patch (stable-fixes CVE-2026-43111 bsc#1264480). - Update patches.suse/HID-usbhid-fix-deadlock-in-hid_post_reset.patch (git-fixes CVE-2026-53037 bsc#1269081). - Update patches.suse/HID-wacom-fix-out-of-bounds-read-in-wacom_intuos_bt_.patch (stable-fixes CVE-2026-43051 bsc#1264065). - Update patches.suse/Input-uinput-fix-circular-locking-dependency-with-ff.patch (git-fixes CVE-2026-31667 bsc#1263139). - Update patches.suse/KVM-SVM-Inject-UD-for-INVLPGA-if-EFER.SVME-0.patch (git-fixes CVE-2026-46082 bsc#1267473). - Update patches.suse/KVM-nSVM-Always-use-vmcb01-in-VMLOAD-VMSAVE-emulatio.patch (git-fixes CVE-2026-43133 bsc#1264640). - Update patches.suse/KVM-x86-check-for-nEPT-nNPT-in-slow-flush-hypercalls.patch (git-fixes CVE-2026-46131 bsc#1267636). - Update patches.suse/NFC-nxp-nci-allow-GPIOs-to-sleep.patch (git-fixes CVE-2026-31545 bsc#1263013). - Update patches.suse/NFC-pn533-bound-the-UART-receive-buffer.patch (git-fixes CVE-2026-43032 bsc#1263999). - Update patches.suse/PCI-Fix-pci_slot_trylock-error-handling.patch (git-fixes CVE-2026-43211 bsc#1264387). - Update patches.suse/PCI-P2PDMA-Release-per-CPU-pgmap-ref-when-vm_insert_.patch (git-fixes CVE-2026-45880 bsc#1268223). - Update patches.suse/PCI-endpoint-Fix-swapped-parameters-in-pci_-primary-.patch (git-fixes CVE-2026-43200 bsc#1264431). - Update patches.suse/PCI-endpoint-pci-epf-ntb-Remove-duplicate-resource-t.patch (git-fixes CVE-2026-46009 bsc#1266684). - Update patches.suse/Revert-PCI-IOV-Add-PCI-rescan-remove-locking-when-en.patch (git-fixes CVE-2026-43147 bsc#1264642). - Update patches.suse/Revert-hwmon-ibmpex-fix-use-after-free-in-high-low-s.patch (git-fixes CVE-2026-45914 bsc#1266884). - Update patches.suse/USB-core-Limit-the-length-of-unkillable-synchronous-.patch (git-fixes CVE-2026-43428 bsc#1265138). - Update patches.suse/USB-dummy-hcd-Fix-interrupt-synchronization-error.patch (git-fixes CVE-2026-43324 bsc#1264803). - Update patches.suse/USB-dummy-hcd-Fix-locking-synchronization-error.patch (git-fixes CVE-2026-43327 bsc#1265078). - Update patches.suse/USB-serial-io_ti-fix-heap-overflow-in-build_i2c_fw_h.patch (git-fixes CVE-2026-53195 bsc#1269984). - Update patches.suse/USB-serial-kl5kusb105-fix-bulk-out-buffer-overflow.patch (git-fixes CVE-2026-53194 bsc#1269904). - Update patches.suse/USB-usbtmc-Use-usb_bulk_msg_killable-with-user-speci.patch (git-fixes CVE-2026-43429 bsc#1265054). - Update patches.suse/X.509-Fix-out-of-bounds-access-when-parsing-extensio.patch (git-fixes CVE-2026-31430 bsc#1262391). - Update patches.suse/accel-qaic-Handle-DBC-deactivation-if-the-owner-went.patch (git-fixes CVE-2026-43007 bsc#1264019). - Update patches.suse/agp-amd64-Fix-broken-error-propagation-in-agp_amd64_.patch (git-fixes CVE-2026-53325 bsc#1269726). - Update patches.suse/atm-fore200e-fix-use-after-free-in-tasklets-during-d.patch (git-fixes CVE-2026-43203 bsc#1264600). - Update patches.suse/batman-adv-Avoid-double-rtnl_lock-ELP-metric-worker.patch (git-fixes CVE-2026-43382 bsc#1265047). - Update patches.suse/batman-adv-bla-only-purge-non-released-claims.patch (git-fixes CVE-2026-46233 bsc#1267701). - Update patches.suse/batman-adv-bla-prevent-use-after-free-when-deleting-.patch (git-fixes CVE-2026-46212 bsc#1267693). - Update patches.suse/batman-adv-bla-put-backbone-reference-on-failed-clai.patch (git-fixes CVE-2026-46231 bsc#1267565). - Update patches.suse/batman-adv-clear-current-gateway-during-teardown.patch (git-fixes CVE-2026-52926 bsc#1269025). - Update patches.suse/batman-adv-dat-handle-forward-allocation-error.patch (git-fixes CVE-2026-52922 bsc#1269030). - Update patches.suse/batman-adv-fix-fragment-reassembly-length-accounting.patch (git-fixes CVE-2026-52914 bsc#1268986). - Update patches.suse/batman-adv-fix-integer-overflow-on-buff_pos.patch (git-fixes CVE-2026-46198 bsc#1266854). - Update patches.suse/batman-adv-fix-tp_meter-counter-underflow-during-shu.patch (git-fixes CVE-2026-52919 bsc#1269031). - Update patches.suse/batman-adv-frag-disallow-unicast-fragment-in-fragmen.patch (git-fixes CVE-2026-52916 bsc#1269002). - Update patches.suse/batman-adv-hold-claim-backbone-gateways-by-reference.patch (git-fixes CVE-2026-31657 bsc#1263175). - Update patches.suse/batman-adv-reject-new-tp_meter-sessions-during-teard.patch (git-fixes CVE-2026-46206 bsc#1266834). - Update patches.suse/batman-adv-reject-oversized-global-TT-response-buffe.patch (git-fixes CVE-2026-31659 bsc#1263495). - Update patches.suse/batman-adv-stop-caching-unowned-originator-pointers-.patch (git-fixes CVE-2026-46238 bsc#1266846). - Update patches.suse/batman-adv-tp_meter-avoid-use-of-uninit-sender-vars.patch (git-fixes CVE-2026-52931 bsc#1269008). - Update patches.suse/btrfs-fix-zero-size-inode-with-non-zero-size-after-l.patch (git-fixes CVE-2026-43118 bsc#1264417). - Update patches.suse/btrfs-tracepoints-get-correct-superblock-from-dentry-in-ev.patch (bsc#1257777 CVE-2026-43117 bsc#1264414). - Update patches.suse/can-isotp-fix-tx.buf-use-after-free-in-isotp_sendmsg.patch (git-fixes CVE-2026-31474 bsc#1262723). - Update patches.suse/can-raw-fix-ro-uniq-use-after-free-in-raw_rcv.patch (git-fixes CVE-2026-31532 bsc#1262757). - Update patches.suse/can-ucan-fix-devres-lifetime.patch (git-fixes CVE-2026-46103 bsc#1267555). - Update patches.suse/clk-qcom-gfx3d-add-parent-to-parent-request-map.patch (git-fixes CVE-2026-46247 bsc#1267666). - Update patches.suse/comedi-Reinit-dev-spinlock-between-attachments-to-lo.patch (git-fixes CVE-2026-43340 bsc#1265096). - Update patches.suse/comedi-dt2815-add-hardware-detection-to-prevent-cras.patch (stable-fixes CVE-2026-31751 bsc#1264044). - Update patches.suse/comedi-me4000-Fix-potential-overrun-of-firmware-buff.patch (git-fixes CVE-2026-31747 bsc#1264101). - Update patches.suse/comedi-me_daq-Fix-potential-overrun-of-firmware-buff.patch (git-fixes CVE-2026-31748 bsc#1264100). - Update patches.suse/comedi-ni_atmio16d-Fix-invalid-clean-up-after-failed.patch (git-fixes CVE-2026-31749 bsc#1264075). - Update patches.suse/crypto-af-alg-fix-NULL-pointer-dereference-in-scatte.patch (git-fixes CVE-2026-43043 bsc#1264088). - Update patches.suse/crypto-atmel-aes-Fix-3-page-memory-leak-in-atmel_aes.patch (git-fixes CVE-2026-46019 bsc#1266732). - Update patches.suse/crypto-atmel-sha204a-Fix-potential-UAF-and-memory-le.patch (git-fixes CVE-2026-46075 bsc#1267367). - Update patches.suse/crypto-atmel-tdes-fix-DMA-sync-direction.patch (git-fixes CVE-2026-46077 bsc#1267466). - Update patches.suse/crypto-authencesn-reject-short-ahash-digests-during-.patch (git-fixes CVE-2026-46033 bsc#1266692). - Update patches.suse/crypto-ccree-fix-a-memory-leak-in-cc_mac_digest.patch (git-fixes CVE-2026-45986 bsc#1266739). - Update patches.suse/crypto-jitterentropy-replace-long-held-spinlock-with.patch (git-fixes CVE-2026-52936 bsc#1268981). - Update patches.suse/crypto-pcrypt-Fix-handling-of-MAY_BACKLOG-requests.patch (git-fixes CVE-2026-43493 bsc#1265627). - Update patches.suse/dmaengine-idxd-Fix-leaking-event-log-memory.patch (git-fixes CVE-2026-31440 bsc#1262658). - Update patches.suse/dmaengine-idxd-Fix-memory-leak-when-a-wq-is-reset.patch (git-fixes CVE-2026-31441 bsc#1262659). - Update patches.suse/dmaengine-idxd-Fix-not-releasing-workqueue-on-.relea.patch (git-fixes CVE-2026-43064 bsc#1264189). - Update patches.suse/dmaengine-xilinx-xdma-Fix-regmap-init-error-handling.patch (git-fixes CVE-2026-31439 bsc#1262639). - Update patches.suse/drm-Account-property-blob-allocations-to-memcg.patch (stable-fixes CVE-2026-43287 bsc#1265037). - Update patches.suse/drm-amd-display-Avoid-NULL-dereference-in-dc_dmub_sr.patch (git-fixes CVE-2026-53313 bsc#1269719). - Update patches.suse/drm-amd-display-Clamp-HDMI-HDCP2-rx_id_list-read-to-.patch (git-fixes CVE-2026-53137 bsc#1269796). - Update patches.suse/drm-amd-display-Clamp-VBIOS-HDMI-retimer-register-co.patch (stable-fixes CVE-2026-53136 bsc#1269811). - Update patches.suse/drm-amd-display-Fix-NULL-deref-and-buffer-over-read-.patch (git-fixes CVE-2026-53135 bsc#1269817). - Update patches.suse/drm-amd-display-Use-krealloc_array-in-dal_vector_res.patch (git-fixes CVE-2026-53329 bsc#1270058). - Update patches.suse/drm-amdgpu-Add-bounds-checking-to-ib_-get-set-_value.patch (stable-fixes CVE-2026-46218 bsc#1267632). - Update patches.suse/drm-amdgpu-Fix-fence-put-before-wait-in-amdgpu_amdkf.patch (git-fixes CVE-2026-31566 bsc#1263055). - Update patches.suse/drm-amdgpu-Fix-memory-leak-in-amdgpu_acpi_enumerate_.patch (git-fixes CVE-2026-45947 bsc#1267198). - Update patches.suse/drm-amdgpu-Fix-memory-leak-in-amdgpu_ras_init.patch (git-fixes CVE-2026-45976 bsc#1267027). - Update patches.suse/drm-amdgpu-Fix-use-after-free-race-in-VM-acquire.patch (stable-fixes CVE-2026-43370 bsc#1264782). - Update patches.suse/drm-amdgpu-fix-AMDGPU_INFO_READ_MMR_REG.patch (git-fixes CVE-2026-53293 bsc#1269898). - Update patches.suse/drm-amdgpu-fix-sync-handling-in-amdgpu_dma_buf_move_.patch (git-fixes CVE-2026-43318 bsc#1264991). - Update patches.suse/drm-amdgpu-fix-zero-size-GDS-range-init-on-RDNA4.patch (stable-fixes CVE-2026-46276 bsc#1267922). - Update patches.suse/drm-amdgpu-sdma4-replace-BUG_ON-with-WARN_ON-in-fenc.patch (git-fixes CVE-2026-46220 bsc#1267704). - Update patches.suse/drm-amdgpu-vcn3-Prevent-OOB-reads-when-parsing-dec-m.patch (stable-fixes CVE-2026-46230 bsc#1267623). - Update patches.suse/drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-IB.patch (stable-fixes CVE-2026-46204 bsc#1267661). - Update patches.suse/drm-amdgpu-vcn4-Prevent-OOB-reads-when-parsing-dec-m.patch (stable-fixes CVE-2026-46199 bsc#1267638). - Update patches.suse/drm-amdkfd-Fix-buffer-overflow-in-SDMA-queue-checkpo.patch (git-fixes CVE-2026-53143 bsc#1269652). - Update patches.suse/drm-amdkfd-fix-NULL-dereference-in-get_queue_ids.patch (git-fixes CVE-2026-53144 bsc#1269245). - Update patches.suse/drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch (stable-fixes CVE-2026-43269 bsc#1264590). - Update patches.suse/drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch (stable-fixes CVE-2026-43236 bsc#1264538). - Update patches.suse/drm-bridge-cadence-cdns-mhdp8546-core-Set-the-mhdp-c.patch (git-fixes CVE-2026-53058 bsc#1269684). - Update patches.suse/drm-bridge-samsung-dsim-Fix-memory-leak-in-error-pat.patch (git-fixes CVE-2026-43397 bsc#1264668). - Update patches.suse/drm-buddy-Prevent-BUG_ON-by-validating-rounded-alloc.patch (git-fixes CVE-2026-43169 bsc#1264379). - Update patches.suse/drm-display-dp_mst-Add-protection-against-0-vcpi.patch (stable-fixes CVE-2025-71305 bsc#1266762). - Update patches.suse/drm-gma500-oaktrail_lvds-fix-hang-on-init-failure.patch (git-fixes CVE-2026-53279 bsc#1269505). - Update patches.suse/drm-i915-gem-Fix-phys-BO-pread-pwrite-with-offset.patch (git-fixes CVE-2026-53356 bsc#1270112). - Update patches.suse/drm-i915-gt-Check-set_default_submission-before-defe.patch (git-fixes CVE-2026-31540 bsc#1263011). - Update patches.suse/drm-ioc32-stop-speculation-on-the-drm_compat_ioctl-p.patch (git-fixes CVE-2026-31781 bsc#1264033). - Update patches.suse/drm-komeda-fix-integer-overflow-in-AFBC-framebuffer-.patch (git-fixes CVE-2026-53068 bsc#1269410). - Update patches.suse/drm-msm-dpu-fix-mismatch-between-power-and-frequency.patch (git-fixes CVE-2026-53056 bsc#1269403). - Update patches.suse/drm-nouveau-fix-u32-overflow-in-pushbuf-reloc-bounds.patch (git-fixes CVE-2026-46006 bsc#1267479). - Update patches.suse/drm-sun4i-backend-fix-error-pointer-dereference.patch (git-fixes CVE-2026-53066 bsc#1269187). - Update patches.suse/drm-v3d-Set-DMA-segment-size-to-avoid-debug-warnings.patch (stable-fixes CVE-2026-43302 bsc#1265102). - Update patches.suse/drm-vc4-Fix-a-memory-leak-in-hang-state-error-path.patch (git-fixes CVE-2026-43104 bsc#1264247). - Update patches.suse/drm-vc4-Fix-memory-leak-of-BO-array-in-hang-state.patch (git-fixes CVE-2026-43105 bsc#1264237). - Update patches.suse/drm-vc4-fix-krealloc-memory-leak.patch (git-fixes CVE-2026-53213 bsc#1269283). - Update patches.suse/drm-vc4-platform_get_irq_byname-returns-an-int.patch (stable-fixes CVE-2026-43072 bsc#1264451). - Update patches.suse/drm-virtio-Fix-driver-removal-with-disabled-KMS.patch (git-fixes CVE-2026-53347 bsc#1270241). - Update patches.suse/drm-virtio-fix-dma_fence-refcount-leak-on-error-in-v.patch (git-fixes CVE-2026-53190 bsc#1269772). - Update patches.suse/efi-Fix-reservation-of-unaccepted-memory-table.patch (git-fixes CVE-2026-45851 bsc#1266688). - Update patches.suse/efi-capsule-loader-fix-incorrect-sizeof-in-phys-arra.patch (git-fixes CVE-2026-53047 bsc#1269644). - Update patches.suse/ext4-reject-mount-if-bigalloc-with-s_first_data_bloc.patch (git-fixes CVE-2026-31447 bsc#1262614). - Update patches.suse/fbcon-check-return-value-of-con2fb_acquire_newinfo.patch (git-fixes CVE-2026-43123 bsc#1264598). - Update patches.suse/fbdev-au1200fb-Fix-a-memory-leak-in-au1200fb_drv_pro.patch (git-fixes CVE-2026-45954 bsc#1266939). - Update patches.suse/fbdev-of-display_timing-fix-refcount-leak-in-of_get_.patch (git-fixes CVE-2026-43264 bsc#1264424). - Update patches.suse/fbdev-tdfxfb-avoid-divide-by-zero-on-FBIOPUT_VSCREEN.patch (stable-fixes CVE-2026-31618 bsc#1263785). - Update patches.suse/fbdev-udlfb-add-vm_ops-to-dlfb_ops_mmap-to-prevent-u.patch (stable-fixes CVE-2026-43497 bsc#1266003). - Update patches.suse/fbdev-udlfb-avoid-divide-by-zero-on-FBIOPUT_VSCREENI.patch (git-fixes CVE-2026-31605 bsc#1263493). - Update patches.suse/fbdev-vt8500lcdfb-fix-missing-dma_free_coherent.patch (git-fixes CVE-2026-43202 bsc#1264336). - Update patches.suse/gpio-mvebu-fix-NULL-pointer-dereference-in-suspend-r.patch (git-fixes CVE-2026-53237 bsc#1269131). - Update patches.suse/gpio-omap-do-not-register-driver-in-probe.patch (git-fixes CVE-2026-31687 bsc#1263598). - Update patches.suse/hwmon-occ-Fix-division-by-zero-in-occ_show_power_1.patch (git-fixes CVE-2026-31770 bsc#1264142). - Update patches.suse/hwmon-pmbus-q54sj108a2-fix-stack-overflow-in-debugfs.patch (git-fixes CVE-2026-43380 bsc#1264780). - Update patches.suse/i2c-cp2615-fix-serial-string-NULL-deref-at-probe.patch (git-fixes CVE-2026-31549 bsc#1263025). - Update patches.suse/i2c-dev-prevent-integer-overflow-in-I2C_TIMEOUT-ioct.patch (stable-fixes CVE-2026-52948 bsc#1269116). - Update patches.suse/i2c-qcom-cci-Fix-NULL-pointer-dereference-in-cci_rem.patch (git-fixes CVE-2026-53339 bsc#1270248). - Update patches.suse/i2c-s3c24xx-check-the-size-of-the-SMBUS-message-befo.patch (stable-fixes CVE-2026-31627 bsc#1263786). - Update patches.suse/iio-adc-ti-adc161s626-use-DMA-safe-memory-for-spi_re.patch (git-fixes CVE-2026-31768 bsc#1264125). - Update patches.suse/iio-chemical-sps30_i2c-fix-buffer-size-in-sps30_i2c_.patch (git-fixes CVE-2026-43476 bsc#1265257). - Update patches.suse/iio-gyro-mpu3050-Fix-incorrect-free_irq-variable.patch (git-fixes CVE-2026-31763 bsc#1263975). - Update patches.suse/iio-gyro-mpu3050-Fix-irq-resource-leak.patch (git-fixes CVE-2026-31762 bsc#1264048). - Update patches.suse/iio-gyro-mpu3050-Move-iio_device_register-to-correct.patch (git-fixes CVE-2026-31761 bsc#1264122). - Update patches.suse/iio-gyro-mpu3050-core-fix-pm_runtime-error-handling.patch (git-fixes CVE-2026-43357 bsc#1264809). - Update patches.suse/iio-sca3000-Fix-a-resource-leak-in-sca3000_probe.patch (git-fixes CVE-2026-45883 bsc#1266774). - Update patches.suse/ima-verify-the-previous-kernel-s-IMA-buffer-lies-in-a.patch (CVE-2026-43240 bsc#1264386 CVE-2026-43129 bsc#1264553). - Update patches.suse/iommu-amd-serialize-sequence-allocation-under-concur.patch (git-fixes CVE-2026-43220 bsc#1264416). - Update patches.suse/ipmi-Add-limits-to-event-and-receive-message-request.patch (git-fixes CVE-2026-46177 bsc#1267725). - Update patches.suse/ipmi-Check-event-message-buffer-response-for-bad-dat.patch (git-fixes CVE-2026-46128 bsc#1267643). - Update patches.suse/ipmi-ipmb-initialise-event-handler-read-bytes.patch (git-fixes CVE-2026-43221 bsc#1264442). - Update patches.suse/ipmi-si-Return-state-to-normal-if-message-allocation.patch (git-fixes CVE-2026-46108 bsc#1267615). - Update patches.suse/ipv4-account-for-fraggap-on-the-paged-allocation-path.patch (git-fixes CVE-2026-53366 bsc#1271366). - Update patches.suse/media-amphion-Fix-race-between-m2m-job_abort-and-dev.patch (git-fixes CVE-2026-46058 bsc#1266677). - Update patches.suse/media-as102-fix-to-not-free-memory-after-the-device-.patch (git-fixes CVE-2026-31578 bsc#1263075). - Update patches.suse/media-ccs-Avoid-possible-division-by-zero.patch (git-fixes CVE-2026-43182 bsc#1264340). - Update patches.suse/media-cx23885-Add-missing-unmap-in-snd_cx23885_hw_pa.patch (git-fixes CVE-2026-43135 bsc#1264613). - Update patches.suse/media-cx25821-Fix-a-resource-leak-in-cx25821_dev_set.patch (stable-fixes CVE-2026-43183 bsc#1264620). - Update patches.suse/media-cx88-Add-missing-unmap-in-snd_cx88_hw_params.patch (git-fixes CVE-2026-43257 bsc#1264296). - Update patches.suse/media-em28xx-fix-use-after-free-in-em28xx_v4l2_open.patch (git-fixes CVE-2026-31583 bsc#1263173). - Update patches.suse/media-hackrf-fix-to-not-free-memory-after-the-device.patch (git-fixes CVE-2026-31576 bsc#1263073). - Update patches.suse/media-i2c-ov5647-Initialize-subdev-before-controls.patch (git-fixes CVE-2026-43312 bsc#1265101). - Update patches.suse/media-i2c-tw9903-Fix-potential-memory-leak-in-tw9903.patch (git-fixes CVE-2026-43218 bsc#1264479). - Update patches.suse/media-i2c-tw9906-Fix-potential-memory-leak-in-tw9906.patch (git-fixes CVE-2026-43246 bsc#1264322). - Update patches.suse/media-mtk-jpeg-fix-use-after-free-in-release-path-du.patch (git-fixes CVE-2026-46011 bsc#1267491). - Update patches.suse/media-mtk-mdp-Fix-a-reference-leak-bug-in-mtk_mdp_re.patch (git-fixes CVE-2026-43270 bsc#1264313). - Update patches.suse/media-mtk-mdp-Fix-error-handling-in-probe-function.patch (git-fixes CVE-2026-43207 bsc#1264365). - Update patches.suse/media-pvrusb2-fix-URB-leak-in-pvr2_send_request_ex.patch (stable-fixes CVE-2026-43223 bsc#1264645). - Update patches.suse/media-qcom-camss-vfe-Fix-out-of-bounds-access-in-vfe.patch (git-fixes CVE-2026-43256 bsc#1264425). - Update patches.suse/media-radio-keene-fix-memory-leak-in-error-path.patch (git-fixes CVE-2026-43231 bsc#1264592). - Update patches.suse/media-rc-xbox_remote-heed-DMA-restrictions.patch (git-fixes CVE-2026-46236 bsc#1266910). - Update patches.suse/media-saa7164-add-ioremap-return-checks-and-cleanups.patch (git-fixes CVE-2026-46235 bsc#1267702). - Update patches.suse/media-solo6x10-Check-for-out-of-bounds-chip_id.patch (stable-fixes CVE-2026-43316 bsc#1264826). - Update patches.suse/media-videobuf2-Set-vma_flags-in-vb2_dma_sg_mmap.patch (git-fixes CVE-2026-46312 bsc#1267990). - Update patches.suse/media-vidtv-fix-NULL-pointer-dereference-in-vidtv_ch.patch (git-fixes CVE-2026-31599 bsc#1263031). - Update patches.suse/media-vidtv-fix-nfeeds-state-corruption-on-start_str.patch (git-fixes CVE-2026-31585 bsc#1263134). - Update patches.suse/media-vidtv-fix-pass-by-value-structs-causing-MSAN-w.patch (git-fixes CVE-2026-43058 bsc#1264129). - Update patches.suse/memory-tegra124-emc-Fix-dll_change-check.patch (git-fixes CVE-2026-53045 bsc#1269404). - Update patches.suse/mfd-arizona-Fix-regulator-resource-leak-on-wm5102_cl.patch (git-fixes CVE-2026-45875 bsc#1266707). - Update patches.suse/mfd-core-Add-locking-around-mfd_of_node_list.patch (git-fixes CVE-2026-43143 bsc#1264388). - Update patches.suse/misc-bcm_vk-Fix-possible-null-pointer-dereferences-i.patch (stable-fixes CVE-2025-71291 bsc#1264560). - Update patches.suse/misc-fastrpc-Fix-NULL-pointer-dereference-in-rpmsg-c.patch (git-fixes CVE-2026-53158 bsc#1269385). - Update patches.suse/misc-fastrpc-fix-DMA-address-corruption-due-to-find_.patch (git-fixes CVE-2026-53159 bsc#1269654). - Update patches.suse/misc-fastrpc-fix-use-after-free-of-fastrpc_user-in-w.patch (git-fixes CVE-2026-53161 bsc#1269255). - Update patches.suse/misc-fastrpc-fix-use-after-free-race-in-fastrpc_map_.patch (git-fixes CVE-2026-53160 bsc#1269670). - Update patches.suse/misc-fastrpc-possible-double-free-of-cctx-remote_hea.patch (git-fixes CVE-2026-31730 bsc#1264041). - Update patches.suse/mmc-vub300-fix-NULL-deref-on-disconnect.patch (git-fixes CVE-2026-31651 bsc#1263111). - Update patches.suse/mtd-docg3-fix-use-after-free-in-docg3_release.patch (git-fixes CVE-2026-46285 bsc#1267948). - Update patches.suse/mtd-parsers-Fix-memory-leak-in-mtd_parser_tplink_saf.patch (git-fixes CVE-2026-45921 bsc#1266806). - Update patches.suse/net-mlx5-Fix-crash-when-moving-to-switchdev-mode.patch (git-fixes CVE-2026-43467 bsc#1264791). - Update patches.suse/net-nfc-nci-Fix-parameter-validation-for-packet-data.patch (git-fixes CVE-2026-43291 bsc#1264819). - Update patches.suse/net-sched-cls_fw-fix-NULL-dereference-of-old-filters-befor.patch (git-fixes CVE-2026-53080 bsc#1269141). - Update patches.suse/net-usb-catc-enable-basic-endpoint-checking.patch (git-fixes CVE-2026-45923 bsc#1266894). - Update patches.suse/net-usb-cdc-phonet-fix-skb-frags-overflow-in-rx_comp.patch (git-fixes CVE-2026-31623 bsc#1263778). - Update patches.suse/net-usb-kaweth-remove-TX-queue-manipulation-in-kawet.patch (git-fixes CVE-2026-43180 bsc#1265093). - Update patches.suse/net-usb-pegasus-enable-basic-endpoint-checking.patch (git-fixes CVE-2026-43156 bsc#1265092). - Update patches.suse/net-usb-rtl8150-fix-use-after-free-in-rtl8150_start_.patch (git-fixes CVE-2026-52982 bsc#1269258). - Update patches.suse/net-wan-farsync-Fix-use-after-free-bugs-caused-by-un.patch (git-fixes CVE-2026-43232 bsc#1264633). - Update patches.suse/net-wan-fsl_ucc_hdlc-Fix-dma_free_coherent-in-uhdlc_.patch (git-fixes CVE-2026-43149 bsc#1264315). - Update patches.suse/net-x25-Fix-potential-double-free-of-skb.patch (git-fixes CVE-2026-43011 bsc#1264079). - Update patches.suse/nfc-hci-shdlc-Stop-timers-and-work-before-freeing-co.patch (git-fixes CVE-2026-46267 bsc#1267630). - Update patches.suse/nfc-nci-fix-circular-locking-dependency-in-nci_close.patch (git-fixes CVE-2026-31509 bsc#1263097). - Update patches.suse/nfc-pn533-allocate-rx-skb-before-consuming-bytes.patch (git-fixes CVE-2026-31660 bsc#1263539). - Update patches.suse/nfc-s3fwrn5-allocate-rx-skb-before-consuming-bytes.patch (git-fixes CVE-2026-43098 bsc#1264257). - Update patches.suse/nouveau-dpcd-return-EBUSY-for-aux-xfer-if-the-device.patch (git-fixes CVE-2026-43381 bsc#1265105). - Update patches.suse/ntb-ntb_hw_switchtec-Fix-array-index-out-of-bounds-a.patch (stable-fixes CVE-2026-43241 bsc#1264844). - Update patches.suse/ntb-ntb_hw_switchtec-Fix-shift-out-of-bounds-for-0-m.patch (stable-fixes CVE-2026-43141 bsc#1264626). - Update patches.suse/nvmet-tcp-propagate-nvmet_tcp_build_pdu_iovec-errors.patch (git-fixes CVE-2026-52989 bsc#1269364). - Update patches.suse/openvswitch-vport-fix-self-deadlock-on-release-of-tunnel-p.patch (CVE-2026-31678 bsc#1263562 CVE-2026-46165 bsc#1266836). - Update patches.suse/pinctrl-single-fix-refcount-leak-in-pcs_add_gpio_fun.patch (git-fixes CVE-2026-45868 bsc#1266741). - Update patches.suse/platform-x86-dell-wmi-sysman-bound-enumeration-strin.patch (git-fixes CVE-2026-53022 bsc#1269153). - Update patches.suse/power-supply-ab8500-Fix-use-after-free-in-power_supp.patch (git-fixes CVE-2026-45946 bsc#1268221). - Update patches.suse/power-supply-act8945a-Fix-use-after-free-in-power_su.patch (git-fixes CVE-2026-45867 bsc#1268220). - Update patches.suse/power-supply-bq256xx-Fix-use-after-free-in-power_sup.patch (git-fixes CVE-2026-45902 bsc#1266886). - Update patches.suse/power-supply-bq25980-Fix-use-after-free-in-power_sup.patch (git-fixes CVE-2026-45879 bsc#1266703). - Update patches.suse/power-supply-cpcap-battery-Fix-use-after-free-in-pow.patch (git-fixes CVE-2026-45885 bsc#1266780). - Update patches.suse/power-supply-goldfish-Fix-use-after-free-in-power_su.patch (git-fixes CVE-2026-45936 bsc#1266947). - Update patches.suse/power-supply-rt9455-Fix-use-after-free-in-power_supp.patch (git-fixes CVE-2026-46270 bsc#1267680). - Update patches.suse/power-supply-sbs-battery-Fix-use-after-free-in-power.patch (git-fixes CVE-2026-45916 bsc#1266679). - Update patches.suse/power-supply-wm97xx-Fix-NULL-pointer-dereference-in-.patch (git-fixes CVE-2026-45869 bsc#1266467). - Update patches.suse/rapidio-replace-rio_free_net-with-kfree-in-rio_scan_.patch (git-fixes CVE-2026-43295 bsc#1265100). - Update patches.suse/regulator-core-fix-locking-in-regulator_resolve_supp.patch (git-fixes CVE-2026-46252 bsc#1267676). - Update patches.suse/remoteproc-xlnx-Only-access-buffer-information-if-IP.patch (git-fixes CVE-2026-46016 bsc#1266729). - Update patches.suse/rpmsg-core-fix-race-in-driver_override_show-and-use-.patch (git-fixes CVE-2025-71274 bsc#1264377). - Update patches.suse/sched-rt-Skip-currently-executing-CPU-in-rto_next_cpu.patch (bsc#1262649 CVE-2026-45919 bsc#1266777). - Update patches.suse/sctp-disable-BH-before-calling-udp_tunnel_xmit_skb.patch (CVE-2026-23276 bsc#1260012 CVE-2026-53070 bsc#1269674). - Update patches.suse/serial-8250-Fix-TX-deadlock-when-using-DMA.patch (git-fixes CVE-2026-43061 bsc#1264188). - Update patches.suse/soc-mediatek-svs-Fix-memory-leak-in-svs_enable_debug.patch (git-fixes CVE-2026-45881 bsc#1266721). - Update patches.suse/soc-ti-k3-socinfo-Fix-regmap-leak-on-probe-failure.patch (git-fixes CVE-2026-43242 bsc#1264338). - Update patches.suse/soc-ti-pruss-Fix-double-free-in-pruss_clk_mux_setup.patch (git-fixes CVE-2026-43196 bsc#1264436). - Update patches.suse/sound-ua101-fix-division-by-zero-at-probe.patch (git-fixes CVE-2026-46184 bsc#1266864). - Update patches.suse/spi-imx-fix-use-after-free-on-unbind.patch (git-fixes CVE-2026-45996 bsc#1267436). - Update patches.suse/spi-mpc52xx-fix-use-after-free-on-unbind.patch (git-fixes CVE-2026-46219 bsc#1267667). - Update patches.suse/spi-rspi-fix-controller-deregistration.patch (git-fixes CVE-2026-46225 bsc#1267627). - Update patches.suse/spi-spi-fsl-lpspi-fix-teardown-order-issue-UAF.patch (git-fixes CVE-2026-31485 bsc#1262768). - Update patches.suse/spi-wpcm-fiu-Fix-potential-NULL-pointer-dereference-.patch (git-fixes CVE-2026-46261 bsc#1267646). - Update patches.suse/staging-media-atomisp-Disallow-all-private-IOCTLs.patch (git-fixes CVE-2026-46205 bsc#1266908). - Update patches.suse/staging-rtl8723bs-fix-memory-leak-on-failure-path.patch (stable-fixes CVE-2026-43225 bsc#1264526). - Update patches.suse/staging-rtl8723bs-fix-null-dereference-in-find_netwo.patch (git-fixes CVE-2026-43159 bsc#1264616). - Update patches.suse/staging-rtl8723bs-initialize-le_tmp64-in-rtw_BIP_ver.patch (git-fixes CVE-2026-31626 bsc#1263782). - Update patches.suse/staging-rtl8723bs-properly-validate-the-data-in-rtw_.patch (stable-fixes CVE-2026-43387 bsc#1265032). - Update patches.suse/staging-sm750fb-fix-division-by-zero-in-ps_to_hz.patch (git-fixes CVE-2026-31603 bsc#1263491). - Update patches.suse/thunderbolt-Bound-root-directory-content-to-block-si.patch (git-fixes CVE-2026-53149 bsc#1269733). - Update patches.suse/thunderbolt-Clamp-XDomain-response-data-copy-to-allo.patch (git-fixes CVE-2026-53148 bsc#1269786). - Update patches.suse/thunderbolt-Limit-XDomain-response-copy-to-actual-fr.patch (git-fixes CVE-2026-53146 bsc#1269826). - Update patches.suse/thunderbolt-Reject-zero-length-property-entries-in-v.patch (git-fixes CVE-2026-53150 bsc#1269386). - Update patches.suse/thunderbolt-Validate-XDomain-request-packet-size-bef.patch (git-fixes CVE-2026-53147 bsc#1269709). - Update patches.suse/tpm-st33zp24-Fix-missing-cleanup-on-get_burstcount-e.patch (git-fixes CVE-2026-45871 bsc#1266755). - Update patches.suse/tpm-tpm_i2c_infineon-Fix-locality-leak-on-get_burstc.patch (git-fixes CVE-2026-45941 bsc#1266920). - Update patches.suse/usb-cdns3-fix-role-switching-during-resume.patch (git-fixes CVE-2026-45911 bsc#1266898). - Update patches.suse/usb-cdns3-gadget-fix-NULL-pointer-dereference-in-ep_.patch (git-fixes CVE-2026-31755 bsc#1264071). - Update patches.suse/usb-cdns3-gadget-fix-state-inconsistency-on-gadget-i.patch (git-fixes CVE-2026-31754 bsc#1264074). - Update patches.suse/usb-class-cdc-wdm-fix-reordering-issue-in-read-code-.patch (git-fixes CVE-2026-43427 bsc#1264746). - Update patches.suse/usb-dwc2-gadget-Fix-spin_lock-unlock-mismatch-in-dwc.patch (git-fixes CVE-2026-31756 bsc#1264070). - Update patches.suse/usb-gadget-f_ncm-validate-minimum-block_len-in-ncm_u.patch (git-fixes CVE-2026-31617 bsc#1263780). - Update patches.suse/usb-gadget-f_phonet-fix-skb-frags-overflow-in-pn_rx_.patch (stable-fixes CVE-2026-31616 bsc#1263777). - Update patches.suse/usb-gadget-f_rndis-Protect-RNDIS-options-with-mutex.patch (git-fixes CVE-2026-43342 bsc#1264758). - Update patches.suse/usb-gadget-f_subset-Fix-unbalanced-refcnt-in-geth_fr.patch (git-fixes CVE-2026-43343 bsc#1264816). - Update patches.suse/usb-gadget-f_uac1_legacy-validate-control-request-si.patch (stable-fixes CVE-2026-31720 bsc#1264110). - Update patches.suse/usb-gadget-renesas_usb3-validate-endpoint-index-in-s.patch (git-fixes CVE-2026-31615 bsc#1263776). - Update patches.suse/usb-gadget-u_ether-Fix-NULL-pointer-deref-in-eth_get.patch (git-fixes CVE-2026-31727 bsc#1263904). - Update patches.suse/usb-gadget-u_ether-Fix-race-between-gether_disconnec.patch (git-fixes CVE-2026-31728 bsc#1263911). - Update patches.suse/usb-gadget-uvc-fix-NULL-pointer-dereference-during-u.patch (git-fixes CVE-2026-31726 bsc#1263905). - Update patches.suse/usb-image-mdc800-kill-download-URB-on-timeout.patch (stable-fixes CVE-2026-43425 bsc#1265133). - Update patches.suse/usb-renesas_usbhs-fix-use-after-free-in-ISR-during-d.patch (git-fixes CVE-2026-43426 bsc#1265074). - Update patches.suse/usb-usblp-fix-heap-leak-in-IEEE-1284-device-ID-via-s.patch (stable-fixes CVE-2026-46151 bsc#1267728). - Update patches.suse/usb-usblp-fix-uninitialized-heap-leak-via-LPGETSTATU.patch (stable-fixes CVE-2026-46167 bsc#1266832). - Update patches.suse/usb-xhci-Fix-memory-leak-in-xhci_disable_slot.patch (git-fixes CVE-2026-43432 bsc#1264783). - Update patches.suse/usb-xhci-Prevent-interrupt-storm-on-host-controller-.patch (stable-fixes CVE-2026-43488 bsc#1265264). - Update patches.suse/usb-yurex-fix-race-in-probe.patch (stable-fixes CVE-2026-43430 bsc#1264677). - Update patches.suse/wifi-ath5k-do-not-access-array-OOB.patch (git-fixes CVE-2026-46307 bsc#1267987). - Update patches.suse/wifi-b43-enforce-bounds-check-on-firmware-key-index-.patch (git-fixes CVE-2026-46122 bsc#1267583). - Update patches.suse/wifi-b43legacy-enforce-bounds-check-on-firmware-key-.patch (git-fixes CVE-2026-46163 bsc#1266863). - Update patches.suse/wifi-brcmfmac-Fix-error-pointer-dereference.patch (git-fixes CVE-2026-53093 bsc#1269414). - Update patches.suse/wifi-brcmsmac-Fix-dma_free_coherent-size.patch (git-fixes CVE-2026-31661 bsc#1263128). - Update patches.suse/wifi-cfg80211-cancel-pmsr_free_wk-in-cfg80211_pmsr_w.patch (git-fixes CVE-2026-31548 bsc#1263008). - Update patches.suse/wifi-iwlwifi-mvm-fix-potential-out-of-bounds-read-in.patch (git-fixes CVE-2026-31779 bsc#1264030). - Update patches.suse/wifi-libertas-fix-WARNING-in-usb_tx_block.patch (stable-fixes CVE-2026-43255 bsc#1264473). - Update patches.suse/wifi-mac80211-Fix-static_branch_dec-underflow-for-aq.patch (git-fixes CVE-2026-31551 bsc#1263014). - Update patches.suse/wifi-mac80211-drop-stray-static-from-fast-RX-rx_resu.patch (git-fixes CVE-2026-46152 bsc#1266855). - Update patches.suse/wifi-mac80211-remove-station-if-connection-prep-fail.patch (git-fixes CVE-2026-46125 bsc#1266879). - Update patches.suse/wifi-mt76-mt7915-fix-use-after-free-bugs-in-mt7915_m.patch (git-fixes CVE-2026-53098 bsc#1269976). - Update patches.suse/wifi-mt76-mt7921-fix-a-potential-clc-buffer-length-u.patch (git-fixes CVE-2026-46136 bsc#1266831). - Update patches.suse/wifi-rsi-fix-kthread-lifetime-race-between-self-exit.patch (git-fixes CVE-2026-46187 bsc#1266842). - Update patches.suse/wifi-rt2x00usb-fix-devres-lifetime.patch (git-fixes CVE-2026-31672 bsc#1263142). - Update patches.suse/wifi-rtlwifi-pci-fix-possible-use-after-free-caused-.patch (git-fixes CVE-2026-53112 bsc#1269998). - Update patches.suse/wifi-rtw88-8822b-Avoid-WARNING-in-rtw8822b_config_tr.patch (stable-fixes CVE-2025-71297 bsc#1264830). - Update patches.suse/wifi-rtw88-check-for-PCI-upstream-bridge-existence.patch (git-fixes CVE-2026-46092 bsc#1267595). - Update patches.suse/wifi-rtw88-fix-device-leak-on-probe-failure.patch (git-fixes CVE-2026-31604 bsc#1263045). - Update patches.suse/wifi-wilc1000-fix-u8-overflow-in-SSID-scan-buffer-si.patch (git-fixes CVE-2026-31780 bsc#1264032). - Update patches.suse/wifi-wl1251-validate-packet-IDs-before-indexing-tx_f.patch (stable-fixes CVE-2026-43113 bsc#1264637). - Update patches.suse/wifi-wlcore-Return-ENOMEM-instead-of-EAGAIN-if-there.patch (git-fixes CVE-2026-31552 bsc#1263016). - commit 9043982 - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239 bsc#1269677). - commit e28f7cf - netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268 bsc#1269257). - commit 2c13e43 - vsock/virtio: fix empty payload in tap skb for non-linear buffers (CVE-2026-46207 bsc#1267691). - commit fadb0f2 - vsock/virtio: fix length and offset in tap skb for split packets (CVE-2026-46207 bsc#1267691). - commit 1ce6ee2 - fbcon: Avoid OOB font access if console rotation fails (bsc#1267690 CVE-2026-46191) - commit e1c5dbc - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() (CVE-2026-53262 bsc#1270000). - commit a2b7211 - net: bcmgenet: move DESC_INDEX flow to ring 0 (CVE-2026-53086 bsc#1269537). - Refresh patches.suse/net-bcmgenet-fix-racing-timeout-handler.patch. - commit 21ba2b5 - net: bcmgenet: Reset RBUF on first open (CVE-2026-53086 bsc#1269537). - commit 9f413dc - net: bcmgenet: Remove TX ring full logging (CVE-2026-53086 bsc#1269537). - commit cf56f3c - netfilter: nft_ct: fix missing expect put in obj eval (CVE-2026-52970 bsc#1269229) - commit 6dc70e5 - netfilter: nft_tunnel: fix use-after-free on object destroy (CVE-2026-53212 bsc#1269672) - commit 184d0a8 - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush (CVE-2026-53175 bsc#1269714) - commit 8254a3f - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() (CVE-2026-53221 bsc#1269318) - commit f10b90f - ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006 bsc#1269104) - commit 9185932 - nexthop: fix IPv6 route referencing IPv4 nexthop (CVE-2026-53012 bsc#1269154) - commit 870437e - net: tls: fix strparser anchor skb leak on offload RX setup failure (CVE-2026-52974 bsc#1269233) - commit cbb91a9 - net/sched: netem: fix queue limit check to include reordered packets (CVE-2026-52984 bsc#1269272) - commit e5127d0 - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011 bsc#1269094) - commit 830fab6 - flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306 bsc#1267986) - commit 8b2c29d - vsock: fix buffer size clamping order (CVE-2026-46234 bsc#1266904) - commit 2c62c8b - HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (CVE-2026-45877 bsc#1266468) - commit 71aacb8 - HID: Intel-ish-hid: Ishtp: Fix sensor reads after ACPI S3 suspend (bsc#1266468) - commit 190ec15 - tcp: call sk_data_ready() after listener migration (CVE-2026-46015 bsc#1267439) - commit 869d8b9 - neigh: let neigh_xmit take skb ownership (CVE-2026-52981 bsc#1269254) - commit 97ed52e - ibmasm: fix heap over-read in ibmasm_send_i2o_message() (CVE-2026-46064 bsc#1267497) - commit a2c2ee6 - kcm: fix zero-frag skb in frag_list on partial sendmsg error (CVE-2026-43244 bsc#1264321). - commit 5b27b10 ++++ nvidia-open-driver-G06-signed: - update non-CUDA variant to version 580.178.04 (boo#1271603) ++++ python-pyasn1: - CVE-2026-59884: BER/CER/DER decoder denial of service via unbounded long-form tag IDs (bsc#1271464) * added CVE-2026-59884.patch - CVE-2026-59885: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service (bsc#1271465) * added CVE-2026-59885.patch - CVE-2026-59886: Uncontrolled resource consumption when converting decoded REAL values (bsc#1271466) * added CVE-2026-59886.patch ------------------------------------------------------------------ ------------------ 2026-7-15 - Jul 15 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task (CVE-2026-46180 bsc#1266813) - commit aedf17c - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (CVE-2026-53218 bsc#1269273) - commit bfa1122 - netfilter: ip6t_hbh: reject oversized option lists (CVE-2026-52915 bsc#1269001) - commit d8bfff1 - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (CVE-2026-45839 bsc#1266399) - commit dde76a6 - dm mirror: fix integer overflow in create_dirty_log() (CVE-2026-46023 bsc#1267449) - commit f7013cc - ibmasm: fix OOB reads in command_file_write due to missing size checks (CVE-2026-45994 bsc#1267432) - commit db36e77 - s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (CVE-2026-45981 bsc#1267204) - commit 0e65e9d - net: strparser: fix skb_head leak in strp_abort_strp() (CVE-2026-46102 bsc#1267502) - commit fe556d2 - net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (CVE-2026-43496 bsc#1266000) - commit 9abcb52 - i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (CVE-2026-43353 bsc#1265089) - commit a3f828f - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (CVE-2026-46040 bsc#1267472) - commit 4e7ceae - zram: do not forget to endio for partial discard requests (CVE-2026-46089 bsc#1267445). - commit db02a17 - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo (CVE-2026-46132 bsc#1267616). - commit 49150c8 - crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx (CVE-2026-46068 bsc#1267592). - commit 1061c80 - net: openvswitch: fix possible kfree_skb of ERR_PTR (CVE-2026-53227 bsc#1269877). - net: rds: clear i_sends on setup unwind (CVE-2026-53355 bsc#1270249). - tun: free page on short-frame rejection in tun_xdp_one() (CVE-2026-46321 bsc#1268024). - net/smc: avoid early lgr access in smc_clc_wait_msg (CVE-2026-46027 bsc#1266744). - net/rds: zero per-item info buffer before handing it to visitors (CVE-2026-52995 bsc#1269124). - pppoe: drop PFC frames (CVE-2026-53003 bsc#1269111). - ice: fix double-free of tx_buf skb (CVE-2026-53009 bsc#1269098). - net: bridge: use a stable FDB dst snapshot in RCU readers (CVE-2026-46086 bsc#1267524). - macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF (CVE-2026-53013 bsc#1269095). - octeontx2-af: Fix PF driver crash with kexec kernel booting (CVE-2026-46249 bsc#1267683). - commit 222d2dd - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (CVE-2026-53004 bsc#1269106) - commit b8721f0 - iommu/vt-d: Fix oops due to out of scope access (CVE-2026-52953 bsc#1269133). - commit fa45aa6 - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() (CVE-2026-53225 bsc#1269711) - commit fc7b364 - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947 bsc#1269115). - net: qrtr: ns: Limit the total number of nodes (CVE-2026-46003 bsc#1267210). - net: qrtr: ns: Free the node during ctrl_cmd_bye() (CVE-2026-46038 bsc#1266695). - net: qrtr: ns: Limit the maximum number of lookups (CVE-2026-46026 bsc#1266876). - commit d39451d - sctp: validate embedded address parameter length (git-fixes) - commit 30715bc - sctp: validate embedded INIT chunk and address list lengths in cookie (CVE-2026-53224 bsc#1269997) - commit 0ee7e9b - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246 bsc#1269988) - commit b6d2069 - sctp: validate embedded address parameter length (git-fixes) - commit 4a82278 - sctp: validate embedded INIT chunk and address list lengths in cookie (CVE-2026-53224 bsc#1269997) - commit d30084b - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246 bsc#1269988) - commit 4720078 - RDMA/srp: bound SRP_RSP sense copy by the received length (CVE-2026-53186 bsc#1269663) - commit 405a18c - Refresh patches.suse/net-correctly-handle-tunneled-traffic-on-IPV6_CSUM-GSO-fal.patch. - commit cf8b2df - ALSA: hda: conexant: Remove mic bias threshold override (git-fixes). - ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC (git-fixes). - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup (git-fixes). - ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() (git-fixes). - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop (git-fixes). - ALSA: hda: Fix cached processing coefficient verbs (git-fixes). - selftests/alsa: Fix memory leak in find_controls error path (git-fixes). - commit b0fbf18 ++++ kernel-rt: - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task (CVE-2026-46180 bsc#1266813) - commit aedf17c - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (CVE-2026-53218 bsc#1269273) - commit bfa1122 - netfilter: ip6t_hbh: reject oversized option lists (CVE-2026-52915 bsc#1269001) - commit d8bfff1 - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (CVE-2026-45839 bsc#1266399) - commit dde76a6 - dm mirror: fix integer overflow in create_dirty_log() (CVE-2026-46023 bsc#1267449) - commit f7013cc - ibmasm: fix OOB reads in command_file_write due to missing size checks (CVE-2026-45994 bsc#1267432) - commit db36e77 - s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (CVE-2026-45981 bsc#1267204) - commit 0e65e9d - net: strparser: fix skb_head leak in strp_abort_strp() (CVE-2026-46102 bsc#1267502) - commit fe556d2 - net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (CVE-2026-43496 bsc#1266000) - commit 9abcb52 - i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (CVE-2026-43353 bsc#1265089) - commit a3f828f - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (CVE-2026-46040 bsc#1267472) - commit 4e7ceae - zram: do not forget to endio for partial discard requests (CVE-2026-46089 bsc#1267445). - commit db02a17 - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo (CVE-2026-46132 bsc#1267616). - commit 49150c8 - crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx (CVE-2026-46068 bsc#1267592). - commit 1061c80 - net: openvswitch: fix possible kfree_skb of ERR_PTR (CVE-2026-53227 bsc#1269877). - net: rds: clear i_sends on setup unwind (CVE-2026-53355 bsc#1270249). - tun: free page on short-frame rejection in tun_xdp_one() (CVE-2026-46321 bsc#1268024). - net/smc: avoid early lgr access in smc_clc_wait_msg (CVE-2026-46027 bsc#1266744). - net/rds: zero per-item info buffer before handing it to visitors (CVE-2026-52995 bsc#1269124). - pppoe: drop PFC frames (CVE-2026-53003 bsc#1269111). - ice: fix double-free of tx_buf skb (CVE-2026-53009 bsc#1269098). - net: bridge: use a stable FDB dst snapshot in RCU readers (CVE-2026-46086 bsc#1267524). - macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF (CVE-2026-53013 bsc#1269095). - octeontx2-af: Fix PF driver crash with kexec kernel booting (CVE-2026-46249 bsc#1267683). - commit 222d2dd - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (CVE-2026-53004 bsc#1269106) - commit b8721f0 - iommu/vt-d: Fix oops due to out of scope access (CVE-2026-52953 bsc#1269133). - commit fa45aa6 - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() (CVE-2026-53225 bsc#1269711) - commit fc7b364 - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947 bsc#1269115). - net: qrtr: ns: Limit the total number of nodes (CVE-2026-46003 bsc#1267210). - net: qrtr: ns: Free the node during ctrl_cmd_bye() (CVE-2026-46038 bsc#1266695). - net: qrtr: ns: Limit the maximum number of lookups (CVE-2026-46026 bsc#1266876). - commit d39451d - sctp: validate embedded address parameter length (git-fixes) - commit 30715bc - sctp: validate embedded INIT chunk and address list lengths in cookie (CVE-2026-53224 bsc#1269997) - commit 0ee7e9b - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246 bsc#1269988) - commit b6d2069 - sctp: validate embedded address parameter length (git-fixes) - commit 4a82278 - sctp: validate embedded INIT chunk and address list lengths in cookie (CVE-2026-53224 bsc#1269997) - commit d30084b - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246 bsc#1269988) - commit 4720078 - RDMA/srp: bound SRP_RSP sense copy by the received length (CVE-2026-53186 bsc#1269663) - commit 405a18c - Refresh patches.suse/net-correctly-handle-tunneled-traffic-on-IPV6_CSUM-GSO-fal.patch. - commit cf8b2df - ALSA: hda: conexant: Remove mic bias threshold override (git-fixes). - ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC (git-fixes). - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup (git-fixes). - ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() (git-fixes). - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop (git-fixes). - ALSA: hda: Fix cached processing coefficient verbs (git-fixes). - selftests/alsa: Fix memory leak in find_controls error path (git-fixes). - commit b0fbf18 ++++ kernel-rt_debug: - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task (CVE-2026-46180 bsc#1266813) - commit aedf17c - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (CVE-2026-53218 bsc#1269273) - commit bfa1122 - netfilter: ip6t_hbh: reject oversized option lists (CVE-2026-52915 bsc#1269001) - commit d8bfff1 - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (CVE-2026-45839 bsc#1266399) - commit dde76a6 - dm mirror: fix integer overflow in create_dirty_log() (CVE-2026-46023 bsc#1267449) - commit f7013cc - ibmasm: fix OOB reads in command_file_write due to missing size checks (CVE-2026-45994 bsc#1267432) - commit db36e77 - s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (CVE-2026-45981 bsc#1267204) - commit 0e65e9d - net: strparser: fix skb_head leak in strp_abort_strp() (CVE-2026-46102 bsc#1267502) - commit fe556d2 - net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (CVE-2026-43496 bsc#1266000) - commit 9abcb52 - i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (CVE-2026-43353 bsc#1265089) - commit a3f828f - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (CVE-2026-46040 bsc#1267472) - commit 4e7ceae - zram: do not forget to endio for partial discard requests (CVE-2026-46089 bsc#1267445). - commit db02a17 - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo (CVE-2026-46132 bsc#1267616). - commit 49150c8 - crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx (CVE-2026-46068 bsc#1267592). - commit 1061c80 - net: openvswitch: fix possible kfree_skb of ERR_PTR (CVE-2026-53227 bsc#1269877). - net: rds: clear i_sends on setup unwind (CVE-2026-53355 bsc#1270249). - tun: free page on short-frame rejection in tun_xdp_one() (CVE-2026-46321 bsc#1268024). - net/smc: avoid early lgr access in smc_clc_wait_msg (CVE-2026-46027 bsc#1266744). - net/rds: zero per-item info buffer before handing it to visitors (CVE-2026-52995 bsc#1269124). - pppoe: drop PFC frames (CVE-2026-53003 bsc#1269111). - ice: fix double-free of tx_buf skb (CVE-2026-53009 bsc#1269098). - net: bridge: use a stable FDB dst snapshot in RCU readers (CVE-2026-46086 bsc#1267524). - macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF (CVE-2026-53013 bsc#1269095). - octeontx2-af: Fix PF driver crash with kexec kernel booting (CVE-2026-46249 bsc#1267683). - commit 222d2dd - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (CVE-2026-53004 bsc#1269106) - commit b8721f0 - iommu/vt-d: Fix oops due to out of scope access (CVE-2026-52953 bsc#1269133). - commit fa45aa6 - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() (CVE-2026-53225 bsc#1269711) - commit fc7b364 - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947 bsc#1269115). - net: qrtr: ns: Limit the total number of nodes (CVE-2026-46003 bsc#1267210). - net: qrtr: ns: Free the node during ctrl_cmd_bye() (CVE-2026-46038 bsc#1266695). - net: qrtr: ns: Limit the maximum number of lookups (CVE-2026-46026 bsc#1266876). - commit d39451d - sctp: validate embedded address parameter length (git-fixes) - commit 30715bc - sctp: validate embedded INIT chunk and address list lengths in cookie (CVE-2026-53224 bsc#1269997) - commit 0ee7e9b - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246 bsc#1269988) - commit b6d2069 - sctp: validate embedded address parameter length (git-fixes) - commit 4a82278 - sctp: validate embedded INIT chunk and address list lengths in cookie (CVE-2026-53224 bsc#1269997) - commit d30084b - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246 bsc#1269988) - commit 4720078 - RDMA/srp: bound SRP_RSP sense copy by the received length (CVE-2026-53186 bsc#1269663) - commit 405a18c - Refresh patches.suse/net-correctly-handle-tunneled-traffic-on-IPV6_CSUM-GSO-fal.patch. - commit cf8b2df - ALSA: hda: conexant: Remove mic bias threshold override (git-fixes). - ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC (git-fixes). - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup (git-fixes). - ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() (git-fixes). - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop (git-fixes). - ALSA: hda: Fix cached processing coefficient verbs (git-fixes). - selftests/alsa: Fix memory leak in find_controls error path (git-fixes). - commit b0fbf18 ++++ pcr-oracle: - Update to 0.6.4 + Support TPM PCR snapshot on PowerPC 64 platform + Fix SBAT string length calculations (bsc#1270265) ++++ perl: - fix crash when parsing malformed DOS dates in IO:Uncompress:Unzip [bsc#1266361] [CVE-2025-15649] * new patch: perl-unzip-timelocal.diff - fix integer overflow in leading to an out-of-bounds heap read in pack and unpack [bsc#1271372] [CVE-2026-57432] * new patch: perl-pack-measure-ovfl.diff - fix potential out-of-bounds heap read in the Socket module [bsc#1268349] [CVE-2026-12087] * new patch: perl-socket-mreq-len.diff - heap buffer overflow when compiling regular expressions with a repeated fixed string [bsc#1266304] [CVE-2026-8376] * new patch: perl-study-rep-ovfl.diff - fix overflow in regex trie branch count calculation [bsc#1271386] [CVE-2026-13221] * new patch: perl-trie-branch-ovfl.diff ++++ vim: - Updated to version 9.2.0780. - Fix bsc#1271193 / CVE-2026-59858. - Fix bsc#1271194 / CVE-2026-59856. - Fix bsc#1271195 / CVE-2026-59857. - Changelog: * filetype detect missing from completion (9.2.0726). * popup images not rendered correctly when unfocused (9.2.0727). * filetype: supertux info pattern is relative to current dir (9.2.0728). * % skips parens on continued quoted lines (9.2.0729). * GTK4 GUI tabline is not updated (9.2.0730). * GTK4 GUI scrollbar size not updated when restoring a session (9.2.0731). * session: terminal restored using absolute columns/rows (9.2.0732). * GTK3: GUI slow on X11 since dropping the alpha channel (9.2.0733). * function pointer passed to STRNCMP() instead of a length (9.2.0734). * tests: comment test can be improved (9.2.0737). * completion: 'autocompletedelay' blocks the main loop and drops autocommands (9.2.0739). * GTK4: scrollbar wrongly displayed (9.2.0740). * complete_check() does not return TRUE for mapped input (9.2.0741). * filetype: SSH keys and related filetypes not recognized (9.2.0742). * string macros silently accept a size of the wrong type (9.2.0743). * popup_atcursor() closes immediately on white space (9.2.0744). * cscope: connection leak when growing the array fails (9.2.0747). * 'autocompletedelay' interferes with CTRL-G U (9.2.0748). * 'autocompletedelay' interferes with i_CTRL-K (9.2.0749). * completion: 'autocompletedelay' deferral leaks state (9.2.0750). * GTK3 GUI is slow under Wayland (9.2.0751). * GTK4: drag-and-drop does not support HTML (9.2.0752). * GTK GUI deferred redraw skipped on 'lazyredraw' (9.2.0753). * repeated completion length lookup in search_for_exact_line (9.2.0754). * 'autocomplete' behaves inconsistently when recording (9.2.0755). * session with multiple tabpages sets 'winminheight' to 0 (9.2.0756). * tests: test_popupwin fails with zsh because of the prompt (9.2.0757). * pum: no opacity when background not set for Popup menu group (9.2.0758). * some code for 'autocompletedelay' is no longer needed (9.2.0759). * compiler warning for using potentially uninitialized var (9.2.0760). * runtime(netrw): Unix: unable to open '\' file (9.2.0761). * duplicated sub-option name check in :set completion (9.2.0762). * tests: style issue in test_plugin_netrw (9.2.0763). * compiler warning about unused function (9.2.0764). * popup: opacity popup over a terminal is not cleared when moved (9.2.0765). * quick_tab entries for empty letters point to the wrong index (9.2.0766). * legacy/vim9cmd modifiers do not set script version for options values (9.2.0767). * legacy/vim9cmd modifiers are not exclusive (9.2.0768). * conversion to utf-16be using iconv is inconsistent (9.2.0769). * dict_add_dict() has inconsistent ownership on failure (9.2.0770). * dict_add_list() has inconsistent ownership on failure (9.2.0771). * Vim9: null dereference inside alloc_type() (9.2.0772). * memory leak in evalfunc.c on alloc failure (9.2.0773). * memory leak in f_getscriptinfo() on alloc failure (9.2.0774). * memory leak in highlight_get_info() on alloc failure (9.2.0775). * memory leak in sign_getlist() on alloc failure (9.2.0776). * memory leak in add_defer() on alloc failure (9.2.0777). * memory leak in compile_dict() on alloc failure (9.2.0778). * memory leak in type_name_func() on alloc failure (9.2.0779). * memory leak in evalvars.c on alloc failure (9.2.0780). ++++ wget: - ftp validate PASV/LPSV response address against control connection peer [bsc#1271320, CVE-2026-15146] * CVE-2026-15146.patch ++++ wpa_supplicant: - Add Require-network_ctx-and-AKMP-match-for-accepting-PMK.patch https://w1.fi/security/2026-2/ CVE-2026-78807 bsc#1280914 - Add SAE-Fix-crash-due-to-NULL-pointer-dereference-in-H2E.patch https://w1.fi/security/2026-3/ - Add CVE-2026-58374.patch: Missing multi-link parsing validation in wpa_supplicant and hostapd (bsc#1269892) - Add CVE-2025-24912.patch: hostapd fails to process crafted RADIUS packets properly (bsc#1239461) - Revert "Mark authorization completed on driver indication during 4-way HS offload" because of WPA2-PSK/WPA-SAE connection problems with brcmfmac wifi hardware. (bsc#1230797) [+ Revert-Mark-authorization-completed-on-driver-indica.patch] ------------------------------------------------------------------ ------------------ 2026-7-14 - Jul 14 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - libceph: define and enforce CEPH_MAX_KEY_LEN (CVE-2026-43304 bsc#1264993). - commit 78c847e - Update "arm64: errata: Mitigate TLBI errata on various Arm CPUs" (bsc#1266290 CVE-2025-10263 bsc#1270230 CVE-2026-53354) - commit 7b3ebf1 - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (CVE-2026-45987 bsc#1267213). - commit 47c06cf - KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN (CVE-2026-46059 bsc#1267495). - commit 85c4c90 - net: mvpp2: limit XDP frame size to the RX buffer (CVE-2026-53216 bsc#1269587). - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr (CVE-2026-53245 bsc#1269675). - tun: free page on build_skb failure in tun_xdp_one() (CVE-2026-46322 bsc#1267994). - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS (CVE-2026-53274 bsc#1269651). - net: bcmgenet: fix racing timeout handler (CVE-2026-53086 bsc#1269537). - net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback (CVE-2026-43057 bsc#1264056). - udp: Fix wildcard bind conflict check when using hash2 (CVE-2026-31503 bsc#1263077). - e1000/e1000e: Fix leak in DMA error cleanup (CVE-2026-43445 bsc#1265041). - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CVE-2026-43205 bsc#1264328). - octeontx2-af: CGX: fix bitmap leaks (CVE-2026-43157 bsc#1264624). - net/rds: No shortcut out of RDS_CONN_ERROR (CVE-2026-43226 bsc#1264544). - net: mpls: error out if inner headers are not set (CVE-2026-43057 bsc#1264056). - commit b82a23f - ipv4: account for fraggap on the paged allocation path (git-fixes). - commit 1f4f2bb ++++ kernel-rt: - libceph: define and enforce CEPH_MAX_KEY_LEN (CVE-2026-43304 bsc#1264993). - commit 78c847e - Update "arm64: errata: Mitigate TLBI errata on various Arm CPUs" (bsc#1266290 CVE-2025-10263 bsc#1270230 CVE-2026-53354) - commit 7b3ebf1 - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (CVE-2026-45987 bsc#1267213). - commit 47c06cf - KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN (CVE-2026-46059 bsc#1267495). - commit 85c4c90 - net: mvpp2: limit XDP frame size to the RX buffer (CVE-2026-53216 bsc#1269587). - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr (CVE-2026-53245 bsc#1269675). - tun: free page on build_skb failure in tun_xdp_one() (CVE-2026-46322 bsc#1267994). - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS (CVE-2026-53274 bsc#1269651). - net: bcmgenet: fix racing timeout handler (CVE-2026-53086 bsc#1269537). - net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback (CVE-2026-43057 bsc#1264056). - udp: Fix wildcard bind conflict check when using hash2 (CVE-2026-31503 bsc#1263077). - e1000/e1000e: Fix leak in DMA error cleanup (CVE-2026-43445 bsc#1265041). - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CVE-2026-43205 bsc#1264328). - octeontx2-af: CGX: fix bitmap leaks (CVE-2026-43157 bsc#1264624). - net/rds: No shortcut out of RDS_CONN_ERROR (CVE-2026-43226 bsc#1264544). - net: mpls: error out if inner headers are not set (CVE-2026-43057 bsc#1264056). - commit b82a23f - ipv4: account for fraggap on the paged allocation path (git-fixes). - commit 1f4f2bb ++++ kernel-rt_debug: - libceph: define and enforce CEPH_MAX_KEY_LEN (CVE-2026-43304 bsc#1264993). - commit 78c847e - Update "arm64: errata: Mitigate TLBI errata on various Arm CPUs" (bsc#1266290 CVE-2025-10263 bsc#1270230 CVE-2026-53354) - commit 7b3ebf1 - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (CVE-2026-45987 bsc#1267213). - commit 47c06cf - KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN (CVE-2026-46059 bsc#1267495). - commit 85c4c90 - net: mvpp2: limit XDP frame size to the RX buffer (CVE-2026-53216 bsc#1269587). - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr (CVE-2026-53245 bsc#1269675). - tun: free page on build_skb failure in tun_xdp_one() (CVE-2026-46322 bsc#1267994). - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS (CVE-2026-53274 bsc#1269651). - net: bcmgenet: fix racing timeout handler (CVE-2026-53086 bsc#1269537). - net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback (CVE-2026-43057 bsc#1264056). - udp: Fix wildcard bind conflict check when using hash2 (CVE-2026-31503 bsc#1263077). - e1000/e1000e: Fix leak in DMA error cleanup (CVE-2026-43445 bsc#1265041). - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CVE-2026-43205 bsc#1264328). - octeontx2-af: CGX: fix bitmap leaks (CVE-2026-43157 bsc#1264624). - net/rds: No shortcut out of RDS_CONN_ERROR (CVE-2026-43226 bsc#1264544). - net: mpls: error out if inner headers are not set (CVE-2026-43057 bsc#1264056). - commit b82a23f - ipv4: account for fraggap on the paged allocation path (git-fixes). - commit 1f4f2bb ++++ libgcrypt: - Security fix [bsc#1262684, CVE-2026-41989] * libgcrypt: libgcrypt: crafted ECDH ciphertext can lead denial of service * Add libgcrypt-CVE-2026-41989.patch ------------------------------------------------------------------ ------------------ 2026-7-13 - Jul 13 2026 ------------------- ------------------------------------------------------------------ ++++ gzip: - Fix CVE-2026-41991, insecure temporary file handling in the gzexe utility when the mktemp utility is not available in the user’s PATH (CVE-2026-41991, bsc#1269622) * CVE-2026-41991.patch ++++ kernel-default: - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails (CVE-2026-45997 bsc#1266740). - commit 3eeb423 - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (CVE-2026-43449 bsc#1265023). - commit 533ab5a - scsi: mpi3mr: Add NULL checks when resetting request and reply queues (CVE-2026-43473 bsc#1264731). - commit c99fb53 - smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181 CVE-2026-52967). - commit 6cd9f0f - vsock/vmci: fix sk_ack_backlog leak on failed handshake (CVE-2026-53181 bsc#1269886). - commit 6b1cc5c - Drop hwrng:virtio patch that caused a regression (a guest stuck) (bsc#1271040) - commit d80450b - tpm: Make the TPM character devices non-seekable (git-fixes). - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop (git-fixes). - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop (git-fixes). - staging: rtl8723bs: fix OOB write in HT_caps_handler() (git-fixes). - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() (git-fixes). - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop (git-fixes). - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() (git-fixes). - iio: event: Fix event FIFO reset race (git-fixes). - iio: light: al3010: fix incorrect scale for the highest gain range (git-fixes). - iio: light: tsl2591: return actual error from probe IRQ failure (git-fixes). - iio: imu: st_lsm6dsx: deselect shub page before reading whoami (git-fixes). - iio: adc: ti-ads124s08: Return reset GPIO lookup errors (git-fixes). - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ (git-fixes). - iio: adc: spear: Initialize completion before requesting IRQ (git-fixes). - iio: adc: lpc32xx: Initialize completion before requesting IRQ (git-fixes). - iio: light: gp2ap002: fix runtime PM leak on read error (git-fixes). - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error (git-fixes). - iio: accel: bmc150: clamp the device-reported FIFO frame count (git-fixes). - serial: 8250_omap: clear rx_running on zero-length DMA completes (git-fixes). - serial: msm: Disable DMA for kernel console UART (git-fixes). - USB: chaoskey: Fix slab-use-after-free in chaoskey_release() (git-fixes). - usb: typec: ucsi: cancel pending work on system suspend (git-fixes). - usb: typec: class: drop PD lookup reference (git-fixes). - usb: xhci: Fix sleep in atomic context in xhci_free_streams() (git-fixes). - usb: dwc3: run gadget disconnect from sleepable suspend context (git-fixes). - usb: sl811-hcd: disable controller wakeup on remove (git-fixes). - usb: typec: anx7411: use devm_pm_runtime_enable() (git-fixes). - USB: misc: uss720: unregister parport on probe failure (git-fixes). - usb: free iso schedules on failed submit (git-fixes). - USB: usb-storage: ene_ub6250: restore media-ready check (git-fixes). - usb: gadget: f_printer: take kref only for successful open (git-fixes). - usbip: vudc: fix NULL deref in vep_dequeue() (git-fixes). - usbip: tools: support SuperSpeedPlus devices (git-fixes). - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode (git-fixes). - USB: serial: keyspan_pda: fix information leak (git-fixes). - USB: serial: digi_acceleport: fix broken rx after throttle (git-fixes). - USB: serial: digi_acceleport: fix hard lockup on disconnect (git-fixes). - USB: serial: digi_acceleport: fix write buffer corruption (git-fixes). - usb: mtu3: unmap request DMA on queue failure (git-fixes). - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() (git-fixes). - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler (git-fixes). - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove (git-fixes). - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() (git-fixes). - USB: legousbtower: fix use-after-free on disconnect race (git-fixes). - USB: ldusb: fix use-after-free on disconnect race (git-fixes). - USB: idmouse: fix use-after-free on disconnect race (git-fixes). - USB: iowarrior: fix use-after-free on disconnect (git-fixes). - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() (git-fixes). - usb: typec: ucsi: Invert DisplayPort role assignment (git-fixes). - USB: ulpi: fix memory leak on registration failure (git-fixes). - USB: storage: include US_FL_NO_SAME in quirks mask (git-fixes). - Input: mms114 - fix multi-touch slot corruption (git-fixes). - Input: maplemouse - fix NULL pointer dereference in open() (git-fixes). - regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK (git-fixes). - gpios: palmas: add .get_direction() op (git-fixes). - drm/i915/gem: Do not leak siblings[] on proto context error (git-fixes). - drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU (git-fixes). - commit fa9ccc7 - Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync (CVE-2026-43019 bsc#1264003). - commit cfa9024 - ASoC: qcom: q6asm: drop DSP responses for closed data streams (CVE-2026-43204 bsc#1264531). - ASoC: qcom: q6asm: handle the responses after closing (CVE-2026-43204 bsc#1264531). - commit 70ebaab - bpf: Fix ld_{abs,ind} failure path analysis in subprogs (CVE-2026-53090 bsc#1269532). - commit 2ef21b7 - RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() (CVE-2026-46178 bsc#1267493). - commit 0209e7f - net: mana: Validate the packet length reported by the NIC (git-fixes). - commit c1b4427 - x86/kexec: add a sanity check on previous kernel's ima kexec buffer (CVE-2026-43240 bsc#1264386). - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (CVE-2026-43240 bsc#1264386). - ima: verify the previous kernel's IMA buffer lies in addressable RAM (CVE-2026-43240 bsc#1264386). - commit 17e8904 - tty: hvc_iucv: fix off-by-one in number of supported devices (CVE-2026-53306 bsc#1269814). - commit 26a7ad0 ++++ kernel-rt: - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails (CVE-2026-45997 bsc#1266740). - commit 3eeb423 - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (CVE-2026-43449 bsc#1265023). - commit 533ab5a - scsi: mpi3mr: Add NULL checks when resetting request and reply queues (CVE-2026-43473 bsc#1264731). - commit c99fb53 - smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181 CVE-2026-52967). - commit 6cd9f0f - vsock/vmci: fix sk_ack_backlog leak on failed handshake (CVE-2026-53181 bsc#1269886). - commit 6b1cc5c - Drop hwrng:virtio patch that caused a regression (a guest stuck) (bsc#1271040) - commit d80450b - tpm: Make the TPM character devices non-seekable (git-fixes). - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop (git-fixes). - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop (git-fixes). - staging: rtl8723bs: fix OOB write in HT_caps_handler() (git-fixes). - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() (git-fixes). - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop (git-fixes). - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() (git-fixes). - iio: event: Fix event FIFO reset race (git-fixes). - iio: light: al3010: fix incorrect scale for the highest gain range (git-fixes). - iio: light: tsl2591: return actual error from probe IRQ failure (git-fixes). - iio: imu: st_lsm6dsx: deselect shub page before reading whoami (git-fixes). - iio: adc: ti-ads124s08: Return reset GPIO lookup errors (git-fixes). - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ (git-fixes). - iio: adc: spear: Initialize completion before requesting IRQ (git-fixes). - iio: adc: lpc32xx: Initialize completion before requesting IRQ (git-fixes). - iio: light: gp2ap002: fix runtime PM leak on read error (git-fixes). - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error (git-fixes). - iio: accel: bmc150: clamp the device-reported FIFO frame count (git-fixes). - serial: 8250_omap: clear rx_running on zero-length DMA completes (git-fixes). - serial: msm: Disable DMA for kernel console UART (git-fixes). - USB: chaoskey: Fix slab-use-after-free in chaoskey_release() (git-fixes). - usb: typec: ucsi: cancel pending work on system suspend (git-fixes). - usb: typec: class: drop PD lookup reference (git-fixes). - usb: xhci: Fix sleep in atomic context in xhci_free_streams() (git-fixes). - usb: dwc3: run gadget disconnect from sleepable suspend context (git-fixes). - usb: sl811-hcd: disable controller wakeup on remove (git-fixes). - usb: typec: anx7411: use devm_pm_runtime_enable() (git-fixes). - USB: misc: uss720: unregister parport on probe failure (git-fixes). - usb: free iso schedules on failed submit (git-fixes). - USB: usb-storage: ene_ub6250: restore media-ready check (git-fixes). - usb: gadget: f_printer: take kref only for successful open (git-fixes). - usbip: vudc: fix NULL deref in vep_dequeue() (git-fixes). - usbip: tools: support SuperSpeedPlus devices (git-fixes). - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode (git-fixes). - USB: serial: keyspan_pda: fix information leak (git-fixes). - USB: serial: digi_acceleport: fix broken rx after throttle (git-fixes). - USB: serial: digi_acceleport: fix hard lockup on disconnect (git-fixes). - USB: serial: digi_acceleport: fix write buffer corruption (git-fixes). - usb: mtu3: unmap request DMA on queue failure (git-fixes). - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() (git-fixes). - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler (git-fixes). - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove (git-fixes). - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() (git-fixes). - USB: legousbtower: fix use-after-free on disconnect race (git-fixes). - USB: ldusb: fix use-after-free on disconnect race (git-fixes). - USB: idmouse: fix use-after-free on disconnect race (git-fixes). - USB: iowarrior: fix use-after-free on disconnect (git-fixes). - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() (git-fixes). - usb: typec: ucsi: Invert DisplayPort role assignment (git-fixes). - USB: ulpi: fix memory leak on registration failure (git-fixes). - USB: storage: include US_FL_NO_SAME in quirks mask (git-fixes). - Input: mms114 - fix multi-touch slot corruption (git-fixes). - Input: maplemouse - fix NULL pointer dereference in open() (git-fixes). - regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK (git-fixes). - gpios: palmas: add .get_direction() op (git-fixes). - drm/i915/gem: Do not leak siblings[] on proto context error (git-fixes). - drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU (git-fixes). - commit fa9ccc7 - Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync (CVE-2026-43019 bsc#1264003). - commit cfa9024 - ASoC: qcom: q6asm: drop DSP responses for closed data streams (CVE-2026-43204 bsc#1264531). - ASoC: qcom: q6asm: handle the responses after closing (CVE-2026-43204 bsc#1264531). - commit 70ebaab - bpf: Fix ld_{abs,ind} failure path analysis in subprogs (CVE-2026-53090 bsc#1269532). - commit 2ef21b7 - RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() (CVE-2026-46178 bsc#1267493). - commit 0209e7f - net: mana: Validate the packet length reported by the NIC (git-fixes). - commit c1b4427 - x86/kexec: add a sanity check on previous kernel's ima kexec buffer (CVE-2026-43240 bsc#1264386). - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (CVE-2026-43240 bsc#1264386). - ima: verify the previous kernel's IMA buffer lies in addressable RAM (CVE-2026-43240 bsc#1264386). - commit 17e8904 - tty: hvc_iucv: fix off-by-one in number of supported devices (CVE-2026-53306 bsc#1269814). - commit 26a7ad0 ++++ kernel-rt_debug: - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails (CVE-2026-45997 bsc#1266740). - commit 3eeb423 - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (CVE-2026-43449 bsc#1265023). - commit 533ab5a - scsi: mpi3mr: Add NULL checks when resetting request and reply queues (CVE-2026-43473 bsc#1264731). - commit c99fb53 - smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181 CVE-2026-52967). - commit 6cd9f0f - vsock/vmci: fix sk_ack_backlog leak on failed handshake (CVE-2026-53181 bsc#1269886). - commit 6b1cc5c - Drop hwrng:virtio patch that caused a regression (a guest stuck) (bsc#1271040) - commit d80450b - tpm: Make the TPM character devices non-seekable (git-fixes). - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop (git-fixes). - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop (git-fixes). - staging: rtl8723bs: fix OOB write in HT_caps_handler() (git-fixes). - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() (git-fixes). - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop (git-fixes). - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() (git-fixes). - iio: event: Fix event FIFO reset race (git-fixes). - iio: light: al3010: fix incorrect scale for the highest gain range (git-fixes). - iio: light: tsl2591: return actual error from probe IRQ failure (git-fixes). - iio: imu: st_lsm6dsx: deselect shub page before reading whoami (git-fixes). - iio: adc: ti-ads124s08: Return reset GPIO lookup errors (git-fixes). - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ (git-fixes). - iio: adc: spear: Initialize completion before requesting IRQ (git-fixes). - iio: adc: lpc32xx: Initialize completion before requesting IRQ (git-fixes). - iio: light: gp2ap002: fix runtime PM leak on read error (git-fixes). - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error (git-fixes). - iio: accel: bmc150: clamp the device-reported FIFO frame count (git-fixes). - serial: 8250_omap: clear rx_running on zero-length DMA completes (git-fixes). - serial: msm: Disable DMA for kernel console UART (git-fixes). - USB: chaoskey: Fix slab-use-after-free in chaoskey_release() (git-fixes). - usb: typec: ucsi: cancel pending work on system suspend (git-fixes). - usb: typec: class: drop PD lookup reference (git-fixes). - usb: xhci: Fix sleep in atomic context in xhci_free_streams() (git-fixes). - usb: dwc3: run gadget disconnect from sleepable suspend context (git-fixes). - usb: sl811-hcd: disable controller wakeup on remove (git-fixes). - usb: typec: anx7411: use devm_pm_runtime_enable() (git-fixes). - USB: misc: uss720: unregister parport on probe failure (git-fixes). - usb: free iso schedules on failed submit (git-fixes). - USB: usb-storage: ene_ub6250: restore media-ready check (git-fixes). - usb: gadget: f_printer: take kref only for successful open (git-fixes). - usbip: vudc: fix NULL deref in vep_dequeue() (git-fixes). - usbip: tools: support SuperSpeedPlus devices (git-fixes). - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode (git-fixes). - USB: serial: keyspan_pda: fix information leak (git-fixes). - USB: serial: digi_acceleport: fix broken rx after throttle (git-fixes). - USB: serial: digi_acceleport: fix hard lockup on disconnect (git-fixes). - USB: serial: digi_acceleport: fix write buffer corruption (git-fixes). - usb: mtu3: unmap request DMA on queue failure (git-fixes). - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() (git-fixes). - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler (git-fixes). - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove (git-fixes). - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() (git-fixes). - USB: legousbtower: fix use-after-free on disconnect race (git-fixes). - USB: ldusb: fix use-after-free on disconnect race (git-fixes). - USB: idmouse: fix use-after-free on disconnect race (git-fixes). - USB: iowarrior: fix use-after-free on disconnect (git-fixes). - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() (git-fixes). - usb: typec: ucsi: Invert DisplayPort role assignment (git-fixes). - USB: ulpi: fix memory leak on registration failure (git-fixes). - USB: storage: include US_FL_NO_SAME in quirks mask (git-fixes). - Input: mms114 - fix multi-touch slot corruption (git-fixes). - Input: maplemouse - fix NULL pointer dereference in open() (git-fixes). - regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK (git-fixes). - gpios: palmas: add .get_direction() op (git-fixes). - drm/i915/gem: Do not leak siblings[] on proto context error (git-fixes). - drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU (git-fixes). - commit fa9ccc7 - Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync (CVE-2026-43019 bsc#1264003). - commit cfa9024 - ASoC: qcom: q6asm: drop DSP responses for closed data streams (CVE-2026-43204 bsc#1264531). - ASoC: qcom: q6asm: handle the responses after closing (CVE-2026-43204 bsc#1264531). - commit 70ebaab - bpf: Fix ld_{abs,ind} failure path analysis in subprogs (CVE-2026-53090 bsc#1269532). - commit 2ef21b7 - RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() (CVE-2026-46178 bsc#1267493). - commit 0209e7f - net: mana: Validate the packet length reported by the NIC (git-fixes). - commit c1b4427 - x86/kexec: add a sanity check on previous kernel's ima kexec buffer (CVE-2026-43240 bsc#1264386). - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (CVE-2026-43240 bsc#1264386). - ima: verify the previous kernel's IMA buffer lies in addressable RAM (CVE-2026-43240 bsc#1264386). - commit 17e8904 - tty: hvc_iucv: fix off-by-one in number of supported devices (CVE-2026-53306 bsc#1269814). - commit 26a7ad0 ++++ util-linux-systemd: - BREAKING CHANGE: Paths must always be canonicalized for unprivileged users to ensure safe target resolution. X-mount.nocanonicalize is ignored for them. - INCOMAPTIBLE CHANGE (linux < 6.15): X-mount.subdir: The safe detached subdirectory is no more supported for unprivileged users for safety reasons. - liblastlog2: Wait on busy SQLite connections (bsc#1268886#c3, util-linux-bsc1268886-01-wait-on-busy-SQLite-connections.patch). - libmount: Fix subvolid buffer overflow in get_btrfs_fs_root (bsc#1268886#c2, util-linux-bsc1268886-02-libmount-subvolid-overflow.patch). - libblkid: Fix use-after-free in nested partition probing (bsc#1269583, bsc#1268886#c2, CVE-2026-13595, util-linux-bsc1268886-03-libblkid-probe-use-after-free.patch). - libmount: fix SUID bypass via LIBMOUNT_FORCE_MOUNT2 and legacy mount path (bsc#1268886, CVE-2026-53614, GHSA-67r7-8m5w-22wx, util-linux-bsc1268886-04-libmount-LIBMOUNT_FORCE_MOUNT2.patch and updated util-linux-login_defs-check.sh checksum). - fileutils: add ul_open_no_symlinks() needed by other patches (bsc#1268886, util-linux-bsc1268886-05-fileutils-ul_open_no_symlinks.patch). - libmount: add fd_target to context for TOCTOU race condition prevention (bsc#1268886, CVE-2026-53613, GHSA-8gj5-72r3-428g, util-linux-bsc1268886-06-add-fd_target-to-context.patch). - libmount: ignore X-mount.nocanonicalize for restricted users (bsc#1268886#c2, util-linux-bsc1268886-07-libmount-X-mount_nocanonicalize.patch). - libmount: use fd-based fchownat/chmod in hook_owner (bsc#1268886, CVE-2026-53612, GHSA-g8wm-75wr-g2vh, util-linux-bsc1268886-08-libmount-use-fd-based-fchownat.patch). - libmount: restrict X-mount.subdir for non-root (bsc#1268886#c2, util-linux-bsc1268886-09-libmount-restrict-X-mount_subdir.patch). - libmount: use fd_target in hook_idmap for move_mount() (bsc#1268886#c2, util-linux-bsc1268886-10-libmount-move_mount.patch). - libmount: add mount ID verification and man page TOCTOU note (bsc#1268886#c2, util-linux-bsc1268886-11-libmount-mount-ID-verification.patch). - loopdev: use openat2(RESOLVE_NO_SYMLINKS) for backing file (bsc#1268886#c2, bsc#1261606, follow up for CVE-2026-27456, util-linux-bsc1268886-12-loopdev-openat2.patch). - Regenerate man pages (util-linux-bsc1268886-man-generated.patch). - If needed, display post installation message (bsc#1268886#c17). - Ignore pam-config error that prevents update failure if common* pam configuration is not symlink to common-*-pc (bsc#1270219). ++++ util-linux: - BREAKING CHANGE: Paths must always be canonicalized for unprivileged users to ensure safe target resolution. X-mount.nocanonicalize is ignored for them. - INCOMAPTIBLE CHANGE (linux < 6.15): X-mount.subdir: The safe detached subdirectory is no more supported for unprivileged users for safety reasons. - liblastlog2: Wait on busy SQLite connections (bsc#1268886#c3, util-linux-bsc1268886-01-wait-on-busy-SQLite-connections.patch). - libmount: Fix subvolid buffer overflow in get_btrfs_fs_root (bsc#1268886#c2, util-linux-bsc1268886-02-libmount-subvolid-overflow.patch). - libblkid: Fix use-after-free in nested partition probing (bsc#1269583, bsc#1268886#c2, CVE-2026-13595, util-linux-bsc1268886-03-libblkid-probe-use-after-free.patch). - libmount: fix SUID bypass via LIBMOUNT_FORCE_MOUNT2 and legacy mount path (bsc#1268886, CVE-2026-53614, GHSA-67r7-8m5w-22wx, util-linux-bsc1268886-04-libmount-LIBMOUNT_FORCE_MOUNT2.patch and updated util-linux-login_defs-check.sh checksum). - fileutils: add ul_open_no_symlinks() needed by other patches (bsc#1268886, util-linux-bsc1268886-05-fileutils-ul_open_no_symlinks.patch). - libmount: add fd_target to context for TOCTOU race condition prevention (bsc#1268886, CVE-2026-53613, GHSA-8gj5-72r3-428g, util-linux-bsc1268886-06-add-fd_target-to-context.patch). - libmount: ignore X-mount.nocanonicalize for restricted users (bsc#1268886#c2, util-linux-bsc1268886-07-libmount-X-mount_nocanonicalize.patch). - libmount: use fd-based fchownat/chmod in hook_owner (bsc#1268886, CVE-2026-53612, GHSA-g8wm-75wr-g2vh, util-linux-bsc1268886-08-libmount-use-fd-based-fchownat.patch). - libmount: restrict X-mount.subdir for non-root (bsc#1268886#c2, util-linux-bsc1268886-09-libmount-restrict-X-mount_subdir.patch). - libmount: use fd_target in hook_idmap for move_mount() (bsc#1268886#c2, util-linux-bsc1268886-10-libmount-move_mount.patch). - libmount: add mount ID verification and man page TOCTOU note (bsc#1268886#c2, util-linux-bsc1268886-11-libmount-mount-ID-verification.patch). - loopdev: use openat2(RESOLVE_NO_SYMLINKS) for backing file (bsc#1268886#c2, bsc#1261606, follow up for CVE-2026-27456, util-linux-bsc1268886-12-loopdev-openat2.patch). - Regenerate man pages (util-linux-bsc1268886-man-generated.patch). - If needed, display post installation message (bsc#1268886#c17). - Ignore pam-config error that prevents update failure if common* pam configuration is not symlink to common-*-pc (bsc#1270219). ------------------------------------------------------------------ ------------------ 2026-7-12 - Jul 12 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (bsc#1266773 CVE-2026-45858). - commit 76d7ff5 - ext4: subdivide EXT4_EXT_DATA_VALID1 (bsc#1266773 CVE-2026-45858). Refresh patches.suse/ext4-don-t-set-EXT4_GET_BLOCKS_CONVERT-when-splitting-befo.patch Refresh patches.suse/ext4-don-t-cache-extent-during-splitting-extent.patch - commit d77f46e - quota: Fix race of dquot_scan_active() with quota deactivation (bsc#1269188 CVE-2026-53050). - commit 2a8b30d - file: add fput() cleanup helper (bsc#1267618 CVE-2026-46242). - commit 5eec3fc - epoll: annotate racy check (git-fixes bsc#1267618 CVE-2026-46242). - commit 04cbe4e - eventpoll: prefer kfree_rcu() in __ep_remove() (bsc#1267618 CVE-2026-46242). Refresh: patches.suse/eventpoll-don-t-decrement-ep-refcount-while-still-ho.patch - commit 5fcb11a - eventpoll: drop vestigial epi->dying flag (bsc#1267618 CVE-2026-46242). - commit 91a0d94 - eventpoll: drop dead bool return from ep_remove_epi() (bsc#1267618 CVE-2026-46242). - commit 240e99f - eventpoll: refresh eventpoll_release() fast-path comment (bsc#1267618 CVE-2026-46242). - commit 5229e16 - eventpoll: move f_lock acquisition into ep_remove_file() (bsc#1267618 CVE-2026-46242). - commit a15ee1c - eventpoll: fix ep_remove struct eventpoll / struct file UAF (bsc#1267618 CVE-2026-46242). - commit 06c11bf - eventpoll: move epi_fget() up (bsc#1267618 CVE-2026-46242). - commit 0dd8e11 - eventpoll: rename ep_remove_safe() back to ep_remove() (bsc#1267618 CVE-2026-46242). - commit 07e96b5 - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (bsc#1267618 CVE-2026-46242). - commit 90f4baa - eventpoll: kill __ep_remove() (bsc#1267618 CVE-2026-46242). - commit 9ba90c3 - eventpoll: split __ep_remove() (bsc#1267618 CVE-2026-46242). - commit ecd55be - eventpoll: use hlist_is_singular_node() in __ep_remove() (bsc#1267618 CVE-2026-46242). - commit 763dc7c - eventpoll: Fix integer overflow in ep_loop_check_proc() (bsc#1267618 CVE-2026-46242). - commit 91a4d85 ++++ kernel-rt: - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (bsc#1266773 CVE-2026-45858). - commit 76d7ff5 - ext4: subdivide EXT4_EXT_DATA_VALID1 (bsc#1266773 CVE-2026-45858). Refresh patches.suse/ext4-don-t-set-EXT4_GET_BLOCKS_CONVERT-when-splitting-befo.patch Refresh patches.suse/ext4-don-t-cache-extent-during-splitting-extent.patch - commit d77f46e - quota: Fix race of dquot_scan_active() with quota deactivation (bsc#1269188 CVE-2026-53050). - commit 2a8b30d - file: add fput() cleanup helper (bsc#1267618 CVE-2026-46242). - commit 5eec3fc - epoll: annotate racy check (git-fixes bsc#1267618 CVE-2026-46242). - commit 04cbe4e - eventpoll: prefer kfree_rcu() in __ep_remove() (bsc#1267618 CVE-2026-46242). Refresh: patches.suse/eventpoll-don-t-decrement-ep-refcount-while-still-ho.patch - commit 5fcb11a - eventpoll: drop vestigial epi->dying flag (bsc#1267618 CVE-2026-46242). - commit 91a0d94 - eventpoll: drop dead bool return from ep_remove_epi() (bsc#1267618 CVE-2026-46242). - commit 240e99f - eventpoll: refresh eventpoll_release() fast-path comment (bsc#1267618 CVE-2026-46242). - commit 5229e16 - eventpoll: move f_lock acquisition into ep_remove_file() (bsc#1267618 CVE-2026-46242). - commit a15ee1c - eventpoll: fix ep_remove struct eventpoll / struct file UAF (bsc#1267618 CVE-2026-46242). - commit 06c11bf - eventpoll: move epi_fget() up (bsc#1267618 CVE-2026-46242). - commit 0dd8e11 - eventpoll: rename ep_remove_safe() back to ep_remove() (bsc#1267618 CVE-2026-46242). - commit 07e96b5 - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (bsc#1267618 CVE-2026-46242). - commit 90f4baa - eventpoll: kill __ep_remove() (bsc#1267618 CVE-2026-46242). - commit 9ba90c3 - eventpoll: split __ep_remove() (bsc#1267618 CVE-2026-46242). - commit ecd55be - eventpoll: use hlist_is_singular_node() in __ep_remove() (bsc#1267618 CVE-2026-46242). - commit 763dc7c - eventpoll: Fix integer overflow in ep_loop_check_proc() (bsc#1267618 CVE-2026-46242). - commit 91a4d85 ++++ kernel-rt_debug: - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (bsc#1266773 CVE-2026-45858). - commit 76d7ff5 - ext4: subdivide EXT4_EXT_DATA_VALID1 (bsc#1266773 CVE-2026-45858). Refresh patches.suse/ext4-don-t-set-EXT4_GET_BLOCKS_CONVERT-when-splitting-befo.patch Refresh patches.suse/ext4-don-t-cache-extent-during-splitting-extent.patch - commit d77f46e - quota: Fix race of dquot_scan_active() with quota deactivation (bsc#1269188 CVE-2026-53050). - commit 2a8b30d - file: add fput() cleanup helper (bsc#1267618 CVE-2026-46242). - commit 5eec3fc - epoll: annotate racy check (git-fixes bsc#1267618 CVE-2026-46242). - commit 04cbe4e - eventpoll: prefer kfree_rcu() in __ep_remove() (bsc#1267618 CVE-2026-46242). Refresh: patches.suse/eventpoll-don-t-decrement-ep-refcount-while-still-ho.patch - commit 5fcb11a - eventpoll: drop vestigial epi->dying flag (bsc#1267618 CVE-2026-46242). - commit 91a0d94 - eventpoll: drop dead bool return from ep_remove_epi() (bsc#1267618 CVE-2026-46242). - commit 240e99f - eventpoll: refresh eventpoll_release() fast-path comment (bsc#1267618 CVE-2026-46242). - commit 5229e16 - eventpoll: move f_lock acquisition into ep_remove_file() (bsc#1267618 CVE-2026-46242). - commit a15ee1c - eventpoll: fix ep_remove struct eventpoll / struct file UAF (bsc#1267618 CVE-2026-46242). - commit 06c11bf - eventpoll: move epi_fget() up (bsc#1267618 CVE-2026-46242). - commit 0dd8e11 - eventpoll: rename ep_remove_safe() back to ep_remove() (bsc#1267618 CVE-2026-46242). - commit 07e96b5 - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (bsc#1267618 CVE-2026-46242). - commit 90f4baa - eventpoll: kill __ep_remove() (bsc#1267618 CVE-2026-46242). - commit 9ba90c3 - eventpoll: split __ep_remove() (bsc#1267618 CVE-2026-46242). - commit ecd55be - eventpoll: use hlist_is_singular_node() in __ep_remove() (bsc#1267618 CVE-2026-46242). - commit 763dc7c - eventpoll: Fix integer overflow in ep_loop_check_proc() (bsc#1267618 CVE-2026-46242). - commit 91a4d85 ------------------------------------------------------------------ ------------------ 2026-7-11 - Jul 11 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops (CVE-2026-53078 bsc#1269700). - commit 37876b7 ++++ kernel-rt: - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops (CVE-2026-53078 bsc#1269700). - commit 37876b7 ++++ kernel-rt_debug: - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops (CVE-2026-53078 bsc#1269700). - commit 37876b7 ------------------------------------------------------------------ ------------------ 2026-7-10 - Jul 10 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size (CVE-2026-52961 bsc#1269129). - commit d61a3b2 - bpf, sockmap: Fix af_unix iter deadlock (CVE-2026-53035 bsc#1269190). - commit af7a8a1 - kABI fix for KVM: x86/mmu: Track possible NX huge pages separately for TDP vs Shadow MMU (bsc#1271050) (bsc#1271050). - commit 0b4ce51 - net: mvpp2: sync RX data at the hardware packet offset (CVE-2026-53217 bsc#1269989). - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (CVE-2026-43465 bsc#1264997). - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (CVE-2026-43466 bsc#1264790). - net/mlx5: Fix deadlock between devlink lock and esw->wq (CVE-2026-43468 bsc#1264978). - commit f3e0959 - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() (git-fixes). - Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length (git-fixes). - Bluetooth: ISO: fix malformed ISO_END/CONT handling (git-fixes). - Bluetooth: fix UAF in bt_accept_dequeue() (git-fixes). - Bluetooth: bnep: pin L2CAP connection during netdev registration (git-fixes). - Bluetooth: MGMT: Fix adv monitor add failure cleanup (git-fixes). - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control (git-fixes). - Bluetooth: L2CAP: validate option length before reading conf opt value (git-fixes). - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete (git-fixes). - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (git-fixes). - net: usb: lan78xx: disable VLAN filter in promiscuous mode (git-fixes). - net: usb: net1080: validate packet_len before pad-byte access in rx_fixup (git-fixes). - HID: lg-g15: cancel pending work on remove to fix a use-after-free (git-fixes). - HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() (git-fixes). - HID: letsketch: fix UAF on inrange_timer at driver unbind (git-fixes). - commit 211156a ++++ kernel-rt: - ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size (CVE-2026-52961 bsc#1269129). - commit d61a3b2 - bpf, sockmap: Fix af_unix iter deadlock (CVE-2026-53035 bsc#1269190). - commit af7a8a1 - kABI fix for KVM: x86/mmu: Track possible NX huge pages separately for TDP vs Shadow MMU (bsc#1271050) (bsc#1271050). - commit 0b4ce51 - net: mvpp2: sync RX data at the hardware packet offset (CVE-2026-53217 bsc#1269989). - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (CVE-2026-43465 bsc#1264997). - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (CVE-2026-43466 bsc#1264790). - net/mlx5: Fix deadlock between devlink lock and esw->wq (CVE-2026-43468 bsc#1264978). - commit f3e0959 - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() (git-fixes). - Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length (git-fixes). - Bluetooth: ISO: fix malformed ISO_END/CONT handling (git-fixes). - Bluetooth: fix UAF in bt_accept_dequeue() (git-fixes). - Bluetooth: bnep: pin L2CAP connection during netdev registration (git-fixes). - Bluetooth: MGMT: Fix adv monitor add failure cleanup (git-fixes). - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control (git-fixes). - Bluetooth: L2CAP: validate option length before reading conf opt value (git-fixes). - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete (git-fixes). - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (git-fixes). - net: usb: lan78xx: disable VLAN filter in promiscuous mode (git-fixes). - net: usb: net1080: validate packet_len before pad-byte access in rx_fixup (git-fixes). - HID: lg-g15: cancel pending work on remove to fix a use-after-free (git-fixes). - HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() (git-fixes). - HID: letsketch: fix UAF on inrange_timer at driver unbind (git-fixes). - commit 211156a ++++ kernel-rt_debug: - ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size (CVE-2026-52961 bsc#1269129). - commit d61a3b2 - bpf, sockmap: Fix af_unix iter deadlock (CVE-2026-53035 bsc#1269190). - commit af7a8a1 - kABI fix for KVM: x86/mmu: Track possible NX huge pages separately for TDP vs Shadow MMU (bsc#1271050) (bsc#1271050). - commit 0b4ce51 - net: mvpp2: sync RX data at the hardware packet offset (CVE-2026-53217 bsc#1269989). - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (CVE-2026-43465 bsc#1264997). - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (CVE-2026-43466 bsc#1264790). - net/mlx5: Fix deadlock between devlink lock and esw->wq (CVE-2026-43468 bsc#1264978). - commit f3e0959 - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() (git-fixes). - Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length (git-fixes). - Bluetooth: ISO: fix malformed ISO_END/CONT handling (git-fixes). - Bluetooth: fix UAF in bt_accept_dequeue() (git-fixes). - Bluetooth: bnep: pin L2CAP connection during netdev registration (git-fixes). - Bluetooth: MGMT: Fix adv monitor add failure cleanup (git-fixes). - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control (git-fixes). - Bluetooth: L2CAP: validate option length before reading conf opt value (git-fixes). - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete (git-fixes). - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (git-fixes). - net: usb: lan78xx: disable VLAN filter in promiscuous mode (git-fixes). - net: usb: net1080: validate packet_len before pad-byte access in rx_fixup (git-fixes). - HID: lg-g15: cancel pending work on remove to fix a use-after-free (git-fixes). - HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() (git-fixes). - HID: letsketch: fix UAF on inrange_timer at driver unbind (git-fixes). - commit 211156a ++++ libxml2: - CVE-2026-11979: stack-based buffer overflows in the `xmlcatalog` utility when running in `--shell` mode (bsc#1269790) * Add patch libxml2-CVE-2026-11979.patch ++++ patch: - dont-infloop-on-null-ranges.patch: Apply the same checks to null ranges as are applied to non-null ranges (bsc#1271166 CVE-2026-56289). - avoid-null-pointer-derefence-with-bad-hunks.patch: Avoid null pointer derefence with bad hunks (bsc#1271167 CVE-2026-56288). - CVE-2021-45261.patch: Clear range of pointers before they are used/freed (boo#1194037 CVE-2021-45261). ++++ libxml2-python: - CVE-2026-11979: stack-based buffer overflows in the `xmlcatalog` utility when running in `--shell` mode (bsc#1269790) * Add patch libxml2-CVE-2026-11979.patch ------------------------------------------------------------------ ------------------ 2026-7-9 - Jul 9 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - KVM: x86/mmu: Recover TDP MMU NX huge pages using MMU read lock (bsc#1271050). - commit ab2e5ac - KVM: x86/mmu: Rename kvm_tdp_mmu_zap_sp() to better indicate its purpose (bsc#1271050). - commit b5fffff - KVM: x86/mmu: Track possible NX huge pages separately for TDP vs. Shadow MMU (bsc#1271050). - commit 8162ecb ++++ kernel-rt: - KVM: x86/mmu: Recover TDP MMU NX huge pages using MMU read lock (bsc#1271050). - commit ab2e5ac - KVM: x86/mmu: Rename kvm_tdp_mmu_zap_sp() to better indicate its purpose (bsc#1271050). - commit b5fffff - KVM: x86/mmu: Track possible NX huge pages separately for TDP vs. Shadow MMU (bsc#1271050). - commit 8162ecb ++++ kernel-rt_debug: - KVM: x86/mmu: Recover TDP MMU NX huge pages using MMU read lock (bsc#1271050). - commit ab2e5ac - KVM: x86/mmu: Rename kvm_tdp_mmu_zap_sp() to better indicate its purpose (bsc#1271050). - commit b5fffff - KVM: x86/mmu: Track possible NX huge pages separately for TDP vs. Shadow MMU (bsc#1271050). - commit 8162ecb ++++ freetype2: - update to 2.14.3 - Important bug fixes * A bunch of potential security problems have been found. All users should update. - Miscellaneous * If configuration option `TT_CONFIG_OPTION_GPOS_KERNING` is active, GPOS-based kerning could miss some value pairs (bug introduced in version 2.14.0). - Added patch: * freetype-CVE-2026-50811.patch + upstream fix for issue #1436, bsc#1271045, CVE-2026-50811: out-of-bounds read vulnerabilityin src/truetype/ttgxvar.c in the TT_Get_Var_Design implementation used by FT_Get_Var_Design_Coordinates ++++ wget: - Fix buffer underflow in clean_metalink_link [bsc#1271033, CVE-2026-58469] * CVE-2026-58469.patch - Fix integer overflow in parse_content_range [bsc#1271034, CVE-2026-58470] * CVE-2026-58470.patch - Fix buffer size handling in filename conversion [bsc#1271035, CVE-2026-58471] * CVE-2026-58471.patch - Fix integer+buffer overflow in html_quote_string [bsc#1271036, CVE-2026-58472] * CVE-2026-58472.patch ------------------------------------------------------------------ ------------------ 2026-7-8 - Jul 8 2026 ------------------- ------------------------------------------------------------------ ++++ jq: - Add patch CVE-2026-43896.patch (CVE-2026-43896, bsc#1265075) - Add patch CVE-2026-44777.patch (CVE-2026-44777, bsc#1265076) - Add patch CVE-2026-49839.patch (CVE-2026-49839, bsc#1269220) - Add patch CVE-2026-54679.patch (CVE-2026-54679, bsc#1269390) ++++ kernel-default: - drm/amd/display: Fix dsc eDP issue (CVE-2026-43320 bsc#1264987) - commit efe61fa - netfilter: x_tables: guard option walkers against 1-byte tail reads (CVE-2026-43452 bsc#1265142) - commit 145c47f - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CVE-2026-43450 bsc#1264794) - commit e1f5d63 - net/tcp-md5: Fix MAC comparison to be constant-time (CVE-2026-43383 bsc#1264744) - commit 5d9ee14 - net: ncsi: fix skb leak in error paths (CVE-2026-43373 bsc#1265079) - commit 93fe82e - xsk: respect tailroom for ZC setups (CVE-2026-43092 bsc#1264270). - commit ffc5f58 - drm/amd/display: Add a function for checking tmds mode (CVE-2026-43191 bsc#1264548). - commit f2aa959 ++++ kernel-rt: - drm/amd/display: Fix dsc eDP issue (CVE-2026-43320 bsc#1264987) - commit efe61fa - netfilter: x_tables: guard option walkers against 1-byte tail reads (CVE-2026-43452 bsc#1265142) - commit 145c47f - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CVE-2026-43450 bsc#1264794) - commit e1f5d63 - net/tcp-md5: Fix MAC comparison to be constant-time (CVE-2026-43383 bsc#1264744) - commit 5d9ee14 - net: ncsi: fix skb leak in error paths (CVE-2026-43373 bsc#1265079) - commit 93fe82e - xsk: respect tailroom for ZC setups (CVE-2026-43092 bsc#1264270). - commit ffc5f58 - drm/amd/display: Add a function for checking tmds mode (CVE-2026-43191 bsc#1264548). - commit f2aa959 ++++ kernel-rt_debug: - drm/amd/display: Fix dsc eDP issue (CVE-2026-43320 bsc#1264987) - commit efe61fa - netfilter: x_tables: guard option walkers against 1-byte tail reads (CVE-2026-43452 bsc#1265142) - commit 145c47f - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CVE-2026-43450 bsc#1264794) - commit e1f5d63 - net/tcp-md5: Fix MAC comparison to be constant-time (CVE-2026-43383 bsc#1264744) - commit 5d9ee14 - net: ncsi: fix skb leak in error paths (CVE-2026-43373 bsc#1265079) - commit 93fe82e - xsk: respect tailroom for ZC setups (CVE-2026-43092 bsc#1264270). - commit ffc5f58 - drm/amd/display: Add a function for checking tmds mode (CVE-2026-43191 bsc#1264548). - commit f2aa959 ++++ sssd: - Fix GPO cache path traversal via unsanitized gPCFileSysPath; (bsc#1270708); (CVE-2026-14476); Add patch 0006-gpo-reject-path-traversal-in-gPCFileSysPath.patch - Warn when a SUDO provider LDAP search falls back to root DN; (bsc#1270709); (CVE-2026-14474); Add patch 0007-sudo-warn-when-ldap_sudo_search_base-falls-back-to-r.patch ++++ openSUSE-build-key: - Update key for zSystems (managed by OBS, expires 2026-12-06) - replace gpg-pubkey-f6ab3975-62e9e6fb.asc - by gpg-pubkey-f6ab3975-66f622c2.asc ------------------------------------------------------------------ ------------------ 2026-7-7 - Jul 7 2026 ------------------- ------------------------------------------------------------------ ++++ afterburn: - Update to version 5.10.0.git73.b97f772: * build(deps): bump anyhow from 1.0.99 to 1.0.103 https://github.com/coreos/afterburn/pull/1284 * build(deps): bump libflate from 2.1.0 to 2.2.2 https://github.com/coreos/afterburn/pull/1283 * build(deps): bump openssl from 0.10.79 to 0.10.80 not vulnerable but patches CVE-2026-45784 AKA bsc#1270949 https://github.com/coreos/afterburn/pull/1277 - Update to version 5.10.0.git70.9cc2a7b: * build(deps): bump openssl from 0.10.78 to 0.10.79 fixes CVE-2026-42327 AKA bsc#1270483 , CVE-2026-44662 AKA bsc#1270886 * providers/hetzner: Add the HETZNER_PUBLIC_IPV6 attribute * providers/hetzner: Add support for network configuration * build(deps): bump rustls-webpki from 0.103.10 to 0.103.13 fixes GHSA-82j2-j2ch-gfr8 , GHSA-965h-392x-2mh5 , GHSA-xgp8-3hg3-c2mh * build(deps): bump openssl from 0.10.73 to 0.10.78 fixes CVE-2026-41898 AKA bsc#1270817 , CVE-2026-41681 AKA bsc#1270787 , CVE-2026-41676 AKA bsc#1270175 , CVE-2026-41678 AKA bsc#1270651 , CVE-2026-41677 AKA bsc#1270555 * docs: Add AGENTS.md and CLAUDE.md for AI coding assistants * build(deps): bump rand from 0.9.2 to 0.9.4 not vulnerable but patches RUSTSEC-2026-0097 AKA GHSA-cq8v-f236-94qc * opencode: add skills for provider scaffolding and release automation * ibmcloud-classic: Add missing network_id to fixture * kubevirt: Support static gateway and DNS with DHCP * build(deps): bump rustls-webpki from 0.103.6 to 0.103.10 fixes GHSA-pwjx-qhcg-rvj4 * fix(proxmoxve): Define DNS entries for every interface * Makefile: download `90-afterburn-authorized-keys-file.conf` for rpm building * Sync repo templates ⚙ * Sync repo templates ⚙ * build(deps): bump bytes from 1.10.1 to 1.11.1 fixes CVE-2026-25541 * util/dhcp: Fix clippy lints * Sync repo templates ⚙ * build(deps): bump actions/checkout from 4 to 6 * Sync repo templates ⚙ * build(deps): bump actions/upload-artifact from 4 to 5 * kubevirt: modprobe for virtio_blk; remove dracut preload * Sync repo templates ⚙ * kubevirt: Add NoCloud network configuration support * kubevirt: Support config drive network data * kubevirt: Refactor the provider to follow the proxmoxve structure * dracut: Add virtio_blk module preload to afterburn-network-kargs service * docs: Add release notes * cargo: Afterburn release 5.10.0 - Update to version 5.10.0: * cargo: Afterburn release 5.10.0 * docs/release-notes: update for release 5.10.0 * cargo: update dependencies * microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat * docs/release-notes: Add entry for Azure SharedConfig XML parsing fix * microsoft/azure: Fix SharedConfig parsing of XML attributes * microsoft/azure: Mock goalstate.SharedConfig output in tests * providers/azure: switch SSH key retrieval from certs endpoint to IMDS * build(deps): bump the build group with 8 updates * build(deps): bump slab from 0.4.10 to 0.4.11 * build(deps): bump actions/checkout from 4 to 5 * upcloud: implement UpCloud provider * build(deps): bump the build group with 4 updates * Sync repo templates ⚙ ++++ grub2: - Dump PCRs on key unsealing fail (bsc#1270265) * 0001-tpm2_key_protector-Dump-PCRs-on-policy-fail.patch ++++ kernel-default: - io_uring/poll: fix signed comparison in io_poll_get_ownership() (bsc#1268989 CVE-2026-52933). - commit 26f7e93 - scsi: target: core: Fix integer overflow in UNMAP bounds check (CVE-2026-53021 bsc#1269151). - commit 1e19f6b - dm cache metadata: fix memory leak on metadata abort retry (CVE-2026-53060 bsc#1269164). - commit 8c6360e - libceph: Fix potential out-of-bounds access in osdmap_decode() (CVE-2026-52958 bsc#1269174). - commit e469798 - libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (CVE-2026-52956 bsc#1269172). - commit e6938b1 - ceph: only d_add() negative dentries when they are unhashed (CVE-2026-46052 bsc#1267494). - commit d67a188 - ocfs2: validate group add input before caching (CVE-2026-53039 bsc#1269392). - commit 4e4e2ad - gfs2: add some missing log locking (CVE-2026-53049 bsc#1269646). - commit 588d3c1 - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios (CVE-2026-53167 bsc#1269768). - commit bc9d90b - fuse: reject fuse_notify() pagecache ops on directories (CVE-2026-53168 bsc#1269645). - commit f86f95e - md/raid5: fix soft lockup in retry_aligned_read() (CVE-2026-46051 bsc#1267360). - commit 14f88d8 - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies (CVE-2026-46161 bsc#1266838). - commit 4b7776d - md/raid10: fix deadlock with check operation and nowait requests (CVE-2026-46050 bsc#1266686). - commit 1e05cdc - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (CVE-2026-46046 bsc#1266726). - commit 8e9d2c4 - ext4: fix dirtyclusters double decrement on fs shutdown (CVE-2026-45920 bsc#1266893). - commit 08bcb0c - ext4: drop extent cache when splitting extent fails (CVE-2026-45899 bsc#1266883). - commit fc5f28e - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options (CVE-2026-53249 bsc#1269992). - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (CVE-2026-46099 bsc#1266722). - xsk: validate MTU against usable frame size on bind (CVE-2026-43092 bsc#1264270). - net: consume xmit errors of GSO frames (CVE-2026-43194 bsc#1264304). - commit fe8c145 - USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196 bsc#1269986). - commit 718392c - staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction (CVE-2026-53178 bsc#1269795) - commit 1a70ae4 - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CVE-2026-53357 bsc#1270257). - commit 3201735 ++++ kernel-rt: - io_uring/poll: fix signed comparison in io_poll_get_ownership() (bsc#1268989 CVE-2026-52933). - commit 26f7e93 - scsi: target: core: Fix integer overflow in UNMAP bounds check (CVE-2026-53021 bsc#1269151). - commit 1e19f6b - dm cache metadata: fix memory leak on metadata abort retry (CVE-2026-53060 bsc#1269164). - commit 8c6360e - libceph: Fix potential out-of-bounds access in osdmap_decode() (CVE-2026-52958 bsc#1269174). - commit e469798 - libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (CVE-2026-52956 bsc#1269172). - commit e6938b1 - ceph: only d_add() negative dentries when they are unhashed (CVE-2026-46052 bsc#1267494). - commit d67a188 - ocfs2: validate group add input before caching (CVE-2026-53039 bsc#1269392). - commit 4e4e2ad - gfs2: add some missing log locking (CVE-2026-53049 bsc#1269646). - commit 588d3c1 - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios (CVE-2026-53167 bsc#1269768). - commit bc9d90b - fuse: reject fuse_notify() pagecache ops on directories (CVE-2026-53168 bsc#1269645). - commit f86f95e - md/raid5: fix soft lockup in retry_aligned_read() (CVE-2026-46051 bsc#1267360). - commit 14f88d8 - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies (CVE-2026-46161 bsc#1266838). - commit 4b7776d - md/raid10: fix deadlock with check operation and nowait requests (CVE-2026-46050 bsc#1266686). - commit 1e05cdc - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (CVE-2026-46046 bsc#1266726). - commit 8e9d2c4 - ext4: fix dirtyclusters double decrement on fs shutdown (CVE-2026-45920 bsc#1266893). - commit 08bcb0c - ext4: drop extent cache when splitting extent fails (CVE-2026-45899 bsc#1266883). - commit fc5f28e - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options (CVE-2026-53249 bsc#1269992). - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (CVE-2026-46099 bsc#1266722). - xsk: validate MTU against usable frame size on bind (CVE-2026-43092 bsc#1264270). - net: consume xmit errors of GSO frames (CVE-2026-43194 bsc#1264304). - commit fe8c145 - USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196 bsc#1269986). - commit 718392c - staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction (CVE-2026-53178 bsc#1269795) - commit 1a70ae4 - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CVE-2026-53357 bsc#1270257). - commit 3201735 ++++ kernel-rt_debug: - io_uring/poll: fix signed comparison in io_poll_get_ownership() (bsc#1268989 CVE-2026-52933). - commit 26f7e93 - scsi: target: core: Fix integer overflow in UNMAP bounds check (CVE-2026-53021 bsc#1269151). - commit 1e19f6b - dm cache metadata: fix memory leak on metadata abort retry (CVE-2026-53060 bsc#1269164). - commit 8c6360e - libceph: Fix potential out-of-bounds access in osdmap_decode() (CVE-2026-52958 bsc#1269174). - commit e469798 - libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (CVE-2026-52956 bsc#1269172). - commit e6938b1 - ceph: only d_add() negative dentries when they are unhashed (CVE-2026-46052 bsc#1267494). - commit d67a188 - ocfs2: validate group add input before caching (CVE-2026-53039 bsc#1269392). - commit 4e4e2ad - gfs2: add some missing log locking (CVE-2026-53049 bsc#1269646). - commit 588d3c1 - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios (CVE-2026-53167 bsc#1269768). - commit bc9d90b - fuse: reject fuse_notify() pagecache ops on directories (CVE-2026-53168 bsc#1269645). - commit f86f95e - md/raid5: fix soft lockup in retry_aligned_read() (CVE-2026-46051 bsc#1267360). - commit 14f88d8 - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies (CVE-2026-46161 bsc#1266838). - commit 4b7776d - md/raid10: fix deadlock with check operation and nowait requests (CVE-2026-46050 bsc#1266686). - commit 1e05cdc - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (CVE-2026-46046 bsc#1266726). - commit 8e9d2c4 - ext4: fix dirtyclusters double decrement on fs shutdown (CVE-2026-45920 bsc#1266893). - commit 08bcb0c - ext4: drop extent cache when splitting extent fails (CVE-2026-45899 bsc#1266883). - commit fc5f28e - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options (CVE-2026-53249 bsc#1269992). - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (CVE-2026-46099 bsc#1266722). - xsk: validate MTU against usable frame size on bind (CVE-2026-43092 bsc#1264270). - net: consume xmit errors of GSO frames (CVE-2026-43194 bsc#1264304). - commit fe8c145 - USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196 bsc#1269986). - commit 718392c - staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction (CVE-2026-53178 bsc#1269795) - commit 1a70ae4 - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CVE-2026-53357 bsc#1270257). - commit 3201735 ------------------------------------------------------------------ ------------------ 2026-7-6 - Jul 6 2026 ------------------- ------------------------------------------------------------------ ++++ containerd: - Add patch for CVE-2026-35469 (bsc#1262266) * 0006-CVE-2026-35469-Update-spdystream-to-0.5.1.patch - Rebase patches: * 0003-CVE-2026-34986-Bump-go-jose-to-v3.0.5.patch * 0004-CVE-2026-39821-idna-update-from-x-text-fix-ToUnicode.patch * 0005-CVE-2026-33814-http2-prevent-hanging-Transport-due-t.patch ++++ kernel-default: - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256 bsc#1269993). - commit ec1f193 - ice: introduce PTP state machine (bsc#1269981). - Refresh patches.suse/ice-Don-t-process-extts-if-PTP-is-disabled.patch. - Refresh patches.suse/ice-Fix-improper-extts-handling.patch. - commit 31099ce - ice: Fix PTP NULL pointer dereference during VSI rebuild (bsc#1269981). - ice: stop destroying and reinitalizing Tx tracker during reset (bsc#1269981). - ice: factor out ice_ptp_rebuild_owner() (bsc#1269981). - ice: rename ice_ptp_tx_cfg_intr (bsc#1269981). - ice: don't check has_ready_bitmap in E810 functions (bsc#1269981). - ice: rename verify_cached to has_ready_bitmap (bsc#1269981). - ice: pass reset type to PTP reset functions (bsc#1269981). - commit 2640e24 - add bugnumber to existing mana change (bsc#1270022). - commit 92ee9e3 - Update patches.suse/KVM-x86-Fix-shadow-paging-use-after-free-due-to-unex-81ccda30b4e8.patch (bsc#1270059 CVE-2026-53359). - commit c6042d7 - Update patches.suse/ipv6-account-for-fraggap-on-the-paged-allocation-path.patch (git-fixes CVE-2026-53362 bsc#1269493). - commit 400728f - Sort patches for TLBI errata mitigation's on Arm CPUs - commit 8005e5d ++++ kernel-rt: - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256 bsc#1269993). - commit ec1f193 - ice: introduce PTP state machine (bsc#1269981). - Refresh patches.suse/ice-Don-t-process-extts-if-PTP-is-disabled.patch. - Refresh patches.suse/ice-Fix-improper-extts-handling.patch. - commit 31099ce - ice: Fix PTP NULL pointer dereference during VSI rebuild (bsc#1269981). - ice: stop destroying and reinitalizing Tx tracker during reset (bsc#1269981). - ice: factor out ice_ptp_rebuild_owner() (bsc#1269981). - ice: rename ice_ptp_tx_cfg_intr (bsc#1269981). - ice: don't check has_ready_bitmap in E810 functions (bsc#1269981). - ice: rename verify_cached to has_ready_bitmap (bsc#1269981). - ice: pass reset type to PTP reset functions (bsc#1269981). - commit 2640e24 - add bugnumber to existing mana change (bsc#1270022). - commit 92ee9e3 - Update patches.suse/KVM-x86-Fix-shadow-paging-use-after-free-due-to-unex-81ccda30b4e8.patch (bsc#1270059 CVE-2026-53359). - commit c6042d7 - Update patches.suse/ipv6-account-for-fraggap-on-the-paged-allocation-path.patch (git-fixes CVE-2026-53362 bsc#1269493). - commit 400728f - Sort patches for TLBI errata mitigation's on Arm CPUs - commit 8005e5d ++++ kernel-rt_debug: - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256 bsc#1269993). - commit ec1f193 - ice: introduce PTP state machine (bsc#1269981). - Refresh patches.suse/ice-Don-t-process-extts-if-PTP-is-disabled.patch. - Refresh patches.suse/ice-Fix-improper-extts-handling.patch. - commit 31099ce - ice: Fix PTP NULL pointer dereference during VSI rebuild (bsc#1269981). - ice: stop destroying and reinitalizing Tx tracker during reset (bsc#1269981). - ice: factor out ice_ptp_rebuild_owner() (bsc#1269981). - ice: rename ice_ptp_tx_cfg_intr (bsc#1269981). - ice: don't check has_ready_bitmap in E810 functions (bsc#1269981). - ice: rename verify_cached to has_ready_bitmap (bsc#1269981). - ice: pass reset type to PTP reset functions (bsc#1269981). - commit 2640e24 - add bugnumber to existing mana change (bsc#1270022). - commit 92ee9e3 - Update patches.suse/KVM-x86-Fix-shadow-paging-use-after-free-due-to-unex-81ccda30b4e8.patch (bsc#1270059 CVE-2026-53359). - commit c6042d7 - Update patches.suse/ipv6-account-for-fraggap-on-the-paged-allocation-path.patch (git-fixes CVE-2026-53362 bsc#1269493). - commit 400728f - Sort patches for TLBI errata mitigation's on Arm CPUs - commit 8005e5d ++++ tiff: - Update to 4.7.2: Software configuration changes: * cmake: Fix bundle identifiers to use reverse-DNS format * cmake: Fix and improve Apple framework build support * cmake: Use TurboJPEG CONFIG by default (issue #767) * cmake: changes related to 8-/12-bit modes * cmake: Replace CMath::CMath with direct link to avoid export. * Support for iOS-derived builds * Simplify cmake byte order version check * Add additional warnings, primarily floating precision conversions and integer arithmetic conversions * configure.ac: Require bootstrap with at least Autoconf 2.71. Library changes: * New/improved functionalities:: + Add TIFFGetMaxCompressionRatio() and use it in _TIFFReadEncoded[Tile|Strip)AndAllocBuffer() (issue #781) (CVE-2026-36849) (bsc#1268434) * API/ABI breaks: + None Bug fixes: * Handle negative TIFFReadFile results before state updates (issue #854) * tif_dirread.c: fix copy-paste bug in ChopUpSingleUncompressedStrip * tif_read.c: Fixed division by zero in TIFFStartStrip() (issue #777) * tif_dirwrite.c: add integer overflow checks to allocation size calculations * tif_print.c: add integer overflow checks to allocation size calculations * tif_write.c: fix OOB read and underflow in TIFFAppendToStrip copy loop * DumpModeSeek: add bounds check to prevent OOB pointer advance * TIFFGrowStrips: fix use-after-free on partial realloc failure. * Fix NULL dereference in _TIFFReserveLargeEnoughWriteBuffer() by validating the strip bytecount array before accessing it. * TIFFRGBAImage: avoid int overflows in put functions (issue #830) * tif_getimage: fix inconsistent fromskew handling in put16bitbwtile (issue #792) * tif_getimage: Widen pointer-offset arithmetic in tif_getimage * putcontig8bitYCbCr44tile: fix wrong fromskew computation (issue #798) * putcontig8bitYCbCr42tile: Reject invalid YCbCr subsampling when image dimensions are smaller than the subsampling block to prevent out-of-bounds writes. (issue #753) * TIFFReadRGBAImage(): prevent integer overflow and later heap overflow (issue #787) (CVE-2026-4775) (bsc#1260411) * TIFFFillStrip/Tile(): avoid excessive memory allocation (issue #831) * TIFFLinkDirectory() checks for IFD loops (issue #788) * Check result of _TIFFCheckRealloc to prevent memory leaks and segmentation fault when reallocation fails. * TIFFVTileSize64(): in YCbCr contig non upsampled mode, validate td_samplesperpixel==3 (issue #805) * TIFFReadDirEntryPersampleShort(): be tolerant to tags like SampleFormat not having 1 or SamplesPerPixel values (https://github.com/OSGeo/gdal/issues/13465) * tif_getimage: reject tile widths that would overflow toskew (issue #808) * Fix integer overflow in _TIFFPartialReadStripArray on 32-bit. * TIFFAppendToStrip(): add some checks to avoid null-pointer-dereferencing (issue #777). * _TIFFGetStrileOffsetOrByteCountValue(): fix potential crash on corrupted files when file opened in 'O' mode (https://issues.oss-fuzz.com/issues/471328917) * TIFFReadDirectory(): re-set TIFF_LAZYSTRILELOAD if file opened in 'O' mode * _TIFFMergeFields(): avoid NULL ptr dereference (issue #755). * Check td_stripbytecount_p and td_stripoffset_p for NULL pointer before (re-)writing to file. (issue #749) * JPEGDecodeRaw: initialize output buffer to avoid returning uninitialized memory (issue #892) * JPEG decompressor: initialize output buffer when JPEG image is smaller than strile dimension to avoid heap memory disclosure (issue #826) * JPEG: fix generation of tiled 12-bit JPEG compressed files with libjpeg-turbo 3.0.3 (issue #773) * JPEGDecode(): fix memory leak in error code path (https://issues.oss-fuzz.com/issues/471945501) * tif_jpeg: reject mismatched JPEG data precision to avoid write overflow * Fix signed left-shift UB in LogLuv RANDITHER encoding (issue #850) * PixarLog: error out on invalid ABGR output buffer sizes. * PixarLog: complete ABGR bounds check for multi-row strip decoding. * PixarLog: fix heap-buffer-overflow in 8BITABGR decode with stride 3 (issue #824) (CVE-2026-12912) (bsc#1269779) * PixarLog: fix undoing horizontal differencing when SamplesPerPixel != 3 and 4 (issue #789). * PixarLog codec: fix potential integer overflow/out-of-bounds access (issue #797) * TIFFAdvanceDirectory(): avoid potential read heap-buffer-overflow in mmap code path on 32 bit builds (https://issues.oss-fuzz.com/issues/506737072) * OJPEG: fix integer overflow in subsampling buffer allocation. * OJPEG: fix nullptr deref when changing compression method from OJPEG to something else (issue #795). * OJPEG fix potential integer overflow/out-of-bounds access (issue #796). * ojpeg: prevent EOF infinite loop (fixes commit 2a3d55b) * fix null pointer deference in issue #782. * fix stack-overflow in issue #784. Other changes: * Change EXIF and GPS tag type from IFD8 to LONG8 per EXIF-specification (issue #739). * Harden integer size and offset calculations (issue #897) * TIFFComputeTile/TIFFComputeStrip: use overflow-checked multiplication * Move widening casts inside multiplication scope. * Lots of compiler warning fixes related to enabling more warning flags * Align writing and reading of TIFF_LONG8 and TIFF_IFD8 tags (issue #773) * TIFFFillStrip(): prevent harmless unsigned integer overflow - Drop tiff-CVE-2026-4775.patch ++++ rust-keylime: - Remove Cargo_toml.patch (merged upstream) - Update openssl to 0.10.81 bsc#1270174, CVE-2026-41676 bsc#1270999, CVE-2026-45784 bsc#1270903, CVE-2026-44662 bsc#1270842, CVE-2026-41898 bsc#1270792, CVE-2026-41681 bsc#1270699, CVE-2026-41678 bsc#1270614, CVE-2026-41677 bsc#1270523, CVE-2026-42327 - Update to version 0.2.9+49: * build(deps): bump uuid from 1.23.3 to 1.23.4 * build(deps): bump syn from 2.0.117 to 2.0.118 * build(deps): bump openssl from 0.10.80 to 0.10.81 * build(deps): bump rand from 0.9.4 to 0.10.1 * Added new regression test into packit-ci.yaml * build(deps): bump actions/checkout from 6 to 7 * build(deps): bump uuid from 1.23.1 to 1.23.3 * build(deps): bump log from 0.4.29 to 0.4.32 * build(deps): bump http from 1.4.0 to 1.4.2 * build(deps): bump codecov/codecov-action from 6 to 7 * build(deps): bump retry-policies from 0.5.1 to 0.5.2 * fix: Remove unused base64::Engine import in context_info tests * build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2 * build(deps): bump serde_json from 1.0.149 to 1.0.150 * build(deps): bump openssl from 0.10.79 to 0.10.80 * agent: Hash agent ID before TPM2_Certify qualifying data * cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der * build(deps): bump openssl from 0.10.78 to 0.10.79 * build(deps): bump once_cell from 1.21.3 to 1.21.4 * build(deps): bump tempfile from 3.23.0 to 3.27.0 * push-model: cache UEFI event log bytes at startup * build(deps): bump quote from 1.0.40 to 1.0.45 * build(deps): bump chrono from 0.4.42 to 0.4.44 * build(deps): bump openssl from 0.10.73 to 0.10.78 * build(deps): bump serde_json from 1.0.143 to 1.0.149 * build(deps): bump syn from 2.0.106 to 2.0.117 * build(deps): bump libc from 0.2.175 to 0.2.184 * build(deps): bump rand from 0.9.2 to 0.9.4 ------------------------------------------------------------------ ------------------ 2026-7-5 - Jul 5 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels (CVE-2026-43294 bsc#1264853). - commit 02c1e4c - drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 (CVE-2026-43191 bsc#1264548). - commit be9e9f8 - drm/v3d: Skip CSD when it has zeroed workgroups (CVE-2026-53139 bsc#1269262). - commit 7631875 - drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED (CVE-2026-53285 bsc#1269527). - commit b33690d - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var (stable-fixes). - fbdev: fix use-after-free in store_modes() (stable-fixes). - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S (stable-fixes). - wifi: iwlwifi: mvm: fix race condition in PTP removal (stable-fixes). - crypto: qat - Return pointer directly in adf_ctl_alloc_resources (stable-fixes). - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() (stable-fixes). - commit 9153874 ++++ kernel-rt: - drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels (CVE-2026-43294 bsc#1264853). - commit 02c1e4c - drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 (CVE-2026-43191 bsc#1264548). - commit be9e9f8 - drm/v3d: Skip CSD when it has zeroed workgroups (CVE-2026-53139 bsc#1269262). - commit 7631875 - drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED (CVE-2026-53285 bsc#1269527). - commit b33690d - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var (stable-fixes). - fbdev: fix use-after-free in store_modes() (stable-fixes). - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S (stable-fixes). - wifi: iwlwifi: mvm: fix race condition in PTP removal (stable-fixes). - crypto: qat - Return pointer directly in adf_ctl_alloc_resources (stable-fixes). - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() (stable-fixes). - commit 9153874 ++++ kernel-rt_debug: - drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels (CVE-2026-43294 bsc#1264853). - commit 02c1e4c - drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 (CVE-2026-43191 bsc#1264548). - commit be9e9f8 - drm/v3d: Skip CSD when it has zeroed workgroups (CVE-2026-53139 bsc#1269262). - commit 7631875 - drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED (CVE-2026-53285 bsc#1269527). - commit b33690d - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var (stable-fixes). - fbdev: fix use-after-free in store_modes() (stable-fixes). - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S (stable-fixes). - wifi: iwlwifi: mvm: fix race condition in PTP removal (stable-fixes). - crypto: qat - Return pointer directly in adf_ctl_alloc_resources (stable-fixes). - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() (stable-fixes). - commit 9153874 ------------------------------------------------------------------ ------------------ 2026-7-4 - Jul 4 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() (git-fixes). - drm/virtio: bound EDID block reads to the response buffer (git-fixes). - drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference (git-fixes). - drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips (git-fixes). - drm/amdgpu: fix aperture mapping leak (git-fixes). - drm/i915: Return NULL on error in active_instance (git-fixes). - pinctrl: meson: restore non-sleeping GPIO access (git-fixes). - gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe (git-fixes). - gpio-f7188x: Add support for NCT6126D version B (git-fixes). - gpio: htc-egpio: use managed gpiochip registration (git-fixes). - gpio: mvebu: fail probe if gpiochip registration fails (git-fixes). - commit 5354f05 ++++ kernel-rt: - drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() (git-fixes). - drm/virtio: bound EDID block reads to the response buffer (git-fixes). - drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference (git-fixes). - drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips (git-fixes). - drm/amdgpu: fix aperture mapping leak (git-fixes). - drm/i915: Return NULL on error in active_instance (git-fixes). - pinctrl: meson: restore non-sleeping GPIO access (git-fixes). - gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe (git-fixes). - gpio-f7188x: Add support for NCT6126D version B (git-fixes). - gpio: htc-egpio: use managed gpiochip registration (git-fixes). - gpio: mvebu: fail probe if gpiochip registration fails (git-fixes). - commit 5354f05 ++++ kernel-rt_debug: - drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() (git-fixes). - drm/virtio: bound EDID block reads to the response buffer (git-fixes). - drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference (git-fixes). - drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips (git-fixes). - drm/amdgpu: fix aperture mapping leak (git-fixes). - drm/i915: Return NULL on error in active_instance (git-fixes). - pinctrl: meson: restore non-sleeping GPIO access (git-fixes). - gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe (git-fixes). - gpio-f7188x: Add support for NCT6126D version B (git-fixes). - gpio: htc-egpio: use managed gpiochip registration (git-fixes). - gpio: mvebu: fail probe if gpiochip registration fails (git-fixes). - commit 5354f05 ++++ python311-core: - CVE-2026-7210: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible (bsc#1264962, gh#python/cpython#149018). CVE-2026-7210-pyexpat-entropy-hash-flooding.patch ++++ python311: - CVE-2026-7210: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible (bsc#1264962, gh#python/cpython#149018). CVE-2026-7210-pyexpat-entropy-hash-flooding.patch ------------------------------------------------------------------ ------------------ 2026-7-3 - Jul 3 2026 ------------------- ------------------------------------------------------------------ ++++ python-kiwi: - Fix reading of runtime config files Make sure the reading of the runtime config files in the different locations is not an exclusive procedure. According to the systemd/uapi spec both vendor(/usr) and admin(/etc) places needs to be taken into account and not only one. In addition the drop-ins directories should also be taken into account if their main file is not present. This Fixes #3014 - Add support for sha512sum Allow to select between the default shasum size 256 and 512 via a new runtime config section named: shasum This Fixes #3004 ++++ kernel-default: - drm/v3d: Reject empty multisync extension to prevent infinite loop (CVE-2026-46314 bsc#1267992). - commit 6d0927d - scsi: csiostor: Fix dereference of null pointer rn (CVE-2026-45857 bsc#1266458). - commit 875f44a - ppc/fadump: invoke kmsg_dump in fadump panic path (bsc#1270226 ltc#218302). - Refresh patches.suse/powerpc-lock-down-kernel-in-secure-boot-mode.patch. - commit 70e0f9c - wifi: fix leak if split 6 GHz scanning fails (CVE-2026-53258 bsc#1269230). - commit 6f58bfc - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176 bsc#1269710) - commit 38f8473 - batman-adv: dat: ensure accessible eth_hdr proto field (git-fixes). - batman-adv: bla: reacquire gw address after skb realloc (git-fixes). - batman-adv: dat: acquire ARP hw source only after skb realloc (git-fixes). - batman-adv: gw: acquire ethernet header only after skb realloc (git-fixes). - batman-adv: access unicast_ttvn skb->data only after skb realloc (git-fixes). - net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy (git-fixes). - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() (git-fixes). - net: wwan: iosm: bound device offsets in the MUX downlink decoder (git-fixes). - hwmon: adm1275: Prevent reading uninitialized stack (git-fixes). - hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig (git-fixes). - hwmon: (asus_atk0110) Check package count before accessing element (git-fixes). - hwmon: (occ) unregister sysfs devices outside occ lock (git-fixes). - commit c2ee381 - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure (CVE-2026-53229 bsc#1269691). - commit 06626f0 - bpf, arm64: Fix off-by-one in check_imm signed range check (bsc#1269389 CVE-2026-53036). - bpf, arm64: Reject out-of-range B.cond targets (bsc#1269389 CVE-2026-53036). - commit d3f2678 ++++ kernel-rt: - drm/v3d: Reject empty multisync extension to prevent infinite loop (CVE-2026-46314 bsc#1267992). - commit 6d0927d - scsi: csiostor: Fix dereference of null pointer rn (CVE-2026-45857 bsc#1266458). - commit 875f44a - ppc/fadump: invoke kmsg_dump in fadump panic path (bsc#1270226 ltc#218302). - Refresh patches.suse/powerpc-lock-down-kernel-in-secure-boot-mode.patch. - commit 70e0f9c - wifi: fix leak if split 6 GHz scanning fails (CVE-2026-53258 bsc#1269230). - commit 6f58bfc - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176 bsc#1269710) - commit 38f8473 - batman-adv: dat: ensure accessible eth_hdr proto field (git-fixes). - batman-adv: bla: reacquire gw address after skb realloc (git-fixes). - batman-adv: dat: acquire ARP hw source only after skb realloc (git-fixes). - batman-adv: gw: acquire ethernet header only after skb realloc (git-fixes). - batman-adv: access unicast_ttvn skb->data only after skb realloc (git-fixes). - net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy (git-fixes). - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() (git-fixes). - net: wwan: iosm: bound device offsets in the MUX downlink decoder (git-fixes). - hwmon: adm1275: Prevent reading uninitialized stack (git-fixes). - hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig (git-fixes). - hwmon: (asus_atk0110) Check package count before accessing element (git-fixes). - hwmon: (occ) unregister sysfs devices outside occ lock (git-fixes). - commit c2ee381 - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure (CVE-2026-53229 bsc#1269691). - commit 06626f0 - bpf, arm64: Fix off-by-one in check_imm signed range check (bsc#1269389 CVE-2026-53036). - bpf, arm64: Reject out-of-range B.cond targets (bsc#1269389 CVE-2026-53036). - commit d3f2678 ++++ kernel-rt_debug: - drm/v3d: Reject empty multisync extension to prevent infinite loop (CVE-2026-46314 bsc#1267992). - commit 6d0927d - scsi: csiostor: Fix dereference of null pointer rn (CVE-2026-45857 bsc#1266458). - commit 875f44a - ppc/fadump: invoke kmsg_dump in fadump panic path (bsc#1270226 ltc#218302). - Refresh patches.suse/powerpc-lock-down-kernel-in-secure-boot-mode.patch. - commit 70e0f9c - wifi: fix leak if split 6 GHz scanning fails (CVE-2026-53258 bsc#1269230). - commit 6f58bfc - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176 bsc#1269710) - commit 38f8473 - batman-adv: dat: ensure accessible eth_hdr proto field (git-fixes). - batman-adv: bla: reacquire gw address after skb realloc (git-fixes). - batman-adv: dat: acquire ARP hw source only after skb realloc (git-fixes). - batman-adv: gw: acquire ethernet header only after skb realloc (git-fixes). - batman-adv: access unicast_ttvn skb->data only after skb realloc (git-fixes). - net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy (git-fixes). - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() (git-fixes). - net: wwan: iosm: bound device offsets in the MUX downlink decoder (git-fixes). - hwmon: adm1275: Prevent reading uninitialized stack (git-fixes). - hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig (git-fixes). - hwmon: (asus_atk0110) Check package count before accessing element (git-fixes). - hwmon: (occ) unregister sysfs devices outside occ lock (git-fixes). - commit c2ee381 - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure (CVE-2026-53229 bsc#1269691). - commit 06626f0 - bpf, arm64: Fix off-by-one in check_imm signed range check (bsc#1269389 CVE-2026-53036). - bpf, arm64: Reject out-of-range B.cond targets (bsc#1269389 CVE-2026-53036). - commit d3f2678 ++++ python-cryptography: - CVE-2026-41676: openssl: derive` can overflow short buffers on OpenSSL 1.1.1 (bsc#1270208) - CVE-2026-41677: openssl: Out-of-bounds read in PEM password callback when user callback returns an oversized length (bsc#1270620) - CVE-2026-41678: openssl: Incorrect bounds assertion in aes key wrap (bsc#1270706) - CVE-2026-41681: openssl: digest_final() writes past caller buffer with no length check (bsc#1270772) - CVE-2026-41898: openssl: Unchecked callback-returned length in PSK and cookie generate trampolines can cause OpenSSL to leak adjacent memory to the network peer (bsc#1270801) - CVE-2026-44662: openssl: Heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270936) - CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs (bsc#1270515) - CVE-2026-45784: openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers (bsc#1270994) * refreshed vendor tarball to update openssl crate to 0.10.81 ------------------------------------------------------------------ ------------------ 2026-7-2 - Jul 2 2026 ------------------- ------------------------------------------------------------------ ++++ curl: - Security fixes: * CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402) * CVE-2026-8458: wrong reuse for different services (bsc#1268407) * CVE-2026-8924: traling dot domain super cookie (bsc#1268409) * CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413) * CVE-2026-9079: stale proxy password leak (bsc#1268415) * CVE-2026-9080: UAF after pause in socket callback (bsc#1268416) * CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417) * CVE-2026-9547: SSH improper host validation (bsc#1268420) * CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422) * CVE-2026-12064: proto-default skips SSH verification (bsc#1268427) * Add patches: curl-CVE-2026-8286.patch curl-CVE-2026-8458.patch curl-CVE-2026-8924.patch curl-CVE-2026-8927.patch curl-CVE-2026-9079.patch curl-CVE-2026-9080.patch curl-CVE-2026-9545.patch curl-CVE-2026-9547.patch curl-CVE-2026-10536.patch curl-config2setopts-exit-if-curl_url_set-fails-on-OOM.patch curl-CVE-2026-12064.patch ++++ kernel-default: - iommu/amd: serialize sequence allocation under concurrent TLB invalidations (git-fixes). - commit 27171ec - vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248 bsc#1264302). - commit 140bf73 - iommu/amd: move wait_on_sem() out of spinlock (git-fixes bsc#1260593 CVE-2026-43253 bsc#1264419). - commit cb12df3 - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (CVE-2026-43199 bsc#1264556). - commit e93008f - net: mvpp2: refill RX buffers before XDP or skb use (CVE-2026-53215 bsc#1269680). - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075 bsc#1269690). - commit be5f4a3 - KVM: x86: Fix shadow paging use-after-free due to unexpected role (git-fixes). - commit 2245927 - netfilter: bridge: make ebt_snat ARP rewrite writable (CVE-2026-53266 bsc#1269136). - commit 5517b02 ++++ kernel-rt: - iommu/amd: serialize sequence allocation under concurrent TLB invalidations (git-fixes). - commit 27171ec - vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248 bsc#1264302). - commit 140bf73 - iommu/amd: move wait_on_sem() out of spinlock (git-fixes bsc#1260593 CVE-2026-43253 bsc#1264419). - commit cb12df3 - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (CVE-2026-43199 bsc#1264556). - commit e93008f - net: mvpp2: refill RX buffers before XDP or skb use (CVE-2026-53215 bsc#1269680). - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075 bsc#1269690). - commit be5f4a3 - KVM: x86: Fix shadow paging use-after-free due to unexpected role (git-fixes). - commit 2245927 - netfilter: bridge: make ebt_snat ARP rewrite writable (CVE-2026-53266 bsc#1269136). - commit 5517b02 ++++ kernel-rt_debug: - iommu/amd: serialize sequence allocation under concurrent TLB invalidations (git-fixes). - commit 27171ec - vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248 bsc#1264302). - commit 140bf73 - iommu/amd: move wait_on_sem() out of spinlock (git-fixes bsc#1260593 CVE-2026-43253 bsc#1264419). - commit cb12df3 - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (CVE-2026-43199 bsc#1264556). - commit e93008f - net: mvpp2: refill RX buffers before XDP or skb use (CVE-2026-53215 bsc#1269680). - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075 bsc#1269690). - commit be5f4a3 - KVM: x86: Fix shadow paging use-after-free due to unexpected role (git-fixes). - commit 2245927 - netfilter: bridge: make ebt_snat ARP rewrite writable (CVE-2026-53266 bsc#1269136). - commit 5517b02 ++++ python311-core: - CVE-2026-8328: Make ftplib not trust the PASV response (bsc#1265268) CVE-2026-8328-ftplib-no-trust-PASV-resp.patch ++++ python311: - CVE-2026-8328: Make ftplib not trust the PASV response (bsc#1265268) CVE-2026-8328-ftplib-no-trust-PASV-resp.patch ++++ python-tornado6: - GHSA-pw6j-qg29-8w7f: CurlAsyncHTTPClient leaks per-request credentials on handle reuse (bsc#1269012) - Add patch GHSA-pw6j-qg29-8w7f.patch ------------------------------------------------------------------ ------------------ 2026-7-1 - Jul 1 2026 ------------------- ------------------------------------------------------------------ ++++ docker-compose: - Add patch for CVE-2026-33814 (bsc#1265782) * 0003-CVE-2026-33814-http2-prevent-hanging-Transport-due-t.patch - Add patch for CVE-2026-39821 (bsc#1266625) * 0004-CVE-2026-39821-idna-update-from-x-text-fix-ToUnicode.patch - Add patch for CVE-2025-22869 (bsc#1239340) * 0005-CVE-2025-22869-ssh-limit-the-size-of-the-internal-pa.patch - Add patch for CVE-2025-0495 (bsc#1239766) * 0006-CVE-2025-0495-fix-localstate-remove-definition-and-i.patch ++++ python-kiwi: - Fix system resize When resizing the partition table via sfdisk --relocate, the resize failed when the device was locked beforehand. In addition the resize of the actual filesystem failed the prior filesystem check if the btrfs filesystem is used. btrfs reports the free space cache to be outdated/corrupt after kiwi has resized the partition table. This is an expected condition prior resize of the filesystem and should not prevent the following resize. As such the filesystem check is not applied for btrfs prior resize. ++++ kernel-default: - net: rds: fix MR cleanup on copy error (CVE-2026-46053 bsc#1267427). - commit aafabc7 - net/rds: handle zerocopy send cleanup before the message is queued (CVE-2026-43502 bsc#1266008). - commit f11be57 - xsk: tighten UMEM headroom validation to account for tailroom and min frame (CVE-2026-43093 bsc#1264254). - commit 5f4bf63 - tipc: fix double-free in tipc_buf_append() (CVE-2026-52993 bsc#1269193). - commit 106ed97 - sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924 bsc#1269036). - commit 34cb918 - Revert "net/smc: Introduce TCP ULP support" (CVE-2026-46330 bsc#1268049). - commit 3f4a07f - libceph: Fix potential out-of-bounds access in crush_decode() (CVE-2026-52955 bsc#1269159). - commit 50d0a31 - Bluetooth: bnep: reject short frames before parsing (CVE-2026-53253 bsc#1269574). - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling (CVE-2026-53253 bsc#1269574). - commit 0aaf398 - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072 bsc#1269681). - commit 9499df6 - wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182 bsc#1269884). - commit ac19aff - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071 bsc#1269678). - commit 5a0d934 - Refresh patches.suse/iommu-amd-Fix-clone_alias-to-use-the-original-device.patch. - commit 2d05323 - RDMA/umem: Fix truncation for block sizes >= 4G (CVE-2026-53133 bsc#1269821) - commit c6d138c - RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133 bsc#1266928) - commit f911b5f - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible (CVE-2026-52908 bsc#1268661) - commit fd9f6e2 - crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016 bsc#1269090). - commit 918dc49 - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (CVE-2026-53281 bsc#1269519). - commit 492b510 - audit: fix incorrect inheritable capability in CAPSET records (CVE-2026-53287 bsc#1269506). - commit d82f7b4 - Bluetooth: serialize accept_q access (CVE-2026-52918 bsc#1269100) (CVE-2026-52918 bsc#1269100). - commit 55e3579 - ocfs2: fix listxattr handling when the buffer is full (CVE-2026-53041 bsc#1269398). - commit 15b9067 - ocfs2: validate bg_bits during freefrag scan (CVE-2026-53040 bsc#1269397). - commit f7d5b9f ++++ kernel-rt: - net: rds: fix MR cleanup on copy error (CVE-2026-46053 bsc#1267427). - commit aafabc7 - net/rds: handle zerocopy send cleanup before the message is queued (CVE-2026-43502 bsc#1266008). - commit f11be57 - xsk: tighten UMEM headroom validation to account for tailroom and min frame (CVE-2026-43093 bsc#1264254). - commit 5f4bf63 - tipc: fix double-free in tipc_buf_append() (CVE-2026-52993 bsc#1269193). - commit 106ed97 - sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924 bsc#1269036). - commit 34cb918 - Revert "net/smc: Introduce TCP ULP support" (CVE-2026-46330 bsc#1268049). - commit 3f4a07f - libceph: Fix potential out-of-bounds access in crush_decode() (CVE-2026-52955 bsc#1269159). - commit 50d0a31 - Bluetooth: bnep: reject short frames before parsing (CVE-2026-53253 bsc#1269574). - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling (CVE-2026-53253 bsc#1269574). - commit 0aaf398 - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072 bsc#1269681). - commit 9499df6 - wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182 bsc#1269884). - commit ac19aff - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071 bsc#1269678). - commit 5a0d934 - Refresh patches.suse/iommu-amd-Fix-clone_alias-to-use-the-original-device.patch. - commit 2d05323 - RDMA/umem: Fix truncation for block sizes >= 4G (CVE-2026-53133 bsc#1269821) - commit c6d138c - RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133 bsc#1266928) - commit f911b5f - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible (CVE-2026-52908 bsc#1268661) - commit fd9f6e2 - crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016 bsc#1269090). - commit 918dc49 - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (CVE-2026-53281 bsc#1269519). - commit 492b510 - audit: fix incorrect inheritable capability in CAPSET records (CVE-2026-53287 bsc#1269506). - commit d82f7b4 - Bluetooth: serialize accept_q access (CVE-2026-52918 bsc#1269100) (CVE-2026-52918 bsc#1269100). - commit 55e3579 - ocfs2: fix listxattr handling when the buffer is full (CVE-2026-53041 bsc#1269398). - commit 15b9067 - ocfs2: validate bg_bits during freefrag scan (CVE-2026-53040 bsc#1269397). - commit f7d5b9f ++++ kernel-rt_debug: - net: rds: fix MR cleanup on copy error (CVE-2026-46053 bsc#1267427). - commit aafabc7 - net/rds: handle zerocopy send cleanup before the message is queued (CVE-2026-43502 bsc#1266008). - commit f11be57 - xsk: tighten UMEM headroom validation to account for tailroom and min frame (CVE-2026-43093 bsc#1264254). - commit 5f4bf63 - tipc: fix double-free in tipc_buf_append() (CVE-2026-52993 bsc#1269193). - commit 106ed97 - sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924 bsc#1269036). - commit 34cb918 - Revert "net/smc: Introduce TCP ULP support" (CVE-2026-46330 bsc#1268049). - commit 3f4a07f - libceph: Fix potential out-of-bounds access in crush_decode() (CVE-2026-52955 bsc#1269159). - commit 50d0a31 - Bluetooth: bnep: reject short frames before parsing (CVE-2026-53253 bsc#1269574). - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling (CVE-2026-53253 bsc#1269574). - commit 0aaf398 - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072 bsc#1269681). - commit 9499df6 - wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182 bsc#1269884). - commit ac19aff - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071 bsc#1269678). - commit 5a0d934 - Refresh patches.suse/iommu-amd-Fix-clone_alias-to-use-the-original-device.patch. - commit 2d05323 - RDMA/umem: Fix truncation for block sizes >= 4G (CVE-2026-53133 bsc#1269821) - commit c6d138c - RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133 bsc#1266928) - commit f911b5f - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible (CVE-2026-52908 bsc#1268661) - commit fd9f6e2 - crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016 bsc#1269090). - commit 918dc49 - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (CVE-2026-53281 bsc#1269519). - commit 492b510 - audit: fix incorrect inheritable capability in CAPSET records (CVE-2026-53287 bsc#1269506). - commit d82f7b4 - Bluetooth: serialize accept_q access (CVE-2026-52918 bsc#1269100) (CVE-2026-52918 bsc#1269100). - commit 55e3579 - ocfs2: fix listxattr handling when the buffer is full (CVE-2026-53041 bsc#1269398). - commit 15b9067 - ocfs2: validate bg_bits during freefrag scan (CVE-2026-53040 bsc#1269397). - commit f7d5b9f ++++ python311-core: - CVE-2026-11940: fix the symlink escape via tarfile hardlink-extraction fallback (bsc#1268977) CVE-2026-11940-tarfile-escape.patch ++++ python311: - CVE-2026-11940: fix the symlink escape via tarfile hardlink-extraction fallback (bsc#1268977) CVE-2026-11940-tarfile-escape.patch ++++ python-msgpack: - CVE-2026-57585: Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error potentially leading to a DoS attack (bsc#1269947) * CVE-2026-57585.patch - Add stop-using-cpp.patch for the above patch to be applicable ------------------------------------------------------------------ ------------------ 2026-6-30 - Jun 30 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - add bugnumber to existing mana changes (bsc#1269798). - commit e65974f - pstore: ram_core: fix incorrect success return when vmap() fails (CVE-2026-43124 bsc#1264545) - commit 4bdddad - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (CVE-2026-43281 bsc#1264534) - commit f90d78e - btrfs: fix deadlock between reflink and transaction commit when using flushoncommit (CVE-2026-53122 bsc#1269418). - commit 5ff6aed - scsi: target: Fix hexadecimal CHAP_I handling (git-fixes). - commit b1c985a - xfrm: always flush state and policy upon NETDEV_UNREGISTER event (CVE-2026-43167 bsc#1264580) - commit b4e53db - net: mana: Optimize irq affinity for low vcpu configs (git-fixes). - net: mana: Fall back to standard MTU when PF reports adapter_mtu of 0 (git-fixes). - hv_balloon: Simplify data output in hv_balloon_debug_show() (git-fixes). - scsi: storvsc: Replace symbolic permissions with octal (git-fixes). - RDMA/mana_ib: Use ib_get_eth_speed for reporting port speed (git-fixes). - net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check (git-fixes). - net: mana: initialize gdma queue id to INVALID_QUEUE_ID (git-fixes). - net: mana: Add support for PF device 0x00C1 (bsc#1268237). - RDMA/mana_ib: Allocate interrupt contexts on EQs (git-fixes). - net: mana: Allocate interrupt context for each EQ when creating vPort (git-fixes). - net: mana: Use GIC functions to allocate global EQs (git-fixes). - net: mana: Introduce GIC context with refcounting for interrupt management (git-fixes). - net: mana: Query device capabilities and configure MSI-X sharing for EQs (git-fixes). - net: mana: Create separate EQs for each vPort (git-fixes). - update mainline tags for existing mana patches - commit bd93685 - ipc: limit next_id allocation to the valid ID range (CVE-2026-52923 bsc#1269033). - commit dd85e38 - Move upstreamed mana patches into sorted section - commit 87d2c61 - Update patches.suse/net-sched-fix-pedit-partial-COW-leading-to-page-cach.patch (CVE-2026-46331 bsc#1268335 bsc#1265421). - commit 8cdeb6c - iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053 bsc#1269310). - commit c791dc8 ++++ kernel-rt: - add bugnumber to existing mana changes (bsc#1269798). - commit e65974f - pstore: ram_core: fix incorrect success return when vmap() fails (CVE-2026-43124 bsc#1264545) - commit 4bdddad - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (CVE-2026-43281 bsc#1264534) - commit f90d78e - btrfs: fix deadlock between reflink and transaction commit when using flushoncommit (CVE-2026-53122 bsc#1269418). - commit 5ff6aed - scsi: target: Fix hexadecimal CHAP_I handling (git-fixes). - commit b1c985a - xfrm: always flush state and policy upon NETDEV_UNREGISTER event (CVE-2026-43167 bsc#1264580) - commit b4e53db - net: mana: Optimize irq affinity for low vcpu configs (git-fixes). - net: mana: Fall back to standard MTU when PF reports adapter_mtu of 0 (git-fixes). - hv_balloon: Simplify data output in hv_balloon_debug_show() (git-fixes). - scsi: storvsc: Replace symbolic permissions with octal (git-fixes). - RDMA/mana_ib: Use ib_get_eth_speed for reporting port speed (git-fixes). - net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check (git-fixes). - net: mana: initialize gdma queue id to INVALID_QUEUE_ID (git-fixes). - net: mana: Add support for PF device 0x00C1 (bsc#1268237). - RDMA/mana_ib: Allocate interrupt contexts on EQs (git-fixes). - net: mana: Allocate interrupt context for each EQ when creating vPort (git-fixes). - net: mana: Use GIC functions to allocate global EQs (git-fixes). - net: mana: Introduce GIC context with refcounting for interrupt management (git-fixes). - net: mana: Query device capabilities and configure MSI-X sharing for EQs (git-fixes). - net: mana: Create separate EQs for each vPort (git-fixes). - update mainline tags for existing mana patches - commit bd93685 - ipc: limit next_id allocation to the valid ID range (CVE-2026-52923 bsc#1269033). - commit dd85e38 - Move upstreamed mana patches into sorted section - commit 87d2c61 - Update patches.suse/net-sched-fix-pedit-partial-COW-leading-to-page-cach.patch (CVE-2026-46331 bsc#1268335 bsc#1265421). - commit 8cdeb6c - iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053 bsc#1269310). - commit c791dc8 ++++ kernel-rt_debug: - add bugnumber to existing mana changes (bsc#1269798). - commit e65974f - pstore: ram_core: fix incorrect success return when vmap() fails (CVE-2026-43124 bsc#1264545) - commit 4bdddad - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (CVE-2026-43281 bsc#1264534) - commit f90d78e - btrfs: fix deadlock between reflink and transaction commit when using flushoncommit (CVE-2026-53122 bsc#1269418). - commit 5ff6aed - scsi: target: Fix hexadecimal CHAP_I handling (git-fixes). - commit b1c985a - xfrm: always flush state and policy upon NETDEV_UNREGISTER event (CVE-2026-43167 bsc#1264580) - commit b4e53db - net: mana: Optimize irq affinity for low vcpu configs (git-fixes). - net: mana: Fall back to standard MTU when PF reports adapter_mtu of 0 (git-fixes). - hv_balloon: Simplify data output in hv_balloon_debug_show() (git-fixes). - scsi: storvsc: Replace symbolic permissions with octal (git-fixes). - RDMA/mana_ib: Use ib_get_eth_speed for reporting port speed (git-fixes). - net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check (git-fixes). - net: mana: initialize gdma queue id to INVALID_QUEUE_ID (git-fixes). - net: mana: Add support for PF device 0x00C1 (bsc#1268237). - RDMA/mana_ib: Allocate interrupt contexts on EQs (git-fixes). - net: mana: Allocate interrupt context for each EQ when creating vPort (git-fixes). - net: mana: Use GIC functions to allocate global EQs (git-fixes). - net: mana: Introduce GIC context with refcounting for interrupt management (git-fixes). - net: mana: Query device capabilities and configure MSI-X sharing for EQs (git-fixes). - net: mana: Create separate EQs for each vPort (git-fixes). - update mainline tags for existing mana patches - commit bd93685 - ipc: limit next_id allocation to the valid ID range (CVE-2026-52923 bsc#1269033). - commit dd85e38 - Move upstreamed mana patches into sorted section - commit 87d2c61 - Update patches.suse/net-sched-fix-pedit-partial-COW-leading-to-page-cach.patch (CVE-2026-46331 bsc#1268335 bsc#1265421). - commit 8cdeb6c - iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053 bsc#1269310). - commit c791dc8 ------------------------------------------------------------------ ------------------ 2026-6-29 - Jun 29 2026 ------------------- ------------------------------------------------------------------ ++++ container-selinux: - Introduce container_can_execstack boolean for older Java applications and allow execmem (bsc#1268490) - Add patch: allow-spc_t-execstack-via-boolean-and-execmem-bsc-1268490.patch ++++ python-kiwi: - Fix qemu-xxx requirement Do not require qemu variant packages for 32bit architectures. This Fixes bsc#1263564 Co-authored-by: Ana Guerrero ++++ kernel-default: - apparmor: fix NULL sock in aa_sock_file_perm (CVE-2026-45848 bsc#1266734). - commit 6c08d6a - ipv6: account for fraggap on the paged allocation path (git-fixes). - commit 7029afd - xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (CVE-2026-43139 bsc#1264294) - commit 8927331 - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (CVE-2026-43238 bsc#1264320) - commit 82ff1bb - ipvs: fix NULL deref in ip_vs_add_service error path (CVE-2026-43086 bsc#1264286) - commit ae6c68f - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (CVE-2026-43085 bsc#1264230) - commit ecf053a - xfrm: Wait for RCU readers during policy netns exit (CVE-2026-43091 bsc#1264267) - commit ab98dc5 - xfrm: account XFRMA_IF_ID in aevent size calculation (CVE-2026-43107 bsc#1264258) - commit 68fb519 - xfrm_user: fix info leak in build_mapping() (CVE-2026-43089 bsc#1264261) - commit 267add1 - perf/x86/intel/uncore: Skip discovery table for offline dies (CVE-2026-43079 bsc#1264228) - commit 838ea53 - drm/amd/display: Bound VBIOS record-chain walk loops (CVE-2026-53138 bsc#1269281). - commit 4b51877 - vsock/virtio: fix accept queue count leak on transport mismatch (CVE-2026-46214 bsc#1267717). - commit 8639d73 - ASoC: qcom: qdsp6: topology: check widget type before accessing data (CVE-2026-53052 bsc#1269314). - commit de5f24c - ceph: fix a buffer leak in __ceph_setxattr() (CVE-2026-52962 bsc#1269135). - commit add8de8 - libceph: Fix potential null-ptr-deref in decode_choose_args() (CVE-2026-52957 bsc#1269103). - commit 7e72bcf - libceph: handle rbtree insertion error in decode_choose_args() (CVE-2026-52954 bsc#1269137). - commit 2e4b9c2 - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972 bsc#1269195). - commit 4319d7f - crypto: algif_aead - snapshot IV for async AEAD requests (CVE-2026-46028 bsc#1267430). - commit 3df94fe - lib/crypto: chacha: Zeroize permuted_state before it leaves scope (CVE-2026-43336 bsc#1265113). - commit b087967 - x86/tsc: Disable clocksource watchdog checking on recent and future UV platforms (jsc#PED-16305). - commit 669c206 - x86/platform/uv: Expose the uv_hub_type() interface (jsc#PED-16305). - commit b5a6e96 - bnxt_en: fix module unload sequence (bsc#1264180). - commit d95bac0 - bnxt_en: Refactor all PTP TX timestamp fields into a struct (bsc#1264180). - Refresh patches.suse/bnxt_en-Refactor-bnxt_ptp_init.patch. - commit a776c30 - bnxt_en: Add TX timestamp completion logic (bsc#1264180). - Refresh patches.suse/bnxt_en-Refactor-bnxt_ptp_init.patch. - commit c155e2f - bnxt_en: Allow some TX packets to be unprocessed in NAPI (bsc#1264180). - Refresh patches.suse/bnxt-properly-flush-XDP-redirect-lists.patch. - commit a6b59ae - bnxt_en: Add is_ts_pkt field to struct bnxt_sw_tx_bd (bsc#1264180). - Refresh patches.suse/eth-bnxt-fix-missing-ring-index-trim-on-error-path.patch. - commit 2ab1278 - bnxt_en: Retry PTP TX timestamp from FW for 1 second (bsc#1264180). - Refresh patches.suse/bnxt_en-Refactor-bnxt_ptp_init.patch. - commit 51ad351 - bnxt_en: improve TX timestamping FIFO configuration (bsc#1264180). - bnxt_en: Remove atomic operations on ptp->tx_avail (bsc#1264180). - bnxt_en: Increase the max total outstanding PTP TX packets to 4 (bsc#1264180). - bnxt_en: Let bnxt_stamp_tx_skb() return error code (bsc#1264180). - bnxt_en: Remove an impossible condition check for PTP TX pending SKB (bsc#1264180). - bnxt_en: Add new TX timestamp completion definitions (bsc#1264180). - bnxt_en: silence clang build warning (bsc#1264180). - bnxt_en: Fix PTP firmware timeout parameter (bsc#1264180). - bnxt_en: Add a timeout parameter to bnxt_hwrm_port_ts_query() (bsc#1264180). - commit 6e75257 - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (git-fixes). - commit 2413d8b - KVM: x86: Unconditionally recompute CR8 intercept on PPR update (git-fixes). - commit e0e8fbc - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode (git-fixes). - commit 1224ff3 - KVM: x86: Move update_cr8_intercept() to lapic.c (git-fixes). - commit 5e7b8a6 - lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() (CVE-2026-43492 bsc#1265629). - commit d7cff60 - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (git-fixes). - commit 680150f - KVM: x86: Fix shadow paging use-after-free due to unexpected role (git-fixes). - commit 5125b9a - Refresh patches.suse/KVM-x86-Fix-shadow-paging-use-after-free-due-to-unex.patch. Remove a duplicate Git-commit header. - commit 573b335 - KVM: x86/mmu: Recursively zap orphaned nested TDP shadow pages on emulated writes (git-fixes). - commit c4a5ca8 - KVM: SVM: Truncate INVLPGA address in compatibility mode (git-fixes). - commit e7ca155 - KVM: x86: ioapic: Use old_dest_mode consistently in ioapic_write_indirect() (git-fixes). - commit 3a4f776 - KVM: x86: hyper-v: Bound the bank index when querying sparse banks (git-fixes). - commit 9b39296 - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (CVE-2026-52969 bsc#1269184). - commit 6855373 - crypto: af_alg - limit RX SG extraction by receive buffer budget (CVE-2026-31677 bsc#1263560). - commit 73b77b0 - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (git-fixes). - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (git-fixes). - commit 32103d6 ++++ kernel-rt: - apparmor: fix NULL sock in aa_sock_file_perm (CVE-2026-45848 bsc#1266734). - commit 6c08d6a - ipv6: account for fraggap on the paged allocation path (git-fixes). - commit 7029afd - xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (CVE-2026-43139 bsc#1264294) - commit 8927331 - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (CVE-2026-43238 bsc#1264320) - commit 82ff1bb - ipvs: fix NULL deref in ip_vs_add_service error path (CVE-2026-43086 bsc#1264286) - commit ae6c68f - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (CVE-2026-43085 bsc#1264230) - commit ecf053a - xfrm: Wait for RCU readers during policy netns exit (CVE-2026-43091 bsc#1264267) - commit ab98dc5 - xfrm: account XFRMA_IF_ID in aevent size calculation (CVE-2026-43107 bsc#1264258) - commit 68fb519 - xfrm_user: fix info leak in build_mapping() (CVE-2026-43089 bsc#1264261) - commit 267add1 - perf/x86/intel/uncore: Skip discovery table for offline dies (CVE-2026-43079 bsc#1264228) - commit 838ea53 - drm/amd/display: Bound VBIOS record-chain walk loops (CVE-2026-53138 bsc#1269281). - commit 4b51877 - vsock/virtio: fix accept queue count leak on transport mismatch (CVE-2026-46214 bsc#1267717). - commit 8639d73 - ASoC: qcom: qdsp6: topology: check widget type before accessing data (CVE-2026-53052 bsc#1269314). - commit de5f24c - ceph: fix a buffer leak in __ceph_setxattr() (CVE-2026-52962 bsc#1269135). - commit add8de8 - libceph: Fix potential null-ptr-deref in decode_choose_args() (CVE-2026-52957 bsc#1269103). - commit 7e72bcf - libceph: handle rbtree insertion error in decode_choose_args() (CVE-2026-52954 bsc#1269137). - commit 2e4b9c2 - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972 bsc#1269195). - commit 4319d7f - crypto: algif_aead - snapshot IV for async AEAD requests (CVE-2026-46028 bsc#1267430). - commit 3df94fe - lib/crypto: chacha: Zeroize permuted_state before it leaves scope (CVE-2026-43336 bsc#1265113). - commit b087967 - x86/tsc: Disable clocksource watchdog checking on recent and future UV platforms (jsc#PED-16305). - commit 669c206 - x86/platform/uv: Expose the uv_hub_type() interface (jsc#PED-16305). - commit b5a6e96 - bnxt_en: fix module unload sequence (bsc#1264180). - commit d95bac0 - bnxt_en: Refactor all PTP TX timestamp fields into a struct (bsc#1264180). - Refresh patches.suse/bnxt_en-Refactor-bnxt_ptp_init.patch. - commit a776c30 - bnxt_en: Add TX timestamp completion logic (bsc#1264180). - Refresh patches.suse/bnxt_en-Refactor-bnxt_ptp_init.patch. - commit c155e2f - bnxt_en: Allow some TX packets to be unprocessed in NAPI (bsc#1264180). - Refresh patches.suse/bnxt-properly-flush-XDP-redirect-lists.patch. - commit a6b59ae - bnxt_en: Add is_ts_pkt field to struct bnxt_sw_tx_bd (bsc#1264180). - Refresh patches.suse/eth-bnxt-fix-missing-ring-index-trim-on-error-path.patch. - commit 2ab1278 - bnxt_en: Retry PTP TX timestamp from FW for 1 second (bsc#1264180). - Refresh patches.suse/bnxt_en-Refactor-bnxt_ptp_init.patch. - commit 51ad351 - bnxt_en: improve TX timestamping FIFO configuration (bsc#1264180). - bnxt_en: Remove atomic operations on ptp->tx_avail (bsc#1264180). - bnxt_en: Increase the max total outstanding PTP TX packets to 4 (bsc#1264180). - bnxt_en: Let bnxt_stamp_tx_skb() return error code (bsc#1264180). - bnxt_en: Remove an impossible condition check for PTP TX pending SKB (bsc#1264180). - bnxt_en: Add new TX timestamp completion definitions (bsc#1264180). - bnxt_en: silence clang build warning (bsc#1264180). - bnxt_en: Fix PTP firmware timeout parameter (bsc#1264180). - bnxt_en: Add a timeout parameter to bnxt_hwrm_port_ts_query() (bsc#1264180). - commit 6e75257 - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (git-fixes). - commit 2413d8b - KVM: x86: Unconditionally recompute CR8 intercept on PPR update (git-fixes). - commit e0e8fbc - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode (git-fixes). - commit 1224ff3 - KVM: x86: Move update_cr8_intercept() to lapic.c (git-fixes). - commit 5e7b8a6 - lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() (CVE-2026-43492 bsc#1265629). - commit d7cff60 - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (git-fixes). - commit 680150f - KVM: x86: Fix shadow paging use-after-free due to unexpected role (git-fixes). - commit 5125b9a - Refresh patches.suse/KVM-x86-Fix-shadow-paging-use-after-free-due-to-unex.patch. Remove a duplicate Git-commit header. - commit 573b335 - KVM: x86/mmu: Recursively zap orphaned nested TDP shadow pages on emulated writes (git-fixes). - commit c4a5ca8 - KVM: SVM: Truncate INVLPGA address in compatibility mode (git-fixes). - commit e7ca155 - KVM: x86: ioapic: Use old_dest_mode consistently in ioapic_write_indirect() (git-fixes). - commit 3a4f776 - KVM: x86: hyper-v: Bound the bank index when querying sparse banks (git-fixes). - commit 9b39296 - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (CVE-2026-52969 bsc#1269184). - commit 6855373 - crypto: af_alg - limit RX SG extraction by receive buffer budget (CVE-2026-31677 bsc#1263560). - commit 73b77b0 - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (git-fixes). - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (git-fixes). - commit 32103d6 ++++ kernel-rt_debug: - apparmor: fix NULL sock in aa_sock_file_perm (CVE-2026-45848 bsc#1266734). - commit 6c08d6a - ipv6: account for fraggap on the paged allocation path (git-fixes). - commit 7029afd - xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (CVE-2026-43139 bsc#1264294) - commit 8927331 - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (CVE-2026-43238 bsc#1264320) - commit 82ff1bb - ipvs: fix NULL deref in ip_vs_add_service error path (CVE-2026-43086 bsc#1264286) - commit ae6c68f - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (CVE-2026-43085 bsc#1264230) - commit ecf053a - xfrm: Wait for RCU readers during policy netns exit (CVE-2026-43091 bsc#1264267) - commit ab98dc5 - xfrm: account XFRMA_IF_ID in aevent size calculation (CVE-2026-43107 bsc#1264258) - commit 68fb519 - xfrm_user: fix info leak in build_mapping() (CVE-2026-43089 bsc#1264261) - commit 267add1 - perf/x86/intel/uncore: Skip discovery table for offline dies (CVE-2026-43079 bsc#1264228) - commit 838ea53 - drm/amd/display: Bound VBIOS record-chain walk loops (CVE-2026-53138 bsc#1269281). - commit 4b51877 - vsock/virtio: fix accept queue count leak on transport mismatch (CVE-2026-46214 bsc#1267717). - commit 8639d73 - ASoC: qcom: qdsp6: topology: check widget type before accessing data (CVE-2026-53052 bsc#1269314). - commit de5f24c - ceph: fix a buffer leak in __ceph_setxattr() (CVE-2026-52962 bsc#1269135). - commit add8de8 - libceph: Fix potential null-ptr-deref in decode_choose_args() (CVE-2026-52957 bsc#1269103). - commit 7e72bcf - libceph: handle rbtree insertion error in decode_choose_args() (CVE-2026-52954 bsc#1269137). - commit 2e4b9c2 - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972 bsc#1269195). - commit 4319d7f - crypto: algif_aead - snapshot IV for async AEAD requests (CVE-2026-46028 bsc#1267430). - commit 3df94fe - lib/crypto: chacha: Zeroize permuted_state before it leaves scope (CVE-2026-43336 bsc#1265113). - commit b087967 - x86/tsc: Disable clocksource watchdog checking on recent and future UV platforms (jsc#PED-16305). - commit 669c206 - x86/platform/uv: Expose the uv_hub_type() interface (jsc#PED-16305). - commit b5a6e96 - bnxt_en: fix module unload sequence (bsc#1264180). - commit d95bac0 - bnxt_en: Refactor all PTP TX timestamp fields into a struct (bsc#1264180). - Refresh patches.suse/bnxt_en-Refactor-bnxt_ptp_init.patch. - commit a776c30 - bnxt_en: Add TX timestamp completion logic (bsc#1264180). - Refresh patches.suse/bnxt_en-Refactor-bnxt_ptp_init.patch. - commit c155e2f - bnxt_en: Allow some TX packets to be unprocessed in NAPI (bsc#1264180). - Refresh patches.suse/bnxt-properly-flush-XDP-redirect-lists.patch. - commit a6b59ae - bnxt_en: Add is_ts_pkt field to struct bnxt_sw_tx_bd (bsc#1264180). - Refresh patches.suse/eth-bnxt-fix-missing-ring-index-trim-on-error-path.patch. - commit 2ab1278 - bnxt_en: Retry PTP TX timestamp from FW for 1 second (bsc#1264180). - Refresh patches.suse/bnxt_en-Refactor-bnxt_ptp_init.patch. - commit 51ad351 - bnxt_en: improve TX timestamping FIFO configuration (bsc#1264180). - bnxt_en: Remove atomic operations on ptp->tx_avail (bsc#1264180). - bnxt_en: Increase the max total outstanding PTP TX packets to 4 (bsc#1264180). - bnxt_en: Let bnxt_stamp_tx_skb() return error code (bsc#1264180). - bnxt_en: Remove an impossible condition check for PTP TX pending SKB (bsc#1264180). - bnxt_en: Add new TX timestamp completion definitions (bsc#1264180). - bnxt_en: silence clang build warning (bsc#1264180). - bnxt_en: Fix PTP firmware timeout parameter (bsc#1264180). - bnxt_en: Add a timeout parameter to bnxt_hwrm_port_ts_query() (bsc#1264180). - commit 6e75257 - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (git-fixes). - commit 2413d8b - KVM: x86: Unconditionally recompute CR8 intercept on PPR update (git-fixes). - commit e0e8fbc - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode (git-fixes). - commit 1224ff3 - KVM: x86: Move update_cr8_intercept() to lapic.c (git-fixes). - commit 5e7b8a6 - lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() (CVE-2026-43492 bsc#1265629). - commit d7cff60 - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (git-fixes). - commit 680150f - KVM: x86: Fix shadow paging use-after-free due to unexpected role (git-fixes). - commit 5125b9a - Refresh patches.suse/KVM-x86-Fix-shadow-paging-use-after-free-due-to-unex.patch. Remove a duplicate Git-commit header. - commit 573b335 - KVM: x86/mmu: Recursively zap orphaned nested TDP shadow pages on emulated writes (git-fixes). - commit c4a5ca8 - KVM: SVM: Truncate INVLPGA address in compatibility mode (git-fixes). - commit e7ca155 - KVM: x86: ioapic: Use old_dest_mode consistently in ioapic_write_indirect() (git-fixes). - commit 3a4f776 - KVM: x86: hyper-v: Bound the bank index when querying sparse banks (git-fixes). - commit 9b39296 - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (CVE-2026-52969 bsc#1269184). - commit 6855373 - crypto: af_alg - limit RX SG extraction by receive buffer budget (CVE-2026-31677 bsc#1263560). - commit 73b77b0 - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (git-fixes). - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (git-fixes). - commit 32103d6 ++++ krb5: - Prevent read overrun in kdb-ldap: * CVE-2026-11850, bsc#1268131 - Add patch 0012-Prevent-read-overrun-in-libkdb_ldap.patch ++++ nghttp2: - stricter validation for HTTP CONNECT and Upgrade requests across HTTP/1, HTTP/2, and HTTP/3 upstreams, specifically rejecting requests that incorrectly include Content-Length or Transfer-Encoding headers * Add 0001-nghttpx-Tighten-up-CONNECT-and-HTTP-Upgrade-handling.patch CVE-2026-58055, bsc#1269489 ++++ python311-core: - Add test_UDPLITE_support.patch which improves testing for the support of IPPROTO_UDPLITE, which could be not present although header files are (bsc#1268375). ++++ python311: - Add test_UDPLITE_support.patch which improves testing for the support of IPPROTO_UDPLITE, which could be not present although header files are (bsc#1268375). ------------------------------------------------------------------ ------------------ 2026-6-28 - Jun 28 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - rtc: cmos: unregister HPET IRQ handler on probe failure (git-fixes). - rtc: ds1307: Fix off-by-one issue with wday for rx8130 (git-fixes). - rtc: msc313: fix NULL deref in shared IRQ handler at probe (git-fixes). - rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 (git-fixes). - rtc: mpfs: fix counter upload completion condition (git-fixes). - rtc: abx80x: fix the RTC_VL_CLR clearing all status flags (git-fixes). - commit 64cc5db - ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count (git-fixes). - ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode (git-fixes). - ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback (git-fixes). - ALSA: firewire: isight: bound the sample count to the packet payload (git-fixes). - ALSA: usb-audio: avoid kobject path lookup in DualSense match (git-fixes). - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() (git-fixes). - ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints (git-fixes). - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser (git-fixes). - i2c: mpc: Fix timeout calculations (git-fixes). - commit 45e1716 ++++ kernel-rt: - rtc: cmos: unregister HPET IRQ handler on probe failure (git-fixes). - rtc: ds1307: Fix off-by-one issue with wday for rx8130 (git-fixes). - rtc: msc313: fix NULL deref in shared IRQ handler at probe (git-fixes). - rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 (git-fixes). - rtc: mpfs: fix counter upload completion condition (git-fixes). - rtc: abx80x: fix the RTC_VL_CLR clearing all status flags (git-fixes). - commit 64cc5db - ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count (git-fixes). - ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode (git-fixes). - ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback (git-fixes). - ALSA: firewire: isight: bound the sample count to the packet payload (git-fixes). - ALSA: usb-audio: avoid kobject path lookup in DualSense match (git-fixes). - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() (git-fixes). - ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints (git-fixes). - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser (git-fixes). - i2c: mpc: Fix timeout calculations (git-fixes). - commit 45e1716 ++++ kernel-rt_debug: - rtc: cmos: unregister HPET IRQ handler on probe failure (git-fixes). - rtc: ds1307: Fix off-by-one issue with wday for rx8130 (git-fixes). - rtc: msc313: fix NULL deref in shared IRQ handler at probe (git-fixes). - rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 (git-fixes). - rtc: mpfs: fix counter upload completion condition (git-fixes). - rtc: abx80x: fix the RTC_VL_CLR clearing all status flags (git-fixes). - commit 64cc5db - ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count (git-fixes). - ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode (git-fixes). - ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback (git-fixes). - ALSA: firewire: isight: bound the sample count to the packet payload (git-fixes). - ALSA: usb-audio: avoid kobject path lookup in DualSense match (git-fixes). - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() (git-fixes). - ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints (git-fixes). - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser (git-fixes). - i2c: mpc: Fix timeout calculations (git-fixes). - commit 45e1716 ------------------------------------------------------------------ ------------------ 2026-6-27 - Jun 27 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - Move upstreamed powerpc patch into sorted section - commit 86bbb5b - drm/edid: fix OOB read in drm_parse_tiled_block() (git-fixes). - drm/nouveau: fix reversed error cleanup order in ucopy functions (git-fixes). - drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() (git-fixes). - drm/i915/gem: Add missing nospec on parallel submit slot (git-fixes). - drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT (git-fixes). - drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 (git-fixes). - drm/amdgpu: initialize irq.lock spinlock earlier (git-fixes). - drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (git-fixes). - drm/amdgpu: skip already suspended IP blocks in ip_suspend_phase2 (git-fixes). - drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free (git-fixes). - thermal: intel: Fix dangling resources on thermal_throttle_online() failure (git-fixes). - ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() (git-fixes). - ACPI: resource: Amend kernel-doc style (git-fixes). - spi: rpc-if: Use correct device for hardware reinitialization on resume (git-fixes). - spi: dw: fix wrong BAUDR setting after resume (git-fixes). - spi: uniphier: Fix completion initialization order before devm_request_irq() (git-fixes). - commit 8390847 ++++ kernel-rt: - Move upstreamed powerpc patch into sorted section - commit 86bbb5b - drm/edid: fix OOB read in drm_parse_tiled_block() (git-fixes). - drm/nouveau: fix reversed error cleanup order in ucopy functions (git-fixes). - drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() (git-fixes). - drm/i915/gem: Add missing nospec on parallel submit slot (git-fixes). - drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT (git-fixes). - drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 (git-fixes). - drm/amdgpu: initialize irq.lock spinlock earlier (git-fixes). - drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (git-fixes). - drm/amdgpu: skip already suspended IP blocks in ip_suspend_phase2 (git-fixes). - drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free (git-fixes). - thermal: intel: Fix dangling resources on thermal_throttle_online() failure (git-fixes). - ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() (git-fixes). - ACPI: resource: Amend kernel-doc style (git-fixes). - spi: rpc-if: Use correct device for hardware reinitialization on resume (git-fixes). - spi: dw: fix wrong BAUDR setting after resume (git-fixes). - spi: uniphier: Fix completion initialization order before devm_request_irq() (git-fixes). - commit 8390847 ++++ kernel-rt_debug: - Move upstreamed powerpc patch into sorted section - commit 86bbb5b - drm/edid: fix OOB read in drm_parse_tiled_block() (git-fixes). - drm/nouveau: fix reversed error cleanup order in ucopy functions (git-fixes). - drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() (git-fixes). - drm/i915/gem: Add missing nospec on parallel submit slot (git-fixes). - drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT (git-fixes). - drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 (git-fixes). - drm/amdgpu: initialize irq.lock spinlock earlier (git-fixes). - drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (git-fixes). - drm/amdgpu: skip already suspended IP blocks in ip_suspend_phase2 (git-fixes). - drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free (git-fixes). - thermal: intel: Fix dangling resources on thermal_throttle_online() failure (git-fixes). - ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() (git-fixes). - ACPI: resource: Amend kernel-doc style (git-fixes). - spi: rpc-if: Use correct device for hardware reinitialization on resume (git-fixes). - spi: dw: fix wrong BAUDR setting after resume (git-fixes). - spi: uniphier: Fix completion initialization order before devm_request_irq() (git-fixes). - commit 8390847 ------------------------------------------------------------------ ------------------ 2026-6-26 - Jun 26 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O (CVE-2026-45985 bsc#1266700). - commit aa3e6a3 - x86: shadow stacks: proper error handling for mmap lock (bsc#1264484 CVE-2026-43109). - commit d800cb1 - net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ (CVE-2026-43081 bsc#1264241). - bnxt_en: set backing store type from query type (CVE-2026-43034 bsc#1263998). - commit 0b757eb - tap: free page on error paths in tap_get_user_xdp() (CVE-2026-46320 bsc#1267993). - commit 0faa8e1 - drm/amdgpu: fix NULL pointer issue buffer funcs (CVE-2025-71294 bsc#1264562). - commit 9270b96 - Split off kABI workaround for bsc#1267458 (bsc#1267458) Split off the kABI workaround bsc#1267458 into a separate patch. The patch "fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info" breaks kABI by removing struct fb_defered_io.lock and adding struct fb_info.fbdefio_state. Revert these changes and store the value of fbdefio_state in the now-unused memory location of lock. Add helpers to wrap the read and write operations on this field. While at it, replace the existing backport with the one from linux-stable's v6.6.140. - commit 56fdaf4 - ip6_vti: set netns_immutable on the fallback device (CVE-2026-52909 bsc#1268660). - commit 4f5aad7 ++++ kernel-rt: - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O (CVE-2026-45985 bsc#1266700). - commit aa3e6a3 - x86: shadow stacks: proper error handling for mmap lock (bsc#1264484 CVE-2026-43109). - commit d800cb1 - net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ (CVE-2026-43081 bsc#1264241). - bnxt_en: set backing store type from query type (CVE-2026-43034 bsc#1263998). - commit 0b757eb - tap: free page on error paths in tap_get_user_xdp() (CVE-2026-46320 bsc#1267993). - commit 0faa8e1 - drm/amdgpu: fix NULL pointer issue buffer funcs (CVE-2025-71294 bsc#1264562). - commit 9270b96 - Split off kABI workaround for bsc#1267458 (bsc#1267458) Split off the kABI workaround bsc#1267458 into a separate patch. The patch "fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info" breaks kABI by removing struct fb_defered_io.lock and adding struct fb_info.fbdefio_state. Revert these changes and store the value of fbdefio_state in the now-unused memory location of lock. Add helpers to wrap the read and write operations on this field. While at it, replace the existing backport with the one from linux-stable's v6.6.140. - commit 56fdaf4 - ip6_vti: set netns_immutable on the fallback device (CVE-2026-52909 bsc#1268660). - commit 4f5aad7 ++++ kernel-rt_debug: - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O (CVE-2026-45985 bsc#1266700). - commit aa3e6a3 - x86: shadow stacks: proper error handling for mmap lock (bsc#1264484 CVE-2026-43109). - commit d800cb1 - net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ (CVE-2026-43081 bsc#1264241). - bnxt_en: set backing store type from query type (CVE-2026-43034 bsc#1263998). - commit 0b757eb - tap: free page on error paths in tap_get_user_xdp() (CVE-2026-46320 bsc#1267993). - commit 0faa8e1 - drm/amdgpu: fix NULL pointer issue buffer funcs (CVE-2025-71294 bsc#1264562). - commit 9270b96 - Split off kABI workaround for bsc#1267458 (bsc#1267458) Split off the kABI workaround bsc#1267458 into a separate patch. The patch "fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info" breaks kABI by removing struct fb_defered_io.lock and adding struct fb_info.fbdefio_state. Revert these changes and store the value of fbdefio_state in the now-unused memory location of lock. Add helpers to wrap the read and write operations on this field. While at it, replace the existing backport with the one from linux-stable's v6.6.140. - commit 56fdaf4 - ip6_vti: set netns_immutable on the fallback device (CVE-2026-52909 bsc#1268660). - commit 4f5aad7 ++++ shim: - shim-install: Improve the detection of SL Micro The GRUB_DISTRIBUTOR variable in SL Micro images may contain "SL Micro" or "SL-Micro" prefix. (bsc#1269084) ++++ vim: - Updated to version 9.2.0725, fixes the following problems: 9.2.0531: tests: Test_cd_completion() fails on MS-Windows with E344 9.2.0532: GTK: preedit font size is wrong for fractional point sizes 9.2.0533: '[ mark moved to end of inserted text after CTRL-R CTRL-P paste 9.2.0534: GTK UI does not support fullscreen mode 9.2.0535: tests: matchit plugin is not tested 9.2.0536: tests: Test_invalid_args() fails on GTK4 without xterm_clipboard 9.2.0537: GTK4: mouse popup menu does not show up at mouse pointer 9.2.0538: Cannot keep leading whitespace in %{} statusline expr 9.2.0539: filetype: too many Bitbake include files are recognized 9.2.0540: tests: Test_mswin_event_mouse is flaky 9.2.0541: Vim9: endclass/endenum/endinterface can give errors 9.2.0542: tests: test_codestyle fails 9.2.0543: Vim9: wrong error when redeclaring a typed variable 9.2.0544: GTK4: window blank after a resize or drag 9.2.0545: popup: blending uses hardcoded fallback colors 9.2.0546: configure: GTK4 build requires GTK >= 4.10 9.2.0547: "%v" in 'errorformat' is affected by 'tabstop' 9.2.0548: GTK4: terminal and pty job output is not processed 9.2.0549: Cursor wrong after autoindent strip is skipped 9.2.0550: GTK4: 'mousehide' unhides cursor when switching tabs 9.2.0551: filetype: Tolk files are not recognized 9.2.0552: GTK4: F10 does nothing when the menubar is hidden 9.2.0553: runtime(netrw): netrw rejects hostnames containing _ 9.2.0554: GTK4: memory leak in free_menu() 9.2.0555: too many strlen() in ex_substitute() 9.2.0556: GTK4: scrollbars not shown and do not respond to clicks 9.2.0557: filetype: Kawasaki Robots files are not recognized 9.2.0558: filetype: Popcap Reanimation files are not recognized 9.2.0559: filetype: Kaitai struct files are not recogonized 9.2.0560: filetype: busybox shebang lines are not recognized 9.2.0561: [security]: possible code execution with python3complete 9.2.0562: filetype: SGF files are not recognized 9.2.0563: GTK3/Wayland: crash with right mouse-button in tabline 9.2.0564: GTK4: tabline does not respond to mouse clicks 9.2.0565: [security]: out-of-bounds read in update_snapshot() 9.2.0566: f duplicates window if do_ecmd() is aborted 9.2.0567: dict function name allocation failure not handled 9.2.0568: pythoncomplete: g:pythoncomplete_allow_import had no effect 9.2.0569: out-of-bounds access in libvterm CSI 8 t resize 9.2.0570: GTK4: mouse wheel scrolling does not work correctly 9.2.0571: Vim9: memory leak in compile_nested_function() on failure 9.2.0572: lines disappear with wrapping virtual text after a double-width char 9.2.0573: Vim9: missing EX_WHOLE on some block keywords 9.2.0574: tests: missing test for v9.2.0572 9.2.0575: tests: filetype test for v9.2.0557 can be improved 9.2.0576: popup_create() not blocked in secure/sandbox 9.2.0577: GTK4: window resizing issues 9.2.0578: GTK4: :unmenu does not remove entries from the menubar 9.2.0579: :mksession, :mkview and :mkvimrc emit legacy Vim script 9.2.0580: xxd: binary output is not colored with -R 9.2.0581: After maximizing and deleting the quickfix buffer, window height is wrong 9.2.0582: GTK4: compile error when XFONTSET is defined 9.2.0583: completion: indent not ignored for fuzzy line completion 9.2.0584: GTK4: missing UI features 9.2.0585: line number wrong after undoing a deletion in quickfix buffer 9.2.0586: Crash with TextPut autocmd when pasting in terminal buffer 9.2.0587: GTK4: left scrollbar overlaps drawarea 9.2.0588: GTK4: drawing area loses focus after closing a menubar popover 9.2.0589: filetype: xinitrc files are not recognized 9.2.0590: GTK4: drawing area loses focus shape on popup menu open 9.2.0591: 'scrolljump' ignored when scrolling up 9.2.0592: Error when restoring session with terminal window 9.2.0593: :wqall ignores term_setkill() on running terminal buffers 9.2.0594: Use-after-free with ":wqall" and a running terminal job 9.2.0595: MS-Windows: Wrong buffer size calculation for gvimext 9.2.0596: cmdline completion popup cannot be scrolled with the mouse 9.2.0597: [security]: possible code execution with python complete 9.2.0598: tests: Test_statusline() is flaky 9.2.0599: popup: title set with popup_setoptions() is not shown 9.2.0600: clientserver method needs to be given as argument 9.2.0601: matchfuzzypos() returns garbage positions for long candidates 9.2.0602: popup: No opacity when background not set for Popup group 9.2.0603: possible heap-buffer-overflow when resizing the GUI 9.2.0604: tests: Test_mswin_event_mouse() is still flaky 9.2.0605: tests: Test_screenpos() is flaky in GUI 9.2.0606: GTK4: does not support all clipboard formats 9.2.0607: GTK4: inputdialog() does not work as expected 9.2.0608: popup_setoptions()/ch_setoptions() does not check secure mode 9.2.0609: completion info popup cannot be scrolled with the keyboard 9.2.0610: cindent: closing brace in a comment affects the next line's indent 9.2.0611: MS-Windows: evim.exe not working with VIMDLL 9.2.0612: Cannot render images in popup windows 9.2.0613: tests: test_xxd_color2() checks for dash but uses sh 9.2.0614: opacity popup leaves stale cells 9.2.0615: sixel encoder drops pixels on the right edge of shapes 9.2.0616: GTK4: use-after-free on clipboard read timeout 9.2.0617: GvimExt: does not support different runtime dirs 9.2.0618: use-after-free in popup_getoptions() on dict_add() failure 9.2.0619: integer overflow in popup image size validation 9.2.0620: runtime(netrw): fix 2match pattern rebuild 9.2.0621: 'autoindent' not stripped with virtualedit=onemore 9.2.0622: str2blob() does not work with wide UTF-16 encoding 9.2.0623: possible integer overflow in spellfile tree bounds check 9.2.0624: C-N/C-P cannot be mapped in complete() completion 9.2.0625: GTK4: Link error when Wayland is disabled 9.2.0626: Vim9: illegal characters allowed in dict key names with dot notation 9.2.0627: :vim9cmd source handles all scripts as Vim9 script 9.2.0628: popup image: wrong overlap layering, kitty laggy 9.2.0629: 0x80 and 0x9b byte not unescaped when check for valid abbr 9.2.0630: popup images: kitty images output in GUI mode 9.2.0631: DECRQM and SGR Mouse not supported in foot terminal 9.2.0632: GTK4: no support for hardware-accelerated rendering 9.2.0633: MS-Windows: No support for kitty graphics support in terminal 9.2.0634: GTK4: no minimum resize limit 9.2.0635: checking the syntax contains/cluster list is slow 9.2.0636: popup image: stale pixels under RGBA animation frames 9.2.0637: sixel: anti-aliased RGBA images render with visible outline 9.2.0638: cannot return matches containing spaces from a custom completion 9.2.0639: gq with 'formatprg' fails on an empty buffer 9.2.0640: the "%" command jumps to parens and braces inside comments 9.2.0641: GTK4: crash in gui_mch_menu_hidden() 9.2.0642: statusline: buffer overflow with item groups 9.2.0643: Missing Image ifdefs 9.2.0644: popup image: duplicate sync-output code 9.2.0645: Composing chars no longer accepted in end-id abbr 9.2.0646: GTK3 GUI slow on HiDPI/4K with software rendering 9.2.0647: matchfuzzypos() false exact match for long equal-length candidates 9.2.0648: MS-Windows: Compile warnings 9.2.0649: filetype: tf files sometimes incorrectly recognized 9.2.0650: Vim aborts at startup when built with the example -O2 CFLAGS 9.2.0651: completion: 'smartcase' doesn't work with 'longest' 9.2.0652: popup: stale kitty image after clipwindow scrolls out of view 9.2.0653: [security]: out-of-bounds write in tree_count_words() 9.2.0654: GTK4: using uninitialised colors in gui_mch_init() 9.2.0655: GTK4: missing NULL checks in vim_form_measure() 9.2.0656: completion: using wrong tolower() in smartcase filtering 9.2.0657: GTK4: missing menu when right-clicking in tabline 9.2.0658: xxd: signed integer overflow in huntype() 9.2.0659: GTK4: no balloon support in GUI 9.2.0660: Dragging the scrollbar does not trigger WinScrolled 9.2.0661: unintended wipe of Vim's temp dir, causes errors 9.2.0662: [security] Stack out-of-bounds write in dump_prefixes() 9.2.0663: [security]: runtime(netrw): code injection in local file deletion 9.2.0664: tests: Test_delete_temp_dir() fails on MacOS 9.2.0665: GTK4: GTK critical error on exit printed 9.2.0666: Terminal-Normal mode does not color empty lines with a background color 9.2.0667: patch 9.2.0590 was wrong 9.2.0668: GTK4: minimum horizontal size is too small 9.2.0669: GTK4: toolbar can be improved 9.2.0670: [security]: Out-of-bounds read with text properties 9.2.0671: [security]: possible out-of-bounds read with sodium encrypted files 9.2.0672: corrupted text property causes internal error 9.2.0673: tests: Test_recover_corrupted_swap_file() cannot handle symlinks 9.2.0674: configure: clears dynamic ruby linker flags 9.2.0675: tests: Test_cd_from_non_existing_dir() fails on Solaris 9.2.0676: MS-Windows: cannot switch to a buffer with '%' in its name 9.2.0677: Cannot clear the alternate file register # 9.2.0678: [security]: potential powershell code execution in zip.vim 9.2.0679: [security]: Out-of-bounds read with text property virtual text 9.2.0680: keytrans() doesn't replace '|' and '\' 9.2.0681: configure: -lruby added even for a dynamic ruby build 9.2.0682: Wrong dot-repeat when calling complete() while filtering completion 9.2.0683: filetype completion mishandles finished sub options 9.2.0684: :reg # does not display the value of the '#' register 9.2.0685: clipboard.c does not get the Wayland CFLAGS on GTK2 9.2.0686: style: strcmp usage is inconsistent 9.2.0687: popup_image_composites_frames() has improper if block scope 9.2.0688: Terminal-Normal mode does not show the Visual selection on a colored empty line 9.2.0689: the "%" command is slow on a long line with many slashes 9.2.0690: Solaris: swap file names are too long 9.2.0691: Solaris: Test_terminal_composing_unicode() fails 9.2.0692: GTK2: build failure, popup images not drawn correctly 9.2.0693: tests: Test_suspend() may fail because of keyprotocol query 9.2.0694: Solaris: some tests faiures due to Solaris peculiarities 9.2.0695: Solaris: test_delete_temp_dir() fails because of missing flock 9.2.0696: GTK4: A few issues with toolbar support 9.2.0697: possible overflow when parsing CSI keys 9.2.0698: [security]: Out-of-bounds write with soundfold() 9.2.0699: [security]: possible code execution with python complete 9.2.0700: configure: -lrt requirement for timer_create not detected 9.2.0701: tests: test_terminal.vim does not wait for job to finish 9.2.0702: :windo and :tabdo create an extra window with 'winfixbuf' 9.2.0703: session file does not store relative Vim9 autoload imports 9.2.0704: GTK4: not handling mouse events 9.2.0705: :delete # silently fails to update "# and clobbers "0 9.2.0706: tests: test_terminal3 may fail when $SHELL is zsh 9.2.0707: completion: popup misplaced when text before it is concealed 9.2.0708: Leaks in do_autocmd in error case 9.2.0709: GTK4: a few minor issues 9.2.0710: GTK4 GUI resize handling can be improved 9.2.0711: leak in ins_compl_infercase_gettext() in error case 9.2.0712: GTK4: dialogs not handling mnemonics correctly 9.2.0713: completion: ruler not updated correctly when the popup menu is visible 9.2.0714: Coverity warns for NULL deref 9.2.0715: Coverity warns about copy/paste error in hl_blend_attr() 9.2.0716: filetype: not all supertux files are recognized 9.2.0717: tests: strange indent in Test_autocmd_dup_arg() 9.2.0718: :syn sync without an argument also lists syntax cluster 9.2.0719: GTK4: default menu is lacking 9.2.0720: GTK4: no support for browsefilter 9.2.0721: serverlist() returns strings separated by \n 9.2.0722: GTK4: find/replace dialog can be improved 9.2.0723: term_start() does not support "noclose" 9.2.0724: Use-after-free when freeing exit_cb job on exit 9.2.0725: [security]: Stack out-of-bounds write in spell_soundfold_sal() - Refresh patches: * vim-9.1.1732-fix-inc-detection.patch ------------------------------------------------------------------ ------------------ 2026-6-25 - Jun 25 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319 bsc#1268022). - commit 716abed - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266 bsc#1267684). - commit 08926f3 - fbdev: defio: Disconnect deferred I/O from the lifetime of struct (bsc#1267458 CVE-2026-46065) - commit e91951f - drm/amdgpu: prevent immediate PASID reuse case (CVE-2026-31462 bsc#1262655). - commit 99a516e - x86/shstk: Prevent deadlock during shstk sigreturn (CVE-2026-46063 bsc#1267228). - commit f51c3c6 - net: rfkill: prevent unlimited numbers of rfkill events from being created (CVE-2026-31670 bsc#1263573). - commit f3e9886 - RDMA/umem: Fix double dma_buf_unpin in failure path (CVE-2026-43128 bsc#1264612) - commit bb06bb1 ++++ kernel-rt: - net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319 bsc#1268022). - commit 716abed - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266 bsc#1267684). - commit 08926f3 - fbdev: defio: Disconnect deferred I/O from the lifetime of struct (bsc#1267458 CVE-2026-46065) - commit e91951f - drm/amdgpu: prevent immediate PASID reuse case (CVE-2026-31462 bsc#1262655). - commit 99a516e - x86/shstk: Prevent deadlock during shstk sigreturn (CVE-2026-46063 bsc#1267228). - commit f51c3c6 - net: rfkill: prevent unlimited numbers of rfkill events from being created (CVE-2026-31670 bsc#1263573). - commit f3e9886 - RDMA/umem: Fix double dma_buf_unpin in failure path (CVE-2026-43128 bsc#1264612) - commit bb06bb1 ++++ kernel-rt_debug: - net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319 bsc#1268022). - commit 716abed - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266 bsc#1267684). - commit 08926f3 - fbdev: defio: Disconnect deferred I/O from the lifetime of struct (bsc#1267458 CVE-2026-46065) - commit e91951f - drm/amdgpu: prevent immediate PASID reuse case (CVE-2026-31462 bsc#1262655). - commit 99a516e - x86/shstk: Prevent deadlock during shstk sigreturn (CVE-2026-46063 bsc#1267228). - commit f51c3c6 - net: rfkill: prevent unlimited numbers of rfkill events from being created (CVE-2026-31670 bsc#1263573). - commit f3e9886 - RDMA/umem: Fix double dma_buf_unpin in failure path (CVE-2026-43128 bsc#1264612) - commit bb06bb1 ++++ alsa: - Fix double-free vulnerability in parse_def() (CVE-2026-56109, bsc#1268853): 0001-conf-add-missing-return-value-check-in-parse_def.patch ------------------------------------------------------------------ ------------------ 2026-6-24 - Jun 24 2026 ------------------- ------------------------------------------------------------------ ++++ cloud-init: - Re-add cloud-init-write-routes.patch (bsc#1267422) incorrectly dropped ++++ docker: - Ensure correct certificate is used for TSA auth (bsc#1262346, CVE-2026-39984) * 0007-CVE-2026-39984-Ensure-correct-certificate-is-used-fo.patch - http2: prevent hanging Transport due to bad SETTINGS (bsc#1265782, CVE-2026-33814) * 0008-CVE-2026-33814-http2-prevent-hanging-Transport-due-t.patch - idna: update from x/text, fix ToUnicode and all-ASCII xn-- labels (bsc#1266625, CVE-2026-39821) * 0009-CVE-2026-39821-idna-update-from-x-text-fix-ToUnicode.patch - daemon: Decompress archives before entering container filesystem (bsc#1267827, CVE-2026-41567) * 0010-CVE-2026-41567-daemon-Decompress-archives-before-ent.patch ++++ haproxy: - VUL-0: CVE-2026-55203: haproxy: integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers (bsc#1268557) Apply upstream patch: mux-fcgi-fix-uint16_t-overflow.patch - VUL-0: CVE-2026-55204: haproxy: null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c (bsc#1268558) Apply upstream patch: hpack-tbl-add-missing-NULL-check.patch ++++ kernel-default: - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (CVE-2026-46069 bsc#1267437). - commit c2a68c5 - net: skbuff: fix missing zerocopy reference in pskb_carve helpers (CVE-2026-52943 bsc#1269022) - commit f0d2a7c - apparmor: fix rlimit for posix cpu timers (CVE-2026-46328 bsc#1268037). - commit 46e0890 - AppArmor: Allow apparmor to handle unaligned dfa tables (CVE-2026-46254 bsc#1267637). - commit 721953b - ext4: fix memory leak in ext4_ext_shift_extents() (CVE-2026-45948 bsc#1266929). - commit 1888b9b - ext4: don't cache extent during splitting extent (CVE-2026-45912 bsc#1266899). - commit 4e1d4cf - isofs: validate block number from NFS file handle in isofs_export_iget (CVE-2026-46124 bsc#1266847). - commit bc4bf51 - smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185 bsc#1266830). - commit 671bdd5 - dmaengine: tegra: Fix burst size calculation (git-fixes). - dmaengine: Fix possible use after free (git-fixes). - dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK (git-fixes). - dmaengine: qcom: gpi: set DMA_PRIVATE capability (git-fixes). - dmaengine: imx-sdma: Refine spba bus searching in probe (git-fixes). - platform/x86: xo15-ebook: Fix wakeup source and GPE handling (git-fixes). - mailbox: mtk-adsp: fix UAF during device teardown (git-fixes). - tpm: fix event_size output in tpm1_binary_bios_measurements_show (git-fixes). - tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() (git-fixes). - commit 67ea05b - ceph: fix i_nlink underrun during async unlink (CVE-2026-43420 bsc#1264814). - commit 680a346 - unshare: fix unshare_fs() handling (CVE-2026-43472 bsc#1264748). - commit c43ac49 - ext4: publish jinode after initialization (CVE-2026-31450 bsc#1262618). - commit 57489bb - loadpin: remove MODULE_COMPRESS_NONE as it is no longer supported (jsc#PED-16303). - loadpin: Prevent SECURITY_LOADPIN_ENFORCE=y without module decompression (jsc#PED-16303). - commit 9a9280e - bpf: fix end-of-list detection in cgroup_storage_get_next_key() (bsc#1266396 CVE-2026-45838). - commit b742081 - Update config files: enable zstd module decompression (jsc#PED-16303). Enable in-kernel decompression for modules compressed with zstd. This allows kmod to load these modules using the finit_module syscall, which provides better detection of idempotent modules compared to init_module. Additionally, it enables module loading with tools that do not natively support zstd decompression, such as busybox. - commit 4ce055a - module: Split modules_install compression and in-kernel decompression (jsc#PED-16303). - Update config files. - commit 8e16333 - module: make waiting for a concurrent module loader interruptible (jsc#PED-16303). - commit b3392ca - module: warn about excessively long module waits (jsc#PED-16303). - blacklist.conf: Remove the commit - commit 543f210 - module: fix init_module_from_file() error handling (jsc#PED-16303). - commit e0e88d8 - modules: catch concurrent module loads, treat them as idempotent (jsc#PED-16303). - commit e965772 - module: split up 'finit_module()' into init_module_from_file() helper (jsc#PED-16303). - commit deb4378 - selftests/bpf: Add test to ensure kprobe_multi is not sleepable (bsc#1264015 CVE-2026-43010). - bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015 CVE-2026-43010). - commit 3e14373 - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (CVE-2026-43022 bsc#1264001). - commit 76d9424 ++++ kernel-rt: - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (CVE-2026-46069 bsc#1267437). - commit c2a68c5 - net: skbuff: fix missing zerocopy reference in pskb_carve helpers (CVE-2026-52943 bsc#1269022) - commit f0d2a7c - apparmor: fix rlimit for posix cpu timers (CVE-2026-46328 bsc#1268037). - commit 46e0890 - AppArmor: Allow apparmor to handle unaligned dfa tables (CVE-2026-46254 bsc#1267637). - commit 721953b - ext4: fix memory leak in ext4_ext_shift_extents() (CVE-2026-45948 bsc#1266929). - commit 1888b9b - ext4: don't cache extent during splitting extent (CVE-2026-45912 bsc#1266899). - commit 4e1d4cf - isofs: validate block number from NFS file handle in isofs_export_iget (CVE-2026-46124 bsc#1266847). - commit bc4bf51 - smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185 bsc#1266830). - commit 671bdd5 - dmaengine: tegra: Fix burst size calculation (git-fixes). - dmaengine: Fix possible use after free (git-fixes). - dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK (git-fixes). - dmaengine: qcom: gpi: set DMA_PRIVATE capability (git-fixes). - dmaengine: imx-sdma: Refine spba bus searching in probe (git-fixes). - platform/x86: xo15-ebook: Fix wakeup source and GPE handling (git-fixes). - mailbox: mtk-adsp: fix UAF during device teardown (git-fixes). - tpm: fix event_size output in tpm1_binary_bios_measurements_show (git-fixes). - tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() (git-fixes). - commit 67ea05b - ceph: fix i_nlink underrun during async unlink (CVE-2026-43420 bsc#1264814). - commit 680a346 - unshare: fix unshare_fs() handling (CVE-2026-43472 bsc#1264748). - commit c43ac49 - ext4: publish jinode after initialization (CVE-2026-31450 bsc#1262618). - commit 57489bb - loadpin: remove MODULE_COMPRESS_NONE as it is no longer supported (jsc#PED-16303). - loadpin: Prevent SECURITY_LOADPIN_ENFORCE=y without module decompression (jsc#PED-16303). - commit 9a9280e - bpf: fix end-of-list detection in cgroup_storage_get_next_key() (bsc#1266396 CVE-2026-45838). - commit b742081 - Update config files: enable zstd module decompression (jsc#PED-16303). Enable in-kernel decompression for modules compressed with zstd. This allows kmod to load these modules using the finit_module syscall, which provides better detection of idempotent modules compared to init_module. Additionally, it enables module loading with tools that do not natively support zstd decompression, such as busybox. - commit 4ce055a - module: Split modules_install compression and in-kernel decompression (jsc#PED-16303). - Update config files. - commit 8e16333 - module: make waiting for a concurrent module loader interruptible (jsc#PED-16303). - commit b3392ca - module: warn about excessively long module waits (jsc#PED-16303). - blacklist.conf: Remove the commit - commit 543f210 - module: fix init_module_from_file() error handling (jsc#PED-16303). - commit e0e88d8 - modules: catch concurrent module loads, treat them as idempotent (jsc#PED-16303). - commit e965772 - module: split up 'finit_module()' into init_module_from_file() helper (jsc#PED-16303). - commit deb4378 - selftests/bpf: Add test to ensure kprobe_multi is not sleepable (bsc#1264015 CVE-2026-43010). - bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015 CVE-2026-43010). - commit 3e14373 - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (CVE-2026-43022 bsc#1264001). - commit 76d9424 ++++ kernel-rt_debug: - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (CVE-2026-46069 bsc#1267437). - commit c2a68c5 - net: skbuff: fix missing zerocopy reference in pskb_carve helpers (CVE-2026-52943 bsc#1269022) - commit f0d2a7c - apparmor: fix rlimit for posix cpu timers (CVE-2026-46328 bsc#1268037). - commit 46e0890 - AppArmor: Allow apparmor to handle unaligned dfa tables (CVE-2026-46254 bsc#1267637). - commit 721953b - ext4: fix memory leak in ext4_ext_shift_extents() (CVE-2026-45948 bsc#1266929). - commit 1888b9b - ext4: don't cache extent during splitting extent (CVE-2026-45912 bsc#1266899). - commit 4e1d4cf - isofs: validate block number from NFS file handle in isofs_export_iget (CVE-2026-46124 bsc#1266847). - commit bc4bf51 - smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185 bsc#1266830). - commit 671bdd5 - dmaengine: tegra: Fix burst size calculation (git-fixes). - dmaengine: Fix possible use after free (git-fixes). - dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK (git-fixes). - dmaengine: qcom: gpi: set DMA_PRIVATE capability (git-fixes). - dmaengine: imx-sdma: Refine spba bus searching in probe (git-fixes). - platform/x86: xo15-ebook: Fix wakeup source and GPE handling (git-fixes). - mailbox: mtk-adsp: fix UAF during device teardown (git-fixes). - tpm: fix event_size output in tpm1_binary_bios_measurements_show (git-fixes). - tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() (git-fixes). - commit 67ea05b - ceph: fix i_nlink underrun during async unlink (CVE-2026-43420 bsc#1264814). - commit 680a346 - unshare: fix unshare_fs() handling (CVE-2026-43472 bsc#1264748). - commit c43ac49 - ext4: publish jinode after initialization (CVE-2026-31450 bsc#1262618). - commit 57489bb - loadpin: remove MODULE_COMPRESS_NONE as it is no longer supported (jsc#PED-16303). - loadpin: Prevent SECURITY_LOADPIN_ENFORCE=y without module decompression (jsc#PED-16303). - commit 9a9280e - bpf: fix end-of-list detection in cgroup_storage_get_next_key() (bsc#1266396 CVE-2026-45838). - commit b742081 - Update config files: enable zstd module decompression (jsc#PED-16303). Enable in-kernel decompression for modules compressed with zstd. This allows kmod to load these modules using the finit_module syscall, which provides better detection of idempotent modules compared to init_module. Additionally, it enables module loading with tools that do not natively support zstd decompression, such as busybox. - commit 4ce055a - module: Split modules_install compression and in-kernel decompression (jsc#PED-16303). - Update config files. - commit 8e16333 - module: make waiting for a concurrent module loader interruptible (jsc#PED-16303). - commit b3392ca - module: warn about excessively long module waits (jsc#PED-16303). - blacklist.conf: Remove the commit - commit 543f210 - module: fix init_module_from_file() error handling (jsc#PED-16303). - commit e0e88d8 - modules: catch concurrent module loads, treat them as idempotent (jsc#PED-16303). - commit e965772 - module: split up 'finit_module()' into init_module_from_file() helper (jsc#PED-16303). - commit deb4378 - selftests/bpf: Add test to ensure kprobe_multi is not sleepable (bsc#1264015 CVE-2026-43010). - bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015 CVE-2026-43010). - commit 3e14373 - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (CVE-2026-43022 bsc#1264001). - commit 76d9424 ++++ libslirp: - added patches CVE-2026-9539: An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in freedesktop.org libslirp version before v4.9.2 [bsc#1268903] * libslirp-CVE-2026-9539.patch ------------------------------------------------------------------ ------------------ 2026-6-23 - Jun 23 2026 ------------------- ------------------------------------------------------------------ ++++ dnsmasq: - Update to 2.93: * CVE-2026-12725, bsc#1268764: Heap buffer overflow in `log_query()` when logging unsupported DS/DNSKEY replies. * CVE-2026-12969, bsc#1268882: out-of-bounds read in `find_soa()` due to missing extrabytes validation. * Fix a corner-case in DNSSEC validation with wildcards. * Fix DNSSEC failure with spurious RRSIGs. * Fix DNSSEC fail with CNAME replies to DS queries. * Fix regression in 2.92 release which broke DHCPv6 when a DHCP relay is in use. * Modify the inotify implementation so that inotify watches are only created after dnsmasq has changed permissions and userid. * CVE-2026-2291: Rework storage allocation for domain names. * Obsoletes dnsmasq-CVE-2026-6507.patch * Obsoletes dnsmasq-Fix-FTBFS-nettle-4.0.patch ++++ kernel-default: - l2tp: Drop large packets with UDP encap (CVE-2026-43080 bsc#1264236) - commit abd11d4 - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233 bsc#1264337) - commit a2b2b64 - lib/scatterlist: fix temp buffer in extract_user_to_sg() (CVE-2026-46289 bsc#1267966). - commit 615b85c - lib/scatterlist: fix length calculations in extract_kvec_to_sg (CVE-2026-46289 bsc#1267966). - commit 36c010e - mm/page_alloc: clear page->private in free_pages_prepare() (CVE-2026-43303 bsc#1264974). - commit 2c2058d - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (CVE-2026-31466 bsc#1267825). - commit d427335 - net: hns3: fix double free issue for tx spare buffer (CVE-2026-45891 bsc#1266717). - commit 52abbcd - staging: most: video: avoid double free on video register failure (git-fixes). - staging: nvec: fix use-after-free in nvec_rx_completed() (git-fixes). - iio: light: opt3001: fix missing state reset on timeout (git-fixes). - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug (git-fixes). - iio: light: veml6030: fix channel type when pushing events (git-fixes). - iio: gyro: bmg160: wait full startup time after mode change at probe (git-fixes). - iio: gyro: bmg160: bail out when bandwidth/filter is not in table (git-fixes). - iio: temperature: ltc2983: Fix reinit_completion() called after conversion start (git-fixes). - iio: tcs3472: power down chip on probe failure (git-fixes). - iio: accel: mma8452: handle I2C read error(s) in mma8452_read() (git-fixes). - iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling (git-fixes). - iio: magnetometer: ak8975: fix potential kernel stack memory leak (git-fixes). - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call (git-fixes). - iio: light: si1133: prevent race condition on timeout (git-fixes). - iio: light: si1133: reset counter to prevent race condition (git-fixes). - bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path (git-fixes). - bus: mhi: ep: Add missing state_lock protection for mhi_state access (git-fixes). - bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() (git-fixes). - fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() (git-fixes). - fpga: dfl: add bounds check in dfh_get_param_size() (git-fixes). - fpga: region: fix use-after-free in child_regions_with_firmware() (git-fixes). - char: tlclk: fix use-after-free in tlclk_cleanup() (git-fixes). - usb: host: max3421: Reject hub port requests for non-existent ports (git-fixes). - usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() (git-fixes). - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write (git-fixes). - i2c: stm32f7: truncate clock period instead of rounding it (git-fixes). - i3c: master: Prevent reuse of dynamic address on device add failure (git-fixes). - commit 176f7a3 - pstore/ram: fix buffer overflow in persistent_ram_save_old() (CVE-2026-46253 bsc#1267635). - commit 49fa8f4 ++++ kernel-rt: - l2tp: Drop large packets with UDP encap (CVE-2026-43080 bsc#1264236) - commit abd11d4 - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233 bsc#1264337) - commit a2b2b64 - lib/scatterlist: fix temp buffer in extract_user_to_sg() (CVE-2026-46289 bsc#1267966). - commit 615b85c - lib/scatterlist: fix length calculations in extract_kvec_to_sg (CVE-2026-46289 bsc#1267966). - commit 36c010e - mm/page_alloc: clear page->private in free_pages_prepare() (CVE-2026-43303 bsc#1264974). - commit 2c2058d - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (CVE-2026-31466 bsc#1267825). - commit d427335 - net: hns3: fix double free issue for tx spare buffer (CVE-2026-45891 bsc#1266717). - commit 52abbcd - staging: most: video: avoid double free on video register failure (git-fixes). - staging: nvec: fix use-after-free in nvec_rx_completed() (git-fixes). - iio: light: opt3001: fix missing state reset on timeout (git-fixes). - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug (git-fixes). - iio: light: veml6030: fix channel type when pushing events (git-fixes). - iio: gyro: bmg160: wait full startup time after mode change at probe (git-fixes). - iio: gyro: bmg160: bail out when bandwidth/filter is not in table (git-fixes). - iio: temperature: ltc2983: Fix reinit_completion() called after conversion start (git-fixes). - iio: tcs3472: power down chip on probe failure (git-fixes). - iio: accel: mma8452: handle I2C read error(s) in mma8452_read() (git-fixes). - iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling (git-fixes). - iio: magnetometer: ak8975: fix potential kernel stack memory leak (git-fixes). - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call (git-fixes). - iio: light: si1133: prevent race condition on timeout (git-fixes). - iio: light: si1133: reset counter to prevent race condition (git-fixes). - bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path (git-fixes). - bus: mhi: ep: Add missing state_lock protection for mhi_state access (git-fixes). - bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() (git-fixes). - fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() (git-fixes). - fpga: dfl: add bounds check in dfh_get_param_size() (git-fixes). - fpga: region: fix use-after-free in child_regions_with_firmware() (git-fixes). - char: tlclk: fix use-after-free in tlclk_cleanup() (git-fixes). - usb: host: max3421: Reject hub port requests for non-existent ports (git-fixes). - usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() (git-fixes). - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write (git-fixes). - i2c: stm32f7: truncate clock period instead of rounding it (git-fixes). - i3c: master: Prevent reuse of dynamic address on device add failure (git-fixes). - commit 176f7a3 - pstore/ram: fix buffer overflow in persistent_ram_save_old() (CVE-2026-46253 bsc#1267635). - commit 49fa8f4 ++++ kernel-rt_debug: - l2tp: Drop large packets with UDP encap (CVE-2026-43080 bsc#1264236) - commit abd11d4 - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233 bsc#1264337) - commit a2b2b64 - lib/scatterlist: fix temp buffer in extract_user_to_sg() (CVE-2026-46289 bsc#1267966). - commit 615b85c - lib/scatterlist: fix length calculations in extract_kvec_to_sg (CVE-2026-46289 bsc#1267966). - commit 36c010e - mm/page_alloc: clear page->private in free_pages_prepare() (CVE-2026-43303 bsc#1264974). - commit 2c2058d - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (CVE-2026-31466 bsc#1267825). - commit d427335 - net: hns3: fix double free issue for tx spare buffer (CVE-2026-45891 bsc#1266717). - commit 52abbcd - staging: most: video: avoid double free on video register failure (git-fixes). - staging: nvec: fix use-after-free in nvec_rx_completed() (git-fixes). - iio: light: opt3001: fix missing state reset on timeout (git-fixes). - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug (git-fixes). - iio: light: veml6030: fix channel type when pushing events (git-fixes). - iio: gyro: bmg160: wait full startup time after mode change at probe (git-fixes). - iio: gyro: bmg160: bail out when bandwidth/filter is not in table (git-fixes). - iio: temperature: ltc2983: Fix reinit_completion() called after conversion start (git-fixes). - iio: tcs3472: power down chip on probe failure (git-fixes). - iio: accel: mma8452: handle I2C read error(s) in mma8452_read() (git-fixes). - iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling (git-fixes). - iio: magnetometer: ak8975: fix potential kernel stack memory leak (git-fixes). - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call (git-fixes). - iio: light: si1133: prevent race condition on timeout (git-fixes). - iio: light: si1133: reset counter to prevent race condition (git-fixes). - bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path (git-fixes). - bus: mhi: ep: Add missing state_lock protection for mhi_state access (git-fixes). - bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() (git-fixes). - fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() (git-fixes). - fpga: dfl: add bounds check in dfh_get_param_size() (git-fixes). - fpga: region: fix use-after-free in child_regions_with_firmware() (git-fixes). - char: tlclk: fix use-after-free in tlclk_cleanup() (git-fixes). - usb: host: max3421: Reject hub port requests for non-existent ports (git-fixes). - usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() (git-fixes). - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write (git-fixes). - i2c: stm32f7: truncate clock period instead of rounding it (git-fixes). - i3c: master: Prevent reuse of dynamic address on device add failure (git-fixes). - commit 176f7a3 - pstore/ram: fix buffer overflow in persistent_ram_save_old() (CVE-2026-46253 bsc#1267635). - commit 49fa8f4 ++++ openSUSE-build-key: - do not include the projects _pubkey if we have it already. ------------------------------------------------------------------ ------------------ 2026-6-22 - Jun 22 2026 ------------------- ------------------------------------------------------------------ ++++ glibc: - resolv-sprintrrf-unkown-types.patch: resolv: More types as unknown in ns_sprintrrf (CVE-2026-5435, bsc#1263656, BZ #34033) - resolv-sprintrrf-inet-ntop-check.patch: resolv: Check for inet_ntop failure in ns_sprintrrf - resolv-sprintrrf-buffer-overreads.patch: resolv: Fix buffer overreads in ns_sprintrrf (CVE-2026-6238, bsc#1263658, BZ #34069) ++++ kernel-default: - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (git-fixes). - commit c2b4038 - printk: add print_hex_dump_devel() (CVE-2026-46291 bsc#1267937). - commit 086da9a - crypto: caam - guard HMAC key hex dumps in hash_digest_key (CVE-2026-46291 bsc#1267937). - commit 261d6f1 - exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173 bsc#1267722). - commit c09b6c0 - mtd: rawnand: pl353: fix probe resource allocation (git-fixes). - mtd: rawnand: fix condition in 'nand_select_target()' (git-fixes). - mtd: spi-nor: Drop duplicate Kconfig dependency (git-fixes). - mtd: spi-nor: swp: Improve locking user experience (git-fixes). - mtd: slram: remove failed entries from the device list (git-fixes). - mtd: maps: vmu-flash: fix NULL pointer dereference in initialization (git-fixes). - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 (stable-fixes). - commit 63fe546 - power: supply: charger-manager: fix refcount leak in is_full_charged() (git-fixes). - power: supply: core: fix supplied_from allocations (git-fixes). - power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak (git-fixes). - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() (git-fixes). - media: pci: dm1105: Free allocated workqueue (git-fixes). - media: ti: vpe: unwind v4l2 device registration on probe error (git-fixes). - media: marvell-cam: fix missing pci_disable_device() on remove (git-fixes). - media: vimc: fix reference leak on failed device registration (git-fixes). - media: vidtv: fix reference leak on failed device registration (git-fixes). - media: vpif_capture: fix OF node reference imbalance (git-fixes). - media: aspeed: fix missing of_reserved_mem_device_release() on probe failure (git-fixes). - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si (git-fixes). - media: cec: seco: unregister adapter on IR probe failure (git-fixes). - media: cedrus: Fix failure to clean up hardware on probe failure (git-fixes). - media: cedrus: Fix missing cleanup in error path (git-fixes). - media: mtk-jpeg: cancel workqueue on release for supported platforms only (git-fixes). - media: cedrus: skip invalid H.264 reference list entries (git-fixes). - media: v4l2-ctrls: validate HEVC active reference counts (git-fixes). - leds: uleds: Fix potential buffer overread (git-fixes). - HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter (git-fixes). - HID: wacom: stop hardware after post-start probe failures (git-fixes). - HID: wiimote: Fix table layout and whitespace errors (git-fixes). - drm/amdgpu: restart the CS if some parts of the VM are still invalidated (stable-fixes). - USB: serial: option: add usb-id for Dell Wireless DW5826e-m (stable-fixes). - ALSA: timer: Fix UAF at snd_timer_user_params() (stable-fixes). - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) (stable-fixes). - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (stable-fixes). - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig (stable-fixes). - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 (stable-fixes). - Input: xpad - add "Nova 2 Lite" from GameSir (stable-fixes). - Input: xpad - add support for ASUS ROG RAIKIRI II (stable-fixes). - Input: elan_i2c - validate firmware size before use (stable-fixes). - USB: serial: option: add MeiG SRM813Q (stable-fixes). - usb: storage: Add quirks for PNY Elite Portable SSD (stable-fixes). - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers (stable-fixes). - usb: typec: ucsi: validate connector number in ucsi_connector_change() (stable-fixes). - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (stable-fixes). - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT (stable-fixes). - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (stable-fixes). - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() (stable-fixes). - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval (stable-fixes). - usb: core: Fix SuperSpeed root hub wMaxPacketSize (stable-fixes). - usb: typec: ucsi: ccg: reject firmware images without a ':' record header (stable-fixes). - iio: chemical: scd30: fix division by zero in write_raw (git-fixes). - drm/amdkfd: Check for pdd drm file first in CRIU restore path (stable-fixes). - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr (stable-fixes). - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse (stable-fixes). - nfc: hci: fix out-of-bounds read in HCP header parsing (git-fixes). - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (git-fixes). - nfc: llcp: Fix use-after-free in llcp_sock_release() (git-fixes). - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register (stable-fixes). - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl (stable-fixes). - usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo (git-fixes). - iio: chemical: scd30: Use guard(mutex) to allow early returns (stable-fixes). - drm/dp: Add eDP 1.5 bit definition (stable-fixes). - serdev: make serdev_bus_type const (stable-fixes). - iio: adc: npcm: Convert to platform remove callback returning void (stable-fixes). - commit 609e056 - powerpc/boot: Allow text relocations for pseries wrapper with binutils 2.46+ (git-fixes). - commit a3670eb ++++ kernel-rt: - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (git-fixes). - commit c2b4038 - printk: add print_hex_dump_devel() (CVE-2026-46291 bsc#1267937). - commit 086da9a - crypto: caam - guard HMAC key hex dumps in hash_digest_key (CVE-2026-46291 bsc#1267937). - commit 261d6f1 - exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173 bsc#1267722). - commit c09b6c0 - mtd: rawnand: pl353: fix probe resource allocation (git-fixes). - mtd: rawnand: fix condition in 'nand_select_target()' (git-fixes). - mtd: spi-nor: Drop duplicate Kconfig dependency (git-fixes). - mtd: spi-nor: swp: Improve locking user experience (git-fixes). - mtd: slram: remove failed entries from the device list (git-fixes). - mtd: maps: vmu-flash: fix NULL pointer dereference in initialization (git-fixes). - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 (stable-fixes). - commit 63fe546 - power: supply: charger-manager: fix refcount leak in is_full_charged() (git-fixes). - power: supply: core: fix supplied_from allocations (git-fixes). - power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak (git-fixes). - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() (git-fixes). - media: pci: dm1105: Free allocated workqueue (git-fixes). - media: ti: vpe: unwind v4l2 device registration on probe error (git-fixes). - media: marvell-cam: fix missing pci_disable_device() on remove (git-fixes). - media: vimc: fix reference leak on failed device registration (git-fixes). - media: vidtv: fix reference leak on failed device registration (git-fixes). - media: vpif_capture: fix OF node reference imbalance (git-fixes). - media: aspeed: fix missing of_reserved_mem_device_release() on probe failure (git-fixes). - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si (git-fixes). - media: cec: seco: unregister adapter on IR probe failure (git-fixes). - media: cedrus: Fix failure to clean up hardware on probe failure (git-fixes). - media: cedrus: Fix missing cleanup in error path (git-fixes). - media: mtk-jpeg: cancel workqueue on release for supported platforms only (git-fixes). - media: cedrus: skip invalid H.264 reference list entries (git-fixes). - media: v4l2-ctrls: validate HEVC active reference counts (git-fixes). - leds: uleds: Fix potential buffer overread (git-fixes). - HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter (git-fixes). - HID: wacom: stop hardware after post-start probe failures (git-fixes). - HID: wiimote: Fix table layout and whitespace errors (git-fixes). - drm/amdgpu: restart the CS if some parts of the VM are still invalidated (stable-fixes). - USB: serial: option: add usb-id for Dell Wireless DW5826e-m (stable-fixes). - ALSA: timer: Fix UAF at snd_timer_user_params() (stable-fixes). - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) (stable-fixes). - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (stable-fixes). - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig (stable-fixes). - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 (stable-fixes). - Input: xpad - add "Nova 2 Lite" from GameSir (stable-fixes). - Input: xpad - add support for ASUS ROG RAIKIRI II (stable-fixes). - Input: elan_i2c - validate firmware size before use (stable-fixes). - USB: serial: option: add MeiG SRM813Q (stable-fixes). - usb: storage: Add quirks for PNY Elite Portable SSD (stable-fixes). - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers (stable-fixes). - usb: typec: ucsi: validate connector number in ucsi_connector_change() (stable-fixes). - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (stable-fixes). - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT (stable-fixes). - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (stable-fixes). - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() (stable-fixes). - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval (stable-fixes). - usb: core: Fix SuperSpeed root hub wMaxPacketSize (stable-fixes). - usb: typec: ucsi: ccg: reject firmware images without a ':' record header (stable-fixes). - iio: chemical: scd30: fix division by zero in write_raw (git-fixes). - drm/amdkfd: Check for pdd drm file first in CRIU restore path (stable-fixes). - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr (stable-fixes). - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse (stable-fixes). - nfc: hci: fix out-of-bounds read in HCP header parsing (git-fixes). - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (git-fixes). - nfc: llcp: Fix use-after-free in llcp_sock_release() (git-fixes). - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register (stable-fixes). - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl (stable-fixes). - usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo (git-fixes). - iio: chemical: scd30: Use guard(mutex) to allow early returns (stable-fixes). - drm/dp: Add eDP 1.5 bit definition (stable-fixes). - serdev: make serdev_bus_type const (stable-fixes). - iio: adc: npcm: Convert to platform remove callback returning void (stable-fixes). - commit 609e056 - powerpc/boot: Allow text relocations for pseries wrapper with binutils 2.46+ (git-fixes). - commit a3670eb ++++ kernel-rt_debug: - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (git-fixes). - commit c2b4038 - printk: add print_hex_dump_devel() (CVE-2026-46291 bsc#1267937). - commit 086da9a - crypto: caam - guard HMAC key hex dumps in hash_digest_key (CVE-2026-46291 bsc#1267937). - commit 261d6f1 - exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173 bsc#1267722). - commit c09b6c0 - mtd: rawnand: pl353: fix probe resource allocation (git-fixes). - mtd: rawnand: fix condition in 'nand_select_target()' (git-fixes). - mtd: spi-nor: Drop duplicate Kconfig dependency (git-fixes). - mtd: spi-nor: swp: Improve locking user experience (git-fixes). - mtd: slram: remove failed entries from the device list (git-fixes). - mtd: maps: vmu-flash: fix NULL pointer dereference in initialization (git-fixes). - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 (stable-fixes). - commit 63fe546 - power: supply: charger-manager: fix refcount leak in is_full_charged() (git-fixes). - power: supply: core: fix supplied_from allocations (git-fixes). - power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak (git-fixes). - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() (git-fixes). - media: pci: dm1105: Free allocated workqueue (git-fixes). - media: ti: vpe: unwind v4l2 device registration on probe error (git-fixes). - media: marvell-cam: fix missing pci_disable_device() on remove (git-fixes). - media: vimc: fix reference leak on failed device registration (git-fixes). - media: vidtv: fix reference leak on failed device registration (git-fixes). - media: vpif_capture: fix OF node reference imbalance (git-fixes). - media: aspeed: fix missing of_reserved_mem_device_release() on probe failure (git-fixes). - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si (git-fixes). - media: cec: seco: unregister adapter on IR probe failure (git-fixes). - media: cedrus: Fix failure to clean up hardware on probe failure (git-fixes). - media: cedrus: Fix missing cleanup in error path (git-fixes). - media: mtk-jpeg: cancel workqueue on release for supported platforms only (git-fixes). - media: cedrus: skip invalid H.264 reference list entries (git-fixes). - media: v4l2-ctrls: validate HEVC active reference counts (git-fixes). - leds: uleds: Fix potential buffer overread (git-fixes). - HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter (git-fixes). - HID: wacom: stop hardware after post-start probe failures (git-fixes). - HID: wiimote: Fix table layout and whitespace errors (git-fixes). - drm/amdgpu: restart the CS if some parts of the VM are still invalidated (stable-fixes). - USB: serial: option: add usb-id for Dell Wireless DW5826e-m (stable-fixes). - ALSA: timer: Fix UAF at snd_timer_user_params() (stable-fixes). - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) (stable-fixes). - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (stable-fixes). - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig (stable-fixes). - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 (stable-fixes). - Input: xpad - add "Nova 2 Lite" from GameSir (stable-fixes). - Input: xpad - add support for ASUS ROG RAIKIRI II (stable-fixes). - Input: elan_i2c - validate firmware size before use (stable-fixes). - USB: serial: option: add MeiG SRM813Q (stable-fixes). - usb: storage: Add quirks for PNY Elite Portable SSD (stable-fixes). - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers (stable-fixes). - usb: typec: ucsi: validate connector number in ucsi_connector_change() (stable-fixes). - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (stable-fixes). - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT (stable-fixes). - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (stable-fixes). - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() (stable-fixes). - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval (stable-fixes). - usb: core: Fix SuperSpeed root hub wMaxPacketSize (stable-fixes). - usb: typec: ucsi: ccg: reject firmware images without a ':' record header (stable-fixes). - iio: chemical: scd30: fix division by zero in write_raw (git-fixes). - drm/amdkfd: Check for pdd drm file first in CRIU restore path (stable-fixes). - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr (stable-fixes). - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse (stable-fixes). - nfc: hci: fix out-of-bounds read in HCP header parsing (git-fixes). - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (git-fixes). - nfc: llcp: Fix use-after-free in llcp_sock_release() (git-fixes). - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register (stable-fixes). - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl (stable-fixes). - usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo (git-fixes). - iio: chemical: scd30: Use guard(mutex) to allow early returns (stable-fixes). - drm/dp: Add eDP 1.5 bit definition (stable-fixes). - serdev: make serdev_bus_type const (stable-fixes). - iio: adc: npcm: Convert to platform remove callback returning void (stable-fixes). - commit 609e056 - powerpc/boot: Allow text relocations for pseries wrapper with binutils 2.46+ (git-fixes). - commit a3670eb ++++ openssl-3: - Security fix: * CVE-2026-42767 NULL Pointer Dereference in CRMF EncryptedValue Decryption (bsc#1266350) * Add patch: openssl-CVE-2026-42767.patch ++++ libssh2_org: - Security Fix: * CVE-2026-55199: pre-Authentication DoS via SSH_MSG_EXT_INFO Handler (bsc#1268530) * Add libssh2_org-CVE-2026-55199.patch ++++ openSUSE-build-key: - use the modification time for key2rpname ++++ podman: - Add patch for CVE-2026-34986 (bsc#1262856): * 0007-CVE-2026-34986-Merge-commit-from-fork.patch - Add patch for CVE-2026-39829, CVE-2026-39830, CVE-2026-42508, CVE-2026-46598 (bsc#1266125) * 0008-CVE-2026-39829-CVE-2026-39830-CVE-2026-42508-CVE-202.patch - Rebase patches: * 0001-CVE-2025-22869-ssh-limit-the-size-of-the-internal-pa.patch * 0002-Fix-Remove-appending-rw-as-the-default-mount-option.patch * 0003-CVE-2025-6032-machine-init-fix-tls-check.patch * 0004-CVE-2025-9566-kube-play-don-t-follow-volume-symlinks.patch * 0005-CVE-2025-52881-backport-subset-of-patch-from-runc.patch * 0006-CVE-2025-47913-CVE-2025-47914-ssh-agent-fixes.patch ------------------------------------------------------------------ ------------------ 2026-6-21 - Jun 21 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - Move io-wq-check-that-the-predecessor-is-hashed-in-io_wq_remove_pending.patch to the sorted section. - commit 5d149dc ++++ kernel-rt: - Move io-wq-check-that-the-predecessor-is-hashed-in-io_wq_remove_pending.patch to the sorted section. - commit 5d149dc ++++ kernel-rt_debug: - Move io-wq-check-that-the-predecessor-is-hashed-in-io_wq_remove_pending.patch to the sorted section. - commit 5d149dc ------------------------------------------------------------------ ------------------ 2026-6-20 - Jun 20 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - RDMA/hns: Fix unlocked call to hns_roce_qp_remove() (CVE-2026-46112 bsc#1267582) - commit b051019 ++++ kernel-rt: - RDMA/hns: Fix unlocked call to hns_roce_qp_remove() (CVE-2026-46112 bsc#1267582) - commit b051019 ++++ kernel-rt_debug: - RDMA/hns: Fix unlocked call to hns_roce_qp_remove() (CVE-2026-46112 bsc#1267582) - commit b051019 ------------------------------------------------------------------ ------------------ 2026-6-19 - Jun 19 2026 ------------------- ------------------------------------------------------------------ ++++ cifs-utils: - CVE-2026-12505: cifs.upcall: remove getpwuid() dependency (bsc#1267389) * add cifs.upcall-remove-getpwuid-dependency.patch - update spec to use "%patch -P N" ++++ dracut: - Update to version 059+suse.643.g1f1d880: * fix(network-legacy): sanitize DHCP values in dhclient-script.sh (bsc#1268322, CVE-2026-6893) * fix(network-legacy): add input validation to RFC 3442 route parser ++++ kernel-default: - xfs: close crash window in attr dabtree inactivation (CVE-2026-43053 bsc#1264084). - commit e9f0cc6 - xfs: remove bp->b_error check in xfs_attr3_root_inactive (CVE-2026-43053 bsc#1264084). - commit d993a94 - xfs: factor out xfs_attr3_leaf_init (CVE-2026-43053 bsc#1264084). - commit f5f40df - xfs: factor out xfs_attr3_node_entry_remove (CVE-2026-43053 bsc#1264084). - commit 63857e2 - futex: Don't leak robust_list pointer on exec race (CVE-2025-40341 bsc#1255029). - commit 6b42f74 - KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) (git-fixes). - Refresh patches.suse/KVM-SVM-check-validity-of-VMCB-controls-when-returni.patch. - commit 5d78587 - kABI: Hide change of header_ops.parse parameter change (CVE-2026-23451 bsc#1261604). (cherry picked from commit ba5ef0d7d08902bd87954c8a1e6d719cf43fb3b9) - kABI: Hide change of header_ops.parse parameter change (CVE-2026-23451 bsc#1261604). - commit 29f40ca - team: fix header_ops type confusion with non-Ethernet ports (CVE-2026-31502 bsc#1263072). (cherry picked from commit 46225d30b472593ae9df317518042e77bbe120e8) - bonding: prevent potential infinite loop in bond_header_parse() (CVE-2026-23451 bsc#1261604). (cherry picked from commit c097c6557fd563538b5b29d49b66e9302a4916ea) - bonding: fix type confusion in bond_setup_by_slave() (CVE-2026-43456 bsc#1264734). (cherry picked from commit 2e5e16392d4394c51972adff621c66d7da1b928c) - team: fix header_ops type confusion with non-Ethernet ports (CVE-2026-31502 bsc#1263072). - bonding: prevent potential infinite loop in bond_header_parse() (CVE-2026-23451 bsc#1261604). - bonding: fix type confusion in bond_setup_by_slave() (CVE-2026-43456 bsc#1264734). - net: aquantia: Add missing descriptor cache invalidation on ATL2 (bsc#1268428). - commit fa6d055 ++++ kernel-rt: - xfs: close crash window in attr dabtree inactivation (CVE-2026-43053 bsc#1264084). - commit e9f0cc6 - xfs: remove bp->b_error check in xfs_attr3_root_inactive (CVE-2026-43053 bsc#1264084). - commit d993a94 - xfs: factor out xfs_attr3_leaf_init (CVE-2026-43053 bsc#1264084). - commit f5f40df - xfs: factor out xfs_attr3_node_entry_remove (CVE-2026-43053 bsc#1264084). - commit 63857e2 - futex: Don't leak robust_list pointer on exec race (CVE-2025-40341 bsc#1255029). - commit 6b42f74 - KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) (git-fixes). - Refresh patches.suse/KVM-SVM-check-validity-of-VMCB-controls-when-returni.patch. - commit 5d78587 - kABI: Hide change of header_ops.parse parameter change (CVE-2026-23451 bsc#1261604). (cherry picked from commit ba5ef0d7d08902bd87954c8a1e6d719cf43fb3b9) - kABI: Hide change of header_ops.parse parameter change (CVE-2026-23451 bsc#1261604). - commit 29f40ca - team: fix header_ops type confusion with non-Ethernet ports (CVE-2026-31502 bsc#1263072). (cherry picked from commit 46225d30b472593ae9df317518042e77bbe120e8) - bonding: prevent potential infinite loop in bond_header_parse() (CVE-2026-23451 bsc#1261604). (cherry picked from commit c097c6557fd563538b5b29d49b66e9302a4916ea) - bonding: fix type confusion in bond_setup_by_slave() (CVE-2026-43456 bsc#1264734). (cherry picked from commit 2e5e16392d4394c51972adff621c66d7da1b928c) - team: fix header_ops type confusion with non-Ethernet ports (CVE-2026-31502 bsc#1263072). - bonding: prevent potential infinite loop in bond_header_parse() (CVE-2026-23451 bsc#1261604). - bonding: fix type confusion in bond_setup_by_slave() (CVE-2026-43456 bsc#1264734). - net: aquantia: Add missing descriptor cache invalidation on ATL2 (bsc#1268428). - commit fa6d055 ++++ kernel-rt_debug: - xfs: close crash window in attr dabtree inactivation (CVE-2026-43053 bsc#1264084). - commit e9f0cc6 - xfs: remove bp->b_error check in xfs_attr3_root_inactive (CVE-2026-43053 bsc#1264084). - commit d993a94 - xfs: factor out xfs_attr3_leaf_init (CVE-2026-43053 bsc#1264084). - commit f5f40df - xfs: factor out xfs_attr3_node_entry_remove (CVE-2026-43053 bsc#1264084). - commit 63857e2 - futex: Don't leak robust_list pointer on exec race (CVE-2025-40341 bsc#1255029). - commit 6b42f74 - KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) (git-fixes). - Refresh patches.suse/KVM-SVM-check-validity-of-VMCB-controls-when-returni.patch. - commit 5d78587 - kABI: Hide change of header_ops.parse parameter change (CVE-2026-23451 bsc#1261604). (cherry picked from commit ba5ef0d7d08902bd87954c8a1e6d719cf43fb3b9) - kABI: Hide change of header_ops.parse parameter change (CVE-2026-23451 bsc#1261604). - commit 29f40ca - team: fix header_ops type confusion with non-Ethernet ports (CVE-2026-31502 bsc#1263072). (cherry picked from commit 46225d30b472593ae9df317518042e77bbe120e8) - bonding: prevent potential infinite loop in bond_header_parse() (CVE-2026-23451 bsc#1261604). (cherry picked from commit c097c6557fd563538b5b29d49b66e9302a4916ea) - bonding: fix type confusion in bond_setup_by_slave() (CVE-2026-43456 bsc#1264734). (cherry picked from commit 2e5e16392d4394c51972adff621c66d7da1b928c) - team: fix header_ops type confusion with non-Ethernet ports (CVE-2026-31502 bsc#1263072). - bonding: prevent potential infinite loop in bond_header_parse() (CVE-2026-23451 bsc#1261604). - bonding: fix type confusion in bond_setup_by_slave() (CVE-2026-43456 bsc#1264734). - net: aquantia: Add missing descriptor cache invalidation on ATL2 (bsc#1268428). - commit fa6d055 ++++ libnfs: - Add libnfs-CVE-2026-53689.patch: ZDR: check the string size for sanity (bsc#1268135 CVE-2026-53689). ++++ libzypp: - zypp.conf: add solver.NoUpdateProvide (default: false) option. In general, packages that obsolete another package are treated as update candidates for the obsoleted package. However, SUSE-specific update rules prefer candidates that also explicitly 'provide' the obsoleted package. Sometimes it is necessary or helpful to disable this rule. (may help in bsc#1261038) - Use HttpHeader class for defining host specific http headers (bsc#1268321) - Compile and link with -fPIE to build on sparc64 (fixes #742) - version 17.38.14 (35) ------------------------------------------------------------------ ------------------ 2026-6-18 - Jun 18 2026 ------------------- ------------------------------------------------------------------ ++++ containerd: - Add patch for CVE-2026-34986 (bsc#1262948) * 0003-CVE-2026-34986-Bump-go-jose-to-v3.0.5.patch - Add patch for CVE-2026-39821 (bsc#1266640) * 0004-CVE-2026-39821-idna-update-from-x-text-fix-ToUnicode.patch - Add patch for CVE-2026-33814 (bsc#1265794) * 0005-CVE-2026-33814-http2-prevent-hanging-Transport-due-t.patch ++++ kernel-default: - Update patches.suse/io-wq-check-that-the-predecessor-is-hashed-in-io_wq_remove_pending.patch (git-fixes bsc#1267918 CVE-2026-46274). - commit d30fb9d - xfs: fix a resource leak in xfs_alloc_buftarg() (CVE-2026-46005 bsc#1267431). - commit 08b4554 - EFI/CPER: don't dump the entire memory region (bsc#1264549 CVE-2026-43171). - commit 0b53ad7 - of: cpu: add check in __of_find_n_match_cpu_property() (git-fixes). - hwrng: virtio: clamp device-reported used.len at copy_data() (git-fixes). - soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy (git-fixes). - soc: fsl: qe: panic on ioremap() failure in qe_reset() (git-fixes). - gpu: host1x: Fix iommu_map_sgtable() return value check (git-fixes). - wifi: wcn36xx: fix OOB read from short trigger BA firmware response (git-fixes). - wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication (git-fixes). - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response (git-fixes). - wifi: mt76: mt7996: fix potential tx_retries underflow (git-fixes). - wifi: mt76: mt7925: fix potential tx_retries underflow (git-fixes). - wifi: mt76: mt7921: fix potential tx_retries underflow (git-fixes). - wifi: mt76: mt7915: fix potential tx_retries underflow (git-fixes). - wifi: mt76: fix argument to ieee80211_is_first_frag() (git-fixes). - wifi: mt76: mt7925: clean up DMA on probe failure (git-fixes). - wifi: mac80211: fix monitor mode frame capture for real chanctx drivers (git-fixes). - wifi: rtw88: usb: fix memory leaks on USB write failures (git-fixes). - wifi: rtw88: increase TX report timeout to fix race condition (git-fixes). - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor (git-fixes). - wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer (git-fixes). - wifi: rtw89: Correct data type for scan index to avoid infinite loop (git-fixes). - wifi: ath11k: fix warning when unbinding (git-fixes). - wifi: ath9k: fix OOB access from firmware tx status queue ID (git-fixes). - wifi: cfg80211: fix grammar in MLO group key error message (git-fixes). - commit f3af1ec - firmware: arm_scmi: Fix OOB in scmi_power_name_get() (git-fixes). - firmware: arm_scmi: Read sensor config as 32-bit value (git-fixes). - drm/amdgpu: set sub_block_index for mca ras sub-blocks (git-fixes). - drm/amd/display: Add missing kdoc for ALLM parameters (git-fixes). - drm/msm/dp: Fix the ISR_* enum values (git-fixes). - drm/msm/dp: fix HPD state status bit shift value (git-fixes). - drm/nouveau/bios: specify correct display fuse register for Ampere and Ada (git-fixes). - drm/tegra: Fix iommu_map_sgtable() return value check (git-fixes). - drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() (git-fixes). - gpu: host1x: Allow entries in BO caches to be freed (git-fixes). - drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers (git-fixes). - drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers (git-fixes). - drm/hisilicon/hibmc: use clock to look up the PLL value (git-fixes). - drm/hisilicon/hibmc: move display contrl config to hibmc_probe() (git-fixes). - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (git-fixes). - drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() (git-fixes). - drm/hyperv: use VMBUS_RING_SIZE() (git-fixes). - drm/amdkfd: Validate CRIU-restored IDs before idr_alloc (git-fixes). - commit 4affa42 - ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO (git-fixes). - ASoC: topology: Check PCM and DAI name strings before use (git-fixes). - ASoC: tegra: tegra210_ahub: Validate written enum value (git-fixes). - ASoC: fsl: fsl_audmix: Validate written enum values (git-fixes). - ASoC: meson: aiu: Validate written enum values (git-fixes). - ASoC: codecs: hdac_hdmi: Validate written enum value (git-fixes). - ASoC: SOF: topology: validate vendor array size before parsing (git-fixes). - ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails (git-fixes). - ASoC: cs35l56: Cleanup if component_probe fails (git-fixes). - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() (git-fixes). - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (git-fixes). - ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (git-fixes). - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (git-fixes). - ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc (git-fixes). - ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put (git-fixes). - ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() (git-fixes). - ALSA: aloop: Drop superfluous break (git-fixes). - ALSA: seq: Clear variable event pointer on read (git-fixes). - ALSA: seq: Fix partial userptr event expansion (git-fixes). - ALSA: cmipci: check snd_ctl_new1() return value (git-fixes). - ALSA: ymfpci: check snd_ctl_new1() return value (git-fixes). - ALSA: ice1712: check snd_ctl_new1() return value (git-fixes). - ALSA: gus: check snd_ctl_new1() return value (git-fixes). - ALSA: es1938: check snd_ctl_new1() return value (git-fixes). - ALSA: seq: midi: Serialize output teardown with event_input (git-fixes). - ALSA: virtio: Add missing 384 kHz PCM rate mapping (git-fixes). - ALSA: usb-audio: Update Babyface Pro control caches only after successful writes (git-fixes). - ALSA: usb-audio: Roll back quirk control caches on write errors (git-fixes). - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes (git-fixes). - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks (git-fixes). - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() (git-fixes). - agp/amd64: Fix broken error propagation in agp_amd64_probe() (git-fixes). - drm/radeon: fix memory leak in radeon_ring_restore() on lock failure (git-fixes). - drm/radeon: fix integer overflow in radeon_align_pitch() (git-fixes). - drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() (git-fixes). - drm/tidss: Fix missing drm_bridge_add() call (git-fixes). - drm/tidss: Drop extra drm_mode_config_reset() call (git-fixes). - drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() (git-fixes). - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() (git-fixes). - Bluetooth: vhci: validate devcoredump state before side effects (git-fixes). - Bluetooth: hci: validate codec capability element length (git-fixes). - Bluetooth: btusb: fix wakeup irq devres lifetime (git-fixes). - Bluetooth: btusb: fix wakeup source leak on probe failure (git-fixes). - Bluetooth: btusb: fix use-after-free on marvell probe failure (git-fixes). - Bluetooth: btusb: fix use-after-free on registration failure (git-fixes). - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD (git-fixes). - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE (git-fixes). - batman-adv: tp_meter: add only finished tp_vars to lists (git-fixes). - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection (git-fixes). - batman-adv: tp_meter: fix fast recovery precondition (git-fixes). - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd (git-fixes). - batman-adv: tp_meter: avoid window underflow (git-fixes). - batman-adv: tp_meter: initialize dec_cwnd explicitly (git-fixes). - batman-adv: tp_meter: initialize dup_acks explicitly (git-fixes). - batman-adv: tp_meter: keep unacked list in ascending ordered (git-fixes). - commit 17b623a - KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 (bsc#1267591, CVE-2026-46071). - commit 8d4d416 ++++ kernel-rt: - Update patches.suse/io-wq-check-that-the-predecessor-is-hashed-in-io_wq_remove_pending.patch (git-fixes bsc#1267918 CVE-2026-46274). - commit d30fb9d - xfs: fix a resource leak in xfs_alloc_buftarg() (CVE-2026-46005 bsc#1267431). - commit 08b4554 - EFI/CPER: don't dump the entire memory region (bsc#1264549 CVE-2026-43171). - commit 0b53ad7 - of: cpu: add check in __of_find_n_match_cpu_property() (git-fixes). - hwrng: virtio: clamp device-reported used.len at copy_data() (git-fixes). - soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy (git-fixes). - soc: fsl: qe: panic on ioremap() failure in qe_reset() (git-fixes). - gpu: host1x: Fix iommu_map_sgtable() return value check (git-fixes). - wifi: wcn36xx: fix OOB read from short trigger BA firmware response (git-fixes). - wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication (git-fixes). - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response (git-fixes). - wifi: mt76: mt7996: fix potential tx_retries underflow (git-fixes). - wifi: mt76: mt7925: fix potential tx_retries underflow (git-fixes). - wifi: mt76: mt7921: fix potential tx_retries underflow (git-fixes). - wifi: mt76: mt7915: fix potential tx_retries underflow (git-fixes). - wifi: mt76: fix argument to ieee80211_is_first_frag() (git-fixes). - wifi: mt76: mt7925: clean up DMA on probe failure (git-fixes). - wifi: mac80211: fix monitor mode frame capture for real chanctx drivers (git-fixes). - wifi: rtw88: usb: fix memory leaks on USB write failures (git-fixes). - wifi: rtw88: increase TX report timeout to fix race condition (git-fixes). - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor (git-fixes). - wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer (git-fixes). - wifi: rtw89: Correct data type for scan index to avoid infinite loop (git-fixes). - wifi: ath11k: fix warning when unbinding (git-fixes). - wifi: ath9k: fix OOB access from firmware tx status queue ID (git-fixes). - wifi: cfg80211: fix grammar in MLO group key error message (git-fixes). - commit f3af1ec - firmware: arm_scmi: Fix OOB in scmi_power_name_get() (git-fixes). - firmware: arm_scmi: Read sensor config as 32-bit value (git-fixes). - drm/amdgpu: set sub_block_index for mca ras sub-blocks (git-fixes). - drm/amd/display: Add missing kdoc for ALLM parameters (git-fixes). - drm/msm/dp: Fix the ISR_* enum values (git-fixes). - drm/msm/dp: fix HPD state status bit shift value (git-fixes). - drm/nouveau/bios: specify correct display fuse register for Ampere and Ada (git-fixes). - drm/tegra: Fix iommu_map_sgtable() return value check (git-fixes). - drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() (git-fixes). - gpu: host1x: Allow entries in BO caches to be freed (git-fixes). - drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers (git-fixes). - drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers (git-fixes). - drm/hisilicon/hibmc: use clock to look up the PLL value (git-fixes). - drm/hisilicon/hibmc: move display contrl config to hibmc_probe() (git-fixes). - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (git-fixes). - drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() (git-fixes). - drm/hyperv: use VMBUS_RING_SIZE() (git-fixes). - drm/amdkfd: Validate CRIU-restored IDs before idr_alloc (git-fixes). - commit 4affa42 - ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO (git-fixes). - ASoC: topology: Check PCM and DAI name strings before use (git-fixes). - ASoC: tegra: tegra210_ahub: Validate written enum value (git-fixes). - ASoC: fsl: fsl_audmix: Validate written enum values (git-fixes). - ASoC: meson: aiu: Validate written enum values (git-fixes). - ASoC: codecs: hdac_hdmi: Validate written enum value (git-fixes). - ASoC: SOF: topology: validate vendor array size before parsing (git-fixes). - ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails (git-fixes). - ASoC: cs35l56: Cleanup if component_probe fails (git-fixes). - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() (git-fixes). - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (git-fixes). - ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (git-fixes). - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (git-fixes). - ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc (git-fixes). - ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put (git-fixes). - ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() (git-fixes). - ALSA: aloop: Drop superfluous break (git-fixes). - ALSA: seq: Clear variable event pointer on read (git-fixes). - ALSA: seq: Fix partial userptr event expansion (git-fixes). - ALSA: cmipci: check snd_ctl_new1() return value (git-fixes). - ALSA: ymfpci: check snd_ctl_new1() return value (git-fixes). - ALSA: ice1712: check snd_ctl_new1() return value (git-fixes). - ALSA: gus: check snd_ctl_new1() return value (git-fixes). - ALSA: es1938: check snd_ctl_new1() return value (git-fixes). - ALSA: seq: midi: Serialize output teardown with event_input (git-fixes). - ALSA: virtio: Add missing 384 kHz PCM rate mapping (git-fixes). - ALSA: usb-audio: Update Babyface Pro control caches only after successful writes (git-fixes). - ALSA: usb-audio: Roll back quirk control caches on write errors (git-fixes). - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes (git-fixes). - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks (git-fixes). - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() (git-fixes). - agp/amd64: Fix broken error propagation in agp_amd64_probe() (git-fixes). - drm/radeon: fix memory leak in radeon_ring_restore() on lock failure (git-fixes). - drm/radeon: fix integer overflow in radeon_align_pitch() (git-fixes). - drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() (git-fixes). - drm/tidss: Fix missing drm_bridge_add() call (git-fixes). - drm/tidss: Drop extra drm_mode_config_reset() call (git-fixes). - drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() (git-fixes). - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() (git-fixes). - Bluetooth: vhci: validate devcoredump state before side effects (git-fixes). - Bluetooth: hci: validate codec capability element length (git-fixes). - Bluetooth: btusb: fix wakeup irq devres lifetime (git-fixes). - Bluetooth: btusb: fix wakeup source leak on probe failure (git-fixes). - Bluetooth: btusb: fix use-after-free on marvell probe failure (git-fixes). - Bluetooth: btusb: fix use-after-free on registration failure (git-fixes). - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD (git-fixes). - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE (git-fixes). - batman-adv: tp_meter: add only finished tp_vars to lists (git-fixes). - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection (git-fixes). - batman-adv: tp_meter: fix fast recovery precondition (git-fixes). - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd (git-fixes). - batman-adv: tp_meter: avoid window underflow (git-fixes). - batman-adv: tp_meter: initialize dec_cwnd explicitly (git-fixes). - batman-adv: tp_meter: initialize dup_acks explicitly (git-fixes). - batman-adv: tp_meter: keep unacked list in ascending ordered (git-fixes). - commit 17b623a - KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 (bsc#1267591, CVE-2026-46071). - commit 8d4d416 ++++ kernel-rt_debug: - Update patches.suse/io-wq-check-that-the-predecessor-is-hashed-in-io_wq_remove_pending.patch (git-fixes bsc#1267918 CVE-2026-46274). - commit d30fb9d - xfs: fix a resource leak in xfs_alloc_buftarg() (CVE-2026-46005 bsc#1267431). - commit 08b4554 - EFI/CPER: don't dump the entire memory region (bsc#1264549 CVE-2026-43171). - commit 0b53ad7 - of: cpu: add check in __of_find_n_match_cpu_property() (git-fixes). - hwrng: virtio: clamp device-reported used.len at copy_data() (git-fixes). - soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy (git-fixes). - soc: fsl: qe: panic on ioremap() failure in qe_reset() (git-fixes). - gpu: host1x: Fix iommu_map_sgtable() return value check (git-fixes). - wifi: wcn36xx: fix OOB read from short trigger BA firmware response (git-fixes). - wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication (git-fixes). - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response (git-fixes). - wifi: mt76: mt7996: fix potential tx_retries underflow (git-fixes). - wifi: mt76: mt7925: fix potential tx_retries underflow (git-fixes). - wifi: mt76: mt7921: fix potential tx_retries underflow (git-fixes). - wifi: mt76: mt7915: fix potential tx_retries underflow (git-fixes). - wifi: mt76: fix argument to ieee80211_is_first_frag() (git-fixes). - wifi: mt76: mt7925: clean up DMA on probe failure (git-fixes). - wifi: mac80211: fix monitor mode frame capture for real chanctx drivers (git-fixes). - wifi: rtw88: usb: fix memory leaks on USB write failures (git-fixes). - wifi: rtw88: increase TX report timeout to fix race condition (git-fixes). - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor (git-fixes). - wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer (git-fixes). - wifi: rtw89: Correct data type for scan index to avoid infinite loop (git-fixes). - wifi: ath11k: fix warning when unbinding (git-fixes). - wifi: ath9k: fix OOB access from firmware tx status queue ID (git-fixes). - wifi: cfg80211: fix grammar in MLO group key error message (git-fixes). - commit f3af1ec - firmware: arm_scmi: Fix OOB in scmi_power_name_get() (git-fixes). - firmware: arm_scmi: Read sensor config as 32-bit value (git-fixes). - drm/amdgpu: set sub_block_index for mca ras sub-blocks (git-fixes). - drm/amd/display: Add missing kdoc for ALLM parameters (git-fixes). - drm/msm/dp: Fix the ISR_* enum values (git-fixes). - drm/msm/dp: fix HPD state status bit shift value (git-fixes). - drm/nouveau/bios: specify correct display fuse register for Ampere and Ada (git-fixes). - drm/tegra: Fix iommu_map_sgtable() return value check (git-fixes). - drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() (git-fixes). - gpu: host1x: Allow entries in BO caches to be freed (git-fixes). - drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers (git-fixes). - drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers (git-fixes). - drm/hisilicon/hibmc: use clock to look up the PLL value (git-fixes). - drm/hisilicon/hibmc: move display contrl config to hibmc_probe() (git-fixes). - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (git-fixes). - drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() (git-fixes). - drm/hyperv: use VMBUS_RING_SIZE() (git-fixes). - drm/amdkfd: Validate CRIU-restored IDs before idr_alloc (git-fixes). - commit 4affa42 - ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO (git-fixes). - ASoC: topology: Check PCM and DAI name strings before use (git-fixes). - ASoC: tegra: tegra210_ahub: Validate written enum value (git-fixes). - ASoC: fsl: fsl_audmix: Validate written enum values (git-fixes). - ASoC: meson: aiu: Validate written enum values (git-fixes). - ASoC: codecs: hdac_hdmi: Validate written enum value (git-fixes). - ASoC: SOF: topology: validate vendor array size before parsing (git-fixes). - ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails (git-fixes). - ASoC: cs35l56: Cleanup if component_probe fails (git-fixes). - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() (git-fixes). - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (git-fixes). - ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (git-fixes). - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (git-fixes). - ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc (git-fixes). - ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put (git-fixes). - ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() (git-fixes). - ALSA: aloop: Drop superfluous break (git-fixes). - ALSA: seq: Clear variable event pointer on read (git-fixes). - ALSA: seq: Fix partial userptr event expansion (git-fixes). - ALSA: cmipci: check snd_ctl_new1() return value (git-fixes). - ALSA: ymfpci: check snd_ctl_new1() return value (git-fixes). - ALSA: ice1712: check snd_ctl_new1() return value (git-fixes). - ALSA: gus: check snd_ctl_new1() return value (git-fixes). - ALSA: es1938: check snd_ctl_new1() return value (git-fixes). - ALSA: seq: midi: Serialize output teardown with event_input (git-fixes). - ALSA: virtio: Add missing 384 kHz PCM rate mapping (git-fixes). - ALSA: usb-audio: Update Babyface Pro control caches only after successful writes (git-fixes). - ALSA: usb-audio: Roll back quirk control caches on write errors (git-fixes). - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes (git-fixes). - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks (git-fixes). - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() (git-fixes). - agp/amd64: Fix broken error propagation in agp_amd64_probe() (git-fixes). - drm/radeon: fix memory leak in radeon_ring_restore() on lock failure (git-fixes). - drm/radeon: fix integer overflow in radeon_align_pitch() (git-fixes). - drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() (git-fixes). - drm/tidss: Fix missing drm_bridge_add() call (git-fixes). - drm/tidss: Drop extra drm_mode_config_reset() call (git-fixes). - drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() (git-fixes). - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() (git-fixes). - Bluetooth: vhci: validate devcoredump state before side effects (git-fixes). - Bluetooth: hci: validate codec capability element length (git-fixes). - Bluetooth: btusb: fix wakeup irq devres lifetime (git-fixes). - Bluetooth: btusb: fix wakeup source leak on probe failure (git-fixes). - Bluetooth: btusb: fix use-after-free on marvell probe failure (git-fixes). - Bluetooth: btusb: fix use-after-free on registration failure (git-fixes). - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD (git-fixes). - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE (git-fixes). - batman-adv: tp_meter: add only finished tp_vars to lists (git-fixes). - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection (git-fixes). - batman-adv: tp_meter: fix fast recovery precondition (git-fixes). - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd (git-fixes). - batman-adv: tp_meter: avoid window underflow (git-fixes). - batman-adv: tp_meter: initialize dec_cwnd explicitly (git-fixes). - batman-adv: tp_meter: initialize dup_acks explicitly (git-fixes). - batman-adv: tp_meter: keep unacked list in ascending ordered (git-fixes). - commit 17b623a - KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 (bsc#1267591, CVE-2026-46071). - commit 8d4d416 ++++ systemd: - Import commit 260e668bfa1cbb2b3e854010e6d547671386e731 (bsc#1267647 bsc#1262305 bsc#1267644) ++++ python-tornado6: - CVE-2026-49853: authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395) - CVE-2026-49854: out-of-bounds memory access via C extension (bsc#1268396) - CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) (bsc#1268397) Add patches: * CVE-2026-49853.patch * CVE-2026-49854.patch * CVE-2026-49855.patch ------------------------------------------------------------------ ------------------ 2026-6-17 - Jun 17 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - Refresh patches.suse/scsi-target-iscsi-validate-CHAP_R-length-before-base.patch. - commit dd26935 - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (bsc#1267365, CVE-2026-46076). - commit 4809e50 - futex: Clear stale exiting pointer in futex_lock_pi() retry path (CVE-2026-31555 bsc#1263178). - commit bd7cbb0 - KVM: arm64: PMU: Preserve AArch32 counter low bits (git-fixes). - commit 5901e22 - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (git-fixes). - commit 66e5da3 - KVM: arm64: Guard against NULL vcpu on VHE hyp panic path (git-fixes). - commit f01d5d2 - KVM: arm64: Wake-up from WFI when iqrchip is in userspace (git-fixes). - commit ef45687 - KVM: arm64: Treat vCPU with pending SError as runnable (git-fixes). - commit 63eecf3 - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes). - commit aa1b279 - KVM: arm64: Discard PC update state on vcpu reset (git-fixes). - commit d16e788 - KVM: SEV: Ignore Port I/O requests of length '0' (git-fixes). - commit 0709065 - KVM: SEV: Ignore MMIO requests of length '0' (git-fixes). - commit 932a965 - drm/amdkfd: validate SVM ioctl nattr against buffer size (bsc#1267381 CVE-2026-46197) - commit 55e1894 ++++ kernel-rt: - Refresh patches.suse/scsi-target-iscsi-validate-CHAP_R-length-before-base.patch. - commit dd26935 - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (bsc#1267365, CVE-2026-46076). - commit 4809e50 - futex: Clear stale exiting pointer in futex_lock_pi() retry path (CVE-2026-31555 bsc#1263178). - commit bd7cbb0 - KVM: arm64: PMU: Preserve AArch32 counter low bits (git-fixes). - commit 5901e22 - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (git-fixes). - commit 66e5da3 - KVM: arm64: Guard against NULL vcpu on VHE hyp panic path (git-fixes). - commit f01d5d2 - KVM: arm64: Wake-up from WFI when iqrchip is in userspace (git-fixes). - commit ef45687 - KVM: arm64: Treat vCPU with pending SError as runnable (git-fixes). - commit 63eecf3 - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes). - commit aa1b279 - KVM: arm64: Discard PC update state on vcpu reset (git-fixes). - commit d16e788 - KVM: SEV: Ignore Port I/O requests of length '0' (git-fixes). - commit 0709065 - KVM: SEV: Ignore MMIO requests of length '0' (git-fixes). - commit 932a965 - drm/amdkfd: validate SVM ioctl nattr against buffer size (bsc#1267381 CVE-2026-46197) - commit 55e1894 ++++ kernel-rt_debug: - Refresh patches.suse/scsi-target-iscsi-validate-CHAP_R-length-before-base.patch. - commit dd26935 - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (bsc#1267365, CVE-2026-46076). - commit 4809e50 - futex: Clear stale exiting pointer in futex_lock_pi() retry path (CVE-2026-31555 bsc#1263178). - commit bd7cbb0 - KVM: arm64: PMU: Preserve AArch32 counter low bits (git-fixes). - commit 5901e22 - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (git-fixes). - commit 66e5da3 - KVM: arm64: Guard against NULL vcpu on VHE hyp panic path (git-fixes). - commit f01d5d2 - KVM: arm64: Wake-up from WFI when iqrchip is in userspace (git-fixes). - commit ef45687 - KVM: arm64: Treat vCPU with pending SError as runnable (git-fixes). - commit 63eecf3 - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes). - commit aa1b279 - KVM: arm64: Discard PC update state on vcpu reset (git-fixes). - commit d16e788 - KVM: SEV: Ignore Port I/O requests of length '0' (git-fixes). - commit 0709065 - KVM: SEV: Ignore MMIO requests of length '0' (git-fixes). - commit 932a965 - drm/amdkfd: validate SVM ioctl nattr against buffer size (bsc#1267381 CVE-2026-46197) - commit 55e1894 ------------------------------------------------------------------ ------------------ 2026-6-16 - Jun 16 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - ext4: convert inline data to extents when truncate exceeds inline size (CVE-2026-31452 bsc#1262620). - commit 2076b97 - apparmor: fix invalid deref of rawdata when export_binary is unset (CVE-2026-45965 bsc#1267208). - commit f325213 - libceph: Fix slab-out-of-bounds access in auth message processing (CVE-2026-46119 bsc#1267628). - commit 9f3128e - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259 bsc#1267685). - commit 6e9cb04 - cifs: some missing initializations on replay (bsc#1267744 CVE-2026-31693). - commit b3b9535 - HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure (CVE-2026-43049 bsc#1264080) - commit 40b2786 - bridge: br_nd_send: validate ND option lengths (CVE-2026-31752 bsc#1264045) - commit 31bc659 - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak (CVE-2026-43035 bsc#1263996) - commit 155d3bd - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure (CVE-2026-46229 bsc#1267567) - commit fb4ff0b - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() (CVE-2026-46172 bsc#1266903). - openvswitch: cap upcall PID array size and pre-size vport replies (CVE-2026-45840 bsc#1266397). - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() (CVE-2026-43101 bsc#1264239). - net: ipv6: flowlabel: defer exclusive option free until RCU teardown (CVE-2026-31680 bsc#1263563). - net: use skb_header_pointer() for TCPv4 GSO frag_off check (CVE-2026-43036 bsc#1263993). - commit 17a97e7 - iommu/vt-d: Flush cache for PASID table before using it (CVE-2026-45862 bsc#1266705). - commit 6d37ad7 - crypto: rng - Free default RNG on module exit (git-fixes). - hwrng: jh7110 - fix refcount leak in starfive_trng_read() (git-fixes). - crypto: cavium/cpt - fix DMA cleanup using wrong loop index (git-fixes). - crypto: marvell/octeontx - fix DMA cleanup using wrong loop index (git-fixes). - crypto: qat - validate RSA CRT component lengths (git-fixes). - crypto: pcrypt - restore callback for non-parallel fallback (git-fixes). - crypto: qat - protect service table iterations with service_lock (git-fixes). - crypto: hisilicon/qm - disable error report before flr (git-fixes). - X.509: Fix validation of ASN.1 certificate header (git-fixes). - crypto: ecc - Fix carry overflow in vli multiplication (git-fixes). - crypto: amlogic - avoid double cleanup in meson_crypto_probe() (git-fixes). - crypto: af_alg - Cap AEAD AD length to 0x80000000 (git-fixes). - crypto: ccp - Treat zero-length cert chain as query for blob lengths (git-fixes). - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents (git-fixes). - crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve (git-fixes). - crypto: atmel-sha204a - fix blocking and non-blocking rng logic (git-fixes). - crypto: drbg - Fix the fips_enabled priority boost (git-fixes). - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels (git-fixes). - crypto: drbg - Fix returning success on failure in CTR_DRBG (git-fixes). - crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one (git-fixes). - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode (git-fixes). - fbdev: sm501fb: Fix buffer errors in OF binding code (git-fixes). - fbdev: sm712: Fix operator precedence in big_swap macro (git-fixes). - fbdev: vesafb: fix memory leak in vesafb_probe() (git-fixes). - commit f4cdb00 - fbdev: uvesafb: fix potential memory leak in uvesafb_probe() (git-fixes). - fbdev: tridentfb: fix potential memory leak in trident_pci_probe() (git-fixes). - fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() (git-fixes). - fbdev: s3fb: fix potential memory leak in s3_pci_probe() (git-fixes). - fbdev: nvidia: fix potential memory leak in nvidiafb_probe() (git-fixes). - fbdev: i740fb: fix potential memory leak in i740fb_probe() (git-fixes). - fbdev: radeon: fix potential memory leak in radeonfb_pci_register() (git-fixes). - fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (git-fixes). - fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() (git-fixes). - fbdev: hecubafb: fix potential memory leak in hecubafb_probe() (git-fixes). - hwmon: (it87) Clamp negative values to zero in set_fan() (git-fixes). - watchdog: unregister PM notifier on watchdog unregister (git-fixes). - watchdog: apple: Add "apple,t8103-wdt" compatible (git-fixes). - watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure (git-fixes). - watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH (git-fixes). - spi: xilinx: use FIFO occupancy register to determine buffer size (git-fixes). - spi: meson-spifc: fix runtime PM leak on remove (git-fixes). - spi: ep93xx: fix double-free of zeropage on DMA setup failure (git-fixes). - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (git-fixes). - spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() (git-fixes). - spi: at91-usart: drop dead runtime pm support (git-fixes). - i2c: core: fix irq domain leak on adapter registration failure (git-fixes). - firmware_loader: Fix recursive lock in device_cache_fw_images() (git-fixes). - firmware_loader: fix device reference leak in firmware_upload_register() (git-fixes). - driver core: reject devices with unregistered buses (git-fixes). - driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() (git-fixes). - PM: sleep: Use complete() in device_pm_sleep_init() (git-fixes). - thermal: hwmon: Fix critical temperature attribute removal (git-fixes). - ACPI: CPPC: Suppress UBSAN warning caused by field misuse (git-fixes). - ACPI: IPMI: Fix message kref handling on dead device (git-fixes). - ACPI: NFIT: core: Fix possible NULL pointer dereference (git-fixes). - commit a9dcc0a ++++ kernel-rt: - ext4: convert inline data to extents when truncate exceeds inline size (CVE-2026-31452 bsc#1262620). - commit 2076b97 - apparmor: fix invalid deref of rawdata when export_binary is unset (CVE-2026-45965 bsc#1267208). - commit f325213 - libceph: Fix slab-out-of-bounds access in auth message processing (CVE-2026-46119 bsc#1267628). - commit 9f3128e - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259 bsc#1267685). - commit 6e9cb04 - cifs: some missing initializations on replay (bsc#1267744 CVE-2026-31693). - commit b3b9535 - HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure (CVE-2026-43049 bsc#1264080) - commit 40b2786 - bridge: br_nd_send: validate ND option lengths (CVE-2026-31752 bsc#1264045) - commit 31bc659 - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak (CVE-2026-43035 bsc#1263996) - commit 155d3bd - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure (CVE-2026-46229 bsc#1267567) - commit fb4ff0b - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() (CVE-2026-46172 bsc#1266903). - openvswitch: cap upcall PID array size and pre-size vport replies (CVE-2026-45840 bsc#1266397). - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() (CVE-2026-43101 bsc#1264239). - net: ipv6: flowlabel: defer exclusive option free until RCU teardown (CVE-2026-31680 bsc#1263563). - net: use skb_header_pointer() for TCPv4 GSO frag_off check (CVE-2026-43036 bsc#1263993). - commit 17a97e7 - iommu/vt-d: Flush cache for PASID table before using it (CVE-2026-45862 bsc#1266705). - commit 6d37ad7 - crypto: rng - Free default RNG on module exit (git-fixes). - hwrng: jh7110 - fix refcount leak in starfive_trng_read() (git-fixes). - crypto: cavium/cpt - fix DMA cleanup using wrong loop index (git-fixes). - crypto: marvell/octeontx - fix DMA cleanup using wrong loop index (git-fixes). - crypto: qat - validate RSA CRT component lengths (git-fixes). - crypto: pcrypt - restore callback for non-parallel fallback (git-fixes). - crypto: qat - protect service table iterations with service_lock (git-fixes). - crypto: hisilicon/qm - disable error report before flr (git-fixes). - X.509: Fix validation of ASN.1 certificate header (git-fixes). - crypto: ecc - Fix carry overflow in vli multiplication (git-fixes). - crypto: amlogic - avoid double cleanup in meson_crypto_probe() (git-fixes). - crypto: af_alg - Cap AEAD AD length to 0x80000000 (git-fixes). - crypto: ccp - Treat zero-length cert chain as query for blob lengths (git-fixes). - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents (git-fixes). - crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve (git-fixes). - crypto: atmel-sha204a - fix blocking and non-blocking rng logic (git-fixes). - crypto: drbg - Fix the fips_enabled priority boost (git-fixes). - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels (git-fixes). - crypto: drbg - Fix returning success on failure in CTR_DRBG (git-fixes). - crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one (git-fixes). - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode (git-fixes). - fbdev: sm501fb: Fix buffer errors in OF binding code (git-fixes). - fbdev: sm712: Fix operator precedence in big_swap macro (git-fixes). - fbdev: vesafb: fix memory leak in vesafb_probe() (git-fixes). - commit f4cdb00 - fbdev: uvesafb: fix potential memory leak in uvesafb_probe() (git-fixes). - fbdev: tridentfb: fix potential memory leak in trident_pci_probe() (git-fixes). - fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() (git-fixes). - fbdev: s3fb: fix potential memory leak in s3_pci_probe() (git-fixes). - fbdev: nvidia: fix potential memory leak in nvidiafb_probe() (git-fixes). - fbdev: i740fb: fix potential memory leak in i740fb_probe() (git-fixes). - fbdev: radeon: fix potential memory leak in radeonfb_pci_register() (git-fixes). - fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (git-fixes). - fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() (git-fixes). - fbdev: hecubafb: fix potential memory leak in hecubafb_probe() (git-fixes). - hwmon: (it87) Clamp negative values to zero in set_fan() (git-fixes). - watchdog: unregister PM notifier on watchdog unregister (git-fixes). - watchdog: apple: Add "apple,t8103-wdt" compatible (git-fixes). - watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure (git-fixes). - watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH (git-fixes). - spi: xilinx: use FIFO occupancy register to determine buffer size (git-fixes). - spi: meson-spifc: fix runtime PM leak on remove (git-fixes). - spi: ep93xx: fix double-free of zeropage on DMA setup failure (git-fixes). - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (git-fixes). - spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() (git-fixes). - spi: at91-usart: drop dead runtime pm support (git-fixes). - i2c: core: fix irq domain leak on adapter registration failure (git-fixes). - firmware_loader: Fix recursive lock in device_cache_fw_images() (git-fixes). - firmware_loader: fix device reference leak in firmware_upload_register() (git-fixes). - driver core: reject devices with unregistered buses (git-fixes). - driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() (git-fixes). - PM: sleep: Use complete() in device_pm_sleep_init() (git-fixes). - thermal: hwmon: Fix critical temperature attribute removal (git-fixes). - ACPI: CPPC: Suppress UBSAN warning caused by field misuse (git-fixes). - ACPI: IPMI: Fix message kref handling on dead device (git-fixes). - ACPI: NFIT: core: Fix possible NULL pointer dereference (git-fixes). - commit a9dcc0a ++++ kernel-rt_debug: - ext4: convert inline data to extents when truncate exceeds inline size (CVE-2026-31452 bsc#1262620). - commit 2076b97 - apparmor: fix invalid deref of rawdata when export_binary is unset (CVE-2026-45965 bsc#1267208). - commit f325213 - libceph: Fix slab-out-of-bounds access in auth message processing (CVE-2026-46119 bsc#1267628). - commit 9f3128e - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259 bsc#1267685). - commit 6e9cb04 - cifs: some missing initializations on replay (bsc#1267744 CVE-2026-31693). - commit b3b9535 - HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure (CVE-2026-43049 bsc#1264080) - commit 40b2786 - bridge: br_nd_send: validate ND option lengths (CVE-2026-31752 bsc#1264045) - commit 31bc659 - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak (CVE-2026-43035 bsc#1263996) - commit 155d3bd - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure (CVE-2026-46229 bsc#1267567) - commit fb4ff0b - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() (CVE-2026-46172 bsc#1266903). - openvswitch: cap upcall PID array size and pre-size vport replies (CVE-2026-45840 bsc#1266397). - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() (CVE-2026-43101 bsc#1264239). - net: ipv6: flowlabel: defer exclusive option free until RCU teardown (CVE-2026-31680 bsc#1263563). - net: use skb_header_pointer() for TCPv4 GSO frag_off check (CVE-2026-43036 bsc#1263993). - commit 17a97e7 - iommu/vt-d: Flush cache for PASID table before using it (CVE-2026-45862 bsc#1266705). - commit 6d37ad7 - crypto: rng - Free default RNG on module exit (git-fixes). - hwrng: jh7110 - fix refcount leak in starfive_trng_read() (git-fixes). - crypto: cavium/cpt - fix DMA cleanup using wrong loop index (git-fixes). - crypto: marvell/octeontx - fix DMA cleanup using wrong loop index (git-fixes). - crypto: qat - validate RSA CRT component lengths (git-fixes). - crypto: pcrypt - restore callback for non-parallel fallback (git-fixes). - crypto: qat - protect service table iterations with service_lock (git-fixes). - crypto: hisilicon/qm - disable error report before flr (git-fixes). - X.509: Fix validation of ASN.1 certificate header (git-fixes). - crypto: ecc - Fix carry overflow in vli multiplication (git-fixes). - crypto: amlogic - avoid double cleanup in meson_crypto_probe() (git-fixes). - crypto: af_alg - Cap AEAD AD length to 0x80000000 (git-fixes). - crypto: ccp - Treat zero-length cert chain as query for blob lengths (git-fixes). - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents (git-fixes). - crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve (git-fixes). - crypto: atmel-sha204a - fix blocking and non-blocking rng logic (git-fixes). - crypto: drbg - Fix the fips_enabled priority boost (git-fixes). - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels (git-fixes). - crypto: drbg - Fix returning success on failure in CTR_DRBG (git-fixes). - crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one (git-fixes). - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode (git-fixes). - fbdev: sm501fb: Fix buffer errors in OF binding code (git-fixes). - fbdev: sm712: Fix operator precedence in big_swap macro (git-fixes). - fbdev: vesafb: fix memory leak in vesafb_probe() (git-fixes). - commit f4cdb00 - fbdev: uvesafb: fix potential memory leak in uvesafb_probe() (git-fixes). - fbdev: tridentfb: fix potential memory leak in trident_pci_probe() (git-fixes). - fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() (git-fixes). - fbdev: s3fb: fix potential memory leak in s3_pci_probe() (git-fixes). - fbdev: nvidia: fix potential memory leak in nvidiafb_probe() (git-fixes). - fbdev: i740fb: fix potential memory leak in i740fb_probe() (git-fixes). - fbdev: radeon: fix potential memory leak in radeonfb_pci_register() (git-fixes). - fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (git-fixes). - fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() (git-fixes). - fbdev: hecubafb: fix potential memory leak in hecubafb_probe() (git-fixes). - hwmon: (it87) Clamp negative values to zero in set_fan() (git-fixes). - watchdog: unregister PM notifier on watchdog unregister (git-fixes). - watchdog: apple: Add "apple,t8103-wdt" compatible (git-fixes). - watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure (git-fixes). - watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH (git-fixes). - spi: xilinx: use FIFO occupancy register to determine buffer size (git-fixes). - spi: meson-spifc: fix runtime PM leak on remove (git-fixes). - spi: ep93xx: fix double-free of zeropage on DMA setup failure (git-fixes). - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (git-fixes). - spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() (git-fixes). - spi: at91-usart: drop dead runtime pm support (git-fixes). - i2c: core: fix irq domain leak on adapter registration failure (git-fixes). - firmware_loader: Fix recursive lock in device_cache_fw_images() (git-fixes). - firmware_loader: fix device reference leak in firmware_upload_register() (git-fixes). - driver core: reject devices with unregistered buses (git-fixes). - driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() (git-fixes). - PM: sleep: Use complete() in device_pm_sleep_init() (git-fixes). - thermal: hwmon: Fix critical temperature attribute removal (git-fixes). - ACPI: CPPC: Suppress UBSAN warning caused by field misuse (git-fixes). - ACPI: IPMI: Fix message kref handling on dead device (git-fixes). - ACPI: NFIT: core: Fix possible NULL pointer dereference (git-fixes). - commit a9dcc0a ++++ libarchive: - Fix CVE-2026-4424, 257-byte heap memory leak when processing a 170-byte RAR3 (CVE-2026-4424, bsc#1259928) * CVE-2026-4424.patch - Fix CVE-2026-4426, undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code 3.8.1 in function apply_substitution in file tar/subst.c (CVE-2026-4426, bsc#1259931) * CVE-2026-4426.patch - Fix CVE-2026-4111, logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop and DoS (CVE-2026-4111, bsc#1259635) * CVE-2026-4111.patch - Fix CVE-2026-5121, missing validation check for pz_log2_bs can a heap buffer overflow write (CVE-2026-5121, bsc#1261186) * CVE-2026-5121.patch - Fix CVE-2025-60753, An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules (CVE-2025-60753, bsc#1253088) * CVE-2025-60753.patch ++++ nvidia-open-driver-G06-signed: - linux-7.1.patch * improved patch in order to avoid Use-After-Free (found by AI review; proposal fix by Michal Suchanek) - linux-7.1.patch: * fixes build against kernel 7.1 (currently blocking our kernel 7.1 release for TW); stolen from changes for 580.159.04 release (boo#1268331) ++++ pam: - Fix password comparison timing leak from pam_userdb [CVE-2026-54411], [bsc#1268290] * pam_userdb-fix-password-comparison-timing-leak.patch ------------------------------------------------------------------ ------------------ 2026-6-15 - Jun 15 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - bnxt_en: Fix NULL pointer dereference (bsc#1268307). - commit 7ae93a3 - netfilter: nf_conntrack_expect: use expect->helper (CVE-2026-31414 bsc#1262085). - Refresh patches.suse/netfilter-ctnetlink-ignore-explicit-helper-on-new-expectat.patch. - commit 99ec017 - KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock (CVE-2026-31592 bsc#1263123) - commit a27f5df - kABI: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137 CVE-2026-31665). - commit 852b745 - netfilter: nft_ct: fix use-after-free in timeout object destroy (CVE-2026-31665 bsc#1263137). - commit 6829bf4 - Bluetooth: hci_event: move wake reason storage into validated event handlers (CVE-2026-31771 bsc#1264145). - commit 67a2e31 - xprtrdma: Decrement re_receiving on the early exit paths (CVE-2026-43469 bsc#1265143). - commit f6ecb8c - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (bsc#1264116 CVE-2026-31697). - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (bsc#1263880 CVE-2026-31698). - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (bsc#1263879 CVE-2026-31699). - commit cec78a2 - KVM: x86/mmu: Fix UBSAN warning when reading nx_huge_pages parameter (git-fixes). - commit c1a8431 - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode (git-fixes). - commit 504cc97 - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state (git-fixes). - commit 8e02e91 - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (git-fixes). - commit 233e411 - KVM: SVM: Allow KVM_SET_NESTED_STATE to clear GIF when SVME==0 (git-fixes). - commit 11a6b9c - KVM: SVM: Don't set GIF when clearing EFER.SVME (git-fixes). - commit e8d7f01 - KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC (git-fixes). - commit 92eed6c - KVM: SVM: check validity of VMCB controls when returning from SMM (git-fixes). - commit 9ab2ff1 - add bugnumber to existing mana_ib change (bsc#1267682) - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs (git-fixes). - hyperv: Clean up and fix the guest ID comment in hvgdk.h (git-fixes). - hv: utils: handle and propagate errors in kvp_register (git-fixes). - net: mana: Add ethtool counters for RX CQEs in coalesced type (bsc#1261256). - net: mana: Add support for RX CQE Coalescing (bsc#1261256). - net: ethtool: add ethtool COALESCE_RX_CQE_FRAMES/NSECS (bsc#1261256). - ethtool: provide customized dim profile management (bsc#1261256). - linux/dim: move useful macros to .h file (bsc#1261256). - commit 71b9923 - RDMA/irdma: Initialize free_qp completion before using it (CVE-2026-31492 bsc#1262748) - commit 992fcda ++++ kernel-rt: - bnxt_en: Fix NULL pointer dereference (bsc#1268307). - commit 7ae93a3 - netfilter: nf_conntrack_expect: use expect->helper (CVE-2026-31414 bsc#1262085). - Refresh patches.suse/netfilter-ctnetlink-ignore-explicit-helper-on-new-expectat.patch. - commit 99ec017 - KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock (CVE-2026-31592 bsc#1263123) - commit a27f5df - kABI: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137 CVE-2026-31665). - commit 852b745 - netfilter: nft_ct: fix use-after-free in timeout object destroy (CVE-2026-31665 bsc#1263137). - commit 6829bf4 - Bluetooth: hci_event: move wake reason storage into validated event handlers (CVE-2026-31771 bsc#1264145). - commit 67a2e31 - xprtrdma: Decrement re_receiving on the early exit paths (CVE-2026-43469 bsc#1265143). - commit f6ecb8c - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (bsc#1264116 CVE-2026-31697). - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (bsc#1263880 CVE-2026-31698). - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (bsc#1263879 CVE-2026-31699). - commit cec78a2 - KVM: x86/mmu: Fix UBSAN warning when reading nx_huge_pages parameter (git-fixes). - commit c1a8431 - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode (git-fixes). - commit 504cc97 - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state (git-fixes). - commit 8e02e91 - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (git-fixes). - commit 233e411 - KVM: SVM: Allow KVM_SET_NESTED_STATE to clear GIF when SVME==0 (git-fixes). - commit 11a6b9c - KVM: SVM: Don't set GIF when clearing EFER.SVME (git-fixes). - commit e8d7f01 - KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC (git-fixes). - commit 92eed6c - KVM: SVM: check validity of VMCB controls when returning from SMM (git-fixes). - commit 9ab2ff1 - add bugnumber to existing mana_ib change (bsc#1267682) - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs (git-fixes). - hyperv: Clean up and fix the guest ID comment in hvgdk.h (git-fixes). - hv: utils: handle and propagate errors in kvp_register (git-fixes). - net: mana: Add ethtool counters for RX CQEs in coalesced type (bsc#1261256). - net: mana: Add support for RX CQE Coalescing (bsc#1261256). - net: ethtool: add ethtool COALESCE_RX_CQE_FRAMES/NSECS (bsc#1261256). - ethtool: provide customized dim profile management (bsc#1261256). - linux/dim: move useful macros to .h file (bsc#1261256). - commit 71b9923 - RDMA/irdma: Initialize free_qp completion before using it (CVE-2026-31492 bsc#1262748) - commit 992fcda ++++ kernel-rt_debug: - bnxt_en: Fix NULL pointer dereference (bsc#1268307). - commit 7ae93a3 - netfilter: nf_conntrack_expect: use expect->helper (CVE-2026-31414 bsc#1262085). - Refresh patches.suse/netfilter-ctnetlink-ignore-explicit-helper-on-new-expectat.patch. - commit 99ec017 - KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock (CVE-2026-31592 bsc#1263123) - commit a27f5df - kABI: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137 CVE-2026-31665). - commit 852b745 - netfilter: nft_ct: fix use-after-free in timeout object destroy (CVE-2026-31665 bsc#1263137). - commit 6829bf4 - Bluetooth: hci_event: move wake reason storage into validated event handlers (CVE-2026-31771 bsc#1264145). - commit 67a2e31 - xprtrdma: Decrement re_receiving on the early exit paths (CVE-2026-43469 bsc#1265143). - commit f6ecb8c - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (bsc#1264116 CVE-2026-31697). - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (bsc#1263880 CVE-2026-31698). - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (bsc#1263879 CVE-2026-31699). - commit cec78a2 - KVM: x86/mmu: Fix UBSAN warning when reading nx_huge_pages parameter (git-fixes). - commit c1a8431 - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode (git-fixes). - commit 504cc97 - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state (git-fixes). - commit 8e02e91 - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (git-fixes). - commit 233e411 - KVM: SVM: Allow KVM_SET_NESTED_STATE to clear GIF when SVME==0 (git-fixes). - commit 11a6b9c - KVM: SVM: Don't set GIF when clearing EFER.SVME (git-fixes). - commit e8d7f01 - KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC (git-fixes). - commit 92eed6c - KVM: SVM: check validity of VMCB controls when returning from SMM (git-fixes). - commit 9ab2ff1 - add bugnumber to existing mana_ib change (bsc#1267682) - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs (git-fixes). - hyperv: Clean up and fix the guest ID comment in hvgdk.h (git-fixes). - hv: utils: handle and propagate errors in kvp_register (git-fixes). - net: mana: Add ethtool counters for RX CQEs in coalesced type (bsc#1261256). - net: mana: Add support for RX CQE Coalescing (bsc#1261256). - net: ethtool: add ethtool COALESCE_RX_CQE_FRAMES/NSECS (bsc#1261256). - ethtool: provide customized dim profile management (bsc#1261256). - linux/dim: move useful macros to .h file (bsc#1261256). - commit 71b9923 - RDMA/irdma: Initialize free_qp completion before using it (CVE-2026-31492 bsc#1262748) - commit 992fcda ++++ sg3_utils: - Update to version 1.48~20221101+2.5a7572d6: * sg_inq: --export output conformance for SCSI name string and ATA fields (bsc#1267823) ++++ suseconnect-ng: - Update version to 1.23.0: - Use product identifier for product migrations. (bsc#1268596) - Switch to using go1.26-openssl as the default Go version to install to support building the package (jsc#SCC-843 bsc#1268900). - Fix flag parsing so that unknown flags or options are flagged as an error and the usage message is displayed. (bsc#1159776) - InstallReleasePackage interactive/noninteractive handling should be consistent with DistUpgrade (bsc#1267478). - Add new optional rpm_packages collector, disabled by default, to collect list of installed SUSE vendored RPM packages. (jsc#TEL-298) - Allow deregsiter when subscribed regcode has expired (bsc#1270392 jsc#865) ------------------------------------------------------------------ ------------------ 2026-6-14 - Jun 14 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - i2c: tegra: Fix NOIRQ suspend/resume (git-fixes). - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() (git-fixes). - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter (git-fixes). - commit 1fefba4 ++++ kernel-rt: - i2c: tegra: Fix NOIRQ suspend/resume (git-fixes). - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() (git-fixes). - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter (git-fixes). - commit 1fefba4 ++++ kernel-rt_debug: - i2c: tegra: Fix NOIRQ suspend/resume (git-fixes). - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() (git-fixes). - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter (git-fixes). - commit 1fefba4 ------------------------------------------------------------------ ------------------ 2026-6-13 - Jun 13 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - drm/vc4: fix krealloc() memory leak (git-fixes). - drm/virtio: Fix driver removal with disabled KMS (git-fixes). - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() (git-fixes). - drm/i915/gem: Fix phys BO pread/pwrite with offset (git-fixes). - USB: serial: kl5kusb105: fix bulk-out buffer overflow (git-fixes). - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (git-fixes). - USB: serial: io_ti: fix heap overflow in get_manuf_info() (git-fixes). - thunderbolt: Limit XDomain response copy to actual frame size (git-fixes). - thunderbolt: Validate XDomain request packet size before type cast (git-fixes). - thunderbolt: Clamp XDomain response data copy to allocation size (git-fixes). - thunderbolt: Bound root directory content to block size (git-fixes). - thunderbolt: Reject zero-length property entries in validator (git-fixes). - misc: fastrpc: fix use-after-free race in fastrpc_map_create (git-fixes). - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback (git-fixes). - misc: fastrpc: fix DMA address corruption due to find_vma misuse (git-fixes). - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context (git-fixes). - slimbus: qcom-ngd-ctrl: fix OF node refcount (git-fixes). - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls (git-fixes). - commit ac4853c ++++ kernel-rt: - drm/vc4: fix krealloc() memory leak (git-fixes). - drm/virtio: Fix driver removal with disabled KMS (git-fixes). - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() (git-fixes). - drm/i915/gem: Fix phys BO pread/pwrite with offset (git-fixes). - USB: serial: kl5kusb105: fix bulk-out buffer overflow (git-fixes). - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (git-fixes). - USB: serial: io_ti: fix heap overflow in get_manuf_info() (git-fixes). - thunderbolt: Limit XDomain response copy to actual frame size (git-fixes). - thunderbolt: Validate XDomain request packet size before type cast (git-fixes). - thunderbolt: Clamp XDomain response data copy to allocation size (git-fixes). - thunderbolt: Bound root directory content to block size (git-fixes). - thunderbolt: Reject zero-length property entries in validator (git-fixes). - misc: fastrpc: fix use-after-free race in fastrpc_map_create (git-fixes). - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback (git-fixes). - misc: fastrpc: fix DMA address corruption due to find_vma misuse (git-fixes). - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context (git-fixes). - slimbus: qcom-ngd-ctrl: fix OF node refcount (git-fixes). - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls (git-fixes). - commit ac4853c ++++ kernel-rt_debug: - drm/vc4: fix krealloc() memory leak (git-fixes). - drm/virtio: Fix driver removal with disabled KMS (git-fixes). - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() (git-fixes). - drm/i915/gem: Fix phys BO pread/pwrite with offset (git-fixes). - USB: serial: kl5kusb105: fix bulk-out buffer overflow (git-fixes). - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (git-fixes). - USB: serial: io_ti: fix heap overflow in get_manuf_info() (git-fixes). - thunderbolt: Limit XDomain response copy to actual frame size (git-fixes). - thunderbolt: Validate XDomain request packet size before type cast (git-fixes). - thunderbolt: Clamp XDomain response data copy to allocation size (git-fixes). - thunderbolt: Bound root directory content to block size (git-fixes). - thunderbolt: Reject zero-length property entries in validator (git-fixes). - misc: fastrpc: fix use-after-free race in fastrpc_map_create (git-fixes). - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback (git-fixes). - misc: fastrpc: fix DMA address corruption due to find_vma misuse (git-fixes). - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context (git-fixes). - slimbus: qcom-ngd-ctrl: fix OF node refcount (git-fixes). - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls (git-fixes). - commit ac4853c ------------------------------------------------------------------ ------------------ 2026-6-12 - Jun 12 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - gpio: mvebu: fix NULL pointer dereference in suspend/resume (git-fixes). - commit c9de88e - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116 bsc#1267369) - commit b3f5572 - crypto: algif_aead - Fix minimum RX size check for decryption (CVE-2026-43077 bsc#1264470). - commit a2c5d8a - Input: alps - fix use-after-free bugs caused by dev3_register_work (git-fixes CVE-2025-68822 bsc#1256668). - commit aadcd5f - ibmveth: Disable GSO for packets with small MSS (CVE-2026-46273 bsc#1267651 bsc#1265211). - commit 0ebaf44 - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (bsc#1264437 CVE-2026-43112). - commit 9c7b554 - smb: client: prevent races in ->query_interfaces() (bsc#1264444 CVE-2026-43239). - commit 6565bdf ++++ kernel-rt: - gpio: mvebu: fix NULL pointer dereference in suspend/resume (git-fixes). - commit c9de88e - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116 bsc#1267369) - commit b3f5572 - crypto: algif_aead - Fix minimum RX size check for decryption (CVE-2026-43077 bsc#1264470). - commit a2c5d8a - Input: alps - fix use-after-free bugs caused by dev3_register_work (git-fixes CVE-2025-68822 bsc#1256668). - commit aadcd5f - ibmveth: Disable GSO for packets with small MSS (CVE-2026-46273 bsc#1267651 bsc#1265211). - commit 0ebaf44 - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (bsc#1264437 CVE-2026-43112). - commit 9c7b554 - smb: client: prevent races in ->query_interfaces() (bsc#1264444 CVE-2026-43239). - commit 6565bdf ++++ kernel-rt_debug: - gpio: mvebu: fix NULL pointer dereference in suspend/resume (git-fixes). - commit c9de88e - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116 bsc#1267369) - commit b3f5572 - crypto: algif_aead - Fix minimum RX size check for decryption (CVE-2026-43077 bsc#1264470). - commit a2c5d8a - Input: alps - fix use-after-free bugs caused by dev3_register_work (git-fixes CVE-2025-68822 bsc#1256668). - commit aadcd5f - ibmveth: Disable GSO for packets with small MSS (CVE-2026-46273 bsc#1267651 bsc#1265211). - commit 0ebaf44 - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (bsc#1264437 CVE-2026-43112). - commit 9c7b554 - smb: client: prevent races in ->query_interfaces() (bsc#1264444 CVE-2026-43239). - commit 6565bdf ++++ python-PyJWT: - CVE-2026-48526: JWK JSON accepted as HMAC secret (algorithm confusion) (bsc#1266802) - CVE-2026-48523: Algorithm allow-list bypass with PyJWK / PyJWKClient (bsc#1266799) - CVE-2026-48525: DoS via base64 decode of unused payload segment when b64=false (bsc#1266801) - CVE-2026-48522: PyJWKClient accepts non-HTTP(S) URIs (bsc#1266798) - CVE-2026-48524: PyJWKClient cache wiped on fetch error (bsc#1266800) - added security-fixes.patch to fix above vulnerabilities ++++ zypper: - Transactional systems: Delegate rw-commands to transactional-wrapper if available (jsc#PED-13680, jsc#PED-15607) On a transactional system where the root filesystem is mounted read-only, zypper commands that modify the system cannot be executed directly. If the system provides a transactional-wrapper utility, zypper will automatically attempt to invoke it. The wrapper transparently executes the zypper command within a new, writable snapshot and manages the lifecycle of that snapshot based on the command's exit status. On transactional systems lacking a transactional-wrapper, users must manually invoke specialized tools -such as transactional-update- to install, update, or remove software. - version 1.14.98 ------------------------------------------------------------------ ------------------ 2026-6-11 - Jun 11 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - eventpoll: defer struct eventpoll free to RCU grace period (CVE-2026-43074 bsc#1264263) - commit 5e95666 - iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894 bsc#1266895). - commit ec9091b - netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392 bsc#1260531). - commit ac2b5d0 - ip6_gre: Use cached t->net in ip6erspan_changelink() (CVE-2026-46120 bsc#1267640) - commit 3cdb7eb - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CVE-2026-46227 bsc#1267697) - commit 8717948 - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (CVE-2026-31500 bsc#1262993). - Bluetooth: hci_sync: Remove remaining dependencies of hci_request (CVE-2026-31500 bsc#1262993). - commit d8d0a21 - virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (CVE-2026-31469 bsc#1267816) - commit 72f6530 - net: skb: fix cross-cache free of KFENCE-allocated skb head (CVE-2026-31429 bsc#1262392) - commit c65b0a2 - kabi: revert kabi breaking changes from bsc#1264610 fix (CVE-2026-43198 bsc#1264610). - tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198 bsc#1264610). - commit 8603fd2 - Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (CVE-2026-31499 bsc#1262674). - commit db804b6 - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244 bsc#1267654). - commit 7d565d3 - Fixup bugzilla reference in patches.suse/fanotify-fix-false-positive-on-permission-events.patch (bsc#1267387 CVE-2026-46150). - commit 95ca9eb - netfilter: reject zero shift in nft_bitwise (CVE-2026-46101 bsc#1266878). - commit 1f577bf - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (CVE-2026-45841 bsc#1266390). - commit 28279a1 - net: qrtr: ns: Limit the maximum server registration per node (CVE-2026-43491 bsc#1265628). - commit 34ca9be - Bluetooth: virtio_bt: clamp rx length before skb_put (CVE-2026-46123 bsc#1267621). - commit 5f859e1 - netfilter: x_tables: ensure names are nul-terminated (CVE-2026-43028 bsc#1263934). - commit 86e008b - netfilter: ctnetlink: use netlink policy range checks (CVE-2026-31495 bsc#1262798). - commit 8fd7248 - ipv4: icmp: validate reply type before using icmp_pointers (CVE-2026-46037 bsc#1267361). - commit f16567d ++++ kernel-rt: - eventpoll: defer struct eventpoll free to RCU grace period (CVE-2026-43074 bsc#1264263) - commit 5e95666 - iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894 bsc#1266895). - commit ec9091b - netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392 bsc#1260531). - commit ac2b5d0 - ip6_gre: Use cached t->net in ip6erspan_changelink() (CVE-2026-46120 bsc#1267640) - commit 3cdb7eb - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CVE-2026-46227 bsc#1267697) - commit 8717948 - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (CVE-2026-31500 bsc#1262993). - Bluetooth: hci_sync: Remove remaining dependencies of hci_request (CVE-2026-31500 bsc#1262993). - commit d8d0a21 - virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (CVE-2026-31469 bsc#1267816) - commit 72f6530 - net: skb: fix cross-cache free of KFENCE-allocated skb head (CVE-2026-31429 bsc#1262392) - commit c65b0a2 - kabi: revert kabi breaking changes from bsc#1264610 fix (CVE-2026-43198 bsc#1264610). - tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198 bsc#1264610). - commit 8603fd2 - Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (CVE-2026-31499 bsc#1262674). - commit db804b6 - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244 bsc#1267654). - commit 7d565d3 - Fixup bugzilla reference in patches.suse/fanotify-fix-false-positive-on-permission-events.patch (bsc#1267387 CVE-2026-46150). - commit 95ca9eb - netfilter: reject zero shift in nft_bitwise (CVE-2026-46101 bsc#1266878). - commit 1f577bf - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (CVE-2026-45841 bsc#1266390). - commit 28279a1 - net: qrtr: ns: Limit the maximum server registration per node (CVE-2026-43491 bsc#1265628). - commit 34ca9be - Bluetooth: virtio_bt: clamp rx length before skb_put (CVE-2026-46123 bsc#1267621). - commit 5f859e1 - netfilter: x_tables: ensure names are nul-terminated (CVE-2026-43028 bsc#1263934). - commit 86e008b - netfilter: ctnetlink: use netlink policy range checks (CVE-2026-31495 bsc#1262798). - commit 8fd7248 - ipv4: icmp: validate reply type before using icmp_pointers (CVE-2026-46037 bsc#1267361). - commit f16567d ++++ kernel-rt_debug: - eventpoll: defer struct eventpoll free to RCU grace period (CVE-2026-43074 bsc#1264263) - commit 5e95666 - iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894 bsc#1266895). - commit ec9091b - netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392 bsc#1260531). - commit ac2b5d0 - ip6_gre: Use cached t->net in ip6erspan_changelink() (CVE-2026-46120 bsc#1267640) - commit 3cdb7eb - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CVE-2026-46227 bsc#1267697) - commit 8717948 - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (CVE-2026-31500 bsc#1262993). - Bluetooth: hci_sync: Remove remaining dependencies of hci_request (CVE-2026-31500 bsc#1262993). - commit d8d0a21 - virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (CVE-2026-31469 bsc#1267816) - commit 72f6530 - net: skb: fix cross-cache free of KFENCE-allocated skb head (CVE-2026-31429 bsc#1262392) - commit c65b0a2 - kabi: revert kabi breaking changes from bsc#1264610 fix (CVE-2026-43198 bsc#1264610). - tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198 bsc#1264610). - commit 8603fd2 - Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (CVE-2026-31499 bsc#1262674). - commit db804b6 - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244 bsc#1267654). - commit 7d565d3 - Fixup bugzilla reference in patches.suse/fanotify-fix-false-positive-on-permission-events.patch (bsc#1267387 CVE-2026-46150). - commit 95ca9eb - netfilter: reject zero shift in nft_bitwise (CVE-2026-46101 bsc#1266878). - commit 1f577bf - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (CVE-2026-45841 bsc#1266390). - commit 28279a1 - net: qrtr: ns: Limit the maximum server registration per node (CVE-2026-43491 bsc#1265628). - commit 34ca9be - Bluetooth: virtio_bt: clamp rx length before skb_put (CVE-2026-46123 bsc#1267621). - commit 5f859e1 - netfilter: x_tables: ensure names are nul-terminated (CVE-2026-43028 bsc#1263934). - commit 86e008b - netfilter: ctnetlink: use netlink policy range checks (CVE-2026-31495 bsc#1262798). - commit 8fd7248 - ipv4: icmp: validate reply type before using icmp_pointers (CVE-2026-46037 bsc#1267361). - commit f16567d ++++ freeipmi: - Fix memory corruption in ipmi-oem-dell.c and ipmi-oem-fujitsu.c bsc#1267605 - CVE-2026-50031 A freeipmi_dell_mem_corruption.fix A freeipmi_fujitsu_buffer_overflow.fix ++++ opensc: - added patches CVE-2026-10275: global buffer overflow during key pair generation tests due to missing input validation [bsc#1267246] * opensc-CVE-2026-10275.patch CVE-2026-40528: stack and heap buffer overrun in the `do_key_value()` function due to missing length check allows for memory corruption via a crafted profile configuration file [bsc#1266963] * opensc-CVE-2026-40528.patch ------------------------------------------------------------------ ------------------ 2026-6-10 - Jun 10 2026 ------------------- ------------------------------------------------------------------ ++++ python-kiwi: - Fix rereading DASD partition table with partprobe On s390 and with a DASD disk the rereading of the partition table can only be done properly with partprobe. This commit changes the dracut code to Require parted and partprobe only for DASD disks on s390. In addition this commit prevents the active device locking for parted and partprobe when called in the context of a DASD device. The reason for this change is because of a patch in libparted which applies flock() itself in this condition. For details see: https://build.opensuse.org/projects/Base:System/packages/parted/files/libparted-make-BLKRRPART-more-robust.patch?expand=1 This change however does not exist in the upstream version of parted which is causing problems that are hard to solve by kiwi. However, a dead-lock condition should be avoided and I think it's still better to have this change in kiwi and convince people to upstream the above parted fix, rather than living with a dead-lock condition due to double locking in kiwi. This Fixes bsc#1263973 ++++ glib-networking: - Add CVE-2026-10028.patch: tls: detect cycles when setting issuer property (CVE-2026-10028, bsc#1267979, glgo#GNOME/glib-networking!279) ++++ kernel-default: - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (CVE-2026-31674 bsc#1263568). - commit 14ef35f - netfilter: nf_tables: reject immediate NF_QUEUE verdict (CVE-2026-43024 bsc#1263930). - commit b9b3d82 - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (CVE-2026-45964 bsc#1266698). - commit c35ac40 - fanotify: fix false positive on permission events (bsc#1267388 CVE-2026-46150). - commit cb980a6 - libceph: Use u32 for non-negative values in ceph_monmap_decode() (CVE-2026-43405 bsc#1264741). - commit 6169499 - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (CVE-2026-45974 bsc#1266922). - commit 2435899 - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (CVE-2026-45870 bsc#1266704). - commit 2615535 - usb: ulpi: fix memory leak on ulpi_register() error paths (CVE-2026-31759 bsc#1264076). - commit a4d2e1d - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CVE-2026-43023 bsc#1264137). - commit e99ef79 - Bluetooth: hci_sync: annotate data-races around hdev->req_status (CVE-2026-43119 bsc#1264561). - commit 1f0b9c9 - usb: ulpi: fix double free in ulpi_register_interface() error path (CVE-2026-31759 bsc#1264076). - commit 38bc056 - gfs2: fix memory leaks in gfs2_fill_super error path (CVE-2026-45961 bsc#1266933). - commit 1135f65 - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158 bsc#1264595). - commit 2670466 - xfs: delete attr leaf freemap entries when empty (CVE-2026-43187 bsc#1264603). - commit fa80c64 ++++ kernel-rt: - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (CVE-2026-31674 bsc#1263568). - commit 14ef35f - netfilter: nf_tables: reject immediate NF_QUEUE verdict (CVE-2026-43024 bsc#1263930). - commit b9b3d82 - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (CVE-2026-45964 bsc#1266698). - commit c35ac40 - fanotify: fix false positive on permission events (bsc#1267388 CVE-2026-46150). - commit cb980a6 - libceph: Use u32 for non-negative values in ceph_monmap_decode() (CVE-2026-43405 bsc#1264741). - commit 6169499 - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (CVE-2026-45974 bsc#1266922). - commit 2435899 - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (CVE-2026-45870 bsc#1266704). - commit 2615535 - usb: ulpi: fix memory leak on ulpi_register() error paths (CVE-2026-31759 bsc#1264076). - commit a4d2e1d - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CVE-2026-43023 bsc#1264137). - commit e99ef79 - Bluetooth: hci_sync: annotate data-races around hdev->req_status (CVE-2026-43119 bsc#1264561). - commit 1f0b9c9 - usb: ulpi: fix double free in ulpi_register_interface() error path (CVE-2026-31759 bsc#1264076). - commit 38bc056 - gfs2: fix memory leaks in gfs2_fill_super error path (CVE-2026-45961 bsc#1266933). - commit 1135f65 - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158 bsc#1264595). - commit 2670466 - xfs: delete attr leaf freemap entries when empty (CVE-2026-43187 bsc#1264603). - commit fa80c64 ++++ kernel-rt_debug: - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (CVE-2026-31674 bsc#1263568). - commit 14ef35f - netfilter: nf_tables: reject immediate NF_QUEUE verdict (CVE-2026-43024 bsc#1263930). - commit b9b3d82 - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (CVE-2026-45964 bsc#1266698). - commit c35ac40 - fanotify: fix false positive on permission events (bsc#1267388 CVE-2026-46150). - commit cb980a6 - libceph: Use u32 for non-negative values in ceph_monmap_decode() (CVE-2026-43405 bsc#1264741). - commit 6169499 - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (CVE-2026-45974 bsc#1266922). - commit 2435899 - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (CVE-2026-45870 bsc#1266704). - commit 2615535 - usb: ulpi: fix memory leak on ulpi_register() error paths (CVE-2026-31759 bsc#1264076). - commit a4d2e1d - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CVE-2026-43023 bsc#1264137). - commit e99ef79 - Bluetooth: hci_sync: annotate data-races around hdev->req_status (CVE-2026-43119 bsc#1264561). - commit 1f0b9c9 - usb: ulpi: fix double free in ulpi_register_interface() error path (CVE-2026-31759 bsc#1264076). - commit 38bc056 - gfs2: fix memory leaks in gfs2_fill_super error path (CVE-2026-45961 bsc#1266933). - commit 1135f65 - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158 bsc#1264595). - commit 2670466 - xfs: delete attr leaf freemap entries when empty (CVE-2026-43187 bsc#1264603). - commit fa80c64 ++++ suseconnect-ng: - Update version to 1.22.1: - library: Allow clients to disable the token handling mechanism (jsc#SCC-801) - Ensure updated system certs are included when creating HTTP client connections (bsc#1268017, jsc#SCC-804) ------------------------------------------------------------------ ------------------ 2026-6-9 - Jun 9 2026 ------------------- ------------------------------------------------------------------ ++++ cloud-regionsrv-client: - Update to version 11.0.3 + Write instance data cache file after cleaning the cache when the update server fails (bsc#1265930) + Create the cache directory when populating the cache (bsc#1267739) ++++ kernel-default: - btrfs: fix missing last_unlink_trans update when removing a directory (CVE-2026-46160 bsc#1267624). - commit f0782dc - Update patches.suse/xfs-avoid-dereferencing-log-items-after-push-callbacks.patch (CVE-2026-31453 bsc#1262617). - commit 570e724 - net: ipa: fix event ring index not programmed for IPA v5.0+ (CVE-2026-43345 bsc#1265103). - net: ioam6: fix OOB and missing lock (CVE-2026-43083 bsc#1264266). - xfrm: clear trailing padding in build_polexpire() (CVE-2026-31664 bsc#1263578). - ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339 bsc#1264763). - net: stmmac: fix oops when split header is enabled (CVE-2026-45940 bsc#1266916). - commit 075c4e7 - arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1266290 CVE-2025-10263) Enable workaround for this errata. - commit ea6e24e - arm64: cputype: Add C1-Premium definitions (bsc#1266290 CVE-2025-10263) - commit ca04e04 - arm64: cputype: Add C1-Ultra definitions (bsc#1266290 CVE-2025-10263) - commit c45105c - scsi: hisi_sas: Fix NULL pointer exception during user_scan() (CVE-2026-43413, bsc#1264671). - commit bfe6757 - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger (CVE-2026-46157 bsc#1267726). - commit f38bfb2 - Refresh patches.suse/team-avoid-NETDEV_CHANGEMTU-event-when-unregistering.patch. Added missing locking in backport (bsc#1267732). - commit a8766b2 - Bluetooth: hci_conn: fix potential UAF in create_big_sync (CVE-2026-46111 bsc#1267626). - commit 7777a50 - nfsd: never defer requests during idmap lookup (CVE-2026-45983 bsc#1266697). - Delete patches.suse/nfsd-do-not-defer-requests-during-idmap-lookup-in-v4-compo.patch. - commit 664a09a - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CVE-2026-46209 bsc#1267663). - commit 2c841fc - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (CVE-2026-46024 bsc#1267218). - commit e967a8f - libceph: prevent potential out-of-bounds reads in process_message_header() (CVE-2026-43406 bsc#1265073). - commit 79f8547 - rbd: fix null-ptr-deref when device_add_disk() fails (CVE-2026-46079 bsc#1266452). - commit 82a7e5e - ocfs2: handle invalid dinode in ocfs2_group_extend (CVE-2026-31596 bsc#1263319). - commit d319998 - libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (CVE-2026-43407 bsc#1265020). - commit d87fc06 ++++ kernel-rt: - btrfs: fix missing last_unlink_trans update when removing a directory (CVE-2026-46160 bsc#1267624). - commit f0782dc - Update patches.suse/xfs-avoid-dereferencing-log-items-after-push-callbacks.patch (CVE-2026-31453 bsc#1262617). - commit 570e724 - net: ipa: fix event ring index not programmed for IPA v5.0+ (CVE-2026-43345 bsc#1265103). - net: ioam6: fix OOB and missing lock (CVE-2026-43083 bsc#1264266). - xfrm: clear trailing padding in build_polexpire() (CVE-2026-31664 bsc#1263578). - ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339 bsc#1264763). - net: stmmac: fix oops when split header is enabled (CVE-2026-45940 bsc#1266916). - commit 075c4e7 - arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1266290 CVE-2025-10263) Enable workaround for this errata. - commit ea6e24e - arm64: cputype: Add C1-Premium definitions (bsc#1266290 CVE-2025-10263) - commit ca04e04 - arm64: cputype: Add C1-Ultra definitions (bsc#1266290 CVE-2025-10263) - commit c45105c - scsi: hisi_sas: Fix NULL pointer exception during user_scan() (CVE-2026-43413, bsc#1264671). - commit bfe6757 - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger (CVE-2026-46157 bsc#1267726). - commit f38bfb2 - Refresh patches.suse/team-avoid-NETDEV_CHANGEMTU-event-when-unregistering.patch. Added missing locking in backport (bsc#1267732). - commit a8766b2 - Bluetooth: hci_conn: fix potential UAF in create_big_sync (CVE-2026-46111 bsc#1267626). - commit 7777a50 - nfsd: never defer requests during idmap lookup (CVE-2026-45983 bsc#1266697). - Delete patches.suse/nfsd-do-not-defer-requests-during-idmap-lookup-in-v4-compo.patch. - commit 664a09a - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CVE-2026-46209 bsc#1267663). - commit 2c841fc - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (CVE-2026-46024 bsc#1267218). - commit e967a8f - libceph: prevent potential out-of-bounds reads in process_message_header() (CVE-2026-43406 bsc#1265073). - commit 79f8547 - rbd: fix null-ptr-deref when device_add_disk() fails (CVE-2026-46079 bsc#1266452). - commit 82a7e5e - ocfs2: handle invalid dinode in ocfs2_group_extend (CVE-2026-31596 bsc#1263319). - commit d319998 - libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (CVE-2026-43407 bsc#1265020). - commit d87fc06 ++++ kernel-rt_debug: - btrfs: fix missing last_unlink_trans update when removing a directory (CVE-2026-46160 bsc#1267624). - commit f0782dc - Update patches.suse/xfs-avoid-dereferencing-log-items-after-push-callbacks.patch (CVE-2026-31453 bsc#1262617). - commit 570e724 - net: ipa: fix event ring index not programmed for IPA v5.0+ (CVE-2026-43345 bsc#1265103). - net: ioam6: fix OOB and missing lock (CVE-2026-43083 bsc#1264266). - xfrm: clear trailing padding in build_polexpire() (CVE-2026-31664 bsc#1263578). - ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339 bsc#1264763). - net: stmmac: fix oops when split header is enabled (CVE-2026-45940 bsc#1266916). - commit 075c4e7 - arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1266290 CVE-2025-10263) Enable workaround for this errata. - commit ea6e24e - arm64: cputype: Add C1-Premium definitions (bsc#1266290 CVE-2025-10263) - commit ca04e04 - arm64: cputype: Add C1-Ultra definitions (bsc#1266290 CVE-2025-10263) - commit c45105c - scsi: hisi_sas: Fix NULL pointer exception during user_scan() (CVE-2026-43413, bsc#1264671). - commit bfe6757 - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger (CVE-2026-46157 bsc#1267726). - commit f38bfb2 - Refresh patches.suse/team-avoid-NETDEV_CHANGEMTU-event-when-unregistering.patch. Added missing locking in backport (bsc#1267732). - commit a8766b2 - Bluetooth: hci_conn: fix potential UAF in create_big_sync (CVE-2026-46111 bsc#1267626). - commit 7777a50 - nfsd: never defer requests during idmap lookup (CVE-2026-45983 bsc#1266697). - Delete patches.suse/nfsd-do-not-defer-requests-during-idmap-lookup-in-v4-compo.patch. - commit 664a09a - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CVE-2026-46209 bsc#1267663). - commit 2c841fc - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (CVE-2026-46024 bsc#1267218). - commit e967a8f - libceph: prevent potential out-of-bounds reads in process_message_header() (CVE-2026-43406 bsc#1265073). - commit 79f8547 - rbd: fix null-ptr-deref when device_add_disk() fails (CVE-2026-46079 bsc#1266452). - commit 82a7e5e - ocfs2: handle invalid dinode in ocfs2_group_extend (CVE-2026-31596 bsc#1263319). - commit d319998 - libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (CVE-2026-43407 bsc#1265020). - commit d87fc06 ------------------------------------------------------------------ ------------------ 2026-6-8 - Jun 8 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - nfs: return EISDIR on nfs3_proc_create if d_alias is a dir (CVE-2026-43470 bsc#1265128). - commit 9fc75a8 - af_unix: read UNIX_DIAG_VFS data under unix_state_lock (CVE-2026-31673 bsc#1263143). - Refresh patches.suse/vfs-add-super_operations-get_inode_dev. - commit 00e1878 - ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090 bsc#1267531). - ALSA: aloop: Use guard() for spin locks (CVE-2026-46090 bsc#1267531). - ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090 bsc#1267531). - ALSA: aloop: Use guard() for spin locks (CVE-2026-46090 bsc#1267531). - commit d19a9e2 - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878 bsc#1266767). - commit aa9368a - arm64: Add support for TSV110 Spectre-BHB mitigation (bsc#1264430 CVE-2026-43261) - commit ba98a63 - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard (git-fixes). - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams (git-fixes). - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c (git-fixes). - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (git-fixes). - drm/amdkfd: fix NULL dereference in get_queue_ids() (git-fixes). - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size (git-fixes). - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() (git-fixes). - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (git-fixes). - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs (git-fixes). - commit 276cfd7 ++++ kernel-rt: - nfs: return EISDIR on nfs3_proc_create if d_alias is a dir (CVE-2026-43470 bsc#1265128). - commit 9fc75a8 - af_unix: read UNIX_DIAG_VFS data under unix_state_lock (CVE-2026-31673 bsc#1263143). - Refresh patches.suse/vfs-add-super_operations-get_inode_dev. - commit 00e1878 - ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090 bsc#1267531). - ALSA: aloop: Use guard() for spin locks (CVE-2026-46090 bsc#1267531). - ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090 bsc#1267531). - ALSA: aloop: Use guard() for spin locks (CVE-2026-46090 bsc#1267531). - commit d19a9e2 - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878 bsc#1266767). - commit aa9368a - arm64: Add support for TSV110 Spectre-BHB mitigation (bsc#1264430 CVE-2026-43261) - commit ba98a63 - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard (git-fixes). - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams (git-fixes). - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c (git-fixes). - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (git-fixes). - drm/amdkfd: fix NULL dereference in get_queue_ids() (git-fixes). - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size (git-fixes). - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() (git-fixes). - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (git-fixes). - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs (git-fixes). - commit 276cfd7 ++++ kernel-rt_debug: - nfs: return EISDIR on nfs3_proc_create if d_alias is a dir (CVE-2026-43470 bsc#1265128). - commit 9fc75a8 - af_unix: read UNIX_DIAG_VFS data under unix_state_lock (CVE-2026-31673 bsc#1263143). - Refresh patches.suse/vfs-add-super_operations-get_inode_dev. - commit 00e1878 - ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090 bsc#1267531). - ALSA: aloop: Use guard() for spin locks (CVE-2026-46090 bsc#1267531). - ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090 bsc#1267531). - ALSA: aloop: Use guard() for spin locks (CVE-2026-46090 bsc#1267531). - commit d19a9e2 - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878 bsc#1266767). - commit aa9368a - arm64: Add support for TSV110 Spectre-BHB mitigation (bsc#1264430 CVE-2026-43261) - commit ba98a63 - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard (git-fixes). - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams (git-fixes). - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c (git-fixes). - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (git-fixes). - drm/amdkfd: fix NULL dereference in get_queue_ids() (git-fixes). - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size (git-fixes). - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() (git-fixes). - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (git-fixes). - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs (git-fixes). - commit 276cfd7 ++++ graphite2: - added patches CVE-2026-50593: Out-of-bounds write via Graphite actions [bsc#1267733] * graphite2-CVE-2026-50593.patch ++++ openvswitch: - Fix CVE-2026-5265 [bsc#1262498] heap over-read in ICMP error response generation * Add ovn-CVE-2026-5265.patch - Fix CVE-2026-5367 [bsc#1262499] heap over-read in OVN DHCPv6 client ID processing * Add ovn-CVE-2026-5367.patch - Fix controller: Use multicast for IPv6 Prefix Delegation * Add ovn-controller-Use-multicast-for-IPv6-Prefix-Delegation.patch - Rename patch CVE-2025-0650.patch to ovn-CVE-2025-0650.patch ++++ libzypp: - A .repo files "path=" entry must not refer to a location outside the repo (bsc#1267874, CVE-2026-44942) A "path=" entry may solely denote a sub-directory of the baseurl where the metadata are located. A relative path trying to access data outside the baseurl is reported and sanitized. - version 17.38.13 (35) ------------------------------------------------------------------ ------------------ 2026-6-6 - Jun 6 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - scsi: imm: Fix use-after-free bug caused by unfinished delayed work (CVE-2025-68324 bsc#1255416). - commit 195217b ++++ kernel-rt: - scsi: imm: Fix use-after-free bug caused by unfinished delayed work (CVE-2025-68324 bsc#1255416). - commit 195217b ++++ kernel-rt_debug: - scsi: imm: Fix use-after-free bug caused by unfinished delayed work (CVE-2025-68324 bsc#1255416). - commit 195217b ------------------------------------------------------------------ ------------------ 2026-6-5 - Jun 5 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (CVE-2026-43026 bsc#1263932). - commit 059378b - xfs: stop reclaim before pushing AIL during unmount (CVE-2026-31455 bsc#1262615). - commit e53a301 - xfs: save ailp before dropping the AIL lock in push callbacks (CVE-2026-31454 bsc#1262624). - commit 7159c4e - packaging: Add nvidia kernel description - commit 5f2699f - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724 CVE-2026-31655) - commit 9295a19 - bpf: Fix bpf_xdp_store_bytes proto for read-only arg (CVE-2026-45886 bsc#1266810). - commit 20a9956 - bpf: Fix regsafe() for pointers to packet (CVE-2026-43030 bsc#1264000). - commit 8f3e36e - bpf: Fix tcx/netkit detach permissions when prog fd isn't given (CVE-2026-45932 bsc#1266827). - commit b648f57 - spi: fix resource leaks on device setup failure (bsc#1266696 CVE-2026-46083) - commit 742a92d - Bluetooth: MGMT: Fix backward compatibility with userspace (git-fixes). - Bluetooth: bnep: reject short frames before parsing (git-fixes). - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (git-fixes). - Bluetooth: RFCOMM: validate skb length in MCC handlers (git-fixes). - Bluetooth: MGMT: validate advertising TLV before type checks (git-fixes). - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (git-fixes). - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (git-fixes). - wifi: nl80211: reject oversized EMA RNR lists (git-fixes). - mmc: sdhci: add signal voltage switch in sdhci_resume_host (git-fixes). - mmc: litex_mmc: Set mandatory idle clocks before CMD0 (git-fixes). - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation (git-fixes). - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC (git-fixes). - mmc: core: Fix host controller programming for fixed driver type (git-fixes). - commit 1ef939b - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak (bsc#1267652,CVE-2026-46159). - commit 56f6424 ++++ kernel-rt: - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (CVE-2026-43026 bsc#1263932). - commit 059378b - xfs: stop reclaim before pushing AIL during unmount (CVE-2026-31455 bsc#1262615). - commit e53a301 - xfs: save ailp before dropping the AIL lock in push callbacks (CVE-2026-31454 bsc#1262624). - commit 7159c4e - packaging: Add nvidia kernel description - commit 5f2699f - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724 CVE-2026-31655) - commit 9295a19 - bpf: Fix bpf_xdp_store_bytes proto for read-only arg (CVE-2026-45886 bsc#1266810). - commit 20a9956 - bpf: Fix regsafe() for pointers to packet (CVE-2026-43030 bsc#1264000). - commit 8f3e36e - bpf: Fix tcx/netkit detach permissions when prog fd isn't given (CVE-2026-45932 bsc#1266827). - commit b648f57 - spi: fix resource leaks on device setup failure (bsc#1266696 CVE-2026-46083) - commit 742a92d - Bluetooth: MGMT: Fix backward compatibility with userspace (git-fixes). - Bluetooth: bnep: reject short frames before parsing (git-fixes). - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (git-fixes). - Bluetooth: RFCOMM: validate skb length in MCC handlers (git-fixes). - Bluetooth: MGMT: validate advertising TLV before type checks (git-fixes). - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (git-fixes). - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (git-fixes). - wifi: nl80211: reject oversized EMA RNR lists (git-fixes). - mmc: sdhci: add signal voltage switch in sdhci_resume_host (git-fixes). - mmc: litex_mmc: Set mandatory idle clocks before CMD0 (git-fixes). - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation (git-fixes). - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC (git-fixes). - mmc: core: Fix host controller programming for fixed driver type (git-fixes). - commit 1ef939b - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak (bsc#1267652,CVE-2026-46159). - commit 56f6424 ++++ kernel-rt_debug: - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (CVE-2026-43026 bsc#1263932). - commit 059378b - xfs: stop reclaim before pushing AIL during unmount (CVE-2026-31455 bsc#1262615). - commit e53a301 - xfs: save ailp before dropping the AIL lock in push callbacks (CVE-2026-31454 bsc#1262624). - commit 7159c4e - packaging: Add nvidia kernel description - commit 5f2699f - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724 CVE-2026-31655) - commit 9295a19 - bpf: Fix bpf_xdp_store_bytes proto for read-only arg (CVE-2026-45886 bsc#1266810). - commit 20a9956 - bpf: Fix regsafe() for pointers to packet (CVE-2026-43030 bsc#1264000). - commit 8f3e36e - bpf: Fix tcx/netkit detach permissions when prog fd isn't given (CVE-2026-45932 bsc#1266827). - commit b648f57 - spi: fix resource leaks on device setup failure (bsc#1266696 CVE-2026-46083) - commit 742a92d - Bluetooth: MGMT: Fix backward compatibility with userspace (git-fixes). - Bluetooth: bnep: reject short frames before parsing (git-fixes). - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (git-fixes). - Bluetooth: RFCOMM: validate skb length in MCC handlers (git-fixes). - Bluetooth: MGMT: validate advertising TLV before type checks (git-fixes). - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (git-fixes). - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (git-fixes). - wifi: nl80211: reject oversized EMA RNR lists (git-fixes). - mmc: sdhci: add signal voltage switch in sdhci_resume_host (git-fixes). - mmc: litex_mmc: Set mandatory idle clocks before CMD0 (git-fixes). - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation (git-fixes). - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC (git-fixes). - mmc: core: Fix host controller programming for fixed driver type (git-fixes). - commit 1ef939b - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak (bsc#1267652,CVE-2026-46159). - commit 56f6424 ++++ openssl-3: - Security fixes: * CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357) * CVE-2026-45446: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (bsc#1266356) * CVE-2026-42770: FFC-DH Peer Validation Uses Attacker-Supplied q (bsc#1266353) * CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path (bsc#1266355) * CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349) * CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages (bsc#1266344) * CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341) * CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340) * CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342) * Add patches: openssl-CVE-2026-45447.patch openssl-CVE-2026-45446.patch openssl-CVE-2026-42770.patch openssl-CVE-2026-45445.patch openssl-CVE-2026-42766.patch openssl-CVE-2026-34182.patch openssl-CVE-2026-9076.patch openssl-CVE-2026-7383.patch openssl-CVE-2026-34180.patch ++++ sqlite3: - Update to version 3.53.2: * Fixes for problems in 3.53.0 reported by users. * bsc#1268013, CVE-2026-11824: heap-based buffer overflow vulnerability in the FTS5 full-text search extension. * bsc#1268012, CVE-2026-11822: memory corruption vulnerabilities in the FTS5 full-text search extension. * See the check-in timeline for details: https://sqlite.org/src/timeline?from=version-3.53.1&to=version-3.53.2 ++++ libzypp: - Repo "keyhint" must denote a filename, no path (bsc#1267426, CVE-2026-44941) - version 17.38.12 (35) ------------------------------------------------------------------ ------------------ 2026-6-4 - Jun 4 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - kabi: arm64: module: Update missing .init.text.ftrace_trampoline section message (bsc#1265579 bsc#1265170) Message was supposed to give us a hint that these KMP's will have issue when user try to ftrace them. But it turns out to be just source confusion and worry. - commit 2983ae5 - gfs2: Fix use-after-free in iomap inline data write path (CVE-2026-45984 bsc#1267214). - gfs2: Add metapath_dibh helper (CVE-2026-45984 bsc#1267214). - commit 7f4705a - mctp: route: hold key->lock in mctp_flow_prepare_output() (CVE-2026-43455 bsc#1264765). - net: mctp: Ensure keys maintain only one ref to corresponding dev (CVE-2026-43455 bsc#1264765). - commit 7c8d579 ++++ kernel-rt: - kabi: arm64: module: Update missing .init.text.ftrace_trampoline section message (bsc#1265579 bsc#1265170) Message was supposed to give us a hint that these KMP's will have issue when user try to ftrace them. But it turns out to be just source confusion and worry. - commit 2983ae5 - gfs2: Fix use-after-free in iomap inline data write path (CVE-2026-45984 bsc#1267214). - gfs2: Add metapath_dibh helper (CVE-2026-45984 bsc#1267214). - commit 7f4705a - mctp: route: hold key->lock in mctp_flow_prepare_output() (CVE-2026-43455 bsc#1264765). - net: mctp: Ensure keys maintain only one ref to corresponding dev (CVE-2026-43455 bsc#1264765). - commit 7c8d579 ++++ kernel-rt_debug: - kabi: arm64: module: Update missing .init.text.ftrace_trampoline section message (bsc#1265579 bsc#1265170) Message was supposed to give us a hint that these KMP's will have issue when user try to ftrace them. But it turns out to be just source confusion and worry. - commit 2983ae5 - gfs2: Fix use-after-free in iomap inline data write path (CVE-2026-45984 bsc#1267214). - gfs2: Add metapath_dibh helper (CVE-2026-45984 bsc#1267214). - commit 7f4705a - mctp: route: hold key->lock in mctp_flow_prepare_output() (CVE-2026-43455 bsc#1264765). - net: mctp: Ensure keys maintain only one ref to corresponding dev (CVE-2026-43455 bsc#1264765). - commit 7c8d579 ------------------------------------------------------------------ ------------------ 2026-6-3 - Jun 3 2026 ------------------- ------------------------------------------------------------------ ++++ python-kiwi: - Do not hardcode dracut omit module in live builder This is a relict from the old days when the pure presence of multipath in a live ISO caused issues at boot time. kiwi should not maintain a hardcoded list of dracut modules except for those that are mandatory for live boot, if there should be any special setting needed it should come from an overlay setup in /etc/dracut.conf.d/*.conf as part of the image description. This is related to bsc#1260340 ++++ kernel-default: - rpm/mkspec: Conditionally set Rust BuildReqs (bsc#1258538) This is a further optimization of kernel packaging rust-enablement. Add the check of CONFIG_RUST at creating the spec for each kernel flavor, and set BuildRequires conditionally only for archs that have CONFIG_RUST. This avoids the unnecessary dependency chains due to unused rust. The main knob ENABLE_RUST is still needed because otherwise we can't know whether to pass the dummy-tools or not at processing run_oldconfig. - commit ccf4b93 - rpm/check-for-config-changes: ignore Rust-related configs (bsc#1258538) Those configs may be dynamically changed at the build time - commit 5251980 - rpm: Add BuildRequires for Rust enablement (bsc#1258538) Update mkspec and template to generate the spec files with BuildRequires of Rust-related packages when ENABLE_RUST=Yes is set in rpm/config.sh. - commit d0f276f - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970 bsc#1267205). - commit c7c508f - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181 bsc#1266826). - commit 971667c - x86: shadow stacks: proper error handling for mmap lock (bsc#1264484 CVE-2026-43109). - commit fbd32de - ALSA: caiaq: Don't abort when no input device is available (CVE-2026-46004 bsc#1267222). - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path (CVE-2026-46004 bsc#1267222). - commit a3abbee - ALSA: caiaq: Handle probe errors properly (CVE-2026-46004 bsc#1267222). - commit c42211b - thermal: core: Fix thermal zone governor cleanup issues (CVE-2026-46021 bsc#1267220). - commit 5b274e1 - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (CVE-2026-43059 bsc#1264184). - commit 58f5225 - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (CVE-2026-43059 bsc#1264184). - Refresh patches.kabi/hci_dev-centralize-extra-lock.patch. - commit 59594e6 ++++ kernel-rt: - rpm/mkspec: Conditionally set Rust BuildReqs (bsc#1258538) This is a further optimization of kernel packaging rust-enablement. Add the check of CONFIG_RUST at creating the spec for each kernel flavor, and set BuildRequires conditionally only for archs that have CONFIG_RUST. This avoids the unnecessary dependency chains due to unused rust. The main knob ENABLE_RUST is still needed because otherwise we can't know whether to pass the dummy-tools or not at processing run_oldconfig. - commit ccf4b93 - rpm/check-for-config-changes: ignore Rust-related configs (bsc#1258538) Those configs may be dynamically changed at the build time - commit 5251980 - rpm: Add BuildRequires for Rust enablement (bsc#1258538) Update mkspec and template to generate the spec files with BuildRequires of Rust-related packages when ENABLE_RUST=Yes is set in rpm/config.sh. - commit d0f276f - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970 bsc#1267205). - commit c7c508f - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181 bsc#1266826). - commit 971667c - x86: shadow stacks: proper error handling for mmap lock (bsc#1264484 CVE-2026-43109). - commit fbd32de - ALSA: caiaq: Don't abort when no input device is available (CVE-2026-46004 bsc#1267222). - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path (CVE-2026-46004 bsc#1267222). - commit a3abbee - ALSA: caiaq: Handle probe errors properly (CVE-2026-46004 bsc#1267222). - commit c42211b - thermal: core: Fix thermal zone governor cleanup issues (CVE-2026-46021 bsc#1267220). - commit 5b274e1 - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (CVE-2026-43059 bsc#1264184). - commit 58f5225 - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (CVE-2026-43059 bsc#1264184). - Refresh patches.kabi/hci_dev-centralize-extra-lock.patch. - commit 59594e6 ++++ kernel-rt_debug: - rpm/mkspec: Conditionally set Rust BuildReqs (bsc#1258538) This is a further optimization of kernel packaging rust-enablement. Add the check of CONFIG_RUST at creating the spec for each kernel flavor, and set BuildRequires conditionally only for archs that have CONFIG_RUST. This avoids the unnecessary dependency chains due to unused rust. The main knob ENABLE_RUST is still needed because otherwise we can't know whether to pass the dummy-tools or not at processing run_oldconfig. - commit ccf4b93 - rpm/check-for-config-changes: ignore Rust-related configs (bsc#1258538) Those configs may be dynamically changed at the build time - commit 5251980 - rpm: Add BuildRequires for Rust enablement (bsc#1258538) Update mkspec and template to generate the spec files with BuildRequires of Rust-related packages when ENABLE_RUST=Yes is set in rpm/config.sh. - commit d0f276f - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970 bsc#1267205). - commit c7c508f - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181 bsc#1266826). - commit 971667c - x86: shadow stacks: proper error handling for mmap lock (bsc#1264484 CVE-2026-43109). - commit fbd32de - ALSA: caiaq: Don't abort when no input device is available (CVE-2026-46004 bsc#1267222). - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path (CVE-2026-46004 bsc#1267222). - commit a3abbee - ALSA: caiaq: Handle probe errors properly (CVE-2026-46004 bsc#1267222). - commit c42211b - thermal: core: Fix thermal zone governor cleanup issues (CVE-2026-46021 bsc#1267220). - commit 5b274e1 - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (CVE-2026-43059 bsc#1264184). - commit 58f5225 - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (CVE-2026-43059 bsc#1264184). - Refresh patches.kabi/hci_dev-centralize-extra-lock.patch. - commit 59594e6 ++++ rpcbind: - Tue Jun 2 11:32:51 UTC 2026 - Thomas Blume Update to rpcbind 1.2.9 (bsc#1267212) https://lore.kernel.org/linux-nfs/5cad3ab4-d24a-45fa-b1e9-d57b2c47a5e4@redhat.com/ rpcinfo: stack buffer overflow in rpcinfo rpcbaddrlist() * rpcbind: Stop unauthenticated oversized allocation in PMAPPROC_CALLIT decode * rpcbind: fix memory leak in read_warmstart() * rpcbind: fix memory leaks in network_init() * rpcbind: fix memory leak in init_transport() - Update to rpcbind 1.2.8 https://lore.kernel.org/linux-nfs/b553cc5a-46eb-453b-80f0-cfe69ccb7b21@redhat.com/ * Added -v (print version and compile flags) * rpcinfo: Removed a number of "old-style function definition" warnings * man/rpcbind: Update list of options * Comment out ListenStream=@/run/rpcbind.sock * [nfs/nfs-utils/rpcbind] rpcbind: avoid dereferencing NULL from realloc() * systemd/rpcbind.service.in: Add various hardenings options * man/rpcbind: Add Files section to manpage * Moved rpcbind.lock and default configs to /run instead of /var/run - systemd: Upstream added systemd EnvironmentFile: 1) /etc/rpcbind.conf 2) /etc/default/rpcbind 3) /etc/sysconfig/rpcbind (the only one originally used in openSUSE patch for boo#1117217) - systemd: Add 'systemd-tmpfiles-setup.service' into 'Wants' and 'After' targets (originally openSUSE patch for boo#1117217 added 'After=sysinit.target') - Removed patches (accepted upstream): * 0001-systemd-unit-files.patch * harden_rpcbind.service.patch * 0001-change-lockingdir-to-run.patch - Update to rpcbind 1.2.7 * rpcinfo: try connecting using abstract address * Listen on an AF_UNIX abstract address if supported * autotools/systemd: call rpcbind with -w only on enabled warm starts * rpcbind: fix double free in init_transport ------------------------------------------------------------------ ------------------ 2026-6-2 - Jun 2 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - slip: reject VJ receive packets on instances with no rstate array (CVE-2026-45842 bsc#1266400) - commit 9c6954f - media: dvb-net: fix OOB access in ULE extension header tables (CVE-2026-31405 bsc#1261700) - commit 0115edd - usb: usbtmc: Flush anchored URBs in usbtmc_release (CVE-2026-31758 bsc#1264093) - commit 862c169 - xfrm_user: fix info leak in build_report() (CVE-2026-31671 bsc#1263115) - commit e993b23 - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (CVE-2026-45846 bsc#1266394) - commit 8489b03 - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CVE-2026-46113 bsc#1266969). - commit 492a8ff - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak (CVE-2026-43040 bsc#1264091) - commit afb5ee9 - efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (CVE-2025-38549 bsc#1248235). - commit 07594aa - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (bsc#1266927 CVE-2026-46094). - commit 7627409 - writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883 CVE-2026-31703). - commit afdb742 - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255 CVE-2026-43068). - commit 3900419 - ext4: avoid infinite loops caused by residual data (bsc#1262622 CVE-2026-31448). - commit 23a715f - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245 CVE-2026-43066). - commit 283732e - ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243 CVE-2026-43065). - commit 01e5eec - ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619 CVE-2026-31446). - commit 2d5d4dc - arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes) - commit 0883f58 - arm64: tlb: Allow XZR argument to TLBI ops (git-fixes) - commit a27017d - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (CVE-2026-46114 bsc#1266972) - commit 76ec1c1 - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856 bsc#1266720) - commit c95a10d - auxdisplay: line-display: fix OOB read on zero-length message_store() (git-fixes). - security/keys: fix missed RCU read section on lookup (stable-fixes). - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (stable-fixes). - drm/amd/display: Validate GPIO pin LUT table size before iterating (stable-fixes). - drm/amd/display: Fix integer overflow in bios_get_image() (stable-fixes). - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access (git-fixes). - spi: ti-qspi: fix use-after-free after DMA setup failure (git-fixes). - spi: sprd: fix error pointer deref after DMA setup failure (git-fixes). - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() (git-fixes). - ALSA: asihpi: Fix potential OOB array access at reading cache (stable-fixes). - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() (git-fixes). - drivers/base/memory: fix memory block reference leak in poison accounting (git-fixes). - HID: quirks: really enable the intended work around for appledisplay (git-fixes). - HID: uclogic: Fix regression of input name assignment (git-fixes). - string: add mem_is_zero() helper to check if memory area is all zeros (stable-fixes). - commit 55d2e55 - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CVE-2026-46176 bsc#1266816) - commit f587e2a ++++ kernel-rt: - slip: reject VJ receive packets on instances with no rstate array (CVE-2026-45842 bsc#1266400) - commit 9c6954f - media: dvb-net: fix OOB access in ULE extension header tables (CVE-2026-31405 bsc#1261700) - commit 0115edd - usb: usbtmc: Flush anchored URBs in usbtmc_release (CVE-2026-31758 bsc#1264093) - commit 862c169 - xfrm_user: fix info leak in build_report() (CVE-2026-31671 bsc#1263115) - commit e993b23 - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (CVE-2026-45846 bsc#1266394) - commit 8489b03 - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CVE-2026-46113 bsc#1266969). - commit 492a8ff - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak (CVE-2026-43040 bsc#1264091) - commit afb5ee9 - efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (CVE-2025-38549 bsc#1248235). - commit 07594aa - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (bsc#1266927 CVE-2026-46094). - commit 7627409 - writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883 CVE-2026-31703). - commit afdb742 - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255 CVE-2026-43068). - commit 3900419 - ext4: avoid infinite loops caused by residual data (bsc#1262622 CVE-2026-31448). - commit 23a715f - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245 CVE-2026-43066). - commit 283732e - ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243 CVE-2026-43065). - commit 01e5eec - ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619 CVE-2026-31446). - commit 2d5d4dc - arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes) - commit 0883f58 - arm64: tlb: Allow XZR argument to TLBI ops (git-fixes) - commit a27017d - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (CVE-2026-46114 bsc#1266972) - commit 76ec1c1 - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856 bsc#1266720) - commit c95a10d - auxdisplay: line-display: fix OOB read on zero-length message_store() (git-fixes). - security/keys: fix missed RCU read section on lookup (stable-fixes). - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (stable-fixes). - drm/amd/display: Validate GPIO pin LUT table size before iterating (stable-fixes). - drm/amd/display: Fix integer overflow in bios_get_image() (stable-fixes). - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access (git-fixes). - spi: ti-qspi: fix use-after-free after DMA setup failure (git-fixes). - spi: sprd: fix error pointer deref after DMA setup failure (git-fixes). - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() (git-fixes). - ALSA: asihpi: Fix potential OOB array access at reading cache (stable-fixes). - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() (git-fixes). - drivers/base/memory: fix memory block reference leak in poison accounting (git-fixes). - HID: quirks: really enable the intended work around for appledisplay (git-fixes). - HID: uclogic: Fix regression of input name assignment (git-fixes). - string: add mem_is_zero() helper to check if memory area is all zeros (stable-fixes). - commit 55d2e55 - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CVE-2026-46176 bsc#1266816) - commit f587e2a ++++ kernel-rt_debug: - slip: reject VJ receive packets on instances with no rstate array (CVE-2026-45842 bsc#1266400) - commit 9c6954f - media: dvb-net: fix OOB access in ULE extension header tables (CVE-2026-31405 bsc#1261700) - commit 0115edd - usb: usbtmc: Flush anchored URBs in usbtmc_release (CVE-2026-31758 bsc#1264093) - commit 862c169 - xfrm_user: fix info leak in build_report() (CVE-2026-31671 bsc#1263115) - commit e993b23 - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (CVE-2026-45846 bsc#1266394) - commit 8489b03 - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CVE-2026-46113 bsc#1266969). - commit 492a8ff - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak (CVE-2026-43040 bsc#1264091) - commit afb5ee9 - efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (CVE-2025-38549 bsc#1248235). - commit 07594aa - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (bsc#1266927 CVE-2026-46094). - commit 7627409 - writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883 CVE-2026-31703). - commit afdb742 - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255 CVE-2026-43068). - commit 3900419 - ext4: avoid infinite loops caused by residual data (bsc#1262622 CVE-2026-31448). - commit 23a715f - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245 CVE-2026-43066). - commit 283732e - ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243 CVE-2026-43065). - commit 01e5eec - ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619 CVE-2026-31446). - commit 2d5d4dc - arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes) - commit 0883f58 - arm64: tlb: Allow XZR argument to TLBI ops (git-fixes) - commit a27017d - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (CVE-2026-46114 bsc#1266972) - commit 76ec1c1 - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856 bsc#1266720) - commit c95a10d - auxdisplay: line-display: fix OOB read on zero-length message_store() (git-fixes). - security/keys: fix missed RCU read section on lookup (stable-fixes). - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (stable-fixes). - drm/amd/display: Validate GPIO pin LUT table size before iterating (stable-fixes). - drm/amd/display: Fix integer overflow in bios_get_image() (stable-fixes). - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access (git-fixes). - spi: ti-qspi: fix use-after-free after DMA setup failure (git-fixes). - spi: sprd: fix error pointer deref after DMA setup failure (git-fixes). - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() (git-fixes). - ALSA: asihpi: Fix potential OOB array access at reading cache (stable-fixes). - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() (git-fixes). - drivers/base/memory: fix memory block reference leak in poison accounting (git-fixes). - HID: quirks: really enable the intended work around for appledisplay (git-fixes). - HID: uclogic: Fix regression of input name assignment (git-fixes). - string: add mem_is_zero() helper to check if memory area is all zeros (stable-fixes). - commit 55d2e55 - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CVE-2026-46176 bsc#1266816) - commit f587e2a ------------------------------------------------------------------ ------------------ 2026-6-1 - Jun 1 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - net: mana: Expose hardware diagnostic info via debugfs (bsc#1266414). - net: mana: Use kvmalloc for large RX queue and buffer allocations (bsc#1266765). - net: mana: Use per-queue allocation for tx_qp to reduce allocation size (bsc#1266765). - net: mana: hardening: Reject zero max_num_queues from GDMA_QUERY_MAX_RESOURCES (git-fixes). - drm/hyperv: validate VMBus packet size in receive callback (git-fixes). - drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes). - net: mana: Skip redundant detach on already-detached port (git-fixes). - net: mana: Add NULL guards in teardown path to prevent panic on attach failure (git-fixes). - RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port (git-fixes). - net: mana: validate rx_req_idx to prevent out-of-bounds array access (bsc#1266402). - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (bsc#1265928). - commit 81225ae - net: mvpp2: guard flow control update with global_tx_fc in buffer switching (CVE-2026-23438 bsc#1261619) - commit c2bc3dd - net: bonding: fix NULL deref in bond_debug_rlb_hash_show (CVE-2026-31546 bsc#1263006) - commit ec64778 - 9p/xen: protect xen_9pfs_front_free against concurrent calls (bsc#1264476 CVE-2026-43249). - commit efe84aa - net: macb: fix use-after-free access to PTP clock (CVE-2026-31396 bsc#1261791) - commit a390b05 - sched/rt: Skip currently executing CPU in rto_next_cpu() (bsc#1262649). - commit 239586c - RDMA/rxe: Fix race condition in QP timer handlers (CVE-2026-45910 bsc#1266889) - commit d80968b - RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852 bsc#1266711) - commit 16dd3c8 - cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() (CVE-2026-23327 bsc#1260548) - commit 27dbf08 - nfc: llcp: add missing return after LLCP_CLOSED checks (CVE-2026-31629 bsc#1263790) - commit db86873 - smb: client: Don't log plaintext credentials in cifs_set_cifscreds (CVE-2026-23303 bsc#1260502) - commit 53c0ff0 - team: avoid NETDEV_CHANGEMTU event when unregistering slave (CVE-2026-43234 bsc#1264409). - commit 6b7c409 - tipc: fix divide-by-zero in tipc_sk_filter_connect() (CVE-2026-43411 bsc#1264672) - commit 32611e5 - net: stmmac: Prevent NULL deref when RX memory exhausted (CVE-2026-46110 bsc#1266759). - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() (CVE-2026-46110 bsc#1266759). - net/mlx5: lag: Check for LAG device before creating debugfs (CVE-2026-43013 bsc#1264011). - commit b15f093 - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043 bsc#1266901) - commit 909d78b - esp: fix skb leak with espintcp and async crypto (CVE-2026-31518 bsc#1262606) - commit f42cbf9 - packaging: Replace compute-PATCHVERSION with python implementation This script is copied by kkspec to the package directory and called from there. That means that libraries from kernel-source cannot be loaded, and that's the reason why the script is appended to the library that is most useful for it. compute-PATCHVERSION and mkspec are no longer shipped in rpm packages which means compute-PATCHVERSION could be folded into mkspec, and that in turn into tar-up. However, these are all written in different languages. - commit de458e0 - kabi: arm: io: Export ioremap_prot() symbol v2 (CVE-2026-23346 bsc#1260529 bsc#1266993) First version of this kABI fix missed that ioremap_prot() now accept only user-space mappings which breaks any out of tree KMP's which used the function for legitimate kernel IO mappings. Lets fix this by allowing kernel mappings and at same time properly handle user-space mappings [1] 9625623795d3 ("kabi: arm: io: Export ioremap_prot() symbol (CVE-2026-23346 bsc#1260529)") - commit 223d255 - btrfs: reserve enough transaction items for qgroup ioctls (CVE-2026-43338 bsc#1264716). - commit 9eef1bf - btrfs: fix transaction abort on set received ioctl due to item overflow (CVE-2026-43359 bsc#1264719). - commit 847b693 - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() (git-fixes). - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem (git-fixes). - Input: xpad - fix out-of-bounds access for Share button (git-fixes). - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size (git-fixes). - commit f75d3d9 ++++ kernel-rt: - net: mana: Expose hardware diagnostic info via debugfs (bsc#1266414). - net: mana: Use kvmalloc for large RX queue and buffer allocations (bsc#1266765). - net: mana: Use per-queue allocation for tx_qp to reduce allocation size (bsc#1266765). - net: mana: hardening: Reject zero max_num_queues from GDMA_QUERY_MAX_RESOURCES (git-fixes). - drm/hyperv: validate VMBus packet size in receive callback (git-fixes). - drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes). - net: mana: Skip redundant detach on already-detached port (git-fixes). - net: mana: Add NULL guards in teardown path to prevent panic on attach failure (git-fixes). - RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port (git-fixes). - net: mana: validate rx_req_idx to prevent out-of-bounds array access (bsc#1266402). - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (bsc#1265928). - commit 81225ae - net: mvpp2: guard flow control update with global_tx_fc in buffer switching (CVE-2026-23438 bsc#1261619) - commit c2bc3dd - net: bonding: fix NULL deref in bond_debug_rlb_hash_show (CVE-2026-31546 bsc#1263006) - commit ec64778 - 9p/xen: protect xen_9pfs_front_free against concurrent calls (bsc#1264476 CVE-2026-43249). - commit efe84aa - net: macb: fix use-after-free access to PTP clock (CVE-2026-31396 bsc#1261791) - commit a390b05 - sched/rt: Skip currently executing CPU in rto_next_cpu() (bsc#1262649). - commit 239586c - RDMA/rxe: Fix race condition in QP timer handlers (CVE-2026-45910 bsc#1266889) - commit d80968b - RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852 bsc#1266711) - commit 16dd3c8 - cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() (CVE-2026-23327 bsc#1260548) - commit 27dbf08 - nfc: llcp: add missing return after LLCP_CLOSED checks (CVE-2026-31629 bsc#1263790) - commit db86873 - smb: client: Don't log plaintext credentials in cifs_set_cifscreds (CVE-2026-23303 bsc#1260502) - commit 53c0ff0 - team: avoid NETDEV_CHANGEMTU event when unregistering slave (CVE-2026-43234 bsc#1264409). - commit 6b7c409 - tipc: fix divide-by-zero in tipc_sk_filter_connect() (CVE-2026-43411 bsc#1264672) - commit 32611e5 - net: stmmac: Prevent NULL deref when RX memory exhausted (CVE-2026-46110 bsc#1266759). - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() (CVE-2026-46110 bsc#1266759). - net/mlx5: lag: Check for LAG device before creating debugfs (CVE-2026-43013 bsc#1264011). - commit b15f093 - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043 bsc#1266901) - commit 909d78b - esp: fix skb leak with espintcp and async crypto (CVE-2026-31518 bsc#1262606) - commit f42cbf9 - packaging: Replace compute-PATCHVERSION with python implementation This script is copied by kkspec to the package directory and called from there. That means that libraries from kernel-source cannot be loaded, and that's the reason why the script is appended to the library that is most useful for it. compute-PATCHVERSION and mkspec are no longer shipped in rpm packages which means compute-PATCHVERSION could be folded into mkspec, and that in turn into tar-up. However, these are all written in different languages. - commit de458e0 - kabi: arm: io: Export ioremap_prot() symbol v2 (CVE-2026-23346 bsc#1260529 bsc#1266993) First version of this kABI fix missed that ioremap_prot() now accept only user-space mappings which breaks any out of tree KMP's which used the function for legitimate kernel IO mappings. Lets fix this by allowing kernel mappings and at same time properly handle user-space mappings [1] 9625623795d3 ("kabi: arm: io: Export ioremap_prot() symbol (CVE-2026-23346 bsc#1260529)") - commit 223d255 - btrfs: reserve enough transaction items for qgroup ioctls (CVE-2026-43338 bsc#1264716). - commit 9eef1bf - btrfs: fix transaction abort on set received ioctl due to item overflow (CVE-2026-43359 bsc#1264719). - commit 847b693 - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() (git-fixes). - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem (git-fixes). - Input: xpad - fix out-of-bounds access for Share button (git-fixes). - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size (git-fixes). - commit f75d3d9 ++++ kernel-rt_debug: - net: mana: Expose hardware diagnostic info via debugfs (bsc#1266414). - net: mana: Use kvmalloc for large RX queue and buffer allocations (bsc#1266765). - net: mana: Use per-queue allocation for tx_qp to reduce allocation size (bsc#1266765). - net: mana: hardening: Reject zero max_num_queues from GDMA_QUERY_MAX_RESOURCES (git-fixes). - drm/hyperv: validate VMBus packet size in receive callback (git-fixes). - drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes). - net: mana: Skip redundant detach on already-detached port (git-fixes). - net: mana: Add NULL guards in teardown path to prevent panic on attach failure (git-fixes). - RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port (git-fixes). - net: mana: validate rx_req_idx to prevent out-of-bounds array access (bsc#1266402). - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (bsc#1265928). - commit 81225ae - net: mvpp2: guard flow control update with global_tx_fc in buffer switching (CVE-2026-23438 bsc#1261619) - commit c2bc3dd - net: bonding: fix NULL deref in bond_debug_rlb_hash_show (CVE-2026-31546 bsc#1263006) - commit ec64778 - 9p/xen: protect xen_9pfs_front_free against concurrent calls (bsc#1264476 CVE-2026-43249). - commit efe84aa - net: macb: fix use-after-free access to PTP clock (CVE-2026-31396 bsc#1261791) - commit a390b05 - sched/rt: Skip currently executing CPU in rto_next_cpu() (bsc#1262649). - commit 239586c - RDMA/rxe: Fix race condition in QP timer handlers (CVE-2026-45910 bsc#1266889) - commit d80968b - RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852 bsc#1266711) - commit 16dd3c8 - cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() (CVE-2026-23327 bsc#1260548) - commit 27dbf08 - nfc: llcp: add missing return after LLCP_CLOSED checks (CVE-2026-31629 bsc#1263790) - commit db86873 - smb: client: Don't log plaintext credentials in cifs_set_cifscreds (CVE-2026-23303 bsc#1260502) - commit 53c0ff0 - team: avoid NETDEV_CHANGEMTU event when unregistering slave (CVE-2026-43234 bsc#1264409). - commit 6b7c409 - tipc: fix divide-by-zero in tipc_sk_filter_connect() (CVE-2026-43411 bsc#1264672) - commit 32611e5 - net: stmmac: Prevent NULL deref when RX memory exhausted (CVE-2026-46110 bsc#1266759). - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() (CVE-2026-46110 bsc#1266759). - net/mlx5: lag: Check for LAG device before creating debugfs (CVE-2026-43013 bsc#1264011). - commit b15f093 - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043 bsc#1266901) - commit 909d78b - esp: fix skb leak with espintcp and async crypto (CVE-2026-31518 bsc#1262606) - commit f42cbf9 - packaging: Replace compute-PATCHVERSION with python implementation This script is copied by kkspec to the package directory and called from there. That means that libraries from kernel-source cannot be loaded, and that's the reason why the script is appended to the library that is most useful for it. compute-PATCHVERSION and mkspec are no longer shipped in rpm packages which means compute-PATCHVERSION could be folded into mkspec, and that in turn into tar-up. However, these are all written in different languages. - commit de458e0 - kabi: arm: io: Export ioremap_prot() symbol v2 (CVE-2026-23346 bsc#1260529 bsc#1266993) First version of this kABI fix missed that ioremap_prot() now accept only user-space mappings which breaks any out of tree KMP's which used the function for legitimate kernel IO mappings. Lets fix this by allowing kernel mappings and at same time properly handle user-space mappings [1] 9625623795d3 ("kabi: arm: io: Export ioremap_prot() symbol (CVE-2026-23346 bsc#1260529)") - commit 223d255 - btrfs: reserve enough transaction items for qgroup ioctls (CVE-2026-43338 bsc#1264716). - commit 9eef1bf - btrfs: fix transaction abort on set received ioctl due to item overflow (CVE-2026-43359 bsc#1264719). - commit 847b693 - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() (git-fixes). - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem (git-fixes). - Input: xpad - fix out-of-bounds access for Share button (git-fixes). - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size (git-fixes). - commit f75d3d9 ++++ openssh: - Add patch rebased from upstream to add missing askpass check for proxy-mode multiplexing sessions (CVE-2026-35388, bsc#1261441): * openssh-cve-2026-35388-askpass-multiplexing.patch - Update patch to fix a possible information disclosure or denial of service due to uninitialized variables in gssapi patches (CVE-2026-3497, bsc#1259642) : * openssh-8.0p1-gssapi-keyex.patch ------------------------------------------------------------------ ------------------ 2026-5-31 - May 31 2026 ------------------- ------------------------------------------------------------------ ++++ python-kiwi: - Drop parted requirement for msdos partitioner parted was used in kiwi at one place to set the active flag on a partition in the DOS table. This action can also be done via sfdisk and drops the parted requirement from the kiwi builder code ++++ kernel-default: - USB: serial: cypress_m8: validate interrupt packet headers (git-fixes). - USB: serial: safe_serial: fix memory corruption with small endpoint (git-fixes). - USB: serial: omninet: fix memory corruption with small endpoint (git-fixes). - USB: serial: mxuport: fix memory corruption with small endpoint (git-fixes). - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL (git-fixes). - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (git-fixes). - USB: serial: keyspan: fix missing indat transfer sanity check (git-fixes). - USB: serial: belkin_sa: validate interrupt status length (git-fixes). - USB: cdc-acm: Fix bit overlap and move quirk definitions to header (git-fixes). - usb: dwc2: Fix use after free in debug code (git-fixes). - usb: chipidea: core: convert ci_role_switch to local variable (git-fixes). - usb: gadget: f_fs: copy only received bytes on short ep0 read (git-fixes). - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports (git-fixes). - usbip: vudc: Fix use after free bug in vudc_remove due to race condition (git-fixes). - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize (git-fixes). - usb: usbtmc: check URB actual_length for interrupt-IN notifications (git-fixes). - usb: gadget: net2280: Fix double free in probe error path (git-fixes). - usb: gadget: f_hid: fix device reference leak in hidg_alloc() (git-fixes). - usb: cdns3: gadget: fix request skipping after clearing halt (git-fixes). - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles (git-fixes). - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling (git-fixes). - tty: serial: pch_uart: add check for dma_alloc_coherent() (git-fixes). - commit 2bf3f1e - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow (git-fixes). - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (git-fixes). - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma (git-fixes). - serial: qcom-geni: fix UART_RX_PAR_EN bit position (git-fixes). - parport: Fix race between port and client registration (git-fixes). - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() (git-fixes). - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() (git-fixes). - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw (git-fixes). - iio: gyro: itg3200: fix i2c read into the wrong stack location (git-fixes). - iio: dac: ad5686: acquire lock when doing powerdown control (git-fixes). - iio: temperature: tsys01: fix broken PROM checksum validation (git-fixes). - iio: buffer: hw-consumer: fix use-after-free in error path (git-fixes). - iio: dac: ad5686: fix input raw value check (git-fixes). - iio: ssp_sensors: cancel delayed work_refresh on remove (git-fixes). - iio: dac: max5821: fix return value check in powerdown sync (git-fixes). - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer (git-fixes). - iio: light: cm3323: fix reg_conf not being initialized correctly (git-fixes). - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL (git-fixes). - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux (git-fixes). - drm/hyperv: validate VMBus packet size in receive callback (git-fixes). - drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes). - drm/amd/pm/si: Disregard vblank time when no displays are connected (git-fixes). - drm/i915: Fix potential UAF in TTM object purge (git-fixes). - commit 129155c ++++ kernel-rt: - USB: serial: cypress_m8: validate interrupt packet headers (git-fixes). - USB: serial: safe_serial: fix memory corruption with small endpoint (git-fixes). - USB: serial: omninet: fix memory corruption with small endpoint (git-fixes). - USB: serial: mxuport: fix memory corruption with small endpoint (git-fixes). - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL (git-fixes). - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (git-fixes). - USB: serial: keyspan: fix missing indat transfer sanity check (git-fixes). - USB: serial: belkin_sa: validate interrupt status length (git-fixes). - USB: cdc-acm: Fix bit overlap and move quirk definitions to header (git-fixes). - usb: dwc2: Fix use after free in debug code (git-fixes). - usb: chipidea: core: convert ci_role_switch to local variable (git-fixes). - usb: gadget: f_fs: copy only received bytes on short ep0 read (git-fixes). - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports (git-fixes). - usbip: vudc: Fix use after free bug in vudc_remove due to race condition (git-fixes). - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize (git-fixes). - usb: usbtmc: check URB actual_length for interrupt-IN notifications (git-fixes). - usb: gadget: net2280: Fix double free in probe error path (git-fixes). - usb: gadget: f_hid: fix device reference leak in hidg_alloc() (git-fixes). - usb: cdns3: gadget: fix request skipping after clearing halt (git-fixes). - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles (git-fixes). - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling (git-fixes). - tty: serial: pch_uart: add check for dma_alloc_coherent() (git-fixes). - commit 2bf3f1e - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow (git-fixes). - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (git-fixes). - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma (git-fixes). - serial: qcom-geni: fix UART_RX_PAR_EN bit position (git-fixes). - parport: Fix race between port and client registration (git-fixes). - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() (git-fixes). - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() (git-fixes). - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw (git-fixes). - iio: gyro: itg3200: fix i2c read into the wrong stack location (git-fixes). - iio: dac: ad5686: acquire lock when doing powerdown control (git-fixes). - iio: temperature: tsys01: fix broken PROM checksum validation (git-fixes). - iio: buffer: hw-consumer: fix use-after-free in error path (git-fixes). - iio: dac: ad5686: fix input raw value check (git-fixes). - iio: ssp_sensors: cancel delayed work_refresh on remove (git-fixes). - iio: dac: max5821: fix return value check in powerdown sync (git-fixes). - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer (git-fixes). - iio: light: cm3323: fix reg_conf not being initialized correctly (git-fixes). - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL (git-fixes). - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux (git-fixes). - drm/hyperv: validate VMBus packet size in receive callback (git-fixes). - drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes). - drm/amd/pm/si: Disregard vblank time when no displays are connected (git-fixes). - drm/i915: Fix potential UAF in TTM object purge (git-fixes). - commit 129155c ++++ kernel-rt_debug: - USB: serial: cypress_m8: validate interrupt packet headers (git-fixes). - USB: serial: safe_serial: fix memory corruption with small endpoint (git-fixes). - USB: serial: omninet: fix memory corruption with small endpoint (git-fixes). - USB: serial: mxuport: fix memory corruption with small endpoint (git-fixes). - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL (git-fixes). - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (git-fixes). - USB: serial: keyspan: fix missing indat transfer sanity check (git-fixes). - USB: serial: belkin_sa: validate interrupt status length (git-fixes). - USB: cdc-acm: Fix bit overlap and move quirk definitions to header (git-fixes). - usb: dwc2: Fix use after free in debug code (git-fixes). - usb: chipidea: core: convert ci_role_switch to local variable (git-fixes). - usb: gadget: f_fs: copy only received bytes on short ep0 read (git-fixes). - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports (git-fixes). - usbip: vudc: Fix use after free bug in vudc_remove due to race condition (git-fixes). - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize (git-fixes). - usb: usbtmc: check URB actual_length for interrupt-IN notifications (git-fixes). - usb: gadget: net2280: Fix double free in probe error path (git-fixes). - usb: gadget: f_hid: fix device reference leak in hidg_alloc() (git-fixes). - usb: cdns3: gadget: fix request skipping after clearing halt (git-fixes). - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles (git-fixes). - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling (git-fixes). - tty: serial: pch_uart: add check for dma_alloc_coherent() (git-fixes). - commit 2bf3f1e - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow (git-fixes). - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (git-fixes). - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma (git-fixes). - serial: qcom-geni: fix UART_RX_PAR_EN bit position (git-fixes). - parport: Fix race between port and client registration (git-fixes). - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() (git-fixes). - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() (git-fixes). - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw (git-fixes). - iio: gyro: itg3200: fix i2c read into the wrong stack location (git-fixes). - iio: dac: ad5686: acquire lock when doing powerdown control (git-fixes). - iio: temperature: tsys01: fix broken PROM checksum validation (git-fixes). - iio: buffer: hw-consumer: fix use-after-free in error path (git-fixes). - iio: dac: ad5686: fix input raw value check (git-fixes). - iio: ssp_sensors: cancel delayed work_refresh on remove (git-fixes). - iio: dac: max5821: fix return value check in powerdown sync (git-fixes). - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer (git-fixes). - iio: light: cm3323: fix reg_conf not being initialized correctly (git-fixes). - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL (git-fixes). - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux (git-fixes). - drm/hyperv: validate VMBus packet size in receive callback (git-fixes). - drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes). - drm/amd/pm/si: Disregard vblank time when no displays are connected (git-fixes). - drm/i915: Fix potential UAF in TTM object purge (git-fixes). - commit 129155c ------------------------------------------------------------------ ------------------ 2026-5-30 - May 30 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (git-fixes). - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (git-fixes). - Bluetooth: ISO: fix UAF in iso_recv_frame (git-fixes). - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (git-fixes). - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success (git-fixes). - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() (git-fixes). - Bluetooth: btusb: Allow firmware re-download when version matches (git-fixes). - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (git-fixes). - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (git-fixes). - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (git-fixes). - ASoC: codecs: simple-mux: Fix enum control bounds check (git-fixes). - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params (git-fixes). - ASoC: qcom: q6asm-dai: close stream only when running (git-fixes). - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks (git-fixes). - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() (git-fixes). - commit 5cccd97 ++++ kernel-rt: - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (git-fixes). - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (git-fixes). - Bluetooth: ISO: fix UAF in iso_recv_frame (git-fixes). - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (git-fixes). - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success (git-fixes). - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() (git-fixes). - Bluetooth: btusb: Allow firmware re-download when version matches (git-fixes). - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (git-fixes). - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (git-fixes). - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (git-fixes). - ASoC: codecs: simple-mux: Fix enum control bounds check (git-fixes). - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params (git-fixes). - ASoC: qcom: q6asm-dai: close stream only when running (git-fixes). - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks (git-fixes). - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() (git-fixes). - commit 5cccd97 ++++ kernel-rt_debug: - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (git-fixes). - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (git-fixes). - Bluetooth: ISO: fix UAF in iso_recv_frame (git-fixes). - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (git-fixes). - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success (git-fixes). - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() (git-fixes). - Bluetooth: btusb: Allow firmware re-download when version matches (git-fixes). - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (git-fixes). - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (git-fixes). - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (git-fixes). - ASoC: codecs: simple-mux: Fix enum control bounds check (git-fixes). - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params (git-fixes). - ASoC: qcom: q6asm-dai: close stream only when running (git-fixes). - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks (git-fixes). - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() (git-fixes). - commit 5cccd97 ------------------------------------------------------------------ ------------------ 2026-5-29 - May 29 2026 ------------------- ------------------------------------------------------------------ ++++ firewalld: - CVE-2026-4948: Fix D-Bus setter authorization vulnerability that allowed local unprivileged users to modify firewall state (bsc#1260903) * CVE-2026-4948-fix-dbus-setter-authorizations.patch ++++ kernel-default: - btrfs: fix transaction abort when snapshotting received subvolumes (CVE-2026-43361 bsc#1264722). - commit 68eb967 - btrfs: fix transaction abort on file creation due to name hash collision (CVE-2026-43360 bsc#1264720). - commit 335b528 - wifi: iwlwifi: mvm: don't send a 6E related command when not supported (CVE-2026-43325 bsc#1265110). - commit 3c8b5bc - smb: client: reject userspace cifs.spnego descriptions (bsc#1266238). - commit b2ca6ab - drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode (CVE-2026-31767 bsc#1264124). - commit f45f094 - iommu/amd: Use maximum PPR log buffer size when SNP is enabled on Family 0x19 (bsc#1243603 CVE-2023-20585). - commit 993ad90 - KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC (git-fixes). - commit 671dbfb - KVM: X86: Fix array_index_nospec protection in __pv_send_ipi (git-fixes). - commit ef45aed - iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 (bsc#1243603 CVE-2023-20585). - commit 1185f18 - Refresh patches.suse/selftests-bpf-Add-more-precision-tracking-tests-for-.patch. (CVE-2026-43009 bsc#1264014) - commit 1de8df8 - selftests/bpf: add test for nullable PTR_TO_BUF access (CVE-2026-43333 bsc#1264726). - commit 9b6669a - bpf: reject direct access to nullable PTR_TO_BUF pointers (CVE-2026-43333 bsc#1264726). - commit 8b12683 ++++ kernel-rt: - btrfs: fix transaction abort when snapshotting received subvolumes (CVE-2026-43361 bsc#1264722). - commit 68eb967 - btrfs: fix transaction abort on file creation due to name hash collision (CVE-2026-43360 bsc#1264720). - commit 335b528 - wifi: iwlwifi: mvm: don't send a 6E related command when not supported (CVE-2026-43325 bsc#1265110). - commit 3c8b5bc - smb: client: reject userspace cifs.spnego descriptions (bsc#1266238). - commit b2ca6ab - drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode (CVE-2026-31767 bsc#1264124). - commit f45f094 - iommu/amd: Use maximum PPR log buffer size when SNP is enabled on Family 0x19 (bsc#1243603 CVE-2023-20585). - commit 993ad90 - KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC (git-fixes). - commit 671dbfb - KVM: X86: Fix array_index_nospec protection in __pv_send_ipi (git-fixes). - commit ef45aed - iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 (bsc#1243603 CVE-2023-20585). - commit 1185f18 - Refresh patches.suse/selftests-bpf-Add-more-precision-tracking-tests-for-.patch. (CVE-2026-43009 bsc#1264014) - commit 1de8df8 - selftests/bpf: add test for nullable PTR_TO_BUF access (CVE-2026-43333 bsc#1264726). - commit 9b6669a - bpf: reject direct access to nullable PTR_TO_BUF pointers (CVE-2026-43333 bsc#1264726). - commit 8b12683 ++++ kernel-rt_debug: - btrfs: fix transaction abort when snapshotting received subvolumes (CVE-2026-43361 bsc#1264722). - commit 68eb967 - btrfs: fix transaction abort on file creation due to name hash collision (CVE-2026-43360 bsc#1264720). - commit 335b528 - wifi: iwlwifi: mvm: don't send a 6E related command when not supported (CVE-2026-43325 bsc#1265110). - commit 3c8b5bc - smb: client: reject userspace cifs.spnego descriptions (bsc#1266238). - commit b2ca6ab - drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode (CVE-2026-31767 bsc#1264124). - commit f45f094 - iommu/amd: Use maximum PPR log buffer size when SNP is enabled on Family 0x19 (bsc#1243603 CVE-2023-20585). - commit 993ad90 - KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC (git-fixes). - commit 671dbfb - KVM: X86: Fix array_index_nospec protection in __pv_send_ipi (git-fixes). - commit ef45aed - iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 (bsc#1243603 CVE-2023-20585). - commit 1185f18 - Refresh patches.suse/selftests-bpf-Add-more-precision-tracking-tests-for-.patch. (CVE-2026-43009 bsc#1264014) - commit 1de8df8 - selftests/bpf: add test for nullable PTR_TO_BUF access (CVE-2026-43333 bsc#1264726). - commit 9b6669a - bpf: reject direct access to nullable PTR_TO_BUF pointers (CVE-2026-43333 bsc#1264726). - commit 8b12683 ++++ libzypp: - Fix potential crash on malformed or malicious repository metadata (fixes #740) - version 17.38.11 (35) ++++ qemu: - Take care of bsc#1199023: * [openSUSE] qemu-ga: fix service file against no-autostart (bsc#1199023) ------------------------------------------------------------------ ------------------ 2026-5-28 - May 28 2026 ------------------- ------------------------------------------------------------------ ++++ ignition: - Add CVE-2026-33814.patch * Fixes [bsc#1265751] ++++ kernel-default: - xfrm: prevent policy_hthresh.work from racing with netns teardown (CVE-2026-31516 bsc#1262755). - commit 5ec6779 - mptcp: pm: in-kernel: always set ID as avail when rm endp (CVE-2026-43252 bsc#1264300). - commit f1372d7 - net/ipv6: ioam6: prevent schema length wraparound in trace fill (CVE-2026-43341 bsc#1265044). - commit 26ee766 - slip: bound decode() reads against the compressed packet length (CVE-2026-45843 bsc#1266395). - commit c9770c0 - s390/entry: Scrub r12 register on kernel entry (bsc#1263068). - s390/syscalls: Add spectre boundary for syscall dispatch table (bsc#1263068). - s390/barrier: Make array_index_mask_nospec() __always_inline (bsc#1263068). - commit f6cfac6 - tracing: Fix potential deadlock in cpu hotplug with osnoise (CVE-2026-31480 bsc#1262634). - tracing: Switch trace_osnoise.c code over to use guard() and __free() (bsc#1262634). - commit 6db35fe - bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584 CVE-2026-23359). - commit 0fb7dc1 - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (CVE-2026-23444 bsc#1266307). - commit a948d1e - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206 bsc#1264551). - commit 7f880f2 - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (CVE-2026-43296 bsc#1264805). - commit f336a2d ++++ kernel-rt: - xfrm: prevent policy_hthresh.work from racing with netns teardown (CVE-2026-31516 bsc#1262755). - commit 5ec6779 - mptcp: pm: in-kernel: always set ID as avail when rm endp (CVE-2026-43252 bsc#1264300). - commit f1372d7 - net/ipv6: ioam6: prevent schema length wraparound in trace fill (CVE-2026-43341 bsc#1265044). - commit 26ee766 - slip: bound decode() reads against the compressed packet length (CVE-2026-45843 bsc#1266395). - commit c9770c0 - s390/entry: Scrub r12 register on kernel entry (bsc#1263068). - s390/syscalls: Add spectre boundary for syscall dispatch table (bsc#1263068). - s390/barrier: Make array_index_mask_nospec() __always_inline (bsc#1263068). - commit f6cfac6 - tracing: Fix potential deadlock in cpu hotplug with osnoise (CVE-2026-31480 bsc#1262634). - tracing: Switch trace_osnoise.c code over to use guard() and __free() (bsc#1262634). - commit 6db35fe - bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584 CVE-2026-23359). - commit 0fb7dc1 - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (CVE-2026-23444 bsc#1266307). - commit a948d1e - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206 bsc#1264551). - commit 7f880f2 - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (CVE-2026-43296 bsc#1264805). - commit f336a2d ++++ kernel-rt_debug: - xfrm: prevent policy_hthresh.work from racing with netns teardown (CVE-2026-31516 bsc#1262755). - commit 5ec6779 - mptcp: pm: in-kernel: always set ID as avail when rm endp (CVE-2026-43252 bsc#1264300). - commit f1372d7 - net/ipv6: ioam6: prevent schema length wraparound in trace fill (CVE-2026-43341 bsc#1265044). - commit 26ee766 - slip: bound decode() reads against the compressed packet length (CVE-2026-45843 bsc#1266395). - commit c9770c0 - s390/entry: Scrub r12 register on kernel entry (bsc#1263068). - s390/syscalls: Add spectre boundary for syscall dispatch table (bsc#1263068). - s390/barrier: Make array_index_mask_nospec() __always_inline (bsc#1263068). - commit f6cfac6 - tracing: Fix potential deadlock in cpu hotplug with osnoise (CVE-2026-31480 bsc#1262634). - tracing: Switch trace_osnoise.c code over to use guard() and __free() (bsc#1262634). - commit 6db35fe - bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584 CVE-2026-23359). - commit 0fb7dc1 - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (CVE-2026-23444 bsc#1266307). - commit a948d1e - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206 bsc#1264551). - commit 7f880f2 - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (CVE-2026-43296 bsc#1264805). - commit f336a2d ++++ libsolv: - fix solv_chksum_free segfault when called with a NULL pointer - bump version to 0.7.39 ++++ nvidia-open-driver-G06-signed: - linux-7.0.patch * adjust driver to changes of screen_info with Kernel 7.0, which broke the driver completely (boo#1263825); see also https://forums.developer.nvidia.com/t/linux-driver-595-71-05-still-tries-to-use-screen-info-struct-which-was-refactored-in-7-0-kernel/370825 ++++ openSUSE-build-key: - extended to openSUSE 4096bit RSA key for 4 more years. gpg-pubkey-29b700a4-6a17fa38.asc ------------------------------------------------------------------ ------------------ 2026-5-27 - May 27 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - bcache: fix uninitialized closure object (git-fixes). - commit d35dc31 - bcache: fix cached_dev.sb_bio use-after-free and crash (CVE-2026-3150 bsc#1263169). - scsi: target: tcm_loop: Drain commands in target_reset handler (CVE-2026-43054 bsc#1264063). - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (CVE-2026-31464 bsc#1262656). - scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414 bsc#1264669). - commit b1bc3f3 - rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001 CVE-2026-43499). - commit f92fa24 - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501 bsc#1266009). - commit d86aabe - ip6_tunnel: clear skb2->cb in ip4ip6_err() (CVE-2026-43037 bsc#1263995). - commit 60e0626 - Improve compatibility with awk 2.4.0 (bsc#1266214) This was meant to match the literal '+', so it needs to be backslashed not a repetition of the '^' symbol. - commit fbbce3e - media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (CVE-2026-31473 bsc#1262663). - commit 3f03cf7 - Update patches.suse/net-skbuff-propagate-shared-frag-marker-through-frag-trans.patch (CVE-2026-43503 bsc#1265960 CVE-2026-43284 bsc#1264449). - Update patches.suse/xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch (CVE-2026-43284 bsc#1264449). Add references and move to the sorted section. - commit 83a3405 - RDMA/efa: Fix possible deadlock (git-fixes) - commit b9b2bbf - RDMA/efa: Fix use of completion ctx after free (CVE-2026-31493 bsc#1262668) - commit 3fa0669 - RDMA/efa: Improve admin completion context state machine (git-fixes) - commit 8e8c981 - RDMA/efa: Extend admin timeout error print (git-fixes) - commit 4d9f061 - RDMA/efa: Check stored completion CTX command ID with received one (git-fixes) - commit f0e6a90 ++++ kernel-rt: - bcache: fix uninitialized closure object (git-fixes). - commit d35dc31 - bcache: fix cached_dev.sb_bio use-after-free and crash (CVE-2026-3150 bsc#1263169). - scsi: target: tcm_loop: Drain commands in target_reset handler (CVE-2026-43054 bsc#1264063). - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (CVE-2026-31464 bsc#1262656). - scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414 bsc#1264669). - commit b1bc3f3 - rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001 CVE-2026-43499). - commit f92fa24 - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501 bsc#1266009). - commit d86aabe - ip6_tunnel: clear skb2->cb in ip4ip6_err() (CVE-2026-43037 bsc#1263995). - commit 60e0626 - Improve compatibility with awk 2.4.0 (bsc#1266214) This was meant to match the literal '+', so it needs to be backslashed not a repetition of the '^' symbol. - commit fbbce3e - media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (CVE-2026-31473 bsc#1262663). - commit 3f03cf7 - Update patches.suse/net-skbuff-propagate-shared-frag-marker-through-frag-trans.patch (CVE-2026-43503 bsc#1265960 CVE-2026-43284 bsc#1264449). - Update patches.suse/xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch (CVE-2026-43284 bsc#1264449). Add references and move to the sorted section. - commit 83a3405 - RDMA/efa: Fix possible deadlock (git-fixes) - commit b9b2bbf - RDMA/efa: Fix use of completion ctx after free (CVE-2026-31493 bsc#1262668) - commit 3fa0669 - RDMA/efa: Improve admin completion context state machine (git-fixes) - commit 8e8c981 - RDMA/efa: Extend admin timeout error print (git-fixes) - commit 4d9f061 - RDMA/efa: Check stored completion CTX command ID with received one (git-fixes) - commit f0e6a90 ++++ kernel-rt_debug: - bcache: fix uninitialized closure object (git-fixes). - commit d35dc31 - bcache: fix cached_dev.sb_bio use-after-free and crash (CVE-2026-3150 bsc#1263169). - scsi: target: tcm_loop: Drain commands in target_reset handler (CVE-2026-43054 bsc#1264063). - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (CVE-2026-31464 bsc#1262656). - scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414 bsc#1264669). - commit b1bc3f3 - rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001 CVE-2026-43499). - commit f92fa24 - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501 bsc#1266009). - commit d86aabe - ip6_tunnel: clear skb2->cb in ip4ip6_err() (CVE-2026-43037 bsc#1263995). - commit 60e0626 - Improve compatibility with awk 2.4.0 (bsc#1266214) This was meant to match the literal '+', so it needs to be backslashed not a repetition of the '^' symbol. - commit fbbce3e - media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (CVE-2026-31473 bsc#1262663). - commit 3f03cf7 - Update patches.suse/net-skbuff-propagate-shared-frag-marker-through-frag-trans.patch (CVE-2026-43503 bsc#1265960 CVE-2026-43284 bsc#1264449). - Update patches.suse/xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch (CVE-2026-43284 bsc#1264449). Add references and move to the sorted section. - commit 83a3405 - RDMA/efa: Fix possible deadlock (git-fixes) - commit b9b2bbf - RDMA/efa: Fix use of completion ctx after free (CVE-2026-31493 bsc#1262668) - commit 3fa0669 - RDMA/efa: Improve admin completion context state machine (git-fixes) - commit 8e8c981 - RDMA/efa: Extend admin timeout error print (git-fixes) - commit 4d9f061 - RDMA/efa: Check stored completion CTX command ID with received one (git-fixes) - commit f0e6a90 ++++ libsoup: - Add libsoup-CVE-2026-1801.patch: Use CRLF as line boundary when parsing chunk encoding data (bsc#1257649 CVE-2026-1801 glgo#GNOME/libsoup#481). - Add libsoup-CVE-2026-4271.patch: Protect message io while reading and writing (bsc#1259767, CVE-2026-4271, glgo#GNOME/libsoup#496). ++++ libzypp: - Repo metadata: discard entries referring to a location outside the repo (bsc#1259802, CVE-2026-25707) Mirroring those data locally would refer to a location outside the repo's local cache directory. Those data entries are reported and discarded. - zypp.conf: Allow [env] section to add environment variables. This feature is designed to enable environment-specific settings or debugging options over an extended period. See zypp.conf(5). - version 17.38.10 (35) ------------------------------------------------------------------ ------------------ 2026-5-26 - May 26 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - wifi: mac80211: check tdls flag in ieee80211_tdls_oper (CVE-2026-43052 bsc#1263945). - commit e6ee8c1 - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (CVE-2026-31590 bsc#1263152). - commit 4957e7f - openvswitch: vport: fix self-deadlock on release of tunnel ports (CVE-2026-31678 bsc#1263562). - commit 7eb6b28 - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CVE-2026-43483 bsc#1265240). - commit de0bf57 - smb: client: fix in-place encryption corruption in SMB2_write() (bsc#1264989 CVE-2026-43362) - commit 2633e79 - compute-PATCHVERSION: Do not append .. to default patch directories All the callers are either using . or a specific patch directory. If a caller really needs to load patches from .. it should be passed as parameter. - commit d383394 - compute-PATCHVERSION: Remove unpack logic This used to be needed when compute-PATCHVERSION was shipped as part of the rpm package where unpacked patches are not available. It is not done annymore, and the unpackinng is not needed. - commit 9a8fa0e - openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678 bsc#1263562). - commit c40a933 - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested [#]VMEXIT (git-fixes). - commit ec599f4 - KVM: x86: Fix Xen hypercall tracepoint argument assignment (git-fixes). - commit bee29ed - packaging: Rip out extra symbols support Extra symbols are not supported for a long time. The oldest branch we maintain is SLE 11 SP1 and it does not use patch guards to select patches. - commit 7b3d5b0 - batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes). - commit f65d5f2 - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() (git-fixes). - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() (git-fixes). - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors (git-fixes). - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple (git-fixes). - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR (git-fixes). - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer (git-fixes). - hwmon: (pmbus/adm1266) include adapter number in GPIO line label (git-fixes). - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer (git-fixes). - hwmon: (pmbus/adm1266) reject implausible blackbox record_count (git-fixes). - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX (git-fixes). - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock (git-fixes). - drm/virtio: use uninterruptible resv lock for plane updates (git-fixes). - drm/bridge: megachips: remove bridge when irq request fails (git-fixes). - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe (git-fixes). - drm/bridge: it66121: acquire reset GPIO in probe (git-fixes). - drm/radeon/evergreen_cs: Add missing NULL prefix check in surface check (git-fixes). - drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets (git-fixes). - drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets (git-fixes). - drm/msm/snapshot: fix dumping of the unaligned regions (git-fixes). - drm/msm/dsi: don't dump registers past the mapped region (git-fixes). - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL (git-fixes). - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL (git-fixes). - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL (git-fixes). - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL (git-fixes). - wifi: ath11k: clear shared SRNG pointer state on restart (git-fixes). - wifi: ath11k: fix use after free in ath11k_dp_rx_msdu_coalesce() (git-fixes). - wifi: ath11k: fix peer resolution on rx path when peer_id=0 (git-fixes). - wifi: ath10k: skip WMI and beacon transmission when device is wedged (git-fixes). - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() (git-fixes). - wifi: ath11k: fix error path leaks in some WMI calls (git-fixes). - wifi: ath11k: fix error path leaks in some WMI WOW calls (git-fixes). - wifi: mac80211: consume only present negotiated TTLM maps (git-fixes). - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (git-fixes). - efi: Allocate runtime workqueue before ACPI init (git-fixes). - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure (git-fixes). - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration (git-fixes). - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated (git-fixes). - r8152: fix incorrect register write to USB_UPHY_XTAL (git-fixes). - drm/amdgpu: fix spelling typos (stable-fixes). - drm/i915: Loop over all active pipes in intel_mbus_dbox_update (stable-fixes). - spi: st-ssc4: switch to use modern name (stable-fixes). - commit 8b80180 - device property: set fwnode->secondary to NULL in fwnode_init() (git-fixes). - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() (git-fixes). - ALSA: ua101: Reject too-short USB descriptors (git-fixes). - batman-adv: bla: fix report_work leak on backbone_gw purge (git-fixes). - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (git-fixes). - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (git-fixes). - Bluetooth: MGMT: validate Add Extended Advertising Data length (git-fixes). - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START (git-fixes). - Bluetooth: bnep: Fix UAF read of dev->name (git-fixes). - batman-adv: frag: disallow unicast fragment in fragment (git-fixes). - batman-adv: tp_meter: avoid use of uninit sender vars (git-fixes). - batman-adv: dat: handle forward allocation error (git-fixes). - batman-adv: clear current gateway during teardown (git-fixes). - batman-adv: fix fragment reassembly length accounting (git-fixes). - batman-adv: tt: fix negative last_changeset_len (git-fixes). - batman-adv: tt: fix negative tt_buff_len (git-fixes). - batman-adv: fix tp_meter counter underflow during shutdown (git-fixes). - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans (git-fixes). - ALSA: usb-audio: Bound MIDI endpoint descriptor scans (git-fixes). - ALSA: sc6000: Keep the programmed board state in card-private data (git-fixes). - ASoC: SOF: Intel: hda: Fix NULL pointer dereference (stable-fixes). - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 (stable-fixes). - ALSA: sc6000: Use standard print API (stable-fixes). - drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() (stable-fixes). - ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio (stable-fixes). - ASoC: SOF: Intel: hda-dai: remove dspless special case (stable-fixes). - commit b214d9a ++++ kernel-rt: - wifi: mac80211: check tdls flag in ieee80211_tdls_oper (CVE-2026-43052 bsc#1263945). - commit e6ee8c1 - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (CVE-2026-31590 bsc#1263152). - commit 4957e7f - openvswitch: vport: fix self-deadlock on release of tunnel ports (CVE-2026-31678 bsc#1263562). - commit 7eb6b28 - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CVE-2026-43483 bsc#1265240). - commit de0bf57 - smb: client: fix in-place encryption corruption in SMB2_write() (bsc#1264989 CVE-2026-43362) - commit 2633e79 - compute-PATCHVERSION: Do not append .. to default patch directories All the callers are either using . or a specific patch directory. If a caller really needs to load patches from .. it should be passed as parameter. - commit d383394 - compute-PATCHVERSION: Remove unpack logic This used to be needed when compute-PATCHVERSION was shipped as part of the rpm package where unpacked patches are not available. It is not done annymore, and the unpackinng is not needed. - commit 9a8fa0e - openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678 bsc#1263562). - commit c40a933 - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested [#]VMEXIT (git-fixes). - commit ec599f4 - KVM: x86: Fix Xen hypercall tracepoint argument assignment (git-fixes). - commit bee29ed - packaging: Rip out extra symbols support Extra symbols are not supported for a long time. The oldest branch we maintain is SLE 11 SP1 and it does not use patch guards to select patches. - commit 7b3d5b0 - batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes). - commit f65d5f2 - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() (git-fixes). - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() (git-fixes). - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors (git-fixes). - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple (git-fixes). - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR (git-fixes). - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer (git-fixes). - hwmon: (pmbus/adm1266) include adapter number in GPIO line label (git-fixes). - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer (git-fixes). - hwmon: (pmbus/adm1266) reject implausible blackbox record_count (git-fixes). - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX (git-fixes). - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock (git-fixes). - drm/virtio: use uninterruptible resv lock for plane updates (git-fixes). - drm/bridge: megachips: remove bridge when irq request fails (git-fixes). - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe (git-fixes). - drm/bridge: it66121: acquire reset GPIO in probe (git-fixes). - drm/radeon/evergreen_cs: Add missing NULL prefix check in surface check (git-fixes). - drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets (git-fixes). - drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets (git-fixes). - drm/msm/snapshot: fix dumping of the unaligned regions (git-fixes). - drm/msm/dsi: don't dump registers past the mapped region (git-fixes). - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL (git-fixes). - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL (git-fixes). - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL (git-fixes). - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL (git-fixes). - wifi: ath11k: clear shared SRNG pointer state on restart (git-fixes). - wifi: ath11k: fix use after free in ath11k_dp_rx_msdu_coalesce() (git-fixes). - wifi: ath11k: fix peer resolution on rx path when peer_id=0 (git-fixes). - wifi: ath10k: skip WMI and beacon transmission when device is wedged (git-fixes). - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() (git-fixes). - wifi: ath11k: fix error path leaks in some WMI calls (git-fixes). - wifi: ath11k: fix error path leaks in some WMI WOW calls (git-fixes). - wifi: mac80211: consume only present negotiated TTLM maps (git-fixes). - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (git-fixes). - efi: Allocate runtime workqueue before ACPI init (git-fixes). - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure (git-fixes). - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration (git-fixes). - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated (git-fixes). - r8152: fix incorrect register write to USB_UPHY_XTAL (git-fixes). - drm/amdgpu: fix spelling typos (stable-fixes). - drm/i915: Loop over all active pipes in intel_mbus_dbox_update (stable-fixes). - spi: st-ssc4: switch to use modern name (stable-fixes). - commit 8b80180 - device property: set fwnode->secondary to NULL in fwnode_init() (git-fixes). - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() (git-fixes). - ALSA: ua101: Reject too-short USB descriptors (git-fixes). - batman-adv: bla: fix report_work leak on backbone_gw purge (git-fixes). - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (git-fixes). - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (git-fixes). - Bluetooth: MGMT: validate Add Extended Advertising Data length (git-fixes). - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START (git-fixes). - Bluetooth: bnep: Fix UAF read of dev->name (git-fixes). - batman-adv: frag: disallow unicast fragment in fragment (git-fixes). - batman-adv: tp_meter: avoid use of uninit sender vars (git-fixes). - batman-adv: dat: handle forward allocation error (git-fixes). - batman-adv: clear current gateway during teardown (git-fixes). - batman-adv: fix fragment reassembly length accounting (git-fixes). - batman-adv: tt: fix negative last_changeset_len (git-fixes). - batman-adv: tt: fix negative tt_buff_len (git-fixes). - batman-adv: fix tp_meter counter underflow during shutdown (git-fixes). - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans (git-fixes). - ALSA: usb-audio: Bound MIDI endpoint descriptor scans (git-fixes). - ALSA: sc6000: Keep the programmed board state in card-private data (git-fixes). - ASoC: SOF: Intel: hda: Fix NULL pointer dereference (stable-fixes). - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 (stable-fixes). - ALSA: sc6000: Use standard print API (stable-fixes). - drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() (stable-fixes). - ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio (stable-fixes). - ASoC: SOF: Intel: hda-dai: remove dspless special case (stable-fixes). - commit b214d9a ++++ kernel-rt_debug: - wifi: mac80211: check tdls flag in ieee80211_tdls_oper (CVE-2026-43052 bsc#1263945). - commit e6ee8c1 - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (CVE-2026-31590 bsc#1263152). - commit 4957e7f - openvswitch: vport: fix self-deadlock on release of tunnel ports (CVE-2026-31678 bsc#1263562). - commit 7eb6b28 - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CVE-2026-43483 bsc#1265240). - commit de0bf57 - smb: client: fix in-place encryption corruption in SMB2_write() (bsc#1264989 CVE-2026-43362) - commit 2633e79 - compute-PATCHVERSION: Do not append .. to default patch directories All the callers are either using . or a specific patch directory. If a caller really needs to load patches from .. it should be passed as parameter. - commit d383394 - compute-PATCHVERSION: Remove unpack logic This used to be needed when compute-PATCHVERSION was shipped as part of the rpm package where unpacked patches are not available. It is not done annymore, and the unpackinng is not needed. - commit 9a8fa0e - openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678 bsc#1263562). - commit c40a933 - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested [#]VMEXIT (git-fixes). - commit ec599f4 - KVM: x86: Fix Xen hypercall tracepoint argument assignment (git-fixes). - commit bee29ed - packaging: Rip out extra symbols support Extra symbols are not supported for a long time. The oldest branch we maintain is SLE 11 SP1 and it does not use patch guards to select patches. - commit 7b3d5b0 - batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes). - commit f65d5f2 - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() (git-fixes). - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() (git-fixes). - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors (git-fixes). - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple (git-fixes). - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR (git-fixes). - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer (git-fixes). - hwmon: (pmbus/adm1266) include adapter number in GPIO line label (git-fixes). - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer (git-fixes). - hwmon: (pmbus/adm1266) reject implausible blackbox record_count (git-fixes). - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX (git-fixes). - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock (git-fixes). - drm/virtio: use uninterruptible resv lock for plane updates (git-fixes). - drm/bridge: megachips: remove bridge when irq request fails (git-fixes). - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe (git-fixes). - drm/bridge: it66121: acquire reset GPIO in probe (git-fixes). - drm/radeon/evergreen_cs: Add missing NULL prefix check in surface check (git-fixes). - drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets (git-fixes). - drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets (git-fixes). - drm/msm/snapshot: fix dumping of the unaligned regions (git-fixes). - drm/msm/dsi: don't dump registers past the mapped region (git-fixes). - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL (git-fixes). - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL (git-fixes). - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL (git-fixes). - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL (git-fixes). - wifi: ath11k: clear shared SRNG pointer state on restart (git-fixes). - wifi: ath11k: fix use after free in ath11k_dp_rx_msdu_coalesce() (git-fixes). - wifi: ath11k: fix peer resolution on rx path when peer_id=0 (git-fixes). - wifi: ath10k: skip WMI and beacon transmission when device is wedged (git-fixes). - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() (git-fixes). - wifi: ath11k: fix error path leaks in some WMI calls (git-fixes). - wifi: ath11k: fix error path leaks in some WMI WOW calls (git-fixes). - wifi: mac80211: consume only present negotiated TTLM maps (git-fixes). - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (git-fixes). - efi: Allocate runtime workqueue before ACPI init (git-fixes). - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure (git-fixes). - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration (git-fixes). - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated (git-fixes). - r8152: fix incorrect register write to USB_UPHY_XTAL (git-fixes). - drm/amdgpu: fix spelling typos (stable-fixes). - drm/i915: Loop over all active pipes in intel_mbus_dbox_update (stable-fixes). - spi: st-ssc4: switch to use modern name (stable-fixes). - commit 8b80180 - device property: set fwnode->secondary to NULL in fwnode_init() (git-fixes). - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() (git-fixes). - ALSA: ua101: Reject too-short USB descriptors (git-fixes). - batman-adv: bla: fix report_work leak on backbone_gw purge (git-fixes). - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (git-fixes). - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (git-fixes). - Bluetooth: MGMT: validate Add Extended Advertising Data length (git-fixes). - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START (git-fixes). - Bluetooth: bnep: Fix UAF read of dev->name (git-fixes). - batman-adv: frag: disallow unicast fragment in fragment (git-fixes). - batman-adv: tp_meter: avoid use of uninit sender vars (git-fixes). - batman-adv: dat: handle forward allocation error (git-fixes). - batman-adv: clear current gateway during teardown (git-fixes). - batman-adv: fix fragment reassembly length accounting (git-fixes). - batman-adv: tt: fix negative last_changeset_len (git-fixes). - batman-adv: tt: fix negative tt_buff_len (git-fixes). - batman-adv: fix tp_meter counter underflow during shutdown (git-fixes). - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans (git-fixes). - ALSA: usb-audio: Bound MIDI endpoint descriptor scans (git-fixes). - ALSA: sc6000: Keep the programmed board state in card-private data (git-fixes). - ASoC: SOF: Intel: hda: Fix NULL pointer dereference (stable-fixes). - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 (stable-fixes). - ALSA: sc6000: Use standard print API (stable-fixes). - drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() (stable-fixes). - ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio (stable-fixes). - ASoC: SOF: Intel: hda-dai: remove dspless special case (stable-fixes). - commit b214d9a ++++ libsolv: - made repo_add_solv more robust against corrupt files [bsc#1265935] [CVE-2026-9149] - fix potential buffer overflow when verifying EdDSA signatures [bsc#1266039] [CVE-2026-48863] - added limit checks in multiple places to catch overflows - reduce the size of the language id cache - fixed Debian canon selection - fixed dbpath detection in repo_rpmdb_librpm - reduced stack usage in repo page compression (needed for musl) - bump version to 0.7.38 ------------------------------------------------------------------ ------------------ 2026-5-25 - May 25 2026 ------------------- ------------------------------------------------------------------ ++++ jq: - Add patch CVE-2026-32316.patch (CVE-2026-32316, bsc#1262044) - Add patch CVE-2026-33947.patch (CVE-2026-33947, bsc#1262069) - Add patch CVE-2026-39956.patch (CVE-2026-39956, bsc#1262070) - Add patch CVE-2026-39979.patch (CVE-2026-39979, bsc#1262071) - Add patch CVE-2026-40164.patch (CVE-2026-40164, bsc#1262072) - Add patch CVE-2026-40612.patch (CVE-2026-40612, bsc#1265060) - Add patch CVE-2026-41256.patch (CVE-2026-41256, bsc#1265061) - Add patch CVE-2026-41257.patch (CVE-2026-41257, bsc#1265062) - Add patch CVE-2026-43894.patch (CVE-2026-43894, bsc#1265070) ++++ kernel-default: - Fix the wrong kabi patch order at merging from SLE15-SP6-LTSS No functional changes - commit edd353b - net: gro: don't merge zcopy skbs (git-fixes). - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-43503 bsc#1265960). - net: skbuff: preserve shared-frag marker during coalescing (CVE-2026-46300 bsc#1265209). - net: gro: don't merge zcopy skbs (git-fixes). - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-43503 bsc#1265960). - net: skbuff: preserve shared-frag marker during coalescing (CVE-2026-46300 bsc#1265209). - commit 17348bf - Revert "net: skbuff: propagate shared-frag marker through pskb_copy()" This reverts commit 7d64bf1e8cbaf1eb308d2e84a0475b85e0129adc. - commit 44dd5e4 - packaging: compute-PATCHVERSION.sh -> compute-PATCHVERSION - commit fc624df ++++ kernel-rt: - Fix the wrong kabi patch order at merging from SLE15-SP6-LTSS No functional changes - commit edd353b - net: gro: don't merge zcopy skbs (git-fixes). - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-43503 bsc#1265960). - net: skbuff: preserve shared-frag marker during coalescing (CVE-2026-46300 bsc#1265209). - net: gro: don't merge zcopy skbs (git-fixes). - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-43503 bsc#1265960). - net: skbuff: preserve shared-frag marker during coalescing (CVE-2026-46300 bsc#1265209). - commit 17348bf - Revert "net: skbuff: propagate shared-frag marker through pskb_copy()" This reverts commit 7d64bf1e8cbaf1eb308d2e84a0475b85e0129adc. - commit 44dd5e4 - packaging: compute-PATCHVERSION.sh -> compute-PATCHVERSION - commit fc624df ++++ kernel-rt_debug: - Fix the wrong kabi patch order at merging from SLE15-SP6-LTSS No functional changes - commit edd353b - net: gro: don't merge zcopy skbs (git-fixes). - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-43503 bsc#1265960). - net: skbuff: preserve shared-frag marker during coalescing (CVE-2026-46300 bsc#1265209). - net: gro: don't merge zcopy skbs (git-fixes). - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-43503 bsc#1265960). - net: skbuff: preserve shared-frag marker during coalescing (CVE-2026-46300 bsc#1265209). - commit 17348bf - Revert "net: skbuff: propagate shared-frag marker through pskb_copy()" This reverts commit 7d64bf1e8cbaf1eb308d2e84a0475b85e0129adc. - commit 44dd5e4 - packaging: compute-PATCHVERSION.sh -> compute-PATCHVERSION - commit fc624df ++++ python-idna: - CVE-2026-45409: Specially crafted inputs to idna.encode() can bypass earlier security fix(bsc#1265413) Add patch CVE-2026-45409.patch ++++ qemu: - Bug and CVE fixes: * virtio-snd: tighten read amount in in_cb (bsc#1259079, CVE-2026-3196, bsc#1259080, CVE-2026-3195) * virtio-snd: fix max_size bounds check in input cb (bsc#1259079, CVE-2026-3196, bsc#1259080, CVE-2026-3195) * virtio-snd: handle 5.14.6.2 for PCM_INFO properly (bsc#1259079, CVE-2026-3196, bsc#1259080, CVE-2026-3195:) * virtio-snd: remove TODO comments (bsc#1259079, CVE-2026-3196, bsc#1259080, CVE-2026-3195) * block/vmdk: fix OOB read in vmdk_read_extent() (bsc#1258509, CVE-2026-2243) * hyperv/syndbg: check length returned by cpu_physical_memory_map() (bsc#1262089, CVE-2026-3842) * cryptodev-builtin: Limit the maximum size (bsc#1255400, CVE-2025-14876) * hw/virtio/virtio-crypto: verify asym request size (bsc#1255400, CVE-2025-14876) * hw/i386/kvm: fix PIRQ bounds check in xen_physdev_map_pirq() (bsc#1256484, CVE-2026-0665) * [openSUSE][RPM} spec: delete old specfile constructs ++++ vim: - Update to v9.2.0530. - Fix for SG#71948, bsc#1262395: * vim-9.1.1732-fix-inc-detection.patch: Fix for incorrectly detecting scientific parameter files as bitbake recipies. - Upstream fixed the following bugs / CVEs: * bsc#1264706 CVE-2026-42307 * bsc#1265360 CVE-2026-46483 * bsc#1264708 CVE-2026-45130 * bsc#1264707 CVE-2026-44656 * bsc#1265349 CVE-2026-43961 - Changes: * 9.2.0530: WinBar row vertical separator not refreshed on window change * 9.2.0529: GTK4: clipboard returns empty after a foreign app takes the selection * 9.2.0528: possible overflow in XIM resource handling * 9.2.0527: Possible double free in fill_partial_and_closure() * 9.2.0526: missing out-of-memory check in ex_substitute() * 9.2.0525: spell: memory leak in spell_read_dic() * 9.2.0524: spell: buffer overflow with many affix or compound flags * 9.2.0523: tests: no test for using shellescape() in combination with :! * 9.2.0522: event_nr2name() in autocmd.c can be improved * 9.2.0521: GTK4: cannot resize shell after the window is shown * 9.2.0520: Reversed text opacity in popup when termguicolor is set * 9.2.0519: GTK4: GUI tabline is not displayed correctly * 9.2.0518: GTK4: input method cannot compose text * 9.2.0517: quickfix: can set quickfixtextfunc in restricted/sandbox mode * 9.2.0516: socketserver: spurious error when servername is taken * 9.2.0515: virtualedit=insert doesn't work during change operation * 9.2.0514: GTK4: build errors when socketserver is enabled * 9.2.0513: [security]: memory safety issues in spellfile.c * 9.2.0512: clientserver uses binary protocol * 9.2.0511: configure: when GTK4 is used also links in X11 libs * 9.2.0510: setline() mapping may trigger autoindent * 9.2.0509: term.c: compile error when LOG_TRN is enabled * 9.2.0508: completion: cannot complete user cmd :K with 'ignorecase' * 9.2.0507: Vim9 class: public/protected member name clash uses same error * 9.2.0506: home_replace() function can be improved * 9.2.0505: GTK4: text looks blurry on HiDPI displays * 9.2.0504: configure: requires X11 libraries for GTK4 build * 9.2.0503: Makefile: Missing dependencies for new GTK4 source files * 9.2.0502: runtime(netrw): bookmark handling can be improved * 9.2.0501: GTK4: there is no GTK4 UI available * 9.2.0500: filetype: some html files wrongly recognized as htmlangular * 9.2.0499: modeline: allow to disable modelines with modelinestrict * 9.2.0498: potential heap buffer overflow in if_xcmdsrv.c * 9.2.0497: Cannot jump to remote tags * 9.2.0496: [security]: Code Injection in cucumber filetype plugin * 9.2.0495: [security]: runtime(netrw): code injection via NetrwBookHistSave() * 9.2.0494: User commands cannot handle single args with spaces * 9.2.0493: popup: missing Popup, PopupBorder and PopupTitle hi groups * 9.2.0492: popup: decoration wrongly drawn with clipping on border * 9.2.0491: VMS: various build issues * 9.2.0490: matchfuzzy() can crash on long multi-word patterns * 9.2.0489: filetype: some Objective-C files are not recognized * 9.2.0488: statusline: status line highlight blends into adjacent vsep cells * 9.2.0487: viminfo: possible signed int overflow in register array * 9.2.0486: out-of-bound read when recovering swap files * 9.2.0485: clipboard provider callback can be called recursively * 9.2.0484: TextPutPre triggers clipboard provider callback twice * 9.2.0483: popup: terminal embedded in an opacity popup freezes Vim on input * 9.2.0482: runtime(osc52): triggered twice with TextPutPoste autocmd * 9.2.0481: runtime(netrw): command injection possible via maps * 9.2.0480: [security]: runtime(netrw): code injection via mf command * 9.2.0479: [security]: runtime(tar): command injection in tar plugin * 9.2.0478: channel: redundant str/length assignments in channel_part_info() * 9.2.0477: popup: leftover content after popup_free under layout change * 9.2.0476: pattern completion leaks memory on alloc failures * 9.2.0475: runtime(netrw): bookmark paths not normalized * 9.2.0474: MS-Windows: hard to tell which Visual Studio version was selected with MSVC * 9.2.0473: Pasting ". register without autocommands breaks TextPut* * 9.2.0472: popup: column jitters when scrolled outside viewport * 9.2.0471: vimvars di_key initialized at runtime * 9.2.0470: No way to hook into put commands * 9.2.0469: popup: textprop-anchored popups bleed past host window edges * 9.2.0468: popups: not correctly updated from a CmdlineChanged autocommand * 9.2.0467: multi-line statusline loses highlighting attributes * 9.2.0466: popup: redraw can use stale blended cells * 9.2.0465: modeline: foldmarker cannot be set with modelinestrict * 9.2.0464: runtime(netrw): bookmarking directory uses current dir * 9.2.0463: Not able to use legacy expression evaluation in a vim9script maps * 9.2.0462: MS-Windows: workaround for assert error on GUI * 9.2.0461: Corrupted undofile causes use-after-free * 9.2.0460: did_set_shellpipe_redir() in wrong file * 9.2.0459: tests: test_termcodes fails (after v9.2.0456) * 9.2.0458: Crash with invalid shellredir/shellpipe value * 9.2.0457: Compile warning about unused variable * 9.2.0456: stray p character displayed on some terms * 9.2.0455: 'findfunc' only allows extra info for cmdline completion * 9.2.0454: tests: no test that "abbr" in customlist completion is shown * 9.2.0453: vertical separator of statusline blend into active statusline * 9.2.0452: screen.c popup opacity blend logic is duplicated * 9.2.0451: 'findfunc' can't return extra info for cmdline completion * 9.2.0450: [security]: heap buffer overflow in spellfile.c read_compound() * 9.2.0449: Make proto fails in non GTK builds * 9.2.0448: Vim9: dangling cmdline pointer after skip_expr_cctx() * 9.2.0447: cindent does not ignore comments * 9.2.0446: runtime(netrw): off-by-one bug in s:NetrwUnMarkFile() * 9.2.0445: win_fix_scroll() called before win_comp_pos() in command_height() * 9.2.0444: Cannot set 'path' option via modeline * 9.2.0443: GUI: cancelling save dialog overwrites or discards unnamed buffer * 9.2.0442: completion: i_CTRL-X_CTRL-V doesn't use dict from customlist * 9.2.0441: statusline: click handler not called on multi-line statusline * 9.2.0440: MS-Windows: cursor flicker during update_screen() * 9.2.0439: completion: info popup not removed in cmdline mode * 9.2.0438: tests: test_plugin_termdebug is flaky * 9.2.0437: MS-Windows: cursor flicker in vtp mode * 9.2.0436: Buffer overflow when parsing overlong errorformat lines * 9.2.0435: [security]: backticks in 'path' may cause shell execution on completion * 9.2.0434: cscope: filename interpreted by /bin/sh * 9.2.0433: customlist completion cannot supply pum metadata * 9.2.0432: blob to string conversion can be improved * 9.2.0431: blob encoding can be improved * 9.2.0430: tests: Test_shortmess_F3() is flaky on MS-Windows * 9.2.0429: tests: flaky screendump Test_smoothscroll_incsearch() * 9.2.0428: popup: no opacity support for completepopup/previewpopup * 9.2.0427: popup: opacity blend may leaks white bg color * 9.2.0426: tests: still some flaky screendump tests * 9.2.0425: Cannot silence undo/redo messages * 9.2.0424: popup: flicker when wildtrigger() refreshes the popup menu * 9.2.0423: popup: wrapped cmdline truncated with wildoptions=pum * 9.2.0422: popup: leave stray char when scrollbar changes * 9.2.0421: vimball: can smuggle Vimscript into VimballRecord file * 9.2.0420: channel: cannot handle binary data via channel callbacks * 9.2.0419: popup: rendering issues * 9.2.0418: wildcards in expanded env vars reinterpreted by glob * 9.2.0417: completion: no support for "noinsert" with 'wildmode' * 9.2.0416: Unix: filename completion splits at space for single-file Ex commands * 9.2.0415: Wrong behavior when executing register that ends in Insert mode * 9.2.0414: Flicker when drawing window separator and pum is shown * 9.2.0413: Scrolling wrong with 'splitkeep' when changing 'cmdheight' * 9.2.0412: channel: term_start() out_cb/err_cb no longer deliver raw chunks * 9.2.0411: tabpanel: no Vim script functions for the tabpanel * 9.2.0410: test suite races when run with parallel make * 9.2.0409: memory leaks in copy_substring_from_pos() * 9.2.0408: Insert-mode edits can corrupt undo * 9.2.0407: tabpanel: A few issues with the tabpanel * 9.2.0406: VisualNOS not used when Wayland selection ownership lost * 9.2.0405: when jumping to tags, will open URLs * 9.2.0404: redraw_listener_add() does not check secure flag * 9.2.0403: Vim9: def function sandbox bypass * 9.2.0402: pum: opacity not applied to wildmenu pum * 9.2.0401: tests: still a few flaky tests * 9.2.0400: sandbox callbacks selected through 'complete' * 9.2.0399: MS-Windows: compile warning in strptime.c ------------------------------------------------------------------ ------------------ 2026-5-21 - May 21 2026 ------------------- ------------------------------------------------------------------ ++++ jq: - Add patch CVE-2026-33948.patch (CVE-2026-33948, bsc#1262043) ++++ kernel-default: - kernel-binary: Only apply vmlinux workaround on SLE15 and later To create debuginfo for vmlinux the file needs to be present even if it's not packaged because a compressed file is packaged insteand. To accomplish that the file is marked as ghost in the file list. Then rpm does not complain that the file exists but does not package it. However, rpm still reserves space for ghost files when installing a package. To avoid reserving space for a file that is not used the file is truncated. That works on SLE 15 but on SLE 12 rpm then fails packaging the debuginfo complaiing that extra debuginfo files are present. Limit the workaround to SLE 15 and later. Fixes: 222edac2a18 (kernel-binary: prevent uncompressed vmlinux from inflating rpm size requirements) - commit 1ef7451 - scsi: target: iscsi: validate CHAP_R length before base64 decode (bsc#1265449). - commit 9997c88 - Refresh patches.suse/io-wq-check-that-the-predecessor-is-hashed-in-io_wq_remove_pending.patch. - commit af6de0d - net: mana: Fix crash from unvalidated SHM offset read from BAR0 during FLR (bsc#1265846). - net: mana: remove double CQ cleanup in mana_create_rxq error path (git-fixes). - net: mana: Skip WQ object destruction for uninitialized RXQ (git-fixes). - net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() (git-fixes). - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() (git-fixes). - RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() (git-fixes). - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (git-fixes). - RDMA/mana: Validate rx_hash_key_len (git-fixes). - hv_sock: fix ARM64 support (git-fixes). - commit 18c2af9 - Kernel-binary: Do not truncate vmlinux when it's the boot image Some architectures use vmlinux to boot. Truncating vmlinux on those architectures causes signing failure during build. Also if the signing was disabled a brokne kernel would be produced. Fixes: 222edac2a18 (kernel-binary: prevent uncompressed vmlinux from inflating rpm size requirements) - commit d3cf603 ++++ kernel-rt: - kernel-binary: Only apply vmlinux workaround on SLE15 and later To create debuginfo for vmlinux the file needs to be present even if it's not packaged because a compressed file is packaged insteand. To accomplish that the file is marked as ghost in the file list. Then rpm does not complain that the file exists but does not package it. However, rpm still reserves space for ghost files when installing a package. To avoid reserving space for a file that is not used the file is truncated. That works on SLE 15 but on SLE 12 rpm then fails packaging the debuginfo complaiing that extra debuginfo files are present. Limit the workaround to SLE 15 and later. Fixes: 222edac2a18 (kernel-binary: prevent uncompressed vmlinux from inflating rpm size requirements) - commit 1ef7451 - scsi: target: iscsi: validate CHAP_R length before base64 decode (bsc#1265449). - commit 9997c88 - Refresh patches.suse/io-wq-check-that-the-predecessor-is-hashed-in-io_wq_remove_pending.patch. - commit af6de0d - net: mana: Fix crash from unvalidated SHM offset read from BAR0 during FLR (bsc#1265846). - net: mana: remove double CQ cleanup in mana_create_rxq error path (git-fixes). - net: mana: Skip WQ object destruction for uninitialized RXQ (git-fixes). - net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() (git-fixes). - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() (git-fixes). - RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() (git-fixes). - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (git-fixes). - RDMA/mana: Validate rx_hash_key_len (git-fixes). - hv_sock: fix ARM64 support (git-fixes). - commit 18c2af9 - Kernel-binary: Do not truncate vmlinux when it's the boot image Some architectures use vmlinux to boot. Truncating vmlinux on those architectures causes signing failure during build. Also if the signing was disabled a brokne kernel would be produced. Fixes: 222edac2a18 (kernel-binary: prevent uncompressed vmlinux from inflating rpm size requirements) - commit d3cf603 ++++ kernel-rt_debug: - kernel-binary: Only apply vmlinux workaround on SLE15 and later To create debuginfo for vmlinux the file needs to be present even if it's not packaged because a compressed file is packaged insteand. To accomplish that the file is marked as ghost in the file list. Then rpm does not complain that the file exists but does not package it. However, rpm still reserves space for ghost files when installing a package. To avoid reserving space for a file that is not used the file is truncated. That works on SLE 15 but on SLE 12 rpm then fails packaging the debuginfo complaiing that extra debuginfo files are present. Limit the workaround to SLE 15 and later. Fixes: 222edac2a18 (kernel-binary: prevent uncompressed vmlinux from inflating rpm size requirements) - commit 1ef7451 - scsi: target: iscsi: validate CHAP_R length before base64 decode (bsc#1265449). - commit 9997c88 - Refresh patches.suse/io-wq-check-that-the-predecessor-is-hashed-in-io_wq_remove_pending.patch. - commit af6de0d - net: mana: Fix crash from unvalidated SHM offset read from BAR0 during FLR (bsc#1265846). - net: mana: remove double CQ cleanup in mana_create_rxq error path (git-fixes). - net: mana: Skip WQ object destruction for uninitialized RXQ (git-fixes). - net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() (git-fixes). - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() (git-fixes). - RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() (git-fixes). - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (git-fixes). - RDMA/mana: Validate rx_hash_key_len (git-fixes). - hv_sock: fix ARM64 support (git-fixes). - commit 18c2af9 - Kernel-binary: Do not truncate vmlinux when it's the boot image Some architectures use vmlinux to boot. Truncating vmlinux on those architectures causes signing failure during build. Also if the signing was disabled a brokne kernel would be produced. Fixes: 222edac2a18 (kernel-binary: prevent uncompressed vmlinux from inflating rpm size requirements) - commit d3cf603 ++++ unbound: - Add security patch unbound-patch_combined-1.25.1_v3.diff: * CVE-2026-33278, bsc#1265587: Possible remote code execution during DNSSEC validation * CVE-2026-42944, bsc#1265578: Heap overflow and crash with multiple nsid, cookie, padding EDNS options * CVE-2026-42959, bsc#1265586: Crash during DNSSEC validation of malicious content * CVE-2026-32792, bsc#1265583: Packet of death with DNSCrypt * CVE-2026-40622, bsc#1265581: "Ghost domain name" variant * CVE-2026-41292, bsc#1265580: Parsing a long list of incoming EDNS options degrades performance * CVE-2026-42534, bsc#1265585: Jostle logic bypass degrades resolution performance * CVE-2026-42923, bsc#1265589: Degradation of service with unbounded NSEC3 hash calculations * CVE-2026-42960, bsc#1265588: Possible cache poisoning attack while following delegation * CVE-2026-44390, bsc#1265584: Unbounded name compression in certain cases causes degradation of service * CVE-2026-44608, bsc#1265582: Use after free and crash in RPZ code. ++++ pcr-oracle: - Update to 0.6.3 + Relax TPM self-test attribute checks (bsc#1265871) ------------------------------------------------------------------ ------------------ 2026-5-20 - May 20 2026 ------------------- ------------------------------------------------------------------ ++++ cockpit: - Add CVE-2026-4802.patch to backport upstreams fix for bsc#1265040/CVE-2026-4802 ++++ kernel-default: - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018 CVE-2026-23271). - commit d05430f - xfs: avoid dereferencing log items after push callbacks (CVE-2026-31404 bsc#1261628). - commit bed0ec1 - kernel-binary: prevent uncompressed vmlinux from inflating rpm size requirements define %__spec_install_post to truncate the uncompressed vmlinux to 0 bytes after find-debuginfo.sh and brp-* scripts run. This prevents rpmbuild from baking the %ghost file size into the FILESIZES header, which can cause installation failures on smaller /boot partitions. Fixes: bsc#1265456 - commit 222edac - net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626, CVE-2026-43494). - net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626). - commit b66d9fc ++++ kernel-rt: - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018 CVE-2026-23271). - commit d05430f - xfs: avoid dereferencing log items after push callbacks (CVE-2026-31404 bsc#1261628). - commit bed0ec1 - kernel-binary: prevent uncompressed vmlinux from inflating rpm size requirements define %__spec_install_post to truncate the uncompressed vmlinux to 0 bytes after find-debuginfo.sh and brp-* scripts run. This prevents rpmbuild from baking the %ghost file size into the FILESIZES header, which can cause installation failures on smaller /boot partitions. Fixes: bsc#1265456 - commit 222edac - net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626, CVE-2026-43494). - net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626). - commit b66d9fc ++++ kernel-rt_debug: - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018 CVE-2026-23271). - commit d05430f - xfs: avoid dereferencing log items after push callbacks (CVE-2026-31404 bsc#1261628). - commit bed0ec1 - kernel-binary: prevent uncompressed vmlinux from inflating rpm size requirements define %__spec_install_post to truncate the uncompressed vmlinux to 0 bytes after find-debuginfo.sh and brp-* scripts run. This prevents rpmbuild from baking the %ghost file size into the FILESIZES header, which can cause installation failures on smaller /boot partitions. Fixes: bsc#1265456 - commit 222edac - net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626, CVE-2026-43494). - net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626). - commit b66d9fc ++++ openssh: - Add patch to fix a potential issue when validating mac or ciphers (bsc#1264568): * fix-mac-validation-strsep-logic-bug.patch ++++ salt: - Use non vendored tornado with Python 3.11 (bsc#1257583, bsc#1259700) - Added: * use-non-vendored-tornado-with-python-3.11.patch ------------------------------------------------------------------ ------------------ 2026-5-19 - May 19 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - perf: Make sure to use pmu_ctx->pmu for groups (bsc#1263001 CVE-2026-31528). - commit 2f72854 - RDMA/irdma: Fix deadlock during netdev reset with active connections (CVE-2026-31565 bsc#1263064) - commit e3d01c8 ++++ kernel-rt: - perf: Make sure to use pmu_ctx->pmu for groups (bsc#1263001 CVE-2026-31528). - commit 2f72854 - RDMA/irdma: Fix deadlock during netdev reset with active connections (CVE-2026-31565 bsc#1263064) - commit e3d01c8 ++++ kernel-rt_debug: - perf: Make sure to use pmu_ctx->pmu for groups (bsc#1263001 CVE-2026-31528). - commit 2f72854 - RDMA/irdma: Fix deadlock during netdev reset with active connections (CVE-2026-31565 bsc#1263064) - commit e3d01c8 ++++ libzypp: - Prevent configured scripts from escaping the sigcheck directory (bsc#1265223, CVE-2026-44933) - StringV: guard hasPrefix/hasPrefixCI against reading past the view end (fixes #735) - version 17.38.9 (35) ++++ rsync: - Security update: - CVE-2025-10158, bsc#1254441: Out of bounds array access via negative index - CVE-2026-41035, bsc#1262223: count of entries mismatch can lead to a use-after-free - CVE-2026-43617, bsc#1264515: Authorization Bypass via Hostname Resolution - CVE-2026-29518, bsc#1264512: Integer Overflow Information Disclosure - CVE-2026-43618, bsc#1264512: Integer Overflow Information Disclosure - CVE-2026-43619, bsc#1264514: Symlink Race Condition via Path-Based Syscalls - CVE-2026-43620, bsc#1264513: Out-of-Bounds Array Read via recv_files() - CVE-2026-45232, bsc#1265296: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing - List of patches added + hardening pre-requisite patches: - rsync-hardening-0001-bool-is-a-keyword-in-C23.patch - rsync-hardening-0002-syscall-fix-a-Y2038-bug-by-replacing-Int32x32To64-wi.patch - rsync-hardening-0003-options.c-Fix-segv-if-poptGetContext-returns-NULL.patch - rsync-hardening-0004-Using-a-correct-time-in-log-file.patch - rsync-hardening-0005-configure.ac-check-for-xattr-support-both-in-libc-an.patch - rsync-hardening-0006-util-fixed-issue-in-clean_fname.patch - rsync-hardening-0007-testsuite-added-clean-fname-underflow-test.patch - rsync-hardening-0008-CVE-2025-10158-fixed-an-invalid-access-to-files-array.patch - rsync-hardening-0009-fix-uninitialized-buf1-in-get_checksum2-MD4-path.patch - rsync-hardening-0010-reject-negative-token-values-in-compressed-stream-re.patch - rsync-hardening-0011-acl-fixed-ACL-ID-mapping-for-non-root.patch - rsync-hardening-0012-fix-uninitialized-mul_one-in-AVX2-checksum-and-add-S.patch - rsync-hardening-0013-Fix-glibc-2.43-constness-warnings.patch - rsync-hardening-0015-fix-signed-integer-overflow-in-proxy-protocol-v2-hea.patch - rsync-hardening-0016-zero-all-new-memory-from-allocations.patch - rsync-hardening-0017-CVE-2026-41035-xattrs-fixed-count-in-qsort.patch - rsync-hardening-0018-call-tzset-before-chroot-to-cache-timezone-data.patch - rsync-hardening-0019-testsuite-xattrs-ignore-SUNWattr_-in-the-Solaris-xls.patch - rsync-hardening-0020-syscall-use-openat2-RESOLVE_BENEATH-on-Linux-for-sec.patch - rsync-hardening-0021-syscall-also-use-O_RESOLVE_BENEATH-on-FreeBSD-and-Ma.patch - rsync-hardening-0022-testsuite-skip-symlink-dirlink-basis-on-platforms-wi.patch - rsync-hardening-0023-CVE-2026-29518-syscall-clientserver-am_chrooted-and-use_secure_syml.patch - rsync-hardening-0024-CVE-2026-29518-sender-fix-read-path-TOCTOU-by-opening-from-module-r.patch - rsync-hardening-0025-CVE-2026-43619-syscall-receiver-secure-receiver-side-do_chmod-again.patch - rsync-hardening-0026-CVE-2026-43619-util1-secure-change_dir-against-symlink-race-chdir-e.patch - rsync-hardening-0027-CVE-2026-43619-syscall-add-symlink-race-safe-do_-_at-wrappers-and-h.patch - rsync-hardening-0028-CVE-2026-43619-util1-syscall-secure-copy_file-source-dest-opens-bar.patch - rsync-hardening-0029-CVE-2026-43619-testsuite-end-to-end-regression-test-for-chdir-symli.patch - rsync-hardening-0030-CVE-2026-43618-token-harden-compressed-token-decoding-against-integ.patch - rsync-hardening-0031-CVE-2026-43618-testsuite-cover-refuse-options-compress-for-the-daem.patch - rsync-hardening-0032-CVE-2026-43620-receiver-add-parent_ndx-0-guard-mirroring-797e17f.patch - rsync-hardening-0033-CVE-2026-43617-clientserver-fix-hostname-ACL-bypass-when-using-daem.patch - rsync-hardening-0034-CVE-2026-43618-defence-in-depth-bound-wire-supplied-counts-and-leng.patch - rsync-hardening-0035-CVE-2026-43618-defence-in-depth-guard-cumulative-snprintf-against-l.patch - rsync-hardening-0036-CVE-2026-43620-defence-in-depth-receiver-block-index-bounds-read_de.patch - rsync-hardening-0037-ci-add-Ubuntu-22.04-and-AlmaLinux-8-workflows-for-ba.patch - rsync-hardening-0039-Fix-flaky-hardlinks-test.patch - rsync-hardening-0040-rsync.h-lower-MAX_WIRE_DEL_STAT-to-avoid-signed-int-.patch - rsync-hardening-0041-CVE-2026-45232-socket-reject-over-long-proxy-response-line.patch - rsync-hardening-0042-main-reject-hyphen-prefixed-remote-shell-hostnames.patch - rsync-hardening-0043-util1-handle-out-of-range-times-in-timestring.patch - Replaced patches: - rsync-no-libattr.patch - > rsync-hardening-0005-configure.ac-check-for-xattr-support-both-in-libc-an.patch - rsync-CVE-2025-10158.patch - > rsync-hardening-0008-CVE-2025-10158-fixed-an-invalid-access-to-files-array.patch - rsync-CVE-2026-41035.patch - > rsync-hardening-0017-CVE-2026-41035-xattrs-fixed-count-in-qsort.patch - Patches not applied/required for openSUSE (left for reference, they are NOT missing neither it was a mistake not to include them): - rsync-hardening-0014-zlib-convert-K-R-function-definitions-to-ANSI-style - rsync-hardening-0038-CI-fix-workflows-for-backport-testing ++++ timezone: - Update to 2026b: * British Columbia moved to permanent -07 on 2026-03-09. (bsc#1264965) * Some more overflow bugs have been fixed in zic. - Refresh revert-philippines-historical-data.patch ------------------------------------------------------------------ ------------------ 2026-5-18 - May 18 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - net/sched: fix pedit partial COW leading to page cache corruption (bsc#1265421). - commit a756c69 - RDMA/irdma: Fix double free related to rereg_user_mr (CVE-2026-43120) - commit c514796 - spi: zynq-qspi: switch to use modern name (stable-fixes). - Refresh patches.suse/spi-zynq-qspi-Add-check-for-clk_enable.patch. - commit 79d17cd - USB: serial: option: add Telit Cinterion LE910Cx compositions (stable-fixes). - usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl (stable-fixes). - usb: usblp: fix heap leak in IEEE 1284 device ID via short response (stable-fixes). - platform/x86: hp-wmi: Ignore backlight and FnLock events (stable-fixes). - mtd: spi-nor: sst: Fix write enable before AAI sequence (git-fixes). - mtd: docg3: fix use-after-free in docg3_release() (git-fixes). - spi: uniphier: fix controller deregistration (git-fixes). - spi: syncuacer: fix controller deregistration (git-fixes). - spi: sun4i: fix controller deregistration (git-fixes). - spi: omap2-mcspi: fix controller deregistration (git-fixes). - spi: mtk-nor: fix controller deregistration (git-fixes). - spi: microchip-core-qspi: fix controller deregistration (git-fixes). - spi: uniphier: Simplify clock handling with devm_clk_get_enabled() (stable-fixes). - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling (git-fixes). - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor (stable-fixes). - mtd: spi-nor: sst: Fix SST write failure (git-fixes). - mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()` (stable-fixes). - spi: uniphier: switch to use modern name (stable-fixes). - spi: synquacer: switch to use modern name (stable-fixes). - spi: sun4i: switch to use modern name (stable-fixes). - spi: spi-ti-qspi: Convert to platform remove callback returning void (stable-fixes). - spi: microchip-core-qspi: Use helper function devm_clk_get_enabled() (stable-fixes). - commit 401263c - drm/amdkfd: Add upper bound check for num_of_nodes (stable-fixes). - commit 46b01e2 - HID: playstation: Clamp num_touch_reports (git-fixes). - drm/amdgpu: zero-initialize GART table on allocation (stable-fixes). - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ (stable-fixes). - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free (stable-fixes). - ipmi: Add limits to event and receive message requests (git-fixes). - crypto: authencesn - reject short ahash digests during instance creation (git-fixes). - drm/amdgpu/vcn4: Avoid overflow on msg bound check (git-fixes). - drm/amdgpu/vcn3: Avoid overflow on msg bound check (git-fixes). - drm/amdkfd: validate SVM ioctl nattr against buffer size (stable-fixes). - drm/amdgpu: fix zero-size GDS range init on RDNA4 (stable-fixes). - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure (stable-fixes). - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (stable-fixes). - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (stable-fixes). - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (stable-fixes). - drm/amdgpu/vce: Prevent partial address patches (stable-fixes). - drm/amdgpu: Add bounds checking to ib_{get,set}_value (stable-fixes). - mtd: docg3: Convert to platform remove callback returning void (stable-fixes). - commit 8bb0040 - ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table (stable-fixes). - ALSA: core: Serialize deferred fasync state checks (git-fixes). - ACPI: video: force native backlight on HP OMEN 16 (8A44) (stable-fixes). - ACPI: scan: Use acpi_dev_put() in object add error paths (git-fixes). - ALSA: aoa: i2sbus: clear stale prepared state (git-fixes). - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes (stable-fixes). - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() (git-fixes). - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit (git-fixes). - ALSA: misc: Use guard() for spin locks (stable-fixes). - ALSA: aoa: Use guard() for mutex locks (stable-fixes). - ALSA: seq: Notify client and port info changes (stable-fixes). - commit fd79ce9 ++++ kernel-rt: - net/sched: fix pedit partial COW leading to page cache corruption (bsc#1265421). - commit a756c69 - RDMA/irdma: Fix double free related to rereg_user_mr (CVE-2026-43120) - commit c514796 - spi: zynq-qspi: switch to use modern name (stable-fixes). - Refresh patches.suse/spi-zynq-qspi-Add-check-for-clk_enable.patch. - commit 79d17cd - USB: serial: option: add Telit Cinterion LE910Cx compositions (stable-fixes). - usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl (stable-fixes). - usb: usblp: fix heap leak in IEEE 1284 device ID via short response (stable-fixes). - platform/x86: hp-wmi: Ignore backlight and FnLock events (stable-fixes). - mtd: spi-nor: sst: Fix write enable before AAI sequence (git-fixes). - mtd: docg3: fix use-after-free in docg3_release() (git-fixes). - spi: uniphier: fix controller deregistration (git-fixes). - spi: syncuacer: fix controller deregistration (git-fixes). - spi: sun4i: fix controller deregistration (git-fixes). - spi: omap2-mcspi: fix controller deregistration (git-fixes). - spi: mtk-nor: fix controller deregistration (git-fixes). - spi: microchip-core-qspi: fix controller deregistration (git-fixes). - spi: uniphier: Simplify clock handling with devm_clk_get_enabled() (stable-fixes). - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling (git-fixes). - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor (stable-fixes). - mtd: spi-nor: sst: Fix SST write failure (git-fixes). - mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()` (stable-fixes). - spi: uniphier: switch to use modern name (stable-fixes). - spi: synquacer: switch to use modern name (stable-fixes). - spi: sun4i: switch to use modern name (stable-fixes). - spi: spi-ti-qspi: Convert to platform remove callback returning void (stable-fixes). - spi: microchip-core-qspi: Use helper function devm_clk_get_enabled() (stable-fixes). - commit 401263c - drm/amdkfd: Add upper bound check for num_of_nodes (stable-fixes). - commit 46b01e2 - HID: playstation: Clamp num_touch_reports (git-fixes). - drm/amdgpu: zero-initialize GART table on allocation (stable-fixes). - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ (stable-fixes). - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free (stable-fixes). - ipmi: Add limits to event and receive message requests (git-fixes). - crypto: authencesn - reject short ahash digests during instance creation (git-fixes). - drm/amdgpu/vcn4: Avoid overflow on msg bound check (git-fixes). - drm/amdgpu/vcn3: Avoid overflow on msg bound check (git-fixes). - drm/amdkfd: validate SVM ioctl nattr against buffer size (stable-fixes). - drm/amdgpu: fix zero-size GDS range init on RDNA4 (stable-fixes). - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure (stable-fixes). - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (stable-fixes). - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (stable-fixes). - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (stable-fixes). - drm/amdgpu/vce: Prevent partial address patches (stable-fixes). - drm/amdgpu: Add bounds checking to ib_{get,set}_value (stable-fixes). - mtd: docg3: Convert to platform remove callback returning void (stable-fixes). - commit 8bb0040 - ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table (stable-fixes). - ALSA: core: Serialize deferred fasync state checks (git-fixes). - ACPI: video: force native backlight on HP OMEN 16 (8A44) (stable-fixes). - ACPI: scan: Use acpi_dev_put() in object add error paths (git-fixes). - ALSA: aoa: i2sbus: clear stale prepared state (git-fixes). - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes (stable-fixes). - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() (git-fixes). - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit (git-fixes). - ALSA: misc: Use guard() for spin locks (stable-fixes). - ALSA: aoa: Use guard() for mutex locks (stable-fixes). - ALSA: seq: Notify client and port info changes (stable-fixes). - commit fd79ce9 ++++ kernel-rt_debug: - net/sched: fix pedit partial COW leading to page cache corruption (bsc#1265421). - commit a756c69 - RDMA/irdma: Fix double free related to rereg_user_mr (CVE-2026-43120) - commit c514796 - spi: zynq-qspi: switch to use modern name (stable-fixes). - Refresh patches.suse/spi-zynq-qspi-Add-check-for-clk_enable.patch. - commit 79d17cd - USB: serial: option: add Telit Cinterion LE910Cx compositions (stable-fixes). - usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl (stable-fixes). - usb: usblp: fix heap leak in IEEE 1284 device ID via short response (stable-fixes). - platform/x86: hp-wmi: Ignore backlight and FnLock events (stable-fixes). - mtd: spi-nor: sst: Fix write enable before AAI sequence (git-fixes). - mtd: docg3: fix use-after-free in docg3_release() (git-fixes). - spi: uniphier: fix controller deregistration (git-fixes). - spi: syncuacer: fix controller deregistration (git-fixes). - spi: sun4i: fix controller deregistration (git-fixes). - spi: omap2-mcspi: fix controller deregistration (git-fixes). - spi: mtk-nor: fix controller deregistration (git-fixes). - spi: microchip-core-qspi: fix controller deregistration (git-fixes). - spi: uniphier: Simplify clock handling with devm_clk_get_enabled() (stable-fixes). - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling (git-fixes). - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor (stable-fixes). - mtd: spi-nor: sst: Fix SST write failure (git-fixes). - mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()` (stable-fixes). - spi: uniphier: switch to use modern name (stable-fixes). - spi: synquacer: switch to use modern name (stable-fixes). - spi: sun4i: switch to use modern name (stable-fixes). - spi: spi-ti-qspi: Convert to platform remove callback returning void (stable-fixes). - spi: microchip-core-qspi: Use helper function devm_clk_get_enabled() (stable-fixes). - commit 401263c - drm/amdkfd: Add upper bound check for num_of_nodes (stable-fixes). - commit 46b01e2 - HID: playstation: Clamp num_touch_reports (git-fixes). - drm/amdgpu: zero-initialize GART table on allocation (stable-fixes). - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ (stable-fixes). - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free (stable-fixes). - ipmi: Add limits to event and receive message requests (git-fixes). - crypto: authencesn - reject short ahash digests during instance creation (git-fixes). - drm/amdgpu/vcn4: Avoid overflow on msg bound check (git-fixes). - drm/amdgpu/vcn3: Avoid overflow on msg bound check (git-fixes). - drm/amdkfd: validate SVM ioctl nattr against buffer size (stable-fixes). - drm/amdgpu: fix zero-size GDS range init on RDNA4 (stable-fixes). - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure (stable-fixes). - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (stable-fixes). - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (stable-fixes). - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (stable-fixes). - drm/amdgpu/vce: Prevent partial address patches (stable-fixes). - drm/amdgpu: Add bounds checking to ib_{get,set}_value (stable-fixes). - mtd: docg3: Convert to platform remove callback returning void (stable-fixes). - commit 8bb0040 - ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table (stable-fixes). - ALSA: core: Serialize deferred fasync state checks (git-fixes). - ACPI: video: force native backlight on HP OMEN 16 (8A44) (stable-fixes). - ACPI: scan: Use acpi_dev_put() in object add error paths (git-fixes). - ALSA: aoa: i2sbus: clear stale prepared state (git-fixes). - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes (stable-fixes). - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() (git-fixes). - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit (git-fixes). - ALSA: misc: Use guard() for spin locks (stable-fixes). - ALSA: aoa: Use guard() for mutex locks (stable-fixes). - ALSA: seq: Notify client and port info changes (stable-fixes). - commit fd79ce9 ++++ xz: - Fix buffer overflow in lzma_index_append (bsc#1261280, CVE-2026-34743) * CVE-2026-34743.patch ++++ python-urllib3: - CVE-2026-44431: sensitive information disclosure due to sensitive headers being forwarded across origins in proxied low-level redirects (bsc#1265267) Add patch CVE-2026-44431.patch ------------------------------------------------------------------ ------------------ 2026-5-16 - May 16 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init (git-fixes). - drm/gma500/oaktrail_lvds: fix hang on init failure (git-fixes). - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup (git-fixes). - accel/qaic: Add overflow check to remap_pfn_range during mmap (git-fixes). - drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() (git-fixes). - drm/i915/dp: Fix VSC dynamic range signaling for RGB formats (git-fixes). - drm/i915: skip __i915_request_skip() for already signaled requests (git-fixes). - commit a143ec8 ++++ kernel-rt: - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init (git-fixes). - drm/gma500/oaktrail_lvds: fix hang on init failure (git-fixes). - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup (git-fixes). - accel/qaic: Add overflow check to remap_pfn_range during mmap (git-fixes). - drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() (git-fixes). - drm/i915/dp: Fix VSC dynamic range signaling for RGB formats (git-fixes). - drm/i915: skip __i915_request_skip() for already signaled requests (git-fixes). - commit a143ec8 ++++ kernel-rt_debug: - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init (git-fixes). - drm/gma500/oaktrail_lvds: fix hang on init failure (git-fixes). - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup (git-fixes). - accel/qaic: Add overflow check to remap_pfn_range during mmap (git-fixes). - drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() (git-fixes). - drm/i915/dp: Fix VSC dynamic range signaling for RGB formats (git-fixes). - drm/i915: skip __i915_request_skip() for already signaled requests (git-fixes). - commit a143ec8 ------------------------------------------------------------------ ------------------ 2026-5-15 - May 15 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - kabi assert ptrace: slightly saner 'get_dumpable()' logic (bsc#1265308). - kabi ptrace: slightly saner 'get_dumpable()' logic (bsc#1265308). - kabi assert ptrace: slightly saner 'get_dumpable()' logic (bsc#1265308). - kabi ptrace: slightly saner 'get_dumpable()' logic (bsc#1265308). - commit 7939970 - batman-adv: bla: put backbone reference on failed claim hash insert (git-fixes). - batman-adv: bla: only purge non-released claims (git-fixes). - batman-adv: bla: prevent use-after-free when deleting claims (git-fixes). - batman-adv: stop caching unowned originator pointers in BAT IV (git-fixes). - batman-adv: reject new tp_meter sessions during teardown (git-fixes). - batman-adv: fix integer overflow on buff_pos (git-fixes). - net: wan: fsl_ucc_hdlc: free tx_skbuff in uhdlc_memclean (git-fixes). - hwmon: (ads7871) Fix endianness bug in 16-bit register reads (git-fixes). - hwmon: (lm63) Add locking to avoid TOCTOU (git-fixes). - hwmon: (corsair-psu) Close HID device on probe errors (git-fixes). - hwmon: (ltc2992) Fix u32 overflow in power read path (git-fixes). - hwmon: (ltc2992) Clamp threshold writes to hardware range (git-fixes). - staging: vme_user: fix root device leak on init failure (git-fixes). - usb: ulpi: fix memory leak on ulpi_register() error paths (git-fixes). - USB: omap_udc: DMA: Don't enable burst 4 mode (git-fixes). - i2c: smbus: reject oversized block transfers in the common path (git-fixes). - i2c: stub: Reject I2C block transfers with invalid length (git-fixes). - i2c: stm32f7: reinit_completion() per transfer not per msg (git-fixes). - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission (git-fixes). - drm/radeon: add missing revision check for CI (git-fixes). - drm/amdgpu/pm: align Hawaii mclk workaround with radeon (git-fixes). - drm/amdgpu/pm: add missing revision check for CI (git-fixes). - drm/etnaviv: Fix armed job not being pushed to the DRM scheduler (git-fixes). - drm/fb-helper: Fix clipping when damage area spans a single scanline (git-fixes). - Bluetooth: HIDP: serialise l2cap_unregister_user via hidp_session_sem (git-fixes). - Bluetooth: RFCOMM: pull credit byte with skb_pull_data() (git-fixes). - Bluetooth: virtio_bt: validate rx pkt_type header length (git-fixes). - Bluetooth: virtio_bt: clamp rx length before skb_put (git-fixes). - Bluetooth: ISO: Fix data-race on dst in iso_sock_connect() (git-fixes). - Bluetooth: SCO: hold sk properly in sco_conn_ready (git-fixes). - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (git-fixes). - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() (git-fixes). - Bluetooth: l2cap: fix MPS check in l2cap_ecred_reconf_req (git-fixes). - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling (git-fixes). - Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt (git-fixes). - Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready (git-fixes). - wifi: nl80211: fix NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST usage (git-fixes). - wifi: mac80211: remove station if connection prep fails (git-fixes). - wifi: ath5k: do not access array OOB (git-fixes). - wifi: libertas: notify firmware load wait on disconnect (git-fixes). - wifi: cw1200: Revert "Fix locking in error paths" (git-fixes). - wifi: rsi: fix kthread lifetime race between self-exit and external-stop (git-fixes). - wifi: mac80211: drop stray 'static' from fast-RX rx_result (git-fixes). - wifi: mac80211: check ieee80211_rx_data_set_link return in pubsta MLO path (git-fixes). - wifi: nl80211: require admin perm on SET_PMK / DEL_PMK (git-fixes). - wifi: b43legacy: enforce bounds check on firmware key index in RX path (git-fixes). - wifi: b43: enforce bounds check on firmware key index in b43_rx() (git-fixes). - net: usb: asix: ax88772: re-add usbnet_link_change() in phylink callbacks (git-fixes). - net: wan: fsl_ucc_hdlc: fix ucc_hdlc_remove (git-fixes). - net: wan: fsl_ucc_hdlc: fix uhdlc_memclean (git-fixes). - ASoC: cs35l56: Destroy workqueue in probe error path (git-fixes). - ASoC: cs35l56: Don't use devres to unregister component (git-fixes). - ASoC: fsl_xcvr: Fix event generation for cached controls (git-fixes). - ALSA: usb-audio: midi2: Restart output URBs on resume (git-fixes). - ALSA: firewire-tascam: Do not drop unread control events (git-fixes). - staging: vme_user: added bound check to geoid (stable-fixes). - commit 59f26f5 - efi: pstore: Drop efivar lock when efi_pstore_open() returns with an error (git-fixes). - commit 5e02074 - ptrace: slightly saner 'get_dumpable()' logic (bsc#1265308). - commit a7c7176 - seg6: separate dst_cache for input and output paths in seg6 lwtunnel (CVE-2026-31668 bsc#1263140). - bridge: br_nd_send: linearize skb before parsing ND options (CVE-2026-31682 bsc#1263595). - commit 001a6c2 - tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (CVE-2026-31662 bsc#1263131). - ipv6: icmp: clear skb2->cb in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038 bsc#1264097). - iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (CVE-2026-31505 bsc#1263093). - can: gw: fix OOB heap access in cgw_csum_crc8_rel() (CVE-2026-31570 bsc#1263065). - atm: lec: fix use-after-free in sock_def_readable() (CVE-2026-43050 bsc#1264082). - commit 1116ef5 - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() (CVE-2026-43437 bsc#1265126). - commit 3fdd8bf - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CVE-2026-43334 bsc#1265090). - commit dc24bd4 - ALSA: mixer: oss: Add card disconnect checkpoints (CVE-2026-43126 bsc#1264634). - commit 2dc845f - wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110 bsc#1264482). - commit c50a71a - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CVE-2026-31488 bsc#1262746). - commit 7991223 - Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() (CVE-2026-31512 bsc#1262734). - commit 5ce5473 - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685 bsc#1263668). - commit ecee315 - netfilter: ctnetlink: ignore explicit helper on new expectations (CVE-2026-43025 bsc#1263931). - commit 96c1319 - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027 bsc#1263933). - commit 652688a - netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190 bsc#1264848). - commit 0b53f94 - net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled (CVE-2026-43441 bsc#1264674). - commit 3361ec7 - netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329 bsc#1265085). - commit 28f800b - vxlan: validate ND option lengths in vxlan_na_create (CVE-2026-31738 bsc#1264059). - commit 1854232 - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (bsc#1263170 CVE-2026-31656) - commit 5344cae - selftests/bpf: Add more precision tracking tests for atomics (CVE-2026-43009 bsc#1264014). - commit 1c3f25f - bpf: Fix incorrect pruning due to atomic fetch precision tracking (CVE-2026-43009 bsc#1264014). - commit 7f14444 ++++ kernel-rt: - kabi assert ptrace: slightly saner 'get_dumpable()' logic (bsc#1265308). - kabi ptrace: slightly saner 'get_dumpable()' logic (bsc#1265308). - kabi assert ptrace: slightly saner 'get_dumpable()' logic (bsc#1265308). - kabi ptrace: slightly saner 'get_dumpable()' logic (bsc#1265308). - commit 7939970 - batman-adv: bla: put backbone reference on failed claim hash insert (git-fixes). - batman-adv: bla: only purge non-released claims (git-fixes). - batman-adv: bla: prevent use-after-free when deleting claims (git-fixes). - batman-adv: stop caching unowned originator pointers in BAT IV (git-fixes). - batman-adv: reject new tp_meter sessions during teardown (git-fixes). - batman-adv: fix integer overflow on buff_pos (git-fixes). - net: wan: fsl_ucc_hdlc: free tx_skbuff in uhdlc_memclean (git-fixes). - hwmon: (ads7871) Fix endianness bug in 16-bit register reads (git-fixes). - hwmon: (lm63) Add locking to avoid TOCTOU (git-fixes). - hwmon: (corsair-psu) Close HID device on probe errors (git-fixes). - hwmon: (ltc2992) Fix u32 overflow in power read path (git-fixes). - hwmon: (ltc2992) Clamp threshold writes to hardware range (git-fixes). - staging: vme_user: fix root device leak on init failure (git-fixes). - usb: ulpi: fix memory leak on ulpi_register() error paths (git-fixes). - USB: omap_udc: DMA: Don't enable burst 4 mode (git-fixes). - i2c: smbus: reject oversized block transfers in the common path (git-fixes). - i2c: stub: Reject I2C block transfers with invalid length (git-fixes). - i2c: stm32f7: reinit_completion() per transfer not per msg (git-fixes). - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission (git-fixes). - drm/radeon: add missing revision check for CI (git-fixes). - drm/amdgpu/pm: align Hawaii mclk workaround with radeon (git-fixes). - drm/amdgpu/pm: add missing revision check for CI (git-fixes). - drm/etnaviv: Fix armed job not being pushed to the DRM scheduler (git-fixes). - drm/fb-helper: Fix clipping when damage area spans a single scanline (git-fixes). - Bluetooth: HIDP: serialise l2cap_unregister_user via hidp_session_sem (git-fixes). - Bluetooth: RFCOMM: pull credit byte with skb_pull_data() (git-fixes). - Bluetooth: virtio_bt: validate rx pkt_type header length (git-fixes). - Bluetooth: virtio_bt: clamp rx length before skb_put (git-fixes). - Bluetooth: ISO: Fix data-race on dst in iso_sock_connect() (git-fixes). - Bluetooth: SCO: hold sk properly in sco_conn_ready (git-fixes). - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (git-fixes). - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() (git-fixes). - Bluetooth: l2cap: fix MPS check in l2cap_ecred_reconf_req (git-fixes). - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling (git-fixes). - Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt (git-fixes). - Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready (git-fixes). - wifi: nl80211: fix NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST usage (git-fixes). - wifi: mac80211: remove station if connection prep fails (git-fixes). - wifi: ath5k: do not access array OOB (git-fixes). - wifi: libertas: notify firmware load wait on disconnect (git-fixes). - wifi: cw1200: Revert "Fix locking in error paths" (git-fixes). - wifi: rsi: fix kthread lifetime race between self-exit and external-stop (git-fixes). - wifi: mac80211: drop stray 'static' from fast-RX rx_result (git-fixes). - wifi: mac80211: check ieee80211_rx_data_set_link return in pubsta MLO path (git-fixes). - wifi: nl80211: require admin perm on SET_PMK / DEL_PMK (git-fixes). - wifi: b43legacy: enforce bounds check on firmware key index in RX path (git-fixes). - wifi: b43: enforce bounds check on firmware key index in b43_rx() (git-fixes). - net: usb: asix: ax88772: re-add usbnet_link_change() in phylink callbacks (git-fixes). - net: wan: fsl_ucc_hdlc: fix ucc_hdlc_remove (git-fixes). - net: wan: fsl_ucc_hdlc: fix uhdlc_memclean (git-fixes). - ASoC: cs35l56: Destroy workqueue in probe error path (git-fixes). - ASoC: cs35l56: Don't use devres to unregister component (git-fixes). - ASoC: fsl_xcvr: Fix event generation for cached controls (git-fixes). - ALSA: usb-audio: midi2: Restart output URBs on resume (git-fixes). - ALSA: firewire-tascam: Do not drop unread control events (git-fixes). - staging: vme_user: added bound check to geoid (stable-fixes). - commit 59f26f5 - efi: pstore: Drop efivar lock when efi_pstore_open() returns with an error (git-fixes). - commit 5e02074 - ptrace: slightly saner 'get_dumpable()' logic (bsc#1265308). - commit a7c7176 - seg6: separate dst_cache for input and output paths in seg6 lwtunnel (CVE-2026-31668 bsc#1263140). - bridge: br_nd_send: linearize skb before parsing ND options (CVE-2026-31682 bsc#1263595). - commit 001a6c2 - tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (CVE-2026-31662 bsc#1263131). - ipv6: icmp: clear skb2->cb in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038 bsc#1264097). - iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (CVE-2026-31505 bsc#1263093). - can: gw: fix OOB heap access in cgw_csum_crc8_rel() (CVE-2026-31570 bsc#1263065). - atm: lec: fix use-after-free in sock_def_readable() (CVE-2026-43050 bsc#1264082). - commit 1116ef5 - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() (CVE-2026-43437 bsc#1265126). - commit 3fdd8bf - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CVE-2026-43334 bsc#1265090). - commit dc24bd4 - ALSA: mixer: oss: Add card disconnect checkpoints (CVE-2026-43126 bsc#1264634). - commit 2dc845f - wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110 bsc#1264482). - commit c50a71a - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CVE-2026-31488 bsc#1262746). - commit 7991223 - Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() (CVE-2026-31512 bsc#1262734). - commit 5ce5473 - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685 bsc#1263668). - commit ecee315 - netfilter: ctnetlink: ignore explicit helper on new expectations (CVE-2026-43025 bsc#1263931). - commit 96c1319 - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027 bsc#1263933). - commit 652688a - netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190 bsc#1264848). - commit 0b53f94 - net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled (CVE-2026-43441 bsc#1264674). - commit 3361ec7 - netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329 bsc#1265085). - commit 28f800b - vxlan: validate ND option lengths in vxlan_na_create (CVE-2026-31738 bsc#1264059). - commit 1854232 - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (bsc#1263170 CVE-2026-31656) - commit 5344cae - selftests/bpf: Add more precision tracking tests for atomics (CVE-2026-43009 bsc#1264014). - commit 1c3f25f - bpf: Fix incorrect pruning due to atomic fetch precision tracking (CVE-2026-43009 bsc#1264014). - commit 7f14444 ++++ kernel-rt_debug: - kabi assert ptrace: slightly saner 'get_dumpable()' logic (bsc#1265308). - kabi ptrace: slightly saner 'get_dumpable()' logic (bsc#1265308). - kabi assert ptrace: slightly saner 'get_dumpable()' logic (bsc#1265308). - kabi ptrace: slightly saner 'get_dumpable()' logic (bsc#1265308). - commit 7939970 - batman-adv: bla: put backbone reference on failed claim hash insert (git-fixes). - batman-adv: bla: only purge non-released claims (git-fixes). - batman-adv: bla: prevent use-after-free when deleting claims (git-fixes). - batman-adv: stop caching unowned originator pointers in BAT IV (git-fixes). - batman-adv: reject new tp_meter sessions during teardown (git-fixes). - batman-adv: fix integer overflow on buff_pos (git-fixes). - net: wan: fsl_ucc_hdlc: free tx_skbuff in uhdlc_memclean (git-fixes). - hwmon: (ads7871) Fix endianness bug in 16-bit register reads (git-fixes). - hwmon: (lm63) Add locking to avoid TOCTOU (git-fixes). - hwmon: (corsair-psu) Close HID device on probe errors (git-fixes). - hwmon: (ltc2992) Fix u32 overflow in power read path (git-fixes). - hwmon: (ltc2992) Clamp threshold writes to hardware range (git-fixes). - staging: vme_user: fix root device leak on init failure (git-fixes). - usb: ulpi: fix memory leak on ulpi_register() error paths (git-fixes). - USB: omap_udc: DMA: Don't enable burst 4 mode (git-fixes). - i2c: smbus: reject oversized block transfers in the common path (git-fixes). - i2c: stub: Reject I2C block transfers with invalid length (git-fixes). - i2c: stm32f7: reinit_completion() per transfer not per msg (git-fixes). - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission (git-fixes). - drm/radeon: add missing revision check for CI (git-fixes). - drm/amdgpu/pm: align Hawaii mclk workaround with radeon (git-fixes). - drm/amdgpu/pm: add missing revision check for CI (git-fixes). - drm/etnaviv: Fix armed job not being pushed to the DRM scheduler (git-fixes). - drm/fb-helper: Fix clipping when damage area spans a single scanline (git-fixes). - Bluetooth: HIDP: serialise l2cap_unregister_user via hidp_session_sem (git-fixes). - Bluetooth: RFCOMM: pull credit byte with skb_pull_data() (git-fixes). - Bluetooth: virtio_bt: validate rx pkt_type header length (git-fixes). - Bluetooth: virtio_bt: clamp rx length before skb_put (git-fixes). - Bluetooth: ISO: Fix data-race on dst in iso_sock_connect() (git-fixes). - Bluetooth: SCO: hold sk properly in sco_conn_ready (git-fixes). - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (git-fixes). - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() (git-fixes). - Bluetooth: l2cap: fix MPS check in l2cap_ecred_reconf_req (git-fixes). - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling (git-fixes). - Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt (git-fixes). - Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready (git-fixes). - wifi: nl80211: fix NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST usage (git-fixes). - wifi: mac80211: remove station if connection prep fails (git-fixes). - wifi: ath5k: do not access array OOB (git-fixes). - wifi: libertas: notify firmware load wait on disconnect (git-fixes). - wifi: cw1200: Revert "Fix locking in error paths" (git-fixes). - wifi: rsi: fix kthread lifetime race between self-exit and external-stop (git-fixes). - wifi: mac80211: drop stray 'static' from fast-RX rx_result (git-fixes). - wifi: mac80211: check ieee80211_rx_data_set_link return in pubsta MLO path (git-fixes). - wifi: nl80211: require admin perm on SET_PMK / DEL_PMK (git-fixes). - wifi: b43legacy: enforce bounds check on firmware key index in RX path (git-fixes). - wifi: b43: enforce bounds check on firmware key index in b43_rx() (git-fixes). - net: usb: asix: ax88772: re-add usbnet_link_change() in phylink callbacks (git-fixes). - net: wan: fsl_ucc_hdlc: fix ucc_hdlc_remove (git-fixes). - net: wan: fsl_ucc_hdlc: fix uhdlc_memclean (git-fixes). - ASoC: cs35l56: Destroy workqueue in probe error path (git-fixes). - ASoC: cs35l56: Don't use devres to unregister component (git-fixes). - ASoC: fsl_xcvr: Fix event generation for cached controls (git-fixes). - ALSA: usb-audio: midi2: Restart output URBs on resume (git-fixes). - ALSA: firewire-tascam: Do not drop unread control events (git-fixes). - staging: vme_user: added bound check to geoid (stable-fixes). - commit 59f26f5 - efi: pstore: Drop efivar lock when efi_pstore_open() returns with an error (git-fixes). - commit 5e02074 - ptrace: slightly saner 'get_dumpable()' logic (bsc#1265308). - commit a7c7176 - seg6: separate dst_cache for input and output paths in seg6 lwtunnel (CVE-2026-31668 bsc#1263140). - bridge: br_nd_send: linearize skb before parsing ND options (CVE-2026-31682 bsc#1263595). - commit 001a6c2 - tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (CVE-2026-31662 bsc#1263131). - ipv6: icmp: clear skb2->cb in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038 bsc#1264097). - iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (CVE-2026-31505 bsc#1263093). - can: gw: fix OOB heap access in cgw_csum_crc8_rel() (CVE-2026-31570 bsc#1263065). - atm: lec: fix use-after-free in sock_def_readable() (CVE-2026-43050 bsc#1264082). - commit 1116ef5 - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() (CVE-2026-43437 bsc#1265126). - commit 3fdd8bf - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CVE-2026-43334 bsc#1265090). - commit dc24bd4 - ALSA: mixer: oss: Add card disconnect checkpoints (CVE-2026-43126 bsc#1264634). - commit 2dc845f - wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110 bsc#1264482). - commit c50a71a - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CVE-2026-31488 bsc#1262746). - commit 7991223 - Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() (CVE-2026-31512 bsc#1262734). - commit 5ce5473 - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685 bsc#1263668). - commit ecee315 - netfilter: ctnetlink: ignore explicit helper on new expectations (CVE-2026-43025 bsc#1263931). - commit 96c1319 - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027 bsc#1263933). - commit 652688a - netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190 bsc#1264848). - commit 0b53f94 - net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled (CVE-2026-43441 bsc#1264674). - commit 3361ec7 - netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329 bsc#1265085). - commit 28f800b - vxlan: validate ND option lengths in vxlan_na_create (CVE-2026-31738 bsc#1264059). - commit 1854232 - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (bsc#1263170 CVE-2026-31656) - commit 5344cae - selftests/bpf: Add more precision tracking tests for atomics (CVE-2026-43009 bsc#1264014). - commit 1c3f25f - bpf: Fix incorrect pruning due to atomic fetch precision tracking (CVE-2026-43009 bsc#1264014). - commit 7f14444 ++++ util-linux-systemd: - loopdev: Prevent unauthorized read access to symlinked filesystem images (bsc#1261606, CVE-2026-27456, util-linux-CVE-2026-27456.patch). ++++ util-linux: - loopdev: Prevent unauthorized read access to symlinked filesystem images (bsc#1261606, CVE-2026-27456, util-linux-CVE-2026-27456.patch). ++++ open-vm-tools: - update to 13.1.0 release based on build 25218885: (boo#1265304) Please refer to the Release Notes at https://github.com/vmware/open-vm-tools/blob/stable-13.1.0/ReleaseNotes.md. Support for GNOME Toolkit version 4. This release of open-vm-tools supports building with either the GNOME Toolkit version 4 (GTK4) or to continue using version 3 (GTK3). The configure script will accept options to restrict the build to either GTK3 or GTK4. If no restriction is applied, the latest version for which the required development package(s) are installed will be used. Please see the What's New section of the Release Notes for details. The following github issues have been resolved: - issue #707 - issue #763 The granular changes that have gone into the open-vm-tools 13.1.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-13.1.0/open-vm-tools/ChangeLog. For a more complete description of what is new in this release, see the What's New and Resolved Issues sections of the Release Notes. https://github.com/vmware/open-vm-tools/blob/stable-13.1.0/ReleaseNotes.md#whatsnew https://github.com/vmware/open-vm-tools/blob/stable-13.1.0/ReleaseNotes.md#resolved-issues ------------------------------------------------------------------ ------------------ 2026-5-14 - May 14 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - netfilter: xt_multiport: validate range encoding in checkentry (CVE-2026-31681 bsc#1263593). - commit 7b212df - netfilter: nft_ct: drop pending enqueued packets on removal (CVE-2026-43060 bsc#1264183). - commit d1173bc - netfilter: nf_conntrack_expect: skip expectations in other netns via proc (CVE-2026-31496 bsc#1262673). - commit 74f2ac3 - net: af_key: zero aligned sockaddr tail in PF_KEY exports (CVE-2026-43088 bsc#1264469). - commit 341f2a8 - io_uring/kbuf: check if target buffer list is still legacy on recycle (CVE-2026-43366 bsc#1265116). - commit 8443276 - btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create (CVE-2026-31519 bsc#1263012). - commit 84e52ca - ceph: fix memory leaks in ceph_mdsc_build_path() (CVE-2026-43419 bsc#1264661). - commit 1ad98c2 - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (git-fixes). - commit 9bb4bde - KVM: x86: check for nEPT/nNPT in slow flush hypercalls (git-fixes). - commit a8658e7 - pmdomain: bcm: bcm2835-power: Increase ASB control timeout (CVE-2026-31550 bsc#1263104) - commit de9c81c - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (bsc#1264013 CVE-2025-54518). - commit f788381 - io-wq: check that the predecessor is hashed in io_wq_remove_pending() (git-fixes). - commit fcb4942 ++++ kernel-rt: - netfilter: xt_multiport: validate range encoding in checkentry (CVE-2026-31681 bsc#1263593). - commit 7b212df - netfilter: nft_ct: drop pending enqueued packets on removal (CVE-2026-43060 bsc#1264183). - commit d1173bc - netfilter: nf_conntrack_expect: skip expectations in other netns via proc (CVE-2026-31496 bsc#1262673). - commit 74f2ac3 - net: af_key: zero aligned sockaddr tail in PF_KEY exports (CVE-2026-43088 bsc#1264469). - commit 341f2a8 - io_uring/kbuf: check if target buffer list is still legacy on recycle (CVE-2026-43366 bsc#1265116). - commit 8443276 - btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create (CVE-2026-31519 bsc#1263012). - commit 84e52ca - ceph: fix memory leaks in ceph_mdsc_build_path() (CVE-2026-43419 bsc#1264661). - commit 1ad98c2 - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (git-fixes). - commit 9bb4bde - KVM: x86: check for nEPT/nNPT in slow flush hypercalls (git-fixes). - commit a8658e7 - pmdomain: bcm: bcm2835-power: Increase ASB control timeout (CVE-2026-31550 bsc#1263104) - commit de9c81c - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (bsc#1264013 CVE-2025-54518). - commit f788381 - io-wq: check that the predecessor is hashed in io_wq_remove_pending() (git-fixes). - commit fcb4942 ++++ kernel-rt_debug: - netfilter: xt_multiport: validate range encoding in checkentry (CVE-2026-31681 bsc#1263593). - commit 7b212df - netfilter: nft_ct: drop pending enqueued packets on removal (CVE-2026-43060 bsc#1264183). - commit d1173bc - netfilter: nf_conntrack_expect: skip expectations in other netns via proc (CVE-2026-31496 bsc#1262673). - commit 74f2ac3 - net: af_key: zero aligned sockaddr tail in PF_KEY exports (CVE-2026-43088 bsc#1264469). - commit 341f2a8 - io_uring/kbuf: check if target buffer list is still legacy on recycle (CVE-2026-43366 bsc#1265116). - commit 8443276 - btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create (CVE-2026-31519 bsc#1263012). - commit 84e52ca - ceph: fix memory leaks in ceph_mdsc_build_path() (CVE-2026-43419 bsc#1264661). - commit 1ad98c2 - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (git-fixes). - commit 9bb4bde - KVM: x86: check for nEPT/nNPT in slow flush hypercalls (git-fixes). - commit a8658e7 - pmdomain: bcm: bcm2835-power: Increase ASB control timeout (CVE-2026-31550 bsc#1263104) - commit de9c81c - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (bsc#1264013 CVE-2025-54518). - commit f788381 - io-wq: check that the predecessor is hashed in io_wq_remove_pending() (git-fixes). - commit fcb4942 ++++ expat: - update to 2.8.1 (bsc#1264713, CVE-2026-45186, bsc#1262263, CVE-2026-41080): * Fix quadratic runtime from attribute name collision checks that allowed denial of service attacks through moderately sized crafted XML input (CWE-407). Please note that a layer of compression around XML can significantly reduce the minimum attack payload size. * CVE-2026-41080 -- The existing hash flooding protection only used 4 to 8 bytes of entropy for * a salt, when 16 bytes of salt are supported by the * implementation of SipHash used by Expat. Now full 16 bytes * of entropy are used to improve protection against hash * flooding attacks. * Existing API function XML_SetHashSalt is now deprecated * because of its limitations, and its use should be * considered a vulnerability. Please either use the new API * function XML_SetHashSalt16Bytes (with known-high-quality * entropy input only!) instead, or leave the derivation of * a 16-bytes hash salt from high quality entropy to Expat's * internal machinery (by *not* calling either of the two * XML_SetHashSalt* functions). ------------------------------------------------------------------ ------------------ 2026-5-13 - May 13 2026 ------------------- ------------------------------------------------------------------ ++++ docker: - Update to Docker 29.4.0. See upstream changelog online at - Update to buildx 0.33.0. See upstream changelog online at - Rebased patches: * 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch * 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-openSUSE-point-users-to-docker-buildx-package.patch * cli-0002-SECRETS-SUSE-default-to-DOCKER_BUILDKIT-0-for-docker.patch - Removed patch * 0007-CVE-2025-58181-fix-vendor-crypto-ssh.patch (applicable only when docker version < v29.1.0) ++++ iproute2: - update to a copy of SLE15 SP6 package * update to upstream 6.4 release - bridge: mdb: added underlay destination IP support, UDP destination port support, destination VNI support, source VNI support, outgoing interface support - macvlan: added the "bclim" parameter * existing patches moved to patches.tar.xz: - adjust-installation-directories-for-openSUSE-SLE.patch - use-sysconf-_SC_CLK_TCK-if-HZ-undefined.patch - add-explicit-typecast-to-avoid-gcc-warning.patch - split-link-and-compile-steps-for-binaries.patch - support display of bound but unconnected sockets (bsc#1204562) * ss-Add-support-for-dumping-TCP-bound-inactive-socket.patch - avoid spurious cgroup warning (bsc#1234383): - ss-Tone-down-cgroup-path-resolution.patch - add post-6.4 follow-up fixes (bsc#1243005): * bond-fix-stack-smash-in-xstats.patch * bpf-fix-warning-from-basename.patch * bridge-fdb-add-an-error-print-for-unknown-command.patch * bridge-vni-Accept-del-command.patch * bridge-vni-Fix-duplicate-group-and-remote-error-mess.patch * bridge-vni-Fix-vni-filter-help-strings.patch * bridge-vni-Remove-dead-code-in-group-argument-parsin.patch * bridge-vni-Report-duplicate-vni-argument-using-dupar.patch * f_flower-Treat-port-0-as-valid.patch * genl-ctrl.c-spelling-fix-in-error-message.patch * ip-Add-missing-echo-option-to-usage.patch * ip-Add-missing-stats-command-to-usage.patch * ip-ipmroute-use-preferred_family-to-get-prefix.patch * ip-remove-non-existent-amt-subcommand-from-usage.patch * iplink-fix-fd-leak-when-playing-with-netns.patch * iplink_bridge-fix-incorrect-root-id-dump.patch * iplink_xstats-spelling-fix-in-error-message.patch * iproute2-fix-type-incompatibility-in-ifstat.c.patch * iproute2-prevent-memory-leak.patch * libnetlink-validate-nlmsg-header-length-first.patch * man-devlink-resource-add-missing-words-in-the-exampl.patch * mnl_utils-sanitize-incoming-netlink-payload-size-in-.patch * rdma-Fix-help-information-of-rdma-resource.patch * rdma-Fix-the-error-of-accessing-string-variable-outs.patch * rdma-use-print_XXX-instead-of-COLOR_NONE.patch * ss-Fix-socket-type-check-in-packet_show_line.patch * ss-fix-directory-leak-when-T-option-is-used.patch * ss-mptcp-display-info-counters-as-unsigned.patch * ss-prevent-Process-column-from-being-printed-unless-.patch * ss-show-extra-info-when-processes-is-not-used.patch * tc-gred-fix-debug-print.patch * tc-taprio-don-t-print-netlink-attributes-which-weren.patch * tc-taprio-fix-JSON-output-when-TCA_TAPRIO_ATTR_ADMIN.patch * tc-taprio-fix-parsing-of-fp-option-when-it-doesn-t-a.patch * vdpa-consume-device_features-parameter.patch - devlink: support ipsec_crypto and ipsec_packet cap (bsc#1248660) * add devlink-Support-setting-port-function-ipsec_crypto-c.patch * add devlink-Support-setting-port-function-ipsec_packet-c.patch * refresh ss-Tone-down-cgroup-path-resolution.patch - sync UAPI header copies with SLE15-SP6 kernel * sync-UAPI-header-copies-with-SLE15-SP6.patch - add CVE fix (CVE-2024-58251 bsc#1254324) * ss-escape-characters-in-command-name.patch ++++ kernel-default: - net: skbuff: propagate shared-frag marker through pskb_copy() (CVE-2026-46300 bsc#1265209). - commit 7c5b30e - crypto: caam - fix overflow on long hmac keys (CVE-2026-43330 bsc#1264801). - commit ff3f6e1 - KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (CVE-2026-43214 bsc#1264651). - commit 6e4d171 - KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() (CVE-2026-43265 bsc#1264427). - commit f25583e - smb: client: fix OOB reads parsing symlink error response (bsc#1263769 CVE-2026-31613) - commit b4021f9 - smb: client: correctly handle ErrorContextData as a flexible array (git-fixes) - commit df3ad57 - Refresh patches.suse/x86-CPU-AMD-Prevent-improper-isolation-of-shared-resources.patch. - commit 672c4f5 - nfnetlink_osf: validate individual option lengths in fingerprints (CVE-2026-23397 bsc#1260728). - commit d44e384 - usbip: validate number_of_packets in usbip_pack_ret_submit() (CVE-2026-31607 bsc#1263600). - commit 6b244db - xfs: fix undersized l_iclog_roundoff values (CVE-2026-43365 bsc#1265119). - commit 053332c - net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684 bsc#1263596). - commit 3f23f03 - net/sched: cls_fw: fix NULL dereference of "old" filters before change() (git-fixes). - commit 37b93f7 - ipv6: avoid overflows in ip6_datagram_send_ctl() (CVE-2026-31415 bsc#1262099). - net/sched: cls_fw: fix NULL pointer dereference on shared blocks (CVE-2026-31421 bsc#1262061). - ip6_tunnel: clear skb2->cb in ip4ip6_err() (CVE-2026-43037 bsc#1263995). - af_key: validate families in pfkey_send_migrate() (CVE-2026-31515 bsc#1262752). - openvswitch: validate MPLS set/set_masked payload length (CVE-2026-31679 bsc#1263592). - commit 787e11b - net/sched: sch_netem: fix out-of-bounds access in packet corruption (CVE-2026-31675 bsc#1263556). - commit 8380a87 - ibmveth: Disable GSO for packets with small MSS (bsc#1265144). - commit f85e566 - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (CVE-2026-31700 bsc#1263882). - commit 554d459 ++++ kernel-rt: - net: skbuff: propagate shared-frag marker through pskb_copy() (CVE-2026-46300 bsc#1265209). - commit 7c5b30e - crypto: caam - fix overflow on long hmac keys (CVE-2026-43330 bsc#1264801). - commit ff3f6e1 - KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (CVE-2026-43214 bsc#1264651). - commit 6e4d171 - KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() (CVE-2026-43265 bsc#1264427). - commit f25583e - smb: client: fix OOB reads parsing symlink error response (bsc#1263769 CVE-2026-31613) - commit b4021f9 - smb: client: correctly handle ErrorContextData as a flexible array (git-fixes) - commit df3ad57 - Refresh patches.suse/x86-CPU-AMD-Prevent-improper-isolation-of-shared-resources.patch. - commit 672c4f5 - nfnetlink_osf: validate individual option lengths in fingerprints (CVE-2026-23397 bsc#1260728). - commit d44e384 - usbip: validate number_of_packets in usbip_pack_ret_submit() (CVE-2026-31607 bsc#1263600). - commit 6b244db - xfs: fix undersized l_iclog_roundoff values (CVE-2026-43365 bsc#1265119). - commit 053332c - net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684 bsc#1263596). - commit 3f23f03 - net/sched: cls_fw: fix NULL dereference of "old" filters before change() (git-fixes). - commit 37b93f7 - ipv6: avoid overflows in ip6_datagram_send_ctl() (CVE-2026-31415 bsc#1262099). - net/sched: cls_fw: fix NULL pointer dereference on shared blocks (CVE-2026-31421 bsc#1262061). - ip6_tunnel: clear skb2->cb in ip4ip6_err() (CVE-2026-43037 bsc#1263995). - af_key: validate families in pfkey_send_migrate() (CVE-2026-31515 bsc#1262752). - openvswitch: validate MPLS set/set_masked payload length (CVE-2026-31679 bsc#1263592). - commit 787e11b - net/sched: sch_netem: fix out-of-bounds access in packet corruption (CVE-2026-31675 bsc#1263556). - commit 8380a87 - ibmveth: Disable GSO for packets with small MSS (bsc#1265144). - commit f85e566 - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (CVE-2026-31700 bsc#1263882). - commit 554d459 ++++ kernel-rt_debug: - net: skbuff: propagate shared-frag marker through pskb_copy() (CVE-2026-46300 bsc#1265209). - commit 7c5b30e - crypto: caam - fix overflow on long hmac keys (CVE-2026-43330 bsc#1264801). - commit ff3f6e1 - KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (CVE-2026-43214 bsc#1264651). - commit 6e4d171 - KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() (CVE-2026-43265 bsc#1264427). - commit f25583e - smb: client: fix OOB reads parsing symlink error response (bsc#1263769 CVE-2026-31613) - commit b4021f9 - smb: client: correctly handle ErrorContextData as a flexible array (git-fixes) - commit df3ad57 - Refresh patches.suse/x86-CPU-AMD-Prevent-improper-isolation-of-shared-resources.patch. - commit 672c4f5 - nfnetlink_osf: validate individual option lengths in fingerprints (CVE-2026-23397 bsc#1260728). - commit d44e384 - usbip: validate number_of_packets in usbip_pack_ret_submit() (CVE-2026-31607 bsc#1263600). - commit 6b244db - xfs: fix undersized l_iclog_roundoff values (CVE-2026-43365 bsc#1265119). - commit 053332c - net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684 bsc#1263596). - commit 3f23f03 - net/sched: cls_fw: fix NULL dereference of "old" filters before change() (git-fixes). - commit 37b93f7 - ipv6: avoid overflows in ip6_datagram_send_ctl() (CVE-2026-31415 bsc#1262099). - net/sched: cls_fw: fix NULL pointer dereference on shared blocks (CVE-2026-31421 bsc#1262061). - ip6_tunnel: clear skb2->cb in ip4ip6_err() (CVE-2026-43037 bsc#1263995). - af_key: validate families in pfkey_send_migrate() (CVE-2026-31515 bsc#1262752). - openvswitch: validate MPLS set/set_masked payload length (CVE-2026-31679 bsc#1263592). - commit 787e11b - net/sched: sch_netem: fix out-of-bounds access in packet corruption (CVE-2026-31675 bsc#1263556). - commit 8380a87 - ibmveth: Disable GSO for packets with small MSS (bsc#1265144). - commit f85e566 - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (CVE-2026-31700 bsc#1263882). - commit 554d459 ++++ openssh: - Improve %prep LDAP regex to preserve subdirectories (e.g., ope- nbsd-compat/) and handle optional [ab]/ prefixes. ++++ pcr-oracle: - Update to 0.6.2 + Update the SBAT offset boundary check (bsc#1265042) ++++ ucode-intel: - Intel CPU Microcode was updated to the 20260512 release (bsc#1265189) - CVE-2025-35979: Security updates for INTEL-SA-01420 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01420.html - Update for various functional issues. [#]## New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | PTL 404 | A1 | 06-cc-03/90 | | 0000011b | Intel Core Ultra Processor (Series 3) | PTL-H 484/12Xe | A0/B0 | 06-cc-02/90 | | 0000011b | Intel Core Ultra Processor (Series 3) [#]## Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ARL-H | A1 | 06-c5-02/82 | 0000011b | 00000121 | Core Ultra Processor (Series 2) | ARL-S/HX (8P) | B0 | 06-c6-02/82 | 0000011b | 00000121 | Core Ultra Processor (Series 2) | EMR-SP | A1 | 06-cf-02/87 | 210002d3 | 210002e0 | Xeon Scalable Gen5 | GNR-AP/SP | Bx/Hx/Lx | 06-ad-01/95 | 01000405 | 01000423 | Xeon 6900/6700/6500 Series Processors with P-Cores | GNR-D | B0/B1 | 06-ae-01/97 | 01000303 | 01000307 | Xeon 6700P-B/6500P-B Series SoC with P-Cores | GNR-SP R1S | Bx/Hx/Lx | 06-ad-01/20 | 0a000133 | 0a000142 | Xeon 6700/6500-Series Processors with P-Cores | LNL | B0 | 06-bd-01/80 | 00000125 | 00000126 | Core Ultra 200 V Series Processor | SPR-SP | E4/S2 | 06-8f-07/87 | 2b000661 | 2b000670 | Xeon Scalable Gen4 | SPR-SP | E5/S3 | 06-8f-08/87 | 2b000661 | 2b000670 | Xeon Scalable Gen4 | SRF-AP/SP | C0 | 06-af-03/01 | 03000382 | 030003a3 | Xeon 6900/6700-Series Processors with E-Cores ++++ zypper: - Add --filter-version-change to zypper lu. Adds filtering by version change significance to reduce noise in update listings. Supports levels: rebuild (hides rebuild-only changes) and package (hides all release-only changes). - version 1.14.97 ------------------------------------------------------------------ ------------------ 2026-5-12 - May 12 2026 ------------------- ------------------------------------------------------------------ ++++ dnsmasq: - Update to security release 2.92rel2: * CVE-2026-2291, bsc#1258251: dnsmasq can be abused to record false cached data enabling DoS or attacker redirect. * Obsoletes dnsmasq-CVE-2026-2291.patch . * CVE-2026-4890, bsc#1265001: DoS vulnerability in the DNSSEC validation. * CVE-2026-4891, bsc#1265002: heap-based out-of-bounds read vulnerability in the DNSSEC validation. * CVE-2026-4892, bsc#1265003: heap-based out-of-bounds write vulnerability in the DHCPv6 implementation. * CVE-2026-4893, bsc#1265004: information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks. * CVE-2026-5172, bsc#1265006: buffer overflow in dnsmasq’s extract_addresses() function. ++++ kernel-default: - smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774 CVE-2026-31614) - commit 1cd0d33 - ice: set max queues in alloc_etherdev_mqs() (git-fixes). - commit 45beb20 - gtp: disable BH before calling udp_tunnel_xmit_skb() (git-fixes). - commit 2bd1644 ++++ kernel-rt: - smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774 CVE-2026-31614) - commit 1cd0d33 - ice: set max queues in alloc_etherdev_mqs() (git-fixes). - commit 45beb20 - gtp: disable BH before calling udp_tunnel_xmit_skb() (git-fixes). - commit 2bd1644 ++++ kernel-rt_debug: - smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774 CVE-2026-31614) - commit 1cd0d33 - ice: set max queues in alloc_etherdev_mqs() (git-fixes). - commit 45beb20 - gtp: disable BH before calling udp_tunnel_xmit_skb() (git-fixes). - commit 2bd1644 ++++ libzypp: - Mandatory signature verification plugin support (PED#11922) - version 17.38.8 (35) ++++ pcr-oracle: - Update to 0.6.1 + Advance the comparison event pointer after comparison + Partially support shim extra files + Locate shim extra files + Synthesize shim extra events + Fix various issues from review by Claude Code and introduce adversarial testing ------------------------------------------------------------------ ------------------ 2026-5-11 - May 11 2026 ------------------- ------------------------------------------------------------------ ++++ glibc: - ungetwc-byte-stream.patch: libio: Fix ungetwc operating on byte stream (CVE-2026-5928, bsc#1262464, BZ #33998) - scanf-mc-buffer-overflow.patch: stdio-common: Fix buffer overflow in scanf %mc (CVE-2026-5450, bsc#1262465, BZ #34008) ++++ kernel-default: - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers (git-fixes). - commit 6e4ed54 - mkspec: Add signature to source list only when it exists - commit e496e84 - config: s390x/ppc64le: disable unsupported CONFIG_AFS_FS and CONFIG_AF_RXRPC References: bsc#1264450 - commit 280b978 ++++ kernel-rt: - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers (git-fixes). - commit 6e4ed54 - mkspec: Add signature to source list only when it exists - commit e496e84 - config: s390x/ppc64le: disable unsupported CONFIG_AFS_FS and CONFIG_AF_RXRPC References: bsc#1264450 - commit 280b978 ++++ kernel-rt_debug: - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers (git-fixes). - commit 6e4ed54 - mkspec: Add signature to source list only when it exists - commit e496e84 - config: s390x/ppc64le: disable unsupported CONFIG_AFS_FS and CONFIG_AF_RXRPC References: bsc#1264450 - commit 280b978 ++++ lcms2: - Fix CVE-2026-41254 (bsc#1264994), integer overflow in CubeSize in cmslut.c * CVE-2026-41254.patch * CVE-2026-41254-2.patch - Fix CVE-2026-42798 (bsc#1263703), integer overflow in ParseCube in cmscgats.c * CVE-2026-42798.patch ------------------------------------------------------------------ ------------------ 2026-5-8 - May 8 2026 ------------------- ------------------------------------------------------------------ ++++ busybox: - Fix heap buffer overflow vulnerability in the DHCPv6 client (CVE-2026-29004, bsc#1263989) * 0001-udhcpc6-fix-buffer-overflow.patch * 0002-udhcpc6-check-the-size-of-D6_OPT_IAPREFIX-option.patch ++++ kernel-default: - net: macb: use the current queue number for stats (CVE-2026-31494 bsc#1262671). - net: cadence: macb: Synchronize stats calculations (CVE-2026-31494 bsc#1262671). - commit 5471a37 - disable unsupported CONFIG_AFS_FS and CONFIG_AF_RXRPC Yousaf: Removed CONFIG_AFS_DEBUG from config/arm64/debug and config/x86_64/debug - disable unsupported CONFIG_AFS_FS and CONFIG_AF_RXRPC - commit ae0ebb1 ++++ kernel-rt: - net: macb: use the current queue number for stats (CVE-2026-31494 bsc#1262671). - net: cadence: macb: Synchronize stats calculations (CVE-2026-31494 bsc#1262671). - commit 5471a37 - disable unsupported CONFIG_AFS_FS and CONFIG_AF_RXRPC Yousaf: Removed CONFIG_AFS_DEBUG from config/arm64/debug and config/x86_64/debug - disable unsupported CONFIG_AFS_FS and CONFIG_AF_RXRPC - commit ae0ebb1 ++++ kernel-rt_debug: - net: macb: use the current queue number for stats (CVE-2026-31494 bsc#1262671). - net: cadence: macb: Synchronize stats calculations (CVE-2026-31494 bsc#1262671). - commit 5471a37 - disable unsupported CONFIG_AFS_FS and CONFIG_AF_RXRPC Yousaf: Removed CONFIG_AFS_DEBUG from config/arm64/debug and config/x86_64/debug - disable unsupported CONFIG_AFS_FS and CONFIG_AF_RXRPC - commit ae0ebb1 ++++ openssh: - Added openssh-cve-2026-35385-scp-setuid-modes.patch (CVE-2026-35385, bsc#1261427), ensuring setuid bits default to being masked out by scp. - Added openssh-cve-2026-35414-mishandled-ca-commas.patch (CVE-2026-35414, bsc#1261430), fixing mishandling of comma characters in CA in certain situations. ------------------------------------------------------------------ ------------------ 2026-5-7 - May 7 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - supported.conf: drop rxrpc and afs_fs (bsc#1264450) - commit e146a57 - dm init: ensure device probing has finished in dm-mod.waitfor= (git-fixes). - commit 8556eb6 - xfrm: esp: avoid in-place decrypt on shared skb frags (bsc#1264449). - commit e2cf3b5 - fuse: reject oversized dirents in page cache (CVE-2026-31694 bsc#1263901). - commit a96975d - kABI fix after KVM: x86: Use scratch field in MMIO fragment to hold small write values (CVE-2026-31588 bsc#1263165). - commit 3f577a5 - KVM: x86: Use scratch field in MMIO fragment to hold small write values (CVE-2026-31588 bsc#1263165). - commit da2d350 - ALSA: ctxfi: Limit PTP to a single page (CVE-2026-31602 bsc#1263723). - commit 7aede2c - Xarray: do not return sibling entries from xas_find_marked() (bsc#1263815). - commit cc4d1b2 - crypto: caam - fix DMA corruption on long hmac keys (CVE-2026-43044 bsc#1264087). - commit 7ca9379 ++++ kernel-rt: - supported.conf: drop rxrpc and afs_fs (bsc#1264450) - commit e146a57 - dm init: ensure device probing has finished in dm-mod.waitfor= (git-fixes). - commit 8556eb6 - xfrm: esp: avoid in-place decrypt on shared skb frags (bsc#1264449). - commit e2cf3b5 - fuse: reject oversized dirents in page cache (CVE-2026-31694 bsc#1263901). - commit a96975d - kABI fix after KVM: x86: Use scratch field in MMIO fragment to hold small write values (CVE-2026-31588 bsc#1263165). - commit 3f577a5 - KVM: x86: Use scratch field in MMIO fragment to hold small write values (CVE-2026-31588 bsc#1263165). - commit da2d350 - ALSA: ctxfi: Limit PTP to a single page (CVE-2026-31602 bsc#1263723). - commit 7aede2c - Xarray: do not return sibling entries from xas_find_marked() (bsc#1263815). - commit cc4d1b2 - crypto: caam - fix DMA corruption on long hmac keys (CVE-2026-43044 bsc#1264087). - commit 7ca9379 ++++ kernel-rt_debug: - supported.conf: drop rxrpc and afs_fs (bsc#1264450) - commit e146a57 - dm init: ensure device probing has finished in dm-mod.waitfor= (git-fixes). - commit 8556eb6 - xfrm: esp: avoid in-place decrypt on shared skb frags (bsc#1264449). - commit e2cf3b5 - fuse: reject oversized dirents in page cache (CVE-2026-31694 bsc#1263901). - commit a96975d - kABI fix after KVM: x86: Use scratch field in MMIO fragment to hold small write values (CVE-2026-31588 bsc#1263165). - commit 3f577a5 - KVM: x86: Use scratch field in MMIO fragment to hold small write values (CVE-2026-31588 bsc#1263165). - commit da2d350 - ALSA: ctxfi: Limit PTP to a single page (CVE-2026-31602 bsc#1263723). - commit 7aede2c - Xarray: do not return sibling entries from xas_find_marked() (bsc#1263815). - commit cc4d1b2 - crypto: caam - fix DMA corruption on long hmac keys (CVE-2026-43044 bsc#1264087). - commit 7ca9379 ++++ rsync: - Security update (CVE-2026-41035, bsc#1262223): rsync: count of entries mismatch can lead to a use-after-free - Add rsync-CVE-2026-41035.patch ------------------------------------------------------------------ ------------------ 2026-5-6 - May 6 2026 ------------------- ------------------------------------------------------------------ ++++ gnutls: - Security fixes: * CVE-2026-33846: buffers: add more checks to DTLS reassembly (bsc#1263705) * CVE-2026-42009: lib/buffers: ensure packets have differing sequence numbers (bsc#1263708) * CVE-2026-33845: buffers: switch from end_offset over to frag_length (bsc#1263704) * CVE-2026-42010: lib/auth/rsa_psk: fix binary PSK identity lookup (bsc#1263709) * CVE-2026-3833: x509/name-constraints: compare domain names case-insensitive (bsc#1263707) * CVE-2026-42011: x509/name_constraints: fix intersecting empty constraints (bsc#1263710) * CVE-2026-42012: x509/hostname-verify: make URI/SRV SAN preclude CN fallback (bsc#1263711) * CVE-2026-42013: x509: prevent fallback on oversized SAN (bsc#1263712) * CVE-2026-42014: pkcs11_write: fix UAF and leak in gnutls_pkcs11_token_set_pin (bsc#1263713) * CVE-2026-42015: x509/pkcs12_bag: fix off-by-one in bag element bounds check (bsc#1263714) * CVE-2026-5260: lib/pkcs11_privkey: guard against overreading on short ciphertexts (bsc#1263715) * CVE-2026-5419: gnutls_cipher_decrypt3: make PKCS#7 unpadding branch free (bsc#1263716) * Add patches: gnutls-CVE-2026-33846.patch gnutls-CVE-2026-42009.patch gnutls-CVE-2026-33845.patch gnutls-CVE-2026-42010.patch gnutls-CVE-2026-3833.patch gnutls-CVE-2026-42011.patch gnutls-CVE-2026-42012.patch gnutls-CVE-2026-42013.patch gnutls-CVE-2026-42014.patch gnutls-CVE-2026-5260.patch gnutls-CVE-2026-42015.patch gnutls-CVE-2026-5419.patch ++++ kernel-default: - KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (git-fixes). - commit 48ffbc3 - KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (git-fixes). - commit f2fdc97 - selftests/bpf: Add tests for sdiv32/smod32 with INT_MIN dividend (CVE-2026-31525 bsc#1262725). - commit 0ba5380 - bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN (CVE-2026-31525 bsc#1262725). - commit f9373c2 ++++ kernel-rt: - KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (git-fixes). - commit 48ffbc3 - KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (git-fixes). - commit f2fdc97 - selftests/bpf: Add tests for sdiv32/smod32 with INT_MIN dividend (CVE-2026-31525 bsc#1262725). - commit 0ba5380 - bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN (CVE-2026-31525 bsc#1262725). - commit f9373c2 ++++ kernel-rt_debug: - KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (git-fixes). - commit 48ffbc3 - KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (git-fixes). - commit f2fdc97 - selftests/bpf: Add tests for sdiv32/smod32 with INT_MIN dividend (CVE-2026-31525 bsc#1262725). - commit 0ba5380 - bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN (CVE-2026-31525 bsc#1262725). - commit f9373c2 ++++ krb5: - Fix Fix two NegoEx parsing vulnerabilities: * CVE-2026-40355, bsc#1263366 * CVE-2026-40356, bsc#1263367 - Add patch 0011-Fix-two-NegoEx-parsing-vulnerabilities.patch ------------------------------------------------------------------ ------------------ 2026-5-5 - May 5 2026 ------------------- ------------------------------------------------------------------ ++++ glibc: - ibm139x-pending-char-state.patch: Use pending character state in IBM1390, IBM1399 character sets (CVE-2026-4046, bsc#1261206, BZ #33980) ++++ kernel-default: - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263176 CVE-2026-31586). - commit 4d6e307 - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (git-fixes). - commit a7f35f1 - KVM: x86: Ignore cpuid faulting in SMM (git-fixes). - commit 5237a47 - KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (git-fixes). - commit 4aad3ae - mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669 bsc#1263141). - commit 99d5df9 - net: fix fanout UAF in packet_release() via NETDEV_UP race (CVE-2026-31504 bsc#1263085). - commit 249d605 - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (CVE-2026-31533 bsc#1262758). - commit 6cd641f - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (bsc#1264013 CVE-2025-54518). - commit 37dfa14 - ipmi:si: Return state to normal if message allocation fails (git-fixes). - ipmi: Check event message buffer response for bad data (git-fixes). - commit ed7a5de - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler (CVE-2026-31622 bsc#1263797). - commit aaf3f00 - net: stmmac: fix integer underflow in chain mode (CVE-2026-31649 bsc#1263582). - commit 218af5d - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer (CVE-2026-31507 bsc#1263095). - commit a24ca79 ++++ kernel-rt: - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263176 CVE-2026-31586). - commit 4d6e307 - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (git-fixes). - commit a7f35f1 - KVM: x86: Ignore cpuid faulting in SMM (git-fixes). - commit 5237a47 - KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (git-fixes). - commit 4aad3ae - mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669 bsc#1263141). - commit 99d5df9 - net: fix fanout UAF in packet_release() via NETDEV_UP race (CVE-2026-31504 bsc#1263085). - commit 249d605 - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (CVE-2026-31533 bsc#1262758). - commit 6cd641f - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (bsc#1264013 CVE-2025-54518). - commit 37dfa14 - ipmi:si: Return state to normal if message allocation fails (git-fixes). - ipmi: Check event message buffer response for bad data (git-fixes). - commit ed7a5de - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler (CVE-2026-31622 bsc#1263797). - commit aaf3f00 - net: stmmac: fix integer underflow in chain mode (CVE-2026-31649 bsc#1263582). - commit 218af5d - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer (CVE-2026-31507 bsc#1263095). - commit a24ca79 ++++ kernel-rt_debug: - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263176 CVE-2026-31586). - commit 4d6e307 - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (git-fixes). - commit a7f35f1 - KVM: x86: Ignore cpuid faulting in SMM (git-fixes). - commit 5237a47 - KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (git-fixes). - commit 4aad3ae - mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669 bsc#1263141). - commit 99d5df9 - net: fix fanout UAF in packet_release() via NETDEV_UP race (CVE-2026-31504 bsc#1263085). - commit 249d605 - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (CVE-2026-31533 bsc#1262758). - commit 6cd641f - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (bsc#1264013 CVE-2025-54518). - commit 37dfa14 - ipmi:si: Return state to normal if message allocation fails (git-fixes). - ipmi: Check event message buffer response for bad data (git-fixes). - commit ed7a5de - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler (CVE-2026-31622 bsc#1263797). - commit aaf3f00 - net: stmmac: fix integer underflow in chain mode (CVE-2026-31649 bsc#1263582). - commit 218af5d - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer (CVE-2026-31507 bsc#1263095). - commit a24ca79 ++++ sqlite3: - Update to version 3.53.1: * Fixes for problems in 3.53.0 reported by users. * See the check-in timeline for details: https://sqlite.org/src/timeline?from=version-3.53.0&to=version-3.53.1 ++++ python-lxml: - CVE-2026-41066: Information disclosure via untrusted XML input leading to local file read (bsc#1263254) Add patches: * CVE-2026-41066.patch * disable-external-entity-resolution.patch - Add upstream patch to fix tests with libexpat 2.6, gh#lxml/lxml@3ccc7d583, libexpat-2.6.patch ------------------------------------------------------------------ ------------------ 2026-5-4 - May 4 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - Update patches.suse/tracing-net_sched-NULL-pointer-dereference-in-perf_trace_qdisc_reset.patch (git-fixes bsc#1263149). Add the same check for qdisc_dev(q) being NULL to TP_fast_assign() in the definition of the qdisc_reset event, since the codestream doesn't have mainline commit c1fa617caeb0 ("tracing: Rework __assign_str() and __string() to not duplicate getting the string"). - commit 8327a2b - rds: ib: reject FRMR registration before IB connection is established (CVE-2026-31425 bsc#1262074). - bridge: mrp: reject zero test interval to avoid OOM panic (CVE-2026-31420 bsc#1262055). - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CVE-2026-31411 bsc#1261752). - commit 942ce54 - drm/amd/display: Read EDID from VBIOS embedded panel info (git-fixes). - drm/amd/display: Allow DCE link encoder without AUX registers (git-fixes). - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring (git-fixes). - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring (git-fixes). - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring (git-fixes). - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring (git-fixes). - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring (git-fixes). - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring (git-fixes). - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring (git-fixes). - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring (git-fixes). - drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring (git-fixes). - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings (git-fixes). - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings (git-fixes). - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings (git-fixes). - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) (git-fixes). - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG (git-fixes). - drm/amdgpu/gmc: Fix AMDGPU_GART_PLACEMENT_LOW to not overlap with VRAM (git-fixes). - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (git-fixes). - net: phy: dp83869: fix setting CLK_O_SEL field (git-fixes). - NFC: trf7970a: Ignore antenna noise when checking for RF field (git-fixes). - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit (git-fixes). - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() (git-fixes). - ASoC: codecs: ab8500: Fix casting of private data (git-fixes). - sound: ua101: fix division by zero at probe (git-fixes). - commit 150c3ab - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug (git-fixes). - ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error (git-fixes). - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() (git-fixes). - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams (git-fixes). - ALSA: caiaq: Don't abort when no input device is available (git-fixes). - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path (git-fixes). - ALSA: caiaq: fix usb_dev refcount leak on probe failure (git-fixes). - ALSA: usb-audio: Fix UAC3 cluster descriptor size check (git-fixes). - commit 49c4aad ++++ kernel-rt: - Update patches.suse/tracing-net_sched-NULL-pointer-dereference-in-perf_trace_qdisc_reset.patch (git-fixes bsc#1263149). Add the same check for qdisc_dev(q) being NULL to TP_fast_assign() in the definition of the qdisc_reset event, since the codestream doesn't have mainline commit c1fa617caeb0 ("tracing: Rework __assign_str() and __string() to not duplicate getting the string"). - commit 8327a2b - rds: ib: reject FRMR registration before IB connection is established (CVE-2026-31425 bsc#1262074). - bridge: mrp: reject zero test interval to avoid OOM panic (CVE-2026-31420 bsc#1262055). - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CVE-2026-31411 bsc#1261752). - commit 942ce54 - drm/amd/display: Read EDID from VBIOS embedded panel info (git-fixes). - drm/amd/display: Allow DCE link encoder without AUX registers (git-fixes). - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring (git-fixes). - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring (git-fixes). - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring (git-fixes). - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring (git-fixes). - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring (git-fixes). - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring (git-fixes). - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring (git-fixes). - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring (git-fixes). - drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring (git-fixes). - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings (git-fixes). - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings (git-fixes). - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings (git-fixes). - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) (git-fixes). - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG (git-fixes). - drm/amdgpu/gmc: Fix AMDGPU_GART_PLACEMENT_LOW to not overlap with VRAM (git-fixes). - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (git-fixes). - net: phy: dp83869: fix setting CLK_O_SEL field (git-fixes). - NFC: trf7970a: Ignore antenna noise when checking for RF field (git-fixes). - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit (git-fixes). - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() (git-fixes). - ASoC: codecs: ab8500: Fix casting of private data (git-fixes). - sound: ua101: fix division by zero at probe (git-fixes). - commit 150c3ab - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug (git-fixes). - ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error (git-fixes). - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() (git-fixes). - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams (git-fixes). - ALSA: caiaq: Don't abort when no input device is available (git-fixes). - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path (git-fixes). - ALSA: caiaq: fix usb_dev refcount leak on probe failure (git-fixes). - ALSA: usb-audio: Fix UAC3 cluster descriptor size check (git-fixes). - commit 49c4aad ++++ kernel-rt_debug: - Update patches.suse/tracing-net_sched-NULL-pointer-dereference-in-perf_trace_qdisc_reset.patch (git-fixes bsc#1263149). Add the same check for qdisc_dev(q) being NULL to TP_fast_assign() in the definition of the qdisc_reset event, since the codestream doesn't have mainline commit c1fa617caeb0 ("tracing: Rework __assign_str() and __string() to not duplicate getting the string"). - commit 8327a2b - rds: ib: reject FRMR registration before IB connection is established (CVE-2026-31425 bsc#1262074). - bridge: mrp: reject zero test interval to avoid OOM panic (CVE-2026-31420 bsc#1262055). - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CVE-2026-31411 bsc#1261752). - commit 942ce54 - drm/amd/display: Read EDID from VBIOS embedded panel info (git-fixes). - drm/amd/display: Allow DCE link encoder without AUX registers (git-fixes). - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring (git-fixes). - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring (git-fixes). - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring (git-fixes). - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring (git-fixes). - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring (git-fixes). - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring (git-fixes). - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring (git-fixes). - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring (git-fixes). - drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring (git-fixes). - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings (git-fixes). - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings (git-fixes). - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings (git-fixes). - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) (git-fixes). - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG (git-fixes). - drm/amdgpu/gmc: Fix AMDGPU_GART_PLACEMENT_LOW to not overlap with VRAM (git-fixes). - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (git-fixes). - net: phy: dp83869: fix setting CLK_O_SEL field (git-fixes). - NFC: trf7970a: Ignore antenna noise when checking for RF field (git-fixes). - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit (git-fixes). - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() (git-fixes). - ASoC: codecs: ab8500: Fix casting of private data (git-fixes). - sound: ua101: fix division by zero at probe (git-fixes). - commit 150c3ab - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug (git-fixes). - ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error (git-fixes). - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() (git-fixes). - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams (git-fixes). - ALSA: caiaq: Don't abort when no input device is available (git-fixes). - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path (git-fixes). - ALSA: caiaq: fix usb_dev refcount leak on probe failure (git-fixes). - ALSA: usb-audio: Fix UAC3 cluster descriptor size check (git-fixes). - commit 49c4aad ++++ python-pyOpenSSL: - CVE-2026-40475: improper input handling of null bytes can lead to silent data truncation and security-state inconsistency (bsc#1262803) * CVE-2026-40475.patch ------------------------------------------------------------------ ------------------ 2026-5-3 - May 3 2026 ------------------- ------------------------------------------------------------------ ++++ nvidia-open-driver-G06-signed: - fix-objtool-warnings.patch (not applied on aarch64) * Get rid of "'naked' return found in MITIGATION_RETHUNK build" objtool warnings (boo#1212841, boo#1263834) - remove again disable-objtool-override.patch ------------------------------------------------------------------ ------------------ 2026-5-1 - May 1 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - crypto: authencesn - Fix src offset when decrypting in-place (bsc#1262573 CVE-2026-31431). - commit 00dc708 - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (bsc#1262573 CVE-2026-31431). - commit 3756951 - crypto: authenc - use memcpy_sglist() instead of null skcipher (bsc#1262573 CVE-2026-31431). - Refresh patches.suse/crypto-authencesn-reject-too-short-AAD-assoclen-8-to.patch - commit ce64565 ++++ kernel-rt: - crypto: authencesn - Fix src offset when decrypting in-place (bsc#1262573 CVE-2026-31431). - commit d2ff634 - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (bsc#1262573 CVE-2026-31431). - commit 5b8dd6e - crypto: authenc - use memcpy_sglist() instead of null skcipher (bsc#1262573 CVE-2026-31431). - Refresh patches.suse/crypto-authencesn-reject-too-short-AAD-assoclen-8-to.patch - commit 272eebb ++++ kernel-rt_debug: - crypto: authencesn - Fix src offset when decrypting in-place (bsc#1262573 CVE-2026-31431). - commit d2ff634 - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (bsc#1262573 CVE-2026-31431). - commit 5b8dd6e - crypto: authenc - use memcpy_sglist() instead of null skcipher (bsc#1262573 CVE-2026-31431). - Refresh patches.suse/crypto-authencesn-reject-too-short-AAD-assoclen-8-to.patch - commit 272eebb ++++ python311-core: - Remove macros.python3. ++++ python311: - Remove macros.python3. ------------------------------------------------------------------ ------------------ 2026-4-30 - Apr 30 2026 ------------------- ------------------------------------------------------------------ ++++ containerd: - Add patch for CVE-2026-33186 (bsc#1260296): * 0002-CVE-2026-33186-containerd-google.golang.org-grpc-aut.patch ++++ kernel-default: - kABI: Restore af_alg_{count,pull}_tsgl() signatures (bsc#1262573 CVE-2026-31431). - commit 6b01c90 - crypto: algif_aead - Revert to operating out-of-place (bsc#1262573 CVE-2026-31431). - commit 6bcb58c - crypto: algif_aead - use memcpy_sglist() instead of null skcipher (bsc#1262573 CVE-2026-31431). - commit ad83acd - crypto: scatterwalk - Fix memcpy_sglist() to always succeed (bsc#1262573 CVE-2026-31431). - commit 18a46ad - crypto: scatterwalk - Add memcpy_sglist (bsc#1262573 CVE-2026-31431). - commit 174b840 - net: mana: Fix EQ leak in mana_remove on NULL port (git-fixes). - net: mana: Don't overwrite port probe error with add_adev result (git-fixes). - net: mana: Guard mana_remove against double invocation (git-fixes). - net: mana: Init gf_stats_work before potential error paths in probe (git-fixes). - net: mana: Init link_change_work before potential error paths in probe (git-fixes). - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (git-fixes). - RDMA/mana_ib: Support memory windows (git-fixes). - RDMA/mana_ib: Disable RX steering on RSS QP destroy (git-fixes). - RDMA/mana_ib: cleanup the usage of mana_gd_send_request() (git-fixes). - net: mana: Use pci_name() for debugfs directory naming (git-fixes). - net: mana: hardening: Validate adapter_mtu from MANA_QUERY_DEV_CONFIG (git-fixes). - net: mana: Use at least SZ_4K in doorbell ID range check (git-fixes). - net: mana: Set default number of queues to 16 (bsc#1261648). - net: mana: hardening: Validate doorbell ID from GDMA_REGISTER_DEVICE response (git-fixes). - net: mana: Add MAC address to vPort logs and clarify error messages (git-fixes). - add mainline tag to mana patch - PCI: hv: Set default NUMA node to 0 for devices without affinity info (git-fixes). - net: mana: Fix RX skb truesize accounting (bsc#1248754). - net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown (git-fixes). - commit fecbcc4 - Update patches.suse/virt-tdx-guest-Fix-handling-of-host-controlled-quote.patch (git-fixes CVE-2026-31470 bsc#1262665). - commit d89b60e - virt: tdx-guest: Return error for GetQuote failures (git-fixes). - commit ce01521 - virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (CVE-2026-31470 bsc#1262665). - commit c143766 - ext4: validate p_idx bounds in ext4_ext_correct_indexes (bsc#1262616 CVE-2026-31449). - commit 815f45c - dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() (CVE-2026-31436 bsc#1262602). - commit 907f228 - Move misplaced upstreamed patches into sorted section - commit 7e931bc ++++ kernel-rt: - kABI: Restore af_alg_{count,pull}_tsgl() signatures (bsc#1262573 CVE-2026-31431). - commit 836e34c - crypto: algif_aead - Revert to operating out-of-place (bsc#1262573 CVE-2026-31431). - commit e25eea2 - crypto: algif_aead - use memcpy_sglist() instead of null skcipher (bsc#1262573 CVE-2026-31431). - commit ee70f2d - crypto: scatterwalk - Fix memcpy_sglist() to always succeed (bsc#1262573 CVE-2026-31431). - commit 72778af - crypto: scatterwalk - Add memcpy_sglist (bsc#1262573 CVE-2026-31431). - commit 55e74e4 - net: mana: Fix EQ leak in mana_remove on NULL port (git-fixes). - net: mana: Don't overwrite port probe error with add_adev result (git-fixes). - net: mana: Guard mana_remove against double invocation (git-fixes). - net: mana: Init gf_stats_work before potential error paths in probe (git-fixes). - net: mana: Init link_change_work before potential error paths in probe (git-fixes). - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (git-fixes). - RDMA/mana_ib: Support memory windows (git-fixes). - RDMA/mana_ib: Disable RX steering on RSS QP destroy (git-fixes). - RDMA/mana_ib: cleanup the usage of mana_gd_send_request() (git-fixes). - net: mana: Use pci_name() for debugfs directory naming (git-fixes). - net: mana: hardening: Validate adapter_mtu from MANA_QUERY_DEV_CONFIG (git-fixes). - net: mana: Use at least SZ_4K in doorbell ID range check (git-fixes). - net: mana: Set default number of queues to 16 (bsc#1261648). - net: mana: hardening: Validate doorbell ID from GDMA_REGISTER_DEVICE response (git-fixes). - net: mana: Add MAC address to vPort logs and clarify error messages (git-fixes). - add mainline tag to mana patch - PCI: hv: Set default NUMA node to 0 for devices without affinity info (git-fixes). - net: mana: Fix RX skb truesize accounting (bsc#1248754). - net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown (git-fixes). - commit fecbcc4 - Update patches.suse/virt-tdx-guest-Fix-handling-of-host-controlled-quote.patch (git-fixes CVE-2026-31470 bsc#1262665). - commit d89b60e - virt: tdx-guest: Return error for GetQuote failures (git-fixes). - commit ce01521 - virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (CVE-2026-31470 bsc#1262665). - commit c143766 - ext4: validate p_idx bounds in ext4_ext_correct_indexes (bsc#1262616 CVE-2026-31449). - commit 815f45c - dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() (CVE-2026-31436 bsc#1262602). - commit 907f228 - Move misplaced upstreamed patches into sorted section - commit 7e931bc ++++ kernel-rt_debug: - kABI: Restore af_alg_{count,pull}_tsgl() signatures (bsc#1262573 CVE-2026-31431). - commit 836e34c - crypto: algif_aead - Revert to operating out-of-place (bsc#1262573 CVE-2026-31431). - commit e25eea2 - crypto: algif_aead - use memcpy_sglist() instead of null skcipher (bsc#1262573 CVE-2026-31431). - commit ee70f2d - crypto: scatterwalk - Fix memcpy_sglist() to always succeed (bsc#1262573 CVE-2026-31431). - commit 72778af - crypto: scatterwalk - Add memcpy_sglist (bsc#1262573 CVE-2026-31431). - commit 55e74e4 - net: mana: Fix EQ leak in mana_remove on NULL port (git-fixes). - net: mana: Don't overwrite port probe error with add_adev result (git-fixes). - net: mana: Guard mana_remove against double invocation (git-fixes). - net: mana: Init gf_stats_work before potential error paths in probe (git-fixes). - net: mana: Init link_change_work before potential error paths in probe (git-fixes). - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (git-fixes). - RDMA/mana_ib: Support memory windows (git-fixes). - RDMA/mana_ib: Disable RX steering on RSS QP destroy (git-fixes). - RDMA/mana_ib: cleanup the usage of mana_gd_send_request() (git-fixes). - net: mana: Use pci_name() for debugfs directory naming (git-fixes). - net: mana: hardening: Validate adapter_mtu from MANA_QUERY_DEV_CONFIG (git-fixes). - net: mana: Use at least SZ_4K in doorbell ID range check (git-fixes). - net: mana: Set default number of queues to 16 (bsc#1261648). - net: mana: hardening: Validate doorbell ID from GDMA_REGISTER_DEVICE response (git-fixes). - net: mana: Add MAC address to vPort logs and clarify error messages (git-fixes). - add mainline tag to mana patch - PCI: hv: Set default NUMA node to 0 for devices without affinity info (git-fixes). - net: mana: Fix RX skb truesize accounting (bsc#1248754). - net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown (git-fixes). - commit fecbcc4 - Update patches.suse/virt-tdx-guest-Fix-handling-of-host-controlled-quote.patch (git-fixes CVE-2026-31470 bsc#1262665). - commit d89b60e - virt: tdx-guest: Return error for GetQuote failures (git-fixes). - commit ce01521 - virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (CVE-2026-31470 bsc#1262665). - commit c143766 - ext4: validate p_idx bounds in ext4_ext_correct_indexes (bsc#1262616 CVE-2026-31449). - commit 815f45c - dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() (CVE-2026-31436 bsc#1262602). - commit 907f228 - Move misplaced upstreamed patches into sorted section - commit 7e931bc ------------------------------------------------------------------ ------------------ 2026-4-28 - Apr 28 2026 ------------------- ------------------------------------------------------------------ ++++ cups: - Version upgrade to 2.4.19: See https://github.com/openprinting/cups/releases Release 2.4.19 contains another hotfix after CVE-2026-27447 fix: * Fixed a regression in shared printing from non-local accounts (Issue #1557) Issues are those at https://github.com/OpenPrinting/cups/issues - Adapted downgrade-autoconf-requirement.patch for CUPS 2.4.19 - Added 'Michael R Sweet' key to cups.keyring because cups-2.4.19-source.tar.gz.sig belongs to him. ++++ kernel-default: - xen/privcmd: fix double free via VMA splitting (XSA-487 CVE-2026-31787 bsc#1262181). - commit 8c1d428 - Buffer overflow in drivers/xen/sys-hypervisor.c (XSA-485 git-fixes bsc#1262179). - commit 11c17f6 - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu (stable-fixes). - commit fec6f12 - ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF (stable-fixes). - commit 66d1870 - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA (stable-fixes). - commit 02a0607 - USB: serial: option: add Telit Cinterion FN990A MBIM composition (stable-fixes). - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() (stable-fixes). - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen (stable-fixes). - usb: storage: Expand range of matched versions for VL817 quirks entry (stable-fixes). - i2c: s3c24xx: check the size of the SMBUS message before using it (stable-fixes). - HID: core: clamp report_size in s32ton() to avoid undefined shift (stable-fixes). - checkpatch: add support for Assisted-by tag (stable-fixes). - drm/vc4: platform_get_irq_byname() returns an int (stable-fixes). - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (stable-fixes). - pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) (stable-fixes). - ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J (stable-fixes). - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 (stable-fixes). - wifi: brcmfmac: validate bsscfg indices in IF events (stable-fixes). - platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug (stable-fixes). - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 (stable-fixes). - HID: roccat: fix use-after-free in roccat_report_event (stable-fixes). - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 (stable-fixes). - wifi: wl1251: validate packet IDs before indexing tx_frames (stable-fixes). - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list (stable-fixes). - ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx (stable-fixes). - ALSA: hda/realtek: add quirk for Framework F111:000F (stable-fixes). - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex (stable-fixes). - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx (stable-fixes). - ASoC: SOF: topology: reject invalid vendor array size in token parser (stable-fixes). - ALSA: asihpi: avoid write overflow check warning (stable-fixes). - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk (stable-fixes). - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC (stable-fixes). - can: mcp251x: add error handling for power enable in open and resume (stable-fixes). - crypto: testmgr - Hide ENOENT errors better (git-fixes). - crypto: testmgr - Hide ENOENT errors (stable-fixes). - commit e3c1ee0 - Drop cfg80211 patch that may cause a deadlock Deleted: patches.suse/wifi-cfg80211-stop-NAN-and-P2P-in-cfg80211_leave.patch - commit 49e0b7d - x86/boot: Don't add the EFI stub to targets, again (git-fixes). - commit 287d079 - x86/boot/64: Clear most of CR4 in startup_64(), except PAE, MCE and LA57 (git-fixes). - commit 34eec49 - ocfs2: split transactions in dio completion to avoid credit exhaustion (bsc#1258718). - ocfs2: fix possible deadlock between unlink and dio_end_io_write (bsc#1258718). - commit 7fe4156 ++++ kernel-rt: - xen/privcmd: fix double free via VMA splitting (XSA-487 CVE-2026-31787 bsc#1262181). - commit 8c1d428 - Buffer overflow in drivers/xen/sys-hypervisor.c (XSA-485 git-fixes bsc#1262179). - commit 11c17f6 - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu (stable-fixes). - commit fec6f12 - ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF (stable-fixes). - commit 66d1870 - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA (stable-fixes). - commit 02a0607 - USB: serial: option: add Telit Cinterion FN990A MBIM composition (stable-fixes). - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() (stable-fixes). - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen (stable-fixes). - usb: storage: Expand range of matched versions for VL817 quirks entry (stable-fixes). - i2c: s3c24xx: check the size of the SMBUS message before using it (stable-fixes). - HID: core: clamp report_size in s32ton() to avoid undefined shift (stable-fixes). - checkpatch: add support for Assisted-by tag (stable-fixes). - drm/vc4: platform_get_irq_byname() returns an int (stable-fixes). - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (stable-fixes). - pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) (stable-fixes). - ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J (stable-fixes). - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 (stable-fixes). - wifi: brcmfmac: validate bsscfg indices in IF events (stable-fixes). - platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug (stable-fixes). - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 (stable-fixes). - HID: roccat: fix use-after-free in roccat_report_event (stable-fixes). - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 (stable-fixes). - wifi: wl1251: validate packet IDs before indexing tx_frames (stable-fixes). - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list (stable-fixes). - ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx (stable-fixes). - ALSA: hda/realtek: add quirk for Framework F111:000F (stable-fixes). - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex (stable-fixes). - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx (stable-fixes). - ASoC: SOF: topology: reject invalid vendor array size in token parser (stable-fixes). - ALSA: asihpi: avoid write overflow check warning (stable-fixes). - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk (stable-fixes). - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC (stable-fixes). - can: mcp251x: add error handling for power enable in open and resume (stable-fixes). - crypto: testmgr - Hide ENOENT errors better (git-fixes). - crypto: testmgr - Hide ENOENT errors (stable-fixes). - commit e3c1ee0 - Drop cfg80211 patch that may cause a deadlock Deleted: patches.suse/wifi-cfg80211-stop-NAN-and-P2P-in-cfg80211_leave.patch - commit 49e0b7d - x86/boot: Don't add the EFI stub to targets, again (git-fixes). - commit 287d079 - x86/boot/64: Clear most of CR4 in startup_64(), except PAE, MCE and LA57 (git-fixes). - commit 34eec49 - ocfs2: split transactions in dio completion to avoid credit exhaustion (bsc#1258718). - ocfs2: fix possible deadlock between unlink and dio_end_io_write (bsc#1258718). - commit 7fe4156 ++++ kernel-rt_debug: - xen/privcmd: fix double free via VMA splitting (XSA-487 CVE-2026-31787 bsc#1262181). - commit 8c1d428 - Buffer overflow in drivers/xen/sys-hypervisor.c (XSA-485 git-fixes bsc#1262179). - commit 11c17f6 - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu (stable-fixes). - commit fec6f12 - ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF (stable-fixes). - commit 66d1870 - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA (stable-fixes). - commit 02a0607 - USB: serial: option: add Telit Cinterion FN990A MBIM composition (stable-fixes). - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() (stable-fixes). - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen (stable-fixes). - usb: storage: Expand range of matched versions for VL817 quirks entry (stable-fixes). - i2c: s3c24xx: check the size of the SMBUS message before using it (stable-fixes). - HID: core: clamp report_size in s32ton() to avoid undefined shift (stable-fixes). - checkpatch: add support for Assisted-by tag (stable-fixes). - drm/vc4: platform_get_irq_byname() returns an int (stable-fixes). - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (stable-fixes). - pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) (stable-fixes). - ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J (stable-fixes). - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 (stable-fixes). - wifi: brcmfmac: validate bsscfg indices in IF events (stable-fixes). - platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug (stable-fixes). - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 (stable-fixes). - HID: roccat: fix use-after-free in roccat_report_event (stable-fixes). - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 (stable-fixes). - wifi: wl1251: validate packet IDs before indexing tx_frames (stable-fixes). - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list (stable-fixes). - ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx (stable-fixes). - ALSA: hda/realtek: add quirk for Framework F111:000F (stable-fixes). - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex (stable-fixes). - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx (stable-fixes). - ASoC: SOF: topology: reject invalid vendor array size in token parser (stable-fixes). - ALSA: asihpi: avoid write overflow check warning (stable-fixes). - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk (stable-fixes). - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC (stable-fixes). - can: mcp251x: add error handling for power enable in open and resume (stable-fixes). - crypto: testmgr - Hide ENOENT errors better (git-fixes). - crypto: testmgr - Hide ENOENT errors (stable-fixes). - commit e3c1ee0 - Drop cfg80211 patch that may cause a deadlock Deleted: patches.suse/wifi-cfg80211-stop-NAN-and-P2P-in-cfg80211_leave.patch - commit 49e0b7d - x86/boot: Don't add the EFI stub to targets, again (git-fixes). - commit 287d079 - x86/boot/64: Clear most of CR4 in startup_64(), except PAE, MCE and LA57 (git-fixes). - commit 34eec49 - ocfs2: split transactions in dio completion to avoid credit exhaustion (bsc#1258718). - ocfs2: fix possible deadlock between unlink and dio_end_io_write (bsc#1258718). - commit 7fe4156 ++++ nvidia-open-driver-G06-signed: - update CUDA variant to 580.159.03 ++++ openSUSE-build-key: - adjust suse_version condition for the Backports key ------------------------------------------------------------------ ------------------ 2026-4-27 - Apr 27 2026 ------------------- ------------------------------------------------------------------ ++++ avahi: - Add avahi-CVE-2026-34933.patch: refuse to accept publish flags where both wide_area and multicast are set. (CVE-2026-34933, bsc#1261546) ++++ kernel-default: - rtc: abx80x: Disable alarm feature if no interrupt attached (git-fixes). - rtc: ntxec: fix OF node reference imbalance (git-fixes). - tpm: tpm_tis: stop transmit if retries are exhausted (git-fixes). - tpm: tpm_tis: add error logging for data transfer (git-fixes). - tpm: avoid -Wunused-but-set-variable (git-fixes). - commit 9b73710 - dt-bindings: net: Fix Tegra234 MGBE PTP clock (git-fixes) - commit b338f86 - net: stmmac: Fix PTP ref clock for Tegra234 (git-fixes) - commit d31823a - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (CVE-2026-23468 bsc#1261692). - commit 55e6fc0 ++++ kernel-rt: - rtc: abx80x: Disable alarm feature if no interrupt attached (git-fixes). - rtc: ntxec: fix OF node reference imbalance (git-fixes). - tpm: tpm_tis: stop transmit if retries are exhausted (git-fixes). - tpm: tpm_tis: add error logging for data transfer (git-fixes). - tpm: avoid -Wunused-but-set-variable (git-fixes). - commit 9b73710 - dt-bindings: net: Fix Tegra234 MGBE PTP clock (git-fixes) - commit b338f86 - net: stmmac: Fix PTP ref clock for Tegra234 (git-fixes) - commit d31823a - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (CVE-2026-23468 bsc#1261692). - commit 55e6fc0 ++++ kernel-rt_debug: - rtc: abx80x: Disable alarm feature if no interrupt attached (git-fixes). - rtc: ntxec: fix OF node reference imbalance (git-fixes). - tpm: tpm_tis: stop transmit if retries are exhausted (git-fixes). - tpm: tpm_tis: add error logging for data transfer (git-fixes). - tpm: avoid -Wunused-but-set-variable (git-fixes). - commit 9b73710 - dt-bindings: net: Fix Tegra234 MGBE PTP clock (git-fixes) - commit b338f86 - net: stmmac: Fix PTP ref clock for Tegra234 (git-fixes) - commit d31823a - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (CVE-2026-23468 bsc#1261692). - commit 55e6fc0 ++++ python311-core: - CVE-2026-6019: protect against HTML injection by Base64-encoding cookie values embedded in JS (bsc#1262654, gh#python/cpython#90309) CVE-2026-6019-Morsel-js_output.patch ++++ tiff: - * CVE-2026-4775: Signed integer overflow in putcontig8bitYCbCr44tile (bsc#1260411) Add tiff-CVE-2026-4775.patch ++++ open-vm-tools: - Fix build with glibc 2.43 (boo#1257312) + Add patch: - glibc243.patch ++++ libzypp: - Fix purge-kernel -rc kernel handling (bsc#1239718) - Explicitly_set_pool_DISTTYPE_RPM (fixes #726) - version 17.38.7 (35) ++++ python311: - CVE-2026-6019: protect against HTML injection by Base64-encoding cookie values embedded in JS (bsc#1262654, gh#python/cpython#90309) CVE-2026-6019-Morsel-js_output.patch ++++ salt: - BDSA-2025-60810: Harden Tornado from invalid HTTP reason phrases - Read full URI from ldap pillar config (bsc#1254900) - Added: * bdsa-2025-60810-harden-against-invalid-http-reason-p.patch * read-full-uri-from-ldap-pillar-config-753.patch ------------------------------------------------------------------ ------------------ 2026-4-26 - Apr 26 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - fbdev: offb: fix PCI device reference leak on probe failure (git-fixes). - commit 4e96a2a ++++ kernel-rt: - fbdev: offb: fix PCI device reference leak on probe failure (git-fixes). - commit 4e96a2a ++++ kernel-rt_debug: - fbdev: offb: fix PCI device reference leak on probe failure (git-fixes). - commit 4e96a2a ++++ vim: - Fix bsc#1261833 / CVE-2026-39881. - Update to 9.2.0398. - Changes: * 9.2.0398: MS-Windows: missing strptime() support * 9.2.0397: tabpanel: double-click opens a new tab * 9.2.0396: tests: Test_error_callback_terminal is flaky on macOS * 9.2.0395: tests: Test_backupskip() may read from $HOME * 9.2.0394: xxd: offsets greater than LONG_MAX print as negative * 9.2.0393: MS-Windows: link error with XPM support on UCRT64 * 9.2.0392: tests: Some tests are flaky * 9.2.0391: tests: Comment in test_vim9_cmd breaks syntax highlighting * 9.2.0390: filetype: some Beancount files are not recognized * 9.2.0389: DECRQM still leaves stray "pp" on Apple Terminal.app * 9.2.0388: strange indent in update_topline() * 9.2.0387: DECRQM request may leave stray chars in terminal * 9.2.0386: No scroll/scrollbar support in the tabpanel * 9.2.0385: Integer overflow with "ze" and large 'sidescrolloff' * 9.2.0384: stale Insstart after cursor move breaks undo * 9.2.0383: [security]: runtime(netrw): shell-injection via sftp: and file: URLs * 9.2.0382: Wayland: focus-stealing is non-working * 9.2.0381: Vim9: Missing check_secure() in exec_instructions() * 9.2.0380: completion: a few issues in completion code * 9.2.0379: gui.color_approx is never used * 9.2.0378: Using int as bool type in win_T struct * 9.2.0377: Using int as bool type in gui_T struct * 9.2.0376: Vim9: elseif condition compiled in dead branch * 9.2.0375: prop_find() does not find a virt text in starting line * 9.2.0374: c_CTRL-{G,T} does not handle offset * 9.2.0373: Ctrl-R mapping not triggered during completion * 9.2.0372: pum: rendering issues with multibyte text and opacity * 9.2.0371: filetype: ghostty config files are not recognized * 9.2.0370: duplicate code with literal string_T assignment * 9.2.0369: multiple definitions of STRING_INIT macro * 9.2.0368: too many strlen() calls when adding strings to dicts * 9.2.0367: runtime(netrw): ~ note expanded on MS Windows * 9.2.0366: pum: flicker when updating pum in place * 9.2.0365: using int as bool * 9.2.0364: tests: test_smoothscroll_textoff_showbreak() fails * 9.2.0363: Vim9: variable shadowed by script-local function * 9.2.0362: division by zero with smoothscroll and small windows * 9.2.0361: tests: no tests for ch_listen() with IPs * 9.2.0360: Cannot handle mouse-clicks in the tabpanel * 9.2.0359: wrong VertSplitNC highlighting on winbar * 9.2.0358: runtime(vimball): still path traversal attacks possible * 9.2.0357: [security]: command injection via backticks in tag files * 9.2.0356: Cannot apply 'scrolloff' context lines at end of file * 9.2.0355: runtime(tar): missing path traversal checks in tar#Extract() * 9.2.0354: filetype: not all Bitbake include files are recognized * 9.2.0353: Missing out-of-memory check in register.c * 9.2.0352: 'winhighlight' of left window blends into right window * 9.2.0351: repeat_string() can be improved * 9.2.0350: Enabling modelines poses a risk * 9.2.0349: cannot style non-current window separator * 9.2.0348: potential buffer underrun when setting statusline like option * 9.2.0347: Vim9: script-local variable not found * 9.2.0346: Wrong cursor position when entering command line window * 9.2.0345: Wrong autoformatting with 'autocomplete' * 9.2.0344: channel: ch_listen() can bind to network interface * 9.2.0343: tests: test_clientserver may fail on slower systems * 9.2.0342: tests: test_excmd.vim leaves swapfiles behind * 9.2.0341: some functions can be run from the sandbox * 9.2.0340: pum_redraw() may cause flicker * 9.2.0339: regexp: nfa_regmatch() allocates and frees too often * 9.2.0338: Cannot handle mouseclicks in the tabline * 9.2.0337: list indexing broken on big-endian 32-bit platforms * 9.2.0336: libvterm: no terminal reflow support * 9.2.0335: json_encode() uses recursive algorithm * 9.2.0334: GTK: window geometry shrinks with with client-side decorations * 9.2.0333: filetype: PklProject files are not recognized * 9.2.0332: popup: still opacity rendering issues * 9.2.0331: spellfile: stack buffer overflows in spell file generation * 9.2.0330: tests: some patterns in tar and zip plugin tests not strict enough * 9.2.0329: tests: test_indent.vim leaves swapfiles behind * 9.2.0328: Cannot handle mouseclicks in the statusline * 9.2.0327: filetype: uv scripts are not detected * 9.2.0326: runtime(tar): but with dotted path * 9.2.0325: runtime(tar): bug in zstd handling * 9.2.0324: 0x9b byte not unescaped in mapping * 9.2.0323: filetype: buf.lock files are not recognized * 9.2.0322: tests: test_popupwin fails * 9.2.0321: MS-Windows: No OpenType font support * 9.2.0320: several bugs with text properties * 9.2.0319: popup: rendering issues with partially transparent popups * 9.2.0318: cannot configure opacity for popup menu * 9.2.0317: listener functions do not check secure flag * 9.2.0316: [security]: command injection in netbeans interface via defineAnnoType * 9.2.0315: missing bound-checks * 9.2.0314: channel: can bind to all network interfaces * 9.2.0313: Callback channel not registered in GUI * 9.2.0312: C-type names are marked as translatable * 9.2.0311: redrawing logic with text properties can be improved * 9.2.0310: unnecessary work in vim_strchr() and find_term_bykeys() * 9.2.0309: Missing out-of-memory check to may_get_cmd_block() * 9.2.0308: Error message E1547 is wrong * 9.2.0307: more mismatches between return types and documentation * 9.2.0306: runtime(tar): some issues with lz4 support * 9.2.0305: mismatch between return types and documentation * 9.2.0304: tests: test for 9.2.0285 doesn't always fail without the fix * 9.2.0303: tests: zip plugin tests don't check for warning message properly * 9.2.0302: runtime(netrw): RFC2396 decoding double escaping spaces * 9.2.0301: Vim9: void function return value inconsistent * 9.2.0300: The vimball plugin needs some love * 9.2.0299: runtime(zip): may write using absolute paths * 9.2.0298: Some internal variables are not modified * 9.2.0297: libvterm: can improve CSI overflow code * 9.2.0296: Redundant and incorrect integer pointer casts in drawline.c * 9.2.0295: 'showcmd' shows wrong Visual block size with 'linebreak' * 9.2.0294: if_lua: lua interface does not work with lua 5.5 * 9.2.0293: :packadd may lead to heap-buffer-overflow * 9.2.0292: E340 internal error when using method call on void value * 9.2.0291: too many strlen() calls * 9.2.0290: Amiga: no support for AmigaOS 3.x * 9.2.0289: 'linebreak' may lead to wrong Visual block highlighting * 9.2.0288: libvterm: signed integer overflow parsing long CSI args * 9.2.0287: filetype: not all ObjectScript routines are recognized * 9.2.0286: still some unnecessary (int) casts in alloc() * 9.2.0285: :syn sync grouphere may go beyond end of line * 9.2.0284: tabpanel: crash when tabpanel expression returns variable line count * 9.2.0283: unnecessary (int) casts before alloc() calls * 9.2.0282: tests: Test_viminfo_len_overflow() fails * 9.2.0281: tests: Test_netrw_FileUrlEdit.. fails on Windows ------------------------------------------------------------------ ------------------ 2026-4-25 - Apr 25 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - extcon: ptn5150: handle pending IRQ events during system resume (git-fixes). - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() (git-fixes). - iio: adc: ad7768-1: fix one-shot mode data acquisition (git-fixes). - spi: fix controller cleanup() documentation (git-fixes). - spi: orion: fix clock imbalance on registration failure (git-fixes). - spi: orion: fix runtime pm leak on unbind (git-fixes). - spi: imx: fix runtime pm leak on probe deferral (git-fixes). - spi: mpc52xx: fix use-after-free on unbind (git-fixes). - spi: cadence: fix controller deregistration (git-fixes). - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch (git-fixes). - ALSA: usb-audio: Avoid false E-MU sample-rate notifications (git-fixes). - ALSA: core: Fix potential data race at fasync handling (git-fixes). - ALSA: caiaq: Fix control_put() result and cache rollback (git-fixes). - ALSA: 6fire: Fix input volume change detection (git-fixes). - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES (git-fixes). - ALSA: caiaq: Handle probe errors properly (git-fixes). - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check (git-fixes). - drm/arcpgu: fix device node leak (git-fixes). - drm/amd/display: Disable 10-bit truncation and dithering on DCE 6.x (git-fixes). - commit 83142e0 ++++ kernel-rt: - extcon: ptn5150: handle pending IRQ events during system resume (git-fixes). - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() (git-fixes). - iio: adc: ad7768-1: fix one-shot mode data acquisition (git-fixes). - spi: fix controller cleanup() documentation (git-fixes). - spi: orion: fix clock imbalance on registration failure (git-fixes). - spi: orion: fix runtime pm leak on unbind (git-fixes). - spi: imx: fix runtime pm leak on probe deferral (git-fixes). - spi: mpc52xx: fix use-after-free on unbind (git-fixes). - spi: cadence: fix controller deregistration (git-fixes). - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch (git-fixes). - ALSA: usb-audio: Avoid false E-MU sample-rate notifications (git-fixes). - ALSA: core: Fix potential data race at fasync handling (git-fixes). - ALSA: caiaq: Fix control_put() result and cache rollback (git-fixes). - ALSA: 6fire: Fix input volume change detection (git-fixes). - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES (git-fixes). - ALSA: caiaq: Handle probe errors properly (git-fixes). - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check (git-fixes). - drm/arcpgu: fix device node leak (git-fixes). - drm/amd/display: Disable 10-bit truncation and dithering on DCE 6.x (git-fixes). - commit 83142e0 ++++ kernel-rt_debug: - extcon: ptn5150: handle pending IRQ events during system resume (git-fixes). - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() (git-fixes). - iio: adc: ad7768-1: fix one-shot mode data acquisition (git-fixes). - spi: fix controller cleanup() documentation (git-fixes). - spi: orion: fix clock imbalance on registration failure (git-fixes). - spi: orion: fix runtime pm leak on unbind (git-fixes). - spi: imx: fix runtime pm leak on probe deferral (git-fixes). - spi: mpc52xx: fix use-after-free on unbind (git-fixes). - spi: cadence: fix controller deregistration (git-fixes). - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch (git-fixes). - ALSA: usb-audio: Avoid false E-MU sample-rate notifications (git-fixes). - ALSA: core: Fix potential data race at fasync handling (git-fixes). - ALSA: caiaq: Fix control_put() result and cache rollback (git-fixes). - ALSA: 6fire: Fix input volume change detection (git-fixes). - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES (git-fixes). - ALSA: caiaq: Handle probe errors properly (git-fixes). - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check (git-fixes). - drm/arcpgu: fix device node leak (git-fixes). - drm/amd/display: Disable 10-bit truncation and dithering on DCE 6.x (git-fixes). - commit 83142e0 ++++ python311-core: - CVE-2026-1502: reject CR/LF in HTTP tunnel request headers (bsc#1261969, gh#python/cpython#146211) CVE-2026-1502-reject-CRLF-HTTP-tunnel.patch - CVE-2026-4786: fix webbrowser %action substitution bypass of dash-prefix check (bsc#1262319, gh#python/cpython#148169) CVE-2026-4786-webbrowser-open-action.patch ++++ python311: - CVE-2026-1502: reject CR/LF in HTTP tunnel request headers (bsc#1261969, gh#python/cpython#146211) CVE-2026-1502-reject-CRLF-HTTP-tunnel.patch - CVE-2026-4786: fix webbrowser %action substitution bypass of dash-prefix check (bsc#1262319, gh#python/cpython#148169) CVE-2026-4786-webbrowser-open-action.patch ------------------------------------------------------------------ ------------------ 2026-4-24 - Apr 24 2026 ------------------- ------------------------------------------------------------------ ++++ curl: - Security fixes: * CVE-2026-4873: connection reuse ignores TLS requirement (bsc#1262631) * CVE-2026-5545: wrong reuse of HTTP Negotiate connection (bsc#1262632) * CVE-2026-6253: proxy credentials leak over redirect-to proxy (bsc#1262635) * CVE-2026-6276: stale custom cookie host causes cookie leak (bsc#1262636) * CVE-2026-6429: netrc credential leak with reused proxy connection (bsc#1262638) * sws: prevent "connection monitor" to say disconnect twice (bsc#1259362) * Add patches: - curl-CVE-2026-4873.patch - curl-CVE-2026-5545.patch - curl-CVE-2026-6253.patch - curl-CVE-2026-6276.patch - curl-CVE-2026-6429.patch - curl-CVE-2026-1965-disable-ntlm-fix.patch ++++ kernel-default: - virt: tdx-guest: Return error for GetQuote failures (git-fixes). - commit be3ba0d - virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (git-fixes). - commit bca30e2 - powerpc/crash: fix backup region offset update to elfcorehdr (bsc#1259535). - commit a257031 - Drop NFC patch that may cause a boot problem (bsc#1262731) Delete patches.suse/nfc-nxp-nci-remove-interrupt-trigger-type.patch - commit e754db6 - netfilter: conntrack: add missing netlink policy validations (CVE-2026-31407 bsc#1261632). - commit cfb8d63 - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (CVE-2026-23457 bsc#1261686). - commit 757d462 - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (CVE-2026-31424 bsc#1262053). - commit cad22db - netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp (CVE-2026-31427 bsc#1262086). - commit 174d896 - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (CVE-2026-31428 bsc#1262087). - commit 0305838 - netfilter: nfnetlink_log: account for netlink header size (CVE-2026-31416 bsc#1262100). - commit 9c0a9d9 ++++ kernel-rt: - virt: tdx-guest: Return error for GetQuote failures (git-fixes). - commit be3ba0d - virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (git-fixes). - commit bca30e2 - powerpc/crash: fix backup region offset update to elfcorehdr (bsc#1259535). - commit a257031 - Drop NFC patch that may cause a boot problem (bsc#1262731) Delete patches.suse/nfc-nxp-nci-remove-interrupt-trigger-type.patch - commit e754db6 - netfilter: conntrack: add missing netlink policy validations (CVE-2026-31407 bsc#1261632). - commit cfb8d63 - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (CVE-2026-23457 bsc#1261686). - commit 757d462 - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (CVE-2026-31424 bsc#1262053). - commit cad22db - netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp (CVE-2026-31427 bsc#1262086). - commit 174d896 - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (CVE-2026-31428 bsc#1262087). - commit 0305838 - netfilter: nfnetlink_log: account for netlink header size (CVE-2026-31416 bsc#1262100). - commit 9c0a9d9 ++++ kernel-rt_debug: - virt: tdx-guest: Return error for GetQuote failures (git-fixes). - commit be3ba0d - virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (git-fixes). - commit bca30e2 - powerpc/crash: fix backup region offset update to elfcorehdr (bsc#1259535). - commit a257031 - Drop NFC patch that may cause a boot problem (bsc#1262731) Delete patches.suse/nfc-nxp-nci-remove-interrupt-trigger-type.patch - commit e754db6 - netfilter: conntrack: add missing netlink policy validations (CVE-2026-31407 bsc#1261632). - commit cfb8d63 - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (CVE-2026-23457 bsc#1261686). - commit 757d462 - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (CVE-2026-31424 bsc#1262053). - commit cad22db - netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp (CVE-2026-31427 bsc#1262086). - commit 174d896 - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (CVE-2026-31428 bsc#1262087). - commit 0305838 - netfilter: nfnetlink_log: account for netlink header size (CVE-2026-31416 bsc#1262100). - commit 9c0a9d9 ++++ mozilla-nss: - update to NSS 3.112.5 * bmo#2033783 - reject DTLS 1.3 Server Hello after HVR without capping ss->vrange.max. * bmo#2034185 - update to version 2.84 of builtins module. ++++ freeipmi: - bsc#1260414 - CVE-2026-33554: freeipmi: improper memory handling and data validation can lead A ipmi-oem-fix-several-memory-out-of-bounds-errors.patch ++++ python311-core: - CVE-2026-6100: prevent dangling pointer, which can end in the use-after-free error (bsc#1262098, gh#python/cpython#148395) CVE-2026-6100-use-after-free-decompression.patch ++++ nvidia-open-driver-G06-signed: - update non-CUDA variant to 580.159.03 (boo#1262749) ++++ python311: - CVE-2026-6100: prevent dangling pointer, which can end in the use-after-free error (bsc#1262098, gh#python/cpython#148395) CVE-2026-6100-use-after-free-decompression.patch ------------------------------------------------------------------ ------------------ 2026-4-23 - Apr 23 2026 ------------------- ------------------------------------------------------------------ ++++ cups: - Version upgrade to 2.4.18: See https://github.com/openprinting/cups/releases The new release 2.4.18 contains hotfix after CVE-2026-27447 fix: * Fixed cupsd crash if user does not exist (Issue #1555) Issues are those at https://github.com/OpenPrinting/cups/issues - Adapted downgrade-autoconf-requirement.patch for CUPS 2.4.18 ++++ kernel-default: - kabi: arm: io: Export ioremap_prot() symbol (CVE-2026-23346 bsc#1260529) - commit 017493b - Update patches.suse/0001-apparmor-validate-DFA-start-states-are-in-bounds-in-.patch (bsc#1258849 CVE-2026-23269 bsc#1259857). - Update patches.suse/0002-apparmor-fix-memory-leak-in-verify_header.patch (bsc#1258849 CVE-2026-23403 bsc#1261287). - Update patches.suse/0003-apparmor-replace-recursive-profile-removal-with-iter.patch (bsc#1258849 CVE-2026-23404 bsc#1258854). - Update patches.suse/0004-apparmor-fix-limit-the-number-of-levels-of-policy-na.patch (bsc#1258849 CVE-2026-23405 bsc#1261295). - Update patches.suse/0005-apparmor-fix-side-effect-bug-in-match_char-macro-usa.patch (bsc#1258849 CVE-2026-23406 bsc#1258855). - Update patches.suse/0006-apparmor-fix-missing-bounds-check-on-DEFAULT-table-i.patch (bsc#1258849 CVE-2026-23407 bsc#1258855). - Update patches.suse/0007-apparmor-Fix-double-free-of-ns_name-in-aa_replace_pr.patch (bsc#1258849 CVE-2026-23408 bsc#1258857). - Update patches.suse/0008-apparmor-fix-unprivileged-local-user-can-do-privileg.patch (bsc#1258849 CVE-2026-23268 bsc#1258850). - Update patches.suse/0009-apparmor-fix-differential-encoding-verification.patch (bsc#1258849 CVE-2026-23409 bsc#1258857). - Update patches.suse/0010-apparmor-fix-race-on-rawdata-dereference.patch (bsc#1258849 CVE-2026-23410 bsc#1258856). - Update patches.suse/0011-apparmor-fix-race-between-freeing-data-and-fs-access.patch (bsc#1258849 CVE-2026-23411 bsc#1258856). - Update patches.suse/macvlan-observe-an-RCU-grace-period-in-macvlan_commo.patch (CVE-2026-23209 bsc#1258518 CVE-2026-23273 bsc#1260010). - commit d5ee582 - Update patches.suse/ACPI-EC-clean-up-handlers-on-probe-failure-in-acpi_e.patch (git-fixes CVE-2026-31426 bsc#1262078). - Update patches.suse/ACPI-processor-Fix-previous-acpi_processor_errata_pi.patch (git-fixes CVE-2026-23443 bsc#1261679). - Update patches.suse/ALSA-usb-audio-Use-correct-version-for-UAC3-header-v.patch (git-fixes CVE-2026-23318 bsc#1260536). - Update patches.suse/Bluetooth-L2CAP-Validate-L2CAP_INFO_RSP-payload-leng.patch (git-fixes CVE-2026-31393 bsc#1261719). - Update patches.suse/HID-Add-HID_CLAIMED_INPUT-guards-in-raw_event-callba.patch (stable-fixes CVE-2026-23382 bsc#1260551). - Update patches.suse/PCI-IOV-Fix-race-between-SR-IOV-enable-disable-and-h.patch (git-fixes CVE-2025-40219 bsc#1254518). - Update patches.suse/PM-runtime-Fix-a-race-condition-related-to-device-re.patch (git-fixes CVE-2026-23452 bsc#1261618). - Update patches.suse/Revert-drm-amd-Check-if-ASPM-is-enabled-from-PCIe-su.patch (git-fixes CVE-2026-23264 bsc#1259869). - Update patches.suse/btrfs-log-new-dentries-when-logging-parent-dir-of-a-.patch (git-fixes CVE-2026-23465 bsc#1261685). - Update patches.suse/can-bcm-fix-locking-for-bcm_op-runtime-updates.patch (git-fixes CVE-2026-23362 bsc#1260489). - Update patches.suse/can-ems_usb-ems_usb_read_bulk_callback-check-the-pro.patch (git-fixes CVE-2026-23307 bsc#1260541). - Update patches.suse/can-mcp251x-fix-deadlock-in-error-path-of-mcp251x_op.patch (git-fixes CVE-2026-23357 bsc#1260532). - Update patches.suse/can-ucan-Fix-infinite-loop-from-zero-length-messages.patch (git-fixes CVE-2026-23298 bsc#1260485). - Update patches.suse/can-usb-etas_es58x-correctly-anchor-the-urb-in-the-r.patch (git-fixes CVE-2026-23324 bsc#1260507). - Update patches.suse/drm-logicvc-Fix-device-node-reference-leak-in-logicv.patch (git-fixes CVE-2026-23426 bsc#1261504). - Update patches.suse/fbdev-rivafb-fix-divide-error-in-nv3_arb.patch (git-fixes CVE-2026-23266 bsc#1259868). - Update patches.suse/fbdev-smscufx-properly-copy-ioctl-memory-to-kernelsp.patch (stable-fixes CVE-2026-23236 bsc#1259199). - Update patches.suse/media-dvb-core-fix-wrong-reinitialization-of-ringbuf.patch (git-fixes CVE-2026-23253 bsc#1259878). - Update patches.suse/media-dvb-net-fix-OOB-access-in-ULE-extension-header.patch (git-fixes CVE-2026-31405 bsc#1261700). - Update patches.suse/mtd-Avoid-boot-crash-in-RedBoot-partition-table-pars.patch (git-fixes CVE-2026-23474 bsc#1261602). - Update patches.suse/mtd-rawnand-serialize-lock-unlock-against-other-NAND.patch (git-fixes CVE-2026-23434 bsc#1261601). - Update patches.suse/net-rose-fix-NULL-pointer-dereference-in-rose_transm.patch (git-fixes CVE-2026-23460 bsc#1261582). - Update patches.suse/net-usb-aqc111-Do-not-perform-PM-inside-suspend-call.patch (git-fixes CVE-2026-23446 bsc#1261778). - Update patches.suse/net-usb-cdc_ncm-add-ndpoffset-to-NDP16-nframes-bound.patch (git-fixes CVE-2026-23448 bsc#1261750). - Update patches.suse/net-usb-cdc_ncm-add-ndpoffset-to-NDP32-nframes-bound.patch (git-fixes CVE-2026-23447 bsc#1261751). - Update patches.suse/net-usb-kalmia-validate-USB-endpoints.patch (git-fixes CVE-2026-23365 bsc#1260800). - Update patches.suse/net-usb-kaweth-validate-USB-endpoints.patch (git-fixes CVE-2026-23312 bsc#1260561). - Update patches.suse/net-usb-pegasus-validate-USB-endpoints.patch (stable-fixes CVE-2026-23290 bsc#1260533). - Update patches.suse/net-x25-Fix-overflow-when-accumulating-packets.patch (git-fixes CVE-2026-31417 bsc#1262101). - Update patches.suse/nfc-nci-free-skb-on-nci_transceive-early-error-paths.patch (git-fixes CVE-2026-23339 bsc#1260581). - Update patches.suse/nfc-pn533-properly-drop-the-usb-interface-reference-.patch (git-fixes CVE-2026-23291 bsc#1260483). - Update patches.suse/nfc-rawsock-cancel-tx_work-before-socket-teardown.patch (git-fixes CVE-2026-23372 bsc#1260484). - Update patches.suse/pinctrl-equilibrium-fix-warning-trace-on-load.patch (git-fixes CVE-2026-23308 bsc#1260553). - Update patches.suse/platform-x86-classmate-laptop-Add-missing-NULL-point.patch (stable-fixes CVE-2026-23237 bsc#1259222). - Update patches.suse/platform-x86-dell-wmi-sysman-Don-t-hex-dump-plaintex.patch (git-fixes CVE-2026-23370 bsc#1260504). - Update patches.suse/regmap-maple-free-entry-on-mas_store_gfp-failure.patch (stable-fixes CVE-2026-23260 bsc#1259873). - Update patches.suse/scsi-qla2xxx-Fix-bsg_done-causing-double-free.patch (bsc#1256863 CVE-2025-71238 bsc#1259186). - Update patches.suse/soc-fsl-qbman-fix-race-condition-in-qman_destroy_fq.patch (git-fixes CVE-2026-23463 bsc#1261713). - Update patches.suse/spi-fix-statistics-allocation.patch (git-fixes CVE-2026-23475 bsc#1261644). - Update patches.suse/spi-fix-use-after-free-on-controller-registration-fa.patch (git-fixes CVE-2026-31389 bsc#1261789). - Update patches.suse/usb-gadget-f_mass_storage-Fix-potential-integer-over.patch (git-fixes CVE-2026-31412 bsc#1261896). - Update patches.suse/wifi-cfg80211-cancel-rfkill_block-work-in-wiphy_unre.patch (git-fixes CVE-2026-23336 bsc#1260552). - Update patches.suse/wifi-mac80211-bounds-check-link_id-in-ieee80211_ml_r.patch (git-fixes CVE-2026-23246 bsc#1259806). - Update patches.suse/wifi-mac80211-fix-NULL-deref-in-mesh_matches_local.patch (git-fixes CVE-2026-23396 bsc#1260729). - Update patches.suse/wifi-mac80211-fix-NULL-pointer-dereference-in-mesh_r.patch (git-fixes CVE-2026-23279 bsc#1260468). - Update patches.suse/wifi-mt76-Fix-possible-oob-access-in-mt76_connac2_ma.patch (git-fixes CVE-2026-23315 bsc#1260549). - Update patches.suse/wifi-mt76-mt7925-Fix-possible-oob-access-in-mt7925_m.patch (git-fixes CVE-2026-23363 bsc#1260572). - Update patches.suse/wifi-mt76-mt7996-Fix-possible-oob-access-in-mt7996_m.patch (git-fixes CVE-2026-23325 bsc#1260537). - Update patches.suse/wifi-radiotap-reject-radiotap-with-unknown-bits.patch (git-fixes CVE-2026-23367 bsc#1260731). - Update patches.suse/wifi-rsi-Don-t-default-to-EOPNOTSUPP-in-rsi_mac80211.patch (git-fixes CVE-2026-23373 bsc#1260528). - Update patches.suse/wifi-wlcore-Fix-a-locking-bug.patch (git-fixes CVE-2026-23420 bsc#1261503). - commit 61fa16a ++++ kernel-rt: - kabi: arm: io: Export ioremap_prot() symbol (CVE-2026-23346 bsc#1260529) - commit 017493b - Update patches.suse/0001-apparmor-validate-DFA-start-states-are-in-bounds-in-.patch (bsc#1258849 CVE-2026-23269 bsc#1259857). - Update patches.suse/0002-apparmor-fix-memory-leak-in-verify_header.patch (bsc#1258849 CVE-2026-23403 bsc#1261287). - Update patches.suse/0003-apparmor-replace-recursive-profile-removal-with-iter.patch (bsc#1258849 CVE-2026-23404 bsc#1258854). - Update patches.suse/0004-apparmor-fix-limit-the-number-of-levels-of-policy-na.patch (bsc#1258849 CVE-2026-23405 bsc#1261295). - Update patches.suse/0005-apparmor-fix-side-effect-bug-in-match_char-macro-usa.patch (bsc#1258849 CVE-2026-23406 bsc#1258855). - Update patches.suse/0006-apparmor-fix-missing-bounds-check-on-DEFAULT-table-i.patch (bsc#1258849 CVE-2026-23407 bsc#1258855). - Update patches.suse/0007-apparmor-Fix-double-free-of-ns_name-in-aa_replace_pr.patch (bsc#1258849 CVE-2026-23408 bsc#1258857). - Update patches.suse/0008-apparmor-fix-unprivileged-local-user-can-do-privileg.patch (bsc#1258849 CVE-2026-23268 bsc#1258850). - Update patches.suse/0009-apparmor-fix-differential-encoding-verification.patch (bsc#1258849 CVE-2026-23409 bsc#1258857). - Update patches.suse/0010-apparmor-fix-race-on-rawdata-dereference.patch (bsc#1258849 CVE-2026-23410 bsc#1258856). - Update patches.suse/0011-apparmor-fix-race-between-freeing-data-and-fs-access.patch (bsc#1258849 CVE-2026-23411 bsc#1258856). - Update patches.suse/macvlan-observe-an-RCU-grace-period-in-macvlan_commo.patch (CVE-2026-23209 bsc#1258518 CVE-2026-23273 bsc#1260010). - commit d5ee582 - Update patches.suse/ACPI-EC-clean-up-handlers-on-probe-failure-in-acpi_e.patch (git-fixes CVE-2026-31426 bsc#1262078). - Update patches.suse/ACPI-processor-Fix-previous-acpi_processor_errata_pi.patch (git-fixes CVE-2026-23443 bsc#1261679). - Update patches.suse/ALSA-usb-audio-Use-correct-version-for-UAC3-header-v.patch (git-fixes CVE-2026-23318 bsc#1260536). - Update patches.suse/Bluetooth-L2CAP-Validate-L2CAP_INFO_RSP-payload-leng.patch (git-fixes CVE-2026-31393 bsc#1261719). - Update patches.suse/HID-Add-HID_CLAIMED_INPUT-guards-in-raw_event-callba.patch (stable-fixes CVE-2026-23382 bsc#1260551). - Update patches.suse/PCI-IOV-Fix-race-between-SR-IOV-enable-disable-and-h.patch (git-fixes CVE-2025-40219 bsc#1254518). - Update patches.suse/PM-runtime-Fix-a-race-condition-related-to-device-re.patch (git-fixes CVE-2026-23452 bsc#1261618). - Update patches.suse/Revert-drm-amd-Check-if-ASPM-is-enabled-from-PCIe-su.patch (git-fixes CVE-2026-23264 bsc#1259869). - Update patches.suse/btrfs-log-new-dentries-when-logging-parent-dir-of-a-.patch (git-fixes CVE-2026-23465 bsc#1261685). - Update patches.suse/can-bcm-fix-locking-for-bcm_op-runtime-updates.patch (git-fixes CVE-2026-23362 bsc#1260489). - Update patches.suse/can-ems_usb-ems_usb_read_bulk_callback-check-the-pro.patch (git-fixes CVE-2026-23307 bsc#1260541). - Update patches.suse/can-mcp251x-fix-deadlock-in-error-path-of-mcp251x_op.patch (git-fixes CVE-2026-23357 bsc#1260532). - Update patches.suse/can-ucan-Fix-infinite-loop-from-zero-length-messages.patch (git-fixes CVE-2026-23298 bsc#1260485). - Update patches.suse/can-usb-etas_es58x-correctly-anchor-the-urb-in-the-r.patch (git-fixes CVE-2026-23324 bsc#1260507). - Update patches.suse/drm-logicvc-Fix-device-node-reference-leak-in-logicv.patch (git-fixes CVE-2026-23426 bsc#1261504). - Update patches.suse/fbdev-rivafb-fix-divide-error-in-nv3_arb.patch (git-fixes CVE-2026-23266 bsc#1259868). - Update patches.suse/fbdev-smscufx-properly-copy-ioctl-memory-to-kernelsp.patch (stable-fixes CVE-2026-23236 bsc#1259199). - Update patches.suse/media-dvb-core-fix-wrong-reinitialization-of-ringbuf.patch (git-fixes CVE-2026-23253 bsc#1259878). - Update patches.suse/media-dvb-net-fix-OOB-access-in-ULE-extension-header.patch (git-fixes CVE-2026-31405 bsc#1261700). - Update patches.suse/mtd-Avoid-boot-crash-in-RedBoot-partition-table-pars.patch (git-fixes CVE-2026-23474 bsc#1261602). - Update patches.suse/mtd-rawnand-serialize-lock-unlock-against-other-NAND.patch (git-fixes CVE-2026-23434 bsc#1261601). - Update patches.suse/net-rose-fix-NULL-pointer-dereference-in-rose_transm.patch (git-fixes CVE-2026-23460 bsc#1261582). - Update patches.suse/net-usb-aqc111-Do-not-perform-PM-inside-suspend-call.patch (git-fixes CVE-2026-23446 bsc#1261778). - Update patches.suse/net-usb-cdc_ncm-add-ndpoffset-to-NDP16-nframes-bound.patch (git-fixes CVE-2026-23448 bsc#1261750). - Update patches.suse/net-usb-cdc_ncm-add-ndpoffset-to-NDP32-nframes-bound.patch (git-fixes CVE-2026-23447 bsc#1261751). - Update patches.suse/net-usb-kalmia-validate-USB-endpoints.patch (git-fixes CVE-2026-23365 bsc#1260800). - Update patches.suse/net-usb-kaweth-validate-USB-endpoints.patch (git-fixes CVE-2026-23312 bsc#1260561). - Update patches.suse/net-usb-pegasus-validate-USB-endpoints.patch (stable-fixes CVE-2026-23290 bsc#1260533). - Update patches.suse/net-x25-Fix-overflow-when-accumulating-packets.patch (git-fixes CVE-2026-31417 bsc#1262101). - Update patches.suse/nfc-nci-free-skb-on-nci_transceive-early-error-paths.patch (git-fixes CVE-2026-23339 bsc#1260581). - Update patches.suse/nfc-pn533-properly-drop-the-usb-interface-reference-.patch (git-fixes CVE-2026-23291 bsc#1260483). - Update patches.suse/nfc-rawsock-cancel-tx_work-before-socket-teardown.patch (git-fixes CVE-2026-23372 bsc#1260484). - Update patches.suse/pinctrl-equilibrium-fix-warning-trace-on-load.patch (git-fixes CVE-2026-23308 bsc#1260553). - Update patches.suse/platform-x86-classmate-laptop-Add-missing-NULL-point.patch (stable-fixes CVE-2026-23237 bsc#1259222). - Update patches.suse/platform-x86-dell-wmi-sysman-Don-t-hex-dump-plaintex.patch (git-fixes CVE-2026-23370 bsc#1260504). - Update patches.suse/regmap-maple-free-entry-on-mas_store_gfp-failure.patch (stable-fixes CVE-2026-23260 bsc#1259873). - Update patches.suse/scsi-qla2xxx-Fix-bsg_done-causing-double-free.patch (bsc#1256863 CVE-2025-71238 bsc#1259186). - Update patches.suse/soc-fsl-qbman-fix-race-condition-in-qman_destroy_fq.patch (git-fixes CVE-2026-23463 bsc#1261713). - Update patches.suse/spi-fix-statistics-allocation.patch (git-fixes CVE-2026-23475 bsc#1261644). - Update patches.suse/spi-fix-use-after-free-on-controller-registration-fa.patch (git-fixes CVE-2026-31389 bsc#1261789). - Update patches.suse/usb-gadget-f_mass_storage-Fix-potential-integer-over.patch (git-fixes CVE-2026-31412 bsc#1261896). - Update patches.suse/wifi-cfg80211-cancel-rfkill_block-work-in-wiphy_unre.patch (git-fixes CVE-2026-23336 bsc#1260552). - Update patches.suse/wifi-mac80211-bounds-check-link_id-in-ieee80211_ml_r.patch (git-fixes CVE-2026-23246 bsc#1259806). - Update patches.suse/wifi-mac80211-fix-NULL-deref-in-mesh_matches_local.patch (git-fixes CVE-2026-23396 bsc#1260729). - Update patches.suse/wifi-mac80211-fix-NULL-pointer-dereference-in-mesh_r.patch (git-fixes CVE-2026-23279 bsc#1260468). - Update patches.suse/wifi-mt76-Fix-possible-oob-access-in-mt76_connac2_ma.patch (git-fixes CVE-2026-23315 bsc#1260549). - Update patches.suse/wifi-mt76-mt7925-Fix-possible-oob-access-in-mt7925_m.patch (git-fixes CVE-2026-23363 bsc#1260572). - Update patches.suse/wifi-mt76-mt7996-Fix-possible-oob-access-in-mt7996_m.patch (git-fixes CVE-2026-23325 bsc#1260537). - Update patches.suse/wifi-radiotap-reject-radiotap-with-unknown-bits.patch (git-fixes CVE-2026-23367 bsc#1260731). - Update patches.suse/wifi-rsi-Don-t-default-to-EOPNOTSUPP-in-rsi_mac80211.patch (git-fixes CVE-2026-23373 bsc#1260528). - Update patches.suse/wifi-wlcore-Fix-a-locking-bug.patch (git-fixes CVE-2026-23420 bsc#1261503). - commit 61fa16a ++++ kernel-rt_debug: - kabi: arm: io: Export ioremap_prot() symbol (CVE-2026-23346 bsc#1260529) - commit 017493b - Update patches.suse/0001-apparmor-validate-DFA-start-states-are-in-bounds-in-.patch (bsc#1258849 CVE-2026-23269 bsc#1259857). - Update patches.suse/0002-apparmor-fix-memory-leak-in-verify_header.patch (bsc#1258849 CVE-2026-23403 bsc#1261287). - Update patches.suse/0003-apparmor-replace-recursive-profile-removal-with-iter.patch (bsc#1258849 CVE-2026-23404 bsc#1258854). - Update patches.suse/0004-apparmor-fix-limit-the-number-of-levels-of-policy-na.patch (bsc#1258849 CVE-2026-23405 bsc#1261295). - Update patches.suse/0005-apparmor-fix-side-effect-bug-in-match_char-macro-usa.patch (bsc#1258849 CVE-2026-23406 bsc#1258855). - Update patches.suse/0006-apparmor-fix-missing-bounds-check-on-DEFAULT-table-i.patch (bsc#1258849 CVE-2026-23407 bsc#1258855). - Update patches.suse/0007-apparmor-Fix-double-free-of-ns_name-in-aa_replace_pr.patch (bsc#1258849 CVE-2026-23408 bsc#1258857). - Update patches.suse/0008-apparmor-fix-unprivileged-local-user-can-do-privileg.patch (bsc#1258849 CVE-2026-23268 bsc#1258850). - Update patches.suse/0009-apparmor-fix-differential-encoding-verification.patch (bsc#1258849 CVE-2026-23409 bsc#1258857). - Update patches.suse/0010-apparmor-fix-race-on-rawdata-dereference.patch (bsc#1258849 CVE-2026-23410 bsc#1258856). - Update patches.suse/0011-apparmor-fix-race-between-freeing-data-and-fs-access.patch (bsc#1258849 CVE-2026-23411 bsc#1258856). - Update patches.suse/macvlan-observe-an-RCU-grace-period-in-macvlan_commo.patch (CVE-2026-23209 bsc#1258518 CVE-2026-23273 bsc#1260010). - commit d5ee582 - Update patches.suse/ACPI-EC-clean-up-handlers-on-probe-failure-in-acpi_e.patch (git-fixes CVE-2026-31426 bsc#1262078). - Update patches.suse/ACPI-processor-Fix-previous-acpi_processor_errata_pi.patch (git-fixes CVE-2026-23443 bsc#1261679). - Update patches.suse/ALSA-usb-audio-Use-correct-version-for-UAC3-header-v.patch (git-fixes CVE-2026-23318 bsc#1260536). - Update patches.suse/Bluetooth-L2CAP-Validate-L2CAP_INFO_RSP-payload-leng.patch (git-fixes CVE-2026-31393 bsc#1261719). - Update patches.suse/HID-Add-HID_CLAIMED_INPUT-guards-in-raw_event-callba.patch (stable-fixes CVE-2026-23382 bsc#1260551). - Update patches.suse/PCI-IOV-Fix-race-between-SR-IOV-enable-disable-and-h.patch (git-fixes CVE-2025-40219 bsc#1254518). - Update patches.suse/PM-runtime-Fix-a-race-condition-related-to-device-re.patch (git-fixes CVE-2026-23452 bsc#1261618). - Update patches.suse/Revert-drm-amd-Check-if-ASPM-is-enabled-from-PCIe-su.patch (git-fixes CVE-2026-23264 bsc#1259869). - Update patches.suse/btrfs-log-new-dentries-when-logging-parent-dir-of-a-.patch (git-fixes CVE-2026-23465 bsc#1261685). - Update patches.suse/can-bcm-fix-locking-for-bcm_op-runtime-updates.patch (git-fixes CVE-2026-23362 bsc#1260489). - Update patches.suse/can-ems_usb-ems_usb_read_bulk_callback-check-the-pro.patch (git-fixes CVE-2026-23307 bsc#1260541). - Update patches.suse/can-mcp251x-fix-deadlock-in-error-path-of-mcp251x_op.patch (git-fixes CVE-2026-23357 bsc#1260532). - Update patches.suse/can-ucan-Fix-infinite-loop-from-zero-length-messages.patch (git-fixes CVE-2026-23298 bsc#1260485). - Update patches.suse/can-usb-etas_es58x-correctly-anchor-the-urb-in-the-r.patch (git-fixes CVE-2026-23324 bsc#1260507). - Update patches.suse/drm-logicvc-Fix-device-node-reference-leak-in-logicv.patch (git-fixes CVE-2026-23426 bsc#1261504). - Update patches.suse/fbdev-rivafb-fix-divide-error-in-nv3_arb.patch (git-fixes CVE-2026-23266 bsc#1259868). - Update patches.suse/fbdev-smscufx-properly-copy-ioctl-memory-to-kernelsp.patch (stable-fixes CVE-2026-23236 bsc#1259199). - Update patches.suse/media-dvb-core-fix-wrong-reinitialization-of-ringbuf.patch (git-fixes CVE-2026-23253 bsc#1259878). - Update patches.suse/media-dvb-net-fix-OOB-access-in-ULE-extension-header.patch (git-fixes CVE-2026-31405 bsc#1261700). - Update patches.suse/mtd-Avoid-boot-crash-in-RedBoot-partition-table-pars.patch (git-fixes CVE-2026-23474 bsc#1261602). - Update patches.suse/mtd-rawnand-serialize-lock-unlock-against-other-NAND.patch (git-fixes CVE-2026-23434 bsc#1261601). - Update patches.suse/net-rose-fix-NULL-pointer-dereference-in-rose_transm.patch (git-fixes CVE-2026-23460 bsc#1261582). - Update patches.suse/net-usb-aqc111-Do-not-perform-PM-inside-suspend-call.patch (git-fixes CVE-2026-23446 bsc#1261778). - Update patches.suse/net-usb-cdc_ncm-add-ndpoffset-to-NDP16-nframes-bound.patch (git-fixes CVE-2026-23448 bsc#1261750). - Update patches.suse/net-usb-cdc_ncm-add-ndpoffset-to-NDP32-nframes-bound.patch (git-fixes CVE-2026-23447 bsc#1261751). - Update patches.suse/net-usb-kalmia-validate-USB-endpoints.patch (git-fixes CVE-2026-23365 bsc#1260800). - Update patches.suse/net-usb-kaweth-validate-USB-endpoints.patch (git-fixes CVE-2026-23312 bsc#1260561). - Update patches.suse/net-usb-pegasus-validate-USB-endpoints.patch (stable-fixes CVE-2026-23290 bsc#1260533). - Update patches.suse/net-x25-Fix-overflow-when-accumulating-packets.patch (git-fixes CVE-2026-31417 bsc#1262101). - Update patches.suse/nfc-nci-free-skb-on-nci_transceive-early-error-paths.patch (git-fixes CVE-2026-23339 bsc#1260581). - Update patches.suse/nfc-pn533-properly-drop-the-usb-interface-reference-.patch (git-fixes CVE-2026-23291 bsc#1260483). - Update patches.suse/nfc-rawsock-cancel-tx_work-before-socket-teardown.patch (git-fixes CVE-2026-23372 bsc#1260484). - Update patches.suse/pinctrl-equilibrium-fix-warning-trace-on-load.patch (git-fixes CVE-2026-23308 bsc#1260553). - Update patches.suse/platform-x86-classmate-laptop-Add-missing-NULL-point.patch (stable-fixes CVE-2026-23237 bsc#1259222). - Update patches.suse/platform-x86-dell-wmi-sysman-Don-t-hex-dump-plaintex.patch (git-fixes CVE-2026-23370 bsc#1260504). - Update patches.suse/regmap-maple-free-entry-on-mas_store_gfp-failure.patch (stable-fixes CVE-2026-23260 bsc#1259873). - Update patches.suse/scsi-qla2xxx-Fix-bsg_done-causing-double-free.patch (bsc#1256863 CVE-2025-71238 bsc#1259186). - Update patches.suse/soc-fsl-qbman-fix-race-condition-in-qman_destroy_fq.patch (git-fixes CVE-2026-23463 bsc#1261713). - Update patches.suse/spi-fix-statistics-allocation.patch (git-fixes CVE-2026-23475 bsc#1261644). - Update patches.suse/spi-fix-use-after-free-on-controller-registration-fa.patch (git-fixes CVE-2026-31389 bsc#1261789). - Update patches.suse/usb-gadget-f_mass_storage-Fix-potential-integer-over.patch (git-fixes CVE-2026-31412 bsc#1261896). - Update patches.suse/wifi-cfg80211-cancel-rfkill_block-work-in-wiphy_unre.patch (git-fixes CVE-2026-23336 bsc#1260552). - Update patches.suse/wifi-mac80211-bounds-check-link_id-in-ieee80211_ml_r.patch (git-fixes CVE-2026-23246 bsc#1259806). - Update patches.suse/wifi-mac80211-fix-NULL-deref-in-mesh_matches_local.patch (git-fixes CVE-2026-23396 bsc#1260729). - Update patches.suse/wifi-mac80211-fix-NULL-pointer-dereference-in-mesh_r.patch (git-fixes CVE-2026-23279 bsc#1260468). - Update patches.suse/wifi-mt76-Fix-possible-oob-access-in-mt76_connac2_ma.patch (git-fixes CVE-2026-23315 bsc#1260549). - Update patches.suse/wifi-mt76-mt7925-Fix-possible-oob-access-in-mt7925_m.patch (git-fixes CVE-2026-23363 bsc#1260572). - Update patches.suse/wifi-mt76-mt7996-Fix-possible-oob-access-in-mt7996_m.patch (git-fixes CVE-2026-23325 bsc#1260537). - Update patches.suse/wifi-radiotap-reject-radiotap-with-unknown-bits.patch (git-fixes CVE-2026-23367 bsc#1260731). - Update patches.suse/wifi-rsi-Don-t-default-to-EOPNOTSUPP-in-rsi_mac80211.patch (git-fixes CVE-2026-23373 bsc#1260528). - Update patches.suse/wifi-wlcore-Fix-a-locking-bug.patch (git-fixes CVE-2026-23420 bsc#1261503). - commit 61fa16a ++++ libsolv: - fix parsing of sha512 checksums in debian repositories [bsc#1265938] [CVE-2026-9150] - improve speed of dirpool_add_dir makeing parsing of filelists.xml twice as fast - fix parsing of recommends in the old Mandriva synthesis format - bump version to 0.7.37 ++++ nvidia-open-driver-G06-signed: - disable-objtool-override.patch * get rid of confusing objtool warnings (boo#1212841) - -> from https://github.com/joanbm/nvidia-470xx-linux-mainline ++++ ovmf: - Update mbedtls to 3.6.6 to fix CVE-2026-25833, CVE-2026-25834, CVE-2026-25835, CVE-2026-34874 (bsc#1261476, bsc#1261477, bsc#1261478, bsc#1261469) - Requires Mbed TLS 3.6.6 or higher to mitigate vulnerability. ------------------------------------------------------------------ ------------------ 2026-4-22 - Apr 22 2026 ------------------- ------------------------------------------------------------------ ++++ dnsmasq: - bsc#1262487, CVE-2026-6507, dnsmasq-CVE-2026-6507.patch: out-of-bounds write in DHCP BOOTREPLY processing can lead to denial of service. ++++ kernel-default: - mm: ioremap: allow ARCH to have its own ioremap method definition (CVE-2026-23346 bsc#1260529) - commit 66ac8d8 - arm64: io: Extract user memory type in ioremap_prot() (CVE-2026-23346 bsc#1260529) - commit 21a529a - arm64: io: Rename ioremap_prot() to __ioremap_prot() (CVE-2026-23346 bsc#1260529) - commit 2422d1b - arm64 : mm: add wrapper function ioremap_prot() (CVE-2026-23346 bsc#1260529) - commit c722530 - mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (CVE-2026-23346 bsc#1260529) - commit c04cc3b - net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() (CVE-2026-31423 bsc#1262063). - commit 7a85231 - net/sched: cls_flow: fix NULL pointer dereference on shared blocks (CVE-2026-31422 bsc#1262054). - commit e8f4814 - net/sched: teql: Fix double-free in teql_master_xmit (CVE-2026-23449 bsc#1261779). - commit 3f941ea - espintcp: Fix race condition in espintcp_close() (CVE-2026-23239 bsc#1259485). - commit fad2a85 - tls: Fix race condition in tls_sw_cancel_work_tx() (CVE-2026-23240 bsc#1259484). - commit 8f20aa3 - drm/i915/wm: Verify the correct plane DDB entry (git-fixes). - crypto: ccp - copy IV using skcipher ivsize (git-fixes). - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (git-fixes). - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (git-fixes). - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (git-fixes). - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (git-fixes). - crypto: sa2ul - Fix AEAD fallback algorithm names (git-fixes). - commit 96a5ab8 - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (git-fixes). - commit a9d8238 ++++ kernel-rt: - mm: ioremap: allow ARCH to have its own ioremap method definition (CVE-2026-23346 bsc#1260529) - commit 66ac8d8 - arm64: io: Extract user memory type in ioremap_prot() (CVE-2026-23346 bsc#1260529) - commit 21a529a - arm64: io: Rename ioremap_prot() to __ioremap_prot() (CVE-2026-23346 bsc#1260529) - commit 2422d1b - arm64 : mm: add wrapper function ioremap_prot() (CVE-2026-23346 bsc#1260529) - commit c722530 - mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (CVE-2026-23346 bsc#1260529) - commit c04cc3b - net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() (CVE-2026-31423 bsc#1262063). - commit 7a85231 - net/sched: cls_flow: fix NULL pointer dereference on shared blocks (CVE-2026-31422 bsc#1262054). - commit e8f4814 - net/sched: teql: Fix double-free in teql_master_xmit (CVE-2026-23449 bsc#1261779). - commit 3f941ea - espintcp: Fix race condition in espintcp_close() (CVE-2026-23239 bsc#1259485). - commit fad2a85 - tls: Fix race condition in tls_sw_cancel_work_tx() (CVE-2026-23240 bsc#1259484). - commit 8f20aa3 - drm/i915/wm: Verify the correct plane DDB entry (git-fixes). - crypto: ccp - copy IV using skcipher ivsize (git-fixes). - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (git-fixes). - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (git-fixes). - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (git-fixes). - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (git-fixes). - crypto: sa2ul - Fix AEAD fallback algorithm names (git-fixes). - commit 96a5ab8 - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (git-fixes). - commit a9d8238 ++++ kernel-rt_debug: - mm: ioremap: allow ARCH to have its own ioremap method definition (CVE-2026-23346 bsc#1260529) - commit 66ac8d8 - arm64: io: Extract user memory type in ioremap_prot() (CVE-2026-23346 bsc#1260529) - commit 21a529a - arm64: io: Rename ioremap_prot() to __ioremap_prot() (CVE-2026-23346 bsc#1260529) - commit 2422d1b - arm64 : mm: add wrapper function ioremap_prot() (CVE-2026-23346 bsc#1260529) - commit c722530 - mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (CVE-2026-23346 bsc#1260529) - commit c04cc3b - net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() (CVE-2026-31423 bsc#1262063). - commit 7a85231 - net/sched: cls_flow: fix NULL pointer dereference on shared blocks (CVE-2026-31422 bsc#1262054). - commit e8f4814 - net/sched: teql: Fix double-free in teql_master_xmit (CVE-2026-23449 bsc#1261779). - commit 3f941ea - espintcp: Fix race condition in espintcp_close() (CVE-2026-23239 bsc#1259485). - commit fad2a85 - tls: Fix race condition in tls_sw_cancel_work_tx() (CVE-2026-23240 bsc#1259484). - commit 8f20aa3 - drm/i915/wm: Verify the correct plane DDB entry (git-fixes). - crypto: ccp - copy IV using skcipher ivsize (git-fixes). - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (git-fixes). - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (git-fixes). - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (git-fixes). - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (git-fixes). - crypto: sa2ul - Fix AEAD fallback algorithm names (git-fixes). - commit 96a5ab8 - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (git-fixes). - commit a9d8238 ------------------------------------------------------------------ ------------------ 2026-4-21 - Apr 21 2026 ------------------- ------------------------------------------------------------------ ++++ python-kiwi: - Move OVA support to open-vmdk Finally this commit drops the use of the VMware ovftool and moves to the real opensource alternative open-vmdk This Fixes #2292 and Fixes #2627 and Fixes jira#PED-9497 ++++ kernel-default: - Refresh patches.suse/KVM-x86-mmu-Drop-zap-existing-present-SPTE-even-when.patch. - commit a2808d6 - x86/boot: Fix page table access in 5-level to 4-level paging transition (git-fixes). - commit 4526872 - x86/boot/sev: Avoid shared GHCB page for early memory acceptance (git-fixes). - commit 4109e10 - Refresh patches.suse/kdump-wait-for-dma-to-time-out-when-using-cma.patch. Update to the version that was actually committed upstream. - commit eac6225 - Refresh patches.suse/selftests-powerpc-Suppress-Wmaybe-uninitialized-with-GCC-15.patch. - commit 30a517c - sunrpc: fix cache_request leak in cache_release (CVE-2026-31400 bsc#1261645). - commit 881c7a1 - Update tags in patches.suse/ext4-use-optimized-mballoc-scanning-regardless-of-in.patch. - commit ec46e56 - ext4: fix fsync(2) for nojournal mode (git-fixes). - commit 238bddf - ext4: make recently_deleted() properly work with lazy itable initialization (git-fixes). - commit 9897a6f - ext4: reject mount if bigalloc with s_first_data_block != 0 (git-fixes). - commit 7f5229b - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() (git-fixes). - platform/x86: dell-wmi-sysman: bound enumeration string aggregation (git-fixes). - platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() (git-fixes). - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup (git-fixes). - platform/surface: surfacepro3_button: Drop wakeup source on remove (git-fixes). - leds: lgm-sso: Remove duplicate assignments for priv->mmap (git-fixes). - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() (git-fixes). - commit afede1d ++++ kernel-rt: - Refresh patches.suse/KVM-x86-mmu-Drop-zap-existing-present-SPTE-even-when.patch. - commit a2808d6 - x86/boot: Fix page table access in 5-level to 4-level paging transition (git-fixes). - commit 4526872 - x86/boot/sev: Avoid shared GHCB page for early memory acceptance (git-fixes). - commit 4109e10 - Refresh patches.suse/kdump-wait-for-dma-to-time-out-when-using-cma.patch. Update to the version that was actually committed upstream. - commit eac6225 - Refresh patches.suse/selftests-powerpc-Suppress-Wmaybe-uninitialized-with-GCC-15.patch. - commit 30a517c - sunrpc: fix cache_request leak in cache_release (CVE-2026-31400 bsc#1261645). - commit 881c7a1 - Update tags in patches.suse/ext4-use-optimized-mballoc-scanning-regardless-of-in.patch. - commit ec46e56 - ext4: fix fsync(2) for nojournal mode (git-fixes). - commit 238bddf - ext4: make recently_deleted() properly work with lazy itable initialization (git-fixes). - commit 9897a6f - ext4: reject mount if bigalloc with s_first_data_block != 0 (git-fixes). - commit 7f5229b - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() (git-fixes). - platform/x86: dell-wmi-sysman: bound enumeration string aggregation (git-fixes). - platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() (git-fixes). - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup (git-fixes). - platform/surface: surfacepro3_button: Drop wakeup source on remove (git-fixes). - leds: lgm-sso: Remove duplicate assignments for priv->mmap (git-fixes). - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() (git-fixes). - commit afede1d ++++ kernel-rt_debug: - Refresh patches.suse/KVM-x86-mmu-Drop-zap-existing-present-SPTE-even-when.patch. - commit a2808d6 - x86/boot: Fix page table access in 5-level to 4-level paging transition (git-fixes). - commit 4526872 - x86/boot/sev: Avoid shared GHCB page for early memory acceptance (git-fixes). - commit 4109e10 - Refresh patches.suse/kdump-wait-for-dma-to-time-out-when-using-cma.patch. Update to the version that was actually committed upstream. - commit eac6225 - Refresh patches.suse/selftests-powerpc-Suppress-Wmaybe-uninitialized-with-GCC-15.patch. - commit 30a517c - sunrpc: fix cache_request leak in cache_release (CVE-2026-31400 bsc#1261645). - commit 881c7a1 - Update tags in patches.suse/ext4-use-optimized-mballoc-scanning-regardless-of-in.patch. - commit ec46e56 - ext4: fix fsync(2) for nojournal mode (git-fixes). - commit 238bddf - ext4: make recently_deleted() properly work with lazy itable initialization (git-fixes). - commit 9897a6f - ext4: reject mount if bigalloc with s_first_data_block != 0 (git-fixes). - commit 7f5229b - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() (git-fixes). - platform/x86: dell-wmi-sysman: bound enumeration string aggregation (git-fixes). - platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() (git-fixes). - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup (git-fixes). - platform/surface: surfacepro3_button: Drop wakeup source on remove (git-fixes). - leds: lgm-sso: Remove duplicate assignments for priv->mmap (git-fixes). - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() (git-fixes). - commit afede1d ++++ opensuse-migration-tool: - Update to version 20260421.e72b645: * Update ports temp repo url for Tumbleweed ------------------------------------------------------------------ ------------------ 2026-4-20 - Apr 20 2026 ------------------- ------------------------------------------------------------------ ++++ cups: - Version upgrade to 2.4.17: See https://github.com/openprinting/cups/releases The new release 2.4.17 contains the following security fixes: * CVE-2026-27447: The scheduler treated local user and group names as case-insensitive (bsc#1261572) * CVE-2026-34978: The RSS notifier could write outside the scheduler's RSS directory (bsc#1261571) * CVE-2026-34980: The scheduler did not filter control characters from option values (bsc#1261569) * CVE-2026-34979: The scheduler did not always allocate enough memory for a job's options string (bsc#1261570) * CVE-2026-34990: The scheduler incorrectly allowed local certificates over the loopback interface (bsc#1261568) * CVE-2026-39314: Fixed the range check for job password strings (bsc#1261743) * CVE-2026-39316: Fixed a printer subscription bug in the scheduler (bsc#1261742) * CVE-2026-41079: Fixed a SNMP string conversion bug in the backends (bsc#1263116) - The release includes other fixes as well, listed in CHANGES.md. Issues are those at https://github.com/OpenPrinting/cups/issues Detailed list (from CHANGES.md): * The scheduler followed symbolic links when cleaning out its temporary directory (Issue #1448) * Updated `cupsFileGetConf` and `cupsFilePutConf` to escape more characters. * Updated man page `cancel` (Issue #984) * Updated `cupsRasterReadHeader` to validate more of the page header values (Issue #1501) * Fixed an issue with the class/printer CGI name checking. * Fixed infinite loop in `http_write()` on busy print servers (Issue #827) * Fixed potential TLS blocking issues (Issue #1128) * Fixed a job history bug in the scheduler (Issue #1440) * Fixed notifier logging bug that would result in nul bytes getting into the log (Issue #1450) * Fixed possible use-after-free in `cupsdReadClient()` (Issue #1454) * Fixed a document format bug in the IPP backend (Issue #1457) * Fixed DRAIN_OUTPUT race condition (Issue #1461) * Fixed a bug when then `ippFindXxx` and `ippSetXxx` functions were mixed. * Fixed the mapping of supply type keywords to SNMP names. * Fixed a bug in the IPP backend when SNMP was disabled. * Fixed a crash bug in the rastertoepson filter. * Fixed a bug in cgiCheckVariables. * Fixed handling read/write errors with OpenSSL (Issue #1506) * Fixed handling rehandshake error in `_httpTLSRead` (Issue #1508) * Fixed a debug printf bug on Windows (Issue #1529) * Fixed a recursion issue with encoding of nested collections (Issue #1539) * Fixed parsing of the `LimitRequestBody`, `MaxLogSize`, and `MaxRequestSize` directives in "cupsd.conf" (Issue #1540) * Fixed a parsing bug in `ipptool` (Issue #1542) * Fixed blank line detection in the `rastertolabel` filter (Issue #1545) * Fixed `httpPeek` edge case on compressed streams Issues are those at https://github.com/OpenPrinting/cups/issues - Adapted downgrade-autoconf-requirement.patch for CUPS 2.4.17 ++++ dnsmasq: - Fix FTBFS with libnettle 4.0: (boo#1257934) * dnsmasq: missed hash->digest calls in 4070a74 (1eab169) * Add dnsmasq-Fix-FTBFS-nettle-4.0.patch and merge 4070a748.patch ++++ haproxy: - VUL-0: CVE-2026-33555: haproxy: Request smuggling via HTTP/3 parser desynchronization (bsc#1262103) Add upstream patch 0001-BUG-MAJOR-h3-check-body-size-with-content-length-on-.patch ++++ kernel-default: - i40e: Fix preempt count leak in napi poll tracepoint (CVE-2026-23313 bsc#1260555) - commit 2e9a394 - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (CVE-2026-23399 bsc#1261020). - commit 6b85bc1 - modpost: Amend ppc64 save/restfpr symnames for -Os build (bsc#1215199). - commit 5b6f69e - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (CVE-2026-23456 bsc#1261703). - commit a6df659 - NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (CVE-2026-31403 bsc#1261796). - commit fbf8b70 - staging: sm750fb: fix division by zero in ps_to_hz() (git-fixes). - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() (git-fixes). - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() (git-fixes). - usbip: validate number_of_packets in usbip_pack_ret_submit() (git-fixes). - usb: gadget: renesas_usb3: validate endpoint index in standard request handlers (git-fixes). - usb: chipidea: otg: not wait vbus drop if use role_switch (git-fixes). - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (git-fixes). - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() (git-fixes). - usb: port: add delay after usb_hub_set_port_power() (git-fixes). - commit 82d354e - x86/CPU: Fix FPDSS on Zen1 (bsc#1243603 CVE-2023-2058). - commit 7fc9cd2 - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402 bsc#1261638). - commit 7c57216 ++++ kernel-rt: - i40e: Fix preempt count leak in napi poll tracepoint (CVE-2026-23313 bsc#1260555) - commit 2e9a394 - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (CVE-2026-23399 bsc#1261020). - commit 6b85bc1 - modpost: Amend ppc64 save/restfpr symnames for -Os build (bsc#1215199). - commit 5b6f69e - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (CVE-2026-23456 bsc#1261703). - commit a6df659 - NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (CVE-2026-31403 bsc#1261796). - commit fbf8b70 - staging: sm750fb: fix division by zero in ps_to_hz() (git-fixes). - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() (git-fixes). - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() (git-fixes). - usbip: validate number_of_packets in usbip_pack_ret_submit() (git-fixes). - usb: gadget: renesas_usb3: validate endpoint index in standard request handlers (git-fixes). - usb: chipidea: otg: not wait vbus drop if use role_switch (git-fixes). - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (git-fixes). - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() (git-fixes). - usb: port: add delay after usb_hub_set_port_power() (git-fixes). - commit 82d354e - x86/CPU: Fix FPDSS on Zen1 (bsc#1243603 CVE-2023-2058). - commit 7fc9cd2 - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402 bsc#1261638). - commit 7c57216 ++++ kernel-rt_debug: - i40e: Fix preempt count leak in napi poll tracepoint (CVE-2026-23313 bsc#1260555) - commit 2e9a394 - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (CVE-2026-23399 bsc#1261020). - commit 6b85bc1 - modpost: Amend ppc64 save/restfpr symnames for -Os build (bsc#1215199). - commit 5b6f69e - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (CVE-2026-23456 bsc#1261703). - commit a6df659 - NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (CVE-2026-31403 bsc#1261796). - commit fbf8b70 - staging: sm750fb: fix division by zero in ps_to_hz() (git-fixes). - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() (git-fixes). - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() (git-fixes). - usbip: validate number_of_packets in usbip_pack_ret_submit() (git-fixes). - usb: gadget: renesas_usb3: validate endpoint index in standard request handlers (git-fixes). - usb: chipidea: otg: not wait vbus drop if use role_switch (git-fixes). - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (git-fixes). - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() (git-fixes). - usb: port: add delay after usb_hub_set_port_power() (git-fixes). - commit 82d354e - x86/CPU: Fix FPDSS on Zen1 (bsc#1243603 CVE-2023-2058). - commit 7fc9cd2 - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402 bsc#1261638). - commit 7c57216 ++++ libzypp: - Check for trusted key updates when updating the general keyring (bsc#1259706) - Support multiple MirroredOrigin authorities (bsc#1253193) - Workaround doxygen bug: doxygen/doxygen#12057 - libzypp.spec: Add missing graphviz-gd BuildRequires (boo#1259842) - version 17.38.6 (35) ++++ zypper: - Autorefresh ris-services the way as plugin-services (bsc#1246504) It's actually wrong to treat service refreshes different depending on the service type. For the purpose of a service it makes no difference how the data about the repos to use are acquired. - version 1.14.96 ------------------------------------------------------------------ ------------------ 2026-4-19 - Apr 19 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - pinctrl: abx500: Fix type of 'argument' variable (git-fixes). - pinctrl: pinctrl-pic32: Fix resource leak (git-fixes). - pinctrl: pic32: use consistent spacing around '+' (git-fixes). - pinctrl: pic32: change all cases of bare 'unsigned' to 'unsigned int' (git-fixes). - pinctrl: Fix spelling problem (git-fixes). - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status (git-fixes). - i3c: master: Fix error codes at send_ccc_cmd (git-fixes). - ipmi: ssif_bmc: change log level to dbg in irq callback (git-fixes). - ipmi: ssif_bmc: fix message desynchronization after truncated response (git-fixes). - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure (git-fixes). - Input: uinput - take event lock when submitting FF request "event" (stable-fixes). - commit 84d3fa4 - Drop PCI ACS patch that caused a regression (bsc#1261348) It was reverted on stable trees as well Deleted: patches.suse/PCI-Enable-ACS-after-configuring-IOMMU-for-OF-platfo.patch - commit 47c1816 ++++ kernel-rt: - pinctrl: abx500: Fix type of 'argument' variable (git-fixes). - pinctrl: pinctrl-pic32: Fix resource leak (git-fixes). - pinctrl: pic32: use consistent spacing around '+' (git-fixes). - pinctrl: pic32: change all cases of bare 'unsigned' to 'unsigned int' (git-fixes). - pinctrl: Fix spelling problem (git-fixes). - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status (git-fixes). - i3c: master: Fix error codes at send_ccc_cmd (git-fixes). - ipmi: ssif_bmc: change log level to dbg in irq callback (git-fixes). - ipmi: ssif_bmc: fix message desynchronization after truncated response (git-fixes). - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure (git-fixes). - Input: uinput - take event lock when submitting FF request "event" (stable-fixes). - commit 84d3fa4 - Drop PCI ACS patch that caused a regression (bsc#1261348) It was reverted on stable trees as well Deleted: patches.suse/PCI-Enable-ACS-after-configuring-IOMMU-for-OF-platfo.patch - commit 47c1816 ++++ kernel-rt_debug: - pinctrl: abx500: Fix type of 'argument' variable (git-fixes). - pinctrl: pinctrl-pic32: Fix resource leak (git-fixes). - pinctrl: pic32: use consistent spacing around '+' (git-fixes). - pinctrl: pic32: change all cases of bare 'unsigned' to 'unsigned int' (git-fixes). - pinctrl: Fix spelling problem (git-fixes). - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status (git-fixes). - i3c: master: Fix error codes at send_ccc_cmd (git-fixes). - ipmi: ssif_bmc: change log level to dbg in irq callback (git-fixes). - ipmi: ssif_bmc: fix message desynchronization after truncated response (git-fixes). - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure (git-fixes). - Input: uinput - take event lock when submitting FF request "event" (stable-fixes). - commit 84d3fa4 - Drop PCI ACS patch that caused a regression (bsc#1261348) It was reverted on stable trees as well Deleted: patches.suse/PCI-Enable-ACS-after-configuring-IOMMU-for-OF-platfo.patch - commit 47c1816 ------------------------------------------------------------------ ------------------ 2026-4-18 - Apr 18 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - Refresh patches.suse/kdump-add-crashkernel-cma-suffix.patch. - kdump, documentation: describe craskernel CMA reservation (jsc#PED-7249). - Refresh patches.suse/kdump-implement-reserve_crashkernel_cma.patch. - Refresh patches.suse/kdump-wait-for-dma-to-time-out-when-using-cma.patch. - Refresh patches.suse/kdump-x86-implement-crashkernel-cma-reservation.patch. Add upstream references and move to the sorted section. - commit e895108 - remoteproc: xlnx: Only access buffer information if IPI is buffered (git-fixes). - soundwire: cadence: Clear message complete before signaling waiting thread (git-fixes). - soundwire: bus: demote UNATTACHED state warnings to dev_dbg() (git-fixes). - soc: qcom: aoss: compare against normalized cooling state (git-fixes). - soc: qcom: llcc: fix v1 SB syndrome register offset (git-fixes). - soc/tegra: cbb: Set ERD on resume for err interrupt (git-fixes). - commit caf3df8 - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob (git-fixes). - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask (git-fixes). - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations (git-fixes). - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions (git-fixes). - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path (git-fixes). - mtd: physmap_of_gemini: Fix disabled pinctrl state check (git-fixes). - power: supply: axp288_charger: Do not cancel work before initializing it (git-fixes). - power: supply: max17042: avoid overflow when determining health (git-fixes). - HID: asus: do not abort probe when not necessary (git-fixes). - HID: asus: make asus_resume adhere to linux kernel coding standards (git-fixes). - HID: usbhid: fix deadlock in hid_post_reset() (git-fixes). - HID: alps: fix NULL pointer dereference in alps_raw_event() (git-fixes). - dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() (git-fixes). - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function (git-fixes). - memory: tegra30-emc: Fix dll_change check (git-fixes). - memory: tegra124-emc: Fix dll_change check (git-fixes). - commit 095efd4 ++++ kernel-rt: - Refresh patches.suse/kdump-add-crashkernel-cma-suffix.patch. - kdump, documentation: describe craskernel CMA reservation (jsc#PED-7249). - Refresh patches.suse/kdump-implement-reserve_crashkernel_cma.patch. - Refresh patches.suse/kdump-wait-for-dma-to-time-out-when-using-cma.patch. - Refresh patches.suse/kdump-x86-implement-crashkernel-cma-reservation.patch. Add upstream references and move to the sorted section. - commit e895108 - remoteproc: xlnx: Only access buffer information if IPI is buffered (git-fixes). - soundwire: cadence: Clear message complete before signaling waiting thread (git-fixes). - soundwire: bus: demote UNATTACHED state warnings to dev_dbg() (git-fixes). - soc: qcom: aoss: compare against normalized cooling state (git-fixes). - soc: qcom: llcc: fix v1 SB syndrome register offset (git-fixes). - soc/tegra: cbb: Set ERD on resume for err interrupt (git-fixes). - commit caf3df8 - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob (git-fixes). - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask (git-fixes). - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations (git-fixes). - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions (git-fixes). - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path (git-fixes). - mtd: physmap_of_gemini: Fix disabled pinctrl state check (git-fixes). - power: supply: axp288_charger: Do not cancel work before initializing it (git-fixes). - power: supply: max17042: avoid overflow when determining health (git-fixes). - HID: asus: do not abort probe when not necessary (git-fixes). - HID: asus: make asus_resume adhere to linux kernel coding standards (git-fixes). - HID: usbhid: fix deadlock in hid_post_reset() (git-fixes). - HID: alps: fix NULL pointer dereference in alps_raw_event() (git-fixes). - dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() (git-fixes). - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function (git-fixes). - memory: tegra30-emc: Fix dll_change check (git-fixes). - memory: tegra124-emc: Fix dll_change check (git-fixes). - commit 095efd4 ++++ kernel-rt_debug: - Refresh patches.suse/kdump-add-crashkernel-cma-suffix.patch. - kdump, documentation: describe craskernel CMA reservation (jsc#PED-7249). - Refresh patches.suse/kdump-implement-reserve_crashkernel_cma.patch. - Refresh patches.suse/kdump-wait-for-dma-to-time-out-when-using-cma.patch. - Refresh patches.suse/kdump-x86-implement-crashkernel-cma-reservation.patch. Add upstream references and move to the sorted section. - commit e895108 - remoteproc: xlnx: Only access buffer information if IPI is buffered (git-fixes). - soundwire: cadence: Clear message complete before signaling waiting thread (git-fixes). - soundwire: bus: demote UNATTACHED state warnings to dev_dbg() (git-fixes). - soc: qcom: aoss: compare against normalized cooling state (git-fixes). - soc: qcom: llcc: fix v1 SB syndrome register offset (git-fixes). - soc/tegra: cbb: Set ERD on resume for err interrupt (git-fixes). - commit caf3df8 - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob (git-fixes). - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask (git-fixes). - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations (git-fixes). - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions (git-fixes). - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path (git-fixes). - mtd: physmap_of_gemini: Fix disabled pinctrl state check (git-fixes). - power: supply: axp288_charger: Do not cancel work before initializing it (git-fixes). - power: supply: max17042: avoid overflow when determining health (git-fixes). - HID: asus: do not abort probe when not necessary (git-fixes). - HID: asus: make asus_resume adhere to linux kernel coding standards (git-fixes). - HID: usbhid: fix deadlock in hid_post_reset() (git-fixes). - HID: alps: fix NULL pointer dereference in alps_raw_event() (git-fixes). - dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() (git-fixes). - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function (git-fixes). - memory: tegra30-emc: Fix dll_change check (git-fixes). - memory: tegra124-emc: Fix dll_change check (git-fixes). - commit 095efd4 ++++ ucode-intel: - update to microcode-20260227: * Update for functional issues. Refer to Intel® Xeon® 6700P-B/6500P-B-Series SoC with P-Cores for details. * ### Updated Platforms * | GNR-D | B0/B1 | 06-ae-01/97 | 010002f3 | 01000303 | Xeon 6700P-B/6500P-B Series SoC with P-Cores ------------------------------------------------------------------ ------------------ 2026-4-17 - Apr 17 2026 ------------------- ------------------------------------------------------------------ ++++ python-kiwi: - Recreate VTOC with fdasd before recreating partitions Changing partitions with fdasd after a parted resize leads to an internal error because some internal structures mismatch. Work around that by recreating the partition table initially. This Fixes bsc#1271171 ++++ kernel-default: - Refresh patches.suse/netfilter-nft_set_pipapo-split-gc-into-unlink-and-reclaim-.patch. This is fixing the following warning: * discarded-qualifiers (pipapo_gc_queue) in ../net/netfilter/nft_set_pipapo.c in nft_pipapo_commit In file included from ../fs/smb/client/cifsproto.h:10:0, ../include/linux/nls.h:50:26: note: expected 'char *' but argument is of type 'const char *' ../net/netfilter/nft_set_pipapo.c: In function 'nft_pipapo_commit': ../net/netfilter/nft_set_pipapo.c:1768:18: warning: passing argument 1 of 'pipapo_gc_queue' discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers] ../net/netfilter/nft_set_pipapo.c:1666:13: note: expected 'struct nft_set *' but argument is of type 'const struct nft_set *' - commit 418ea5e - efi/capsule-loader: fix incorrect sizeof in phys array reallocation (git-fixes). - commit 278e952 ++++ kernel-rt: - Refresh patches.suse/netfilter-nft_set_pipapo-split-gc-into-unlink-and-reclaim-.patch. This is fixing the following warning: * discarded-qualifiers (pipapo_gc_queue) in ../net/netfilter/nft_set_pipapo.c in nft_pipapo_commit In file included from ../fs/smb/client/cifsproto.h:10:0, ../include/linux/nls.h:50:26: note: expected 'char *' but argument is of type 'const char *' ../net/netfilter/nft_set_pipapo.c: In function 'nft_pipapo_commit': ../net/netfilter/nft_set_pipapo.c:1768:18: warning: passing argument 1 of 'pipapo_gc_queue' discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers] ../net/netfilter/nft_set_pipapo.c:1666:13: note: expected 'struct nft_set *' but argument is of type 'const struct nft_set *' - commit 418ea5e - efi/capsule-loader: fix incorrect sizeof in phys array reallocation (git-fixes). - commit 278e952 ++++ kernel-rt_debug: - Refresh patches.suse/netfilter-nft_set_pipapo-split-gc-into-unlink-and-reclaim-.patch. This is fixing the following warning: * discarded-qualifiers (pipapo_gc_queue) in ../net/netfilter/nft_set_pipapo.c in nft_pipapo_commit In file included from ../fs/smb/client/cifsproto.h:10:0, ../include/linux/nls.h:50:26: note: expected 'char *' but argument is of type 'const char *' ../net/netfilter/nft_set_pipapo.c: In function 'nft_pipapo_commit': ../net/netfilter/nft_set_pipapo.c:1768:18: warning: passing argument 1 of 'pipapo_gc_queue' discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers] ../net/netfilter/nft_set_pipapo.c:1666:13: note: expected 'struct nft_set *' but argument is of type 'const struct nft_set *' - commit 418ea5e - efi/capsule-loader: fix incorrect sizeof in phys array reallocation (git-fixes). - commit 278e952 ++++ opensc: - Security fix: * CVE-2025-66037: crafted input can cause an out-of-bounds read (bsc#1261218) * CVE-2025-66038: improper compact-TLV length validation can lead to crash or unexpected behavior (bsc#1261219) * CVE-2025-49010: stack-buffer-overflow via crafted smart card or USB device responses (bsc#1261214) * CVE-2025-66215: crafted smart card or USB device can cause a stack-buffer-overflow write (bsc#1261220) * Added opensc-CVE-2025-49010.patch * Added opensc-CVE-2025-66037.patch * Added opensc-CVE-2025-66038.patch * Added opensc-CVE-2025-66215.patch ++++ podman: - Add patch for CVE-2025-47914 (bsc#1253993), CVE-2025-47913 (bsc#1253542): * 0006-CVE-2025-47913-CVE-2025-47914-ssh-agent-fixes.patch - Add patch for CVE-2025-31133,CVE-2025-52565,CVE-2025-52881 (bsc#1252376): * 0005-CVE-2025-52881-backport-subset-of-patch-from-runc.patch - Rebase patches: * 0001-CVE-2025-22869-ssh-limit-the-size-of-the-internal-pa.patch * 0002-Fix-Remove-appending-rw-as-the-default-mount-option.patch * 0003-CVE-2025-6032-machine-init-fix-tls-check.patch * 0004-CVE-2025-9566-kube-play-don-t-follow-volume-symlinks.patch ++++ salt: - Fix testsuite failures - Backport of the CVE-2026-31958 fix (bsc#1259554) - Add x86_64_v2 as a possible rpm package architecture - Make users with backslash working for salt-ssh (bsc#1254629) - Fix ansible.playbooks extra-vars quoting (bsc#1257831) - Fix virtualenv call in test helper to use proper python version - Added: * fix-test-failures-754.patch * backport-of-the-cve-2026-31958-fix-bsc-1259554.patch * add-x86_64_v2-as-a-possible-rpm-package-architecture.patch * make-users-with-backslash-working-for-salt-ssh-bsc-1.patch * fix-ansible.playbooks-extra-vars-quoting-bsc-1257831.patch * fix-virtualenv-call-in-test-helper-to-use-proper-pyt.patch ------------------------------------------------------------------ ------------------ 2026-4-16 - Apr 16 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442 bsc#1261581). - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (CVE-2026-23300 bsc#1260538). - commit b424281 - net/sched: act_gate: snapshot parameters with RCU on replace (CVE-2026-23245 bsc#1259799). - commit cea08bb - sched/fair: Have SD_SERIALIZE affect newidle balancing (bsc#1253754). - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (bsc#1253754). - sched/balancing: Switch the 'DEFINE_SPINLOCK(balancing)' spinlock into an 'atomic_t sched_balance_running' flag (bsc#1253754). - commit 7f3daec - Bluetooth: HIDP: Fix possible UAF (CVE-2026-23462 bsc#1261710). - commit c2fcff0 - check-for-config-changes: Exclude CC_MS_EXTENSIONS - commit c04d7e7 - Refresh patches.suse/ice-use-netif_get_num_default_rss_queues.patch. - Refresh patches.suse/mm-page_alloc-thp-prevent-reclaim-for-__GFP_THISNODE-THP-a.patch. - Refresh patches.suse/powerpc-eeh-fix-recursive-pci_lock_rescan_remove-locking-in-EEH-event-handling.patch. Move merged patches to sorted section. - commit 471a61e - blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811 CVE-2026-23374). - commit 357b0af - flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826 CVE-2026-23168). - commit 4572c85 - sched/fair: Remove nohz.nr_cpus and use weight of cpumask instead (bsc#1234634, bsc#1258961). - sched/fair: Change likelyhood of nohz.nr_cpus (bsc#1234634, bsc#1258961). - sched/fair: Move checking for nohz cpus after time check (bsc#1234634, bsc#1258961). - commit 76eeda0 - Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (CVE-2026-23461 bsc#1261707). - commit dba279b - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found (git-fixes). - spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback (git-fixes). - spi: zynqmp-gqspi: fix controller deregistration (git-fixes). - spi: sprd: fix controller deregistration (git-fixes). - spi: sh-hspi: fix controller deregistration (git-fixes). - spi: rspi: fix controller deregistration (git-fixes). - spi: atmel: fix controller deregistration (git-fixes). - spi: at91-usart: fix controller deregistration (git-fixes). - spi: rockchip: fix controller deregistration (git-fixes). - spi: imx: fix use-after-free on unbind (git-fixes). - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo (git-fixes). - spi: fix misleading controller deregistration kernel-doc (git-fixes). - spi: fix misleading controller registration kernel-doc (git-fixes). - spi: fsl-qspi: Use reinit_completion() for repeated operations (git-fixes). - regulator: bd9571mwv: fix OF node reference imbalance (git-fixes). - regulator: act8945a: fix OF node reference imbalance (git-fixes). - regulator: mt6357: fix OF node reference imbalance (git-fixes). - regulator: max77650: fix OF node reference imbalance (git-fixes). - platform/chrome: chromeos_tbmc: Drop wakeup source on remove (git-fixes). - commit 152f382 - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well (git-fixes). - PCI: tegra194: Use DWC IP core version (git-fixes). - PCI: tegra194: Allow system suspend when the Endpoint link is not up (git-fixes). - PCI: tegra194: Set LTR message request before PCIe link up in Endpoint mode (git-fixes). - PCI: tegra194: Disable direct speed change for Endpoint mode (git-fixes). - PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" (git-fixes). - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode (git-fixes). - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down (git-fixes). - PCI: tegra194: Increase LTSSM poll time on surprise link down (git-fixes). - PCI: tegra194: Fix polling delay for L2 state (git-fixes). - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown (git-fixes). - PCI: Enable AtomicOps only if Root Port supports them (git-fixes). - PCI/AER: Stop ruling out unbound devices as error source (git-fixes). - PCI/AER: Clear only error bits in PCIe Device Status (git-fixes). - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration (git-fixes). - media: i2c: ov08d10: fix image vertical start setting (git-fixes). - commit b381137 - media: staging: imx: configure src_mux in csi_start (git-fixes). - media: staging: imx: request mbus_config in csi_start (git-fixes). - media: uvcvideo: Enable VB2_DMABUF for metadata stream (git-fixes). - media: i2c: ov8856: free control handler on error in ov8856_init_controls() (git-fixes). - media: amphion: Fix race between m2m job_abort and device_run (git-fixes). - media: mtk-jpeg: fix use-after-free in release path due to uncancelled work (git-fixes). - media: rc: xbox_remote: heed DMA restrictions (git-fixes). - media: rc: streamzap: Error handling in probe (git-fixes). - media: as102: fix to not free memory after the device is registered in as102_usb_probe() (git-fixes). - media: hackrf: fix to not free memory after the device is registered in hackrf_probe() (git-fixes). - media: saa7164: add ioremap return checks and cleanups (git-fixes). - media: pci: zoran: fix potential memory leak in zoran_probe() (git-fixes). - media: em28xx: fix use-after-free in em28xx_v4l2_open() (git-fixes). - media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections (git-fixes). - media: vidtv: fix nfeeds state corruption on start_streaming failure (git-fixes). - media: vidtv: fix pass-by-value structs causing MSAN warnings (git-fixes). - media: dib8000: avoid division by 0 in dib8000_set_dds() (git-fixes). - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap (git-fixes). - media: omap3isp: drop the use count of v4l2 pipeline (git-fixes). - commit 6696721 - net/sched: act_ife: Fix metalist update behavior (CVE-2026-23378 bsc#1260546). - commit 1bdc011 - drm/vram: remove DRM_VRAM_MM_FILE_OPERATIONS from docs (git-fixes). - drm/msm/a6xx: Use barriers while updating HFI Q headers (git-fixes). - drm/msm/a6xx: Fix dumping A650+ debugbus blocks (git-fixes). - drm/msm/shrinker: Fix can_block() logic (git-fixes). - drm/msm/a6xx: Fix HLSQ register dumping (git-fixes). - drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 (git-fixes). - drm/msm/dsi: fix hdisplay calculation for CMD mode panel (git-fixes). - drm/msm/dsi: fix bits_per_pclk (git-fixes). - drm/msm/dsi: add the missing parameter description (git-fixes). - drm/msm/dpu: fix mismatch between power and frequency (git-fixes). - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board (git-fixes). - drm/amd/pm/ci: Fill DW8 fields from SMC (git-fixes). - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels (git-fixes). - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 (git-fixes). - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock (git-fixes). - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs (git-fixes). - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled (git-fixes). - drm/amd/display: Add NULL check for integrated_info in clk_mgr_construct (git-fixes). - drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths (git-fixes). - drm/panel: simple: Correct G190EAN01 prepare timing (git-fixes). - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first (git-fixes). - drm/amdgpu/gfx10: look at the right prop for gfx queue priority (git-fixes). - drm/sun4i: Fix resource leaks (git-fixes). - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check (git-fixes). - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (git-fixes). - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break (git-fixes). - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() (git-fixes). - staging: media: atomisp: Disallow all private IOCTLs (git-fixes). - media: i2c: imx412: Assert reset GPIO during probe (git-fixes). - commit 654981a - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() (git-fixes). - commit 1effbc1 - crypto: hisilicon - Fix dma_unmap_single() direction (git-fixes). - crypto: talitos - fix SEC1 32k ahash request limitation (git-fixes). - crypto: jitterentropy - replace long-held spinlock with mutex (git-fixes). - crypto: ccree - fix a memory leak in cc_mac_digest() (git-fixes). - crypto: qat - use swab32 macro (git-fixes). - crypto: qat - fix type mismatch in RAS sysfs show functions (git-fixes). - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs (git-fixes). - drm/sun4i: backend: fix error pointer dereference (git-fixes). - drm/komeda: fix integer overflow in AFBC framebuffer size check (git-fixes). - commit 361b735 - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path (git-fixes). - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup (git-fixes). - crypto: simd - reject compat registrations without __ prefixes (git-fixes). - crypto: atmel-tdes - fix DMA sync direction (git-fixes). - crypto: atmel-ecc - Release client on allocation failure (git-fixes). - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() (git-fixes). - ALSA: hda/realtek - fixed speaker no sound update (git-fixes). - ASoC: SOF: Don't allow pointer operations on unconfigured streams (git-fixes). - ASoC: SOF: compress: return the configured codec from get_params (git-fixes). - ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens (git-fixes). - ASoC: qcom: qdsp6: topology: check widget type before accessing data (git-fixes). - ASoC: qcom: q6apm: remove child devices when apm is removed (git-fixes). - ASoC: qcom: q6apm: move component registration to unmanaged version (git-fixes). - ASoC: fsl_easrc: Change the type for iec958 channel status controls (git-fixes). - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() (git-fixes). - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() (git-fixes). - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() (git-fixes). - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() (git-fixes). - ASoC: fsl_micfil: Fix event generation in micfil_quality_set() (git-fixes). - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() (git-fixes). - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() (git-fixes). - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() (git-fixes). - ASoC: fsl_micfil: Add access property for "VAD Detected" (git-fixes). - ASoC: SOF: Intel: hda: Place check before dereference (git-fixes). - ASoC: fsl_easrc: fix comment typo (git-fixes). - ASoC: sti: use managed regmap_field allocations (git-fixes). - ASoC: sti: Return errors from regmap_field_alloc() (git-fixes). - ALSA: caiaq: take a reference on the USB device in create_card() (git-fixes). - ALSA: 6fire: fix use-after-free on disconnect (git-fixes). - ALSA: fireworks: bound device-supplied status before string array lookup (git-fixes). - ALSA: ctxfi: Add fallback to default RSR for S/PDIF (git-fixes). - ALSA: ctxfi: Limit PTP to a single page (git-fixes). - ALSA: scarlett2: Add missing sentinel initializer field (git-fixes). - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') (git-fixes). - ALSA: aoa: i2sbus: fix OF node lifetime handling (git-fixes). - ALSA: core: Validate compress device numbers without dynamic minors (git-fixes). - Revert "ALSA: usb: Increase volume range that triggers a warning" (git-fixes). - ALSA: usb-audio: Evaluate packsize caps at the right place (git-fixes). - commit a0feb51 - net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (CVE-2026-23450 bsc#1261584). - commit 5c35d92 ++++ kernel-rt: - ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442 bsc#1261581). - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (CVE-2026-23300 bsc#1260538). - commit b424281 - net/sched: act_gate: snapshot parameters with RCU on replace (CVE-2026-23245 bsc#1259799). - commit cea08bb - sched/fair: Have SD_SERIALIZE affect newidle balancing (bsc#1253754). - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (bsc#1253754). - sched/balancing: Switch the 'DEFINE_SPINLOCK(balancing)' spinlock into an 'atomic_t sched_balance_running' flag (bsc#1253754). - commit 7f3daec - Bluetooth: HIDP: Fix possible UAF (CVE-2026-23462 bsc#1261710). - commit c2fcff0 - check-for-config-changes: Exclude CC_MS_EXTENSIONS - commit c04d7e7 - Refresh patches.suse/ice-use-netif_get_num_default_rss_queues.patch. - Refresh patches.suse/mm-page_alloc-thp-prevent-reclaim-for-__GFP_THISNODE-THP-a.patch. - Refresh patches.suse/powerpc-eeh-fix-recursive-pci_lock_rescan_remove-locking-in-EEH-event-handling.patch. Move merged patches to sorted section. - commit 471a61e - blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811 CVE-2026-23374). - commit 357b0af - flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826 CVE-2026-23168). - commit 4572c85 - sched/fair: Remove nohz.nr_cpus and use weight of cpumask instead (bsc#1234634, bsc#1258961). - sched/fair: Change likelyhood of nohz.nr_cpus (bsc#1234634, bsc#1258961). - sched/fair: Move checking for nohz cpus after time check (bsc#1234634, bsc#1258961). - commit 76eeda0 - Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (CVE-2026-23461 bsc#1261707). - commit dba279b - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found (git-fixes). - spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback (git-fixes). - spi: zynqmp-gqspi: fix controller deregistration (git-fixes). - spi: sprd: fix controller deregistration (git-fixes). - spi: sh-hspi: fix controller deregistration (git-fixes). - spi: rspi: fix controller deregistration (git-fixes). - spi: atmel: fix controller deregistration (git-fixes). - spi: at91-usart: fix controller deregistration (git-fixes). - spi: rockchip: fix controller deregistration (git-fixes). - spi: imx: fix use-after-free on unbind (git-fixes). - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo (git-fixes). - spi: fix misleading controller deregistration kernel-doc (git-fixes). - spi: fix misleading controller registration kernel-doc (git-fixes). - spi: fsl-qspi: Use reinit_completion() for repeated operations (git-fixes). - regulator: bd9571mwv: fix OF node reference imbalance (git-fixes). - regulator: act8945a: fix OF node reference imbalance (git-fixes). - regulator: mt6357: fix OF node reference imbalance (git-fixes). - regulator: max77650: fix OF node reference imbalance (git-fixes). - platform/chrome: chromeos_tbmc: Drop wakeup source on remove (git-fixes). - commit 152f382 - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well (git-fixes). - PCI: tegra194: Use DWC IP core version (git-fixes). - PCI: tegra194: Allow system suspend when the Endpoint link is not up (git-fixes). - PCI: tegra194: Set LTR message request before PCIe link up in Endpoint mode (git-fixes). - PCI: tegra194: Disable direct speed change for Endpoint mode (git-fixes). - PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" (git-fixes). - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode (git-fixes). - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down (git-fixes). - PCI: tegra194: Increase LTSSM poll time on surprise link down (git-fixes). - PCI: tegra194: Fix polling delay for L2 state (git-fixes). - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown (git-fixes). - PCI: Enable AtomicOps only if Root Port supports them (git-fixes). - PCI/AER: Stop ruling out unbound devices as error source (git-fixes). - PCI/AER: Clear only error bits in PCIe Device Status (git-fixes). - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration (git-fixes). - media: i2c: ov08d10: fix image vertical start setting (git-fixes). - commit b381137 - media: staging: imx: configure src_mux in csi_start (git-fixes). - media: staging: imx: request mbus_config in csi_start (git-fixes). - media: uvcvideo: Enable VB2_DMABUF for metadata stream (git-fixes). - media: i2c: ov8856: free control handler on error in ov8856_init_controls() (git-fixes). - media: amphion: Fix race between m2m job_abort and device_run (git-fixes). - media: mtk-jpeg: fix use-after-free in release path due to uncancelled work (git-fixes). - media: rc: xbox_remote: heed DMA restrictions (git-fixes). - media: rc: streamzap: Error handling in probe (git-fixes). - media: as102: fix to not free memory after the device is registered in as102_usb_probe() (git-fixes). - media: hackrf: fix to not free memory after the device is registered in hackrf_probe() (git-fixes). - media: saa7164: add ioremap return checks and cleanups (git-fixes). - media: pci: zoran: fix potential memory leak in zoran_probe() (git-fixes). - media: em28xx: fix use-after-free in em28xx_v4l2_open() (git-fixes). - media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections (git-fixes). - media: vidtv: fix nfeeds state corruption on start_streaming failure (git-fixes). - media: vidtv: fix pass-by-value structs causing MSAN warnings (git-fixes). - media: dib8000: avoid division by 0 in dib8000_set_dds() (git-fixes). - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap (git-fixes). - media: omap3isp: drop the use count of v4l2 pipeline (git-fixes). - commit 6696721 - net/sched: act_ife: Fix metalist update behavior (CVE-2026-23378 bsc#1260546). - commit 1bdc011 - drm/vram: remove DRM_VRAM_MM_FILE_OPERATIONS from docs (git-fixes). - drm/msm/a6xx: Use barriers while updating HFI Q headers (git-fixes). - drm/msm/a6xx: Fix dumping A650+ debugbus blocks (git-fixes). - drm/msm/shrinker: Fix can_block() logic (git-fixes). - drm/msm/a6xx: Fix HLSQ register dumping (git-fixes). - drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 (git-fixes). - drm/msm/dsi: fix hdisplay calculation for CMD mode panel (git-fixes). - drm/msm/dsi: fix bits_per_pclk (git-fixes). - drm/msm/dsi: add the missing parameter description (git-fixes). - drm/msm/dpu: fix mismatch between power and frequency (git-fixes). - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board (git-fixes). - drm/amd/pm/ci: Fill DW8 fields from SMC (git-fixes). - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels (git-fixes). - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 (git-fixes). - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock (git-fixes). - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs (git-fixes). - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled (git-fixes). - drm/amd/display: Add NULL check for integrated_info in clk_mgr_construct (git-fixes). - drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths (git-fixes). - drm/panel: simple: Correct G190EAN01 prepare timing (git-fixes). - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first (git-fixes). - drm/amdgpu/gfx10: look at the right prop for gfx queue priority (git-fixes). - drm/sun4i: Fix resource leaks (git-fixes). - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check (git-fixes). - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (git-fixes). - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break (git-fixes). - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() (git-fixes). - staging: media: atomisp: Disallow all private IOCTLs (git-fixes). - media: i2c: imx412: Assert reset GPIO during probe (git-fixes). - commit 654981a - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() (git-fixes). - commit 1effbc1 - crypto: hisilicon - Fix dma_unmap_single() direction (git-fixes). - crypto: talitos - fix SEC1 32k ahash request limitation (git-fixes). - crypto: jitterentropy - replace long-held spinlock with mutex (git-fixes). - crypto: ccree - fix a memory leak in cc_mac_digest() (git-fixes). - crypto: qat - use swab32 macro (git-fixes). - crypto: qat - fix type mismatch in RAS sysfs show functions (git-fixes). - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs (git-fixes). - drm/sun4i: backend: fix error pointer dereference (git-fixes). - drm/komeda: fix integer overflow in AFBC framebuffer size check (git-fixes). - commit 361b735 - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path (git-fixes). - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup (git-fixes). - crypto: simd - reject compat registrations without __ prefixes (git-fixes). - crypto: atmel-tdes - fix DMA sync direction (git-fixes). - crypto: atmel-ecc - Release client on allocation failure (git-fixes). - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() (git-fixes). - ALSA: hda/realtek - fixed speaker no sound update (git-fixes). - ASoC: SOF: Don't allow pointer operations on unconfigured streams (git-fixes). - ASoC: SOF: compress: return the configured codec from get_params (git-fixes). - ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens (git-fixes). - ASoC: qcom: qdsp6: topology: check widget type before accessing data (git-fixes). - ASoC: qcom: q6apm: remove child devices when apm is removed (git-fixes). - ASoC: qcom: q6apm: move component registration to unmanaged version (git-fixes). - ASoC: fsl_easrc: Change the type for iec958 channel status controls (git-fixes). - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() (git-fixes). - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() (git-fixes). - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() (git-fixes). - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() (git-fixes). - ASoC: fsl_micfil: Fix event generation in micfil_quality_set() (git-fixes). - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() (git-fixes). - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() (git-fixes). - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() (git-fixes). - ASoC: fsl_micfil: Add access property for "VAD Detected" (git-fixes). - ASoC: SOF: Intel: hda: Place check before dereference (git-fixes). - ASoC: fsl_easrc: fix comment typo (git-fixes). - ASoC: sti: use managed regmap_field allocations (git-fixes). - ASoC: sti: Return errors from regmap_field_alloc() (git-fixes). - ALSA: caiaq: take a reference on the USB device in create_card() (git-fixes). - ALSA: 6fire: fix use-after-free on disconnect (git-fixes). - ALSA: fireworks: bound device-supplied status before string array lookup (git-fixes). - ALSA: ctxfi: Add fallback to default RSR for S/PDIF (git-fixes). - ALSA: ctxfi: Limit PTP to a single page (git-fixes). - ALSA: scarlett2: Add missing sentinel initializer field (git-fixes). - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') (git-fixes). - ALSA: aoa: i2sbus: fix OF node lifetime handling (git-fixes). - ALSA: core: Validate compress device numbers without dynamic minors (git-fixes). - Revert "ALSA: usb: Increase volume range that triggers a warning" (git-fixes). - ALSA: usb-audio: Evaluate packsize caps at the right place (git-fixes). - commit a0feb51 - net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (CVE-2026-23450 bsc#1261584). - commit 5c35d92 ++++ kernel-rt_debug: - ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442 bsc#1261581). - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (CVE-2026-23300 bsc#1260538). - commit b424281 - net/sched: act_gate: snapshot parameters with RCU on replace (CVE-2026-23245 bsc#1259799). - commit cea08bb - sched/fair: Have SD_SERIALIZE affect newidle balancing (bsc#1253754). - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (bsc#1253754). - sched/balancing: Switch the 'DEFINE_SPINLOCK(balancing)' spinlock into an 'atomic_t sched_balance_running' flag (bsc#1253754). - commit 7f3daec - Bluetooth: HIDP: Fix possible UAF (CVE-2026-23462 bsc#1261710). - commit c2fcff0 - check-for-config-changes: Exclude CC_MS_EXTENSIONS - commit c04d7e7 - Refresh patches.suse/ice-use-netif_get_num_default_rss_queues.patch. - Refresh patches.suse/mm-page_alloc-thp-prevent-reclaim-for-__GFP_THISNODE-THP-a.patch. - Refresh patches.suse/powerpc-eeh-fix-recursive-pci_lock_rescan_remove-locking-in-EEH-event-handling.patch. Move merged patches to sorted section. - commit 471a61e - blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811 CVE-2026-23374). - commit 357b0af - flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826 CVE-2026-23168). - commit 4572c85 - sched/fair: Remove nohz.nr_cpus and use weight of cpumask instead (bsc#1234634, bsc#1258961). - sched/fair: Change likelyhood of nohz.nr_cpus (bsc#1234634, bsc#1258961). - sched/fair: Move checking for nohz cpus after time check (bsc#1234634, bsc#1258961). - commit 76eeda0 - Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (CVE-2026-23461 bsc#1261707). - commit dba279b - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found (git-fixes). - spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback (git-fixes). - spi: zynqmp-gqspi: fix controller deregistration (git-fixes). - spi: sprd: fix controller deregistration (git-fixes). - spi: sh-hspi: fix controller deregistration (git-fixes). - spi: rspi: fix controller deregistration (git-fixes). - spi: atmel: fix controller deregistration (git-fixes). - spi: at91-usart: fix controller deregistration (git-fixes). - spi: rockchip: fix controller deregistration (git-fixes). - spi: imx: fix use-after-free on unbind (git-fixes). - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo (git-fixes). - spi: fix misleading controller deregistration kernel-doc (git-fixes). - spi: fix misleading controller registration kernel-doc (git-fixes). - spi: fsl-qspi: Use reinit_completion() for repeated operations (git-fixes). - regulator: bd9571mwv: fix OF node reference imbalance (git-fixes). - regulator: act8945a: fix OF node reference imbalance (git-fixes). - regulator: mt6357: fix OF node reference imbalance (git-fixes). - regulator: max77650: fix OF node reference imbalance (git-fixes). - platform/chrome: chromeos_tbmc: Drop wakeup source on remove (git-fixes). - commit 152f382 - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well (git-fixes). - PCI: tegra194: Use DWC IP core version (git-fixes). - PCI: tegra194: Allow system suspend when the Endpoint link is not up (git-fixes). - PCI: tegra194: Set LTR message request before PCIe link up in Endpoint mode (git-fixes). - PCI: tegra194: Disable direct speed change for Endpoint mode (git-fixes). - PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" (git-fixes). - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode (git-fixes). - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down (git-fixes). - PCI: tegra194: Increase LTSSM poll time on surprise link down (git-fixes). - PCI: tegra194: Fix polling delay for L2 state (git-fixes). - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown (git-fixes). - PCI: Enable AtomicOps only if Root Port supports them (git-fixes). - PCI/AER: Stop ruling out unbound devices as error source (git-fixes). - PCI/AER: Clear only error bits in PCIe Device Status (git-fixes). - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration (git-fixes). - media: i2c: ov08d10: fix image vertical start setting (git-fixes). - commit b381137 - media: staging: imx: configure src_mux in csi_start (git-fixes). - media: staging: imx: request mbus_config in csi_start (git-fixes). - media: uvcvideo: Enable VB2_DMABUF for metadata stream (git-fixes). - media: i2c: ov8856: free control handler on error in ov8856_init_controls() (git-fixes). - media: amphion: Fix race between m2m job_abort and device_run (git-fixes). - media: mtk-jpeg: fix use-after-free in release path due to uncancelled work (git-fixes). - media: rc: xbox_remote: heed DMA restrictions (git-fixes). - media: rc: streamzap: Error handling in probe (git-fixes). - media: as102: fix to not free memory after the device is registered in as102_usb_probe() (git-fixes). - media: hackrf: fix to not free memory after the device is registered in hackrf_probe() (git-fixes). - media: saa7164: add ioremap return checks and cleanups (git-fixes). - media: pci: zoran: fix potential memory leak in zoran_probe() (git-fixes). - media: em28xx: fix use-after-free in em28xx_v4l2_open() (git-fixes). - media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections (git-fixes). - media: vidtv: fix nfeeds state corruption on start_streaming failure (git-fixes). - media: vidtv: fix pass-by-value structs causing MSAN warnings (git-fixes). - media: dib8000: avoid division by 0 in dib8000_set_dds() (git-fixes). - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap (git-fixes). - media: omap3isp: drop the use count of v4l2 pipeline (git-fixes). - commit 6696721 - net/sched: act_ife: Fix metalist update behavior (CVE-2026-23378 bsc#1260546). - commit 1bdc011 - drm/vram: remove DRM_VRAM_MM_FILE_OPERATIONS from docs (git-fixes). - drm/msm/a6xx: Use barriers while updating HFI Q headers (git-fixes). - drm/msm/a6xx: Fix dumping A650+ debugbus blocks (git-fixes). - drm/msm/shrinker: Fix can_block() logic (git-fixes). - drm/msm/a6xx: Fix HLSQ register dumping (git-fixes). - drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 (git-fixes). - drm/msm/dsi: fix hdisplay calculation for CMD mode panel (git-fixes). - drm/msm/dsi: fix bits_per_pclk (git-fixes). - drm/msm/dsi: add the missing parameter description (git-fixes). - drm/msm/dpu: fix mismatch between power and frequency (git-fixes). - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board (git-fixes). - drm/amd/pm/ci: Fill DW8 fields from SMC (git-fixes). - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels (git-fixes). - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 (git-fixes). - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock (git-fixes). - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs (git-fixes). - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled (git-fixes). - drm/amd/display: Add NULL check for integrated_info in clk_mgr_construct (git-fixes). - drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths (git-fixes). - drm/panel: simple: Correct G190EAN01 prepare timing (git-fixes). - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first (git-fixes). - drm/amdgpu/gfx10: look at the right prop for gfx queue priority (git-fixes). - drm/sun4i: Fix resource leaks (git-fixes). - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check (git-fixes). - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (git-fixes). - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break (git-fixes). - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() (git-fixes). - staging: media: atomisp: Disallow all private IOCTLs (git-fixes). - media: i2c: imx412: Assert reset GPIO during probe (git-fixes). - commit 654981a - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() (git-fixes). - commit 1effbc1 - crypto: hisilicon - Fix dma_unmap_single() direction (git-fixes). - crypto: talitos - fix SEC1 32k ahash request limitation (git-fixes). - crypto: jitterentropy - replace long-held spinlock with mutex (git-fixes). - crypto: ccree - fix a memory leak in cc_mac_digest() (git-fixes). - crypto: qat - use swab32 macro (git-fixes). - crypto: qat - fix type mismatch in RAS sysfs show functions (git-fixes). - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs (git-fixes). - drm/sun4i: backend: fix error pointer dereference (git-fixes). - drm/komeda: fix integer overflow in AFBC framebuffer size check (git-fixes). - commit 361b735 - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path (git-fixes). - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup (git-fixes). - crypto: simd - reject compat registrations without __ prefixes (git-fixes). - crypto: atmel-tdes - fix DMA sync direction (git-fixes). - crypto: atmel-ecc - Release client on allocation failure (git-fixes). - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() (git-fixes). - ALSA: hda/realtek - fixed speaker no sound update (git-fixes). - ASoC: SOF: Don't allow pointer operations on unconfigured streams (git-fixes). - ASoC: SOF: compress: return the configured codec from get_params (git-fixes). - ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens (git-fixes). - ASoC: qcom: qdsp6: topology: check widget type before accessing data (git-fixes). - ASoC: qcom: q6apm: remove child devices when apm is removed (git-fixes). - ASoC: qcom: q6apm: move component registration to unmanaged version (git-fixes). - ASoC: fsl_easrc: Change the type for iec958 channel status controls (git-fixes). - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() (git-fixes). - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() (git-fixes). - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() (git-fixes). - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() (git-fixes). - ASoC: fsl_micfil: Fix event generation in micfil_quality_set() (git-fixes). - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() (git-fixes). - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() (git-fixes). - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() (git-fixes). - ASoC: fsl_micfil: Add access property for "VAD Detected" (git-fixes). - ASoC: SOF: Intel: hda: Place check before dereference (git-fixes). - ASoC: fsl_easrc: fix comment typo (git-fixes). - ASoC: sti: use managed regmap_field allocations (git-fixes). - ASoC: sti: Return errors from regmap_field_alloc() (git-fixes). - ALSA: caiaq: take a reference on the USB device in create_card() (git-fixes). - ALSA: 6fire: fix use-after-free on disconnect (git-fixes). - ALSA: fireworks: bound device-supplied status before string array lookup (git-fixes). - ALSA: ctxfi: Add fallback to default RSR for S/PDIF (git-fixes). - ALSA: ctxfi: Limit PTP to a single page (git-fixes). - ALSA: scarlett2: Add missing sentinel initializer field (git-fixes). - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') (git-fixes). - ALSA: aoa: i2sbus: fix OF node lifetime handling (git-fixes). - ALSA: core: Validate compress device numbers without dynamic minors (git-fixes). - Revert "ALSA: usb: Increase volume range that triggers a warning" (git-fixes). - ALSA: usb-audio: Evaluate packsize caps at the right place (git-fixes). - commit a0feb51 - net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (CVE-2026-23450 bsc#1261584). - commit 5c35d92 ++++ ncurses: - Add patch fix-bsc1259924.patch (bsc#1259924, CVE-2025-69720) * Backport from ncurses-6.5-20251213.patch ++++ libpng16: - added patches CVE-2026-34757: Information disclosure and data corruption via use-after-free vulnerability [bsc#1261957] * libpng16-CVE-2026-34757.patch ------------------------------------------------------------------ ------------------ 2026-4-15 - Apr 15 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - sctp: disable BH before calling udp_tunnel_xmit_skb() (CVE-2026-23276 bsc#1260012). - net: increase IP_TUNNEL_RECURSION_LIMIT to 5 (CVE-2026-23276 bsc#1260012). - net: prevent NULL deref in iptunnel_xmit() (CVE-2026-23276 bsc#1260012). - commit ecf9d21 - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (CVE-2026-23340 bsc#1260523). - commit 525ca44 - mptcp: pm: in-kernel: always mark signal+subflow endp as used (CVE-2026-23321 bsc#1260505). - commit 46ae7ff - net: add xmit recursion limit to tunnel xmit functions (CVE-2026-23276 bsc#1260012). - net: move dev_xmit_recursion() helpers to net/core/dev.h (CVE-2026-23276 bsc#1260012). - refresh patches.suse/netdev-prevent-accessing-NAPI-instances-from-another.patch - commit 84e7397 - espintcp: Fix race condition in espintcp_close() (CVE-2026-23239 bsc#1259485). - commit 1e0a523 - tls: Fix race condition in tls_sw_cancel_work_tx() (CVE-2026-23240 bsc#1259484). - commit 87d5eb8 - bridge: cfm: Fix race condition in peer_mep deletion (CVE-2026-23393 bsc#1260522). - commit 09373eb - wifi: mt76: mt7915: fix use_cts_prot support (git-fixes). - commit 6b5af82 - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() (git-fixes). - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler (git-fixes). - nfc: llcp: add missing return after LLCP_CLOSED checks (git-fixes). - can: raw: fix ro->uniq use-after-free in raw_rcv() (git-fixes). - can: ucan: fix devres lifetime (git-fixes). - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (git-fixes). - Bluetooth: SCO: check for codecs->num_codecs == 1 before assigning to sco_pi(sk)->codec (git-fixes). - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (git-fixes). - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (git-fixes). - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (git-fixes). - Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU (git-fixes). - wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() (git-fixes). - wifi: rtw88: fix device leak on probe failure (git-fixes). - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet (git-fixes). - wifi: rtw88: check for PCI upstream bridge existence (git-fixes). - wifi: brcmfmac: Fix error pointer dereference (git-fixes). - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() (git-fixes). - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event (git-fixes). - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work (git-fixes). - wifi: mt76: mt7921: fix a potential clc buffer length underflow (git-fixes). - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor (git-fixes). - wifi: mt76: mt7925: fix incorrect length field in txpower command (git-fixes). - wifi: mt76: mt7615: fix use_cts_prot support (git-fixes). - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() (git-fixes). - wifi: ath9k: Fix typo (git-fixes). - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() (git-fixes). - ACPI: AGDI: fix missing newline in error message (git-fixes). - firmware: dmi: Correct an indexing error in dmi.h (git-fixes). - irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter (git-fixes). - docs: path-lookup: fix unrenamed WALK_GET (git-fixes). - commit 4311357 - io_uring/poll: improve readability of poll reference decrementing (CVE-2026-23473 bsc#1261694). - commit c3cd3d2 - io_uring/poll: fix multishot recv missing EOF on wakeup race (CVE-2026-23473 bsc#1261694). - commit 3ff4020 ++++ kernel-rt: - sctp: disable BH before calling udp_tunnel_xmit_skb() (CVE-2026-23276 bsc#1260012). - net: increase IP_TUNNEL_RECURSION_LIMIT to 5 (CVE-2026-23276 bsc#1260012). - net: prevent NULL deref in iptunnel_xmit() (CVE-2026-23276 bsc#1260012). - commit ecf9d21 - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (CVE-2026-23340 bsc#1260523). - commit 525ca44 - mptcp: pm: in-kernel: always mark signal+subflow endp as used (CVE-2026-23321 bsc#1260505). - commit 46ae7ff - net: add xmit recursion limit to tunnel xmit functions (CVE-2026-23276 bsc#1260012). - net: move dev_xmit_recursion() helpers to net/core/dev.h (CVE-2026-23276 bsc#1260012). - refresh patches.suse/netdev-prevent-accessing-NAPI-instances-from-another.patch - commit 84e7397 - espintcp: Fix race condition in espintcp_close() (CVE-2026-23239 bsc#1259485). - commit 1e0a523 - tls: Fix race condition in tls_sw_cancel_work_tx() (CVE-2026-23240 bsc#1259484). - commit 87d5eb8 - bridge: cfm: Fix race condition in peer_mep deletion (CVE-2026-23393 bsc#1260522). - commit 09373eb - wifi: mt76: mt7915: fix use_cts_prot support (git-fixes). - commit 6b5af82 - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() (git-fixes). - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler (git-fixes). - nfc: llcp: add missing return after LLCP_CLOSED checks (git-fixes). - can: raw: fix ro->uniq use-after-free in raw_rcv() (git-fixes). - can: ucan: fix devres lifetime (git-fixes). - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (git-fixes). - Bluetooth: SCO: check for codecs->num_codecs == 1 before assigning to sco_pi(sk)->codec (git-fixes). - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (git-fixes). - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (git-fixes). - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (git-fixes). - Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU (git-fixes). - wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() (git-fixes). - wifi: rtw88: fix device leak on probe failure (git-fixes). - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet (git-fixes). - wifi: rtw88: check for PCI upstream bridge existence (git-fixes). - wifi: brcmfmac: Fix error pointer dereference (git-fixes). - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() (git-fixes). - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event (git-fixes). - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work (git-fixes). - wifi: mt76: mt7921: fix a potential clc buffer length underflow (git-fixes). - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor (git-fixes). - wifi: mt76: mt7925: fix incorrect length field in txpower command (git-fixes). - wifi: mt76: mt7615: fix use_cts_prot support (git-fixes). - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() (git-fixes). - wifi: ath9k: Fix typo (git-fixes). - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() (git-fixes). - ACPI: AGDI: fix missing newline in error message (git-fixes). - firmware: dmi: Correct an indexing error in dmi.h (git-fixes). - irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter (git-fixes). - docs: path-lookup: fix unrenamed WALK_GET (git-fixes). - commit 4311357 - io_uring/poll: improve readability of poll reference decrementing (CVE-2026-23473 bsc#1261694). - commit c3cd3d2 - io_uring/poll: fix multishot recv missing EOF on wakeup race (CVE-2026-23473 bsc#1261694). - commit 3ff4020 ++++ kernel-rt_debug: - sctp: disable BH before calling udp_tunnel_xmit_skb() (CVE-2026-23276 bsc#1260012). - net: increase IP_TUNNEL_RECURSION_LIMIT to 5 (CVE-2026-23276 bsc#1260012). - net: prevent NULL deref in iptunnel_xmit() (CVE-2026-23276 bsc#1260012). - commit ecf9d21 - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (CVE-2026-23340 bsc#1260523). - commit 525ca44 - mptcp: pm: in-kernel: always mark signal+subflow endp as used (CVE-2026-23321 bsc#1260505). - commit 46ae7ff - net: add xmit recursion limit to tunnel xmit functions (CVE-2026-23276 bsc#1260012). - net: move dev_xmit_recursion() helpers to net/core/dev.h (CVE-2026-23276 bsc#1260012). - refresh patches.suse/netdev-prevent-accessing-NAPI-instances-from-another.patch - commit 84e7397 - espintcp: Fix race condition in espintcp_close() (CVE-2026-23239 bsc#1259485). - commit 1e0a523 - tls: Fix race condition in tls_sw_cancel_work_tx() (CVE-2026-23240 bsc#1259484). - commit 87d5eb8 - bridge: cfm: Fix race condition in peer_mep deletion (CVE-2026-23393 bsc#1260522). - commit 09373eb - wifi: mt76: mt7915: fix use_cts_prot support (git-fixes). - commit 6b5af82 - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() (git-fixes). - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler (git-fixes). - nfc: llcp: add missing return after LLCP_CLOSED checks (git-fixes). - can: raw: fix ro->uniq use-after-free in raw_rcv() (git-fixes). - can: ucan: fix devres lifetime (git-fixes). - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (git-fixes). - Bluetooth: SCO: check for codecs->num_codecs == 1 before assigning to sco_pi(sk)->codec (git-fixes). - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (git-fixes). - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (git-fixes). - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (git-fixes). - Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU (git-fixes). - wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() (git-fixes). - wifi: rtw88: fix device leak on probe failure (git-fixes). - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet (git-fixes). - wifi: rtw88: check for PCI upstream bridge existence (git-fixes). - wifi: brcmfmac: Fix error pointer dereference (git-fixes). - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() (git-fixes). - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event (git-fixes). - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work (git-fixes). - wifi: mt76: mt7921: fix a potential clc buffer length underflow (git-fixes). - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor (git-fixes). - wifi: mt76: mt7925: fix incorrect length field in txpower command (git-fixes). - wifi: mt76: mt7615: fix use_cts_prot support (git-fixes). - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() (git-fixes). - wifi: ath9k: Fix typo (git-fixes). - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() (git-fixes). - ACPI: AGDI: fix missing newline in error message (git-fixes). - firmware: dmi: Correct an indexing error in dmi.h (git-fixes). - irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter (git-fixes). - docs: path-lookup: fix unrenamed WALK_GET (git-fixes). - commit 4311357 - io_uring/poll: improve readability of poll reference decrementing (CVE-2026-23473 bsc#1261694). - commit c3cd3d2 - io_uring/poll: fix multishot recv missing EOF on wakeup race (CVE-2026-23473 bsc#1261694). - commit 3ff4020 ++++ mozilla-nss: - Added "Suggests: p11-kit-nss-trust" to favor over mozilla-nss-certs (Jira: PED-15633) ++++ python311-core: - Add CVE-2026-3446-base64-padding.patch preventing ignoring excess Base64 data after the first padded quad (bsc#1261970, CVE-2026-3446, gh#python/cpython#145264). ++++ python311: - Add CVE-2026-3446-base64-padding.patch preventing ignoring excess Base64 data after the first padded quad (bsc#1261970, CVE-2026-3446, gh#python/cpython#145264). ++++ sed: - Add CVE-2026-5958.patch * Fix CVE-2026-5958 (bsc#1262144): A TOCTOU race can allow to read attacker-controlled content and write it to an unintended file ------------------------------------------------------------------ ------------------ 2026-4-14 - Apr 14 2026 ------------------- ------------------------------------------------------------------ ++++ Mesa: - bsc1261998-CVE-2026-40393-nir-Use-STACK_ARRAY-instead-of-NIR_VLA.patch bsc1261998-CVE-2026-40393-spirv-Use-STACK_ARRAY-instead-of-NIR_VLA.patch * Mesa: out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party (bsc#1261998, CVE-2026-40393) ++++ Mesa-drivers: - bsc1261998-CVE-2026-40393-nir-Use-STACK_ARRAY-instead-of-NIR_VLA.patch bsc1261998-CVE-2026-40393-spirv-Use-STACK_ARRAY-instead-of-NIR_VLA.patch * Mesa: out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party (bsc#1261998, CVE-2026-40393) ++++ kernel-default: - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (CVE-2026-23458 bsc#1261781). - commit dad7401 - netfilter: xt_CT: drop pending enqueued packets on template removal (CVE-2026-23391 bsc#1260566). - commit 382f8ac - netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392 bsc#1260531). - commit fd33c16 - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455 bsc#1261687). - commit 154c998 - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (CVE-2026-23351 bsc#1260526). - commit fea5651 - tty: tty_io: update timestamps on all device nodes (bsc#1262020). - commit 3c38985 - workqueue: Fix UBSAN 'subtraction overflow' error in shift_and_mask() (bsc#1260522). - commit 74437ad - kABI: Include pool_id bits from work_bits into kABI tracking (bsc#1260522). - commit 3492b48 - net/mlx5e: Prevent concurrent access to IPSec ASO context (CVE-2026-23441 bsc#1261768). - Refresh patches.suse/net-mlx5e-Fix-race-condition-during-IPSec-ESN-update.patch. - commit 66528df - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408 bsc#1261797). - commit 9e9c97a - Update patches.suse/Bluetooth-SCO-Fix-use-after-free-in-sco_recv_frame-d.patch (CVE-2026-31408 bsc#1261797 git-fixes). - commit 57943d2 - thermal/drivers/spear: Fix error condition for reading st,thermal-flags (git-fixes). - thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp (git-fixes). - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata (git-fixes). - devres: fix missing node debug info in devm_krealloc() (git-fixes). - commit 7864913 ++++ kernel-rt: - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (CVE-2026-23458 bsc#1261781). - commit dad7401 - netfilter: xt_CT: drop pending enqueued packets on template removal (CVE-2026-23391 bsc#1260566). - commit 382f8ac - netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392 bsc#1260531). - commit fd33c16 - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455 bsc#1261687). - commit 154c998 - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (CVE-2026-23351 bsc#1260526). - commit fea5651 - tty: tty_io: update timestamps on all device nodes (bsc#1262020). - commit 3c38985 - workqueue: Fix UBSAN 'subtraction overflow' error in shift_and_mask() (bsc#1260522). - commit 74437ad - kABI: Include pool_id bits from work_bits into kABI tracking (bsc#1260522). - commit 3492b48 - net/mlx5e: Prevent concurrent access to IPSec ASO context (CVE-2026-23441 bsc#1261768). - Refresh patches.suse/net-mlx5e-Fix-race-condition-during-IPSec-ESN-update.patch. - commit 66528df - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408 bsc#1261797). - commit 9e9c97a - Update patches.suse/Bluetooth-SCO-Fix-use-after-free-in-sco_recv_frame-d.patch (CVE-2026-31408 bsc#1261797 git-fixes). - commit 57943d2 - thermal/drivers/spear: Fix error condition for reading st,thermal-flags (git-fixes). - thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp (git-fixes). - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata (git-fixes). - devres: fix missing node debug info in devm_krealloc() (git-fixes). - commit 7864913 ++++ kernel-rt_debug: - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (CVE-2026-23458 bsc#1261781). - commit dad7401 - netfilter: xt_CT: drop pending enqueued packets on template removal (CVE-2026-23391 bsc#1260566). - commit 382f8ac - netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392 bsc#1260531). - commit fd33c16 - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455 bsc#1261687). - commit 154c998 - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (CVE-2026-23351 bsc#1260526). - commit fea5651 - tty: tty_io: update timestamps on all device nodes (bsc#1262020). - commit 3c38985 - workqueue: Fix UBSAN 'subtraction overflow' error in shift_and_mask() (bsc#1260522). - commit 74437ad - kABI: Include pool_id bits from work_bits into kABI tracking (bsc#1260522). - commit 3492b48 - net/mlx5e: Prevent concurrent access to IPSec ASO context (CVE-2026-23441 bsc#1261768). - Refresh patches.suse/net-mlx5e-Fix-race-condition-during-IPSec-ESN-update.patch. - commit 66528df - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408 bsc#1261797). - commit 9e9c97a - Update patches.suse/Bluetooth-SCO-Fix-use-after-free-in-sco_recv_frame-d.patch (CVE-2026-31408 bsc#1261797 git-fixes). - commit 57943d2 - thermal/drivers/spear: Fix error condition for reading st,thermal-flags (git-fixes). - thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp (git-fixes). - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata (git-fixes). - devres: fix missing node debug info in devm_krealloc() (git-fixes). - commit 7864913 ++++ mozilla-nss: - update to NSS 3.112.4 * bmo#2030135 - improve error handling in PK11_ImportPrivateKeyInfoAndReturnKey. * bmo#2029752 - Improving the allocation of S/MIME DecryptSymKey. * bmo#2029462 - store email on subject cache_entry in NSS trust domain. * bmo#2029425 - Heap use-after-free in cert_VerifyCertChainOld via dangling certsList[] entry on NameConstraints violation. * bmo#2029323 - Improve size calculations in CMS content buffering. * bmo#2028001 - avoid integer overflow while escaping RFC822 Names. * bmo#2027378 - Reject excessively large ASN.1 SEQUENCE OF in quickder. * bmo#2027365 - Deep copy profile data in CERT_FindSMimeProfile. * bmo#2027345 - Improve input validation in DSAU signature decoding. * bmo#2026311 - avoid integer overflow in RSA_EMSAEncodePSS. * bmo#2019357 - RSA_EMSAEncodePSS should validate the length of mHash. * bmo#2026156 - Add a maximum cert uncompressed len and tests. * bmo#2026089 - Clarify extension negotiation mechanism for TLS Handshakes. * bmo#2023209 - ensure permittedSubtrees don't match wildcards that could be outside the permitted tree. * bmo#2023207 - Fix integer underflow in tls13_AEAD when ciphertext is shorter than tag. * bmo#2019224 - Remove invalid PORT_Free(). * bmo#1964722 - free digest objects in SEC_PKCS7DecoderFinish if they haven't already been freed. * bmo#1935995 - make ss->ssl3.hs.cookie an owned-copy of the cookie. ++++ systemd: - Import commit 58e5d2e21e4b75b473717dfc0ec54396177da6c1 58e5d2e21e udev/scsi-id: check for invalid chars in various fields received from the kernel (bsc#1261982) 4bd91117cc sd-json: limit the stack depth during parsing as well (bsc#1261983) ++++ timezone: - Update to 2026a: * Moldova has used EU transition times since 2022. * The "right" TZif files are no longer installed by default. * -DTZ_RUNTIME_LEAPS=0 disables runtime support for leap seconds. * TZif files are no longer limited to 50 bytes of abbreviations. * zic is no longer limited to 50 leap seconds. * Several integer overflow bugs have been fixed. - Changes from 2025c: * update Baja California DST rules in 1953, 1961-1975 * An unset TZ is no longer invalid when /etc/localtime is missing, and is abbreviated "UTC" not "-00". This reverts to 2024b behavior * tzset etc. are now more cautious about questionable TZ settings. * tzset etc. now treat ' ' like '_' in time zone abbreviations * tzfree now preserves errno, consistently with POSIX.1-2024 ‘free’. * zic has new options inspired by FreeBSD. ‘-D’ skips creation of output ancestor directories, ‘-m MODE’ sets output files’ mode, and ‘-u OWNER[:GROUP]’ sets output files’ owner and group. * multiple changes visible to developers - Use "REDO=posix_right" to keep installing "right" TZif files. ------------------------------------------------------------------ ------------------ 2026-4-13 - Apr 13 2026 ------------------- ------------------------------------------------------------------ ++++ grub2: - Fix missing install device check in grub2-install on PowerPC which could lead to bootlist corruption (bsc#1221126) * 0001-Mandatory-install-device-check-for-PowerPC.patch ++++ kernel-default: - net/mlx5e: Fix race condition during IPSec ESN update (CVE-2026-23440 bsc#1261641). - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (CVE-2026-23368 bsc#1260530). - commit f87eed8 - btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631 CVE-2025-71183). - commit a3da7f8 - btrfs: do not skip logging new dentries when logging a new name (git-fixes). - commit f390ffd - check-for-config-changes: Exclude HAVE_CFI_ICALL_NORMALIZE_INTEGERS{,_RUSTC} - commit ba5597d - crypto: algif_aead - Fix minimum RX size check for decryption (git-fixes). - X.509: Fix out-of-bounds access when parsing extensions (git-fixes). - commit 1e6b871 - btrfs: replace BUG() with error handling in __btrfs_balance() (git-fixes). - commit 8ae6b6d - btrfs: reject root items with drop_progress and zero drop_level (git-fixes). - commit f1b2a6e ++++ kernel-rt: - net/mlx5e: Fix race condition during IPSec ESN update (CVE-2026-23440 bsc#1261641). - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (CVE-2026-23368 bsc#1260530). - commit f87eed8 - btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631 CVE-2025-71183). - commit a3da7f8 - btrfs: do not skip logging new dentries when logging a new name (git-fixes). - commit f390ffd - check-for-config-changes: Exclude HAVE_CFI_ICALL_NORMALIZE_INTEGERS{,_RUSTC} - commit ba5597d - crypto: algif_aead - Fix minimum RX size check for decryption (git-fixes). - X.509: Fix out-of-bounds access when parsing extensions (git-fixes). - commit 1e6b871 - btrfs: replace BUG() with error handling in __btrfs_balance() (git-fixes). - commit 8ae6b6d - btrfs: reject root items with drop_progress and zero drop_level (git-fixes). - commit f1b2a6e ++++ kernel-rt_debug: - net/mlx5e: Fix race condition during IPSec ESN update (CVE-2026-23440 bsc#1261641). - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (CVE-2026-23368 bsc#1260530). - commit f87eed8 - btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631 CVE-2025-71183). - commit a3da7f8 - btrfs: do not skip logging new dentries when logging a new name (git-fixes). - commit f390ffd - check-for-config-changes: Exclude HAVE_CFI_ICALL_NORMALIZE_INTEGERS{,_RUSTC} - commit ba5597d - crypto: algif_aead - Fix minimum RX size check for decryption (git-fixes). - X.509: Fix out-of-bounds access when parsing extensions (git-fixes). - commit 1e6b871 - btrfs: replace BUG() with error handling in __btrfs_balance() (git-fixes). - commit 8ae6b6d - btrfs: reject root items with drop_progress and zero drop_level (git-fixes). - commit f1b2a6e ++++ openvswitch: - Fix CVE-2026-34956 [bsc#1261273] -- Invalid memory access in conntrack FTP alg * Add CVE-2026-34956.patch ++++ rust-keylime: - Make tss-esai-sys depends on bindgen 72.1 to support llvm > 21 - Update to version 0.2.9+21: * tests: use Express-style named params in Mockoon endpoints * build(deps): bump pest_derive from 2.8.1 to 2.8.6 * build(deps): bump trybuild from 1.0.110 to 1.0.115 * build(deps): bump log from 0.4.28 to 0.4.29 * build(deps): bump uuid from 1.19.0 to 1.20.0 * build(deps): bump codecov/codecov-action from 5 to 6 * build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23 * build(deps): bump cfg-if from 1.0.3 to 1.0.4 * build(deps): bump tokio from 1.49.0 to 1.50.0 * build(deps): bump actix-web from 4.12.1 to 4.13.0 * build(deps): bump anyhow from 1.0.99 to 1.0.102 * build(deps): bump clap from 4.5.57 to 4.5.60 * build(deps): bump tracing from 0.1.36 to 0.1.44 ------------------------------------------------------------------ ------------------ 2026-4-12 - Apr 12 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - Input: uinput - fix circular locking dependency with ff-core (git-fixes). - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (git-fixes). - drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock (git-fixes). - drm/vc4: Fix a memory leak in hang state error path (git-fixes). - drm/vc4: Fix memory leak of BO array in hang state (git-fixes). - drm/vc4: Release runtime PM reference after binding V3D (git-fixes). - comedi: dt2815: add hardware detection to prevent crash (stable-fixes). - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() (git-fixes). - USB: serial: option: add MeiG Smart SRM825WN (stable-fixes). - USB: serial: io_edgeport: add support for Blackbox IC135A (stable-fixes). - USB: serial: option: add support for Rolling Wireless RW135R-GL (stable-fixes). - usb: gadget: f_uac1_legacy: validate control request size (stable-fixes). - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam (stable-fixes). - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive (stable-fixes). - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer (stable-fixes). - cdc-acm: new quirk for EPSON HMD (stable-fixes). - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode (stable-fixes). - Input: xpad - add support for Razer Wolverine V3 Pro (stable-fixes). - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table (stable-fixes). - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session (git-fixes). - ALSA: ctxfi: Fix missing SPDIFI1 index handling (stable-fixes). - HID: multitouch: Check to ensure report responses match the request (stable-fixes). - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (stable-fixes). - wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation (stable-fixes). - wifi: ath11k: skip status ring entry processing (stable-fixes). - commit f015666 ++++ kernel-rt: - Input: uinput - fix circular locking dependency with ff-core (git-fixes). - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (git-fixes). - drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock (git-fixes). - drm/vc4: Fix a memory leak in hang state error path (git-fixes). - drm/vc4: Fix memory leak of BO array in hang state (git-fixes). - drm/vc4: Release runtime PM reference after binding V3D (git-fixes). - comedi: dt2815: add hardware detection to prevent crash (stable-fixes). - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() (git-fixes). - USB: serial: option: add MeiG Smart SRM825WN (stable-fixes). - USB: serial: io_edgeport: add support for Blackbox IC135A (stable-fixes). - USB: serial: option: add support for Rolling Wireless RW135R-GL (stable-fixes). - usb: gadget: f_uac1_legacy: validate control request size (stable-fixes). - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam (stable-fixes). - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive (stable-fixes). - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer (stable-fixes). - cdc-acm: new quirk for EPSON HMD (stable-fixes). - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode (stable-fixes). - Input: xpad - add support for Razer Wolverine V3 Pro (stable-fixes). - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table (stable-fixes). - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session (git-fixes). - ALSA: ctxfi: Fix missing SPDIFI1 index handling (stable-fixes). - HID: multitouch: Check to ensure report responses match the request (stable-fixes). - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (stable-fixes). - wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation (stable-fixes). - wifi: ath11k: skip status ring entry processing (stable-fixes). - commit f015666 ++++ kernel-rt_debug: - Input: uinput - fix circular locking dependency with ff-core (git-fixes). - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (git-fixes). - drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock (git-fixes). - drm/vc4: Fix a memory leak in hang state error path (git-fixes). - drm/vc4: Fix memory leak of BO array in hang state (git-fixes). - drm/vc4: Release runtime PM reference after binding V3D (git-fixes). - comedi: dt2815: add hardware detection to prevent crash (stable-fixes). - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() (git-fixes). - USB: serial: option: add MeiG Smart SRM825WN (stable-fixes). - USB: serial: io_edgeport: add support for Blackbox IC135A (stable-fixes). - USB: serial: option: add support for Rolling Wireless RW135R-GL (stable-fixes). - usb: gadget: f_uac1_legacy: validate control request size (stable-fixes). - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam (stable-fixes). - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive (stable-fixes). - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer (stable-fixes). - cdc-acm: new quirk for EPSON HMD (stable-fixes). - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode (stable-fixes). - Input: xpad - add support for Razer Wolverine V3 Pro (stable-fixes). - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table (stable-fixes). - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session (git-fixes). - ALSA: ctxfi: Fix missing SPDIFI1 index handling (stable-fixes). - HID: multitouch: Check to ensure report responses match the request (stable-fixes). - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (stable-fixes). - wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation (stable-fixes). - wifi: ath11k: skip status ring entry processing (stable-fixes). - commit f015666 ------------------------------------------------------------------ ------------------ 2026-4-11 - Apr 11 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - gpio: tegra: fix irq_release_resources calling enable instead of disable (git-fixes). - mmc: vub300: fix NULL-deref on disconnect (git-fixes). - nfc: pn533: allocate rx skb before consuming bytes (git-fixes). - wifi: rt2x00usb: fix devres lifetime (git-fixes). - wifi: brcmsmac: Fix dma_free_coherent() size (git-fixes). - batman-adv: hold claim backbone gateways by reference (git-fixes). - batman-adv: reject oversized global TT response buffers (git-fixes). - nfc: s3fwrn5: allocate rx skb before consuming bytes (git-fixes). - commit 6ac4a49 ++++ kernel-rt: - gpio: tegra: fix irq_release_resources calling enable instead of disable (git-fixes). - mmc: vub300: fix NULL-deref on disconnect (git-fixes). - nfc: pn533: allocate rx skb before consuming bytes (git-fixes). - wifi: rt2x00usb: fix devres lifetime (git-fixes). - wifi: brcmsmac: Fix dma_free_coherent() size (git-fixes). - batman-adv: hold claim backbone gateways by reference (git-fixes). - batman-adv: reject oversized global TT response buffers (git-fixes). - nfc: s3fwrn5: allocate rx skb before consuming bytes (git-fixes). - commit 6ac4a49 ++++ kernel-rt_debug: - gpio: tegra: fix irq_release_resources calling enable instead of disable (git-fixes). - mmc: vub300: fix NULL-deref on disconnect (git-fixes). - nfc: pn533: allocate rx skb before consuming bytes (git-fixes). - wifi: rt2x00usb: fix devres lifetime (git-fixes). - wifi: brcmsmac: Fix dma_free_coherent() size (git-fixes). - batman-adv: hold claim backbone gateways by reference (git-fixes). - batman-adv: reject oversized global TT response buffers (git-fixes). - nfc: s3fwrn5: allocate rx skb before consuming bytes (git-fixes). - commit 6ac4a49 ++++ rust-keylime: - Build with Clang <= 21 for now to work around boo#1260596. ------------------------------------------------------------------ ------------------ 2026-4-10 - Apr 10 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - kABI: workqueue: Implement disable/enable for (delayed) work items (bsc#1260522). - commit 0192af1 - workqueue: Implement disable/enable for (delayed) work items (bsc#1260522). - commit a8b1159 - workqueue: Preserve OFFQ bits in cancel[_sync] paths (bsc#1260522). - commit b464c41 - workqueue: Make @flags handling consistent across set_work_data() and friends (bsc#1260522). - commit 02f8d34 - workqueue: Factor out work_grab_pending() from __cancel_work_sync() (bsc#1260522). - commit 0b98d92 - workqueue: Introduce work_cancel_flags (bsc#1260522). - commit 305ef18 - workqueue: Reorganize flush and cancel[_sync] functions (bsc#1260522). - commit 0226729 - workqueue: Rename __cancel_work_timer() to __cancel_timer_sync() (bsc#1260522). - commit 32cb828 - serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (CVE-2026-23472 bsc#1261636). - commit ebf8f3c - workqueue: Clean up enum work_bits and related constants (bsc#1260522). - commit 1fa3104 - workqueue: Break up enum definitions and give names to the types (bsc#1260522). - commit 479a1d6 ++++ kernel-rt: - kABI: workqueue: Implement disable/enable for (delayed) work items (bsc#1260522). - commit 0192af1 - workqueue: Implement disable/enable for (delayed) work items (bsc#1260522). - commit a8b1159 - workqueue: Preserve OFFQ bits in cancel[_sync] paths (bsc#1260522). - commit b464c41 - workqueue: Make @flags handling consistent across set_work_data() and friends (bsc#1260522). - commit 02f8d34 - workqueue: Factor out work_grab_pending() from __cancel_work_sync() (bsc#1260522). - commit 0b98d92 - workqueue: Introduce work_cancel_flags (bsc#1260522). - commit 305ef18 - workqueue: Reorganize flush and cancel[_sync] functions (bsc#1260522). - commit 0226729 - workqueue: Rename __cancel_work_timer() to __cancel_timer_sync() (bsc#1260522). - commit 32cb828 - serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (CVE-2026-23472 bsc#1261636). - commit ebf8f3c - workqueue: Clean up enum work_bits and related constants (bsc#1260522). - commit 1fa3104 - workqueue: Break up enum definitions and give names to the types (bsc#1260522). - commit 479a1d6 ++++ kernel-rt_debug: - kABI: workqueue: Implement disable/enable for (delayed) work items (bsc#1260522). - commit 0192af1 - workqueue: Implement disable/enable for (delayed) work items (bsc#1260522). - commit a8b1159 - workqueue: Preserve OFFQ bits in cancel[_sync] paths (bsc#1260522). - commit b464c41 - workqueue: Make @flags handling consistent across set_work_data() and friends (bsc#1260522). - commit 02f8d34 - workqueue: Factor out work_grab_pending() from __cancel_work_sync() (bsc#1260522). - commit 0b98d92 - workqueue: Introduce work_cancel_flags (bsc#1260522). - commit 305ef18 - workqueue: Reorganize flush and cancel[_sync] functions (bsc#1260522). - commit 0226729 - workqueue: Rename __cancel_work_timer() to __cancel_timer_sync() (bsc#1260522). - commit 32cb828 - serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (CVE-2026-23472 bsc#1261636). - commit ebf8f3c - workqueue: Clean up enum work_bits and related constants (bsc#1260522). - commit 1fa3104 - workqueue: Break up enum definitions and give names to the types (bsc#1260522). - commit 479a1d6 ++++ libcap: - CVE-2026-4878: Fixed a a potential TOCTOU race condition in cap_set_file() (bsc#1261809) 0001-Address-a-potential-TOCTOU-race-condition-in-cap_set.patch: ------------------------------------------------------------------ ------------------ 2026-4-9 - Apr 9 2026 ------------------- ------------------------------------------------------------------ ++++ cockpit-podman: - Update dependencies to fix bsc#1257836/CVE-2026-25547 bsc#1258641/CVE-2026-26996 ++++ gdk-pixbuf: - Add gdk-pixbuf-CVE-2026-5201.patch: jpeg: Reject unsupported number of components (bsc#1261210 CVE-2026-5201 glgo#GNOME/gdk-pixbuf#266). ++++ grub2: - Fix PowerPC network boot prefix to correctly locate grub.cfg (bsc#1249385) * 0001-ieee1275-Use-net-config-for-boot-location-instead-of.patch ++++ kernel-default: - Delete patches.suse/docs-vfio-Add-vfio-device-cdev-description-09467130. Remove duplicate patch - commit aa4fe2a - scsi: pm8001: Fix use-after-free in pm8001_queue_command() (CVE-2026-23306 bsc#1260501). - commit 57106d4 - bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing (CVE-2026-23383 bsc#1260497). - commit 62599f7 ++++ kernel-rt: - Delete patches.suse/docs-vfio-Add-vfio-device-cdev-description-09467130. Remove duplicate patch - commit aa4fe2a - scsi: pm8001: Fix use-after-free in pm8001_queue_command() (CVE-2026-23306 bsc#1260501). - commit 57106d4 - bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing (CVE-2026-23383 bsc#1260497). - commit 62599f7 ++++ kernel-rt_debug: - Delete patches.suse/docs-vfio-Add-vfio-device-cdev-description-09467130. Remove duplicate patch - commit aa4fe2a - scsi: pm8001: Fix use-after-free in pm8001_queue_command() (CVE-2026-23306 bsc#1260501). - commit 57106d4 - bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing (CVE-2026-23383 bsc#1260497). - commit 62599f7 ++++ sqlite3: - Update to version 3.53.0: * https://sqlite.org/releaselog/3_53_0.html * Add the Query Result Formatter (QRF) library for formatting the results of SQL queries for human readability on a fixed-pitch font screen. * Enhance ALTER TABLE to permit adding and removing NOT NULL and CHECK constraints. * The REINDEX EXPRESSIONS statement rebuilds expression indexes. * The body of TEMP triggers may now modify and/or query tables in the main schema. * Enhance VACUUM INTO so that if a URI filename is used as the target and that filename has a reserve=N query parameter with N between 0 and 255, then the reserve amount for the generated database copy is set to N. * New SQL functions json_array_insert() and jsonb_array_insert(). * Renovations to the CLI. * New C-language interfaces: sqlite3_str_truncate(), sqlite3_str_free(), sqlite3_carray_bind_v2(). * Add the SQLITE_PREPARE_FROM_DDL option to sqlite3_prepare_v3(). * Added the SQLITE_UTF8_ZT constant which can be used as the encoding parameter to sqlite3_result_text64() or sqlite3_bind_text64() to indicate that the value is UTF-8 encoded and zero terminated. * The SQLITE_LIMIT_PARSER_DEPTH option is added to sqlite3_limit(). * The SQLITE_DBCONFIG_FP_DIGITS option is added to sqlite3_db_config(). * Query planner improvements. * Add new interfaces to the session extension that enable an application to add changes one at a time to the sqlite3_changegroup object. * Improvements to floating-point ↔ text conversions. * Added the self-healing index feature to deal with the stale expression index problem. * Add the "-p|--port" option to sqlite3_rsync. * Add the "opfs-wl" VFS, functionally identical to the "opfs" VFS but using Web Locks for locking, which can promise fairer lock sharing than the "opfs" bespoke protocol can. "opfs-wl" requires Atomics.waitAsync(), so requires newer browsers than "opfs" does. ------------------------------------------------------------------ ------------------ 2026-4-8 - Apr 8 2026 ------------------- ------------------------------------------------------------------ ++++ cockpit-machines: - Update dependencies to fix bsc#1257836/CVE-2026-25547 bsc#1258641/CVE-2026-26996 ++++ kernel-default: - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (CVE-2026-23304 bsc#1260544). - commit 0e2cfb3 - selftests/powerpc: make sub-folders buildable on their own (bsc#1261669 ltc#212590). - Refresh patches.suse/selftests-powerpc-dexcr-Add-no-pie-to-hashchk-tests.patch. - commit b39cae9 - selftests/powerpc: Re-order *FLAGS to follow lib.mk (bsc#1261669 ltc#212590). - commit cdc7ba4 - selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15 (bsc#1261669 ltc#212590). - commit 875a091 ++++ kernel-rt: - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (CVE-2026-23304 bsc#1260544). - commit 0e2cfb3 - selftests/powerpc: make sub-folders buildable on their own (bsc#1261669 ltc#212590). - Refresh patches.suse/selftests-powerpc-dexcr-Add-no-pie-to-hashchk-tests.patch. - commit b39cae9 - selftests/powerpc: Re-order *FLAGS to follow lib.mk (bsc#1261669 ltc#212590). - commit cdc7ba4 - selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15 (bsc#1261669 ltc#212590). - commit 875a091 ++++ kernel-rt_debug: - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (CVE-2026-23304 bsc#1260544). - commit 0e2cfb3 - selftests/powerpc: make sub-folders buildable on their own (bsc#1261669 ltc#212590). - Refresh patches.suse/selftests-powerpc-dexcr-Add-no-pie-to-hashchk-tests.patch. - commit b39cae9 - selftests/powerpc: Re-order *FLAGS to follow lib.mk (bsc#1261669 ltc#212590). - commit cdc7ba4 - selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15 (bsc#1261669 ltc#212590). - commit 875a091 ++++ openssl-3: - Security fix: * CVE-2026-28390: NULL pointer dereference during processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo (bsc#1261678) * Add openssl-CVE-2026-28390.patch ++++ python311-core: - Rewrite structure of Python interpreter packages. `python3*` symbols should be now provided by real python3 packages and its subpackages instead of the virtual provides (bsc#1258364). ++++ opensuse-migration-tool: - Update to version 20260408.218e5ee: * Add support for Leap Micro to Leap migration * Add quick start guide for git installation * Use .tar.xz for some reason obs service tar fails on 15.6 ++++ python311: - Rewrite structure of Python interpreter packages. `python3*` symbols should be now provided by real python3 packages and its subpackages instead of the virtual provides (bsc#1258364). ------------------------------------------------------------------ ------------------ 2026-4-7 - Apr 7 2026 ------------------- ------------------------------------------------------------------ ++++ grub2: - Fix double free in xen booting if root filesystem is Btrfs (bsc#1259543) * grub2-btrfs-01-add-ability-to-boot-from-subvolumes.patch * grub2-btrfs-09-get-default-subvolume.patch ++++ kernel-default: - xdp: produce a warning when calculated tailroom is negative (CVE-2026-23343 bsc#1260527). - commit 3ff31fa - tg3: Fix race for querying speed/duplex (bsc#1257183). - commit 50cbd22 - net/rds: Fix circular locking dependency in rds_tcp_tune (CVE-2026-23419 bsc#1261507). - commit 5d48507 - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() (CVE-2026-23335 bsc#1260550) - commit 9fa90c7 - gve: Fix stats report corruption on queue count change (CVE-2026-23262 bsc#1259870). - commit 56ed553 - netfilter: bpf: defer hook memory release until rcu readers are done (CVE-2026-23412 bsc#1261412). - commit 1299d5b - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ (CVE-2026-23395 bsc#1260580). - commit 942ba6f - soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching (git-fixes). - commit df6cd61 - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit (CVE-2026-23277 bsc#1259997). - commit 852cc2c - scsi: target: Fix recursive locking in __configfs_open_file() (CVE-2026-23292 bsc#1260500). - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CVE-2026-23193 bsc#1258414). - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CVE-2026-23216 bsc#1258447). - commit e7b5dcd - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CVE-2026-23270 bsc#1259886). - commit 00821f1 ++++ kernel-rt: - xdp: produce a warning when calculated tailroom is negative (CVE-2026-23343 bsc#1260527). - commit 3ff31fa - tg3: Fix race for querying speed/duplex (bsc#1257183). - commit 50cbd22 - net/rds: Fix circular locking dependency in rds_tcp_tune (CVE-2026-23419 bsc#1261507). - commit 5d48507 - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() (CVE-2026-23335 bsc#1260550) - commit 9fa90c7 - gve: Fix stats report corruption on queue count change (CVE-2026-23262 bsc#1259870). - commit 56ed553 - netfilter: bpf: defer hook memory release until rcu readers are done (CVE-2026-23412 bsc#1261412). - commit 1299d5b - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ (CVE-2026-23395 bsc#1260580). - commit 942ba6f - soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching (git-fixes). - commit df6cd61 - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit (CVE-2026-23277 bsc#1259997). - commit 852cc2c - scsi: target: Fix recursive locking in __configfs_open_file() (CVE-2026-23292 bsc#1260500). - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CVE-2026-23193 bsc#1258414). - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CVE-2026-23216 bsc#1258447). - commit e7b5dcd - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CVE-2026-23270 bsc#1259886). - commit 00821f1 ++++ kernel-rt_debug: - xdp: produce a warning when calculated tailroom is negative (CVE-2026-23343 bsc#1260527). - commit 3ff31fa - tg3: Fix race for querying speed/duplex (bsc#1257183). - commit 50cbd22 - net/rds: Fix circular locking dependency in rds_tcp_tune (CVE-2026-23419 bsc#1261507). - commit 5d48507 - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() (CVE-2026-23335 bsc#1260550) - commit 9fa90c7 - gve: Fix stats report corruption on queue count change (CVE-2026-23262 bsc#1259870). - commit 56ed553 - netfilter: bpf: defer hook memory release until rcu readers are done (CVE-2026-23412 bsc#1261412). - commit 1299d5b - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ (CVE-2026-23395 bsc#1260580). - commit 942ba6f - soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching (git-fixes). - commit df6cd61 - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit (CVE-2026-23277 bsc#1259997). - commit 852cc2c - scsi: target: Fix recursive locking in __configfs_open_file() (CVE-2026-23292 bsc#1260500). - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CVE-2026-23193 bsc#1258414). - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CVE-2026-23216 bsc#1258447). - commit e7b5dcd - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CVE-2026-23270 bsc#1259886). - commit 00821f1 ++++ sudo: - CVE-2026-35535: potential privilege escalation when running the mailer (bsc#1261420) * fix-CVE-2026-35535.patch ------------------------------------------------------------------ ------------------ 2026-4-6 - Apr 6 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (CVE-2026-23381 bsc#1260471). - commit 21aa5bd - clsact: Fix use-after-free in init/destroy rollback asymmetry (CVE-2026-23413 bsc#1261498). - commit eaf3b22 - icmp: fix NULL pointer dereference in icmp_tag_validation() (CVE-2026-23398 bsc#1260730). - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled (CVE-2026-23293 bsc#1260486). - commit 05f5f64 - net/sched: ets: fix divide by zero in the offload path (CVE-2026-23379 bsc#1260481). - commit 3672900 - tls: Purge async_hold in tls_decrypt_async_wait() (CVE-2026-23414 bsc#1261496). - commit 1058925 - usb: gadget: uvc: fix NULL pointer dereference during unbind race (git-fixes). - commit 4a9ee96 - misc: fastrpc: possible double-free of cctx->remote_heap (git-fixes). - comedi: Reinit dev->spinlock between attachments to low-level drivers (git-fixes). - comedi: me_daq: Fix potential overrun of firmware buffer (git-fixes). - comedi: me4000: Fix potential overrun of firmware buffer (git-fixes). - comedi: ni_atmio16d: Fix invalid clean-up after failed attach (git-fixes). - iio: dac: ad5770r: fix error return in ad5770r_read_raw() (git-fixes). - iio: accel: fix ADXL355 temperature signature value (git-fixes). - iio: light: vcnl4035: fix scan buffer on big-endian (git-fixes). - iio: adc: ti-adc161s626: fix buffer read on big-endian (git-fixes). - iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() (git-fixes). - iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one (git-fixes). - iio: gyro: mpu3050: Fix out-of-sequence free_irq() (git-fixes). - iio: gyro: mpu3050: Move iio_device_register() to correct location (git-fixes). - iio: gyro: mpu3050: Fix irq resource leak (git-fixes). - iio: gyro: mpu3050: Fix incorrect free_irq() variable (git-fixes). - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only (git-fixes). - usb: cdns3: gadget: fix state inconsistency on gadget init failure (git-fixes). - usb: ulpi: fix double free in ulpi_register_interface() error path (git-fixes). - usb: cdns3: gadget: fix NULL pointer dereference in ep_queue (git-fixes). - usb: gadget: f_rndis: Protect RNDIS options with mutex (git-fixes). - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free (git-fixes). - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() (git-fixes). - usb: ehci-brcm: fix sleep during atomic (git-fixes). - USB: dummy-hcd: Fix interrupt synchronization error (git-fixes). - USB: dummy-hcd: Fix locking/synchronization error (git-fixes). - usb: usbtmc: Flush anchored URBs in usbtmc_release (git-fixes). - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop (git-fixes). - thunderbolt: Fix property read in nhi_wake_supported() (git-fixes). - commit 4e3d5c2 ++++ kernel-rt: - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (CVE-2026-23381 bsc#1260471). - commit 21aa5bd - clsact: Fix use-after-free in init/destroy rollback asymmetry (CVE-2026-23413 bsc#1261498). - commit eaf3b22 - icmp: fix NULL pointer dereference in icmp_tag_validation() (CVE-2026-23398 bsc#1260730). - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled (CVE-2026-23293 bsc#1260486). - commit 05f5f64 - net/sched: ets: fix divide by zero in the offload path (CVE-2026-23379 bsc#1260481). - commit 3672900 - tls: Purge async_hold in tls_decrypt_async_wait() (CVE-2026-23414 bsc#1261496). - commit 1058925 - usb: gadget: uvc: fix NULL pointer dereference during unbind race (git-fixes). - commit 4a9ee96 - misc: fastrpc: possible double-free of cctx->remote_heap (git-fixes). - comedi: Reinit dev->spinlock between attachments to low-level drivers (git-fixes). - comedi: me_daq: Fix potential overrun of firmware buffer (git-fixes). - comedi: me4000: Fix potential overrun of firmware buffer (git-fixes). - comedi: ni_atmio16d: Fix invalid clean-up after failed attach (git-fixes). - iio: dac: ad5770r: fix error return in ad5770r_read_raw() (git-fixes). - iio: accel: fix ADXL355 temperature signature value (git-fixes). - iio: light: vcnl4035: fix scan buffer on big-endian (git-fixes). - iio: adc: ti-adc161s626: fix buffer read on big-endian (git-fixes). - iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() (git-fixes). - iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one (git-fixes). - iio: gyro: mpu3050: Fix out-of-sequence free_irq() (git-fixes). - iio: gyro: mpu3050: Move iio_device_register() to correct location (git-fixes). - iio: gyro: mpu3050: Fix irq resource leak (git-fixes). - iio: gyro: mpu3050: Fix incorrect free_irq() variable (git-fixes). - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only (git-fixes). - usb: cdns3: gadget: fix state inconsistency on gadget init failure (git-fixes). - usb: ulpi: fix double free in ulpi_register_interface() error path (git-fixes). - usb: cdns3: gadget: fix NULL pointer dereference in ep_queue (git-fixes). - usb: gadget: f_rndis: Protect RNDIS options with mutex (git-fixes). - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free (git-fixes). - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() (git-fixes). - usb: ehci-brcm: fix sleep during atomic (git-fixes). - USB: dummy-hcd: Fix interrupt synchronization error (git-fixes). - USB: dummy-hcd: Fix locking/synchronization error (git-fixes). - usb: usbtmc: Flush anchored URBs in usbtmc_release (git-fixes). - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop (git-fixes). - thunderbolt: Fix property read in nhi_wake_supported() (git-fixes). - commit 4e3d5c2 ++++ kernel-rt_debug: - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (CVE-2026-23381 bsc#1260471). - commit 21aa5bd - clsact: Fix use-after-free in init/destroy rollback asymmetry (CVE-2026-23413 bsc#1261498). - commit eaf3b22 - icmp: fix NULL pointer dereference in icmp_tag_validation() (CVE-2026-23398 bsc#1260730). - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled (CVE-2026-23293 bsc#1260486). - commit 05f5f64 - net/sched: ets: fix divide by zero in the offload path (CVE-2026-23379 bsc#1260481). - commit 3672900 - tls: Purge async_hold in tls_decrypt_async_wait() (CVE-2026-23414 bsc#1261496). - commit 1058925 - usb: gadget: uvc: fix NULL pointer dereference during unbind race (git-fixes). - commit 4a9ee96 - misc: fastrpc: possible double-free of cctx->remote_heap (git-fixes). - comedi: Reinit dev->spinlock between attachments to low-level drivers (git-fixes). - comedi: me_daq: Fix potential overrun of firmware buffer (git-fixes). - comedi: me4000: Fix potential overrun of firmware buffer (git-fixes). - comedi: ni_atmio16d: Fix invalid clean-up after failed attach (git-fixes). - iio: dac: ad5770r: fix error return in ad5770r_read_raw() (git-fixes). - iio: accel: fix ADXL355 temperature signature value (git-fixes). - iio: light: vcnl4035: fix scan buffer on big-endian (git-fixes). - iio: adc: ti-adc161s626: fix buffer read on big-endian (git-fixes). - iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() (git-fixes). - iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one (git-fixes). - iio: gyro: mpu3050: Fix out-of-sequence free_irq() (git-fixes). - iio: gyro: mpu3050: Move iio_device_register() to correct location (git-fixes). - iio: gyro: mpu3050: Fix irq resource leak (git-fixes). - iio: gyro: mpu3050: Fix incorrect free_irq() variable (git-fixes). - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only (git-fixes). - usb: cdns3: gadget: fix state inconsistency on gadget init failure (git-fixes). - usb: ulpi: fix double free in ulpi_register_interface() error path (git-fixes). - usb: cdns3: gadget: fix NULL pointer dereference in ep_queue (git-fixes). - usb: gadget: f_rndis: Protect RNDIS options with mutex (git-fixes). - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free (git-fixes). - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() (git-fixes). - usb: ehci-brcm: fix sleep during atomic (git-fixes). - USB: dummy-hcd: Fix interrupt synchronization error (git-fixes). - USB: dummy-hcd: Fix locking/synchronization error (git-fixes). - usb: usbtmc: Flush anchored URBs in usbtmc_release (git-fixes). - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop (git-fixes). - thunderbolt: Fix property read in nhi_wake_supported() (git-fixes). - commit 4e3d5c2 ++++ suseconnect-ng: - Update version to 1.22: - InstallReleasePackage should consider zypperFilesystemRoot (jsc#SCC-630). - Restore exit code 71 handling when attempting keepalive and not registered (bsc#1263772) - Add collector support for gathering RKE2 & K3s kubernetes provider info if enabled on a system (jsc#TEL-317) - Add email address validation to SUSEConnect -e/--email option. (bsc#1197231) - Add collector support for detecting if system is running pacemaker (jsc#SCC-693) - Avoid double slash at start of request URL path component. (jsc#SCC-775) - Use product identifier when finding product packages during migrations. (jsc#SCC=758 bsc#1265410) - Add opt in/out support for collectors (jsc#TEL-312) - Update config parser for suseconnect to be YAML based (jsc#SCC-730) ------------------------------------------------------------------ ------------------ 2026-4-5 - Apr 5 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - Input: synaptics-rmi4 - fix a locking bug in an error path (git-fixes). - hwmon: (occ) Fix missing newline in occ_show_extended() (git-fixes). - hwmon: (occ) Fix division by zero in occ_show_power_1() (git-fixes). - hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() (git-fixes). - hwmon: (pxe1610) Check return value of page-select write in probe (git-fixes). - commit 08cee84 ++++ kernel-rt: - Input: synaptics-rmi4 - fix a locking bug in an error path (git-fixes). - hwmon: (occ) Fix missing newline in occ_show_extended() (git-fixes). - hwmon: (occ) Fix division by zero in occ_show_power_1() (git-fixes). - hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() (git-fixes). - hwmon: (pxe1610) Check return value of page-select write in probe (git-fixes). - commit 08cee84 ++++ kernel-rt_debug: - Input: synaptics-rmi4 - fix a locking bug in an error path (git-fixes). - hwmon: (occ) Fix missing newline in occ_show_extended() (git-fixes). - hwmon: (occ) Fix division by zero in occ_show_power_1() (git-fixes). - hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() (git-fixes). - hwmon: (pxe1610) Check return value of page-select write in probe (git-fixes). - commit 08cee84 ------------------------------------------------------------------ ------------------ 2026-4-4 - Apr 4 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - gpio: mxc: map Both Edge pad wakeup to Rising Edge (git-fixes). - drm/ioc32: stop speculation on the drm_compat_ioctl path (git-fixes). - drm/ast: dp501: Fix initialization of SCU2C (git-fixes). - accel/qaic: Handle DBC deactivation if the owner went away (git-fixes). - drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP (git-fixes). - crypto: af-alg - fix NULL pointer dereference in scatterwalk (git-fixes). - crypto: caam - fix overflow on long hmac keys (git-fixes). - crypto: caam - fix DMA corruption on long hmac keys (git-fixes). - commit 376a907 ++++ kernel-rt: - gpio: mxc: map Both Edge pad wakeup to Rising Edge (git-fixes). - drm/ioc32: stop speculation on the drm_compat_ioctl path (git-fixes). - drm/ast: dp501: Fix initialization of SCU2C (git-fixes). - accel/qaic: Handle DBC deactivation if the owner went away (git-fixes). - drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP (git-fixes). - crypto: af-alg - fix NULL pointer dereference in scatterwalk (git-fixes). - crypto: caam - fix overflow on long hmac keys (git-fixes). - crypto: caam - fix DMA corruption on long hmac keys (git-fixes). - commit 376a907 ++++ kernel-rt_debug: - gpio: mxc: map Both Edge pad wakeup to Rising Edge (git-fixes). - drm/ioc32: stop speculation on the drm_compat_ioctl path (git-fixes). - drm/ast: dp501: Fix initialization of SCU2C (git-fixes). - accel/qaic: Handle DBC deactivation if the owner went away (git-fixes). - drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP (git-fixes). - crypto: af-alg - fix NULL pointer dereference in scatterwalk (git-fixes). - crypto: caam - fix overflow on long hmac keys (git-fixes). - crypto: caam - fix DMA corruption on long hmac keys (git-fixes). - commit 376a907 ------------------------------------------------------------------ ------------------ 2026-4-3 - Apr 3 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode (stable-fixes). - commit 2d1bac8 - net/x25: Fix overflow when accumulating packets (git-fixes). - net/x25: Fix potential double free of skb (git-fixes). - Bluetooth: SMP: derive legacy responder STK authentication from MITM state (git-fixes). - Bluetooth: SMP: force responder MITM requirements before building the pairing response (git-fixes). - Bluetooth: MGMT: validate mesh send advertising payload length (git-fixes). - Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt (git-fixes). - Bluetooth: MGMT: validate LTK enc_size on load (git-fixes). - Bluetooth: SCO: fix race conditions in sco_sock_connect() (git-fixes). - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate (git-fixes). - NFC: pn533: bound the UART receive buffer (git-fixes). - wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler() (git-fixes). - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation (git-fixes). - ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure (git-fixes). - ALSA: caiaq: fix stack out-of-bounds read in init_card (git-fixes). - dmaengine: idxd: Fix freeing the allocated ida too late (git-fixes). - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (git-fixes). - hwmon: axi-fan: don't use driver_override as IRQ name (git-fixes). - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 (stable-fixes). - ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk (stable-fixes). - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() (stable-fixes). - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() (stable-fixes). - HID: mcp2221: cancel last I2C command on read error (stable-fixes). - HID: asus: avoid memory leak in asus_report_fixup() (stable-fixes). - HID: magicmouse: avoid memory leak in magicmouse_report_fixup() (stable-fixes). - HID: apple: avoid memory leak in apple_report_fixup() (stable-fixes). - platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 (stable-fixes). - platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list (stable-fixes). - platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 (stable-fixes). - mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode (stable-fixes). - Bluetooth: hci_sync: Remove remaining dependencies of hci_request (stable-fixes). - Bluetooth: Remove 3 repeated macro definitions (stable-fixes). - hwmon: (axi-fan-control) Make use of dev_err_probe() (stable-fixes). - hwmon: (axi-fan-control) Use device firmware agnostic API (stable-fixes). - dmaengine: idxd: Remove usage of the deprecated ida_simple_xx() API (stable-fixes). - commit a6c10e6 ++++ kernel-rt: - mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode (stable-fixes). - commit 2d1bac8 - net/x25: Fix overflow when accumulating packets (git-fixes). - net/x25: Fix potential double free of skb (git-fixes). - Bluetooth: SMP: derive legacy responder STK authentication from MITM state (git-fixes). - Bluetooth: SMP: force responder MITM requirements before building the pairing response (git-fixes). - Bluetooth: MGMT: validate mesh send advertising payload length (git-fixes). - Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt (git-fixes). - Bluetooth: MGMT: validate LTK enc_size on load (git-fixes). - Bluetooth: SCO: fix race conditions in sco_sock_connect() (git-fixes). - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate (git-fixes). - NFC: pn533: bound the UART receive buffer (git-fixes). - wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler() (git-fixes). - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation (git-fixes). - ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure (git-fixes). - ALSA: caiaq: fix stack out-of-bounds read in init_card (git-fixes). - dmaengine: idxd: Fix freeing the allocated ida too late (git-fixes). - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (git-fixes). - hwmon: axi-fan: don't use driver_override as IRQ name (git-fixes). - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 (stable-fixes). - ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk (stable-fixes). - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() (stable-fixes). - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() (stable-fixes). - HID: mcp2221: cancel last I2C command on read error (stable-fixes). - HID: asus: avoid memory leak in asus_report_fixup() (stable-fixes). - HID: magicmouse: avoid memory leak in magicmouse_report_fixup() (stable-fixes). - HID: apple: avoid memory leak in apple_report_fixup() (stable-fixes). - platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 (stable-fixes). - platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list (stable-fixes). - platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 (stable-fixes). - mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode (stable-fixes). - Bluetooth: hci_sync: Remove remaining dependencies of hci_request (stable-fixes). - Bluetooth: Remove 3 repeated macro definitions (stable-fixes). - hwmon: (axi-fan-control) Make use of dev_err_probe() (stable-fixes). - hwmon: (axi-fan-control) Use device firmware agnostic API (stable-fixes). - dmaengine: idxd: Remove usage of the deprecated ida_simple_xx() API (stable-fixes). - commit a6c10e6 ++++ kernel-rt_debug: - mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode (stable-fixes). - commit 2d1bac8 - net/x25: Fix overflow when accumulating packets (git-fixes). - net/x25: Fix potential double free of skb (git-fixes). - Bluetooth: SMP: derive legacy responder STK authentication from MITM state (git-fixes). - Bluetooth: SMP: force responder MITM requirements before building the pairing response (git-fixes). - Bluetooth: MGMT: validate mesh send advertising payload length (git-fixes). - Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt (git-fixes). - Bluetooth: MGMT: validate LTK enc_size on load (git-fixes). - Bluetooth: SCO: fix race conditions in sco_sock_connect() (git-fixes). - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate (git-fixes). - NFC: pn533: bound the UART receive buffer (git-fixes). - wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler() (git-fixes). - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation (git-fixes). - ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure (git-fixes). - ALSA: caiaq: fix stack out-of-bounds read in init_card (git-fixes). - dmaengine: idxd: Fix freeing the allocated ida too late (git-fixes). - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (git-fixes). - hwmon: axi-fan: don't use driver_override as IRQ name (git-fixes). - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 (stable-fixes). - ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk (stable-fixes). - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() (stable-fixes). - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() (stable-fixes). - HID: mcp2221: cancel last I2C command on read error (stable-fixes). - HID: asus: avoid memory leak in asus_report_fixup() (stable-fixes). - HID: magicmouse: avoid memory leak in magicmouse_report_fixup() (stable-fixes). - HID: apple: avoid memory leak in apple_report_fixup() (stable-fixes). - platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 (stable-fixes). - platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list (stable-fixes). - platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 (stable-fixes). - mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode (stable-fixes). - Bluetooth: hci_sync: Remove remaining dependencies of hci_request (stable-fixes). - Bluetooth: Remove 3 repeated macro definitions (stable-fixes). - hwmon: (axi-fan-control) Make use of dev_err_probe() (stable-fixes). - hwmon: (axi-fan-control) Use device firmware agnostic API (stable-fixes). - dmaengine: idxd: Remove usage of the deprecated ida_simple_xx() API (stable-fixes). - commit a6c10e6 ++++ systemd: - Import commit 1af81619c30d81c14385e2603747388378966ad8 1af81619c3 nspawn: normalize pivot_root paths (bsc#1261400 CVE-2026-40226) fe879ba14c nspawn: apply BindUser/Ephemeral from settings file only if trusted (bsc#1261400 CVE-2026-40226) ------------------------------------------------------------------ ------------------ 2026-4-2 - Apr 2 2026 ------------------- ------------------------------------------------------------------ ++++ avahi: - Add avahi-CVE-2026-24401.patch: Fix unsolicited mDNS response containing a recursive CNAME record (bsc#1257235). ++++ python-kiwi: - Limit workflow to SLE supported pythons - Refactor use of kiwi settings file KIWI supports an optional runtime configuration file for settings to control the behavior of the tools used by KIWI on the build host. So far this config file could be specified via --config or is searched in the user's HOME or looked up as /etc/kiwi.yml. With this commit the following changes to this heuristic are made: 1. Support reading of /etc/kiwi.yml.d/*.yml 2. Support reading of /usr/share/kiwi/kiwi.yml and /usr/share/kiwi/kiwi.yml.d/*.yml 3. Install default settings file as /usr/share/kiwi/kiwi.yml.example from the main package and drop it from kiwi-man-pages which was considered a weird place. ++++ kernel-default: - net: add proper RCU protection to /proc/net/ptype (CVE-2026-23255 bsc#1259891). - commit 970622a - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (CVE-2026-23274 bsc#1260005). - commit b61cf0b - netfilter: nf_tables: always walk all pending catchall elements (CVE-2026-23278 bsc#1259998). - commit bde2f22 ++++ kernel-rt: - net: add proper RCU protection to /proc/net/ptype (CVE-2026-23255 bsc#1259891). - commit 970622a - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (CVE-2026-23274 bsc#1260005). - commit b61cf0b - netfilter: nf_tables: always walk all pending catchall elements (CVE-2026-23278 bsc#1259998). - commit bde2f22 ++++ kernel-rt_debug: - net: add proper RCU protection to /proc/net/ptype (CVE-2026-23255 bsc#1259891). - commit 970622a - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (CVE-2026-23274 bsc#1260005). - commit b61cf0b - netfilter: nf_tables: always walk all pending catchall elements (CVE-2026-23278 bsc#1259998). - commit bde2f22 ++++ python311-core: - Add CVE-2026-3479-pkgutil_get_data.patch pkgutil.get_data() has the same security model as open(). The documented limitations ensure compatibility with non-filesystem loaders; Python doesn't check that. (bsc#1259989, CVE-2026-3479, gh#python/cpython#146121). ++++ python311: - Add CVE-2026-3479-pkgutil_get_data.patch pkgutil.get_data() has the same security model as open(). The documented limitations ensure compatibility with non-filesystem loaders; Python doesn't check that. (bsc#1259989, CVE-2026-3479, gh#python/cpython#146121). ++++ vim: - Fix bsc#1261191 / CVE-2026-34714. - Fix bsc#1261271 / CVE-2026-34982. - Fix bsc#1259985 / CVE-2026-33412. - Update to 9.2.0280: * patch 9.2.0280: [security]: path traversal issue in zip.vim * patch 9.2.0279: terminal: out-of-bounds write with overlong CSI argument list * patch 9.2.0278: viminfo: heap buffer overflow when reading viminfo file * patch 9.2.0277: tests: test_modeline.vim fails * patch 9.2.0276: [security]: modeline security bypass * patch 9.2.0275: tests: test_options.vim fails * patch 9.2.0274: BSU/ESU are output directly to the terminal * patch 9.2.0273: tabpanel: undefined behaviour with large tabpanelop columns * patch 9.2.0272: [security]: 'tabpanel' can be set in a modeline * patch 9.2.0271: buffer underflow in vim_fgets() * patch 9.2.0270: test: trailing spaces used in tests * patch 9.2.0269: configure: Link error on Solaris * patch 9.2.0268: memory leak in call_oc_method() * patch 9.2.0267: 'autowrite' not triggered for :term * patch 9.2.0266: typeahead buffer overflow during mouse drag event * patch 9.2.0265: unnecessary restrictions for defining dictionary function names * patch 9.2.0264: Cannot disable kitty keyboard protocol in vim :terminal * patch 9.2.0263: hlset() cannot handle attributes with spaces * patch 9.2.0262: invalid lnum when pasting text copied blockwise * patch 9.2.0261: terminal: redraws are slow * patch 9.2.0260: statusline not redrawn after closing a popup window * patch 9.2.0259: tabpanel: corrupted display during scrolling causing flicker * patch 9.2.0258: memory leak in add_mark() * patch 9.2.0257: unnecessary memory allocation in set_callback() * patch 9.2.0256: visual selection size not shown in showcmd during test * patch 9.2.0255: tests: Test_popup_opacity_vsplit() fails in a wide terminal * patch 9.2.0254: w_locked can be bypassed when setting recursively * patch 9.2.0253: various issues with wrong b_nwindows after closing buffers * patch 9.2.0252: Crash when ending Visual mode after curbuf was unloaded * patch 9.2.0251: Link error when building without channel feature * patch 9.2.0250: system() does not support bypassing the shell * patch 9.2.0249: clipboard: provider reacts to autoselect feature * patch 9.2.0248: json_decode() is not strict enough * patch 9.2.0247: popup: popups may not wrap as expected * patch 9.2.0246: memory leak in globpath() * patch 9.2.0245: xxd: color output detection is broken * patch 9.2.0244: memory leak in eval8() * patch 9.2.0243: memory leak in change_indent() * patch 9.2.0242: memory leak in check_for_cryptkey() * patch 9.2.0241: tests: Test_visual_block_hl_with_autosel() is flaky * patch 9.2.0240: syn_name2id() is slow due to linear search * patch 9.2.0239: signcolumn may cause flicker * patch 9.2.0238: showmode message may not be displayed * patch 9.2.0237: filetype: ObjectScript routines are not recognized * patch 9.2.0236: stack-overflow with deeply nested data in json_encode/decode() * patch 9.2.0235: filetype: wks files are not recognized. * patch 9.2.0234: test: Test_close_handle() is flaky * patch 9.2.0233: Compiler warning in strings.c * patch 9.2.0232: fileinfo not shown after :bd of last listed buffer * patch 9.2.0231: Amiga: Link error for missing HAVE_LOCALE_H * patch 9.2.0230: popup: opacity not working accross vert splits * patch 9.2.0229: keypad keys may overwrite keycode for another key * patch 9.2.0228: still possible flicker * patch 9.2.0227: MS-Windows: CSI sequences may be written to screen * patch 9.2.0226: No 'incsearch' highlighting support for :uniq * patch 9.2.0225: runtime(compiler): No compiler plugin for just * patch 9.2.0224: channel: 2 issues with out/err callbacks * patch 9.2.0223: Option handling for key:value suboptions is limited * patch 9.2.0222: "zb" scrolls incorrectly with cursor on fold * patch 9.2.0221: Visual selection drawn incorrectly with "autoselect" * patch 9.2.0220: MS-Windows: some defined cannot be set on Cygwin/Mingw * patch 9.2.0219: call stack can be corrupted * patch 9.2.0218: visual selection highlighting in X11 GUI is wrong. * patch 9.2.0217: filetype: cto files are not recognized * patch 9.2.0216: MS-Windows: Rendering artifacts with DirectX * patch 9.2.0215: MS-Windows: several tests fail in the Windows CUI. * patch 9.2.0214: tests: Test_gui_system_term_scroll() is flaky * patch 9.2.0213: Crash when using a partial or lambda as a clipboard provider * patch 9.2.0212: MS-Windows: version packing may overflow * patch 9.2.0211: possible crash when setting 'winhighlight' * patch 9.2.0210: tests: Test_xxd tests are failing * patch 9.2.0209: freeze during wildmenu completion * patch 9.2.0208: MS-Windows: excessive scroll-behaviour with go+=! * patch 9.2.0207: MS-Windows: freeze on second :hardcopy * patch 9.2.0206: MS-Window: stripping all CSI sequences * patch 9.2.0205: xxd: Cannot NUL terminate the C include file style * patch 9.2.0204: filetype: cps files are not recognized * patch 9.2.0203: Patch v9.2.0185 was wrong * patch 9.2.0202: [security]: command injection via newline in glob() * patch 9.2.0201: filetype: Wireguard config files not recognized * patch 9.2.0200: term: DECRQM codes are sent too early * patch 9.2.0199: tests: test_startup.vim fails * patch 9.2.0198: cscope: can escape from restricted mode * patch 9.2.0197: tabpanel: frame width not updated for existing tab pages * patch 9.2.0196: textprop: negative IDs and can cause a crash * patch 9.2.0195: CI: test-suite gets killed for taking too long * patch 9.2.0194: tests: test_startup.vim leaves temp.txt around * patch 9.2.0193: using copy_option_part() can be improved * patch 9.2.0192: not correctly recognizing raw key codes * patch 9.2.0191: Not possible to know if Vim was compiled with Android support * patch 9.2.0190: Status line height mismatch in vertical splits * patch 9.2.0189: MS-Windows: opacity popups flicker during redraw in the console * patch 9.2.0188: Can set environment variables in restricted mode * patch 9.2.0187: MS-Windows: rendering artifacts with DirectX renderer * patch 9.2.0186: heap buffer overflow with long generic function name * patch 9.2.0185: buffer overflow when redrawing custom tabline * patch 9.2.0184: MS-Windows: screen flicker with termguicolors and visualbell * patch 9.2.0183: channel: using deprecated networking APIs * patch 9.2.0182: autocmds may leave windows with w_locked set * patch 9.2.0181: line('w0') moves cursor in terminal-normal mode * patch 9.2.0180: possible crash with winminheight=0 * patch 9.2.0179: MS-Windows: Compiler warning for converting from size_t to int * patch 9.2.0178: DEC mode requests are sent even when not in raw mode * patch 9.2.0177: Vim9: Can set environment variables in restricted mode * patch 9.2.0176: external diff is allowed in restricted mode * patch 9.2.0175: No tests for what v9.2.0141 and v9.2.0156 fixes * patch 9.2.0174: diff: inline word-diffs can be fragmented * patch 9.2.0173: tests: Test_balloon_eval_term_visual is flaky * patch 9.2.0172: Missing semicolon in os_mac_conv.c * patch 9.2.0171: MS-Windows: version detection is deprecated * patch 9.2.0170: channel: some issues in ch_listen() * patch 9.2.0169: assertion failure in syn_id2attr() * patch 9.2.0168: invalid pointer casting in string_convert() arguments * patch 9.2.0167: terminal: setting buftype=terminal may cause a crash * patch 9.2.0166: Coverity warning for potential NULL dereference * patch 9.2.0165: tests: perleval fails in the sandbox * patch 9.2.0164: build error when XCLIPBOARD is not defined * patch 9.2.0163: MS-Windows: Compile warning for unused variable * patch 9.2.0162: tests: unnecessary CheckRunVimInTerminal in test_quickfix * patch 9.2.0161: intro message disappears on startup in some terminals * patch 9.2.0160: terminal DEC mode handling is overly complex * patch 9.2.0159: Crash when reading quickfix line * patch 9.2.0158: Visual highlighting might be incorrect * patch 9.2.0157: Vim9: concatenation can be improved * patch 9.2.0156: perleval() and rubyeval() ignore security settings * patch 9.2.0155: filetype: ObjectScript are not recognized * patch 9.2.0154: if_lua: runtime error with lua 5.5 * patch 9.2.0153: No support to act as a channel server * patch 9.2.0152: concatenating strings is slow * patch 9.2.0151: blob_from_string() is slow for long strings * patch 9.2.0150: synchronized terminal update may cause display artifacts * patch 9.2.0149: Vim9: segfault when unletting an imported variable * patch 9.2.0148: Compile error when FEAT_DIFF is not defined * patch 9.2.0147: blob: concatenation can be improved * patch 9.2.0146: dictionary lookups can be improved * patch 9.2.0145: UTF-8 decoding and length calculation can be improved * patch 9.2.0144: 'statuslineopt' is a global only option * patch 9.2.0143: termdebug: no support for thread and condition in :Break * patch 9.2.0142: Coverity: Dead code warning * patch 9.2.0141: :perl ex commands allowed in restricted mode * patch 9.2.0140: file reading performance can be improved * patch 9.2.0139: Cannot configure terminal resize event * patch 9.2.0138: winhighlight option handling can be improved * patch 9.2.0137: [security]: crash with composing char in collection range * patch 9.2.0136: memory leak in add_interface_from_super_class() * patch 9.2.0135: memory leak in eval_tuple() * patch 9.2.0134: memory leak in socket_server_send_reply() * patch 9.2.0133: memory leak in netbeans_file_activated() * patch 9.2.0132: tests: Test_recover_corrupted_swap_file1 fails on be systems * patch 9.2.0131: potential buffer overflow in regdump() * patch 9.2.0130: missing range flags for the :tab command * patch 9.2.0129: popup: wrong handling of wide-chars and opacity:0 * patch 9.2.0128: Wayland: using _Boolean instead of bool type * patch 9.2.0127: line('w0') and line('w$') return wrong values in a terminal * patch 9.2.0126: String handling can be improved * patch 9.2.0125: tests: test_textformat.vim leaves swapfiles behind * patch 9.2.0124: auto-format may swallow white space * patch 9.2.0123: GTK: using deprecated gdk_pixbuf_new_from_xpm_data() * patch 9.2.0122: Vim still supports compiling on NeXTSTEP * patch 9.2.0120: tests: test_normal fails * patch 9.2.0119: incorrect highlight initialization in win_init() * patch 9.2.0118: memory leak in w_hl when reusing a popup window * patch 9.2.0117: tests: test_wayland.vim fails * patch 9.2.0116: terminal: synchronized output sequences are buffered * patch 9.2.0115: popup: screen flickering possible during async callbacks * patch 9.2.0114: MS-Windows: terminal output may go to wrong terminal * patch 9.2.0113: winhighlight pointer may be used uninitialized * patch 9.2.0112: popup: windows flicker when updating text * patch 9.2.0111: 'winhighlight' option not always applied ------------------------------------------------------------------ ------------------ 2026-4-1 - Apr 1 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - netfilter: nf_tables: unconditionally bump set->nelems before insertion (CVE-2026-23272 bsc#1260009). - commit 4898783 - btrfs: fix zero size inode with non-zero size after log replay (git-fixes). - commit f810098 - btrfs: log new dentries when logging parent dir of a conflicting inode (git-fixes). - commit 2a2fe4a - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim (CVE-2026-23319 bsc#1260735). - commit afdc54a - bpf: export bpf_link_inc_not_zero (CVE-2026-23319 bsc#1260735). - commit 3c0dee1 - net: mana: Trigger VF reset/recovery on health check failure due to HWC timeout (bsc#1259580). - net: mana: fix use-after-free in add_adev() error path (git-fixes). - commit dd3433a ++++ kernel-rt: - netfilter: nf_tables: unconditionally bump set->nelems before insertion (CVE-2026-23272 bsc#1260009). - commit 4898783 - btrfs: fix zero size inode with non-zero size after log replay (git-fixes). - commit f810098 - btrfs: log new dentries when logging parent dir of a conflicting inode (git-fixes). - commit 2a2fe4a - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim (CVE-2026-23319 bsc#1260735). - commit afdc54a - bpf: export bpf_link_inc_not_zero (CVE-2026-23319 bsc#1260735). - commit 3c0dee1 - net: mana: Trigger VF reset/recovery on health check failure due to HWC timeout (bsc#1259580). - net: mana: fix use-after-free in add_adev() error path (git-fixes). - commit dd3433a ++++ kernel-rt_debug: - netfilter: nf_tables: unconditionally bump set->nelems before insertion (CVE-2026-23272 bsc#1260009). - commit 4898783 - btrfs: fix zero size inode with non-zero size after log replay (git-fixes). - commit f810098 - btrfs: log new dentries when logging parent dir of a conflicting inode (git-fixes). - commit 2a2fe4a - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim (CVE-2026-23319 bsc#1260735). - commit afdc54a - bpf: export bpf_link_inc_not_zero (CVE-2026-23319 bsc#1260735). - commit 3c0dee1 - net: mana: Trigger VF reset/recovery on health check failure due to HWC timeout (bsc#1259580). - net: mana: fix use-after-free in add_adev() error path (git-fixes). - commit dd3433a ++++ python-cryptography: - CVE-2026-34073: X.509 bypass of name constraints on wildcard SANs with matching peer names (bsc#1260876) Add patch CVE-2026-34073.patch ++++ suseconnect-ng: - Update version to 1.21.1: - Fix nil token handling (bsc#1261155) - Switch to using go1.24-openssl as the default Go version to install to support building the package (jsc#SCC-585). ------------------------------------------------------------------ ------------------ 2026-3-31 - Mar 31 2026 ------------------- ------------------------------------------------------------------ ++++ ignition: - Add CVE-2026-33186.patch * Fixes [bsc#1260251] ++++ kernel-default: - btrfs: fix reservation leak in some error paths when inserting inline extent (CVE-2025-71268 bsc#1259865). - commit f586cfb - btrfs: do not free data reservation in fallback from inline due to -ENOSPC (CVE-2025-71269 bsc#1259889). - commit 2f2ec59 - kABI fix for ipvlan: Make the addrs_lock be per port (CVE-2026-23103 bsc#1257773). - ipvlan: Make the addrs_lock be per port (CVE-2026-23103 bsc#1257773). - commit 546f802 ++++ kernel-rt: - btrfs: fix reservation leak in some error paths when inserting inline extent (CVE-2025-71268 bsc#1259865). - commit f586cfb - btrfs: do not free data reservation in fallback from inline due to -ENOSPC (CVE-2025-71269 bsc#1259889). - commit 2f2ec59 - kABI fix for ipvlan: Make the addrs_lock be per port (CVE-2026-23103 bsc#1257773). - ipvlan: Make the addrs_lock be per port (CVE-2026-23103 bsc#1257773). - commit 546f802 ++++ kernel-rt_debug: - btrfs: fix reservation leak in some error paths when inserting inline extent (CVE-2025-71268 bsc#1259865). - commit f586cfb - btrfs: do not free data reservation in fallback from inline due to -ENOSPC (CVE-2025-71269 bsc#1259889). - commit 2f2ec59 - kABI fix for ipvlan: Make the addrs_lock be per port (CVE-2026-23103 bsc#1257773). - ipvlan: Make the addrs_lock be per port (CVE-2026-23103 bsc#1257773). - commit 546f802 ------------------------------------------------------------------ ------------------ 2026-3-30 - Mar 30 2026 ------------------- ------------------------------------------------------------------ ++++ python-kiwi: - Add support for oci format for disk images The (oci|docker):image_format format is a special case that stores the disk image inside of an OCI-compliant container. The disk image is stored in the specified image_format in the disk/ directory of the container. The disk format can be one of the above formats or just raw if the disk should be stored as a raw disk inside of the container. Custom naming conventions for the disk image can be applied by using the bundle_format attribute. The derived_from attribute can be used to specify the source container. The resulting container image will be built by adding the disk image as a new layer on top of the specified reference container. If there is no derived_from attribute, the container image will be built from scratch using an empty root directory. This format is particularly useful for building an image which bundles the actual disk image and its runtime requirements into one artifact. This Fixes jira#PCT-1008 ++++ glibc: - resolv-count-resource-records.patch: resolv: Count records correctly (CVE-2026-4437, bsc#1260078, BZ #34014) - resolv-check-hostname.patch: resolv: Check hostname for validity (CVE-2026-4438, bsc#1260082, BZ #34015) ++++ kernel-default: - btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() (bsc#1257777). - commit 5f963b7 - rename Hyper-v patch files to simplify further SP6-SP7 merges - commit aa72668 - net/mlx5: Fix crash when moving to switchdev mode (git-fixes). - bonding: do not set usable_slaves for broadcast mode (git-fixes). - idpf: nullify pointers after they are freed (git-fixes). - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (CVE-2026-23386 bsc#1260799). - commit 1051a48 - xen/privcmd: unregister xenstore notifier on module exit (git-fixes). - commit 0c94fec - xen/privcmd: restrict usage in unprivileged domU (bsc#1259707 CVE-2026-31788). - commit 0c51260 - phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() (git-fixes). - dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction (git-fixes). - dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA (git-fixes). - dmaengine: xilinx: xilinx_dma: Fix dma_device directions (git-fixes). - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock (git-fixes). - dmaengine: sh: rz-dmac: Protect the driver specific lists (git-fixes). - dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() (git-fixes). - dmaengine: xilinx: xdma: Fix regmap init error handling (git-fixes). - dmaengine: idxd: Fix leaking event log memory (git-fixes). - dmaengine: idxd: Fix memory leak when a wq is reset (git-fixes). - dmaengine: idxd: Fix not releasing workqueue on .release() (git-fixes). - commit f22ea44 - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions (CVE-2026-23317 bsc#1260562). - commit 62d1ba3 - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry (CVE-2026-23361 bsc#1260732). - commit e28de60 ++++ kernel-rt: - btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() (bsc#1257777). - commit 5f963b7 - rename Hyper-v patch files to simplify further SP6-SP7 merges - commit aa72668 - net/mlx5: Fix crash when moving to switchdev mode (git-fixes). - bonding: do not set usable_slaves for broadcast mode (git-fixes). - idpf: nullify pointers after they are freed (git-fixes). - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (CVE-2026-23386 bsc#1260799). - commit 1051a48 - xen/privcmd: unregister xenstore notifier on module exit (git-fixes). - commit 0c94fec - xen/privcmd: restrict usage in unprivileged domU (bsc#1259707 CVE-2026-31788). - commit 0c51260 - phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() (git-fixes). - dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction (git-fixes). - dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA (git-fixes). - dmaengine: xilinx: xilinx_dma: Fix dma_device directions (git-fixes). - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock (git-fixes). - dmaengine: sh: rz-dmac: Protect the driver specific lists (git-fixes). - dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() (git-fixes). - dmaengine: xilinx: xdma: Fix regmap init error handling (git-fixes). - dmaengine: idxd: Fix leaking event log memory (git-fixes). - dmaengine: idxd: Fix memory leak when a wq is reset (git-fixes). - dmaengine: idxd: Fix not releasing workqueue on .release() (git-fixes). - commit f22ea44 - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions (CVE-2026-23317 bsc#1260562). - commit 62d1ba3 - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry (CVE-2026-23361 bsc#1260732). - commit e28de60 ++++ kernel-rt_debug: - btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() (bsc#1257777). - commit 5f963b7 - rename Hyper-v patch files to simplify further SP6-SP7 merges - commit aa72668 - net/mlx5: Fix crash when moving to switchdev mode (git-fixes). - bonding: do not set usable_slaves for broadcast mode (git-fixes). - idpf: nullify pointers after they are freed (git-fixes). - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (CVE-2026-23386 bsc#1260799). - commit 1051a48 - xen/privcmd: unregister xenstore notifier on module exit (git-fixes). - commit 0c94fec - xen/privcmd: restrict usage in unprivileged domU (bsc#1259707 CVE-2026-31788). - commit 0c51260 - phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() (git-fixes). - dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction (git-fixes). - dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA (git-fixes). - dmaengine: xilinx: xilinx_dma: Fix dma_device directions (git-fixes). - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock (git-fixes). - dmaengine: sh: rz-dmac: Protect the driver specific lists (git-fixes). - dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() (git-fixes). - dmaengine: xilinx: xdma: Fix regmap init error handling (git-fixes). - dmaengine: idxd: Fix leaking event log memory (git-fixes). - dmaengine: idxd: Fix memory leak when a wq is reset (git-fixes). - dmaengine: idxd: Fix not releasing workqueue on .release() (git-fixes). - commit f22ea44 - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions (CVE-2026-23317 bsc#1260562). - commit 62d1ba3 - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry (CVE-2026-23361 bsc#1260732). - commit e28de60 ++++ libtpms: - CVE-2025-49133: Fixed potential out of bounds (OOB) read vulnerability (bsc#1244528) 0001-tpm2-Fix-potential-out-of-bound-access-abort-due-to-.patch ++++ python-requests: - CVE-2026-25645: `extract_zipped_paths()` uses predictable filenames when extracting files from zip archives and reuses target files that already exist without validation (bsc#1260589) Add patch CVE-2026-25645.patch ------------------------------------------------------------------ ------------------ 2026-3-28 - Mar 28 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - Delete patches.suse/scsi-Fix-sas_user_scan-to-handle-wildcard-and-multi-channe.patch. See bsc#1257506. The git-fix being removed had issues and needs to be redesigned. In the mean time, reverting this addresses the problem. See: > https://bugzilla.suse.com/show_bug.cgi?id=1257506#c47 - commit 14d63c6 - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion (git-fixes). - hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible() (git-fixes). - hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature (git-fixes). - hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes (git-fixes). - drm/i915/gmbus: fix spurious timeout on 512-byte burst reads (git-fixes). - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (git-fixes). - spi: spi-fsl-lpspi: fix teardown order issue (UAF) (git-fixes). - regmap: Synchronize cache for the page selector (git-fixes). - ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (git-fixes). - ASoC: adau1372: Fix clock leak on PLL lock failure (git-fixes). - ASoC: adau1372: Fix unchecked clk_prepare_enable() return value (git-fixes). - ASoC: Intel: catpt: Fix the device initialization (git-fixes). - ALSA: firewire-lib: fix uninitialized local variable (git-fixes). - commit a2172e0 ++++ kernel-rt: - Delete patches.suse/scsi-Fix-sas_user_scan-to-handle-wildcard-and-multi-channe.patch. See bsc#1257506. The git-fix being removed had issues and needs to be redesigned. In the mean time, reverting this addresses the problem. See: > https://bugzilla.suse.com/show_bug.cgi?id=1257506#c47 - commit 14d63c6 - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion (git-fixes). - hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible() (git-fixes). - hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature (git-fixes). - hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes (git-fixes). - drm/i915/gmbus: fix spurious timeout on 512-byte burst reads (git-fixes). - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (git-fixes). - spi: spi-fsl-lpspi: fix teardown order issue (UAF) (git-fixes). - regmap: Synchronize cache for the page selector (git-fixes). - ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (git-fixes). - ASoC: adau1372: Fix clock leak on PLL lock failure (git-fixes). - ASoC: adau1372: Fix unchecked clk_prepare_enable() return value (git-fixes). - ASoC: Intel: catpt: Fix the device initialization (git-fixes). - ALSA: firewire-lib: fix uninitialized local variable (git-fixes). - commit a2172e0 ++++ kernel-rt_debug: - Delete patches.suse/scsi-Fix-sas_user_scan-to-handle-wildcard-and-multi-channe.patch. See bsc#1257506. The git-fix being removed had issues and needs to be redesigned. In the mean time, reverting this addresses the problem. See: > https://bugzilla.suse.com/show_bug.cgi?id=1257506#c47 - commit 14d63c6 - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion (git-fixes). - hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible() (git-fixes). - hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature (git-fixes). - hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes (git-fixes). - drm/i915/gmbus: fix spurious timeout on 512-byte burst reads (git-fixes). - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (git-fixes). - spi: spi-fsl-lpspi: fix teardown order issue (UAF) (git-fixes). - regmap: Synchronize cache for the page selector (git-fixes). - ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (git-fixes). - ASoC: adau1372: Fix clock leak on PLL lock failure (git-fixes). - ASoC: adau1372: Fix unchecked clk_prepare_enable() return value (git-fixes). - ASoC: Intel: catpt: Fix the device initialization (git-fixes). - ALSA: firewire-lib: fix uninitialized local variable (git-fixes). - commit a2172e0 ------------------------------------------------------------------ ------------------ 2026-3-27 - Mar 27 2026 ------------------- ------------------------------------------------------------------ ++++ dpdk: - Update to version 22.11.11 - upstream bugfix release https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id29 - Summary: * app/testpmd: fix conntrack action query, fix DCB Rx queues, fix DCB Tx port, fix flex item link parsing * common/cnxk: fix async event handling * common/mlx5: release unused mempool entries * crypto/ipsec_mb: fix QP release in secondary * dmadev: fix debug build with tracepoints * dma/hisilicon: fix stop with pending transfers * doc: improve documentation for conntrack state inspect command, device argument in txgbe and ionic * eal: fix DMA mask validation with IOVA mode option * efd: fix AVX2 support * event/cnxk: fix Rx offload flags * eventdev: fix listing timer adapters with telemetry * fib6: fix tbl8 allocation check logic * graph: fix unaligned access in stats * hash: fix unaligned access in predictable RSS * net/af_packet: fix crash in secondary process * net/ark: remove double mbuf free * net/bonding: fix MAC address propagation in 802.3ad mode * net/dpaa2: fix duplicate call of close * net/dpaa2: fix L3/L4 checksum results * net/dpaa2: receive packets with additional parse errors * net/dpaa: fix resource leak * net/ena/base: fix unsafe memcpy on invalid memory * net/ena: fix PCI BAR mapping on 64K page size * net/enetfec: fix checksum flag handling and error return * net/enetfec: fix file descriptor leak on read error * net/enetfec: fix memory leak in Rx buffer cleanup * net/enetfec: fix out-of-bounds access in UIO mapping * net/enetfec: fix Tx queue free * net: fix L2 length for GRE packets * net/hns3: fix VLAN resources freeing * net/hns3: fix VLAN tag loss for short tunnel frame * net/i40e: fix symmetric Toeplitz hashing for SCTP * net/ice/base: fix integer overflow on NVM init * net/ice/base: fix memory leak in HW profile handling * net/ice/base: fix memory leak in recipe handling * net/ice: fix initialization with 8 ports * net/ice: fix memory leak in raw pattern parse * net/ice: fix path selection for QinQ Tx offload * net/ice: fix vector Rx VLAN offload flags * net/mlx5: fix connection tracking state item validation * net/mlx5: fix control flow leakage for external SQ * net/mlx5: fix ESP header match after UDP for group 0 * net/mlx5: fix flow aging race condition * net/mlx5: fix min and max MTU reporting * net/mlx5/hws: fix buddy memory allocation * net/ngbe: reduce memory size of ring descriptors * net/tap: fix interrupt callback crash after failed start * net/txgbe: various FDIR fixes * net/vmxnet3: fix mapping of mempools to queues * test/crypto: fix vector initialization * test/debug: fix crash with mlx5 devices * test/debug: fix IOVA mode on PPC64 without huge pages * vfio: fix custom containers in multiprocess * vhost: fix double fetch when dequeue offloading - Add libarchive as dependency, avoid errors like '/lib/firmware/... cannot be decompressed' (bsc#1260007) ++++ kernel-default: - libceph: reset sparse-read state in osd_fault() (CVE-2026-23136 bsc#1258303). - commit 7606f01 - wifi: libertas: fix use-after-free in lbs_free_adapter() (CVE-2026-23281 bsc#1260464). - commit 43b8c42 - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY (git-fixes). - serial: 8250_pci: add support for the AX99100 (stable-fixes). - serial: uartlite: fix PM runtime usage count underflow on probe (git-fixes). - serial: 8250: Fix TX deadlock when using DMA (git-fixes). - spi: fix statistics allocation (git-fixes). - spi: fix use-after-free on controller registration failure (git-fixes). - wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (git-fixes). - wifi: mac80211: fix NULL deref in mesh_matches_local() (git-fixes). - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (git-fixes). - wifi: mac80211: Fix static_branch_dec() underflow for aql_disable (git-fixes). - soc: fsl: qbman: fix race condition in qman_destroy_fq (git-fixes). - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed (stable-fixes). - usb: dwc3: pci: add support for the Intel Nova Lake -H (stable-fixes). - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk (stable-fixes). - usb: xhci: Prevent interrupt storm on host controller error (HCE) (stable-fixes). - usb: cdc-acm: Restore CAP_BRK functionnality to CH343 (git-fixes). - usb: misc: uss720: properly clean up reference in uss720_probe() (stable-fixes). - usb: image: mdc800: kill download URB on timeout (stable-fixes). - usb: mdc800: handle signal and read racing (stable-fixes). - usb: yurex: fix race in probe (stable-fixes). - staging: rtl8723bs: properly validate the data in rtw_get_ie_ex() (stable-fixes). - wifi: mac80211: set default WMM parameters on all links (stable-fixes). - usb: cdns3: fix role switching during resume (git-fixes). - USB: serial: f81232: fix incomplete serial port generation (stable-fixes). - usb: cdns3: call cdns_power_is_lost() only once in cdns_resume() (stable-fixes). - usb: cdns3: remove redundant if branch (stable-fixes). - commit 9cd434e - nfc: nci: fix circular locking dependency in nci_close_device (git-fixes). - pinctrl: mediatek: common: Fix probe failure for devices without EINT (git-fixes). - pinctrl: qcom: spmi-gpio: implement .get_direction() (git-fixes). - platform/x86: ISST: Correct locked bit width (git-fixes). - platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen (git-fixes). - mmc: sdhci: fix timing selection for 1-bit bus width (git-fixes). - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption (git-fixes). - mtd: rawnand: pl353: make sure optimal timings are applied (git-fixes). - mtd: rawnand: brcmnand: skip DMA during panic write (git-fixes). - mtd: rawnand: serialize lock/unlock against other NAND operations (git-fixes). - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() (git-fixes). - mtd: Avoid boot crash in RedBoot partition table parser (git-fixes). - NFC: nxp-nci: allow GPIOs to sleep (git-fixes). - net: usb: aqc111: Do not perform PM inside suspend callback (git-fixes). - net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check (git-fixes). - net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check (git-fixes). - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect (git-fixes). - PM: runtime: Fix a race condition related to device removal (git-fixes). - regulator: pca9450: Correct interrupt type (git-fixes). - platform/x86: dell-wmi: Add audio/mic mute key codes (stable-fixes). - pinctrl: equilibrium: fix warning trace on load (git-fixes). - pinctrl: equilibrium: rename irq_chip function callbacks (stable-fixes). - net: usb: pegasus: validate USB endpoints (stable-fixes). - mfd: omap-usb-host: Fix OF populate on driver rebind (git-fixes). - mfd: qcom-pm8xxx: Fix OF populate on driver rebind (git-fixes). - regulator: pca9450: Make IRQ optional (stable-fixes). - PCI: Update BAR # and window messages (stable-fixes). - mfd: qcom-pm8xxx: Convert to platform remove callback returning void (stable-fixes). - commit ec2548e - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (git-fixes). - can: gw: fix OOB heap access in cgw_csum_crc8_rel() (git-fixes). - media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (git-fixes). - i2c: pxa: defer reset on Armada 3700 when recovery is used (git-fixes). - i2c: fsi: Fix a potential leak in fsi_i2c_probe() (git-fixes). - i2c: cp2615: fix serial string NULL-deref at probe (git-fixes). - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() (git-fixes). - drm/radeon: apply state adjust rules to some additional HAINAN vairants (stable-fixes). - drm/amdgpu: apply state adjust rules to some additional HAINAN vairants (stable-fixes). - drm/amdgpu/gmc9.0: add bounds checking for cid (stable-fixes). - drm/amdgpu/mmhub3.0: add bounds checking for cid (stable-fixes). - drm/amdgpu/mmhub3.0.2: add bounds checking for cid (stable-fixes). - drm/amdgpu/mmhub3.0.1: add bounds checking for cid (stable-fixes). - drm/amdgpu/mmhub2.3: add bounds checking for cid (stable-fixes). - drm/amdgpu/mmhub2.0: add bounds checking for cid (stable-fixes). - drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr() (git-fixes). - drm/i915/gt: Check set_default_submission() before deferencing (git-fixes). - firmware: arm_scpi: Fix device_node reference leak in probe path (git-fixes). - drm/amd: Set num IP blocks to 0 if discovery fails (stable-fixes). - drm/msm/dsi: fix pclk rate calculation for bonded dsi (git-fixes). - drm/msm/dsi: fix hdisplay calculation when programming dsi registers (git-fixes). - drm/amdgpu: Fix use-after-free race in VM acquire (stable-fixes). - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them (stable-fixes). - drm/amdgpu: keep vga memory on MacBooks with switchable graphics (stable-fixes). - drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD (stable-fixes). - drm/amd/display: Add pixel_clock to amd_pp_display_configuration (stable-fixes). - drm/msm/dsi: Document DSC related pclk_rate and hdisplay calculations (stable-fixes). - mfd: omap-usb-host: Convert to platform remove callback returning void (stable-fixes). - media: tegra-video: Use accessors for pad config 'try_*' fields (stable-fixes). - i2c: cp2615: replace deprecated strncpy with strscpy (stable-fixes). - commit 19fcdc7 - Bluetooth: btusb: clamp SCO altsetting table indices (git-fixes). - Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop (git-fixes). - Bluetooth: L2CAP: Fix send LE flow credits in ACL link (git-fixes). - Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb (git-fixes). - Bluetooth: hci_ll: Fix firmware leak on error path (git-fixes). - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (git-fixes). - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (git-fixes). - Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() (git-fixes). - commit d4b4294 - ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() (git-fixes). - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access (git-fixes). - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() (git-fixes). - Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (git-fixes). - Bluetooth: HIDP: Fix possible UAF (git-fixes). - Bluetooth: hci_sync: Fix hci_le_create_conn_sync (git-fixes). - Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy (git-fixes). - Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU (git-fixes). - Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU (git-fixes). - ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (git-fixes). - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces (stable-fixes). - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA (stable-fixes). - ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table (stable-fixes). - ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put() (git-fixes). - ACPI: PM: Save NVS memory on Lenovo G70-35 (stable-fixes). - ACPI: OSI: Add DMI quirk for Acer Aspire One D255 (stable-fixes). - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 (stable-fixes). - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 (stable-fixes). - ALSA: pci: hda: use snd_kcontrol_chip() (stable-fixes). - commit d930c45 - ceph: fix oops due to invalid pointer for kfree() in parse_longname() (bsc#1258337 CVE-2026-23201). - commit c1d531a ++++ kernel-rt: - libceph: reset sparse-read state in osd_fault() (CVE-2026-23136 bsc#1258303). - commit 7606f01 - wifi: libertas: fix use-after-free in lbs_free_adapter() (CVE-2026-23281 bsc#1260464). - commit 43b8c42 - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY (git-fixes). - serial: 8250_pci: add support for the AX99100 (stable-fixes). - serial: uartlite: fix PM runtime usage count underflow on probe (git-fixes). - serial: 8250: Fix TX deadlock when using DMA (git-fixes). - spi: fix statistics allocation (git-fixes). - spi: fix use-after-free on controller registration failure (git-fixes). - wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (git-fixes). - wifi: mac80211: fix NULL deref in mesh_matches_local() (git-fixes). - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (git-fixes). - wifi: mac80211: Fix static_branch_dec() underflow for aql_disable (git-fixes). - soc: fsl: qbman: fix race condition in qman_destroy_fq (git-fixes). - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed (stable-fixes). - usb: dwc3: pci: add support for the Intel Nova Lake -H (stable-fixes). - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk (stable-fixes). - usb: xhci: Prevent interrupt storm on host controller error (HCE) (stable-fixes). - usb: cdc-acm: Restore CAP_BRK functionnality to CH343 (git-fixes). - usb: misc: uss720: properly clean up reference in uss720_probe() (stable-fixes). - usb: image: mdc800: kill download URB on timeout (stable-fixes). - usb: mdc800: handle signal and read racing (stable-fixes). - usb: yurex: fix race in probe (stable-fixes). - staging: rtl8723bs: properly validate the data in rtw_get_ie_ex() (stable-fixes). - wifi: mac80211: set default WMM parameters on all links (stable-fixes). - usb: cdns3: fix role switching during resume (git-fixes). - USB: serial: f81232: fix incomplete serial port generation (stable-fixes). - usb: cdns3: call cdns_power_is_lost() only once in cdns_resume() (stable-fixes). - usb: cdns3: remove redundant if branch (stable-fixes). - commit 9cd434e - nfc: nci: fix circular locking dependency in nci_close_device (git-fixes). - pinctrl: mediatek: common: Fix probe failure for devices without EINT (git-fixes). - pinctrl: qcom: spmi-gpio: implement .get_direction() (git-fixes). - platform/x86: ISST: Correct locked bit width (git-fixes). - platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen (git-fixes). - mmc: sdhci: fix timing selection for 1-bit bus width (git-fixes). - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption (git-fixes). - mtd: rawnand: pl353: make sure optimal timings are applied (git-fixes). - mtd: rawnand: brcmnand: skip DMA during panic write (git-fixes). - mtd: rawnand: serialize lock/unlock against other NAND operations (git-fixes). - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() (git-fixes). - mtd: Avoid boot crash in RedBoot partition table parser (git-fixes). - NFC: nxp-nci: allow GPIOs to sleep (git-fixes). - net: usb: aqc111: Do not perform PM inside suspend callback (git-fixes). - net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check (git-fixes). - net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check (git-fixes). - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect (git-fixes). - PM: runtime: Fix a race condition related to device removal (git-fixes). - regulator: pca9450: Correct interrupt type (git-fixes). - platform/x86: dell-wmi: Add audio/mic mute key codes (stable-fixes). - pinctrl: equilibrium: fix warning trace on load (git-fixes). - pinctrl: equilibrium: rename irq_chip function callbacks (stable-fixes). - net: usb: pegasus: validate USB endpoints (stable-fixes). - mfd: omap-usb-host: Fix OF populate on driver rebind (git-fixes). - mfd: qcom-pm8xxx: Fix OF populate on driver rebind (git-fixes). - regulator: pca9450: Make IRQ optional (stable-fixes). - PCI: Update BAR # and window messages (stable-fixes). - mfd: qcom-pm8xxx: Convert to platform remove callback returning void (stable-fixes). - commit ec2548e - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (git-fixes). - can: gw: fix OOB heap access in cgw_csum_crc8_rel() (git-fixes). - media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (git-fixes). - i2c: pxa: defer reset on Armada 3700 when recovery is used (git-fixes). - i2c: fsi: Fix a potential leak in fsi_i2c_probe() (git-fixes). - i2c: cp2615: fix serial string NULL-deref at probe (git-fixes). - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() (git-fixes). - drm/radeon: apply state adjust rules to some additional HAINAN vairants (stable-fixes). - drm/amdgpu: apply state adjust rules to some additional HAINAN vairants (stable-fixes). - drm/amdgpu/gmc9.0: add bounds checking for cid (stable-fixes). - drm/amdgpu/mmhub3.0: add bounds checking for cid (stable-fixes). - drm/amdgpu/mmhub3.0.2: add bounds checking for cid (stable-fixes). - drm/amdgpu/mmhub3.0.1: add bounds checking for cid (stable-fixes). - drm/amdgpu/mmhub2.3: add bounds checking for cid (stable-fixes). - drm/amdgpu/mmhub2.0: add bounds checking for cid (stable-fixes). - drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr() (git-fixes). - drm/i915/gt: Check set_default_submission() before deferencing (git-fixes). - firmware: arm_scpi: Fix device_node reference leak in probe path (git-fixes). - drm/amd: Set num IP blocks to 0 if discovery fails (stable-fixes). - drm/msm/dsi: fix pclk rate calculation for bonded dsi (git-fixes). - drm/msm/dsi: fix hdisplay calculation when programming dsi registers (git-fixes). - drm/amdgpu: Fix use-after-free race in VM acquire (stable-fixes). - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them (stable-fixes). - drm/amdgpu: keep vga memory on MacBooks with switchable graphics (stable-fixes). - drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD (stable-fixes). - drm/amd/display: Add pixel_clock to amd_pp_display_configuration (stable-fixes). - drm/msm/dsi: Document DSC related pclk_rate and hdisplay calculations (stable-fixes). - mfd: omap-usb-host: Convert to platform remove callback returning void (stable-fixes). - media: tegra-video: Use accessors for pad config 'try_*' fields (stable-fixes). - i2c: cp2615: replace deprecated strncpy with strscpy (stable-fixes). - commit 19fcdc7 - Bluetooth: btusb: clamp SCO altsetting table indices (git-fixes). - Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop (git-fixes). - Bluetooth: L2CAP: Fix send LE flow credits in ACL link (git-fixes). - Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb (git-fixes). - Bluetooth: hci_ll: Fix firmware leak on error path (git-fixes). - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (git-fixes). - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (git-fixes). - Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() (git-fixes). - commit d4b4294 - ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() (git-fixes). - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access (git-fixes). - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() (git-fixes). - Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (git-fixes). - Bluetooth: HIDP: Fix possible UAF (git-fixes). - Bluetooth: hci_sync: Fix hci_le_create_conn_sync (git-fixes). - Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy (git-fixes). - Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU (git-fixes). - Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU (git-fixes). - ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (git-fixes). - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces (stable-fixes). - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA (stable-fixes). - ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table (stable-fixes). - ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put() (git-fixes). - ACPI: PM: Save NVS memory on Lenovo G70-35 (stable-fixes). - ACPI: OSI: Add DMI quirk for Acer Aspire One D255 (stable-fixes). - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 (stable-fixes). - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 (stable-fixes). - ALSA: pci: hda: use snd_kcontrol_chip() (stable-fixes). - commit d930c45 - ceph: fix oops due to invalid pointer for kfree() in parse_longname() (bsc#1258337 CVE-2026-23201). - commit c1d531a ++++ kernel-rt_debug: - libceph: reset sparse-read state in osd_fault() (CVE-2026-23136 bsc#1258303). - commit 7606f01 - wifi: libertas: fix use-after-free in lbs_free_adapter() (CVE-2026-23281 bsc#1260464). - commit 43b8c42 - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY (git-fixes). - serial: 8250_pci: add support for the AX99100 (stable-fixes). - serial: uartlite: fix PM runtime usage count underflow on probe (git-fixes). - serial: 8250: Fix TX deadlock when using DMA (git-fixes). - spi: fix statistics allocation (git-fixes). - spi: fix use-after-free on controller registration failure (git-fixes). - wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (git-fixes). - wifi: mac80211: fix NULL deref in mesh_matches_local() (git-fixes). - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (git-fixes). - wifi: mac80211: Fix static_branch_dec() underflow for aql_disable (git-fixes). - soc: fsl: qbman: fix race condition in qman_destroy_fq (git-fixes). - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed (stable-fixes). - usb: dwc3: pci: add support for the Intel Nova Lake -H (stable-fixes). - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk (stable-fixes). - usb: xhci: Prevent interrupt storm on host controller error (HCE) (stable-fixes). - usb: cdc-acm: Restore CAP_BRK functionnality to CH343 (git-fixes). - usb: misc: uss720: properly clean up reference in uss720_probe() (stable-fixes). - usb: image: mdc800: kill download URB on timeout (stable-fixes). - usb: mdc800: handle signal and read racing (stable-fixes). - usb: yurex: fix race in probe (stable-fixes). - staging: rtl8723bs: properly validate the data in rtw_get_ie_ex() (stable-fixes). - wifi: mac80211: set default WMM parameters on all links (stable-fixes). - usb: cdns3: fix role switching during resume (git-fixes). - USB: serial: f81232: fix incomplete serial port generation (stable-fixes). - usb: cdns3: call cdns_power_is_lost() only once in cdns_resume() (stable-fixes). - usb: cdns3: remove redundant if branch (stable-fixes). - commit 9cd434e - nfc: nci: fix circular locking dependency in nci_close_device (git-fixes). - pinctrl: mediatek: common: Fix probe failure for devices without EINT (git-fixes). - pinctrl: qcom: spmi-gpio: implement .get_direction() (git-fixes). - platform/x86: ISST: Correct locked bit width (git-fixes). - platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen (git-fixes). - mmc: sdhci: fix timing selection for 1-bit bus width (git-fixes). - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption (git-fixes). - mtd: rawnand: pl353: make sure optimal timings are applied (git-fixes). - mtd: rawnand: brcmnand: skip DMA during panic write (git-fixes). - mtd: rawnand: serialize lock/unlock against other NAND operations (git-fixes). - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() (git-fixes). - mtd: Avoid boot crash in RedBoot partition table parser (git-fixes). - NFC: nxp-nci: allow GPIOs to sleep (git-fixes). - net: usb: aqc111: Do not perform PM inside suspend callback (git-fixes). - net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check (git-fixes). - net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check (git-fixes). - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect (git-fixes). - PM: runtime: Fix a race condition related to device removal (git-fixes). - regulator: pca9450: Correct interrupt type (git-fixes). - platform/x86: dell-wmi: Add audio/mic mute key codes (stable-fixes). - pinctrl: equilibrium: fix warning trace on load (git-fixes). - pinctrl: equilibrium: rename irq_chip function callbacks (stable-fixes). - net: usb: pegasus: validate USB endpoints (stable-fixes). - mfd: omap-usb-host: Fix OF populate on driver rebind (git-fixes). - mfd: qcom-pm8xxx: Fix OF populate on driver rebind (git-fixes). - regulator: pca9450: Make IRQ optional (stable-fixes). - PCI: Update BAR # and window messages (stable-fixes). - mfd: qcom-pm8xxx: Convert to platform remove callback returning void (stable-fixes). - commit ec2548e - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (git-fixes). - can: gw: fix OOB heap access in cgw_csum_crc8_rel() (git-fixes). - media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (git-fixes). - i2c: pxa: defer reset on Armada 3700 when recovery is used (git-fixes). - i2c: fsi: Fix a potential leak in fsi_i2c_probe() (git-fixes). - i2c: cp2615: fix serial string NULL-deref at probe (git-fixes). - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() (git-fixes). - drm/radeon: apply state adjust rules to some additional HAINAN vairants (stable-fixes). - drm/amdgpu: apply state adjust rules to some additional HAINAN vairants (stable-fixes). - drm/amdgpu/gmc9.0: add bounds checking for cid (stable-fixes). - drm/amdgpu/mmhub3.0: add bounds checking for cid (stable-fixes). - drm/amdgpu/mmhub3.0.2: add bounds checking for cid (stable-fixes). - drm/amdgpu/mmhub3.0.1: add bounds checking for cid (stable-fixes). - drm/amdgpu/mmhub2.3: add bounds checking for cid (stable-fixes). - drm/amdgpu/mmhub2.0: add bounds checking for cid (stable-fixes). - drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr() (git-fixes). - drm/i915/gt: Check set_default_submission() before deferencing (git-fixes). - firmware: arm_scpi: Fix device_node reference leak in probe path (git-fixes). - drm/amd: Set num IP blocks to 0 if discovery fails (stable-fixes). - drm/msm/dsi: fix pclk rate calculation for bonded dsi (git-fixes). - drm/msm/dsi: fix hdisplay calculation when programming dsi registers (git-fixes). - drm/amdgpu: Fix use-after-free race in VM acquire (stable-fixes). - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them (stable-fixes). - drm/amdgpu: keep vga memory on MacBooks with switchable graphics (stable-fixes). - drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD (stable-fixes). - drm/amd/display: Add pixel_clock to amd_pp_display_configuration (stable-fixes). - drm/msm/dsi: Document DSC related pclk_rate and hdisplay calculations (stable-fixes). - mfd: omap-usb-host: Convert to platform remove callback returning void (stable-fixes). - media: tegra-video: Use accessors for pad config 'try_*' fields (stable-fixes). - i2c: cp2615: replace deprecated strncpy with strscpy (stable-fixes). - commit 19fcdc7 - Bluetooth: btusb: clamp SCO altsetting table indices (git-fixes). - Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop (git-fixes). - Bluetooth: L2CAP: Fix send LE flow credits in ACL link (git-fixes). - Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb (git-fixes). - Bluetooth: hci_ll: Fix firmware leak on error path (git-fixes). - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (git-fixes). - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (git-fixes). - Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() (git-fixes). - commit d4b4294 - ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() (git-fixes). - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access (git-fixes). - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() (git-fixes). - Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (git-fixes). - Bluetooth: HIDP: Fix possible UAF (git-fixes). - Bluetooth: hci_sync: Fix hci_le_create_conn_sync (git-fixes). - Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy (git-fixes). - Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU (git-fixes). - Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU (git-fixes). - ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (git-fixes). - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces (stable-fixes). - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA (stable-fixes). - ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table (stable-fixes). - ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put() (git-fixes). - ACPI: PM: Save NVS memory on Lenovo G70-35 (stable-fixes). - ACPI: OSI: Add DMI quirk for Acer Aspire One D255 (stable-fixes). - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 (stable-fixes). - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 (stable-fixes). - ALSA: pci: hda: use snd_kcontrol_chip() (stable-fixes). - commit d930c45 - ceph: fix oops due to invalid pointer for kfree() in parse_longname() (bsc#1258337 CVE-2026-23201). - commit c1d531a ++++ libpng16: - added patches CVE-2026-33416: use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE` can lead to arbitrary code execution (bsc#1260754) * libpng16-CVE-2026-33416-1.patch * libpng16-CVE-2026-33416-2.patch * libpng16-CVE-2026-33416-3.patch * libpng16-CVE-2026-33416-4.patch CVE-2026-33636: out-of-bounds read/write in the palette expansion on ARM Neon can lead to information leak and crashes (bsc#1260755) * libpng16-CVE-2026-33636.patch ++++ polkit: - avoid reading endless amounts of memory (CVE-2026-4897 bsc#1260859) 0001-CVE-2026-4897-getline-string-overflow.patch ++++ python311-core: - Add CVE-2026-4519-webbrowser-open-dashes.patch to reject leading dashes in webbrowser URLs (bsc#1260026, CVE-2026-4519, gh#python/cpython#143930). ++++ python311: - Add CVE-2026-4519-webbrowser-open-dashes.patch to reject leading dashes in webbrowser URLs (bsc#1260026, CVE-2026-4519, gh#python/cpython#143930). ------------------------------------------------------------------ ------------------ 2026-3-26 - Mar 26 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - libceph: make calc_target() set t->paused, not just clear it (bsc#1257682 CVE-2026-23047). - commit 9134bbf ++++ kernel-rt: - libceph: make calc_target() set t->paused, not just clear it (bsc#1257682 CVE-2026-23047). - commit 9134bbf ++++ kernel-rt_debug: - libceph: make calc_target() set t->paused, not just clear it (bsc#1257682 CVE-2026-23047). - commit 9134bbf ++++ expat: - version update to 2.7.5 (bsc#1259711, bsc#1259729, bsc#1259726) * CVE-2026-32776 -- Fix NULL function pointer dereference for empty external parameter entities; it takes use of both functions XML_ExternalEntityParserCreate and XML_SetParamEntityParsing for an application to be vulnerable. * CVE-2026-32777 -- Protect from XML_TOK_INSTANCE_START infinite loop in function entityValueProcessor; it takes use of both functions XML_ExternalEntityParserCreate and XML_SetParamEntityParsing for an application to be vulnerable. * CVE-2026-32778 -- Fix NULL dereference in function setContext on retry after an earlier ouf-of-memory condition; it takes use of function XML_ParserCreateNS or XML_ParserCreate_MM for an application to be vulnerable. * See full changelog here: https://github.com/libexpat/libexpat/blob/R_2_7_5/expat/Changes ++++ openssl-3: - Security fixes: * CVE-2026-28387: Potential use-after-free in DANE client code (bsc#1260441) * CVE-2026-28388: NULL Pointer Dereference When Processing a Delta (bsc#1260442) * CVE-2026-28389: Possible NULL dereference when processing CMS KeyAgreeRecipientInfo (bsc#1260443) * CVE-2026-31789: Heap buffer overflow in hexadecimal conversion (bsc#1260444) * CVE-2026-31790: Incorrect failure handling in RSA KEM RSASVE encapsulation (bsc#1260445) * NULL pointer dereference when processing an OCSP response (bsc#1260446) * Add patches: openssl-CVE-2026-28387.patch openssl-CVE-2026-28388.patch openssl-CVE-2026-28388-tests.patch openssl-CVE-2026-28389.patch openssl-CVE-2026-31789.patch openssl-CVE-2026-31790.patch openssl-CVE-2026-31790-tests.patch openssl-NULL-pointer-dereference-in-ocsp_find_signer_sk.patch ------------------------------------------------------------------ ------------------ 2026-3-25 - Mar 25 2026 ------------------- ------------------------------------------------------------------ ++++ dnsmasq: - boo#1257934, 4070a748.patch: Fix build with nettle 4.0. ++++ python-kiwi: - Fix caller environment for non chroot scripts Make sure non chroot scripts also knows about the kiwi profile environment such that e.g. the current profile name or other settings from the build can be used in the script ++++ kernel-default: - x86/platform/uv: Handle deconfigured sockets (bsc#1260347). - commit f09c977 ++++ kernel-rt: - x86/platform/uv: Handle deconfigured sockets (bsc#1260347). - commit f09c977 ++++ kernel-rt_debug: - x86/platform/uv: Handle deconfigured sockets (bsc#1260347). - commit f09c977 ++++ python311-core: - Add CVE-2025-13462-tarinfo-header-parse.patch which skips TarInfo DIRTYPE normalization during GNU long name handling (bsc#1259611, CVE-2025-13462). ++++ nvidia-open-driver-G06-signed: - adding 'ExcludeArch: %ix86 s390x ppc64le' to no longer get autoclines by buildservice hoping that this wont't break RPM descriptions for -cuda variant again ... ++++ python311: - Add CVE-2025-13462-tarinfo-header-parse.patch which skips TarInfo DIRTYPE normalization during GNU long name handling (bsc#1259611, CVE-2025-13462). ------------------------------------------------------------------ ------------------ 2026-3-24 - Mar 24 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - RDMA/umad: Reject negative data_len in ib_umad_write (CVE-2026-23243 bsc#1259797) - commit b964f1d - RDMA/siw: Fix potential NULL pointer dereference in header processing (CVE-2026-23242 bsc#1259795) - commit b14d408 ++++ kernel-rt: - RDMA/umad: Reject negative data_len in ib_umad_write (CVE-2026-23243 bsc#1259797) - commit b964f1d - RDMA/siw: Fix potential NULL pointer dereference in header processing (CVE-2026-23242 bsc#1259795) - commit b14d408 ++++ kernel-rt_debug: - RDMA/umad: Reject negative data_len in ib_umad_write (CVE-2026-23243 bsc#1259797) - commit b964f1d - RDMA/siw: Fix potential NULL pointer dereference in header processing (CVE-2026-23242 bsc#1259795) - commit b14d408 ------------------------------------------------------------------ ------------------ 2026-3-23 - Mar 23 2026 ------------------- ------------------------------------------------------------------ ++++ python-kiwi: - Update spec file due to new package restrictions On SUSE new package restrictions where added to support the concept of the so called immutable mode. The new guideline says "Any files in the RPM spec %files section that are not in /usr or /etc is likely to break in Immutable Mode". For the kiwi packaging this applies to the kiwi-pxeboot sub package. This commit implements the suggested solution based on systemd-tmpfiles and only applies for SUSE. This Fixes jira#PCT-1055 - Fix result bundler for uncompressed container data When building container images with the respective runtime configuration: ```yaml container: - compress: false ``` The resulting image output files will be uncompressed meaning there is no ".xz" extension present. When running the result bundler there is an index bug which causes the container format type of the filename name e.g. ".docker" to be dropped from the result names. This commit fixes it. ++++ util-linux-systemd: - Recognize fuse "portal" as a virtual file system (boo#1234736, util-linux-libmount-fuse-portal.patch). - fdisk: Fix possible partition overlay and data corruption if EBR gap is missing (boo#1222465, util-linux-libfdisk-ebr-missing-gap-1.patch, util-linux-tests-fdisk-ebr-missing-gap-1.patch, util-linux-tests-fdisk-ebr-missing-gap-2.patch, util-linux-libfdisk-ebr-missing-gap-2.patch, util-linux-tests-fdisk-ebr-missing-gap-3.patch). ++++ util-linux: - Recognize fuse "portal" as a virtual file system (boo#1234736, util-linux-libmount-fuse-portal.patch). - fdisk: Fix possible partition overlay and data corruption if EBR gap is missing (boo#1222465, util-linux-libfdisk-ebr-missing-gap-1.patch, util-linux-tests-fdisk-ebr-missing-gap-1.patch, util-linux-tests-fdisk-ebr-missing-gap-2.patch, util-linux-libfdisk-ebr-missing-gap-2.patch, util-linux-tests-fdisk-ebr-missing-gap-3.patch). ++++ python311-core: - Add CVE-2026-4224-expat-unbound-C-recursion.patch avoiding unbound C recursion in conv_content_model in pyexpat.c (bsc#1259735, CVE-2026-4224). - Add CVE-2026-3644-cookies-Morsel-update-II.patch to reject control characters in http.cookies.Morsel.update() and http.cookies.BaseCookie.js_output (bsc#1259734, CVE-2026-3644). ++++ python311: - Add CVE-2026-4224-expat-unbound-C-recursion.patch avoiding unbound C recursion in conv_content_model in pyexpat.c (bsc#1259735, CVE-2026-4224). - Add CVE-2026-3644-cookies-Morsel-update-II.patch to reject control characters in http.cookies.Morsel.update() and http.cookies.BaseCookie.js_output (bsc#1259734, CVE-2026-3644). ++++ python-pyOpenSSL: - CVE-2026-27459: large cookie value can lead to a buffer overflow (bsc#1259808) Add patch CVE-2026-27459.patch - CVE-2026-27448: unhandled exception can result in connection not being cancelled (bsc#1259804) Add patch CVE-2026-27448.patch ++++ tar: - Fix bsc#1246399 / CVE-2025-45582. - Add patch: * CVE-2025-45582.patch ------------------------------------------------------------------ ------------------ 2026-3-22 - Mar 22 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - bpf, test_run: Subtract size of xdp_frame from allowed metadata size (CVE-2026-23140 bsc#1258305). - commit 2fff83a ++++ kernel-rt: - bpf, test_run: Subtract size of xdp_frame from allowed metadata size (CVE-2026-23140 bsc#1258305). - commit 2fff83a ++++ kernel-rt_debug: - bpf, test_run: Subtract size of xdp_frame from allowed metadata size (CVE-2026-23140 bsc#1258305). - commit 2fff83a ------------------------------------------------------------------ ------------------ 2026-3-20 - Mar 20 2026 ------------------- ------------------------------------------------------------------ ++++ cloud-regionsrv-client: - Update to version 11.0.2 (bsc#1260421) + Add iputils as a dependency to make automatic NVIDIA repo enablement work - Update to version 11.0.1 + Fix attempt to read a deleted file resulting in an error. Refresh the file list for repos and services for each pass over the server domains we are looking to clean up the registration. + Update user visible messages only showing messages for the application configuration file. ++++ cockpit: - Update dependencies to fix bsc#1258641/CVE-2026-26996, bsc#1257836/CVE-2026-25547 ++++ nghttp2: - added patches CVE-2026-27135: assertion failure due to missing state validation can lead to DoS (bsc#1259845) * nghttp2-CVE-2026-27135.patch ++++ rust-keylime: - Suggests only the IMA policy package, and keep it as example (bsc#1259963) - Add Cargo_toml.patch to re-generate TSS bindings - Update to version 0.2.9+8: * build(deps): bump thiserror from 2.0.17 to 2.0.18 * build(deps): bump docker/login-action from 3 to 4 * build(deps): bump docker/metadata-action from 5 to 6 * Remove generate-bindings feature from tss-esapi * Use port constants instead of hardcoded values in tests * push-attestation: Use registrar TLS port when TLS is enabled * build(deps): bump docker/build-push-action from 6 to 7 * build(deps): bump actions/upload-artifact from 6 to 7 * dist: Make the services to conflict with each other * Bump version to 0.2.9 * build(deps): bump mockoon/cli-action from 2 to 3 * cargo: Bump tracing_subscriber to version 0.3.20 * cargo: Bump time to version 0.3.47 * build(deps): bump http from 1.3.1 to 1.4.0 * Update reqwest from 0.12 to 0.13 * build(deps): bump serde from 1.0.219 to 1.0.228 * auth: Load CA certificate in authentication client * packit: Add missing e2e tests * registrar: Rename insecure option to disable_tls * push-attestation: Drop self-signed mTLS certificate generation * config: Add missing config options to keylime-agent.conf * config: Add support for "default" in registrar_api_versions option * config: Add support for "default" in registrar_tls_ca_cert option * config: Drop unused config options and constants * push-attestation: Drop support for mTLS to registrar * push-attestation: Drop mTLS support and require PoP authentication * build(deps): bump clap from 4.5.45 to 4.5.54 * build(deps): bump actix-web from 4.11.0 to 4.12.1 * auth: Reuse existing ContextInfo to avoid duplicate TPM objects * resilient_client: Reauthenticate if a 403 error is received ------------------------------------------------------------------ ------------------ 2026-3-19 - Mar 19 2026 ------------------- ------------------------------------------------------------------ ++++ crypto-policies: - Add PQC support for OpenSSH (bsc#1258311, bsc#1259825) * Enable and prioritize sntrup761x25519-sha512 for OpenSSH by default * Add crypto-policies-OpenSSH-PQC.patch ++++ kernel-default: - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CVE-2026-23231 bsc#1259188). - netfilter: nf_tables: register hooks last when adding new chain/flowtable (CVE-2026-23231 bsc#1259188). - commit fd540e6 ++++ kernel-rt: - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CVE-2026-23231 bsc#1259188). - netfilter: nf_tables: register hooks last when adding new chain/flowtable (CVE-2026-23231 bsc#1259188). - commit fd540e6 ++++ kernel-rt_debug: - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CVE-2026-23231 bsc#1259188). - netfilter: nf_tables: register hooks last when adding new chain/flowtable (CVE-2026-23231 bsc#1259188). - commit fd540e6 ++++ systemd: - Import commit a943e3ce2f655b8509038e31f03f5ded18f24683 a943e3ce2f machined: reject invalid class types when registering machines (bsc#1259650 CVE-2026-4105) 71593f77db udev: fix review mixup 73a89810b4 udev-builtin-net-id: print cescaped bad attributes 0f360bfdc0 udev-builtin-net_id: do not assume the current interface name is ethX 40905232e2 udev: ensure tag parsing stays within bounds 7bce9026e3 udev: ensure there is space for trailing NUL before calling sprintf d018ac1ea3 udev: check for invalid chars in various fields received from the kernel (bsc#1259697) ++++ python-PyJWT: - Add format-license.patch to work with older setuptools. ++++ python-pyasn1: - CVE-2026-30922: Denial of Service via Unbounded Recursion (bsc#1259803) Add patch CVE-2026-30922.patch ------------------------------------------------------------------ ------------------ 2026-3-18 - Mar 18 2026 ------------------- ------------------------------------------------------------------ ++++ python311-core: - Fix changelog ++++ libzypp: - Fix preloader not caching packages from arch specific subrepos (bsc#1253740) - Deprioritize invalid mirrors (fixes openSUSE/zypper#636) - version 17.38.5 (35) ++++ nvidia-open-driver-G06-signed: - do not set ExclusiveArch in order to fix RPM description for -cuda variant (bsc#1259719) - improved RPM description for -cuda and non-cuda variant ++++ python311: - Fix changelog ++++ python-PyJWT: - Skip failing tests (gh#jpadilla/pyjwt#1153) - Update to 2.12.1: - Add missing typing_extensions dependency for Python < 3.11 in [#1150] - Update to 2.12.0: - Fixed - Annotate PyJWKSet.keys for pyright by @tamird in #1134 - Close HTTPError response to prevent ResourceWarning on Python 3.14 by @veeceey in #1133 - Do not keep algorithms dict in PyJWK instances by @akx in [#1143] - Validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. by @dmbs335 in GHSA-752w-5fwx-jx9f (bsc#1259616, CVE-2026-32597). - Use PyJWK algorithm when encoding without explicit algorithm in #1148 - Added - Docs: Add PyJWKClient API reference and document the two-tier caching system (JWK Set cache and signing key LRU cache). v2.11.0 - Fixed - Enforce ECDSA curve validation per RFC 7518 Section 3.4. - Fix build system warnings by @kurtmckee in #1105 - Validate key against allowed types for Algorithm family in [#964] - Add iterator for JWKSet in #1041 - Validate iss claim is a string during encoding and decoding by @pachewise in #1040 - Improve typing/logic for options in decode, decode_complete by @pachewise in #1045 - Declare float supported type for lifespan and timeout by @nikitagashkov in #1068 - Fix SyntaxWarnings/DeprecationWarnings caused by invalid escape sequences by @kurtmckee in #1103 - Development: Build a shared wheel once to speed up test suite setup times by @kurtmckee in #1114 - Development: Test type annotations across all supported Python versions, increase the strictness of the type checking, and remove the mypy pre-commit hook by @kurtmckee in #1112 - Added - Support Python 3.14, and test against PyPy 3.10 and 3.11 by @kurtmckee in #1104 - Development: Migrate to build to test package building in CI by @kurtmckee in #1108 - Development: Improve coverage config and eliminate unused test suite code by @kurtmckee in #1115 - Docs: Standardize CHANGELOG links to PRs by @kurtmckee in [#1110] - Docs: Fix Read the Docs builds by @kurtmckee in #1111 - Docs: Add example of using leeway with nbf by @djw8605 in [#1034] - Docs: Refactored docs with autodoc; added PyJWS and jwt.algorithms docs by @pachewise in #1045 - Docs: Documentation improvements for "sub" and "jti" claims by @cleder in #1088 - Development: Add pyupgrade as a pre-commit hook by @kurtmckee in #1109 - Add minimum key length validation for HMAC and RSA keys (CWE-326). Warns by default via InsecureKeyLengthWarning when keys are below minimum recommended lengths per RFC 7518 Section 3.2 (HMAC) and NIST SP 800-131A (RSA). Pass enforce_minimum_key_length=True in options to PyJWT or PyJWS to raise InvalidKeyError instead. - Refactor PyJWT to own an internal PyJWS instance instead of calling global api_jws functions. ------------------------------------------------------------------ ------------------ 2026-3-17 - Mar 17 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - scsi: target: target_core_configfs: Add length check to avoid buffer overflow (CVE-2025-39998 bsc#1252073). - commit dff8745 - l2tp: avoid one data-race in l2tp_tunnel_del_work() (CVE-2026-23120 bsc#1258280) - commit 975023c - pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains (CVE-2026-23187 bsc#1258330) - commit 4b333af - phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (CVE-2026-23030 bsc#1257561) - commit 4c335f0 - Use unified maintainers' email address - commit a7ec874 - Use unified maintainers' email address - commit e7955e0 - Use unified maintainers' email address - commit 3c803fb ++++ kernel-rt: - scsi: target: target_core_configfs: Add length check to avoid buffer overflow (CVE-2025-39998 bsc#1252073). - commit dff8745 - l2tp: avoid one data-race in l2tp_tunnel_del_work() (CVE-2026-23120 bsc#1258280) - commit 975023c - pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains (CVE-2026-23187 bsc#1258330) - commit 4b333af - phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (CVE-2026-23030 bsc#1257561) - commit 4c335f0 - Use unified maintainers' email address - commit 7ea5c46 - Use unified maintainers' email address - commit a7ec874 - Use unified maintainers' email address - commit e7955e0 - Use unified maintainers' email address - commit 3c803fb ++++ kernel-rt_debug: - scsi: target: target_core_configfs: Add length check to avoid buffer overflow (CVE-2025-39998 bsc#1252073). - commit dff8745 - l2tp: avoid one data-race in l2tp_tunnel_del_work() (CVE-2026-23120 bsc#1258280) - commit 975023c - pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains (CVE-2026-23187 bsc#1258330) - commit 4b333af - phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (CVE-2026-23030 bsc#1257561) - commit 4c335f0 - Use unified maintainers' email address - commit 7ea5c46 - Use unified maintainers' email address - commit a7ec874 - Use unified maintainers' email address - commit e7955e0 - Use unified maintainers' email address - commit 3c803fb ++++ openSUSE-build-key: - move the pqkeys out of gnupg, its not gpg style. ++++ python-tornado6: - CVE-2026-31958: parsing large multipart bodies with many parts can cause a denial of service (bsc#1259553) * added CVE-2026-31958.patch - VUL-0: incomplete validation of cookie attributes allows for injection of user-controlled values in other cookie attributes (bsc#1259630) * added VUL-0-cookie-attribute-validation.patch ++++ ovmf: - Update mbedtls to 3.6.5 to fix CVE-2025-59438 (bsc#1252441) - Requires Mbed TLS 3.6.5 or higher to mitigate vulnerability. ------------------------------------------------------------------ ------------------ 2026-3-16 - Mar 16 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - net/mana: Null service_wq on setup error to prevent double destroy (git-fix). - commit 4b21ba9 - iomap: adjust read range correctly for non-block-aligned positions (CVE-2025-68794 bsc#1256647) - commit bad6b8a ++++ kernel-rt: - net/mana: Null service_wq on setup error to prevent double destroy (git-fix). - commit 4b21ba9 - iomap: adjust read range correctly for non-block-aligned positions (CVE-2025-68794 bsc#1256647) - commit bad6b8a ++++ kernel-rt_debug: - net/mana: Null service_wq on setup error to prevent double destroy (git-fix). - commit 4b21ba9 - iomap: adjust read range correctly for non-block-aligned positions (CVE-2025-68794 bsc#1256647) - commit bad6b8a ++++ nvidia-open-driver-G06-signed: - add 'Provides: open-driver-non-cuda-variant = %version' for non-CUDA variant to be able to distinguish between both variants; to be used by nvidia-open-driver-G06-signed-kmp-meta for TW ... (boo#1259740) ++++ pcr-oracle: - Update to 0.6.0 + Initial support for CI tests + Fix additional arguments following the PCR index + CI: Shutdown the swtpm instance after tests + Fix stop event check crash for grub-command (bsc#1258119) + Print PCR values during signing or sealing ------------------------------------------------------------------ ------------------ 2026-3-15 - Mar 15 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - usb: roles: get usb role switch from parent only for usb-b-connector (git-fixes). - usb: xhci: Fix memory leak in xhci_disable_slot() (git-fixes). - usb: class: cdc-wdm: fix reordering issue in read code path (git-fixes). - usb: renesas_usbhs: fix use-after-free in ISR during device removal (git-fixes). - usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() (git-fixes). - USB: core: Limit the length of unkillable synchronous timeouts (git-fixes). - USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts (git-fixes). - USB: usbcore: Introduce usb_bulk_msg_killable() (git-fixes). - usb: core: don't power off roothub PHYs if phy_set_mode() fails (git-fixes). - iio: gyro: mpu3050-core: fix pm_runtime error handling (git-fixes). - iio: gyro: mpu3050-i2c: fix pm_runtime error handling (git-fixes). - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() (git-fixes). - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() (git-fixes). - iio: chemical: bme680: Fix measurement wait duration calculation (git-fixes). - iio: dac: ds4424: reject -128 RAW value (git-fixes). - iio: potentiometer: mcp4131: fix double application of wiper shift (git-fixes). - iio: frequency: adf4377: Fix duplicated soft reset mask (git-fixes). - iio: imu: inv_icm42600: fix odr switch to the same value (git-fixes). - commit 4702653 ++++ kernel-rt: - usb: roles: get usb role switch from parent only for usb-b-connector (git-fixes). - usb: xhci: Fix memory leak in xhci_disable_slot() (git-fixes). - usb: class: cdc-wdm: fix reordering issue in read code path (git-fixes). - usb: renesas_usbhs: fix use-after-free in ISR during device removal (git-fixes). - usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() (git-fixes). - USB: core: Limit the length of unkillable synchronous timeouts (git-fixes). - USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts (git-fixes). - USB: usbcore: Introduce usb_bulk_msg_killable() (git-fixes). - usb: core: don't power off roothub PHYs if phy_set_mode() fails (git-fixes). - iio: gyro: mpu3050-core: fix pm_runtime error handling (git-fixes). - iio: gyro: mpu3050-i2c: fix pm_runtime error handling (git-fixes). - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() (git-fixes). - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() (git-fixes). - iio: chemical: bme680: Fix measurement wait duration calculation (git-fixes). - iio: dac: ds4424: reject -128 RAW value (git-fixes). - iio: potentiometer: mcp4131: fix double application of wiper shift (git-fixes). - iio: frequency: adf4377: Fix duplicated soft reset mask (git-fixes). - iio: imu: inv_icm42600: fix odr switch to the same value (git-fixes). - commit 4702653 ++++ kernel-rt_debug: - usb: roles: get usb role switch from parent only for usb-b-connector (git-fixes). - usb: xhci: Fix memory leak in xhci_disable_slot() (git-fixes). - usb: class: cdc-wdm: fix reordering issue in read code path (git-fixes). - usb: renesas_usbhs: fix use-after-free in ISR during device removal (git-fixes). - usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() (git-fixes). - USB: core: Limit the length of unkillable synchronous timeouts (git-fixes). - USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts (git-fixes). - USB: usbcore: Introduce usb_bulk_msg_killable() (git-fixes). - usb: core: don't power off roothub PHYs if phy_set_mode() fails (git-fixes). - iio: gyro: mpu3050-core: fix pm_runtime error handling (git-fixes). - iio: gyro: mpu3050-i2c: fix pm_runtime error handling (git-fixes). - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() (git-fixes). - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() (git-fixes). - iio: chemical: bme680: Fix measurement wait duration calculation (git-fixes). - iio: dac: ds4424: reject -128 RAW value (git-fixes). - iio: potentiometer: mcp4131: fix double application of wiper shift (git-fixes). - iio: frequency: adf4377: Fix duplicated soft reset mask (git-fixes). - iio: imu: inv_icm42600: fix odr switch to the same value (git-fixes). - commit 4702653 ------------------------------------------------------------------ ------------------ 2026-3-14 - Mar 14 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding (git-fixes). - ASoC: amd: acp-mach-common: Add missing error check for clock acquisition (git-fixes). - ASoC: detect empty DMI strings (git-fixes). - ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition (git-fixes). - ASoC: soc-core: flush delayed work before removing DAIs and widgets (git-fixes). - ASoC: soc-core: drop delayed_work_pending() check before flush (git-fixes). - ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start (git-fixes). - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() (git-fixes). - commit 1a186d1 ++++ kernel-rt: - drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding (git-fixes). - ASoC: amd: acp-mach-common: Add missing error check for clock acquisition (git-fixes). - ASoC: detect empty DMI strings (git-fixes). - ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition (git-fixes). - ASoC: soc-core: flush delayed work before removing DAIs and widgets (git-fixes). - ASoC: soc-core: drop delayed_work_pending() check before flush (git-fixes). - ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start (git-fixes). - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() (git-fixes). - commit 1a186d1 ++++ kernel-rt_debug: - drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding (git-fixes). - ASoC: amd: acp-mach-common: Add missing error check for clock acquisition (git-fixes). - ASoC: detect empty DMI strings (git-fixes). - ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition (git-fixes). - ASoC: soc-core: flush delayed work before removing DAIs and widgets (git-fixes). - ASoC: soc-core: drop delayed_work_pending() check before flush (git-fixes). - ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start (git-fixes). - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() (git-fixes). - commit 1a186d1 ------------------------------------------------------------------ ------------------ 2026-3-13 - Mar 13 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (CVE-2025-71231 bsc#1258424). - commit f8a95c7 - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (CVE-2026-23125 bsc#1258293). - commit 6e65546 - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (bsc#1259461). - commit 042631f - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() (git-fixes). - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value (git-fixes). - net: usb: lan78xx: fix TX byte statistics for small packets (git-fixes). - net: usb: lan78xx: fix silent drop of packets with checksum errors (git-fixes). - qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (git-fixes). - remoteproc: sysmon: Correct subsys_name_len type in QMI request (git-fixes). - commit 5d32ac9 - apparmor: fix race between freeing data and fs accessing it (bsc#1258849). - apparmor: fix race on rawdata dereference (bsc#1258849). - apparmor: fix differential encoding verification (bsc#1258849). - apparmor: fix unprivileged local user can do privileged policy management (bsc#1258849). - apparmor: Fix double free of ns_name in aa_replace_profiles() (bsc#1258849). - apparmor: fix missing bounds check on DEFAULT table in verify_dfa() (bsc#1258849). - apparmor: fix side-effect bug in match_char() macro usage (bsc#1258849). - apparmor: fix: limit the number of levels of policy namespaces (bsc#1258849). - apparmor: replace recursive profile removal with iterative approach (bsc#1258849). - apparmor: fix memory leak in verify_header (bsc#1258849). - apparmor: validate DFA start states are in bounds in unpack_pdb (bsc#1258849). - commit 9f31a2e ++++ kernel-rt: - crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (CVE-2025-71231 bsc#1258424). - commit f8a95c7 - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (CVE-2026-23125 bsc#1258293). - commit 6e65546 - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (bsc#1259461). - commit 042631f - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() (git-fixes). - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value (git-fixes). - net: usb: lan78xx: fix TX byte statistics for small packets (git-fixes). - net: usb: lan78xx: fix silent drop of packets with checksum errors (git-fixes). - qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (git-fixes). - remoteproc: sysmon: Correct subsys_name_len type in QMI request (git-fixes). - commit 5d32ac9 - apparmor: fix race between freeing data and fs accessing it (bsc#1258849). - apparmor: fix race on rawdata dereference (bsc#1258849). - apparmor: fix differential encoding verification (bsc#1258849). - apparmor: fix unprivileged local user can do privileged policy management (bsc#1258849). - apparmor: Fix double free of ns_name in aa_replace_profiles() (bsc#1258849). - apparmor: fix missing bounds check on DEFAULT table in verify_dfa() (bsc#1258849). - apparmor: fix side-effect bug in match_char() macro usage (bsc#1258849). - apparmor: fix: limit the number of levels of policy namespaces (bsc#1258849). - apparmor: replace recursive profile removal with iterative approach (bsc#1258849). - apparmor: fix memory leak in verify_header (bsc#1258849). - apparmor: validate DFA start states are in bounds in unpack_pdb (bsc#1258849). - commit 9f31a2e ++++ kernel-rt_debug: - crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (CVE-2025-71231 bsc#1258424). - commit f8a95c7 - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (CVE-2026-23125 bsc#1258293). - commit 6e65546 - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (bsc#1259461). - commit 042631f - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() (git-fixes). - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value (git-fixes). - net: usb: lan78xx: fix TX byte statistics for small packets (git-fixes). - net: usb: lan78xx: fix silent drop of packets with checksum errors (git-fixes). - qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (git-fixes). - remoteproc: sysmon: Correct subsys_name_len type in QMI request (git-fixes). - commit 5d32ac9 - apparmor: fix race between freeing data and fs accessing it (bsc#1258849). - apparmor: fix race on rawdata dereference (bsc#1258849). - apparmor: fix differential encoding verification (bsc#1258849). - apparmor: fix unprivileged local user can do privileged policy management (bsc#1258849). - apparmor: Fix double free of ns_name in aa_replace_profiles() (bsc#1258849). - apparmor: fix missing bounds check on DEFAULT table in verify_dfa() (bsc#1258849). - apparmor: fix side-effect bug in match_char() macro usage (bsc#1258849). - apparmor: fix: limit the number of levels of policy namespaces (bsc#1258849). - apparmor: replace recursive profile removal with iterative approach (bsc#1258849). - apparmor: fix memory leak in verify_header (bsc#1258849). - apparmor: validate DFA start states are in bounds in unpack_pdb (bsc#1258849). - commit 9f31a2e ++++ python311-core: - Add CVE-2026-2297-SourcelessFileLoader-io_open_code.patch ensuring that `SourcelessFileLoader` uses `io.open_code` when opening `.pyc` files (bsc#1259240, CVE-2026-2297). ++++ sqlite3: - Update to version 3.51.3: * Fix the WAL-reset database corruption bug: https://sqlite.org/wal.html#walresetbug * Other minor bug fixes. ++++ python311: - Add CVE-2026-2297-SourcelessFileLoader-io_open_code.patch ensuring that `SourcelessFileLoader` uses `io.open_code` when opening `.pyc` files (bsc#1259240, CVE-2026-2297). ------------------------------------------------------------------ ------------------ 2026-3-12 - Mar 12 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - scsi: mpi3mr: Event processing debug improvement (bsc#1251186, bsc#1258832). - commit 4fde182 - net: mana: Ring doorbell at 4 CQ wraparounds (git-fixes). - net: mana: Fix double destroy_workqueue on service rescan PCI path (git-fixes). - PCI: hv: remove unnecessary module_init/exit functions (git-fixes). - PCI: hv: Remove unused field pci_bus in struct hv_pcibus_device (git-fixes). - RDMA/mana_ib: Add device-memory support (git-fixes). - RDMA/mana_ib: Take CQ type from the device type (git-fixes). - net: mana: Implement ndo_tx_timeout and serialize queue resets per port (bsc#1257472). - RDMA/mana_ib: check cqe length for kernel CQs (git-fixes). - net: mana: Fix use-after-free in reset service rescan path (git-fixes). - Drivers: hv: fix missing kernel-doc description for 'size' in request_arr_init() (git-fixes). - Drivers: hv: remove stale comment (git-fixes). - net: mana: Handle hardware recovery events when probing the device (bsc#1257466). - net: mana: Drop TX skb on post_work_request failure and unmap resources (git-fixes). - net: mana: Handle SKB if TX SGEs exceed hardware limit (git-fixes). - net: mana: Add standard counter rx_missed_errors (git-fixes). - net: mana: Move hardware counter stats from per-port to per-VF context (git-fixes). - net: mana: Support HW link state events (bsc#1253049). - Drivers: hv: vmbus: Fix typos in vmbus_drv.c (git-fixes). - Drivers: hv: vmbus: Fix sysfs output format for ring buffer index (git-fixes). - Drivers: hv: vmbus: Clean up sscanf format specifier in target_cpu_store() (git-fixes). - scsi: storvsc: Remove redundant ternary operators (git-fixes). - RDMA/mana_ib: Extend modify QP (git-fixes). - RDMA/mana_ib: Drain send wrs of GSI QP (git-fixes). - net: mana: Reduce waiting time if HWC not responding (bsc#1252266). - RDMA/mana_ib: add support of multiple ports (bsc#1251135). - RDMA/mana_ib: add additional port counters (bsc#1251135). - RDMA/mana_ib: Fix DSCP value in modify QP (git-fixes). - RDMA/mana_ib: Add device statistics support (git-fixes). - net: mana: fix spelling for mana_gd_deregiser_irq() (git-fixes). - net: mana: Handle Reset Request from MANA NIC (bsc#1245728 bsc#1251971). - net: mana: Handle unsupported HWC commands (git-fixes). - net: mana: Fix warnings for missing export.h header inclusion (git-fixes). - PCI: hv: Remove unnecessary flex array in struct pci_packet (git-fixes). - tools: hv: Enable debug logs for hv_kvp_daemon (git-fixes). - net: mana: Add support for auxiliary device servicing events (bsc#1251971). - RDMA/mana_ib: unify mana_ib functions to support any gdma device (git-fixes). - RDMA/mana_ib: Add support of mana_ib for RNIC and ETH nic (git-fixes). - net: mana: Probe rdma device in mana driver (git-fixes). - RDMA/mana_ib: Add support of 4M, 1G, and 2G pages (git-fixes). - RDMA/mana_ib: support of the zero based MRs (bsc#1251135). - RDMA/mana_ib: Access remote atomic for MRs (bsc#1251135). - RDMA/mana_ib: Fix integer overflow during queue creation (bsc#1251135). - RDMA/mana_ib: Handle net event for pointing to the current netdev (bsc#1256690). - net: mana: Change the function signature of mana_get_primary_netdev_rcu (bsc#1256690). - RDMA/mana_ib: Use safer allocation function() (bsc#1251135). - RDMA/mana_ib: Implement DMABUF MR support (git-fixes). - RDMA/mana_ib: Fix error code in probe() (git-fixes). - RDMA/mana_ib: Add port statistics support (git-fixes). - RDMA/mana_ib: request error CQEs when supported (git-fixes). - RDMA/mana_ib: Query feature_flags bitmask from FW (git-fixes). - RDMA/mana_ib: indicate CM support (git-fixes). - RDMA/mana_ib: polling of CQs for GSI/UD (git-fixes). - RDMA/mana_ib: extend mana QP table (git-fixes). - RDMA/mana_ib: implement req_notify_cq (git-fixes). - RDMA/mana_ib: UD/GSI work requests (git-fixes). - RDMA/mana_ib: create/destroy AH (git-fixes). - RDMA/mana_ib: UD/GSI QP creation for kernel (git-fixes). - RDMA/mana_ib: Create and destroy UD/GSI QP (git-fixes). - RDMA/mana_ib: create kernel-level CQs (git-fixes). - RDMA/mana_ib: helpers to allocate kernel queues (git-fixes). - RDMA/mana_ib: implement get_dma_mr (git-fixes). - RDMA/mana_ib: Allow registration of DMA-mapped memory in PDs (git-fixes). - PCI: hv: Correct a comment (git-fixes). - net: mana: Add metadata support for xdp mode (git-fixes). - tools/hv: reduce resource usage in hv_kvp_daemon (git-fixes). - tools/hv: add a .gitignore file (git-fixes). - tools/hv: reduce resouce usage in hv_get_dns_info helper (git-fixes). - hv/hv_kvp_daemon: Pass NIC name to hv_get_dns_info as well (git-fixes). - net: mana: use ethtool string helpers (git-fixes). - tools: hv: lsvmbus: change shebang to use python3 (git-fixes). - RDMA/mana_ib: Set correct device into ib (git-fixes). - RDMA/mana_ib: Process QP error events in mana_ib (git-fixes). - RDMA/mana_ib: extend query device (git-fixes). - RDMA/mana_ib: set node_guid (git-fixes). - RDMA/mana_ib: Modify QP state (git-fixes). - RDMA/mana_ib: Implement uapi to create and destroy RC QP (git-fixes). - RDMA/mana_ib: Create and destroy RC QP (git-fixes). - net: mana: Use mana_cleanup_port_context() for rxq cleanup (git-fixes). - RDMA/mana_ib: implement uapi for creation of rnic cq (git-fixes). - RDMA/mana_ib: boundary check before installing cq callbacks (git-fixes CVE-2024-38542 bsc#1226591). - RDMA/mana_ib: introduce a helper to remove cq callbacks (git-fixes). - RDMA/mana_ib: create and destroy RNIC cqs (git-fixes). - RDMA/mana_ib: create EQs for RNIC CQs (git-fixes). - RDMA/mana_ib: Fix missing ret value (git-fixes). - RDMA/mana_ib: Configure mac address in RNIC (git-fixes). - RDMA/mana_ib: Adding and deleting GIDs (git-fixes). - RDMA/mana_ib: Enable RoCE on port 1 (git-fixes). - RDMA/mana_ib: Implement port parameters (git-fixes). - RDMA/mana_ib: Create and destroy rnic adapter (git-fixes). - RDMA/mana_ib: Add EQ creation for rnic adapter (git-fixes). - RDMA/mana_ib: Use num_comp_vectors of ib_device (git-fixes). - RDMA/mana_ib: remove useless return values from dbg prints (git-fixes). - RDMA/mana_ib: Use struct mana_ib_queue for RAW QPs (git-fixes). - RDMA/mana_ib: Use struct mana_ib_queue for WQs (git-fixes). - RDMA/mana_ib: Use struct mana_ib_queue for CQs (git-fixes). - RDMA/mana_ib: Introduce helpers to create and destroy mana queues (git-fixes). - hv/hv_kvp_daemon: Handle IPv4 and Ipv6 combination for keyfile format (git-fixes). - RDMA/mana_ib: Introduce mana_ib_install_cq_cb helper function (git-fixes). - RDMA/mana_ib: Introduce mana_ib_get_netdev helper function (git-fixes). - RDMA/mana_ib: Introduce mdev_to_gc helper function (git-fixes). - commit 8690084 ++++ kernel-rt: - scsi: mpi3mr: Event processing debug improvement (bsc#1251186, bsc#1258832). - commit 4fde182 - net: mana: Ring doorbell at 4 CQ wraparounds (git-fixes). - net: mana: Fix double destroy_workqueue on service rescan PCI path (git-fixes). - PCI: hv: remove unnecessary module_init/exit functions (git-fixes). - PCI: hv: Remove unused field pci_bus in struct hv_pcibus_device (git-fixes). - RDMA/mana_ib: Add device-memory support (git-fixes). - RDMA/mana_ib: Take CQ type from the device type (git-fixes). - net: mana: Implement ndo_tx_timeout and serialize queue resets per port (bsc#1257472). - RDMA/mana_ib: check cqe length for kernel CQs (git-fixes). - net: mana: Fix use-after-free in reset service rescan path (git-fixes). - Drivers: hv: fix missing kernel-doc description for 'size' in request_arr_init() (git-fixes). - Drivers: hv: remove stale comment (git-fixes). - net: mana: Handle hardware recovery events when probing the device (bsc#1257466). - net: mana: Drop TX skb on post_work_request failure and unmap resources (git-fixes). - net: mana: Handle SKB if TX SGEs exceed hardware limit (git-fixes). - net: mana: Add standard counter rx_missed_errors (git-fixes). - net: mana: Move hardware counter stats from per-port to per-VF context (git-fixes). - net: mana: Support HW link state events (bsc#1253049). - Drivers: hv: vmbus: Fix typos in vmbus_drv.c (git-fixes). - Drivers: hv: vmbus: Fix sysfs output format for ring buffer index (git-fixes). - Drivers: hv: vmbus: Clean up sscanf format specifier in target_cpu_store() (git-fixes). - scsi: storvsc: Remove redundant ternary operators (git-fixes). - RDMA/mana_ib: Extend modify QP (git-fixes). - RDMA/mana_ib: Drain send wrs of GSI QP (git-fixes). - net: mana: Reduce waiting time if HWC not responding (bsc#1252266). - RDMA/mana_ib: add support of multiple ports (bsc#1251135). - RDMA/mana_ib: add additional port counters (bsc#1251135). - RDMA/mana_ib: Fix DSCP value in modify QP (git-fixes). - RDMA/mana_ib: Add device statistics support (git-fixes). - net: mana: fix spelling for mana_gd_deregiser_irq() (git-fixes). - net: mana: Handle Reset Request from MANA NIC (bsc#1245728 bsc#1251971). - net: mana: Handle unsupported HWC commands (git-fixes). - net: mana: Fix warnings for missing export.h header inclusion (git-fixes). - PCI: hv: Remove unnecessary flex array in struct pci_packet (git-fixes). - tools: hv: Enable debug logs for hv_kvp_daemon (git-fixes). - net: mana: Add support for auxiliary device servicing events (bsc#1251971). - RDMA/mana_ib: unify mana_ib functions to support any gdma device (git-fixes). - RDMA/mana_ib: Add support of mana_ib for RNIC and ETH nic (git-fixes). - net: mana: Probe rdma device in mana driver (git-fixes). - RDMA/mana_ib: Add support of 4M, 1G, and 2G pages (git-fixes). - RDMA/mana_ib: support of the zero based MRs (bsc#1251135). - RDMA/mana_ib: Access remote atomic for MRs (bsc#1251135). - RDMA/mana_ib: Fix integer overflow during queue creation (bsc#1251135). - RDMA/mana_ib: Handle net event for pointing to the current netdev (bsc#1256690). - net: mana: Change the function signature of mana_get_primary_netdev_rcu (bsc#1256690). - RDMA/mana_ib: Use safer allocation function() (bsc#1251135). - RDMA/mana_ib: Implement DMABUF MR support (git-fixes). - RDMA/mana_ib: Fix error code in probe() (git-fixes). - RDMA/mana_ib: Add port statistics support (git-fixes). - RDMA/mana_ib: request error CQEs when supported (git-fixes). - RDMA/mana_ib: Query feature_flags bitmask from FW (git-fixes). - RDMA/mana_ib: indicate CM support (git-fixes). - RDMA/mana_ib: polling of CQs for GSI/UD (git-fixes). - RDMA/mana_ib: extend mana QP table (git-fixes). - RDMA/mana_ib: implement req_notify_cq (git-fixes). - RDMA/mana_ib: UD/GSI work requests (git-fixes). - RDMA/mana_ib: create/destroy AH (git-fixes). - RDMA/mana_ib: UD/GSI QP creation for kernel (git-fixes). - RDMA/mana_ib: Create and destroy UD/GSI QP (git-fixes). - RDMA/mana_ib: create kernel-level CQs (git-fixes). - RDMA/mana_ib: helpers to allocate kernel queues (git-fixes). - RDMA/mana_ib: implement get_dma_mr (git-fixes). - RDMA/mana_ib: Allow registration of DMA-mapped memory in PDs (git-fixes). - PCI: hv: Correct a comment (git-fixes). - net: mana: Add metadata support for xdp mode (git-fixes). - tools/hv: reduce resource usage in hv_kvp_daemon (git-fixes). - tools/hv: add a .gitignore file (git-fixes). - tools/hv: reduce resouce usage in hv_get_dns_info helper (git-fixes). - hv/hv_kvp_daemon: Pass NIC name to hv_get_dns_info as well (git-fixes). - net: mana: use ethtool string helpers (git-fixes). - tools: hv: lsvmbus: change shebang to use python3 (git-fixes). - RDMA/mana_ib: Set correct device into ib (git-fixes). - RDMA/mana_ib: Process QP error events in mana_ib (git-fixes). - RDMA/mana_ib: extend query device (git-fixes). - RDMA/mana_ib: set node_guid (git-fixes). - RDMA/mana_ib: Modify QP state (git-fixes). - RDMA/mana_ib: Implement uapi to create and destroy RC QP (git-fixes). - RDMA/mana_ib: Create and destroy RC QP (git-fixes). - net: mana: Use mana_cleanup_port_context() for rxq cleanup (git-fixes). - RDMA/mana_ib: implement uapi for creation of rnic cq (git-fixes). - RDMA/mana_ib: boundary check before installing cq callbacks (git-fixes CVE-2024-38542 bsc#1226591). - RDMA/mana_ib: introduce a helper to remove cq callbacks (git-fixes). - RDMA/mana_ib: create and destroy RNIC cqs (git-fixes). - RDMA/mana_ib: create EQs for RNIC CQs (git-fixes). - RDMA/mana_ib: Fix missing ret value (git-fixes). - RDMA/mana_ib: Configure mac address in RNIC (git-fixes). - RDMA/mana_ib: Adding and deleting GIDs (git-fixes). - RDMA/mana_ib: Enable RoCE on port 1 (git-fixes). - RDMA/mana_ib: Implement port parameters (git-fixes). - RDMA/mana_ib: Create and destroy rnic adapter (git-fixes). - RDMA/mana_ib: Add EQ creation for rnic adapter (git-fixes). - RDMA/mana_ib: Use num_comp_vectors of ib_device (git-fixes). - RDMA/mana_ib: remove useless return values from dbg prints (git-fixes). - RDMA/mana_ib: Use struct mana_ib_queue for RAW QPs (git-fixes). - RDMA/mana_ib: Use struct mana_ib_queue for WQs (git-fixes). - RDMA/mana_ib: Use struct mana_ib_queue for CQs (git-fixes). - RDMA/mana_ib: Introduce helpers to create and destroy mana queues (git-fixes). - hv/hv_kvp_daemon: Handle IPv4 and Ipv6 combination for keyfile format (git-fixes). - RDMA/mana_ib: Introduce mana_ib_install_cq_cb helper function (git-fixes). - RDMA/mana_ib: Introduce mana_ib_get_netdev helper function (git-fixes). - RDMA/mana_ib: Introduce mdev_to_gc helper function (git-fixes). - commit 8690084 ++++ kernel-rt_debug: - scsi: mpi3mr: Event processing debug improvement (bsc#1251186, bsc#1258832). - commit 4fde182 - net: mana: Ring doorbell at 4 CQ wraparounds (git-fixes). - net: mana: Fix double destroy_workqueue on service rescan PCI path (git-fixes). - PCI: hv: remove unnecessary module_init/exit functions (git-fixes). - PCI: hv: Remove unused field pci_bus in struct hv_pcibus_device (git-fixes). - RDMA/mana_ib: Add device-memory support (git-fixes). - RDMA/mana_ib: Take CQ type from the device type (git-fixes). - net: mana: Implement ndo_tx_timeout and serialize queue resets per port (bsc#1257472). - RDMA/mana_ib: check cqe length for kernel CQs (git-fixes). - net: mana: Fix use-after-free in reset service rescan path (git-fixes). - Drivers: hv: fix missing kernel-doc description for 'size' in request_arr_init() (git-fixes). - Drivers: hv: remove stale comment (git-fixes). - net: mana: Handle hardware recovery events when probing the device (bsc#1257466). - net: mana: Drop TX skb on post_work_request failure and unmap resources (git-fixes). - net: mana: Handle SKB if TX SGEs exceed hardware limit (git-fixes). - net: mana: Add standard counter rx_missed_errors (git-fixes). - net: mana: Move hardware counter stats from per-port to per-VF context (git-fixes). - net: mana: Support HW link state events (bsc#1253049). - Drivers: hv: vmbus: Fix typos in vmbus_drv.c (git-fixes). - Drivers: hv: vmbus: Fix sysfs output format for ring buffer index (git-fixes). - Drivers: hv: vmbus: Clean up sscanf format specifier in target_cpu_store() (git-fixes). - scsi: storvsc: Remove redundant ternary operators (git-fixes). - RDMA/mana_ib: Extend modify QP (git-fixes). - RDMA/mana_ib: Drain send wrs of GSI QP (git-fixes). - net: mana: Reduce waiting time if HWC not responding (bsc#1252266). - RDMA/mana_ib: add support of multiple ports (bsc#1251135). - RDMA/mana_ib: add additional port counters (bsc#1251135). - RDMA/mana_ib: Fix DSCP value in modify QP (git-fixes). - RDMA/mana_ib: Add device statistics support (git-fixes). - net: mana: fix spelling for mana_gd_deregiser_irq() (git-fixes). - net: mana: Handle Reset Request from MANA NIC (bsc#1245728 bsc#1251971). - net: mana: Handle unsupported HWC commands (git-fixes). - net: mana: Fix warnings for missing export.h header inclusion (git-fixes). - PCI: hv: Remove unnecessary flex array in struct pci_packet (git-fixes). - tools: hv: Enable debug logs for hv_kvp_daemon (git-fixes). - net: mana: Add support for auxiliary device servicing events (bsc#1251971). - RDMA/mana_ib: unify mana_ib functions to support any gdma device (git-fixes). - RDMA/mana_ib: Add support of mana_ib for RNIC and ETH nic (git-fixes). - net: mana: Probe rdma device in mana driver (git-fixes). - RDMA/mana_ib: Add support of 4M, 1G, and 2G pages (git-fixes). - RDMA/mana_ib: support of the zero based MRs (bsc#1251135). - RDMA/mana_ib: Access remote atomic for MRs (bsc#1251135). - RDMA/mana_ib: Fix integer overflow during queue creation (bsc#1251135). - RDMA/mana_ib: Handle net event for pointing to the current netdev (bsc#1256690). - net: mana: Change the function signature of mana_get_primary_netdev_rcu (bsc#1256690). - RDMA/mana_ib: Use safer allocation function() (bsc#1251135). - RDMA/mana_ib: Implement DMABUF MR support (git-fixes). - RDMA/mana_ib: Fix error code in probe() (git-fixes). - RDMA/mana_ib: Add port statistics support (git-fixes). - RDMA/mana_ib: request error CQEs when supported (git-fixes). - RDMA/mana_ib: Query feature_flags bitmask from FW (git-fixes). - RDMA/mana_ib: indicate CM support (git-fixes). - RDMA/mana_ib: polling of CQs for GSI/UD (git-fixes). - RDMA/mana_ib: extend mana QP table (git-fixes). - RDMA/mana_ib: implement req_notify_cq (git-fixes). - RDMA/mana_ib: UD/GSI work requests (git-fixes). - RDMA/mana_ib: create/destroy AH (git-fixes). - RDMA/mana_ib: UD/GSI QP creation for kernel (git-fixes). - RDMA/mana_ib: Create and destroy UD/GSI QP (git-fixes). - RDMA/mana_ib: create kernel-level CQs (git-fixes). - RDMA/mana_ib: helpers to allocate kernel queues (git-fixes). - RDMA/mana_ib: implement get_dma_mr (git-fixes). - RDMA/mana_ib: Allow registration of DMA-mapped memory in PDs (git-fixes). - PCI: hv: Correct a comment (git-fixes). - net: mana: Add metadata support for xdp mode (git-fixes). - tools/hv: reduce resource usage in hv_kvp_daemon (git-fixes). - tools/hv: add a .gitignore file (git-fixes). - tools/hv: reduce resouce usage in hv_get_dns_info helper (git-fixes). - hv/hv_kvp_daemon: Pass NIC name to hv_get_dns_info as well (git-fixes). - net: mana: use ethtool string helpers (git-fixes). - tools: hv: lsvmbus: change shebang to use python3 (git-fixes). - RDMA/mana_ib: Set correct device into ib (git-fixes). - RDMA/mana_ib: Process QP error events in mana_ib (git-fixes). - RDMA/mana_ib: extend query device (git-fixes). - RDMA/mana_ib: set node_guid (git-fixes). - RDMA/mana_ib: Modify QP state (git-fixes). - RDMA/mana_ib: Implement uapi to create and destroy RC QP (git-fixes). - RDMA/mana_ib: Create and destroy RC QP (git-fixes). - net: mana: Use mana_cleanup_port_context() for rxq cleanup (git-fixes). - RDMA/mana_ib: implement uapi for creation of rnic cq (git-fixes). - RDMA/mana_ib: boundary check before installing cq callbacks (git-fixes CVE-2024-38542 bsc#1226591). - RDMA/mana_ib: introduce a helper to remove cq callbacks (git-fixes). - RDMA/mana_ib: create and destroy RNIC cqs (git-fixes). - RDMA/mana_ib: create EQs for RNIC CQs (git-fixes). - RDMA/mana_ib: Fix missing ret value (git-fixes). - RDMA/mana_ib: Configure mac address in RNIC (git-fixes). - RDMA/mana_ib: Adding and deleting GIDs (git-fixes). - RDMA/mana_ib: Enable RoCE on port 1 (git-fixes). - RDMA/mana_ib: Implement port parameters (git-fixes). - RDMA/mana_ib: Create and destroy rnic adapter (git-fixes). - RDMA/mana_ib: Add EQ creation for rnic adapter (git-fixes). - RDMA/mana_ib: Use num_comp_vectors of ib_device (git-fixes). - RDMA/mana_ib: remove useless return values from dbg prints (git-fixes). - RDMA/mana_ib: Use struct mana_ib_queue for RAW QPs (git-fixes). - RDMA/mana_ib: Use struct mana_ib_queue for WQs (git-fixes). - RDMA/mana_ib: Use struct mana_ib_queue for CQs (git-fixes). - RDMA/mana_ib: Introduce helpers to create and destroy mana queues (git-fixes). - hv/hv_kvp_daemon: Handle IPv4 and Ipv6 combination for keyfile format (git-fixes). - RDMA/mana_ib: Introduce mana_ib_install_cq_cb helper function (git-fixes). - RDMA/mana_ib: Introduce mana_ib_get_netdev helper function (git-fixes). - RDMA/mana_ib: Introduce mdev_to_gc helper function (git-fixes). - commit 8690084 ++++ libsolv: - respect the "default" attribute in environment optionlist in the comps parser - support suse namespace deps in boolean dependencies [bsc#1258193] - support for the Elbrus2000 (e2k) architecture - support language() suse namespace rewriting - bump version to 0.7.36 ++++ libssh: - CVE-2026-3731: Denial of Service via out-of-bounds read in SFTP extension name handler (bsc#1259377) Added libssh-CVE-2026-3731.patch ++++ openSUSE-build-key: - add the openSUSE post quantum key in /usr/lib/rpm/pqkeys/ ++++ suseconnect-ng: - Update version to 1.21: - Add expanded metric collection for kernel modules and hardware detection (jsc#TEL-226). - Support new profile based metric collection - Fix ignored --root parameter hanbling when reading and writing configuration (bsc#1257667) - Add expanded metric collection for system vendor/manfacturer (jsc#TEL-260). - Removed backport patch: fix-libsuseconnect-and-pci.patch - Add missing product id to allow yast2-registration to not break (bsc#1257825) - Fix libsuseconnect APIError detection logic (bsc#1257825) ------------------------------------------------------------------ ------------------ 2026-3-11 - Mar 11 2026 ------------------- ------------------------------------------------------------------ ++++ NetworkManager: - Add NetworkManager-CVE-2025-9615.patch: avoid that non-admin user using other users' certificates (bsc#1257359, CVE-2025-9615, glfd#NetworkManager/NetworkManager!2324). ++++ kernel-default: - s390/ctcm: Fix double-kfree (CVE-2025-40253 bsc#1255084). - commit a33e581 ++++ kernel-rt: - s390/ctcm: Fix double-kfree (CVE-2025-40253 bsc#1255084). - commit a33e581 ++++ kernel-rt_debug: - s390/ctcm: Fix double-kfree (CVE-2025-40253 bsc#1255084). - commit a33e581 ++++ libsoup: - Refresh some patches to match the output from gitlab.gnome.org. ++++ vim: * Update Vim to version 9.2.0110 (from 9.2.0045). * Specifically, this fixes bsc#1259051 / CVE-2026-28417. ------------------------------------------------------------------ ------------------ 2026-3-10 - Mar 10 2026 ------------------- ------------------------------------------------------------------ ++++ cloud-regionsrv-client: - Update to version 11.0.0 (bsc#1254960, bsc#1254982, bsc#1253777) + Major version bump for main package and plugin sub-packages due to interpreter change in SLE 15 SP4+ from Python 3.6 to Python 3.11 + Create cache directory in code and drop from package (jsc#PED-14732) + Fix race condition between license watcher timer and registration (bsc#1254984) + Fix cleanup issue in hosts (bsc#1254702) + Fix cache clean up + Fix exit condition from container registry setup + Lock the registration process to ensure single execution (bsc#1254984) + Fix traceback on FP and cert mismatch + Switch remaining code to updated logging implementation + Increase loggin information in log to help with issue debugging + Fix exit code on partial registration success + Remove obsolete switchcloudguestservices ++++ python-kiwi: - Fix spec file requirements for SUSE There is no erofs on SLES. This commit drops the respective requirement settings which we have upstream where it exists This Fixes jira#PCT-899 ++++ kernel-default: - Update config files (bsc#1254306). - commit 3c7bab7 - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (bsc#1254306). - commit 165c4b3 ++++ kernel-rt: - Update config files (bsc#1254306). - commit 3c7bab7 - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (bsc#1254306). - commit 165c4b3 ++++ kernel-rt_debug: - Update config files (bsc#1254306). - commit 3c7bab7 - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (bsc#1254306). - commit 165c4b3 ++++ libzypp: - Fix Product::referencePackage lookup (bsc#1259311) Use a provided autoproduct() as hint to the package name of the release package. It might be that not just multiple versions of the same release package provide the same product version, but also different release packages. - version 17.38.4 (35) ------------------------------------------------------------------ ------------------ 2026-3-9 - Mar 9 2026 ------------------- ------------------------------------------------------------------ ++++ curl: - Security fixes: * CVE-2026-1965: Bad reuse of HTTP Negotiate connection (bsc#1259362) * CVE-2026-3783: Token leak with redirect and netrc (bsc#1259363) * CVE-2026-3784: Wrong proxy connection reuse with credentials (bsc#1259364) * CVE-2026-3805: Use after free in SMB connection reuse (bsc#1259365) * Add patches: - curl-CVE-2026-1965.patch - curl-CVE-2026-3783.patch - curl-CVE-2026-3784.patch - curl-CVE-2026-3805.patch ++++ kernel-default: - KVM: x86/mmu: Retry fault before acquiring mmu_lock if mapping is changing (bsc#1253122). - Refresh patches.suse/KVM-x86-mmu-Move-private-vs.-shared-check-above-slot.patch. - commit 1f79320 ++++ kernel-rt: - KVM: x86/mmu: Retry fault before acquiring mmu_lock if mapping is changing (bsc#1253122). - Refresh patches.suse/KVM-x86-mmu-Move-private-vs.-shared-check-above-slot.patch. - commit 1f79320 ++++ kernel-rt_debug: - KVM: x86/mmu: Retry fault before acquiring mmu_lock if mapping is changing (bsc#1253122). - Refresh patches.suse/KVM-x86-mmu-Move-private-vs.-shared-check-above-slot.patch. - commit 1f79320 ------------------------------------------------------------------ ------------------ 2026-3-8 - Mar 8 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read (git-fixes). - hwmon: (it87) Check the it87_lock() return value (git-fixes). - commit 29de358 ++++ kernel-rt: - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read (git-fixes). - hwmon: (it87) Check the it87_lock() return value (git-fixes). - commit 29de358 ++++ kernel-rt_debug: - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read (git-fixes). - hwmon: (it87) Check the it87_lock() return value (git-fixes). - commit 29de358 ------------------------------------------------------------------ ------------------ 2026-3-7 - Mar 7 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - nouveau/dpcd: return EBUSY for aux xfer if the device is asleep (git-fixes). - drm/sched: Fix kernel-doc warning for drm_sched_job_done() (git-fixes). - drm/solomon: Fix page start when updating rectangle in page addressing mode (git-fixes). - platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data (git-fixes). - commit 76161b1 ++++ kernel-rt: - nouveau/dpcd: return EBUSY for aux xfer if the device is asleep (git-fixes). - drm/sched: Fix kernel-doc warning for drm_sched_job_done() (git-fixes). - drm/solomon: Fix page start when updating rectangle in page addressing mode (git-fixes). - platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data (git-fixes). - commit 76161b1 ++++ kernel-rt_debug: - nouveau/dpcd: return EBUSY for aux xfer if the device is asleep (git-fixes). - drm/sched: Fix kernel-doc warning for drm_sched_job_done() (git-fixes). - drm/solomon: Fix page start when updating rectangle in page addressing mode (git-fixes). - platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data (git-fixes). - commit 76161b1 ------------------------------------------------------------------ ------------------ 2026-3-6 - Mar 6 2026 ------------------- ------------------------------------------------------------------ ++++ busybox: - Additional fix for use-after-realloc in awk (CVE-2021-42380, bsc#1192869) * 0001-awk-fix-use-after-realloc-CVE-2021-42380-closes-1560.patch - Fix use-after-free in the awk.c copyvar (CVE-2023-42365, bsc#1217585) * 0002-awk-fix-precedence-of-relative-to.patch - Fix use-after-free vulnerability in xasprintf (CVE-2023-42363, bsc#1217580) * 0003-awk-fix-use-after-free-CVE-2023-42363.patch - Fix use-after-free in the awk.c (CVE-2023-42364, bsc#1217584) * 0004-awk-restore-assignment-precedence-to-be-lower-than-t.patch - Fix hidden files in tar listing using escape chars (CVE-2025-46394, bsc#1241661) * 0005-archival-libarchive-sanitize-filenames-on-output-pre.patch - Fix file overwrite, modification, privilege escalation, potential code execution in tar (CVE-2026-26157, bsc#1258163) (CVE-2026-26158, bsc#1258167) * 0006-tar-strip-unsafe-hardlink-components-GNU-tar-does-th.patch * 0007-tar-only-strip-unsafe-components-from-hardlinks-not-.patch - Fix wget request header injection (CVE-2025-60876, bsc#1253245) * wget-don-t-allow-control-characters-in-url.patch ++++ kernel-default: - tracing: Fix crash on synthetic stacktrace field usage (CVE-2026-23088 bsc#1257814). - commit 5950c9c - tracing: Do not register unsupported perf events (CVE-2025-71125 bsc#1256784). - commit 83b1b69 - nfc: rawsock: cancel tx_work before socket teardown (git-fixes). - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback (git-fixes). - nfc: nci: free skb on nci_transceive early error paths (git-fixes). - net: nfc: nci: Fix zero-length proprietary notifications (git-fixes). - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback (git-fixes). - can: ucan: Fix infinite loop from zero-length messages (git-fixes). - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message (git-fixes). - can: mcp251x: fix deadlock in error path of mcp251x_open (git-fixes). - can: bcm: fix locking for bcm_op runtime updates (git-fixes). - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() (git-fixes). - wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211() (git-fixes). - wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() (git-fixes). - wifi: wlcore: Fix a locking bug (git-fixes). - wifi: cw1200: Fix locking in error paths (git-fixes). - wifi: rsi: Don't default to -EOPNOTSUPP in rsi_mac80211_config (git-fixes). - batman-adv: Avoid double-rtnl_lock ELP metric worker (git-fixes). - commit 502e268 ++++ kernel-rt: - tracing: Fix crash on synthetic stacktrace field usage (CVE-2026-23088 bsc#1257814). - commit 5950c9c - tracing: Do not register unsupported perf events (CVE-2025-71125 bsc#1256784). - commit 83b1b69 - nfc: rawsock: cancel tx_work before socket teardown (git-fixes). - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback (git-fixes). - nfc: nci: free skb on nci_transceive early error paths (git-fixes). - net: nfc: nci: Fix zero-length proprietary notifications (git-fixes). - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback (git-fixes). - can: ucan: Fix infinite loop from zero-length messages (git-fixes). - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message (git-fixes). - can: mcp251x: fix deadlock in error path of mcp251x_open (git-fixes). - can: bcm: fix locking for bcm_op runtime updates (git-fixes). - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() (git-fixes). - wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211() (git-fixes). - wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() (git-fixes). - wifi: wlcore: Fix a locking bug (git-fixes). - wifi: cw1200: Fix locking in error paths (git-fixes). - wifi: rsi: Don't default to -EOPNOTSUPP in rsi_mac80211_config (git-fixes). - batman-adv: Avoid double-rtnl_lock ELP metric worker (git-fixes). - commit 502e268 ++++ kernel-rt_debug: - tracing: Fix crash on synthetic stacktrace field usage (CVE-2026-23088 bsc#1257814). - commit 5950c9c - tracing: Do not register unsupported perf events (CVE-2025-71125 bsc#1256784). - commit 83b1b69 - nfc: rawsock: cancel tx_work before socket teardown (git-fixes). - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback (git-fixes). - nfc: nci: free skb on nci_transceive early error paths (git-fixes). - net: nfc: nci: Fix zero-length proprietary notifications (git-fixes). - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback (git-fixes). - can: ucan: Fix infinite loop from zero-length messages (git-fixes). - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message (git-fixes). - can: mcp251x: fix deadlock in error path of mcp251x_open (git-fixes). - can: bcm: fix locking for bcm_op runtime updates (git-fixes). - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() (git-fixes). - wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211() (git-fixes). - wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() (git-fixes). - wifi: wlcore: Fix a locking bug (git-fixes). - wifi: cw1200: Fix locking in error paths (git-fixes). - wifi: rsi: Don't default to -EOPNOTSUPP in rsi_mac80211_config (git-fixes). - batman-adv: Avoid double-rtnl_lock ELP metric worker (git-fixes). - commit 502e268 ++++ python311-core: - Update to 3.11.15: - Security - gh-144125: BytesGenerator will now refuse to serialize (write) headers that are unsafely folded or delimited; see verify_generated_headers. (Contributed by Bas Bloemsaat and Petr Viktorin in gh-121650) (bsc#1257181, CVE-2026-1299). - gh-143935: Fixed a bug in the folding of comments when flattening an email message using a modern email policy. Comments consisting of a very long sequence of non-foldable characters could trigger a forced line wrap that omitted the required leading space on the continuation line, causing the remainder of the comment to be interpreted as a new header field. This enabled header injection with carefully crafted inputs (bsc#1257029 CVE-2025-11468). - gh-143925: Reject control characters in data: URL media types (bsc#1257046, CVE-2025-15282). - gh-143919: Reject control characters in http.cookies.Morsel fields and values (bsc#1257031, CVE-2026-0672). - gh-143916: Reject C0 control characters within wsgiref.headers.Headers fields, values, and parameters (bsc#1257042, CVE-2026-0865). - gh-142145: Remove quadratic behavior in xml.minidom node ID cache clearing. In order to do this without breaking existing users, we also add the ownerDocument attribute to xml.dom.minidom elements and attributes created by directly instantiating the Element or Attr class. Note that this way of creating nodes is not supported; creator functions like xml.dom.Document.documentElement() should be used instead (bsc#1254997, CVE-2025-12084). - gh-137836: Add support of the “plaintext” element, RAWTEXT elements “xmp”, “iframe”, “noembed” and “noframes”, and optionally RAWTEXT element “noscript” in html.parser.HTMLParser. - gh-136063: email.message: ensure linear complexity for legacy HTTP parameters parsing. Patch by Bénédikt Tran. - gh-136065: Fix quadratic complexity in os.path.expandvars() (bsc#1252974, CVE-2025-6075). - gh-119451: Fix a potential memory denial of service in the http.client module. When connecting to a malicious server, it could cause an arbitrary amount of memory to be allocated. This could have led to symptoms including a MemoryError, swapping, out of memory (OOM) killed processes or containers, or even system crashes (CVE-2025-13836, bsc#1254400). - gh-119452: Fix a potential memory denial of service in the http.server module. When a malicious user is connected to the CGI server on Windows, it could cause an arbitrary amount of memory to be allocated. This could have led to symptoms including a MemoryError, swapping, out of memory (OOM) killed processes or containers, or even system crashes. - gh-119342: Fix a potential memory denial of service in the plistlib module. When reading a Plist file received from untrusted source, it could cause an arbitrary amount of memory to be allocated. This could have led to symptoms including a MemoryError, swapping, out of memory (OOM) killed processes or containers, or even system crashes (bsc#1254401, CVE-2025-13837). - Library - gh-144833: Fixed a use-after-free in ssl when SSL_new() returns NULL in newPySSLSocket(). The error was reported via a dangling pointer after the object had already been freed. - gh-144363: Update bundled libexpat to 2.7.4 - gh-90949: Add SetAllocTrackerActivationThreshold() and SetAllocTrackerMaximumAmplification() to xmlparser objects to prevent use of disproportional amounts of dynamic memory from within an Expat parser. Patch by Bénédikt Tran. - Core and Builtins - gh-120384: Fix an array out of bounds crash in list_ass_subscript, which could be invoked via some specificly tailored input: including concurrent modification of a list object, where one thread assigns a slice and another clears it. - gh-120298: Fix use-after free in list_richcompare_impl which can be invoked via some specificly tailored evil input. Remove upstreamed patches: - CVE-2025-11468-email-hdr-fold-comment.patch - CVE-2025-12084-minidom-quad-search.patch - CVE-2025-13836-http-resp-cont-len.patch - CVE-2025-13837-plistlib-mailicious-length.patch - CVE-2025-6075-expandvars-perf-degrad.patch - CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch - CVE-2026-0865-wsgiref-ctrl-chars.patch - CVE-2025-15282-urllib-ctrl-chars.patch ++++ libzypp: - specfile: on fedora use %{_prefix}/share as zyppconfdir if %{_distconfdir} is undefined (fixes #693) This will set '-DZYPPCONFDIR=%{zyppconfdir}' for cmake. - Fall back to a writable location when precaching packages without root (bsc#1247948) - version 17.38.3 (35) ++++ python311: - Update to 3.11.15: - Security - gh-144125: BytesGenerator will now refuse to serialize (write) headers that are unsafely folded or delimited; see verify_generated_headers. (Contributed by Bas Bloemsaat and Petr Viktorin in gh-121650) (bsc#1257181, CVE-2026-1299). - gh-143935: Fixed a bug in the folding of comments when flattening an email message using a modern email policy. Comments consisting of a very long sequence of non-foldable characters could trigger a forced line wrap that omitted the required leading space on the continuation line, causing the remainder of the comment to be interpreted as a new header field. This enabled header injection with carefully crafted inputs (bsc#1257029 CVE-2025-11468). - gh-143925: Reject control characters in data: URL media types (bsc#1257046, CVE-2025-15282). - gh-143919: Reject control characters in http.cookies.Morsel fields and values (bsc#1257031, CVE-2026-0672). - gh-143916: Reject C0 control characters within wsgiref.headers.Headers fields, values, and parameters (bsc#1257042, CVE-2026-0865). - gh-142145: Remove quadratic behavior in xml.minidom node ID cache clearing. In order to do this without breaking existing users, we also add the ownerDocument attribute to xml.dom.minidom elements and attributes created by directly instantiating the Element or Attr class. Note that this way of creating nodes is not supported; creator functions like xml.dom.Document.documentElement() should be used instead (bsc#1254997, CVE-2025-12084). - gh-137836: Add support of the “plaintext” element, RAWTEXT elements “xmp”, “iframe”, “noembed” and “noframes”, and optionally RAWTEXT element “noscript” in html.parser.HTMLParser. - gh-136063: email.message: ensure linear complexity for legacy HTTP parameters parsing. Patch by Bénédikt Tran. - gh-136065: Fix quadratic complexity in os.path.expandvars() (bsc#1252974, CVE-2025-6075). - gh-119451: Fix a potential memory denial of service in the http.client module. When connecting to a malicious server, it could cause an arbitrary amount of memory to be allocated. This could have led to symptoms including a MemoryError, swapping, out of memory (OOM) killed processes or containers, or even system crashes (CVE-2025-13836, bsc#1254400). - gh-119452: Fix a potential memory denial of service in the http.server module. When a malicious user is connected to the CGI server on Windows, it could cause an arbitrary amount of memory to be allocated. This could have led to symptoms including a MemoryError, swapping, out of memory (OOM) killed processes or containers, or even system crashes. - gh-119342: Fix a potential memory denial of service in the plistlib module. When reading a Plist file received from untrusted source, it could cause an arbitrary amount of memory to be allocated. This could have led to symptoms including a MemoryError, swapping, out of memory (OOM) killed processes or containers, or even system crashes (bsc#1254401, CVE-2025-13837). - Library - gh-144833: Fixed a use-after-free in ssl when SSL_new() returns NULL in newPySSLSocket(). The error was reported via a dangling pointer after the object had already been freed. - gh-144363: Update bundled libexpat to 2.7.4 - gh-90949: Add SetAllocTrackerActivationThreshold() and SetAllocTrackerMaximumAmplification() to xmlparser objects to prevent use of disproportional amounts of dynamic memory from within an Expat parser. Patch by Bénédikt Tran. - Core and Builtins - gh-120384: Fix an array out of bounds crash in list_ass_subscript, which could be invoked via some specificly tailored input: including concurrent modification of a list object, where one thread assigns a slice and another clears it. - gh-120298: Fix use-after free in list_richcompare_impl which can be invoked via some specificly tailored evil input. Remove upstreamed patches: - CVE-2025-11468-email-hdr-fold-comment.patch - CVE-2025-12084-minidom-quad-search.patch - CVE-2025-13836-http-resp-cont-len.patch - CVE-2025-13837-plistlib-mailicious-length.patch - CVE-2025-6075-expandvars-perf-degrad.patch - CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch - CVE-2026-0865-wsgiref-ctrl-chars.patch - CVE-2025-15282-urllib-ctrl-chars.patch ++++ zypper: - Report download progress for command line rpms (fixes #613) - Hint to '-vv ref' to see the mirrors used to download the metadata (bsc#1257882) - Service: Allow "zypper ls SERVICE ..." to test whether a service with this alias is defined (bsc#1252744) The command prints an abstract of all services passed on the command line. It returns 3-ZYPPER_EXIT_ERR_INVALID_ARGS if some argument does not name an existing service. - Keep repo data when updating the service settings (bsc#1252744) - info: Enhance pattern content table (bsc#1158038) Alternatives (multiple packages providing the same requirement) are now listed as a single entry in the content table. The entry shows either the installed package which satisfies the requirement or the requirement itself as type 'Provides'. Listing all potential alternatives was miss leading, especially if the alternatives were mutual exclusive. It looked like an installed pattern had not-installed requirements and it was not possible to install all requirements at the same time. - version 1.14.95 ------------------------------------------------------------------ ------------------ 2026-3-5 - Mar 5 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - ASoC: nau8821: Cancel pending work before suspend (git-fixes). - ASoC: nau8821: Cancel delayed work on component remove (git-fixes). - commit b862c94 - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (git-fixes). - thermal: int340x: Fix sysfs group leak on DLVR registration failure (stable-fixes). - watchdog: imx7ulp_wdt: handle the nowayout option (stable-fixes). - wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (stable-fixes). - wifi: rtw89: pci: restore LDO setting after device resume (stable-fixes). - wifi: iwlwifi: mvm: check the validity of noa_len (stable-fixes). - wifi: ath12k: fix preferred hardware mode calculation (stable-fixes). - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (stable-fixes). - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (stable-fixes). - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (stable-fixes). - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (stable-fixes). - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (stable-fixes). - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (stable-fixes). - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero (stable-fixes). - wifi: libertas: fix WARNING in usb_tx_block (stable-fixes). - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (stable-fixes). - spi: spi-mem: Limit octal DTR constraints to octal DTR situations (stable-fixes). - spi: stm32: fix Overrun issue at < 8bpw (stable-fixes). - spi-geni-qcom: initialize mode related registers to 0 (stable-fixes). - spi-geni-qcom: use xfer->bits_per_word for can_dma() (stable-fixes). - tools/power cpupower: Reset errno before strtoull() (stable-fixes). - spi: wpcm-fiu: Simplify with dev_err_probe() (stable-fixes). - commit 9ae9cd6 - PCI: Add defines for bridge window indexing (stable-fixes). - Refresh patches.suse/PCI-ACPI-Restrict-program_hpx_type2-to-AER-bits.patch. - commit 7f99d8e - PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros (stable-fixes). - Refresh patches.suse/PCI-ACPI-Restrict-program_hpx_type2-to-AER-bits.patch. - commit 8b1fafb - media: dvb-net: fix OOB access in ULE extension header tables (git-fixes). - rtc: zynqmp: correct frequency value (stable-fixes). - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (stable-fixes). - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (stable-fixes). - net: usb: catc: enable basic endpoint checking (git-fixes). - phy: mvebu-cp110-utmi: fix dr_mode property read from dts (stable-fixes). - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (stable-fixes). - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (stable-fixes). - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (stable-fixes). - serial: 8250_dw: handle clock enable errors in runtime_resume (stable-fixes). - staging: rtl8723bs: fix memory leak on failure path (stable-fixes). - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (stable-fixes). - iio: magnetometer: Remove IRQF_ONESHOT (stable-fixes). - iio: Use IRQF_NO_THREAD (stable-fixes). - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (git-fixes). - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (git-fixes). - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (stable-fixes). - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (stable-fixes). - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (git-fixes). - nfc: nxp-nci: remove interrupt trigger type (stable-fixes). - myri10ge: avoid uninitialized variable use (stable-fixes). - net: usb: sr9700: remove code to drive nonexistent multicast filter (stable-fixes). - net: usb: r8152: fix transmit queue timeout (stable-fixes). - PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port (stable-fixes). - PCI: Enable ACS after configuring IOMMU for OF platforms (stable-fixes). - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur (stable-fixes). - PCI: Fix pci_slot_lock () device locking (stable-fixes). - PCI: Mark Nvidia GB10 to avoid bus reset (stable-fixes). - PCI: Mark ASM1164 SATA controller to avoid bus reset (stable-fixes). - media: rkisp1: Fix filter mode register configuration (stable-fixes). - media: cx25821: Fix a resource leak in cx25821_dev_setup() (stable-fixes). - media: pvrusb2: fix URB leak in pvr2_send_request_ex (stable-fixes). - media: solo6x10: Check for out of bounds chip_id (stable-fixes). - media: adv7180: fix frame interval in progressive mode (stable-fixes). - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (stable-fixes). - media: omap3isp: isppreview: always clamp in preview_try_format() (stable-fixes). - media: omap3isp: set initial format (stable-fixes). - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (stable-fixes). - media: dvb-core: dmxdevfilter must always flush bufs (stable-fixes). - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (stable-fixes). - HID: multitouch: add eGalaxTouch EXC3188 support (stable-fixes). - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (stable-fixes). - HID: prodikeys: Check presence of pm->input_ep82 (stable-fixes). - HID: magicmouse: Do not crash on missing msc->input (stable-fixes). - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (stable-fixes). - hwmon: (f71882fg) Add F81968 support (stable-fixes). - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (stable-fixes). - gpio: aspeed-sgpio: Change the macro to support deferred probe (stable-fixes). - PCI/MSI: Unmap MSI-X region on error (stable-fixes). - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (stable-fixes). - spi: wpcm-fiu: Fix uninitialized res (git-fixes). - spi: wpcm-fiu: Use devm_platform_ioremap_resource_byname() (stable-fixes). - PCI: Log bridge info when first enumerating bridge (stable-fixes). - PCI: Log bridge windows conditionally (stable-fixes). - PCI: Supply bridge device, not secondary bus, to read window details (stable-fixes). - PCI: Move pci_read_bridge_windows() below individual window accessors (stable-fixes). - commit 291a680 - ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (stable-fixes). - drm/amdgpu: Add HAINAN clock adjustment (stable-fixes). - drm/radeon: Add HAINAN clock adjustment (stable-fixes). - drm/amdgpu: Adjust usleep_range in fence wait (stable-fixes). - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (git-fixes). - drm/amd/display: Avoid updating surface with the same surface under MPO (stable-fixes). - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (stable-fixes). - dma: dma-axi-dmac: fix SW cyclic transfers (git-fixes). - dmaengine: sun6i: Choose appropriate burst length under maxburst (stable-fixes). - fpga: of-fpga-region: Fail if any bridge is missing (stable-fixes). - fix it87_wdt early reboot by reporting running timer (stable-fixes). - fbdev: ffb: fix corrupted video output on Sun FFB1 (stable-fixes). - ata: libata: avoid long timeouts on hot-unplugged SATA DAS (stable-fixes). - Bluetooth: btusb: Add device ID for Realtek RTL8761BU (stable-fixes). - Bluetooth: btusb: Add new VID/PID for RTL8852CE (stable-fixes). - Bluetooth: hci_conn: Set link_policy on incoming ACL connections (stable-fixes). - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (stable-fixes). - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (stable-fixes). - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (stable-fixes). - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (stable-fixes). - drm: Account property blob allocations to memcg (stable-fixes). - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (stable-fixes). - drm/amdgpu: avoid a warning in timedout job handler (stable-fixes). - drm/amdgpu: add support for HDP IP version 6.1.1 (stable-fixes). - drm/v3d: Set DMA segment size to avoid debug warnings (stable-fixes). - drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (stable-fixes). - drm/display/dp_mst: Add protection against 0 vcpi (stable-fixes). - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (stable-fixes). - ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (stable-fixes). - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (stable-fixes). - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (stable-fixes). - ASoC: nau8821: Fixup nau8821_enable_jack_detect() (git-fixes). - char: tpm: cr50: Remove IRQF_ONESHOT (stable-fixes). - docs: fix WARNING document not included in any toctree (stable-fixes). - drm/amdkfd: fix debug watchpoints for logical devices (stable-fixes). - commit 0c8127e - ASoC: nau8821: Consistently clear interrupts before unmasking (git-fixes). - Refresh patches.suse/ASoC-nau8821-Add-DMI-quirk-to-bypass-jack-debounce-c.patch. - commit abf4286 - ALSA: usb-audio: Add sanity check for OOB writes at silencing (stable-fixes). - ALSA: usb-audio: Update the number of packets properly at receiving (stable-fixes). - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (stable-fixes). - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (stable-fixes). - APEI/GHES: ensure that won't go past CPER allocated record (stable-fixes). - ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (stable-fixes). - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (stable-fixes). - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (stable-fixes). - commit d3af28a - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (CVE-2026-23169 bsc#1258389). - commit fdf82e1 - net: fix segmentation of forwarding fraglist GRO (CVE-2026-23154 bsc#1258286). - commit fa03082 - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CVE-2025-71066 bsc#1256645). - commit bd83957 ++++ kernel-rt: - ASoC: nau8821: Cancel pending work before suspend (git-fixes). - ASoC: nau8821: Cancel delayed work on component remove (git-fixes). - commit b862c94 - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (git-fixes). - thermal: int340x: Fix sysfs group leak on DLVR registration failure (stable-fixes). - watchdog: imx7ulp_wdt: handle the nowayout option (stable-fixes). - wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (stable-fixes). - wifi: rtw89: pci: restore LDO setting after device resume (stable-fixes). - wifi: iwlwifi: mvm: check the validity of noa_len (stable-fixes). - wifi: ath12k: fix preferred hardware mode calculation (stable-fixes). - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (stable-fixes). - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (stable-fixes). - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (stable-fixes). - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (stable-fixes). - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (stable-fixes). - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (stable-fixes). - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero (stable-fixes). - wifi: libertas: fix WARNING in usb_tx_block (stable-fixes). - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (stable-fixes). - spi: spi-mem: Limit octal DTR constraints to octal DTR situations (stable-fixes). - spi: stm32: fix Overrun issue at < 8bpw (stable-fixes). - spi-geni-qcom: initialize mode related registers to 0 (stable-fixes). - spi-geni-qcom: use xfer->bits_per_word for can_dma() (stable-fixes). - tools/power cpupower: Reset errno before strtoull() (stable-fixes). - spi: wpcm-fiu: Simplify with dev_err_probe() (stable-fixes). - commit 9ae9cd6 - PCI: Add defines for bridge window indexing (stable-fixes). - Refresh patches.suse/PCI-ACPI-Restrict-program_hpx_type2-to-AER-bits.patch. - commit 7f99d8e - PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros (stable-fixes). - Refresh patches.suse/PCI-ACPI-Restrict-program_hpx_type2-to-AER-bits.patch. - commit 8b1fafb - media: dvb-net: fix OOB access in ULE extension header tables (git-fixes). - rtc: zynqmp: correct frequency value (stable-fixes). - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (stable-fixes). - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (stable-fixes). - net: usb: catc: enable basic endpoint checking (git-fixes). - phy: mvebu-cp110-utmi: fix dr_mode property read from dts (stable-fixes). - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (stable-fixes). - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (stable-fixes). - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (stable-fixes). - serial: 8250_dw: handle clock enable errors in runtime_resume (stable-fixes). - staging: rtl8723bs: fix memory leak on failure path (stable-fixes). - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (stable-fixes). - iio: magnetometer: Remove IRQF_ONESHOT (stable-fixes). - iio: Use IRQF_NO_THREAD (stable-fixes). - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (git-fixes). - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (git-fixes). - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (stable-fixes). - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (stable-fixes). - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (git-fixes). - nfc: nxp-nci: remove interrupt trigger type (stable-fixes). - myri10ge: avoid uninitialized variable use (stable-fixes). - net: usb: sr9700: remove code to drive nonexistent multicast filter (stable-fixes). - net: usb: r8152: fix transmit queue timeout (stable-fixes). - PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port (stable-fixes). - PCI: Enable ACS after configuring IOMMU for OF platforms (stable-fixes). - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur (stable-fixes). - PCI: Fix pci_slot_lock () device locking (stable-fixes). - PCI: Mark Nvidia GB10 to avoid bus reset (stable-fixes). - PCI: Mark ASM1164 SATA controller to avoid bus reset (stable-fixes). - media: rkisp1: Fix filter mode register configuration (stable-fixes). - media: cx25821: Fix a resource leak in cx25821_dev_setup() (stable-fixes). - media: pvrusb2: fix URB leak in pvr2_send_request_ex (stable-fixes). - media: solo6x10: Check for out of bounds chip_id (stable-fixes). - media: adv7180: fix frame interval in progressive mode (stable-fixes). - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (stable-fixes). - media: omap3isp: isppreview: always clamp in preview_try_format() (stable-fixes). - media: omap3isp: set initial format (stable-fixes). - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (stable-fixes). - media: dvb-core: dmxdevfilter must always flush bufs (stable-fixes). - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (stable-fixes). - HID: multitouch: add eGalaxTouch EXC3188 support (stable-fixes). - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (stable-fixes). - HID: prodikeys: Check presence of pm->input_ep82 (stable-fixes). - HID: magicmouse: Do not crash on missing msc->input (stable-fixes). - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (stable-fixes). - hwmon: (f71882fg) Add F81968 support (stable-fixes). - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (stable-fixes). - gpio: aspeed-sgpio: Change the macro to support deferred probe (stable-fixes). - PCI/MSI: Unmap MSI-X region on error (stable-fixes). - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (stable-fixes). - spi: wpcm-fiu: Fix uninitialized res (git-fixes). - spi: wpcm-fiu: Use devm_platform_ioremap_resource_byname() (stable-fixes). - PCI: Log bridge info when first enumerating bridge (stable-fixes). - PCI: Log bridge windows conditionally (stable-fixes). - PCI: Supply bridge device, not secondary bus, to read window details (stable-fixes). - PCI: Move pci_read_bridge_windows() below individual window accessors (stable-fixes). - commit 291a680 - ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (stable-fixes). - drm/amdgpu: Add HAINAN clock adjustment (stable-fixes). - drm/radeon: Add HAINAN clock adjustment (stable-fixes). - drm/amdgpu: Adjust usleep_range in fence wait (stable-fixes). - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (git-fixes). - drm/amd/display: Avoid updating surface with the same surface under MPO (stable-fixes). - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (stable-fixes). - dma: dma-axi-dmac: fix SW cyclic transfers (git-fixes). - dmaengine: sun6i: Choose appropriate burst length under maxburst (stable-fixes). - fpga: of-fpga-region: Fail if any bridge is missing (stable-fixes). - fix it87_wdt early reboot by reporting running timer (stable-fixes). - fbdev: ffb: fix corrupted video output on Sun FFB1 (stable-fixes). - ata: libata: avoid long timeouts on hot-unplugged SATA DAS (stable-fixes). - Bluetooth: btusb: Add device ID for Realtek RTL8761BU (stable-fixes). - Bluetooth: btusb: Add new VID/PID for RTL8852CE (stable-fixes). - Bluetooth: hci_conn: Set link_policy on incoming ACL connections (stable-fixes). - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (stable-fixes). - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (stable-fixes). - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (stable-fixes). - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (stable-fixes). - drm: Account property blob allocations to memcg (stable-fixes). - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (stable-fixes). - drm/amdgpu: avoid a warning in timedout job handler (stable-fixes). - drm/amdgpu: add support for HDP IP version 6.1.1 (stable-fixes). - drm/v3d: Set DMA segment size to avoid debug warnings (stable-fixes). - drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (stable-fixes). - drm/display/dp_mst: Add protection against 0 vcpi (stable-fixes). - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (stable-fixes). - ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (stable-fixes). - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (stable-fixes). - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (stable-fixes). - ASoC: nau8821: Fixup nau8821_enable_jack_detect() (git-fixes). - char: tpm: cr50: Remove IRQF_ONESHOT (stable-fixes). - docs: fix WARNING document not included in any toctree (stable-fixes). - drm/amdkfd: fix debug watchpoints for logical devices (stable-fixes). - commit 0c8127e - ASoC: nau8821: Consistently clear interrupts before unmasking (git-fixes). - Refresh patches.suse/ASoC-nau8821-Add-DMI-quirk-to-bypass-jack-debounce-c.patch. - commit abf4286 - ALSA: usb-audio: Add sanity check for OOB writes at silencing (stable-fixes). - ALSA: usb-audio: Update the number of packets properly at receiving (stable-fixes). - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (stable-fixes). - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (stable-fixes). - APEI/GHES: ensure that won't go past CPER allocated record (stable-fixes). - ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (stable-fixes). - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (stable-fixes). - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (stable-fixes). - commit d3af28a - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (CVE-2026-23169 bsc#1258389). - commit fdf82e1 - net: fix segmentation of forwarding fraglist GRO (CVE-2026-23154 bsc#1258286). - commit fa03082 - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CVE-2025-71066 bsc#1256645). - commit bd83957 ++++ kernel-rt_debug: - ASoC: nau8821: Cancel pending work before suspend (git-fixes). - ASoC: nau8821: Cancel delayed work on component remove (git-fixes). - commit b862c94 - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (git-fixes). - thermal: int340x: Fix sysfs group leak on DLVR registration failure (stable-fixes). - watchdog: imx7ulp_wdt: handle the nowayout option (stable-fixes). - wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (stable-fixes). - wifi: rtw89: pci: restore LDO setting after device resume (stable-fixes). - wifi: iwlwifi: mvm: check the validity of noa_len (stable-fixes). - wifi: ath12k: fix preferred hardware mode calculation (stable-fixes). - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (stable-fixes). - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (stable-fixes). - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (stable-fixes). - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (stable-fixes). - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (stable-fixes). - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (stable-fixes). - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero (stable-fixes). - wifi: libertas: fix WARNING in usb_tx_block (stable-fixes). - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (stable-fixes). - spi: spi-mem: Limit octal DTR constraints to octal DTR situations (stable-fixes). - spi: stm32: fix Overrun issue at < 8bpw (stable-fixes). - spi-geni-qcom: initialize mode related registers to 0 (stable-fixes). - spi-geni-qcom: use xfer->bits_per_word for can_dma() (stable-fixes). - tools/power cpupower: Reset errno before strtoull() (stable-fixes). - spi: wpcm-fiu: Simplify with dev_err_probe() (stable-fixes). - commit 9ae9cd6 - PCI: Add defines for bridge window indexing (stable-fixes). - Refresh patches.suse/PCI-ACPI-Restrict-program_hpx_type2-to-AER-bits.patch. - commit 7f99d8e - PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros (stable-fixes). - Refresh patches.suse/PCI-ACPI-Restrict-program_hpx_type2-to-AER-bits.patch. - commit 8b1fafb - media: dvb-net: fix OOB access in ULE extension header tables (git-fixes). - rtc: zynqmp: correct frequency value (stable-fixes). - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (stable-fixes). - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (stable-fixes). - net: usb: catc: enable basic endpoint checking (git-fixes). - phy: mvebu-cp110-utmi: fix dr_mode property read from dts (stable-fixes). - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (stable-fixes). - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (stable-fixes). - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (stable-fixes). - serial: 8250_dw: handle clock enable errors in runtime_resume (stable-fixes). - staging: rtl8723bs: fix memory leak on failure path (stable-fixes). - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (stable-fixes). - iio: magnetometer: Remove IRQF_ONESHOT (stable-fixes). - iio: Use IRQF_NO_THREAD (stable-fixes). - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (git-fixes). - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (git-fixes). - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (stable-fixes). - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (stable-fixes). - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (git-fixes). - nfc: nxp-nci: remove interrupt trigger type (stable-fixes). - myri10ge: avoid uninitialized variable use (stable-fixes). - net: usb: sr9700: remove code to drive nonexistent multicast filter (stable-fixes). - net: usb: r8152: fix transmit queue timeout (stable-fixes). - PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port (stable-fixes). - PCI: Enable ACS after configuring IOMMU for OF platforms (stable-fixes). - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur (stable-fixes). - PCI: Fix pci_slot_lock () device locking (stable-fixes). - PCI: Mark Nvidia GB10 to avoid bus reset (stable-fixes). - PCI: Mark ASM1164 SATA controller to avoid bus reset (stable-fixes). - media: rkisp1: Fix filter mode register configuration (stable-fixes). - media: cx25821: Fix a resource leak in cx25821_dev_setup() (stable-fixes). - media: pvrusb2: fix URB leak in pvr2_send_request_ex (stable-fixes). - media: solo6x10: Check for out of bounds chip_id (stable-fixes). - media: adv7180: fix frame interval in progressive mode (stable-fixes). - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (stable-fixes). - media: omap3isp: isppreview: always clamp in preview_try_format() (stable-fixes). - media: omap3isp: set initial format (stable-fixes). - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (stable-fixes). - media: dvb-core: dmxdevfilter must always flush bufs (stable-fixes). - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (stable-fixes). - HID: multitouch: add eGalaxTouch EXC3188 support (stable-fixes). - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (stable-fixes). - HID: prodikeys: Check presence of pm->input_ep82 (stable-fixes). - HID: magicmouse: Do not crash on missing msc->input (stable-fixes). - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (stable-fixes). - hwmon: (f71882fg) Add F81968 support (stable-fixes). - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (stable-fixes). - gpio: aspeed-sgpio: Change the macro to support deferred probe (stable-fixes). - PCI/MSI: Unmap MSI-X region on error (stable-fixes). - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (stable-fixes). - spi: wpcm-fiu: Fix uninitialized res (git-fixes). - spi: wpcm-fiu: Use devm_platform_ioremap_resource_byname() (stable-fixes). - PCI: Log bridge info when first enumerating bridge (stable-fixes). - PCI: Log bridge windows conditionally (stable-fixes). - PCI: Supply bridge device, not secondary bus, to read window details (stable-fixes). - PCI: Move pci_read_bridge_windows() below individual window accessors (stable-fixes). - commit 291a680 - ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (stable-fixes). - drm/amdgpu: Add HAINAN clock adjustment (stable-fixes). - drm/radeon: Add HAINAN clock adjustment (stable-fixes). - drm/amdgpu: Adjust usleep_range in fence wait (stable-fixes). - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (git-fixes). - drm/amd/display: Avoid updating surface with the same surface under MPO (stable-fixes). - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (stable-fixes). - dma: dma-axi-dmac: fix SW cyclic transfers (git-fixes). - dmaengine: sun6i: Choose appropriate burst length under maxburst (stable-fixes). - fpga: of-fpga-region: Fail if any bridge is missing (stable-fixes). - fix it87_wdt early reboot by reporting running timer (stable-fixes). - fbdev: ffb: fix corrupted video output on Sun FFB1 (stable-fixes). - ata: libata: avoid long timeouts on hot-unplugged SATA DAS (stable-fixes). - Bluetooth: btusb: Add device ID for Realtek RTL8761BU (stable-fixes). - Bluetooth: btusb: Add new VID/PID for RTL8852CE (stable-fixes). - Bluetooth: hci_conn: Set link_policy on incoming ACL connections (stable-fixes). - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (stable-fixes). - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (stable-fixes). - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (stable-fixes). - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (stable-fixes). - drm: Account property blob allocations to memcg (stable-fixes). - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (stable-fixes). - drm/amdgpu: avoid a warning in timedout job handler (stable-fixes). - drm/amdgpu: add support for HDP IP version 6.1.1 (stable-fixes). - drm/v3d: Set DMA segment size to avoid debug warnings (stable-fixes). - drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (stable-fixes). - drm/display/dp_mst: Add protection against 0 vcpi (stable-fixes). - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (stable-fixes). - ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (stable-fixes). - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (stable-fixes). - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (stable-fixes). - ASoC: nau8821: Fixup nau8821_enable_jack_detect() (git-fixes). - char: tpm: cr50: Remove IRQF_ONESHOT (stable-fixes). - docs: fix WARNING document not included in any toctree (stable-fixes). - drm/amdkfd: fix debug watchpoints for logical devices (stable-fixes). - commit 0c8127e - ASoC: nau8821: Consistently clear interrupts before unmasking (git-fixes). - Refresh patches.suse/ASoC-nau8821-Add-DMI-quirk-to-bypass-jack-debounce-c.patch. - commit abf4286 - ALSA: usb-audio: Add sanity check for OOB writes at silencing (stable-fixes). - ALSA: usb-audio: Update the number of packets properly at receiving (stable-fixes). - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (stable-fixes). - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (stable-fixes). - APEI/GHES: ensure that won't go past CPER allocated record (stable-fixes). - ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (stable-fixes). - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (stable-fixes). - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (stable-fixes). - commit d3af28a - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (CVE-2026-23169 bsc#1258389). - commit fdf82e1 - net: fix segmentation of forwarding fraglist GRO (CVE-2026-23154 bsc#1258286). - commit fa03082 - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CVE-2025-71066 bsc#1256645). - commit bd83957 ++++ libsoup: - Update libsoup-CVE-2026-0716.patch to incorporate glgo#GNOME/libsoup!518. The original fix was incomplete (bsc#1256418 CVE-2026-0716 glgo#GNOME/libsoup#476). ++++ nvidia-open-driver-G06-signed: - adjusted logic for %suse_version bump with SLE16.1 Beta2 (jsc#PED-15826) ------------------------------------------------------------------ ------------------ 2026-3-4 - Mar 4 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - vsock/virtio: fix potential underflow in virtio_transport_get_credit() (bsc#1257755, CVE-2026-23069). - Refresh patches.suse/vsock-virtio-cap-TX-credit-to-local-buffer-size.patch. - commit aab63d9 - net/sched: cls_u32: use skb_header_pointer_careful() (CVE-2026-23204 bsc#1258340). In addition backport 13e00fdc9236b which introduces skb_header_pointer_careful() helper which is required. - commit 926e136 ++++ kernel-rt: - vsock/virtio: fix potential underflow in virtio_transport_get_credit() (bsc#1257755, CVE-2026-23069). - Refresh patches.suse/vsock-virtio-cap-TX-credit-to-local-buffer-size.patch. - commit aab63d9 - net/sched: cls_u32: use skb_header_pointer_careful() (CVE-2026-23204 bsc#1258340). In addition backport 13e00fdc9236b which introduces skb_header_pointer_careful() helper which is required. - commit 926e136 ++++ kernel-rt_debug: - vsock/virtio: fix potential underflow in virtio_transport_get_credit() (bsc#1257755, CVE-2026-23069). - Refresh patches.suse/vsock-virtio-cap-TX-credit-to-local-buffer-size.patch. - commit aab63d9 - net/sched: cls_u32: use skb_header_pointer_careful() (CVE-2026-23204 bsc#1258340). In addition backport 13e00fdc9236b which introduces skb_header_pointer_careful() helper which is required. - commit 926e136 ++++ salt: - Make syntax in httputil_test compatible with Python 3.6 - Fix KeyError in postgres module with PostgreSQL 17 (bsc#1254325) - Use internal deb classes instead of external aptsource lib - Speed up wheel key.finger call (bsc#1240532) - Backport security patches for Salt vendored tornado: * CVE-2025-67724: missing validation of supplied reason phrase (bsc#1254903) * CVE-2025-67725: fix DoS via malicious HTTP request (bsc#1254905) * CVE-2025-67726: fix HTTP header parameter parsing algorithm (bsc#1254904) - Simplify and speed up utils.find_json function (bsc#1246130) - Extend warn_until period to 2027 - Added: * fix-tornado-s-httputil_test-syntax-for-python-3.6.patch * backport-add-maintain-m-privilege-to-postgres-module.patch * use-internal-salt.utils.pkg.deb-classes-instead-of-a.patch * speedup-wheel-key.finger-call-bsc-1240532-713.patch * fixes-for-security-issues-cve-2025-13836-cve-2025-67.patch * simplify-utils.json.find_json-function.patch * extend-fails-to-warnings-until-2027-742.patch ++++ suseconnect-ng: - Regressions found during QA test runs: - Ignore product in announce call (bsc#1257490) - Registration to SMT server with failed (bsc#1257625) - Backported by PATCH: fix-libsuseconnect-and-pci.patch ++++ tar: - Add tar-fix-deletion-from-archive.patch * Fixes tar creating invalid tarballs when used with --delete (bsc#1246607) * Add makeinfo build requirement, needed after the addition of the patch ++++ vim: * Update Vim to version 9.2.0045 (from 9.1.1629). * Fix bsc#1258229 CVE-2026-26269 as 9.2.0045 is not impacted (fixed upstream). * Fix bsc#1246602 CVE-2025-53906 as 9.2.0045 is not impacted (fixed upstream). * Drop obsolete or upstreamed patches: - vim-7.3-filetype_spec.patch - vim-7.4-filetype_apparmor.patch - vim-8.2.2411-globalvimrc.patch * Refresh the following patches: - vim-7.3-filetype_changes.patch - vim-7.3-filetype_ftl.patch - vim-7.3-sh_is_bash.patch - vim-9.1.1134-revert-putty-terminal-colors.patch * Remove autoconf from BuildRequires and drop the autoconf call in %build. * Package new Swedish (sv) man pages and clean up duplicate encodings (sv.ISO8859-1 and sv.UTF-8) during %install. ------------------------------------------------------------------ ------------------ 2026-3-3 - Mar 3 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - cifs: add xid to query server interface call (git-fixes). - Refresh patches.suse/cifs-handle-when-server-starts-supporting-multichannel.patch. - Refresh patches.suse/cifs-make-sure-server-interfaces-are-requested-only-for-SMB3-.patch (bsc#1258928,bsc#1259070). - Refresh patches.suse/cifs-do-not-disable-interface-polling-on-failure.patch. - Refresh patches.suse/cifs-add-xid-to-query-server-interface-call.patch. - commit e67e831 - iommu/mediatek: fix use-after-free on probe deferral (CVE-2025-71071 bsc#1256802). - commit 0b777d9 - bpf: Forget ranges when refining tnum after JSET (CVE-2025-39748 bsc#1249587). - commit 9bb0920 - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (bsc#1249998 CVE-2025-39817). - commit ccf2d31 ++++ kernel-rt: - cifs: add xid to query server interface call (git-fixes). - Refresh patches.suse/cifs-handle-when-server-starts-supporting-multichannel.patch. - Refresh patches.suse/cifs-make-sure-server-interfaces-are-requested-only-for-SMB3-.patch (bsc#1258928,bsc#1259070). - Refresh patches.suse/cifs-do-not-disable-interface-polling-on-failure.patch. - Refresh patches.suse/cifs-add-xid-to-query-server-interface-call.patch. - commit e67e831 - iommu/mediatek: fix use-after-free on probe deferral (CVE-2025-71071 bsc#1256802). - commit 0b777d9 - bpf: Forget ranges when refining tnum after JSET (CVE-2025-39748 bsc#1249587). - commit 9bb0920 - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (bsc#1249998 CVE-2025-39817). - commit ccf2d31 ++++ kernel-rt_debug: - cifs: add xid to query server interface call (git-fixes). - Refresh patches.suse/cifs-handle-when-server-starts-supporting-multichannel.patch. - Refresh patches.suse/cifs-make-sure-server-interfaces-are-requested-only-for-SMB3-.patch (bsc#1258928,bsc#1259070). - Refresh patches.suse/cifs-do-not-disable-interface-polling-on-failure.patch. - Refresh patches.suse/cifs-add-xid-to-query-server-interface-call.patch. - commit e67e831 - iommu/mediatek: fix use-after-free on probe deferral (CVE-2025-71071 bsc#1256802). - commit 0b777d9 - bpf: Forget ranges when refining tnum after JSET (CVE-2025-39748 bsc#1249587). - commit 9bb0920 - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (bsc#1249998 CVE-2025-39817). - commit ccf2d31 ++++ freetype2: - update to 2.14.2 - Important changes * Several changes related to LCD filtering are implemented to achieve better performance and encourage sound practices. + Instead of blanket LCD filtering over the entire bitmap, it is now applied only to non-zero spans using direct rendering. This speeds up the ClearType-like rendering by more than 40% at sizes above 32 ppem. + Setting the filter weights with FT_Face_Properties is no longer supported. The default and light filters are optimized to work with any face. + The legacy libXft LCD filter algorithm is no longer provided. - Important bug fixes * A bunch of potential security problems have been found (bsc#1259118, CVE-2026-23865). All users should update. * The italic angle in `PS_FontInfo` is now stored as a fixed-point value in degrees for all Type 1 fonts and their derivatives, consistent with CFF fonts and common practices. The broken underline position and thickness values are fixed for CFF fonts. - Miscellaneous * The `x` field in the `FT_Span` structure is now unsigned. * Demo program `ftgrid` got an option `-m` to select a start character to display. * Similarly, demo program `ftmulti` got an option `-m` to select a text string for rendering. * Option `-d` in the demo program `ttdebug` is now called `-a`, expecting a comma-separated list of axis values. The user interface is also slightly improved. * The `ftinspect` demo program can now be compiled with Qt6, too. ------------------------------------------------------------------ ------------------ 2026-3-2 - Mar 2 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (CVE-2026-23113 bsc#1258278). - commit 2e91927 - libceph: replace BUG_ON with bounds check for map->max_osd (CVE-2025-68283 bsc#1255379). - commit 1c35b41 - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (CVE-2026-23179 bsc#1258394). - commit 63de389 - btrfs: don't log conflicting inode if it's a dir moved in the current transaction (bsc#1256683 CVE-2025-68778). - commit 0cd8ff8 - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (CVE-2026-23112 bsc#1258184). - commit e38d2c3 - landlock: Fix handling of disconnected directories (CVE-2025-68736 bsc#1255698). - commit cdf3815 - landlock: Optimize file path walks and prepare for audit support (bsc#1255698). - commit 5db1b51 - pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (CVE-2026-23116 bsc#1258277). - commit 1905ad8 - Add bugnumber to existing mana change (bsc#1251971). - scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT (git-fixes). - commit 425b20d - bonding: fix use-after-free due to enslave fail after slave array update (CVE-2026-23171 bsc#1258349). - bonding: provide a net pointer to __skb_flow_dissect() (CVE-2026-23119 bsc#1258273). - fou: Don't allow 0 for FOU_ATTR_IPPROTO (CVE-2026-23083 bsc#1257745). - bonding: limit BOND_MODE_8023AD to Ethernet devices (CVE-2026-23099 bsc#1257816). - net: bonding: update the slave array for broadcast mode (CVE-2026-23171 bsc#1258349). - commit d461cd4 - Update patches.suse/btrfs-do-not-strictly-require-dirty-metadata-thresho.patch (stable-fixes CVE-2026-23157 bsc#1258376). - Update patches.suse/msft-hv-3440-net-hv_netvsc-reject-RSS-hash-key-programming-withou.patch (bsc#1257473 CVE-2026-23054 bsc#1257732). - Update patches.suse/spi-tegra210-quad-Protect-curr_xfer-check-in-IRQ-handler.patch (bsc#1257952 CVE-2026-23207 bsc#1258524). - Update patches.suse/spi-tegra210-quad-Protect-curr_xfer-in-tegra_qspi_combined.patch (bsc#1257952 CVE-2026-23202 bsc#1258338). - commit 9f4fee7 - Update patches.suse/ALSA-ac97-fix-a-double-free-in-snd_ac97_controller_r.patch (git-fixes CVE-2025-71192 bsc#1257679). - Update patches.suse/ALSA-ctxfi-Fix-potential-OOB-access-in-audio-mixer-h.patch (stable-fixes CVE-2026-23076 bsc#1257788). - Update patches.suse/ALSA-scarlett2-Fix-buffer-overflow-in-config-retriev.patch (git-fixes CVE-2026-23078 bsc#1257789). - Update patches.suse/ASoC-amd-fix-memory-leak-in-acp3x-pdm-dma-ops.patch (git-fixes CVE-2026-23190 bsc#1258397). - Update patches.suse/Bluetooth-MGMT-Fix-memory-leak-in-set_ssp_complete.patch (git-fixes CVE-2026-23151 bsc#1258237). - Update patches.suse/Bluetooth-hci_uart-fix-null-ptr-deref-in-hci_uart_wr.patch (git-fixes CVE-2026-23146 bsc#1258234). - Update patches.suse/HID-i2c-hid-fix-potential-buffer-overflow-in-i2c_hid.patch (stable-fixes CVE-2026-23178 bsc#1258358). - Update patches.suse/bus-fsl-mc-fix-use-after-free-in-driver_override_sho.patch (git-fixes CVE-2026-23221 bsc#1258660). - Update patches.suse/can-ems_usb-ems_usb_read_bulk_callback-fix-URB-memor.patch (git-fixes CVE-2026-23058 bsc#1257739). - Update patches.suse/can-etas_es58x-allow-partial-RX-URB-allocation-to-su.patch (git-fixes CVE-2026-23037 bsc#1257554). - Update patches.suse/can-gs_usb-gs_usb_receive_bulk_callback-fix-error-me.patch (git-fixes CVE-2026-23155 bsc#1258313). - Update patches.suse/can-gs_usb-gs_usb_receive_bulk_callback-unanchor-URL.patch (git-fixes CVE-2026-23082 bsc#1257715). - Update patches.suse/can-j1939-make-j1939_session_activate-fail-if-device.patch (stable-fixes CVE-2025-71182 bsc#1257586). - Update patches.suse/can-kvaser_usb-kvaser_usb_read_bulk_callback-fix-URB.patch (git-fixes CVE-2026-23061 bsc#1257776). - Update patches.suse/can-mcba_usb-mcba_usb_read_bulk_callback-fix-URB-mem.patch (git-fixes CVE-2026-23080 bsc#1257714). - Update patches.suse/can-usb_8dev-usb_8dev_read_bulk_callback-fix-URB-mem.patch (git-fixes CVE-2026-23108 bsc#1257770). - Update patches.suse/crypto-iaa-Fix-out-of-bounds-index-in-find_empty_iaa.patch (git-fixes CVE-2025-71231 bsc#1258424). - Update patches.suse/crypto-omap-Allocate-OMAP_CRYPTO_FORCE_COPY-scatterl.patch (git-fixes CVE-2026-23222 bsc#1258484). - Update patches.suse/crypto-virtio-Add-spinlock-protection-with-virtqueue.patch (git-fixes CVE-2026-23229 bsc#1258429). - Update patches.suse/dmaengine-at_hdmac-fix-device-leak-on-of_dma_xlate.patch (git-fixes CVE-2025-71191 bsc#1257579). - Update patches.suse/dmaengine-bcm-sba-raid-fix-device-leak-on-probe.patch (git-fixes CVE-2025-71190 bsc#1257580). - Update patches.suse/dmaengine-dw-dmamux-fix-OF-node-leak-on-route-alloca.patch (git-fixes CVE-2025-71189 bsc#1257573). - Update patches.suse/dmaengine-lpc18xx-dmamux-fix-device-leak-on-route-al.patch (git-fixes CVE-2025-71188 bsc#1257576). - Update patches.suse/dmaengine-omap-dma-fix-dma_pool-resource-leak-in-err.patch (git-fixes CVE-2026-23033 bsc#1257570). - Update patches.suse/dmaengine-qcom-gpi-Fix-memory-leak-in-gpi_peripheral.patch (git-fixes CVE-2026-23026 bsc#1257562). - Update patches.suse/dmaengine-ti-dma-crossbar-fix-device-leak-on-am335x-.patch (git-fixes CVE-2025-71185 bsc#1257560). - Update patches.suse/dmaengine-xilinx-xdma-Fix-regmap-max_register.patch (git-fixes CVE-2025-71195 bsc#1257704). - Update patches.suse/dpll-Prevent-duplicate-registrations.patch (git-fixes CVE-2026-23129 bsc#1258299). - Update patches.suse/drm-amdgpu-fix-NULL-pointer-dereference-in-amdgpu_gm.patch (git-fixes CVE-2026-23163 bsc#1258544). - Update patches.suse/drm-imx-tve-fix-probe-device-leak.patch (git-fixes CVE-2026-23170 bsc#1258379). - Update patches.suse/drm-panel-simple-fix-connector-type-for-DataImage-SC.patch (git-fixes CVE-2026-23049 bsc#1257723). - Update patches.suse/efivarfs-fix-error-propagation-in-efivar_entry_get.patch (git-fixes CVE-2026-23156 bsc#1258317). - Update patches.suse/ext4-fix-iloc.bh-leak-in-ext4_xattr_inode_update_ref.patch (git-fixes CVE-2026-23145 bsc#1258326). - Update patches.suse/iio-adc-at91-sama5d2_adc-Fix-potential-use-after-fre.patch (git-fixes CVE-2025-71199 bsc#1257750). - Update patches.suse/iio-imu-st_lsm6dsx-fix-iio_chan_spec-for-sensors-wit.patch (git-fixes CVE-2025-71198 bsc#1257741). - Update patches.suse/intel_th-fix-device-leak-on-output-open.patch (git-fixes CVE-2026-23091 bsc#1257813). - Update patches.suse/leds-led-class-Only-Add-LED-to-leds_list-when-it-is-.patch (git-fixes CVE-2026-23101 bsc#1257768). - Update patches.suse/mISDN-annotate-data-race-around-dev-work.patch (git-fixes CVE-2026-23121 bsc#1258309). - Update patches.suse/mmc-sdhci-of-dwcmshc-Prevent-illegal-clock-reduction.patch (git-fixes CVE-2025-71200 bsc#1258222). - Update patches.suse/net-usb-pegasus-fix-memory-leak-in-update_eth_regs_a.patch (git-fixes CVE-2026-23021 bsc#1257557). - Update patches.suse/net-wwan-t7xx-fix-potential-skb-frags-overflow-in-RX.patch (git-fixes CVE-2026-23172 bsc#1258519). - Update patches.suse/nfc-llcp-Fix-memleak-in-nfc_llcp_send_ui_frame.patch (git-fixes CVE-2026-23150 bsc#1258354). - Update patches.suse/nfc-nci-Fix-race-between-rfkill-and-nci_unregister_d.patch (git-fixes CVE-2026-23167 bsc#1258374). - Update patches.suse/phy-stm32-usphyc-Fix-off-by-one-in-probe.patch (git-fixes CVE-2025-71196 bsc#1257716). - Update patches.suse/platform-x86-toshiba_haps-Fix-memory-leaks-in-add-re.patch (git-fixes CVE-2026-23176 bsc#1258256). - Update patches.suse/regmap-Fix-race-condition-in-hwspinlock-irqsave-rout.patch (git-fixes CVE-2026-23071 bsc#1257706). - Update patches.suse/scsi-qla2xxx-Delay-module-unload-while-fabric-scan-i.patch (bsc#1256863 CVE-2025-71235 bsc#1258469). - Update patches.suse/scsi-qla2xxx-Free-sp-in-error-path-to-fix-system-cra.patch (bsc#1256863 CVE-2025-71232 bsc#1258422). - Update patches.suse/scsi-qla2xxx-Validate-sp-before-freeing-associated-m.patch (bsc#1256863 CVE-2025-71236 bsc#1258442). - Update patches.suse/slimbus-core-fix-device-reference-leak-on-report-pre.patch (git-fixes CVE-2026-23090 bsc#1257759). - Update patches.suse/spi-spi-sprd-adi-Fix-double-free-in-probe-error-path.patch (git-fixes CVE-2026-23068 bsc#1257805). - Update patches.suse/spi-tegra-Fix-a-memory-leak-in-tegra_slink_probe.patch (git-fixes CVE-2026-23182 bsc#1258259). - Update patches.suse/spi-tegra210-quad-Protect-curr_xfer-check-in-IRQ-han.patch (git-fixes bsc#1257952 CVE-2026-23207 bsc#1258524). - Update patches.suse/spi-tegra210-quad-Protect-curr_xfer-in-tegra_qspi_co.patch (git-fixes bsc#1257952 CVE-2026-23202 bsc#1258338). - Update patches.suse/uacce-ensure-safe-queue-release-with-state-managemen.patch (git-fixes CVE-2026-23063 bsc#1257722). - Update patches.suse/uacce-fix-cdev-handling-in-the-cleanup-path.patch (git-fixes CVE-2026-23096 bsc#1257809). - Update patches.suse/uacce-fix-isolate-sysfs-check-condition.patch (git-fixes CVE-2026-23094 bsc#1257811). - Update patches.suse/uacce-implement-mremap-in-uacce_vm_ops-to-return-EPE.patch (git-fixes CVE-2026-23056 bsc#1257729). - Update patches.suse/w1-therm-Fix-off-by-one-buffer-overflow-in-alarms_st.patch (git-fixes CVE-2025-71197 bsc#1257743). - Update patches.suse/wifi-ath10k-fix-dma_free_coherent-pointer.patch (git-fixes CVE-2026-23133 bsc#1258249). - Update patches.suse/wifi-ath12k-fix-dma_free_coherent-pointer.patch (git-fixes CVE-2026-23135 bsc#1258245). - Update patches.suse/wifi-mac80211-correctly-decode-TTLM-with-default-lin.patch (git-fixes CVE-2026-23152 bsc#1258252). - Update patches.suse/wifi-mac80211-ocb-skip-rx_no_sta-when-interface-is-n.patch (stable-fixes CVE-2025-71224 bsc#1258824). - Update patches.suse/wifi-rsi-Fix-memory-corruption-due-to-not-set-vif-dr.patch (git-fixes CVE-2026-23073 bsc#1257707). - Update patches.suse/wifi-rtl8xxxu-fix-slab-out-of-bounds-in-rtl8xxxu_sta.patch (git-fixes CVE-2025-71234 bsc#1258419). - Update patches.suse/wifi-rtw88-Fix-alignment-fault-in-rtw_core_enable_be.patch (git-fixes CVE-2025-71229 bsc#1258415). - Update patches.suse/wifi-wlcore-ensure-skb-headroom-before-skb_push.patch (stable-fixes CVE-2025-71222 bsc#1258279). - commit 30080c1 - smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924, CVE-2025-40103). - commit 2028384 - cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911, CVE-2025-40099). - commit 821259f - Refresh patches.suse/smb-client-split-cached_fid-bitfields-to-avoid-shared-byte-RMW-rac.patch. - commit 1325cd1 - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CVE-2026-23166 bsc#1258272). - net/mlx5e: TC, delete flows only for existing peers (CVE-2026-23173 bsc#1258520). - commit 1315a36 ++++ kernel-rt: - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (CVE-2026-23113 bsc#1258278). - commit 2e91927 - libceph: replace BUG_ON with bounds check for map->max_osd (CVE-2025-68283 bsc#1255379). - commit 1c35b41 - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (CVE-2026-23179 bsc#1258394). - commit 63de389 - btrfs: don't log conflicting inode if it's a dir moved in the current transaction (bsc#1256683 CVE-2025-68778). - commit 0cd8ff8 - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (CVE-2026-23112 bsc#1258184). - commit e38d2c3 - landlock: Fix handling of disconnected directories (CVE-2025-68736 bsc#1255698). - commit cdf3815 - landlock: Optimize file path walks and prepare for audit support (bsc#1255698). - commit 5db1b51 - pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (CVE-2026-23116 bsc#1258277). - commit 1905ad8 - Add bugnumber to existing mana change (bsc#1251971). - scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT (git-fixes). - commit 425b20d - bonding: fix use-after-free due to enslave fail after slave array update (CVE-2026-23171 bsc#1258349). - bonding: provide a net pointer to __skb_flow_dissect() (CVE-2026-23119 bsc#1258273). - fou: Don't allow 0 for FOU_ATTR_IPPROTO (CVE-2026-23083 bsc#1257745). - bonding: limit BOND_MODE_8023AD to Ethernet devices (CVE-2026-23099 bsc#1257816). - net: bonding: update the slave array for broadcast mode (CVE-2026-23171 bsc#1258349). - commit d461cd4 - Update patches.suse/btrfs-do-not-strictly-require-dirty-metadata-thresho.patch (stable-fixes CVE-2026-23157 bsc#1258376). - Update patches.suse/msft-hv-3440-net-hv_netvsc-reject-RSS-hash-key-programming-withou.patch (bsc#1257473 CVE-2026-23054 bsc#1257732). - Update patches.suse/spi-tegra210-quad-Protect-curr_xfer-check-in-IRQ-handler.patch (bsc#1257952 CVE-2026-23207 bsc#1258524). - Update patches.suse/spi-tegra210-quad-Protect-curr_xfer-in-tegra_qspi_combined.patch (bsc#1257952 CVE-2026-23202 bsc#1258338). - commit 9f4fee7 - Update patches.suse/ALSA-ac97-fix-a-double-free-in-snd_ac97_controller_r.patch (git-fixes CVE-2025-71192 bsc#1257679). - Update patches.suse/ALSA-ctxfi-Fix-potential-OOB-access-in-audio-mixer-h.patch (stable-fixes CVE-2026-23076 bsc#1257788). - Update patches.suse/ALSA-scarlett2-Fix-buffer-overflow-in-config-retriev.patch (git-fixes CVE-2026-23078 bsc#1257789). - Update patches.suse/ASoC-amd-fix-memory-leak-in-acp3x-pdm-dma-ops.patch (git-fixes CVE-2026-23190 bsc#1258397). - Update patches.suse/Bluetooth-MGMT-Fix-memory-leak-in-set_ssp_complete.patch (git-fixes CVE-2026-23151 bsc#1258237). - Update patches.suse/Bluetooth-hci_uart-fix-null-ptr-deref-in-hci_uart_wr.patch (git-fixes CVE-2026-23146 bsc#1258234). - Update patches.suse/HID-i2c-hid-fix-potential-buffer-overflow-in-i2c_hid.patch (stable-fixes CVE-2026-23178 bsc#1258358). - Update patches.suse/bus-fsl-mc-fix-use-after-free-in-driver_override_sho.patch (git-fixes CVE-2026-23221 bsc#1258660). - Update patches.suse/can-ems_usb-ems_usb_read_bulk_callback-fix-URB-memor.patch (git-fixes CVE-2026-23058 bsc#1257739). - Update patches.suse/can-etas_es58x-allow-partial-RX-URB-allocation-to-su.patch (git-fixes CVE-2026-23037 bsc#1257554). - Update patches.suse/can-gs_usb-gs_usb_receive_bulk_callback-fix-error-me.patch (git-fixes CVE-2026-23155 bsc#1258313). - Update patches.suse/can-gs_usb-gs_usb_receive_bulk_callback-unanchor-URL.patch (git-fixes CVE-2026-23082 bsc#1257715). - Update patches.suse/can-j1939-make-j1939_session_activate-fail-if-device.patch (stable-fixes CVE-2025-71182 bsc#1257586). - Update patches.suse/can-kvaser_usb-kvaser_usb_read_bulk_callback-fix-URB.patch (git-fixes CVE-2026-23061 bsc#1257776). - Update patches.suse/can-mcba_usb-mcba_usb_read_bulk_callback-fix-URB-mem.patch (git-fixes CVE-2026-23080 bsc#1257714). - Update patches.suse/can-usb_8dev-usb_8dev_read_bulk_callback-fix-URB-mem.patch (git-fixes CVE-2026-23108 bsc#1257770). - Update patches.suse/crypto-iaa-Fix-out-of-bounds-index-in-find_empty_iaa.patch (git-fixes CVE-2025-71231 bsc#1258424). - Update patches.suse/crypto-omap-Allocate-OMAP_CRYPTO_FORCE_COPY-scatterl.patch (git-fixes CVE-2026-23222 bsc#1258484). - Update patches.suse/crypto-virtio-Add-spinlock-protection-with-virtqueue.patch (git-fixes CVE-2026-23229 bsc#1258429). - Update patches.suse/dmaengine-at_hdmac-fix-device-leak-on-of_dma_xlate.patch (git-fixes CVE-2025-71191 bsc#1257579). - Update patches.suse/dmaengine-bcm-sba-raid-fix-device-leak-on-probe.patch (git-fixes CVE-2025-71190 bsc#1257580). - Update patches.suse/dmaengine-dw-dmamux-fix-OF-node-leak-on-route-alloca.patch (git-fixes CVE-2025-71189 bsc#1257573). - Update patches.suse/dmaengine-lpc18xx-dmamux-fix-device-leak-on-route-al.patch (git-fixes CVE-2025-71188 bsc#1257576). - Update patches.suse/dmaengine-omap-dma-fix-dma_pool-resource-leak-in-err.patch (git-fixes CVE-2026-23033 bsc#1257570). - Update patches.suse/dmaengine-qcom-gpi-Fix-memory-leak-in-gpi_peripheral.patch (git-fixes CVE-2026-23026 bsc#1257562). - Update patches.suse/dmaengine-ti-dma-crossbar-fix-device-leak-on-am335x-.patch (git-fixes CVE-2025-71185 bsc#1257560). - Update patches.suse/dmaengine-xilinx-xdma-Fix-regmap-max_register.patch (git-fixes CVE-2025-71195 bsc#1257704). - Update patches.suse/dpll-Prevent-duplicate-registrations.patch (git-fixes CVE-2026-23129 bsc#1258299). - Update patches.suse/drm-amdgpu-fix-NULL-pointer-dereference-in-amdgpu_gm.patch (git-fixes CVE-2026-23163 bsc#1258544). - Update patches.suse/drm-imx-tve-fix-probe-device-leak.patch (git-fixes CVE-2026-23170 bsc#1258379). - Update patches.suse/drm-panel-simple-fix-connector-type-for-DataImage-SC.patch (git-fixes CVE-2026-23049 bsc#1257723). - Update patches.suse/efivarfs-fix-error-propagation-in-efivar_entry_get.patch (git-fixes CVE-2026-23156 bsc#1258317). - Update patches.suse/ext4-fix-iloc.bh-leak-in-ext4_xattr_inode_update_ref.patch (git-fixes CVE-2026-23145 bsc#1258326). - Update patches.suse/iio-adc-at91-sama5d2_adc-Fix-potential-use-after-fre.patch (git-fixes CVE-2025-71199 bsc#1257750). - Update patches.suse/iio-imu-st_lsm6dsx-fix-iio_chan_spec-for-sensors-wit.patch (git-fixes CVE-2025-71198 bsc#1257741). - Update patches.suse/intel_th-fix-device-leak-on-output-open.patch (git-fixes CVE-2026-23091 bsc#1257813). - Update patches.suse/leds-led-class-Only-Add-LED-to-leds_list-when-it-is-.patch (git-fixes CVE-2026-23101 bsc#1257768). - Update patches.suse/mISDN-annotate-data-race-around-dev-work.patch (git-fixes CVE-2026-23121 bsc#1258309). - Update patches.suse/mmc-sdhci-of-dwcmshc-Prevent-illegal-clock-reduction.patch (git-fixes CVE-2025-71200 bsc#1258222). - Update patches.suse/net-usb-pegasus-fix-memory-leak-in-update_eth_regs_a.patch (git-fixes CVE-2026-23021 bsc#1257557). - Update patches.suse/net-wwan-t7xx-fix-potential-skb-frags-overflow-in-RX.patch (git-fixes CVE-2026-23172 bsc#1258519). - Update patches.suse/nfc-llcp-Fix-memleak-in-nfc_llcp_send_ui_frame.patch (git-fixes CVE-2026-23150 bsc#1258354). - Update patches.suse/nfc-nci-Fix-race-between-rfkill-and-nci_unregister_d.patch (git-fixes CVE-2026-23167 bsc#1258374). - Update patches.suse/phy-stm32-usphyc-Fix-off-by-one-in-probe.patch (git-fixes CVE-2025-71196 bsc#1257716). - Update patches.suse/platform-x86-toshiba_haps-Fix-memory-leaks-in-add-re.patch (git-fixes CVE-2026-23176 bsc#1258256). - Update patches.suse/regmap-Fix-race-condition-in-hwspinlock-irqsave-rout.patch (git-fixes CVE-2026-23071 bsc#1257706). - Update patches.suse/scsi-qla2xxx-Delay-module-unload-while-fabric-scan-i.patch (bsc#1256863 CVE-2025-71235 bsc#1258469). - Update patches.suse/scsi-qla2xxx-Free-sp-in-error-path-to-fix-system-cra.patch (bsc#1256863 CVE-2025-71232 bsc#1258422). - Update patches.suse/scsi-qla2xxx-Validate-sp-before-freeing-associated-m.patch (bsc#1256863 CVE-2025-71236 bsc#1258442). - Update patches.suse/slimbus-core-fix-device-reference-leak-on-report-pre.patch (git-fixes CVE-2026-23090 bsc#1257759). - Update patches.suse/spi-spi-sprd-adi-Fix-double-free-in-probe-error-path.patch (git-fixes CVE-2026-23068 bsc#1257805). - Update patches.suse/spi-tegra-Fix-a-memory-leak-in-tegra_slink_probe.patch (git-fixes CVE-2026-23182 bsc#1258259). - Update patches.suse/spi-tegra210-quad-Protect-curr_xfer-check-in-IRQ-han.patch (git-fixes bsc#1257952 CVE-2026-23207 bsc#1258524). - Update patches.suse/spi-tegra210-quad-Protect-curr_xfer-in-tegra_qspi_co.patch (git-fixes bsc#1257952 CVE-2026-23202 bsc#1258338). - Update patches.suse/uacce-ensure-safe-queue-release-with-state-managemen.patch (git-fixes CVE-2026-23063 bsc#1257722). - Update patches.suse/uacce-fix-cdev-handling-in-the-cleanup-path.patch (git-fixes CVE-2026-23096 bsc#1257809). - Update patches.suse/uacce-fix-isolate-sysfs-check-condition.patch (git-fixes CVE-2026-23094 bsc#1257811). - Update patches.suse/uacce-implement-mremap-in-uacce_vm_ops-to-return-EPE.patch (git-fixes CVE-2026-23056 bsc#1257729). - Update patches.suse/w1-therm-Fix-off-by-one-buffer-overflow-in-alarms_st.patch (git-fixes CVE-2025-71197 bsc#1257743). - Update patches.suse/wifi-ath10k-fix-dma_free_coherent-pointer.patch (git-fixes CVE-2026-23133 bsc#1258249). - Update patches.suse/wifi-ath12k-fix-dma_free_coherent-pointer.patch (git-fixes CVE-2026-23135 bsc#1258245). - Update patches.suse/wifi-mac80211-correctly-decode-TTLM-with-default-lin.patch (git-fixes CVE-2026-23152 bsc#1258252). - Update patches.suse/wifi-mac80211-ocb-skip-rx_no_sta-when-interface-is-n.patch (stable-fixes CVE-2025-71224 bsc#1258824). - Update patches.suse/wifi-rsi-Fix-memory-corruption-due-to-not-set-vif-dr.patch (git-fixes CVE-2026-23073 bsc#1257707). - Update patches.suse/wifi-rtl8xxxu-fix-slab-out-of-bounds-in-rtl8xxxu_sta.patch (git-fixes CVE-2025-71234 bsc#1258419). - Update patches.suse/wifi-rtw88-Fix-alignment-fault-in-rtw_core_enable_be.patch (git-fixes CVE-2025-71229 bsc#1258415). - Update patches.suse/wifi-wlcore-ensure-skb-headroom-before-skb_push.patch (stable-fixes CVE-2025-71222 bsc#1258279). - commit 30080c1 - smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924, CVE-2025-40103). - commit 2028384 - cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911, CVE-2025-40099). - commit 821259f - Refresh patches.suse/smb-client-split-cached_fid-bitfields-to-avoid-shared-byte-RMW-rac.patch. - commit 1325cd1 - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CVE-2026-23166 bsc#1258272). - net/mlx5e: TC, delete flows only for existing peers (CVE-2026-23173 bsc#1258520). - commit 1315a36 ++++ kernel-rt_debug: - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (CVE-2026-23113 bsc#1258278). - commit 2e91927 - libceph: replace BUG_ON with bounds check for map->max_osd (CVE-2025-68283 bsc#1255379). - commit 1c35b41 - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (CVE-2026-23179 bsc#1258394). - commit 63de389 - btrfs: don't log conflicting inode if it's a dir moved in the current transaction (bsc#1256683 CVE-2025-68778). - commit 0cd8ff8 - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (CVE-2026-23112 bsc#1258184). - commit e38d2c3 - landlock: Fix handling of disconnected directories (CVE-2025-68736 bsc#1255698). - commit cdf3815 - landlock: Optimize file path walks and prepare for audit support (bsc#1255698). - commit 5db1b51 - pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (CVE-2026-23116 bsc#1258277). - commit 1905ad8 - Add bugnumber to existing mana change (bsc#1251971). - scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT (git-fixes). - commit 425b20d - bonding: fix use-after-free due to enslave fail after slave array update (CVE-2026-23171 bsc#1258349). - bonding: provide a net pointer to __skb_flow_dissect() (CVE-2026-23119 bsc#1258273). - fou: Don't allow 0 for FOU_ATTR_IPPROTO (CVE-2026-23083 bsc#1257745). - bonding: limit BOND_MODE_8023AD to Ethernet devices (CVE-2026-23099 bsc#1257816). - net: bonding: update the slave array for broadcast mode (CVE-2026-23171 bsc#1258349). - commit d461cd4 - Update patches.suse/btrfs-do-not-strictly-require-dirty-metadata-thresho.patch (stable-fixes CVE-2026-23157 bsc#1258376). - Update patches.suse/msft-hv-3440-net-hv_netvsc-reject-RSS-hash-key-programming-withou.patch (bsc#1257473 CVE-2026-23054 bsc#1257732). - Update patches.suse/spi-tegra210-quad-Protect-curr_xfer-check-in-IRQ-handler.patch (bsc#1257952 CVE-2026-23207 bsc#1258524). - Update patches.suse/spi-tegra210-quad-Protect-curr_xfer-in-tegra_qspi_combined.patch (bsc#1257952 CVE-2026-23202 bsc#1258338). - commit 9f4fee7 - Update patches.suse/ALSA-ac97-fix-a-double-free-in-snd_ac97_controller_r.patch (git-fixes CVE-2025-71192 bsc#1257679). - Update patches.suse/ALSA-ctxfi-Fix-potential-OOB-access-in-audio-mixer-h.patch (stable-fixes CVE-2026-23076 bsc#1257788). - Update patches.suse/ALSA-scarlett2-Fix-buffer-overflow-in-config-retriev.patch (git-fixes CVE-2026-23078 bsc#1257789). - Update patches.suse/ASoC-amd-fix-memory-leak-in-acp3x-pdm-dma-ops.patch (git-fixes CVE-2026-23190 bsc#1258397). - Update patches.suse/Bluetooth-MGMT-Fix-memory-leak-in-set_ssp_complete.patch (git-fixes CVE-2026-23151 bsc#1258237). - Update patches.suse/Bluetooth-hci_uart-fix-null-ptr-deref-in-hci_uart_wr.patch (git-fixes CVE-2026-23146 bsc#1258234). - Update patches.suse/HID-i2c-hid-fix-potential-buffer-overflow-in-i2c_hid.patch (stable-fixes CVE-2026-23178 bsc#1258358). - Update patches.suse/bus-fsl-mc-fix-use-after-free-in-driver_override_sho.patch (git-fixes CVE-2026-23221 bsc#1258660). - Update patches.suse/can-ems_usb-ems_usb_read_bulk_callback-fix-URB-memor.patch (git-fixes CVE-2026-23058 bsc#1257739). - Update patches.suse/can-etas_es58x-allow-partial-RX-URB-allocation-to-su.patch (git-fixes CVE-2026-23037 bsc#1257554). - Update patches.suse/can-gs_usb-gs_usb_receive_bulk_callback-fix-error-me.patch (git-fixes CVE-2026-23155 bsc#1258313). - Update patches.suse/can-gs_usb-gs_usb_receive_bulk_callback-unanchor-URL.patch (git-fixes CVE-2026-23082 bsc#1257715). - Update patches.suse/can-j1939-make-j1939_session_activate-fail-if-device.patch (stable-fixes CVE-2025-71182 bsc#1257586). - Update patches.suse/can-kvaser_usb-kvaser_usb_read_bulk_callback-fix-URB.patch (git-fixes CVE-2026-23061 bsc#1257776). - Update patches.suse/can-mcba_usb-mcba_usb_read_bulk_callback-fix-URB-mem.patch (git-fixes CVE-2026-23080 bsc#1257714). - Update patches.suse/can-usb_8dev-usb_8dev_read_bulk_callback-fix-URB-mem.patch (git-fixes CVE-2026-23108 bsc#1257770). - Update patches.suse/crypto-iaa-Fix-out-of-bounds-index-in-find_empty_iaa.patch (git-fixes CVE-2025-71231 bsc#1258424). - Update patches.suse/crypto-omap-Allocate-OMAP_CRYPTO_FORCE_COPY-scatterl.patch (git-fixes CVE-2026-23222 bsc#1258484). - Update patches.suse/crypto-virtio-Add-spinlock-protection-with-virtqueue.patch (git-fixes CVE-2026-23229 bsc#1258429). - Update patches.suse/dmaengine-at_hdmac-fix-device-leak-on-of_dma_xlate.patch (git-fixes CVE-2025-71191 bsc#1257579). - Update patches.suse/dmaengine-bcm-sba-raid-fix-device-leak-on-probe.patch (git-fixes CVE-2025-71190 bsc#1257580). - Update patches.suse/dmaengine-dw-dmamux-fix-OF-node-leak-on-route-alloca.patch (git-fixes CVE-2025-71189 bsc#1257573). - Update patches.suse/dmaengine-lpc18xx-dmamux-fix-device-leak-on-route-al.patch (git-fixes CVE-2025-71188 bsc#1257576). - Update patches.suse/dmaengine-omap-dma-fix-dma_pool-resource-leak-in-err.patch (git-fixes CVE-2026-23033 bsc#1257570). - Update patches.suse/dmaengine-qcom-gpi-Fix-memory-leak-in-gpi_peripheral.patch (git-fixes CVE-2026-23026 bsc#1257562). - Update patches.suse/dmaengine-ti-dma-crossbar-fix-device-leak-on-am335x-.patch (git-fixes CVE-2025-71185 bsc#1257560). - Update patches.suse/dmaengine-xilinx-xdma-Fix-regmap-max_register.patch (git-fixes CVE-2025-71195 bsc#1257704). - Update patches.suse/dpll-Prevent-duplicate-registrations.patch (git-fixes CVE-2026-23129 bsc#1258299). - Update patches.suse/drm-amdgpu-fix-NULL-pointer-dereference-in-amdgpu_gm.patch (git-fixes CVE-2026-23163 bsc#1258544). - Update patches.suse/drm-imx-tve-fix-probe-device-leak.patch (git-fixes CVE-2026-23170 bsc#1258379). - Update patches.suse/drm-panel-simple-fix-connector-type-for-DataImage-SC.patch (git-fixes CVE-2026-23049 bsc#1257723). - Update patches.suse/efivarfs-fix-error-propagation-in-efivar_entry_get.patch (git-fixes CVE-2026-23156 bsc#1258317). - Update patches.suse/ext4-fix-iloc.bh-leak-in-ext4_xattr_inode_update_ref.patch (git-fixes CVE-2026-23145 bsc#1258326). - Update patches.suse/iio-adc-at91-sama5d2_adc-Fix-potential-use-after-fre.patch (git-fixes CVE-2025-71199 bsc#1257750). - Update patches.suse/iio-imu-st_lsm6dsx-fix-iio_chan_spec-for-sensors-wit.patch (git-fixes CVE-2025-71198 bsc#1257741). - Update patches.suse/intel_th-fix-device-leak-on-output-open.patch (git-fixes CVE-2026-23091 bsc#1257813). - Update patches.suse/leds-led-class-Only-Add-LED-to-leds_list-when-it-is-.patch (git-fixes CVE-2026-23101 bsc#1257768). - Update patches.suse/mISDN-annotate-data-race-around-dev-work.patch (git-fixes CVE-2026-23121 bsc#1258309). - Update patches.suse/mmc-sdhci-of-dwcmshc-Prevent-illegal-clock-reduction.patch (git-fixes CVE-2025-71200 bsc#1258222). - Update patches.suse/net-usb-pegasus-fix-memory-leak-in-update_eth_regs_a.patch (git-fixes CVE-2026-23021 bsc#1257557). - Update patches.suse/net-wwan-t7xx-fix-potential-skb-frags-overflow-in-RX.patch (git-fixes CVE-2026-23172 bsc#1258519). - Update patches.suse/nfc-llcp-Fix-memleak-in-nfc_llcp_send_ui_frame.patch (git-fixes CVE-2026-23150 bsc#1258354). - Update patches.suse/nfc-nci-Fix-race-between-rfkill-and-nci_unregister_d.patch (git-fixes CVE-2026-23167 bsc#1258374). - Update patches.suse/phy-stm32-usphyc-Fix-off-by-one-in-probe.patch (git-fixes CVE-2025-71196 bsc#1257716). - Update patches.suse/platform-x86-toshiba_haps-Fix-memory-leaks-in-add-re.patch (git-fixes CVE-2026-23176 bsc#1258256). - Update patches.suse/regmap-Fix-race-condition-in-hwspinlock-irqsave-rout.patch (git-fixes CVE-2026-23071 bsc#1257706). - Update patches.suse/scsi-qla2xxx-Delay-module-unload-while-fabric-scan-i.patch (bsc#1256863 CVE-2025-71235 bsc#1258469). - Update patches.suse/scsi-qla2xxx-Free-sp-in-error-path-to-fix-system-cra.patch (bsc#1256863 CVE-2025-71232 bsc#1258422). - Update patches.suse/scsi-qla2xxx-Validate-sp-before-freeing-associated-m.patch (bsc#1256863 CVE-2025-71236 bsc#1258442). - Update patches.suse/slimbus-core-fix-device-reference-leak-on-report-pre.patch (git-fixes CVE-2026-23090 bsc#1257759). - Update patches.suse/spi-spi-sprd-adi-Fix-double-free-in-probe-error-path.patch (git-fixes CVE-2026-23068 bsc#1257805). - Update patches.suse/spi-tegra-Fix-a-memory-leak-in-tegra_slink_probe.patch (git-fixes CVE-2026-23182 bsc#1258259). - Update patches.suse/spi-tegra210-quad-Protect-curr_xfer-check-in-IRQ-han.patch (git-fixes bsc#1257952 CVE-2026-23207 bsc#1258524). - Update patches.suse/spi-tegra210-quad-Protect-curr_xfer-in-tegra_qspi_co.patch (git-fixes bsc#1257952 CVE-2026-23202 bsc#1258338). - Update patches.suse/uacce-ensure-safe-queue-release-with-state-managemen.patch (git-fixes CVE-2026-23063 bsc#1257722). - Update patches.suse/uacce-fix-cdev-handling-in-the-cleanup-path.patch (git-fixes CVE-2026-23096 bsc#1257809). - Update patches.suse/uacce-fix-isolate-sysfs-check-condition.patch (git-fixes CVE-2026-23094 bsc#1257811). - Update patches.suse/uacce-implement-mremap-in-uacce_vm_ops-to-return-EPE.patch (git-fixes CVE-2026-23056 bsc#1257729). - Update patches.suse/w1-therm-Fix-off-by-one-buffer-overflow-in-alarms_st.patch (git-fixes CVE-2025-71197 bsc#1257743). - Update patches.suse/wifi-ath10k-fix-dma_free_coherent-pointer.patch (git-fixes CVE-2026-23133 bsc#1258249). - Update patches.suse/wifi-ath12k-fix-dma_free_coherent-pointer.patch (git-fixes CVE-2026-23135 bsc#1258245). - Update patches.suse/wifi-mac80211-correctly-decode-TTLM-with-default-lin.patch (git-fixes CVE-2026-23152 bsc#1258252). - Update patches.suse/wifi-mac80211-ocb-skip-rx_no_sta-when-interface-is-n.patch (stable-fixes CVE-2025-71224 bsc#1258824). - Update patches.suse/wifi-rsi-Fix-memory-corruption-due-to-not-set-vif-dr.patch (git-fixes CVE-2026-23073 bsc#1257707). - Update patches.suse/wifi-rtl8xxxu-fix-slab-out-of-bounds-in-rtl8xxxu_sta.patch (git-fixes CVE-2025-71234 bsc#1258419). - Update patches.suse/wifi-rtw88-Fix-alignment-fault-in-rtw_core_enable_be.patch (git-fixes CVE-2025-71229 bsc#1258415). - Update patches.suse/wifi-wlcore-ensure-skb-headroom-before-skb_push.patch (stable-fixes CVE-2025-71222 bsc#1258279). - commit 30080c1 - smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924, CVE-2025-40103). - commit 2028384 - cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911, CVE-2025-40099). - commit 821259f - Refresh patches.suse/smb-client-split-cached_fid-bitfields-to-avoid-shared-byte-RMW-rac.patch. - commit 1325cd1 - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CVE-2026-23166 bsc#1258272). - net/mlx5e: TC, delete flows only for existing peers (CVE-2026-23173 bsc#1258520). - commit 1315a36 ++++ openssh: - Add openssh-7.7p1-gssapi-new-unique.patch (bsc#1258166). This allows using SSSD with a non-file backend. ++++ virtiofsd: - Add CVE-2026-25727.patch: Avoid denial of service when parsing Rfc2822(bsc#1257912 CVE-2026-25727). ------------------------------------------------------------------ ------------------ 2026-3-1 - Mar 1 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - device property: Allow secondary lookup in fwnode_get_next_child_node() (git-fixes). - commit 13b0bcb ++++ kernel-rt: - device property: Allow secondary lookup in fwnode_get_next_child_node() (git-fixes). - commit 13b0bcb ++++ kernel-rt_debug: - device property: Allow secondary lookup in fwnode_get_next_child_node() (git-fixes). - commit 13b0bcb ++++ util-linux-systemd: - Use full hostname for PAM to ensure correct access control for "login -h" (bsc#1258859, CVE-2026-3184, util-linux-CVE-2026-3184.patch). ++++ util-linux: - Use full hostname for PAM to ensure correct access control for "login -h" (bsc#1258859, CVE-2026-3184, util-linux-CVE-2026-3184.patch). ------------------------------------------------------------------ ------------------ 2026-2-28 - Feb 28 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 (stable-fixes). - ALSA: usb-audio: Check max frame size for implicit feedback mode, too (stable-fixes). - commit 94dd673 - PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value (git-fixes). - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() (git-fixes). - ALSA: usb-audio: Use correct version for UAC3 header validation (git-fixes). - ALSA: usb-audio: Use inclusive terms (git-fixes). - ALSA: usb-audio: Cap the packet size pre-calculations (git-fixes). - ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices (git-fixes). - drm/bridge: samsung-dsim: Fix memory leak in error path (git-fixes). - drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used (git-fixes). - drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse() (git-fixes). - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions (git-fixes). - drm/vmwgfx: Fix invalid kref_put callback in vmw_bo_dirty_release (git-fixes). - commit b1fa310 ++++ kernel-rt: - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 (stable-fixes). - ALSA: usb-audio: Check max frame size for implicit feedback mode, too (stable-fixes). - commit 94dd673 - PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value (git-fixes). - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() (git-fixes). - ALSA: usb-audio: Use correct version for UAC3 header validation (git-fixes). - ALSA: usb-audio: Use inclusive terms (git-fixes). - ALSA: usb-audio: Cap the packet size pre-calculations (git-fixes). - ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices (git-fixes). - drm/bridge: samsung-dsim: Fix memory leak in error path (git-fixes). - drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used (git-fixes). - drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse() (git-fixes). - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions (git-fixes). - drm/vmwgfx: Fix invalid kref_put callback in vmw_bo_dirty_release (git-fixes). - commit b1fa310 ++++ kernel-rt_debug: - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 (stable-fixes). - ALSA: usb-audio: Check max frame size for implicit feedback mode, too (stable-fixes). - commit 94dd673 - PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value (git-fixes). - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() (git-fixes). - ALSA: usb-audio: Use correct version for UAC3 header validation (git-fixes). - ALSA: usb-audio: Use inclusive terms (git-fixes). - ALSA: usb-audio: Cap the packet size pre-calculations (git-fixes). - ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices (git-fixes). - drm/bridge: samsung-dsim: Fix memory leak in error path (git-fixes). - drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used (git-fixes). - drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse() (git-fixes). - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions (git-fixes). - drm/vmwgfx: Fix invalid kref_put callback in vmw_bo_dirty_release (git-fixes). - commit b1fa310 ------------------------------------------------------------------ ------------------ 2026-2-27 - Feb 27 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - scsi: core: Wake up the error handler when final completions race against each other (CVE-2026-23110 bsc#1257761). - commit 59f5efa - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (CVE-2026-23004 bsc#1257231). - commit 3cd007f - btrfs: fix NULL dereference on root when tracing inode eviction (bsc#1257635 CVE-2025-71184). - commit 5bf422c - netfilter: nf_conncount: update last_gc only when GC has been performed (CVE-2026-23139 bsc#1258304). - commit 9a70b26 - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CVE-2026-23111 bsc#1258181). - commit 56db8af - ipmi: ipmb: initialise event handler read bytes (git-fixes). - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() (git-fixes). - wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration (git-fixes). - wifi: radiotap: reject radiotap with unknown bits (git-fixes). - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() (git-fixes). - wifi: cfg80211: wext: fix IGTK key ID off-by-one (git-fixes). - net: usb: kaweth: validate USB endpoints (git-fixes). - net: usb: kalmia: validate USB endpoints (git-fixes). - nfc: pn533: properly drop the usb interface reference on disconnect (git-fixes). - Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (git-fixes). - Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (git-fixes). - Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (git-fixes). - Bluetooth: hci_qca: Cleanup on all setup failures (git-fixes). - Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (git-fixes). - net: usb: pegasus: enable basic endpoint checking (git-fixes). - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (git-fixes). - net: usb: lan78xx: scan all MDIO addresses on LAN7801 (git-fixes). - net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (git-fixes). - commit d2c7de0 ++++ kernel-rt: - scsi: core: Wake up the error handler when final completions race against each other (CVE-2026-23110 bsc#1257761). - commit 59f5efa - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (CVE-2026-23004 bsc#1257231). - commit 3cd007f - btrfs: fix NULL dereference on root when tracing inode eviction (bsc#1257635 CVE-2025-71184). - commit 5bf422c - netfilter: nf_conncount: update last_gc only when GC has been performed (CVE-2026-23139 bsc#1258304). - commit 9a70b26 - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CVE-2026-23111 bsc#1258181). - commit 56db8af - ipmi: ipmb: initialise event handler read bytes (git-fixes). - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() (git-fixes). - wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration (git-fixes). - wifi: radiotap: reject radiotap with unknown bits (git-fixes). - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() (git-fixes). - wifi: cfg80211: wext: fix IGTK key ID off-by-one (git-fixes). - net: usb: kaweth: validate USB endpoints (git-fixes). - net: usb: kalmia: validate USB endpoints (git-fixes). - nfc: pn533: properly drop the usb interface reference on disconnect (git-fixes). - Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (git-fixes). - Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (git-fixes). - Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (git-fixes). - Bluetooth: hci_qca: Cleanup on all setup failures (git-fixes). - Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (git-fixes). - net: usb: pegasus: enable basic endpoint checking (git-fixes). - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (git-fixes). - net: usb: lan78xx: scan all MDIO addresses on LAN7801 (git-fixes). - net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (git-fixes). - commit d2c7de0 ++++ kernel-rt_debug: - scsi: core: Wake up the error handler when final completions race against each other (CVE-2026-23110 bsc#1257761). - commit 59f5efa - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (CVE-2026-23004 bsc#1257231). - commit 3cd007f - btrfs: fix NULL dereference on root when tracing inode eviction (bsc#1257635 CVE-2025-71184). - commit 5bf422c - netfilter: nf_conncount: update last_gc only when GC has been performed (CVE-2026-23139 bsc#1258304). - commit 9a70b26 - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CVE-2026-23111 bsc#1258181). - commit 56db8af - ipmi: ipmb: initialise event handler read bytes (git-fixes). - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() (git-fixes). - wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration (git-fixes). - wifi: radiotap: reject radiotap with unknown bits (git-fixes). - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() (git-fixes). - wifi: cfg80211: wext: fix IGTK key ID off-by-one (git-fixes). - net: usb: kaweth: validate USB endpoints (git-fixes). - net: usb: kalmia: validate USB endpoints (git-fixes). - nfc: pn533: properly drop the usb interface reference on disconnect (git-fixes). - Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (git-fixes). - Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (git-fixes). - Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (git-fixes). - Bluetooth: hci_qca: Cleanup on all setup failures (git-fixes). - Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (git-fixes). - net: usb: pegasus: enable basic endpoint checking (git-fixes). - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (git-fixes). - net: usb: lan78xx: scan all MDIO addresses on LAN7801 (git-fixes). - net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (git-fixes). - commit d2c7de0 ++++ systemd: - Import commit aef6e11921f8c46a2b7ee8cfab024c9c641d74d8 aef6e11921 core/cgroup: avoid one unnecessary strjoina() cc7426f38a sd-json: fix off-by-one issue when updating parent for array elements 26a748f727 core: validate input cgroup path more prudently (bsc#1259418 CVE-2026-29111) 99d8308fde core/dbus-manager: propagate meaningful dbus errors from EnqueueMarkedJobs ------------------------------------------------------------------ ------------------ 2026-2-26 - Feb 26 2026 ------------------- ------------------------------------------------------------------ ++++ python-kiwi: - Fix spec file for SLFO 1.1 target glibc-gconv-modules-extra does not exist in SLFO 1.1 ++++ kernel-default: - btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (bsc#1257687 CVE-2025-71194). - commit 2e0cb69 - drm/amdgpu: ensure no_hw_access is visible before MMIO (CVE-2026-23213 bsc#1258465). - commit bec3979 - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (CVE-2026-23213 bsc#1258465). - commit 3b81ead - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen (git-fixes). - commit ba51966 ++++ kernel-rt: - btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (bsc#1257687 CVE-2025-71194). - commit 2e0cb69 - drm/amdgpu: ensure no_hw_access is visible before MMIO (CVE-2026-23213 bsc#1258465). - commit bec3979 - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (CVE-2026-23213 bsc#1258465). - commit 3b81ead - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen (git-fixes). - commit ba51966 ++++ kernel-rt_debug: - btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (bsc#1257687 CVE-2025-71194). - commit 2e0cb69 - drm/amdgpu: ensure no_hw_access is visible before MMIO (CVE-2026-23213 bsc#1258465). - commit bec3979 - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (CVE-2026-23213 bsc#1258465). - commit 3b81ead - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen (git-fixes). - commit ba51966 ++++ nvidia-open-driver-G06-signed: - updated CUDA variant to version 580.126.20 - supersedes kernel-6.19.patch ------------------------------------------------------------------ ------------------ 2026-2-25 - Feb 25 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - NFS: Fix a deadlock involving nfs_release_folio() (CVE-2026-23053 bsc#1257718). - commit 492ba43 - KVM: Don't clobber irqfd routing type when deassigning irqfd (CVE-2026-23198 bsc#1258321). - commit e973f50 - KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (CVE-2025-68810 bsc#1256679). - commit a9c2c12 ++++ kernel-rt: - NFS: Fix a deadlock involving nfs_release_folio() (CVE-2026-23053 bsc#1257718). - commit 492ba43 - KVM: Don't clobber irqfd routing type when deassigning irqfd (CVE-2026-23198 bsc#1258321). - commit e973f50 - KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (CVE-2025-68810 bsc#1256679). - commit a9c2c12 ++++ kernel-rt_debug: - NFS: Fix a deadlock involving nfs_release_folio() (CVE-2026-23053 bsc#1257718). - commit 492ba43 - KVM: Don't clobber irqfd routing type when deassigning irqfd (CVE-2026-23198 bsc#1258321). - commit e973f50 - KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (CVE-2025-68810 bsc#1256679). - commit a9c2c12 ++++ libsoup: - Add libsoup-CVE-2026-1760.patch: server: close the connection after responsing a request containing... (bsc#1257597, CVE-2026-1760, glgo#GNOME/libsoup#475). - Add libsoup-CVE-2026-1467.patch: uri-utils: do host validation when checking if a GUri is valid (bsc#1257398, CVE-2026-1467, glgo#GNOME/libsoup#488). - Add libsoup-CVE-2026-1539.patch: Also remove Proxy-Authorization header on cross origin redirect (bsc#1257441, CVE-2026-1539, glgo#GNOME/libsoup#489). ++++ qemu: - Bug and CVE fixes: * cryptodev-builtin: Limit the maximum size (bsc#1255400, CVE-2025-14876) * hw/virtio/virtio-crypto: verify asym request size (bsc#1255400, CVE-2025-14876) * hw/i386/kvm: fix PIRQ bounds check in xen_physdev_map_pirq() (bsc#1256484, CVE-2026-0665) ------------------------------------------------------------------ ------------------ 2026-2-24 - Feb 24 2026 ------------------- ------------------------------------------------------------------ ++++ python-kiwi: - Fix upstream merge README ++++ gnutls: - Add the functionality to allow to specify the hash algorithm for the PSK. This fixes a bug in the current implementation where the binder is always calculated with SHA256. * (bsc#1258083, jsc#PED-15752, jsc#PED-15753) * lib/psk: Add gnutls_psk_allocate_{client,server}_credentials2 * tests/psk-file: Add testing for _credentials2 functions * lib/psk: add null check for binder algo * pre_shared_key: fix memleak when retrying with different binder algo * pre_shared_key: add null check on pskcred * Add patches: - gnutls-PSK-hash.patch - gnutls-PSK-hash-tests.patch - gnutls-PSK-hash-NULL-check.patch - gnutls-PSK-hash-NULL-check-pskcred.patch - gnutls-PSK-hash-fix-memleak.patch ++++ kernel-default: - md: suspend array while updating raid_disks via sysfs (CVE-2025-71225, bsc#1258411). - commit 22f1953 - smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129, CVE-2025-68295). - commit 069aa1f - Refresh patches.suse/smb-client-split-cached_fid-bitfields-to-avoid-shared-byte-RMW-rac.patch. - commit f42de87 - Move upstreamed mm and SCSI patches into sorted section - commit 2b576e9 - btrfs: send: check for inline extents in range_is_hole_in_parent() (bsc#1258377 CVE-2026-23141). - commit b93c18b - btrfs: reject new transactions if the fs is fully read-only (bsc#1258464 CVE-2026-23214). - commit c375a48 ++++ kernel-rt: - md: suspend array while updating raid_disks via sysfs (CVE-2025-71225, bsc#1258411). - commit 22f1953 - smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129, CVE-2025-68295). - commit 069aa1f - Refresh patches.suse/smb-client-split-cached_fid-bitfields-to-avoid-shared-byte-RMW-rac.patch. - commit f42de87 - Move upstreamed mm and SCSI patches into sorted section - commit 2b576e9 - btrfs: send: check for inline extents in range_is_hole_in_parent() (bsc#1258377 CVE-2026-23141). - commit b93c18b - btrfs: reject new transactions if the fs is fully read-only (bsc#1258464 CVE-2026-23214). - commit c375a48 ++++ kernel-rt_debug: - md: suspend array while updating raid_disks via sysfs (CVE-2025-71225, bsc#1258411). - commit 22f1953 - smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129, CVE-2025-68295). - commit 069aa1f - Refresh patches.suse/smb-client-split-cached_fid-bitfields-to-avoid-shared-byte-RMW-rac.patch. - commit f42de87 - Move upstreamed mm and SCSI patches into sorted section - commit 2b576e9 - btrfs: send: check for inline extents in range_is_hole_in_parent() (bsc#1258377 CVE-2026-23141). - commit b93c18b - btrfs: reject new transactions if the fs is fully read-only (bsc#1258464 CVE-2026-23214). - commit c375a48 ------------------------------------------------------------------ ------------------ 2026-2-23 - Feb 23 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - net: fix memory leak in skb_segment_list for GRO packets (CVE-2026-22979 bsc#1257228). - commit 59160d7 - rpm/check-for-config-changes: add OPENSSL_SUPPORTS_ to IGNORED_CONFIGS_RE Config option OPENSSL_SUPPORTS_ML_DSA was introduced by mainline commit 0ad9a71933e7 ("modsign: Enable ML-DSA module signing") in 7.0-rc1 - commit 21b4616 - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (CVE-2026-23209 bsc#1258518). - macvlan: fix error recovery in macvlan_common_newlink() (CVE-2026-23209 bsc#1258518). - commit eaf1535 - bonding: only set speed/duplex to unknown, if getting speed failed (bsc#1253691). - commit 0b66a07 - rtc: interface: Alarm race handling should not discard preceding error (git-fixes). - commit f96272c ++++ kernel-rt: - net: fix memory leak in skb_segment_list for GRO packets (CVE-2026-22979 bsc#1257228). - commit 59160d7 - rpm/check-for-config-changes: add OPENSSL_SUPPORTS_ to IGNORED_CONFIGS_RE Config option OPENSSL_SUPPORTS_ML_DSA was introduced by mainline commit 0ad9a71933e7 ("modsign: Enable ML-DSA module signing") in 7.0-rc1 - commit 21b4616 - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (CVE-2026-23209 bsc#1258518). - macvlan: fix error recovery in macvlan_common_newlink() (CVE-2026-23209 bsc#1258518). - commit eaf1535 - bonding: only set speed/duplex to unknown, if getting speed failed (bsc#1253691). - commit 0b66a07 - rtc: interface: Alarm race handling should not discard preceding error (git-fixes). - commit f96272c ++++ kernel-rt_debug: - net: fix memory leak in skb_segment_list for GRO packets (CVE-2026-22979 bsc#1257228). - commit 59160d7 - rpm/check-for-config-changes: add OPENSSL_SUPPORTS_ to IGNORED_CONFIGS_RE Config option OPENSSL_SUPPORTS_ML_DSA was introduced by mainline commit 0ad9a71933e7 ("modsign: Enable ML-DSA module signing") in 7.0-rc1 - commit 21b4616 - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (CVE-2026-23209 bsc#1258518). - macvlan: fix error recovery in macvlan_common_newlink() (CVE-2026-23209 bsc#1258518). - commit eaf1535 - bonding: only set speed/duplex to unknown, if getting speed failed (bsc#1253691). - commit 0b66a07 - rtc: interface: Alarm race handling should not discard preceding error (git-fixes). - commit f96272c ------------------------------------------------------------------ ------------------ 2026-2-22 - Feb 22 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - NTB: ntb_transport: Fix too small buffer for debugfs_name (git-fixes). - commit 269c576 ++++ kernel-rt: - NTB: ntb_transport: Fix too small buffer for debugfs_name (git-fixes). - commit 269c576 ++++ kernel-rt_debug: - NTB: ntb_transport: Fix too small buffer for debugfs_name (git-fixes). - commit 269c576 ------------------------------------------------------------------ ------------------ 2026-2-21 - Feb 21 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - ALSA: usb-audio: Use the right limit for PCM OOB check (CVE-2026-23208 bsc#1258468). - ALSA: usb-audio: Prevent excessive number of frames (CVE-2026-23208 bsc#1258468). - commit 895c473 - ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (git-fixes). - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (git-fixes). - drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (git-fixes). - drm/i915/acpi: free _DSM package when no connectors (git-fixes). - drm/amd: Fix hang on amdgpu unload by using pci_dev_is_disconnected() (git-fixes). - drm/amdgpu: Fix memory leak in amdgpu_ras_init() (git-fixes). - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (git-fixes). - efi: Fix reservation of unaccepted memory table (git-fixes). - commit 2183b13 ++++ kernel-rt: - ALSA: usb-audio: Use the right limit for PCM OOB check (CVE-2026-23208 bsc#1258468). - ALSA: usb-audio: Prevent excessive number of frames (CVE-2026-23208 bsc#1258468). - commit 895c473 - ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (git-fixes). - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (git-fixes). - drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (git-fixes). - drm/i915/acpi: free _DSM package when no connectors (git-fixes). - drm/amd: Fix hang on amdgpu unload by using pci_dev_is_disconnected() (git-fixes). - drm/amdgpu: Fix memory leak in amdgpu_ras_init() (git-fixes). - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (git-fixes). - efi: Fix reservation of unaccepted memory table (git-fixes). - commit 2183b13 ++++ kernel-rt_debug: - ALSA: usb-audio: Use the right limit for PCM OOB check (CVE-2026-23208 bsc#1258468). - ALSA: usb-audio: Prevent excessive number of frames (CVE-2026-23208 bsc#1258468). - commit 895c473 - ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (git-fixes). - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (git-fixes). - drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (git-fixes). - drm/i915/acpi: free _DSM package when no connectors (git-fixes). - drm/amd: Fix hang on amdgpu unload by using pci_dev_is_disconnected() (git-fixes). - drm/amdgpu: Fix memory leak in amdgpu_ras_init() (git-fixes). - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (git-fixes). - efi: Fix reservation of unaccepted memory table (git-fixes). - commit 2183b13 ------------------------------------------------------------------ ------------------ 2026-2-20 - Feb 20 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (CVE-2025-37861 bsc#1243055). - commit 807000c - net: nfc: nci: Fix parameter validation for packet data (git-fixes). - atm: fore200e: fix use-after-free in tasklets during device removal (git-fixes). - USB: serial: option: add Telit FN920C04 RNDIS compositions (stable-fixes). - fbdev: smscufx: properly copy ioctl memory to kernelspace (stable-fixes). - bus: fsl-mc: fix use-after-free in driver_override_show() (git-fixes). - ASoC: amd: yc: Add quirk for HP 200 G2a 16 (stable-fixes). - ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (stable-fixes). - platform/x86: classmate-laptop: Add missing NULL pointer checks (stable-fixes). - platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (stable-fixes). - platform/x86: panasonic-laptop: Fix sysfs group leak in error path (stable-fixes). - gpio: sprd: Change sprd_gpio lock to raw_spin_lock (stable-fixes). - drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (stable-fixes). - bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (stable-fixes). - commit 436dcdb ++++ kernel-rt: - scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (CVE-2025-37861 bsc#1243055). - commit 807000c - net: nfc: nci: Fix parameter validation for packet data (git-fixes). - atm: fore200e: fix use-after-free in tasklets during device removal (git-fixes). - USB: serial: option: add Telit FN920C04 RNDIS compositions (stable-fixes). - fbdev: smscufx: properly copy ioctl memory to kernelspace (stable-fixes). - bus: fsl-mc: fix use-after-free in driver_override_show() (git-fixes). - ASoC: amd: yc: Add quirk for HP 200 G2a 16 (stable-fixes). - ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (stable-fixes). - platform/x86: classmate-laptop: Add missing NULL pointer checks (stable-fixes). - platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (stable-fixes). - platform/x86: panasonic-laptop: Fix sysfs group leak in error path (stable-fixes). - gpio: sprd: Change sprd_gpio lock to raw_spin_lock (stable-fixes). - drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (stable-fixes). - bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (stable-fixes). - commit 436dcdb ++++ kernel-rt_debug: - scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (CVE-2025-37861 bsc#1243055). - commit 807000c - net: nfc: nci: Fix parameter validation for packet data (git-fixes). - atm: fore200e: fix use-after-free in tasklets during device removal (git-fixes). - USB: serial: option: add Telit FN920C04 RNDIS compositions (stable-fixes). - fbdev: smscufx: properly copy ioctl memory to kernelspace (stable-fixes). - bus: fsl-mc: fix use-after-free in driver_override_show() (git-fixes). - ASoC: amd: yc: Add quirk for HP 200 G2a 16 (stable-fixes). - ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (stable-fixes). - platform/x86: classmate-laptop: Add missing NULL pointer checks (stable-fixes). - platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (stable-fixes). - platform/x86: panasonic-laptop: Fix sysfs group leak in error path (stable-fixes). - gpio: sprd: Change sprd_gpio lock to raw_spin_lock (stable-fixes). - drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (stable-fixes). - bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (stable-fixes). - commit 436dcdb ++++ mozilla-nss: - update to NSS 3.112.3 * bmo#2009552 - avoid integer overflow in platform-independent ghash ------------------------------------------------------------------ ------------------ 2026-2-19 - Feb 19 2026 ------------------- ------------------------------------------------------------------ ++++ docker-compose: - Add patch for CVE-2025-62725 (bsc#1252752) 0002-CVE-2025-62725-fix-Enforce-compose-files-from-OCI-ar.patch ++++ kernel-default: - config.conf: Drop armv7hl builds commit 09ee386c4ae dropped support for armv7hl in SLE15-SP7, SUSE-2024 never supported it, therefore, no branch downstream of fixes/linux-6.4 supports this arch (bsc#1255265). - commit 5dc5aaf - ALSA: aloop: Fix racy access at PCM trigger (CVE-2026-23191 bsc#1258395). - commit 114f0d2 - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (git-fixes). - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (git-fixes). - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (git-fixes). - PM: sleep: wakeirq: Update outdated documentation comments (git-fixes). - commit 700df2d ++++ kernel-rt: - config.conf: Drop armv7hl builds commit 09ee386c4ae dropped support for armv7hl in SLE15-SP7, SUSE-2024 never supported it, therefore, no branch downstream of fixes/linux-6.4 supports this arch (bsc#1255265). - commit 5dc5aaf - ALSA: aloop: Fix racy access at PCM trigger (CVE-2026-23191 bsc#1258395). - commit 114f0d2 - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (git-fixes). - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (git-fixes). - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (git-fixes). - PM: sleep: wakeirq: Update outdated documentation comments (git-fixes). - commit 700df2d ++++ kernel-rt_debug: - config.conf: Drop armv7hl builds commit 09ee386c4ae dropped support for armv7hl in SLE15-SP7, SUSE-2024 never supported it, therefore, no branch downstream of fixes/linux-6.4 supports this arch (bsc#1255265). - commit 5dc5aaf - ALSA: aloop: Fix racy access at PCM trigger (CVE-2026-23191 bsc#1258395). - commit 114f0d2 - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (git-fixes). - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (git-fixes). - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (git-fixes). - PM: sleep: wakeirq: Update outdated documentation comments (git-fixes). - commit 700df2d ++++ libsoup: - Add more CVE fixes: + libsoup-CVE-2025-32049.patch (bsc#1240751 CVE-2025-32049 glgo#GNOME/libsoup#390) + libsoup-CVE-2026-2443.patch (bsc#1258170 CVE-2026-2443 glgo#GNOME/libsoup#487) + libsoup-CVE-2026-2369.patch (bsc#1258120 CVE-2026-2369 glgo#GNOME/libsoup!508) + libsoup-CVE-2026-2708.patch (bsc#1258508 CVE-2026-2708 glgo#GNOME/libsoup#500) ++++ libvirt: - rpc: avoid leak of GSource in use for interrupting main loop bsc#1258345 ------------------------------------------------------------------ ------------------ 2026-2-18 - Feb 18 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (bsc#1257735 CVE-2026-23060). - commit 9347d8b - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (bsc#1256716 CVE-2025-71113). - commit 449e0ae - crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992 CVE-2023-53817). - commit f8259ad - gue: Fix skb memleak with inner IP protocol 0 (CVE-2026-23095 bsc#1257808). - commit e8190a1 - vsock/virtio: cap TX credit to local buffer size (CVE-2026-23086 bsc#1257757). - commit 2a01723 - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (bsc#1251966 CVE-2025-39964). - commit 2a9a19a - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966 CVE-2025-39964). Refresh patches.suse/crypto-add-suse_kabi_padding.patch. - commit a6b1063 - Workaround for hybrid git workflow in SLFO 1.0/1.1 - commit 7ab5a74 - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (git-fixes). - usb: dwc2: fix resume failure if dr_mode is host (git-fixes). - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (git-fixes). - usb: bdc: fix sleep during atomic (git-fixes). - serial: SH_SCI: improve "DMA support" prompt (git-fixes). - serial: imx: change SERIAL_IMX_CONSOLE to bool (git-fixes). - staging: rtl8723bs: fix null dereference in find_network (git-fixes). - iio: sca3000: Fix a resource leak in sca3000_probe() (git-fixes). - iio: gyro: itg3200: Fix unchecked return value in read_raw (git-fixes). - drivers: iio: mpu3050: use dev_err_probe for regulator request (git-fixes). - fpga: dfl: use subsys_initcall to allow built-in drivers to be added (git-fixes). - commit e89b2ea ++++ kernel-rt: - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (bsc#1257735 CVE-2026-23060). - commit 9347d8b - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (bsc#1256716 CVE-2025-71113). - commit 449e0ae - crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992 CVE-2023-53817). - commit f8259ad - gue: Fix skb memleak with inner IP protocol 0 (CVE-2026-23095 bsc#1257808). - commit e8190a1 - vsock/virtio: cap TX credit to local buffer size (CVE-2026-23086 bsc#1257757). - commit 2a01723 - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (bsc#1251966 CVE-2025-39964). - commit 2a9a19a - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966 CVE-2025-39964). Refresh patches.suse/crypto-add-suse_kabi_padding.patch. - commit a6b1063 - Workaround for hybrid git workflow in SLFO 1.0/1.1 - commit 7ab5a74 - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (git-fixes). - usb: dwc2: fix resume failure if dr_mode is host (git-fixes). - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (git-fixes). - usb: bdc: fix sleep during atomic (git-fixes). - serial: SH_SCI: improve "DMA support" prompt (git-fixes). - serial: imx: change SERIAL_IMX_CONSOLE to bool (git-fixes). - staging: rtl8723bs: fix null dereference in find_network (git-fixes). - iio: sca3000: Fix a resource leak in sca3000_probe() (git-fixes). - iio: gyro: itg3200: Fix unchecked return value in read_raw (git-fixes). - drivers: iio: mpu3050: use dev_err_probe for regulator request (git-fixes). - fpga: dfl: use subsys_initcall to allow built-in drivers to be added (git-fixes). - commit e89b2ea ++++ kernel-rt_debug: - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (bsc#1257735 CVE-2026-23060). - commit 9347d8b - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (bsc#1256716 CVE-2025-71113). - commit 449e0ae - crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992 CVE-2023-53817). - commit f8259ad - gue: Fix skb memleak with inner IP protocol 0 (CVE-2026-23095 bsc#1257808). - commit e8190a1 - vsock/virtio: cap TX credit to local buffer size (CVE-2026-23086 bsc#1257757). - commit 2a01723 - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (bsc#1251966 CVE-2025-39964). - commit 2a9a19a - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966 CVE-2025-39964). Refresh patches.suse/crypto-add-suse_kabi_padding.patch. - commit a6b1063 - Workaround for hybrid git workflow in SLFO 1.0/1.1 - commit 7ab5a74 - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (git-fixes). - usb: dwc2: fix resume failure if dr_mode is host (git-fixes). - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (git-fixes). - usb: bdc: fix sleep during atomic (git-fixes). - serial: SH_SCI: improve "DMA support" prompt (git-fixes). - serial: imx: change SERIAL_IMX_CONSOLE to bool (git-fixes). - staging: rtl8723bs: fix null dereference in find_network (git-fixes). - iio: sca3000: Fix a resource leak in sca3000_probe() (git-fixes). - iio: gyro: itg3200: Fix unchecked return value in read_raw (git-fixes). - drivers: iio: mpu3050: use dev_err_probe for regulator request (git-fixes). - fpga: dfl: use subsys_initcall to allow built-in drivers to be added (git-fixes). - commit e89b2ea ++++ zlib: - Fix CVE-2026-27171, infinite loop via the crc32_combine64 and crc32_combine_gen64 functions due to missing checks for negative lengths (bsc#1258392) * CVE-2026-27171.patch ------------------------------------------------------------------ ------------------ 2026-2-17 - Feb 17 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (CVE-2026-23084 bsc#1257830). - commit 27fe347 - leds: qcom-lpg: Check the return value of regmap_bulk_write() (git-fixes). - backlight: qcom-wled: Change PM8950 WLED configurations (git-fixes). - backlight: qcom-wled: Support ovp values for PMI8994 (git-fixes). - mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (git-fixes). - mfd: core: Add locking around 'mfd_of_node_list' (git-fixes). - mfd: tps6105x: Fix kernel-doc warnings relating to the core struct and tps6105x_mode (git-fixes). - Revert "mfd: da9052-spi: Change read-mask to write-mask" (stable-fixes). - pinctrl: single: fix refcount leak in pcs_add_gpio_func() (git-fixes). - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (git-fixes). - pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (git-fixes). - Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (stable-fixes). - commit 516fe60 ++++ kernel-rt: - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (CVE-2026-23084 bsc#1257830). - commit 27fe347 - leds: qcom-lpg: Check the return value of regmap_bulk_write() (git-fixes). - backlight: qcom-wled: Change PM8950 WLED configurations (git-fixes). - backlight: qcom-wled: Support ovp values for PMI8994 (git-fixes). - mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (git-fixes). - mfd: core: Add locking around 'mfd_of_node_list' (git-fixes). - mfd: tps6105x: Fix kernel-doc warnings relating to the core struct and tps6105x_mode (git-fixes). - Revert "mfd: da9052-spi: Change read-mask to write-mask" (stable-fixes). - pinctrl: single: fix refcount leak in pcs_add_gpio_func() (git-fixes). - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (git-fixes). - pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (git-fixes). - Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (stable-fixes). - commit 516fe60 ++++ kernel-rt_debug: - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (CVE-2026-23084 bsc#1257830). - commit 27fe347 - leds: qcom-lpg: Check the return value of regmap_bulk_write() (git-fixes). - backlight: qcom-wled: Change PM8950 WLED configurations (git-fixes). - backlight: qcom-wled: Support ovp values for PMI8994 (git-fixes). - mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (git-fixes). - mfd: core: Add locking around 'mfd_of_node_list' (git-fixes). - mfd: tps6105x: Fix kernel-doc warnings relating to the core struct and tps6105x_mode (git-fixes). - Revert "mfd: da9052-spi: Change read-mask to write-mask" (stable-fixes). - pinctrl: single: fix refcount leak in pcs_add_gpio_func() (git-fixes). - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (git-fixes). - pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (git-fixes). - Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (stable-fixes). - commit 516fe60 ++++ python-cryptography: - CVE-2026-26007: Subgroup Attack Due to Missing Subgroup Validation for SECT Curves (bsc#1258074) * added CVE-2026-26007.patch ------------------------------------------------------------------ ------------------ 2026-2-16 - Feb 16 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - Input: stmfts - make comments correct (git-fixes). - Input: stmfts - correct wording for the warning message (git-fixes). - clk: qcom: gfx3d: add parent to parent request map (git-fixes). - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (git-fixes). - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (git-fixes). - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (git-fixes). - clk: qcom: rcg2: compute 2d using duty fraction directly (git-fixes). - clk: mediatek: Fix error handling in runtime PM setup (git-fixes). - clk: meson: g12a: Limit the HDMI PLL OD to /4 (git-fixes). - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (git-fixes). - clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (git-fixes). - clk: tegra: tegra124-emc: fix device leak on set_rate() (git-fixes). - clk: clk-apple-nco: Add "apple,t8103-nco" compatible (git-fixes). - clk: renesas: rzg2l: Select correct div round macro (git-fixes). - clk: renesas: rzg2l: Fix intin variable size (git-fixes). - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (git-fixes). - fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (git-fixes). - fbdev: vt8500lcdfb: fix missing dma_free_coherent() (git-fixes). - fbcon: check return value of con2fb_acquire_newinfo() (git-fixes). - fbdev: rivafb: fix divide error in nv3_arb() (git-fixes). - rpmsg: core: fix race in driver_override_show() and use core helper (git-fixes). - commit b135afb - Update "drm/mgag200: fix mgag200_bmc_stop_scanout()" bug number (bsc#1258153) - commit 2fe2c66 ++++ kernel-rt: - Input: stmfts - make comments correct (git-fixes). - Input: stmfts - correct wording for the warning message (git-fixes). - clk: qcom: gfx3d: add parent to parent request map (git-fixes). - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (git-fixes). - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (git-fixes). - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (git-fixes). - clk: qcom: rcg2: compute 2d using duty fraction directly (git-fixes). - clk: mediatek: Fix error handling in runtime PM setup (git-fixes). - clk: meson: g12a: Limit the HDMI PLL OD to /4 (git-fixes). - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (git-fixes). - clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (git-fixes). - clk: tegra: tegra124-emc: fix device leak on set_rate() (git-fixes). - clk: clk-apple-nco: Add "apple,t8103-nco" compatible (git-fixes). - clk: renesas: rzg2l: Select correct div round macro (git-fixes). - clk: renesas: rzg2l: Fix intin variable size (git-fixes). - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (git-fixes). - fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (git-fixes). - fbdev: vt8500lcdfb: fix missing dma_free_coherent() (git-fixes). - fbcon: check return value of con2fb_acquire_newinfo() (git-fixes). - fbdev: rivafb: fix divide error in nv3_arb() (git-fixes). - rpmsg: core: fix race in driver_override_show() and use core helper (git-fixes). - commit b135afb - Update "drm/mgag200: fix mgag200_bmc_stop_scanout()" bug number (bsc#1258153) - commit 2fe2c66 ++++ kernel-rt_debug: - Input: stmfts - make comments correct (git-fixes). - Input: stmfts - correct wording for the warning message (git-fixes). - clk: qcom: gfx3d: add parent to parent request map (git-fixes). - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (git-fixes). - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (git-fixes). - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (git-fixes). - clk: qcom: rcg2: compute 2d using duty fraction directly (git-fixes). - clk: mediatek: Fix error handling in runtime PM setup (git-fixes). - clk: meson: g12a: Limit the HDMI PLL OD to /4 (git-fixes). - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (git-fixes). - clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (git-fixes). - clk: tegra: tegra124-emc: fix device leak on set_rate() (git-fixes). - clk: clk-apple-nco: Add "apple,t8103-nco" compatible (git-fixes). - clk: renesas: rzg2l: Select correct div round macro (git-fixes). - clk: renesas: rzg2l: Fix intin variable size (git-fixes). - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (git-fixes). - fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (git-fixes). - fbdev: vt8500lcdfb: fix missing dma_free_coherent() (git-fixes). - fbcon: check return value of con2fb_acquire_newinfo() (git-fixes). - fbdev: rivafb: fix divide error in nv3_arb() (git-fixes). - rpmsg: core: fix race in driver_override_show() and use core helper (git-fixes). - commit b135afb - Update "drm/mgag200: fix mgag200_bmc_stop_scanout()" bug number (bsc#1258153) - commit 2fe2c66 ------------------------------------------------------------------ ------------------ 2026-2-14 - Feb 14 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - crypto: ccp - Add an S4 restore flow (git-fixes). - tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (git-fixes). - mtd: rawnand: pl353: Fix software ECC support (git-fixes). - mtd: spinand: Fix kernel doc (git-fixes). - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (git-fixes). - mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (git-fixes). - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (git-fixes). - commit 766aa67 ++++ kernel-rt: - crypto: ccp - Add an S4 restore flow (git-fixes). - tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (git-fixes). - mtd: rawnand: pl353: Fix software ECC support (git-fixes). - mtd: spinand: Fix kernel doc (git-fixes). - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (git-fixes). - mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (git-fixes). - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (git-fixes). - commit 766aa67 ++++ kernel-rt_debug: - crypto: ccp - Add an S4 restore flow (git-fixes). - tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (git-fixes). - mtd: rawnand: pl353: Fix software ECC support (git-fixes). - mtd: spinand: Fix kernel doc (git-fixes). - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (git-fixes). - mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (git-fixes). - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (git-fixes). - commit 766aa67 ------------------------------------------------------------------ ------------------ 2026-2-13 - Feb 13 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - ice: fix devlink reload call trace (CVE-2026-23104 bsc#1257763). - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (CVE-2026-23035 bsc#1257559). - idpf: fix error handling in the init_task on load (CVE-2026-23017 bsc#1257552). - commit fb93c36 - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (git-fixes). - power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (git-fixes). - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (git-fixes). - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (git-fixes). - power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (git-fixes). - power: supply: rt9455: Fix use-after-free in power_supply_changed() (git-fixes). - power: supply: goldfish: Fix use-after-free in power_supply_changed() (git-fixes). - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (git-fixes). - power: supply: bq25980: Fix use-after-free in power_supply_changed() (git-fixes). - power: supply: bq256xx: Fix use-after-free in power_supply_changed() (git-fixes). - power: supply: act8945a: Fix use-after-free in power_supply_changed() (git-fixes). - power: supply: ab8500: Fix use-after-free in power_supply_changed() (git-fixes). - ata: pata_ftide010: Fix some DMA timings (git-fixes). - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (git-fixes). - commit 46137a2 - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (CVE-2026-23004 bsc#1257231). - commit 75a3dd5 ++++ kernel-rt: - ice: fix devlink reload call trace (CVE-2026-23104 bsc#1257763). - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (CVE-2026-23035 bsc#1257559). - idpf: fix error handling in the init_task on load (CVE-2026-23017 bsc#1257552). - commit fb93c36 - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (git-fixes). - power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (git-fixes). - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (git-fixes). - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (git-fixes). - power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (git-fixes). - power: supply: rt9455: Fix use-after-free in power_supply_changed() (git-fixes). - power: supply: goldfish: Fix use-after-free in power_supply_changed() (git-fixes). - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (git-fixes). - power: supply: bq25980: Fix use-after-free in power_supply_changed() (git-fixes). - power: supply: bq256xx: Fix use-after-free in power_supply_changed() (git-fixes). - power: supply: act8945a: Fix use-after-free in power_supply_changed() (git-fixes). - power: supply: ab8500: Fix use-after-free in power_supply_changed() (git-fixes). - ata: pata_ftide010: Fix some DMA timings (git-fixes). - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (git-fixes). - commit 46137a2 - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (CVE-2026-23004 bsc#1257231). - commit 75a3dd5 ++++ kernel-rt_debug: - ice: fix devlink reload call trace (CVE-2026-23104 bsc#1257763). - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (CVE-2026-23035 bsc#1257559). - idpf: fix error handling in the init_task on load (CVE-2026-23017 bsc#1257552). - commit fb93c36 - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (git-fixes). - power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (git-fixes). - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (git-fixes). - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (git-fixes). - power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (git-fixes). - power: supply: rt9455: Fix use-after-free in power_supply_changed() (git-fixes). - power: supply: goldfish: Fix use-after-free in power_supply_changed() (git-fixes). - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (git-fixes). - power: supply: bq25980: Fix use-after-free in power_supply_changed() (git-fixes). - power: supply: bq256xx: Fix use-after-free in power_supply_changed() (git-fixes). - power: supply: act8945a: Fix use-after-free in power_supply_changed() (git-fixes). - power: supply: ab8500: Fix use-after-free in power_supply_changed() (git-fixes). - ata: pata_ftide010: Fix some DMA timings (git-fixes). - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (git-fixes). - commit 46137a2 - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (CVE-2026-23004 bsc#1257231). - commit 75a3dd5 ++++ libxml2: - CVE-2026-0990: call stack overflow leading to application crash due to infinite recursion in `xmlCatalogXMLResolveURI` (bsc#1256807, bsc#1256811) * Add patch libxml2-CVE-2026-0990.patch - CVE-2026-0992: excessive resource consumption when processing XML catalogs due to exponential behavior when handling `` elements (bsc#1256808, bsc#1256809, bsc#1256812) * Add patch libxml2-CVE-2026-0992.patch - CVE-2025-8732: infinite recursion in catalog parsing functions when processing malformed SGML catalog files (bsc#1247858, bsc#1247850) * Add patch libxml2-CVE-2025-8732.patch ++++ libxml2-python: - CVE-2026-0990: call stack overflow leading to application crash due to infinite recursion in `xmlCatalogXMLResolveURI` (bsc#1256807, bsc#1256811) * Add patch libxml2-CVE-2026-0990.patch - CVE-2026-0992: excessive resource consumption when processing XML catalogs due to exponential behavior when handling `` elements (bsc#1256808, bsc#1256809, bsc#1256812) * Add patch libxml2-CVE-2026-0992.patch - CVE-2025-8732: infinite recursion in catalog parsing functions when processing malformed SGML catalog files (bsc#1247858, bsc#1247850) * Add patch libxml2-CVE-2025-8732.patch ------------------------------------------------------------------ ------------------ 2026-2-12 - Feb 12 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - net/sched: act_ife: avoid possible NULL deref (CVE-2026-23064 bsc#1257765). - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CVE-2026-23105 bsc#1257775). - commit a17643b - Update upstreamed net and powerpc patch references and sorting - commit 638a424 - KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (bsc#1256708, CVE-2025-71104). - commit 1d88ad6 - vsock/virtio: Coalesce only linear skb (bsc#1257740, CVE-2026-23057). - commit 09262b6 - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CVE-2026-22998 bsc#1257209). - commit f5cd5c5 - wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (git-fixes). - wifi: ath9k: fix kernel-doc warnings in common-debug.h (git-fixes). - wifi: ath9k: debug.h: fix kernel-doc bad lines and struct ath_tx_stats (git-fixes). - wifi: cfg80211: stop NAN and P2P in cfg80211_leave (git-fixes). - wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (git-fixes). - wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (git-fixes). - wifi: cfg80211: Fix use_for flag update on BSS refresh (git-fixes). - soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (git-fixes). - soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (git-fixes). - soc: qcom: smem: handle ENOMEM error during probe (git-fixes). - wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (stable-fixes). - wifi: mac80211: correctly check if CSA is active (stable-fixes). - wifi: cfg80211: Fix bitrate calculation overflow for HE rates (stable-fixes). - wifi: mac80211: collect station statistics earlier when disconnect (stable-fixes). - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (stable-fixes). - wifi: wlcore: ensure skb headroom before skb_push (stable-fixes). - commit 7dd6fbf - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (git-fixes). - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (git-fixes). - PCI: Fix pci_slot_trylock() error handling (git-fixes). - PCI/portdrv: Fix potential resource leak (git-fixes). - PCI/PM: Avoid redundant delays on D3hot->D3cold (git-fixes). - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (git-fixes). - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (git-fixes). - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (git-fixes). - PCI/ACPI: Restrict program_hpx_type2() to AER bits (git-fixes). - PCI: Initialize RCB from pci_configure_device() (git-fixes). - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (git-fixes). - regulator: core: move supply check earlier in set_machine_constraints() (git-fixes). - regulator: core: fix locking in regulator_resolve_supply() error path (git-fixes). - platform/chrome: cros_ec_lightbar: Fix response size initialization (git-fixes). - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (git-fixes). - soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (git-fixes). - soc: ti: k3-socinfo: Fix regmap leak on probe failure (git-fixes). - regmap: maple: free entry on mas_store_gfp() failure (stable-fixes). - commit 5d29d16 - nfc: hci: shdlc: Stop timers and work before freeing context (git-fixes). - PCI: Do not attempt to set ExtTag for VFs (git-fixes). - PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (git-fixes). - media: uvcvideo: Fix allocation for small frame sizes (git-fixes). - media: venus: vdec: fix error state assignment for zero bytesused (git-fixes). - media: ccs: Accommodate C-PHY into the calculation (git-fixes). - media: i2c: ov5647: use our own mutex for the ctrl lock (git-fixes). - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (git-fixes). - media: i2c: ov5647: Sensor should report RAW color space (git-fixes). - media: i2c: ov5647: Correct minimum VBLANK value (git-fixes). - media: i2c: ov5647: Correct pixel array offset (git-fixes). - media: i2c: ov5647: Initialize subdev before controls (git-fixes). - media: ccs: Avoid possible division by zero (git-fixes). - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (git-fixes). - media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (git-fixes). - media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (git-fixes). - media: cx25821: Add missing unmap in snd_cx25821_hw_params() (git-fixes). - media: cx23885: Add missing unmap in snd_cx23885_hw_params() (git-fixes). - media: cx88: Add missing unmap in snd_cx88_hw_params() (git-fixes). - net: usb: sr9700: support devices with virtual driver CD (stable-fixes). - commit b9e0ae7 - drm/msm/a2xx: fix pixel shader start on A225 (git-fixes). - drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (git-fixes). - drm/buddy: Prevent BUG_ON by validating rounded allocation (git-fixes). - drm/tegra: dsi: fix device leak on probe (git-fixes). - media: radio-keene: fix memory leak in error path (git-fixes). - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (git-fixes). - media: mtk-mdp: Fix error handling in probe function (git-fixes). - HID: hid-pl: handle probe errors (git-fixes). - HID: playstation: Add missing check for input_ff_create_memless (git-fixes). - Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (git-fixes). - hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced race (git-fixes). - HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (stable-fixes). - HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (stable-fixes). - HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (stable-fixes). - HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (stable-fixes). - HID: intel-ish-hid: Reset enum_devices_done before enumeration (stable-fixes). - HID: intel-ish-hid: Update ishtp bus match to support device ID table (stable-fixes). - HID: playstation: Center initial joystick axes to prevent spurious events (stable-fixes). - commit a4d4518 - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors (git-fixes). - ASoC: amd: drop unused Kconfig symbols (git-fixes). - ASoC: pxa: drop unused Kconfig symbol (git-fixes). - ASoC: SOF: ipc4-control: Keep the payload size up to date (git-fixes). - ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data (git-fixes). - ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (git-fixes). - ASoC: SOF: ipc4-control: If there is no data do not send bytes update (git-fixes). - bus: fsl-mc: fix an error handling in fsl_mc_device_add() (git-fixes). - ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU (git-fixes). - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (stable-fixes). - ASoC: tlv320adcx140: Propagate error codes during probe (stable-fixes). - ASoC: amd: yc: Fix microphone on ASUS M6500RE (stable-fixes). - ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (stable-fixes). - ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (stable-fixes). - commit cd7803f ++++ kernel-rt: - net/sched: act_ife: avoid possible NULL deref (CVE-2026-23064 bsc#1257765). - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CVE-2026-23105 bsc#1257775). - commit a17643b - Update upstreamed net and powerpc patch references and sorting - commit 638a424 - KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (bsc#1256708, CVE-2025-71104). - commit 1d88ad6 - vsock/virtio: Coalesce only linear skb (bsc#1257740, CVE-2026-23057). - commit 09262b6 - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CVE-2026-22998 bsc#1257209). - commit f5cd5c5 - wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (git-fixes). - wifi: ath9k: fix kernel-doc warnings in common-debug.h (git-fixes). - wifi: ath9k: debug.h: fix kernel-doc bad lines and struct ath_tx_stats (git-fixes). - wifi: cfg80211: stop NAN and P2P in cfg80211_leave (git-fixes). - wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (git-fixes). - wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (git-fixes). - wifi: cfg80211: Fix use_for flag update on BSS refresh (git-fixes). - soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (git-fixes). - soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (git-fixes). - soc: qcom: smem: handle ENOMEM error during probe (git-fixes). - wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (stable-fixes). - wifi: mac80211: correctly check if CSA is active (stable-fixes). - wifi: cfg80211: Fix bitrate calculation overflow for HE rates (stable-fixes). - wifi: mac80211: collect station statistics earlier when disconnect (stable-fixes). - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (stable-fixes). - wifi: wlcore: ensure skb headroom before skb_push (stable-fixes). - commit 7dd6fbf - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (git-fixes). - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (git-fixes). - PCI: Fix pci_slot_trylock() error handling (git-fixes). - PCI/portdrv: Fix potential resource leak (git-fixes). - PCI/PM: Avoid redundant delays on D3hot->D3cold (git-fixes). - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (git-fixes). - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (git-fixes). - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (git-fixes). - PCI/ACPI: Restrict program_hpx_type2() to AER bits (git-fixes). - PCI: Initialize RCB from pci_configure_device() (git-fixes). - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (git-fixes). - regulator: core: move supply check earlier in set_machine_constraints() (git-fixes). - regulator: core: fix locking in regulator_resolve_supply() error path (git-fixes). - platform/chrome: cros_ec_lightbar: Fix response size initialization (git-fixes). - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (git-fixes). - soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (git-fixes). - soc: ti: k3-socinfo: Fix regmap leak on probe failure (git-fixes). - regmap: maple: free entry on mas_store_gfp() failure (stable-fixes). - commit 5d29d16 - nfc: hci: shdlc: Stop timers and work before freeing context (git-fixes). - PCI: Do not attempt to set ExtTag for VFs (git-fixes). - PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (git-fixes). - media: uvcvideo: Fix allocation for small frame sizes (git-fixes). - media: venus: vdec: fix error state assignment for zero bytesused (git-fixes). - media: ccs: Accommodate C-PHY into the calculation (git-fixes). - media: i2c: ov5647: use our own mutex for the ctrl lock (git-fixes). - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (git-fixes). - media: i2c: ov5647: Sensor should report RAW color space (git-fixes). - media: i2c: ov5647: Correct minimum VBLANK value (git-fixes). - media: i2c: ov5647: Correct pixel array offset (git-fixes). - media: i2c: ov5647: Initialize subdev before controls (git-fixes). - media: ccs: Avoid possible division by zero (git-fixes). - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (git-fixes). - media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (git-fixes). - media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (git-fixes). - media: cx25821: Add missing unmap in snd_cx25821_hw_params() (git-fixes). - media: cx23885: Add missing unmap in snd_cx23885_hw_params() (git-fixes). - media: cx88: Add missing unmap in snd_cx88_hw_params() (git-fixes). - net: usb: sr9700: support devices with virtual driver CD (stable-fixes). - commit b9e0ae7 - drm/msm/a2xx: fix pixel shader start on A225 (git-fixes). - drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (git-fixes). - drm/buddy: Prevent BUG_ON by validating rounded allocation (git-fixes). - drm/tegra: dsi: fix device leak on probe (git-fixes). - media: radio-keene: fix memory leak in error path (git-fixes). - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (git-fixes). - media: mtk-mdp: Fix error handling in probe function (git-fixes). - HID: hid-pl: handle probe errors (git-fixes). - HID: playstation: Add missing check for input_ff_create_memless (git-fixes). - Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (git-fixes). - hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced race (git-fixes). - HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (stable-fixes). - HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (stable-fixes). - HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (stable-fixes). - HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (stable-fixes). - HID: intel-ish-hid: Reset enum_devices_done before enumeration (stable-fixes). - HID: intel-ish-hid: Update ishtp bus match to support device ID table (stable-fixes). - HID: playstation: Center initial joystick axes to prevent spurious events (stable-fixes). - commit a4d4518 - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors (git-fixes). - ASoC: amd: drop unused Kconfig symbols (git-fixes). - ASoC: pxa: drop unused Kconfig symbol (git-fixes). - ASoC: SOF: ipc4-control: Keep the payload size up to date (git-fixes). - ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data (git-fixes). - ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (git-fixes). - ASoC: SOF: ipc4-control: If there is no data do not send bytes update (git-fixes). - bus: fsl-mc: fix an error handling in fsl_mc_device_add() (git-fixes). - ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU (git-fixes). - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (stable-fixes). - ASoC: tlv320adcx140: Propagate error codes during probe (stable-fixes). - ASoC: amd: yc: Fix microphone on ASUS M6500RE (stable-fixes). - ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (stable-fixes). - ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (stable-fixes). - commit cd7803f ++++ kernel-rt_debug: - net/sched: act_ife: avoid possible NULL deref (CVE-2026-23064 bsc#1257765). - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CVE-2026-23105 bsc#1257775). - commit a17643b - Update upstreamed net and powerpc patch references and sorting - commit 638a424 - KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (bsc#1256708, CVE-2025-71104). - commit 1d88ad6 - vsock/virtio: Coalesce only linear skb (bsc#1257740, CVE-2026-23057). - commit 09262b6 - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CVE-2026-22998 bsc#1257209). - commit f5cd5c5 - wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (git-fixes). - wifi: ath9k: fix kernel-doc warnings in common-debug.h (git-fixes). - wifi: ath9k: debug.h: fix kernel-doc bad lines and struct ath_tx_stats (git-fixes). - wifi: cfg80211: stop NAN and P2P in cfg80211_leave (git-fixes). - wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (git-fixes). - wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (git-fixes). - wifi: cfg80211: Fix use_for flag update on BSS refresh (git-fixes). - soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (git-fixes). - soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (git-fixes). - soc: qcom: smem: handle ENOMEM error during probe (git-fixes). - wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (stable-fixes). - wifi: mac80211: correctly check if CSA is active (stable-fixes). - wifi: cfg80211: Fix bitrate calculation overflow for HE rates (stable-fixes). - wifi: mac80211: collect station statistics earlier when disconnect (stable-fixes). - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (stable-fixes). - wifi: wlcore: ensure skb headroom before skb_push (stable-fixes). - commit 7dd6fbf - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (git-fixes). - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (git-fixes). - PCI: Fix pci_slot_trylock() error handling (git-fixes). - PCI/portdrv: Fix potential resource leak (git-fixes). - PCI/PM: Avoid redundant delays on D3hot->D3cold (git-fixes). - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (git-fixes). - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (git-fixes). - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (git-fixes). - PCI/ACPI: Restrict program_hpx_type2() to AER bits (git-fixes). - PCI: Initialize RCB from pci_configure_device() (git-fixes). - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (git-fixes). - regulator: core: move supply check earlier in set_machine_constraints() (git-fixes). - regulator: core: fix locking in regulator_resolve_supply() error path (git-fixes). - platform/chrome: cros_ec_lightbar: Fix response size initialization (git-fixes). - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (git-fixes). - soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (git-fixes). - soc: ti: k3-socinfo: Fix regmap leak on probe failure (git-fixes). - regmap: maple: free entry on mas_store_gfp() failure (stable-fixes). - commit 5d29d16 - nfc: hci: shdlc: Stop timers and work before freeing context (git-fixes). - PCI: Do not attempt to set ExtTag for VFs (git-fixes). - PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (git-fixes). - media: uvcvideo: Fix allocation for small frame sizes (git-fixes). - media: venus: vdec: fix error state assignment for zero bytesused (git-fixes). - media: ccs: Accommodate C-PHY into the calculation (git-fixes). - media: i2c: ov5647: use our own mutex for the ctrl lock (git-fixes). - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (git-fixes). - media: i2c: ov5647: Sensor should report RAW color space (git-fixes). - media: i2c: ov5647: Correct minimum VBLANK value (git-fixes). - media: i2c: ov5647: Correct pixel array offset (git-fixes). - media: i2c: ov5647: Initialize subdev before controls (git-fixes). - media: ccs: Avoid possible division by zero (git-fixes). - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (git-fixes). - media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (git-fixes). - media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (git-fixes). - media: cx25821: Add missing unmap in snd_cx25821_hw_params() (git-fixes). - media: cx23885: Add missing unmap in snd_cx23885_hw_params() (git-fixes). - media: cx88: Add missing unmap in snd_cx88_hw_params() (git-fixes). - net: usb: sr9700: support devices with virtual driver CD (stable-fixes). - commit b9e0ae7 - drm/msm/a2xx: fix pixel shader start on A225 (git-fixes). - drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (git-fixes). - drm/buddy: Prevent BUG_ON by validating rounded allocation (git-fixes). - drm/tegra: dsi: fix device leak on probe (git-fixes). - media: radio-keene: fix memory leak in error path (git-fixes). - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (git-fixes). - media: mtk-mdp: Fix error handling in probe function (git-fixes). - HID: hid-pl: handle probe errors (git-fixes). - HID: playstation: Add missing check for input_ff_create_memless (git-fixes). - Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (git-fixes). - hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced race (git-fixes). - HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (stable-fixes). - HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (stable-fixes). - HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (stable-fixes). - HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (stable-fixes). - HID: intel-ish-hid: Reset enum_devices_done before enumeration (stable-fixes). - HID: intel-ish-hid: Update ishtp bus match to support device ID table (stable-fixes). - HID: playstation: Center initial joystick axes to prevent spurious events (stable-fixes). - commit a4d4518 - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors (git-fixes). - ASoC: amd: drop unused Kconfig symbols (git-fixes). - ASoC: pxa: drop unused Kconfig symbol (git-fixes). - ASoC: SOF: ipc4-control: Keep the payload size up to date (git-fixes). - ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data (git-fixes). - ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (git-fixes). - ASoC: SOF: ipc4-control: If there is no data do not send bytes update (git-fixes). - bus: fsl-mc: fix an error handling in fsl_mc_device_add() (git-fixes). - ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU (git-fixes). - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (stable-fixes). - ASoC: tlv320adcx140: Propagate error codes during probe (stable-fixes). - ASoC: amd: yc: Fix microphone on ASUS M6500RE (stable-fixes). - ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (stable-fixes). - ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (stable-fixes). - commit cd7803f ++++ libpng16: - added patches CVE-2026-25646: Heap buffer overflow vulnerability in png_set_dither/png_set_quantize (bsc#1258020) * libpng16-CVE-2026-25646.patch ++++ nvidia-open-driver-G06-signed: - update non-CUDA variant to version 580.126.18 (boo#1258154) - updated CUDA variant to version 580.126.16 ------------------------------------------------------------------ ------------------ 2026-2-11 - Feb 11 2026 ------------------- ------------------------------------------------------------------ ++++ gpg2: - Fix Y2K38 FTBFS: * gpg2 quick-key-manipulation test FTBFS-2038 (bsc#1251214) * Upstream issue: dev.gnupg.org/T8096 * Add gnupg-gpgscm-New-operator-long-time-t-to-detect-proper-tim.patch ++++ grub2: - Backport upstream's commit to prevent BIOS assert (bsc#1258022) * 0001-kern-efi-mm-Change-grub_efi_mm_add_regions-to-keep-t.patch ++++ kernel-default: - net/sched: Enforce that teql can only be used as root qdisc (CVE-2026-23074 bsc#1257749). - commit 476e9b8 - mfd: wm8350-core: Use IRQF_ONESHOT (git-fixes). - crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (git-fixes). - crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (git-fixes). - crypto: virtio - Add spinlock protection with virtqueue notification (git-fixes). - crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (git-fixes). - crypto: octeontx - fix dma_free_coherent() size (git-fixes). - crypto: cavium - fix dma_free_coherent() size (git-fixes). - crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (git-fixes). - crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (git-fixes). - crypto: qat - fix warning on adf_pfvf_pf_proto.c (git-fixes). - crypto: qat - fix parameter order used in ICP_QAT_FW_COMN_FLAGS_BUILD (git-fixes). - Documentation: mailbox: mbox_chan_ops.flush() is optional (git-fixes). - commit ef8920f ++++ kernel-rt: - net/sched: Enforce that teql can only be used as root qdisc (CVE-2026-23074 bsc#1257749). - commit 476e9b8 - mfd: wm8350-core: Use IRQF_ONESHOT (git-fixes). - crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (git-fixes). - crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (git-fixes). - crypto: virtio - Add spinlock protection with virtqueue notification (git-fixes). - crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (git-fixes). - crypto: octeontx - fix dma_free_coherent() size (git-fixes). - crypto: cavium - fix dma_free_coherent() size (git-fixes). - crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (git-fixes). - crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (git-fixes). - crypto: qat - fix warning on adf_pfvf_pf_proto.c (git-fixes). - crypto: qat - fix parameter order used in ICP_QAT_FW_COMN_FLAGS_BUILD (git-fixes). - Documentation: mailbox: mbox_chan_ops.flush() is optional (git-fixes). - commit ef8920f ++++ kernel-rt_debug: - net/sched: Enforce that teql can only be used as root qdisc (CVE-2026-23074 bsc#1257749). - commit 476e9b8 - mfd: wm8350-core: Use IRQF_ONESHOT (git-fixes). - crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (git-fixes). - crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (git-fixes). - crypto: virtio - Add spinlock protection with virtqueue notification (git-fixes). - crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (git-fixes). - crypto: octeontx - fix dma_free_coherent() size (git-fixes). - crypto: cavium - fix dma_free_coherent() size (git-fixes). - crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (git-fixes). - crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (git-fixes). - crypto: qat - fix warning on adf_pfvf_pf_proto.c (git-fixes). - crypto: qat - fix parameter order used in ICP_QAT_FW_COMN_FLAGS_BUILD (git-fixes). - Documentation: mailbox: mbox_chan_ops.flush() is optional (git-fixes). - commit ef8920f ++++ python311-core: - CVE-2025-11468: preserving parens when folding comments in email headers (bsc#1257029, gh#python/cpython#143935). CVE-2025-11468-email-hdr-fold-comment.patch - CVE-2026-0672: rejects control characters in http cookies. (bsc#1257031, gh#python/cpython#143919) CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch - CVE-2026-0865: rejecting control characters in wsgiref.headers.Headers, which could be abused for injecting false HTTP headers. (bsc#1257042, gh#python/cpython#143916) CVE-2026-0865-wsgiref-ctrl-chars.patch - CVE-2025-15366: basically the same as the previous patch for IMAP protocol. (bsc#1257044, gh#python/cpython#143921) CVE-2025-15366-imap-ctrl-chars.patch - CVE-2025-15282: basically the same as the previous patch for urllib library. (bsc#1257046, gh#python/cpython#143925) CVE-2025-15282-urllib-ctrl-chars.patch - CVE-2025-15367: basically the same as the previous patch for poplib library. (bsc#1257041, gh#python/cpython#143923) CVE-2025-15367-poplib-ctrl-chars.patch - CVE-2025-12781: fix decoding with non-standard Base64 alphabet (bsc#1257108, gh#python/cpython#125346) CVE-2025-12781-b64decode-alt-chars.patch ++++ libssh: - Security fixes: * CVE-2026-0964: SCP Protocol Path Traversal in ssh_scp_pull_request() (bsc#1258049) * CVE-2026-0965: Possible Denial of Service when parsing unexpected configuration files (bsc#1258045) * CVE-2026-0966: Buffer underflow in ssh_get_hexa() on invalid input (bsc#1258054) * CVE-2026-0967: Specially crafted patterns could cause DoS (bsc#1258081) * CVE-2026-0968: OOB Read in sftp_parse_longname() (bsc#1258080) * Add patches: - libssh-CVE-2026-0964-scp-Reject-invalid-paths-received-thro.patch - libssh-CVE-2026-0965-config-Do-not-attempt-to-read-non-regu.patch - libssh-CVE-2026-0966-misc-Avoid-heap-buffer-underflow-in-ss.patch - libssh-CVE-2026-0966-tests-Test-coverage-for-ssh_get_hexa.patch - libssh-CVE-2026-0966-doc-Update-guided-tour-to-use-SHA256-f.patch - libssh-CVE-2026-0967-match-Avoid-recursive-matching-ReDoS.patch - libssh-CVE-2026-0968-sftp-Sanitize-input-handling-in-sftp_p.patch ++++ python311: - CVE-2025-11468: preserving parens when folding comments in email headers (bsc#1257029, gh#python/cpython#143935). CVE-2025-11468-email-hdr-fold-comment.patch - CVE-2026-0672: rejects control characters in http cookies. (bsc#1257031, gh#python/cpython#143919) CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch - CVE-2026-0865: rejecting control characters in wsgiref.headers.Headers, which could be abused for injecting false HTTP headers. (bsc#1257042, gh#python/cpython#143916) CVE-2026-0865-wsgiref-ctrl-chars.patch - CVE-2025-15366: basically the same as the previous patch for IMAP protocol. (bsc#1257044, gh#python/cpython#143921) CVE-2025-15366-imap-ctrl-chars.patch - CVE-2025-15282: basically the same as the previous patch for urllib library. (bsc#1257046, gh#python/cpython#143925) CVE-2025-15282-urllib-ctrl-chars.patch - CVE-2025-15367: basically the same as the previous patch for poplib library. (bsc#1257041, gh#python/cpython#143923) CVE-2025-15367-poplib-ctrl-chars.patch - CVE-2025-12781: fix decoding with non-standard Base64 alphabet (bsc#1257108, gh#python/cpython#125346) CVE-2025-12781-b64decode-alt-chars.patch ++++ ucode-intel: - Intel CPU Microcode was updated to the 20260210 release (bsc#1258046) - CVE-2024-24853: Updated fix for incorrect behavior order in transition between executive monitor and SMI transfer monitor (STM) in some Intel(R) Processor may allow a privileged user to potentially enable escalation of privilege via local access. (bsc#1229129) - CVE-2025-31648: Improper handling of values in the microcode flow for some Intel Processor Family may allow an escalation of privilege. (bsc#1258046 INTEL-SA-01396 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01396.html) - Update for various functional issues. - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 0000003d | 0000003e | Core Gen12 | ADL | H0 | 06-97-05/07 | 0000003d | 0000003e | Core Gen12 | ADL | L0 | 06-9a-03/80 | 0000043a | 0000043b | Core Gen12 | ADL | R0 | 06-9a-04/80 | 0000043a | 0000043b | Core Gen12 | ADL-N | N0 | 06-be-00/19 | 0000001e | 00000021 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | ARL-H | A1 | 06-c5-02/82 | 0000011a | 0000011b | Core Ultra Processor (Series 2) | ARL-S/HX (8P) | B0 | 06-c6-02/82 | 0000011a | 0000011b | Core Ultra Processor (Series 2) | ARL-U | A0 | 06-b5-00/80 | 0000000a | 0000000d | Core Ultra Processor (Series 2) | AZB | A0/R0 | 06-9a-04/40 | 0000000b | 0000000c | Atom C1100 | EMR-SP | A1 | 06-cf-02/87 | 210002c0 | 210002d3 | Xeon Scalable Gen5 | GNR-AP/SP | Bx/Hx/Lx | 06-ad-01/95 | 010003f0 | 01000405 | Xeon 6900/6700/6500 Series Processors with P-Cores | GNR-D | B0/B1 | 06-ae-01/97 | 01000273 | 010002f3 | Xeon 6700P-B/6500P-B Series SoC with P-Cores | GNR-SP R1S | Bx/Hx/Lx | 06-ad-01/20 | 0a000124 | 0a000133 | Xeon 6700/6500-Series Processors with P-Cores | ICL-D | B0 | 06-6c-01/10 | 010002e0 | 010002f1 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000ca | 000000cc | Core Gen10 Mobile | ICX-SP | Dx/M1 | 06-6a-06/87 | 0d000410 | 0d000421 | Xeon Scalable Gen3 | MTL | C0 | 06-aa-04/e6 | 00000025 | 00000028 | Core Ultra Processor | RKL-S | B0 | 06-a7-01/02 | 00000064 | 00000065 | Core Gen11 | RPL-E/HX/S | B0 | 06-b7-01/32 | 00000132 | 00000133 | Core Gen13/Gen14 | RPL-H/P/PX 6+8 | J0 | 06-ba-02/e0 | 00006133 | 00006134 | Core Gen13 | RPL-HX/S | C0 | 06-bf-02/07 | 0000003d | 0000003e | Core Gen13/Gen14 | RPL-S | H0 | 06-bf-05/07 | 0000003d | 0000003e | Core Gen13/Gen14 | RPL-U 2+8 | Q0 | 06-ba-03/e0 | 00006133 | 00006134 | Core Gen13 | SPR-HBM | Bx | 06-8f-08/10 | 2c000410 | 2c000421 | Xeon Max | SPR-SP | E4/S2 | 06-8f-07/87 | 2b000650 | 2b000661 | Xeon Scalable Gen4 | SPR-SP | E5/S3 | 06-8f-08/87 | 2b000650 | 2b000661 | Xeon Scalable Gen4 | TGL | B0/B1 | 06-8c-01/80 | 000000bc | 000000be | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 00000056 | 00000058 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 0000003c | 0000003e | Core Gen11 Mobile | TWL | N0 | 06-be-00/19 | 0000001e | 00000021 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E ------------------------------------------------------------------ ------------------ 2026-2-10 - Feb 10 2026 ------------------- ------------------------------------------------------------------ ++++ ca-certificates-mozilla: - Updated to 2.84 state (bsc#1258002) - Removed: - Baltimore CyberTrust Root - CommScope Public Trust ECC Root-01 - CommScope Public Trust ECC Root-02 - CommScope Public Trust RSA Root-01 - CommScope Public Trust RSA Root-02 - DigiNotar Root CA - Added: - e-Szigno TLS Root CA 2023 - OISTE Client Root ECC G1 - OISTE Client Root RSA G1 - OISTE Server Root ECC G1 - OISTE Server Root RSA G1 - SwissSign RSA SMIME Root CA 2022 - 1 - SwissSign RSA TLS Root CA 2022 - 1 - TrustAsia SMIME ECC Root CA - TrustAsia SMIME RSA Root CA - TrustAsia TLS ECC Root CA - TrustAsia TLS RSA Root CA ++++ gnutls: - Security fix: * CVE-2025-14831: DoS via excessive resource consumption during certificate verification (bsc#1257960) * Add gnutls-CVE-2025-14831.patch ++++ kernel-default: - irqchip/gic-v3-its: Avoid truncating memory addresses (bsc#1257758 CVE-2026-23085) - commit e3370c0 - arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (bsc#1257762 CVE-2026-23107) - commit c430300 - arm64/fpsimd: signal: Fix restoration of SVE context (bsc#1257772 CVE-2026-23102) - commit 6759c0c - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state (bsc#1257772 CVE-2026-23102) - commit 1baf93e - net: tunnel: make skb_vlan_inet_prepare() return drop reasons (bsc#1257942 bsc#1257246 CVE-2026-23003). - commit 3935902 - vxlan: Pull inner IP header in vxlan_xmit_one() (bsc#1257942 bsc#1257246 CVE-2026-23003). - commit 8097957 - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (bsc#1257952) - commit 54f273c - spi: tegra210-quad: Protect curr_xfer clearing in (bsc#1257952) - commit 1da9508 - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (bsc#1257952) - commit 25ff6b8 - spi: tegra210-quad: Protect curr_xfer assignment in (bsc#1257952) - commit e3d34f8 - spi: tegra210-quad: Move curr_xfer read inside spinlock (bsc#1257952) - commit 4658841 - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed (bsc#1257952) - commit 997844c - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (git-fixes). - PM: wakeup: Handle empty list in wakeup_sources_walk_start() (git-fixes). - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (git-fixes). - tpm: st33zp24: Fix missing cleanup on get_burstcount() error (git-fixes). - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (git-fixes). - i3c: dw: Initialize spinlock to avoid upsetting lockdep (git-fixes). - i3c: Move device name assignment after i3c_bus_init (git-fixes). - auxdisplay: arm-charlcd: fix release_mem_region() size (git-fixes). - commit b423671 - workqueue: mark power efficient workqueue as unbounded if (bsc#1257891) - commit a0e31fb ++++ kernel-rt: - irqchip/gic-v3-its: Avoid truncating memory addresses (bsc#1257758 CVE-2026-23085) - commit e3370c0 - arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (bsc#1257762 CVE-2026-23107) - commit c430300 - arm64/fpsimd: signal: Fix restoration of SVE context (bsc#1257772 CVE-2026-23102) - commit 6759c0c - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state (bsc#1257772 CVE-2026-23102) - commit 1baf93e - net: tunnel: make skb_vlan_inet_prepare() return drop reasons (bsc#1257942 bsc#1257246 CVE-2026-23003). - commit 3935902 - vxlan: Pull inner IP header in vxlan_xmit_one() (bsc#1257942 bsc#1257246 CVE-2026-23003). - commit 8097957 - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (bsc#1257952) - commit 54f273c - spi: tegra210-quad: Protect curr_xfer clearing in (bsc#1257952) - commit 1da9508 - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (bsc#1257952) - commit 25ff6b8 - spi: tegra210-quad: Protect curr_xfer assignment in (bsc#1257952) - commit e3d34f8 - spi: tegra210-quad: Move curr_xfer read inside spinlock (bsc#1257952) - commit 4658841 - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed (bsc#1257952) - commit 997844c - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (git-fixes). - PM: wakeup: Handle empty list in wakeup_sources_walk_start() (git-fixes). - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (git-fixes). - tpm: st33zp24: Fix missing cleanup on get_burstcount() error (git-fixes). - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (git-fixes). - i3c: dw: Initialize spinlock to avoid upsetting lockdep (git-fixes). - i3c: Move device name assignment after i3c_bus_init (git-fixes). - auxdisplay: arm-charlcd: fix release_mem_region() size (git-fixes). - commit b423671 - workqueue: mark power efficient workqueue as unbounded if (bsc#1257891) - commit a0e31fb ++++ kernel-rt_debug: - irqchip/gic-v3-its: Avoid truncating memory addresses (bsc#1257758 CVE-2026-23085) - commit e3370c0 - arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (bsc#1257762 CVE-2026-23107) - commit c430300 - arm64/fpsimd: signal: Fix restoration of SVE context (bsc#1257772 CVE-2026-23102) - commit 6759c0c - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state (bsc#1257772 CVE-2026-23102) - commit 1baf93e - net: tunnel: make skb_vlan_inet_prepare() return drop reasons (bsc#1257942 bsc#1257246 CVE-2026-23003). - commit 3935902 - vxlan: Pull inner IP header in vxlan_xmit_one() (bsc#1257942 bsc#1257246 CVE-2026-23003). - commit 8097957 - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (bsc#1257952) - commit 54f273c - spi: tegra210-quad: Protect curr_xfer clearing in (bsc#1257952) - commit 1da9508 - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (bsc#1257952) - commit 25ff6b8 - spi: tegra210-quad: Protect curr_xfer assignment in (bsc#1257952) - commit e3d34f8 - spi: tegra210-quad: Move curr_xfer read inside spinlock (bsc#1257952) - commit 4658841 - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed (bsc#1257952) - commit 997844c - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (git-fixes). - PM: wakeup: Handle empty list in wakeup_sources_walk_start() (git-fixes). - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (git-fixes). - tpm: st33zp24: Fix missing cleanup on get_burstcount() error (git-fixes). - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (git-fixes). - i3c: dw: Initialize spinlock to avoid upsetting lockdep (git-fixes). - i3c: Move device name assignment after i3c_bus_init (git-fixes). - auxdisplay: arm-charlcd: fix release_mem_region() size (git-fixes). - commit b423671 - workqueue: mark power efficient workqueue as unbounded if (bsc#1257891) - commit a0e31fb ++++ nvidia-open-driver-G06-signed: - kernel-6.19.patch: fixes build against kernel 6.19 ------------------------------------------------------------------ ------------------ 2026-2-9 - Feb 9 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (CVE-2026-23089 bsc#1257790). - commit c09ea34 ++++ kernel-rt: - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (CVE-2026-23089 bsc#1257790). - commit c09ea34 ++++ kernel-rt_debug: - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (CVE-2026-23089 bsc#1257790). - commit c09ea34 ++++ rust-keylime: - Update vendored crates (bsc#1257908, CVE-2026-25727) * time 0.3.47 - Update to version 0.2.8+116: * build(deps): bump bytes from 1.7.2 to 1.11.1 * api: Modify /version endpoint output in version 2.5 * Add API v2.5 with backward-compatible /v2.5/quotes/integrity * tests: add unit test for resolve_agent_id (#1182) * (pull-model): enable retry logic for registration * rpm: Update specfiles to apply on master * workflows: Add test to detect unused crates * lib: Drop unused crates * push-model: Drop unused crates * keylime-agent: Drop unused crates * build(deps): bump uuid from 1.18.1 to 1.19.0 * Update reqwest-retry to 0.8, retry-policies to 0.5 * rpm: Fix cargo_build macro usage on CentOS Stream * fix(push-model): resolve hash_ek uuid to actual EK hash * build(deps): bump thiserror from 2.0.16 to 2.0.17 * workflows: Separate upstream test suite from e2e coverage * Send UEFI measured boot logs as raw bytes (#1173) * auth: Add unit tests for SecretToken implementation * packit: Enable push-attestation tests * resilient_client: Prevent authentication token leakage in logs ------------------------------------------------------------------ ------------------ 2026-2-8 - Feb 8 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - spi: tegra114: Preserve SPI mode bits in def_command1_reg (git-fixes). - spi: tegra: Fix a memory leak in tegra_slink_probe() (git-fixes). - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (git-fixes). - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (git-fixes). - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (git-fixes). - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (git-fixes). - spi: tegra210-quad: Move curr_xfer read inside spinlock (git-fixes). - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (git-fixes). - commit 95b4070 ++++ kernel-rt: - spi: tegra114: Preserve SPI mode bits in def_command1_reg (git-fixes). - spi: tegra: Fix a memory leak in tegra_slink_probe() (git-fixes). - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (git-fixes). - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (git-fixes). - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (git-fixes). - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (git-fixes). - spi: tegra210-quad: Move curr_xfer read inside spinlock (git-fixes). - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (git-fixes). - commit 95b4070 ++++ kernel-rt_debug: - spi: tegra114: Preserve SPI mode bits in def_command1_reg (git-fixes). - spi: tegra: Fix a memory leak in tegra_slink_probe() (git-fixes). - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (git-fixes). - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (git-fixes). - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (git-fixes). - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (git-fixes). - spi: tegra210-quad: Move curr_xfer read inside spinlock (git-fixes). - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (git-fixes). - commit 95b4070 ------------------------------------------------------------------ ------------------ 2026-2-7 - Feb 7 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - ALSA: hda/realtek: Add quirk for Inspur S14-G1 (stable-fixes). - ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP machine (stable-fixes). - ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (stable-fixes). - ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (stable-fixes). - ALSA: hda/realtek - fixed speaker no sound (stable-fixes). - commit e53fbb8 - ASoC: amd: fix memory leak in acp3x pdm dma ops (git-fixes). - ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (git-fixes). - hwmon: (occ) Mark occ_init_attribute() as __printf (git-fixes). - drm/amd/display: fix wrong color value mapping on MCM shaper LUT (git-fixes). - Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (git-fixes). - drm/mgag200: fix mgag200_bmc_stop_scanout() (git-fixes). - efivarfs: fix error propagation in efivar_entry_get() (git-fixes). - ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (stable-fixes). - gpio: pca953x: mask interrupts in irq shutdown (stable-fixes). - drm/amdgpu/gfx11: fix wptr reset in KGQ init (stable-fixes). - drm/amdgpu/gfx10: fix wptr reset in KGQ init (stable-fixes). - drm/amdgpu/soc21: fix xclk for APUs (stable-fixes). - pinctrl: meson: mark the GPIO controller as sleeping (git-fixes). - drm/radeon: delete radeon_fence_process in is_signaled, no deadlock (stable-fixes). - commit 1cabea4 ++++ kernel-rt: - ALSA: hda/realtek: Add quirk for Inspur S14-G1 (stable-fixes). - ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP machine (stable-fixes). - ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (stable-fixes). - ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (stable-fixes). - ALSA: hda/realtek - fixed speaker no sound (stable-fixes). - commit e53fbb8 - ASoC: amd: fix memory leak in acp3x pdm dma ops (git-fixes). - ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (git-fixes). - hwmon: (occ) Mark occ_init_attribute() as __printf (git-fixes). - drm/amd/display: fix wrong color value mapping on MCM shaper LUT (git-fixes). - Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (git-fixes). - drm/mgag200: fix mgag200_bmc_stop_scanout() (git-fixes). - efivarfs: fix error propagation in efivar_entry_get() (git-fixes). - ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (stable-fixes). - gpio: pca953x: mask interrupts in irq shutdown (stable-fixes). - drm/amdgpu/gfx11: fix wptr reset in KGQ init (stable-fixes). - drm/amdgpu/gfx10: fix wptr reset in KGQ init (stable-fixes). - drm/amdgpu/soc21: fix xclk for APUs (stable-fixes). - pinctrl: meson: mark the GPIO controller as sleeping (git-fixes). - drm/radeon: delete radeon_fence_process in is_signaled, no deadlock (stable-fixes). - commit 1cabea4 ++++ kernel-rt_debug: - ALSA: hda/realtek: Add quirk for Inspur S14-G1 (stable-fixes). - ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP machine (stable-fixes). - ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (stable-fixes). - ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (stable-fixes). - ALSA: hda/realtek - fixed speaker no sound (stable-fixes). - commit e53fbb8 - ASoC: amd: fix memory leak in acp3x pdm dma ops (git-fixes). - ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (git-fixes). - hwmon: (occ) Mark occ_init_attribute() as __printf (git-fixes). - drm/amd/display: fix wrong color value mapping on MCM shaper LUT (git-fixes). - Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (git-fixes). - drm/mgag200: fix mgag200_bmc_stop_scanout() (git-fixes). - efivarfs: fix error propagation in efivar_entry_get() (git-fixes). - ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (stable-fixes). - gpio: pca953x: mask interrupts in irq shutdown (stable-fixes). - drm/amdgpu/gfx11: fix wptr reset in KGQ init (stable-fixes). - drm/amdgpu/gfx10: fix wptr reset in KGQ init (stable-fixes). - drm/amdgpu/soc21: fix xclk for APUs (stable-fixes). - pinctrl: meson: mark the GPIO controller as sleeping (git-fixes). - drm/radeon: delete radeon_fence_process in is_signaled, no deadlock (stable-fixes). - commit 1cabea4 ------------------------------------------------------------------ ------------------ 2026-2-6 - Feb 6 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - net: openvswitch: fix middle attribute validation in push_nsh() action (CVE-2025-68785 bsc#1256640). - commit 3dbef50 - clocksource: Reduce watchdog readout delay limit to prevent false positives (bsc#1241345). - commit 6736e91 - clocksource: Print durations for sync check unconditionally (bsc#1241345). - commit 79738b2 ++++ kernel-rt: - net: openvswitch: fix middle attribute validation in push_nsh() action (CVE-2025-68785 bsc#1256640). - commit 3dbef50 - clocksource: Reduce watchdog readout delay limit to prevent false positives (bsc#1241345). - commit 6736e91 - clocksource: Print durations for sync check unconditionally (bsc#1241345). - commit 79738b2 ++++ kernel-rt_debug: - net: openvswitch: fix middle attribute validation in push_nsh() action (CVE-2025-68785 bsc#1256640). - commit 3dbef50 - clocksource: Reduce watchdog readout delay limit to prevent false positives (bsc#1241345). - commit 6736e91 - clocksource: Print durations for sync check unconditionally (bsc#1241345). - commit 79738b2 ------------------------------------------------------------------ ------------------ 2026-2-5 - Feb 5 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - iomap: account for unaligned end offsets when truncating read range (git-fixes). - blacklist.conf: Blacklist 40a71b53d5a6 and 524c3853831c - commit 6f0c964 - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (git-fixes). - commit c2e8303 - mptcp: avoid deadlock on fallback while reinjecting (CVE-2025-71126 bsc#1256755). - mptcp: reset fallback status gracefully at disconnect() time (CVE-2025-71126 bsc#1256755). - commit 3b7ecc1 ++++ kernel-rt: - iomap: account for unaligned end offsets when truncating read range (git-fixes). - blacklist.conf: Blacklist 40a71b53d5a6 and 524c3853831c - commit 6f0c964 - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (git-fixes). - commit c2e8303 - mptcp: avoid deadlock on fallback while reinjecting (CVE-2025-71126 bsc#1256755). - mptcp: reset fallback status gracefully at disconnect() time (CVE-2025-71126 bsc#1256755). - commit 3b7ecc1 ++++ kernel-rt_debug: - iomap: account for unaligned end offsets when truncating read range (git-fixes). - blacklist.conf: Blacklist 40a71b53d5a6 and 524c3853831c - commit 6f0c964 - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (git-fixes). - commit c2e8303 - mptcp: avoid deadlock on fallback while reinjecting (CVE-2025-71126 bsc#1256755). - mptcp: reset fallback status gracefully at disconnect() time (CVE-2025-71126 bsc#1256755). - commit 3b7ecc1 ++++ read-only-root-fs: - Add patch to fix workaround for read-only / subvolumes (bsc#1252892): * 0001-Fix-workaround-for-read-only-subvolumes-by-remountin.patch ++++ regionServiceClientConfigGCE: - Update to version 5.2.0 + Drop the if condition for gcemetdata requirement ------------------------------------------------------------------ ------------------ 2026-2-4 - Feb 4 2026 ------------------- ------------------------------------------------------------------ ++++ cockpit: - Update dependencies for bsc#1257324/CVE-2025-13465 ++++ cockpit-machines: - Update dependencies for bsc#1257325/CVE-2025-13465 ++++ docker: - Places a hard cap on the amount of mechanisms that can be specified and encoded in the payload. (bcs#1253904, CVE-2025-58181) * 0007-CVE-2025-58181-fix-vendor-crypto-ssh.patch ++++ kernel-default: - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CVE-2026-23003 bsc#1257246). - commit 2b67457 - geneve: Fix incorrect inner network header offset when innerprotoinherit is set (CVE-2026-23003 bsc#1257246). - commit 167d4d3 - platform/x86: intel_telemetry: Fix PSS event register mask (git-fixes). - platform/x86: intel_telemetry: Fix swapped arrays in PSS output (git-fixes). - platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (git-fixes). - commit 41b7ff7 - btrfs: scrub: always update btrfs_scrub_progress::last_physical (git-fixes). - commit b2c29ef ++++ kernel-rt: - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CVE-2026-23003 bsc#1257246). - commit 2b67457 - geneve: Fix incorrect inner network header offset when innerprotoinherit is set (CVE-2026-23003 bsc#1257246). - commit 167d4d3 - platform/x86: intel_telemetry: Fix PSS event register mask (git-fixes). - platform/x86: intel_telemetry: Fix swapped arrays in PSS output (git-fixes). - platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (git-fixes). - commit 41b7ff7 - btrfs: scrub: always update btrfs_scrub_progress::last_physical (git-fixes). - commit b2c29ef ++++ kernel-rt_debug: - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CVE-2026-23003 bsc#1257246). - commit 2b67457 - geneve: Fix incorrect inner network header offset when innerprotoinherit is set (CVE-2026-23003 bsc#1257246). - commit 167d4d3 - platform/x86: intel_telemetry: Fix PSS event register mask (git-fixes). - platform/x86: intel_telemetry: Fix swapped arrays in PSS output (git-fixes). - platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (git-fixes). - commit 41b7ff7 - btrfs: scrub: always update btrfs_scrub_progress::last_physical (git-fixes). - commit b2c29ef ++++ libxslt: - CVE-2025-10911 will be fixed on libxml2 side instead [bsc#1250553] - deleted patches * libxslt-CVE-2025-10911.patch ++++ libxml2: - CVE-2026-1757: memory leak in the `xmllint` interactive shell (bsc#1257593, bsc#1257594, bsc#1257595) * Add patch libxml2-CVE-2026-1757.patch - CVE-2025-10911: use-after-free with key data stored cross-RVT (bsc#1250553) * Add patch libxml2-CVE-2025-10911.patch ++++ opensuse-migration-tool: - Update to version 20260204.2cf77a3: * Drop requires on update-bootloader as it's not available on 15.6. Install it in post-script on target of migration instead. boo#1255897 * Refine post-scritps * Ensure update bootloader is installed in post scripts * don't install selinux-policy-targeted-gaming by default ++++ libxml2-python: - CVE-2026-1757: memory leak in the `xmllint` interactive shell (bsc#1257593, bsc#1257594, bsc#1257595) * Add patch libxml2-CVE-2026-1757.patch - CVE-2025-10911: use-after-free with key data stored cross-RVT (bsc#1250553) * Add patch libxml2-CVE-2025-10911.patch ------------------------------------------------------------------ ------------------ 2026-2-3 - Feb 3 2026 ------------------- ------------------------------------------------------------------ ++++ docker-compose: - Add patch for CVE-2025-47914 (bsc#1254041), CVE-2025-47913 (bsc#1253584): 0001-CVE-2025-47913-CVE-2025-47914-ssh-agent-fixes.patch ++++ kernel-default: - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990 bsc#1257221). - commit 0a3e886 - libceph: make free_choose_arg_map() resilient to partial allocation (CVE-2026-22991 bsc#1257220). - commit 2e431bc - libceph: return the handler error from mon_handle_auth_done() (CVE-2026-22992 bsc#1257218). - commit 518f909 - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CVE-2026-22984 bsc#1257217). - commit 7474e34 - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (bsc#1254447 bsc#1253087). - commit e90ec28 - bpf/selftests: test_select_reuseport_kern: Remove unused header (bsc#1257603). - commit 3124f7b ++++ kernel-rt: - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990 bsc#1257221). - commit 0a3e886 - libceph: make free_choose_arg_map() resilient to partial allocation (CVE-2026-22991 bsc#1257220). - commit 2e431bc - libceph: return the handler error from mon_handle_auth_done() (CVE-2026-22992 bsc#1257218). - commit 518f909 - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CVE-2026-22984 bsc#1257217). - commit 7474e34 - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (bsc#1254447 bsc#1253087). - commit e90ec28 - bpf/selftests: test_select_reuseport_kern: Remove unused header (bsc#1257603). - commit 3124f7b ++++ kernel-rt_debug: - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990 bsc#1257221). - commit 0a3e886 - libceph: make free_choose_arg_map() resilient to partial allocation (CVE-2026-22991 bsc#1257220). - commit 2e431bc - libceph: return the handler error from mon_handle_auth_done() (CVE-2026-22992 bsc#1257218). - commit 518f909 - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CVE-2026-22984 bsc#1257217). - commit 7474e34 - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (bsc#1254447 bsc#1253087). - commit e90ec28 - bpf/selftests: test_select_reuseport_kern: Remove unused header (bsc#1257603). - commit 3124f7b ++++ expat: - version update to 2.7.4 * CVE-2026-24515 -- Function XML_ExternalEntityParserCreate failed to copy the encoding handler data passed to XML_SetUnknownEncodingHandler from the parent to the new subparser. This can cause a NULL dereference (CWE-476) from external entities that declare use of an unknown encoding. The expected impact is denial of service. It takes use of both functions XML_ExternalEntityParserCreate and XML_SetUnknownEncodingHandler for an application to be vulnerable. * CVE-2026-25210 -- Add missing check for integer overflow related to buffer size determination in function doContent * lib: Fix missing undoing of group size expansion in doProlog failure cases * xmlwf: Fix a memory leak * WASI: Fix format specifiers for 32bit WASI SDK - fixes [bsc#1257144] and [bsc#1257496] ++++ libsoup: - Add libsoup-CVE-2026-1536.patch: Always validate the headers value when coming from untrusted source (bsc#1257440, CVE-2026-1536, glgo#GNOME/libsoup/commit/5c1a2e9c). - Add libsoup-CVE-2026-1761.patch: multipart: check length of bytes read soup_filter_input_stream_read_until() (bsc#1257598, CVE-2026-1761, glgo#GNOME/libsoup!496). ------------------------------------------------------------------ ------------------ 2026-2-2 - Feb 2 2026 ------------------- ------------------------------------------------------------------ ++++ cockpit-podman: - Update dependencies for bsc#1257324/CVE-2025-13465 ++++ kernel-default: - smb: client: short-circuit in open_cached_dir_by_dentry() if !dentry (git-fixes). - commit 82d6911 - smb: client: ensure open_cached_dir_by_dentry() only returns valid cfid (git-fixes). - commit d1feafe - smb: client: split cached_fid bitfields to avoid shared-byte RMW races (bsc#1250748,bsc#1257154). - commit e7ce4ba - scripts/python/git_sort/git_sort.yaml: add cifs for-next repository - commit 0d24c51 - smb: improve directory cache reuse for readdir operations (bsc#1252712). - commit 20c0243 - smb: client: remove unused fid_lock (git-fixes). - commit ed3cf07 - smb: client: update cfid->last_access_time in open_cached_dir_by_dentry() (git-fixes). - commit 1962196 - cifs: add new field to track the last access time of cfid (git-fixes). - commit 7328aa8 - smb: change return type of cached_dir_lease_break() to bool (git-fixes). - commit da8604d - ipv6: Fix use-after-free in inet6_addr_del() (CVE-2026-23010 bsc#1257332). - commit 0f213a3 - net: mscc: ocelot: Fix crash when adding interface under a lag (CVE-2026-22982 bsc#1257179). - net/handshake: restore destructor on submit failure (CVE-2025-71148 bsc#1257159). - commit 08069be - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (CVE-2025-68284 bsc#1255377). - commit 16880ae - Update config files: disable CONFIG_DEVPORT for arm64 (bsc#1256792) - commit b3a8e60 - x86/fpu: Clear XSTATE_BV in guest XSAVE state whenever XFD[i]=1 (CVE-2026-23005 bsc#1257245). - commit 4fcc2d5 - Update patches.suse/ALSA-hda-Fix-missing-pointer-check-in-hda_component_.patch (git-fixes CVE-2025-40097 bsc#1252900). - Update patches.suse/ASoC-stm32-sai-fix-OF-node-leak-on-probe.patch (git-fixes CVE-2025-71081 bsc#1256609). - Update patches.suse/KEYS-trusted-Fix-a-memory-leak-in-tpm2_load_cmd.patch (git-fixes CVE-2025-71147 bsc#1257158). - Update patches.suse/btrfs-fix-adding-block-group-to-a-reclaim-list-and-t.patch (git-fixes CVE-2024-42103 bsc#1228490). - Update patches.suse/btrfs-fix-invalid-inode-pointer-dereferences-during-.patch (git-fixes CVE-2025-38243 bsc#1246184). - Update patches.suse/drm-stm-ltdc-fix-late-dereference-check.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-53714 bsc#1254465). - Update patches.suse/drm-ttm-Avoid-NULL-pointer-deref-for-evicted-BOs.patch (git-fixes CVE-2025-71083 bsc#1256610). - Update patches.suse/ftrace-Also-allocate-and-copy-hash-for-reading-of-filter-f.patch (bsc#1250032 CVE-2025-39813 CVE-2025-39689 bsc#1249307). - Update patches.suse/hwmon-w83791d-Convert-macros-to-functions-to-avoid-T.patch (git-fixes CVE-2025-71111 bsc#1256728). - Update patches.suse/ipmi-Rework-user-message-limit-handling.patch (git-fixes CVE-2025-40202 bsc#1253451). - Update patches.suse/media-adv7842-Avoid-possible-out-of-bounds-array-acc.patch (git-fixes CVE-2025-71136 bsc#1256759). - Update patches.suse/media-dvb-usb-dtv5100-fix-out-of-bounds-in-dtv5100_i.patch (git-fixes CVE-2025-68819 bsc#1256664). - Update patches.suse/media-vidtv-initialize-local-pointers-upon-transfer-.patch (git-fixes CVE-2025-68808 bsc#1256682). - Update patches.suse/perf-x86-intel-Fix-crash-in-icl_update_topdown_event.patch (git-fixes CVE-2025-38322 bsc#1246447). - Update patches.suse/platform-chrome-cros_ec_ishtp-Fix-UAF-after-unbindin.patch (git-fixes CVE-2025-68804 bsc#1256617). - Update patches.suse/powerpc-64s-slb-Fix-SLB-multihit-issue-during-SLB-preload.patch (bac#1236022 ltc#211187 CVE-2025-71078 bsc#1256616). - Update patches.suse/smb-client-fix-warning-when-reconnecting-channel.patch (git-fixes CVE-2025-38379 bsc#1247030). - Update patches.suse/tcp_bpf-Call-sk_msg_free-when-tcp_bpf_send_verdict-f.patch (bsc#1250705 CVE-2025-39913). - Update patches.suse/trace-fgraph-Fix-the-warning-caused-by-missing-unregister-.patch (bsc#1248211 CVE-2025-38539 CVE-2025-39829 bsc#1250082). - Update patches.suse/usb-dwc3-fix-fault-at-system-suspend-if-device-was-a.patch (git-fixes CVE-2024-53070 bsc#1233563). - Update patches.suse/usb-typec-ucsi-glink-fix-off-by-one-in-connector_sta.patch (git-fixes CVE-2024-53149 bsc#1234842). - Update patches.suse/usb-xhci-Fix-invalid-pointer-dereference-in-Etron-wo.patch (git-fixes CVE-2025-37813 bsc#1242909). - Update patches.suse/x86-microcode-AMD-Fix-__apply_microcode_amd-s-return.patch (bsc#1256528 CVE-2025-22047 bsc#1241437). - commit fbc3d71 - Update patches.suse/ACPICA-Avoid-walking-the-Namespace-if-start_node-is-.patch (stable-fixes CVE-2025-71118 bsc#1256763). - Update patches.suse/ALSA-usb-mixer-us16x08-validate-meter-packet-indices.patch (git-fixes CVE-2025-68783 bsc#1256650). - Update patches.suse/ASoC-tlv320adcx140-fix-null-pointer.patch (git-fixes CVE-2026-23006 bsc#1257208). - Update patches.suse/Bluetooth-btusb-revert-use-of-devm_kzalloc-in-btusb.patch (git-fixes CVE-2025-71082 bsc#1256611). - Update patches.suse/Input-ti_am335x_tsc-fix-off-by-one-error-in-wire_ord.patch (git-fixes CVE-2025-68777 bsc#1256655). - Update patches.suse/arp-do-not-assume-dev_hard_header-does-not-change-skb-head.patch (CVE-2025-71098 bsc#1256591 CVE-2026-22988 bsc#1257282). - Update patches.suse/bpf-Do-not-let-BPF-test-infra-emit-invalid-GSO-types.patch (bsc#1255569 CVE-2025-68725). - Update patches.suse/char-applicom-fix-NULL-pointer-dereference-in-ac_ioc.patch (stable-fixes CVE-2025-68797 bsc#1256660). - Update patches.suse/comedi-fix-divide-by-zero-in-comedi_buf_munge.patch (stable-fixes CVE-2025-40106 bsc#1252891). - Update patches.suse/crypto-seqiv-Do-not-use-req-iv-after-crypto_aead_enc.patch (git-fixes CVE-2025-71131 bsc#1256742). - Update patches.suse/dmaengine-idxd-fix-device-leaks-on-compat-bind-and-u.patch (git-fixes CVE-2025-71163 bsc#1257215). - Update patches.suse/dmaengine-tegra-adma-Fix-use-after-free.patch (git-fixes CVE-2025-71162 bsc#1257204). - Update patches.suse/drm-i915-gem-Zero-initialize-the-eb.vma-array-in-i91.patch (git-fixes CVE-2025-71130 bsc#1256741). - Update patches.suse/drm-msm-dpu-Add-missing-NULL-pointer-check-for-pingp.patch (git-fixes CVE-2025-71138 bsc#1256785). - Update patches.suse/hwmon-ibmpex-fix-use-after-free-in-high-low-store.patch (git-fixes CVE-2025-68789 bsc#1256781). - Update patches.suse/idpf-Fix-RSS-LUT-NULL-pointer-crash-on-early-ethtool.patch (CVE-2026-22993 bsc#1257180 CVE-2026-22985 bsc#1257277). - Update patches.suse/interconnect-Don-t-access-req_list-while-it-s-being-.patch (CVE-2023-54013 bsc#1256280 CVE-2024-27005 bsc#1223800). - Update patches.suse/net-can-j1939-j1939_xtp_rx_rts_session_active-deacti.patch (git-fixes CVE-2026-22997 bsc#1257202). - Update patches.suse/net-nfc-fix-deadlock-between-nfc_unregister_device-a.patch (git-fixes CVE-2025-71079 bsc#1256619). - Update patches.suse/net-rose-fix-invalid-array-index-in-rose_kill_by_dev.patch (git-fixes CVE-2025-71086 bsc#1256625). - Update patches.suse/net-usb-rtl8150-fix-memory-leak-on-usb_submit_urb-fa.patch (git-fixes CVE-2025-71154 bsc#1257163). - Update patches.suse/powerpc-kexec-Enable-SMT-before-waking-offline-CPUs.patch (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588 git-fixes bsc#1253739 ltc#211493 bsc#1254244 ltc#216496 CVE-2025-71119 bsc#1256730). - Update patches.suse/smc91x-fix-broken-irq-context-in-PREEMPT_RT.patch (git-fixes CVE-2025-71132 bsc#1256737). - Update patches.suse/spi-fsl-cpm-Check-length-parity-before-switching-to-.patch (git-fixes CVE-2025-68773 bsc#1256586). - Update patches.suse/staging-rtl8723bs-fix-out-of-bounds-read-in-OnBeacon.patch (stable-fixes CVE-2025-68254 bsc#1255140). - Update patches.suse/staging-rtl8723bs-fix-out-of-bounds-read-in-rtw_get_.patch (stable-fixes CVE-2025-68256 bsc#1255138). - Update patches.suse/usb-phy-isp1301-fix-non-OF-device-reference-imbalanc.patch (git-fixes CVE-2025-71145 bsc#1257155). - Update patches.suse/usb-typec-ucsi-Handle-incorrect-num_connectors-capab.patch (stable-fixes CVE-2025-71108 bsc#1256774). - Update patches.suse/via_wdt-fix-critical-boot-hang-due-to-unnamed-resour.patch (stable-fixes CVE-2025-71114 bsc#1256752). - Update patches.suse/wifi-avoid-kernel-infoleak-from-struct-iw_point.patch (git-fixes CVE-2026-22978 bsc#1257227). - Update patches.suse/wifi-rtlwifi-8192cu-fix-tid-out-of-range-in-rtl92cu_.patch (git-fixes CVE-2025-71100 bsc#1256593). - commit 856d20b - powerpc/addnote: Fix overflow on 32-bit builds (bsc#1215199). - commit b73475a - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (CVE-2026-22996). - net/mlx5e: Fix crash on profile change rollback failure (CVE-2026-23000 bsc#1257234). - commit 46ccefc - macvlan: fix possible UAF in macvlan_forward_source() (CVE-2026-23001 bsc#1257232). - commit bcf0129 - gpio: rockchip: Stop calling pinctrl for set_direction (git-fixes). - commit 8cea9c9 ++++ kernel-rt: - smb: client: short-circuit in open_cached_dir_by_dentry() if !dentry (git-fixes). - commit 82d6911 - smb: client: ensure open_cached_dir_by_dentry() only returns valid cfid (git-fixes). - commit d1feafe - smb: client: split cached_fid bitfields to avoid shared-byte RMW races (bsc#1250748,bsc#1257154). - commit e7ce4ba - scripts/python/git_sort/git_sort.yaml: add cifs for-next repository - commit 0d24c51 - smb: improve directory cache reuse for readdir operations (bsc#1252712). - commit 20c0243 - smb: client: remove unused fid_lock (git-fixes). - commit ed3cf07 - smb: client: update cfid->last_access_time in open_cached_dir_by_dentry() (git-fixes). - commit 1962196 - cifs: add new field to track the last access time of cfid (git-fixes). - commit 7328aa8 - smb: change return type of cached_dir_lease_break() to bool (git-fixes). - commit da8604d - ipv6: Fix use-after-free in inet6_addr_del() (CVE-2026-23010 bsc#1257332). - commit 0f213a3 - net: mscc: ocelot: Fix crash when adding interface under a lag (CVE-2026-22982 bsc#1257179). - net/handshake: restore destructor on submit failure (CVE-2025-71148 bsc#1257159). - commit 08069be - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (CVE-2025-68284 bsc#1255377). - commit 16880ae - Update config files: disable CONFIG_DEVPORT for arm64 (bsc#1256792) - commit b3a8e60 - x86/fpu: Clear XSTATE_BV in guest XSAVE state whenever XFD[i]=1 (CVE-2026-23005 bsc#1257245). - commit 4fcc2d5 - Update patches.suse/ALSA-hda-Fix-missing-pointer-check-in-hda_component_.patch (git-fixes CVE-2025-40097 bsc#1252900). - Update patches.suse/ASoC-stm32-sai-fix-OF-node-leak-on-probe.patch (git-fixes CVE-2025-71081 bsc#1256609). - Update patches.suse/KEYS-trusted-Fix-a-memory-leak-in-tpm2_load_cmd.patch (git-fixes CVE-2025-71147 bsc#1257158). - Update patches.suse/btrfs-fix-adding-block-group-to-a-reclaim-list-and-t.patch (git-fixes CVE-2024-42103 bsc#1228490). - Update patches.suse/btrfs-fix-invalid-inode-pointer-dereferences-during-.patch (git-fixes CVE-2025-38243 bsc#1246184). - Update patches.suse/drm-stm-ltdc-fix-late-dereference-check.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-53714 bsc#1254465). - Update patches.suse/drm-ttm-Avoid-NULL-pointer-deref-for-evicted-BOs.patch (git-fixes CVE-2025-71083 bsc#1256610). - Update patches.suse/ftrace-Also-allocate-and-copy-hash-for-reading-of-filter-f.patch (bsc#1250032 CVE-2025-39813 CVE-2025-39689 bsc#1249307). - Update patches.suse/hwmon-w83791d-Convert-macros-to-functions-to-avoid-T.patch (git-fixes CVE-2025-71111 bsc#1256728). - Update patches.suse/ipmi-Rework-user-message-limit-handling.patch (git-fixes CVE-2025-40202 bsc#1253451). - Update patches.suse/media-adv7842-Avoid-possible-out-of-bounds-array-acc.patch (git-fixes CVE-2025-71136 bsc#1256759). - Update patches.suse/media-dvb-usb-dtv5100-fix-out-of-bounds-in-dtv5100_i.patch (git-fixes CVE-2025-68819 bsc#1256664). - Update patches.suse/media-vidtv-initialize-local-pointers-upon-transfer-.patch (git-fixes CVE-2025-68808 bsc#1256682). - Update patches.suse/perf-x86-intel-Fix-crash-in-icl_update_topdown_event.patch (git-fixes CVE-2025-38322 bsc#1246447). - Update patches.suse/platform-chrome-cros_ec_ishtp-Fix-UAF-after-unbindin.patch (git-fixes CVE-2025-68804 bsc#1256617). - Update patches.suse/powerpc-64s-slb-Fix-SLB-multihit-issue-during-SLB-preload.patch (bac#1236022 ltc#211187 CVE-2025-71078 bsc#1256616). - Update patches.suse/smb-client-fix-warning-when-reconnecting-channel.patch (git-fixes CVE-2025-38379 bsc#1247030). - Update patches.suse/tcp_bpf-Call-sk_msg_free-when-tcp_bpf_send_verdict-f.patch (bsc#1250705 CVE-2025-39913). - Update patches.suse/trace-fgraph-Fix-the-warning-caused-by-missing-unregister-.patch (bsc#1248211 CVE-2025-38539 CVE-2025-39829 bsc#1250082). - Update patches.suse/usb-dwc3-fix-fault-at-system-suspend-if-device-was-a.patch (git-fixes CVE-2024-53070 bsc#1233563). - Update patches.suse/usb-typec-ucsi-glink-fix-off-by-one-in-connector_sta.patch (git-fixes CVE-2024-53149 bsc#1234842). - Update patches.suse/usb-xhci-Fix-invalid-pointer-dereference-in-Etron-wo.patch (git-fixes CVE-2025-37813 bsc#1242909). - Update patches.suse/x86-microcode-AMD-Fix-__apply_microcode_amd-s-return.patch (bsc#1256528 CVE-2025-22047 bsc#1241437). - commit fbc3d71 - Update patches.suse/ACPICA-Avoid-walking-the-Namespace-if-start_node-is-.patch (stable-fixes CVE-2025-71118 bsc#1256763). - Update patches.suse/ALSA-usb-mixer-us16x08-validate-meter-packet-indices.patch (git-fixes CVE-2025-68783 bsc#1256650). - Update patches.suse/ASoC-tlv320adcx140-fix-null-pointer.patch (git-fixes CVE-2026-23006 bsc#1257208). - Update patches.suse/Bluetooth-btusb-revert-use-of-devm_kzalloc-in-btusb.patch (git-fixes CVE-2025-71082 bsc#1256611). - Update patches.suse/Input-ti_am335x_tsc-fix-off-by-one-error-in-wire_ord.patch (git-fixes CVE-2025-68777 bsc#1256655). - Update patches.suse/arp-do-not-assume-dev_hard_header-does-not-change-skb-head.patch (CVE-2025-71098 bsc#1256591 CVE-2026-22988 bsc#1257282). - Update patches.suse/bpf-Do-not-let-BPF-test-infra-emit-invalid-GSO-types.patch (bsc#1255569 CVE-2025-68725). - Update patches.suse/char-applicom-fix-NULL-pointer-dereference-in-ac_ioc.patch (stable-fixes CVE-2025-68797 bsc#1256660). - Update patches.suse/comedi-fix-divide-by-zero-in-comedi_buf_munge.patch (stable-fixes CVE-2025-40106 bsc#1252891). - Update patches.suse/crypto-seqiv-Do-not-use-req-iv-after-crypto_aead_enc.patch (git-fixes CVE-2025-71131 bsc#1256742). - Update patches.suse/dmaengine-idxd-fix-device-leaks-on-compat-bind-and-u.patch (git-fixes CVE-2025-71163 bsc#1257215). - Update patches.suse/dmaengine-tegra-adma-Fix-use-after-free.patch (git-fixes CVE-2025-71162 bsc#1257204). - Update patches.suse/drm-i915-gem-Zero-initialize-the-eb.vma-array-in-i91.patch (git-fixes CVE-2025-71130 bsc#1256741). - Update patches.suse/drm-msm-dpu-Add-missing-NULL-pointer-check-for-pingp.patch (git-fixes CVE-2025-71138 bsc#1256785). - Update patches.suse/hwmon-ibmpex-fix-use-after-free-in-high-low-store.patch (git-fixes CVE-2025-68789 bsc#1256781). - Update patches.suse/idpf-Fix-RSS-LUT-NULL-pointer-crash-on-early-ethtool.patch (CVE-2026-22993 bsc#1257180 CVE-2026-22985 bsc#1257277). - Update patches.suse/interconnect-Don-t-access-req_list-while-it-s-being-.patch (CVE-2023-54013 bsc#1256280 CVE-2024-27005 bsc#1223800). - Update patches.suse/net-can-j1939-j1939_xtp_rx_rts_session_active-deacti.patch (git-fixes CVE-2026-22997 bsc#1257202). - Update patches.suse/net-nfc-fix-deadlock-between-nfc_unregister_device-a.patch (git-fixes CVE-2025-71079 bsc#1256619). - Update patches.suse/net-rose-fix-invalid-array-index-in-rose_kill_by_dev.patch (git-fixes CVE-2025-71086 bsc#1256625). - Update patches.suse/net-usb-rtl8150-fix-memory-leak-on-usb_submit_urb-fa.patch (git-fixes CVE-2025-71154 bsc#1257163). - Update patches.suse/powerpc-kexec-Enable-SMT-before-waking-offline-CPUs.patch (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588 git-fixes bsc#1253739 ltc#211493 bsc#1254244 ltc#216496 CVE-2025-71119 bsc#1256730). - Update patches.suse/smc91x-fix-broken-irq-context-in-PREEMPT_RT.patch (git-fixes CVE-2025-71132 bsc#1256737). - Update patches.suse/spi-fsl-cpm-Check-length-parity-before-switching-to-.patch (git-fixes CVE-2025-68773 bsc#1256586). - Update patches.suse/staging-rtl8723bs-fix-out-of-bounds-read-in-OnBeacon.patch (stable-fixes CVE-2025-68254 bsc#1255140). - Update patches.suse/staging-rtl8723bs-fix-out-of-bounds-read-in-rtw_get_.patch (stable-fixes CVE-2025-68256 bsc#1255138). - Update patches.suse/usb-phy-isp1301-fix-non-OF-device-reference-imbalanc.patch (git-fixes CVE-2025-71145 bsc#1257155). - Update patches.suse/usb-typec-ucsi-Handle-incorrect-num_connectors-capab.patch (stable-fixes CVE-2025-71108 bsc#1256774). - Update patches.suse/via_wdt-fix-critical-boot-hang-due-to-unnamed-resour.patch (stable-fixes CVE-2025-71114 bsc#1256752). - Update patches.suse/wifi-avoid-kernel-infoleak-from-struct-iw_point.patch (git-fixes CVE-2026-22978 bsc#1257227). - Update patches.suse/wifi-rtlwifi-8192cu-fix-tid-out-of-range-in-rtl92cu_.patch (git-fixes CVE-2025-71100 bsc#1256593). - commit 856d20b - powerpc/addnote: Fix overflow on 32-bit builds (bsc#1215199). - commit b73475a - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (CVE-2026-22996). - net/mlx5e: Fix crash on profile change rollback failure (CVE-2026-23000 bsc#1257234). - commit 46ccefc - macvlan: fix possible UAF in macvlan_forward_source() (CVE-2026-23001 bsc#1257232). - commit bcf0129 - gpio: rockchip: Stop calling pinctrl for set_direction (git-fixes). - commit 8cea9c9 ++++ kernel-rt_debug: - smb: client: short-circuit in open_cached_dir_by_dentry() if !dentry (git-fixes). - commit 82d6911 - smb: client: ensure open_cached_dir_by_dentry() only returns valid cfid (git-fixes). - commit d1feafe - smb: client: split cached_fid bitfields to avoid shared-byte RMW races (bsc#1250748,bsc#1257154). - commit e7ce4ba - scripts/python/git_sort/git_sort.yaml: add cifs for-next repository - commit 0d24c51 - smb: improve directory cache reuse for readdir operations (bsc#1252712). - commit 20c0243 - smb: client: remove unused fid_lock (git-fixes). - commit ed3cf07 - smb: client: update cfid->last_access_time in open_cached_dir_by_dentry() (git-fixes). - commit 1962196 - cifs: add new field to track the last access time of cfid (git-fixes). - commit 7328aa8 - smb: change return type of cached_dir_lease_break() to bool (git-fixes). - commit da8604d - ipv6: Fix use-after-free in inet6_addr_del() (CVE-2026-23010 bsc#1257332). - commit 0f213a3 - net: mscc: ocelot: Fix crash when adding interface under a lag (CVE-2026-22982 bsc#1257179). - net/handshake: restore destructor on submit failure (CVE-2025-71148 bsc#1257159). - commit 08069be - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (CVE-2025-68284 bsc#1255377). - commit 16880ae - Update config files: disable CONFIG_DEVPORT for arm64 (bsc#1256792) - commit b3a8e60 - x86/fpu: Clear XSTATE_BV in guest XSAVE state whenever XFD[i]=1 (CVE-2026-23005 bsc#1257245). - commit 4fcc2d5 - Update patches.suse/ALSA-hda-Fix-missing-pointer-check-in-hda_component_.patch (git-fixes CVE-2025-40097 bsc#1252900). - Update patches.suse/ASoC-stm32-sai-fix-OF-node-leak-on-probe.patch (git-fixes CVE-2025-71081 bsc#1256609). - Update patches.suse/KEYS-trusted-Fix-a-memory-leak-in-tpm2_load_cmd.patch (git-fixes CVE-2025-71147 bsc#1257158). - Update patches.suse/btrfs-fix-adding-block-group-to-a-reclaim-list-and-t.patch (git-fixes CVE-2024-42103 bsc#1228490). - Update patches.suse/btrfs-fix-invalid-inode-pointer-dereferences-during-.patch (git-fixes CVE-2025-38243 bsc#1246184). - Update patches.suse/drm-stm-ltdc-fix-late-dereference-check.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-53714 bsc#1254465). - Update patches.suse/drm-ttm-Avoid-NULL-pointer-deref-for-evicted-BOs.patch (git-fixes CVE-2025-71083 bsc#1256610). - Update patches.suse/ftrace-Also-allocate-and-copy-hash-for-reading-of-filter-f.patch (bsc#1250032 CVE-2025-39813 CVE-2025-39689 bsc#1249307). - Update patches.suse/hwmon-w83791d-Convert-macros-to-functions-to-avoid-T.patch (git-fixes CVE-2025-71111 bsc#1256728). - Update patches.suse/ipmi-Rework-user-message-limit-handling.patch (git-fixes CVE-2025-40202 bsc#1253451). - Update patches.suse/media-adv7842-Avoid-possible-out-of-bounds-array-acc.patch (git-fixes CVE-2025-71136 bsc#1256759). - Update patches.suse/media-dvb-usb-dtv5100-fix-out-of-bounds-in-dtv5100_i.patch (git-fixes CVE-2025-68819 bsc#1256664). - Update patches.suse/media-vidtv-initialize-local-pointers-upon-transfer-.patch (git-fixes CVE-2025-68808 bsc#1256682). - Update patches.suse/perf-x86-intel-Fix-crash-in-icl_update_topdown_event.patch (git-fixes CVE-2025-38322 bsc#1246447). - Update patches.suse/platform-chrome-cros_ec_ishtp-Fix-UAF-after-unbindin.patch (git-fixes CVE-2025-68804 bsc#1256617). - Update patches.suse/powerpc-64s-slb-Fix-SLB-multihit-issue-during-SLB-preload.patch (bac#1236022 ltc#211187 CVE-2025-71078 bsc#1256616). - Update patches.suse/smb-client-fix-warning-when-reconnecting-channel.patch (git-fixes CVE-2025-38379 bsc#1247030). - Update patches.suse/tcp_bpf-Call-sk_msg_free-when-tcp_bpf_send_verdict-f.patch (bsc#1250705 CVE-2025-39913). - Update patches.suse/trace-fgraph-Fix-the-warning-caused-by-missing-unregister-.patch (bsc#1248211 CVE-2025-38539 CVE-2025-39829 bsc#1250082). - Update patches.suse/usb-dwc3-fix-fault-at-system-suspend-if-device-was-a.patch (git-fixes CVE-2024-53070 bsc#1233563). - Update patches.suse/usb-typec-ucsi-glink-fix-off-by-one-in-connector_sta.patch (git-fixes CVE-2024-53149 bsc#1234842). - Update patches.suse/usb-xhci-Fix-invalid-pointer-dereference-in-Etron-wo.patch (git-fixes CVE-2025-37813 bsc#1242909). - Update patches.suse/x86-microcode-AMD-Fix-__apply_microcode_amd-s-return.patch (bsc#1256528 CVE-2025-22047 bsc#1241437). - commit fbc3d71 - Update patches.suse/ACPICA-Avoid-walking-the-Namespace-if-start_node-is-.patch (stable-fixes CVE-2025-71118 bsc#1256763). - Update patches.suse/ALSA-usb-mixer-us16x08-validate-meter-packet-indices.patch (git-fixes CVE-2025-68783 bsc#1256650). - Update patches.suse/ASoC-tlv320adcx140-fix-null-pointer.patch (git-fixes CVE-2026-23006 bsc#1257208). - Update patches.suse/Bluetooth-btusb-revert-use-of-devm_kzalloc-in-btusb.patch (git-fixes CVE-2025-71082 bsc#1256611). - Update patches.suse/Input-ti_am335x_tsc-fix-off-by-one-error-in-wire_ord.patch (git-fixes CVE-2025-68777 bsc#1256655). - Update patches.suse/arp-do-not-assume-dev_hard_header-does-not-change-skb-head.patch (CVE-2025-71098 bsc#1256591 CVE-2026-22988 bsc#1257282). - Update patches.suse/bpf-Do-not-let-BPF-test-infra-emit-invalid-GSO-types.patch (bsc#1255569 CVE-2025-68725). - Update patches.suse/char-applicom-fix-NULL-pointer-dereference-in-ac_ioc.patch (stable-fixes CVE-2025-68797 bsc#1256660). - Update patches.suse/comedi-fix-divide-by-zero-in-comedi_buf_munge.patch (stable-fixes CVE-2025-40106 bsc#1252891). - Update patches.suse/crypto-seqiv-Do-not-use-req-iv-after-crypto_aead_enc.patch (git-fixes CVE-2025-71131 bsc#1256742). - Update patches.suse/dmaengine-idxd-fix-device-leaks-on-compat-bind-and-u.patch (git-fixes CVE-2025-71163 bsc#1257215). - Update patches.suse/dmaengine-tegra-adma-Fix-use-after-free.patch (git-fixes CVE-2025-71162 bsc#1257204). - Update patches.suse/drm-i915-gem-Zero-initialize-the-eb.vma-array-in-i91.patch (git-fixes CVE-2025-71130 bsc#1256741). - Update patches.suse/drm-msm-dpu-Add-missing-NULL-pointer-check-for-pingp.patch (git-fixes CVE-2025-71138 bsc#1256785). - Update patches.suse/hwmon-ibmpex-fix-use-after-free-in-high-low-store.patch (git-fixes CVE-2025-68789 bsc#1256781). - Update patches.suse/idpf-Fix-RSS-LUT-NULL-pointer-crash-on-early-ethtool.patch (CVE-2026-22993 bsc#1257180 CVE-2026-22985 bsc#1257277). - Update patches.suse/interconnect-Don-t-access-req_list-while-it-s-being-.patch (CVE-2023-54013 bsc#1256280 CVE-2024-27005 bsc#1223800). - Update patches.suse/net-can-j1939-j1939_xtp_rx_rts_session_active-deacti.patch (git-fixes CVE-2026-22997 bsc#1257202). - Update patches.suse/net-nfc-fix-deadlock-between-nfc_unregister_device-a.patch (git-fixes CVE-2025-71079 bsc#1256619). - Update patches.suse/net-rose-fix-invalid-array-index-in-rose_kill_by_dev.patch (git-fixes CVE-2025-71086 bsc#1256625). - Update patches.suse/net-usb-rtl8150-fix-memory-leak-on-usb_submit_urb-fa.patch (git-fixes CVE-2025-71154 bsc#1257163). - Update patches.suse/powerpc-kexec-Enable-SMT-before-waking-offline-CPUs.patch (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588 git-fixes bsc#1253739 ltc#211493 bsc#1254244 ltc#216496 CVE-2025-71119 bsc#1256730). - Update patches.suse/smc91x-fix-broken-irq-context-in-PREEMPT_RT.patch (git-fixes CVE-2025-71132 bsc#1256737). - Update patches.suse/spi-fsl-cpm-Check-length-parity-before-switching-to-.patch (git-fixes CVE-2025-68773 bsc#1256586). - Update patches.suse/staging-rtl8723bs-fix-out-of-bounds-read-in-OnBeacon.patch (stable-fixes CVE-2025-68254 bsc#1255140). - Update patches.suse/staging-rtl8723bs-fix-out-of-bounds-read-in-rtw_get_.patch (stable-fixes CVE-2025-68256 bsc#1255138). - Update patches.suse/usb-phy-isp1301-fix-non-OF-device-reference-imbalanc.patch (git-fixes CVE-2025-71145 bsc#1257155). - Update patches.suse/usb-typec-ucsi-Handle-incorrect-num_connectors-capab.patch (stable-fixes CVE-2025-71108 bsc#1256774). - Update patches.suse/via_wdt-fix-critical-boot-hang-due-to-unnamed-resour.patch (stable-fixes CVE-2025-71114 bsc#1256752). - Update patches.suse/wifi-avoid-kernel-infoleak-from-struct-iw_point.patch (git-fixes CVE-2026-22978 bsc#1257227). - Update patches.suse/wifi-rtlwifi-8192cu-fix-tid-out-of-range-in-rtl92cu_.patch (git-fixes CVE-2025-71100 bsc#1256593). - commit 856d20b - powerpc/addnote: Fix overflow on 32-bit builds (bsc#1215199). - commit b73475a - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (CVE-2026-22996). - net/mlx5e: Fix crash on profile change rollback failure (CVE-2026-23000 bsc#1257234). - commit 46ccefc - macvlan: fix possible UAF in macvlan_forward_source() (CVE-2026-23001 bsc#1257232). - commit bcf0129 - gpio: rockchip: Stop calling pinctrl for set_direction (git-fixes). - commit 8cea9c9 ++++ pcr-oracle: - Update to 0.5.9 + Fix event skipping due to double increment + Add '--persistent-srk' to make SRK persistent (bsc#1248516) ------------------------------------------------------------------ ------------------ 2026-2-1 - Feb 1 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - btrfs: do not strictly require dirty metadata threshold for metadata writepages (stable-fixes). - commit b83c55a - ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (git-fixes). - ASoC: fsl: imx-card: Do not force slot width to sample width (git-fixes). - commit 6d4f48b ++++ kernel-rt: - btrfs: do not strictly require dirty metadata threshold for metadata writepages (stable-fixes). - commit b83c55a - ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (git-fixes). - ASoC: fsl: imx-card: Do not force slot width to sample width (git-fixes). - commit 6d4f48b ++++ kernel-rt_debug: - btrfs: do not strictly require dirty metadata threshold for metadata writepages (stable-fixes). - commit b83c55a - ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (git-fixes). - ASoC: fsl: imx-card: Do not force slot width to sample width (git-fixes). - commit 6d4f48b ------------------------------------------------------------------ ------------------ 2026-1-31 - Jan 31 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (git-fixes). - commit 4d9fa09 - gpio: omap: do not register driver in probe() (git-fixes). - drm/imx/tve: fix probe device leak (git-fixes). - drm/amd/pm: fix race in power state check before mutex lock (git-fixes). - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (git-fixes). - Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (stable-fixes). - Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (stable-fixes). - spi: spi-sprd-adi: Fix double free in probe error path (git-fixes). - ALSA: ctxfi: Fix potential OOB access in audio mixer handling (stable-fixes). - can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (git-fixes). - phy: freescale: imx8m-pcie: assert phy reset during power on (stable-fixes). - USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (stable-fixes). - USB: serial: option: add Telit LE910 MBIM composition (stable-fixes). - USB: OHCI/UHCI: Add soft dependencies on ehci_platform (stable-fixes). - usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (stable-fixes). - usb: dwc3: Check for USB4 IP_NAME (stable-fixes). - drm/amd/display: Bump the HDMI clock to 340MHz (stable-fixes). - drm/amd: Clean up kfd node on surprise disconnect (stable-fixes). - ASoC: codecs: wsa881x: fix unnecessary initialisation (git-fixes). - HID: usbhid: paper over wrong bNumDescriptor field (stable-fixes). - ASoC: codecs: wsa881x: Drop unused version readout (stable-fixes). - spi: sprd-adi: switch to use spi_alloc_host() (stable-fixes). - spi: sprd: adi: Use devm_register_restart_handler() (stable-fixes). - commit 81840a7 ++++ kernel-rt: - can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (git-fixes). - commit 4d9fa09 - gpio: omap: do not register driver in probe() (git-fixes). - drm/imx/tve: fix probe device leak (git-fixes). - drm/amd/pm: fix race in power state check before mutex lock (git-fixes). - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (git-fixes). - Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (stable-fixes). - Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (stable-fixes). - spi: spi-sprd-adi: Fix double free in probe error path (git-fixes). - ALSA: ctxfi: Fix potential OOB access in audio mixer handling (stable-fixes). - can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (git-fixes). - phy: freescale: imx8m-pcie: assert phy reset during power on (stable-fixes). - USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (stable-fixes). - USB: serial: option: add Telit LE910 MBIM composition (stable-fixes). - USB: OHCI/UHCI: Add soft dependencies on ehci_platform (stable-fixes). - usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (stable-fixes). - usb: dwc3: Check for USB4 IP_NAME (stable-fixes). - drm/amd/display: Bump the HDMI clock to 340MHz (stable-fixes). - drm/amd: Clean up kfd node on surprise disconnect (stable-fixes). - ASoC: codecs: wsa881x: fix unnecessary initialisation (git-fixes). - HID: usbhid: paper over wrong bNumDescriptor field (stable-fixes). - ASoC: codecs: wsa881x: Drop unused version readout (stable-fixes). - spi: sprd-adi: switch to use spi_alloc_host() (stable-fixes). - spi: sprd: adi: Use devm_register_restart_handler() (stable-fixes). - commit 81840a7 ++++ kernel-rt_debug: - can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (git-fixes). - commit 4d9fa09 - gpio: omap: do not register driver in probe() (git-fixes). - drm/imx/tve: fix probe device leak (git-fixes). - drm/amd/pm: fix race in power state check before mutex lock (git-fixes). - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (git-fixes). - Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (stable-fixes). - Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (stable-fixes). - spi: spi-sprd-adi: Fix double free in probe error path (git-fixes). - ALSA: ctxfi: Fix potential OOB access in audio mixer handling (stable-fixes). - can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (git-fixes). - phy: freescale: imx8m-pcie: assert phy reset during power on (stable-fixes). - USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (stable-fixes). - USB: serial: option: add Telit LE910 MBIM composition (stable-fixes). - USB: OHCI/UHCI: Add soft dependencies on ehci_platform (stable-fixes). - usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (stable-fixes). - usb: dwc3: Check for USB4 IP_NAME (stable-fixes). - drm/amd/display: Bump the HDMI clock to 340MHz (stable-fixes). - drm/amd: Clean up kfd node on surprise disconnect (stable-fixes). - ASoC: codecs: wsa881x: fix unnecessary initialisation (git-fixes). - HID: usbhid: paper over wrong bNumDescriptor field (stable-fixes). - ASoC: codecs: wsa881x: Drop unused version readout (stable-fixes). - spi: sprd-adi: switch to use spi_alloc_host() (stable-fixes). - spi: sprd: adi: Use devm_register_restart_handler() (stable-fixes). - commit 81840a7 ------------------------------------------------------------------ ------------------ 2026-1-30 - Jan 30 2026 ------------------- ------------------------------------------------------------------ ++++ fde-tools: - Add fde-tools-bsc1248516-tpm-Support-persistent-SRK.patch to support persistent SRK (bsc#1248516) ++++ kernel-default: - io_uring/poll: correctly handle io_poll_add() return value on update (CVE-2025-71149 bsc#1257164). - commit e38f4cf - libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116 bsc#1256744). - commit 37c126f - scripts: obsapi: Support URL trailing / in oscrc - commit 596ed59 - scripts: uploader: Handle missing upstream in is_pr_open - commit e7d7408 - net: sock: fix hardened usercopy panic in sock_recv_errqueue (CVE-2026-22977 bsc#1257053). - ipv4: Fix reference count leak when using error routes with nexthop objects (CVE-2025-71097 bsc#1256607). - net: stmmac: fix the crash issue for zero copy XDP_TX action (CVE-2025-71095 bsc#1256605). - ethtool: Avoid overflowing userspace buffer on stats query (CVE-2025-68795 bsc#1256688). - bnxt_en: Fix XDP_TX path (CVE-2025-68770 bsc#1256584). - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CVE-2025-68800 bsc#1256646). - mlxsw: spectrum_router: Fix neighbour use-after-free (CVE-2025-68801 bsc#1256653). - lan966x: Fix sleeping in atomic context (CVE-2025-68320 bsc#1255172). - commit 6580707 - net/sched: sch_qfq: do not free existing class in qfq_change_class() (CVE-2026-22999 bsc#1257236). - commit d911768 - ipv4: ip_gre: make ipgre_header() robust (CVE-2026-23011 bsc#1257207). - commit dcc6c91 - wifi: mac80211: correctly decode TTLM with default link map (git-fixes). - nfc: nci: Fix race between rfkill and nci_unregister_device() (git-fixes). - nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame() (git-fixes). - net: wwan: t7xx: fix potential skb->frags overflow in RX path (git-fixes). - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (git-fixes). - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (git-fixes). - commit 6907fd9 ++++ kernel-rt: - io_uring/poll: correctly handle io_poll_add() return value on update (CVE-2025-71149 bsc#1257164). - commit e38f4cf - libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116 bsc#1256744). - commit 37c126f - scripts: obsapi: Support URL trailing / in oscrc - commit 596ed59 - scripts: uploader: Handle missing upstream in is_pr_open - commit e7d7408 - net: sock: fix hardened usercopy panic in sock_recv_errqueue (CVE-2026-22977 bsc#1257053). - ipv4: Fix reference count leak when using error routes with nexthop objects (CVE-2025-71097 bsc#1256607). - net: stmmac: fix the crash issue for zero copy XDP_TX action (CVE-2025-71095 bsc#1256605). - ethtool: Avoid overflowing userspace buffer on stats query (CVE-2025-68795 bsc#1256688). - bnxt_en: Fix XDP_TX path (CVE-2025-68770 bsc#1256584). - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CVE-2025-68800 bsc#1256646). - mlxsw: spectrum_router: Fix neighbour use-after-free (CVE-2025-68801 bsc#1256653). - lan966x: Fix sleeping in atomic context (CVE-2025-68320 bsc#1255172). - commit 6580707 - net/sched: sch_qfq: do not free existing class in qfq_change_class() (CVE-2026-22999 bsc#1257236). - commit d911768 - ipv4: ip_gre: make ipgre_header() robust (CVE-2026-23011 bsc#1257207). - commit dcc6c91 - wifi: mac80211: correctly decode TTLM with default link map (git-fixes). - nfc: nci: Fix race between rfkill and nci_unregister_device() (git-fixes). - nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame() (git-fixes). - net: wwan: t7xx: fix potential skb->frags overflow in RX path (git-fixes). - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (git-fixes). - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (git-fixes). - commit 6907fd9 ++++ kernel-rt_debug: - io_uring/poll: correctly handle io_poll_add() return value on update (CVE-2025-71149 bsc#1257164). - commit e38f4cf - libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116 bsc#1256744). - commit 37c126f - scripts: obsapi: Support URL trailing / in oscrc - commit 596ed59 - scripts: uploader: Handle missing upstream in is_pr_open - commit e7d7408 - net: sock: fix hardened usercopy panic in sock_recv_errqueue (CVE-2026-22977 bsc#1257053). - ipv4: Fix reference count leak when using error routes with nexthop objects (CVE-2025-71097 bsc#1256607). - net: stmmac: fix the crash issue for zero copy XDP_TX action (CVE-2025-71095 bsc#1256605). - ethtool: Avoid overflowing userspace buffer on stats query (CVE-2025-68795 bsc#1256688). - bnxt_en: Fix XDP_TX path (CVE-2025-68770 bsc#1256584). - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CVE-2025-68800 bsc#1256646). - mlxsw: spectrum_router: Fix neighbour use-after-free (CVE-2025-68801 bsc#1256653). - lan966x: Fix sleeping in atomic context (CVE-2025-68320 bsc#1255172). - commit 6580707 - net/sched: sch_qfq: do not free existing class in qfq_change_class() (CVE-2026-22999 bsc#1257236). - commit d911768 - ipv4: ip_gre: make ipgre_header() robust (CVE-2026-23011 bsc#1257207). - commit dcc6c91 - wifi: mac80211: correctly decode TTLM with default link map (git-fixes). - nfc: nci: Fix race between rfkill and nci_unregister_device() (git-fixes). - nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame() (git-fixes). - net: wwan: t7xx: fix potential skb->frags overflow in RX path (git-fixes). - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (git-fixes). - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (git-fixes). - commit 6907fd9 ++++ multipath-tools: - Update to version 0.10.6+201+suse.9f189e79: * libmultipath: reduce log level of "map X has no targets" (bsc#1257476) ------------------------------------------------------------------ ------------------ 2026-1-29 - Jan 29 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - smack: fix bug: unprivileged task can create labels (CVE-2025-68733 bsc#1255615). - commit 4193ba7 - shrink_slab_memcg: clear_bits of skipped shrinkers (bsc#1256564). - commit 1a156a1 - idpf: Fix RSS LUT NULL ptr issue after soft reset (CVE-2026-22993 bsc#1257180). - idpf: Fix RSS LUT NULL pointer crash on early ethtool operations (CVE-2026-22993 bsc#1257180). - commit bb6b853 - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CVE-2025-71085 bsc#1256623). - commit 35a165f - kabi: export inet_frag_rbtree_purge() function again (CVE-2025-68768 bsc#1256579). - commit d066c8d - inet: frags: flush pending skbs in fqdir_pre_exit() (CVE-2025-68768 bsc#1256579). - inet: frags: add inet_frag_queue_flush() (CVE-2025-68768 bsc#1256579). - commit 3c0c564 - mptcp: fallback earlier on simult connection (CVE-2025-71088 bsc#1256630). - commit daab93c - scripts: uploader: Fix no change condition for _maintainership.json - commit 792d98c - =?UTF-8?q?net:=20phy:=20Introduce=20PHY=5FID=5FSIZE=20?= =?UTF-8?q?=E2=80=94=20minimum=20size=20for=20PHY=20ID=20string?= (CVE-2025-71094 bsc#1256597). - commit b3acbda - net/sched: ets: Remove drr class from the active list if it changes to strict (CVE-2025-68815 bsc#1256680). - commit f0fee57 - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CVE-2025-71066 bsc#1256645). - commit 8f4860d ++++ kernel-rt: - smack: fix bug: unprivileged task can create labels (CVE-2025-68733 bsc#1255615). - commit 4193ba7 - shrink_slab_memcg: clear_bits of skipped shrinkers (bsc#1256564). - commit 1a156a1 - idpf: Fix RSS LUT NULL ptr issue after soft reset (CVE-2026-22993 bsc#1257180). - idpf: Fix RSS LUT NULL pointer crash on early ethtool operations (CVE-2026-22993 bsc#1257180). - commit bb6b853 - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CVE-2025-71085 bsc#1256623). - commit 35a165f - kabi: export inet_frag_rbtree_purge() function again (CVE-2025-68768 bsc#1256579). - commit d066c8d - inet: frags: flush pending skbs in fqdir_pre_exit() (CVE-2025-68768 bsc#1256579). - inet: frags: add inet_frag_queue_flush() (CVE-2025-68768 bsc#1256579). - commit 3c0c564 - mptcp: fallback earlier on simult connection (CVE-2025-71088 bsc#1256630). - commit daab93c - scripts: uploader: Fix no change condition for _maintainership.json - commit 792d98c - =?UTF-8?q?net:=20phy:=20Introduce=20PHY=5FID=5FSIZE=20?= =?UTF-8?q?=E2=80=94=20minimum=20size=20for=20PHY=20ID=20string?= (CVE-2025-71094 bsc#1256597). - commit b3acbda - net/sched: ets: Remove drr class from the active list if it changes to strict (CVE-2025-68815 bsc#1256680). - commit f0fee57 - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CVE-2025-71066 bsc#1256645). - commit 8f4860d ++++ kernel-rt_debug: - smack: fix bug: unprivileged task can create labels (CVE-2025-68733 bsc#1255615). - commit 4193ba7 - shrink_slab_memcg: clear_bits of skipped shrinkers (bsc#1256564). - commit 1a156a1 - idpf: Fix RSS LUT NULL ptr issue after soft reset (CVE-2026-22993 bsc#1257180). - idpf: Fix RSS LUT NULL pointer crash on early ethtool operations (CVE-2026-22993 bsc#1257180). - commit bb6b853 - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CVE-2025-71085 bsc#1256623). - commit 35a165f - kabi: export inet_frag_rbtree_purge() function again (CVE-2025-68768 bsc#1256579). - commit d066c8d - inet: frags: flush pending skbs in fqdir_pre_exit() (CVE-2025-68768 bsc#1256579). - inet: frags: add inet_frag_queue_flush() (CVE-2025-68768 bsc#1256579). - commit 3c0c564 - mptcp: fallback earlier on simult connection (CVE-2025-71088 bsc#1256630). - commit daab93c - scripts: uploader: Fix no change condition for _maintainership.json - commit 792d98c - =?UTF-8?q?net:=20phy:=20Introduce=20PHY=5FID=5FSIZE=20?= =?UTF-8?q?=E2=80=94=20minimum=20size=20for=20PHY=20ID=20string?= (CVE-2025-71094 bsc#1256597). - commit b3acbda - net/sched: ets: Remove drr class from the active list if it changes to strict (CVE-2025-68815 bsc#1256680). - commit f0fee57 - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CVE-2025-71066 bsc#1256645). - commit 8f4860d ++++ libzypp: - Prepare a legacy /etc/zypp/zypp.conf to be installed on old distros. See the ZYPP.CONF(5) man page for details. - Fix runtime check for broken rpm --runposttrans (bsc#1257068) - version 17.38.2 (35) ++++ nvidia-open-driver-G06-signed: - apply kernel-5.14.patch also on sle15-sp5 in order to fix build and adjusted it to sle15-sp5 kernel ++++ podman: - Add symlink to catatonit in /usr/libexec/podman (bsc#1248988) ------------------------------------------------------------------ ------------------ 2026-1-28 - Jan 28 2026 ------------------- ------------------------------------------------------------------ ++++ gpg2: - Security fix [bsc#1257396, CVE-2026-24882] * gpg2: stack-based buffer overflow in TPM2 PKDECRYPT for TPM-backed RSA and ECC keys * Added gnupg-CVE-2026-24882.patch - Security fix [bsc#1256389] (gpg.fail/filename) * Added gnupg-accepts-path-separators-literal-data.patch * GnuPG Accepts Path Separators and Path Traversals in Literal Data ++++ kernel-default: - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (CVE-2026-22976 bsc#1257035). - commit 1b89834 - usb: renesas_usbhs: Fix synchronous external abort on unbind (CVE-2025-68327 bsc#1255488). - commit a41f3aa - net: usb: asix: validate PHY address before use (CVE-2025-71094 bsc#1256597). - net: usb: asix: ax88772: Increase phy_name size (CVE-2025-71094 bsc#1256597). - commit addbe43 - net: tcp: allow zero-window ACK update the window (bsc#1254767). - commit b6299d5 - scripts: uploader: Only reset branch when there is no open PR Resetting the branch closes any PR which is disruptive. With project repositories that get a lot of changes this would reset too often if reset was enabled causing unmergeable PRs. Yet it is necessary to reset to be able to get up-to-date state for a new PR. With this branch reset can be enabled for maintainership update. - commit 60e8156 - selftests/bpf: use simply-expanded variables for libpcap flags (bsc#1255552 CVE-2025-68363). - commit 2c7feb9 - selftests/bpf: ns_current_pid_tgid: Rename the test function (bsc#1255552 CVE-2025-68363). - commit 4f40cc9 - selftests/bpf: Replace CHECK with ASSERT_* in ns_current_pid_tgid test (bsc#1255552 CVE-2025-68363). - Refresh patches.suse/selftests-bpf-Clean-up-open-coded-gettid-syscall-inv.patch. - commit 0d13544 - selftests/bpf: tc_links/tc_opts: Unserialize tests (bsc#1255552 CVE-2025-68363). - selftests/bpf: Optionally open a dedicated namespace to run test in it (CVE-2025-68363 bsc#1255552). - commit 5773a45 ++++ kernel-rt: - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (CVE-2026-22976 bsc#1257035). - commit 1b89834 - usb: renesas_usbhs: Fix synchronous external abort on unbind (CVE-2025-68327 bsc#1255488). - commit a41f3aa - net: usb: asix: validate PHY address before use (CVE-2025-71094 bsc#1256597). - net: usb: asix: ax88772: Increase phy_name size (CVE-2025-71094 bsc#1256597). - commit addbe43 - net: tcp: allow zero-window ACK update the window (bsc#1254767). - commit b6299d5 - scripts: uploader: Only reset branch when there is no open PR Resetting the branch closes any PR which is disruptive. With project repositories that get a lot of changes this would reset too often if reset was enabled causing unmergeable PRs. Yet it is necessary to reset to be able to get up-to-date state for a new PR. With this branch reset can be enabled for maintainership update. - commit 60e8156 - selftests/bpf: use simply-expanded variables for libpcap flags (bsc#1255552 CVE-2025-68363). - commit 2c7feb9 - selftests/bpf: ns_current_pid_tgid: Rename the test function (bsc#1255552 CVE-2025-68363). - commit 4f40cc9 - selftests/bpf: Replace CHECK with ASSERT_* in ns_current_pid_tgid test (bsc#1255552 CVE-2025-68363). - Refresh patches.suse/selftests-bpf-Clean-up-open-coded-gettid-syscall-inv.patch. - commit 0d13544 - selftests/bpf: tc_links/tc_opts: Unserialize tests (bsc#1255552 CVE-2025-68363). - selftests/bpf: Optionally open a dedicated namespace to run test in it (CVE-2025-68363 bsc#1255552). - commit 5773a45 ++++ kernel-rt_debug: - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (CVE-2026-22976 bsc#1257035). - commit 1b89834 - usb: renesas_usbhs: Fix synchronous external abort on unbind (CVE-2025-68327 bsc#1255488). - commit a41f3aa - net: usb: asix: validate PHY address before use (CVE-2025-71094 bsc#1256597). - net: usb: asix: ax88772: Increase phy_name size (CVE-2025-71094 bsc#1256597). - commit addbe43 - net: tcp: allow zero-window ACK update the window (bsc#1254767). - commit b6299d5 - scripts: uploader: Only reset branch when there is no open PR Resetting the branch closes any PR which is disruptive. With project repositories that get a lot of changes this would reset too often if reset was enabled causing unmergeable PRs. Yet it is necessary to reset to be able to get up-to-date state for a new PR. With this branch reset can be enabled for maintainership update. - commit 60e8156 - selftests/bpf: use simply-expanded variables for libpcap flags (bsc#1255552 CVE-2025-68363). - commit 2c7feb9 - selftests/bpf: ns_current_pid_tgid: Rename the test function (bsc#1255552 CVE-2025-68363). - commit 4f40cc9 - selftests/bpf: Replace CHECK with ASSERT_* in ns_current_pid_tgid test (bsc#1255552 CVE-2025-68363). - Refresh patches.suse/selftests-bpf-Clean-up-open-coded-gettid-syscall-inv.patch. - commit 0d13544 - selftests/bpf: tc_links/tc_opts: Unserialize tests (bsc#1255552 CVE-2025-68363). - selftests/bpf: Optionally open a dedicated namespace to run test in it (CVE-2025-68363 bsc#1255552). - commit 5773a45 ++++ libpng16: - security update - added patches CVE-2025-28162 [bsc#1257364], memory leaks when running `pngimage` CVE-2025-28164 [bsc#1257365], memory leaks when running `pngimage` * libpng16-CVE-2025-28162,28164.patch ++++ regionServiceClientConfigGCE: - Update to version 5.1.0 (jsc#PCT-590) + Add licenses info in the metdata - Accomodate build setup ------------------------------------------------------------------ ------------------ 2026-1-27 - Jan 27 2026 ------------------- ------------------------------------------------------------------ ++++ glib2: - Add CVE fixes: + glib2-CVE-2026-1484.patch (bsc#1257355 CVE-2026-1484 glgo#GNOME/glib!4979). + glib2-CVE-2026-1485.patch (bsc#1257354 CVE-2026-1485 glgo#GNOME/glib!4981). + glib2-CVE-2026-1489.patch (bsc#1257353 CVE-2026-1489 glgo#GNOME/glib!4984). ++++ kernel-default: - perf/x86/amd: Check event before enable to avoid GPF (bsc#1256689 CVE-2025-68798). - commit 122c93e - selftests/bpf: Optionally open a dedicated namespace to run test in it (CVE-2025-68363 bsc#1255552). - commit 7fc3edd - selftests/bpf: Monitor traffic for select_reuseport (CVE-2025-68363 bsc#1255552). - commit 7687d07 - selftests/bpf: Monitor traffic for sockmap_listen (CVE-2025-68363 bsc#1255552). - commit 200e7d4 - selftests/bpf: Monitor traffic for tc_redirect (CVE-2025-68363 bsc#1255552). - commit ef95f02 - selftests/bpf: netns_new() and netns_free() helpers (CVE-2025-68363 bsc#1255552). - Refresh patches.suse/selftests-bpf-Fix-backtrace-printing-for-selftests-c.patch. - commit 6ac10b7 - selftests/bpf: Add the traffic monitor option to test_progs (CVE-2025-68363 bsc#1255552). - commit 24382fe - selftests/bpf: Add traffic monitor functions (CVE-2025-68363 bsc#1255552). - commit c7346b8 - blk-cgroup: fix possible deadlock while configuring policy (CVE-2025-68178 bsc#1255266). - commit 3f4a2e3 - bpf: Add bpf_prog_run_data_pointers() (bsc#1255241 CVE-2025-68200). - commit 3454614 - net: hv_netvsc: reject RSS hash key programming without RX indirection table (bsc#1257473). - scsi: storvsc: Process unsupported MODE_SENSE_10 (bsc#1257296). - remove an Intel CPU model change which is already part of the base kernel - remove a bpf CVE change which is already part of the base kernel - commit 6def8a1 ++++ kernel-rt: - perf/x86/amd: Check event before enable to avoid GPF (bsc#1256689 CVE-2025-68798). - commit 122c93e - selftests/bpf: Optionally open a dedicated namespace to run test in it (CVE-2025-68363 bsc#1255552). - commit 7fc3edd - selftests/bpf: Monitor traffic for select_reuseport (CVE-2025-68363 bsc#1255552). - commit 7687d07 - selftests/bpf: Monitor traffic for sockmap_listen (CVE-2025-68363 bsc#1255552). - commit 200e7d4 - selftests/bpf: Monitor traffic for tc_redirect (CVE-2025-68363 bsc#1255552). - commit ef95f02 - selftests/bpf: netns_new() and netns_free() helpers (CVE-2025-68363 bsc#1255552). - Refresh patches.suse/selftests-bpf-Fix-backtrace-printing-for-selftests-c.patch. - commit 6ac10b7 - selftests/bpf: Add the traffic monitor option to test_progs (CVE-2025-68363 bsc#1255552). - commit 24382fe - selftests/bpf: Add traffic monitor functions (CVE-2025-68363 bsc#1255552). - commit c7346b8 - blk-cgroup: fix possible deadlock while configuring policy (CVE-2025-68178 bsc#1255266). - commit 3f4a2e3 - bpf: Add bpf_prog_run_data_pointers() (bsc#1255241 CVE-2025-68200). - commit 3454614 - net: hv_netvsc: reject RSS hash key programming without RX indirection table (bsc#1257473). - scsi: storvsc: Process unsupported MODE_SENSE_10 (bsc#1257296). - remove an Intel CPU model change which is already part of the base kernel - remove a bpf CVE change which is already part of the base kernel - commit 6def8a1 ++++ kernel-rt_debug: - perf/x86/amd: Check event before enable to avoid GPF (bsc#1256689 CVE-2025-68798). - commit 122c93e - selftests/bpf: Optionally open a dedicated namespace to run test in it (CVE-2025-68363 bsc#1255552). - commit 7fc3edd - selftests/bpf: Monitor traffic for select_reuseport (CVE-2025-68363 bsc#1255552). - commit 7687d07 - selftests/bpf: Monitor traffic for sockmap_listen (CVE-2025-68363 bsc#1255552). - commit 200e7d4 - selftests/bpf: Monitor traffic for tc_redirect (CVE-2025-68363 bsc#1255552). - commit ef95f02 - selftests/bpf: netns_new() and netns_free() helpers (CVE-2025-68363 bsc#1255552). - Refresh patches.suse/selftests-bpf-Fix-backtrace-printing-for-selftests-c.patch. - commit 6ac10b7 - selftests/bpf: Add the traffic monitor option to test_progs (CVE-2025-68363 bsc#1255552). - commit 24382fe - selftests/bpf: Add traffic monitor functions (CVE-2025-68363 bsc#1255552). - commit c7346b8 - blk-cgroup: fix possible deadlock while configuring policy (CVE-2025-68178 bsc#1255266). - commit 3f4a2e3 - bpf: Add bpf_prog_run_data_pointers() (bsc#1255241 CVE-2025-68200). - commit 3454614 - net: hv_netvsc: reject RSS hash key programming without RX indirection table (bsc#1257473). - scsi: storvsc: Process unsupported MODE_SENSE_10 (bsc#1257296). - remove an Intel CPU model change which is already part of the base kernel - remove a bpf CVE change which is already part of the base kernel - commit 6def8a1 ++++ multipath-tools: - Update to version 0.10.6+200+suse.547788f4 (bsc#1257007): * kpartx: fix segfault when operating on regular files (bsc#1257244, bsc#1257153) * multipathd: print path offline message even without a checker (bsc#1254094) * Fix command descriptions in the multipathd man page. * Fix ISO C23 compatibility issue causing errors with new compilers. * Fix memory leak caused by not joining the "init unwinder" thread. * Fix memory leaks in kpartx. * Print the warning "setting scsi timeouts is unsupported for protocol" only once per protocol. * Make sure multipath-tools is compiled with the compiler flag `-fno-strict-aliasing`. (gh#opensvc/multipath-tools#130, bsc#1255285) ++++ open-vm-tools: - update to 13.0.10 based on build 25056151: (boo#1257357): Please refer to the Release Notes at https://github.com/vmware/open-vm-tools/blob/stable-13.0.10/ReleaseNotes.md. The granular changes that have gone into the open-vm-tools 13.0.10 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-13.0.10/open-vm-tools/ChangeLog. There are no new features in the open-vm-tools 13.0.10 release. This is primarily a maintenance release that addresses a fix. A minor enhancement has been made for Guest OS Customization. The DeployPkg plugin has been updated to handle a new cloud-init error code that signals a recoverable error and allow cloud-init to finish running. For a more complete description of what's new in this release, see the What's New and Resolved Issues sections of the Release Notes. ------------------------------------------------------------------ ------------------ 2026-1-26 - Jan 26 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - e1000: fix OOB in e1000_tbi_should_accept() (CVE-2025-71093 bsc#1256777). - net/mlx5: fw_tracer, Validate format string parameters (CVE-2025-68816 bsc#1256674). - commit 53c77db - ceph: fix crash in process_v2_sparse_read() for encrypted directories (CVE-2025-68297 bsc#1255403). - commit de1a69a - x86: make page fault handling disable interrupts properly (git-fixes). - commit e28ac6a - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (CVE-2025-68284 bsc#1255377). - commit 3382537 - libceph: fix invalid accesses to ceph_connection_v1_info (CVE-2025-39880 bsc#1250388). - commit 592067a - kABI workaround for tpm_chip changes (CVE-2025-71077 bsc#1256613). - commit 66e0457 - tpm: Cap the number of PCR banks (CVE-2025-71077 bsc#1256613). - commit 727f4b1 - w1: fix redundant counter decrement in w1_attach_slave_device() (git-fixes). - w1: therm: Fix off-by-one buffer overflow in alarms_store (git-fixes). - comedi: dmm32at: serialize use of paged registers (git-fixes). - uacce: ensure safe queue release with state management (git-fixes). - uacce: implement mremap in uacce_vm_ops to return -EPERM (git-fixes). - uacce: fix isolate sysfs check condition (git-fixes). - uacce: fix cdev handling in the cleanup path (git-fixes). - slimbus: core: fix of_slim_get_device() kernel doc (git-fixes). - slimbus: core: fix device reference leak on report present (git-fixes). - slimbus: core: fix runtime PM imbalance on report present (git-fixes). - slimbus: core: fix OF node leak on registration failure (git-fixes). - intel_th: fix device leak on output open() (git-fixes). - comedi: Fix getting range information for subdevices 16 to 255 (git-fixes). - iio: accel: iis328dq: fix gain values (git-fixes). - iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (git-fixes). - iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (git-fixes). - iio: adc: ad9467: fix ad9434 vref mask (git-fixes). - iio: adc: ad7280a: handle spi_setup() errors in probe() (git-fixes). - iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (git-fixes). - serial: 8250_pci: Fix broken RS485 for F81504/508/512 (git-fixes). - comedi: fix divide-by-zero in comedi_buf_munge() (stable-fixes). - commit 50f3b9f - bpf: Do not let BPF test infra emit invalid GSO types to stack (bsc#1255569). - commit 1df0a4e ++++ kernel-rt: - e1000: fix OOB in e1000_tbi_should_accept() (CVE-2025-71093 bsc#1256777). - net/mlx5: fw_tracer, Validate format string parameters (CVE-2025-68816 bsc#1256674). - commit 53c77db - ceph: fix crash in process_v2_sparse_read() for encrypted directories (CVE-2025-68297 bsc#1255403). - commit de1a69a - x86: make page fault handling disable interrupts properly (git-fixes). - commit e28ac6a - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (CVE-2025-68284 bsc#1255377). - commit 3382537 - libceph: fix invalid accesses to ceph_connection_v1_info (CVE-2025-39880 bsc#1250388). - commit 592067a - kABI workaround for tpm_chip changes (CVE-2025-71077 bsc#1256613). - commit 66e0457 - tpm: Cap the number of PCR banks (CVE-2025-71077 bsc#1256613). - commit 727f4b1 - w1: fix redundant counter decrement in w1_attach_slave_device() (git-fixes). - w1: therm: Fix off-by-one buffer overflow in alarms_store (git-fixes). - comedi: dmm32at: serialize use of paged registers (git-fixes). - uacce: ensure safe queue release with state management (git-fixes). - uacce: implement mremap in uacce_vm_ops to return -EPERM (git-fixes). - uacce: fix isolate sysfs check condition (git-fixes). - uacce: fix cdev handling in the cleanup path (git-fixes). - slimbus: core: fix of_slim_get_device() kernel doc (git-fixes). - slimbus: core: fix device reference leak on report present (git-fixes). - slimbus: core: fix runtime PM imbalance on report present (git-fixes). - slimbus: core: fix OF node leak on registration failure (git-fixes). - intel_th: fix device leak on output open() (git-fixes). - comedi: Fix getting range information for subdevices 16 to 255 (git-fixes). - iio: accel: iis328dq: fix gain values (git-fixes). - iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (git-fixes). - iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (git-fixes). - iio: adc: ad9467: fix ad9434 vref mask (git-fixes). - iio: adc: ad7280a: handle spi_setup() errors in probe() (git-fixes). - iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (git-fixes). - serial: 8250_pci: Fix broken RS485 for F81504/508/512 (git-fixes). - comedi: fix divide-by-zero in comedi_buf_munge() (stable-fixes). - commit 50f3b9f - bpf: Do not let BPF test infra emit invalid GSO types to stack (bsc#1255569). - commit 1df0a4e ++++ kernel-rt_debug: - e1000: fix OOB in e1000_tbi_should_accept() (CVE-2025-71093 bsc#1256777). - net/mlx5: fw_tracer, Validate format string parameters (CVE-2025-68816 bsc#1256674). - commit 53c77db - ceph: fix crash in process_v2_sparse_read() for encrypted directories (CVE-2025-68297 bsc#1255403). - commit de1a69a - x86: make page fault handling disable interrupts properly (git-fixes). - commit e28ac6a - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (CVE-2025-68284 bsc#1255377). - commit 3382537 - libceph: fix invalid accesses to ceph_connection_v1_info (CVE-2025-39880 bsc#1250388). - commit 592067a - kABI workaround for tpm_chip changes (CVE-2025-71077 bsc#1256613). - commit 66e0457 - tpm: Cap the number of PCR banks (CVE-2025-71077 bsc#1256613). - commit 727f4b1 - w1: fix redundant counter decrement in w1_attach_slave_device() (git-fixes). - w1: therm: Fix off-by-one buffer overflow in alarms_store (git-fixes). - comedi: dmm32at: serialize use of paged registers (git-fixes). - uacce: ensure safe queue release with state management (git-fixes). - uacce: implement mremap in uacce_vm_ops to return -EPERM (git-fixes). - uacce: fix isolate sysfs check condition (git-fixes). - uacce: fix cdev handling in the cleanup path (git-fixes). - slimbus: core: fix of_slim_get_device() kernel doc (git-fixes). - slimbus: core: fix device reference leak on report present (git-fixes). - slimbus: core: fix runtime PM imbalance on report present (git-fixes). - slimbus: core: fix OF node leak on registration failure (git-fixes). - intel_th: fix device leak on output open() (git-fixes). - comedi: Fix getting range information for subdevices 16 to 255 (git-fixes). - iio: accel: iis328dq: fix gain values (git-fixes). - iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (git-fixes). - iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (git-fixes). - iio: adc: ad9467: fix ad9434 vref mask (git-fixes). - iio: adc: ad7280a: handle spi_setup() errors in probe() (git-fixes). - iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (git-fixes). - serial: 8250_pci: Fix broken RS485 for F81504/508/512 (git-fixes). - comedi: fix divide-by-zero in comedi_buf_munge() (stable-fixes). - commit 50f3b9f - bpf: Do not let BPF test infra emit invalid GSO types to stack (bsc#1255569). - commit 1df0a4e ++++ opensuse-migration-tool: - Add dependency on update-bootloader to fix boo#1255897 pattern-base-selinux could be skipped if update-bootloader was missing ++++ pcr-oracle: - Enable build on %{arm} as it is required by sdbootutil ++++ python-urllib3: - Add security patches: * CVE-2025-66471.patch (bsc#1254867) * CVE-2025-66418.patch (bsc#1254866) ------------------------------------------------------------------ ------------------ 2026-1-24 - Jan 24 2026 ------------------- ------------------------------------------------------------------ ++++ dnsmasq: - update to 2.92 * Redesign the interaction between DNSSEC validation and per-domain servers, specified as --server=//. This should just work in all cases now. If the normal chain-of-trust exists into the delegated domain then whether the domain is signed or not, DNSSEC validation will function normally. In the case the delegated domain is an "overlay" on top of the global DNS and no NS and/or DS records exist connecting it to the global dns, then if the domain is unsigned the situation will be handled by synthesising a proof-of-non-existence-of-DS for the domain and queries will be answered unvalidated; this action will be logged. A signed domain without chain-of-trust can be validated if a suitable trust-anchor is provided using --trust-anchor. This change should be backwards compatible for all existing working configurations; it extends the space of possible configurations which are functional. * Fix a couple of problems with DNSSEC validation and DNAME. One could cause validation failure on correct domains, and the other would fail to spot an invalid domain. Thanks to Graham Clinch for spotting the problem. * Add --log-queries=auth option to only log replies from the auth DNS facility. * Fix some edge-cases with domains and --address and --server. There has been some regressions with this in previous releases. This change fixes the priority order from lower to highest as: - -address with a IPv4 or IPv6 address (as long as the query matches the type) - -address with # for all-zeros, as long as the query is A or AAAA) - -address with no address, which returns NXDOMAIN or NOERROR for all types. - -server with address set to # to use the unqualified servers. - -server with matching domain. - -server without domain or from /etc/resolv.conf. * Fix problems with ipset or nftset and TCP DNS transport. Previously this was racy, and insertion of addresses could fail on a busy server when DNS-over-TCP transport was involved. * DNSSEC validation change for reverse lookups in RFC-1918 ranges and friends. The large public DNS services seem not to return proof-of-nonexistence for DS records at the start of RFC-1918 in-addr.arpa domains and the their IPv6 equivalents. 10.in-addr.arpa, 168.192.in-addr.arpa etc. Since dnsmasq already has an option which instructs it not bother upstream servers with pointless queries about these address ranges, namely --bogus-priv, we extend that to enable behaviour which allows dnsmasq to assume that insecure NXDOMAIN replies for these domains are expected and to assume that the domains are legitimately unsigned. This behaviour only matters when some address range is directed to another upstream server using --rev-server. In that case it allows replies from that server to pass DNSSEC validation. Without such a server configured, queries are never sent upstream so they are never validated and the new behaviour is moot. * Add support for leasequery to the dnsmasq DHCPv4 server. This has to be specifically enabled with the --leasequery option. Many thanks to JAXPORT, Jacksonville Port Authority for sponsoring this enhancement to dnsmasq. * Fix failure to cache PTR RRs when a reply contains more than one answer. Thanks to Dmitry for spotting this. * Add TFTP options windowsize (RFC 7440) and timeout (RFC 2349). * Change the behaviour of the DHCPv6 server when a REBIND message is received but no lease exists. Under these circumstances a new lease is created _only_ when the --dhcp-authoritative option is set. This matches the behavior of the DHCPv4 server. * Add --dhcp-split-relay option. This makes a DHCPv4 relay which is functional when client and server networks aren't mutually route-able. * Fix failure to add client MAC address to queries in TCP mode. The options which cause dnsmasq to decorate a DNS query with the MAC address on the originating client can fail when the query is sent using TCP. Thanks to Bruno Ravara for spotting and characterising this bug. ++++ kernel-default: - mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (git-fixes). - mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (git-fixes). - regmap: Fix race condition in hwspinlock irqsave routine (git-fixes). - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (git-fixes). - ALSA: scarlett2: Fix buffer overflow in config retrieval (git-fixes). - ALSA: usb: Increase volume range that triggers a warning (git-fixes). - drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (git-fixes). - drm/amd/pm: Don't clear SI SMC table when setting power limit (git-fixes). - drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (git-fixes). - drm/nouveau: add missing DCB connector types (git-fixes). - commit 03d895b ++++ kernel-rt: - mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (git-fixes). - mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (git-fixes). - regmap: Fix race condition in hwspinlock irqsave routine (git-fixes). - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (git-fixes). - ALSA: scarlett2: Fix buffer overflow in config retrieval (git-fixes). - ALSA: usb: Increase volume range that triggers a warning (git-fixes). - drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (git-fixes). - drm/amd/pm: Don't clear SI SMC table when setting power limit (git-fixes). - drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (git-fixes). - drm/nouveau: add missing DCB connector types (git-fixes). - commit 03d895b ++++ kernel-rt_debug: - mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (git-fixes). - mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (git-fixes). - regmap: Fix race condition in hwspinlock irqsave routine (git-fixes). - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (git-fixes). - ALSA: scarlett2: Fix buffer overflow in config retrieval (git-fixes). - ALSA: usb: Increase volume range that triggers a warning (git-fixes). - drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (git-fixes). - drm/amd/pm: Don't clear SI SMC table when setting power limit (git-fixes). - drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (git-fixes). - drm/nouveau: add missing DCB connector types (git-fixes). - commit 03d895b ++++ tiff: - Enable Lerc support in openSUSE * Used in GDAL for QGIS: boo#1257123 ------------------------------------------------------------------ ------------------ 2026-1-23 - Jan 23 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - io_uring: fix filename leak in __io_openat_prep() (CVE-2025-68814 bsc#1256651). - commit 4d3284d - octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" (CVE-2025-71137 bsc#1256760) - commit f080c28 - net: hns3: using the num_tqps in the vf driver to apply for resources (CVE-2025-71064 bsc#1256654) - commit d8f982b - macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (CVE-2025-68367 bsc#1255547) - commit 31c810e - team: fix check for port enabled in team_queue_override_port_prio_changed() (CVE-2025-71091 bsc#1256773) - commit fb6bd76 - md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt() (CVE-2025-71135 bsc#1256761). - commit 06431f4 - iommu: disable SVA when CONFIG_X86 is set (CVE-2025-71089 bsc#1256612). - commit 74dac8b - net: hns3: add VLAN id validation before using (CVE-2025-71112 bsc#1256726). - net/handshake: duplicate handshake cancellations leak socket (CVE-2025-68775 bsc#1256665). - commit 5f03ae0 - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (git-fixes). - dpll: Prevent duplicate registrations (git-fixes). - wifi: ath12k: fix dma_free_coherent() pointer (git-fixes). - wifi: ath10k: fix dma_free_coherent() pointer (git-fixes). - wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (git-fixes). - wifi: rsi: Fix memory corruption due to not set vif driver data size (git-fixes). - usbnet: limit max_mtu based on device's hard_mtu (git-fixes). - mISDN: annotate data-race around dev->work (git-fixes). - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (git-fixes). - can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (git-fixes). - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (git-fixes). - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (git-fixes). - Revert "nfc/nci: Add the inconsistency check between the input data length and count" (git-fixes). - net: usb: dm9601: remove broken SR9700 support (git-fixes). - leds: led-class: Only Add LED to leds_list when it is fully ready (git-fixes). - dpll: fix device-id-get and pin-id-get to return errors properly (git-fixes). - dpll: spec: add missing module-name and clock-id to pin-get reply (git-fixes). - dpll: fix return value check for kmemdup (git-fixes). - dpll: indent DPLL option type by a tab (git-fixes). - commit 0acacf9 - drm/amdgpu: fix nullptr err of vm_handle_moved (bsc#1255428 CVE-2025-40339) - commit 42c8fa8 - drm/amdgpu: update mappings not managed by KFD (bsc#1255428) - commit 2f69405 ++++ kernel-rt: - io_uring: fix filename leak in __io_openat_prep() (CVE-2025-68814 bsc#1256651). - commit 4d3284d - octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" (CVE-2025-71137 bsc#1256760) - commit f080c28 - net: hns3: using the num_tqps in the vf driver to apply for resources (CVE-2025-71064 bsc#1256654) - commit d8f982b - macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (CVE-2025-68367 bsc#1255547) - commit 31c810e - team: fix check for port enabled in team_queue_override_port_prio_changed() (CVE-2025-71091 bsc#1256773) - commit fb6bd76 - md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt() (CVE-2025-71135 bsc#1256761). - commit 06431f4 - iommu: disable SVA when CONFIG_X86 is set (CVE-2025-71089 bsc#1256612). - commit 74dac8b - net: hns3: add VLAN id validation before using (CVE-2025-71112 bsc#1256726). - net/handshake: duplicate handshake cancellations leak socket (CVE-2025-68775 bsc#1256665). - commit 5f03ae0 - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (git-fixes). - dpll: Prevent duplicate registrations (git-fixes). - wifi: ath12k: fix dma_free_coherent() pointer (git-fixes). - wifi: ath10k: fix dma_free_coherent() pointer (git-fixes). - wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (git-fixes). - wifi: rsi: Fix memory corruption due to not set vif driver data size (git-fixes). - usbnet: limit max_mtu based on device's hard_mtu (git-fixes). - mISDN: annotate data-race around dev->work (git-fixes). - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (git-fixes). - can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (git-fixes). - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (git-fixes). - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (git-fixes). - Revert "nfc/nci: Add the inconsistency check between the input data length and count" (git-fixes). - net: usb: dm9601: remove broken SR9700 support (git-fixes). - leds: led-class: Only Add LED to leds_list when it is fully ready (git-fixes). - dpll: fix device-id-get and pin-id-get to return errors properly (git-fixes). - dpll: spec: add missing module-name and clock-id to pin-get reply (git-fixes). - dpll: fix return value check for kmemdup (git-fixes). - dpll: indent DPLL option type by a tab (git-fixes). - commit 0acacf9 - drm/amdgpu: fix nullptr err of vm_handle_moved (bsc#1255428 CVE-2025-40339) - commit 42c8fa8 - drm/amdgpu: update mappings not managed by KFD (bsc#1255428) - commit 2f69405 ++++ kernel-rt_debug: - io_uring: fix filename leak in __io_openat_prep() (CVE-2025-68814 bsc#1256651). - commit 4d3284d - octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" (CVE-2025-71137 bsc#1256760) - commit f080c28 - net: hns3: using the num_tqps in the vf driver to apply for resources (CVE-2025-71064 bsc#1256654) - commit d8f982b - macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (CVE-2025-68367 bsc#1255547) - commit 31c810e - team: fix check for port enabled in team_queue_override_port_prio_changed() (CVE-2025-71091 bsc#1256773) - commit fb6bd76 - md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt() (CVE-2025-71135 bsc#1256761). - commit 06431f4 - iommu: disable SVA when CONFIG_X86 is set (CVE-2025-71089 bsc#1256612). - commit 74dac8b - net: hns3: add VLAN id validation before using (CVE-2025-71112 bsc#1256726). - net/handshake: duplicate handshake cancellations leak socket (CVE-2025-68775 bsc#1256665). - commit 5f03ae0 - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (git-fixes). - dpll: Prevent duplicate registrations (git-fixes). - wifi: ath12k: fix dma_free_coherent() pointer (git-fixes). - wifi: ath10k: fix dma_free_coherent() pointer (git-fixes). - wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (git-fixes). - wifi: rsi: Fix memory corruption due to not set vif driver data size (git-fixes). - usbnet: limit max_mtu based on device's hard_mtu (git-fixes). - mISDN: annotate data-race around dev->work (git-fixes). - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (git-fixes). - can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (git-fixes). - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (git-fixes). - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (git-fixes). - Revert "nfc/nci: Add the inconsistency check between the input data length and count" (git-fixes). - net: usb: dm9601: remove broken SR9700 support (git-fixes). - leds: led-class: Only Add LED to leds_list when it is fully ready (git-fixes). - dpll: fix device-id-get and pin-id-get to return errors properly (git-fixes). - dpll: spec: add missing module-name and clock-id to pin-get reply (git-fixes). - dpll: fix return value check for kmemdup (git-fixes). - dpll: indent DPLL option type by a tab (git-fixes). - commit 0acacf9 - drm/amdgpu: fix nullptr err of vm_handle_moved (bsc#1255428 CVE-2025-40339) - commit 42c8fa8 - drm/amdgpu: update mappings not managed by KFD (bsc#1255428) - commit 2f69405 ------------------------------------------------------------------ ------------------ 2026-1-22 - Jan 22 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - mptcp: fix a race in mptcp_pm_del_add_timer() (CVE-2025-40257 bsc#1254842). - commit 83400eb - fsnotify: do not generate ACCESS/MODIFY events on child for special files (bsc#1256638 CVE-2025-68788). - commit 6b6945d - ext4: xattr: fix null pointer deref in ext4_raw_inode() (bsc#1256754 CVE-2025-68820). - commit 8f80a8b - ext4: fix string copying in parse_apply_sb_mount_options() (bsc#1256757 CVE-2025-71123). - commit bd1f757 - ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164 CVE-2025-68261). - commit 835edb6 - nbd: defer config put in recv_work (bsc#1255537 CVE-2025-68372). - commit 4a0d1d2 - nbd: defer config unlock in nbd_genl_connect (bsc#1255622 CVE-2025-68366). - commit 7dc2ba0 - jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (bsc#1255482 CVE-2025-68337). - commit dea6220 - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (CVE-2025-68325 bsc#1255417). - commit 0e9df03 - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (CVE-2025-68188 bsc#1255269). - commit 36ba28e ++++ kernel-rt: - mptcp: fix a race in mptcp_pm_del_add_timer() (CVE-2025-40257 bsc#1254842). - commit 83400eb - fsnotify: do not generate ACCESS/MODIFY events on child for special files (bsc#1256638 CVE-2025-68788). - commit 6b6945d - ext4: xattr: fix null pointer deref in ext4_raw_inode() (bsc#1256754 CVE-2025-68820). - commit 8f80a8b - ext4: fix string copying in parse_apply_sb_mount_options() (bsc#1256757 CVE-2025-71123). - commit bd1f757 - ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164 CVE-2025-68261). - commit 835edb6 - nbd: defer config put in recv_work (bsc#1255537 CVE-2025-68372). - commit 4a0d1d2 - nbd: defer config unlock in nbd_genl_connect (bsc#1255622 CVE-2025-68366). - commit 7dc2ba0 - jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (bsc#1255482 CVE-2025-68337). - commit dea6220 - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (CVE-2025-68325 bsc#1255417). - commit 0e9df03 - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (CVE-2025-68188 bsc#1255269). - commit 36ba28e ++++ kernel-rt_debug: - mptcp: fix a race in mptcp_pm_del_add_timer() (CVE-2025-40257 bsc#1254842). - commit 83400eb - fsnotify: do not generate ACCESS/MODIFY events on child for special files (bsc#1256638 CVE-2025-68788). - commit 6b6945d - ext4: xattr: fix null pointer deref in ext4_raw_inode() (bsc#1256754 CVE-2025-68820). - commit 8f80a8b - ext4: fix string copying in parse_apply_sb_mount_options() (bsc#1256757 CVE-2025-71123). - commit bd1f757 - ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164 CVE-2025-68261). - commit 835edb6 - nbd: defer config put in recv_work (bsc#1255537 CVE-2025-68372). - commit 4a0d1d2 - nbd: defer config unlock in nbd_genl_connect (bsc#1255622 CVE-2025-68366). - commit 7dc2ba0 - jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (bsc#1255482 CVE-2025-68337). - commit dea6220 - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (CVE-2025-68325 bsc#1255417). - commit 0e9df03 - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (CVE-2025-68188 bsc#1255269). - commit 36ba28e ++++ sqlite3: - Update to version 3.51.2: * bsc#1259619, CVE-2025-70873: zipfile extension may disclose uninitialized heap memory during inflation. * Fix an obscure deadlock in the new broken-posix-lock detection logic. * Fix multiple problems in the EXISTS-to-JOIN optimization. * Other minor bug fixes. ++++ libxml2: - CVE-2026-0989: call stack exhaustion leading to application crash due to RelaxNG parser not limiting the recursion depth when resolving `` directives (bsc#1256804, bsc#1256805, bsc#1256810) * Add patch libxml2-CVE-2026-0989.patch * https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/374 ++++ libxml2-python: - CVE-2026-0989: call stack exhaustion leading to application crash due to RelaxNG parser not limiting the recursion depth when resolving `` directives (bsc#1256804, bsc#1256805, bsc#1256810) * Add patch libxml2-CVE-2026-0989.patch * https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/374 ++++ suseconnect-ng: - Update version to 1.20: - Update error message for Public Cloud instances with registercloudguest installed. SUSEConnect -d is disabled on PYAG and BYOS when the registercloudguest command is available. (bsc#1230861) - Enhanced SAP detected. Take TREX into account and remove empty values when only /usr/sap but no installation exists (bsc#1241002) - Fixed modules and extension link to point to version less documentation. (bsc#1239439) - Fixed SAP instance detection (bsc#1244550) - Remove link to extensions documentation (bsc#1239439) - Migrate to the public library ------------------------------------------------------------------ ------------------ 2026-1-21 - Jan 21 2026 ------------------- ------------------------------------------------------------------ ++++ cups: - Version upgrade to 2.4.16: See https://github.com/openprinting/cups/releases The hotfix release 2.4.16 includes fix for infinite loop in GTK, which was caused by change of internal behavior in libcups on which GTK depended on, and workaround for stopping the scheduler if configuration includes unknown directives. Detailed list (from CHANGES.md): * 'cupsUTF8ToCharset' didn't validate 2-byte UTF-8 sequences, potentially reading past the end of the source string (Issue #1438) * The web interface did not support domain usernames fully (Issue #1441) * Fixed an infinite loop issue in the GTK+ print dialog (Issue #1439 boo#1254353) * Fixed stopping scheduler on unknown directive in configuration (Issue #1443) Issues are those at https://github.com/OpenPrinting/cups/issues - Version upgrade to 2.4.15: See https://github.com/openprinting/cups/releases The release CUPS 2.4.15 brings two CVE fixes: Fix various cupsd issues which cause local DoS (CVE-2025-61915 bsc#1253783) Fix unresponsive cupsd process caused by slow client (CVE-2025-58436 bsc#1244057) and several bug fixes described in CHANGES.md. Detailed list (from CHANGES.md): * Fixed potential crash in 'cups-driverd' when there are duplicate PPDs (Issue #1355) * Fixed error recovery when scanning for PPDs in 'cups-driverd' (Issue #1416) Issues are those at https://github.com/OpenPrinting/cups/issues - Adapted downgrade-autoconf-requirement.patch for CUPS 2.4.16 - Fixed entry below dated "Sat Sep 30 08:52:42 UTC 2017" which contained needless UTF-8 Unicode characters that are now replaced by plain ASCII text in "... line - the ..." to fix a rpmlint "non-break-space" warning. - Adapted and enhanced 'tmpfiles.d' related things in cups.spec to "Fix packages for Immutable Mode - cups" (implementation task jsc#PED-14775 from epic jsc#PED-14688) ++++ glib2: - Add glib2-CVE-2026-0988.patch: fix a potential integer overflow in g_buffered_input_stream_peek (bsc#1257049 CVE-2026-0988 glgo#GNOME/glib#3851). ++++ kernel-default: - net: ipv6: fix field-spanning memcpy warning in AH output (CVE-2025-40363 bsc#1255102). - commit b54ffd4 - ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (CVE-2025-68241 bsc#1255157). - net: netpoll: fix incorrect refcount handling causing incorrect cleanup (CVE-2025-68245 bsc#1255268). - commit f673593 - Refresh patches.suse/dmaengine-idxd-Fix-refcount-underflow-on-module-unlo.patch Fix the missing cleanup, folding the upsteram stable 6.12.y fix (commit d28c1b1566a1) into the backport patch itself. - commit d2ae2ac - of: fix reference count leak in of_alias_scan() (git-fixes). - of: platform: Use default match table for /firmware (git-fixes). - ata: libata: Add cpr_log to ata_dev_print_features() early return (git-fixes). - commit 403f41b ++++ kernel-rt: - net: ipv6: fix field-spanning memcpy warning in AH output (CVE-2025-40363 bsc#1255102). - commit b54ffd4 - ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (CVE-2025-68241 bsc#1255157). - net: netpoll: fix incorrect refcount handling causing incorrect cleanup (CVE-2025-68245 bsc#1255268). - commit f673593 - Refresh patches.suse/dmaengine-idxd-Fix-refcount-underflow-on-module-unlo.patch Fix the missing cleanup, folding the upsteram stable 6.12.y fix (commit d28c1b1566a1) into the backport patch itself. - commit d2ae2ac - of: fix reference count leak in of_alias_scan() (git-fixes). - of: platform: Use default match table for /firmware (git-fixes). - ata: libata: Add cpr_log to ata_dev_print_features() early return (git-fixes). - commit 403f41b ++++ kernel-rt_debug: - net: ipv6: fix field-spanning memcpy warning in AH output (CVE-2025-40363 bsc#1255102). - commit b54ffd4 - ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (CVE-2025-68241 bsc#1255157). - net: netpoll: fix incorrect refcount handling causing incorrect cleanup (CVE-2025-68245 bsc#1255268). - commit f673593 - Refresh patches.suse/dmaengine-idxd-Fix-refcount-underflow-on-module-unlo.patch Fix the missing cleanup, folding the upsteram stable 6.12.y fix (commit d28c1b1566a1) into the backport patch itself. - commit d2ae2ac - of: fix reference count leak in of_alias_scan() (git-fixes). - of: platform: Use default match table for /firmware (git-fixes). - ata: libata: Add cpr_log to ata_dev_print_features() early return (git-fixes). - commit 403f41b ------------------------------------------------------------------ ------------------ 2026-1-20 - Jan 20 2026 ------------------- ------------------------------------------------------------------ ++++ grub2: - Optimize PBKDF2 to reduce the decryption time (bsc#1248516) * 0001-lib-crypto-Introduce-new-HMAC-functions-to-reuse-buf.patch * 0002-lib-pbkdf2-Optimize-PBKDF2-by-reusing-HMAC-handle.patch * 0001-kern-misc-Implement-faster-grub_memcpy-for-aligned-b.patch ++++ kernel-default: - NFSD: NFSv4 file creation neglects setting ACL (CVE-2025-68803 bsc#1256770). - commit cae9b7a - nfsd: set security label during create operations (CVE-2025-68803 bsc#1256770). - commit 8ee0c2b - RDMA/irdma: avoid invalid read in irdma_net_event (CVE-2025-71133 bsc#1256733) - commit c4b2e81 - RDMA/cm: Fix leaking the multicast GID table reference (CVE-2025-71084 bsc#1256622) - commit 695ad1f - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (CVE-2025-71120 bsc#1256779). - commit 400a381 - scsi: sg: Do not sleep in atomic context (CVE-2025-40259 bsc#1254845). - commit 386a47a ++++ kernel-rt: - NFSD: NFSv4 file creation neglects setting ACL (CVE-2025-68803 bsc#1256770). - commit cae9b7a - nfsd: set security label during create operations (CVE-2025-68803 bsc#1256770). - commit 8ee0c2b - RDMA/irdma: avoid invalid read in irdma_net_event (CVE-2025-71133 bsc#1256733) - commit c4b2e81 - RDMA/cm: Fix leaking the multicast GID table reference (CVE-2025-71084 bsc#1256622) - commit 695ad1f - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (CVE-2025-71120 bsc#1256779). - commit 400a381 - scsi: sg: Do not sleep in atomic context (CVE-2025-40259 bsc#1254845). - commit 386a47a ++++ kernel-rt_debug: - NFSD: NFSv4 file creation neglects setting ACL (CVE-2025-68803 bsc#1256770). - commit cae9b7a - nfsd: set security label during create operations (CVE-2025-68803 bsc#1256770). - commit 8ee0c2b - RDMA/irdma: avoid invalid read in irdma_net_event (CVE-2025-71133 bsc#1256733) - commit c4b2e81 - RDMA/cm: Fix leaking the multicast GID table reference (CVE-2025-71084 bsc#1256622) - commit 695ad1f - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (CVE-2025-71120 bsc#1256779). - commit 400a381 - scsi: sg: Do not sleep in atomic context (CVE-2025-40259 bsc#1254845). - commit 386a47a ++++ nvidia-open-driver-G06-signed: - updated CUDA variant to version 580.126.09 - supersedes kernel-6.18.patch ------------------------------------------------------------------ ------------------ 2026-1-19 - Jan 19 2026 ------------------- ------------------------------------------------------------------ ++++ glibc: - memalign-overflow-check.patch: memalign: reinstate alignment overflow check (CVE-2026-0861, bsc#1256766, BZ #33796) - nss-dns-getnetbyaddr.patch: resolv: Fix NSS DNS backend for getnetbyaddr (CVE-2026-0915, bsc#1256822, BZ #33802) - wordexp-wrde-reuse.patch: posix: Reset wordexp_t fields with WRDE_REUSE (CVE-2025-15281, bsc#1257005, BZ #33814) ++++ kernel-default: - arp: do not assume dev_hard_header() does not change skb->head (CVE-2025-71098 bsc#1256591). - ip6_gre: make ip6gre_header() robust (CVE-2025-71098 bsc#1256591). - commit 0de7076 - drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128 CVE-2025-68296) - commit 4190209 - dmaengine: apple-admac: Add "apple,t8103-admac" compatible (git-fixes). - dmaengine: omap-dma: fix dma_pool resource leak in error paths (git-fixes). - dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (git-fixes). - dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (git-fixes). - dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (git-fixes). - dmaengine: tegra-adma: Fix use-after-free (git-fixes). - dmaengine: ti: k3-udma: fix device leak on udma lookup (git-fixes). - dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (git-fixes). - dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (git-fixes). - dmaengine: lpc18xx-dmamux: fix device leak on route allocation (git-fixes). - dmaengine: idxd: fix device leaks on compat bind and unbind (git-fixes). - dmaengine: dw: dmamux: fix OF node leak on route allocation failure (git-fixes). - dmaengine: bcm-sba-raid: fix device leak on probe (git-fixes). - dmaengine: at_hdmac: fix device leak on of_dma_xlate() (git-fixes). - dmaengine: xilinx: xdma: Fix regmap max_register (git-fixes). - phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (git-fixes). - phy: rockchip: inno-usb2: fix communication disruption in gadget mode (git-fixes). - phy: rockchip: inno-usb2: fix disconnection in gadget mode (git-fixes). - phy: stm32-usphyc: Fix off by one in probe() (git-fixes). - commit c2d8602 - Remove patches.suse/0001-drm-fbcon-vga_switcheroo-Avoid-race-condition-in-fbc.patch - commit 462d775 ++++ kernel-rt: - arp: do not assume dev_hard_header() does not change skb->head (CVE-2025-71098 bsc#1256591). - ip6_gre: make ip6gre_header() robust (CVE-2025-71098 bsc#1256591). - commit 0de7076 - drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128 CVE-2025-68296) - commit 4190209 - dmaengine: apple-admac: Add "apple,t8103-admac" compatible (git-fixes). - dmaengine: omap-dma: fix dma_pool resource leak in error paths (git-fixes). - dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (git-fixes). - dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (git-fixes). - dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (git-fixes). - dmaengine: tegra-adma: Fix use-after-free (git-fixes). - dmaengine: ti: k3-udma: fix device leak on udma lookup (git-fixes). - dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (git-fixes). - dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (git-fixes). - dmaengine: lpc18xx-dmamux: fix device leak on route allocation (git-fixes). - dmaengine: idxd: fix device leaks on compat bind and unbind (git-fixes). - dmaengine: dw: dmamux: fix OF node leak on route allocation failure (git-fixes). - dmaengine: bcm-sba-raid: fix device leak on probe (git-fixes). - dmaengine: at_hdmac: fix device leak on of_dma_xlate() (git-fixes). - dmaengine: xilinx: xdma: Fix regmap max_register (git-fixes). - phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (git-fixes). - phy: rockchip: inno-usb2: fix communication disruption in gadget mode (git-fixes). - phy: rockchip: inno-usb2: fix disconnection in gadget mode (git-fixes). - phy: stm32-usphyc: Fix off by one in probe() (git-fixes). - commit c2d8602 - Remove patches.suse/0001-drm-fbcon-vga_switcheroo-Avoid-race-condition-in-fbc.patch - commit 462d775 ++++ kernel-rt_debug: - arp: do not assume dev_hard_header() does not change skb->head (CVE-2025-71098 bsc#1256591). - ip6_gre: make ip6gre_header() robust (CVE-2025-71098 bsc#1256591). - commit 0de7076 - drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128 CVE-2025-68296) - commit 4190209 - dmaengine: apple-admac: Add "apple,t8103-admac" compatible (git-fixes). - dmaengine: omap-dma: fix dma_pool resource leak in error paths (git-fixes). - dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (git-fixes). - dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (git-fixes). - dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (git-fixes). - dmaengine: tegra-adma: Fix use-after-free (git-fixes). - dmaengine: ti: k3-udma: fix device leak on udma lookup (git-fixes). - dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (git-fixes). - dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (git-fixes). - dmaengine: lpc18xx-dmamux: fix device leak on route allocation (git-fixes). - dmaengine: idxd: fix device leaks on compat bind and unbind (git-fixes). - dmaengine: dw: dmamux: fix OF node leak on route allocation failure (git-fixes). - dmaengine: bcm-sba-raid: fix device leak on probe (git-fixes). - dmaengine: at_hdmac: fix device leak on of_dma_xlate() (git-fixes). - dmaengine: xilinx: xdma: Fix regmap max_register (git-fixes). - phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (git-fixes). - phy: rockchip: inno-usb2: fix communication disruption in gadget mode (git-fixes). - phy: rockchip: inno-usb2: fix disconnection in gadget mode (git-fixes). - phy: stm32-usphyc: Fix off by one in probe() (git-fixes). - commit c2d8602 - Remove patches.suse/0001-drm-fbcon-vga_switcheroo-Avoid-race-condition-in-fbc.patch - commit 462d775 ++++ openssl-3: - Security fixes: * Missing ASN1_TYPE validation in PKCS#12 parsing - openssl-CVE-2026-22795.patch [bsc#1256839, CVE-2026-22795] * ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function - openssl-CVE-2026-22795.patch [bsc#1256840, CVE-2026-22796] * Missing ASN1_TYPE validation in TS_RESP_verify_response() function - openssl-CVE-2025-69420.patch [bsc#1256837, CVE-2025-69420] * NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function - openssl-CVE-2025-69421.patch [bsc#1256838, CVE-2025-69421] * Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion - openssl-CVE-2025-69419.patch [bsc#1256836, CVE-2025-69419] * Heap out-of-bounds write in BIO_f_linebuffer on short writes - openssl-CVE-2025-68160.patch [bsc#1256834, CVE-2025-68160] * Unauthenticated/unencrypted trailing bytes with low-level OCB function calls - openssl-CVE-2025-69418.patch [bsc#1256835, CVE-2025-69418] * Stack buffer overflow in CMS AuthEnvelopedData parsing - openssl-CVE-2025-15467.patch [bsc#1256830, CVE-2025-15467] - openssl-CVE-2025-15467-comments.patch - openssl-CVE-2025-15467-test.patch ++++ python-pyasn1: - Add CVE-2026-23490.patch to fix CVE-2026-23490 (bsc#1256902) - fix broken changelog entries ------------------------------------------------------------------ ------------------ 2026-1-18 - Jan 18 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - gpio: pca953x: fix wrong error probe return value (git-fixes). - commit df5f5f1 - gpio: pca953x: Utilise temporary variable for struct device (stable-fixes). - Refresh patches.suse/gpio-pca953x-log-an-error-when-failing-to-get-the-re.patch. - commit b07f679 - lib/crypto: aes: Fix missing MMU protection for AES S-box (git-fixes). - mei: me: add nova lake point S DID (stable-fixes). - gpio: pca953x: handle short interrupt pulses on PCAL devices (git-fixes). - drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (stable-fixes). - ASoC: fsl_sai: Add missing registers to cache default (stable-fixes). - ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (stable-fixes). - ALSA: usb-audio: Update for native DSD support quirks (stable-fixes). - drm/amd/display: Fix DP no audio issue (stable-fixes). - powercap: fix sscanf() error return value handling (stable-fixes). - powercap: fix race condition in register_control_type() (stable-fixes). - can: j1939: make j1939_session_activate() fail if device is no longer registered (stable-fixes). - mei: me: add wildcat lake P DID (stable-fixes). - gpio: pca953x: Add support for level-triggered interrupts (stable-fixes). - gpio: pca953x: Utilise dev_err_probe() where it makes sense (stable-fixes). - commit 46ebab7 - ocfs2: fix kernel BUG in ocfs2_find_victim_chain (bsc#1256582 CVE-2025-68771). - commit fae1ed0 ++++ kernel-rt: - gpio: pca953x: fix wrong error probe return value (git-fixes). - commit df5f5f1 - gpio: pca953x: Utilise temporary variable for struct device (stable-fixes). - Refresh patches.suse/gpio-pca953x-log-an-error-when-failing-to-get-the-re.patch. - commit b07f679 - lib/crypto: aes: Fix missing MMU protection for AES S-box (git-fixes). - mei: me: add nova lake point S DID (stable-fixes). - gpio: pca953x: handle short interrupt pulses on PCAL devices (git-fixes). - drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (stable-fixes). - ASoC: fsl_sai: Add missing registers to cache default (stable-fixes). - ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (stable-fixes). - ALSA: usb-audio: Update for native DSD support quirks (stable-fixes). - drm/amd/display: Fix DP no audio issue (stable-fixes). - powercap: fix sscanf() error return value handling (stable-fixes). - powercap: fix race condition in register_control_type() (stable-fixes). - can: j1939: make j1939_session_activate() fail if device is no longer registered (stable-fixes). - mei: me: add wildcat lake P DID (stable-fixes). - gpio: pca953x: Add support for level-triggered interrupts (stable-fixes). - gpio: pca953x: Utilise dev_err_probe() where it makes sense (stable-fixes). - commit 46ebab7 - ocfs2: fix kernel BUG in ocfs2_find_victim_chain (bsc#1256582 CVE-2025-68771). - commit fae1ed0 ++++ kernel-rt_debug: - gpio: pca953x: fix wrong error probe return value (git-fixes). - commit df5f5f1 - gpio: pca953x: Utilise temporary variable for struct device (stable-fixes). - Refresh patches.suse/gpio-pca953x-log-an-error-when-failing-to-get-the-re.patch. - commit b07f679 - lib/crypto: aes: Fix missing MMU protection for AES S-box (git-fixes). - mei: me: add nova lake point S DID (stable-fixes). - gpio: pca953x: handle short interrupt pulses on PCAL devices (git-fixes). - drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (stable-fixes). - ASoC: fsl_sai: Add missing registers to cache default (stable-fixes). - ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (stable-fixes). - ALSA: usb-audio: Update for native DSD support quirks (stable-fixes). - drm/amd/display: Fix DP no audio issue (stable-fixes). - powercap: fix sscanf() error return value handling (stable-fixes). - powercap: fix race condition in register_control_type() (stable-fixes). - can: j1939: make j1939_session_activate() fail if device is no longer registered (stable-fixes). - mei: me: add wildcat lake P DID (stable-fixes). - gpio: pca953x: Add support for level-triggered interrupts (stable-fixes). - gpio: pca953x: Utilise dev_err_probe() where it makes sense (stable-fixes). - commit 46ebab7 - ocfs2: fix kernel BUG in ocfs2_find_victim_chain (bsc#1256582 CVE-2025-68771). - commit fae1ed0 ------------------------------------------------------------------ ------------------ 2026-1-17 - Jan 17 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - ASoC: codecs: wsa883x: fix unnecessary initialisation (git-fixes). - commit 9ad50cc - drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (git-fixes). - drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (git-fixes). - drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (git-fixes). - drm/amdkfd: fix a memory leak in device_queue_manager_init() (git-fixes). - ASoC: tlv320adcx140: fix word length (git-fixes). - ASoC: tlv320adcx140: fix null pointer (git-fixes). - ASoC: codecs: wsa884x: fix codec initialisation (git-fixes). - commit b212696 ++++ kernel-rt: - ASoC: codecs: wsa883x: fix unnecessary initialisation (git-fixes). - commit 9ad50cc - drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (git-fixes). - drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (git-fixes). - drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (git-fixes). - drm/amdkfd: fix a memory leak in device_queue_manager_init() (git-fixes). - ASoC: tlv320adcx140: fix word length (git-fixes). - ASoC: tlv320adcx140: fix null pointer (git-fixes). - ASoC: codecs: wsa884x: fix codec initialisation (git-fixes). - commit b212696 ++++ kernel-rt_debug: - ASoC: codecs: wsa883x: fix unnecessary initialisation (git-fixes). - commit 9ad50cc - drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (git-fixes). - drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (git-fixes). - drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (git-fixes). - drm/amdkfd: fix a memory leak in device_queue_manager_init() (git-fixes). - ASoC: tlv320adcx140: fix word length (git-fixes). - ASoC: tlv320adcx140: fix null pointer (git-fixes). - ASoC: codecs: wsa884x: fix codec initialisation (git-fixes). - commit b212696 ------------------------------------------------------------------ ------------------ 2026-1-16 - Jan 16 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (CVE-2025-68764 bsc#1255930). - commit 84f3f58 - net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (CVE-2025-68776 bsc#1256659) - commit 86f02f8 - fs/ntfs3: Initialize allocated memory before use (CVE-2025-68365 bsc#1255548) - commit 354fd40 - ntfs3: fix uninit memory after failed mi_read in mi_format_new (CVE-2025-68728 bsc#1255539) - commit 3c62fa0 - iavf: fix off-by-one issues in iavf_config_rss_reg() (CVE-2025-71087 bsc#1256628). - commit 8d4da32 - RDMA/rxe: Fix null deref on srq->rq.queue after resize failure (CVE-2025-68379 bsc#1255695) - commit 8aea2cc - Fix KABI for "md: fix rcu protection in md_wakeup_thread" (CVE-2025-68374 bsc#1255530). - commit 4078c1e - ice: use netif_get_num_default_rss_queues() (bsc#1247712). - commit eb0fac0 - md: fix rcu protection in md_wakeup_thread (CVE-2025-68374 bsc#1255530). - commit 1b0738f - scsi: qla2xxx: Update version to 10.02.10.100-k (bsc#1256863). - scsi: qla2xxx: Fix bsg_done() causing double free (bsc#1256863). - scsi: qla2xxx: Query FW again before proceeding with login (bsc#1256863). - scsi: qla2xxx: Validate sp before freeing associated memory (bsc#1256863). - scsi: qla2xxx: Free sp in error path to fix system crash (bsc#1256863). - scsi: qla2xxx: Delay module unload while fabric scan in progress (bsc#1256863). - scsi: qla2xxx: Allow recovery for tape devices (bsc#1256863). - scsi: qla2xxx: Add bsg interface to support firmware img validation (bsc#1256863). - scsi: qla2xxx: Validate MCU signature before executing MBC 03h (bsc#1256863). - scsi: qla2xxx: Add load flash firmware mailbox support for 28xxx (bsc#1256863). - scsi: qla2xxx: Add support for 64G SFP speed (bsc#1256863). - scsi: qla2xxx: Add Speed in SFP print information (bsc#1256863). - scsi: lpfc: Update lpfc version to 14.4.0.13 (bsc#1256861). - scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (bsc#1256861). - commit da9bd89 - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (CVE-2025-40261 bsc#1254839). - commit 95251dd - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CVE-2025-68349 bsc#1255544). - commit fea667d - ipvs: fix ipv4 null-ptr-deref in route error path (CVE-2025-68813 bsc#1256641). - commit 238038b - drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128 CVE-2025-68296) - commit b6c7c30 - net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (git-fixes). - can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit (git-fixes). - can: etas_es58x: allow partial RX URB allocation to succeed (git-fixes). - commit 6e93ffe ++++ kernel-rt: - NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (CVE-2025-68764 bsc#1255930). - commit 84f3f58 - net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (CVE-2025-68776 bsc#1256659) - commit 86f02f8 - fs/ntfs3: Initialize allocated memory before use (CVE-2025-68365 bsc#1255548) - commit 354fd40 - ntfs3: fix uninit memory after failed mi_read in mi_format_new (CVE-2025-68728 bsc#1255539) - commit 3c62fa0 - iavf: fix off-by-one issues in iavf_config_rss_reg() (CVE-2025-71087 bsc#1256628). - commit 8d4da32 - RDMA/rxe: Fix null deref on srq->rq.queue after resize failure (CVE-2025-68379 bsc#1255695) - commit 8aea2cc - Fix KABI for "md: fix rcu protection in md_wakeup_thread" (CVE-2025-68374 bsc#1255530). - commit 4078c1e - ice: use netif_get_num_default_rss_queues() (bsc#1247712). - commit eb0fac0 - md: fix rcu protection in md_wakeup_thread (CVE-2025-68374 bsc#1255530). - commit 1b0738f - scsi: qla2xxx: Update version to 10.02.10.100-k (bsc#1256863). - scsi: qla2xxx: Fix bsg_done() causing double free (bsc#1256863). - scsi: qla2xxx: Query FW again before proceeding with login (bsc#1256863). - scsi: qla2xxx: Validate sp before freeing associated memory (bsc#1256863). - scsi: qla2xxx: Free sp in error path to fix system crash (bsc#1256863). - scsi: qla2xxx: Delay module unload while fabric scan in progress (bsc#1256863). - scsi: qla2xxx: Allow recovery for tape devices (bsc#1256863). - scsi: qla2xxx: Add bsg interface to support firmware img validation (bsc#1256863). - scsi: qla2xxx: Validate MCU signature before executing MBC 03h (bsc#1256863). - scsi: qla2xxx: Add load flash firmware mailbox support for 28xxx (bsc#1256863). - scsi: qla2xxx: Add support for 64G SFP speed (bsc#1256863). - scsi: qla2xxx: Add Speed in SFP print information (bsc#1256863). - scsi: lpfc: Update lpfc version to 14.4.0.13 (bsc#1256861). - scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (bsc#1256861). - commit da9bd89 - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (CVE-2025-40261 bsc#1254839). - commit 95251dd - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CVE-2025-68349 bsc#1255544). - commit fea667d - ipvs: fix ipv4 null-ptr-deref in route error path (CVE-2025-68813 bsc#1256641). - commit 238038b - drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128 CVE-2025-68296) - commit b6c7c30 - net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (git-fixes). - can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit (git-fixes). - can: etas_es58x: allow partial RX URB allocation to succeed (git-fixes). - commit 6e93ffe ++++ kernel-rt_debug: - NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (CVE-2025-68764 bsc#1255930). - commit 84f3f58 - net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (CVE-2025-68776 bsc#1256659) - commit 86f02f8 - fs/ntfs3: Initialize allocated memory before use (CVE-2025-68365 bsc#1255548) - commit 354fd40 - ntfs3: fix uninit memory after failed mi_read in mi_format_new (CVE-2025-68728 bsc#1255539) - commit 3c62fa0 - iavf: fix off-by-one issues in iavf_config_rss_reg() (CVE-2025-71087 bsc#1256628). - commit 8d4da32 - RDMA/rxe: Fix null deref on srq->rq.queue after resize failure (CVE-2025-68379 bsc#1255695) - commit 8aea2cc - Fix KABI for "md: fix rcu protection in md_wakeup_thread" (CVE-2025-68374 bsc#1255530). - commit 4078c1e - ice: use netif_get_num_default_rss_queues() (bsc#1247712). - commit eb0fac0 - md: fix rcu protection in md_wakeup_thread (CVE-2025-68374 bsc#1255530). - commit 1b0738f - scsi: qla2xxx: Update version to 10.02.10.100-k (bsc#1256863). - scsi: qla2xxx: Fix bsg_done() causing double free (bsc#1256863). - scsi: qla2xxx: Query FW again before proceeding with login (bsc#1256863). - scsi: qla2xxx: Validate sp before freeing associated memory (bsc#1256863). - scsi: qla2xxx: Free sp in error path to fix system crash (bsc#1256863). - scsi: qla2xxx: Delay module unload while fabric scan in progress (bsc#1256863). - scsi: qla2xxx: Allow recovery for tape devices (bsc#1256863). - scsi: qla2xxx: Add bsg interface to support firmware img validation (bsc#1256863). - scsi: qla2xxx: Validate MCU signature before executing MBC 03h (bsc#1256863). - scsi: qla2xxx: Add load flash firmware mailbox support for 28xxx (bsc#1256863). - scsi: qla2xxx: Add support for 64G SFP speed (bsc#1256863). - scsi: qla2xxx: Add Speed in SFP print information (bsc#1256863). - scsi: lpfc: Update lpfc version to 14.4.0.13 (bsc#1256861). - scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (bsc#1256861). - commit da9bd89 - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (CVE-2025-40261 bsc#1254839). - commit 95251dd - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CVE-2025-68349 bsc#1255544). - commit fea667d - ipvs: fix ipv4 null-ptr-deref in route error path (CVE-2025-68813 bsc#1256641). - commit 238038b - drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128 CVE-2025-68296) - commit b6c7c30 - net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (git-fixes). - can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit (git-fixes). - can: etas_es58x: allow partial RX URB allocation to succeed (git-fixes). - commit 6e93ffe ++++ openSUSE-build-key: - import-openSUSE-build-key: implement importing all keys from /usr/lib/rpm/gnupg/keys ------------------------------------------------------------------ ------------------ 2026-1-15 - Jan 15 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - ntfs3: Fix uninit buffer allocated by __getname() (CVE-2025-68727 bsc#1255568) - commit 97681c7 - libceph: fix potential use-after-free in have_mon_and_osd_map() (CVE-2025-68285 bsc#1255401). - commit fdc5baf - interconnect: Don't access req_list while it's being manipulated (CVE-2023-54013 bsc#1256280). - commit 397aee1 - interconnect: Fix locking for runpm vs reclaim (CVE-2023-54013 bsc#1256280). - commit bacbc82 - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (CVE-2025-71096 bsc#1256606) - commit 7a5edbb - mptcp: Fix proto fallback detection with BPF (CVE-2025-68227 bsc#1255216). - commit 557d74c - sysfs: check visibility before changing group attribute ownership (CVE-2025-40355 bsc#1255261). - commit 7b1e9ed - x86/fpu: Ensure XFD state on signal delivery (CVE-2025-68171 bsc#1255255). - commit 265a09f ++++ kernel-rt: - ntfs3: Fix uninit buffer allocated by __getname() (CVE-2025-68727 bsc#1255568) - commit 97681c7 - libceph: fix potential use-after-free in have_mon_and_osd_map() (CVE-2025-68285 bsc#1255401). - commit fdc5baf - interconnect: Don't access req_list while it's being manipulated (CVE-2023-54013 bsc#1256280). - commit 397aee1 - interconnect: Fix locking for runpm vs reclaim (CVE-2023-54013 bsc#1256280). - commit bacbc82 - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (CVE-2025-71096 bsc#1256606) - commit 7a5edbb - mptcp: Fix proto fallback detection with BPF (CVE-2025-68227 bsc#1255216). - commit 557d74c - sysfs: check visibility before changing group attribute ownership (CVE-2025-40355 bsc#1255261). - commit 7b1e9ed - x86/fpu: Ensure XFD state on signal delivery (CVE-2025-68171 bsc#1255255). - commit 265a09f ++++ kernel-rt_debug: - ntfs3: Fix uninit buffer allocated by __getname() (CVE-2025-68727 bsc#1255568) - commit 97681c7 - libceph: fix potential use-after-free in have_mon_and_osd_map() (CVE-2025-68285 bsc#1255401). - commit fdc5baf - interconnect: Don't access req_list while it's being manipulated (CVE-2023-54013 bsc#1256280). - commit 397aee1 - interconnect: Fix locking for runpm vs reclaim (CVE-2023-54013 bsc#1256280). - commit bacbc82 - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (CVE-2025-71096 bsc#1256606) - commit 7a5edbb - mptcp: Fix proto fallback detection with BPF (CVE-2025-68227 bsc#1255216). - commit 557d74c - sysfs: check visibility before changing group attribute ownership (CVE-2025-40355 bsc#1255261). - commit 7b1e9ed - x86/fpu: Ensure XFD state on signal delivery (CVE-2025-68171 bsc#1255255). - commit 265a09f ++++ libpng16: - security update - added patches CVE-2026-22695 [bsc#1256525], Heap buffer over-read in png_image_finish_read * libpng16-CVE-2026-22695.patch CVE-2026-22801 [bsc#1256526], Integer truncation causing heap buffer over-read in png_image_write_* * libpng16-CVE-2026-22801.patch ------------------------------------------------------------------ ------------------ 2026-1-14 - Jan 14 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - sched: Increase sched_tick_remote timeout (bsc#1254510). - commit 87d4295 - drm/amdgpu: fix gpu page fault after hibernation on PF passthrough (bsc#1255134 CVE-2025-68230) - commit 19b936b - net: atlantic: fix fragment overflow handling in RX path (CVE-2025-68301 bsc#1255120). - be2net: pass wrb_params in case of OS2BMC (CVE-2025-40264 bsc#1254835). - net: openvswitch: remove never-working support for setting nsh fields (CVE-2025-40254 bsc#1254852). - net/mlx5: Fix IPsec cleanup over MPV device (CVE-2025-40238 bsc#1254871). - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (CVE-2025-40350 bsc#1255260). - commit 07231fa - drm/sysfb: Do not dereference NULL pointer in plane reset (bsc#1255095 CVE-2025-40360) - commit adae9ca - amd/amdkfd: enhance kfd process check in switch partition (CVE-2025-68174 bsc#1255327). - commit 9e3bffb - drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (CVE-2025-68190 bsc#1255131). - commit a195e39 - selftests/bpf: Test bpf_skb_check_mtu(BPF_MTU_CHK_SEGS) when transport_header is not set (CVE-2025-68363 bsc#1255552). - commit 742de98 - bpf: Check skb->transport_header is set in bpf_skb_check_mtu (CVE-2025-68363 bsc#1255552). - commit f6cdd52 - drm/amdgpu: remove two invalid BUG_ON()s (CVE-2025-68201 bsc#1255136) - commit 9a27d5e ++++ kernel-rt: - sched: Increase sched_tick_remote timeout (bsc#1254510). - commit 87d4295 - drm/amdgpu: fix gpu page fault after hibernation on PF passthrough (bsc#1255134 CVE-2025-68230) - commit 19b936b - net: atlantic: fix fragment overflow handling in RX path (CVE-2025-68301 bsc#1255120). - be2net: pass wrb_params in case of OS2BMC (CVE-2025-40264 bsc#1254835). - net: openvswitch: remove never-working support for setting nsh fields (CVE-2025-40254 bsc#1254852). - net/mlx5: Fix IPsec cleanup over MPV device (CVE-2025-40238 bsc#1254871). - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (CVE-2025-40350 bsc#1255260). - commit 07231fa - drm/sysfb: Do not dereference NULL pointer in plane reset (bsc#1255095 CVE-2025-40360) - commit adae9ca - amd/amdkfd: enhance kfd process check in switch partition (CVE-2025-68174 bsc#1255327). - commit 9e3bffb - drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (CVE-2025-68190 bsc#1255131). - commit a195e39 - selftests/bpf: Test bpf_skb_check_mtu(BPF_MTU_CHK_SEGS) when transport_header is not set (CVE-2025-68363 bsc#1255552). - commit 742de98 - bpf: Check skb->transport_header is set in bpf_skb_check_mtu (CVE-2025-68363 bsc#1255552). - commit f6cdd52 - drm/amdgpu: remove two invalid BUG_ON()s (CVE-2025-68201 bsc#1255136) - commit 9a27d5e ++++ kernel-rt_debug: - sched: Increase sched_tick_remote timeout (bsc#1254510). - commit 87d4295 - drm/amdgpu: fix gpu page fault after hibernation on PF passthrough (bsc#1255134 CVE-2025-68230) - commit 19b936b - net: atlantic: fix fragment overflow handling in RX path (CVE-2025-68301 bsc#1255120). - be2net: pass wrb_params in case of OS2BMC (CVE-2025-40264 bsc#1254835). - net: openvswitch: remove never-working support for setting nsh fields (CVE-2025-40254 bsc#1254852). - net/mlx5: Fix IPsec cleanup over MPV device (CVE-2025-40238 bsc#1254871). - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (CVE-2025-40350 bsc#1255260). - commit 07231fa - drm/sysfb: Do not dereference NULL pointer in plane reset (bsc#1255095 CVE-2025-40360) - commit adae9ca - amd/amdkfd: enhance kfd process check in switch partition (CVE-2025-68174 bsc#1255327). - commit 9e3bffb - drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (CVE-2025-68190 bsc#1255131). - commit a195e39 - selftests/bpf: Test bpf_skb_check_mtu(BPF_MTU_CHK_SEGS) when transport_header is not set (CVE-2025-68363 bsc#1255552). - commit 742de98 - bpf: Check skb->transport_header is set in bpf_skb_check_mtu (CVE-2025-68363 bsc#1255552). - commit f6cdd52 - drm/amdgpu: remove two invalid BUG_ON()s (CVE-2025-68201 bsc#1255136) - commit 9a27d5e ++++ libzypp: - Avoid libcurl-mini4 when building as it does not support ftp protocol. - Translation: updated .pot file. - version 17.38.1 (35) ------------------------------------------------------------------ ------------------ 2026-1-13 - Jan 13 2026 ------------------- ------------------------------------------------------------------ ++++ avahi: - Add avahi-CVE-2025-68276.patch: Backport 0c013e2 from upstream, refuse to create wide-area record browsers when wide-area is off. (CVE-2025-68276, bsc#1256498) - Add avahi-CVE-2025-68471.patch: Backport 9c6eb53 from upstream, fix DoS bug by changing assert to return. (CVE-2025-68471, bsc#1256500) - Add avahi-CVE-2025-68468.patch: Backport f66be13 from upstream, fix DoS bug by removing incorrect assertion. (CVE-2025-68468, bsc#1256499) ++++ kernel-default: - Refresh patches.suse/cifs-after-disabling-multichannel-mark-tcon-for-reconnect.patch. - Refresh patches.suse/cifs-avoid-redundant-calls-to-disable-multichannel.patch. - Refresh patches.suse/cifs-cifs_pick_channel-should-try-selecting-active-channels.patch. - Refresh patches.suse/cifs-deal-with-the-channel-loading-lag-while-picking-channels.patch. - Refresh patches.suse/cifs-dns-resolution-is-needed-only-for-primary-channel.patch. - Refresh patches.suse/cifs-do-not-search-for-channel-if-server-is-terminating.patch. - Refresh patches.suse/cifs-fix-a-pending-undercount-of-srv_count.patch. - Refresh patches.suse/cifs-fix-lock-ordering-while-disabling-multichannel.patch. - Refresh patches.suse/cifs-fix-stray-unlock-in-cifs_chan_skip_or_disable.patch. - Refresh patches.suse/cifs-fix-use-after-free-for-iface-while-disabling-secondary-channel.patch. - Refresh patches.suse/cifs-handle-when-server-stops-supporting-multichannel.patch. - Refresh patches.suse/cifs-reconnect-worker-should-take-reference-on-server-struct-uncond.patch. - Refresh patches.suse/cifs-reset-connections-for-all-channels-when-reconnect-requested.patch. - Refresh patches.suse/cifs-reset-iface-weights-when-we-cannot-find-a-candidate.patch. - Refresh patches.suse/smb-client-fix-cifs_pick_channel-when-channel-needs-reconnect.patch. - Refresh patches.suse/smb-client-introduce-close_cached_dir_locked-.patch. - Refresh patches.suse/smb3-add-missing-null-server-pointer-check.patch. - commit 966613b - cifs: fix use after free for iface while disabling secondary channels (git-fixes). - commit dfe1d44 - cifs: reconnect worker should take reference on server struct unconditionally (git-fixes). - Refresh patches.suse/cifs-handle-servers-that-still-advertise-multichannel-after-disabli.patch. - Refresh patches.suse/smb-client-get-rid-of-nlsc-param-in-cifs_tree_connect-.patch. - commit a6f7e74 - Refresh patches.suse/cifs-make-sure-that-channel-scaling-is-done-only-once.patch. - commit f14b40c - cifs: avoid redundant calls to disable multichannel (git-fixes). - smb3: add missing null server pointer check (git-fixes). - Refresh patches.suse/cifs-make-sure-server-interfaces-are-requested-only-for-SMB3-.patch. - Refresh patches.suse/cifs-serialize-other-channels-when-query-server-interfaces-is-pendi.patch. - commit 6f71d7c - cifs: fix stray unlock in cifs_chan_skip_or_disable (git-fixes). - commit 9d297d5 - cifs: do not search for channel if server is terminating (git-fixes). - commit 1796cf0 - cifs: handle servers that still advertise multichannel after disabling (git-fixes). - cifs: serialize other channels when query server interfaces is pending (git-fixes). - Refresh patches.suse/cifs-do-not-disable-interface-polling-on-failure.patch. - Refresh patches.suse/cifs-make-sure-server-interfaces-are-requested-only-for-SMB3-.patch. - Refresh patches.suse/cifs-make-sure-that-channel-scaling-is-done-only-once.patch. - Refresh patches.suse/smb-client-get-rid-of-nlsc-param-in-cifs_tree_connect-.patch. - Refresh patches.suse/smb3-fix-for-slab-out-of-bounds-on-mount-to-ksmbd.patch. - commit e76704e - smb: client: fix cifs_pick_channel when channel needs reconnect (git-fixes). - commit 59edbd9 - cifs: cifs_pick_channel should try selecting active channels (git-fixes). - commit 3f9ba92 - ext4: use optimized mballoc scanning regardless of inode format (bsc#1254378). - commit 7e74f80 - supported.conf: Mark lan 743x supported (jsc#PED-14571) - commit c174efd - mlx5: Fix default values in create CQ (CVE-2025-68209 bsc#1255230). - commit e7dee05 - x86/microcode/AMD: Select which microcode patch to load (bsc#1256528). - Refresh patches.suse/x86-microcode-AMD-Handle-the-case-of-no-BIOS-microcode.patch. - commit dca6829 - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (bsc#1256528). - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (bsc#1256528). - x86/microcode/AMD: Add more known models to entry sign checking (bsc#1256528). - x86/microcode/AMD: Limit Entrysign signature checking to known generations (bsc#1256528). - x86/microcode: Fix Entrysign revision check for Zen1/Naples (bsc#1256528). - x86/microcode/AMD: Add TSA microcode SHAs (bsc#1256528). - x86/microcode/AMD: Use sha256() instead of init/update/final (bsc#1256528). - x86/microcode/AMD: Clean the cache if update did not load microcode (bsc#1256528). - x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (bsc#1256528). - x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (bsc#1256528). - x86/microcode/AMD: Add some forgotten models to the SHA check (bsc#1256528). - x86/microcode/AMD: Load only SHA256-checksummed patches (bsc#1256528). - commit 4e60c5e - bpf: Fix invalid prog->stats access when update_effective_progs fails (CVE-2025-68742 bsc#1255707). - commit 53d4b3c - bpf: Improve program stats run-time calculation (CVE-2025-68742 bsc#1255707). - commit 4ed738f ++++ kernel-rt: - Refresh patches.suse/cifs-after-disabling-multichannel-mark-tcon-for-reconnect.patch. - Refresh patches.suse/cifs-avoid-redundant-calls-to-disable-multichannel.patch. - Refresh patches.suse/cifs-cifs_pick_channel-should-try-selecting-active-channels.patch. - Refresh patches.suse/cifs-deal-with-the-channel-loading-lag-while-picking-channels.patch. - Refresh patches.suse/cifs-dns-resolution-is-needed-only-for-primary-channel.patch. - Refresh patches.suse/cifs-do-not-search-for-channel-if-server-is-terminating.patch. - Refresh patches.suse/cifs-fix-a-pending-undercount-of-srv_count.patch. - Refresh patches.suse/cifs-fix-lock-ordering-while-disabling-multichannel.patch. - Refresh patches.suse/cifs-fix-stray-unlock-in-cifs_chan_skip_or_disable.patch. - Refresh patches.suse/cifs-fix-use-after-free-for-iface-while-disabling-secondary-channel.patch. - Refresh patches.suse/cifs-handle-when-server-stops-supporting-multichannel.patch. - Refresh patches.suse/cifs-reconnect-worker-should-take-reference-on-server-struct-uncond.patch. - Refresh patches.suse/cifs-reset-connections-for-all-channels-when-reconnect-requested.patch. - Refresh patches.suse/cifs-reset-iface-weights-when-we-cannot-find-a-candidate.patch. - Refresh patches.suse/smb-client-fix-cifs_pick_channel-when-channel-needs-reconnect.patch. - Refresh patches.suse/smb-client-introduce-close_cached_dir_locked-.patch. - Refresh patches.suse/smb3-add-missing-null-server-pointer-check.patch. - commit 966613b - cifs: fix use after free for iface while disabling secondary channels (git-fixes). - commit dfe1d44 - cifs: reconnect worker should take reference on server struct unconditionally (git-fixes). - Refresh patches.suse/cifs-handle-servers-that-still-advertise-multichannel-after-disabli.patch. - Refresh patches.suse/smb-client-get-rid-of-nlsc-param-in-cifs_tree_connect-.patch. - commit a6f7e74 - Refresh patches.suse/cifs-make-sure-that-channel-scaling-is-done-only-once.patch. - commit f14b40c - cifs: avoid redundant calls to disable multichannel (git-fixes). - smb3: add missing null server pointer check (git-fixes). - Refresh patches.suse/cifs-make-sure-server-interfaces-are-requested-only-for-SMB3-.patch. - Refresh patches.suse/cifs-serialize-other-channels-when-query-server-interfaces-is-pendi.patch. - commit 6f71d7c - cifs: fix stray unlock in cifs_chan_skip_or_disable (git-fixes). - commit 9d297d5 - cifs: do not search for channel if server is terminating (git-fixes). - commit 1796cf0 - cifs: handle servers that still advertise multichannel after disabling (git-fixes). - cifs: serialize other channels when query server interfaces is pending (git-fixes). - Refresh patches.suse/cifs-do-not-disable-interface-polling-on-failure.patch. - Refresh patches.suse/cifs-make-sure-server-interfaces-are-requested-only-for-SMB3-.patch. - Refresh patches.suse/cifs-make-sure-that-channel-scaling-is-done-only-once.patch. - Refresh patches.suse/smb-client-get-rid-of-nlsc-param-in-cifs_tree_connect-.patch. - Refresh patches.suse/smb3-fix-for-slab-out-of-bounds-on-mount-to-ksmbd.patch. - commit e76704e - smb: client: fix cifs_pick_channel when channel needs reconnect (git-fixes). - commit 59edbd9 - cifs: cifs_pick_channel should try selecting active channels (git-fixes). - commit 3f9ba92 - ext4: use optimized mballoc scanning regardless of inode format (bsc#1254378). - commit 7e74f80 - supported.conf: Mark lan 743x supported (jsc#PED-14571) - commit c174efd - mlx5: Fix default values in create CQ (CVE-2025-68209 bsc#1255230). - commit e7dee05 - x86/microcode/AMD: Select which microcode patch to load (bsc#1256528). - Refresh patches.suse/x86-microcode-AMD-Handle-the-case-of-no-BIOS-microcode.patch. - commit dca6829 - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (bsc#1256528). - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (bsc#1256528). - x86/microcode/AMD: Add more known models to entry sign checking (bsc#1256528). - x86/microcode/AMD: Limit Entrysign signature checking to known generations (bsc#1256528). - x86/microcode: Fix Entrysign revision check for Zen1/Naples (bsc#1256528). - x86/microcode/AMD: Add TSA microcode SHAs (bsc#1256528). - x86/microcode/AMD: Use sha256() instead of init/update/final (bsc#1256528). - x86/microcode/AMD: Clean the cache if update did not load microcode (bsc#1256528). - x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (bsc#1256528). - x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (bsc#1256528). - x86/microcode/AMD: Add some forgotten models to the SHA check (bsc#1256528). - x86/microcode/AMD: Load only SHA256-checksummed patches (bsc#1256528). - commit 4e60c5e - bpf: Fix invalid prog->stats access when update_effective_progs fails (CVE-2025-68742 bsc#1255707). - commit 53d4b3c - bpf: Improve program stats run-time calculation (CVE-2025-68742 bsc#1255707). - commit 4ed738f ++++ kernel-rt_debug: - Refresh patches.suse/cifs-after-disabling-multichannel-mark-tcon-for-reconnect.patch. - Refresh patches.suse/cifs-avoid-redundant-calls-to-disable-multichannel.patch. - Refresh patches.suse/cifs-cifs_pick_channel-should-try-selecting-active-channels.patch. - Refresh patches.suse/cifs-deal-with-the-channel-loading-lag-while-picking-channels.patch. - Refresh patches.suse/cifs-dns-resolution-is-needed-only-for-primary-channel.patch. - Refresh patches.suse/cifs-do-not-search-for-channel-if-server-is-terminating.patch. - Refresh patches.suse/cifs-fix-a-pending-undercount-of-srv_count.patch. - Refresh patches.suse/cifs-fix-lock-ordering-while-disabling-multichannel.patch. - Refresh patches.suse/cifs-fix-stray-unlock-in-cifs_chan_skip_or_disable.patch. - Refresh patches.suse/cifs-fix-use-after-free-for-iface-while-disabling-secondary-channel.patch. - Refresh patches.suse/cifs-handle-when-server-stops-supporting-multichannel.patch. - Refresh patches.suse/cifs-reconnect-worker-should-take-reference-on-server-struct-uncond.patch. - Refresh patches.suse/cifs-reset-connections-for-all-channels-when-reconnect-requested.patch. - Refresh patches.suse/cifs-reset-iface-weights-when-we-cannot-find-a-candidate.patch. - Refresh patches.suse/smb-client-fix-cifs_pick_channel-when-channel-needs-reconnect.patch. - Refresh patches.suse/smb-client-introduce-close_cached_dir_locked-.patch. - Refresh patches.suse/smb3-add-missing-null-server-pointer-check.patch. - commit 966613b - cifs: fix use after free for iface while disabling secondary channels (git-fixes). - commit dfe1d44 - cifs: reconnect worker should take reference on server struct unconditionally (git-fixes). - Refresh patches.suse/cifs-handle-servers-that-still-advertise-multichannel-after-disabli.patch. - Refresh patches.suse/smb-client-get-rid-of-nlsc-param-in-cifs_tree_connect-.patch. - commit a6f7e74 - Refresh patches.suse/cifs-make-sure-that-channel-scaling-is-done-only-once.patch. - commit f14b40c - cifs: avoid redundant calls to disable multichannel (git-fixes). - smb3: add missing null server pointer check (git-fixes). - Refresh patches.suse/cifs-make-sure-server-interfaces-are-requested-only-for-SMB3-.patch. - Refresh patches.suse/cifs-serialize-other-channels-when-query-server-interfaces-is-pendi.patch. - commit 6f71d7c - cifs: fix stray unlock in cifs_chan_skip_or_disable (git-fixes). - commit 9d297d5 - cifs: do not search for channel if server is terminating (git-fixes). - commit 1796cf0 - cifs: handle servers that still advertise multichannel after disabling (git-fixes). - cifs: serialize other channels when query server interfaces is pending (git-fixes). - Refresh patches.suse/cifs-do-not-disable-interface-polling-on-failure.patch. - Refresh patches.suse/cifs-make-sure-server-interfaces-are-requested-only-for-SMB3-.patch. - Refresh patches.suse/cifs-make-sure-that-channel-scaling-is-done-only-once.patch. - Refresh patches.suse/smb-client-get-rid-of-nlsc-param-in-cifs_tree_connect-.patch. - Refresh patches.suse/smb3-fix-for-slab-out-of-bounds-on-mount-to-ksmbd.patch. - commit e76704e - smb: client: fix cifs_pick_channel when channel needs reconnect (git-fixes). - commit 59edbd9 - cifs: cifs_pick_channel should try selecting active channels (git-fixes). - commit 3f9ba92 - ext4: use optimized mballoc scanning regardless of inode format (bsc#1254378). - commit 7e74f80 - supported.conf: Mark lan 743x supported (jsc#PED-14571) - commit c174efd - mlx5: Fix default values in create CQ (CVE-2025-68209 bsc#1255230). - commit e7dee05 - x86/microcode/AMD: Select which microcode patch to load (bsc#1256528). - Refresh patches.suse/x86-microcode-AMD-Handle-the-case-of-no-BIOS-microcode.patch. - commit dca6829 - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (bsc#1256528). - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (bsc#1256528). - x86/microcode/AMD: Add more known models to entry sign checking (bsc#1256528). - x86/microcode/AMD: Limit Entrysign signature checking to known generations (bsc#1256528). - x86/microcode: Fix Entrysign revision check for Zen1/Naples (bsc#1256528). - x86/microcode/AMD: Add TSA microcode SHAs (bsc#1256528). - x86/microcode/AMD: Use sha256() instead of init/update/final (bsc#1256528). - x86/microcode/AMD: Clean the cache if update did not load microcode (bsc#1256528). - x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (bsc#1256528). - x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (bsc#1256528). - x86/microcode/AMD: Add some forgotten models to the SHA check (bsc#1256528). - x86/microcode/AMD: Load only SHA256-checksummed patches (bsc#1256528). - commit 4e60c5e - bpf: Fix invalid prog->stats access when update_effective_progs fails (CVE-2025-68742 bsc#1255707). - commit 53d4b3c - bpf: Improve program stats run-time calculation (CVE-2025-68742 bsc#1255707). - commit 4ed738f ++++ libsoup: - Add libsoup-CVE-2026-0716.patch: Fix out-of-bounds read for websocket (bsc#1256418, CVE-2026-0716, glgo#GNOME/libsoup!494). - Add libsoup-CVE-2026-0719.patch: Fix overflow for password md4sum (bsc#1256399, CVE-2026-0719, glgo#GNOME/libsoup!493). ++++ systemd: - Name libsystemd-{shared,core} based on the major version of systemd and the package release number (bsc#1228081 bsc#1256427) This way, both the old and new versions of the shared libraries will be present during the update. This should prevent issues during package updates when incompatible changes are introduced in the new versions of the shared libraries. - Import commit 8bbac1d508acb8aa4e7262f47c7f4076b8350f72 8bbac1d508 detect-virt: bare-metal GCE only for x86 and i386 (bsc#1254293) ++++ linuxptp: - Move to DevicePolicy=closed instead of -PrivateDevices=true to allow access to devices (bsc#1256059) ++++ nvidia-open-driver-G06-signed: - kernel-5.14.patch * fixes build for sle15-sp4 ++++ python-urllib3: - Add CVE-2026-21441.patch to fix excessive resource consumption during decompression of data in HTTP redirect responses (bsc#1256331, CVE-2026-21441) ------------------------------------------------------------------ ------------------ 2026-1-12 - Jan 12 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - fuse: fix livelock in synchronous file put from fuseblk workers (CVE-2025-40220 bsc#1254520). - commit 46a797f - tracing: Fix access to trace_event_file (bsc#1254373). - commit 768b257 - virtio_console: fix order of fields cols and rows (stable-fixes). - commit 0d412d7 - drm/amdgpu: Forward VMID reservation errors (git-fixes). - commit a7344a2 - pinctrl: single: Fix PIN_CONFIG_BIAS_DISABLE handling (stable-fixes). - Refresh patches.suse/pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch. - commit bc41b99 - usb: ohci-nxp: fix device leak on probe failure (git-fixes). - usb: usb-storage: Maintain minimal modifications to the bcdDevice range (git-fixes). - Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table (stable-fixes). - drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() (stable-fixes). - ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() (git-fixes). - i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured firmware (stable-fixes). - platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks (stable-fixes). - pinctrl: single: Fix incorrect type for error return variable (git-fixes). - i3c: fix refcount inconsistency in i3c_master_register (git-fixes). - staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing (stable-fixes). - staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser (stable-fixes). - USB: serial: option: move Telit 0x10c7 composition in the right place (stable-fixes). - USB: serial: option: add Telit Cinterion FE910C04 new compositions (stable-fixes). - USB: serial: option: add Foxconn T99W760 (stable-fixes). - USB: serial: ftdi_sio: match on interface number for jtag (stable-fixes). - usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive (stable-fixes). - usb: dwc2: fix hang during shutdown if set as peripheral (git-fixes). - usb: xhci: limit run_graceperiod for only usb 3.0 devices (stable-fixes). - usb: typec: ucsi: Handle incorrect num_connectors capability (stable-fixes). - usbip: Fix locking bug in RT-enabled kernels (stable-fixes). - serial: sprd: Return -EPROBE_DEFER when uart clock is not ready (stable-fixes). - serial: add support of CPCI cards (stable-fixes). - char: applicom: fix NULL pointer dereference in ac_ioctl (stable-fixes). - iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains (stable-fixes). - fbdev: gbefb: fix to use physical address instead of dma address (stable-fixes). - via_wdt: fix critical boot hang due to unnamed resource allocation (stable-fixes). - ipmi: Fix __scan_channels() failing to rescan channels (stable-fixes). - ipmi: Fix the race between __scan_channels() and deliver_response() (stable-fixes). - reset: fix BIT macro reference (stable-fixes). - firmware: imx: scu-irq: Init workqueue before request mbox channel (stable-fixes). - HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen (stable-fixes). - mmc: sdhci-msm: Avoid early clock doubling during HS400 transition (stable-fixes). - ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr (git-fixes). - media: amphion: Remove vpu_vb_is_codecconfig (git-fixes). - media: verisilicon: Fix CPU stalls on G2 bus error (git-fixes). - Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE (stable-fixes). - Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV (stable-fixes). - wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet (stable-fixes). - wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1 (stable-fixes). - ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only (stable-fixes). - ACPICA: Avoid walking the Namespace if start_node is NULL (stable-fixes). - pinctrl: qcom: msm: Fix deadlock in pinmux configuration (stable-fixes). - platform/x86: acer-wmi: Ignore backlight event (stable-fixes). - platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list (stable-fixes). - platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally (stable-fixes). - platform/x86: huawei-wmi: add keys for HONOR models (stable-fixes). - HID: elecom: Add support for ELECOM M-XT3URBK (018F) (stable-fixes). - HID: hid-input: Extend Elan ignore battery quirk to USB (stable-fixes). - HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list (stable-fixes). - drm/vmwgfx: Use kref in vmw_bo_dirty (stable-fixes). - spi: xilinx: increase number of retries before declaring stall (stable-fixes). - spi: imx: keep dma request disabled before dma transfer setup (stable-fixes). - ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series (stable-fixes). - Bluetooth: btrtl: Avoid loading the config file on security chips (stable-fixes). - media: amphion: Make some vpu_v4l2 functions static (stable-fixes). - usb: dwc2: disable platform lowlevel hw resources during shutdown (stable-fixes). - media: amphion: Add a frame flush mode for decoder (stable-fixes). - usb: ohci-nxp: Use helper function devm_clk_get_enabled() (stable-fixes). - drm/tilcdc: request and mapp iomem with devres (stable-fixes). - media: verisilicon: g2: Use common helpers to compute chroma and mv offsets (stable-fixes). - media: verisilicon: Store chroma and motion vectors offset (stable-fixes). - i3c: master: Inherit DMA masks and parameters from parent device (stable-fixes). - commit bc3be49 - supported.conf: mark ksmbd unsupported Based on discussion with Enzo Matsumiya it has tuned out that ksmbd module is unsupported but the supported.conf entry is incorrect. Fix that. - commit c800e3f - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (bsc#1253262 ltc#216029). - commit daa4104 - Update patches.suse/1260-drm-amdkfd-Add-missing-gfx11-MQD-manager-callbacks.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-54261 bsc#1255879). - Update patches.suse/ACPI-video-Fix-use-after-free-in-acpi_video_switch_b.patch (git-fixes CVE-2025-40211 bsc#1254126). - Update patches.suse/ALSA-dice-fix-buffer-overflow-in-detect_stream_forma.patch (git-fixes CVE-2025-68346 bsc#1255603). - Update patches.suse/ALSA-firewire-motu-add-bounds-check-in-put_user-loop.patch (git-fixes CVE-2025-68753 bsc#1256238). - Update patches.suse/ALSA-firewire-motu-fix-buffer-overflow-in-hwdep-read.patch (git-fixes CVE-2025-68347 bsc#1255706). - Update patches.suse/ALSA-hda-cs35l41-Fix-NULL-pointer-dereference-in-cs3-c34b04c.patch (git-fixes CVE-2025-68345 bsc#1255601). - Update patches.suse/ALSA-pcm-Fix-potential-data-race-at-PCM-memory-.patch (bsc#1012628 CVE-2023-54072 bsc#1256291). - Update patches.suse/ALSA-usb-audio-Fix-NULL-pointer-dereference-in-snd_u.patch (git-fixes CVE-2025-40275 bsc#1254829). - Update patches.suse/ALSA-usb-audio-Fix-potential-memory-leaks-at-error-p.patch (jsc#PED-6045 jsc#PED-6036 jsc#PED-6104 jsc#PED-6114 jsc#PED-6067 jsc#PED-6123 CVE-2023-54022 bsc#1255545). - Update patches.suse/ALSA-usb-audio-Fix-potential-overflow-of-PCM-transfe.patch (stable-fixes CVE-2025-40269 bsc#1255035). - Update patches.suse/ASoC-codecs-wcd-mbhc-v2-fix-resource-leaks-on-c.patch (bsc#1012628 CVE-2023-53842 bsc#1254690). - Update patches.suse/Bluetooth-6lowpan-reset-link-local-header-on-ipv6-re.patch (git-fixes CVE-2025-40282 bsc#1254850). - Update patches.suse/Bluetooth-ISO-fix-iso_conn-related-locking-and-.patch (bsc#1012628 CVE-2023-54164 bsc#1256071). - Update patches.suse/Bluetooth-MGMT-cancel-mesh-send-timer-when-hdev-remo.patch (git-fixes CVE-2025-40284 bsc#1254860). - Update patches.suse/Bluetooth-SCO-Fix-UAF-on-sco_conn_free.patch (stable-fixes CVE-2025-40309 bsc#1255065). - Update patches.suse/Bluetooth-bcsp-receive-data-only-if-registered.patch (stable-fixes CVE-2025-40308 bsc#1255064). - Update patches.suse/Bluetooth-btusb-reorder-cleanup-in-btusb_disconnect-.patch (git-fixes CVE-2025-40283 bsc#1254858). - Update patches.suse/Bluetooth-hci_conn-return-ERR_PTR-instead-of-NU.patch (bsc#1012628 CVE-2023-54038 bsc#1255540). - Update patches.suse/Bluetooth-hci_event-validate-skb-length-for-unknown-.patch (git-fixes CVE-2025-40301 bsc#1255193). - Update patches.suse/Bluetooth-hci_sock-Prevent-race-in-socket-write-iter.patch (git-fixes CVE-2025-68305 bsc#1255169). - Update patches.suse/Bluetooth-hci_sync-Avoid-use-after-free-in-dbg-.patch (bsc#1012628 CVE-2023-54210 bsc#1255955). - Update patches.suse/Bluetooth-hci_sync-Avoid-use-after-free-in-dbg-for-h.patch (git-fixes CVE-2023-53828 bsc#1254623). - Update patches.suse/Bluetooth-hci_sync-Fix-UAF-in-hci_disconnect_all_syn.patch (git-fixes CVE-2023-53762 bsc#1254606). - Update patches.suse/Bluetooth-hci_sync-fix-race-in-hci_cmd_sync_dequeue_.patch (git-fixes CVE-2025-40318 bsc#1254798). - Update patches.suse/FS-JFS-Check-for-read-only-mounted-filesystem-i.patch (bsc#1012628 CVE-2023-53766 bsc#1255005). - Update patches.suse/HID-hidraw-fix-data-race-on-device-refcount.patch (bsc#1012628 CVE-2023-53759 bsc#1254663). - Update patches.suse/HID-uclogic-Correct-devm-device-reference-for-hidinp.patch (git-fixes CVE-2023-54207 bsc#1255961). - Update patches.suse/HID-wacom-Use-ktime_t-rather-than-int-when-deal.patch (bsc#1012628 CVE-2023-53797 bsc#1254733). - Update patches.suse/Input-cros_ec_keyb-fix-an-invalid-memory-access.patch (stable-fixes CVE-2025-40263 bsc#1255077). - Update patches.suse/Input-imx_sc_key-fix-memory-corruption-on-unload.patch (git-fixes CVE-2025-40262 bsc#1254840). - Update patches.suse/Input-pegasus-notetaker-fix-potential-out-of-bounds-.patch (git-fixes CVE-2025-68217 bsc#1255221). - Update patches.suse/KVM-SVM-Get-source-vCPUs-from-source-VM-for-SEV-ES-i.patch (git-fixes CVE-2023-54296 bsc#1255793). - Update patches.suse/KVM-s390-pv-fix-index-value-of-replaced-ASCE.patch (bsc#1012628 CVE-2023-54092 bsc#1256370). - Update patches.suse/MIPS-KVM-Fix-NULL-pointer-dereference.patch (bsc#1012628 CVE-2023-54241 bsc#1255838). - Update patches.suse/NFSD-Fix-crash-in-nfsd4_read_release.patch (git-fixes CVE-2025-40324 bsc#1254791). - Update patches.suse/NFSD-free-copynotify-stateid-in-nfs4_free_ol_stateid.patch (git-fixes CVE-2025-40273 bsc#1254828). - Update patches.suse/PCI-DOE-Fix-destroy_work_on_stack-race.patch (git-fixes CVE-2023-54235 bsc#1255921). - Update patches.suse/PCI-Free-released-resource-after-coalescing.patch (git-fixes CVE-2023-53743 bsc#1254782). - Update patches.suse/PCI-IOV-Add-PCI-rescan-remove-locking-when-enabling-.patch (git-fixes CVE-2025-40219 bsc#1254518). - Update patches.suse/PCI-cadence-Check-for-the-existence-of-cdns_pcie-ops.patch (stable-fixes CVE-2025-68176 bsc#1255329). - Update patches.suse/RDMA-bnxt_re-Prevent-handling-any-completions-a.patch (bsc#1012628 CVE-2023-54048 bsc#1256395). - Update patches.suse/RDMA-efa-Fix-wrong-resources-deallocation-order.patch (git-fixes CVE-2023-54201 bsc#1255964). - Update patches.suse/RDMA-irdma-Fix-data-race-on-CQP-completion-stat.patch (bsc#1012628 CVE-2023-54302 bsc#1255792). - Update patches.suse/RDMA-irdma-Fix-data-race-on-CQP-request-done.patch (bsc#1012628 CVE-2023-54292 bsc#1255800). - Update patches.suse/Revert-IB-isert-Fix-incorrect-release-of-isert-conne.patch (git-fixes CVE-2023-54219 bsc#1256231). - Update patches.suse/accel-habanalabs-support-mapping-cb-with-vmalloc-bac.patch (stable-fixes CVE-2025-40311 bsc#1255068). - Update patches.suse/accel-qaic-Clean-up-integer-overflow-checking-.patch (bsc#1012628 CVE-2023-53778 bsc#1254761). - Update patches.suse/af_unix-Fix-data-race-around-unix_tot_inflight.patch (git-fixes CVE-2023-54006 bsc#1255591). - Update patches.suse/amba-bus-fix-refcount-leak.patch (git-fixes CVE-2023-54230 bsc#1255925). - Update patches.suse/amd-amdkfd-resolve-a-race-in-amdgpu_amdkfd_device_fi.patch (stable-fixes CVE-2025-40310 bsc#1255041). - Update patches.suse/amdgpu-validate-offset_in_bo-of-drm_amdgpu_gem_.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-53819 bsc#1254712). - Update patches.suse/arm64-mm-fix-VA-range-sanity-check.patch (bsc#1012628 CVE-2023-53989 bsc#1256302). - Update patches.suse/arm64-set-__exception_irq_entry-with-__irq_entr.patch (bsc#1012628 CVE-2023-54322 bsc#1255763). - Update patches.suse/atm-fore200e-Fix-possible-data-race-in-fore200e_open.patch (git-fixes CVE-2025-68339 bsc#1255505). - Update patches.suse/audit-fix-possible-soft-lockup-in-__audit_inode_chil.patch (git-fixes CVE-2023-54045 bsc#1256285). - Update patches.suse/autofs-fix-memory-leak-of-waitqueues-in-autofs_catat.patch (git-fixes CVE-2023-54134 bsc#1256106). - Update patches.suse/backlight-led-bl-Add-devlink-to-supplier-LEDs.patch (git-fixes CVE-2025-68758 bsc#1255944). - Update patches.suse/bcache-fixup-btree_cache_wait-list-damage.patch (bsc#1012628 CVE-2023-54293 bsc#1255801). - Update patches.suse/binder-fix-memory-leak-in-binder_init.patch (bsc#1012628 CVE-2023-54005 bsc#1255629). - Update patches.suse/blk-cgroup-Fix-NULL-deref-caused-by-blkg_policy_data-being-installed-before-init.patch (bsc#1216062 CVE-2023-54271 bsc#1255902). - Update patches.suse/blk-cgroup-hold-queue_lock-when-removing-blkg-.patch (bsc#1012628 CVE-2023-54088 bsc#1256263). - Update patches.suse/blk-mq-fix-tags-leak-when-shrink-nr_hw_queues.patch (bsc#1216436 CVE-2023-54227 bsc#1255952). - Update patches.suse/block-fix-blktrace-debugfs-entries-leakage.patch (bsc#1012628 CVE-2023-54209 bsc#1255963). - Update patches.suse/block-rq_qos-protect-rq_qos-apis-with-a-new-loc.patch (bsc#1012628 CVE-2023-53823 bsc#1254691). - Update patches.suse/bpf-Address-KCSAN-report-on-bpf_lru_list.patch (bsc#1012628 CVE-2023-54283 bsc#1255809). - Update patches.suse/bpf-Disable-preemption-in-bpf_event_output.patch (bsc#1012628 CVE-2023-54173 bsc#1255996). - Update patches.suse/bpf-Disable-preemption-in-bpf_perf_event_outpu.patch (bsc#1012628 CVE-2023-54303 bsc#1255785). - Update patches.suse/bpf-Fix-issue-in-verifying-allow_ptr_leaks.patch (jsc#PED-6811 CVE-2023-54181 bsc#1255988). - Update patches.suse/bpf-Silence-a-warning-in-btf_type_id_size.patch (bsc#1012628 CVE-2023-54247 bsc#1255892). - Update patches.suse/bpf-bpf_sk_storage-Fix-invalid-wait-context-lockdep-.patch (jsc#PED-6811 CVE-2023-53857 bsc#1254648). - Update patches.suse/bpf-drop-unnecessary-user-triggerable-WARN_ONCE.patch (bsc#1012628 CVE-2023-54145 bsc#1256090). - Update patches.suse/bpf-sockmap-Fix-skb-refcnt-race-after-locking-change.patch (jsc#PED-6811 CVE-2023-53836 bsc#1254693). - Update patches.suse/btrfs-fix-incorrect-splitting-in-btrfs_drop_ex.patch (bsc#1012628 CVE-2023-54121 bsc#1256267). - Update patches.suse/btrfs-fix-lockdep-splat-and-potential-deadlock-after.patch (git-fixes CVE-2023-54224 bsc#1255951). - Update patches.suse/btrfs-fix-race-between-balance-and-cancel-pause.patch (bsc#1012628 CVE-2023-54023 bsc#1256301). - Update patches.suse/btrfs-fix-race-when-deleting-free-space-root-fr.patch (bsc#1012628 CVE-2023-54067 bsc#1256369). - Update patches.suse/btrfs-fix-race-when-deleting-quota-root-from-th.patch (bsc#1012628 CVE-2023-54032 bsc#1255617). - Update patches.suse/btrfs-fix-warning-when-putting-transaction-with.patch (bsc#1012628 CVE-2023-53865 bsc#1254762). - Update patches.suse/btrfs-release-path-before-inode-lookup-during-the-in.patch (git-fixes CVE-2023-54281 bsc#1255820). - Update patches.suse/btrfs-remove-BUG_ON-s-in-add_new_free_space.patch (bsc#1012628 CVE-2023-54185 bsc#1255984). - Update patches.suse/btrfs-set-page-extent-mapped-after-read_folio-in-rel.patch (git-fixes CVE-2023-54253 bsc#1255891). - Update patches.suse/btrfs-zoned-fix-memory-leak-after-finding-block.patch (bsc#1012628 CVE-2023-54297 bsc#1255795). - Update patches.suse/btrfs-zoned-skip-splitting-and-logical-rewriting-on-.patch (bsc#1223731 CVE-2024-26944 CVE-2023-54080 bsc#1256367). - Update patches.suse/can-gs_usb-gs_usb_xmit_callback-fix-handling-of-fail.patch (git-fixes CVE-2025-68307 bsc#1255146). - Update patches.suse/can-kvaser_usb-leaf-Fix-potential-infinite-loop-in-c.patch (git-fixes CVE-2025-68308 bsc#1255149). - Update patches.suse/cifs-fix-potential-oops-in-cifs_oplock_break.patch (bsc#1012628 CVE-2023-54258 bsc#1255886). - Update patches.suse/cifs-fix-session-state-check-in-reconnect-to-a.patch (bsc#1012628 CVE-2023-53794 bsc#1255163). - Update patches.suse/clk-clocking-wizard-Fix-Oops-in-clk_wzrd_regist.patch (bsc#1012628 CVE-2023-53807 bsc#1254724). - Update patches.suse/clk-imx93-fix-memory-leak-and-missing-unwind-go.patch (bsc#1012628 CVE-2023-54221 bsc#1255842). - Update patches.suse/comedi-c6xdigio-Fix-invalid-PNP-driver-unregistratio.patch (git-fixes CVE-2025-68332 bsc#1255483). - Update patches.suse/comedi-check-device-s-attached-status-in-compat-ioct.patch (git-fixes CVE-2025-68257 bsc#1255167). - Update patches.suse/comedi-multiq3-sanitize-config-options-in-multiq3_at.patch (git-fixes CVE-2025-68258 bsc#1255182). - Update patches.suse/comedi-pcl818-fix-null-ptr-deref-in-pcl818_ai_cancel.patch (git-fixes CVE-2025-68335 bsc#1255480). - Update patches.suse/crypto-api-Use-work-queue-in-crypto_destroy_instance.patch (git-fixes CVE-2023-53799 bsc#1254732). - Update patches.suse/crypto-aspeed-fix-double-free-caused-by-devm.patch (git-fixes CVE-2025-68172 bsc#1255253). - Update patches.suse/crypto-asymmetric_keys-prevent-overflow-in-asymmetri.patch (git-fixes CVE-2025-68724 bsc#1255550). - Update patches.suse/dccp-Fix-out-of-bounds-access-in-DCCP-error-handler.patch (bsc#1220419 CVE-2023-53782 bsc#1254758). - Update patches.suse/dccp-fix-data-race-around-dp-dccps_mss_cache.patch (bsc#1012628 CVE-2023-53839 bsc#1254655). - Update patches.suse/devlink-report-devlink_port_type_warn-source-de.patch (bsc#1012628 CVE-2023-53841 bsc#1255009). - Update patches.suse/dm-don-t-attempt-to-queue-IO-under-RCU-protection-a9ce.patch (jsc#PED-7514 CVE-2023-53860 bsc#1254626). - Update patches.suse/dm-fix-a-race-condition-in-retrieve_deps-f600.patch (jsc#PED-7514 CVE-2023-54324 bsc#1255759). - Update patches.suse/driver-soc-xilinx-use-_safe-loop-iterator-to-av.patch (bsc#1012628 CVE-2023-54101 bsc#1256153). - Update patches.suse/drm-amd-display-Check-NULL-before-accessing.patch (stable-fixes CVE-2025-68286 bsc#1255351). - Update patches.suse/drm-amd-display-Fix-NULL-deref-in-debugfs-odm_combin.patch (git-fixes CVE-2025-68180 bsc#1255252). - Update patches.suse/drm-amdgpu-Fix-NULL-pointer-dereference-in-VRAM-logi.patch (stable-fixes CVE-2025-40288 bsc#1255057). - Update patches.suse/drm-bridge-dw_hdmi-fix-connector-access-for-scd.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-53784 bsc#1254765). - Update patches.suse/drm-client-Fix-memory-leak-in-drm_client_target.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-54091 bsc#1256274). - Update patches.suse/drm-i915-Avoid-lock-inversion-when-pinning-to-GGTT-o.patch (git-fixes CVE-2025-68244 bsc#1255190). - Update patches.suse/drm-mediatek-Fix-device-use-after-free-on-unbind.patch (git-fixes CVE-2025-40316 bsc#1254797). - Update patches.suse/drm-msm-dp-Drop-aux-devices-together-with-DP-co.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-53851 bsc#1254695). - Update patches.suse/drm-mxsfb-Disable-overlay-plane-in-mxsfb_plane_overl.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-53864 bsc#1254754). - Update patches.suse/drm-nouveau-kms-nv50-init-hpd_irq_lock-for-PIOR.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-54263 bsc#1255883). - Update patches.suse/drm-sched-Fix-deadlock-in-drm_sched_entity_kill_jobs.patch (git-fixes CVE-2025-40329 bsc#1254621). - Update patches.suse/drm-tegra-Add-call-to-put_pid.patch (git-fixes CVE-2025-68233 bsc#1255206). - Update patches.suse/drm-ttm-Don-t-leak-a-resource-on-eviction-error.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-54254 bsc#1255890). - Update patches.suse/drm-ttm-Don-t-leak-a-resource-on-swapout-move-e.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-53844 bsc#1254649). - Update patches.suse/drm-vgem-fence-Fix-potential-deadlock-on-release.patch (git-fixes CVE-2025-68757 bsc#1255943). - Update patches.suse/drm-vmwgfx-Validate-command-header-size-against-SVGA.patch (git-fixes CVE-2025-40277 bsc#1254894). - Update patches.suse/erofs-kill-hooked-chains-to-avoid-loops-on-dedu.patch (bsc#1012628 CVE-2023-53777 bsc#1254749). - Update patches.suse/exfat-use-kvmalloc_array-kvfree-instead-of-kma.patch (bsc#1012628 CVE-2023-54194 bsc#1255974). - Update patches.suse/ext4-correct-grp-validation-in-ext4_mb_good_group.patch (bsc#1234163 CVE-2023-53861 bsc#1254678). - Update patches.suse/ext4-fix-BUG-in-ext4_mb_new_inode_pa-due-to-overflow.patch (bsc#1219165 CVE-2023-54069 bsc#1256371). - Update patches.suse/ext4-fix-rbtree-traversal-bug-in-ext4_mb_use_pr.patch (bsc#1012628 CVE-2023-53813 bsc#1254717). - Update patches.suse/ext4-turn-quotas-off-if-mount-failed-after-enab.patch (bsc#1012628 CVE-2023-54153 bsc#1256081). - Update patches.suse/f2fs-fix-to-do-sanity-check-on-direct-node-in-.patch (bsc#1012628 CVE-2023-53846 bsc#1254983). - Update patches.suse/fbcon-Set-fb_display-i-mode-to-NULL-when-the-mode-is.patch (stable-fixes CVE-2025-40323 bsc#1255094). - Update patches.suse/fbdev-Add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch (stable-fixes CVE-2025-40304 bsc#1255034). - Update patches.suse/fbdev-bitblit-bound-check-glyph-index-in-bit_putcs.patch (stable-fixes CVE-2025-40322 bsc#1255092). - Update patches.suse/firmware-meson_sm-fix-to-avoid-potential-NULL-pointe.patch (git-fixes CVE-2023-54304 bsc#1255786). - Update patches.suse/firmware-stratix10-svc-fix-bug-in-saving-controller-.patch (git-fixes CVE-2025-68328 bsc#1255489). - Update patches.suse/fs-Protect-reconfiguration-of-sb-read-write-fr.patch (bsc#1012628 CVE-2023-54099 bsc#1256197). - Update patches.suse/fs-jfs-prevent-double-free-in-dbUnmount-after-failed-jfs_remount.patch (git-fixes CVE-2023-54127 bsc#1256119). - Update patches.suse/fs-ntfs3-Return-error-for-inconsistent-extende.patch (bsc#1012628 CVE-2023-54125 bsc#1256117). - Update patches.suse/fs-sysv-Null-check-to-prevent-null-ptr-deref-b.patch (bsc#1012628 CVE-2023-54264 bsc#1255872). - Update patches.suse/gpu-host1x-Fix-race-in-syncpt-alloc-free.patch (git-fixes CVE-2025-68732 bsc#1255688). - Update patches.suse/gtp-Fix-use-after-free-in-__gtp_encap_destroy.patch (bsc#1012628 CVE-2023-54142 bsc#1256095). - Update patches.suse/hfs-validate-record-offset-in-hfsplus_bmap_alloc.patch (git-fixes CVE-2025-40349 bsc#1255280). - Update patches.suse/hfsplus-fix-KMSAN-uninit-value-issue-in-__hfsplus_ext_cache_extent.patch (git-fixes CVE-2025-40244 bsc#1255033). - Update patches.suse/hfsplus-fix-KMSAN-uninit-value-issue-in-hfsplus_delete_cat.patch (git-fixes CVE-2025-40351 bsc#1255281). - Update patches.suse/hwrng-virtio-Fix-race-on-data_avail-and-actual-.patch (bsc#1012628 CVE-2023-53998 bsc#1255578). - Update patches.suse/iavf-use-internal-state-to-free-traffic-IRQs.patch (bsc#1012628 CVE-2023-53850 bsc#1254677). - Update patches.suse/ice-prevent-NULL-pointer-deref-during-reload.patch (bsc#1012628 CVE-2023-54037 bsc#1255557). - Update patches.suse/igb-clean-up-in-all-error-paths-when-enabling-SR-IOV.patch (jsc#PED-4866 CVE-2023-54070 bsc#1256364). - Update patches.suse/igc-Fix-Kernel-Panic-during-ndo_tx_timeout-call.patch (bsc#1012628 CVE-2023-54166 bsc#1256074). - Update patches.suse/iio-accel-bmc150-Fix-irq-assumption-regression.patch (stable-fixes CVE-2025-68330 bsc#1255493). - Update patches.suse/iio-adc-ina2xx-avoid-NULL-pointer-dereference-.patch (bsc#1012628 CVE-2023-53834 bsc#1254660). - Update patches.suse/iio-core-Prevent-invalid-memory-access-when-th.patch (bsc#1012628 CVE-2023-54027 bsc#1255579). - Update patches.suse/ima-Handle-error-code-returned-by-ima_filter_rule_ma.patch (git-fixes CVE-2025-68740 bsc#1255812). - Update patches.suse/ima-don-t-clear-IMA_DIGSIG-flag-when-setting-or-remo.patch (stable-fixes CVE-2025-68183 bsc#1255251). - Update patches.suse/io_uring-net-don-t-overflow-multishot-recv.patch (bsc#1215211 CVE-2023-54030 bsc#1255691). - Update patches.suse/iomap-Fix-possible-overflow-condition-in-iomap_write_delalloc_scan.patch (jsc#PED-5453 CVE-2023-54285 bsc#1255807). - Update patches.suse/iommufd-IOMMUFD_DESTROY-should-not-increase-the.patch (bsc#1012628 CVE-2023-53795 bsc#1254737). - Update patches.suse/iommufd-Set-end-correctly-when-doing-batch-carr.patch (bsc#1012628 CVE-2023-54060 bsc#1256379). - Update patches.suse/ionic-remove-WARN_ON-to-prevent-panic_on_warn.patch (bsc#1012628 CVE-2023-53994 bsc#1255570). - Update patches.suse/ip6_vti-fix-slab-use-after-free-in-decode_sess.patch (bsc#1012628 CVE-2023-53821 bsc#1254669). - Update patches.suse/ipmi-ssif-Fix-a-memory-leak-when-scanning-for-an-ada.patch (git-fixes CVE-2023-54064 bsc#1256375). - Update patches.suse/irqchip-mchp-eic-Fix-error-code-in-mchp_eic_domain_a.patch (git-fixes CVE-2025-68766 bsc#1255932). - Update patches.suse/isdn-mISDN-hfcsusb-fix-memory-leak-in-hfcsusb_probe.patch (git-fixes CVE-2025-68734 bsc#1255538). - Update patches.suse/jfs-Verify-inode-mode-when-loading-from-disk.patch (git-fixes CVE-2025-40312 bsc#1255046). - Update patches.suse/jfs-fix-uninitialized-waitqueue-in-transaction-manager.patch (git-fixes CVE-2025-68168 bsc#1255100). - Update patches.suse/kcm-Fix-error-handling-for-SOCK_DGRAM-in-kcm_sendmsg.patch (bsc#1220419 CVE-2023-53825 bsc#1254707). - Update patches.suse/kcm-Fix-memory-leak-in-error-path-of-kcm_sendmsg.patch (bsc#1220419 CVE-2023-54112 bsc#1256354). - Update patches.suse/keys-Fix-linking-a-duplicate-key-to-a-keyring-s.patch (bsc#1012628 CVE-2023-54170 bsc#1256045). - Update patches.suse/maple_tree-fix-potential-out-of-bounds-access-i.patch (bsc#1012628 CVE-2023-54135 bsc#1256107). - Update patches.suse/md-fix-warning-for-holder-mismatch-from-export_rdev.patch (git-fixes CVE-2023-53791 bsc#1254742). - Update patches.suse/md-raid5-cache-fix-a-deadlock-in-r5l_exit_log-a705.patch (jsc#PED-7542 CVE-2023-53848 bsc#1254753). - Update patches.suse/media-af9005-Fix-null-ptr-deref-in-af9005_i2c_xfer.patch (git-fixes CVE-2023-54314 bsc#1255776). - Update patches.suse/media-anysee-fix-null-ptr-deref-in-anysee_master_xfe.patch (git-fixes CVE-2023-54093 bsc#1256273). - Update patches.suse/media-dvb-usb-m920x-Fix-a-potential-memory-leak-in-m.patch (git-fixes CVE-2023-54266 bsc#1255875). - Update patches.suse/media-dvb-usb-v2-gl861-Fix-null-ptr-deref-in-gl861_i.patch (git-fixes CVE-2023-54066 bsc#1256373). - Update patches.suse/media-imon-make-send_packet-more-robust.patch (stable-fixes CVE-2025-68194 bsc#1255325). - Update patches.suse/media-mediatek-vcodec-fix-resource-leaks-in-vdec_msg.patch (git-fixes CVE-2023-54143 bsc#1256096). - Update patches.suse/media-tuners-qt1010-replace-BUG_ON-with-a-regular-er.patch (git-fixes CVE-2023-54282 bsc#1255810). - Update patches.suse/media-v4l2-core-Fix-a-potential-resource-leak-in-v4l.patch (git-fixes CVE-2023-54183 bsc#1255990). - Update patches.suse/misc-fastrpc-Fix-dma_buf-object-leak-in-fastrpc_map_.patch (git-fixes CVE-2025-68252 bsc#1255197). - Update patches.suse/misc-pci_endpoint_test-Free-IRQs-before-removin.patch (bsc#1012628 CVE-2023-54326 bsc#1255758). - Update patches.suse/mm-secretmem-fix-use-after-free-race-in-fault-handle.patch (git-fixes CVE-2025-40272 bsc#1254832). - Update patches.suse/mmc-sunplus-fix-return-value-check-of-mmc_add_.patch (bsc#1012628 CVE-2023-54204 bsc#1255967). - Update patches.suse/most-usb-Fix-use-after-free-in-hdm_disconnect.patch (git-fixes CVE-2025-40223 bsc#1254957). - Update patches.suse/most-usb-fix-double-free-on-late-probe-failure.patch (git-fixes CVE-2025-68290 bsc#1255154). - Update patches.suse/most-usb-hdm_probe-Fix-calling-put_device-before-dev.patch (git-fixes CVE-2025-68249 bsc#1255233). - Update patches.suse/mt76-mt7615-Fix-memory-leak-in-mt7615_mcu_wtbl_sta_a.patch (git-fixes CVE-2025-68765 bsc#1255931). - Update patches.suse/mt76-mt7921-don-t-assume-adequate-headroom-for-SDIO-.patch (git-fixes CVE-2023-53785 bsc#1254918). - Update patches.suse/mtd-rawnand-cadence-fix-DMA-device-NULL-pointer-dere.patch (git-fixes CVE-2025-68238 bsc#1255202). - Update patches.suse/mtd-rawnand-fsl_upm-Fix-an-off-by-one-test-in-.patch (bsc#1012628 CVE-2023-54104 bsc#1256145). - Update patches.suse/mtdchar-fix-integer-overflow-in-read-write-ioctls.patch (git-fixes CVE-2025-68237 bsc#1255203). - Update patches.suse/net-core-remove-unnecessary-frame_sz-check-in-.patch (bsc#1012628 CVE-2023-54155 bsc#1256083). - Update patches.suse/net-deal-with-integer-overflows-in-kmalloc_reserve.patch (bsc#1215146 CVE-2023-42752 CVE-2023-53752 bsc#1254613). - Update patches.suse/net-do-not-allow-gso_size-to-be-set-to-GSO_BY_.patch (bsc#1012628 CVE-2023-54051 bsc#1256394). - Update patches.suse/net-dsa-avoid-suspicious-RCU-usage-for-synced-V.patch (bsc#1012628 CVE-2023-54149 bsc#1256085). - Update patches.suse/net-dsa-ocelot-call-dsa_tag_8021q_unregister-u.patch (bsc#1012628 CVE-2023-53855 bsc#1254688). - Update patches.suse/net-ethernet-mtk_eth_soc-fix-possible-NULL-pointer-d.patch (git-fixes CVE-2023-54240 bsc#1255918). - Update patches.suse/net-hns3-fix-deadlock-issue-when-externel_lb-a.patch (bsc#1012628 CVE-2023-54000 bsc#1255564). - Update patches.suse/net-ipa-only-reset-hashed-tables-when-supported.patch (bsc#1012628 CVE-2023-54225 bsc#1256234). - Update patches.suse/net-ipv4-fix-one-memleak-in-__inet_del_ifa.patch (bsc#1220419 CVE-2023-53995 bsc#1255616). - Update patches.suse/net-mlx5-fix-potential-memory-leak-in-mlx5e_in.patch (bsc#1012628 CVE-2023-54106 bsc#1256358). - Update patches.suse/net-mlx5e-Move-representor-neigh-cleanup-to-pr.patch (bsc#1012628 CVE-2023-54148 bsc#1256084). - Update patches.suse/net-mlx5e-TC-Fix-internal-port-memory-leak.patch (bsc#1012628 CVE-2023-53999 bsc#1255621). - Update patches.suse/net-mlx5e-fix-memory-leak-in-mlx5e_ptp_open.patch (bsc#1012628 CVE-2023-54169 bsc#1256050). - Update patches.suse/net-mlx5e-xsk-Fix-invalid-buffer-access-for-le.patch (bsc#1012628 CVE-2023-54223 bsc#1256233). - Update patches.suse/net-openvswitch-reject-negative-ifindex.patch (bsc#1012628 CVE-2023-53843 bsc#1254705). - Update patches.suse/net-prevent-skb-corruption-on-frag-list-segment.patch (bsc#1012628 CVE-2023-54094 bsc#1256292). - Update patches.suse/net-read-sk-sk_family-once-in-sk_mc_loop.patch (bsc#1220419 CVE-2023-53831 bsc#1254701). - Update patches.suse/net-sched-taprio-Limit-TCA_TAPRIO_ATTR_SCHED_C.patch (bsc#1012628 CVE-2023-54251 bsc#1255888). - Update patches.suse/net-smc-use-smc_lgr_list.lock-to-protect-smc_lgr_lis.patch (git-fixes CVE-2023-54318 bsc#1255772). - Update patches.suse/net-usb-qmi_wwan-initialize-MAC-header-offset-in-qmi.patch (git-fixes CVE-2025-68192 bsc#1255246). - Update patches.suse/netfilter-nf_tables-fix-underflow-in-chain-refe.patch (bsc#1012628 CVE-2023-54035 bsc#1255563). - Update patches.suse/netlink-do-not-hard-code-device-address-lenth-i.patch (bsc#1012628 CVE-2023-53863 bsc#1254657). - Update patches.suse/nfp-clean-mc-addresses-in-application-firmware-.patch (bsc#1012628 CVE-2023-54133 bsc#1256104). - Update patches.suse/nfs4_setup_readdir-insufficient-locking-for-d_parent-d_inode-dereferencing.patch (git-fixes CVE-2025-68185 bsc#1255135). - Update patches.suse/nfsd-move-init-of-percpu-reply_cache_stats-coun.patch (bsc#1012628 CVE-2023-54276 bsc#1255907). - Update patches.suse/nilfs2-fix-WARNING-in-mark_buffer_dirty-due-to.patch (bsc#1012628 CVE-2023-54140 bsc#1256093). - Update patches.suse/nouveau-firmware-Add-missing-kfree-of-nvkm_falcon_fw.patch (git-fixes CVE-2025-68235 bsc#1255209). - Update patches.suse/nvme-core-fix-memory-leak-in-dhchap_ctrl_secret.patch (bsc#1012628 CVE-2023-53792 bsc#1254743). - Update patches.suse/nvme-core-fix-memory-leak-in-dhchap_secret_stor.patch (bsc#1012628 CVE-2023-53852 bsc#1254653). - Update patches.suse/nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch (bsc#1245193 bsc#1247500 CVE-2025-40342 bsc#1255274). - Update patches.suse/nvme-multipath-fix-lockdep-WARN-due-to-partition-sca.patch (git-fixes bsc#1233640 CVE-2024-53093 CVE-2025-68218 bsc#1255245). - Update patches.suse/nvmet-fc-avoid-scheduling-association-deletion-twice.patch (bsc#1245193 bsc#1247500 CVE-2025-40343 bsc#1255276). - Update patches.suse/of-overlay-Call-of_changeset_init-early.patch (git-fixes CVE-2023-53856 bsc#1254661). - Update patches.suse/of-unittest-fix-null-pointer-dereferencing-in-of_uni.patch (git-fixes CVE-2023-54178 bsc#1255992). - Update patches.suse/opp-Fix-use-after-free-in-lazy_opp_tables-after.patch (bsc#1012628 CVE-2023-54026 bsc#1255549). - Update patches.suse/orangefs-fix-xattr-related-buffer-overflow.patch (git-fixes CVE-2025-40306 bsc#1255062). - Update patches.suse/ovl-fix-null-pointer-dereference-in-ovl_get_acl.patch (bsc#1012628 CVE-2023-54313 bsc#1255775). - Update patches.suse/pcmcia-rsrc_nonstatic-Fix-memory-leak-in-nonst.patch (bsc#1012628 CVE-2023-54115 bsc#1256121). - Update patches.suse/perf-tool-x86-Fix-perf_env-memory-leak.patch (bsc#1012628 CVE-2023-53793 bsc#1254739). - Update patches.suse/phy-tegra-xusb-Clear-the-driver-reference-in-us.patch (bsc#1012628 CVE-2023-54083 bsc#1256368). - Update patches.suse/pinctrl-at91-pio4-check-return-value-of-devm_ka.patch (bsc#1012628 CVE-2023-54319 bsc#1255760). - Update patches.suse/pinctrl-freescale-Fix-a-memory-out-of-bounds-wh.patch (bsc#1012628 CVE-2023-53750 bsc#1254611). - Update patches.suse/pinctrl-s32cc-fix-uninitialized-memory-in-s32_pinctr.patch (git-fixes CVE-2025-68222 bsc#1255218). - Update patches.suse/platform-x86-intel-punit_ipc-fix-memory-corruption.patch (git-fixes CVE-2025-68303 bsc#1255122). - Update patches.suse/posix-timers-Prevent-RT-livelock-in-itimer_dele.patch (bsc#1012628 CVE-2023-53815 bsc#1254715). - Update patches.suse/powerpc-64s-Fix-VAS-mm-use-after-free.patch (bsc#1012628 CVE-2023-54042 bsc#1255702). - Update patches.suse/powerpc-iommu-Fix-notifiers-being-shared-by-PCI-and-.patch (bsc#1065729 CVE-2023-54095 bsc#1256271). - Update patches.suse/powerpc-powernv-sriov-perform-null-check-on-iov.patch (bsc#1012628 CVE-2023-54315 bsc#1255769). - Update patches.suse/powerpc-pseries-Rework-lppaca_shared_proc-to-avoid-D.patch (bsc#1194869 CVE-2023-54267 bsc#1255899). - Update patches.suse/powerpc-pseries-fix-possible-memory-leak-in-ibmebus_.patch (bsc#1194869 CVE-2023-54017 bsc#1255605). - Update patches.suse/pstore-ram-Add-check-for-kstrdup.patch (bsc#1012628 CVE-2023-54189 bsc#1255978). - Update patches.suse/quota-fix-warning-in-dqgrab.patch (bsc#1012628 CVE-2023-54177 bsc#1255993). - Update patches.suse/rcu-dump-vmalloc-memory-info-safely.patch (git-fixes CVE-2023-54113 bsc#1256351). - Update patches.suse/rcuscale-Move-rcu_scale_writer-schedule_timeout_unin.patch (git-fixes CVE-2023-54246 bsc#1255915). - Update patches.suse/refscale-Fix-uninitalized-use-of-wait_queue_head_t.patch (git-fixes CVE-2023-54316 bsc#1255770). - Update patches.suse/regmap-irq-Fix-out-of-bounds-access-when-alloca.patch (bsc#1012628 CVE-2023-53768 bsc#1254599). - Update patches.suse/regmap-slimbus-fix-bus_context-pointer-in-regmap-ini.patch (git-fixes CVE-2025-40317 bsc#1254796). - Update patches.suse/regulator-core-Protect-regulator_supply_alias_list-w.patch (git-fixes CVE-2025-68354 bsc#1255553). - Update patches.suse/regulator-da9063-fix-null-pointer-deref-with-pa.patch (bsc#1012628 CVE-2023-53787 bsc#1254750). - Update patches.suse/rpmsg-glink-Add-check-for-kstrdup.patch (git-fixes CVE-2023-54049 bsc#1256396). - Update patches.suse/s390-dcssblk-fix-kernel-crash-with-list_add-corruption.patch (git-fixes bsc#1215344 CVE-2023-54117 bsc#1256348). - Update patches.suse/s390-vmem-split-pages-when-debug-pagealloc-is-.patch (bsc#1012628 CVE-2023-54278 bsc#1255911). - Update patches.suse/samples-bpf-Fix-buffer-overflow-in-tcp_basertt.patch (bsc#1012628 CVE-2023-54312 bsc#1255774). - Update patches.suse/sched-psi-use-kernfs-polling-functions-for-PSI-.patch (bsc#1012628 CVE-2023-54019 bsc#1255636). - Update patches.suse/scsi-qedf-Fix-NULL-dereference-in-error-handlin.patch (bsc#1012628 CVE-2023-54289 bsc#1255806). - Update patches.suse/scsi-qla2xxx-Array-index-may-go-out-of-bound.patch (bsc#1012628 CVE-2023-54179 bsc#1255994). - Update patches.suse/scsi-qla2xxx-Check-valid-rport-returned-by-fc_b.patch (bsc#1012628 CVE-2023-54014 bsc#1256300). - Update patches.suse/scsi-target-core-Fix-target_cmd_counter-leak.patch (bsc#1214847 CVE-2023-54154 bsc#1256082). - Update patches.suse/serial-8250-Fix-oops-for-port-pm-on-uart_chang.patch (bsc#1012628 CVE-2023-54220 bsc#1255949). - Update patches.suse/serial-sprd-Fix-DMA-buffer-leak-issue.patch (git-fixes CVE-2023-54136 bsc#1256099). - Update patches.suse/sfc-fix-crash-when-reading-stats-while-NIC-is-r.patch (bsc#1012628 CVE-2023-54156 bsc#1255704). - Update patches.suse/sh-dma-Fix-DMA-channel-offset-calculation.patch (bsc#1012628 CVE-2023-54255 bsc#1255884). - Update patches.suse/smb-client-fix-missed-ses-refcounting.patch (bsc#1012628 CVE-2023-54076 bsc#1256335). - Update patches.suse/smb-client-fix-potential-cfid-UAF-in-smb2_query_info_compound.patch (bsc#1248886 CVE-2025-40320 bsc#1254793). - Update patches.suse/soundwire-fix-enumeration-completion.patch (bsc#1012628 CVE-2023-54096 bsc#1256178). - Update patches.suse/spi-tegra210-quad-Fix-timeout-handling.patch (bsc#1253155 CVE-2025-68746 bsc#1255722). - Update patches.suse/staging-r8712-Fix-memory-leak-in-_r8712_init_xm.patch (bsc#1012628 CVE-2023-54001 bsc#1255628). - Update patches.suse/thermal-of-fix-double-free-on-unregistration.patch (bsc#1012628 CVE-2023-53997 bsc#1255632). - Update patches.suse/tpm-tpm_vtpm_proxy-fix-a-race-condition-in-dev-.patch (bsc#1012628 CVE-2023-54309 bsc#1255780). - Update patches.suse/tracing-Fix-memory-leak-of-iter-temp-when-readi.patch (bsc#1012628 CVE-2023-54171 bsc#1256034). - Update patches.suse/tracing-Fix-warning-in-trace_buffered_event_dis.patch (bsc#1012628 CVE-2023-54211 bsc#1255843). - Update patches.suse/tty-serial-samsung_tty-Fix-a-memory-leak-in-s3c.patch (bsc#1012628 CVE-2023-53858 bsc#1254704). - Update patches.suse/usb-cdns3-gadget-Use-after-free-during-failed-initia.patch (stable-fixes CVE-2025-40314 bsc#1255072). - Update patches.suse/usb-dwc3-Fix-race-condition-between-concurrent-dwc3_.patch (git-fixes CVE-2025-68287 bsc#1255152). - Update patches.suse/usb-gadget-f_eem-Fix-memory-leak-in-eem_unwrap.patch (git-fixes CVE-2025-68289 bsc#1255155). - Update patches.suse/usb-gadget-f_fs-Fix-epfile-null-pointer-access-after.patch (stable-fixes CVE-2025-40315 bsc#1255083). - Update patches.suse/usb-potential-integer-overflow-in-usbg_make_tpg.patch (stable-fixes CVE-2025-68750 bsc#1255814). - Update patches.suse/usb-storage-alauda-Fix-uninit-value-in-alauda_.patch (bsc#1012628 CVE-2023-53847 bsc#1254698). - Update patches.suse/usb-storage-sddr55-Reject-out-of-bound-new_pba.patch (stable-fixes CVE-2025-40345 bsc#1255279). - Update patches.suse/usb-typec-bus-verify-partner-exists-in-typec_altmode.patch (git-fixes CVE-2023-54299 bsc#1255789). - Update patches.suse/usb-uas-fix-urb-unmapping-issue-when-the-uas-device-.patch (git-fixes CVE-2025-68331 bsc#1255495). - Update patches.suse/usbnet-Prevents-free-active-kevent.patch (git-fixes CVE-2025-68312 bsc#1255171). - Update patches.suse/vdpa-Add-queue-index-attr-to-vdpa_nl_policy-fo.patch (bsc#1012628 CVE-2023-54031 bsc#1255583). - Update patches.suse/vduse-fix-NULL-pointer-dereference.patch (bsc#1012628 CVE-2023-54291 bsc#1255798). - Update patches.suse/vfio-type1-fix-cap_migration-information-leak (jsc#PED-7779 jsc#PED-7780 CVE-2023-54137 bsc#1256100). - Update patches.suse/virtio-vdpa-Fix-cpumask-memory-leak-in-virtio_.patch (bsc#1012628 CVE-2023-54215 bsc#1255957). - Update patches.suse/virtio_pmem-add-the-missing-REQ_OP_WRITE-for-flush-b.patch (git-fixes CVE-2023-54089 bsc#1256268). - Update patches.suse/virtio_vdpa-build-affinity-masks-conditionally.patch (git-fixes CVE-2023-54008 bsc#1255630). - Update patches.suse/wifi-ath11k-Add-missing-hw_ops-get_ring_selecto.patch (bsc#1012628 CVE-2023-54141 bsc#1256094). - Update patches.suse/wifi-ath11k-fix-peer-HE-MCS-assignment.patch (git-fixes CVE-2025-68380 bsc#1255580). - Update patches.suse/wifi-ath11k-fix-registration-of-6Ghz-only-phy-w.patch (bsc#1012628 CVE-2023-54229 bsc#1255924). - Update patches.suse/wifi-ath12k-Fix-memory-leak-in-rx_desc-and-tx_desc.patch (git-fixes CVE-2023-54016 bsc#1256279). - Update patches.suse/wifi-ath9k-avoid-referencing-uninit-memory-in-a.patch (bsc#1012628 CVE-2023-54300 bsc#1255790). - Update patches.suse/wifi-brcmfmac-fix-crash-while-sending-Action-Frames-.patch (git-fixes CVE-2025-40321 bsc#1254795). - Update patches.suse/wifi-cfg80211-ocb-don-t-leave-if-not-joined.patch (git-fixes CVE-2023-53992 bsc#1256058). - Update patches.suse/wifi-mt76-mt7921-fix-skb-leak-by-txs-missing-i.patch (bsc#1012628 CVE-2023-54052 bsc#1256387). - Update patches.suse/wifi-mwifiex-fix-memory-leak-in-mwifiex_histogram_re.patch (git-fixes CVE-2023-53808 bsc#1254723). - Update patches.suse/wifi-rsi-Do-not-configure-WoWlan-in-shutdown-ho.patch (bsc#1012628 CVE-2023-54025 bsc#1255558). - Update patches.suse/wifi-rtl818x-Fix-potential-memory-leaks-in-rtl8180_i.patch (git-fixes CVE-2025-68759 bsc#1255934). - Update patches.suse/wifi-rtl818x-rtl8187-Fix-potential-buffer-underflow-.patch (git-fixes CVE-2025-68362 bsc#1255611). - Update patches.suse/x86-CPU-AMD-Add-RDSEED-fix-for-Zen5.patch (git-fixes CVE-2025-68313 bsc#1255415). - Update patches.suse/x86-CPU-AMD-Add-missing-terminator-for-zen5_rdseed_microco.patch (git-fixes CVE-2025-68195 bsc#1255259). - Update patches.suse/x86-hyperv-Disable-IBT-when-hypercall-page-lac.patch (bsc#1012628 CVE-2023-54172 bsc#1256033). - Update patches.suse/x86-sev-Make-enc_dec_hypercall-accept-a-size-instead-of-npages (bsc#1214635 CVE-2023-53996 bsc#1255618). - Update patches.suse/xen-speed-up-grant-table-reclaim.patch (bsc#1012628 CVE-2023-54081 bsc#1256361). - Update patches.suse/xfrm-also-call-xfrm_state_delete_tunnel-at-destroy-time-fo.patch (CVE-2025-40215 bsc#1254959 CVE-2025-40256 bsc#1254851). - commit c2db288 - Update patches.suse/exfat-fix-refcount-leak-in-exfat_find.patch (CVE-2025-40287 bsc#1255030 CVE-2025-68351 bsc#1255567). - Update patches.suse/net-enetc-fix-the-deadlock-of-enetc_mdio_lock.patch (CVE-2025-40337 bsc#1255081 CVE-2025-40347 bsc#1255262). - commit 8022326 ++++ kernel-firmware: - Update AMD ucode to 20251203 (bsc#1256483) ++++ kernel-rt: - fuse: fix livelock in synchronous file put from fuseblk workers (CVE-2025-40220 bsc#1254520). - commit 46a797f - tracing: Fix access to trace_event_file (bsc#1254373). - commit 768b257 - virtio_console: fix order of fields cols and rows (stable-fixes). - commit 0d412d7 - drm/amdgpu: Forward VMID reservation errors (git-fixes). - commit a7344a2 - pinctrl: single: Fix PIN_CONFIG_BIAS_DISABLE handling (stable-fixes). - Refresh patches.suse/pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch. - commit bc41b99 - usb: ohci-nxp: fix device leak on probe failure (git-fixes). - usb: usb-storage: Maintain minimal modifications to the bcdDevice range (git-fixes). - Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table (stable-fixes). - drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() (stable-fixes). - ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() (git-fixes). - i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured firmware (stable-fixes). - platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks (stable-fixes). - pinctrl: single: Fix incorrect type for error return variable (git-fixes). - i3c: fix refcount inconsistency in i3c_master_register (git-fixes). - staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing (stable-fixes). - staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser (stable-fixes). - USB: serial: option: move Telit 0x10c7 composition in the right place (stable-fixes). - USB: serial: option: add Telit Cinterion FE910C04 new compositions (stable-fixes). - USB: serial: option: add Foxconn T99W760 (stable-fixes). - USB: serial: ftdi_sio: match on interface number for jtag (stable-fixes). - usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive (stable-fixes). - usb: dwc2: fix hang during shutdown if set as peripheral (git-fixes). - usb: xhci: limit run_graceperiod for only usb 3.0 devices (stable-fixes). - usb: typec: ucsi: Handle incorrect num_connectors capability (stable-fixes). - usbip: Fix locking bug in RT-enabled kernels (stable-fixes). - serial: sprd: Return -EPROBE_DEFER when uart clock is not ready (stable-fixes). - serial: add support of CPCI cards (stable-fixes). - char: applicom: fix NULL pointer dereference in ac_ioctl (stable-fixes). - iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains (stable-fixes). - fbdev: gbefb: fix to use physical address instead of dma address (stable-fixes). - via_wdt: fix critical boot hang due to unnamed resource allocation (stable-fixes). - ipmi: Fix __scan_channels() failing to rescan channels (stable-fixes). - ipmi: Fix the race between __scan_channels() and deliver_response() (stable-fixes). - reset: fix BIT macro reference (stable-fixes). - firmware: imx: scu-irq: Init workqueue before request mbox channel (stable-fixes). - HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen (stable-fixes). - mmc: sdhci-msm: Avoid early clock doubling during HS400 transition (stable-fixes). - ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr (git-fixes). - media: amphion: Remove vpu_vb_is_codecconfig (git-fixes). - media: verisilicon: Fix CPU stalls on G2 bus error (git-fixes). - Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE (stable-fixes). - Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV (stable-fixes). - wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet (stable-fixes). - wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1 (stable-fixes). - ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only (stable-fixes). - ACPICA: Avoid walking the Namespace if start_node is NULL (stable-fixes). - pinctrl: qcom: msm: Fix deadlock in pinmux configuration (stable-fixes). - platform/x86: acer-wmi: Ignore backlight event (stable-fixes). - platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list (stable-fixes). - platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally (stable-fixes). - platform/x86: huawei-wmi: add keys for HONOR models (stable-fixes). - HID: elecom: Add support for ELECOM M-XT3URBK (018F) (stable-fixes). - HID: hid-input: Extend Elan ignore battery quirk to USB (stable-fixes). - HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list (stable-fixes). - drm/vmwgfx: Use kref in vmw_bo_dirty (stable-fixes). - spi: xilinx: increase number of retries before declaring stall (stable-fixes). - spi: imx: keep dma request disabled before dma transfer setup (stable-fixes). - ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series (stable-fixes). - Bluetooth: btrtl: Avoid loading the config file on security chips (stable-fixes). - media: amphion: Make some vpu_v4l2 functions static (stable-fixes). - usb: dwc2: disable platform lowlevel hw resources during shutdown (stable-fixes). - media: amphion: Add a frame flush mode for decoder (stable-fixes). - usb: ohci-nxp: Use helper function devm_clk_get_enabled() (stable-fixes). - drm/tilcdc: request and mapp iomem with devres (stable-fixes). - media: verisilicon: g2: Use common helpers to compute chroma and mv offsets (stable-fixes). - media: verisilicon: Store chroma and motion vectors offset (stable-fixes). - i3c: master: Inherit DMA masks and parameters from parent device (stable-fixes). - commit bc3be49 - supported.conf: mark ksmbd unsupported Based on discussion with Enzo Matsumiya it has tuned out that ksmbd module is unsupported but the supported.conf entry is incorrect. Fix that. - commit c800e3f - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (bsc#1253262 ltc#216029). - commit daa4104 - Update patches.suse/1260-drm-amdkfd-Add-missing-gfx11-MQD-manager-callbacks.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-54261 bsc#1255879). - Update patches.suse/ACPI-video-Fix-use-after-free-in-acpi_video_switch_b.patch (git-fixes CVE-2025-40211 bsc#1254126). - Update patches.suse/ALSA-dice-fix-buffer-overflow-in-detect_stream_forma.patch (git-fixes CVE-2025-68346 bsc#1255603). - Update patches.suse/ALSA-firewire-motu-add-bounds-check-in-put_user-loop.patch (git-fixes CVE-2025-68753 bsc#1256238). - Update patches.suse/ALSA-firewire-motu-fix-buffer-overflow-in-hwdep-read.patch (git-fixes CVE-2025-68347 bsc#1255706). - Update patches.suse/ALSA-hda-cs35l41-Fix-NULL-pointer-dereference-in-cs3-c34b04c.patch (git-fixes CVE-2025-68345 bsc#1255601). - Update patches.suse/ALSA-pcm-Fix-potential-data-race-at-PCM-memory-.patch (bsc#1012628 CVE-2023-54072 bsc#1256291). - Update patches.suse/ALSA-usb-audio-Fix-NULL-pointer-dereference-in-snd_u.patch (git-fixes CVE-2025-40275 bsc#1254829). - Update patches.suse/ALSA-usb-audio-Fix-potential-memory-leaks-at-error-p.patch (jsc#PED-6045 jsc#PED-6036 jsc#PED-6104 jsc#PED-6114 jsc#PED-6067 jsc#PED-6123 CVE-2023-54022 bsc#1255545). - Update patches.suse/ALSA-usb-audio-Fix-potential-overflow-of-PCM-transfe.patch (stable-fixes CVE-2025-40269 bsc#1255035). - Update patches.suse/ASoC-codecs-wcd-mbhc-v2-fix-resource-leaks-on-c.patch (bsc#1012628 CVE-2023-53842 bsc#1254690). - Update patches.suse/Bluetooth-6lowpan-reset-link-local-header-on-ipv6-re.patch (git-fixes CVE-2025-40282 bsc#1254850). - Update patches.suse/Bluetooth-ISO-fix-iso_conn-related-locking-and-.patch (bsc#1012628 CVE-2023-54164 bsc#1256071). - Update patches.suse/Bluetooth-MGMT-cancel-mesh-send-timer-when-hdev-remo.patch (git-fixes CVE-2025-40284 bsc#1254860). - Update patches.suse/Bluetooth-SCO-Fix-UAF-on-sco_conn_free.patch (stable-fixes CVE-2025-40309 bsc#1255065). - Update patches.suse/Bluetooth-bcsp-receive-data-only-if-registered.patch (stable-fixes CVE-2025-40308 bsc#1255064). - Update patches.suse/Bluetooth-btusb-reorder-cleanup-in-btusb_disconnect-.patch (git-fixes CVE-2025-40283 bsc#1254858). - Update patches.suse/Bluetooth-hci_conn-return-ERR_PTR-instead-of-NU.patch (bsc#1012628 CVE-2023-54038 bsc#1255540). - Update patches.suse/Bluetooth-hci_event-validate-skb-length-for-unknown-.patch (git-fixes CVE-2025-40301 bsc#1255193). - Update patches.suse/Bluetooth-hci_sock-Prevent-race-in-socket-write-iter.patch (git-fixes CVE-2025-68305 bsc#1255169). - Update patches.suse/Bluetooth-hci_sync-Avoid-use-after-free-in-dbg-.patch (bsc#1012628 CVE-2023-54210 bsc#1255955). - Update patches.suse/Bluetooth-hci_sync-Avoid-use-after-free-in-dbg-for-h.patch (git-fixes CVE-2023-53828 bsc#1254623). - Update patches.suse/Bluetooth-hci_sync-Fix-UAF-in-hci_disconnect_all_syn.patch (git-fixes CVE-2023-53762 bsc#1254606). - Update patches.suse/Bluetooth-hci_sync-fix-race-in-hci_cmd_sync_dequeue_.patch (git-fixes CVE-2025-40318 bsc#1254798). - Update patches.suse/FS-JFS-Check-for-read-only-mounted-filesystem-i.patch (bsc#1012628 CVE-2023-53766 bsc#1255005). - Update patches.suse/HID-hidraw-fix-data-race-on-device-refcount.patch (bsc#1012628 CVE-2023-53759 bsc#1254663). - Update patches.suse/HID-uclogic-Correct-devm-device-reference-for-hidinp.patch (git-fixes CVE-2023-54207 bsc#1255961). - Update patches.suse/HID-wacom-Use-ktime_t-rather-than-int-when-deal.patch (bsc#1012628 CVE-2023-53797 bsc#1254733). - Update patches.suse/Input-cros_ec_keyb-fix-an-invalid-memory-access.patch (stable-fixes CVE-2025-40263 bsc#1255077). - Update patches.suse/Input-imx_sc_key-fix-memory-corruption-on-unload.patch (git-fixes CVE-2025-40262 bsc#1254840). - Update patches.suse/Input-pegasus-notetaker-fix-potential-out-of-bounds-.patch (git-fixes CVE-2025-68217 bsc#1255221). - Update patches.suse/KVM-SVM-Get-source-vCPUs-from-source-VM-for-SEV-ES-i.patch (git-fixes CVE-2023-54296 bsc#1255793). - Update patches.suse/KVM-s390-pv-fix-index-value-of-replaced-ASCE.patch (bsc#1012628 CVE-2023-54092 bsc#1256370). - Update patches.suse/MIPS-KVM-Fix-NULL-pointer-dereference.patch (bsc#1012628 CVE-2023-54241 bsc#1255838). - Update patches.suse/NFSD-Fix-crash-in-nfsd4_read_release.patch (git-fixes CVE-2025-40324 bsc#1254791). - Update patches.suse/NFSD-free-copynotify-stateid-in-nfs4_free_ol_stateid.patch (git-fixes CVE-2025-40273 bsc#1254828). - Update patches.suse/PCI-DOE-Fix-destroy_work_on_stack-race.patch (git-fixes CVE-2023-54235 bsc#1255921). - Update patches.suse/PCI-Free-released-resource-after-coalescing.patch (git-fixes CVE-2023-53743 bsc#1254782). - Update patches.suse/PCI-IOV-Add-PCI-rescan-remove-locking-when-enabling-.patch (git-fixes CVE-2025-40219 bsc#1254518). - Update patches.suse/PCI-cadence-Check-for-the-existence-of-cdns_pcie-ops.patch (stable-fixes CVE-2025-68176 bsc#1255329). - Update patches.suse/RDMA-bnxt_re-Prevent-handling-any-completions-a.patch (bsc#1012628 CVE-2023-54048 bsc#1256395). - Update patches.suse/RDMA-efa-Fix-wrong-resources-deallocation-order.patch (git-fixes CVE-2023-54201 bsc#1255964). - Update patches.suse/RDMA-irdma-Fix-data-race-on-CQP-completion-stat.patch (bsc#1012628 CVE-2023-54302 bsc#1255792). - Update patches.suse/RDMA-irdma-Fix-data-race-on-CQP-request-done.patch (bsc#1012628 CVE-2023-54292 bsc#1255800). - Update patches.suse/Revert-IB-isert-Fix-incorrect-release-of-isert-conne.patch (git-fixes CVE-2023-54219 bsc#1256231). - Update patches.suse/accel-habanalabs-support-mapping-cb-with-vmalloc-bac.patch (stable-fixes CVE-2025-40311 bsc#1255068). - Update patches.suse/accel-qaic-Clean-up-integer-overflow-checking-.patch (bsc#1012628 CVE-2023-53778 bsc#1254761). - Update patches.suse/af_unix-Fix-data-race-around-unix_tot_inflight.patch (git-fixes CVE-2023-54006 bsc#1255591). - Update patches.suse/amba-bus-fix-refcount-leak.patch (git-fixes CVE-2023-54230 bsc#1255925). - Update patches.suse/amd-amdkfd-resolve-a-race-in-amdgpu_amdkfd_device_fi.patch (stable-fixes CVE-2025-40310 bsc#1255041). - Update patches.suse/amdgpu-validate-offset_in_bo-of-drm_amdgpu_gem_.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-53819 bsc#1254712). - Update patches.suse/arm64-mm-fix-VA-range-sanity-check.patch (bsc#1012628 CVE-2023-53989 bsc#1256302). - Update patches.suse/arm64-set-__exception_irq_entry-with-__irq_entr.patch (bsc#1012628 CVE-2023-54322 bsc#1255763). - Update patches.suse/atm-fore200e-Fix-possible-data-race-in-fore200e_open.patch (git-fixes CVE-2025-68339 bsc#1255505). - Update patches.suse/audit-fix-possible-soft-lockup-in-__audit_inode_chil.patch (git-fixes CVE-2023-54045 bsc#1256285). - Update patches.suse/autofs-fix-memory-leak-of-waitqueues-in-autofs_catat.patch (git-fixes CVE-2023-54134 bsc#1256106). - Update patches.suse/backlight-led-bl-Add-devlink-to-supplier-LEDs.patch (git-fixes CVE-2025-68758 bsc#1255944). - Update patches.suse/bcache-fixup-btree_cache_wait-list-damage.patch (bsc#1012628 CVE-2023-54293 bsc#1255801). - Update patches.suse/binder-fix-memory-leak-in-binder_init.patch (bsc#1012628 CVE-2023-54005 bsc#1255629). - Update patches.suse/blk-cgroup-Fix-NULL-deref-caused-by-blkg_policy_data-being-installed-before-init.patch (bsc#1216062 CVE-2023-54271 bsc#1255902). - Update patches.suse/blk-cgroup-hold-queue_lock-when-removing-blkg-.patch (bsc#1012628 CVE-2023-54088 bsc#1256263). - Update patches.suse/blk-mq-fix-tags-leak-when-shrink-nr_hw_queues.patch (bsc#1216436 CVE-2023-54227 bsc#1255952). - Update patches.suse/block-fix-blktrace-debugfs-entries-leakage.patch (bsc#1012628 CVE-2023-54209 bsc#1255963). - Update patches.suse/block-rq_qos-protect-rq_qos-apis-with-a-new-loc.patch (bsc#1012628 CVE-2023-53823 bsc#1254691). - Update patches.suse/bpf-Address-KCSAN-report-on-bpf_lru_list.patch (bsc#1012628 CVE-2023-54283 bsc#1255809). - Update patches.suse/bpf-Disable-preemption-in-bpf_event_output.patch (bsc#1012628 CVE-2023-54173 bsc#1255996). - Update patches.suse/bpf-Disable-preemption-in-bpf_perf_event_outpu.patch (bsc#1012628 CVE-2023-54303 bsc#1255785). - Update patches.suse/bpf-Fix-issue-in-verifying-allow_ptr_leaks.patch (jsc#PED-6811 CVE-2023-54181 bsc#1255988). - Update patches.suse/bpf-Silence-a-warning-in-btf_type_id_size.patch (bsc#1012628 CVE-2023-54247 bsc#1255892). - Update patches.suse/bpf-bpf_sk_storage-Fix-invalid-wait-context-lockdep-.patch (jsc#PED-6811 CVE-2023-53857 bsc#1254648). - Update patches.suse/bpf-drop-unnecessary-user-triggerable-WARN_ONCE.patch (bsc#1012628 CVE-2023-54145 bsc#1256090). - Update patches.suse/bpf-sockmap-Fix-skb-refcnt-race-after-locking-change.patch (jsc#PED-6811 CVE-2023-53836 bsc#1254693). - Update patches.suse/btrfs-fix-incorrect-splitting-in-btrfs_drop_ex.patch (bsc#1012628 CVE-2023-54121 bsc#1256267). - Update patches.suse/btrfs-fix-lockdep-splat-and-potential-deadlock-after.patch (git-fixes CVE-2023-54224 bsc#1255951). - Update patches.suse/btrfs-fix-race-between-balance-and-cancel-pause.patch (bsc#1012628 CVE-2023-54023 bsc#1256301). - Update patches.suse/btrfs-fix-race-when-deleting-free-space-root-fr.patch (bsc#1012628 CVE-2023-54067 bsc#1256369). - Update patches.suse/btrfs-fix-race-when-deleting-quota-root-from-th.patch (bsc#1012628 CVE-2023-54032 bsc#1255617). - Update patches.suse/btrfs-fix-warning-when-putting-transaction-with.patch (bsc#1012628 CVE-2023-53865 bsc#1254762). - Update patches.suse/btrfs-release-path-before-inode-lookup-during-the-in.patch (git-fixes CVE-2023-54281 bsc#1255820). - Update patches.suse/btrfs-remove-BUG_ON-s-in-add_new_free_space.patch (bsc#1012628 CVE-2023-54185 bsc#1255984). - Update patches.suse/btrfs-set-page-extent-mapped-after-read_folio-in-rel.patch (git-fixes CVE-2023-54253 bsc#1255891). - Update patches.suse/btrfs-zoned-fix-memory-leak-after-finding-block.patch (bsc#1012628 CVE-2023-54297 bsc#1255795). - Update patches.suse/btrfs-zoned-skip-splitting-and-logical-rewriting-on-.patch (bsc#1223731 CVE-2024-26944 CVE-2023-54080 bsc#1256367). - Update patches.suse/can-gs_usb-gs_usb_xmit_callback-fix-handling-of-fail.patch (git-fixes CVE-2025-68307 bsc#1255146). - Update patches.suse/can-kvaser_usb-leaf-Fix-potential-infinite-loop-in-c.patch (git-fixes CVE-2025-68308 bsc#1255149). - Update patches.suse/cifs-fix-potential-oops-in-cifs_oplock_break.patch (bsc#1012628 CVE-2023-54258 bsc#1255886). - Update patches.suse/cifs-fix-session-state-check-in-reconnect-to-a.patch (bsc#1012628 CVE-2023-53794 bsc#1255163). - Update patches.suse/clk-clocking-wizard-Fix-Oops-in-clk_wzrd_regist.patch (bsc#1012628 CVE-2023-53807 bsc#1254724). - Update patches.suse/clk-imx93-fix-memory-leak-and-missing-unwind-go.patch (bsc#1012628 CVE-2023-54221 bsc#1255842). - Update patches.suse/comedi-c6xdigio-Fix-invalid-PNP-driver-unregistratio.patch (git-fixes CVE-2025-68332 bsc#1255483). - Update patches.suse/comedi-check-device-s-attached-status-in-compat-ioct.patch (git-fixes CVE-2025-68257 bsc#1255167). - Update patches.suse/comedi-multiq3-sanitize-config-options-in-multiq3_at.patch (git-fixes CVE-2025-68258 bsc#1255182). - Update patches.suse/comedi-pcl818-fix-null-ptr-deref-in-pcl818_ai_cancel.patch (git-fixes CVE-2025-68335 bsc#1255480). - Update patches.suse/crypto-api-Use-work-queue-in-crypto_destroy_instance.patch (git-fixes CVE-2023-53799 bsc#1254732). - Update patches.suse/crypto-aspeed-fix-double-free-caused-by-devm.patch (git-fixes CVE-2025-68172 bsc#1255253). - Update patches.suse/crypto-asymmetric_keys-prevent-overflow-in-asymmetri.patch (git-fixes CVE-2025-68724 bsc#1255550). - Update patches.suse/dccp-Fix-out-of-bounds-access-in-DCCP-error-handler.patch (bsc#1220419 CVE-2023-53782 bsc#1254758). - Update patches.suse/dccp-fix-data-race-around-dp-dccps_mss_cache.patch (bsc#1012628 CVE-2023-53839 bsc#1254655). - Update patches.suse/devlink-report-devlink_port_type_warn-source-de.patch (bsc#1012628 CVE-2023-53841 bsc#1255009). - Update patches.suse/dm-don-t-attempt-to-queue-IO-under-RCU-protection-a9ce.patch (jsc#PED-7514 CVE-2023-53860 bsc#1254626). - Update patches.suse/dm-fix-a-race-condition-in-retrieve_deps-f600.patch (jsc#PED-7514 CVE-2023-54324 bsc#1255759). - Update patches.suse/driver-soc-xilinx-use-_safe-loop-iterator-to-av.patch (bsc#1012628 CVE-2023-54101 bsc#1256153). - Update patches.suse/drm-amd-display-Check-NULL-before-accessing.patch (stable-fixes CVE-2025-68286 bsc#1255351). - Update patches.suse/drm-amd-display-Fix-NULL-deref-in-debugfs-odm_combin.patch (git-fixes CVE-2025-68180 bsc#1255252). - Update patches.suse/drm-amdgpu-Fix-NULL-pointer-dereference-in-VRAM-logi.patch (stable-fixes CVE-2025-40288 bsc#1255057). - Update patches.suse/drm-bridge-dw_hdmi-fix-connector-access-for-scd.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-53784 bsc#1254765). - Update patches.suse/drm-client-Fix-memory-leak-in-drm_client_target.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-54091 bsc#1256274). - Update patches.suse/drm-i915-Avoid-lock-inversion-when-pinning-to-GGTT-o.patch (git-fixes CVE-2025-68244 bsc#1255190). - Update patches.suse/drm-mediatek-Fix-device-use-after-free-on-unbind.patch (git-fixes CVE-2025-40316 bsc#1254797). - Update patches.suse/drm-msm-dp-Drop-aux-devices-together-with-DP-co.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-53851 bsc#1254695). - Update patches.suse/drm-mxsfb-Disable-overlay-plane-in-mxsfb_plane_overl.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-53864 bsc#1254754). - Update patches.suse/drm-nouveau-kms-nv50-init-hpd_irq_lock-for-PIOR.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-54263 bsc#1255883). - Update patches.suse/drm-sched-Fix-deadlock-in-drm_sched_entity_kill_jobs.patch (git-fixes CVE-2025-40329 bsc#1254621). - Update patches.suse/drm-tegra-Add-call-to-put_pid.patch (git-fixes CVE-2025-68233 bsc#1255206). - Update patches.suse/drm-ttm-Don-t-leak-a-resource-on-eviction-error.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-54254 bsc#1255890). - Update patches.suse/drm-ttm-Don-t-leak-a-resource-on-swapout-move-e.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-53844 bsc#1254649). - Update patches.suse/drm-vgem-fence-Fix-potential-deadlock-on-release.patch (git-fixes CVE-2025-68757 bsc#1255943). - Update patches.suse/drm-vmwgfx-Validate-command-header-size-against-SVGA.patch (git-fixes CVE-2025-40277 bsc#1254894). - Update patches.suse/erofs-kill-hooked-chains-to-avoid-loops-on-dedu.patch (bsc#1012628 CVE-2023-53777 bsc#1254749). - Update patches.suse/exfat-use-kvmalloc_array-kvfree-instead-of-kma.patch (bsc#1012628 CVE-2023-54194 bsc#1255974). - Update patches.suse/ext4-correct-grp-validation-in-ext4_mb_good_group.patch (bsc#1234163 CVE-2023-53861 bsc#1254678). - Update patches.suse/ext4-fix-BUG-in-ext4_mb_new_inode_pa-due-to-overflow.patch (bsc#1219165 CVE-2023-54069 bsc#1256371). - Update patches.suse/ext4-fix-rbtree-traversal-bug-in-ext4_mb_use_pr.patch (bsc#1012628 CVE-2023-53813 bsc#1254717). - Update patches.suse/ext4-turn-quotas-off-if-mount-failed-after-enab.patch (bsc#1012628 CVE-2023-54153 bsc#1256081). - Update patches.suse/f2fs-fix-to-do-sanity-check-on-direct-node-in-.patch (bsc#1012628 CVE-2023-53846 bsc#1254983). - Update patches.suse/fbcon-Set-fb_display-i-mode-to-NULL-when-the-mode-is.patch (stable-fixes CVE-2025-40323 bsc#1255094). - Update patches.suse/fbdev-Add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch (stable-fixes CVE-2025-40304 bsc#1255034). - Update patches.suse/fbdev-bitblit-bound-check-glyph-index-in-bit_putcs.patch (stable-fixes CVE-2025-40322 bsc#1255092). - Update patches.suse/firmware-meson_sm-fix-to-avoid-potential-NULL-pointe.patch (git-fixes CVE-2023-54304 bsc#1255786). - Update patches.suse/firmware-stratix10-svc-fix-bug-in-saving-controller-.patch (git-fixes CVE-2025-68328 bsc#1255489). - Update patches.suse/fs-Protect-reconfiguration-of-sb-read-write-fr.patch (bsc#1012628 CVE-2023-54099 bsc#1256197). - Update patches.suse/fs-jfs-prevent-double-free-in-dbUnmount-after-failed-jfs_remount.patch (git-fixes CVE-2023-54127 bsc#1256119). - Update patches.suse/fs-ntfs3-Return-error-for-inconsistent-extende.patch (bsc#1012628 CVE-2023-54125 bsc#1256117). - Update patches.suse/fs-sysv-Null-check-to-prevent-null-ptr-deref-b.patch (bsc#1012628 CVE-2023-54264 bsc#1255872). - Update patches.suse/gpu-host1x-Fix-race-in-syncpt-alloc-free.patch (git-fixes CVE-2025-68732 bsc#1255688). - Update patches.suse/gtp-Fix-use-after-free-in-__gtp_encap_destroy.patch (bsc#1012628 CVE-2023-54142 bsc#1256095). - Update patches.suse/hfs-validate-record-offset-in-hfsplus_bmap_alloc.patch (git-fixes CVE-2025-40349 bsc#1255280). - Update patches.suse/hfsplus-fix-KMSAN-uninit-value-issue-in-__hfsplus_ext_cache_extent.patch (git-fixes CVE-2025-40244 bsc#1255033). - Update patches.suse/hfsplus-fix-KMSAN-uninit-value-issue-in-hfsplus_delete_cat.patch (git-fixes CVE-2025-40351 bsc#1255281). - Update patches.suse/hwrng-virtio-Fix-race-on-data_avail-and-actual-.patch (bsc#1012628 CVE-2023-53998 bsc#1255578). - Update patches.suse/iavf-use-internal-state-to-free-traffic-IRQs.patch (bsc#1012628 CVE-2023-53850 bsc#1254677). - Update patches.suse/ice-prevent-NULL-pointer-deref-during-reload.patch (bsc#1012628 CVE-2023-54037 bsc#1255557). - Update patches.suse/igb-clean-up-in-all-error-paths-when-enabling-SR-IOV.patch (jsc#PED-4866 CVE-2023-54070 bsc#1256364). - Update patches.suse/igc-Fix-Kernel-Panic-during-ndo_tx_timeout-call.patch (bsc#1012628 CVE-2023-54166 bsc#1256074). - Update patches.suse/iio-accel-bmc150-Fix-irq-assumption-regression.patch (stable-fixes CVE-2025-68330 bsc#1255493). - Update patches.suse/iio-adc-ina2xx-avoid-NULL-pointer-dereference-.patch (bsc#1012628 CVE-2023-53834 bsc#1254660). - Update patches.suse/iio-core-Prevent-invalid-memory-access-when-th.patch (bsc#1012628 CVE-2023-54027 bsc#1255579). - Update patches.suse/ima-Handle-error-code-returned-by-ima_filter_rule_ma.patch (git-fixes CVE-2025-68740 bsc#1255812). - Update patches.suse/ima-don-t-clear-IMA_DIGSIG-flag-when-setting-or-remo.patch (stable-fixes CVE-2025-68183 bsc#1255251). - Update patches.suse/io_uring-net-don-t-overflow-multishot-recv.patch (bsc#1215211 CVE-2023-54030 bsc#1255691). - Update patches.suse/iomap-Fix-possible-overflow-condition-in-iomap_write_delalloc_scan.patch (jsc#PED-5453 CVE-2023-54285 bsc#1255807). - Update patches.suse/iommufd-IOMMUFD_DESTROY-should-not-increase-the.patch (bsc#1012628 CVE-2023-53795 bsc#1254737). - Update patches.suse/iommufd-Set-end-correctly-when-doing-batch-carr.patch (bsc#1012628 CVE-2023-54060 bsc#1256379). - Update patches.suse/ionic-remove-WARN_ON-to-prevent-panic_on_warn.patch (bsc#1012628 CVE-2023-53994 bsc#1255570). - Update patches.suse/ip6_vti-fix-slab-use-after-free-in-decode_sess.patch (bsc#1012628 CVE-2023-53821 bsc#1254669). - Update patches.suse/ipmi-ssif-Fix-a-memory-leak-when-scanning-for-an-ada.patch (git-fixes CVE-2023-54064 bsc#1256375). - Update patches.suse/irqchip-mchp-eic-Fix-error-code-in-mchp_eic_domain_a.patch (git-fixes CVE-2025-68766 bsc#1255932). - Update patches.suse/isdn-mISDN-hfcsusb-fix-memory-leak-in-hfcsusb_probe.patch (git-fixes CVE-2025-68734 bsc#1255538). - Update patches.suse/jfs-Verify-inode-mode-when-loading-from-disk.patch (git-fixes CVE-2025-40312 bsc#1255046). - Update patches.suse/jfs-fix-uninitialized-waitqueue-in-transaction-manager.patch (git-fixes CVE-2025-68168 bsc#1255100). - Update patches.suse/kcm-Fix-error-handling-for-SOCK_DGRAM-in-kcm_sendmsg.patch (bsc#1220419 CVE-2023-53825 bsc#1254707). - Update patches.suse/kcm-Fix-memory-leak-in-error-path-of-kcm_sendmsg.patch (bsc#1220419 CVE-2023-54112 bsc#1256354). - Update patches.suse/keys-Fix-linking-a-duplicate-key-to-a-keyring-s.patch (bsc#1012628 CVE-2023-54170 bsc#1256045). - Update patches.suse/maple_tree-fix-potential-out-of-bounds-access-i.patch (bsc#1012628 CVE-2023-54135 bsc#1256107). - Update patches.suse/md-fix-warning-for-holder-mismatch-from-export_rdev.patch (git-fixes CVE-2023-53791 bsc#1254742). - Update patches.suse/md-raid5-cache-fix-a-deadlock-in-r5l_exit_log-a705.patch (jsc#PED-7542 CVE-2023-53848 bsc#1254753). - Update patches.suse/media-af9005-Fix-null-ptr-deref-in-af9005_i2c_xfer.patch (git-fixes CVE-2023-54314 bsc#1255776). - Update patches.suse/media-anysee-fix-null-ptr-deref-in-anysee_master_xfe.patch (git-fixes CVE-2023-54093 bsc#1256273). - Update patches.suse/media-dvb-usb-m920x-Fix-a-potential-memory-leak-in-m.patch (git-fixes CVE-2023-54266 bsc#1255875). - Update patches.suse/media-dvb-usb-v2-gl861-Fix-null-ptr-deref-in-gl861_i.patch (git-fixes CVE-2023-54066 bsc#1256373). - Update patches.suse/media-imon-make-send_packet-more-robust.patch (stable-fixes CVE-2025-68194 bsc#1255325). - Update patches.suse/media-mediatek-vcodec-fix-resource-leaks-in-vdec_msg.patch (git-fixes CVE-2023-54143 bsc#1256096). - Update patches.suse/media-tuners-qt1010-replace-BUG_ON-with-a-regular-er.patch (git-fixes CVE-2023-54282 bsc#1255810). - Update patches.suse/media-v4l2-core-Fix-a-potential-resource-leak-in-v4l.patch (git-fixes CVE-2023-54183 bsc#1255990). - Update patches.suse/misc-fastrpc-Fix-dma_buf-object-leak-in-fastrpc_map_.patch (git-fixes CVE-2025-68252 bsc#1255197). - Update patches.suse/misc-pci_endpoint_test-Free-IRQs-before-removin.patch (bsc#1012628 CVE-2023-54326 bsc#1255758). - Update patches.suse/mm-secretmem-fix-use-after-free-race-in-fault-handle.patch (git-fixes CVE-2025-40272 bsc#1254832). - Update patches.suse/mmc-sunplus-fix-return-value-check-of-mmc_add_.patch (bsc#1012628 CVE-2023-54204 bsc#1255967). - Update patches.suse/most-usb-Fix-use-after-free-in-hdm_disconnect.patch (git-fixes CVE-2025-40223 bsc#1254957). - Update patches.suse/most-usb-fix-double-free-on-late-probe-failure.patch (git-fixes CVE-2025-68290 bsc#1255154). - Update patches.suse/most-usb-hdm_probe-Fix-calling-put_device-before-dev.patch (git-fixes CVE-2025-68249 bsc#1255233). - Update patches.suse/mt76-mt7615-Fix-memory-leak-in-mt7615_mcu_wtbl_sta_a.patch (git-fixes CVE-2025-68765 bsc#1255931). - Update patches.suse/mt76-mt7921-don-t-assume-adequate-headroom-for-SDIO-.patch (git-fixes CVE-2023-53785 bsc#1254918). - Update patches.suse/mtd-rawnand-cadence-fix-DMA-device-NULL-pointer-dere.patch (git-fixes CVE-2025-68238 bsc#1255202). - Update patches.suse/mtd-rawnand-fsl_upm-Fix-an-off-by-one-test-in-.patch (bsc#1012628 CVE-2023-54104 bsc#1256145). - Update patches.suse/mtdchar-fix-integer-overflow-in-read-write-ioctls.patch (git-fixes CVE-2025-68237 bsc#1255203). - Update patches.suse/net-core-remove-unnecessary-frame_sz-check-in-.patch (bsc#1012628 CVE-2023-54155 bsc#1256083). - Update patches.suse/net-deal-with-integer-overflows-in-kmalloc_reserve.patch (bsc#1215146 CVE-2023-42752 CVE-2023-53752 bsc#1254613). - Update patches.suse/net-do-not-allow-gso_size-to-be-set-to-GSO_BY_.patch (bsc#1012628 CVE-2023-54051 bsc#1256394). - Update patches.suse/net-dsa-avoid-suspicious-RCU-usage-for-synced-V.patch (bsc#1012628 CVE-2023-54149 bsc#1256085). - Update patches.suse/net-dsa-ocelot-call-dsa_tag_8021q_unregister-u.patch (bsc#1012628 CVE-2023-53855 bsc#1254688). - Update patches.suse/net-ethernet-mtk_eth_soc-fix-possible-NULL-pointer-d.patch (git-fixes CVE-2023-54240 bsc#1255918). - Update patches.suse/net-hns3-fix-deadlock-issue-when-externel_lb-a.patch (bsc#1012628 CVE-2023-54000 bsc#1255564). - Update patches.suse/net-ipa-only-reset-hashed-tables-when-supported.patch (bsc#1012628 CVE-2023-54225 bsc#1256234). - Update patches.suse/net-ipv4-fix-one-memleak-in-__inet_del_ifa.patch (bsc#1220419 CVE-2023-53995 bsc#1255616). - Update patches.suse/net-mlx5-fix-potential-memory-leak-in-mlx5e_in.patch (bsc#1012628 CVE-2023-54106 bsc#1256358). - Update patches.suse/net-mlx5e-Move-representor-neigh-cleanup-to-pr.patch (bsc#1012628 CVE-2023-54148 bsc#1256084). - Update patches.suse/net-mlx5e-TC-Fix-internal-port-memory-leak.patch (bsc#1012628 CVE-2023-53999 bsc#1255621). - Update patches.suse/net-mlx5e-fix-memory-leak-in-mlx5e_ptp_open.patch (bsc#1012628 CVE-2023-54169 bsc#1256050). - Update patches.suse/net-mlx5e-xsk-Fix-invalid-buffer-access-for-le.patch (bsc#1012628 CVE-2023-54223 bsc#1256233). - Update patches.suse/net-openvswitch-reject-negative-ifindex.patch (bsc#1012628 CVE-2023-53843 bsc#1254705). - Update patches.suse/net-prevent-skb-corruption-on-frag-list-segment.patch (bsc#1012628 CVE-2023-54094 bsc#1256292). - Update patches.suse/net-read-sk-sk_family-once-in-sk_mc_loop.patch (bsc#1220419 CVE-2023-53831 bsc#1254701). - Update patches.suse/net-sched-taprio-Limit-TCA_TAPRIO_ATTR_SCHED_C.patch (bsc#1012628 CVE-2023-54251 bsc#1255888). - Update patches.suse/net-smc-use-smc_lgr_list.lock-to-protect-smc_lgr_lis.patch (git-fixes CVE-2023-54318 bsc#1255772). - Update patches.suse/net-usb-qmi_wwan-initialize-MAC-header-offset-in-qmi.patch (git-fixes CVE-2025-68192 bsc#1255246). - Update patches.suse/netfilter-nf_tables-fix-underflow-in-chain-refe.patch (bsc#1012628 CVE-2023-54035 bsc#1255563). - Update patches.suse/netlink-do-not-hard-code-device-address-lenth-i.patch (bsc#1012628 CVE-2023-53863 bsc#1254657). - Update patches.suse/nfp-clean-mc-addresses-in-application-firmware-.patch (bsc#1012628 CVE-2023-54133 bsc#1256104). - Update patches.suse/nfs4_setup_readdir-insufficient-locking-for-d_parent-d_inode-dereferencing.patch (git-fixes CVE-2025-68185 bsc#1255135). - Update patches.suse/nfsd-move-init-of-percpu-reply_cache_stats-coun.patch (bsc#1012628 CVE-2023-54276 bsc#1255907). - Update patches.suse/nilfs2-fix-WARNING-in-mark_buffer_dirty-due-to.patch (bsc#1012628 CVE-2023-54140 bsc#1256093). - Update patches.suse/nouveau-firmware-Add-missing-kfree-of-nvkm_falcon_fw.patch (git-fixes CVE-2025-68235 bsc#1255209). - Update patches.suse/nvme-core-fix-memory-leak-in-dhchap_ctrl_secret.patch (bsc#1012628 CVE-2023-53792 bsc#1254743). - Update patches.suse/nvme-core-fix-memory-leak-in-dhchap_secret_stor.patch (bsc#1012628 CVE-2023-53852 bsc#1254653). - Update patches.suse/nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch (bsc#1245193 bsc#1247500 CVE-2025-40342 bsc#1255274). - Update patches.suse/nvme-multipath-fix-lockdep-WARN-due-to-partition-sca.patch (git-fixes bsc#1233640 CVE-2024-53093 CVE-2025-68218 bsc#1255245). - Update patches.suse/nvmet-fc-avoid-scheduling-association-deletion-twice.patch (bsc#1245193 bsc#1247500 CVE-2025-40343 bsc#1255276). - Update patches.suse/of-overlay-Call-of_changeset_init-early.patch (git-fixes CVE-2023-53856 bsc#1254661). - Update patches.suse/of-unittest-fix-null-pointer-dereferencing-in-of_uni.patch (git-fixes CVE-2023-54178 bsc#1255992). - Update patches.suse/opp-Fix-use-after-free-in-lazy_opp_tables-after.patch (bsc#1012628 CVE-2023-54026 bsc#1255549). - Update patches.suse/orangefs-fix-xattr-related-buffer-overflow.patch (git-fixes CVE-2025-40306 bsc#1255062). - Update patches.suse/ovl-fix-null-pointer-dereference-in-ovl_get_acl.patch (bsc#1012628 CVE-2023-54313 bsc#1255775). - Update patches.suse/pcmcia-rsrc_nonstatic-Fix-memory-leak-in-nonst.patch (bsc#1012628 CVE-2023-54115 bsc#1256121). - Update patches.suse/perf-tool-x86-Fix-perf_env-memory-leak.patch (bsc#1012628 CVE-2023-53793 bsc#1254739). - Update patches.suse/phy-tegra-xusb-Clear-the-driver-reference-in-us.patch (bsc#1012628 CVE-2023-54083 bsc#1256368). - Update patches.suse/pinctrl-at91-pio4-check-return-value-of-devm_ka.patch (bsc#1012628 CVE-2023-54319 bsc#1255760). - Update patches.suse/pinctrl-freescale-Fix-a-memory-out-of-bounds-wh.patch (bsc#1012628 CVE-2023-53750 bsc#1254611). - Update patches.suse/pinctrl-s32cc-fix-uninitialized-memory-in-s32_pinctr.patch (git-fixes CVE-2025-68222 bsc#1255218). - Update patches.suse/platform-x86-intel-punit_ipc-fix-memory-corruption.patch (git-fixes CVE-2025-68303 bsc#1255122). - Update patches.suse/posix-timers-Prevent-RT-livelock-in-itimer_dele.patch (bsc#1012628 CVE-2023-53815 bsc#1254715). - Update patches.suse/powerpc-64s-Fix-VAS-mm-use-after-free.patch (bsc#1012628 CVE-2023-54042 bsc#1255702). - Update patches.suse/powerpc-iommu-Fix-notifiers-being-shared-by-PCI-and-.patch (bsc#1065729 CVE-2023-54095 bsc#1256271). - Update patches.suse/powerpc-powernv-sriov-perform-null-check-on-iov.patch (bsc#1012628 CVE-2023-54315 bsc#1255769). - Update patches.suse/powerpc-pseries-Rework-lppaca_shared_proc-to-avoid-D.patch (bsc#1194869 CVE-2023-54267 bsc#1255899). - Update patches.suse/powerpc-pseries-fix-possible-memory-leak-in-ibmebus_.patch (bsc#1194869 CVE-2023-54017 bsc#1255605). - Update patches.suse/pstore-ram-Add-check-for-kstrdup.patch (bsc#1012628 CVE-2023-54189 bsc#1255978). - Update patches.suse/quota-fix-warning-in-dqgrab.patch (bsc#1012628 CVE-2023-54177 bsc#1255993). - Update patches.suse/rcu-dump-vmalloc-memory-info-safely.patch (git-fixes CVE-2023-54113 bsc#1256351). - Update patches.suse/rcuscale-Move-rcu_scale_writer-schedule_timeout_unin.patch (git-fixes CVE-2023-54246 bsc#1255915). - Update patches.suse/refscale-Fix-uninitalized-use-of-wait_queue_head_t.patch (git-fixes CVE-2023-54316 bsc#1255770). - Update patches.suse/regmap-irq-Fix-out-of-bounds-access-when-alloca.patch (bsc#1012628 CVE-2023-53768 bsc#1254599). - Update patches.suse/regmap-slimbus-fix-bus_context-pointer-in-regmap-ini.patch (git-fixes CVE-2025-40317 bsc#1254796). - Update patches.suse/regulator-core-Protect-regulator_supply_alias_list-w.patch (git-fixes CVE-2025-68354 bsc#1255553). - Update patches.suse/regulator-da9063-fix-null-pointer-deref-with-pa.patch (bsc#1012628 CVE-2023-53787 bsc#1254750). - Update patches.suse/rpmsg-glink-Add-check-for-kstrdup.patch (git-fixes CVE-2023-54049 bsc#1256396). - Update patches.suse/s390-dcssblk-fix-kernel-crash-with-list_add-corruption.patch (git-fixes bsc#1215344 CVE-2023-54117 bsc#1256348). - Update patches.suse/s390-vmem-split-pages-when-debug-pagealloc-is-.patch (bsc#1012628 CVE-2023-54278 bsc#1255911). - Update patches.suse/samples-bpf-Fix-buffer-overflow-in-tcp_basertt.patch (bsc#1012628 CVE-2023-54312 bsc#1255774). - Update patches.suse/sched-psi-use-kernfs-polling-functions-for-PSI-.patch (bsc#1012628 CVE-2023-54019 bsc#1255636). - Update patches.suse/scsi-qedf-Fix-NULL-dereference-in-error-handlin.patch (bsc#1012628 CVE-2023-54289 bsc#1255806). - Update patches.suse/scsi-qla2xxx-Array-index-may-go-out-of-bound.patch (bsc#1012628 CVE-2023-54179 bsc#1255994). - Update patches.suse/scsi-qla2xxx-Check-valid-rport-returned-by-fc_b.patch (bsc#1012628 CVE-2023-54014 bsc#1256300). - Update patches.suse/scsi-target-core-Fix-target_cmd_counter-leak.patch (bsc#1214847 CVE-2023-54154 bsc#1256082). - Update patches.suse/serial-8250-Fix-oops-for-port-pm-on-uart_chang.patch (bsc#1012628 CVE-2023-54220 bsc#1255949). - Update patches.suse/serial-sprd-Fix-DMA-buffer-leak-issue.patch (git-fixes CVE-2023-54136 bsc#1256099). - Update patches.suse/sfc-fix-crash-when-reading-stats-while-NIC-is-r.patch (bsc#1012628 CVE-2023-54156 bsc#1255704). - Update patches.suse/sh-dma-Fix-DMA-channel-offset-calculation.patch (bsc#1012628 CVE-2023-54255 bsc#1255884). - Update patches.suse/smb-client-fix-missed-ses-refcounting.patch (bsc#1012628 CVE-2023-54076 bsc#1256335). - Update patches.suse/smb-client-fix-potential-cfid-UAF-in-smb2_query_info_compound.patch (bsc#1248886 CVE-2025-40320 bsc#1254793). - Update patches.suse/soundwire-fix-enumeration-completion.patch (bsc#1012628 CVE-2023-54096 bsc#1256178). - Update patches.suse/spi-tegra210-quad-Fix-timeout-handling.patch (bsc#1253155 CVE-2025-68746 bsc#1255722). - Update patches.suse/staging-r8712-Fix-memory-leak-in-_r8712_init_xm.patch (bsc#1012628 CVE-2023-54001 bsc#1255628). - Update patches.suse/thermal-of-fix-double-free-on-unregistration.patch (bsc#1012628 CVE-2023-53997 bsc#1255632). - Update patches.suse/tpm-tpm_vtpm_proxy-fix-a-race-condition-in-dev-.patch (bsc#1012628 CVE-2023-54309 bsc#1255780). - Update patches.suse/tracing-Fix-memory-leak-of-iter-temp-when-readi.patch (bsc#1012628 CVE-2023-54171 bsc#1256034). - Update patches.suse/tracing-Fix-warning-in-trace_buffered_event_dis.patch (bsc#1012628 CVE-2023-54211 bsc#1255843). - Update patches.suse/tty-serial-samsung_tty-Fix-a-memory-leak-in-s3c.patch (bsc#1012628 CVE-2023-53858 bsc#1254704). - Update patches.suse/usb-cdns3-gadget-Use-after-free-during-failed-initia.patch (stable-fixes CVE-2025-40314 bsc#1255072). - Update patches.suse/usb-dwc3-Fix-race-condition-between-concurrent-dwc3_.patch (git-fixes CVE-2025-68287 bsc#1255152). - Update patches.suse/usb-gadget-f_eem-Fix-memory-leak-in-eem_unwrap.patch (git-fixes CVE-2025-68289 bsc#1255155). - Update patches.suse/usb-gadget-f_fs-Fix-epfile-null-pointer-access-after.patch (stable-fixes CVE-2025-40315 bsc#1255083). - Update patches.suse/usb-potential-integer-overflow-in-usbg_make_tpg.patch (stable-fixes CVE-2025-68750 bsc#1255814). - Update patches.suse/usb-storage-alauda-Fix-uninit-value-in-alauda_.patch (bsc#1012628 CVE-2023-53847 bsc#1254698). - Update patches.suse/usb-storage-sddr55-Reject-out-of-bound-new_pba.patch (stable-fixes CVE-2025-40345 bsc#1255279). - Update patches.suse/usb-typec-bus-verify-partner-exists-in-typec_altmode.patch (git-fixes CVE-2023-54299 bsc#1255789). - Update patches.suse/usb-uas-fix-urb-unmapping-issue-when-the-uas-device-.patch (git-fixes CVE-2025-68331 bsc#1255495). - Update patches.suse/usbnet-Prevents-free-active-kevent.patch (git-fixes CVE-2025-68312 bsc#1255171). - Update patches.suse/vdpa-Add-queue-index-attr-to-vdpa_nl_policy-fo.patch (bsc#1012628 CVE-2023-54031 bsc#1255583). - Update patches.suse/vduse-fix-NULL-pointer-dereference.patch (bsc#1012628 CVE-2023-54291 bsc#1255798). - Update patches.suse/vfio-type1-fix-cap_migration-information-leak (jsc#PED-7779 jsc#PED-7780 CVE-2023-54137 bsc#1256100). - Update patches.suse/virtio-vdpa-Fix-cpumask-memory-leak-in-virtio_.patch (bsc#1012628 CVE-2023-54215 bsc#1255957). - Update patches.suse/virtio_pmem-add-the-missing-REQ_OP_WRITE-for-flush-b.patch (git-fixes CVE-2023-54089 bsc#1256268). - Update patches.suse/virtio_vdpa-build-affinity-masks-conditionally.patch (git-fixes CVE-2023-54008 bsc#1255630). - Update patches.suse/wifi-ath11k-Add-missing-hw_ops-get_ring_selecto.patch (bsc#1012628 CVE-2023-54141 bsc#1256094). - Update patches.suse/wifi-ath11k-fix-peer-HE-MCS-assignment.patch (git-fixes CVE-2025-68380 bsc#1255580). - Update patches.suse/wifi-ath11k-fix-registration-of-6Ghz-only-phy-w.patch (bsc#1012628 CVE-2023-54229 bsc#1255924). - Update patches.suse/wifi-ath12k-Fix-memory-leak-in-rx_desc-and-tx_desc.patch (git-fixes CVE-2023-54016 bsc#1256279). - Update patches.suse/wifi-ath9k-avoid-referencing-uninit-memory-in-a.patch (bsc#1012628 CVE-2023-54300 bsc#1255790). - Update patches.suse/wifi-brcmfmac-fix-crash-while-sending-Action-Frames-.patch (git-fixes CVE-2025-40321 bsc#1254795). - Update patches.suse/wifi-cfg80211-ocb-don-t-leave-if-not-joined.patch (git-fixes CVE-2023-53992 bsc#1256058). - Update patches.suse/wifi-mt76-mt7921-fix-skb-leak-by-txs-missing-i.patch (bsc#1012628 CVE-2023-54052 bsc#1256387). - Update patches.suse/wifi-mwifiex-fix-memory-leak-in-mwifiex_histogram_re.patch (git-fixes CVE-2023-53808 bsc#1254723). - Update patches.suse/wifi-rsi-Do-not-configure-WoWlan-in-shutdown-ho.patch (bsc#1012628 CVE-2023-54025 bsc#1255558). - Update patches.suse/wifi-rtl818x-Fix-potential-memory-leaks-in-rtl8180_i.patch (git-fixes CVE-2025-68759 bsc#1255934). - Update patches.suse/wifi-rtl818x-rtl8187-Fix-potential-buffer-underflow-.patch (git-fixes CVE-2025-68362 bsc#1255611). - Update patches.suse/x86-CPU-AMD-Add-RDSEED-fix-for-Zen5.patch (git-fixes CVE-2025-68313 bsc#1255415). - Update patches.suse/x86-CPU-AMD-Add-missing-terminator-for-zen5_rdseed_microco.patch (git-fixes CVE-2025-68195 bsc#1255259). - Update patches.suse/x86-hyperv-Disable-IBT-when-hypercall-page-lac.patch (bsc#1012628 CVE-2023-54172 bsc#1256033). - Update patches.suse/x86-sev-Make-enc_dec_hypercall-accept-a-size-instead-of-npages (bsc#1214635 CVE-2023-53996 bsc#1255618). - Update patches.suse/xen-speed-up-grant-table-reclaim.patch (bsc#1012628 CVE-2023-54081 bsc#1256361). - Update patches.suse/xfrm-also-call-xfrm_state_delete_tunnel-at-destroy-time-fo.patch (CVE-2025-40215 bsc#1254959 CVE-2025-40256 bsc#1254851). - commit c2db288 - Update patches.suse/exfat-fix-refcount-leak-in-exfat_find.patch (CVE-2025-40287 bsc#1255030 CVE-2025-68351 bsc#1255567). - Update patches.suse/net-enetc-fix-the-deadlock-of-enetc_mdio_lock.patch (CVE-2025-40337 bsc#1255081 CVE-2025-40347 bsc#1255262). - commit 8022326 ++++ kernel-rt_debug: - fuse: fix livelock in synchronous file put from fuseblk workers (CVE-2025-40220 bsc#1254520). - commit 46a797f - tracing: Fix access to trace_event_file (bsc#1254373). - commit 768b257 - virtio_console: fix order of fields cols and rows (stable-fixes). - commit 0d412d7 - drm/amdgpu: Forward VMID reservation errors (git-fixes). - commit a7344a2 - pinctrl: single: Fix PIN_CONFIG_BIAS_DISABLE handling (stable-fixes). - Refresh patches.suse/pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch. - commit bc41b99 - usb: ohci-nxp: fix device leak on probe failure (git-fixes). - usb: usb-storage: Maintain minimal modifications to the bcdDevice range (git-fixes). - Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table (stable-fixes). - drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() (stable-fixes). - ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() (git-fixes). - i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured firmware (stable-fixes). - platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks (stable-fixes). - pinctrl: single: Fix incorrect type for error return variable (git-fixes). - i3c: fix refcount inconsistency in i3c_master_register (git-fixes). - staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing (stable-fixes). - staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser (stable-fixes). - USB: serial: option: move Telit 0x10c7 composition in the right place (stable-fixes). - USB: serial: option: add Telit Cinterion FE910C04 new compositions (stable-fixes). - USB: serial: option: add Foxconn T99W760 (stable-fixes). - USB: serial: ftdi_sio: match on interface number for jtag (stable-fixes). - usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive (stable-fixes). - usb: dwc2: fix hang during shutdown if set as peripheral (git-fixes). - usb: xhci: limit run_graceperiod for only usb 3.0 devices (stable-fixes). - usb: typec: ucsi: Handle incorrect num_connectors capability (stable-fixes). - usbip: Fix locking bug in RT-enabled kernels (stable-fixes). - serial: sprd: Return -EPROBE_DEFER when uart clock is not ready (stable-fixes). - serial: add support of CPCI cards (stable-fixes). - char: applicom: fix NULL pointer dereference in ac_ioctl (stable-fixes). - iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains (stable-fixes). - fbdev: gbefb: fix to use physical address instead of dma address (stable-fixes). - via_wdt: fix critical boot hang due to unnamed resource allocation (stable-fixes). - ipmi: Fix __scan_channels() failing to rescan channels (stable-fixes). - ipmi: Fix the race between __scan_channels() and deliver_response() (stable-fixes). - reset: fix BIT macro reference (stable-fixes). - firmware: imx: scu-irq: Init workqueue before request mbox channel (stable-fixes). - HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen (stable-fixes). - mmc: sdhci-msm: Avoid early clock doubling during HS400 transition (stable-fixes). - ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr (git-fixes). - media: amphion: Remove vpu_vb_is_codecconfig (git-fixes). - media: verisilicon: Fix CPU stalls on G2 bus error (git-fixes). - Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE (stable-fixes). - Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV (stable-fixes). - wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet (stable-fixes). - wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1 (stable-fixes). - ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only (stable-fixes). - ACPICA: Avoid walking the Namespace if start_node is NULL (stable-fixes). - pinctrl: qcom: msm: Fix deadlock in pinmux configuration (stable-fixes). - platform/x86: acer-wmi: Ignore backlight event (stable-fixes). - platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list (stable-fixes). - platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally (stable-fixes). - platform/x86: huawei-wmi: add keys for HONOR models (stable-fixes). - HID: elecom: Add support for ELECOM M-XT3URBK (018F) (stable-fixes). - HID: hid-input: Extend Elan ignore battery quirk to USB (stable-fixes). - HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list (stable-fixes). - drm/vmwgfx: Use kref in vmw_bo_dirty (stable-fixes). - spi: xilinx: increase number of retries before declaring stall (stable-fixes). - spi: imx: keep dma request disabled before dma transfer setup (stable-fixes). - ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series (stable-fixes). - Bluetooth: btrtl: Avoid loading the config file on security chips (stable-fixes). - media: amphion: Make some vpu_v4l2 functions static (stable-fixes). - usb: dwc2: disable platform lowlevel hw resources during shutdown (stable-fixes). - media: amphion: Add a frame flush mode for decoder (stable-fixes). - usb: ohci-nxp: Use helper function devm_clk_get_enabled() (stable-fixes). - drm/tilcdc: request and mapp iomem with devres (stable-fixes). - media: verisilicon: g2: Use common helpers to compute chroma and mv offsets (stable-fixes). - media: verisilicon: Store chroma and motion vectors offset (stable-fixes). - i3c: master: Inherit DMA masks and parameters from parent device (stable-fixes). - commit bc3be49 - supported.conf: mark ksmbd unsupported Based on discussion with Enzo Matsumiya it has tuned out that ksmbd module is unsupported but the supported.conf entry is incorrect. Fix that. - commit c800e3f - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (bsc#1253262 ltc#216029). - commit daa4104 - Update patches.suse/1260-drm-amdkfd-Add-missing-gfx11-MQD-manager-callbacks.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-54261 bsc#1255879). - Update patches.suse/ACPI-video-Fix-use-after-free-in-acpi_video_switch_b.patch (git-fixes CVE-2025-40211 bsc#1254126). - Update patches.suse/ALSA-dice-fix-buffer-overflow-in-detect_stream_forma.patch (git-fixes CVE-2025-68346 bsc#1255603). - Update patches.suse/ALSA-firewire-motu-add-bounds-check-in-put_user-loop.patch (git-fixes CVE-2025-68753 bsc#1256238). - Update patches.suse/ALSA-firewire-motu-fix-buffer-overflow-in-hwdep-read.patch (git-fixes CVE-2025-68347 bsc#1255706). - Update patches.suse/ALSA-hda-cs35l41-Fix-NULL-pointer-dereference-in-cs3-c34b04c.patch (git-fixes CVE-2025-68345 bsc#1255601). - Update patches.suse/ALSA-pcm-Fix-potential-data-race-at-PCM-memory-.patch (bsc#1012628 CVE-2023-54072 bsc#1256291). - Update patches.suse/ALSA-usb-audio-Fix-NULL-pointer-dereference-in-snd_u.patch (git-fixes CVE-2025-40275 bsc#1254829). - Update patches.suse/ALSA-usb-audio-Fix-potential-memory-leaks-at-error-p.patch (jsc#PED-6045 jsc#PED-6036 jsc#PED-6104 jsc#PED-6114 jsc#PED-6067 jsc#PED-6123 CVE-2023-54022 bsc#1255545). - Update patches.suse/ALSA-usb-audio-Fix-potential-overflow-of-PCM-transfe.patch (stable-fixes CVE-2025-40269 bsc#1255035). - Update patches.suse/ASoC-codecs-wcd-mbhc-v2-fix-resource-leaks-on-c.patch (bsc#1012628 CVE-2023-53842 bsc#1254690). - Update patches.suse/Bluetooth-6lowpan-reset-link-local-header-on-ipv6-re.patch (git-fixes CVE-2025-40282 bsc#1254850). - Update patches.suse/Bluetooth-ISO-fix-iso_conn-related-locking-and-.patch (bsc#1012628 CVE-2023-54164 bsc#1256071). - Update patches.suse/Bluetooth-MGMT-cancel-mesh-send-timer-when-hdev-remo.patch (git-fixes CVE-2025-40284 bsc#1254860). - Update patches.suse/Bluetooth-SCO-Fix-UAF-on-sco_conn_free.patch (stable-fixes CVE-2025-40309 bsc#1255065). - Update patches.suse/Bluetooth-bcsp-receive-data-only-if-registered.patch (stable-fixes CVE-2025-40308 bsc#1255064). - Update patches.suse/Bluetooth-btusb-reorder-cleanup-in-btusb_disconnect-.patch (git-fixes CVE-2025-40283 bsc#1254858). - Update patches.suse/Bluetooth-hci_conn-return-ERR_PTR-instead-of-NU.patch (bsc#1012628 CVE-2023-54038 bsc#1255540). - Update patches.suse/Bluetooth-hci_event-validate-skb-length-for-unknown-.patch (git-fixes CVE-2025-40301 bsc#1255193). - Update patches.suse/Bluetooth-hci_sock-Prevent-race-in-socket-write-iter.patch (git-fixes CVE-2025-68305 bsc#1255169). - Update patches.suse/Bluetooth-hci_sync-Avoid-use-after-free-in-dbg-.patch (bsc#1012628 CVE-2023-54210 bsc#1255955). - Update patches.suse/Bluetooth-hci_sync-Avoid-use-after-free-in-dbg-for-h.patch (git-fixes CVE-2023-53828 bsc#1254623). - Update patches.suse/Bluetooth-hci_sync-Fix-UAF-in-hci_disconnect_all_syn.patch (git-fixes CVE-2023-53762 bsc#1254606). - Update patches.suse/Bluetooth-hci_sync-fix-race-in-hci_cmd_sync_dequeue_.patch (git-fixes CVE-2025-40318 bsc#1254798). - Update patches.suse/FS-JFS-Check-for-read-only-mounted-filesystem-i.patch (bsc#1012628 CVE-2023-53766 bsc#1255005). - Update patches.suse/HID-hidraw-fix-data-race-on-device-refcount.patch (bsc#1012628 CVE-2023-53759 bsc#1254663). - Update patches.suse/HID-uclogic-Correct-devm-device-reference-for-hidinp.patch (git-fixes CVE-2023-54207 bsc#1255961). - Update patches.suse/HID-wacom-Use-ktime_t-rather-than-int-when-deal.patch (bsc#1012628 CVE-2023-53797 bsc#1254733). - Update patches.suse/Input-cros_ec_keyb-fix-an-invalid-memory-access.patch (stable-fixes CVE-2025-40263 bsc#1255077). - Update patches.suse/Input-imx_sc_key-fix-memory-corruption-on-unload.patch (git-fixes CVE-2025-40262 bsc#1254840). - Update patches.suse/Input-pegasus-notetaker-fix-potential-out-of-bounds-.patch (git-fixes CVE-2025-68217 bsc#1255221). - Update patches.suse/KVM-SVM-Get-source-vCPUs-from-source-VM-for-SEV-ES-i.patch (git-fixes CVE-2023-54296 bsc#1255793). - Update patches.suse/KVM-s390-pv-fix-index-value-of-replaced-ASCE.patch (bsc#1012628 CVE-2023-54092 bsc#1256370). - Update patches.suse/MIPS-KVM-Fix-NULL-pointer-dereference.patch (bsc#1012628 CVE-2023-54241 bsc#1255838). - Update patches.suse/NFSD-Fix-crash-in-nfsd4_read_release.patch (git-fixes CVE-2025-40324 bsc#1254791). - Update patches.suse/NFSD-free-copynotify-stateid-in-nfs4_free_ol_stateid.patch (git-fixes CVE-2025-40273 bsc#1254828). - Update patches.suse/PCI-DOE-Fix-destroy_work_on_stack-race.patch (git-fixes CVE-2023-54235 bsc#1255921). - Update patches.suse/PCI-Free-released-resource-after-coalescing.patch (git-fixes CVE-2023-53743 bsc#1254782). - Update patches.suse/PCI-IOV-Add-PCI-rescan-remove-locking-when-enabling-.patch (git-fixes CVE-2025-40219 bsc#1254518). - Update patches.suse/PCI-cadence-Check-for-the-existence-of-cdns_pcie-ops.patch (stable-fixes CVE-2025-68176 bsc#1255329). - Update patches.suse/RDMA-bnxt_re-Prevent-handling-any-completions-a.patch (bsc#1012628 CVE-2023-54048 bsc#1256395). - Update patches.suse/RDMA-efa-Fix-wrong-resources-deallocation-order.patch (git-fixes CVE-2023-54201 bsc#1255964). - Update patches.suse/RDMA-irdma-Fix-data-race-on-CQP-completion-stat.patch (bsc#1012628 CVE-2023-54302 bsc#1255792). - Update patches.suse/RDMA-irdma-Fix-data-race-on-CQP-request-done.patch (bsc#1012628 CVE-2023-54292 bsc#1255800). - Update patches.suse/Revert-IB-isert-Fix-incorrect-release-of-isert-conne.patch (git-fixes CVE-2023-54219 bsc#1256231). - Update patches.suse/accel-habanalabs-support-mapping-cb-with-vmalloc-bac.patch (stable-fixes CVE-2025-40311 bsc#1255068). - Update patches.suse/accel-qaic-Clean-up-integer-overflow-checking-.patch (bsc#1012628 CVE-2023-53778 bsc#1254761). - Update patches.suse/af_unix-Fix-data-race-around-unix_tot_inflight.patch (git-fixes CVE-2023-54006 bsc#1255591). - Update patches.suse/amba-bus-fix-refcount-leak.patch (git-fixes CVE-2023-54230 bsc#1255925). - Update patches.suse/amd-amdkfd-resolve-a-race-in-amdgpu_amdkfd_device_fi.patch (stable-fixes CVE-2025-40310 bsc#1255041). - Update patches.suse/amdgpu-validate-offset_in_bo-of-drm_amdgpu_gem_.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-53819 bsc#1254712). - Update patches.suse/arm64-mm-fix-VA-range-sanity-check.patch (bsc#1012628 CVE-2023-53989 bsc#1256302). - Update patches.suse/arm64-set-__exception_irq_entry-with-__irq_entr.patch (bsc#1012628 CVE-2023-54322 bsc#1255763). - Update patches.suse/atm-fore200e-Fix-possible-data-race-in-fore200e_open.patch (git-fixes CVE-2025-68339 bsc#1255505). - Update patches.suse/audit-fix-possible-soft-lockup-in-__audit_inode_chil.patch (git-fixes CVE-2023-54045 bsc#1256285). - Update patches.suse/autofs-fix-memory-leak-of-waitqueues-in-autofs_catat.patch (git-fixes CVE-2023-54134 bsc#1256106). - Update patches.suse/backlight-led-bl-Add-devlink-to-supplier-LEDs.patch (git-fixes CVE-2025-68758 bsc#1255944). - Update patches.suse/bcache-fixup-btree_cache_wait-list-damage.patch (bsc#1012628 CVE-2023-54293 bsc#1255801). - Update patches.suse/binder-fix-memory-leak-in-binder_init.patch (bsc#1012628 CVE-2023-54005 bsc#1255629). - Update patches.suse/blk-cgroup-Fix-NULL-deref-caused-by-blkg_policy_data-being-installed-before-init.patch (bsc#1216062 CVE-2023-54271 bsc#1255902). - Update patches.suse/blk-cgroup-hold-queue_lock-when-removing-blkg-.patch (bsc#1012628 CVE-2023-54088 bsc#1256263). - Update patches.suse/blk-mq-fix-tags-leak-when-shrink-nr_hw_queues.patch (bsc#1216436 CVE-2023-54227 bsc#1255952). - Update patches.suse/block-fix-blktrace-debugfs-entries-leakage.patch (bsc#1012628 CVE-2023-54209 bsc#1255963). - Update patches.suse/block-rq_qos-protect-rq_qos-apis-with-a-new-loc.patch (bsc#1012628 CVE-2023-53823 bsc#1254691). - Update patches.suse/bpf-Address-KCSAN-report-on-bpf_lru_list.patch (bsc#1012628 CVE-2023-54283 bsc#1255809). - Update patches.suse/bpf-Disable-preemption-in-bpf_event_output.patch (bsc#1012628 CVE-2023-54173 bsc#1255996). - Update patches.suse/bpf-Disable-preemption-in-bpf_perf_event_outpu.patch (bsc#1012628 CVE-2023-54303 bsc#1255785). - Update patches.suse/bpf-Fix-issue-in-verifying-allow_ptr_leaks.patch (jsc#PED-6811 CVE-2023-54181 bsc#1255988). - Update patches.suse/bpf-Silence-a-warning-in-btf_type_id_size.patch (bsc#1012628 CVE-2023-54247 bsc#1255892). - Update patches.suse/bpf-bpf_sk_storage-Fix-invalid-wait-context-lockdep-.patch (jsc#PED-6811 CVE-2023-53857 bsc#1254648). - Update patches.suse/bpf-drop-unnecessary-user-triggerable-WARN_ONCE.patch (bsc#1012628 CVE-2023-54145 bsc#1256090). - Update patches.suse/bpf-sockmap-Fix-skb-refcnt-race-after-locking-change.patch (jsc#PED-6811 CVE-2023-53836 bsc#1254693). - Update patches.suse/btrfs-fix-incorrect-splitting-in-btrfs_drop_ex.patch (bsc#1012628 CVE-2023-54121 bsc#1256267). - Update patches.suse/btrfs-fix-lockdep-splat-and-potential-deadlock-after.patch (git-fixes CVE-2023-54224 bsc#1255951). - Update patches.suse/btrfs-fix-race-between-balance-and-cancel-pause.patch (bsc#1012628 CVE-2023-54023 bsc#1256301). - Update patches.suse/btrfs-fix-race-when-deleting-free-space-root-fr.patch (bsc#1012628 CVE-2023-54067 bsc#1256369). - Update patches.suse/btrfs-fix-race-when-deleting-quota-root-from-th.patch (bsc#1012628 CVE-2023-54032 bsc#1255617). - Update patches.suse/btrfs-fix-warning-when-putting-transaction-with.patch (bsc#1012628 CVE-2023-53865 bsc#1254762). - Update patches.suse/btrfs-release-path-before-inode-lookup-during-the-in.patch (git-fixes CVE-2023-54281 bsc#1255820). - Update patches.suse/btrfs-remove-BUG_ON-s-in-add_new_free_space.patch (bsc#1012628 CVE-2023-54185 bsc#1255984). - Update patches.suse/btrfs-set-page-extent-mapped-after-read_folio-in-rel.patch (git-fixes CVE-2023-54253 bsc#1255891). - Update patches.suse/btrfs-zoned-fix-memory-leak-after-finding-block.patch (bsc#1012628 CVE-2023-54297 bsc#1255795). - Update patches.suse/btrfs-zoned-skip-splitting-and-logical-rewriting-on-.patch (bsc#1223731 CVE-2024-26944 CVE-2023-54080 bsc#1256367). - Update patches.suse/can-gs_usb-gs_usb_xmit_callback-fix-handling-of-fail.patch (git-fixes CVE-2025-68307 bsc#1255146). - Update patches.suse/can-kvaser_usb-leaf-Fix-potential-infinite-loop-in-c.patch (git-fixes CVE-2025-68308 bsc#1255149). - Update patches.suse/cifs-fix-potential-oops-in-cifs_oplock_break.patch (bsc#1012628 CVE-2023-54258 bsc#1255886). - Update patches.suse/cifs-fix-session-state-check-in-reconnect-to-a.patch (bsc#1012628 CVE-2023-53794 bsc#1255163). - Update patches.suse/clk-clocking-wizard-Fix-Oops-in-clk_wzrd_regist.patch (bsc#1012628 CVE-2023-53807 bsc#1254724). - Update patches.suse/clk-imx93-fix-memory-leak-and-missing-unwind-go.patch (bsc#1012628 CVE-2023-54221 bsc#1255842). - Update patches.suse/comedi-c6xdigio-Fix-invalid-PNP-driver-unregistratio.patch (git-fixes CVE-2025-68332 bsc#1255483). - Update patches.suse/comedi-check-device-s-attached-status-in-compat-ioct.patch (git-fixes CVE-2025-68257 bsc#1255167). - Update patches.suse/comedi-multiq3-sanitize-config-options-in-multiq3_at.patch (git-fixes CVE-2025-68258 bsc#1255182). - Update patches.suse/comedi-pcl818-fix-null-ptr-deref-in-pcl818_ai_cancel.patch (git-fixes CVE-2025-68335 bsc#1255480). - Update patches.suse/crypto-api-Use-work-queue-in-crypto_destroy_instance.patch (git-fixes CVE-2023-53799 bsc#1254732). - Update patches.suse/crypto-aspeed-fix-double-free-caused-by-devm.patch (git-fixes CVE-2025-68172 bsc#1255253). - Update patches.suse/crypto-asymmetric_keys-prevent-overflow-in-asymmetri.patch (git-fixes CVE-2025-68724 bsc#1255550). - Update patches.suse/dccp-Fix-out-of-bounds-access-in-DCCP-error-handler.patch (bsc#1220419 CVE-2023-53782 bsc#1254758). - Update patches.suse/dccp-fix-data-race-around-dp-dccps_mss_cache.patch (bsc#1012628 CVE-2023-53839 bsc#1254655). - Update patches.suse/devlink-report-devlink_port_type_warn-source-de.patch (bsc#1012628 CVE-2023-53841 bsc#1255009). - Update patches.suse/dm-don-t-attempt-to-queue-IO-under-RCU-protection-a9ce.patch (jsc#PED-7514 CVE-2023-53860 bsc#1254626). - Update patches.suse/dm-fix-a-race-condition-in-retrieve_deps-f600.patch (jsc#PED-7514 CVE-2023-54324 bsc#1255759). - Update patches.suse/driver-soc-xilinx-use-_safe-loop-iterator-to-av.patch (bsc#1012628 CVE-2023-54101 bsc#1256153). - Update patches.suse/drm-amd-display-Check-NULL-before-accessing.patch (stable-fixes CVE-2025-68286 bsc#1255351). - Update patches.suse/drm-amd-display-Fix-NULL-deref-in-debugfs-odm_combin.patch (git-fixes CVE-2025-68180 bsc#1255252). - Update patches.suse/drm-amdgpu-Fix-NULL-pointer-dereference-in-VRAM-logi.patch (stable-fixes CVE-2025-40288 bsc#1255057). - Update patches.suse/drm-bridge-dw_hdmi-fix-connector-access-for-scd.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-53784 bsc#1254765). - Update patches.suse/drm-client-Fix-memory-leak-in-drm_client_target.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-54091 bsc#1256274). - Update patches.suse/drm-i915-Avoid-lock-inversion-when-pinning-to-GGTT-o.patch (git-fixes CVE-2025-68244 bsc#1255190). - Update patches.suse/drm-mediatek-Fix-device-use-after-free-on-unbind.patch (git-fixes CVE-2025-40316 bsc#1254797). - Update patches.suse/drm-msm-dp-Drop-aux-devices-together-with-DP-co.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-53851 bsc#1254695). - Update patches.suse/drm-mxsfb-Disable-overlay-plane-in-mxsfb_plane_overl.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-53864 bsc#1254754). - Update patches.suse/drm-nouveau-kms-nv50-init-hpd_irq_lock-for-PIOR.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-54263 bsc#1255883). - Update patches.suse/drm-sched-Fix-deadlock-in-drm_sched_entity_kill_jobs.patch (git-fixes CVE-2025-40329 bsc#1254621). - Update patches.suse/drm-tegra-Add-call-to-put_pid.patch (git-fixes CVE-2025-68233 bsc#1255206). - Update patches.suse/drm-ttm-Don-t-leak-a-resource-on-eviction-error.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-54254 bsc#1255890). - Update patches.suse/drm-ttm-Don-t-leak-a-resource-on-swapout-move-e.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-53844 bsc#1254649). - Update patches.suse/drm-vgem-fence-Fix-potential-deadlock-on-release.patch (git-fixes CVE-2025-68757 bsc#1255943). - Update patches.suse/drm-vmwgfx-Validate-command-header-size-against-SVGA.patch (git-fixes CVE-2025-40277 bsc#1254894). - Update patches.suse/erofs-kill-hooked-chains-to-avoid-loops-on-dedu.patch (bsc#1012628 CVE-2023-53777 bsc#1254749). - Update patches.suse/exfat-use-kvmalloc_array-kvfree-instead-of-kma.patch (bsc#1012628 CVE-2023-54194 bsc#1255974). - Update patches.suse/ext4-correct-grp-validation-in-ext4_mb_good_group.patch (bsc#1234163 CVE-2023-53861 bsc#1254678). - Update patches.suse/ext4-fix-BUG-in-ext4_mb_new_inode_pa-due-to-overflow.patch (bsc#1219165 CVE-2023-54069 bsc#1256371). - Update patches.suse/ext4-fix-rbtree-traversal-bug-in-ext4_mb_use_pr.patch (bsc#1012628 CVE-2023-53813 bsc#1254717). - Update patches.suse/ext4-turn-quotas-off-if-mount-failed-after-enab.patch (bsc#1012628 CVE-2023-54153 bsc#1256081). - Update patches.suse/f2fs-fix-to-do-sanity-check-on-direct-node-in-.patch (bsc#1012628 CVE-2023-53846 bsc#1254983). - Update patches.suse/fbcon-Set-fb_display-i-mode-to-NULL-when-the-mode-is.patch (stable-fixes CVE-2025-40323 bsc#1255094). - Update patches.suse/fbdev-Add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch (stable-fixes CVE-2025-40304 bsc#1255034). - Update patches.suse/fbdev-bitblit-bound-check-glyph-index-in-bit_putcs.patch (stable-fixes CVE-2025-40322 bsc#1255092). - Update patches.suse/firmware-meson_sm-fix-to-avoid-potential-NULL-pointe.patch (git-fixes CVE-2023-54304 bsc#1255786). - Update patches.suse/firmware-stratix10-svc-fix-bug-in-saving-controller-.patch (git-fixes CVE-2025-68328 bsc#1255489). - Update patches.suse/fs-Protect-reconfiguration-of-sb-read-write-fr.patch (bsc#1012628 CVE-2023-54099 bsc#1256197). - Update patches.suse/fs-jfs-prevent-double-free-in-dbUnmount-after-failed-jfs_remount.patch (git-fixes CVE-2023-54127 bsc#1256119). - Update patches.suse/fs-ntfs3-Return-error-for-inconsistent-extende.patch (bsc#1012628 CVE-2023-54125 bsc#1256117). - Update patches.suse/fs-sysv-Null-check-to-prevent-null-ptr-deref-b.patch (bsc#1012628 CVE-2023-54264 bsc#1255872). - Update patches.suse/gpu-host1x-Fix-race-in-syncpt-alloc-free.patch (git-fixes CVE-2025-68732 bsc#1255688). - Update patches.suse/gtp-Fix-use-after-free-in-__gtp_encap_destroy.patch (bsc#1012628 CVE-2023-54142 bsc#1256095). - Update patches.suse/hfs-validate-record-offset-in-hfsplus_bmap_alloc.patch (git-fixes CVE-2025-40349 bsc#1255280). - Update patches.suse/hfsplus-fix-KMSAN-uninit-value-issue-in-__hfsplus_ext_cache_extent.patch (git-fixes CVE-2025-40244 bsc#1255033). - Update patches.suse/hfsplus-fix-KMSAN-uninit-value-issue-in-hfsplus_delete_cat.patch (git-fixes CVE-2025-40351 bsc#1255281). - Update patches.suse/hwrng-virtio-Fix-race-on-data_avail-and-actual-.patch (bsc#1012628 CVE-2023-53998 bsc#1255578). - Update patches.suse/iavf-use-internal-state-to-free-traffic-IRQs.patch (bsc#1012628 CVE-2023-53850 bsc#1254677). - Update patches.suse/ice-prevent-NULL-pointer-deref-during-reload.patch (bsc#1012628 CVE-2023-54037 bsc#1255557). - Update patches.suse/igb-clean-up-in-all-error-paths-when-enabling-SR-IOV.patch (jsc#PED-4866 CVE-2023-54070 bsc#1256364). - Update patches.suse/igc-Fix-Kernel-Panic-during-ndo_tx_timeout-call.patch (bsc#1012628 CVE-2023-54166 bsc#1256074). - Update patches.suse/iio-accel-bmc150-Fix-irq-assumption-regression.patch (stable-fixes CVE-2025-68330 bsc#1255493). - Update patches.suse/iio-adc-ina2xx-avoid-NULL-pointer-dereference-.patch (bsc#1012628 CVE-2023-53834 bsc#1254660). - Update patches.suse/iio-core-Prevent-invalid-memory-access-when-th.patch (bsc#1012628 CVE-2023-54027 bsc#1255579). - Update patches.suse/ima-Handle-error-code-returned-by-ima_filter_rule_ma.patch (git-fixes CVE-2025-68740 bsc#1255812). - Update patches.suse/ima-don-t-clear-IMA_DIGSIG-flag-when-setting-or-remo.patch (stable-fixes CVE-2025-68183 bsc#1255251). - Update patches.suse/io_uring-net-don-t-overflow-multishot-recv.patch (bsc#1215211 CVE-2023-54030 bsc#1255691). - Update patches.suse/iomap-Fix-possible-overflow-condition-in-iomap_write_delalloc_scan.patch (jsc#PED-5453 CVE-2023-54285 bsc#1255807). - Update patches.suse/iommufd-IOMMUFD_DESTROY-should-not-increase-the.patch (bsc#1012628 CVE-2023-53795 bsc#1254737). - Update patches.suse/iommufd-Set-end-correctly-when-doing-batch-carr.patch (bsc#1012628 CVE-2023-54060 bsc#1256379). - Update patches.suse/ionic-remove-WARN_ON-to-prevent-panic_on_warn.patch (bsc#1012628 CVE-2023-53994 bsc#1255570). - Update patches.suse/ip6_vti-fix-slab-use-after-free-in-decode_sess.patch (bsc#1012628 CVE-2023-53821 bsc#1254669). - Update patches.suse/ipmi-ssif-Fix-a-memory-leak-when-scanning-for-an-ada.patch (git-fixes CVE-2023-54064 bsc#1256375). - Update patches.suse/irqchip-mchp-eic-Fix-error-code-in-mchp_eic_domain_a.patch (git-fixes CVE-2025-68766 bsc#1255932). - Update patches.suse/isdn-mISDN-hfcsusb-fix-memory-leak-in-hfcsusb_probe.patch (git-fixes CVE-2025-68734 bsc#1255538). - Update patches.suse/jfs-Verify-inode-mode-when-loading-from-disk.patch (git-fixes CVE-2025-40312 bsc#1255046). - Update patches.suse/jfs-fix-uninitialized-waitqueue-in-transaction-manager.patch (git-fixes CVE-2025-68168 bsc#1255100). - Update patches.suse/kcm-Fix-error-handling-for-SOCK_DGRAM-in-kcm_sendmsg.patch (bsc#1220419 CVE-2023-53825 bsc#1254707). - Update patches.suse/kcm-Fix-memory-leak-in-error-path-of-kcm_sendmsg.patch (bsc#1220419 CVE-2023-54112 bsc#1256354). - Update patches.suse/keys-Fix-linking-a-duplicate-key-to-a-keyring-s.patch (bsc#1012628 CVE-2023-54170 bsc#1256045). - Update patches.suse/maple_tree-fix-potential-out-of-bounds-access-i.patch (bsc#1012628 CVE-2023-54135 bsc#1256107). - Update patches.suse/md-fix-warning-for-holder-mismatch-from-export_rdev.patch (git-fixes CVE-2023-53791 bsc#1254742). - Update patches.suse/md-raid5-cache-fix-a-deadlock-in-r5l_exit_log-a705.patch (jsc#PED-7542 CVE-2023-53848 bsc#1254753). - Update patches.suse/media-af9005-Fix-null-ptr-deref-in-af9005_i2c_xfer.patch (git-fixes CVE-2023-54314 bsc#1255776). - Update patches.suse/media-anysee-fix-null-ptr-deref-in-anysee_master_xfe.patch (git-fixes CVE-2023-54093 bsc#1256273). - Update patches.suse/media-dvb-usb-m920x-Fix-a-potential-memory-leak-in-m.patch (git-fixes CVE-2023-54266 bsc#1255875). - Update patches.suse/media-dvb-usb-v2-gl861-Fix-null-ptr-deref-in-gl861_i.patch (git-fixes CVE-2023-54066 bsc#1256373). - Update patches.suse/media-imon-make-send_packet-more-robust.patch (stable-fixes CVE-2025-68194 bsc#1255325). - Update patches.suse/media-mediatek-vcodec-fix-resource-leaks-in-vdec_msg.patch (git-fixes CVE-2023-54143 bsc#1256096). - Update patches.suse/media-tuners-qt1010-replace-BUG_ON-with-a-regular-er.patch (git-fixes CVE-2023-54282 bsc#1255810). - Update patches.suse/media-v4l2-core-Fix-a-potential-resource-leak-in-v4l.patch (git-fixes CVE-2023-54183 bsc#1255990). - Update patches.suse/misc-fastrpc-Fix-dma_buf-object-leak-in-fastrpc_map_.patch (git-fixes CVE-2025-68252 bsc#1255197). - Update patches.suse/misc-pci_endpoint_test-Free-IRQs-before-removin.patch (bsc#1012628 CVE-2023-54326 bsc#1255758). - Update patches.suse/mm-secretmem-fix-use-after-free-race-in-fault-handle.patch (git-fixes CVE-2025-40272 bsc#1254832). - Update patches.suse/mmc-sunplus-fix-return-value-check-of-mmc_add_.patch (bsc#1012628 CVE-2023-54204 bsc#1255967). - Update patches.suse/most-usb-Fix-use-after-free-in-hdm_disconnect.patch (git-fixes CVE-2025-40223 bsc#1254957). - Update patches.suse/most-usb-fix-double-free-on-late-probe-failure.patch (git-fixes CVE-2025-68290 bsc#1255154). - Update patches.suse/most-usb-hdm_probe-Fix-calling-put_device-before-dev.patch (git-fixes CVE-2025-68249 bsc#1255233). - Update patches.suse/mt76-mt7615-Fix-memory-leak-in-mt7615_mcu_wtbl_sta_a.patch (git-fixes CVE-2025-68765 bsc#1255931). - Update patches.suse/mt76-mt7921-don-t-assume-adequate-headroom-for-SDIO-.patch (git-fixes CVE-2023-53785 bsc#1254918). - Update patches.suse/mtd-rawnand-cadence-fix-DMA-device-NULL-pointer-dere.patch (git-fixes CVE-2025-68238 bsc#1255202). - Update patches.suse/mtd-rawnand-fsl_upm-Fix-an-off-by-one-test-in-.patch (bsc#1012628 CVE-2023-54104 bsc#1256145). - Update patches.suse/mtdchar-fix-integer-overflow-in-read-write-ioctls.patch (git-fixes CVE-2025-68237 bsc#1255203). - Update patches.suse/net-core-remove-unnecessary-frame_sz-check-in-.patch (bsc#1012628 CVE-2023-54155 bsc#1256083). - Update patches.suse/net-deal-with-integer-overflows-in-kmalloc_reserve.patch (bsc#1215146 CVE-2023-42752 CVE-2023-53752 bsc#1254613). - Update patches.suse/net-do-not-allow-gso_size-to-be-set-to-GSO_BY_.patch (bsc#1012628 CVE-2023-54051 bsc#1256394). - Update patches.suse/net-dsa-avoid-suspicious-RCU-usage-for-synced-V.patch (bsc#1012628 CVE-2023-54149 bsc#1256085). - Update patches.suse/net-dsa-ocelot-call-dsa_tag_8021q_unregister-u.patch (bsc#1012628 CVE-2023-53855 bsc#1254688). - Update patches.suse/net-ethernet-mtk_eth_soc-fix-possible-NULL-pointer-d.patch (git-fixes CVE-2023-54240 bsc#1255918). - Update patches.suse/net-hns3-fix-deadlock-issue-when-externel_lb-a.patch (bsc#1012628 CVE-2023-54000 bsc#1255564). - Update patches.suse/net-ipa-only-reset-hashed-tables-when-supported.patch (bsc#1012628 CVE-2023-54225 bsc#1256234). - Update patches.suse/net-ipv4-fix-one-memleak-in-__inet_del_ifa.patch (bsc#1220419 CVE-2023-53995 bsc#1255616). - Update patches.suse/net-mlx5-fix-potential-memory-leak-in-mlx5e_in.patch (bsc#1012628 CVE-2023-54106 bsc#1256358). - Update patches.suse/net-mlx5e-Move-representor-neigh-cleanup-to-pr.patch (bsc#1012628 CVE-2023-54148 bsc#1256084). - Update patches.suse/net-mlx5e-TC-Fix-internal-port-memory-leak.patch (bsc#1012628 CVE-2023-53999 bsc#1255621). - Update patches.suse/net-mlx5e-fix-memory-leak-in-mlx5e_ptp_open.patch (bsc#1012628 CVE-2023-54169 bsc#1256050). - Update patches.suse/net-mlx5e-xsk-Fix-invalid-buffer-access-for-le.patch (bsc#1012628 CVE-2023-54223 bsc#1256233). - Update patches.suse/net-openvswitch-reject-negative-ifindex.patch (bsc#1012628 CVE-2023-53843 bsc#1254705). - Update patches.suse/net-prevent-skb-corruption-on-frag-list-segment.patch (bsc#1012628 CVE-2023-54094 bsc#1256292). - Update patches.suse/net-read-sk-sk_family-once-in-sk_mc_loop.patch (bsc#1220419 CVE-2023-53831 bsc#1254701). - Update patches.suse/net-sched-taprio-Limit-TCA_TAPRIO_ATTR_SCHED_C.patch (bsc#1012628 CVE-2023-54251 bsc#1255888). - Update patches.suse/net-smc-use-smc_lgr_list.lock-to-protect-smc_lgr_lis.patch (git-fixes CVE-2023-54318 bsc#1255772). - Update patches.suse/net-usb-qmi_wwan-initialize-MAC-header-offset-in-qmi.patch (git-fixes CVE-2025-68192 bsc#1255246). - Update patches.suse/netfilter-nf_tables-fix-underflow-in-chain-refe.patch (bsc#1012628 CVE-2023-54035 bsc#1255563). - Update patches.suse/netlink-do-not-hard-code-device-address-lenth-i.patch (bsc#1012628 CVE-2023-53863 bsc#1254657). - Update patches.suse/nfp-clean-mc-addresses-in-application-firmware-.patch (bsc#1012628 CVE-2023-54133 bsc#1256104). - Update patches.suse/nfs4_setup_readdir-insufficient-locking-for-d_parent-d_inode-dereferencing.patch (git-fixes CVE-2025-68185 bsc#1255135). - Update patches.suse/nfsd-move-init-of-percpu-reply_cache_stats-coun.patch (bsc#1012628 CVE-2023-54276 bsc#1255907). - Update patches.suse/nilfs2-fix-WARNING-in-mark_buffer_dirty-due-to.patch (bsc#1012628 CVE-2023-54140 bsc#1256093). - Update patches.suse/nouveau-firmware-Add-missing-kfree-of-nvkm_falcon_fw.patch (git-fixes CVE-2025-68235 bsc#1255209). - Update patches.suse/nvme-core-fix-memory-leak-in-dhchap_ctrl_secret.patch (bsc#1012628 CVE-2023-53792 bsc#1254743). - Update patches.suse/nvme-core-fix-memory-leak-in-dhchap_secret_stor.patch (bsc#1012628 CVE-2023-53852 bsc#1254653). - Update patches.suse/nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch (bsc#1245193 bsc#1247500 CVE-2025-40342 bsc#1255274). - Update patches.suse/nvme-multipath-fix-lockdep-WARN-due-to-partition-sca.patch (git-fixes bsc#1233640 CVE-2024-53093 CVE-2025-68218 bsc#1255245). - Update patches.suse/nvmet-fc-avoid-scheduling-association-deletion-twice.patch (bsc#1245193 bsc#1247500 CVE-2025-40343 bsc#1255276). - Update patches.suse/of-overlay-Call-of_changeset_init-early.patch (git-fixes CVE-2023-53856 bsc#1254661). - Update patches.suse/of-unittest-fix-null-pointer-dereferencing-in-of_uni.patch (git-fixes CVE-2023-54178 bsc#1255992). - Update patches.suse/opp-Fix-use-after-free-in-lazy_opp_tables-after.patch (bsc#1012628 CVE-2023-54026 bsc#1255549). - Update patches.suse/orangefs-fix-xattr-related-buffer-overflow.patch (git-fixes CVE-2025-40306 bsc#1255062). - Update patches.suse/ovl-fix-null-pointer-dereference-in-ovl_get_acl.patch (bsc#1012628 CVE-2023-54313 bsc#1255775). - Update patches.suse/pcmcia-rsrc_nonstatic-Fix-memory-leak-in-nonst.patch (bsc#1012628 CVE-2023-54115 bsc#1256121). - Update patches.suse/perf-tool-x86-Fix-perf_env-memory-leak.patch (bsc#1012628 CVE-2023-53793 bsc#1254739). - Update patches.suse/phy-tegra-xusb-Clear-the-driver-reference-in-us.patch (bsc#1012628 CVE-2023-54083 bsc#1256368). - Update patches.suse/pinctrl-at91-pio4-check-return-value-of-devm_ka.patch (bsc#1012628 CVE-2023-54319 bsc#1255760). - Update patches.suse/pinctrl-freescale-Fix-a-memory-out-of-bounds-wh.patch (bsc#1012628 CVE-2023-53750 bsc#1254611). - Update patches.suse/pinctrl-s32cc-fix-uninitialized-memory-in-s32_pinctr.patch (git-fixes CVE-2025-68222 bsc#1255218). - Update patches.suse/platform-x86-intel-punit_ipc-fix-memory-corruption.patch (git-fixes CVE-2025-68303 bsc#1255122). - Update patches.suse/posix-timers-Prevent-RT-livelock-in-itimer_dele.patch (bsc#1012628 CVE-2023-53815 bsc#1254715). - Update patches.suse/powerpc-64s-Fix-VAS-mm-use-after-free.patch (bsc#1012628 CVE-2023-54042 bsc#1255702). - Update patches.suse/powerpc-iommu-Fix-notifiers-being-shared-by-PCI-and-.patch (bsc#1065729 CVE-2023-54095 bsc#1256271). - Update patches.suse/powerpc-powernv-sriov-perform-null-check-on-iov.patch (bsc#1012628 CVE-2023-54315 bsc#1255769). - Update patches.suse/powerpc-pseries-Rework-lppaca_shared_proc-to-avoid-D.patch (bsc#1194869 CVE-2023-54267 bsc#1255899). - Update patches.suse/powerpc-pseries-fix-possible-memory-leak-in-ibmebus_.patch (bsc#1194869 CVE-2023-54017 bsc#1255605). - Update patches.suse/pstore-ram-Add-check-for-kstrdup.patch (bsc#1012628 CVE-2023-54189 bsc#1255978). - Update patches.suse/quota-fix-warning-in-dqgrab.patch (bsc#1012628 CVE-2023-54177 bsc#1255993). - Update patches.suse/rcu-dump-vmalloc-memory-info-safely.patch (git-fixes CVE-2023-54113 bsc#1256351). - Update patches.suse/rcuscale-Move-rcu_scale_writer-schedule_timeout_unin.patch (git-fixes CVE-2023-54246 bsc#1255915). - Update patches.suse/refscale-Fix-uninitalized-use-of-wait_queue_head_t.patch (git-fixes CVE-2023-54316 bsc#1255770). - Update patches.suse/regmap-irq-Fix-out-of-bounds-access-when-alloca.patch (bsc#1012628 CVE-2023-53768 bsc#1254599). - Update patches.suse/regmap-slimbus-fix-bus_context-pointer-in-regmap-ini.patch (git-fixes CVE-2025-40317 bsc#1254796). - Update patches.suse/regulator-core-Protect-regulator_supply_alias_list-w.patch (git-fixes CVE-2025-68354 bsc#1255553). - Update patches.suse/regulator-da9063-fix-null-pointer-deref-with-pa.patch (bsc#1012628 CVE-2023-53787 bsc#1254750). - Update patches.suse/rpmsg-glink-Add-check-for-kstrdup.patch (git-fixes CVE-2023-54049 bsc#1256396). - Update patches.suse/s390-dcssblk-fix-kernel-crash-with-list_add-corruption.patch (git-fixes bsc#1215344 CVE-2023-54117 bsc#1256348). - Update patches.suse/s390-vmem-split-pages-when-debug-pagealloc-is-.patch (bsc#1012628 CVE-2023-54278 bsc#1255911). - Update patches.suse/samples-bpf-Fix-buffer-overflow-in-tcp_basertt.patch (bsc#1012628 CVE-2023-54312 bsc#1255774). - Update patches.suse/sched-psi-use-kernfs-polling-functions-for-PSI-.patch (bsc#1012628 CVE-2023-54019 bsc#1255636). - Update patches.suse/scsi-qedf-Fix-NULL-dereference-in-error-handlin.patch (bsc#1012628 CVE-2023-54289 bsc#1255806). - Update patches.suse/scsi-qla2xxx-Array-index-may-go-out-of-bound.patch (bsc#1012628 CVE-2023-54179 bsc#1255994). - Update patches.suse/scsi-qla2xxx-Check-valid-rport-returned-by-fc_b.patch (bsc#1012628 CVE-2023-54014 bsc#1256300). - Update patches.suse/scsi-target-core-Fix-target_cmd_counter-leak.patch (bsc#1214847 CVE-2023-54154 bsc#1256082). - Update patches.suse/serial-8250-Fix-oops-for-port-pm-on-uart_chang.patch (bsc#1012628 CVE-2023-54220 bsc#1255949). - Update patches.suse/serial-sprd-Fix-DMA-buffer-leak-issue.patch (git-fixes CVE-2023-54136 bsc#1256099). - Update patches.suse/sfc-fix-crash-when-reading-stats-while-NIC-is-r.patch (bsc#1012628 CVE-2023-54156 bsc#1255704). - Update patches.suse/sh-dma-Fix-DMA-channel-offset-calculation.patch (bsc#1012628 CVE-2023-54255 bsc#1255884). - Update patches.suse/smb-client-fix-missed-ses-refcounting.patch (bsc#1012628 CVE-2023-54076 bsc#1256335). - Update patches.suse/smb-client-fix-potential-cfid-UAF-in-smb2_query_info_compound.patch (bsc#1248886 CVE-2025-40320 bsc#1254793). - Update patches.suse/soundwire-fix-enumeration-completion.patch (bsc#1012628 CVE-2023-54096 bsc#1256178). - Update patches.suse/spi-tegra210-quad-Fix-timeout-handling.patch (bsc#1253155 CVE-2025-68746 bsc#1255722). - Update patches.suse/staging-r8712-Fix-memory-leak-in-_r8712_init_xm.patch (bsc#1012628 CVE-2023-54001 bsc#1255628). - Update patches.suse/thermal-of-fix-double-free-on-unregistration.patch (bsc#1012628 CVE-2023-53997 bsc#1255632). - Update patches.suse/tpm-tpm_vtpm_proxy-fix-a-race-condition-in-dev-.patch (bsc#1012628 CVE-2023-54309 bsc#1255780). - Update patches.suse/tracing-Fix-memory-leak-of-iter-temp-when-readi.patch (bsc#1012628 CVE-2023-54171 bsc#1256034). - Update patches.suse/tracing-Fix-warning-in-trace_buffered_event_dis.patch (bsc#1012628 CVE-2023-54211 bsc#1255843). - Update patches.suse/tty-serial-samsung_tty-Fix-a-memory-leak-in-s3c.patch (bsc#1012628 CVE-2023-53858 bsc#1254704). - Update patches.suse/usb-cdns3-gadget-Use-after-free-during-failed-initia.patch (stable-fixes CVE-2025-40314 bsc#1255072). - Update patches.suse/usb-dwc3-Fix-race-condition-between-concurrent-dwc3_.patch (git-fixes CVE-2025-68287 bsc#1255152). - Update patches.suse/usb-gadget-f_eem-Fix-memory-leak-in-eem_unwrap.patch (git-fixes CVE-2025-68289 bsc#1255155). - Update patches.suse/usb-gadget-f_fs-Fix-epfile-null-pointer-access-after.patch (stable-fixes CVE-2025-40315 bsc#1255083). - Update patches.suse/usb-potential-integer-overflow-in-usbg_make_tpg.patch (stable-fixes CVE-2025-68750 bsc#1255814). - Update patches.suse/usb-storage-alauda-Fix-uninit-value-in-alauda_.patch (bsc#1012628 CVE-2023-53847 bsc#1254698). - Update patches.suse/usb-storage-sddr55-Reject-out-of-bound-new_pba.patch (stable-fixes CVE-2025-40345 bsc#1255279). - Update patches.suse/usb-typec-bus-verify-partner-exists-in-typec_altmode.patch (git-fixes CVE-2023-54299 bsc#1255789). - Update patches.suse/usb-uas-fix-urb-unmapping-issue-when-the-uas-device-.patch (git-fixes CVE-2025-68331 bsc#1255495). - Update patches.suse/usbnet-Prevents-free-active-kevent.patch (git-fixes CVE-2025-68312 bsc#1255171). - Update patches.suse/vdpa-Add-queue-index-attr-to-vdpa_nl_policy-fo.patch (bsc#1012628 CVE-2023-54031 bsc#1255583). - Update patches.suse/vduse-fix-NULL-pointer-dereference.patch (bsc#1012628 CVE-2023-54291 bsc#1255798). - Update patches.suse/vfio-type1-fix-cap_migration-information-leak (jsc#PED-7779 jsc#PED-7780 CVE-2023-54137 bsc#1256100). - Update patches.suse/virtio-vdpa-Fix-cpumask-memory-leak-in-virtio_.patch (bsc#1012628 CVE-2023-54215 bsc#1255957). - Update patches.suse/virtio_pmem-add-the-missing-REQ_OP_WRITE-for-flush-b.patch (git-fixes CVE-2023-54089 bsc#1256268). - Update patches.suse/virtio_vdpa-build-affinity-masks-conditionally.patch (git-fixes CVE-2023-54008 bsc#1255630). - Update patches.suse/wifi-ath11k-Add-missing-hw_ops-get_ring_selecto.patch (bsc#1012628 CVE-2023-54141 bsc#1256094). - Update patches.suse/wifi-ath11k-fix-peer-HE-MCS-assignment.patch (git-fixes CVE-2025-68380 bsc#1255580). - Update patches.suse/wifi-ath11k-fix-registration-of-6Ghz-only-phy-w.patch (bsc#1012628 CVE-2023-54229 bsc#1255924). - Update patches.suse/wifi-ath12k-Fix-memory-leak-in-rx_desc-and-tx_desc.patch (git-fixes CVE-2023-54016 bsc#1256279). - Update patches.suse/wifi-ath9k-avoid-referencing-uninit-memory-in-a.patch (bsc#1012628 CVE-2023-54300 bsc#1255790). - Update patches.suse/wifi-brcmfmac-fix-crash-while-sending-Action-Frames-.patch (git-fixes CVE-2025-40321 bsc#1254795). - Update patches.suse/wifi-cfg80211-ocb-don-t-leave-if-not-joined.patch (git-fixes CVE-2023-53992 bsc#1256058). - Update patches.suse/wifi-mt76-mt7921-fix-skb-leak-by-txs-missing-i.patch (bsc#1012628 CVE-2023-54052 bsc#1256387). - Update patches.suse/wifi-mwifiex-fix-memory-leak-in-mwifiex_histogram_re.patch (git-fixes CVE-2023-53808 bsc#1254723). - Update patches.suse/wifi-rsi-Do-not-configure-WoWlan-in-shutdown-ho.patch (bsc#1012628 CVE-2023-54025 bsc#1255558). - Update patches.suse/wifi-rtl818x-Fix-potential-memory-leaks-in-rtl8180_i.patch (git-fixes CVE-2025-68759 bsc#1255934). - Update patches.suse/wifi-rtl818x-rtl8187-Fix-potential-buffer-underflow-.patch (git-fixes CVE-2025-68362 bsc#1255611). - Update patches.suse/x86-CPU-AMD-Add-RDSEED-fix-for-Zen5.patch (git-fixes CVE-2025-68313 bsc#1255415). - Update patches.suse/x86-CPU-AMD-Add-missing-terminator-for-zen5_rdseed_microco.patch (git-fixes CVE-2025-68195 bsc#1255259). - Update patches.suse/x86-hyperv-Disable-IBT-when-hypercall-page-lac.patch (bsc#1012628 CVE-2023-54172 bsc#1256033). - Update patches.suse/x86-sev-Make-enc_dec_hypercall-accept-a-size-instead-of-npages (bsc#1214635 CVE-2023-53996 bsc#1255618). - Update patches.suse/xen-speed-up-grant-table-reclaim.patch (bsc#1012628 CVE-2023-54081 bsc#1256361). - Update patches.suse/xfrm-also-call-xfrm_state_delete_tunnel-at-destroy-time-fo.patch (CVE-2025-40215 bsc#1254959 CVE-2025-40256 bsc#1254851). - commit c2db288 - Update patches.suse/exfat-fix-refcount-leak-in-exfat_find.patch (CVE-2025-40287 bsc#1255030 CVE-2025-68351 bsc#1255567). - Update patches.suse/net-enetc-fix-the-deadlock-of-enetc_mdio_lock.patch (CVE-2025-40337 bsc#1255081 CVE-2025-40347 bsc#1255262). - commit 8022326 ++++ net-snmp: - Fix snmptrapd buffer overflow (bsc#1255491, CVE-2025-68615). Add net-snmp-5.9.4-fix-out-of-bounds-trapOid-access.patch ------------------------------------------------------------------ ------------------ 2026-1-11 - Jan 11 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - docs: ABI: sysfs-devices-soc: Fix swapped sample values (git-fixes). - commit 208252e ++++ kernel-rt: - docs: ABI: sysfs-devices-soc: Fix swapped sample values (git-fixes). - commit 208252e ++++ kernel-rt_debug: - docs: ABI: sysfs-devices-soc: Fix swapped sample values (git-fixes). - commit 208252e ++++ util-linux-systemd: - Fix heap buffer overread in setpwnam() when processing 256-byte usernames (bsc#1254666, CVE-2025-14104, util-linux-CVE-2025-14104-1.patch, util-linux-CVE-2025-14104-2.patch). ++++ util-linux: - Fix heap buffer overread in setpwnam() when processing 256-byte usernames (bsc#1254666, CVE-2025-14104, util-linux-CVE-2025-14104-1.patch, util-linux-CVE-2025-14104-2.patch). ++++ libzypp: - zypp.conf: follow the UAPI configuration file specification (PED-14658) In short terms it means we will no longer ship an /etc/zypp/zypp.conf, but store our own defaults in /usr/etc/zypp/zypp.conf. The systems administrator may choose to keep a full copy in /etc/zypp/zypp.conf ignoring our config file settings completely, or - the preferred way - to overwrite specific settings via /etc/zypp/zypp.conf.d/*.conf overlay files. See the ZYPP.CONF(5) man page for details. - cmake: correctly detect rpm6 (fixes #689) - Use 'zypp.tmp' as temp directory component to ease setting up SELinux policies (bsc#1249435) - zyppng: Update Provider to current MediaCurl2 download approach, drop Metalink ( fixes #682 ) - version 17.38.0 (35) ------------------------------------------------------------------ ------------------ 2026-1-10 - Jan 10 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - gpio: rockchip: mark the GPIO controller as sleeping (git-fixes). - drm/pl111: Fix error handling in pl111_amba_probe (git-fixes). - crypto: qat - fix duplicate restarting msg during AER error (git-fixes). - commit db7c5b1 ++++ kernel-rt: - gpio: rockchip: mark the GPIO controller as sleeping (git-fixes). - drm/pl111: Fix error handling in pl111_amba_probe (git-fixes). - crypto: qat - fix duplicate restarting msg during AER error (git-fixes). - commit db7c5b1 ++++ kernel-rt_debug: - gpio: rockchip: mark the GPIO controller as sleeping (git-fixes). - drm/pl111: Fix error handling in pl111_amba_probe (git-fixes). - crypto: qat - fix duplicate restarting msg during AER error (git-fixes). - commit db7c5b1 ------------------------------------------------------------------ ------------------ 2026-1-9 - Jan 9 2026 ------------------- ------------------------------------------------------------------ ++++ python-kiwi: - Fixed ramdisk sysroot generator Do not use a custom _dev name and stick with the UUID representation of the disk image in RAM after deployment. Former versions of udev did not create a by-uuid device representation which now seems to have changed. This then leads to the device name RamDisk_rootfs not being created the and respective .device unit times out. In addition the timer unit for the standard device representation changed to infinity. This fixes bsc#1254116 ++++ kernel-default: - cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082, CVE-2025-40268). - commit 1547549 - ext4: wait for ongoing I/O to complete before freeing blocks (bsc#1256366). - commit 73f54be - selftests/bpf: Add test to verify freeing the special fields in pcpu maps (CVE-2025-68744 bsc#1255709). - commit 7a07150 - bpf: Free special fields when update [lru_,]percpu_hash maps (CVE-2025-68744 bsc#1255709). - commit 5246440 - pmdomain: arm: scmi: Fix genpd leak on provider registration failure (CVE-2025-68204 bsc#1255224). - commit 51ed7f6 - wifi: mac80211: restore non-chanctx injection behaviour (git-fixes). - pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (git-fixes). - wifi: avoid kernel-infoleak from struct iw_point (git-fixes). - atm: Fix dma_free_coherent() size (git-fixes). - net: usb: pegasus: fix memory leak in update_eth_regs_async() (git-fixes). - net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (git-fixes). - HID: quirks: work around VID/PID conflict for appledisplay (git-fixes). - ASoC: sun4i-spdif: Add missing kerneldoc fields for sun4i_spdif_quirks (git-fixes). - ALSA: ac97: fix a double free in snd_ac97_controller_register() (git-fixes). - commit 31818ae - binfmt_misc: restore write access before closing files opened by open_exec() (bsc#1255272 CVE-2025-68239). - commit 40d7043 - fs/proc: fix uaf in proc_readdir_de() (bsc#1255297 CVE-2025-40271). - commit e033d9a - ext4: refresh inline data size before write operations (bsc#1255380 CVE-2025-68264). - commit eb0de51 - ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623 CVE-2025-40190). - commit 7ad9fff - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced (CVE-2025-68259 bsc#1255199). - commit bca135e ++++ kernel-rt: - cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082, CVE-2025-40268). - commit 1547549 - ext4: wait for ongoing I/O to complete before freeing blocks (bsc#1256366). - commit 73f54be - selftests/bpf: Add test to verify freeing the special fields in pcpu maps (CVE-2025-68744 bsc#1255709). - commit 7a07150 - bpf: Free special fields when update [lru_,]percpu_hash maps (CVE-2025-68744 bsc#1255709). - commit 5246440 - pmdomain: arm: scmi: Fix genpd leak on provider registration failure (CVE-2025-68204 bsc#1255224). - commit 51ed7f6 - wifi: mac80211: restore non-chanctx injection behaviour (git-fixes). - pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (git-fixes). - wifi: avoid kernel-infoleak from struct iw_point (git-fixes). - atm: Fix dma_free_coherent() size (git-fixes). - net: usb: pegasus: fix memory leak in update_eth_regs_async() (git-fixes). - net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (git-fixes). - HID: quirks: work around VID/PID conflict for appledisplay (git-fixes). - ASoC: sun4i-spdif: Add missing kerneldoc fields for sun4i_spdif_quirks (git-fixes). - ALSA: ac97: fix a double free in snd_ac97_controller_register() (git-fixes). - commit 31818ae - binfmt_misc: restore write access before closing files opened by open_exec() (bsc#1255272 CVE-2025-68239). - commit 40d7043 - fs/proc: fix uaf in proc_readdir_de() (bsc#1255297 CVE-2025-40271). - commit e033d9a - ext4: refresh inline data size before write operations (bsc#1255380 CVE-2025-68264). - commit eb0de51 - ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623 CVE-2025-40190). - commit 7ad9fff - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced (CVE-2025-68259 bsc#1255199). - commit bca135e ++++ kernel-rt_debug: - cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082, CVE-2025-40268). - commit 1547549 - ext4: wait for ongoing I/O to complete before freeing blocks (bsc#1256366). - commit 73f54be - selftests/bpf: Add test to verify freeing the special fields in pcpu maps (CVE-2025-68744 bsc#1255709). - commit 7a07150 - bpf: Free special fields when update [lru_,]percpu_hash maps (CVE-2025-68744 bsc#1255709). - commit 5246440 - pmdomain: arm: scmi: Fix genpd leak on provider registration failure (CVE-2025-68204 bsc#1255224). - commit 51ed7f6 - wifi: mac80211: restore non-chanctx injection behaviour (git-fixes). - pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (git-fixes). - wifi: avoid kernel-infoleak from struct iw_point (git-fixes). - atm: Fix dma_free_coherent() size (git-fixes). - net: usb: pegasus: fix memory leak in update_eth_regs_async() (git-fixes). - net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (git-fixes). - HID: quirks: work around VID/PID conflict for appledisplay (git-fixes). - ASoC: sun4i-spdif: Add missing kerneldoc fields for sun4i_spdif_quirks (git-fixes). - ALSA: ac97: fix a double free in snd_ac97_controller_register() (git-fixes). - commit 31818ae - binfmt_misc: restore write access before closing files opened by open_exec() (bsc#1255272 CVE-2025-68239). - commit 40d7043 - fs/proc: fix uaf in proc_readdir_de() (bsc#1255297 CVE-2025-40271). - commit e033d9a - ext4: refresh inline data size before write operations (bsc#1255380 CVE-2025-68264). - commit eb0de51 - ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623 CVE-2025-40190). - commit 7ad9fff - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced (CVE-2025-68259 bsc#1255199). - commit bca135e ++++ libtasn1: - Security fix: [bsc#1256341, CVE-2025-13151] * Stack-based buffer overflow. The function asn1_expend_octet_string() fails to validate the size of input data resulting in a buffer overflow. * Add libtasn1-CVE-2025-13151.patch ------------------------------------------------------------------ ------------------ 2026-1-8 - Jan 8 2026 ------------------- ------------------------------------------------------------------ ++++ SL-Micro-release: - fix issue generator.conf bsc#1256098 ++++ gpg2: - Security fix: [bsc#1255715, CVE-2025-68973] (gpg.fail/memcpy) * gpg: Fix possible memory corruption in the armor parser [T7906] * Add gnupg-CVE-2025-68973.patch - Security fix: [bsc#1256246] (gpg.fail/sha1) * gpg: Avoid potential downgrade to SHA1 in 3rd party key signatures [T7904] * Add gnupg-gpg-Avoid-potential-downgrade-to-SHA1-in-3rd-party-keysig.patch - Security fix: [bsc#1256244] (gpg.fail/detached) * gpg: Error out on unverified output for non-detached signatures [T7903] * Add gnupg-gpg-Error-out-on-unverified-output-for-non-detached-signatures.patch - Security fix: [bsc#1256243] * gpg2 agent: Fix a memory leak * Add patch gnupg-agent-memleak.patch - Security fix: [bsc#1256390] (gpg.fail/notdash) * gpg2: Cleartext Signature Forgery in the NotDashEscaped header implementation in GnuPG * Add patch gnupg-notdash-escape.patch ++++ kernel-default: - smb: client: introduce close_cached_dir_locked() (git-fixes). - commit f4f985c - smb: client: fix potential UAF in smb2_close_cached_fid() (CVE-2025-40328 bsc#1254624). - commit e0eb1d9 - cifs: after disabling multichannel, mark tcon for reconnect (git-fixes). - Refresh patches.suse/cifs-cifs_chan_is_iface_active-should-be-called-with-chan_lock-held.patch. - Refresh patches.suse/cifs-handle-cases-where-multiple-sessions-share-connection.patch. - Refresh patches.suse/smb-client-fix-UAF-in-smb2_reconnect_server-.patch. - commit 5105d2e - cifs: fix a pending undercount of srv_count (git-fixes). - Refresh patches.suse/cifs-make-sure-that-channel-scaling-is-done-only-once.patch. - commit f2eddbf - cifs: fix lock ordering while disabling multichannel (git-fixes). - commit 897a8e5 - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (CVE-2025-40346 bsc#1255318) - commit 24256b7 - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (CVE-2025-40278 bsc#1254825). - commit 34ab5ba - bpf: Fix stackmap overflow check in __bpf_get_stackid() (CVE-2025-68378 bsc#1255614). - commit f957faa - bpf: Refactor stack map trace depth calculation into helper function (CVE-2025-68378 bsc#1255614). - commit 89dceec ++++ kernel-rt: - smb: client: introduce close_cached_dir_locked() (git-fixes). - commit f4f985c - smb: client: fix potential UAF in smb2_close_cached_fid() (CVE-2025-40328 bsc#1254624). - commit e0eb1d9 - cifs: after disabling multichannel, mark tcon for reconnect (git-fixes). - Refresh patches.suse/cifs-cifs_chan_is_iface_active-should-be-called-with-chan_lock-held.patch. - Refresh patches.suse/cifs-handle-cases-where-multiple-sessions-share-connection.patch. - Refresh patches.suse/smb-client-fix-UAF-in-smb2_reconnect_server-.patch. - commit 5105d2e - cifs: fix a pending undercount of srv_count (git-fixes). - Refresh patches.suse/cifs-make-sure-that-channel-scaling-is-done-only-once.patch. - commit f2eddbf - cifs: fix lock ordering while disabling multichannel (git-fixes). - commit 897a8e5 - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (CVE-2025-40346 bsc#1255318) - commit 24256b7 - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (CVE-2025-40278 bsc#1254825). - commit 34ab5ba - bpf: Fix stackmap overflow check in __bpf_get_stackid() (CVE-2025-68378 bsc#1255614). - commit f957faa - bpf: Refactor stack map trace depth calculation into helper function (CVE-2025-68378 bsc#1255614). - commit 89dceec ++++ kernel-rt_debug: - smb: client: introduce close_cached_dir_locked() (git-fixes). - commit f4f985c - smb: client: fix potential UAF in smb2_close_cached_fid() (CVE-2025-40328 bsc#1254624). - commit e0eb1d9 - cifs: after disabling multichannel, mark tcon for reconnect (git-fixes). - Refresh patches.suse/cifs-cifs_chan_is_iface_active-should-be-called-with-chan_lock-held.patch. - Refresh patches.suse/cifs-handle-cases-where-multiple-sessions-share-connection.patch. - Refresh patches.suse/smb-client-fix-UAF-in-smb2_reconnect_server-.patch. - commit 5105d2e - cifs: fix a pending undercount of srv_count (git-fixes). - Refresh patches.suse/cifs-make-sure-that-channel-scaling-is-done-only-once.patch. - commit f2eddbf - cifs: fix lock ordering while disabling multichannel (git-fixes). - commit 897a8e5 - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (CVE-2025-40346 bsc#1255318) - commit 24256b7 - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (CVE-2025-40278 bsc#1254825). - commit 34ab5ba - bpf: Fix stackmap overflow check in __bpf_get_stackid() (CVE-2025-68378 bsc#1255614). - commit f957faa - bpf: Refactor stack map trace depth calculation into helper function (CVE-2025-68378 bsc#1255614). - commit 89dceec ++++ libsodium: - Security fix: [bsc#1256070, CVE-2025-15444, bsc#1255764, CVE-2025-69277] * check Y==Z in addition to X==0 * Add patch libsodium-CVE-2025-15444.patch ++++ libsoup: - Refresh libsoup-CVE-2025-14523.patch: Follow the update of upstream (bsc#1254876, CVE-2025-14523, glgo#GNOME/libsoup!491). ++++ opensuse-migration-tool: - Update to version 20260106.d2cfd39: * Update scripts/20_pulse2pipewire.sh * Update scripts/20_ia32.sh * Update scripts/20_pulse2pipewire.sh * Consistent no-use of sudo in migration scripts * Update scripts/10_keepapparmor.sh * Update scripts/10_keepselinux.sh * Update scripts/10_keepapparmor.sh * Update scripts/10_keepapparmor.sh * Update opensuse-migration-tool * Update scripts/10_keepselinux.sh * Improve DRYRUN option to work well even from scripts * Enable migration to SElinux with proper dryrun * Update 10_keepselinux.sh * Update 10_keepapparmor.sh * Update 10_keepapparmor.sh ------------------------------------------------------------------ ------------------ 2026-1-7 - Jan 7 2026 ------------------- ------------------------------------------------------------------ ++++ curl: - Security fix: [bsc#1256105, CVE-2025-14017] * call ldap_init() before setting the options * Add patch curl-CVE-2025-14017.patch ++++ kernel-default: - cifs: make sure server interfaces are requested only for SMB3+ (git-fixes). - Refresh patches.suse/smb-client-get-rid-of-nlsc-param-in-cifs_tree_connect-.patch. - commit 850b9c8 - iommufd: Don't overflow during division for dirty tracking (CVE-2025-40293 bsc#1255179). - commit 8fb40bc ++++ kernel-rt: - cifs: make sure server interfaces are requested only for SMB3+ (git-fixes). - Refresh patches.suse/smb-client-get-rid-of-nlsc-param-in-cifs_tree_connect-.patch. - commit 850b9c8 - iommufd: Don't overflow during division for dirty tracking (CVE-2025-40293 bsc#1255179). - commit 8fb40bc ++++ kernel-rt_debug: - cifs: make sure server interfaces are requested only for SMB3+ (git-fixes). - Refresh patches.suse/smb-client-get-rid-of-nlsc-param-in-cifs_tree_connect-.patch. - commit 850b9c8 - iommufd: Don't overflow during division for dirty tracking (CVE-2025-40293 bsc#1255179). - commit 8fb40bc ++++ rust-keylime: - Use tmpfiles.d for /var directories (PED-14736) + tmpfiles.keylime renamed to rust-keylime.conf and extended - Update to version 0.2.8+96: * build(deps): bump wiremock from 0.6.4 to 0.6.5 * build(deps): bump actions/checkout from 5 to 6 * build(deps): bump chrono from 0.4.41 to 0.4.42 * packit: Get coverage from Fedora 43 runs * Fix issues pointed out by clippy * Replace mutex unwraps with proper error handling in TPM library * Remove unused session request methods from StructureFiller * Fix config panic on missing ek_handle in push model agent * build(deps): bump tempfile from 3.21.0 to 3.23.0 * build(deps): bump actions/upload-artifact from 4 to 6 (#1163) * Fix clippy warnings project-wide * Add KEYLIME_DIR support for verifier TLS certificates in push model agent * Thread privileged resources and use MeasurementList for IMA reading * Add privileged resource initialization and privilege dropping to push model agent * Fix privilege dropping order in run_as() * add documentation on FQDN hostnames * Remove confusing logs for push mode agent * Set correct default Verifier port (8891->8881) (#1159) * Add verifier_url to reference configuration file (#1158) * Add TLS support for Registrar communication (#1139) * Fix agent handling of 403 registration responses (#1154) * Add minor README.md rephrasing (#1151) * build(deps): bump actions/checkout from 5 to 6 (#1153) * ci: update spec files for packit COPR build * docs: improve challenge encoding and async TPM documentation * refactor: improve middleware and error handling * feat: add authentication client with middleware integration * docker: Include keylime_push_model_agent binary * Include attestation_interval configuration (#1146) * Persist payload keys to avoid attestation failure on restart * crypto: Implement the load or generate pattern for keys * Use simple algorithm specifiers in certification_keys object (#1140) * tests: Enable more tests in CI * Fix RSA2048 algorithm reporting in keylime agent * Remove disabled_signing_algorithms configuration * rpm: Fix metadata patches to apply to current code * workflows/rpm.yml: Use more strict patching * build(deps): bump uuid from 1.17.0 to 1.18.1 * Fix ECC algorithm selection and reporting for keylime agent * Improve logging consistency and coherency * Implement minimal RFC compliance for Location header and URI parsing (#1125) * Use separate keys for payload mechanism and mTLS * docker: update rust to 1.81 for distroless Dockerfile * Ensure UEFI log capabilities are set to false * build(deps): bump http from 1.1.0 to 1.3.1 * build(deps): bump log from 0.4.27 to 0.4.28 * build(deps): bump cfg-if from 1.0.1 to 1.0.3 * build(deps): bump actix-rt from 2.10.0 to 2.11.0 * build(deps): bump async-trait from 0.1.88 to 0.1.89 * build(deps): bump trybuild from 1.0.105 to 1.0.110 * Accept evidence handling structures null entries * workflows: Add test to check if RPM patches still apply * CI: Enable test add-agent-with-malformed-ek-cert * config: Fix singleton tests * FSM: Remove needless lifetime annotations (#1105) * rpm: Do not remove wiremock which is now available in Fedora * Use latest Fedora httpdate version (1.0.3) * Enhance coverage with parse_retry_after test * Fix issues reported by CI regarding unwrap() calls * Reuse max retries indicated to the ResilientClient * Include limit of retries to 5 for Retry-After * Add policy to handle Retry-After response headers * build(deps): bump wiremock from 0.6.3 to 0.6.4 * build(deps): bump serde_json from 1.0.140 to 1.0.143 * build(deps): bump pest_derive from 2.8.0 to 2.8.1 * build(deps): bump syn from 2.0.90 to 2.0.106 * build(deps): bump tempfile from 3.20.0 to 3.21.0 * build(deps): bump thiserror from 2.0.12 to 2.0.16 * rpm: Fix patches to apply to current master code * build(deps): bump anyhow from 1.0.98 to 1.0.99 * state_machine: Automatically clean config override during tests * config: Implement singleton and factory pattern * testing: Support overriding configuration during tests * feat: implement standalone challenge-response authentication module * structures: rename session structs for clarity and fix typos * tpm: refactor certify_credential_with_iak() into a more generic function * Add Push Model Agent Mermaid FSM chart (#1095) * Add state to avoid exiting on wrong attestation (#1093) * Add 6 alphanumeric lowercase X-Request-ID header * Enhance Evidence Handling response parsing * build(deps): bump quote from 1.0.35 to 1.0.40 * build(deps): bump libc from 0.2.172 to 0.2.175 * build(deps): bump glob from 0.3.2 to 0.3.3 * build(deps): bump actix-web from 4.10.2 to 4.11.0 ++++ selinux-policy: - Update to version 20241031+git17.66062d7a5: * rsync: add rsync_exec_commands boolean and enable it by default (bsc#1231494, bsc#1255372) ------------------------------------------------------------------ ------------------ 2026-1-6 - Jan 6 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (CVE-2025-40251 bsc#1254856). - commit 07d80e9 - Refresh patches.suse/cifs-do-not-disable-interface-polling-on-failure.patch. - Refresh patches.suse/cifs-make-sure-server-interfaces-are-requested-only-for-SMB3-.patch. - commit 4e4929f - cifs: reset iface weights when we cannot find a candidate (git-fixes). - commit a4fc567 - cifs: make cifs_chan_update_iface() a void function (git-fixes). - Refresh patches.suse/cifs-reduce-warning-log-level-for-server-not-advertising-interfaces.patch. - commit d2b9424 - smb: client: fix warning when reconnecting channel (git-fixes). - commit 87ea733 - cifs: do not disable interface polling on failure (git-fixes). - commit 40cfdea - cifs: deal with the channel loading lag while picking channels (git-fixes). - commit 979af19 - cifs: handle when server stops supporting multichannel (git-fixes). - Refresh patches.suse/cifs-cifs_chan_is_iface_active-should-be-called-with-chan_lock-held.patch. - Refresh patches.suse/cifs-handle-cases-where-multiple-sessions-share-connection.patch. - Refresh patches.suse/smb-client-fix-UAF-in-smb2_reconnect_server-.patch. - Refresh patches.suse/smb-client-get-rid-of-nlsc-param-in-cifs_tree_connect-.patch. - commit c8dfa59 - cifs: make sure that channel scaling is done only once (git-fixes). - commit 3175d69 - cifs: handle when server starts supporting multichannel (git-fixes). - commit cc5563a - cifs: dns resolution is needed only for primary channel (git-fixes). - commit b750bd0 - cifs: update dstaddr whenever channel iface is updated (git-fixes). - commit 87415ee - cifs: reset connections for all channels when reconnect requested (git-fixes). - commit 506f274 - mptcp: fix race condition in mptcp_schedule_work() (CVE-2025-40258 bsc#1254843). - commit 664f157 ++++ kernel-rt: - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (CVE-2025-40251 bsc#1254856). - commit 07d80e9 - Refresh patches.suse/cifs-do-not-disable-interface-polling-on-failure.patch. - Refresh patches.suse/cifs-make-sure-server-interfaces-are-requested-only-for-SMB3-.patch. - commit 4e4929f - cifs: reset iface weights when we cannot find a candidate (git-fixes). - commit a4fc567 - cifs: make cifs_chan_update_iface() a void function (git-fixes). - Refresh patches.suse/cifs-reduce-warning-log-level-for-server-not-advertising-interfaces.patch. - commit d2b9424 - smb: client: fix warning when reconnecting channel (git-fixes). - commit 87ea733 - cifs: do not disable interface polling on failure (git-fixes). - commit 40cfdea - cifs: deal with the channel loading lag while picking channels (git-fixes). - commit 979af19 - cifs: handle when server stops supporting multichannel (git-fixes). - Refresh patches.suse/cifs-cifs_chan_is_iface_active-should-be-called-with-chan_lock-held.patch. - Refresh patches.suse/cifs-handle-cases-where-multiple-sessions-share-connection.patch. - Refresh patches.suse/smb-client-fix-UAF-in-smb2_reconnect_server-.patch. - Refresh patches.suse/smb-client-get-rid-of-nlsc-param-in-cifs_tree_connect-.patch. - commit c8dfa59 - cifs: make sure that channel scaling is done only once (git-fixes). - commit 3175d69 - cifs: handle when server starts supporting multichannel (git-fixes). - commit cc5563a - cifs: dns resolution is needed only for primary channel (git-fixes). - commit b750bd0 - cifs: update dstaddr whenever channel iface is updated (git-fixes). - commit 87415ee - cifs: reset connections for all channels when reconnect requested (git-fixes). - commit 506f274 - mptcp: fix race condition in mptcp_schedule_work() (CVE-2025-40258 bsc#1254843). - commit 664f157 ++++ kernel-rt_debug: - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (CVE-2025-40251 bsc#1254856). - commit 07d80e9 - Refresh patches.suse/cifs-do-not-disable-interface-polling-on-failure.patch. - Refresh patches.suse/cifs-make-sure-server-interfaces-are-requested-only-for-SMB3-.patch. - commit 4e4929f - cifs: reset iface weights when we cannot find a candidate (git-fixes). - commit a4fc567 - cifs: make cifs_chan_update_iface() a void function (git-fixes). - Refresh patches.suse/cifs-reduce-warning-log-level-for-server-not-advertising-interfaces.patch. - commit d2b9424 - smb: client: fix warning when reconnecting channel (git-fixes). - commit 87ea733 - cifs: do not disable interface polling on failure (git-fixes). - commit 40cfdea - cifs: deal with the channel loading lag while picking channels (git-fixes). - commit 979af19 - cifs: handle when server stops supporting multichannel (git-fixes). - Refresh patches.suse/cifs-cifs_chan_is_iface_active-should-be-called-with-chan_lock-held.patch. - Refresh patches.suse/cifs-handle-cases-where-multiple-sessions-share-connection.patch. - Refresh patches.suse/smb-client-fix-UAF-in-smb2_reconnect_server-.patch. - Refresh patches.suse/smb-client-get-rid-of-nlsc-param-in-cifs_tree_connect-.patch. - commit c8dfa59 - cifs: make sure that channel scaling is done only once (git-fixes). - commit 3175d69 - cifs: handle when server starts supporting multichannel (git-fixes). - commit cc5563a - cifs: dns resolution is needed only for primary channel (git-fixes). - commit b750bd0 - cifs: update dstaddr whenever channel iface is updated (git-fixes). - commit 87415ee - cifs: reset connections for all channels when reconnect requested (git-fixes). - commit 506f274 - mptcp: fix race condition in mptcp_schedule_work() (CVE-2025-40258 bsc#1254843). - commit 664f157 ++++ libsoup: - Add libsoup-CVE-2025-14523.patch: Reject duplicated Host in headers (bsc#1254876, CVE-2025-14523, glgo#GNOME/libsoup!490). ------------------------------------------------------------------ ------------------ 2026-1-5 - Jan 5 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - bs-upload-kernel: Fix cve branch uploads - commit 2716d28 - team: Move team device type change at the end of team_port_add (CVE-2025-68340 bsc#1255507). - net/mlx5: Clean up only new IRQ glue on request_irq() failure (CVE-2025-40250 bsc#1254854). - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (CVE-2025-40252 bsc#1254849). - net: enetc: fix the deadlock of enetc_mdio_lock (CVE-2025-40337 bsc#1255081). - net: stmmac: Correctly handle Rx checksum offload errors (CVE-2025-40337 bsc#1255081). - commit 3ae940f - staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing (CVE-2025-68255 bsc#1255395). - commit d962eb4 - ASoC: Intel: avs: Do not share the name pointer between components (CVE-2025-40338 bsc#1255273). - commit 968173c - drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (CVE-2025-40289 bsc#1255042). - commit ff414f2 - scripts: teaapi: Add paging - commit dfea5bd - scrits: teaapi: Add list_repos - commit 83fa609 - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (CVE-2025-40279 bsc#1254846). - commit 9f73fa4 - scripts: bs-upload-kernel: do not create the IGNORE-KABI-BADNESS file There is a tar-up option that creates it. bs-upload-kernel should only set the ignore_kabi_badness macro in prjconf. - commit 1bc75ca - usb: phy: isp1301: fix non-OF device reference imbalance (git-fixes). - usb: gadget: lpc32xx_udc: fix clock imbalance in error path (git-fixes). - commit 4724dd4 - platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic (git-fixes). - platform/x86: msi-laptop: add missing sysfs_remove_group() (git-fixes). - platform/mellanox: mlxbf-pmc: Remove trailing whitespaces from event names (git-fixes). - wifi: mac80211: do not use old MBSSID elements (git-fixes). - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() (git-fixes). - wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() (git-fixes). - wifi: rtw88: limit indirect IO under powered off for RTL8822CS (git-fixes). - smc91x: fix broken irq-context in PREEMPT_RT (git-fixes). - usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe (git-fixes). - USB: lpc32xx_udc: Fix error handling in probe (git-fixes). - usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() (git-fixes). - usb: dwc3: keep susphy enabled during exit to avoid controller faults (git-fixes). - spi: fsl-cpm: Check length parity before switching to 16 bit mode (git-fixes). - PM: runtime: Do not clear needs_force_resume with enabled runtime PM (git-fixes). - nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() (git-fixes). - commit 29120de - sctp: avoid NULL dereference when chunk data buffer is missing (CVE-2025-40240 bsc#1254869). - commit 7732dc5 - net: rose: fix invalid array index in rose_kill_by_device() (git-fixes). - net: usb: sr9700: fix incorrect command used to write single register (git-fixes). - net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write (git-fixes). - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure (git-fixes). - net: mdio: aspeed: add dummy read to avoid read-after-write issue (git-fixes). - Input: ti_am335x_tsc - fix off-by-one error in wire_order validation (git-fixes). - Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard (git-fixes). - mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig (git-fixes). - commit 0ed2427 - drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer (git-fixes). - drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb (git-fixes). - Bluetooth: btusb: revert use of devm_kzalloc in btusb (git-fixes). - idr: fix idr_alloc() returning an ID out of range (git-fixes). - genalloc.h: fix htmldocs warning (git-fixes). - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt (git-fixes). - firewire: nosy: Fix dma_free_coherent() size (git-fixes). - drm/msm/dpu: Add missing NULL pointer check for pingpong interface (git-fixes). - ALSA: usb-mixer: us16x08: validate meter packet indices (git-fixes). - ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path (git-fixes). - ALSA: vxpocket: Fix resource leak in vxpocket_probe error path (git-fixes). - hwmon: (tmp401) fix overflow caused by default conversion rate value (git-fixes). - hwmon: (ibmpex) fix use-after-free in high/low store (git-fixes). - drm/panel: sony-td4353-jdi: Enable prepare_prev_first (git-fixes). - ACPI: PCC: Fix race condition by removing static qualifier (git-fixes). - ACPI: CPPC: Fix missing PCC check for guaranteed_perf (git-fixes). - can: j1939: make j1939_sk_bind() fail if device is no longer registered (git-fixes). - can: gs_usb: gs_can_open(): fix error handling (git-fixes). - broadcom: b44: prevent uninitialized value usage (git-fixes). - commit bf82bcb ++++ kernel-rt: - bs-upload-kernel: Fix cve branch uploads - commit 2716d28 - team: Move team device type change at the end of team_port_add (CVE-2025-68340 bsc#1255507). - net/mlx5: Clean up only new IRQ glue on request_irq() failure (CVE-2025-40250 bsc#1254854). - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (CVE-2025-40252 bsc#1254849). - net: enetc: fix the deadlock of enetc_mdio_lock (CVE-2025-40337 bsc#1255081). - net: stmmac: Correctly handle Rx checksum offload errors (CVE-2025-40337 bsc#1255081). - commit 3ae940f - staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing (CVE-2025-68255 bsc#1255395). - commit d962eb4 - ASoC: Intel: avs: Do not share the name pointer between components (CVE-2025-40338 bsc#1255273). - commit 968173c - drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (CVE-2025-40289 bsc#1255042). - commit ff414f2 - scripts: teaapi: Add paging - commit dfea5bd - scrits: teaapi: Add list_repos - commit 83fa609 - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (CVE-2025-40279 bsc#1254846). - commit 9f73fa4 - scripts: bs-upload-kernel: do not create the IGNORE-KABI-BADNESS file There is a tar-up option that creates it. bs-upload-kernel should only set the ignore_kabi_badness macro in prjconf. - commit 1bc75ca - usb: phy: isp1301: fix non-OF device reference imbalance (git-fixes). - usb: gadget: lpc32xx_udc: fix clock imbalance in error path (git-fixes). - commit 4724dd4 - platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic (git-fixes). - platform/x86: msi-laptop: add missing sysfs_remove_group() (git-fixes). - platform/mellanox: mlxbf-pmc: Remove trailing whitespaces from event names (git-fixes). - wifi: mac80211: do not use old MBSSID elements (git-fixes). - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() (git-fixes). - wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() (git-fixes). - wifi: rtw88: limit indirect IO under powered off for RTL8822CS (git-fixes). - smc91x: fix broken irq-context in PREEMPT_RT (git-fixes). - usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe (git-fixes). - USB: lpc32xx_udc: Fix error handling in probe (git-fixes). - usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() (git-fixes). - usb: dwc3: keep susphy enabled during exit to avoid controller faults (git-fixes). - spi: fsl-cpm: Check length parity before switching to 16 bit mode (git-fixes). - PM: runtime: Do not clear needs_force_resume with enabled runtime PM (git-fixes). - nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() (git-fixes). - commit 29120de - sctp: avoid NULL dereference when chunk data buffer is missing (CVE-2025-40240 bsc#1254869). - commit 7732dc5 - net: rose: fix invalid array index in rose_kill_by_device() (git-fixes). - net: usb: sr9700: fix incorrect command used to write single register (git-fixes). - net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write (git-fixes). - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure (git-fixes). - net: mdio: aspeed: add dummy read to avoid read-after-write issue (git-fixes). - Input: ti_am335x_tsc - fix off-by-one error in wire_order validation (git-fixes). - Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard (git-fixes). - mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig (git-fixes). - commit 0ed2427 - drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer (git-fixes). - drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb (git-fixes). - Bluetooth: btusb: revert use of devm_kzalloc in btusb (git-fixes). - idr: fix idr_alloc() returning an ID out of range (git-fixes). - genalloc.h: fix htmldocs warning (git-fixes). - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt (git-fixes). - firewire: nosy: Fix dma_free_coherent() size (git-fixes). - drm/msm/dpu: Add missing NULL pointer check for pingpong interface (git-fixes). - ALSA: usb-mixer: us16x08: validate meter packet indices (git-fixes). - ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path (git-fixes). - ALSA: vxpocket: Fix resource leak in vxpocket_probe error path (git-fixes). - hwmon: (tmp401) fix overflow caused by default conversion rate value (git-fixes). - hwmon: (ibmpex) fix use-after-free in high/low store (git-fixes). - drm/panel: sony-td4353-jdi: Enable prepare_prev_first (git-fixes). - ACPI: PCC: Fix race condition by removing static qualifier (git-fixes). - ACPI: CPPC: Fix missing PCC check for guaranteed_perf (git-fixes). - can: j1939: make j1939_sk_bind() fail if device is no longer registered (git-fixes). - can: gs_usb: gs_can_open(): fix error handling (git-fixes). - broadcom: b44: prevent uninitialized value usage (git-fixes). - commit bf82bcb ++++ kernel-rt_debug: - bs-upload-kernel: Fix cve branch uploads - commit 2716d28 - team: Move team device type change at the end of team_port_add (CVE-2025-68340 bsc#1255507). - net/mlx5: Clean up only new IRQ glue on request_irq() failure (CVE-2025-40250 bsc#1254854). - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (CVE-2025-40252 bsc#1254849). - net: enetc: fix the deadlock of enetc_mdio_lock (CVE-2025-40337 bsc#1255081). - net: stmmac: Correctly handle Rx checksum offload errors (CVE-2025-40337 bsc#1255081). - commit 3ae940f - staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing (CVE-2025-68255 bsc#1255395). - commit d962eb4 - ASoC: Intel: avs: Do not share the name pointer between components (CVE-2025-40338 bsc#1255273). - commit 968173c - drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (CVE-2025-40289 bsc#1255042). - commit ff414f2 - scripts: teaapi: Add paging - commit dfea5bd - scrits: teaapi: Add list_repos - commit 83fa609 - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (CVE-2025-40279 bsc#1254846). - commit 9f73fa4 - scripts: bs-upload-kernel: do not create the IGNORE-KABI-BADNESS file There is a tar-up option that creates it. bs-upload-kernel should only set the ignore_kabi_badness macro in prjconf. - commit 1bc75ca - usb: phy: isp1301: fix non-OF device reference imbalance (git-fixes). - usb: gadget: lpc32xx_udc: fix clock imbalance in error path (git-fixes). - commit 4724dd4 - platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic (git-fixes). - platform/x86: msi-laptop: add missing sysfs_remove_group() (git-fixes). - platform/mellanox: mlxbf-pmc: Remove trailing whitespaces from event names (git-fixes). - wifi: mac80211: do not use old MBSSID elements (git-fixes). - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() (git-fixes). - wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() (git-fixes). - wifi: rtw88: limit indirect IO under powered off for RTL8822CS (git-fixes). - smc91x: fix broken irq-context in PREEMPT_RT (git-fixes). - usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe (git-fixes). - USB: lpc32xx_udc: Fix error handling in probe (git-fixes). - usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() (git-fixes). - usb: dwc3: keep susphy enabled during exit to avoid controller faults (git-fixes). - spi: fsl-cpm: Check length parity before switching to 16 bit mode (git-fixes). - PM: runtime: Do not clear needs_force_resume with enabled runtime PM (git-fixes). - nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() (git-fixes). - commit 29120de - sctp: avoid NULL dereference when chunk data buffer is missing (CVE-2025-40240 bsc#1254869). - commit 7732dc5 - net: rose: fix invalid array index in rose_kill_by_device() (git-fixes). - net: usb: sr9700: fix incorrect command used to write single register (git-fixes). - net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write (git-fixes). - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure (git-fixes). - net: mdio: aspeed: add dummy read to avoid read-after-write issue (git-fixes). - Input: ti_am335x_tsc - fix off-by-one error in wire_order validation (git-fixes). - Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard (git-fixes). - mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig (git-fixes). - commit 0ed2427 - drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer (git-fixes). - drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb (git-fixes). - Bluetooth: btusb: revert use of devm_kzalloc in btusb (git-fixes). - idr: fix idr_alloc() returning an ID out of range (git-fixes). - genalloc.h: fix htmldocs warning (git-fixes). - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt (git-fixes). - firewire: nosy: Fix dma_free_coherent() size (git-fixes). - drm/msm/dpu: Add missing NULL pointer check for pingpong interface (git-fixes). - ALSA: usb-mixer: us16x08: validate meter packet indices (git-fixes). - ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path (git-fixes). - ALSA: vxpocket: Fix resource leak in vxpocket_probe error path (git-fixes). - hwmon: (tmp401) fix overflow caused by default conversion rate value (git-fixes). - hwmon: (ibmpex) fix use-after-free in high/low store (git-fixes). - drm/panel: sony-td4353-jdi: Enable prepare_prev_first (git-fixes). - ACPI: PCC: Fix race condition by removing static qualifier (git-fixes). - ACPI: CPPC: Fix missing PCC check for guaranteed_perf (git-fixes). - can: j1939: make j1939_sk_bind() fail if device is no longer registered (git-fixes). - can: gs_usb: gs_can_open(): fix error handling (git-fixes). - broadcom: b44: prevent uninitialized value usage (git-fixes). - commit bf82bcb ++++ libpcap: - Security fix: [bsc#1255765, CVE-2025-11961] * Fix out-of-bound-write and out-of-bound-read in pcap_ether_aton() due to missing validation of provided MAC-48 address string * Add libpcap-CVE-2025-11961.patch ------------------------------------------------------------------ ------------------ 2026-1-3 - Jan 3 2026 ------------------- ------------------------------------------------------------------ ++++ nvidia-open-driver-G06-signed: - update non-CUDA variant to version 580.126.09 (boo#1255858) ------------------------------------------------------------------ ------------------ 2026-1-2 - Jan 2 2026 ------------------- ------------------------------------------------------------------ ++++ curl: - Security fixes: * [bsc#1255731, CVE-2025-14524] if redirected, require permission to use bearer * [bsc#1255734, CVE-2025-15224] require private key or user-agent for public key auth * [bsc#1255732, CVE-2025-14819] toggling CURLSSLOPT_NO_PARTIALCHAIN makes a different CA cache * [bsc#1255733, CVE-2025-15079] set both knownhosts options to the same file * Add patches: - curl-CVE-2025-14524.patch - curl-CVE-2025-15224.patch - curl-CVE-2025-14819.patch - curl-CVE-2025-15079.patch ++++ kernel-default: - exfat: validate cluster allocation bits of the allocation bitmap (CVE-2025-40307 bsc#1255039). - commit 61971f7 - exfat: using hweight instead of internal logic (git-fixes). - commit 18b7ccc - powerpc/kexec: Enable SMT before waking offline CPUs (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588 git-fixes bsc#1253739 ltc#211493 bsc#1254244 ltc#216496). - commit 8505ec5 ++++ kernel-rt: - exfat: validate cluster allocation bits of the allocation bitmap (CVE-2025-40307 bsc#1255039). - commit 61971f7 - exfat: using hweight instead of internal logic (git-fixes). - commit 18b7ccc - powerpc/kexec: Enable SMT before waking offline CPUs (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588 git-fixes bsc#1253739 ltc#211493 bsc#1254244 ltc#216496). - commit 8505ec5 ++++ kernel-rt_debug: - exfat: validate cluster allocation bits of the allocation bitmap (CVE-2025-40307 bsc#1255039). - commit 61971f7 - exfat: using hweight instead of internal logic (git-fixes). - commit 18b7ccc - powerpc/kexec: Enable SMT before waking offline CPUs (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588 git-fixes bsc#1253739 ltc#211493 bsc#1254244 ltc#216496). - commit 8505ec5 ------------------------------------------------------------------ ------------------ 2026-1-1 - Jan 1 2026 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - Branch maintainers was auto-merged from SLE15-SP6-LTSS. Restore to SP7 maintainers per ML discussion at: https://mailman.suse.de/mlarch/SuSE/kernel/2025/kernel.2025.12/msg00127.html https://mailman.suse.de/mlarch/SuSE/kernel/2025/kernel.2025.12/msg00134.html - commit ca6d40d ++++ kernel-rt: - Branch maintainers was auto-merged from SLE15-SP6-LTSS. Restore to SP7 maintainers per ML discussion at: https://mailman.suse.de/mlarch/SuSE/kernel/2025/kernel.2025.12/msg00127.html https://mailman.suse.de/mlarch/SuSE/kernel/2025/kernel.2025.12/msg00134.html - commit ca6d40d ++++ kernel-rt_debug: - Branch maintainers was auto-merged from SLE15-SP6-LTSS. Restore to SP7 maintainers per ML discussion at: https://mailman.suse.de/mlarch/SuSE/kernel/2025/kernel.2025.12/msg00127.html https://mailman.suse.de/mlarch/SuSE/kernel/2025/kernel.2025.12/msg00134.html - commit ca6d40d ++++ c-ares: - c-ares 1.35.6: * CVE-2025-62408: use-after-free in read_answers() (boo#1254738) * Ignore Windows IDN Search Domains until proper IDN support is added * Various bug fixes ------------------------------------------------------------------ ------------------ 2025-12-31 - Dec 31 2025 ------------------- ------------------------------------------------------------------ ++++ fde-tools: - Add fde-tools.conf to create /var/log/fde with tmpfiles.d (jsc#PED-14754) ++++ kernel-default: - tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (CVE-2025-40042 bsc#1252861). - commit ee6a745 ++++ kernel-rt: - tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (CVE-2025-40042 bsc#1252861). - commit ee6a745 ++++ kernel-rt_debug: - tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (CVE-2025-40042 bsc#1252861). - commit ee6a745 ------------------------------------------------------------------ ------------------ 2025-12-30 - Dec 30 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - README.BRANCH: SLE15-SP6 became LTSS, update maintainers - commit f86184e ++++ kernel-rt: - README.BRANCH: SLE15-SP6 became LTSS, update maintainers - commit f86184e ++++ kernel-rt_debug: - README.BRANCH: SLE15-SP6 became LTSS, update maintainers - commit f86184e ------------------------------------------------------------------ ------------------ 2025-12-29 - Dec 29 2025 ------------------- ------------------------------------------------------------------ ++++ cyrus-sasl: - Clean up an synchronize changes - Fix packages for Immutable Mode - cyrus-sasl (jsc#PED-14856) ++++ kernel-default: - cpuidle: menu: Use residency threshold in polling state override decisions (bsc#1255026). - commit 2c42ea1 - fs: dlm: allow to F_SETLKW getting interrupted (bsc#1255025). - commit c5ce147 - selftests/bpf: Add test case for different expected_attach_type (CVE-2025-40123 bsc#1253365). - commit a20378c - kABI workaround for bpf: Enforce expected_attach_type for tailcall compatibility (CVE-2025-40123 bsc#1253365). - commit b3b5837 - bpf: Enforce expected_attach_type for tailcall compatibility (CVE-2025-40123 bsc#1253365). Refresh patches.kabi/bpf-struct-bpf_map-workaround.patch. - commit 4229239 ++++ kernel-rt: - cpuidle: menu: Use residency threshold in polling state override decisions (bsc#1255026). - commit 2c42ea1 - fs: dlm: allow to F_SETLKW getting interrupted (bsc#1255025). - commit c5ce147 - selftests/bpf: Add test case for different expected_attach_type (CVE-2025-40123 bsc#1253365). - commit a20378c - kABI workaround for bpf: Enforce expected_attach_type for tailcall compatibility (CVE-2025-40123 bsc#1253365). - commit b3b5837 - bpf: Enforce expected_attach_type for tailcall compatibility (CVE-2025-40123 bsc#1253365). Refresh patches.kabi/bpf-struct-bpf_map-workaround.patch. - commit 4229239 ++++ kernel-rt_debug: - cpuidle: menu: Use residency threshold in polling state override decisions (bsc#1255026). - commit 2c42ea1 - fs: dlm: allow to F_SETLKW getting interrupted (bsc#1255025). - commit c5ce147 - selftests/bpf: Add test case for different expected_attach_type (CVE-2025-40123 bsc#1253365). - commit a20378c - kABI workaround for bpf: Enforce expected_attach_type for tailcall compatibility (CVE-2025-40123 bsc#1253365). - commit b3b5837 - bpf: Enforce expected_attach_type for tailcall compatibility (CVE-2025-40123 bsc#1253365). Refresh patches.kabi/bpf-struct-bpf_map-workaround.patch. - commit 4229239 ------------------------------------------------------------------ ------------------ 2025-12-23 - Dec 23 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - exfat: fix refcount leak in exfat_find (CVE-2025-40287 bsc#1255030). - commit 8d74fe6 - exfat: fix improper check of dentry.stream.valid_size (CVE-2025-40287 bsc#1255030). - commit 6d6e321 - exfat: add a check for invalid data size (git-fixes). - commit 2af7089 - selftests/bpf: Test widen_imprecise_scalars() with different stack depth (CVE-2025-68208 bsc#1255227). - commit 7bc82c5 - bpf: account for current allocated stack depth in widen_imprecise_scalars() (CVE-2025-68208 bsc#1255227). - commit 59eb6d6 - gfs2: Fix unlikely race in gdlm_put_lock (CVE-2025-40242 bsc#1255075). - commit c371711 ++++ kernel-rt: - exfat: fix refcount leak in exfat_find (CVE-2025-40287 bsc#1255030). - commit 8d74fe6 - exfat: fix improper check of dentry.stream.valid_size (CVE-2025-40287 bsc#1255030). - commit 6d6e321 - exfat: add a check for invalid data size (git-fixes). - commit 2af7089 - selftests/bpf: Test widen_imprecise_scalars() with different stack depth (CVE-2025-68208 bsc#1255227). - commit 7bc82c5 - bpf: account for current allocated stack depth in widen_imprecise_scalars() (CVE-2025-68208 bsc#1255227). - commit 59eb6d6 - gfs2: Fix unlikely race in gdlm_put_lock (CVE-2025-40242 bsc#1255075). - commit c371711 ++++ kernel-rt_debug: - exfat: fix refcount leak in exfat_find (CVE-2025-40287 bsc#1255030). - commit 8d74fe6 - exfat: fix improper check of dentry.stream.valid_size (CVE-2025-40287 bsc#1255030). - commit 6d6e321 - exfat: add a check for invalid data size (git-fixes). - commit 2af7089 - selftests/bpf: Test widen_imprecise_scalars() with different stack depth (CVE-2025-68208 bsc#1255227). - commit 7bc82c5 - bpf: account for current allocated stack depth in widen_imprecise_scalars() (CVE-2025-68208 bsc#1255227). - commit 59eb6d6 - gfs2: Fix unlikely race in gdlm_put_lock (CVE-2025-40242 bsc#1255075). - commit c371711 ++++ capstone: - fix bsc#1255309 (CVE-2025-67873) Patch added: * fix-unchecked-lenght-cbef76.patch ------------------------------------------------------------------ ------------------ 2025-12-22 - Dec 22 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - selftests/bpf: Skip timer cases when bpf_timer is not supported (git-fixes). - commit c865cf8 - bpf: Reject bpf_timer for PREEMPT_RT (git-fixes). - commit 4c49578 - bpf: Sync pending IRQ work before freeing ring buffer (CVE-2025-40319 bsc#1254794). - commit d39f398 - netfilter: nft_ct: add seqadj extension for natted connections (CVE-2025-68206 bsc#1255142). - commit 85cf637 - sctp: Prevent TOCTOU out-of-bounds write (CVE-2025-40331 bsc#1254615). - commit a261090 - net: bridge: fix use-after-free due to MST port state bypass (CVE-2025-40297 bsc#1255187). - commit 551613c ++++ kernel-rt: - selftests/bpf: Skip timer cases when bpf_timer is not supported (git-fixes). - commit c865cf8 - bpf: Reject bpf_timer for PREEMPT_RT (git-fixes). - commit 4c49578 - bpf: Sync pending IRQ work before freeing ring buffer (CVE-2025-40319 bsc#1254794). - commit d39f398 - netfilter: nft_ct: add seqadj extension for natted connections (CVE-2025-68206 bsc#1255142). - commit 85cf637 - sctp: Prevent TOCTOU out-of-bounds write (CVE-2025-40331 bsc#1254615). - commit a261090 - net: bridge: fix use-after-free due to MST port state bypass (CVE-2025-40297 bsc#1255187). - commit 551613c ++++ kernel-rt_debug: - selftests/bpf: Skip timer cases when bpf_timer is not supported (git-fixes). - commit c865cf8 - bpf: Reject bpf_timer for PREEMPT_RT (git-fixes). - commit 4c49578 - bpf: Sync pending IRQ work before freeing ring buffer (CVE-2025-40319 bsc#1254794). - commit d39f398 - netfilter: nft_ct: add seqadj extension for natted connections (CVE-2025-68206 bsc#1255142). - commit 85cf637 - sctp: Prevent TOCTOU out-of-bounds write (CVE-2025-40331 bsc#1254615). - commit a261090 - net: bridge: fix use-after-free due to MST port state bypass (CVE-2025-40297 bsc#1255187). - commit 551613c ++++ qemu: - More spec file cleanup: * [openSUSE][RPM} spec: delete old specfile constructs ------------------------------------------------------------------ ------------------ 2025-12-21 - Dec 21 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - ocfs2: clear extent cache after moving/defragmenting extents (CVE-2025-40233 bsc#1254813). - commit 2e6aaae - net: use dst_dev_rcu() in sk_setup_caps() (CVE-2025-40170 bsc#1253413). - commit 7607c99 - ipv6: use RCU in ip6_output() (CVE-2025-40158 bsc#1253402). - ipv6: use RCU in ip6_xmit() (CVE-2025-40135 bsc#1253342). - ipv6: use RCU in ip6_output() (CVE-2025-40158 bsc#1253402). - ipv6: use RCU in ip6_xmit() (CVE-2025-40135 bsc#1253342). - commit c7716e0 ++++ kernel-rt: - ocfs2: clear extent cache after moving/defragmenting extents (CVE-2025-40233 bsc#1254813). - commit 2e6aaae - net: use dst_dev_rcu() in sk_setup_caps() (CVE-2025-40170 bsc#1253413). - commit 7607c99 - ipv6: use RCU in ip6_output() (CVE-2025-40158 bsc#1253402). - ipv6: use RCU in ip6_xmit() (CVE-2025-40135 bsc#1253342). - ipv6: use RCU in ip6_output() (CVE-2025-40158 bsc#1253402). - ipv6: use RCU in ip6_xmit() (CVE-2025-40135 bsc#1253342). - commit c7716e0 ++++ kernel-rt_debug: - ocfs2: clear extent cache after moving/defragmenting extents (CVE-2025-40233 bsc#1254813). - commit 2e6aaae - net: use dst_dev_rcu() in sk_setup_caps() (CVE-2025-40170 bsc#1253413). - commit 7607c99 - ipv6: use RCU in ip6_output() (CVE-2025-40158 bsc#1253402). - ipv6: use RCU in ip6_xmit() (CVE-2025-40135 bsc#1253342). - ipv6: use RCU in ip6_output() (CVE-2025-40158 bsc#1253402). - ipv6: use RCU in ip6_xmit() (CVE-2025-40135 bsc#1253342). - commit c7716e0 ------------------------------------------------------------------ ------------------ 2025-12-19 - Dec 19 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - tipc: Fix use-after-free in tipc_mon_reinit_self() (CVE-2025-40280 bsc#1254847). - commit 293c735 - virtio-net: fix received length check in big packets (bsc#1255175, CVE-2025-40292). - commit 640f7af - vsock: Ignore signal/timeout on connect() if already established (CVE-2025-40248, bsc#1254864). - commit 76e0cd6 - vsock: fix lock inversion in vsock_assign_transport() (CVE-2025-40231, bsc#1254815). - commit f20ceef - xen/events: Return -EEXIST for bound VIRQs (CVE-2025-40160, bsc#1253400). - commit a401c8b - xen/events: Cleanup find_virq() return codes (CVE-2025-40160, bsc#1253400). - commit 3a48f4b ++++ kernel-rt: - tipc: Fix use-after-free in tipc_mon_reinit_self() (CVE-2025-40280 bsc#1254847). - commit 293c735 - virtio-net: fix received length check in big packets (bsc#1255175, CVE-2025-40292). - commit 640f7af - vsock: Ignore signal/timeout on connect() if already established (CVE-2025-40248, bsc#1254864). - commit 76e0cd6 - vsock: fix lock inversion in vsock_assign_transport() (CVE-2025-40231, bsc#1254815). - commit f20ceef - xen/events: Return -EEXIST for bound VIRQs (CVE-2025-40160, bsc#1253400). - commit a401c8b - xen/events: Cleanup find_virq() return codes (CVE-2025-40160, bsc#1253400). - commit 3a48f4b ++++ kernel-rt_debug: - tipc: Fix use-after-free in tipc_mon_reinit_self() (CVE-2025-40280 bsc#1254847). - commit 293c735 - virtio-net: fix received length check in big packets (bsc#1255175, CVE-2025-40292). - commit 640f7af - vsock: Ignore signal/timeout on connect() if already established (CVE-2025-40248, bsc#1254864). - commit 76e0cd6 - vsock: fix lock inversion in vsock_assign_transport() (CVE-2025-40231, bsc#1254815). - commit f20ceef - xen/events: Return -EEXIST for bound VIRQs (CVE-2025-40160, bsc#1253400). - commit a401c8b - xen/events: Cleanup find_virq() return codes (CVE-2025-40160, bsc#1253400). - commit 3a48f4b ++++ capstone: - Fix bsc#1255310 (CVE-2025-68114) Patch added: * fix-buffer-overflow-2c7797.patch ------------------------------------------------------------------ ------------------ 2025-12-18 - Dec 18 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added (CVE-2025-40215 bsc#1254959). - commit ae22a6c - xfrm: delete x->tunnel as we delete x (CVE-2025-40215 bsc#1254959). - commit 13f0f1f - kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959 CVE-2025-40215). - commit 63a872c - cifs: Fix copy offload to flush destination region (bsc#1252511). - commit 5ef1ba0 - cifs: Fix flushing, invalidation and file size with copy_file_range() (bsc#1252511). - commit 957492b ++++ kernel-rt: - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added (CVE-2025-40215 bsc#1254959). - commit ae22a6c - xfrm: delete x->tunnel as we delete x (CVE-2025-40215 bsc#1254959). - commit 13f0f1f - kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959 CVE-2025-40215). - commit 63a872c - cifs: Fix copy offload to flush destination region (bsc#1252511). - commit 5ef1ba0 - cifs: Fix flushing, invalidation and file size with copy_file_range() (bsc#1252511). - commit 957492b ++++ kernel-rt_debug: - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added (CVE-2025-40215 bsc#1254959). - commit ae22a6c - xfrm: delete x->tunnel as we delete x (CVE-2025-40215 bsc#1254959). - commit 13f0f1f - kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959 CVE-2025-40215). - commit 63a872c - cifs: Fix copy offload to flush destination region (bsc#1252511). - commit 5ef1ba0 - cifs: Fix flushing, invalidation and file size with copy_file_range() (bsc#1252511). - commit 957492b ++++ python311-core: - Add CVE-2025-13836-http-resp-cont-len.patch (bsc#1254400, CVE-2025-13836) to prevent reading an HTTP response from a server, if no read amount is specified, with using Content-Length per default as the length. - Add CVE-2025-12084-minidom-quad-search.patch prevent quadratic behavior in node ID cache clearing (CVE-2025-12084, bsc#1254997). - Add CVE-2025-13837-plistlib-mailicious-length.patch protect against OOM when loading malicious content (CVE-2025-13837, bsc#1254401). ++++ python311: - Add CVE-2025-13836-http-resp-cont-len.patch (bsc#1254400, CVE-2025-13836) to prevent reading an HTTP response from a server, if no read amount is specified, with using Content-Length per default as the length. - Add CVE-2025-12084-minidom-quad-search.patch prevent quadratic behavior in node ID cache clearing (CVE-2025-12084, bsc#1254997). - Add CVE-2025-13837-plistlib-mailicious-length.patch protect against OOM when loading malicious content (CVE-2025-13837, bsc#1254401). ++++ qemu: - We *always* want a display driver in x86 too: * [openSUSE][RPM] spec: require qemu-hw-display-virtio-gpu-pci for x86 too ------------------------------------------------------------------ ------------------ 2025-12-17 - Dec 17 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (CVE-2025-40274, bsc#1254830). - commit 539aace ++++ kernel-rt: - KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (CVE-2025-40274, bsc#1254830). - commit 539aace ++++ kernel-rt_debug: - KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (CVE-2025-40274, bsc#1254830). - commit 539aace ------------------------------------------------------------------ ------------------ 2025-12-16 - Dec 16 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - Move upstreamed ath12k patch into sorted section - commit fa80682 - Move upstreamed SCSI patches into sorted section - commit 8ea340d - futex: Prevent use-after-free during requeue-PI (CVE-2025-39977 bsc#1252046). - commit 3062182 ++++ kernel-rt: - Move upstreamed ath12k patch into sorted section - commit fa80682 - Move upstreamed SCSI patches into sorted section - commit 8ea340d - futex: Prevent use-after-free during requeue-PI (CVE-2025-39977 bsc#1252046). - commit 3062182 ++++ kernel-rt_debug: - Move upstreamed ath12k patch into sorted section - commit fa80682 - Move upstreamed SCSI patches into sorted section - commit 8ea340d - futex: Prevent use-after-free during requeue-PI (CVE-2025-39977 bsc#1252046). - commit 3062182 ++++ libvirt: - CVE-2025-13193: qemu: Set umask for 'qemu-img' when creating external inactive snapshots bsc#1253703 - CVE-2025-12748: Check ACLs before parsing the whole domain XML bsc#1253278 ++++ qemu: - Bug and CVE fixes: * [openSUSE][RPM]: really fix *-virtio-gpu-pci dependency on ARM (bsc#1254286) * net: pad packets to minimum length in qemu_receive_packet() (bsc#1253002, CVE-2025-12464) ++++ rsync: - Security update (CVE-2025-10158, bsc#1254441): rsync: Out of bounds array access via negative index - Add rsync-CVE-2025-10158.patch ++++ selinux-policy: - Update to version 20241031+git15.e32e86fd5: * Add a new type for systemd-ssh-issue PID files (bsc#1254889) * Label /usr/lib/systemd/systemd-ssh-issue with systemd_ssh_issue_exec_t (bsc#1254889) ++++ shim: - shim-install: Add ca_string for SL Micro to update fallback loader The fallback loader, /boot/efi/EFI/BOOT/bootaa64.efi or bootx64.efi, cannot be upgraded by shim-install on SL Micro. The issue case is SL Micro 6.0. It causes that system gets regression bug because it's fallback to a old shim. So this patch adds ca_string to SL Micro. (bsc#1254336) ------------------------------------------------------------------ ------------------ 2025-12-15 - Dec 15 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE (git-fixes). - commit 808d009 - usb: typec: ucsi: psy: Set max current to zero when disconnected (git-fixes). - commit de6f0cd - USB: serial: option: add Telit FN920C04 ECM compositions (stable-fixes). - USB: serial: option: add Quectel RG255C (stable-fixes). - USB: serial: option: add UNISOC UIS7720 (stable-fixes). - usb: dwc3: Abort suspend on soft disconnect failure (git-fixes). - usb: chipidea: udc: limit usb request length to max 16KB (stable-fixes). - commit 15d4d36 - usb: raw-gadget: do not limit transfer length (git-fixes). - usb: vhci-hcd: Prevent suspending virtually attached devices (git-fixes). - usb: typec: tipd: Clear interrupts first (git-fixes). - usb: udc: Add trace event for usb_gadget_set_state (stable-fixes). - usb: gadget: configfs: Correctly set use_os_string at bind (git-fixes). - commit c4f787c - Correct USB typec tcpm patches In upstream backports, changes were applied to wrong places (sink instead of source). In the stable upstream, it was corrected in a commit d967f6ae3149, but we fold the corrections in each patch, instead. Refreshed: patches.suse/usb-typec-tcpm-fix-use-after-free-case-in-tcpm_regis.patch patches.suse/usb-typec-tcpm-unregister-existing-source-caps-befor.patch - commit 55aaa8f - x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (git-fixes). - commit 4dc2ee9 ++++ kernel-rt: - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE (git-fixes). - commit 808d009 - usb: typec: ucsi: psy: Set max current to zero when disconnected (git-fixes). - commit de6f0cd - USB: serial: option: add Telit FN920C04 ECM compositions (stable-fixes). - USB: serial: option: add Quectel RG255C (stable-fixes). - USB: serial: option: add UNISOC UIS7720 (stable-fixes). - usb: dwc3: Abort suspend on soft disconnect failure (git-fixes). - usb: chipidea: udc: limit usb request length to max 16KB (stable-fixes). - commit 15d4d36 - usb: raw-gadget: do not limit transfer length (git-fixes). - usb: vhci-hcd: Prevent suspending virtually attached devices (git-fixes). - usb: typec: tipd: Clear interrupts first (git-fixes). - usb: udc: Add trace event for usb_gadget_set_state (stable-fixes). - usb: gadget: configfs: Correctly set use_os_string at bind (git-fixes). - commit c4f787c - Correct USB typec tcpm patches In upstream backports, changes were applied to wrong places (sink instead of source). In the stable upstream, it was corrected in a commit d967f6ae3149, but we fold the corrections in each patch, instead. Refreshed: patches.suse/usb-typec-tcpm-fix-use-after-free-case-in-tcpm_regis.patch patches.suse/usb-typec-tcpm-unregister-existing-source-caps-befor.patch - commit 55aaa8f - x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (git-fixes). - commit 4dc2ee9 ++++ kernel-rt_debug: - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE (git-fixes). - commit 808d009 - usb: typec: ucsi: psy: Set max current to zero when disconnected (git-fixes). - commit de6f0cd - USB: serial: option: add Telit FN920C04 ECM compositions (stable-fixes). - USB: serial: option: add Quectel RG255C (stable-fixes). - USB: serial: option: add UNISOC UIS7720 (stable-fixes). - usb: dwc3: Abort suspend on soft disconnect failure (git-fixes). - usb: chipidea: udc: limit usb request length to max 16KB (stable-fixes). - commit 15d4d36 - usb: raw-gadget: do not limit transfer length (git-fixes). - usb: vhci-hcd: Prevent suspending virtually attached devices (git-fixes). - usb: typec: tipd: Clear interrupts first (git-fixes). - usb: udc: Add trace event for usb_gadget_set_state (stable-fixes). - usb: gadget: configfs: Correctly set use_os_string at bind (git-fixes). - commit c4f787c - Correct USB typec tcpm patches In upstream backports, changes were applied to wrong places (sink instead of source). In the stable upstream, it was corrected in a commit d967f6ae3149, but we fold the corrections in each patch, instead. Refreshed: patches.suse/usb-typec-tcpm-fix-use-after-free-case-in-tcpm_regis.patch patches.suse/usb-typec-tcpm-unregister-existing-source-caps-befor.patch - commit 55aaa8f - x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (git-fixes). - commit 4dc2ee9 ++++ systemd: - Import commit 9ecd16228492f44212e2771bec11ec78245b4094 9ecd162284 timer: rebase last_trigger timestamp if needed cd4a9103ef timer: rebase the next elapse timestamp only if timer didn't already run c3f4407e97 timer: don't run service immediately after restart of a timer (bsc#1254563) 05bcfe3295 test: check the next elapse timer timestamp after deserialization fe8f656975 test: restarting elapsed timer shouldn't trigger the corresponding service e4dd315b6c units: don't force the loading of the loop and dm_mod modules in systemd-repart.service (bsc#1248356) b58e72215a units: add dep on systemd-logind.service by user@.service 97ceca445c detect-virt: add bare-metal support for GCE (bsc#1244449 - Sync systemd-update-helper with the version shipped in Base:System This includes the following changes: - systemd-update-helper: do not stop or disable services when they are migrated to other packages. This can occur during package renaming or splitting. - systemd-update-helper: Fix invalid use of "break" in case statement - systemd-update-helper: fix regression introduced when support for package renaming/splitting was added (bsc#1245551) - systemd-update-helper: backport commit 2d0af8bc354f4a1429ce Since user@.service has `Type=notify-reload` (making the reloading process synchronous) and reloading implies reexecuting with `ReloadSignal=RTMIN+25`, reexecuting user managers synchronously can be achieved with `systemctl reload user@*.service" now. ++++ python-tornado6: - Add security patches: * CVE-2025-67724.patch (bsc#1254903) * CVE-2025-67725.patch (bsc#1254905) * CVE-2025-67726.patch (bsc#1254904) ++++ shim: - Add DER format certificate files for the pretrans script to verify that the necessary certificate is in the UEFI db - openSUSE Secure Boot CA, 2013-2035 openSUSE_Secure_Boot_CA_2013.crt - SUSE Linux Enterprise Secure Boot CA, 2013-2035 SUSE_Linux_Enterprise_Secure_Boot_CA_2013.crt - Microsoft Corporation UEFI CA 2011, 2011-2026 Microsoft_Corporation_UEFI_CA_2011.crt - Microsoft UEFI CA 2023, 2023-2038 Microsoft_UEFI_CA_2023.crt - shim.spec: Add a pretrans script to verify that the necessary certificate is in the UEFI db. - Always put SUSE Linux Enterprise Secure Boot CA to target array. (bsc#1254679) ------------------------------------------------------------------ ------------------ 2025-12-14 - Dec 14 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() (git-fixes). - drm/mgag200: Fix big-endian support (git-fixes). - drm/ttm: Avoid NULL pointer deref for evicted BOs (git-fixes). - drm: nouveau: Replace sprintf() with sysfs_emit() (git-fixes). - rtc: gamecube: Check the return value of ioremap() (git-fixes). - commit 4a0695a ++++ kernel-rt: - irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() (git-fixes). - drm/mgag200: Fix big-endian support (git-fixes). - drm/ttm: Avoid NULL pointer deref for evicted BOs (git-fixes). - drm: nouveau: Replace sprintf() with sysfs_emit() (git-fixes). - rtc: gamecube: Check the return value of ioremap() (git-fixes). - commit 4a0695a ++++ kernel-rt_debug: - irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() (git-fixes). - drm/mgag200: Fix big-endian support (git-fixes). - drm/ttm: Avoid NULL pointer deref for evicted BOs (git-fixes). - drm: nouveau: Replace sprintf() with sysfs_emit() (git-fixes). - rtc: gamecube: Check the return value of ioremap() (git-fixes). - commit 4a0695a ------------------------------------------------------------------ ------------------ 2025-12-13 - Dec 13 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - ASoC: codecs: wcd938x: fix OF node leaks on probe failure (git-fixes). - ASoC: ak5558: Disable regulator when error happens (git-fixes). - ASoC: ak4458: Disable regulator when error happens (git-fixes). - ALSA: firewire-motu: add bounds check in put_user loop for DSP events (git-fixes). - ALSA: uapi: Fix typo in asound.h comment (git-fixes). - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (git-fixes). - ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() (git-fixes). - commit 203c44f ++++ kernel-rt: - ASoC: codecs: wcd938x: fix OF node leaks on probe failure (git-fixes). - ASoC: ak5558: Disable regulator when error happens (git-fixes). - ASoC: ak4458: Disable regulator when error happens (git-fixes). - ALSA: firewire-motu: add bounds check in put_user loop for DSP events (git-fixes). - ALSA: uapi: Fix typo in asound.h comment (git-fixes). - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (git-fixes). - ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() (git-fixes). - commit 203c44f ++++ kernel-rt_debug: - ASoC: codecs: wcd938x: fix OF node leaks on probe failure (git-fixes). - ASoC: ak5558: Disable regulator when error happens (git-fixes). - ASoC: ak4458: Disable regulator when error happens (git-fixes). - ALSA: firewire-motu: add bounds check in put_user loop for DSP events (git-fixes). - ALSA: uapi: Fix typo in asound.h comment (git-fixes). - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (git-fixes). - ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() (git-fixes). - commit 203c44f ------------------------------------------------------------------ ------------------ 2025-12-12 - Dec 12 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458 CVE-2025-40167). - commit 18e6218 - ext4: align max orphan file size with e2fsprogs limit (bsc#1253442 CVE-2025-40179). - commit 7ae82ce - ext4: free orphan info with kvfree (bsc#1253442 CVE-2025-40179). - commit a10c019 - ext4: verify orphan file size is not too big (bsc#1253442 CVE-2025-40179). - commit 6c1724d - Revert "ipmi: fix msg stack when IPMI is disconnected" (bsc#1253622 CVE-2025-40192) - commit 33bdbac ++++ kernel-rt: - ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458 CVE-2025-40167). - commit 18e6218 - ext4: align max orphan file size with e2fsprogs limit (bsc#1253442 CVE-2025-40179). - commit 7ae82ce - ext4: free orphan info with kvfree (bsc#1253442 CVE-2025-40179). - commit a10c019 - ext4: verify orphan file size is not too big (bsc#1253442 CVE-2025-40179). - commit 6c1724d - Revert "ipmi: fix msg stack when IPMI is disconnected" (bsc#1253622 CVE-2025-40192) - commit 33bdbac ++++ kernel-rt_debug: - ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458 CVE-2025-40167). - commit 18e6218 - ext4: align max orphan file size with e2fsprogs limit (bsc#1253442 CVE-2025-40179). - commit 7ae82ce - ext4: free orphan info with kvfree (bsc#1253442 CVE-2025-40179). - commit a10c019 - ext4: verify orphan file size is not too big (bsc#1253442 CVE-2025-40179). - commit 6c1724d - Revert "ipmi: fix msg stack when IPMI is disconnected" (bsc#1253622 CVE-2025-40192) - commit 33bdbac ++++ shim: - Update to 16.1 - RPMs shim-16.1-150300.4.31.1.x86_64.rpm shim-debuginfo-16.1-150300.4.31.1.x86_64.rpm shim-debugsource-16.1-150300.4.31.1.x86_64.rpm shim-16.1-150300.4.31.1.aarch64.rpm shim-debuginfo-16.1-150300.4.31.1.aarch64.rpm shim-debugsource-16.1-150300.4.31.1.aarch64.rpm - submitreq: https://build.suse.de/request/show/395247 - repo: https://build.suse.de/package/show/SUSE:Maintenance:39913/shim.SUSE_SLE-15-SP3_Update - Patches (git log --oneline --reverse 16.0..16.1) 4040ec4 shim_start_image(): fix guid/handle pairing when uninstalling protocols 39c0aa1 str2ip6(): parsing of "uncompressed" ipv6 addresses 3133d19 test-mock-variables: make our filter list entries safer. d44405e mock-variables: remove unused variable 0e8459f Update CI to use ubuntu-24.04 instead of ubuntu-20.04 d16a5a6 SbatLevel_Variable.txt: minor typo fix. 32804cf Realloc() needs one more byte for sprintf() 431d370 IPv6: Add more check to avoid multiple double colon and illegal char 5e4d93c Loader Proto: make freeing of bprop.buffer conditional. 33deac2 Prepare to move things from shim.c to verify.c 030e7df Move a bunch of stuff from shim.c to verify.c f3ddda7 handle_image(): make verification conditional 774f226 Cache sections of a loaded image and sub-images from them. eb0d20b loader-protocol: handle sub-section loading for UKIs 2f64bb9 loader-protocol: add workaround for EDK2 2025.02 page fault on FreePages 1abc7ca loader-protocol: NULL output variable in load_image on failure fb77b44 Generate Authenticode for the entire PE file b86b909 README: mention new loader protocol and interaction with UKIs 8522612 ci: add mkosi configuration and CI 9ebab84 mkosi workflow: fix the branch name for main. 72a4c41 shim: change automatically enable MOK_POLICY_REQUIRE_NX a2f0dfa This is an organizational patch to move some things around in mok.c 54b9946 Update to the shim-16.1 branch of gnu-efi to get AsciiSPrint() a5a6922 get_max_var_sz(): add more debugging for apple platforms 77a2922 Add a "VariableInfo" variable to mok-variables. efc71c9 build: Avoid passing *FLAGS to sub-make 7670932 Fixes for 'make TOPDIR=... clean' 13ab598 add SbatLevel entry 2025051000 for PSA-2025-00012-1 617aed5 Update version to 16.1~rc1 d316ba8 format_variable_info(): fix wrong size test. f5fad0e _do_sha256_sum(): Fix missing error check. 3a9734d doc: add howto for running mkosi locally ced5f71 mkosi: remove spurious slashes from script 0076155 ci: update mkosi commit 5481105 fix http boot 121cddf loader-protocol: Handle UnloadImage after StartImage properly 6a1d1a9 loader-protocol: Fix memory leaks 27a5d22 gitignore: add more mkosi dirs and vscode dir 346ed15 mkosi: disable repository key check on Fedora afc4955 Update version to 16.1 - 16.1 release note https://github.com/rhboot/shim/releases shim_start_image(): fix guid/handle pairing when uninstalling protocols by @vathpela in #738 Fix uncompressed ipv6 netboot by @hrvach in #742 fix test segfaults caused by uninitialized memory by @Fabian-Gruenbichler in #739 Update CI to use ubuntu-24.04 instead of ubuntu-20.04 by @vathpela in #749 SbatLevel_Variable.txt: minor typo fix. by @vathpela in #751 Realloc() needs to allocate one more byte for sprintf() by @dennis-tseng99 in #746 IPv6: Add more check to avoid multiple double colon and illegal char by @dennis-tseng99 in #753 Loader proto v2 by @vathpela in #748 loader-protocol: add workaround for EDK2 2025.02 page fault on FreePages by @bluca in #750 Generate Authenticode for the entire PE file by @esnowberg in #604 README: mention new loader protocol and interaction with UKIs by @bluca in #755 ci: add mkosi configuration and CI by @bluca in #764 shim: change automatically enable MOK_POLICY_REQUIRE_NX by @vathpela in #761 Save var info by @vathpela in #763 build: Avoid passing *FLAGS to sub-make by @rosslagerwall in #758 Fixes for 'make TOPDIR=... clean' by @bluca in #762 add SbatLevel entry 2025051000 for PSA-2025-00012-1 by @Fabian-Gruenbichler in #766 Coverity fixes 20250804 by @vathpela in #767 ci: fixlets and docs for mkosi workflow by @bluca in #768 fix http boot by @jsetje in #770 Fix double free and leak in the loader protocol by @rosslagerwall in #769 gitignore: add more mkosi dirs and vscode dir by @bluca in #771 - Drop upstreamed patch: The following patches are merged to 16.1 - shim-alloc-one-more-byte-for-sprintf.patch - 32804cf5d9 Realloc() needs one more byte for sprintf() [16.1] - shim-change-automatically-enable-MOK_POLICY_REQUIRE_NX.patch (bsc#1205588) - 72a4c41877 shim: change automatically enable MOK_POLICY_REQUIRE_NX [16.1] - Building MokManager.efi and fallback.efi with POST_PROCESS_PE_FLAGS=-n (bsc#1205588) - Building with the latest version of gcc in the codebase: - The gcc13 can workaround dxe_get_mem_attrs() hsi_status problem - We prefer that building shim with the latest version of gcc in codebase. - Set the minimum version is gcc-13. (bsc#1247432) - SLE shim should includes vendor-dbx-sles.esl instead of vendor-dbx-opensuse.esl. Fixed it in shim.spec. ++++ supportutils: - Changes to version 3.2.12 + Optimized lsof usage and honors OPTION_OFILES (bsc#1232351, PR#274) + Run in containers without errors (bsc#1245667, PR#272) + Removed pmap PID from memory.txt (bsc#1246011, PR#263) + Added missing /proc/pagetypeinfo to memory.txt (bsc#1246025, PR#264) + Improved database perforce with kGraft patching (bsc#1249657, PR#273) + Using last boot for journalctl for optimization (bsc#1250224, PR#287) + Fixed extraction failures (bsc#1252318, PR#275) + Update supportconfig.conf path in docs (bsc#1254425, PR#281) + drm_sub_info: Catch error when dir doesn't exist (PR#265) + Replace remaining `egrep` with `grep -E` (PR#261, PR#266) + Add process affinity to slert logs (PR#269) + Reintroduce cgroup statistics (and v2) (PR#270) + Minor changes to basic-health-check: improve information level (PR#271) + Collect important machine health counters (PR#276) + powerpc: collect hot-pluggable PCI and PHB slots (PR#278) + podman: collect podman disk usage (PR#279) + Exclude binary files in crondir (PR#282) + kexec/kdump: collect everything under /sys/kernel/kexec dir (PR#284) + Use short-iso for journalctl (PR#288) ------------------------------------------------------------------ ------------------ 2025-12-11 - Dec 11 2025 ------------------- ------------------------------------------------------------------ ++++ glib2: - Add CVE fixes: + glib2-CVE-2025-13601-1.patch, glib2-CVE-2025-13601-2.patch (bsc#1254297 CVE-2025-13601 glgo#GNOME/glib#3827). + glib2-CVE-2025-14087-1.patch, glib2-CVE-2025-14087-2.patch, glib2-CVE-2025-14087-3.patch (bsc#1254662 CVE-2025-14087 glgo#GNOME/glib#3834). + glib2-CVE-2025-14512.patch (bsc#1254878 CVE-2025-14512 glgo#GNOME/glib#3845). ++++ kernel-default: - kABI workaround for HCI_LE_ADV_0 addition (git-fixes). - commit 90a4a45 - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 (git-fixes). - commit 02e48bb ++++ kernel-rt: - kABI workaround for HCI_LE_ADV_0 addition (git-fixes). - commit 90a4a45 - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 (git-fixes). - commit 02e48bb ++++ kernel-rt_debug: - kABI workaround for HCI_LE_ADV_0 addition (git-fixes). - commit 90a4a45 - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 (git-fixes). - commit 02e48bb ++++ nvidia-open-driver-G06-signed: - readded kernel-6.18.patch still needed for cuda driver version 580.105.08 - update non-CUDA variant to version 580.119.02 (boo#1254801) ------------------------------------------------------------------ ------------------ 2025-12-10 - Dec 10 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (git-fixes). - commit 8914d15 - i2c: amd-mp2: fix reference leak in MP2 PCI device (git-fixes). - i2c: i2c.h: fix a bad kernel-doc line (git-fixes). - platform/x86: asus-wmi: use brightness_set_blocking() for kbd led (git-fixes). - commit 9bd979e ++++ kernel-rt: - cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (git-fixes). - commit 8914d15 - i2c: amd-mp2: fix reference leak in MP2 PCI device (git-fixes). - i2c: i2c.h: fix a bad kernel-doc line (git-fixes). - platform/x86: asus-wmi: use brightness_set_blocking() for kbd led (git-fixes). - commit 9bd979e ++++ kernel-rt_debug: - cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (git-fixes). - commit 8914d15 - i2c: amd-mp2: fix reference leak in MP2 PCI device (git-fixes). - i2c: i2c.h: fix a bad kernel-doc line (git-fixes). - platform/x86: asus-wmi: use brightness_set_blocking() for kbd led (git-fixes). - commit 9bd979e ------------------------------------------------------------------ ------------------ 2025-12-9 - Dec 9 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256, CVE-2025-38728). - commit 8caf30e - spi: tegra210-quad: Check hardware status on timeout (bsc#1253155) - commit d031559 - spi: tegra210-quad: Refactor error handling into helper functions (bsc#1253155) - commit 82f1192 - spi: tegra210-quad: Fix timeout handling (bsc#1253155) - commit bd1de03 - spi: tegra210-qspi: Remove cache operations (git-fixes) - commit a5fab01 - spi: tegra210-quad: Add support for internal DMA (git-fixes) - commit 8c1e0cc - spi: tegra210-quad: Update dummy sequence configuration (git-fixes) - commit 8db7584 - Delete patches.suse/spi-tegra210-quad-Fix-timeout-handling.patch. It will reinserted as part of bsc#1253155 update request. - commit aed40ae - smb: Log an error when close_all_cached_dirs fails (bsc#1246328, CVE-2025-38321). - commit a8a838a - arm64: zynqmp: Revert usb node drive strength and slew rate for (git-fixes) - commit 056601e - arm64: zynqmp: Fix usb node drive strength and slew rate (git-fixes) - commit 10b4884 - wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (CVE-2025-39890 bsc#1250334). - commit 51d9ba6 - dm-verity: fix unreliable memory allocation (git-fixes). - commit 811cec6 - ipmi: Fix handling of messages with provided receive message pointer (git-fixes). - commit 2e987f2 - ipmi: Rework user message limit handling (git-fixes). - commit 4cbb961 - mm/hugetlb: fix folio is still mapped when deleted (CVE-2025-40006 bsc#1252342). - commit e2e7e3b - hwmon: (w83791d) Convert macros to functions to avoid TOCTOU (git-fixes). - pinctrl: stm32: fix hwspinlock resource leak in probe function (git-fixes). - phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe() (git-fixes). - phy: broadcom: bcm63xx-usbh: fix section mismatches (git-fixes). - commit 2f1faf6 - kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths (CVE-2025-40201 bsc#1253455). - commit 4c20c7d - mm: hugetlb: avoid soft lockup when mprotect to large memory area (CVE-2025-40153 bsc#1253408). - commit 03b4aee ++++ kernel-rt: - smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256, CVE-2025-38728). - commit 8caf30e - spi: tegra210-quad: Check hardware status on timeout (bsc#1253155) - commit d031559 - spi: tegra210-quad: Refactor error handling into helper functions (bsc#1253155) - commit 82f1192 - spi: tegra210-quad: Fix timeout handling (bsc#1253155) - commit bd1de03 - spi: tegra210-qspi: Remove cache operations (git-fixes) - commit a5fab01 - spi: tegra210-quad: Add support for internal DMA (git-fixes) - commit 8c1e0cc - spi: tegra210-quad: Update dummy sequence configuration (git-fixes) - commit 8db7584 - Delete patches.suse/spi-tegra210-quad-Fix-timeout-handling.patch. It will reinserted as part of bsc#1253155 update request. - commit aed40ae - smb: Log an error when close_all_cached_dirs fails (bsc#1246328, CVE-2025-38321). - commit a8a838a - arm64: zynqmp: Revert usb node drive strength and slew rate for (git-fixes) - commit 056601e - arm64: zynqmp: Fix usb node drive strength and slew rate (git-fixes) - commit 10b4884 - wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (CVE-2025-39890 bsc#1250334). - commit 51d9ba6 - dm-verity: fix unreliable memory allocation (git-fixes). - commit 811cec6 - ipmi: Fix handling of messages with provided receive message pointer (git-fixes). - commit 2e987f2 - ipmi: Rework user message limit handling (git-fixes). - commit 4cbb961 - mm/hugetlb: fix folio is still mapped when deleted (CVE-2025-40006 bsc#1252342). - commit e2e7e3b - hwmon: (w83791d) Convert macros to functions to avoid TOCTOU (git-fixes). - pinctrl: stm32: fix hwspinlock resource leak in probe function (git-fixes). - phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe() (git-fixes). - phy: broadcom: bcm63xx-usbh: fix section mismatches (git-fixes). - commit 2f1faf6 - kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths (CVE-2025-40201 bsc#1253455). - commit 4c20c7d - mm: hugetlb: avoid soft lockup when mprotect to large memory area (CVE-2025-40153 bsc#1253408). - commit 03b4aee ++++ kernel-rt_debug: - smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256, CVE-2025-38728). - commit 8caf30e - spi: tegra210-quad: Check hardware status on timeout (bsc#1253155) - commit d031559 - spi: tegra210-quad: Refactor error handling into helper functions (bsc#1253155) - commit 82f1192 - spi: tegra210-quad: Fix timeout handling (bsc#1253155) - commit bd1de03 - spi: tegra210-qspi: Remove cache operations (git-fixes) - commit a5fab01 - spi: tegra210-quad: Add support for internal DMA (git-fixes) - commit 8c1e0cc - spi: tegra210-quad: Update dummy sequence configuration (git-fixes) - commit 8db7584 - Delete patches.suse/spi-tegra210-quad-Fix-timeout-handling.patch. It will reinserted as part of bsc#1253155 update request. - commit aed40ae - smb: Log an error when close_all_cached_dirs fails (bsc#1246328, CVE-2025-38321). - commit a8a838a - arm64: zynqmp: Revert usb node drive strength and slew rate for (git-fixes) - commit 056601e - arm64: zynqmp: Fix usb node drive strength and slew rate (git-fixes) - commit 10b4884 - wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (CVE-2025-39890 bsc#1250334). - commit 51d9ba6 - dm-verity: fix unreliable memory allocation (git-fixes). - commit 811cec6 - ipmi: Fix handling of messages with provided receive message pointer (git-fixes). - commit 2e987f2 - ipmi: Rework user message limit handling (git-fixes). - commit 4cbb961 - mm/hugetlb: fix folio is still mapped when deleted (CVE-2025-40006 bsc#1252342). - commit e2e7e3b - hwmon: (w83791d) Convert macros to functions to avoid TOCTOU (git-fixes). - pinctrl: stm32: fix hwspinlock resource leak in probe function (git-fixes). - phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe() (git-fixes). - phy: broadcom: bcm63xx-usbh: fix section mismatches (git-fixes). - commit 2f1faf6 - kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths (CVE-2025-40201 bsc#1253455). - commit 4c20c7d - mm: hugetlb: avoid soft lockup when mprotect to large memory area (CVE-2025-40153 bsc#1253408). - commit 03b4aee ------------------------------------------------------------------ ------------------ 2025-12-8 - Dec 8 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - powerpc/64s/slb: Fix SLB multihit issue during SLB preload (bac#1236022 ltc#211187). - commit 1a4723e - i3c: master: svc: Prevent incomplete IBI transaction (git-fixes). - clk: qcom: camcc-sm6350: Fix PLL config of PLL2 (git-fixes). - clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to other (git-fixes). - clk: renesas: r9a06g032: Fix memory leak in error path (git-fixes). - clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback (git-fixes). - commit 4cf8a99 ++++ kernel-rt: - powerpc/64s/slb: Fix SLB multihit issue during SLB preload (bac#1236022 ltc#211187). - commit 1a4723e - i3c: master: svc: Prevent incomplete IBI transaction (git-fixes). - clk: qcom: camcc-sm6350: Fix PLL config of PLL2 (git-fixes). - clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to other (git-fixes). - clk: renesas: r9a06g032: Fix memory leak in error path (git-fixes). - clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback (git-fixes). - commit 4cf8a99 ++++ kernel-rt_debug: - powerpc/64s/slb: Fix SLB multihit issue during SLB preload (bac#1236022 ltc#211187). - commit 1a4723e - i3c: master: svc: Prevent incomplete IBI transaction (git-fixes). - clk: qcom: camcc-sm6350: Fix PLL config of PLL2 (git-fixes). - clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to other (git-fixes). - clk: renesas: r9a06g032: Fix memory leak in error path (git-fixes). - clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback (git-fixes). - commit 4cf8a99 ------------------------------------------------------------------ ------------------ 2025-12-7 - Dec 7 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - staging: fbtft: core: fix potential memory leak in fbtft_probe_common() (git-fixes). - usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt (git-fixes). - USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC (git-fixes). - USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC (git-fixes). - usb: phy: Initialize struct usb_phy list_head (git-fixes). - usb: dwc2: fix hang during suspend if set as peripheral (git-fixes). - usb: chaoskey: fix locking for O_NONBLOCK (git-fixes). - USB: Fix descriptor count when handling invalid MBIM extended descriptor (git-fixes). - intel_th: Fix error handling in intel_th_output_open (git-fixes). - comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel() (git-fixes). - comedi: multiq3: sanitize config options in multiq3_attach() (git-fixes). - comedi: check device's attached status in compat ioctls (git-fixes). - comedi: c6xdigio: Fix invalid PNP driver unregistration (git-fixes). - firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc (git-fixes). - iio: core: Clean up device correctly on iio_device_alloc() failure (git-fixes). - iio: core: add missing mutex_destroy in iio_dev_release() (git-fixes). - iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member (git-fixes). - firmware: stratix10-svc: Add mutex in stratix10 memory management (git-fixes). - uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe (git-fixes). - fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() (git-fixes). - fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing (git-fixes). - fbdev: tcx.c fix mem_map to correct smem_start offset (git-fixes). - watchdog: wdat_wdt: Fix ACPI table leak in probe function (git-fixes). - rpmsg: glink: fix rpmsg device leak (git-fixes). - iio: accel: bmc150: Fix irq assumption regression (stable-fixes). - usb: storage: sddr55: Reject out-of-bound new_pba (stable-fixes). - USB: serial: option: add support for Rolling RW101R-GL (stable-fixes). - USB: serial: ftdi_sio: add support for u-blox EVK-M101 (stable-fixes). - usb: dwc3: pci: Sort out the Intel device IDs (stable-fixes). - usb: dwc3: pci: add support for the Intel Nova Lake -S (stable-fixes). - thunderbolt: Add support for Intel Wildcat Lake (stable-fixes). - drm/amd/display: Check NULL before accessing (stable-fixes). - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 (stable-fixes). - commit a6f8c1f ++++ kernel-rt: - staging: fbtft: core: fix potential memory leak in fbtft_probe_common() (git-fixes). - usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt (git-fixes). - USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC (git-fixes). - USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC (git-fixes). - usb: phy: Initialize struct usb_phy list_head (git-fixes). - usb: dwc2: fix hang during suspend if set as peripheral (git-fixes). - usb: chaoskey: fix locking for O_NONBLOCK (git-fixes). - USB: Fix descriptor count when handling invalid MBIM extended descriptor (git-fixes). - intel_th: Fix error handling in intel_th_output_open (git-fixes). - comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel() (git-fixes). - comedi: multiq3: sanitize config options in multiq3_attach() (git-fixes). - comedi: check device's attached status in compat ioctls (git-fixes). - comedi: c6xdigio: Fix invalid PNP driver unregistration (git-fixes). - firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc (git-fixes). - iio: core: Clean up device correctly on iio_device_alloc() failure (git-fixes). - iio: core: add missing mutex_destroy in iio_dev_release() (git-fixes). - iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member (git-fixes). - firmware: stratix10-svc: Add mutex in stratix10 memory management (git-fixes). - uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe (git-fixes). - fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() (git-fixes). - fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing (git-fixes). - fbdev: tcx.c fix mem_map to correct smem_start offset (git-fixes). - watchdog: wdat_wdt: Fix ACPI table leak in probe function (git-fixes). - rpmsg: glink: fix rpmsg device leak (git-fixes). - iio: accel: bmc150: Fix irq assumption regression (stable-fixes). - usb: storage: sddr55: Reject out-of-bound new_pba (stable-fixes). - USB: serial: option: add support for Rolling RW101R-GL (stable-fixes). - USB: serial: ftdi_sio: add support for u-blox EVK-M101 (stable-fixes). - usb: dwc3: pci: Sort out the Intel device IDs (stable-fixes). - usb: dwc3: pci: add support for the Intel Nova Lake -S (stable-fixes). - thunderbolt: Add support for Intel Wildcat Lake (stable-fixes). - drm/amd/display: Check NULL before accessing (stable-fixes). - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 (stable-fixes). - commit a6f8c1f ++++ kernel-rt_debug: - staging: fbtft: core: fix potential memory leak in fbtft_probe_common() (git-fixes). - usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt (git-fixes). - USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC (git-fixes). - USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC (git-fixes). - usb: phy: Initialize struct usb_phy list_head (git-fixes). - usb: dwc2: fix hang during suspend if set as peripheral (git-fixes). - usb: chaoskey: fix locking for O_NONBLOCK (git-fixes). - USB: Fix descriptor count when handling invalid MBIM extended descriptor (git-fixes). - intel_th: Fix error handling in intel_th_output_open (git-fixes). - comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel() (git-fixes). - comedi: multiq3: sanitize config options in multiq3_attach() (git-fixes). - comedi: check device's attached status in compat ioctls (git-fixes). - comedi: c6xdigio: Fix invalid PNP driver unregistration (git-fixes). - firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc (git-fixes). - iio: core: Clean up device correctly on iio_device_alloc() failure (git-fixes). - iio: core: add missing mutex_destroy in iio_dev_release() (git-fixes). - iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member (git-fixes). - firmware: stratix10-svc: Add mutex in stratix10 memory management (git-fixes). - uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe (git-fixes). - fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() (git-fixes). - fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing (git-fixes). - fbdev: tcx.c fix mem_map to correct smem_start offset (git-fixes). - watchdog: wdat_wdt: Fix ACPI table leak in probe function (git-fixes). - rpmsg: glink: fix rpmsg device leak (git-fixes). - iio: accel: bmc150: Fix irq assumption regression (stable-fixes). - usb: storage: sddr55: Reject out-of-bound new_pba (stable-fixes). - USB: serial: option: add support for Rolling RW101R-GL (stable-fixes). - USB: serial: ftdi_sio: add support for u-blox EVK-M101 (stable-fixes). - usb: dwc3: pci: Sort out the Intel device IDs (stable-fixes). - usb: dwc3: pci: add support for the Intel Nova Lake -S (stable-fixes). - thunderbolt: Add support for Intel Wildcat Lake (stable-fixes). - drm/amd/display: Check NULL before accessing (stable-fixes). - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 (stable-fixes). - commit a6f8c1f ------------------------------------------------------------------ ------------------ 2025-12-6 - Dec 6 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - soc: amlogic: canvas: fix device leak on lookup (git-fixes). - soc: qcom: smem: fix hwspinlock resource leak in probe error paths (git-fixes). - soc: qcom: ocmem: fix device leak on lookup (git-fixes). - firmware: imx: scu-irq: fix OF node leak in (git-fixes). - soc/tegra: fuse: speedo-tegra210: Update speedo IDs (git-fixes). - commit 67bcab6 ++++ kernel-rt: - soc: amlogic: canvas: fix device leak on lookup (git-fixes). - soc: qcom: smem: fix hwspinlock resource leak in probe error paths (git-fixes). - soc: qcom: ocmem: fix device leak on lookup (git-fixes). - firmware: imx: scu-irq: fix OF node leak in (git-fixes). - soc/tegra: fuse: speedo-tegra210: Update speedo IDs (git-fixes). - commit 67bcab6 ++++ kernel-rt_debug: - soc: amlogic: canvas: fix device leak on lookup (git-fixes). - soc: qcom: smem: fix hwspinlock resource leak in probe error paths (git-fixes). - soc: qcom: ocmem: fix device leak on lookup (git-fixes). - firmware: imx: scu-irq: fix OF node leak in (git-fixes). - soc/tegra: fuse: speedo-tegra210: Update speedo IDs (git-fixes). - commit 67bcab6 ------------------------------------------------------------------ ------------------ 2025-12-5 - Dec 5 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2 (git-fixes). - PCI: keystone: Exit ks_pcie_probe() for invalid mode (git-fixes). - PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition (git-fixes). - PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths (git-fixes). - power: supply: apm_power: only unset own apm_get_power_status (git-fixes). - power: supply: wm831x: Check wm831x_set_bits() return value (git-fixes). - power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges() (git-fixes). - power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges() (git-fixes). - power: supply: cw2015: Check devm_delayed_work_autocancel() return code (git-fixes). - mfd: mt6358-irq: Fix missing irq_domain_remove() in error path (git-fixes). - mfd: mt6397-irq: Fix missing irq_domain_remove() in error path (git-fixes). - mfd: max77620: Fix potential IRQ chip conflict when probing two devices (git-fixes). - platform/x86: intel: chtwc_int33fe: don't dereference swnode args (git-fixes). - spi: bcm63xx: drop wrong casts in probe() (git-fixes). - spi: tegra210-quad: Fix timeout handling (git-fixes). - regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex (git-fixes). - regulator: core: disable supply if enabling main regulator fails (git-fixes). - mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors (git-fixes). - mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove (git-fixes). - mtd: nand: relax ECC parameter validation check (git-fixes). - Revert "mtd: rawnand: marvell: fix layouts" (git-fixes). - mtd: lpddr_cmds: fix signed shifts in lpddr_cmds (git-fixes). - mtd: maps: pcmciamtd: fix potential memory leak in pcmciamtd_detach() (git-fixes). - pwm: bcm2835: Make sure the channel is enabled after pwm_request() (git-fixes). - platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver (git-fixes). - commit 6ae74c9 - mfd: da9055: Fix missing regmap_del_irq_chip() in error path (git-fixes). - mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup (git-fixes). - media: rc: st_rc: Fix reset control resource leak (git-fixes). - media: videobuf2: Fix device reference leak in vb2_dc_alloc error path (git-fixes). - media: vpif_display: fix section mismatch (git-fixes). - media: vpif_capture: fix section mismatch (git-fixes). - media: samsung: exynos4-is: fix potential ABBA deadlock on init (git-fixes). - media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled (git-fixes). - media: amphion: Cancel message work before releasing the VPU core (git-fixes). - media: verisilicon: Protect G2 HEVC decoder against invalid DPB index (git-fixes). - media: v4l2-mem2mem: Fix outdated documentation (git-fixes). - media: cec: Fix debugfs leak on bus_register() failure (git-fixes). - media: vidtv: initialize local pointers upon transfer of memory ownership (git-fixes). - media: pvrusb2: Fix incorrect variable used in trace message (git-fixes). - media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() (git-fixes). - media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() (git-fixes). - media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe (git-fixes). - media: i2c: adv7842: Remove redundant cancel_delayed_work in probe (git-fixes). - media: TDA1997x: Remove redundant cancel_delayed_work in probe (git-fixes). - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() (git-fixes). - commit 0f91c8f - Documentation: hid-alps: Fix packet format section headings (git-fixes). - HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync() (git-fixes). - HID: logitech-dj: Remove duplicate error logging (git-fixes). - backlight: lp855x: Fix lp855x.h kernel-doc warnings (git-fixes). - backlight: led-bl: Add devlink to supplier LEDs (git-fixes). - leds: netxbig: Fix GPIO descriptor leak in error paths (git-fixes). - leds: leds-lp50xx: Enable chip before any communication (git-fixes). - leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs (git-fixes). - leds: leds-lp50xx: Allow LED 0 to be added to module bank (git-fixes). - hwmon: (max16065) Use local variable to avoid TOCTOU (git-fixes). - hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU (git-fixes). - hwmon: sy7636a: Fix regulator_enable resource leak on error path (git-fixes). - ASoC: Intel: catpt: Fix error path in hw_params() (git-fixes). - ASoC: stm32: sai: fix OF node leak on probe (git-fixes). - ASoC: stm32: sai: fix clk prepare imbalance on probe failure (git-fixes). - ASoC: stm32: sai: fix device leak on probe (git-fixes). - ASoC: qcom: q6asm-dai: perform correct state check before closing (git-fixes). - ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment (git-fixes). - ASoC: qcom: q6adm: the the copp device only during last instance (git-fixes). - ALSA: dice: fix buffer overflow in detect_stream_formats() (git-fixes). - ASoC: fsl_xcvr: clear the channel status control memory (git-fixes). - drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma (git-fixes). - drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() (git-fixes). - drm/nouveau: restrict the flush page to a 32-bit address (git-fixes). - drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse() (git-fixes). - drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue (git-fixes). - drm/msm/a6xx: Flush LRZ cache before PT switch (git-fixes). - drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers (git-fixes). - drm/msm/a2xx: stop over-complaining about the legacy firmware (git-fixes). - drm/msm/dpu: Remove dead-code in dpu_encoder_helper_reset_mixers() (git-fixes). - drm/vgem-fence: Fix potential deadlock on release (git-fixes). - drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() (git-fixes). - gpu: host1x: Fix race in syncpt alloc/free (git-fixes). - commit 7fcfbe3 ++++ kernel-rt: - PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2 (git-fixes). - PCI: keystone: Exit ks_pcie_probe() for invalid mode (git-fixes). - PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition (git-fixes). - PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths (git-fixes). - power: supply: apm_power: only unset own apm_get_power_status (git-fixes). - power: supply: wm831x: Check wm831x_set_bits() return value (git-fixes). - power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges() (git-fixes). - power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges() (git-fixes). - power: supply: cw2015: Check devm_delayed_work_autocancel() return code (git-fixes). - mfd: mt6358-irq: Fix missing irq_domain_remove() in error path (git-fixes). - mfd: mt6397-irq: Fix missing irq_domain_remove() in error path (git-fixes). - mfd: max77620: Fix potential IRQ chip conflict when probing two devices (git-fixes). - platform/x86: intel: chtwc_int33fe: don't dereference swnode args (git-fixes). - spi: bcm63xx: drop wrong casts in probe() (git-fixes). - spi: tegra210-quad: Fix timeout handling (git-fixes). - regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex (git-fixes). - regulator: core: disable supply if enabling main regulator fails (git-fixes). - mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors (git-fixes). - mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove (git-fixes). - mtd: nand: relax ECC parameter validation check (git-fixes). - Revert "mtd: rawnand: marvell: fix layouts" (git-fixes). - mtd: lpddr_cmds: fix signed shifts in lpddr_cmds (git-fixes). - mtd: maps: pcmciamtd: fix potential memory leak in pcmciamtd_detach() (git-fixes). - pwm: bcm2835: Make sure the channel is enabled after pwm_request() (git-fixes). - platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver (git-fixes). - commit 6ae74c9 - mfd: da9055: Fix missing regmap_del_irq_chip() in error path (git-fixes). - mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup (git-fixes). - media: rc: st_rc: Fix reset control resource leak (git-fixes). - media: videobuf2: Fix device reference leak in vb2_dc_alloc error path (git-fixes). - media: vpif_display: fix section mismatch (git-fixes). - media: vpif_capture: fix section mismatch (git-fixes). - media: samsung: exynos4-is: fix potential ABBA deadlock on init (git-fixes). - media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled (git-fixes). - media: amphion: Cancel message work before releasing the VPU core (git-fixes). - media: verisilicon: Protect G2 HEVC decoder against invalid DPB index (git-fixes). - media: v4l2-mem2mem: Fix outdated documentation (git-fixes). - media: cec: Fix debugfs leak on bus_register() failure (git-fixes). - media: vidtv: initialize local pointers upon transfer of memory ownership (git-fixes). - media: pvrusb2: Fix incorrect variable used in trace message (git-fixes). - media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() (git-fixes). - media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() (git-fixes). - media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe (git-fixes). - media: i2c: adv7842: Remove redundant cancel_delayed_work in probe (git-fixes). - media: TDA1997x: Remove redundant cancel_delayed_work in probe (git-fixes). - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() (git-fixes). - commit 0f91c8f - Documentation: hid-alps: Fix packet format section headings (git-fixes). - HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync() (git-fixes). - HID: logitech-dj: Remove duplicate error logging (git-fixes). - backlight: lp855x: Fix lp855x.h kernel-doc warnings (git-fixes). - backlight: led-bl: Add devlink to supplier LEDs (git-fixes). - leds: netxbig: Fix GPIO descriptor leak in error paths (git-fixes). - leds: leds-lp50xx: Enable chip before any communication (git-fixes). - leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs (git-fixes). - leds: leds-lp50xx: Allow LED 0 to be added to module bank (git-fixes). - hwmon: (max16065) Use local variable to avoid TOCTOU (git-fixes). - hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU (git-fixes). - hwmon: sy7636a: Fix regulator_enable resource leak on error path (git-fixes). - ASoC: Intel: catpt: Fix error path in hw_params() (git-fixes). - ASoC: stm32: sai: fix OF node leak on probe (git-fixes). - ASoC: stm32: sai: fix clk prepare imbalance on probe failure (git-fixes). - ASoC: stm32: sai: fix device leak on probe (git-fixes). - ASoC: qcom: q6asm-dai: perform correct state check before closing (git-fixes). - ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment (git-fixes). - ASoC: qcom: q6adm: the the copp device only during last instance (git-fixes). - ALSA: dice: fix buffer overflow in detect_stream_formats() (git-fixes). - ASoC: fsl_xcvr: clear the channel status control memory (git-fixes). - drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma (git-fixes). - drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() (git-fixes). - drm/nouveau: restrict the flush page to a 32-bit address (git-fixes). - drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse() (git-fixes). - drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue (git-fixes). - drm/msm/a6xx: Flush LRZ cache before PT switch (git-fixes). - drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers (git-fixes). - drm/msm/a2xx: stop over-complaining about the legacy firmware (git-fixes). - drm/msm/dpu: Remove dead-code in dpu_encoder_helper_reset_mixers() (git-fixes). - drm/vgem-fence: Fix potential deadlock on release (git-fixes). - drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() (git-fixes). - gpu: host1x: Fix race in syncpt alloc/free (git-fixes). - commit 7fcfbe3 ++++ kernel-rt_debug: - PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2 (git-fixes). - PCI: keystone: Exit ks_pcie_probe() for invalid mode (git-fixes). - PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition (git-fixes). - PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths (git-fixes). - power: supply: apm_power: only unset own apm_get_power_status (git-fixes). - power: supply: wm831x: Check wm831x_set_bits() return value (git-fixes). - power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges() (git-fixes). - power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges() (git-fixes). - power: supply: cw2015: Check devm_delayed_work_autocancel() return code (git-fixes). - mfd: mt6358-irq: Fix missing irq_domain_remove() in error path (git-fixes). - mfd: mt6397-irq: Fix missing irq_domain_remove() in error path (git-fixes). - mfd: max77620: Fix potential IRQ chip conflict when probing two devices (git-fixes). - platform/x86: intel: chtwc_int33fe: don't dereference swnode args (git-fixes). - spi: bcm63xx: drop wrong casts in probe() (git-fixes). - spi: tegra210-quad: Fix timeout handling (git-fixes). - regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex (git-fixes). - regulator: core: disable supply if enabling main regulator fails (git-fixes). - mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors (git-fixes). - mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove (git-fixes). - mtd: nand: relax ECC parameter validation check (git-fixes). - Revert "mtd: rawnand: marvell: fix layouts" (git-fixes). - mtd: lpddr_cmds: fix signed shifts in lpddr_cmds (git-fixes). - mtd: maps: pcmciamtd: fix potential memory leak in pcmciamtd_detach() (git-fixes). - pwm: bcm2835: Make sure the channel is enabled after pwm_request() (git-fixes). - platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver (git-fixes). - commit 6ae74c9 - mfd: da9055: Fix missing regmap_del_irq_chip() in error path (git-fixes). - mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup (git-fixes). - media: rc: st_rc: Fix reset control resource leak (git-fixes). - media: videobuf2: Fix device reference leak in vb2_dc_alloc error path (git-fixes). - media: vpif_display: fix section mismatch (git-fixes). - media: vpif_capture: fix section mismatch (git-fixes). - media: samsung: exynos4-is: fix potential ABBA deadlock on init (git-fixes). - media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled (git-fixes). - media: amphion: Cancel message work before releasing the VPU core (git-fixes). - media: verisilicon: Protect G2 HEVC decoder against invalid DPB index (git-fixes). - media: v4l2-mem2mem: Fix outdated documentation (git-fixes). - media: cec: Fix debugfs leak on bus_register() failure (git-fixes). - media: vidtv: initialize local pointers upon transfer of memory ownership (git-fixes). - media: pvrusb2: Fix incorrect variable used in trace message (git-fixes). - media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() (git-fixes). - media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() (git-fixes). - media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe (git-fixes). - media: i2c: adv7842: Remove redundant cancel_delayed_work in probe (git-fixes). - media: TDA1997x: Remove redundant cancel_delayed_work in probe (git-fixes). - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() (git-fixes). - commit 0f91c8f - Documentation: hid-alps: Fix packet format section headings (git-fixes). - HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync() (git-fixes). - HID: logitech-dj: Remove duplicate error logging (git-fixes). - backlight: lp855x: Fix lp855x.h kernel-doc warnings (git-fixes). - backlight: led-bl: Add devlink to supplier LEDs (git-fixes). - leds: netxbig: Fix GPIO descriptor leak in error paths (git-fixes). - leds: leds-lp50xx: Enable chip before any communication (git-fixes). - leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs (git-fixes). - leds: leds-lp50xx: Allow LED 0 to be added to module bank (git-fixes). - hwmon: (max16065) Use local variable to avoid TOCTOU (git-fixes). - hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU (git-fixes). - hwmon: sy7636a: Fix regulator_enable resource leak on error path (git-fixes). - ASoC: Intel: catpt: Fix error path in hw_params() (git-fixes). - ASoC: stm32: sai: fix OF node leak on probe (git-fixes). - ASoC: stm32: sai: fix clk prepare imbalance on probe failure (git-fixes). - ASoC: stm32: sai: fix device leak on probe (git-fixes). - ASoC: qcom: q6asm-dai: perform correct state check before closing (git-fixes). - ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment (git-fixes). - ASoC: qcom: q6adm: the the copp device only during last instance (git-fixes). - ALSA: dice: fix buffer overflow in detect_stream_formats() (git-fixes). - ASoC: fsl_xcvr: clear the channel status control memory (git-fixes). - drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma (git-fixes). - drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() (git-fixes). - drm/nouveau: restrict the flush page to a 32-bit address (git-fixes). - drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse() (git-fixes). - drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue (git-fixes). - drm/msm/a6xx: Flush LRZ cache before PT switch (git-fixes). - drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers (git-fixes). - drm/msm/a2xx: stop over-complaining about the legacy firmware (git-fixes). - drm/msm/dpu: Remove dead-code in dpu_encoder_helper_reset_mixers() (git-fixes). - drm/vgem-fence: Fix potential deadlock on release (git-fixes). - drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() (git-fixes). - gpu: host1x: Fix race in syncpt alloc/free (git-fixes). - commit 7fcfbe3 ++++ libpng16: - security update - added patches CVE-2025-66293 [bsc#1254480], LIBPNG out-of-bounds read in png_image_read_composite * libpng16-CVE-2025-66293-1.patch * libpng16-CVE-2025-66293-2.patch ------------------------------------------------------------------ ------------------ 2025-12-4 - Dec 4 2025 ------------------- ------------------------------------------------------------------ ++++ fde-tools: - Build with distro flags ++++ kernel-default: - RDMA/irdma: Remove unused struct irdma_cq fields (git-fixes) Refresh patches.suse/RDMA-irdma-Set-irdma_cq-cq_num-field-during-CQ-creat.patch - commit acb152c - wifi: nl80211: vendor-cmd: intel: fix a blank kernel-doc line warning (git-fixes). - wifi: ieee80211: correct FILS status codes (git-fixes). - mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() (git-fixes). - wifi: mt76: Fix DTS power-limits on little endian systems (git-fixes). - wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() (git-fixes). - wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() (git-fixes). - wifi: mac80211: fix CMAC functions not handling errors (git-fixes). - net: phy: adin1100: Fix software power-down ready condition (git-fixes). - wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() (git-fixes). - wifi: ath11k: fix peer HE MCS assignment (git-fixes). - wifi: ath11k: restore register window after global reset (git-fixes). - lib/vsprintf: Check pointer before dereferencing in time_and_date() (git-fixes). - Documentation/kernel-parameters: fix typo in retbleed= kernel parameter description (git-fixes). - Documentation: parport-lowlevel: Separate function listing code blocks (git-fixes). - docs: w1: fix w1-netlink invalid URL (git-fixes). - crypto: ccree - Correctly handle return of sg_nents_for_len (git-fixes). - crypto: iaa - Fix incorrect return value in save_iaa_wq() (git-fixes). - crypto: rockchip - drop redundant crypto_skcipher_ivsize() calls (git-fixes). - crypto: hisilicon/qm - restore original qos values (git-fixes). - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (git-fixes). - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (git-fixes). - ima: Handle error code returned by ima_filter_rule_match() (git-fixes). - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (git-fixes). - KEYS: trusted_tpm1: Compare HMAC values in constant time (git-fixes). - commit 912d691 - btrfs: make sure extent and csum paths are always released in scrub_raid56_parity_stripe() (git-fixes). - commit 6dcb53c ++++ kernel-rt: - RDMA/irdma: Remove unused struct irdma_cq fields (git-fixes) Refresh patches.suse/RDMA-irdma-Set-irdma_cq-cq_num-field-during-CQ-creat.patch - commit acb152c - wifi: nl80211: vendor-cmd: intel: fix a blank kernel-doc line warning (git-fixes). - wifi: ieee80211: correct FILS status codes (git-fixes). - mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() (git-fixes). - wifi: mt76: Fix DTS power-limits on little endian systems (git-fixes). - wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() (git-fixes). - wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() (git-fixes). - wifi: mac80211: fix CMAC functions not handling errors (git-fixes). - net: phy: adin1100: Fix software power-down ready condition (git-fixes). - wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() (git-fixes). - wifi: ath11k: fix peer HE MCS assignment (git-fixes). - wifi: ath11k: restore register window after global reset (git-fixes). - lib/vsprintf: Check pointer before dereferencing in time_and_date() (git-fixes). - Documentation/kernel-parameters: fix typo in retbleed= kernel parameter description (git-fixes). - Documentation: parport-lowlevel: Separate function listing code blocks (git-fixes). - docs: w1: fix w1-netlink invalid URL (git-fixes). - crypto: ccree - Correctly handle return of sg_nents_for_len (git-fixes). - crypto: iaa - Fix incorrect return value in save_iaa_wq() (git-fixes). - crypto: rockchip - drop redundant crypto_skcipher_ivsize() calls (git-fixes). - crypto: hisilicon/qm - restore original qos values (git-fixes). - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (git-fixes). - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (git-fixes). - ima: Handle error code returned by ima_filter_rule_match() (git-fixes). - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (git-fixes). - KEYS: trusted_tpm1: Compare HMAC values in constant time (git-fixes). - commit 912d691 - btrfs: make sure extent and csum paths are always released in scrub_raid56_parity_stripe() (git-fixes). - commit 6dcb53c ++++ kernel-rt_debug: - RDMA/irdma: Remove unused struct irdma_cq fields (git-fixes) Refresh patches.suse/RDMA-irdma-Set-irdma_cq-cq_num-field-during-CQ-creat.patch - commit acb152c - wifi: nl80211: vendor-cmd: intel: fix a blank kernel-doc line warning (git-fixes). - wifi: ieee80211: correct FILS status codes (git-fixes). - mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() (git-fixes). - wifi: mt76: Fix DTS power-limits on little endian systems (git-fixes). - wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() (git-fixes). - wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() (git-fixes). - wifi: mac80211: fix CMAC functions not handling errors (git-fixes). - net: phy: adin1100: Fix software power-down ready condition (git-fixes). - wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() (git-fixes). - wifi: ath11k: fix peer HE MCS assignment (git-fixes). - wifi: ath11k: restore register window after global reset (git-fixes). - lib/vsprintf: Check pointer before dereferencing in time_and_date() (git-fixes). - Documentation/kernel-parameters: fix typo in retbleed= kernel parameter description (git-fixes). - Documentation: parport-lowlevel: Separate function listing code blocks (git-fixes). - docs: w1: fix w1-netlink invalid URL (git-fixes). - crypto: ccree - Correctly handle return of sg_nents_for_len (git-fixes). - crypto: iaa - Fix incorrect return value in save_iaa_wq() (git-fixes). - crypto: rockchip - drop redundant crypto_skcipher_ivsize() calls (git-fixes). - crypto: hisilicon/qm - restore original qos values (git-fixes). - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (git-fixes). - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (git-fixes). - ima: Handle error code returned by ima_filter_rule_match() (git-fixes). - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (git-fixes). - KEYS: trusted_tpm1: Compare HMAC values in constant time (git-fixes). - commit 912d691 - btrfs: make sure extent and csum paths are always released in scrub_raid56_parity_stripe() (git-fixes). - commit 6dcb53c ------------------------------------------------------------------ ------------------ 2025-12-3 - Dec 3 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() (git-fixes). - ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 (git-fixes). - efi/libstub: Fix page table access in 5-level to 4-level paging transition (git-fixes). - efi/libstub: Describe missing 'out' parameter in efi_load_initrd (git-fixes). - commit 242aae6 ++++ kernel-rt: - ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() (git-fixes). - ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 (git-fixes). - efi/libstub: Fix page table access in 5-level to 4-level paging transition (git-fixes). - efi/libstub: Describe missing 'out' parameter in efi_load_initrd (git-fixes). - commit 242aae6 ++++ kernel-rt_debug: - ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() (git-fixes). - ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 (git-fixes). - efi/libstub: Fix page table access in 5-level to 4-level paging transition (git-fixes). - efi/libstub: Describe missing 'out' parameter in efi_load_initrd (git-fixes). - commit 242aae6 ++++ nvidia-open-driver-G06-signed: - kernel-6.18.patch * fixed build against kernel 6.18 ------------------------------------------------------------------ ------------------ 2025-12-2 - Dec 2 2025 ------------------- ------------------------------------------------------------------ ++++ python-kiwi: - Adding support for import of custom certificates This commit adds support for providing custom CA certificates during the build process. It allows a user to specify one ore more CA file(s) via the new section and/or via the command line. The certificate files will be imported directly after the image bootstrap has finished (where the required CA update tools are available), but before any further packages are retrieved, solving for situations where the chroot environment needs certificates, e.g. when there's a proxy server in the build environment. This fixes bsc#1271367 Co-authored-by: Marcus Schaefer (cherry picked from commit 88107398f5495b30b907cab7e6aacc9ff46ff316) ++++ kernel-default: - Input: cros_ec_keyb - fix an invalid memory access (stable-fixes). - Input: goodix - add support for ACPI ID GDIX1003 (stable-fixes). - drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled (stable-fixes). - drm/amd/display: Increase DPCD read retries (stable-fixes). - drm/amd/display: Move sleep into each retry for retrieve_link_cap() (stable-fixes). - kconfig/nconf: Initialize the default locale at startup (stable-fixes). - kconfig/mconf: Initialize the default locale at startup (stable-fixes). - Input: goodix - add support for ACPI ID GDX9110 (stable-fixes). - commit 7011d30 ++++ kernel-rt: - Input: cros_ec_keyb - fix an invalid memory access (stable-fixes). - Input: goodix - add support for ACPI ID GDIX1003 (stable-fixes). - drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled (stable-fixes). - drm/amd/display: Increase DPCD read retries (stable-fixes). - drm/amd/display: Move sleep into each retry for retrieve_link_cap() (stable-fixes). - kconfig/nconf: Initialize the default locale at startup (stable-fixes). - kconfig/mconf: Initialize the default locale at startup (stable-fixes). - Input: goodix - add support for ACPI ID GDX9110 (stable-fixes). - commit 7011d30 ++++ kernel-rt_debug: - Input: cros_ec_keyb - fix an invalid memory access (stable-fixes). - Input: goodix - add support for ACPI ID GDIX1003 (stable-fixes). - drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled (stable-fixes). - drm/amd/display: Increase DPCD read retries (stable-fixes). - drm/amd/display: Move sleep into each retry for retrieve_link_cap() (stable-fixes). - kconfig/nconf: Initialize the default locale at startup (stable-fixes). - kconfig/mconf: Initialize the default locale at startup (stable-fixes). - Input: goodix - add support for ACPI ID GDX9110 (stable-fixes). - commit 7011d30 ------------------------------------------------------------------ ------------------ 2025-12-1 - Dec 1 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - orangefs: fix xattr related buffer overflow.. (git-fixes). - commit f97ca07 - rpm/mkspec: Exclude azure from kernel-syms dependencies Similar to rt azure was initially a separate kernel variant, and not all KMPs are built for it. kernel-azure-devel should be included as explicit build depedency to get a KMP for this kernel flavor. - commit c174e9b ++++ kernel-rt: - orangefs: fix xattr related buffer overflow.. (git-fixes). - commit f97ca07 - rpm/mkspec: Exclude azure from kernel-syms dependencies Similar to rt azure was initially a separate kernel variant, and not all KMPs are built for it. kernel-azure-devel should be included as explicit build depedency to get a KMP for this kernel flavor. - commit c174e9b ++++ kernel-rt_debug: - orangefs: fix xattr related buffer overflow.. (git-fixes). - commit f97ca07 - rpm/mkspec: Exclude azure from kernel-syms dependencies Similar to rt azure was initially a separate kernel variant, and not all KMPs are built for it. kernel-azure-devel should be included as explicit build depedency to get a KMP for this kernel flavor. - commit c174e9b ------------------------------------------------------------------ ------------------ 2025-11-29 - Nov 29 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors (git-fixes). - spi: bcm63xx: fix premature CS deassertion on RX-only transactions (git-fixes). - firmware: stratix10-svc: fix bug in saving controller data (git-fixes). - iio: st_lsm6dsx: Fixed calibrated timestamp calculation (git-fixes). - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields (git-fixes). - iio: accel: fix ADXL355 startup race condition (git-fixes). - iio:common:ssp_sensors: Fix an error handling path ssp_probe() (git-fixes). - iio: adc: ad7280a: fix ad7280_store_balance_timer() (git-fixes). - most: usb: fix double free on late probe failure (git-fixes). - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves (git-fixes). - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking (git-fixes). - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors (git-fixes). - USB: storage: Remove subclass and protocol overrides from Novatek quirk (git-fixes). - usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer (git-fixes). - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (git-fixes). - xhci: dbgtty: fix device unregister (git-fixes). - usb: gadget: f_eem: Fix memory leak in eem_unwrap (git-fixes). - drivers/usb/dwc3: fix PCI parent check (git-fixes). - usb: storage: Fix memory leak in USB bulk transport (git-fixes). - usb: cdns3: Fix double resource release in cdns3_pci_probe (git-fixes). - mailbox: mailbox-test: Fix debugfs_create_dir error checking (git-fixes). - drm: sti: fix device leaks at component probe (git-fixes). - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling (git-fixes). - commit 17705d7 - net: dlink: handle copy_thresh allocation failure (CVE-2025-40053 bsc#1252808) - commit 975011b ++++ kernel-rt: - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors (git-fixes). - spi: bcm63xx: fix premature CS deassertion on RX-only transactions (git-fixes). - firmware: stratix10-svc: fix bug in saving controller data (git-fixes). - iio: st_lsm6dsx: Fixed calibrated timestamp calculation (git-fixes). - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields (git-fixes). - iio: accel: fix ADXL355 startup race condition (git-fixes). - iio:common:ssp_sensors: Fix an error handling path ssp_probe() (git-fixes). - iio: adc: ad7280a: fix ad7280_store_balance_timer() (git-fixes). - most: usb: fix double free on late probe failure (git-fixes). - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves (git-fixes). - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking (git-fixes). - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors (git-fixes). - USB: storage: Remove subclass and protocol overrides from Novatek quirk (git-fixes). - usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer (git-fixes). - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (git-fixes). - xhci: dbgtty: fix device unregister (git-fixes). - usb: gadget: f_eem: Fix memory leak in eem_unwrap (git-fixes). - drivers/usb/dwc3: fix PCI parent check (git-fixes). - usb: storage: Fix memory leak in USB bulk transport (git-fixes). - usb: cdns3: Fix double resource release in cdns3_pci_probe (git-fixes). - mailbox: mailbox-test: Fix debugfs_create_dir error checking (git-fixes). - drm: sti: fix device leaks at component probe (git-fixes). - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling (git-fixes). - commit 17705d7 - net: dlink: handle copy_thresh allocation failure (CVE-2025-40053 bsc#1252808) - commit 975011b ++++ kernel-rt_debug: - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors (git-fixes). - spi: bcm63xx: fix premature CS deassertion on RX-only transactions (git-fixes). - firmware: stratix10-svc: fix bug in saving controller data (git-fixes). - iio: st_lsm6dsx: Fixed calibrated timestamp calculation (git-fixes). - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields (git-fixes). - iio: accel: fix ADXL355 startup race condition (git-fixes). - iio:common:ssp_sensors: Fix an error handling path ssp_probe() (git-fixes). - iio: adc: ad7280a: fix ad7280_store_balance_timer() (git-fixes). - most: usb: fix double free on late probe failure (git-fixes). - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves (git-fixes). - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking (git-fixes). - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors (git-fixes). - USB: storage: Remove subclass and protocol overrides from Novatek quirk (git-fixes). - usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer (git-fixes). - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (git-fixes). - xhci: dbgtty: fix device unregister (git-fixes). - usb: gadget: f_eem: Fix memory leak in eem_unwrap (git-fixes). - drivers/usb/dwc3: fix PCI parent check (git-fixes). - usb: storage: Fix memory leak in USB bulk transport (git-fixes). - usb: cdns3: Fix double resource release in cdns3_pci_probe (git-fixes). - mailbox: mailbox-test: Fix debugfs_create_dir error checking (git-fixes). - drm: sti: fix device leaks at component probe (git-fixes). - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling (git-fixes). - commit 17705d7 - net: dlink: handle copy_thresh allocation failure (CVE-2025-40053 bsc#1252808) - commit 975011b ------------------------------------------------------------------ ------------------ 2025-11-28 - Nov 28 2025 ------------------- ------------------------------------------------------------------ ++++ cyrus-sasl: - Python3 error log upon importing pycurl (bsc#1233529) Remove senceless log message. * add remove-senceless-log.patch ++++ kernel-default: - pid: Add a judgment for ns null in pid_nr_ns (CVE-2025-40178 bsc#1253463) - commit ce07984 - net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (CVE-2025-40187 bsc#1253647) - commit e8a76b4 - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling (git-fixes). - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs (git-fixes). - can: sja1000: fix max irq loop handling (git-fixes). - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers (git-fixes). - net: phy: mxl-gpy: fix link properties on USXGMII and internal PHYs (git-fixes). - atm/fore200e: Fix possible data race in fore200e_open() (git-fixes). - Bluetooth: SMP: Fix not generating mackey and ltk when repairing (git-fixes). - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (git-fixes). - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY (git-fixes). - platform/x86: intel: punit_ipc: fix memory corruption (git-fixes). - atm: idt77252: Add missing `dma_map_error()` (stable-fixes). - commit 2366cbf ++++ kernel-rt: - pid: Add a judgment for ns null in pid_nr_ns (CVE-2025-40178 bsc#1253463) - commit ce07984 - net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (CVE-2025-40187 bsc#1253647) - commit e8a76b4 - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling (git-fixes). - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs (git-fixes). - can: sja1000: fix max irq loop handling (git-fixes). - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers (git-fixes). - net: phy: mxl-gpy: fix link properties on USXGMII and internal PHYs (git-fixes). - atm/fore200e: Fix possible data race in fore200e_open() (git-fixes). - Bluetooth: SMP: Fix not generating mackey and ltk when repairing (git-fixes). - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (git-fixes). - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY (git-fixes). - platform/x86: intel: punit_ipc: fix memory corruption (git-fixes). - atm: idt77252: Add missing `dma_map_error()` (stable-fixes). - commit 2366cbf ++++ kernel-rt_debug: - pid: Add a judgment for ns null in pid_nr_ns (CVE-2025-40178 bsc#1253463) - commit ce07984 - net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (CVE-2025-40187 bsc#1253647) - commit e8a76b4 - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling (git-fixes). - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs (git-fixes). - can: sja1000: fix max irq loop handling (git-fixes). - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers (git-fixes). - net: phy: mxl-gpy: fix link properties on USXGMII and internal PHYs (git-fixes). - atm/fore200e: Fix possible data race in fore200e_open() (git-fixes). - Bluetooth: SMP: Fix not generating mackey and ltk when repairing (git-fixes). - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (git-fixes). - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY (git-fixes). - platform/x86: intel: punit_ipc: fix memory corruption (git-fixes). - atm: idt77252: Add missing `dma_map_error()` (stable-fixes). - commit 2366cbf ++++ libpng16: - security update - added patches CVE-2025-64505 [bsc#1254157], heap buffer over-read in `png_do_quantize` via malformed palette index * libpng16-CVE-2025-64505.patch CVE-2025-64506 [bsc#1254158], heap buffer over-read in `png_write_image_8bit` with 8-bit input and `convert_to_8bit` enabled * libpng16-CVE-2025-64506.patch CVE-2025-64720 [bsc#1254159], buffer overflow in `png_image_read_composite` via incorrect palette premultiplication * libpng16-CVE-2025-64720.patch CVE-2025-65018 [bsc#1254160], heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read` * libpng16-CVE-2025-65018.patch ++++ sqlite3: - Update to version 3.51.1: * Fix incorrect results from nested EXISTS queries caused by the optimization in item 6b in the 3.51.0 release. * Fix a latent bug in fts5vocab virtual table, exposed by new optimizations in the 3.51.0 release - Changes in version 3.51.0: * New macros in sqlite3.h: - SQLITE_SCM_BRANCH → the name of the branch from which the source code is taken. - SQLITE_SCM_TAGS → space-separated list of tags on the source code check-in. - SQLITE_SCM_DATETIME → ISO-8601 date and time of the source code check-in. * Two new JSON functions, jsonb_each() and jsonb_tree() work the same as the existing json_each() and json_tree() functions except that they return JSONB for the "value" column when the "type" is 'array' or 'object'. * The carray and percentile extensions are now built into the amalgamation, though they are disabled by default and must be activated at compile-time using the -DSQLITE_ENABLE_CARRAY and/or -DSQLITE_ENABLE_PERCENTILE options, respectively. * Enhancements to TCL Interface: - Add the -asdict flag to the eval command to have it set the row data as a dict instead of an array. - User-defined functions may now break to return an SQL NULL. * CLI enhancements: - Increase the precision of ".timer" to microseconds. - Enhance the "box" and "column" formatting modes to deal with double-wide characters. - The ".imposter" command provides read-only imposter tables that work with VACUUM and do not require the --unsafe-testing option. - Add the --ifexists option to the CLI command-line option and to the .open command. - Limit columns widths set by the ".width" command to 30,000 or less, as there is not good reason to have wider columns, but supporting wider columns provides opportunity to malefactors. * Performance enhancements: - Use fewer CPU cycles to commit a read transaction. - Early detection of joins that return no rows due to one or more of the tables containing no rows. - Avoid evaluation of scalar subqueries if the result of the subquery does not change the result of the overall expression. - Faster window function queries when using "BETWEEN :x FOLLOWING AND :y FOLLOWING" with a large :y. * Add the PRAGMA wal_checkpoint=NOOP; command and the SQLITE_CHECKPOINT_NOOP argument for sqlite3_wal_checkpoint_v2(). * Add the sqlite3_set_errmsg() API for use by extensions. * Add the sqlite3_db_status64() API, which works just like the existing sqlite3_db_status() API except that it returns 64-bit results. * Add the SQLITE_DBSTATUS_TEMPBUF_SPILL option to the sqlite3_db_status() and sqlite3_db_status64() interfaces. * In the session extension add the sqlite3changeset_apply_v3() interface. * For the built-in printf() and the format() SQL function, omit the leading '-' from negative floating point numbers if the '+' flag is omitted and the "#" flag is present and all displayed digits are '0'. Use '%#f' or similar to avoid outputs like '-0.00' and instead show just '0.00'. * Improved error messages generated by FTS5. * Enforce STRICT typing on computed columns. * Improved support for VxWorks * JavaScript/WASM now supports 64-bit WASM. The canonical builds continue to be 32-bit but creating one's own 64-bit build is now as simple as running "make". * Improved resistance to database corruption caused by an application breaking Posix advisory locks using close(). ++++ runc: - Update to runc v1.3.4. Upstream changelog is available from . bsc#1254362 ------------------------------------------------------------------ ------------------ 2025-11-27 - Nov 27 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (CVE-2025-40033 bsc#1252824) - commit 2054391 - dm: fix NULL pointer dereference in __dm_suspend() (CVE-2025-40134 bsc#1253386) - commit 1e5953d - dm: fix queue start/stop imbalance under suspend/load/resume races (bsc#1253386) - commit bd1d198 - KVM: arm64: Prevent access to vCPU events before init (CVE-2025-40102 bsc#1252919) - commit 104fba7 - perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (CVE-2025-40081 bsc#1252776) - commit f1cab17 - Add dtb-spacemit SpacemiT boards include MilkV-Jupiter, Banana Pi F3 and Orange Pi RV2. - commit f2f396d - scsi: lpfc: Update lpfc version to 14.4.0.12 (bsc#1254119). - scsi: lpfc: Add capability to register Platform Name ID to fabric (bsc#1254119). - scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (bsc#1254119). - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (bsc#1254119). - scsi: lpfc: Modify kref handling for Fabric Controller ndlps (bsc#1254119). - scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (bsc#1254119). - scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (bsc#1254119). - scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (bsc#1254119). - scsi: lpfc: Revise discovery related function headers and comments (bsc#1254119). - scsi: lpfc: Update various NPIV diagnostic log messaging (bsc#1254119). - commit bfcfc18 - nvme-multipath: fix lockdep WARN due to partition scan work (git-fixes bsc#1233640 CVE-2024-53093). - commit 28a7b7d - dm-integrity: limit MAX_TAG_SIZE to 255 (git-fixes). - commit a7bb416 - nvme: Use non zero KATO for persistent discovery connections (git-fixes). - commit 4d9eece - ALSA: usb-audio: fix uac2 clock source at terminal parser (git-fixes). - commit 74497c6 ++++ kernel-rt: - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (CVE-2025-40033 bsc#1252824) - commit 2054391 - dm: fix NULL pointer dereference in __dm_suspend() (CVE-2025-40134 bsc#1253386) - commit 1e5953d - dm: fix queue start/stop imbalance under suspend/load/resume races (bsc#1253386) - commit bd1d198 - KVM: arm64: Prevent access to vCPU events before init (CVE-2025-40102 bsc#1252919) - commit 104fba7 - perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (CVE-2025-40081 bsc#1252776) - commit f1cab17 - Add dtb-spacemit SpacemiT boards include MilkV-Jupiter, Banana Pi F3 and Orange Pi RV2. - commit f2f396d - scsi: lpfc: Update lpfc version to 14.4.0.12 (bsc#1254119). - scsi: lpfc: Add capability to register Platform Name ID to fabric (bsc#1254119). - scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (bsc#1254119). - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (bsc#1254119). - scsi: lpfc: Modify kref handling for Fabric Controller ndlps (bsc#1254119). - scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (bsc#1254119). - scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (bsc#1254119). - scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (bsc#1254119). - scsi: lpfc: Revise discovery related function headers and comments (bsc#1254119). - scsi: lpfc: Update various NPIV diagnostic log messaging (bsc#1254119). - commit bfcfc18 - nvme-multipath: fix lockdep WARN due to partition scan work (git-fixes bsc#1233640 CVE-2024-53093). - commit 28a7b7d - dm-integrity: limit MAX_TAG_SIZE to 255 (git-fixes). - commit a7bb416 - nvme: Use non zero KATO for persistent discovery connections (git-fixes). - commit 4d9eece - ALSA: usb-audio: fix uac2 clock source at terminal parser (git-fixes). - commit 74497c6 ++++ kernel-rt_debug: - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (CVE-2025-40033 bsc#1252824) - commit 2054391 - dm: fix NULL pointer dereference in __dm_suspend() (CVE-2025-40134 bsc#1253386) - commit 1e5953d - dm: fix queue start/stop imbalance under suspend/load/resume races (bsc#1253386) - commit bd1d198 - KVM: arm64: Prevent access to vCPU events before init (CVE-2025-40102 bsc#1252919) - commit 104fba7 - perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (CVE-2025-40081 bsc#1252776) - commit f1cab17 - Add dtb-spacemit SpacemiT boards include MilkV-Jupiter, Banana Pi F3 and Orange Pi RV2. - commit f2f396d - scsi: lpfc: Update lpfc version to 14.4.0.12 (bsc#1254119). - scsi: lpfc: Add capability to register Platform Name ID to fabric (bsc#1254119). - scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (bsc#1254119). - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (bsc#1254119). - scsi: lpfc: Modify kref handling for Fabric Controller ndlps (bsc#1254119). - scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (bsc#1254119). - scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (bsc#1254119). - scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (bsc#1254119). - scsi: lpfc: Revise discovery related function headers and comments (bsc#1254119). - scsi: lpfc: Update various NPIV diagnostic log messaging (bsc#1254119). - commit bfcfc18 - nvme-multipath: fix lockdep WARN due to partition scan work (git-fixes bsc#1233640 CVE-2024-53093). - commit 28a7b7d - dm-integrity: limit MAX_TAG_SIZE to 255 (git-fixes). - commit a7bb416 - nvme: Use non zero KATO for persistent discovery connections (git-fixes). - commit 4d9eece - ALSA: usb-audio: fix uac2 clock source at terminal parser (git-fixes). - commit 74497c6 ------------------------------------------------------------------ ------------------ 2025-11-26 - Nov 26 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - nfsd: fix return error codes for nfsd_map_name_to_id (bsc#1232223). - commit 24071c5 - vhost: Take a reference on the task in struct vhost_task (CVE-2025-40024 bsc#1252686) - commit fc81dc2 - nfsd: do not defer requests during idmap lookup in v4 compound decode (bsc#1232223). - commit 4b41b11 - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149 bsc#1253355). - commit c8fb6ed - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (CVE-2025-40168 bsc#1253427). - commit 0f10629 - smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (CVE-2025-40139 bsc#1253409). - commit a7ae1b3 - smc: Fix use-after-free in __pnet_find_base_ndev() (CVE-2025-40064 bsc#1252845). - commit 2971b90 - tcp_metrics: use dst_dev_net_rcu() (CVE-2025-40075 bsc#1252795). - commit fcb52d9 - Update patches.suse/ASoC-Intel-bytcr_rt5640-Fix-invalid-quirk-input-mapp.patch (git-fixes CVE-2025-40154 bsc#1253431). - Update patches.suse/ASoC-Intel-bytcr_rt5651-Fix-invalid-quirk-input-mapp.patch (git-fixes CVE-2025-40121 bsc#1253367). - Update patches.suse/Bluetooth-ISO-Fix-possible-UAF-on-iso_conn_free.patch (git-fixes CVE-2025-40141 bsc#1253352). - Update patches.suse/EDAC-i10nm-Skip-DIMM-enumeration-on-a-disabled-memor.patch (git-fixes CVE-2025-40157 bsc#1253423). - Update patches.suse/PM-devfreq-mtk-cci-Fix-potential-error-pointer-deref.patch (git-fixes CVE-2025-40156 bsc#1253428). - Update patches.suse/Squashfs-reject-negative-file-sizes-in-squashfs_read_inode.patch (git-fixes CVE-2025-40200 bsc#1253448). - Update patches.suse/accel-qaic-Treat-remaining-0-as-error-in-find_and_ma.patch (git-fixes CVE-2025-40172 bsc#1253424). - Update patches.suse/bpf-Fix-metadata_dst-leak-__bpf_redirect_neigh_v-4-6.patch (git-fixes CVE-2025-40183 bsc#1253441). - Update patches.suse/btrfs-avoid-potential-out-of-bounds-in-btrfs_encode_.patch (git-fixes CVE-2025-40205 bsc#1253456). - Update patches.suse/can-hi311x-fix-null-pointer-dereference-when-resumin.patch (stable-fixes CVE-2025-40107 bsc#1253018). - Update patches.suse/cpufreq-intel_pstate-Fix-object-lifecycle-issue-in-update_qos_request.patch (stable-fixes git-fixes CVE-2025-40194 bsc#1253445). - Update patches.suse/crypto-rng-Ensure-set_ent-is-always-present.patch (git-fixes CVE-2025-40109 bsc#1253176). - Update patches.suse/drm-vmwgfx-Fix-Use-after-free-in-validation.patch (git-fixes CVE-2025-40111 bsc#1253362). - Update patches.suse/drm-vmwgfx-Fix-a-null-ptr-access-in-the-cursor-snoop.patch (git-fixes CVE-2025-40110 bsc#1253275). - Update patches.suse/ext4-avoid-potential-buffer-over-read-in-parse_apply.patch (git-fixes CVE-2025-40198 bsc#1253453). - Update patches.suse/hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch (git-fixes CVE-2025-40127 bsc#1253369). - Update patches.suse/mailbox-zynqmp-ipi-Fix-out-of-bounds-access-in-mailb.patch (git-fixes CVE-2025-40180 bsc#1253440). - Update patches.suse/media-v4l2-subdev-Fix-alloc-failure-check-in-v4l2_su.patch (git-fixes CVE-2025-40207 bsc#1253395). - Update patches.suse/net-usb-Remove-disruptive-netif_wake_queue-in-rtl815.patch (git-fixes CVE-2025-40140 bsc#1253349). - Update patches.suse/net-usb-asix-hold-PM-usage-ref-to-avoid-PM-MDIO-RTNL.patch (git-fixes CVE-2025-40120 bsc#1253360). - Update patches.suse/nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch (bsc#1245193 bsc#1247500 CVE-2025-40171 bsc#1253412). - Update patches.suse/pwm-berlin-Fix-wrong-register-in-suspend-resume.patch (git-fixes CVE-2025-40188 bsc#1253449). - Update patches.suse/scsi-mpt3sas-Fix-crash-in-transport-port-remove-by-using-i.patch (git-fixes CVE-2025-40115 bsc#1253318). - Update patches.suse/scsi-pm80xx-Fix-array-index-out-of-of-bounds-on-rmmod.patch (git-fixes CVE-2025-40118 bsc#1253363). - Update patches.suse/sunrpc-fix-null-pointer-dereference-on-zero-length-checksum.patch (git-fixes CVE-2025-40129 bsc#1253472). - Update patches.suse/tcp-Don-t-call-reqsk_fastopen_remove-in-tcp_conn_request.patch (git-fixes CVE-2025-40186 bsc#1253438). - Update patches.suse/usb-host-max3421-hcd-Fix-error-pointer-dereference-i.patch (git-fixes CVE-2025-40116 bsc#1253324). - Update patches.suse/usbnet-Fix-using-smp_processor_id-in-preemptible-cod.patch (git-fixes CVE-2025-40164 bsc#1253407). - commit d8d3cd1 ++++ kernel-rt: - nfsd: fix return error codes for nfsd_map_name_to_id (bsc#1232223). - commit 24071c5 - vhost: Take a reference on the task in struct vhost_task (CVE-2025-40024 bsc#1252686) - commit fc81dc2 - nfsd: do not defer requests during idmap lookup in v4 compound decode (bsc#1232223). - commit 4b41b11 - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149 bsc#1253355). - commit c8fb6ed - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (CVE-2025-40168 bsc#1253427). - commit 0f10629 - smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (CVE-2025-40139 bsc#1253409). - commit a7ae1b3 - smc: Fix use-after-free in __pnet_find_base_ndev() (CVE-2025-40064 bsc#1252845). - commit 2971b90 - tcp_metrics: use dst_dev_net_rcu() (CVE-2025-40075 bsc#1252795). - commit fcb52d9 - Update patches.suse/ASoC-Intel-bytcr_rt5640-Fix-invalid-quirk-input-mapp.patch (git-fixes CVE-2025-40154 bsc#1253431). - Update patches.suse/ASoC-Intel-bytcr_rt5651-Fix-invalid-quirk-input-mapp.patch (git-fixes CVE-2025-40121 bsc#1253367). - Update patches.suse/Bluetooth-ISO-Fix-possible-UAF-on-iso_conn_free.patch (git-fixes CVE-2025-40141 bsc#1253352). - Update patches.suse/EDAC-i10nm-Skip-DIMM-enumeration-on-a-disabled-memor.patch (git-fixes CVE-2025-40157 bsc#1253423). - Update patches.suse/PM-devfreq-mtk-cci-Fix-potential-error-pointer-deref.patch (git-fixes CVE-2025-40156 bsc#1253428). - Update patches.suse/Squashfs-reject-negative-file-sizes-in-squashfs_read_inode.patch (git-fixes CVE-2025-40200 bsc#1253448). - Update patches.suse/accel-qaic-Treat-remaining-0-as-error-in-find_and_ma.patch (git-fixes CVE-2025-40172 bsc#1253424). - Update patches.suse/bpf-Fix-metadata_dst-leak-__bpf_redirect_neigh_v-4-6.patch (git-fixes CVE-2025-40183 bsc#1253441). - Update patches.suse/btrfs-avoid-potential-out-of-bounds-in-btrfs_encode_.patch (git-fixes CVE-2025-40205 bsc#1253456). - Update patches.suse/can-hi311x-fix-null-pointer-dereference-when-resumin.patch (stable-fixes CVE-2025-40107 bsc#1253018). - Update patches.suse/cpufreq-intel_pstate-Fix-object-lifecycle-issue-in-update_qos_request.patch (stable-fixes git-fixes CVE-2025-40194 bsc#1253445). - Update patches.suse/crypto-rng-Ensure-set_ent-is-always-present.patch (git-fixes CVE-2025-40109 bsc#1253176). - Update patches.suse/drm-vmwgfx-Fix-Use-after-free-in-validation.patch (git-fixes CVE-2025-40111 bsc#1253362). - Update patches.suse/drm-vmwgfx-Fix-a-null-ptr-access-in-the-cursor-snoop.patch (git-fixes CVE-2025-40110 bsc#1253275). - Update patches.suse/ext4-avoid-potential-buffer-over-read-in-parse_apply.patch (git-fixes CVE-2025-40198 bsc#1253453). - Update patches.suse/hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch (git-fixes CVE-2025-40127 bsc#1253369). - Update patches.suse/mailbox-zynqmp-ipi-Fix-out-of-bounds-access-in-mailb.patch (git-fixes CVE-2025-40180 bsc#1253440). - Update patches.suse/media-v4l2-subdev-Fix-alloc-failure-check-in-v4l2_su.patch (git-fixes CVE-2025-40207 bsc#1253395). - Update patches.suse/net-usb-Remove-disruptive-netif_wake_queue-in-rtl815.patch (git-fixes CVE-2025-40140 bsc#1253349). - Update patches.suse/net-usb-asix-hold-PM-usage-ref-to-avoid-PM-MDIO-RTNL.patch (git-fixes CVE-2025-40120 bsc#1253360). - Update patches.suse/nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch (bsc#1245193 bsc#1247500 CVE-2025-40171 bsc#1253412). - Update patches.suse/pwm-berlin-Fix-wrong-register-in-suspend-resume.patch (git-fixes CVE-2025-40188 bsc#1253449). - Update patches.suse/scsi-mpt3sas-Fix-crash-in-transport-port-remove-by-using-i.patch (git-fixes CVE-2025-40115 bsc#1253318). - Update patches.suse/scsi-pm80xx-Fix-array-index-out-of-of-bounds-on-rmmod.patch (git-fixes CVE-2025-40118 bsc#1253363). - Update patches.suse/sunrpc-fix-null-pointer-dereference-on-zero-length-checksum.patch (git-fixes CVE-2025-40129 bsc#1253472). - Update patches.suse/tcp-Don-t-call-reqsk_fastopen_remove-in-tcp_conn_request.patch (git-fixes CVE-2025-40186 bsc#1253438). - Update patches.suse/usb-host-max3421-hcd-Fix-error-pointer-dereference-i.patch (git-fixes CVE-2025-40116 bsc#1253324). - Update patches.suse/usbnet-Fix-using-smp_processor_id-in-preemptible-cod.patch (git-fixes CVE-2025-40164 bsc#1253407). - commit d8d3cd1 ++++ kernel-rt_debug: - nfsd: fix return error codes for nfsd_map_name_to_id (bsc#1232223). - commit 24071c5 - vhost: Take a reference on the task in struct vhost_task (CVE-2025-40024 bsc#1252686) - commit fc81dc2 - nfsd: do not defer requests during idmap lookup in v4 compound decode (bsc#1232223). - commit 4b41b11 - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149 bsc#1253355). - commit c8fb6ed - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (CVE-2025-40168 bsc#1253427). - commit 0f10629 - smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (CVE-2025-40139 bsc#1253409). - commit a7ae1b3 - smc: Fix use-after-free in __pnet_find_base_ndev() (CVE-2025-40064 bsc#1252845). - commit 2971b90 - tcp_metrics: use dst_dev_net_rcu() (CVE-2025-40075 bsc#1252795). - commit fcb52d9 - Update patches.suse/ASoC-Intel-bytcr_rt5640-Fix-invalid-quirk-input-mapp.patch (git-fixes CVE-2025-40154 bsc#1253431). - Update patches.suse/ASoC-Intel-bytcr_rt5651-Fix-invalid-quirk-input-mapp.patch (git-fixes CVE-2025-40121 bsc#1253367). - Update patches.suse/Bluetooth-ISO-Fix-possible-UAF-on-iso_conn_free.patch (git-fixes CVE-2025-40141 bsc#1253352). - Update patches.suse/EDAC-i10nm-Skip-DIMM-enumeration-on-a-disabled-memor.patch (git-fixes CVE-2025-40157 bsc#1253423). - Update patches.suse/PM-devfreq-mtk-cci-Fix-potential-error-pointer-deref.patch (git-fixes CVE-2025-40156 bsc#1253428). - Update patches.suse/Squashfs-reject-negative-file-sizes-in-squashfs_read_inode.patch (git-fixes CVE-2025-40200 bsc#1253448). - Update patches.suse/accel-qaic-Treat-remaining-0-as-error-in-find_and_ma.patch (git-fixes CVE-2025-40172 bsc#1253424). - Update patches.suse/bpf-Fix-metadata_dst-leak-__bpf_redirect_neigh_v-4-6.patch (git-fixes CVE-2025-40183 bsc#1253441). - Update patches.suse/btrfs-avoid-potential-out-of-bounds-in-btrfs_encode_.patch (git-fixes CVE-2025-40205 bsc#1253456). - Update patches.suse/can-hi311x-fix-null-pointer-dereference-when-resumin.patch (stable-fixes CVE-2025-40107 bsc#1253018). - Update patches.suse/cpufreq-intel_pstate-Fix-object-lifecycle-issue-in-update_qos_request.patch (stable-fixes git-fixes CVE-2025-40194 bsc#1253445). - Update patches.suse/crypto-rng-Ensure-set_ent-is-always-present.patch (git-fixes CVE-2025-40109 bsc#1253176). - Update patches.suse/drm-vmwgfx-Fix-Use-after-free-in-validation.patch (git-fixes CVE-2025-40111 bsc#1253362). - Update patches.suse/drm-vmwgfx-Fix-a-null-ptr-access-in-the-cursor-snoop.patch (git-fixes CVE-2025-40110 bsc#1253275). - Update patches.suse/ext4-avoid-potential-buffer-over-read-in-parse_apply.patch (git-fixes CVE-2025-40198 bsc#1253453). - Update patches.suse/hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch (git-fixes CVE-2025-40127 bsc#1253369). - Update patches.suse/mailbox-zynqmp-ipi-Fix-out-of-bounds-access-in-mailb.patch (git-fixes CVE-2025-40180 bsc#1253440). - Update patches.suse/media-v4l2-subdev-Fix-alloc-failure-check-in-v4l2_su.patch (git-fixes CVE-2025-40207 bsc#1253395). - Update patches.suse/net-usb-Remove-disruptive-netif_wake_queue-in-rtl815.patch (git-fixes CVE-2025-40140 bsc#1253349). - Update patches.suse/net-usb-asix-hold-PM-usage-ref-to-avoid-PM-MDIO-RTNL.patch (git-fixes CVE-2025-40120 bsc#1253360). - Update patches.suse/nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch (bsc#1245193 bsc#1247500 CVE-2025-40171 bsc#1253412). - Update patches.suse/pwm-berlin-Fix-wrong-register-in-suspend-resume.patch (git-fixes CVE-2025-40188 bsc#1253449). - Update patches.suse/scsi-mpt3sas-Fix-crash-in-transport-port-remove-by-using-i.patch (git-fixes CVE-2025-40115 bsc#1253318). - Update patches.suse/scsi-pm80xx-Fix-array-index-out-of-of-bounds-on-rmmod.patch (git-fixes CVE-2025-40118 bsc#1253363). - Update patches.suse/sunrpc-fix-null-pointer-dereference-on-zero-length-checksum.patch (git-fixes CVE-2025-40129 bsc#1253472). - Update patches.suse/tcp-Don-t-call-reqsk_fastopen_remove-in-tcp_conn_request.patch (git-fixes CVE-2025-40186 bsc#1253438). - Update patches.suse/usb-host-max3421-hcd-Fix-error-pointer-dereference-i.patch (git-fixes CVE-2025-40116 bsc#1253324). - Update patches.suse/usbnet-Fix-using-smp_processor_id-in-preemptible-cod.patch (git-fixes CVE-2025-40164 bsc#1253407). - commit d8d3cd1 ++++ openvswitch: - OpenvSwitch upstream bugfix updates: * https://www.openvswitch.org/releases/NEWS-3.1.7.txt * v3.1.7 - Bug fixes - OVS validated with DPDK 22.11.7. * v3.1.6 - Bug fixes - OVS validated with DPDK 22.11.6. * v3.1.5 - Bug fixes - OVS validated with DPDK 22.11.5. * v3.1.4 - Bug fixes - Fixed vulnerabilities CVE-2023-3966 (bsc#1219465) and CVE-2023-5366 (bsc#1216002). - OVS validated with DPDK 22.11.4. * v3.1.3 - Bug fixes * v3.1.2 - Bug fixes * v3.1.1 - Bug fixes - Fixed vulnerability CVE-2023-1668 (bsc#1210054) - Remove included patches: CVE-2023-1668.patch - OVN upstream bugfix updates: * https://github.com/ovn-org/ovn/blob/branch-23.03/NEWS - Fix CVE-2025-0650 (bsc#1236353) ovn: egress ACLs may be bypassed via specially crafted UDP packet (CVE-2025-0650.patch) * v23.03.3 - Bug fixes - Add "garp-max-timeout-sec" config option to vswitchd external-ids to cap the time between when ovn-controller sends gARP packets. - Security: Fixed vulnerability CVE-2024-2182 (bsc#1255435). - Updated patches install-ovsdb-tools.patch * v23.03.2 - Bug fixes * v23.03.1 - Bug fixes - CT entries are not flushed by default anymore whenever a load balancer backend is removed. A new, per-LB, option 'ct_flush' can be used to restore the previous behavior. Disabled by default. - Always allow IPv6 Router Discovery, Neighbor Discovery, and Multicast Listener Discovery protocols, regardless of ACLs defined. - Send ICMP Fragmentation Needed packets back to offending ports when communicating with multichassis ports using frames that don't fit through a tunnel. This is done only for logical switches that are attached to a physical network via a localnet port, in which case multichassis ports may have an effective MTU different from regular ports and hence may need this mechanism to maintain connectivity with other peers in the network. - ECMP routes use L4_SYM dp-hash by default if the datapath supports it. Existing sessions might get re-hashed to a different ECMP path when OVN detects the algorithm support in the datapath during an upgrade or restart of ovn-controller. - Add CoPP for the svc_monitor_mac. This addresses CVE-2023-3153 (bsc#1212125). - Remove included patches: CVE-2023-3152.patch ------------------------------------------------------------------ ------------------ 2025-11-25 - Nov 25 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - cifs: Fix uncached read into ITER_KVEC iterator (bsc#1245449). - commit caf12ec - ipv4: start using dst_dev_rcu() (CVE-2025-40074 bsc#1252794). - commit d58640c - kabi: hide dst_entry::dev_rcu (CVE-2025-40074 bsc#1252794). - commit 7047515 - net: dst: introduce dst->dev_rcu (CVE-2025-40074 bsc#1252794). - commit bc25dd4 - net: Add locking to protect skb->dev access in ip_output (CVE-2025-40074 bsc#1252794). - commit ba856a3 - ipv6: ip6_mc_input() and ip6_mr_input() cleanups (CVE-2025-40074 bsc#1252794). - commit 74e34e6 - ipv6: adopt skb_dst_dev() and skb_dst_dev_net[_rcu]() helpers (CVE-2025-40074 bsc#1252794). - commit bef51be - ipv6: adopt dst_dev() helper (CVE-2025-40074 bsc#1252794). - refresh patches.suse/net-ip6_tunnel-Prevent-perpetual-tunnel-growth.patch - commit 7eda2f1 - ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (CVE-2025-40074 bsc#1252794). - commit 172fe2b - net: dst: add four helpers to annotate data-races around dst->dev (CVE-2025-40074 bsc#1252794). - commit d644653 - net: dst: annotate data-races around dst->output (CVE-2025-40074 bsc#1252794). - commit a54672b - net: dst: annotate data-races around dst->input (CVE-2025-40074 bsc#1252794). - commit ffc43da - net: dst: annotate data-races around dst->lastuse (CVE-2025-40074 bsc#1252794). - commit 8826356 - net: dst: annotate data-races around dst->expires (CVE-2025-40074 bsc#1252794). - commit 2c55499 - net: dst: annotate data-races around dst->obsolete (CVE-2025-40074 bsc#1252794). - commit 2ab42e2 - net: ipv4: ipmr: ipmr_queue_xmit(): Drop local variable `dev' (CVE-2025-40074 bsc#1252794). - commit 3c39f8c - net: gro: convert four dev_net() calls (CVE-2025-40074 bsc#1252794). - commit cf41694 - tcp: convert to dev_net_rcu() (CVE-2025-40074 bsc#1252794). - commit 2fe0b75 - net: dst_cache: annotate data-races around dst_cache->reset_ts (CVE-2025-40074 bsc#1252794). - commit 5a73952 - Refresh patches.suse/ALSA-usb-audio-Fix-potential-overflow-of-PCM-transfe.patch Fix the missing mutex unlock at the error path - commit f1238c1 - rpm/kernel-obs-build.spec.in: Add xt_addrtype module for docker Needed by docker meanwhile. - commit 1cd2f7d - x86/amd_nb: Add new PCI IDs for AMD family 0x1a (stable-fixes). - Refresh patches.suse/x86-amd_nb-Add-new-PCI-IDs-for-AMD-family-1Ah-model-60h.patch. - commit 5a88cd1 - ALSA: hda: Fix missing pointer check in hda_component_manager_init function (git-fixes). - commit 39c22db - tools: lib: thermal: don't preserve owner in install (stable-fixes). - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (stable-fixes). - usb: gadget: f_fs: Fix epfile null pointer access after ep enable (stable-fixes). - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (stable-fixes). - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (stable-fixes). - usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (stable-fixes). - usb: gadget: f_hid: Fix zero length packet transfer (stable-fixes). - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (stable-fixes). - wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (stable-fixes). - wifi: ath10k: Fix connection after GTK rekeying (stable-fixes). - wifi: rtw88: sdio: use indirect IO for device registers before power-on (stable-fixes). - wifi: mt76: mt7996: Temporarily disable EPCS (stable-fixes). - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (stable-fixes). - wifi: mac80211: Fix HE capabilities element check (stable-fixes). - video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (stable-fixes). - commit 7dad19b - tools: lib: thermal: use pkg-config to locate libnl3 (stable-fixes). - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (stable-fixes). - thunderbolt: Use is_pciehp instead of is_hotplug_bridge (stable-fixes). - soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (stable-fixes). - soc: qcom: smem: Fix endian-unaware access of num_entries (stable-fixes). - soc: aspeed: socinfo: Add AST27xx silicon IDs (stable-fixes). - pinctrl: single: fix bias pull up/down handling in pin_config_set (stable-fixes). - power: supply: qcom_battmgr: handle charging state change notifications (stable-fixes). - power: supply: sbs-charger: Support multiple devices (stable-fixes). - power: supply: qcom_battmgr: add OOI chemistry (stable-fixes). - spi: rpc-if: Add resume support for RZ/G3E (stable-fixes). - spi: loopback-test: Don't use %pK through printk (stable-fixes). - commit 47c8f1c - NFS4: Fix state renewals missing after boot (git-fixes). - commit 1f41fdb - NFS: check if suid/sgid was cleared after a write as needed (git-fixes). - commit 6f2e3ba - nfs4_setup_readdir(): insufficient locking for - >d_parent->d_inode dereferencing (git-fixes). - commit cbc0708 - PCI: cadence: Check for the existence of cdns_pcie::ops before using it (stable-fixes). - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (git-fixes). - PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (stable-fixes). - PCI/PM: Skip resuming to D0 if device is disconnected (stable-fixes). - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (stable-fixes). - PCI: Disable MSI on RDC PCI to PCIe bridges (stable-fixes). - phy: cadence: cdns-dphy: Enable lower resolutions in dphy (stable-fixes). - phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (stable-fixes). - net: phy: clear link parameters on admin link down (stable-fixes). - net: phy: marvell: Fix 88e1510 downshift counter errata (stable-fixes). - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (stable-fixes). - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (stable-fixes). - media: redrat3: use int type to store negative error codes (stable-fixes). - media: ov08x40: Fix the horizontal flip control (stable-fixes). - media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (stable-fixes). - media: adv7180: Only validate format in querystd (stable-fixes). - media: adv7180: Do not write format to device in set_fmt (stable-fixes). - media: adv7180: Add missing lock in suspend callback (stable-fixes). - media: fix uninitialized symbol warnings (stable-fixes). - media: imon: make send_packet() more robust (stable-fixes). - media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (stable-fixes). - media: amphion: Delete v4l2_fh synchronously in .release() (stable-fixes). - mfd: madera: Work around false-positive -Wininitialized warning (stable-fixes). - mfd: da9063: Split chip variant reading in two bus transactions (stable-fixes). - mfd: stmpe-i2c: Add missing MODULE_LICENSE (stable-fixes). - mfd: stmpe: Remove IRQ domain upon removal (stable-fixes). - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (stable-fixes). - memstick: Add timeout to prevent indefinite waiting (stable-fixes). - mmc: host: renesas_sdhi: Fix the actual clock (stable-fixes). - commit 8c57bbb - NFSv4.1: fix mount hang after CREATE_SESSION failure (git-fixes). - commit c832cc2 - NFSv4: handle ERR_GRACE on delegation recalls (git-fixes). - commit aaacda9 - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (stable-fixes). - iio: adc: imx93_adc: load calibrated values even calibration failed (stable-fixes). - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (stable-fixes). - hwmon: (dell-smm) Add support for Dell OptiPlex 7040 (stable-fixes). - hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (stable-fixes). - hwmon: sy7636a: add alias (stable-fixes). - hwmon: (sbtsi_temp) AMD CPU extended temperature range support (stable-fixes). - hwmon: (k10temp) Add device ID for Strix Halo (stable-fixes). - hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (stable-fixes). - commit f501af0 - jfs: fix uninitialized waitqueue in transaction manager (git-fixes). - commit 0b36ea1 - jfs: Verify inode mode when loading from disk (git-fixes). - commit 475a90c - extcon: adc-jack: Cleanup wakeup source only if it was enabled (git-fixes). - commit 5b8d1e6 - drm/amd/display: Disable VRR on DCE 6 (stable-fixes). - commit d98de00 - drm/amd/display: ensure committing streams is seamless (stable-fixes). - commit 0def0fa - exfat: limit log print for IO error (git-fixes). - commit 1fa4a3d - drm/amd/display: Fix black screen with HDMI outputs (git-fixes). - fbcon: Set fb_display[i]->mode to NULL when the mode is released (stable-fixes). - fbdev: bitblit: bound-check glyph index in bit_putcs* (stable-fixes). - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (stable-fixes). - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (stable-fixes). - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (stable-fixes). - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (stable-fixes). - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (stable-fixes). - extcon: adc-jack: Fix wakeup source leaks on device unbind (stable-fixes). - char: misc: Does not request module for miscdevice with dynamic minor (stable-fixes). - char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (stable-fixes). - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (stable-fixes). - drm/amdgpu: reject gang submissions under SRIOV (stable-fixes). - drm/amd/display: Fix DVI-D/HDMI adapters (stable-fixes). - drm/amd: Avoid evicting resources at S5 (stable-fixes). - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (stable-fixes). - drm/msm: make sure to not queue up recovery more than once (stable-fixes). - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (stable-fixes). - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (stable-fixes). - drm/amdgpu: don't enable SMU on cyan skillfish (stable-fixes). - drm/amdgpu: add support for cyan skillfish gpu_info (stable-fixes). - drm/amd: add more cyan skillfish PCI ids (stable-fixes). - drm/amdgpu: Allow kfd CRIU with no buffer objects (stable-fixes). - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (stable-fixes). - drm/amdkfd: fix vram allocation failure for a special case (stable-fixes). - drm/amdkfd: Handle lack of READ permissions in SVM mapping (stable-fixes). - drm/amdkfd: return -ENOTTY for unsupported IOCTLs (stable-fixes). - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (stable-fixes). - drm/amd/pm: Use cached metrics data on arcturus (stable-fixes). - drm/amd/pm: Use cached metrics data on aldebaran (stable-fixes). - drm/amd/display: update dpp/disp clock from smu clock table (stable-fixes). - drm/amd/display: add more cyan skillfish devices (stable-fixes). - drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (stable-fixes). - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (stable-fixes). - drm/tidss: Set crtc modesetting parameters with adjusted mode (stable-fixes). - drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST (stable-fixes). - drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (stable-fixes). - drm/tidss: Use the crtc_* timings when programming the HW (stable-fixes). - commit 304e918 - tcp: correct handling of extreme memory squeeze (bsc#1253779 CVE-2025-21710 bsc#1237888). - commit bba09b0 - net: tcp: send zero-window ACK when no memory (bsc#1253779). - commit f54e913 - ACPI: property: Return present device nodes only on fwnode interface (stable-fixes). - commit 7bfc861 - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (stable-fixes). - commit d4e809a - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids (stable-fixes). - commit cea477f - ACPICA: Update dsmethod.c to get rid of unused variable warning (stable-fixes). - commit 47d058d - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (stable-fixes). - commit a383be8 - tools/cpupower: Fix incorrect size in cpuidle_state_disable() (stable-fixes). - commit 2d1aa96 - tools/cpupower: fix error return value in cpupower_write_sysfs() (stable-fixes). - commit c9d6e6c - tools/power x86_energy_perf_policy: Prefer driver HWP limits (stable-fixes). - commit e772bc7 - tools/power x86_energy_perf_policy: Enhance HWP enable (stable-fixes). - commit 1133dff - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (stable-fixes). - commit 23d6e42 - Update patches.suse/net-smc-Remove-validation-of-reserved-bits-in-CLC-Decline-.patch (bsc#1252353). - commit d9fe289 - crypto: aspeed - fix double free caused by devm (git-fixes). - dmaengine: dw-edma: Set status for callback_result (stable-fixes). - dmaengine: mv_xor: match alloc_wc and free_wc (stable-fixes). - crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (stable-fixes). - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (stable-fixes). - char: misc: restrict the dynamic range to exclude reserved minors (stable-fixes). - crypto: aspeed-acry - Convert to platform remove callback returning void (stable-fixes). - commit 89d05dd - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (stable-fixes). - ALSA: usb-audio: don't log messages meant for 1810c when initializing 1824c (git-fixes). - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (stable-fixes). - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (stable-fixes). - Bluetooth: SCO: Fix UAF on sco_conn_free (stable-fixes). - Bluetooth: bcsp: receive data only if registered (stable-fixes). - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (stable-fixes). - amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (stable-fixes). - accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (stable-fixes). - accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (stable-fixes). - accel/habanalabs/gaudi2: fix BMON disable configuration (stable-fixes). - accel/habanalabs: return ENOMEM if less than requested pages were pinned (stable-fixes). - ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (stable-fixes). - ASoC: stm32: sai: manage context in set_sysclk callback (stable-fixes). - ALSA: usb-audio: add mono main switch to Presonus S1824c (stable-fixes). - ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (stable-fixes). - ALSA: serial-generic: remove shared static buffer (stable-fixes). - ALSA: usb-audio: apply quirk for MOONDROP Quark2 (stable-fixes). - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (stable-fixes). - commit d6deb82 ++++ kernel-rt: - cifs: Fix uncached read into ITER_KVEC iterator (bsc#1245449). - commit caf12ec - ipv4: start using dst_dev_rcu() (CVE-2025-40074 bsc#1252794). - commit d58640c - kabi: hide dst_entry::dev_rcu (CVE-2025-40074 bsc#1252794). - commit 7047515 - net: dst: introduce dst->dev_rcu (CVE-2025-40074 bsc#1252794). - commit bc25dd4 - net: Add locking to protect skb->dev access in ip_output (CVE-2025-40074 bsc#1252794). - commit ba856a3 - ipv6: ip6_mc_input() and ip6_mr_input() cleanups (CVE-2025-40074 bsc#1252794). - commit 74e34e6 - ipv6: adopt skb_dst_dev() and skb_dst_dev_net[_rcu]() helpers (CVE-2025-40074 bsc#1252794). - commit bef51be - ipv6: adopt dst_dev() helper (CVE-2025-40074 bsc#1252794). - refresh patches.suse/net-ip6_tunnel-Prevent-perpetual-tunnel-growth.patch - commit 7eda2f1 - ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (CVE-2025-40074 bsc#1252794). - commit 172fe2b - net: dst: add four helpers to annotate data-races around dst->dev (CVE-2025-40074 bsc#1252794). - commit d644653 - net: dst: annotate data-races around dst->output (CVE-2025-40074 bsc#1252794). - commit a54672b - net: dst: annotate data-races around dst->input (CVE-2025-40074 bsc#1252794). - commit ffc43da - net: dst: annotate data-races around dst->lastuse (CVE-2025-40074 bsc#1252794). - commit 8826356 - net: dst: annotate data-races around dst->expires (CVE-2025-40074 bsc#1252794). - commit 2c55499 - net: dst: annotate data-races around dst->obsolete (CVE-2025-40074 bsc#1252794). - commit 2ab42e2 - net: ipv4: ipmr: ipmr_queue_xmit(): Drop local variable `dev' (CVE-2025-40074 bsc#1252794). - commit 3c39f8c - net: gro: convert four dev_net() calls (CVE-2025-40074 bsc#1252794). - commit cf41694 - tcp: convert to dev_net_rcu() (CVE-2025-40074 bsc#1252794). - commit 2fe0b75 - net: dst_cache: annotate data-races around dst_cache->reset_ts (CVE-2025-40074 bsc#1252794). - commit 5a73952 - Refresh patches.suse/ALSA-usb-audio-Fix-potential-overflow-of-PCM-transfe.patch Fix the missing mutex unlock at the error path - commit f1238c1 - rpm/kernel-obs-build.spec.in: Add xt_addrtype module for docker Needed by docker meanwhile. - commit 1cd2f7d - x86/amd_nb: Add new PCI IDs for AMD family 0x1a (stable-fixes). - Refresh patches.suse/x86-amd_nb-Add-new-PCI-IDs-for-AMD-family-1Ah-model-60h.patch. - commit 5a88cd1 - ALSA: hda: Fix missing pointer check in hda_component_manager_init function (git-fixes). - commit 39c22db - tools: lib: thermal: don't preserve owner in install (stable-fixes). - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (stable-fixes). - usb: gadget: f_fs: Fix epfile null pointer access after ep enable (stable-fixes). - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (stable-fixes). - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (stable-fixes). - usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (stable-fixes). - usb: gadget: f_hid: Fix zero length packet transfer (stable-fixes). - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (stable-fixes). - wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (stable-fixes). - wifi: ath10k: Fix connection after GTK rekeying (stable-fixes). - wifi: rtw88: sdio: use indirect IO for device registers before power-on (stable-fixes). - wifi: mt76: mt7996: Temporarily disable EPCS (stable-fixes). - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (stable-fixes). - wifi: mac80211: Fix HE capabilities element check (stable-fixes). - video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (stable-fixes). - commit 7dad19b - tools: lib: thermal: use pkg-config to locate libnl3 (stable-fixes). - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (stable-fixes). - thunderbolt: Use is_pciehp instead of is_hotplug_bridge (stable-fixes). - soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (stable-fixes). - soc: qcom: smem: Fix endian-unaware access of num_entries (stable-fixes). - soc: aspeed: socinfo: Add AST27xx silicon IDs (stable-fixes). - pinctrl: single: fix bias pull up/down handling in pin_config_set (stable-fixes). - power: supply: qcom_battmgr: handle charging state change notifications (stable-fixes). - power: supply: sbs-charger: Support multiple devices (stable-fixes). - power: supply: qcom_battmgr: add OOI chemistry (stable-fixes). - spi: rpc-if: Add resume support for RZ/G3E (stable-fixes). - spi: loopback-test: Don't use %pK through printk (stable-fixes). - commit 47c8f1c - NFS4: Fix state renewals missing after boot (git-fixes). - commit 1f41fdb - NFS: check if suid/sgid was cleared after a write as needed (git-fixes). - commit 6f2e3ba - nfs4_setup_readdir(): insufficient locking for - >d_parent->d_inode dereferencing (git-fixes). - commit cbc0708 - PCI: cadence: Check for the existence of cdns_pcie::ops before using it (stable-fixes). - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (git-fixes). - PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (stable-fixes). - PCI/PM: Skip resuming to D0 if device is disconnected (stable-fixes). - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (stable-fixes). - PCI: Disable MSI on RDC PCI to PCIe bridges (stable-fixes). - phy: cadence: cdns-dphy: Enable lower resolutions in dphy (stable-fixes). - phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (stable-fixes). - net: phy: clear link parameters on admin link down (stable-fixes). - net: phy: marvell: Fix 88e1510 downshift counter errata (stable-fixes). - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (stable-fixes). - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (stable-fixes). - media: redrat3: use int type to store negative error codes (stable-fixes). - media: ov08x40: Fix the horizontal flip control (stable-fixes). - media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (stable-fixes). - media: adv7180: Only validate format in querystd (stable-fixes). - media: adv7180: Do not write format to device in set_fmt (stable-fixes). - media: adv7180: Add missing lock in suspend callback (stable-fixes). - media: fix uninitialized symbol warnings (stable-fixes). - media: imon: make send_packet() more robust (stable-fixes). - media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (stable-fixes). - media: amphion: Delete v4l2_fh synchronously in .release() (stable-fixes). - mfd: madera: Work around false-positive -Wininitialized warning (stable-fixes). - mfd: da9063: Split chip variant reading in two bus transactions (stable-fixes). - mfd: stmpe-i2c: Add missing MODULE_LICENSE (stable-fixes). - mfd: stmpe: Remove IRQ domain upon removal (stable-fixes). - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (stable-fixes). - memstick: Add timeout to prevent indefinite waiting (stable-fixes). - mmc: host: renesas_sdhi: Fix the actual clock (stable-fixes). - commit 8c57bbb - NFSv4.1: fix mount hang after CREATE_SESSION failure (git-fixes). - commit c832cc2 - NFSv4: handle ERR_GRACE on delegation recalls (git-fixes). - commit aaacda9 - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (stable-fixes). - iio: adc: imx93_adc: load calibrated values even calibration failed (stable-fixes). - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (stable-fixes). - hwmon: (dell-smm) Add support for Dell OptiPlex 7040 (stable-fixes). - hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (stable-fixes). - hwmon: sy7636a: add alias (stable-fixes). - hwmon: (sbtsi_temp) AMD CPU extended temperature range support (stable-fixes). - hwmon: (k10temp) Add device ID for Strix Halo (stable-fixes). - hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (stable-fixes). - commit f501af0 - jfs: fix uninitialized waitqueue in transaction manager (git-fixes). - commit 0b36ea1 - jfs: Verify inode mode when loading from disk (git-fixes). - commit 475a90c - extcon: adc-jack: Cleanup wakeup source only if it was enabled (git-fixes). - commit 5b8d1e6 - drm/amd/display: Disable VRR on DCE 6 (stable-fixes). - commit d98de00 - drm/amd/display: ensure committing streams is seamless (stable-fixes). - commit 0def0fa - exfat: limit log print for IO error (git-fixes). - commit 1fa4a3d - drm/amd/display: Fix black screen with HDMI outputs (git-fixes). - fbcon: Set fb_display[i]->mode to NULL when the mode is released (stable-fixes). - fbdev: bitblit: bound-check glyph index in bit_putcs* (stable-fixes). - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (stable-fixes). - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (stable-fixes). - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (stable-fixes). - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (stable-fixes). - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (stable-fixes). - extcon: adc-jack: Fix wakeup source leaks on device unbind (stable-fixes). - char: misc: Does not request module for miscdevice with dynamic minor (stable-fixes). - char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (stable-fixes). - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (stable-fixes). - drm/amdgpu: reject gang submissions under SRIOV (stable-fixes). - drm/amd/display: Fix DVI-D/HDMI adapters (stable-fixes). - drm/amd: Avoid evicting resources at S5 (stable-fixes). - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (stable-fixes). - drm/msm: make sure to not queue up recovery more than once (stable-fixes). - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (stable-fixes). - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (stable-fixes). - drm/amdgpu: don't enable SMU on cyan skillfish (stable-fixes). - drm/amdgpu: add support for cyan skillfish gpu_info (stable-fixes). - drm/amd: add more cyan skillfish PCI ids (stable-fixes). - drm/amdgpu: Allow kfd CRIU with no buffer objects (stable-fixes). - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (stable-fixes). - drm/amdkfd: fix vram allocation failure for a special case (stable-fixes). - drm/amdkfd: Handle lack of READ permissions in SVM mapping (stable-fixes). - drm/amdkfd: return -ENOTTY for unsupported IOCTLs (stable-fixes). - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (stable-fixes). - drm/amd/pm: Use cached metrics data on arcturus (stable-fixes). - drm/amd/pm: Use cached metrics data on aldebaran (stable-fixes). - drm/amd/display: update dpp/disp clock from smu clock table (stable-fixes). - drm/amd/display: add more cyan skillfish devices (stable-fixes). - drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (stable-fixes). - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (stable-fixes). - drm/tidss: Set crtc modesetting parameters with adjusted mode (stable-fixes). - drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST (stable-fixes). - drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (stable-fixes). - drm/tidss: Use the crtc_* timings when programming the HW (stable-fixes). - commit 304e918 - tcp: correct handling of extreme memory squeeze (bsc#1253779 CVE-2025-21710 bsc#1237888). - commit bba09b0 - net: tcp: send zero-window ACK when no memory (bsc#1253779). - commit f54e913 - ACPI: property: Return present device nodes only on fwnode interface (stable-fixes). - commit 7bfc861 - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (stable-fixes). - commit d4e809a - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids (stable-fixes). - commit cea477f - ACPICA: Update dsmethod.c to get rid of unused variable warning (stable-fixes). - commit 47d058d - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (stable-fixes). - commit a383be8 - tools/cpupower: Fix incorrect size in cpuidle_state_disable() (stable-fixes). - commit 2d1aa96 - tools/cpupower: fix error return value in cpupower_write_sysfs() (stable-fixes). - commit c9d6e6c - tools/power x86_energy_perf_policy: Prefer driver HWP limits (stable-fixes). - commit e772bc7 - tools/power x86_energy_perf_policy: Enhance HWP enable (stable-fixes). - commit 1133dff - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (stable-fixes). - commit 23d6e42 - Update patches.suse/net-smc-Remove-validation-of-reserved-bits-in-CLC-Decline-.patch (bsc#1252353). - commit d9fe289 - crypto: aspeed - fix double free caused by devm (git-fixes). - dmaengine: dw-edma: Set status for callback_result (stable-fixes). - dmaengine: mv_xor: match alloc_wc and free_wc (stable-fixes). - crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (stable-fixes). - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (stable-fixes). - char: misc: restrict the dynamic range to exclude reserved minors (stable-fixes). - crypto: aspeed-acry - Convert to platform remove callback returning void (stable-fixes). - commit 89d05dd - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (stable-fixes). - ALSA: usb-audio: don't log messages meant for 1810c when initializing 1824c (git-fixes). - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (stable-fixes). - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (stable-fixes). - Bluetooth: SCO: Fix UAF on sco_conn_free (stable-fixes). - Bluetooth: bcsp: receive data only if registered (stable-fixes). - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (stable-fixes). - amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (stable-fixes). - accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (stable-fixes). - accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (stable-fixes). - accel/habanalabs/gaudi2: fix BMON disable configuration (stable-fixes). - accel/habanalabs: return ENOMEM if less than requested pages were pinned (stable-fixes). - ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (stable-fixes). - ASoC: stm32: sai: manage context in set_sysclk callback (stable-fixes). - ALSA: usb-audio: add mono main switch to Presonus S1824c (stable-fixes). - ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (stable-fixes). - ALSA: serial-generic: remove shared static buffer (stable-fixes). - ALSA: usb-audio: apply quirk for MOONDROP Quark2 (stable-fixes). - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (stable-fixes). - commit d6deb82 ++++ kernel-rt_debug: - cifs: Fix uncached read into ITER_KVEC iterator (bsc#1245449). - commit caf12ec - ipv4: start using dst_dev_rcu() (CVE-2025-40074 bsc#1252794). - commit d58640c - kabi: hide dst_entry::dev_rcu (CVE-2025-40074 bsc#1252794). - commit 7047515 - net: dst: introduce dst->dev_rcu (CVE-2025-40074 bsc#1252794). - commit bc25dd4 - net: Add locking to protect skb->dev access in ip_output (CVE-2025-40074 bsc#1252794). - commit ba856a3 - ipv6: ip6_mc_input() and ip6_mr_input() cleanups (CVE-2025-40074 bsc#1252794). - commit 74e34e6 - ipv6: adopt skb_dst_dev() and skb_dst_dev_net[_rcu]() helpers (CVE-2025-40074 bsc#1252794). - commit bef51be - ipv6: adopt dst_dev() helper (CVE-2025-40074 bsc#1252794). - refresh patches.suse/net-ip6_tunnel-Prevent-perpetual-tunnel-growth.patch - commit 7eda2f1 - ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (CVE-2025-40074 bsc#1252794). - commit 172fe2b - net: dst: add four helpers to annotate data-races around dst->dev (CVE-2025-40074 bsc#1252794). - commit d644653 - net: dst: annotate data-races around dst->output (CVE-2025-40074 bsc#1252794). - commit a54672b - net: dst: annotate data-races around dst->input (CVE-2025-40074 bsc#1252794). - commit ffc43da - net: dst: annotate data-races around dst->lastuse (CVE-2025-40074 bsc#1252794). - commit 8826356 - net: dst: annotate data-races around dst->expires (CVE-2025-40074 bsc#1252794). - commit 2c55499 - net: dst: annotate data-races around dst->obsolete (CVE-2025-40074 bsc#1252794). - commit 2ab42e2 - net: ipv4: ipmr: ipmr_queue_xmit(): Drop local variable `dev' (CVE-2025-40074 bsc#1252794). - commit 3c39f8c - net: gro: convert four dev_net() calls (CVE-2025-40074 bsc#1252794). - commit cf41694 - tcp: convert to dev_net_rcu() (CVE-2025-40074 bsc#1252794). - commit 2fe0b75 - net: dst_cache: annotate data-races around dst_cache->reset_ts (CVE-2025-40074 bsc#1252794). - commit 5a73952 - Refresh patches.suse/ALSA-usb-audio-Fix-potential-overflow-of-PCM-transfe.patch Fix the missing mutex unlock at the error path - commit f1238c1 - rpm/kernel-obs-build.spec.in: Add xt_addrtype module for docker Needed by docker meanwhile. - commit 1cd2f7d - x86/amd_nb: Add new PCI IDs for AMD family 0x1a (stable-fixes). - Refresh patches.suse/x86-amd_nb-Add-new-PCI-IDs-for-AMD-family-1Ah-model-60h.patch. - commit 5a88cd1 - ALSA: hda: Fix missing pointer check in hda_component_manager_init function (git-fixes). - commit 39c22db - tools: lib: thermal: don't preserve owner in install (stable-fixes). - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (stable-fixes). - usb: gadget: f_fs: Fix epfile null pointer access after ep enable (stable-fixes). - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (stable-fixes). - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (stable-fixes). - usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (stable-fixes). - usb: gadget: f_hid: Fix zero length packet transfer (stable-fixes). - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (stable-fixes). - wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (stable-fixes). - wifi: ath10k: Fix connection after GTK rekeying (stable-fixes). - wifi: rtw88: sdio: use indirect IO for device registers before power-on (stable-fixes). - wifi: mt76: mt7996: Temporarily disable EPCS (stable-fixes). - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (stable-fixes). - wifi: mac80211: Fix HE capabilities element check (stable-fixes). - video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (stable-fixes). - commit 7dad19b - tools: lib: thermal: use pkg-config to locate libnl3 (stable-fixes). - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (stable-fixes). - thunderbolt: Use is_pciehp instead of is_hotplug_bridge (stable-fixes). - soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (stable-fixes). - soc: qcom: smem: Fix endian-unaware access of num_entries (stable-fixes). - soc: aspeed: socinfo: Add AST27xx silicon IDs (stable-fixes). - pinctrl: single: fix bias pull up/down handling in pin_config_set (stable-fixes). - power: supply: qcom_battmgr: handle charging state change notifications (stable-fixes). - power: supply: sbs-charger: Support multiple devices (stable-fixes). - power: supply: qcom_battmgr: add OOI chemistry (stable-fixes). - spi: rpc-if: Add resume support for RZ/G3E (stable-fixes). - spi: loopback-test: Don't use %pK through printk (stable-fixes). - commit 47c8f1c - NFS4: Fix state renewals missing after boot (git-fixes). - commit 1f41fdb - NFS: check if suid/sgid was cleared after a write as needed (git-fixes). - commit 6f2e3ba - nfs4_setup_readdir(): insufficient locking for - >d_parent->d_inode dereferencing (git-fixes). - commit cbc0708 - PCI: cadence: Check for the existence of cdns_pcie::ops before using it (stable-fixes). - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (git-fixes). - PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (stable-fixes). - PCI/PM: Skip resuming to D0 if device is disconnected (stable-fixes). - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (stable-fixes). - PCI: Disable MSI on RDC PCI to PCIe bridges (stable-fixes). - phy: cadence: cdns-dphy: Enable lower resolutions in dphy (stable-fixes). - phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (stable-fixes). - net: phy: clear link parameters on admin link down (stable-fixes). - net: phy: marvell: Fix 88e1510 downshift counter errata (stable-fixes). - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (stable-fixes). - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (stable-fixes). - media: redrat3: use int type to store negative error codes (stable-fixes). - media: ov08x40: Fix the horizontal flip control (stable-fixes). - media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (stable-fixes). - media: adv7180: Only validate format in querystd (stable-fixes). - media: adv7180: Do not write format to device in set_fmt (stable-fixes). - media: adv7180: Add missing lock in suspend callback (stable-fixes). - media: fix uninitialized symbol warnings (stable-fixes). - media: imon: make send_packet() more robust (stable-fixes). - media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (stable-fixes). - media: amphion: Delete v4l2_fh synchronously in .release() (stable-fixes). - mfd: madera: Work around false-positive -Wininitialized warning (stable-fixes). - mfd: da9063: Split chip variant reading in two bus transactions (stable-fixes). - mfd: stmpe-i2c: Add missing MODULE_LICENSE (stable-fixes). - mfd: stmpe: Remove IRQ domain upon removal (stable-fixes). - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (stable-fixes). - memstick: Add timeout to prevent indefinite waiting (stable-fixes). - mmc: host: renesas_sdhi: Fix the actual clock (stable-fixes). - commit 8c57bbb - NFSv4.1: fix mount hang after CREATE_SESSION failure (git-fixes). - commit c832cc2 - NFSv4: handle ERR_GRACE on delegation recalls (git-fixes). - commit aaacda9 - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (stable-fixes). - iio: adc: imx93_adc: load calibrated values even calibration failed (stable-fixes). - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (stable-fixes). - hwmon: (dell-smm) Add support for Dell OptiPlex 7040 (stable-fixes). - hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (stable-fixes). - hwmon: sy7636a: add alias (stable-fixes). - hwmon: (sbtsi_temp) AMD CPU extended temperature range support (stable-fixes). - hwmon: (k10temp) Add device ID for Strix Halo (stable-fixes). - hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (stable-fixes). - commit f501af0 - jfs: fix uninitialized waitqueue in transaction manager (git-fixes). - commit 0b36ea1 - jfs: Verify inode mode when loading from disk (git-fixes). - commit 475a90c - extcon: adc-jack: Cleanup wakeup source only if it was enabled (git-fixes). - commit 5b8d1e6 - drm/amd/display: Disable VRR on DCE 6 (stable-fixes). - commit d98de00 - drm/amd/display: ensure committing streams is seamless (stable-fixes). - commit 0def0fa - exfat: limit log print for IO error (git-fixes). - commit 1fa4a3d - drm/amd/display: Fix black screen with HDMI outputs (git-fixes). - fbcon: Set fb_display[i]->mode to NULL when the mode is released (stable-fixes). - fbdev: bitblit: bound-check glyph index in bit_putcs* (stable-fixes). - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (stable-fixes). - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (stable-fixes). - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (stable-fixes). - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (stable-fixes). - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (stable-fixes). - extcon: adc-jack: Fix wakeup source leaks on device unbind (stable-fixes). - char: misc: Does not request module for miscdevice with dynamic minor (stable-fixes). - char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (stable-fixes). - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (stable-fixes). - drm/amdgpu: reject gang submissions under SRIOV (stable-fixes). - drm/amd/display: Fix DVI-D/HDMI adapters (stable-fixes). - drm/amd: Avoid evicting resources at S5 (stable-fixes). - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (stable-fixes). - drm/msm: make sure to not queue up recovery more than once (stable-fixes). - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (stable-fixes). - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (stable-fixes). - drm/amdgpu: don't enable SMU on cyan skillfish (stable-fixes). - drm/amdgpu: add support for cyan skillfish gpu_info (stable-fixes). - drm/amd: add more cyan skillfish PCI ids (stable-fixes). - drm/amdgpu: Allow kfd CRIU with no buffer objects (stable-fixes). - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (stable-fixes). - drm/amdkfd: fix vram allocation failure for a special case (stable-fixes). - drm/amdkfd: Handle lack of READ permissions in SVM mapping (stable-fixes). - drm/amdkfd: return -ENOTTY for unsupported IOCTLs (stable-fixes). - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (stable-fixes). - drm/amd/pm: Use cached metrics data on arcturus (stable-fixes). - drm/amd/pm: Use cached metrics data on aldebaran (stable-fixes). - drm/amd/display: update dpp/disp clock from smu clock table (stable-fixes). - drm/amd/display: add more cyan skillfish devices (stable-fixes). - drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (stable-fixes). - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (stable-fixes). - drm/tidss: Set crtc modesetting parameters with adjusted mode (stable-fixes). - drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST (stable-fixes). - drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (stable-fixes). - drm/tidss: Use the crtc_* timings when programming the HW (stable-fixes). - commit 304e918 - tcp: correct handling of extreme memory squeeze (bsc#1253779 CVE-2025-21710 bsc#1237888). - commit bba09b0 - net: tcp: send zero-window ACK when no memory (bsc#1253779). - commit f54e913 - ACPI: property: Return present device nodes only on fwnode interface (stable-fixes). - commit 7bfc861 - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (stable-fixes). - commit d4e809a - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids (stable-fixes). - commit cea477f - ACPICA: Update dsmethod.c to get rid of unused variable warning (stable-fixes). - commit 47d058d - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (stable-fixes). - commit a383be8 - tools/cpupower: Fix incorrect size in cpuidle_state_disable() (stable-fixes). - commit 2d1aa96 - tools/cpupower: fix error return value in cpupower_write_sysfs() (stable-fixes). - commit c9d6e6c - tools/power x86_energy_perf_policy: Prefer driver HWP limits (stable-fixes). - commit e772bc7 - tools/power x86_energy_perf_policy: Enhance HWP enable (stable-fixes). - commit 1133dff - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (stable-fixes). - commit 23d6e42 - Update patches.suse/net-smc-Remove-validation-of-reserved-bits-in-CLC-Decline-.patch (bsc#1252353). - commit d9fe289 - crypto: aspeed - fix double free caused by devm (git-fixes). - dmaengine: dw-edma: Set status for callback_result (stable-fixes). - dmaengine: mv_xor: match alloc_wc and free_wc (stable-fixes). - crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (stable-fixes). - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (stable-fixes). - char: misc: restrict the dynamic range to exclude reserved minors (stable-fixes). - crypto: aspeed-acry - Convert to platform remove callback returning void (stable-fixes). - commit 89d05dd - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (stable-fixes). - ALSA: usb-audio: don't log messages meant for 1810c when initializing 1824c (git-fixes). - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (stable-fixes). - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (stable-fixes). - Bluetooth: SCO: Fix UAF on sco_conn_free (stable-fixes). - Bluetooth: bcsp: receive data only if registered (stable-fixes). - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (stable-fixes). - amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (stable-fixes). - accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (stable-fixes). - accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (stable-fixes). - accel/habanalabs/gaudi2: fix BMON disable configuration (stable-fixes). - accel/habanalabs: return ENOMEM if less than requested pages were pinned (stable-fixes). - ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (stable-fixes). - ASoC: stm32: sai: manage context in set_sysclk callback (stable-fixes). - ALSA: usb-audio: add mono main switch to Presonus S1824c (stable-fixes). - ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (stable-fixes). - ALSA: serial-generic: remove shared static buffer (stable-fixes). - ALSA: usb-audio: apply quirk for MOONDROP Quark2 (stable-fixes). - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (stable-fixes). - commit d6deb82 ++++ salt: - Add minimum_auth_version to enforce security (CVE-2025-62349) - Backport security fixes for vendored tornado * BDSA-2024-3438 * BDSA-2024-3439 * BDSA-2024-9026 - Junos module yaml loader fix (CVE-2025-62348) - Require Python dependencies only for used Python version - Fix TLS and x509 modules for OSes with older cryptography module - Require python-legacy-cgi only for Python > 3.12 - Builds with py >=3.13 require python-legacy-cgi - Fix Salt for Python > 3.11 (bsc#1252285) (bsc#1252244) - * Use external tornado on Python > 3.11 - * Make tls and x509 to use python-cryptography - * Remove usage of spwd - Fix payload signature verification on Tumbleweed (bsc#1251776) - Fix broken symlink on migration to Leap 16.0 (bsc#1250755) - Use versioned python interpreter for salt-ssh - Fix known_hosts error on gitfs (bsc#1250520) (bsc#1227207) - Add python3.11 as preferable for salt-ssh to avoid tests fails - Make test_pillar_timeout test more reliable - Modify README and other doc files for openSUSE - Set python-CherryPy as required for python-salt-testsuite (#115) - Revert require M2Crypto >= 0.44.0 for SUSE Family distros - This reverts commit aa40615dcf7a15325ef71bbc09a5423ce512491d. - Improve SL Micro 6.2 detection with grains - Fix functional.states.test_user for SLES 16 and Micro systems - Fix the tests failing on AlmaLinux 10 and other clones - Add `minion_legacy_req_warnings` option to avoid noisy warnings - Require M2Crypto >= 0.44.0 for SUSE Family distros - Added: * backport-3006.17-security-fixes-739.patch * fix-tls-and-x509-modules-for-older-cryptography-modu.patch * fix-salt-for-python-3.11.patch * do-not-break-signature-verification-on-latest-m2cryp.patch * use-versioned-python-interpreter-for-salt-ssh.patch * allow-libgit2-to-guess-sysdir-homedir-successfully-b.patch * add-python3.11-as-preferable-for-salt-ssh-to-avoid-t.patch * even-more-reliable-pillar-timeout-test.patch * modify-readme-for-opensuse-728.patch * improve-sl-micro-6.2-detection-with-grains.patch * fix-functional.states.test_user-for-sles-16-and-micr.patch * fix-the-tests-failing-on-almalinux-10-and-other-clon.patch * add-minion_legacy_req_warnings-option-to-avoid-noisy.patch ------------------------------------------------------------------ ------------------ 2025-11-24 - Nov 24 2025 ------------------- ------------------------------------------------------------------ ++++ python-kiwi: - Delete workflows conflicting with upstream ++++ gnutls: - Security fix bsc#1254132 CVE-2025-9820 * Fix buffer overflow in gnutls_pkcs11_token_init * Added gnutls-CVE-2025-9820.patch ++++ kernel-default: - kernel-binary: Only skip brp-strip when debuginfo is enabled Fixes: 4fc8f912b4f2 ("kernel-binary: Do not change debuginfo config during build") - commit cd9963e - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (CVE-2025-39944 bsc#1251120) - commit f5c6371 - ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (CVE-2025-39859 bsc#1250252) - commit b475528 - x86/bugs: Fix reporting of LFENCE retpoline (git-fixes). - commit 879f123 - x86/vmscape: Add old Intel CPUs to affected list (git-fixes). - commit 3042143 - net: macb: fix unregister_netdev call order in macb_remove() (CVE-2025-39805 bsc#1249982) - commit 8a9576d - x86/bugs: Report correct retbleed mitigation status (git-fixes). - commit 11da480 - x86/CPU/AMD: Add additional fixed RDSEED microcode revisions (git-fixes). - commit 265ca5a - x86/CPU/AMD: Add missing terminator for zen5_rdseed_microcode (git-fixes). - commit 0a4b156 - net/ip6_tunnel: Prevent perpetual tunnel growth (CVE-2025-40173 bsc#1253421). - commit 2d9c02f - net/smc: Remove validation of reserved bits in CLC Decline message (bsc#1253779). - commit 6b0f67d - kernel-binary: Support building gendwarfksyms on SLE/Leap 15 - commit 940a186 - cramfs: Verify inode mode when loading from disk (git-fixes). - commit 593324b - minixfs: Verify inode mode when loading from disk (git-fixes). - commit a428067 - Add missing bugzilla reference to net fix (bsc#1250237 CVE-2025-40206 bsc#1253393) - commit 9ef65cb ++++ kernel-rt: - kernel-binary: Only skip brp-strip when debuginfo is enabled Fixes: 4fc8f912b4f2 ("kernel-binary: Do not change debuginfo config during build") - commit cd9963e - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (CVE-2025-39944 bsc#1251120) - commit f5c6371 - ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (CVE-2025-39859 bsc#1250252) - commit b475528 - x86/bugs: Fix reporting of LFENCE retpoline (git-fixes). - commit 879f123 - x86/vmscape: Add old Intel CPUs to affected list (git-fixes). - commit 3042143 - net: macb: fix unregister_netdev call order in macb_remove() (CVE-2025-39805 bsc#1249982) - commit 8a9576d - x86/bugs: Report correct retbleed mitigation status (git-fixes). - commit 11da480 - x86/CPU/AMD: Add additional fixed RDSEED microcode revisions (git-fixes). - commit 265ca5a - x86/CPU/AMD: Add missing terminator for zen5_rdseed_microcode (git-fixes). - commit 0a4b156 - net/ip6_tunnel: Prevent perpetual tunnel growth (CVE-2025-40173 bsc#1253421). - commit 2d9c02f - net/smc: Remove validation of reserved bits in CLC Decline message (bsc#1253779). - commit 6b0f67d - kernel-binary: Support building gendwarfksyms on SLE/Leap 15 - commit 940a186 - cramfs: Verify inode mode when loading from disk (git-fixes). - commit 593324b - minixfs: Verify inode mode when loading from disk (git-fixes). - commit a428067 - Add missing bugzilla reference to net fix (bsc#1250237 CVE-2025-40206 bsc#1253393) - commit 9ef65cb ++++ kernel-rt_debug: - kernel-binary: Only skip brp-strip when debuginfo is enabled Fixes: 4fc8f912b4f2 ("kernel-binary: Do not change debuginfo config during build") - commit cd9963e - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (CVE-2025-39944 bsc#1251120) - commit f5c6371 - ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (CVE-2025-39859 bsc#1250252) - commit b475528 - x86/bugs: Fix reporting of LFENCE retpoline (git-fixes). - commit 879f123 - x86/vmscape: Add old Intel CPUs to affected list (git-fixes). - commit 3042143 - net: macb: fix unregister_netdev call order in macb_remove() (CVE-2025-39805 bsc#1249982) - commit 8a9576d - x86/bugs: Report correct retbleed mitigation status (git-fixes). - commit 11da480 - x86/CPU/AMD: Add additional fixed RDSEED microcode revisions (git-fixes). - commit 265ca5a - x86/CPU/AMD: Add missing terminator for zen5_rdseed_microcode (git-fixes). - commit 0a4b156 - net/ip6_tunnel: Prevent perpetual tunnel growth (CVE-2025-40173 bsc#1253421). - commit 2d9c02f - net/smc: Remove validation of reserved bits in CLC Decline message (bsc#1253779). - commit 6b0f67d - kernel-binary: Support building gendwarfksyms on SLE/Leap 15 - commit 940a186 - cramfs: Verify inode mode when loading from disk (git-fixes). - commit 593324b - minixfs: Verify inode mode when loading from disk (git-fixes). - commit a428067 - Add missing bugzilla reference to net fix (bsc#1250237 CVE-2025-40206 bsc#1253393) - commit 9ef65cb ------------------------------------------------------------------ ------------------ 2025-11-23 - Nov 23 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - Input: imx_sc_key - fix memory corruption on unload (git-fixes). - Input: pegasus-notetaker - fix potential out-of-bounds access (git-fixes). - Input: atmel_mxt_ts - allow reset GPIO to sleep (stable-fixes). - commit a07d058 ++++ kernel-rt: - Input: imx_sc_key - fix memory corruption on unload (git-fixes). - Input: pegasus-notetaker - fix potential out-of-bounds access (git-fixes). - Input: atmel_mxt_ts - allow reset GPIO to sleep (stable-fixes). - commit a07d058 ++++ kernel-rt_debug: - Input: imx_sc_key - fix memory corruption on unload (git-fixes). - Input: pegasus-notetaker - fix potential out-of-bounds access (git-fixes). - Input: atmel_mxt_ts - allow reset GPIO to sleep (stable-fixes). - commit a07d058 ------------------------------------------------------------------ ------------------ 2025-11-22 - Nov 22 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (CVE-2025-40001 bsc#1252303). - commit 2c846dd - Disable CONFIG_CPU5_WDT The cpu5wdt driver doesn't implement a proper watchdog interface and has many code issues. It only handles obscure and obsolete hardware. Stop building and supporting this driver (jsc#PED-14062). - commit 5170874 - pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() (git-fixes). - pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc (git-fixes). - nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot (git-fixes). - Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" (git-fixes). - drm/tegra: Add call to put_pid() (git-fixes). - drm/tegra: dc: Fix reference leak in tegra_dc_couple() (git-fixes). - commit 401121e ++++ kernel-rt: - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (CVE-2025-40001 bsc#1252303). - commit 2c846dd - Disable CONFIG_CPU5_WDT The cpu5wdt driver doesn't implement a proper watchdog interface and has many code issues. It only handles obscure and obsolete hardware. Stop building and supporting this driver (jsc#PED-14062). - commit 5170874 - pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() (git-fixes). - pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc (git-fixes). - nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot (git-fixes). - Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" (git-fixes). - drm/tegra: Add call to put_pid() (git-fixes). - drm/tegra: dc: Fix reference leak in tegra_dc_couple() (git-fixes). - commit 401121e ++++ kernel-rt_debug: - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (CVE-2025-40001 bsc#1252303). - commit 2c846dd - Disable CONFIG_CPU5_WDT The cpu5wdt driver doesn't implement a proper watchdog interface and has many code issues. It only handles obscure and obsolete hardware. Stop building and supporting this driver (jsc#PED-14062). - commit 5170874 - pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() (git-fixes). - pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc (git-fixes). - nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot (git-fixes). - Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" (git-fixes). - drm/tegra: Add call to put_pid() (git-fixes). - drm/tegra: dc: Fix reference leak in tegra_dc_couple() (git-fixes). - commit 401121e ------------------------------------------------------------------ ------------------ 2025-11-21 - Nov 21 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - tls: wait for pending async decryptions if tls_strp_msg_hold fails (CVE-2025-40176 bsc#1253425). - commit 411c26e - series.conf: reorder misplaced patches from kABI section Fix misplaced patches in the kABI section by restoring correct order. - commit f6506b9 - platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos (git-fixes). - commit e814a2b - vfs: Don't leak disconnected dentries on umount (CVE-2025-40105 bsc#1252928). - commit 29d6b54 ++++ kernel-rt: - tls: wait for pending async decryptions if tls_strp_msg_hold fails (CVE-2025-40176 bsc#1253425). - commit 411c26e - series.conf: reorder misplaced patches from kABI section Fix misplaced patches in the kABI section by restoring correct order. - commit f6506b9 - platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos (git-fixes). - commit e814a2b - vfs: Don't leak disconnected dentries on umount (CVE-2025-40105 bsc#1252928). - commit 29d6b54 ++++ kernel-rt_debug: - tls: wait for pending async decryptions if tls_strp_msg_hold fails (CVE-2025-40176 bsc#1253425). - commit 411c26e - series.conf: reorder misplaced patches from kABI section Fix misplaced patches in the kABI section by restoring correct order. - commit f6506b9 - platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos (git-fixes). - commit e814a2b - vfs: Don't leak disconnected dentries on umount (CVE-2025-40105 bsc#1252928). - commit 29d6b54 ++++ multipath-tools: - Update to version 0.10.5+213+suse.04c3a0ac: * Log offline path state if "log_checker_err always" is set (bsc#1254094) * mpathpersist: Fix REPORT CAPABILITIES output ++++ libmicrohttpd: - Fix for the following bugs: * bsc#1253177 CVE-2025-59777 * bsc#1253178 CVE-2025-62689 - Add patch: * CVE-2025-59777.patch * this same patch fixes both CVEs * git commit ff13abc1c1d7d2b30d69d5c0bd4a237e1801c50b ------------------------------------------------------------------ ------------------ 2025-11-20 - Nov 20 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (git-fixes). - commit f6f6b8f - KVM: VMX: Fix check for valid GVA on an EPT violation (git-fixes). - commit dab0856 - KVM: x86: Don't treat ENTER and LEAVE as branches, because they aren't (git-fixes). - commit 4d07448 - HID: uclogic: Fix potential memory leak in error path (git-fixes). - HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (git-fixes). - HID: amd_sfh: Stop sensor before starting (git-fixes). - HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 (git-fixes). - commit 98129db ++++ kernel-rt: - KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (git-fixes). - commit f6f6b8f - KVM: VMX: Fix check for valid GVA on an EPT violation (git-fixes). - commit dab0856 - KVM: x86: Don't treat ENTER and LEAVE as branches, because they aren't (git-fixes). - commit 4d07448 - HID: uclogic: Fix potential memory leak in error path (git-fixes). - HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (git-fixes). - HID: amd_sfh: Stop sensor before starting (git-fixes). - HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 (git-fixes). - commit 98129db ++++ kernel-rt_debug: - KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (git-fixes). - commit f6f6b8f - KVM: VMX: Fix check for valid GVA on an EPT violation (git-fixes). - commit dab0856 - KVM: x86: Don't treat ENTER and LEAVE as branches, because they aren't (git-fixes). - commit 4d07448 - HID: uclogic: Fix potential memory leak in error path (git-fixes). - HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (git-fixes). - HID: amd_sfh: Stop sensor before starting (git-fixes). - HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 (git-fixes). - commit 98129db ------------------------------------------------------------------ ------------------ 2025-11-19 - Nov 19 2025 ------------------- ------------------------------------------------------------------ ++++ curl: - Security fix: [bsc#1253757, CVE-2025-11563] * curl: wcurl path traversal with percent-encoded slashes * Add curl-CVE-2025-11563.patch ++++ kernel-default: - scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (bsc#1252267). - uio_hv_generic: Let userspace take care of interrupt mask (git-fixes CVE-2025-40048 bsc#1252862). - net/mana: fix warning in the writer of client oob (git-fixes). - uio_hv_generic: Query the ringbuffer size for device (git-fixes). - Drivers: hv: vmbus: Add utility function for querying ring size (git-fixes). - commit 0473d84 - sctp: Fix MAC comparison to be constant-time (CVE-2025-40204 bsc#1253436). - commit 53f522f - tracing: dynevent: Add a missing lockdown check on dynevent (CVE-2025-40021 bsc#1252681). - commit c113400 - Update patches.suse/netfilter-nft_objref-validate-objref-and-objrefmap-e.patch (bsc#1250237 CVE-2025-40206). Inserted series, updated CVE reference and mainline - commit 617e07d - selftests/bpf: Close fd in error path in drop_on_reuseport (git-fixes). - commit 9eacaa7 - selftests/bpf: Close obj in error path in xdp_adjust_tail (git-fixes). - commit 32804dc - selftests/bpf: Use pid_t consistently in test_progs.c (git-fixes). - commit 12adc35 - bpf: Reject negative offsets for ALU ops (CVE-2025-40169 bsc#1253416). - commit 004bd79 ++++ kernel-rt: - scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (bsc#1252267). - uio_hv_generic: Let userspace take care of interrupt mask (git-fixes CVE-2025-40048 bsc#1252862). - net/mana: fix warning in the writer of client oob (git-fixes). - uio_hv_generic: Query the ringbuffer size for device (git-fixes). - Drivers: hv: vmbus: Add utility function for querying ring size (git-fixes). - commit 0473d84 - sctp: Fix MAC comparison to be constant-time (CVE-2025-40204 bsc#1253436). - commit 53f522f - tracing: dynevent: Add a missing lockdown check on dynevent (CVE-2025-40021 bsc#1252681). - commit c113400 - Update patches.suse/netfilter-nft_objref-validate-objref-and-objrefmap-e.patch (bsc#1250237 CVE-2025-40206). Inserted series, updated CVE reference and mainline - commit 617e07d - selftests/bpf: Close fd in error path in drop_on_reuseport (git-fixes). - commit 9eacaa7 - selftests/bpf: Close obj in error path in xdp_adjust_tail (git-fixes). - commit 32804dc - selftests/bpf: Use pid_t consistently in test_progs.c (git-fixes). - commit 12adc35 - bpf: Reject negative offsets for ALU ops (CVE-2025-40169 bsc#1253416). - commit 004bd79 ++++ kernel-rt_debug: - scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (bsc#1252267). - uio_hv_generic: Let userspace take care of interrupt mask (git-fixes CVE-2025-40048 bsc#1252862). - net/mana: fix warning in the writer of client oob (git-fixes). - uio_hv_generic: Query the ringbuffer size for device (git-fixes). - Drivers: hv: vmbus: Add utility function for querying ring size (git-fixes). - commit 0473d84 - sctp: Fix MAC comparison to be constant-time (CVE-2025-40204 bsc#1253436). - commit 53f522f - tracing: dynevent: Add a missing lockdown check on dynevent (CVE-2025-40021 bsc#1252681). - commit c113400 - Update patches.suse/netfilter-nft_objref-validate-objref-and-objrefmap-e.patch (bsc#1250237 CVE-2025-40206). Inserted series, updated CVE reference and mainline - commit 617e07d - selftests/bpf: Close fd in error path in drop_on_reuseport (git-fixes). - commit 9eacaa7 - selftests/bpf: Close obj in error path in xdp_adjust_tail (git-fixes). - commit 32804dc - selftests/bpf: Use pid_t consistently in test_progs.c (git-fixes). - commit 12adc35 - bpf: Reject negative offsets for ALU ops (CVE-2025-40169 bsc#1253416). - commit 004bd79 ++++ kmod: - man: modprobe.d: document the config file order handling (bsc#1253741) * man-modprobe.d-document-the-config-file-order-handling.patch ------------------------------------------------------------------ ------------------ 2025-11-18 - Nov 18 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - kernel-binary: Require libdw in Factory Libdw is required for gendwarfksyms - commit 0d3f66b - mtd: onenand: Pass correct pointer to IRQ handler (git-fixes). - mtd: rawnand: cadence: fix DMA device NULL pointer dereference (git-fixes). - mtdchar: fix integer overflow in read/write ioctls (git-fixes). - commit fd43643 ++++ kernel-rt: - kernel-binary: Require libdw in Factory Libdw is required for gendwarfksyms - commit 0d3f66b - mtd: onenand: Pass correct pointer to IRQ handler (git-fixes). - mtd: rawnand: cadence: fix DMA device NULL pointer dereference (git-fixes). - mtdchar: fix integer overflow in read/write ioctls (git-fixes). - commit fd43643 ++++ kernel-rt_debug: - kernel-binary: Require libdw in Factory Libdw is required for gendwarfksyms - commit 0d3f66b - mtd: onenand: Pass correct pointer to IRQ handler (git-fixes). - mtd: rawnand: cadence: fix DMA device NULL pointer dereference (git-fixes). - mtdchar: fix integer overflow in read/write ioctls (git-fixes). - commit fd43643 ++++ libsoup: - Add libsoup-CVE-2025-12105.patch: fix use after free caused by 'finishing' queue item twice (bsc#1252555 CVE-2025-12105 glgo#GNOME/libsoup!481). ++++ sssd: - Install file in krb5.conf.d to include sssd krb5 config snippets; (bsc#1244325); - Disable Kerberos localauth an2ln plugin for AD; (CVE-2025-11561); (bsc#1251827); Add patch 0005-krb5-disable-Kerberos-localauth-an2ln-plugin-for-AD-.patch ------------------------------------------------------------------ ------------------ 2025-11-17 - Nov 17 2025 ------------------- ------------------------------------------------------------------ ++++ dpdk: - Upstream bugfix update: - Version 22.11.10 - net/mlx5: fix out-of-order completions in ordinary Rx burst (CVE-2025-23259, bsc#1254161) - Version 22.11.9 https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id24 - Version 22.11.8 https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id21 - Version 22.11.7 https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id18 - Remove included fix dpdk-CVE-2024-11614.patch - Version 22.11.6 https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id15 - Version 22.11.5 https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id12 - Version 22.11.4 https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id8 - Version 22.11.3 https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id4 Remove included fixes: - 0001-kni-fix-build-with-Linux-6.3.patch - Version 22.11.2 https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id2 - Fix [bsc#1214724], SUSE provided DPDK modules taint the kernel as unsupported + Add kernel support flag for rte_kni.ko ++++ python-kiwi: - Fixed spec file requires The package requirement for binutils was set to TW (>=1650) only but is also required for SLES16/Leap16 which is 1600 This commit fixes the condition to match with all required distributions and fixes bsc#1253637 ++++ kernel-default: - net/sched: sch_qfq: Fix null-deref in agg_dequeue (CVE-2025-40083 bsc#1252912). - commit 517474e - mm/secretmem: fix use-after-free race in fault handler (git-fixes). - commit 8bf2ad9 - mm/mm_init: fix hash table order logging in alloc_large_system_hash() (git-fixes). - commit fdeb2e0 - xsk: Harden userspace-supplied xdp_desc validation (CVE-2025-40159 bsc#1253403). - commit 7cd1a7d ++++ kernel-rt: - net/sched: sch_qfq: Fix null-deref in agg_dequeue (CVE-2025-40083 bsc#1252912). - commit 517474e - mm/secretmem: fix use-after-free race in fault handler (git-fixes). - commit 8bf2ad9 - mm/mm_init: fix hash table order logging in alloc_large_system_hash() (git-fixes). - commit fdeb2e0 - xsk: Harden userspace-supplied xdp_desc validation (CVE-2025-40159 bsc#1253403). - commit 7cd1a7d ++++ kernel-rt_debug: - net/sched: sch_qfq: Fix null-deref in agg_dequeue (CVE-2025-40083 bsc#1252912). - commit 517474e - mm/secretmem: fix use-after-free race in fault handler (git-fixes). - commit 8bf2ad9 - mm/mm_init: fix hash table order logging in alloc_large_system_hash() (git-fixes). - commit fdeb2e0 - xsk: Harden userspace-supplied xdp_desc validation (CVE-2025-40159 bsc#1253403). - commit 7cd1a7d ++++ multipath-tools: - Update to version 0.10.5+190+suse.a9f87040: * CI: GitHub workflow updates. No code changes. ++++ freetype2: - update to 2.14.1: * The auto-hinter got new abilities. It can now better separate diacritic glyphs from base glyphs at small sizes by artificially moving diacritics up (or down) if necessary * Tilde accent glyphs get vertically stretched at small sizes so that they don't degenerate to horizontal lines. * Diacritics directly attached to a base glyph (like the ogonek in character 'ę') no longer distort the shape of the base glyph * The TrueType instruction interpreter was optimized to produce a 15% gain in the glyph loading speed. * Handling of Variation Fonts is now considerably faster * TrueType and CFF glyph loading speed has been improved by 5-10% on modern 64-bit platforms as a result of better handling of fixed-point multiplication. * The BDF driver now loads fonts 75% faster. ------------------------------------------------------------------ ------------------ 2025-11-16 - Nov 16 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - selftests/bpf: Fix missing ARRAY_SIZE() definition in bench.c (git-fixes). - commit f67cafa - selftests/bpf: Fix missing UINT_MAX definitions in benchmarks (git-fixes). - commit 172ead3 - selftests/bpf: Fix missing BUILD_BUG_ON() declaration (git-fixes). - commit 67585df ++++ kernel-rt: - selftests/bpf: Fix missing ARRAY_SIZE() definition in bench.c (git-fixes). - commit f67cafa - selftests/bpf: Fix missing UINT_MAX definitions in benchmarks (git-fixes). - commit 172ead3 - selftests/bpf: Fix missing BUILD_BUG_ON() declaration (git-fixes). - commit 67585df ++++ kernel-rt_debug: - selftests/bpf: Fix missing ARRAY_SIZE() definition in bench.c (git-fixes). - commit f67cafa - selftests/bpf: Fix missing UINT_MAX definitions in benchmarks (git-fixes). - commit 172ead3 - selftests/bpf: Fix missing BUILD_BUG_ON() declaration (git-fixes). - commit 67585df ------------------------------------------------------------------ ------------------ 2025-11-15 - Nov 15 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (git-fixes). - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (git-fixes). - acpi,srat: Fix incorrect device handle check for Generic Initiator (git-fixes). - spi: Try to get ACPI GPIO IRQ earlier (git-fixes). - regulator: fixed: fix GPIO descriptor leak on register failure (git-fixes). - ASoC: codecs: va-macro: fix resource leak in probe error path (git-fixes). - ASoC: cs4271: Fix regulator leak on probe failure (git-fixes). - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (git-fixes). - crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (git-fixes). - commit c9e8681 ++++ kernel-rt: - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (git-fixes). - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (git-fixes). - acpi,srat: Fix incorrect device handle check for Generic Initiator (git-fixes). - spi: Try to get ACPI GPIO IRQ earlier (git-fixes). - regulator: fixed: fix GPIO descriptor leak on register failure (git-fixes). - ASoC: codecs: va-macro: fix resource leak in probe error path (git-fixes). - ASoC: cs4271: Fix regulator leak on probe failure (git-fixes). - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (git-fixes). - crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (git-fixes). - commit c9e8681 ++++ kernel-rt_debug: - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (git-fixes). - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (git-fixes). - acpi,srat: Fix incorrect device handle check for Generic Initiator (git-fixes). - spi: Try to get ACPI GPIO IRQ earlier (git-fixes). - regulator: fixed: fix GPIO descriptor leak on register failure (git-fixes). - ASoC: codecs: va-macro: fix resource leak in probe error path (git-fixes). - ASoC: cs4271: Fix regulator leak on probe failure (git-fixes). - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (git-fixes). - crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (git-fixes). - commit c9e8681 ------------------------------------------------------------------ ------------------ 2025-11-14 - Nov 14 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - s390/mm: Fix in_atomic() handling in do_secure_storage_access() (git-fixes CVE-2025-38359 bsc#1247076). - s390/mm,fault: simplify kfence fault handling (bsc#1247076). - commit 5eab67b - kernel-binary: Do not change debuginfo config during build Historically when debuginfo build was disabled in OBS kernel was configured to not generate the debuginfo at all saving space during build and making the build faster. More and more kernel features depend on debuginfo, and disabling it changes the kernel significantly disabling functionality that is otherwise available and causing ABI breakage. Recently genksyms was rewritten as gendwarfksyms to support more features but requires debuginfo to operate. With that kernel builds without deuginfo are not very useful anymore. Even if rpm eventually trashes the debuginfo it needs to be always generated. - commit 4fc8f91 - Bluetooth: L2CAP: export l2cap_chan_hold for modules (stable-fixes). - commit 0d1ed96 - ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (git-fixes). - ACPI: CPPC: Perform fast check switch only for online CPUs (git-fixes). - ACPI: CPPC: Check _CPC validity for only the online CPUs (git-fixes). - wifi: mwl8k: inject DSSS Parameter Set element into beacons if missing (git-fixes). - wifi: mac80211: skip rate verification for not captured PSDUs (git-fixes). - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp() (git-fixes). - wifi: mac80211: reject address change while connecting (git-fixes). - Bluetooth: 6lowpan: add missing l2cap_chan_lock() (git-fixes). - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (git-fixes). - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (git-fixes). - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (git-fixes). - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (git-fixes). - Bluetooth: MGMT: cancel mesh send timer when hdev removed (git-fixes). - strparser: Fix signed/unsigned mismatch bug (git-fixes). - commit 22e4e84 ++++ kernel-rt: - s390/mm: Fix in_atomic() handling in do_secure_storage_access() (git-fixes CVE-2025-38359 bsc#1247076). - s390/mm,fault: simplify kfence fault handling (bsc#1247076). - commit 5eab67b - kernel-binary: Do not change debuginfo config during build Historically when debuginfo build was disabled in OBS kernel was configured to not generate the debuginfo at all saving space during build and making the build faster. More and more kernel features depend on debuginfo, and disabling it changes the kernel significantly disabling functionality that is otherwise available and causing ABI breakage. Recently genksyms was rewritten as gendwarfksyms to support more features but requires debuginfo to operate. With that kernel builds without deuginfo are not very useful anymore. Even if rpm eventually trashes the debuginfo it needs to be always generated. - commit 4fc8f91 - Bluetooth: L2CAP: export l2cap_chan_hold for modules (stable-fixes). - commit 0d1ed96 - ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (git-fixes). - ACPI: CPPC: Perform fast check switch only for online CPUs (git-fixes). - ACPI: CPPC: Check _CPC validity for only the online CPUs (git-fixes). - wifi: mwl8k: inject DSSS Parameter Set element into beacons if missing (git-fixes). - wifi: mac80211: skip rate verification for not captured PSDUs (git-fixes). - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp() (git-fixes). - wifi: mac80211: reject address change while connecting (git-fixes). - Bluetooth: 6lowpan: add missing l2cap_chan_lock() (git-fixes). - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (git-fixes). - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (git-fixes). - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (git-fixes). - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (git-fixes). - Bluetooth: MGMT: cancel mesh send timer when hdev removed (git-fixes). - strparser: Fix signed/unsigned mismatch bug (git-fixes). - commit 22e4e84 ++++ kernel-rt_debug: - s390/mm: Fix in_atomic() handling in do_secure_storage_access() (git-fixes CVE-2025-38359 bsc#1247076). - s390/mm,fault: simplify kfence fault handling (bsc#1247076). - commit 5eab67b - kernel-binary: Do not change debuginfo config during build Historically when debuginfo build was disabled in OBS kernel was configured to not generate the debuginfo at all saving space during build and making the build faster. More and more kernel features depend on debuginfo, and disabling it changes the kernel significantly disabling functionality that is otherwise available and causing ABI breakage. Recently genksyms was rewritten as gendwarfksyms to support more features but requires debuginfo to operate. With that kernel builds without deuginfo are not very useful anymore. Even if rpm eventually trashes the debuginfo it needs to be always generated. - commit 4fc8f91 - Bluetooth: L2CAP: export l2cap_chan_hold for modules (stable-fixes). - commit 0d1ed96 - ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (git-fixes). - ACPI: CPPC: Perform fast check switch only for online CPUs (git-fixes). - ACPI: CPPC: Check _CPC validity for only the online CPUs (git-fixes). - wifi: mwl8k: inject DSSS Parameter Set element into beacons if missing (git-fixes). - wifi: mac80211: skip rate verification for not captured PSDUs (git-fixes). - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp() (git-fixes). - wifi: mac80211: reject address change while connecting (git-fixes). - Bluetooth: 6lowpan: add missing l2cap_chan_lock() (git-fixes). - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (git-fixes). - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (git-fixes). - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (git-fixes). - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (git-fixes). - Bluetooth: MGMT: cancel mesh send timer when hdev removed (git-fixes). - strparser: Fix signed/unsigned mismatch bug (git-fixes). - commit 22e4e84 ------------------------------------------------------------------ ------------------ 2025-11-13 - Nov 13 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - bpf: make sure skb->len != 0 when redirecting to a tunneling device (CVE-2022-50253 bsc#1249912) - commit 9d76bea - scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (CVE-2025-39788 bsc#1249547) - commit 8ecb142 - drm/amd/display: Check dce_hwseq before dereferencing it (CVE-2025-38361 bsc#1247079) - commit c29726d - NFSD: Skip close replay processing if XDR encoding fails (git-fixes). - commit a56f52a - NFSD: Never cache a COMPOUND when the SEQUENCE operation fails (git-fixes). - commit bd549b4 - NFSD: free copynotify stateid in nfs4_free_ol_stateid() (git-fixes). - commit e5427cd ++++ kernel-rt: - bpf: make sure skb->len != 0 when redirecting to a tunneling device (CVE-2022-50253 bsc#1249912) - commit 9d76bea - scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (CVE-2025-39788 bsc#1249547) - commit 8ecb142 - drm/amd/display: Check dce_hwseq before dereferencing it (CVE-2025-38361 bsc#1247079) - commit c29726d - NFSD: Skip close replay processing if XDR encoding fails (git-fixes). - commit a56f52a - NFSD: Never cache a COMPOUND when the SEQUENCE operation fails (git-fixes). - commit bd549b4 - NFSD: free copynotify stateid in nfs4_free_ol_stateid() (git-fixes). - commit e5427cd ++++ kernel-rt_debug: - bpf: make sure skb->len != 0 when redirecting to a tunneling device (CVE-2022-50253 bsc#1249912) - commit 9d76bea - scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (CVE-2025-39788 bsc#1249547) - commit 8ecb142 - drm/amd/display: Check dce_hwseq before dereferencing it (CVE-2025-38361 bsc#1247079) - commit c29726d - NFSD: Skip close replay processing if XDR encoding fails (git-fixes). - commit a56f52a - NFSD: Never cache a COMPOUND when the SEQUENCE operation fails (git-fixes). - commit bd549b4 - NFSD: free copynotify stateid in nfs4_free_ol_stateid() (git-fixes). - commit e5427cd ++++ python311-core: - Add CVE-2025-6075-expandvars-perf-degrad.patch avoid simple quadratic complexity vulnerabilities of os.path.expandvars() (CVE-2025-6075, bsc#1252974). - Readjusted patches: - CVE-2023-52425-libexpat-2.6.0-backport.patch - CVE-2023-52425-remove-reparse_deferral-tests.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch ++++ unbound: - Fix CVE-2025-11411 (possible domain hijacking attack). Since this minimal patch interferes with most of the unit tests, the '%check' section has been removed from the spec file. [CVE-2025-11411, bsc#1252525, unbound-1.22-CVE-2025-11411.patch] ++++ nvidia-open-driver-G06-signed: - introduced extra %gfx_aarch64_version and appropriate tarball/pci_id file in the hope that build service will no longer complain - update CUDA variant to 580.105.08 ++++ python311: - Add CVE-2025-6075-expandvars-perf-degrad.patch avoid simple quadratic complexity vulnerabilities of os.path.expandvars() (CVE-2025-6075, bsc#1252974). - Readjusted patches: - CVE-2023-52425-libexpat-2.6.0-backport.patch - CVE-2023-52425-remove-reparse_deferral-tests.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch ++++ qemu: - Bugfixes: * io: fix use after free in websocket handshake code (bsc#1250984, CVE-2025-11234) * io: move websock resource release to close method (bsc#1250984, CVE-2025-11234) * io: release active GSource in TLS channel finalizer (bsc#1250984, CVE-2025-11234) * block/curl: fix curl internal handles handling (bsc#1252768, CVE-2025-11234) ------------------------------------------------------------------ ------------------ 2025-11-12 - Nov 12 2025 ------------------- ------------------------------------------------------------------ ++++ grub2: - Fix CVE-2025-54771 (bsc#1252931) * 0001-kern-file-Call-grub_dl_unref-after-fs-fs_close.patch - Fix CVE-2025-54770 (bsc#1252930) * 0002-net-net-Unregister-net_set_vlan-command-on-unload.patch - Fix CVE-2025-61662 (bsc#1252933) * 0003-gettext-gettext-Unregister-gettext-command-on-module.patch - Fix CVE-2025-61663 (bsc#1252934) - Fix CVE-2025-61664 (bsc#1252935) * 0004-normal-main-Unregister-commands-on-module-unload.patch * 0005-tests-lib-functional_test-Unregister-commands-on-mod.patch - Fix CVE-2025-61661 (bsc#1252932) * 0006-commands-usbtest-Use-correct-string-length-field.patch * 0007-commands-usbtest-Ensure-string-length-is-sufficient-.patch - Bump upstream SBAT generation to 6 ++++ kernel-default: - perf script: add --addr2line option (bsc#1247509). - commit b555487 - scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (bsc#1251786 CVE-2023-53676). - commit 9f54767 - crypto: iaa - Do not clobber req->base.data (git-fixes). - commit 5feccb5 - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (git-fixes). - commit 065dd63 - btrfs: do not update last_log_commit when logging inode due to a new name (git-fixes). - commit c42dda1 - KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (git-fixes). - commit 187ad0b - KVM: SVM: Re-load current, not host, TSC_AUX on #VMEXIT from SEV-ES guest (git-fixes). - commit ce2cf8f - KVM: x86: Add helper to retrieve current value of user return MSR (git-fixes). - commit aaea082 - KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (git-fixes). - commit 6c43180 - btrfs: tree-checker: fix the wrong output of data backref objectid (git-fix). - commit b216859 - btrfs: fix COW handling in run_delalloc_nocow() (git-fix). - commit 1ee428c - btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range() (git-fix). - commit 0febf2a - btrfs: run btrfs_error_commit_super() early (git-fix). - commit 8643309 - btrfs: tree-checker: add dev extent item checks (git-fix). - commit 48bfe9b - btrfs: tree-checker: reject BTRFS_FT_UNKNOWN dir type (git-fix). - commit 4308950 - btrfs: avoid using fixed char array size for tree names (git-fix). - commit f141f17 - btrfs: tree-checker: validate dref root and objectid (git-fix). - commit 3243d37 - btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve (git-fix). - commit 36065ed - btrfs: qgroup: correctly model root qgroup rsv in convert (git-fix). - commit 9e4469e - btrfs: tree-checker: add type and sequence check for inline backrefs (git-fix). - commit d1d2092 - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (git-fix). - commit ee165a1 ++++ kernel-rt: - perf script: add --addr2line option (bsc#1247509). - commit b555487 - scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (bsc#1251786 CVE-2023-53676). - commit 9f54767 - crypto: iaa - Do not clobber req->base.data (git-fixes). - commit 5feccb5 - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (git-fixes). - commit 065dd63 - btrfs: do not update last_log_commit when logging inode due to a new name (git-fixes). - commit c42dda1 - KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (git-fixes). - commit 187ad0b - KVM: SVM: Re-load current, not host, TSC_AUX on #VMEXIT from SEV-ES guest (git-fixes). - commit ce2cf8f - KVM: x86: Add helper to retrieve current value of user return MSR (git-fixes). - commit aaea082 - KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (git-fixes). - commit 6c43180 - btrfs: tree-checker: fix the wrong output of data backref objectid (git-fix). - commit b216859 - btrfs: fix COW handling in run_delalloc_nocow() (git-fix). - commit 1ee428c - btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range() (git-fix). - commit 0febf2a - btrfs: run btrfs_error_commit_super() early (git-fix). - commit 8643309 - btrfs: tree-checker: add dev extent item checks (git-fix). - commit 48bfe9b - btrfs: tree-checker: reject BTRFS_FT_UNKNOWN dir type (git-fix). - commit 4308950 - btrfs: avoid using fixed char array size for tree names (git-fix). - commit f141f17 - btrfs: tree-checker: validate dref root and objectid (git-fix). - commit 3243d37 - btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve (git-fix). - commit 36065ed - btrfs: qgroup: correctly model root qgroup rsv in convert (git-fix). - commit 9e4469e - btrfs: tree-checker: add type and sequence check for inline backrefs (git-fix). - commit d1d2092 - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (git-fix). - commit ee165a1 ++++ kernel-rt_debug: - perf script: add --addr2line option (bsc#1247509). - commit b555487 - scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (bsc#1251786 CVE-2023-53676). - commit 9f54767 - crypto: iaa - Do not clobber req->base.data (git-fixes). - commit 5feccb5 - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (git-fixes). - commit 065dd63 - btrfs: do not update last_log_commit when logging inode due to a new name (git-fixes). - commit c42dda1 - KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (git-fixes). - commit 187ad0b - KVM: SVM: Re-load current, not host, TSC_AUX on #VMEXIT from SEV-ES guest (git-fixes). - commit ce2cf8f - KVM: x86: Add helper to retrieve current value of user return MSR (git-fixes). - commit aaea082 - KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (git-fixes). - commit 6c43180 - btrfs: tree-checker: fix the wrong output of data backref objectid (git-fix). - commit b216859 - btrfs: fix COW handling in run_delalloc_nocow() (git-fix). - commit 1ee428c - btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range() (git-fix). - commit 0febf2a - btrfs: run btrfs_error_commit_super() early (git-fix). - commit 8643309 - btrfs: tree-checker: add dev extent item checks (git-fix). - commit 48bfe9b - btrfs: tree-checker: reject BTRFS_FT_UNKNOWN dir type (git-fix). - commit 4308950 - btrfs: avoid using fixed char array size for tree names (git-fix). - commit f141f17 - btrfs: tree-checker: validate dref root and objectid (git-fix). - commit 3243d37 - btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve (git-fix). - commit 36065ed - btrfs: qgroup: correctly model root qgroup rsv in convert (git-fix). - commit 9e4469e - btrfs: tree-checker: add type and sequence check for inline backrefs (git-fix). - commit d1d2092 - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (git-fix). - commit ee165a1 ++++ multipath-tools: - _service: switched to tar_scm for git LFS - Update to version 0.10.5+125+suse.1ed79487: - Fixes from upstream 0.10.5 (see also NEWS.md) (bsc#1253260) * Improved the communication with **udev** and **systemd** by triggering uevents when path devices are added to or removed from multipath maps, or when `multipathd reconfigure` is executed after changing blacklist directives in `multipath.conf`. * Failed paths should be checked every `polling_interval`. In certain cases, this wouldn't happen, because the check interval wasn't reset by multipathd. * It could happen that multipathd would accidentally release a SCSI persistent reservation held by another node. Fix it. * After manually failing some paths and then reinstating them, sometimes the reinstated paths were immediately failed again by multipathd. Fix it. * Various minor fixes reported by coverity. ++++ ucode-intel: - Intel CPU Microcode was updated to the 20251111 release (bsc#1253319) - Update for functional issues. New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | GNR-D | B0/B1 | 06-ae-01/97 | | 01000273 | Xeon 6700P-B/6500P-B Series SoC with P-Cores Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 0000003a | 0000003d | Core Gen12 | ADL | H0 | 06-97-05/07 | 0000003a | 0000003d | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000437 | 0000043a | Core Gen12 | ADL | R0 | 06-9a-04/80 | 00000437 | 0000043a | Core Gen12 | ADL-N | N0 | 06-be-00/19 | 0000001d | 0000001e | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | ARL-H | A1 | 06-c5-02/82 | 00000119 | 0000011a | Core Ultra Processor (Series 2) | ARL-S/HX (8P) | B0 | 06-c6-02/82 | 00000119 | 0000011a | Core Ultra Processor (Series 2) | AZB | A0/R0 | 06-9a-04/40 | 0000000a | 0000000b | Atom C1100 | EMR-SP | A1 | 06-cf-02/87 | 210002b3 | 210002c0 | Xeon Scalable Gen5 | GNR-AP/SP | Bx/Hx/Lx | 06-ad-01/95 | 010003d0 | 010003f0 | Xeon 6900-6700/6500-Series Processors with P-Cores | GNR-SP R1S | Bx/Hx/Lx | 06-ad-01/20 | 0a000100 | 0a000124 | Xeon 6700/6500-Series Processors with P-Cores | LNL | B0 | 06-bd-01/80 | 00000123 | 00000125 | Core Ultra 200 V Series Processor | RPL-E/HX/S | B0 | 06-b7-01/32 | 0000012f | 00000132 | Core Gen13/Gen14 | RPL-H/P/PX 6+8 | J0 | 06-ba-02/e0 | 00004129 | 00006133 | Core Gen13 | RPL-HX/S | C0 | 06-bf-02/07 | 0000003a | 0000003d | Core Gen13/Gen14 | RPL-S | H0 | 06-bf-05/07 | 0000003a | 0000003d | Core Gen13/Gen14 | RPL-U 2+8 | Q0 | 06-ba-03/e0 | 00004129 | 00006133 | Core Gen13 | SPR-HBM | Bx | 06-8f-08/10 | 2c000401 | 2c000410 | Xeon Max | SPR-SP | E4/S2 | 06-8f-07/87 | 2b000643 | 2b000650 | Xeon Scalable Gen4 | SPR-SP | E5/S3 | 06-8f-08/87 | 2b000643 | 2b000650 | Xeon Scalable Gen4 | SRF-AP/SP | C0 | 06-af-03/01 | 03000362 | 03000382 | Xeon 6900/6700-Series Processors with E-Cores | TWL | N0 | 06-be-00/19 | 0000001d | 0000001e | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E ------------------------------------------------------------------ ------------------ 2025-11-11 - Nov 11 2025 ------------------- ------------------------------------------------------------------ ++++ cloud-init: - Fix dependency replace -serial with -pyserial ++++ kernel-default: - Alt-commit updates - Refresh patches.suse/drm-amd-display-Fix-brightness-level-not-retained-ov.patch. - Refresh patches.suse/drm-amdkfd-Don-t-call-mmput-from-MMU-notifier-callba.patch. - Refresh patches.suse/drm-i915-dsi-Use-TRANS_DDI_FUNC_CTL-s-own-port-width.patch. - Refresh patches.suse/drm-panel-simple-Update-timings-for-AUO-G101EVN010.patch. - Refresh patches.suse/drm-sched-Add-locking-to-drm_sched_entity_modify_sch.patch. - commit 1d2b5d5 - KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (git-fixes). - commit baa92d8 - KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter (git-fixes). - commit 508e295 - btrfs: set inode flag BTRFS_INODE_COPY_EVERYTHING when logging new name (git-fixes). - commit c373962 - btrfs: simplify error handling logic for btrfs_link() (git-fixes). - commit 5e3a1fc - btrfs: fix inode leak on failure to add link to inode (git-fixes). - commit 5155c3a - btrfs: abort transaction on failure to add link to inode (git-fixes). - commit 91c4075 - btrfs: rename err to ret in btrfs_link() (git-fixes). - commit 4d5a044 - btrfs: send: fix duplicated rmdir operations when using extrefs (git-fixes). - commit 2c08529 - KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (git-fixes). - commit 78a2926 - KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (git-fixes). - commit d3c0a38 - KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (git-fixes). - commit b58dbd2 - Delete patches.kabi/KVM-x86-Snapshot-the-host-s-DEBUGCTL-in-common-x86.patch. Now that kabi/severities is amended to ignore xfer_to_guest_mode_handle_work(), drop the unneeded kABI workaround. - commit 27b5996 ++++ kernel-rt: - Alt-commit updates - Refresh patches.suse/drm-amd-display-Fix-brightness-level-not-retained-ov.patch. - Refresh patches.suse/drm-amdkfd-Don-t-call-mmput-from-MMU-notifier-callba.patch. - Refresh patches.suse/drm-i915-dsi-Use-TRANS_DDI_FUNC_CTL-s-own-port-width.patch. - Refresh patches.suse/drm-panel-simple-Update-timings-for-AUO-G101EVN010.patch. - Refresh patches.suse/drm-sched-Add-locking-to-drm_sched_entity_modify_sch.patch. - commit 1d2b5d5 - KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (git-fixes). - commit baa92d8 - KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter (git-fixes). - commit 508e295 - btrfs: set inode flag BTRFS_INODE_COPY_EVERYTHING when logging new name (git-fixes). - commit c373962 - btrfs: simplify error handling logic for btrfs_link() (git-fixes). - commit 5e3a1fc - btrfs: fix inode leak on failure to add link to inode (git-fixes). - commit 5155c3a - btrfs: abort transaction on failure to add link to inode (git-fixes). - commit 91c4075 - btrfs: rename err to ret in btrfs_link() (git-fixes). - commit 4d5a044 - btrfs: send: fix duplicated rmdir operations when using extrefs (git-fixes). - commit 2c08529 - KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (git-fixes). - commit 78a2926 - KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (git-fixes). - commit d3c0a38 - KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (git-fixes). - commit b58dbd2 - Delete patches.kabi/KVM-x86-Snapshot-the-host-s-DEBUGCTL-in-common-x86.patch. Now that kabi/severities is amended to ignore xfer_to_guest_mode_handle_work(), drop the unneeded kABI workaround. - commit 27b5996 ++++ kernel-rt_debug: - Alt-commit updates - Refresh patches.suse/drm-amd-display-Fix-brightness-level-not-retained-ov.patch. - Refresh patches.suse/drm-amdkfd-Don-t-call-mmput-from-MMU-notifier-callba.patch. - Refresh patches.suse/drm-i915-dsi-Use-TRANS_DDI_FUNC_CTL-s-own-port-width.patch. - Refresh patches.suse/drm-panel-simple-Update-timings-for-AUO-G101EVN010.patch. - Refresh patches.suse/drm-sched-Add-locking-to-drm_sched_entity_modify_sch.patch. - commit 1d2b5d5 - KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (git-fixes). - commit baa92d8 - KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter (git-fixes). - commit 508e295 - btrfs: set inode flag BTRFS_INODE_COPY_EVERYTHING when logging new name (git-fixes). - commit c373962 - btrfs: simplify error handling logic for btrfs_link() (git-fixes). - commit 5e3a1fc - btrfs: fix inode leak on failure to add link to inode (git-fixes). - commit 5155c3a - btrfs: abort transaction on failure to add link to inode (git-fixes). - commit 91c4075 - btrfs: rename err to ret in btrfs_link() (git-fixes). - commit 4d5a044 - btrfs: send: fix duplicated rmdir operations when using extrefs (git-fixes). - commit 2c08529 - KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (git-fixes). - commit 78a2926 - KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (git-fixes). - commit d3c0a38 - KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (git-fixes). - commit b58dbd2 - Delete patches.kabi/KVM-x86-Snapshot-the-host-s-DEBUGCTL-in-common-x86.patch. Now that kabi/severities is amended to ignore xfer_to_guest_mode_handle_work(), drop the unneeded kABI workaround. - commit 27b5996 ------------------------------------------------------------------ ------------------ 2025-11-10 - Nov 10 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - btrfs: mark dirty extent range for out of bound prealloc extents (git-fixes). - commit d11dc7c - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (git-fixes). - commit 0e43958 - usb/core/quirks: Add Huawei ME906S to wakeup quirk (git-fixes). - commit add9d74 - kABI fix for KVM: VMX: Apply MMIO Stale Data mitigation if KVM maps MMIO into the guest (git-fixes) (git-fixes). - commit 10ade44 - pds_core: remove write-after-free of client_id (CVE-2025-37916 bsc#1243474) - commit 40805a0 - coresight: Fix incorrect handling for return value of devm_kzalloc (CVE-2025-40059 bsc#1252809) - commit f7e7b0e - ocfs2: fix double free in user_cluster_connect() (CVE-2025-40055 bsc#1252821) - commit 9897d8a - pinctrl: check the return value of pinmux_ops::get_function_name() (CVE-2025-40030 bsc#1252773). - commit 060cddf - KVM: VMX: Apply MMIO Stale Data mitigation if KVM maps MMIO into the guest (git-fixes). - commit 0701a3a - pps: fix warning in pps_register_cdev when register device fail (CVE-2025-40070 bsc#1252836). - commit 98a58ce - KVM: x86/mmu: Locally cache whether a PFN is host MMIO when making a SPTE (git-fixes). - commit 15e0a05 - ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (CVE-2025-40098 bsc#1252917). - commit 8b9eeeb - rtc: rx8025: fix incorrect register reference (git-fixes). - drm/amd: Fix suspend failure with secure display TA (git-fixes). - drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (git-fixes). - drm/i915: Fix conversion between clock ticks and nanoseconds (git-fixes). - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (git-fixes). - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (git-fixes). - Documentation: ACPI: i2c-muxes: fix I2C device references (git-fixes). - ACPI: SBS: Fix present test in acpi_battery_read() (git-fixes). - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (git-fixes). - wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (git-fixes). - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (git-fixes). - isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (git-fixes). - Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (git-fixes). - Bluetooth: hci_event: validate skb length for unknown CC opcode (git-fixes). - wifi: zd1211rw: fix potential memory leak in __zd_usb_enable_rx() (git-fixes). - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (git-fixes). - media: uvcvideo: Use heuristic to find stream entity (git-fixes). - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (git-fixes). - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive (git-fixes). - xhci: dbc: Improve performance by removing delay in transfer event polling (stable-fixes). - xhci: dbc: Allow users to modify DbC poll interval via sysfs (stable-fixes). - xhci: dbc: poll at different rate depending on data transfer activity (stable-fixes). - commit 6309683 ++++ kernel-rt: - btrfs: mark dirty extent range for out of bound prealloc extents (git-fixes). - commit d11dc7c - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (git-fixes). - commit 0e43958 - usb/core/quirks: Add Huawei ME906S to wakeup quirk (git-fixes). - commit add9d74 - kABI fix for KVM: VMX: Apply MMIO Stale Data mitigation if KVM maps MMIO into the guest (git-fixes) (git-fixes). - commit 10ade44 - pds_core: remove write-after-free of client_id (CVE-2025-37916 bsc#1243474) - commit 40805a0 - coresight: Fix incorrect handling for return value of devm_kzalloc (CVE-2025-40059 bsc#1252809) - commit f7e7b0e - ocfs2: fix double free in user_cluster_connect() (CVE-2025-40055 bsc#1252821) - commit 9897d8a - pinctrl: check the return value of pinmux_ops::get_function_name() (CVE-2025-40030 bsc#1252773). - commit 060cddf - KVM: VMX: Apply MMIO Stale Data mitigation if KVM maps MMIO into the guest (git-fixes). - commit 0701a3a - pps: fix warning in pps_register_cdev when register device fail (CVE-2025-40070 bsc#1252836). - commit 98a58ce - KVM: x86/mmu: Locally cache whether a PFN is host MMIO when making a SPTE (git-fixes). - commit 15e0a05 - ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (CVE-2025-40098 bsc#1252917). - commit 8b9eeeb - rtc: rx8025: fix incorrect register reference (git-fixes). - drm/amd: Fix suspend failure with secure display TA (git-fixes). - drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (git-fixes). - drm/i915: Fix conversion between clock ticks and nanoseconds (git-fixes). - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (git-fixes). - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (git-fixes). - Documentation: ACPI: i2c-muxes: fix I2C device references (git-fixes). - ACPI: SBS: Fix present test in acpi_battery_read() (git-fixes). - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (git-fixes). - wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (git-fixes). - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (git-fixes). - isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (git-fixes). - Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (git-fixes). - Bluetooth: hci_event: validate skb length for unknown CC opcode (git-fixes). - wifi: zd1211rw: fix potential memory leak in __zd_usb_enable_rx() (git-fixes). - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (git-fixes). - media: uvcvideo: Use heuristic to find stream entity (git-fixes). - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (git-fixes). - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive (git-fixes). - xhci: dbc: Improve performance by removing delay in transfer event polling (stable-fixes). - xhci: dbc: Allow users to modify DbC poll interval via sysfs (stable-fixes). - xhci: dbc: poll at different rate depending on data transfer activity (stable-fixes). - commit 6309683 ++++ kernel-rt_debug: - btrfs: mark dirty extent range for out of bound prealloc extents (git-fixes). - commit d11dc7c - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (git-fixes). - commit 0e43958 - usb/core/quirks: Add Huawei ME906S to wakeup quirk (git-fixes). - commit add9d74 - kABI fix for KVM: VMX: Apply MMIO Stale Data mitigation if KVM maps MMIO into the guest (git-fixes) (git-fixes). - commit 10ade44 - pds_core: remove write-after-free of client_id (CVE-2025-37916 bsc#1243474) - commit 40805a0 - coresight: Fix incorrect handling for return value of devm_kzalloc (CVE-2025-40059 bsc#1252809) - commit f7e7b0e - ocfs2: fix double free in user_cluster_connect() (CVE-2025-40055 bsc#1252821) - commit 9897d8a - pinctrl: check the return value of pinmux_ops::get_function_name() (CVE-2025-40030 bsc#1252773). - commit 060cddf - KVM: VMX: Apply MMIO Stale Data mitigation if KVM maps MMIO into the guest (git-fixes). - commit 0701a3a - pps: fix warning in pps_register_cdev when register device fail (CVE-2025-40070 bsc#1252836). - commit 98a58ce - KVM: x86/mmu: Locally cache whether a PFN is host MMIO when making a SPTE (git-fixes). - commit 15e0a05 - ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (CVE-2025-40098 bsc#1252917). - commit 8b9eeeb - rtc: rx8025: fix incorrect register reference (git-fixes). - drm/amd: Fix suspend failure with secure display TA (git-fixes). - drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (git-fixes). - drm/i915: Fix conversion between clock ticks and nanoseconds (git-fixes). - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (git-fixes). - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (git-fixes). - Documentation: ACPI: i2c-muxes: fix I2C device references (git-fixes). - ACPI: SBS: Fix present test in acpi_battery_read() (git-fixes). - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (git-fixes). - wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (git-fixes). - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (git-fixes). - isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (git-fixes). - Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (git-fixes). - Bluetooth: hci_event: validate skb length for unknown CC opcode (git-fixes). - wifi: zd1211rw: fix potential memory leak in __zd_usb_enable_rx() (git-fixes). - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (git-fixes). - media: uvcvideo: Use heuristic to find stream entity (git-fixes). - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (git-fixes). - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive (git-fixes). - xhci: dbc: Improve performance by removing delay in transfer event polling (stable-fixes). - xhci: dbc: Allow users to modify DbC poll interval via sysfs (stable-fixes). - xhci: dbc: poll at different rate depending on data transfer activity (stable-fixes). - commit 6309683 ------------------------------------------------------------------ ------------------ 2025-11-9 - Nov 9 2025 ------------------- ------------------------------------------------------------------ ++++ containerd: - Update to containerd v1.7.29. Upstream release notes: * CVE-2024-25621 bsc#1253126 * CVE-2025-64329 bsc#1253132 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch ------------------------------------------------------------------ ------------------ 2025-11-7 - Nov 7 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - x86/CPU/AMD: Do the common init on future Zens too (git-fixes). - Refresh patches.suse/x86-CPU-AMD-Add-RDSEED-fix-for-Zen5.patch. - Refresh patches.suse/x86-CPU-AMD-Clear-virtualized-VMLOAD-VMSAVE-on-Zen4-client. - commit d7ef23e - x86/CPU/AMD: Add RDSEED fix for Zen5 (git-fixes). - commit 85fd0b8 - fs/smb: Fix inconsistent refcnt update (bsc#1250176, CVE-2025-39819). - commit 966a58e - kabi/severities: drop xfer_to_guest_mode_handle_work This is part of KVM, and it is already ignored in SL-16.0. The function only takes a pointer to a KVM struct and feeds it back to the KVM subsystem. - commit dc5bb81 - net/9p: fix double req put in p9_fd_cancelled (CVE-2025-40027 bsc#1252763). - commit bff03bd - KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (CVE-2025-40038 bsc#1252817). - commit d00fe85 - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork (bsc#1250705). - commit fd68ed6 ++++ kernel-rt: - x86/CPU/AMD: Do the common init on future Zens too (git-fixes). - Refresh patches.suse/x86-CPU-AMD-Add-RDSEED-fix-for-Zen5.patch. - Refresh patches.suse/x86-CPU-AMD-Clear-virtualized-VMLOAD-VMSAVE-on-Zen4-client. - commit d7ef23e - x86/CPU/AMD: Add RDSEED fix for Zen5 (git-fixes). - commit 85fd0b8 - fs/smb: Fix inconsistent refcnt update (bsc#1250176, CVE-2025-39819). - commit 966a58e - kabi/severities: drop xfer_to_guest_mode_handle_work This is part of KVM, and it is already ignored in SL-16.0. The function only takes a pointer to a KVM struct and feeds it back to the KVM subsystem. - commit dc5bb81 - net/9p: fix double req put in p9_fd_cancelled (CVE-2025-40027 bsc#1252763). - commit bff03bd - KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (CVE-2025-40038 bsc#1252817). - commit d00fe85 - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork (bsc#1250705). - commit fd68ed6 ++++ kernel-rt_debug: - x86/CPU/AMD: Do the common init on future Zens too (git-fixes). - Refresh patches.suse/x86-CPU-AMD-Add-RDSEED-fix-for-Zen5.patch. - Refresh patches.suse/x86-CPU-AMD-Clear-virtualized-VMLOAD-VMSAVE-on-Zen4-client. - commit d7ef23e - x86/CPU/AMD: Add RDSEED fix for Zen5 (git-fixes). - commit 85fd0b8 - fs/smb: Fix inconsistent refcnt update (bsc#1250176, CVE-2025-39819). - commit 966a58e - kabi/severities: drop xfer_to_guest_mode_handle_work This is part of KVM, and it is already ignored in SL-16.0. The function only takes a pointer to a KVM struct and feeds it back to the KVM subsystem. - commit dc5bb81 - net/9p: fix double req put in p9_fd_cancelled (CVE-2025-40027 bsc#1252763). - commit bff03bd - KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (CVE-2025-40038 bsc#1252817). - commit d00fe85 - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork (bsc#1250705). - commit fd68ed6 ++++ openssh: - Add openssh-cve-2025-61984-username-validation.patch (bsc#1251198, CVE-2025-61984). - Add openssh-cve-2025-61985-nul-url-encode.patch (bsc#1251199, CVE-2025-61985). ++++ opensuse-migration-tool: - Drop accidentally created submodule * Add opensuse-migration-tool to .gitignore ------------------------------------------------------------------ ------------------ 2025-11-6 - Nov 6 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - scsi: libfc: Prevent integer overflow in fc_fcp_recv_data() (git-fixes). - scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (git-fixes). - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (git-fixes). - scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (git-fixes). - md: fix mssing blktrace bio split events (git-fixes). - md/raid1: fix data lost for writemostly rdev (git-fixes). - scsi: core: sysfs: Correct sysfs attributes access rights (git-fixes). - block: fix kobject double initialization in add_disk (git-fixes). - block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (git-fixes). - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (git-fixes). - scsi: aacraid: Stop using PCI_IRQ_AFFINITY (git-fixes). - commit 59aa14f - nexthop: Forbid FDB status change while nexthop is in a group (CVE-2025-39980 bsc#1252063). - commit 44a7e79 - mm/ksm: fix flag-dropping behavior in ksm_madvise (CVE-2025-40040 bsc#1252780). - commit ff8401e - serial: 8250_mtk: Enable baud clock and manage in runtime PM (git-fixes). - serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (git-fixes). - PCI: j721e: Fix incorrect error message in probe() (git-fixes). - PCI: tegra194: Reset BARs when running in PCIe endpoint mode (git-fixes). - commit c2ea229 - media: atomisp: Prefix firmware paths with "intel/ipu/" (bsc#1252973). - media: atomisp: Remove firmware_name module parameter (bsc#1252973). - commit 903670f ++++ kernel-rt: - scsi: libfc: Prevent integer overflow in fc_fcp_recv_data() (git-fixes). - scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (git-fixes). - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (git-fixes). - scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (git-fixes). - md: fix mssing blktrace bio split events (git-fixes). - md/raid1: fix data lost for writemostly rdev (git-fixes). - scsi: core: sysfs: Correct sysfs attributes access rights (git-fixes). - block: fix kobject double initialization in add_disk (git-fixes). - block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (git-fixes). - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (git-fixes). - scsi: aacraid: Stop using PCI_IRQ_AFFINITY (git-fixes). - commit 59aa14f - nexthop: Forbid FDB status change while nexthop is in a group (CVE-2025-39980 bsc#1252063). - commit 44a7e79 - mm/ksm: fix flag-dropping behavior in ksm_madvise (CVE-2025-40040 bsc#1252780). - commit ff8401e - serial: 8250_mtk: Enable baud clock and manage in runtime PM (git-fixes). - serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (git-fixes). - PCI: j721e: Fix incorrect error message in probe() (git-fixes). - PCI: tegra194: Reset BARs when running in PCIe endpoint mode (git-fixes). - commit c2ea229 - media: atomisp: Prefix firmware paths with "intel/ipu/" (bsc#1252973). - media: atomisp: Remove firmware_name module parameter (bsc#1252973). - commit 903670f ++++ kernel-rt_debug: - scsi: libfc: Prevent integer overflow in fc_fcp_recv_data() (git-fixes). - scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (git-fixes). - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (git-fixes). - scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (git-fixes). - md: fix mssing blktrace bio split events (git-fixes). - md/raid1: fix data lost for writemostly rdev (git-fixes). - scsi: core: sysfs: Correct sysfs attributes access rights (git-fixes). - block: fix kobject double initialization in add_disk (git-fixes). - block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (git-fixes). - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (git-fixes). - scsi: aacraid: Stop using PCI_IRQ_AFFINITY (git-fixes). - commit 59aa14f - nexthop: Forbid FDB status change while nexthop is in a group (CVE-2025-39980 bsc#1252063). - commit 44a7e79 - mm/ksm: fix flag-dropping behavior in ksm_madvise (CVE-2025-40040 bsc#1252780). - commit ff8401e - serial: 8250_mtk: Enable baud clock and manage in runtime PM (git-fixes). - serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (git-fixes). - PCI: j721e: Fix incorrect error message in probe() (git-fixes). - PCI: tegra194: Reset BARs when running in PCIe endpoint mode (git-fixes). - commit c2ea229 - media: atomisp: Prefix firmware paths with "intel/ipu/" (bsc#1252973). - media: atomisp: Remove firmware_name module parameter (bsc#1252973). - commit 903670f ------------------------------------------------------------------ ------------------ 2025-11-5 - Nov 5 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - selftests/bpf: Fix string read in strncmp benchmark (git-fixes). - commit 0165696 - selftests/bpf: Mitigate sockmap_ktls disconnect_after_delete failure (git-fixes). - commit 2116607 - selftests/bpf: fix signedness bug in redir_partial() (git-fixes). - commit b261c17 - nbd: restrict sockets to TCP and UDP (bsc#1252774 CVE-2025-40080). - commit a7c3e39 - KVM: SVM: Delete IRTE link from previous vCPU irrespective of new routing (git-fixes). - commit 6f9b1c9 - KVM: SVM: Delete IRTE link from previous vCPU before setting new IRTE (git-fixes). - commit b83e48d - KVM: SVM: WARN if an invalid posted interrupt IRTE entry is added (git-fixes). - commit 2982d0e - iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE (git-fixes). - commit 5cc1fcc - KVM: SVM: Track per-vCPU IRTEs using kvm_kernel_irqfd structure (git-fixes). - commit 9e70f85 - KVM: Pass new routing entries and irqfd when updating IRTEs (git-fixes). - commit 2630cbd - Refresh patches.suse/Revert-KVM-VMX-Move-LOAD_IA32_PERF_GLOBAL_CTRL-errat.patch. Fix whitespace (patch was using spaces). - commit 04dc661 - kernel-subpackage-spec: Do not doubly-sign modules (bsc#1251930). - commit 0f034b6 - RDMA/bnxt_re: Don't fail destroy QP and cleanup debugfs earlier (git-fixes) - commit c7164d9 - RDMA/hns: Fix wrong WQE data when QP wraps around (git-fixes) - commit ff60916 - RDMA/hns: Fix the modification of max_send_sge (git-fixes) - commit e73e586 - RDMA/hns: Fix recv CQ and QP cache affinity (git-fixes) - commit 80efef8 - RDMA/irdma: Set irdma_cq cq_num field during CQ create (git-fixes) - commit 8445b54 - RDMA/irdma: Fix SD index calculation (git-fixes) - commit 05d9bdd - RDMA/bnxt_re: Fix a potential memory leak in destroy_gsi_sqp (git-fixes) - commit 3c9a931 ++++ kernel-rt: - selftests/bpf: Fix string read in strncmp benchmark (git-fixes). - commit 0165696 - selftests/bpf: Mitigate sockmap_ktls disconnect_after_delete failure (git-fixes). - commit 2116607 - selftests/bpf: fix signedness bug in redir_partial() (git-fixes). - commit b261c17 - nbd: restrict sockets to TCP and UDP (bsc#1252774 CVE-2025-40080). - commit a7c3e39 - KVM: SVM: Delete IRTE link from previous vCPU irrespective of new routing (git-fixes). - commit 6f9b1c9 - KVM: SVM: Delete IRTE link from previous vCPU before setting new IRTE (git-fixes). - commit b83e48d - KVM: SVM: WARN if an invalid posted interrupt IRTE entry is added (git-fixes). - commit 2982d0e - iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE (git-fixes). - commit 5cc1fcc - KVM: SVM: Track per-vCPU IRTEs using kvm_kernel_irqfd structure (git-fixes). - commit 9e70f85 - KVM: Pass new routing entries and irqfd when updating IRTEs (git-fixes). - commit 2630cbd - Refresh patches.suse/Revert-KVM-VMX-Move-LOAD_IA32_PERF_GLOBAL_CTRL-errat.patch. Fix whitespace (patch was using spaces). - commit 04dc661 - kernel-subpackage-spec: Do not doubly-sign modules (bsc#1251930). - commit 0f034b6 - RDMA/bnxt_re: Don't fail destroy QP and cleanup debugfs earlier (git-fixes) - commit c7164d9 - RDMA/hns: Fix wrong WQE data when QP wraps around (git-fixes) - commit ff60916 - RDMA/hns: Fix the modification of max_send_sge (git-fixes) - commit e73e586 - RDMA/hns: Fix recv CQ and QP cache affinity (git-fixes) - commit 80efef8 - RDMA/irdma: Set irdma_cq cq_num field during CQ create (git-fixes) - commit 8445b54 - RDMA/irdma: Fix SD index calculation (git-fixes) - commit 05d9bdd - RDMA/bnxt_re: Fix a potential memory leak in destroy_gsi_sqp (git-fixes) - commit 3c9a931 ++++ kernel-rt_debug: - selftests/bpf: Fix string read in strncmp benchmark (git-fixes). - commit 0165696 - selftests/bpf: Mitigate sockmap_ktls disconnect_after_delete failure (git-fixes). - commit 2116607 - selftests/bpf: fix signedness bug in redir_partial() (git-fixes). - commit b261c17 - nbd: restrict sockets to TCP and UDP (bsc#1252774 CVE-2025-40080). - commit a7c3e39 - KVM: SVM: Delete IRTE link from previous vCPU irrespective of new routing (git-fixes). - commit 6f9b1c9 - KVM: SVM: Delete IRTE link from previous vCPU before setting new IRTE (git-fixes). - commit b83e48d - KVM: SVM: WARN if an invalid posted interrupt IRTE entry is added (git-fixes). - commit 2982d0e - iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE (git-fixes). - commit 5cc1fcc - KVM: SVM: Track per-vCPU IRTEs using kvm_kernel_irqfd structure (git-fixes). - commit 9e70f85 - KVM: Pass new routing entries and irqfd when updating IRTEs (git-fixes). - commit 2630cbd - Refresh patches.suse/Revert-KVM-VMX-Move-LOAD_IA32_PERF_GLOBAL_CTRL-errat.patch. Fix whitespace (patch was using spaces). - commit 04dc661 - kernel-subpackage-spec: Do not doubly-sign modules (bsc#1251930). - commit 0f034b6 - RDMA/bnxt_re: Don't fail destroy QP and cleanup debugfs earlier (git-fixes) - commit c7164d9 - RDMA/hns: Fix wrong WQE data when QP wraps around (git-fixes) - commit ff60916 - RDMA/hns: Fix the modification of max_send_sge (git-fixes) - commit e73e586 - RDMA/hns: Fix recv CQ and QP cache affinity (git-fixes) - commit 80efef8 - RDMA/irdma: Set irdma_cq cq_num field during CQ create (git-fixes) - commit 8445b54 - RDMA/irdma: Fix SD index calculation (git-fixes) - commit 05d9bdd - RDMA/bnxt_re: Fix a potential memory leak in destroy_gsi_sqp (git-fixes) - commit 3c9a931 ++++ runc: - Update to runc v1.3.3. Upstream changelog is available from . bsc#1252232 * CVE-2025-31133 * CVE-2025-52565 * CVE-2025-52881 - Remove upstreamed patches for bsc#1252232: - 2025-11-05-CVEs.patch ------------------------------------------------------------------ ------------------ 2025-11-4 - Nov 4 2025 ------------------- ------------------------------------------------------------------ ++++ dracut: - Update to version 059+suse.641.g906a3d31: * fix(kernel-modules-extra): remove stray \ before / (bsc#1253029) ++++ kernel-default: - Delete patches.kabi/KVM-x86-pmu-Allow-programming-events-that-match-unsu.patch. This avoids a kbuild error in check-patchrv. This patch is not needed anyway since 4f5efb71e1f4. - commit 624b1b2 - vhost: vringh: Modify the return value check (CVE-2025-40051 bsc#1252858). - commit 80d9f20 - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (git-fixes). - commit 91a9728 ++++ kernel-rt: - Delete patches.kabi/KVM-x86-pmu-Allow-programming-events-that-match-unsu.patch. This avoids a kbuild error in check-patchrv. This patch is not needed anyway since 4f5efb71e1f4. - commit 624b1b2 - vhost: vringh: Modify the return value check (CVE-2025-40051 bsc#1252858). - commit 80d9f20 - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (git-fixes). - commit 91a9728 ++++ kernel-rt_debug: - Delete patches.kabi/KVM-x86-pmu-Allow-programming-events-that-match-unsu.patch. This avoids a kbuild error in check-patchrv. This patch is not needed anyway since 4f5efb71e1f4. - commit 624b1b2 - vhost: vringh: Modify the return value check (CVE-2025-40051 bsc#1252858). - commit 80d9f20 - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (git-fixes). - commit 91a9728 ++++ nvidia-open-driver-G06-signed: - back to 580.95.05 on aarch64, since userspace drivers have not been updated for this platform ------------------------------------------------------------------ ------------------ 2025-11-3 - Nov 3 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - KVM: x86: Introduce kvm_x86_call() to simplify static calls of kvm_x86_ops (git-fixes). - Refresh patches.suse/KVM-x86-Don-t-inject-PV-async-PF-if-SEND_ALWAYS-0-an.patch. - Refresh patches.suse/KVM-x86-Exit-to-userspace-if-fastpath-triggers-one-o.patch. - Refresh patches.suse/KVM-x86-Introduce-kvm_set_mp_state.patch. - Refresh patches.suse/KVM-x86-Route-non-canonical-checks-in-emulator-throu.patch. - Refresh patches.suse/KVM-x86-model-canonical-checks-more-precisely.patch. - commit 3454959 - KVM: x86: Replace static_call_cond() with static_call() (git-fixes). - commit 6bb685c - Update patches.suse/ACPI-x86-s2idle-Catch-multiple-ACPI_TYPE_PACKAGE-obj.patch (git-fixes CVE-2023-53708 bsc#1252537). - Update patches.suse/ALSA-usb-audio-Fix-NULL-pointer-deference-in-try_to_.patch (git-fixes CVE-2025-40085 bsc#1252873). - Update patches.suse/ALSA-usb-audio-fix-race-condition-to-UAF-in-snd_usbm.patch (git-fixes CVE-2025-39997 bsc#1252056). - Update patches.suse/ASoC-qcom-audioreach-fix-potential-null-pointer-dere.patch (git-fixes CVE-2025-40013 bsc#1252348). - Update patches.suse/Bluetooth-MGMT-Fix-possible-UAFs.patch (git-fixes CVE-2025-39981 bsc#1252060). - Update patches.suse/Bluetooth-hci_event-Fix-UAF-in-hci_acl_create_conn_s.patch (git-fixes CVE-2025-39982 bsc#1252083). - Update patches.suse/HID-amd_sfh-Fix-for-shift-out-of-bounds.patch (bsc#1012628 CVE-2023-53703 bsc#1252553). - Update patches.suse/Input-uinput-zero-initialize-uinput_ff_upload_compat.patch (git-fixes CVE-2025-40035 bsc#1252866). - Update patches.suse/NFS-Fix-a-potential-data-corruption.patch (git-fixes CVE-2023-53711 bsc#1252536). - Update patches.suse/NFSD-Define-a-proc_layoutcommit-for-the-FlexFiles-layout-type.patch (git-fixes CVE-2025-40087 bsc#1252909). - Update patches.suse/PCI-endpoint-pci-epf-test-Add-NULL-check-for-DMA-cha.patch (git-fixes CVE-2025-40032 bsc#1252841). - Update patches.suse/RDMA-rxe-Fix-race-in-do_task-when-draining.patch (git-fixes CVE-2025-40061 bsc#1252849). - Update patches.suse/Squashfs-fix-uninit-value-in-squashfs_get_parent.patch (git-fixes CVE-2025-40049 bsc#1252822). - Update patches.suse/USB-gadget-Fix-the-memory-leak-in-raw_gadget-dr.patch (bsc#1012628 CVE-2023-53693 bsc#1252489). - Update patches.suse/afs-Fix-potential-null-pointer-dereference-in-afs_put_server.patch (git-fixes CVE-2025-40010 bsc#1252332). - Update patches.suse/arm64-csum-Fix-OoB-access-in-IP-checksum-code-for-ne.patch (git-fixes CVE-2023-53726 bsc#1252565). - Update patches.suse/arm64-sme-Use-STR-P-to-clear-FFR-context-field-.patch (bsc#1012628 CVE-2023-53713 bsc#1252559). - Update patches.suse/blk-iocost-use-spin_lock_irqsave-in-adjust_inus.patch (bsc#1012628 CVE-2023-53730 bsc#1252495). - Update patches.suse/bus-fsl-mc-Check-return-value-of-platform_get_resour.patch (git-fixes CVE-2025-40029 bsc#1252772). - Update patches.suse/can-etas_es58x-populate-ndo_change_mtu-to-prevent-bu.patch (git-fixes CVE-2025-39988 bsc#1252074). - Update patches.suse/can-hi311x-populate-ndo_change_mtu-to-prevent-buffer.patch (git-fixes CVE-2025-39987 bsc#1252079). - Update patches.suse/can-mcba_usb-populate-ndo_change_mtu-to-prevent-buff.patch (git-fixes CVE-2025-39985 bsc#1252082). - Update patches.suse/can-peak_usb-fix-shift-out-of-bounds-issue.patch (git-fixes CVE-2025-40020 bsc#1252679). - Update patches.suse/can-sun4i_can-populate-ndo_change_mtu-to-prevent-buf.patch (git-fixes CVE-2025-39986 bsc#1252078). - Update patches.suse/clk-imx-clk-imx8mp-improve-error-handling-in-im.patch (bsc#1012628 CVE-2023-53704 bsc#1252490). - Update patches.suse/clocksource-drivers-cadence-ttc-Fix-memory-leak.patch (bsc#1012628 CVE-2023-53725 bsc#1252492). - Update patches.suse/crypto-essiv-Check-ssize-for-decryption-and-in-place.patch (git-fixes CVE-2025-40019 bsc#1252678). - Update patches.suse/crypto-hisilicon-qm-set-NULL-to-qm-debug.qm_diff_reg.patch (git-fixes CVE-2025-40062 bsc#1252850). - Update patches.suse/drm-amdgpu-Fix-integer-overflow-in-amdgpu_cs_p.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-53707 bsc#1252632). - Update patches.suse/drm-gma500-Fix-null-dereference-in-hdmi-teardown.patch (git-fixes CVE-2025-40011 bsc#1252336). - Update patches.suse/drm-sched-Fix-potential-double-free-in-drm_sched_job.patch (git-fixes CVE-2025-40096 bsc#1252902). - Update patches.suse/fbcon-fix-integer-overflow-in-fbcon_do_set_font.patch (git-fixes CVE-2025-39967 bsc#1252033). - Update patches.suse/fs-udf-fix-OOB-read-in-lengthAllocDescs-handling.patch (git-fixes CVE-2025-40044 bsc#1252785). - Update patches.suse/hfsplus-fix-slab-out-of-bounds-read-in-hfsplus_strcasecmp.patch (git-fixes CVE-2025-40088 bsc#1252904). - Update patches.suse/hfsplus-fix-slab-out-of-bounds-read-in-hfsplus_uni2asc_followup.patch (git-fixes CVE-2025-40082 bsc#1252775). - Update patches.suse/iommu-vt-d-Disallow-dirty-tracking-if-incoherent-pag.patch (git-fixes CVE-2025-40058 bsc#1252854). - Update patches.suse/md-raid1-fix-potential-OOB-in-raid1_remove_disk-8b04.patch (jsc#PED-7542 CVE-2023-53722 bsc#1252499). - Update patches.suse/media-b2c2-Fix-use-after-free-causing-by-irq_check_w.patch (git-fixes CVE-2025-39996 bsc#1252065). - Update patches.suse/media-i2c-tc358743-Fix-use-after-free-bugs-caused-by.patch (git-fixes CVE-2025-39995 bsc#1252064). - Update patches.suse/media-rc-fix-races-with-imon_disconnect.patch (git-fixes CVE-2025-39993 bsc#1252070). - Update patches.suse/media-tuner-xc5000-Fix-use-after-free-in-xc5000_rele.patch (git-fixes CVE-2025-39994 bsc#1252072). - Update patches.suse/media-uvcvideo-Mark-invalid-entities-with-id-UVC_INV.patch (git-fixes CVE-2025-40016 bsc#1252346). - Update patches.suse/misc-fastrpc-fix-possible-map-leak-in-fastrpc_put_ar.patch (git-fixes CVE-2025-40036 bsc#1252865). - Update patches.suse/net-nfc-nci-Add-parameter-validation-for-packet-data.patch (git-fixes CVE-2025-40043 bsc#1252787). - Update patches.suse/net-sched-cls_u32-Undo-tcf_bind_filter-if-u32_r.patch (bsc#1012628 CVE-2023-53733 bsc#1252685). - Update patches.suse/net-sched-fq_pie-avoid-stalls-in-fq_pie_timer.patch (bsc#1220419 CVE-2023-53727 bsc#1252566). - Update patches.suse/netlink-fix-potential-deadlock-in-netlink_set_e.patch (bsc#1012628 CVE-2023-53731 bsc#1252481). - Update patches.suse/nvdimm-Fix-memleak-of-pmu-attr_groups-in-unregister_-85ae.patch (jsc#PED-5853 CVE-2023-53697 bsc#1252534). - Update patches.suse/posix-timers-Ensure-timer-ID-search-loop-limit-.patch (bsc#1012628 CVE-2023-53728 bsc#1252668). - Update patches.suse/ring-buffer-Do-not-swap-cpu_buffer-during-resi.patch (bsc#1012628 CVE-2023-53718 bsc#1252564). - Update patches.suse/riscv-move-memblock_allow_resize-after-linear-m.patch (bsc#1012628 CVE-2023-53699 bsc#1252550). - Update patches.suse/smb-client-fix-crypto-buffers-in-non-linear-memory.patch (bsc#1250491 boo#1239206 CVE-2025-40052 bsc#1252851). - Update patches.suse/soc-qcom-qmi_encdec-Restrict-string-length-in-decode.patch (git-fixes CVE-2023-53729 bsc#1252496). - Update patches.suse/tty-n_gsm-Don-t-block-input-queue-by-waiting-MSC.patch (git-fixes CVE-2025-40071 bsc#1252797). - Update patches.suse/wifi-ath11k-fix-NULL-dereference-in-ath11k_qmi_m3_lo.patch (git-fixes CVE-2025-39991 bsc#1252075). - Update patches.suse/wifi-ath12k-Fix-a-NULL-pointer-dereference-in-ath12k.patch (git-fixes CVE-2023-53721 bsc#1252561). - Update patches.suse/xfrm-xfrm_alloc_spi-shouldn-t-use-0-as-SPI.patch (CVE-2025-39797 bsc#1249608 CVE-2025-39965 bsc#1251967). - Update patches.suse/xsk-fix-refcount-underflow-in-error-path.patch (bsc#1012628 CVE-2023-53698 bsc#1252479). - commit 9042362 - coresight: trbe: Return NULL pointer for allocation failures (CVE-2025-40060 bsc#1252848). - commit 4543e34 ++++ kernel-rt: - KVM: x86: Introduce kvm_x86_call() to simplify static calls of kvm_x86_ops (git-fixes). - Refresh patches.suse/KVM-x86-Don-t-inject-PV-async-PF-if-SEND_ALWAYS-0-an.patch. - Refresh patches.suse/KVM-x86-Exit-to-userspace-if-fastpath-triggers-one-o.patch. - Refresh patches.suse/KVM-x86-Introduce-kvm_set_mp_state.patch. - Refresh patches.suse/KVM-x86-Route-non-canonical-checks-in-emulator-throu.patch. - Refresh patches.suse/KVM-x86-model-canonical-checks-more-precisely.patch. - commit 3454959 - KVM: x86: Replace static_call_cond() with static_call() (git-fixes). - commit 6bb685c - Update patches.suse/ACPI-x86-s2idle-Catch-multiple-ACPI_TYPE_PACKAGE-obj.patch (git-fixes CVE-2023-53708 bsc#1252537). - Update patches.suse/ALSA-usb-audio-Fix-NULL-pointer-deference-in-try_to_.patch (git-fixes CVE-2025-40085 bsc#1252873). - Update patches.suse/ALSA-usb-audio-fix-race-condition-to-UAF-in-snd_usbm.patch (git-fixes CVE-2025-39997 bsc#1252056). - Update patches.suse/ASoC-qcom-audioreach-fix-potential-null-pointer-dere.patch (git-fixes CVE-2025-40013 bsc#1252348). - Update patches.suse/Bluetooth-MGMT-Fix-possible-UAFs.patch (git-fixes CVE-2025-39981 bsc#1252060). - Update patches.suse/Bluetooth-hci_event-Fix-UAF-in-hci_acl_create_conn_s.patch (git-fixes CVE-2025-39982 bsc#1252083). - Update patches.suse/HID-amd_sfh-Fix-for-shift-out-of-bounds.patch (bsc#1012628 CVE-2023-53703 bsc#1252553). - Update patches.suse/Input-uinput-zero-initialize-uinput_ff_upload_compat.patch (git-fixes CVE-2025-40035 bsc#1252866). - Update patches.suse/NFS-Fix-a-potential-data-corruption.patch (git-fixes CVE-2023-53711 bsc#1252536). - Update patches.suse/NFSD-Define-a-proc_layoutcommit-for-the-FlexFiles-layout-type.patch (git-fixes CVE-2025-40087 bsc#1252909). - Update patches.suse/PCI-endpoint-pci-epf-test-Add-NULL-check-for-DMA-cha.patch (git-fixes CVE-2025-40032 bsc#1252841). - Update patches.suse/RDMA-rxe-Fix-race-in-do_task-when-draining.patch (git-fixes CVE-2025-40061 bsc#1252849). - Update patches.suse/Squashfs-fix-uninit-value-in-squashfs_get_parent.patch (git-fixes CVE-2025-40049 bsc#1252822). - Update patches.suse/USB-gadget-Fix-the-memory-leak-in-raw_gadget-dr.patch (bsc#1012628 CVE-2023-53693 bsc#1252489). - Update patches.suse/afs-Fix-potential-null-pointer-dereference-in-afs_put_server.patch (git-fixes CVE-2025-40010 bsc#1252332). - Update patches.suse/arm64-csum-Fix-OoB-access-in-IP-checksum-code-for-ne.patch (git-fixes CVE-2023-53726 bsc#1252565). - Update patches.suse/arm64-sme-Use-STR-P-to-clear-FFR-context-field-.patch (bsc#1012628 CVE-2023-53713 bsc#1252559). - Update patches.suse/blk-iocost-use-spin_lock_irqsave-in-adjust_inus.patch (bsc#1012628 CVE-2023-53730 bsc#1252495). - Update patches.suse/bus-fsl-mc-Check-return-value-of-platform_get_resour.patch (git-fixes CVE-2025-40029 bsc#1252772). - Update patches.suse/can-etas_es58x-populate-ndo_change_mtu-to-prevent-bu.patch (git-fixes CVE-2025-39988 bsc#1252074). - Update patches.suse/can-hi311x-populate-ndo_change_mtu-to-prevent-buffer.patch (git-fixes CVE-2025-39987 bsc#1252079). - Update patches.suse/can-mcba_usb-populate-ndo_change_mtu-to-prevent-buff.patch (git-fixes CVE-2025-39985 bsc#1252082). - Update patches.suse/can-peak_usb-fix-shift-out-of-bounds-issue.patch (git-fixes CVE-2025-40020 bsc#1252679). - Update patches.suse/can-sun4i_can-populate-ndo_change_mtu-to-prevent-buf.patch (git-fixes CVE-2025-39986 bsc#1252078). - Update patches.suse/clk-imx-clk-imx8mp-improve-error-handling-in-im.patch (bsc#1012628 CVE-2023-53704 bsc#1252490). - Update patches.suse/clocksource-drivers-cadence-ttc-Fix-memory-leak.patch (bsc#1012628 CVE-2023-53725 bsc#1252492). - Update patches.suse/crypto-essiv-Check-ssize-for-decryption-and-in-place.patch (git-fixes CVE-2025-40019 bsc#1252678). - Update patches.suse/crypto-hisilicon-qm-set-NULL-to-qm-debug.qm_diff_reg.patch (git-fixes CVE-2025-40062 bsc#1252850). - Update patches.suse/drm-amdgpu-Fix-integer-overflow-in-amdgpu_cs_p.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-53707 bsc#1252632). - Update patches.suse/drm-gma500-Fix-null-dereference-in-hdmi-teardown.patch (git-fixes CVE-2025-40011 bsc#1252336). - Update patches.suse/drm-sched-Fix-potential-double-free-in-drm_sched_job.patch (git-fixes CVE-2025-40096 bsc#1252902). - Update patches.suse/fbcon-fix-integer-overflow-in-fbcon_do_set_font.patch (git-fixes CVE-2025-39967 bsc#1252033). - Update patches.suse/fs-udf-fix-OOB-read-in-lengthAllocDescs-handling.patch (git-fixes CVE-2025-40044 bsc#1252785). - Update patches.suse/hfsplus-fix-slab-out-of-bounds-read-in-hfsplus_strcasecmp.patch (git-fixes CVE-2025-40088 bsc#1252904). - Update patches.suse/hfsplus-fix-slab-out-of-bounds-read-in-hfsplus_uni2asc_followup.patch (git-fixes CVE-2025-40082 bsc#1252775). - Update patches.suse/iommu-vt-d-Disallow-dirty-tracking-if-incoherent-pag.patch (git-fixes CVE-2025-40058 bsc#1252854). - Update patches.suse/md-raid1-fix-potential-OOB-in-raid1_remove_disk-8b04.patch (jsc#PED-7542 CVE-2023-53722 bsc#1252499). - Update patches.suse/media-b2c2-Fix-use-after-free-causing-by-irq_check_w.patch (git-fixes CVE-2025-39996 bsc#1252065). - Update patches.suse/media-i2c-tc358743-Fix-use-after-free-bugs-caused-by.patch (git-fixes CVE-2025-39995 bsc#1252064). - Update patches.suse/media-rc-fix-races-with-imon_disconnect.patch (git-fixes CVE-2025-39993 bsc#1252070). - Update patches.suse/media-tuner-xc5000-Fix-use-after-free-in-xc5000_rele.patch (git-fixes CVE-2025-39994 bsc#1252072). - Update patches.suse/media-uvcvideo-Mark-invalid-entities-with-id-UVC_INV.patch (git-fixes CVE-2025-40016 bsc#1252346). - Update patches.suse/misc-fastrpc-fix-possible-map-leak-in-fastrpc_put_ar.patch (git-fixes CVE-2025-40036 bsc#1252865). - Update patches.suse/net-nfc-nci-Add-parameter-validation-for-packet-data.patch (git-fixes CVE-2025-40043 bsc#1252787). - Update patches.suse/net-sched-cls_u32-Undo-tcf_bind_filter-if-u32_r.patch (bsc#1012628 CVE-2023-53733 bsc#1252685). - Update patches.suse/net-sched-fq_pie-avoid-stalls-in-fq_pie_timer.patch (bsc#1220419 CVE-2023-53727 bsc#1252566). - Update patches.suse/netlink-fix-potential-deadlock-in-netlink_set_e.patch (bsc#1012628 CVE-2023-53731 bsc#1252481). - Update patches.suse/nvdimm-Fix-memleak-of-pmu-attr_groups-in-unregister_-85ae.patch (jsc#PED-5853 CVE-2023-53697 bsc#1252534). - Update patches.suse/posix-timers-Ensure-timer-ID-search-loop-limit-.patch (bsc#1012628 CVE-2023-53728 bsc#1252668). - Update patches.suse/ring-buffer-Do-not-swap-cpu_buffer-during-resi.patch (bsc#1012628 CVE-2023-53718 bsc#1252564). - Update patches.suse/riscv-move-memblock_allow_resize-after-linear-m.patch (bsc#1012628 CVE-2023-53699 bsc#1252550). - Update patches.suse/smb-client-fix-crypto-buffers-in-non-linear-memory.patch (bsc#1250491 boo#1239206 CVE-2025-40052 bsc#1252851). - Update patches.suse/soc-qcom-qmi_encdec-Restrict-string-length-in-decode.patch (git-fixes CVE-2023-53729 bsc#1252496). - Update patches.suse/tty-n_gsm-Don-t-block-input-queue-by-waiting-MSC.patch (git-fixes CVE-2025-40071 bsc#1252797). - Update patches.suse/wifi-ath11k-fix-NULL-dereference-in-ath11k_qmi_m3_lo.patch (git-fixes CVE-2025-39991 bsc#1252075). - Update patches.suse/wifi-ath12k-Fix-a-NULL-pointer-dereference-in-ath12k.patch (git-fixes CVE-2023-53721 bsc#1252561). - Update patches.suse/xfrm-xfrm_alloc_spi-shouldn-t-use-0-as-SPI.patch (CVE-2025-39797 bsc#1249608 CVE-2025-39965 bsc#1251967). - Update patches.suse/xsk-fix-refcount-underflow-in-error-path.patch (bsc#1012628 CVE-2023-53698 bsc#1252479). - commit 9042362 - coresight: trbe: Return NULL pointer for allocation failures (CVE-2025-40060 bsc#1252848). - commit 4543e34 ++++ kernel-rt_debug: - KVM: x86: Introduce kvm_x86_call() to simplify static calls of kvm_x86_ops (git-fixes). - Refresh patches.suse/KVM-x86-Don-t-inject-PV-async-PF-if-SEND_ALWAYS-0-an.patch. - Refresh patches.suse/KVM-x86-Exit-to-userspace-if-fastpath-triggers-one-o.patch. - Refresh patches.suse/KVM-x86-Introduce-kvm_set_mp_state.patch. - Refresh patches.suse/KVM-x86-Route-non-canonical-checks-in-emulator-throu.patch. - Refresh patches.suse/KVM-x86-model-canonical-checks-more-precisely.patch. - commit 3454959 - KVM: x86: Replace static_call_cond() with static_call() (git-fixes). - commit 6bb685c - Update patches.suse/ACPI-x86-s2idle-Catch-multiple-ACPI_TYPE_PACKAGE-obj.patch (git-fixes CVE-2023-53708 bsc#1252537). - Update patches.suse/ALSA-usb-audio-Fix-NULL-pointer-deference-in-try_to_.patch (git-fixes CVE-2025-40085 bsc#1252873). - Update patches.suse/ALSA-usb-audio-fix-race-condition-to-UAF-in-snd_usbm.patch (git-fixes CVE-2025-39997 bsc#1252056). - Update patches.suse/ASoC-qcom-audioreach-fix-potential-null-pointer-dere.patch (git-fixes CVE-2025-40013 bsc#1252348). - Update patches.suse/Bluetooth-MGMT-Fix-possible-UAFs.patch (git-fixes CVE-2025-39981 bsc#1252060). - Update patches.suse/Bluetooth-hci_event-Fix-UAF-in-hci_acl_create_conn_s.patch (git-fixes CVE-2025-39982 bsc#1252083). - Update patches.suse/HID-amd_sfh-Fix-for-shift-out-of-bounds.patch (bsc#1012628 CVE-2023-53703 bsc#1252553). - Update patches.suse/Input-uinput-zero-initialize-uinput_ff_upload_compat.patch (git-fixes CVE-2025-40035 bsc#1252866). - Update patches.suse/NFS-Fix-a-potential-data-corruption.patch (git-fixes CVE-2023-53711 bsc#1252536). - Update patches.suse/NFSD-Define-a-proc_layoutcommit-for-the-FlexFiles-layout-type.patch (git-fixes CVE-2025-40087 bsc#1252909). - Update patches.suse/PCI-endpoint-pci-epf-test-Add-NULL-check-for-DMA-cha.patch (git-fixes CVE-2025-40032 bsc#1252841). - Update patches.suse/RDMA-rxe-Fix-race-in-do_task-when-draining.patch (git-fixes CVE-2025-40061 bsc#1252849). - Update patches.suse/Squashfs-fix-uninit-value-in-squashfs_get_parent.patch (git-fixes CVE-2025-40049 bsc#1252822). - Update patches.suse/USB-gadget-Fix-the-memory-leak-in-raw_gadget-dr.patch (bsc#1012628 CVE-2023-53693 bsc#1252489). - Update patches.suse/afs-Fix-potential-null-pointer-dereference-in-afs_put_server.patch (git-fixes CVE-2025-40010 bsc#1252332). - Update patches.suse/arm64-csum-Fix-OoB-access-in-IP-checksum-code-for-ne.patch (git-fixes CVE-2023-53726 bsc#1252565). - Update patches.suse/arm64-sme-Use-STR-P-to-clear-FFR-context-field-.patch (bsc#1012628 CVE-2023-53713 bsc#1252559). - Update patches.suse/blk-iocost-use-spin_lock_irqsave-in-adjust_inus.patch (bsc#1012628 CVE-2023-53730 bsc#1252495). - Update patches.suse/bus-fsl-mc-Check-return-value-of-platform_get_resour.patch (git-fixes CVE-2025-40029 bsc#1252772). - Update patches.suse/can-etas_es58x-populate-ndo_change_mtu-to-prevent-bu.patch (git-fixes CVE-2025-39988 bsc#1252074). - Update patches.suse/can-hi311x-populate-ndo_change_mtu-to-prevent-buffer.patch (git-fixes CVE-2025-39987 bsc#1252079). - Update patches.suse/can-mcba_usb-populate-ndo_change_mtu-to-prevent-buff.patch (git-fixes CVE-2025-39985 bsc#1252082). - Update patches.suse/can-peak_usb-fix-shift-out-of-bounds-issue.patch (git-fixes CVE-2025-40020 bsc#1252679). - Update patches.suse/can-sun4i_can-populate-ndo_change_mtu-to-prevent-buf.patch (git-fixes CVE-2025-39986 bsc#1252078). - Update patches.suse/clk-imx-clk-imx8mp-improve-error-handling-in-im.patch (bsc#1012628 CVE-2023-53704 bsc#1252490). - Update patches.suse/clocksource-drivers-cadence-ttc-Fix-memory-leak.patch (bsc#1012628 CVE-2023-53725 bsc#1252492). - Update patches.suse/crypto-essiv-Check-ssize-for-decryption-and-in-place.patch (git-fixes CVE-2025-40019 bsc#1252678). - Update patches.suse/crypto-hisilicon-qm-set-NULL-to-qm-debug.qm_diff_reg.patch (git-fixes CVE-2025-40062 bsc#1252850). - Update patches.suse/drm-amdgpu-Fix-integer-overflow-in-amdgpu_cs_p.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-53707 bsc#1252632). - Update patches.suse/drm-gma500-Fix-null-dereference-in-hdmi-teardown.patch (git-fixes CVE-2025-40011 bsc#1252336). - Update patches.suse/drm-sched-Fix-potential-double-free-in-drm_sched_job.patch (git-fixes CVE-2025-40096 bsc#1252902). - Update patches.suse/fbcon-fix-integer-overflow-in-fbcon_do_set_font.patch (git-fixes CVE-2025-39967 bsc#1252033). - Update patches.suse/fs-udf-fix-OOB-read-in-lengthAllocDescs-handling.patch (git-fixes CVE-2025-40044 bsc#1252785). - Update patches.suse/hfsplus-fix-slab-out-of-bounds-read-in-hfsplus_strcasecmp.patch (git-fixes CVE-2025-40088 bsc#1252904). - Update patches.suse/hfsplus-fix-slab-out-of-bounds-read-in-hfsplus_uni2asc_followup.patch (git-fixes CVE-2025-40082 bsc#1252775). - Update patches.suse/iommu-vt-d-Disallow-dirty-tracking-if-incoherent-pag.patch (git-fixes CVE-2025-40058 bsc#1252854). - Update patches.suse/md-raid1-fix-potential-OOB-in-raid1_remove_disk-8b04.patch (jsc#PED-7542 CVE-2023-53722 bsc#1252499). - Update patches.suse/media-b2c2-Fix-use-after-free-causing-by-irq_check_w.patch (git-fixes CVE-2025-39996 bsc#1252065). - Update patches.suse/media-i2c-tc358743-Fix-use-after-free-bugs-caused-by.patch (git-fixes CVE-2025-39995 bsc#1252064). - Update patches.suse/media-rc-fix-races-with-imon_disconnect.patch (git-fixes CVE-2025-39993 bsc#1252070). - Update patches.suse/media-tuner-xc5000-Fix-use-after-free-in-xc5000_rele.patch (git-fixes CVE-2025-39994 bsc#1252072). - Update patches.suse/media-uvcvideo-Mark-invalid-entities-with-id-UVC_INV.patch (git-fixes CVE-2025-40016 bsc#1252346). - Update patches.suse/misc-fastrpc-fix-possible-map-leak-in-fastrpc_put_ar.patch (git-fixes CVE-2025-40036 bsc#1252865). - Update patches.suse/net-nfc-nci-Add-parameter-validation-for-packet-data.patch (git-fixes CVE-2025-40043 bsc#1252787). - Update patches.suse/net-sched-cls_u32-Undo-tcf_bind_filter-if-u32_r.patch (bsc#1012628 CVE-2023-53733 bsc#1252685). - Update patches.suse/net-sched-fq_pie-avoid-stalls-in-fq_pie_timer.patch (bsc#1220419 CVE-2023-53727 bsc#1252566). - Update patches.suse/netlink-fix-potential-deadlock-in-netlink_set_e.patch (bsc#1012628 CVE-2023-53731 bsc#1252481). - Update patches.suse/nvdimm-Fix-memleak-of-pmu-attr_groups-in-unregister_-85ae.patch (jsc#PED-5853 CVE-2023-53697 bsc#1252534). - Update patches.suse/posix-timers-Ensure-timer-ID-search-loop-limit-.patch (bsc#1012628 CVE-2023-53728 bsc#1252668). - Update patches.suse/ring-buffer-Do-not-swap-cpu_buffer-during-resi.patch (bsc#1012628 CVE-2023-53718 bsc#1252564). - Update patches.suse/riscv-move-memblock_allow_resize-after-linear-m.patch (bsc#1012628 CVE-2023-53699 bsc#1252550). - Update patches.suse/smb-client-fix-crypto-buffers-in-non-linear-memory.patch (bsc#1250491 boo#1239206 CVE-2025-40052 bsc#1252851). - Update patches.suse/soc-qcom-qmi_encdec-Restrict-string-length-in-decode.patch (git-fixes CVE-2023-53729 bsc#1252496). - Update patches.suse/tty-n_gsm-Don-t-block-input-queue-by-waiting-MSC.patch (git-fixes CVE-2025-40071 bsc#1252797). - Update patches.suse/wifi-ath11k-fix-NULL-dereference-in-ath11k_qmi_m3_lo.patch (git-fixes CVE-2025-39991 bsc#1252075). - Update patches.suse/wifi-ath12k-Fix-a-NULL-pointer-dereference-in-ath12k.patch (git-fixes CVE-2023-53721 bsc#1252561). - Update patches.suse/xfrm-xfrm_alloc_spi-shouldn-t-use-0-as-SPI.patch (CVE-2025-39797 bsc#1249608 CVE-2025-39965 bsc#1251967). - Update patches.suse/xsk-fix-refcount-underflow-in-error-path.patch (bsc#1012628 CVE-2023-53698 bsc#1252479). - commit 9042362 - coresight: trbe: Return NULL pointer for allocation failures (CVE-2025-40060 bsc#1252848). - commit 4543e34 ------------------------------------------------------------------ ------------------ 2025-11-2 - Nov 2 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - regulator: bd718x7: Fix voltages scaled by resistor divider (git-fixes). - regmap: slimbus: fix bus_context pointer in regmap init calls (git-fixes). - commit 20abe4b - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (git-fixes). - Refresh patches.suse/scsi-mpi3mr-Serialize-admin-queue-BAR-writes-on-32-bit-sys.patch. - commit 0321942 ++++ kernel-rt: - regulator: bd718x7: Fix voltages scaled by resistor divider (git-fixes). - regmap: slimbus: fix bus_context pointer in regmap init calls (git-fixes). - commit 20abe4b - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (git-fixes). - Refresh patches.suse/scsi-mpi3mr-Serialize-admin-queue-BAR-writes-on-32-bit-sys.patch. - commit 0321942 ++++ kernel-rt_debug: - regulator: bd718x7: Fix voltages scaled by resistor divider (git-fixes). - regmap: slimbus: fix bus_context pointer in regmap init calls (git-fixes). - commit 20abe4b - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (git-fixes). - Refresh patches.suse/scsi-mpi3mr-Serialize-admin-queue-BAR-writes-on-32-bit-sys.patch. - commit 0321942 ------------------------------------------------------------------ ------------------ 2025-11-1 - Nov 1 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - scsi: mpt3sas: Correctly handle ATA device errors (git-fixes). - scsi: mpi3mr: Correctly handle ATA device errors (git-fixes). - commit 237fed8 - drm/panel: kingdisplay-kd097d04: Disable EoTp (git-fixes). - drm/panel: sitronix-st7789v: fix sync flags for t28cp45tn89 (git-fixes). - drm/etnaviv: fix flush sequence logic (git-fixes). - drm/msm/dpu: Fix pixel extension sub-sampling (git-fixes). - drm/msm/a6xx: Fix GMU firmware parser (git-fixes). - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (git-fixes). - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (git-fixes). - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (git-fixes). - drm/mediatek: Fix device use-after-free on unbind (git-fixes). - ASoC: fsl_sai: fix bit order for DSD format (git-fixes). - ASoC: Intel: avs: Unprepare a stream when XRUN occurs (git-fixes). - ASoC: qdsp6: q6asm: do not sleep while atomic (git-fixes). - ALSA: usb-audio: fix control pipe direction (git-fixes). - commit acb4ea2 ++++ kernel-rt: - scsi: mpt3sas: Correctly handle ATA device errors (git-fixes). - scsi: mpi3mr: Correctly handle ATA device errors (git-fixes). - commit 237fed8 - drm/panel: kingdisplay-kd097d04: Disable EoTp (git-fixes). - drm/panel: sitronix-st7789v: fix sync flags for t28cp45tn89 (git-fixes). - drm/etnaviv: fix flush sequence logic (git-fixes). - drm/msm/dpu: Fix pixel extension sub-sampling (git-fixes). - drm/msm/a6xx: Fix GMU firmware parser (git-fixes). - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (git-fixes). - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (git-fixes). - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (git-fixes). - drm/mediatek: Fix device use-after-free on unbind (git-fixes). - ASoC: fsl_sai: fix bit order for DSD format (git-fixes). - ASoC: Intel: avs: Unprepare a stream when XRUN occurs (git-fixes). - ASoC: qdsp6: q6asm: do not sleep while atomic (git-fixes). - ALSA: usb-audio: fix control pipe direction (git-fixes). - commit acb4ea2 ++++ kernel-rt_debug: - scsi: mpt3sas: Correctly handle ATA device errors (git-fixes). - scsi: mpi3mr: Correctly handle ATA device errors (git-fixes). - commit 237fed8 - drm/panel: kingdisplay-kd097d04: Disable EoTp (git-fixes). - drm/panel: sitronix-st7789v: fix sync flags for t28cp45tn89 (git-fixes). - drm/etnaviv: fix flush sequence logic (git-fixes). - drm/msm/dpu: Fix pixel extension sub-sampling (git-fixes). - drm/msm/a6xx: Fix GMU firmware parser (git-fixes). - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (git-fixes). - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (git-fixes). - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (git-fixes). - drm/mediatek: Fix device use-after-free on unbind (git-fixes). - ASoC: fsl_sai: fix bit order for DSD format (git-fixes). - ASoC: Intel: avs: Unprepare a stream when XRUN occurs (git-fixes). - ASoC: qdsp6: q6asm: do not sleep while atomic (git-fixes). - ALSA: usb-audio: fix control pipe direction (git-fixes). - commit acb4ea2 ++++ nvidia-open-driver-G06-signed: - update non-CUDA variant to version 580.105.08 (boo#1252978) ------------------------------------------------------------------ ------------------ 2025-10-31 - Oct 31 2025 ------------------- ------------------------------------------------------------------ ++++ glib2: - Add glib2-CVE-2025-7039.patch: fix computation of temporary file name (bsc#1249055 CVE-2025-7039 glgo#GNOME/glib#3716). ++++ kernel-default: - smb: client: fix potential cfid UAF in smb2_query_info_compound (bsc#1248886). - commit 5e5239d - vhost: vringh: Fix copy_to_iter return value check (CVE-2025-40056 bsc#1252826) - commit 4efa16a - btrfs: do not assert we found block group item when creating free space tree (bsc#1252918 CVE-2025-40100). - commit 327502f - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (git-fixes). - commit f5ef369 - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (git-fixes). - commit 8cb68fe - KVM: x86/mmu: Prevent installing hugepages when mem attributes are changing (git-fixes). - commit 37d594a - selftests/bpf: Fix a fd leak in error paths in open_netns (git-fixes). - commit 51d3745 - selftests/bpf: Fix umount cgroup2 error in test_sockmap (git-fixes). - commit 24ba5aa - selftests/bpf: Use bpf_link__destroy in fill_link_info tests (git-fixes). - commit 9809b14 - ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (git-fixes). - ACPI: button: Call input_free_device() on failing input device registration (git-fixes). - fbdev: atyfb: Check if pll_ops->init_pll failed (git-fixes). - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (git-fixes). - net: phy: dp83869: fix STRAP_OPMODE bitmask (git-fixes). - net: usb: asix_devices: Check return value of usbnet_get_endpoints (git-fixes). - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset (git-fixes). - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (git-fixes). - usbnet: Prevents free active kevent (git-fixes). - wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (git-fixes). - wifi: ath12k: free skb during idr cleanup callback (git-fixes). - wifi: ath11k: Add missing platform IDs for quirk table (git-fixes). - wifi: ath10k: Fix memory leak on unsupported WMI command (git-fixes). - wifi: mac80211: reset FILS discovery and unsol probe resp intervals (git-fixes). - commit cc1ca5e ++++ kernel-rt: - smb: client: fix potential cfid UAF in smb2_query_info_compound (bsc#1248886). - commit 5e5239d - vhost: vringh: Fix copy_to_iter return value check (CVE-2025-40056 bsc#1252826) - commit 4efa16a - btrfs: do not assert we found block group item when creating free space tree (bsc#1252918 CVE-2025-40100). - commit 327502f - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (git-fixes). - commit f5ef369 - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (git-fixes). - commit 8cb68fe - KVM: x86/mmu: Prevent installing hugepages when mem attributes are changing (git-fixes). - commit 37d594a - selftests/bpf: Fix a fd leak in error paths in open_netns (git-fixes). - commit 51d3745 - selftests/bpf: Fix umount cgroup2 error in test_sockmap (git-fixes). - commit 24ba5aa - selftests/bpf: Use bpf_link__destroy in fill_link_info tests (git-fixes). - commit 9809b14 - ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (git-fixes). - ACPI: button: Call input_free_device() on failing input device registration (git-fixes). - fbdev: atyfb: Check if pll_ops->init_pll failed (git-fixes). - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (git-fixes). - net: phy: dp83869: fix STRAP_OPMODE bitmask (git-fixes). - net: usb: asix_devices: Check return value of usbnet_get_endpoints (git-fixes). - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset (git-fixes). - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (git-fixes). - usbnet: Prevents free active kevent (git-fixes). - wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (git-fixes). - wifi: ath12k: free skb during idr cleanup callback (git-fixes). - wifi: ath11k: Add missing platform IDs for quirk table (git-fixes). - wifi: ath10k: Fix memory leak on unsupported WMI command (git-fixes). - wifi: mac80211: reset FILS discovery and unsol probe resp intervals (git-fixes). - commit cc1ca5e ++++ kernel-rt_debug: - smb: client: fix potential cfid UAF in smb2_query_info_compound (bsc#1248886). - commit 5e5239d - vhost: vringh: Fix copy_to_iter return value check (CVE-2025-40056 bsc#1252826) - commit 4efa16a - btrfs: do not assert we found block group item when creating free space tree (bsc#1252918 CVE-2025-40100). - commit 327502f - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (git-fixes). - commit f5ef369 - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (git-fixes). - commit 8cb68fe - KVM: x86/mmu: Prevent installing hugepages when mem attributes are changing (git-fixes). - commit 37d594a - selftests/bpf: Fix a fd leak in error paths in open_netns (git-fixes). - commit 51d3745 - selftests/bpf: Fix umount cgroup2 error in test_sockmap (git-fixes). - commit 24ba5aa - selftests/bpf: Use bpf_link__destroy in fill_link_info tests (git-fixes). - commit 9809b14 - ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (git-fixes). - ACPI: button: Call input_free_device() on failing input device registration (git-fixes). - fbdev: atyfb: Check if pll_ops->init_pll failed (git-fixes). - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (git-fixes). - net: phy: dp83869: fix STRAP_OPMODE bitmask (git-fixes). - net: usb: asix_devices: Check return value of usbnet_get_endpoints (git-fixes). - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset (git-fixes). - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (git-fixes). - usbnet: Prevents free active kevent (git-fixes). - wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (git-fixes). - wifi: ath12k: free skb during idr cleanup callback (git-fixes). - wifi: ath11k: Add missing platform IDs for quirk table (git-fixes). - wifi: ath10k: Fix memory leak on unsupported WMI command (git-fixes). - wifi: mac80211: reset FILS discovery and unsol probe resp intervals (git-fixes). - commit cc1ca5e ------------------------------------------------------------------ ------------------ 2025-10-30 - Oct 30 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - bpf: Explicitly check accesses to bpf_sock_addr (CVE-2025-40078 bsc#1252789). - commit 6edd4b3 - KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer (git-fixes). - commit fdfcdff - KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update() (git-fixes). - commit cb2e3ab - kdb: Replace deprecated strcpy() with memmove() in vkdb_printf() (bsc#1252939). - commit 7cb788c - Revert "KVM: VMX: Move LOAD_IA32_PERF_GLOBAL_CTRL errata handling out of setup_vmcs_config()" (git-fixes). - commit 769724a - hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (git-fixes). - commit 40898e0 - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (git-fixes). - commit a2e4db9 - hfs: validate record offset in hfsplus_bmap_alloc (git-fixes). - commit 693ef92 - hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (git-fixes). - commit 6aec9cc ++++ kernel-rt: - bpf: Explicitly check accesses to bpf_sock_addr (CVE-2025-40078 bsc#1252789). - commit 6edd4b3 - KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer (git-fixes). - commit fdfcdff - KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update() (git-fixes). - commit cb2e3ab - kdb: Replace deprecated strcpy() with memmove() in vkdb_printf() (bsc#1252939). - commit 7cb788c - Revert "KVM: VMX: Move LOAD_IA32_PERF_GLOBAL_CTRL errata handling out of setup_vmcs_config()" (git-fixes). - commit 769724a - hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (git-fixes). - commit 40898e0 - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (git-fixes). - commit a2e4db9 - hfs: validate record offset in hfsplus_bmap_alloc (git-fixes). - commit 693ef92 - hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (git-fixes). - commit 6aec9cc ++++ kernel-rt_debug: - bpf: Explicitly check accesses to bpf_sock_addr (CVE-2025-40078 bsc#1252789). - commit 6edd4b3 - KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer (git-fixes). - commit fdfcdff - KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update() (git-fixes). - commit cb2e3ab - kdb: Replace deprecated strcpy() with memmove() in vkdb_printf() (bsc#1252939). - commit 7cb788c - Revert "KVM: VMX: Move LOAD_IA32_PERF_GLOBAL_CTRL errata handling out of setup_vmcs_config()" (git-fixes). - commit 769724a - hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (git-fixes). - commit 40898e0 - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (git-fixes). - commit a2e4db9 - hfs: validate record offset in hfsplus_bmap_alloc (git-fixes). - commit 693ef92 - hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (git-fixes). - commit 6aec9cc ------------------------------------------------------------------ ------------------ 2025-10-29 - Oct 29 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - ARM: tegra: Use I/O memcpy to write to IRAM (CVE-2025-39794 bsc#1249595) - commit ad8d355 - ipvs: Defer ip_vs_ftp unregister during netns cleanup (CVE-2025-40018 bsc#1252688). - commit d48a123 - NFSD: Fix crash in nfsd4_read_release() (git-fixes). - commit 1a326b8 - Fix Git-commit for patches.suse/cxl-downgrade-a-warning-message-to-debug-level-in-cxl.patch. - commit 31a5035 ++++ kernel-rt: - ARM: tegra: Use I/O memcpy to write to IRAM (CVE-2025-39794 bsc#1249595) - commit ad8d355 - ipvs: Defer ip_vs_ftp unregister during netns cleanup (CVE-2025-40018 bsc#1252688). - commit d48a123 - NFSD: Fix crash in nfsd4_read_release() (git-fixes). - commit 1a326b8 - Fix Git-commit for patches.suse/cxl-downgrade-a-warning-message-to-debug-level-in-cxl.patch. - commit 31a5035 ++++ kernel-rt_debug: - ARM: tegra: Use I/O memcpy to write to IRAM (CVE-2025-39794 bsc#1249595) - commit ad8d355 - ipvs: Defer ip_vs_ftp unregister during netns cleanup (CVE-2025-40018 bsc#1252688). - commit d48a123 - NFSD: Fix crash in nfsd4_read_release() (git-fixes). - commit 1a326b8 - Fix Git-commit for patches.suse/cxl-downgrade-a-warning-message-to-debug-level-in-cxl.patch. - commit 31a5035 ++++ opensuse-migration-tool: - Update to version 20251029.ed0d12d: * Update opensuse-migration-tool ------------------------------------------------------------------ ------------------ 2025-10-28 - Oct 28 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - bpf: Allow helper bpf_get_[ns_]current_pid_tgid() for all prog types (bsc#1252364). - commit 82fd58d - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request() (git-fixes). - commit fceae30 - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (CVE-2025-39978 bsc#1252069). - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (CVE-2025-39955 bsc#1251804). - commit 0468786 - Revert "e1000e: fix heap overflow in e1000_set_eeprom (CVE-2025-39898" This reverts commit df2ae2c1bd0dd998b7e23e3d49e90e95ada467f0. - commit 79fa523 - i40e: add max boundary check for VF filters (CVE-2025-39968 bsc#1252047). - i40e: fix validation of VF state in get resources (CVE-2025-39969 bsc#1252044). - i40e: fix idx validation in i40e_validate_queue_map (CVE-2025-39972 bsc#1252039). - i40e: add validation for ring_len param (CVE-2025-39973 bsc#1252035). - ice: fix Rx page leak on multi-buffer frames (CVE-2025-39948 bsc#1251233). - qed: Don't collect too many protection override GRC elements (CVE-2025-39949 bsc#1251177). - commit 2c4293d - Delete patches.suse/cpuidle-menu-Avoid-discarding-useful-information.patch. - commit c2e3ac6 - Delete patches.suse/cpuidle-governors-menu-Avoid-using-invalid-recent-intervals-data.patch. - commit b1a47b7 - nvme/tcp: handle tls partially sent records in write_space() (git-fixes). - nvme-multipath: Skip nr_active increments in RETRY disposition (git-fixes). - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (git-fixes). - commit 4b35633 - ACPI: battery: Add synchronization between interface updates (git-fixes). - locking/mutex: Mark devm_mutex_init() as __must_check (stable-fixes). - ACPI: battery: Check for error code from devm_mutex_init() call (git-fixes). - ACPI: battery: initialize mutexes through devm_ APIs (stable-fixes). - accel/ivpu: Add missing MODULE_FIRMWARE metadata (git-fixes). - locking/mutex: Introduce devm_mutex_init() (stable-fixes). - commit 7bacc8f ++++ kernel-rt: - bpf: Allow helper bpf_get_[ns_]current_pid_tgid() for all prog types (bsc#1252364). - commit 82fd58d - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request() (git-fixes). - commit fceae30 - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (CVE-2025-39978 bsc#1252069). - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (CVE-2025-39955 bsc#1251804). - commit 0468786 - Revert "e1000e: fix heap overflow in e1000_set_eeprom (CVE-2025-39898" This reverts commit df2ae2c1bd0dd998b7e23e3d49e90e95ada467f0. - commit 79fa523 - i40e: add max boundary check for VF filters (CVE-2025-39968 bsc#1252047). - i40e: fix validation of VF state in get resources (CVE-2025-39969 bsc#1252044). - i40e: fix idx validation in i40e_validate_queue_map (CVE-2025-39972 bsc#1252039). - i40e: add validation for ring_len param (CVE-2025-39973 bsc#1252035). - ice: fix Rx page leak on multi-buffer frames (CVE-2025-39948 bsc#1251233). - qed: Don't collect too many protection override GRC elements (CVE-2025-39949 bsc#1251177). - commit 2c4293d - Delete patches.suse/cpuidle-menu-Avoid-discarding-useful-information.patch. - commit c2e3ac6 - Delete patches.suse/cpuidle-governors-menu-Avoid-using-invalid-recent-intervals-data.patch. - commit b1a47b7 - nvme/tcp: handle tls partially sent records in write_space() (git-fixes). - nvme-multipath: Skip nr_active increments in RETRY disposition (git-fixes). - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (git-fixes). - commit 4b35633 - ACPI: battery: Add synchronization between interface updates (git-fixes). - locking/mutex: Mark devm_mutex_init() as __must_check (stable-fixes). - ACPI: battery: Check for error code from devm_mutex_init() call (git-fixes). - ACPI: battery: initialize mutexes through devm_ APIs (stable-fixes). - accel/ivpu: Add missing MODULE_FIRMWARE metadata (git-fixes). - locking/mutex: Introduce devm_mutex_init() (stable-fixes). - commit 7bacc8f ++++ kernel-rt_debug: - bpf: Allow helper bpf_get_[ns_]current_pid_tgid() for all prog types (bsc#1252364). - commit 82fd58d - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request() (git-fixes). - commit fceae30 - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (CVE-2025-39978 bsc#1252069). - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (CVE-2025-39955 bsc#1251804). - commit 0468786 - Revert "e1000e: fix heap overflow in e1000_set_eeprom (CVE-2025-39898" This reverts commit df2ae2c1bd0dd998b7e23e3d49e90e95ada467f0. - commit 79fa523 - i40e: add max boundary check for VF filters (CVE-2025-39968 bsc#1252047). - i40e: fix validation of VF state in get resources (CVE-2025-39969 bsc#1252044). - i40e: fix idx validation in i40e_validate_queue_map (CVE-2025-39972 bsc#1252039). - i40e: add validation for ring_len param (CVE-2025-39973 bsc#1252035). - ice: fix Rx page leak on multi-buffer frames (CVE-2025-39948 bsc#1251233). - qed: Don't collect too many protection override GRC elements (CVE-2025-39949 bsc#1251177). - commit 2c4293d - Delete patches.suse/cpuidle-menu-Avoid-discarding-useful-information.patch. - commit c2e3ac6 - Delete patches.suse/cpuidle-governors-menu-Avoid-using-invalid-recent-intervals-data.patch. - commit b1a47b7 - nvme/tcp: handle tls partially sent records in write_space() (git-fixes). - nvme-multipath: Skip nr_active increments in RETRY disposition (git-fixes). - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (git-fixes). - commit 4b35633 - ACPI: battery: Add synchronization between interface updates (git-fixes). - locking/mutex: Mark devm_mutex_init() as __must_check (stable-fixes). - ACPI: battery: Check for error code from devm_mutex_init() call (git-fixes). - ACPI: battery: initialize mutexes through devm_ APIs (stable-fixes). - accel/ivpu: Add missing MODULE_FIRMWARE metadata (git-fixes). - locking/mutex: Introduce devm_mutex_init() (stable-fixes). - commit 7bacc8f ++++ libgcrypt: - Fix running the test suite in FIPS mode [bsc#1246934] * Add libgcrypt-fix-pkcs12-test-in-FIPS-mode.patch * Rebase libgcrypt-FIPS-SLI-kdf-leylength.patch ------------------------------------------------------------------ ------------------ 2025-10-27 - Oct 27 2025 ------------------- ------------------------------------------------------------------ ++++ docker: - Enable SELinux in default daemon.json config (--selinux-enabled). This has no practical impact on non-SELinux systems. bsc#1252290 ++++ kernel-default: - wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (CVE-2025-40000 bsc#1252062). - commit b7a479d - sched/fair: set_load_weight() must also call reweight_task() (git-fixes) - commit b185921 - misc: fastrpc: Save actual DMA size in fastrpc_map structure (git-fixes). - Refresh patches.suse/misc-fastrpc-Skip-reference-for-DMA-handles.patch. - commit b472422 - most: usb: hdm_probe: Fix calling put_device() before device initialization (git-fixes). - most: usb: Fix use-after-free in hdm_disconnect (git-fixes). - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup (git-fixes). - serial: 8250_dw: handle reset control deassert error (git-fixes). - xhci: dbc: enable back DbC in resume if it was enabled before suspend (git-fixes). - spi: spi-nxp-fspi: add extra delay after dll locked (git-fixes). - net: usb: rtl8150: Fix frame padding (git-fixes). - HID: multitouch: fix name of Stylus input devices (git-fixes). - HID: hid-input: only ignore 0 battery events for digitizers (git-fixes). - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (git-fixes). - rtc: interface: Ensure alarm irq is enabled when UIE is enabled (stable-fixes). - rtc: interface: Fix long-standing race when setting alarm (stable-fixes). - PCI: j721e: Fix programming sequence of "strap" settings (git-fixes). - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (git-fixes). - PCI/AER: Support errors introduced by PCIe r6.0 (stable-fixes). - phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (git-fixes). - phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (git-fixes). - phy: cdns-dphy: Store hs_clk_rate and return it (stable-fixes). - mtd: rawnand: fsmc: Default to autodetect buswidth (stable-fixes). - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (stable-fixes). - media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (stable-fixes). - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (git-fixes). - mmc: core: SPI mode remove cmd7 (stable-fixes). - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (stable-fixes). - PM: runtime: Add new devm functions (stable-fixes). - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (stable-fixes). - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (stable-fixes). - PCI: Add PCI_VDEVICE_SUB helper macro (stable-fixes). - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (stable-fixes). - PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists (stable-fixes). - misc: fastrpc: Add missing dev_err newlines (stable-fixes). - commit 9f99f4e - firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode (git-fixes). - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (git-fixes). - drm/rockchip: vop2: use correct destination rectangle height check (git-fixes). - drm/bridge: lt9211: Drop check for last nibble of version register (git-fixes). - drm/amd/powerplay: Fix CIK shutdown temperature (git-fixes). - drm/amdgpu: use atomic functions with memory barriers for vm fault info (git-fixes). - drm/i915/guc: Skip communication warning on reset in progress (git-fixes). - drm/amd: Check whether secure display TA loaded successfully (stable-fixes). - drm/exynos: exynos7_drm_decon: properly clear channels during bind (stable-fixes). - drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (stable-fixes). - commit 110d102 - can: netlink: can_changelink(): allow disabling of automatic restart (git-fixes). - can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (git-fixes). - ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (git-fixes). - ASoC: nau8821: Generalize helper to clear IRQ status (git-fixes). - ASoC: nau8821: Cancel jdet_work before handling jack ejection (git-fixes). - ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (git-fixes). - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (git-fixes). - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (git-fixes). - accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (git-fixes). - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (stable-fixes). - ACPI: property: Add code comments explaining what is going on (stable-fixes). - ACPI: property: Disregard references in data-only subnode lists (stable-fixes). - ACPICA: Allow to skip Global Lock initialization (stable-fixes). - ACPI: battery: allocate driver data through devm_ APIs (stable-fixes). - drm/msm/adreno: De-spaghettify the use of memory barriers (stable-fixes). - commit e53e617 - spi: cadence-quadspi: Implement refcount to handle unbind during busy (CVE-2025-40005 bsc#1252349). - commit 7406f70 ++++ kernel-rt: - wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (CVE-2025-40000 bsc#1252062). - commit b7a479d - sched/fair: set_load_weight() must also call reweight_task() (git-fixes) - commit b185921 - misc: fastrpc: Save actual DMA size in fastrpc_map structure (git-fixes). - Refresh patches.suse/misc-fastrpc-Skip-reference-for-DMA-handles.patch. - commit b472422 - most: usb: hdm_probe: Fix calling put_device() before device initialization (git-fixes). - most: usb: Fix use-after-free in hdm_disconnect (git-fixes). - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup (git-fixes). - serial: 8250_dw: handle reset control deassert error (git-fixes). - xhci: dbc: enable back DbC in resume if it was enabled before suspend (git-fixes). - spi: spi-nxp-fspi: add extra delay after dll locked (git-fixes). - net: usb: rtl8150: Fix frame padding (git-fixes). - HID: multitouch: fix name of Stylus input devices (git-fixes). - HID: hid-input: only ignore 0 battery events for digitizers (git-fixes). - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (git-fixes). - rtc: interface: Ensure alarm irq is enabled when UIE is enabled (stable-fixes). - rtc: interface: Fix long-standing race when setting alarm (stable-fixes). - PCI: j721e: Fix programming sequence of "strap" settings (git-fixes). - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (git-fixes). - PCI/AER: Support errors introduced by PCIe r6.0 (stable-fixes). - phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (git-fixes). - phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (git-fixes). - phy: cdns-dphy: Store hs_clk_rate and return it (stable-fixes). - mtd: rawnand: fsmc: Default to autodetect buswidth (stable-fixes). - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (stable-fixes). - media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (stable-fixes). - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (git-fixes). - mmc: core: SPI mode remove cmd7 (stable-fixes). - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (stable-fixes). - PM: runtime: Add new devm functions (stable-fixes). - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (stable-fixes). - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (stable-fixes). - PCI: Add PCI_VDEVICE_SUB helper macro (stable-fixes). - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (stable-fixes). - PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists (stable-fixes). - misc: fastrpc: Add missing dev_err newlines (stable-fixes). - commit 9f99f4e - firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode (git-fixes). - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (git-fixes). - drm/rockchip: vop2: use correct destination rectangle height check (git-fixes). - drm/bridge: lt9211: Drop check for last nibble of version register (git-fixes). - drm/amd/powerplay: Fix CIK shutdown temperature (git-fixes). - drm/amdgpu: use atomic functions with memory barriers for vm fault info (git-fixes). - drm/i915/guc: Skip communication warning on reset in progress (git-fixes). - drm/amd: Check whether secure display TA loaded successfully (stable-fixes). - drm/exynos: exynos7_drm_decon: properly clear channels during bind (stable-fixes). - drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (stable-fixes). - commit 110d102 - can: netlink: can_changelink(): allow disabling of automatic restart (git-fixes). - can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (git-fixes). - ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (git-fixes). - ASoC: nau8821: Generalize helper to clear IRQ status (git-fixes). - ASoC: nau8821: Cancel jdet_work before handling jack ejection (git-fixes). - ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (git-fixes). - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (git-fixes). - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (git-fixes). - accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (git-fixes). - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (stable-fixes). - ACPI: property: Add code comments explaining what is going on (stable-fixes). - ACPI: property: Disregard references in data-only subnode lists (stable-fixes). - ACPICA: Allow to skip Global Lock initialization (stable-fixes). - ACPI: battery: allocate driver data through devm_ APIs (stable-fixes). - drm/msm/adreno: De-spaghettify the use of memory barriers (stable-fixes). - commit e53e617 - spi: cadence-quadspi: Implement refcount to handle unbind during busy (CVE-2025-40005 bsc#1252349). - commit 7406f70 ++++ kernel-rt_debug: - wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (CVE-2025-40000 bsc#1252062). - commit b7a479d - sched/fair: set_load_weight() must also call reweight_task() (git-fixes) - commit b185921 - misc: fastrpc: Save actual DMA size in fastrpc_map structure (git-fixes). - Refresh patches.suse/misc-fastrpc-Skip-reference-for-DMA-handles.patch. - commit b472422 - most: usb: hdm_probe: Fix calling put_device() before device initialization (git-fixes). - most: usb: Fix use-after-free in hdm_disconnect (git-fixes). - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup (git-fixes). - serial: 8250_dw: handle reset control deassert error (git-fixes). - xhci: dbc: enable back DbC in resume if it was enabled before suspend (git-fixes). - spi: spi-nxp-fspi: add extra delay after dll locked (git-fixes). - net: usb: rtl8150: Fix frame padding (git-fixes). - HID: multitouch: fix name of Stylus input devices (git-fixes). - HID: hid-input: only ignore 0 battery events for digitizers (git-fixes). - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (git-fixes). - rtc: interface: Ensure alarm irq is enabled when UIE is enabled (stable-fixes). - rtc: interface: Fix long-standing race when setting alarm (stable-fixes). - PCI: j721e: Fix programming sequence of "strap" settings (git-fixes). - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (git-fixes). - PCI/AER: Support errors introduced by PCIe r6.0 (stable-fixes). - phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (git-fixes). - phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (git-fixes). - phy: cdns-dphy: Store hs_clk_rate and return it (stable-fixes). - mtd: rawnand: fsmc: Default to autodetect buswidth (stable-fixes). - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (stable-fixes). - media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (stable-fixes). - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (git-fixes). - mmc: core: SPI mode remove cmd7 (stable-fixes). - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (stable-fixes). - PM: runtime: Add new devm functions (stable-fixes). - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (stable-fixes). - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (stable-fixes). - PCI: Add PCI_VDEVICE_SUB helper macro (stable-fixes). - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (stable-fixes). - PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists (stable-fixes). - misc: fastrpc: Add missing dev_err newlines (stable-fixes). - commit 9f99f4e - firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode (git-fixes). - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (git-fixes). - drm/rockchip: vop2: use correct destination rectangle height check (git-fixes). - drm/bridge: lt9211: Drop check for last nibble of version register (git-fixes). - drm/amd/powerplay: Fix CIK shutdown temperature (git-fixes). - drm/amdgpu: use atomic functions with memory barriers for vm fault info (git-fixes). - drm/i915/guc: Skip communication warning on reset in progress (git-fixes). - drm/amd: Check whether secure display TA loaded successfully (stable-fixes). - drm/exynos: exynos7_drm_decon: properly clear channels during bind (stable-fixes). - drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (stable-fixes). - commit 110d102 - can: netlink: can_changelink(): allow disabling of automatic restart (git-fixes). - can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (git-fixes). - ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (git-fixes). - ASoC: nau8821: Generalize helper to clear IRQ status (git-fixes). - ASoC: nau8821: Cancel jdet_work before handling jack ejection (git-fixes). - ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (git-fixes). - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (git-fixes). - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (git-fixes). - accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (git-fixes). - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (stable-fixes). - ACPI: property: Add code comments explaining what is going on (stable-fixes). - ACPI: property: Disregard references in data-only subnode lists (stable-fixes). - ACPICA: Allow to skip Global Lock initialization (stable-fixes). - ACPI: battery: allocate driver data through devm_ APIs (stable-fixes). - drm/msm/adreno: De-spaghettify the use of memory barriers (stable-fixes). - commit e53e617 - spi: cadence-quadspi: Implement refcount to handle unbind during busy (CVE-2025-40005 bsc#1252349). - commit 7406f70 ++++ python-PyJWT: - Remove not needed update-alternatives requirement. ------------------------------------------------------------------ ------------------ 2025-10-26 - Oct 26 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - i40e: fix idx validation in config queues msg (CVE-2025-39971 bsc#1252052) - commit 70699a8 - i40e: fix input validation logic for action_meta (CVE-2025-39970 bsc#1252051) - commit 57401e3 ++++ kernel-rt: - i40e: fix idx validation in config queues msg (CVE-2025-39971 bsc#1252052) - commit 70699a8 - i40e: fix input validation logic for action_meta (CVE-2025-39970 bsc#1252051) - commit 57401e3 ++++ kernel-rt_debug: - i40e: fix idx validation in config queues msg (CVE-2025-39971 bsc#1252052) - commit 70699a8 - i40e: fix input validation logic for action_meta (CVE-2025-39970 bsc#1252051) - commit 57401e3 ------------------------------------------------------------------ ------------------ 2025-10-25 - Oct 25 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - arm64, mm: avoid always making PTE dirty in pte_mkwrite() (git-fixes) - commit 59db3fb - arm64: errata: Apply workarounds for Neoverse-V3AE (git-fixes) - commit da235eb - arm64: cputype: Add Neoverse-V3AE definitions (git-fixes) - commit 5587842 ++++ kernel-rt: - arm64, mm: avoid always making PTE dirty in pte_mkwrite() (git-fixes) - commit 59db3fb - arm64: errata: Apply workarounds for Neoverse-V3AE (git-fixes) - commit da235eb - arm64: cputype: Add Neoverse-V3AE definitions (git-fixes) - commit 5587842 ++++ kernel-rt_debug: - arm64, mm: avoid always making PTE dirty in pte_mkwrite() (git-fixes) - commit 59db3fb - arm64: errata: Apply workarounds for Neoverse-V3AE (git-fixes) - commit da235eb - arm64: cputype: Add Neoverse-V3AE definitions (git-fixes) - commit 5587842 ------------------------------------------------------------------ ------------------ 2025-10-24 - Oct 24 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - NFSD: Minor cleanup in layoutcommit processing (git-fixes). - commit baef4e7 - NFSD: Rework encoding and decoding of nfsd4_deviceid (git-fixes). - commit 72f1d28 - hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (git-fixes). - commit a6f88ab - xfs: rename the old_crc variable in xlog_recover_process (git-fixes). - commit 677fb8c ++++ kernel-rt: - NFSD: Minor cleanup in layoutcommit processing (git-fixes). - commit baef4e7 - NFSD: Rework encoding and decoding of nfsd4_deviceid (git-fixes). - commit 72f1d28 - hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (git-fixes). - commit a6f88ab - xfs: rename the old_crc variable in xlog_recover_process (git-fixes). - commit 677fb8c ++++ kernel-rt_debug: - NFSD: Minor cleanup in layoutcommit processing (git-fixes). - commit baef4e7 - NFSD: Rework encoding and decoding of nfsd4_deviceid (git-fixes). - commit 72f1d28 - hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (git-fixes). - commit a6f88ab - xfs: rename the old_crc variable in xlog_recover_process (git-fixes). - commit 677fb8c ------------------------------------------------------------------ ------------------ 2025-10-23 - Oct 23 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (CVE-2025-39876 bsc#1250400) - commit 137f367 - proc: fix type confusion in pde_set_flags() (bsc#1248630) - commit c6a1bb4 - proc: fix missing pde_set_flags() for net proc files (bsc#1248630) - commit 539da61 - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653 bsc#1248630) - commit bcff9b5 - ovl: fix file reference leak when submitting aio (stable-fixes). - commit 57db5b5 - KVM: x86: Set PVCLOCK_GUEST_STOPPED only for kvmclock, not for Xen PV clock (git-fixes). - commit 85e57cf - KVM: x86: Don't bleed PVCLOCK_GUEST_STOPPED across PV clocks (git-fixes). - commit cd63f69 - KVM: x86: Process "guest stopped request" once per guest time update (git-fixes). - commit 29a55cf - add bug reference to existing hv_netvsc change (bsc#1252265) - commit 95261dd ++++ kernel-rt: - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (CVE-2025-39876 bsc#1250400) - commit 137f367 - proc: fix type confusion in pde_set_flags() (bsc#1248630) - commit c6a1bb4 - proc: fix missing pde_set_flags() for net proc files (bsc#1248630) - commit 539da61 - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653 bsc#1248630) - commit bcff9b5 - ovl: fix file reference leak when submitting aio (stable-fixes). - commit 57db5b5 - KVM: x86: Set PVCLOCK_GUEST_STOPPED only for kvmclock, not for Xen PV clock (git-fixes). - commit 85e57cf - KVM: x86: Don't bleed PVCLOCK_GUEST_STOPPED across PV clocks (git-fixes). - commit cd63f69 - KVM: x86: Process "guest stopped request" once per guest time update (git-fixes). - commit 29a55cf - add bug reference to existing hv_netvsc change (bsc#1252265) - commit 95261dd ++++ kernel-rt_debug: - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (CVE-2025-39876 bsc#1250400) - commit 137f367 - proc: fix type confusion in pde_set_flags() (bsc#1248630) - commit c6a1bb4 - proc: fix missing pde_set_flags() for net proc files (bsc#1248630) - commit 539da61 - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653 bsc#1248630) - commit bcff9b5 - ovl: fix file reference leak when submitting aio (stable-fixes). - commit 57db5b5 - KVM: x86: Set PVCLOCK_GUEST_STOPPED only for kvmclock, not for Xen PV clock (git-fixes). - commit 85e57cf - KVM: x86: Don't bleed PVCLOCK_GUEST_STOPPED across PV clocks (git-fixes). - commit cd63f69 - KVM: x86: Process "guest stopped request" once per guest time update (git-fixes). - commit 29a55cf - add bug reference to existing hv_netvsc change (bsc#1252265) - commit 95261dd ------------------------------------------------------------------ ------------------ 2025-10-22 - Oct 22 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - KVM: SVM: Inject #GP if memory operand for INVPCID is non-canonical (git-fixes). - commit ed9dfb1 - KVM: x86: Clear pv_unhalted on all transitions to KVM_MP_STATE_RUNNABLE (git-fixes). - commit f4d45de - KVM: x86: Introduce kvm_set_mp_state() (git-fixes). - commit 4b1f2ec ++++ kernel-rt: - KVM: SVM: Inject #GP if memory operand for INVPCID is non-canonical (git-fixes). - commit ed9dfb1 - KVM: x86: Clear pv_unhalted on all transitions to KVM_MP_STATE_RUNNABLE (git-fixes). - commit f4d45de - KVM: x86: Introduce kvm_set_mp_state() (git-fixes). - commit 4b1f2ec ++++ kernel-rt_debug: - KVM: SVM: Inject #GP if memory operand for INVPCID is non-canonical (git-fixes). - commit ed9dfb1 - KVM: x86: Clear pv_unhalted on all transitions to KVM_MP_STATE_RUNNABLE (git-fixes). - commit f4d45de - KVM: x86: Introduce kvm_set_mp_state() (git-fixes). - commit 4b1f2ec ++++ gpgme: - Treat empty DISPLAY variable as unset. [bsc#1252425, bsc#1231055] * To avoid gpgme constructing an invalid gpg command line when the DISPLAY variable is empty it can be treated as unset. * Add gpgme-Treat-empty-DISPLAY-variable-as-unset.patch * Reported upstream: dev.gnupg.org/T7919 ------------------------------------------------------------------ ------------------ 2025-10-21 - Oct 21 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - NFS: Fix a race when updating an existing write (bsc#1249319 bsc#1252236 CVE-2025-39697). - commit 40cab0c - nfs: Add missing release on error in nfs_lock_and_join_requests() (bsc#1249319 bsc#1252236 CVE-2025-39697). - commit b903556 - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (bsc#1249319 bsc#1252236 CVE-2025-39697). - commit 13ceff1 - nfs: fold nfs_folio_find_and_lock_request into nfs_lock_and_join_requests (bsc#1249319 bsc#1252236 CVE-2025-39697). - commit 14874ac - nfs: simplify nfs_folio_find_and_lock_request (bsc#1249319 bsc#1252236 CVE-2025-39697). - commit 1b25c26 - nfs: remove nfs_folio_private_request (bsc#1249319 bsc#1252236 CVE-2025-39697). - commit c28ea5d - nfs: remove dead code for the old swap over NFS implementation (bsc#1249319 bsc#1252236 CVE-2025-39697). - Refresh patches.suse/NFS-fix-nfs_release_folio-to-not-deadlock-via-kcompa.patch. - commit e7a5c52 - kABI fix for KVM: x86: Snapshot the host's DEBUGCTL in common x86 (git-fixes). - commit 0bb2570 - overlayfs: set ctime when setting mtime and atime (stable-fixes). - ovl: fix incorrect fdput() on aio completion (stable-fixes). - ovl: Always reevaluate the file signature for IMA (stable-fixes). - commit 4cfc4ed - i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (CVE-2025-39911 bsc#1250704) - commit 627f938 - sched: Fix sched_numa_find_nth_cpu() if mask offline (CVE-2025-39895 bsc#1250721) - commit 581de7a - sctp: initialize more fields in sctp_v6_from_sk() (CVE-2025-39812 bsc#1250202) - commit 56a7db3 ++++ kernel-rt: - NFS: Fix a race when updating an existing write (bsc#1249319 bsc#1252236 CVE-2025-39697). - commit 40cab0c - nfs: Add missing release on error in nfs_lock_and_join_requests() (bsc#1249319 bsc#1252236 CVE-2025-39697). - commit b903556 - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (bsc#1249319 bsc#1252236 CVE-2025-39697). - commit 13ceff1 - nfs: fold nfs_folio_find_and_lock_request into nfs_lock_and_join_requests (bsc#1249319 bsc#1252236 CVE-2025-39697). - commit 14874ac - nfs: simplify nfs_folio_find_and_lock_request (bsc#1249319 bsc#1252236 CVE-2025-39697). - commit 1b25c26 - nfs: remove nfs_folio_private_request (bsc#1249319 bsc#1252236 CVE-2025-39697). - commit c28ea5d - nfs: remove dead code for the old swap over NFS implementation (bsc#1249319 bsc#1252236 CVE-2025-39697). - Refresh patches.suse/NFS-fix-nfs_release_folio-to-not-deadlock-via-kcompa.patch. - commit e7a5c52 - kABI fix for KVM: x86: Snapshot the host's DEBUGCTL in common x86 (git-fixes). - commit 0bb2570 - overlayfs: set ctime when setting mtime and atime (stable-fixes). - ovl: fix incorrect fdput() on aio completion (stable-fixes). - ovl: Always reevaluate the file signature for IMA (stable-fixes). - commit 4cfc4ed - i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (CVE-2025-39911 bsc#1250704) - commit 627f938 - sched: Fix sched_numa_find_nth_cpu() if mask offline (CVE-2025-39895 bsc#1250721) - commit 581de7a - sctp: initialize more fields in sctp_v6_from_sk() (CVE-2025-39812 bsc#1250202) - commit 56a7db3 ++++ kernel-rt_debug: - NFS: Fix a race when updating an existing write (bsc#1249319 bsc#1252236 CVE-2025-39697). - commit 40cab0c - nfs: Add missing release on error in nfs_lock_and_join_requests() (bsc#1249319 bsc#1252236 CVE-2025-39697). - commit b903556 - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (bsc#1249319 bsc#1252236 CVE-2025-39697). - commit 13ceff1 - nfs: fold nfs_folio_find_and_lock_request into nfs_lock_and_join_requests (bsc#1249319 bsc#1252236 CVE-2025-39697). - commit 14874ac - nfs: simplify nfs_folio_find_and_lock_request (bsc#1249319 bsc#1252236 CVE-2025-39697). - commit 1b25c26 - nfs: remove nfs_folio_private_request (bsc#1249319 bsc#1252236 CVE-2025-39697). - commit c28ea5d - nfs: remove dead code for the old swap over NFS implementation (bsc#1249319 bsc#1252236 CVE-2025-39697). - Refresh patches.suse/NFS-fix-nfs_release_folio-to-not-deadlock-via-kcompa.patch. - commit e7a5c52 - kABI fix for KVM: x86: Snapshot the host's DEBUGCTL in common x86 (git-fixes). - commit 0bb2570 - overlayfs: set ctime when setting mtime and atime (stable-fixes). - ovl: fix incorrect fdput() on aio completion (stable-fixes). - ovl: Always reevaluate the file signature for IMA (stable-fixes). - commit 4cfc4ed - i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (CVE-2025-39911 bsc#1250704) - commit 627f938 - sched: Fix sched_numa_find_nth_cpu() if mask offline (CVE-2025-39895 bsc#1250721) - commit 581de7a - sctp: initialize more fields in sctp_v6_from_sk() (CVE-2025-39812 bsc#1250202) - commit 56a7db3 ++++ sqlite3: - bsc#1252217: Add a %license file. ------------------------------------------------------------------ ------------------ 2025-10-20 - Oct 20 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - ipv6: sr: Fix MAC comparison to be constant-time (CVE-2025-39702 bsc#1249317) - commit 3d85c5c - sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718 bsc#1249161) - commit 0083867 - scsi: qla4xxx: Prevent a potential error pointer dereference (CVE-2025-39676 bsc#1249302) - commit a3b8686 - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (git-fixes). - commit f1ec116 - net/mlx5e: Harden uplink netdev access against device unbind (CVE-2025-39947 bsc#1251232). - commit d4278a0 - KVM: x86: Snapshot the host's DEBUGCTL after disabling IRQs (git-fixes). - commit 09e399f - KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (git-fixes). - commit 27a06fc - net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset (git-fixes). - commit ad26239 - r8152: add error handling in rtl8152_driver_init (git-fixes). - commit db73d98 - usbnet: Fix using smp_processor_id() in preemptible code warnings (git-fixes). - commit b2c518b - config.sh: Update IBS project - commit f8ef735 - cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (git-fixes). - commit 149500a - cpuidle: governors: menu: Avoid using invalid recent intervals data (git-fixes). - commit a4ef664 - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (git-fixes). - commit baddd40 - selftests/bpf: Fix backtrace printing for selftests crashes (git-fixes). - commit 63e24c4 - tools/resolve_btfids: Fix build when cross compiling kernel with clang (git-fixes). - commit f4f0a36 - samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora (git-fixes). - commit fa036e9 - selftests/bpf: Fix cross-compiling urandom_read (git-fixes). - commit d19eec5 - selftests/bpf: Fix compile if backtrace support missing in libc (git-fixes). - commit 3353a4b - selftests/bpf: Fix redefinition errors compiling lwt_reroute.c (git-fixes). - commit b5270ce - selftests/bpf: Fix C++ compile error from missing _Bool type (git-fixes). - commit 736692a - selftests/bpf: Fix error compiling test_lru_map.c (git-fixes). - commit 8aa3099 - selftests/bpf: Fix compile error from rlim_t in sk_storage_map.c (git-fixes). - commit 35f5a49 ++++ kernel-rt: - ipv6: sr: Fix MAC comparison to be constant-time (CVE-2025-39702 bsc#1249317) - commit 3d85c5c - sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718 bsc#1249161) - commit 0083867 - scsi: qla4xxx: Prevent a potential error pointer dereference (CVE-2025-39676 bsc#1249302) - commit a3b8686 - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (git-fixes). - commit f1ec116 - net/mlx5e: Harden uplink netdev access against device unbind (CVE-2025-39947 bsc#1251232). - commit d4278a0 - KVM: x86: Snapshot the host's DEBUGCTL after disabling IRQs (git-fixes). - commit 09e399f - KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (git-fixes). - commit 27a06fc - net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset (git-fixes). - commit ad26239 - r8152: add error handling in rtl8152_driver_init (git-fixes). - commit db73d98 - usbnet: Fix using smp_processor_id() in preemptible code warnings (git-fixes). - commit b2c518b - config.sh: Update IBS project - commit f8ef735 - cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (git-fixes). - commit 149500a - cpuidle: governors: menu: Avoid using invalid recent intervals data (git-fixes). - commit a4ef664 - serial: jsm: fix NPE during jsm_uart_port_init (git fixes, bsc#1246244). - commit 8f7711f - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (git-fixes). - commit baddd40 - selftests/bpf: Fix backtrace printing for selftests crashes (git-fixes). - commit 63e24c4 - tools/resolve_btfids: Fix build when cross compiling kernel with clang (git-fixes). - commit f4f0a36 - samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora (git-fixes). - commit fa036e9 - selftests/bpf: Fix cross-compiling urandom_read (git-fixes). - commit d19eec5 - selftests/bpf: Fix compile if backtrace support missing in libc (git-fixes). - commit 3353a4b - selftests/bpf: Fix redefinition errors compiling lwt_reroute.c (git-fixes). - commit b5270ce - selftests/bpf: Fix C++ compile error from missing _Bool type (git-fixes). - commit 736692a - selftests/bpf: Fix error compiling test_lru_map.c (git-fixes). - commit 8aa3099 - selftests/bpf: Fix compile error from rlim_t in sk_storage_map.c (git-fixes). - commit 35f5a49 ++++ kernel-rt_debug: - ipv6: sr: Fix MAC comparison to be constant-time (CVE-2025-39702 bsc#1249317) - commit 3d85c5c - sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718 bsc#1249161) - commit 0083867 - scsi: qla4xxx: Prevent a potential error pointer dereference (CVE-2025-39676 bsc#1249302) - commit a3b8686 - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (git-fixes). - commit f1ec116 - net/mlx5e: Harden uplink netdev access against device unbind (CVE-2025-39947 bsc#1251232). - commit d4278a0 - KVM: x86: Snapshot the host's DEBUGCTL after disabling IRQs (git-fixes). - commit 09e399f - KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (git-fixes). - commit 27a06fc - net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset (git-fixes). - commit ad26239 - r8152: add error handling in rtl8152_driver_init (git-fixes). - commit db73d98 - usbnet: Fix using smp_processor_id() in preemptible code warnings (git-fixes). - commit b2c518b - config.sh: Update IBS project - commit f8ef735 - cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (git-fixes). - commit 149500a - cpuidle: governors: menu: Avoid using invalid recent intervals data (git-fixes). - commit a4ef664 - serial: jsm: fix NPE during jsm_uart_port_init (git fixes, bsc#1246244). - commit 8f7711f - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (git-fixes). - commit baddd40 - selftests/bpf: Fix backtrace printing for selftests crashes (git-fixes). - commit 63e24c4 - tools/resolve_btfids: Fix build when cross compiling kernel with clang (git-fixes). - commit f4f0a36 - samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora (git-fixes). - commit fa036e9 - selftests/bpf: Fix cross-compiling urandom_read (git-fixes). - commit d19eec5 - selftests/bpf: Fix compile if backtrace support missing in libc (git-fixes). - commit 3353a4b - selftests/bpf: Fix redefinition errors compiling lwt_reroute.c (git-fixes). - commit b5270ce - selftests/bpf: Fix C++ compile error from missing _Bool type (git-fixes). - commit 736692a - selftests/bpf: Fix error compiling test_lru_map.c (git-fixes). - commit 8aa3099 - selftests/bpf: Fix compile error from rlim_t in sk_storage_map.c (git-fixes). - commit 35f5a49 ------------------------------------------------------------------ ------------------ 2025-10-19 - Oct 19 2025 ------------------- ------------------------------------------------------------------ ++++ util-linux-systemd: - lscpu: Add support for NVIDIA Olympus arm64 core (jsc#PED-13682, util-linux-lscpu-add-arm64-NVIDIA-Olympus.patch). ++++ util-linux: - lscpu: Add support for NVIDIA Olympus arm64 core (jsc#PED-13682, util-linux-lscpu-add-arm64-NVIDIA-Olympus.patch). ------------------------------------------------------------------ ------------------ 2025-10-17 - Oct 17 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - perf/core: Fix the WARN_ON_ONCE is out of lock protected region (git-fixes). - perf/x86/intel: Fix crash in icl_update_topdown_event() (git-fixes). - perf/x86: Fix non-sampling (counting) events on certain x86 platforms (git-fixes). - commit 814983a - doc/README.SUSE: Correct the character used for TAINT_NO_SUPPORT The character was previously 'N', but upstream used it for TAINT_TEST, which prompted the change of TAINT_NO_SUPPORT to 'n'. This occurred in commit c35dc3823d08 ("Update to 6.0-rc1") on master and in d016c04d731d ("Bump to 6.4 kernel (jsc#PED-4593)") for SLE15-SP6 (and onwards). Update the documentation to reflect this change. - commit f42ecf5 - ACPI: property: Do not pass NULL handles to acpi_attach_data() (stable-fixes git-fixes). - commit 19fb175 - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (stable-fixes). - commit d0f4111 - cpufreq: CPPC: fix perf_to_khz/khz_to_perf conversion exception (git-fixes). - commit 59c2171 - ACPI: x86: Move acpi_quirk_skip_serdev_enumeration() out of CONFIG_X86_ANDROID_TABLETS (stable-fixes). - commit 793bb70 - cpuidle: qcom-spm: fix device and OF node leaks at probe (git-fixes). - commit 39be628 - cpuidle: menu: Avoid discarding useful information (stable-fixes). - commit b136410 - cpufreq: tegra186: Set target frequency for all cpus in policy (git-fixes). - commit e1cfca8 - cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (stable-fixes git-fixes). - commit 8b10f36 - cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (stable-fixes git-fixes). - commit 3e7dc0b - cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs (stable-fixes). - commit 2dde40f - tcp_bpf: Fix copied value in tcp_bpf_sendmsg (bsc#1250650). - skmsg: Return copied bytes in sk_msg_memcopy_from_iter (bsc#1250650). - commit 5925a0e - sched/idle: Conditionally handle tick broadcast in default_idle_call() (bsc#1248517). - Update config files. - commit 1a58311 - x86/idle: Sanitize X86_BUG_AMD_E400 handling (bsc#1248517). - Refresh patches.suse/x86-tdx-Fix-arch_safe_halt-execution-for-TDX-VMs.patch. - commit be42a2d ++++ kernel-rt: - perf/core: Fix the WARN_ON_ONCE is out of lock protected region (git-fixes). - perf/x86/intel: Fix crash in icl_update_topdown_event() (git-fixes). - perf/x86: Fix non-sampling (counting) events on certain x86 platforms (git-fixes). - commit 814983a - doc/README.SUSE: Correct the character used for TAINT_NO_SUPPORT The character was previously 'N', but upstream used it for TAINT_TEST, which prompted the change of TAINT_NO_SUPPORT to 'n'. This occurred in commit c35dc3823d08 ("Update to 6.0-rc1") on master and in d016c04d731d ("Bump to 6.4 kernel (jsc#PED-4593)") for SLE15-SP6 (and onwards). Update the documentation to reflect this change. - commit f42ecf5 - ACPI: property: Do not pass NULL handles to acpi_attach_data() (stable-fixes git-fixes). - commit 19fb175 - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (stable-fixes). - commit d0f4111 - cpufreq: CPPC: fix perf_to_khz/khz_to_perf conversion exception (git-fixes). - commit 59c2171 - ACPI: x86: Move acpi_quirk_skip_serdev_enumeration() out of CONFIG_X86_ANDROID_TABLETS (stable-fixes). - commit 793bb70 - cpuidle: qcom-spm: fix device and OF node leaks at probe (git-fixes). - commit 39be628 - cpuidle: menu: Avoid discarding useful information (stable-fixes). - commit b136410 - cpufreq: tegra186: Set target frequency for all cpus in policy (git-fixes). - commit e1cfca8 - cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (stable-fixes git-fixes). - commit 8b10f36 - cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (stable-fixes git-fixes). - commit 3e7dc0b - cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs (stable-fixes). - commit 2dde40f - tcp_bpf: Fix copied value in tcp_bpf_sendmsg (bsc#1250650). - skmsg: Return copied bytes in sk_msg_memcopy_from_iter (bsc#1250650). - commit 5925a0e - sched/idle: Conditionally handle tick broadcast in default_idle_call() (bsc#1248517). - Update config files. - commit 1a58311 - x86/idle: Sanitize X86_BUG_AMD_E400 handling (bsc#1248517). - Refresh patches.suse/x86-tdx-Fix-arch_safe_halt-execution-for-TDX-VMs.patch. - commit be42a2d ++++ kernel-rt_debug: - perf/core: Fix the WARN_ON_ONCE is out of lock protected region (git-fixes). - perf/x86/intel: Fix crash in icl_update_topdown_event() (git-fixes). - perf/x86: Fix non-sampling (counting) events on certain x86 platforms (git-fixes). - commit 814983a - doc/README.SUSE: Correct the character used for TAINT_NO_SUPPORT The character was previously 'N', but upstream used it for TAINT_TEST, which prompted the change of TAINT_NO_SUPPORT to 'n'. This occurred in commit c35dc3823d08 ("Update to 6.0-rc1") on master and in d016c04d731d ("Bump to 6.4 kernel (jsc#PED-4593)") for SLE15-SP6 (and onwards). Update the documentation to reflect this change. - commit f42ecf5 - ACPI: property: Do not pass NULL handles to acpi_attach_data() (stable-fixes git-fixes). - commit 19fb175 - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (stable-fixes). - commit d0f4111 - cpufreq: CPPC: fix perf_to_khz/khz_to_perf conversion exception (git-fixes). - commit 59c2171 - ACPI: x86: Move acpi_quirk_skip_serdev_enumeration() out of CONFIG_X86_ANDROID_TABLETS (stable-fixes). - commit 793bb70 - cpuidle: qcom-spm: fix device and OF node leaks at probe (git-fixes). - commit 39be628 - cpuidle: menu: Avoid discarding useful information (stable-fixes). - commit b136410 - cpufreq: tegra186: Set target frequency for all cpus in policy (git-fixes). - commit e1cfca8 - cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (stable-fixes git-fixes). - commit 8b10f36 - cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (stable-fixes git-fixes). - commit 3e7dc0b - cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs (stable-fixes). - commit 2dde40f - tcp_bpf: Fix copied value in tcp_bpf_sendmsg (bsc#1250650). - skmsg: Return copied bytes in sk_msg_memcopy_from_iter (bsc#1250650). - commit 5925a0e - sched/idle: Conditionally handle tick broadcast in default_idle_call() (bsc#1248517). - Update config files. - commit 1a58311 - x86/idle: Sanitize X86_BUG_AMD_E400 handling (bsc#1248517). - Refresh patches.suse/x86-tdx-Fix-arch_safe_halt-execution-for-TDX-VMs.patch. - commit be42a2d ++++ freetype2: - package FTL.TXT and GPLv2.TXT [bsc#1252148] ++++ opensuse-migration-tool: - Update to version 20251017.e28f94c: * fix: remove the check for x86-64-v3 flag xsave from the v2 check ------------------------------------------------------------------ ------------------ 2025-10-16 - Oct 16 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - perf/aux: Fix pending disable flow when the AUX ring buffer overruns (git-fixes). - perf/core: Fix WARN in perf_cgroup_switch() (git-fixes). - perf: Fix cgroup state vs ERROR (git-fixes). - perf/core: Fix broken throttling when max_samples_per_tick=1 (git-fixes). - perf: Ensure bpf_perf_link path is properly serialized (git-fixes). - perf/x86/intel: Only check the group flag for X86 leader (git-fixes). - perf/x86/intel: Allow to update user space GPRs from PEBS records (git-fixes). - perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR (git-fixes). - perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX (git-fixes). - perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR (git-fixes). - perf/core: Fix child_total_time_enabled accounting bug at task exit (git-fixes). - perf/ring_buffer: Allow the EPOLLRDNORM flag for poll (git-fixes). - perf/bpf: Robustify perf_event_free_bpf_prog() (git-fixes). - perf/hw_breakpoint: Return EOPNOTSUPP for unsupported breakpoint type (git-fixes). - perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read (git-fixes). - perf/x86/intel: Apply static call for drain_pebs (git-fixes). - perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt (git-fixes). - perf/amd/ibs: Fix ->config to sample period calculation for OP PMU (git-fixes). - perf/core: Fix pmus_lock vs. pmus_srcu ordering (git-fixes). - perf/x86/intel: Use better start period for frequency mode (git-fixes). - perf/core: Fix low freq setting via IOC_PERIOD (git-fixes). - perf/x86: Fix low freqency setting issue (git-fixes). - perf/x86/intel/ds: Unconditionally drain PEBS DS when changing PEBS_DATA_CFG (git-fixes). - perf/x86/amd: Warn only on new bits set (git-fixes). - s390: Initialize psw mask in perf_arch_fetch_caller_regs() (git-fixes). - perf/core: Fix small negative period being ignored (git-fixes). - perf: Extract a few helpers (git-fixes). - perf/x86/intel/pt: Fix sampling synchronization (git-fixes). - perf/x86/intel: Allow to setup LBR for counting event for BPF (git-fixes). - drivers/perf: arm_spe: Use perf_allow_kernel() for permissions (git-fixes). - perf/amd: Prevent grouping of IBS events (git-fixes). - commit 76eb280 - tls: make sure to abort the stream if headers are bogus (CVE-2025-39946 bsc#1251114). - commit d62deaa - selftests/bpf: Fix error compiling tc_redirect.c with musl libc (git-fixes). - commit b2a359c - selftests/bpf: Fix errors compiling cg_storage_multi.h with musl libc (git-fixes). - commit 799529b - selftests/bpf: Fix errors compiling decap_sanity.c with musl libc (git-fixes). - commit f14b275 - selftests/bpf: Fix errors compiling lwt_redirect.c with musl libc (git-fixes). - commit 498999e - selftests/bpf: Fix compiling core_reloc.c with musl-libc (git-fixes). - commit eb3a7bd - selftests/bpf: Fix compiling tcp_rtt.c with musl-libc (git-fixes). - commit 109e7cc - selftests/bpf: Fix compiling flow_dissector.c with musl-libc (git-fixes). - commit 9b43d04 - selftests/bpf: Fix compiling kfree_skb.c with musl-libc (git-fixes). - commit 442e8bf - selftests/bpf: Fix compiling parse_tcp_hdr_opt.c with musl-libc (git-fixes). - commit 1f65169 - selftests/bpf: Fix error compiling bpf_iter_setsockopt.c with musl libc (git-fixes). - commit 7613608 - selftests/bpf: Add test for unpinning htab with internal timer struct (git-fixes). - commit 8a1df26 - bpf: Avoid RCU context warning when unpinning htab with internal structs (git-fixes). - commit 73d4d2d - bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (git-fixes). - commit 1a82fe5 - kabi: hide new member allow_subflows in struct mptcp_sock (CVE-2025-38552 bsc#1248230). - commit f51a25e - mptcp: plug races between subflow fail and subflow creation (CVE-2025-38552 bsc#1248230). - Refresh patches.kabi/kabi-hide-new-member-fallback_lock-in-struct-mptcp_s.patch. (also delete outdated part of a comment) - commit fdbbed8 ++++ kernel-rt: - perf/aux: Fix pending disable flow when the AUX ring buffer overruns (git-fixes). - perf/core: Fix WARN in perf_cgroup_switch() (git-fixes). - perf: Fix cgroup state vs ERROR (git-fixes). - perf/core: Fix broken throttling when max_samples_per_tick=1 (git-fixes). - perf: Ensure bpf_perf_link path is properly serialized (git-fixes). - perf/x86/intel: Only check the group flag for X86 leader (git-fixes). - perf/x86/intel: Allow to update user space GPRs from PEBS records (git-fixes). - perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR (git-fixes). - perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX (git-fixes). - perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR (git-fixes). - perf/core: Fix child_total_time_enabled accounting bug at task exit (git-fixes). - perf/ring_buffer: Allow the EPOLLRDNORM flag for poll (git-fixes). - perf/bpf: Robustify perf_event_free_bpf_prog() (git-fixes). - perf/hw_breakpoint: Return EOPNOTSUPP for unsupported breakpoint type (git-fixes). - perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read (git-fixes). - perf/x86/intel: Apply static call for drain_pebs (git-fixes). - perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt (git-fixes). - perf/amd/ibs: Fix ->config to sample period calculation for OP PMU (git-fixes). - perf/core: Fix pmus_lock vs. pmus_srcu ordering (git-fixes). - perf/x86/intel: Use better start period for frequency mode (git-fixes). - perf/core: Fix low freq setting via IOC_PERIOD (git-fixes). - perf/x86: Fix low freqency setting issue (git-fixes). - perf/x86/intel/ds: Unconditionally drain PEBS DS when changing PEBS_DATA_CFG (git-fixes). - perf/x86/amd: Warn only on new bits set (git-fixes). - s390: Initialize psw mask in perf_arch_fetch_caller_regs() (git-fixes). - perf/core: Fix small negative period being ignored (git-fixes). - perf: Extract a few helpers (git-fixes). - perf/x86/intel/pt: Fix sampling synchronization (git-fixes). - perf/x86/intel: Allow to setup LBR for counting event for BPF (git-fixes). - drivers/perf: arm_spe: Use perf_allow_kernel() for permissions (git-fixes). - perf/amd: Prevent grouping of IBS events (git-fixes). - commit 76eb280 - tls: make sure to abort the stream if headers are bogus (CVE-2025-39946 bsc#1251114). - commit d62deaa - selftests/bpf: Fix error compiling tc_redirect.c with musl libc (git-fixes). - commit b2a359c - selftests/bpf: Fix errors compiling cg_storage_multi.h with musl libc (git-fixes). - commit 799529b - selftests/bpf: Fix errors compiling decap_sanity.c with musl libc (git-fixes). - commit f14b275 - selftests/bpf: Fix errors compiling lwt_redirect.c with musl libc (git-fixes). - commit 498999e - selftests/bpf: Fix compiling core_reloc.c with musl-libc (git-fixes). - commit eb3a7bd - selftests/bpf: Fix compiling tcp_rtt.c with musl-libc (git-fixes). - commit 109e7cc - selftests/bpf: Fix compiling flow_dissector.c with musl-libc (git-fixes). - commit 9b43d04 - selftests/bpf: Fix compiling kfree_skb.c with musl-libc (git-fixes). - commit 442e8bf - selftests/bpf: Fix compiling parse_tcp_hdr_opt.c with musl-libc (git-fixes). - commit 1f65169 - selftests/bpf: Fix error compiling bpf_iter_setsockopt.c with musl libc (git-fixes). - commit 7613608 - selftests/bpf: Add test for unpinning htab with internal timer struct (git-fixes). - commit 8a1df26 - bpf: Avoid RCU context warning when unpinning htab with internal structs (git-fixes). - commit 73d4d2d - bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (git-fixes). - commit 1a82fe5 - kabi: hide new member allow_subflows in struct mptcp_sock (CVE-2025-38552 bsc#1248230). - commit f51a25e - mptcp: plug races between subflow fail and subflow creation (CVE-2025-38552 bsc#1248230). - Refresh patches.kabi/kabi-hide-new-member-fallback_lock-in-struct-mptcp_s.patch. (also delete outdated part of a comment) - commit fdbbed8 ++++ kernel-rt_debug: - perf/aux: Fix pending disable flow when the AUX ring buffer overruns (git-fixes). - perf/core: Fix WARN in perf_cgroup_switch() (git-fixes). - perf: Fix cgroup state vs ERROR (git-fixes). - perf/core: Fix broken throttling when max_samples_per_tick=1 (git-fixes). - perf: Ensure bpf_perf_link path is properly serialized (git-fixes). - perf/x86/intel: Only check the group flag for X86 leader (git-fixes). - perf/x86/intel: Allow to update user space GPRs from PEBS records (git-fixes). - perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR (git-fixes). - perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX (git-fixes). - perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR (git-fixes). - perf/core: Fix child_total_time_enabled accounting bug at task exit (git-fixes). - perf/ring_buffer: Allow the EPOLLRDNORM flag for poll (git-fixes). - perf/bpf: Robustify perf_event_free_bpf_prog() (git-fixes). - perf/hw_breakpoint: Return EOPNOTSUPP for unsupported breakpoint type (git-fixes). - perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read (git-fixes). - perf/x86/intel: Apply static call for drain_pebs (git-fixes). - perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt (git-fixes). - perf/amd/ibs: Fix ->config to sample period calculation for OP PMU (git-fixes). - perf/core: Fix pmus_lock vs. pmus_srcu ordering (git-fixes). - perf/x86/intel: Use better start period for frequency mode (git-fixes). - perf/core: Fix low freq setting via IOC_PERIOD (git-fixes). - perf/x86: Fix low freqency setting issue (git-fixes). - perf/x86/intel/ds: Unconditionally drain PEBS DS when changing PEBS_DATA_CFG (git-fixes). - perf/x86/amd: Warn only on new bits set (git-fixes). - s390: Initialize psw mask in perf_arch_fetch_caller_regs() (git-fixes). - perf/core: Fix small negative period being ignored (git-fixes). - perf: Extract a few helpers (git-fixes). - perf/x86/intel/pt: Fix sampling synchronization (git-fixes). - perf/x86/intel: Allow to setup LBR for counting event for BPF (git-fixes). - drivers/perf: arm_spe: Use perf_allow_kernel() for permissions (git-fixes). - perf/amd: Prevent grouping of IBS events (git-fixes). - commit 76eb280 - tls: make sure to abort the stream if headers are bogus (CVE-2025-39946 bsc#1251114). - commit d62deaa - selftests/bpf: Fix error compiling tc_redirect.c with musl libc (git-fixes). - commit b2a359c - selftests/bpf: Fix errors compiling cg_storage_multi.h with musl libc (git-fixes). - commit 799529b - selftests/bpf: Fix errors compiling decap_sanity.c with musl libc (git-fixes). - commit f14b275 - selftests/bpf: Fix errors compiling lwt_redirect.c with musl libc (git-fixes). - commit 498999e - selftests/bpf: Fix compiling core_reloc.c with musl-libc (git-fixes). - commit eb3a7bd - selftests/bpf: Fix compiling tcp_rtt.c with musl-libc (git-fixes). - commit 109e7cc - selftests/bpf: Fix compiling flow_dissector.c with musl-libc (git-fixes). - commit 9b43d04 - selftests/bpf: Fix compiling kfree_skb.c with musl-libc (git-fixes). - commit 442e8bf - selftests/bpf: Fix compiling parse_tcp_hdr_opt.c with musl-libc (git-fixes). - commit 1f65169 - selftests/bpf: Fix error compiling bpf_iter_setsockopt.c with musl libc (git-fixes). - commit 7613608 - selftests/bpf: Add test for unpinning htab with internal timer struct (git-fixes). - commit 8a1df26 - bpf: Avoid RCU context warning when unpinning htab with internal structs (git-fixes). - commit 73d4d2d - bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (git-fixes). - commit 1a82fe5 - kabi: hide new member allow_subflows in struct mptcp_sock (CVE-2025-38552 bsc#1248230). - commit f51a25e - mptcp: plug races between subflow fail and subflow creation (CVE-2025-38552 bsc#1248230). - Refresh patches.kabi/kabi-hide-new-member-fallback_lock-in-struct-mptcp_s.patch. (also delete outdated part of a comment) - commit fdbbed8 ++++ libsoup: - Update libsoup-CVE-2025-11021.patch: Add NULL check for soup_date_time_to_string() (bsc#1250562, CVE-2025-11021, glgo#GNOME/libsoup!483). ++++ nvidia-open-driver-G06-signed: - renamed check to %name-check package ++++ runc: [ This update was only released for SLE 12 and 15. ] - Backport patches for three CVEs. All three vulnerabilities ultimately allow (through different methods) for full container breakouts by bypassing runc's restrictions for writing to arbitrary /proc files. bsc#1252232 * CVE-2025-31133 * CVE-2025-52565 * CVE-2025-52881 + 2025-11-05-CVEs.patch ------------------------------------------------------------------ ------------------ 2025-10-15 - Oct 15 2025 ------------------- ------------------------------------------------------------------ ++++ kernel-default: - Update patches.suse/ALSA-ac97-Fix-possible-NULL-dereference-in-snd_.patch (bsc#1012628 CVE-2023-53648 bsc#1251750). - Update patches.suse/ASoC-codecs-wcd938x-fix-missing-mbhc-init-error.patch (bsc#1012628 CVE-2023-53666 bsc#1251760). - Update patches.suse/ASoC-qcom-q6apm-lpass-dais-Fix-NULL-pointer-derefere.patch (git-fixes CVE-2025-39938 bsc#1251134). - Update patches.suse/Bluetooth-hci_event-call-disconnect-callback-be.patch (bsc#1012628 CVE-2023-53673 bsc#1251763). - Update patches.suse/HID-hyperv-avoid-struct-memcpy-overrun-warning.patch (bsc#1012628 CVE-2023-53553 bsc#1251068). - Update patches.suse/KVM-nSVM-Check-instead-of-asserting-on-nested-TSC-sc.patch (git-fixes CVE-2023-53663 bsc#1251290). - Update patches.suse/RDMA-rxe-Fix-incomplete-state-save-in-rxe_requester.patch (git-fixes CVE-2023-53539 bsc#1251060). - Update patches.suse/USB-Gadget-core-Help-prevent-panic-during-UVC-.patch (bsc#1012628 CVE-2023-53580 bsc#1251105). - Update patches.suse/accel-qaic-Fix-a-leak-in-map_user_pages.patch (bsc#1012628 CVE-2023-53633 bsc#1251746). - Update patches.suse/bcache-Fix-__bch_btree_node_alloc-to-make-the-f.patch (bsc#1012628 CVE-2023-53681 bsc#1251769). - Update patches.suse/bonding-do-not-assume-skb-mac_header-is-set.patch (bsc#1012628 CVE-2023-53601 bsc#1251153). - Update patches.suse/bpf-Make-bpf_refcount_acquire-fallible-for-non-.patch (bsc#1012628 CVE-2023-53645 bsc#1251321). - Update patches.suse/bpf-cpumap-Handle-skb-as-well-when-clean-up-pt.patch (bsc#1012628 CVE-2023-53660 bsc#1251721). - Update patches.suse/bpf-cpumap-Make-sure-kthread-is-running-before.patch (bsc#1012628 CVE-2023-53577 bsc#1251028). - Update patches.suse/bpf-reject-unhashed-sockets-in-bpf_sk_assign.patch (jsc#PED-6811 CVE-2023-53585 bsc#1251126). - Update patches.suse/btrfs-insert-tree-mod-log-move-in-push_node_lef.patch (bsc#1012628 CVE-2023-53538 bsc#1251024). - Update patches.suse/btrfs-output-extra-debug-info-if-we-failed-to-find-a.patch (git-fixes CVE-2023-53672 bsc#1251780). - Update patches.suse/btrfs-reject-invalid-reloc-tree-root-keys-with.patch (bsc#1012628 CVE-2023-53618 bsc#1251748). - Update patches.suse/cifs-Release-folio-lock-on-fscache-read-hit.patch (bsc#1012628 CVE-2023-53593 bsc#1251132). - Update patches.suse/cifs-fix-mid-leak-during-reconnection-after-tim.patch (bsc#1012628 CVE-2023-53597 bsc#1251159). - Update patches.suse/clk-Fix-memory-leak-in-devm_clk_notifier_regist.patch (bsc#1012628 CVE-2023-53674 bsc#1251764). - Update patches.suse/clk-imx-scu-use-_safe-list-iterator-to-avoid-a-.patch (bsc#1012628 CVE-2023-53572 bsc#1251027). - Update patches.suse/cpufreq-amd-pstate-fix-global-sysfs-attribute-.patch (bsc#1012628 CVE-2023-53550 bsc#1251071). - Update patches.suse/cpufreq-amd-pstate-ut-Fix-kernel-panic-when-loading-.patch (git-fixes CVE-2023-53563 bsc#1251038). - Update patches.suse/crypto-af_alg-Fix-missing-initialisation-affecting-g.patch (bsc#1216396 CVE-2023-53599 bsc#1251150). - Update patches.suse/crypto-af_alg-Set-merge-to-zero-early-in-af_alg_send.patch (git-fixes CVE-2025-39931 bsc#1251100). - Update patches.suse/dax-Fix-dax_mapping_release-use-after-free.patch (bsc#1012628 CVE-2023-53613 bsc#1251119). - Update patches.suse/drivers-base-Free-devm-resources-when-unregistering-.patch (jsc#PED-6054 CVE-2023-53596 bsc#1251161). - Update patches.suse/drivers-perf-hisi-Don-t-migrate-perf-to-the-CPU.patch (bsc#1012628 CVE-2023-53656 bsc#1251758). - Update patches.suse/drm-amdgpu-unmap-and-remove-csa_va-properly.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-53545 bsc#1251084). - Update patches.suse/drm-bridge-anx7625-Fix-NULL-pointer-dereference-with.patch (git-fixes CVE-2025-39934 bsc#1251146). - Update patches.suse/drm-i915-mark-requests-for-GuC-virtual-engines-to-av.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-53552 bsc#1251065). - Update patches.suse/drm-i915-perf-add-sentinel-to-xehp_oa_b_counter.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-53646 bsc#1251742). - Update patches.suse/ext4-fix-memory-leaks-in-ext4_fname_-setup_filename-.patch (bsc#1214954 CVE-2023-53662 bsc#1251282). - Update patches.suse/fbdev-omapfb-lcd_mipid-Fix-an-error-handling-pa.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-53650 bsc#1251283). - Update patches.suse/fprobe-Release-rethook-after-the-ftrace_ops-is-.patch (bsc#1012628 CVE-2023-53557 bsc#1251054). - Update patches.suse/gfs2-Fix-possible-data-races-in-gfs2_show_opti.patch (bsc#1012628 CVE-2023-53622 bsc#1251777). - Update patches.suse/gpio-mvebu-fix-irq-domain-leak.patch (bsc#1012628 CVE-2023-53579 bsc#1251170). - Update patches.suse/iavf-Fix-out-of-bounds-when-setting-channels-on.patch (bsc#1012628 CVE-2023-53659 bsc#1251247). - Update patches.suse/iavf-Fix-use-after-free-in-free_netdev.patch (bsc#1012628 CVE-2023-53556 bsc#1251059). - Update patches.suse/ice-Don-t-tx-before-switchdev-is-fully-configured.patch (jsc#PED-4876 CVE-2023-53657 bsc#1251319). - Update patches.suse/ip_vti-fix-potential-slab-use-after-free-in-de.patch (bsc#1012628 CVE-2023-53559 bsc#1251052). - Update patches.suse/ipmi_si-fix-a-memleak-in-try_smi_init.patch (git-fixes CVE-2023-53611 bsc#1251123). - Update patches.suse/jfs-fix-invalid-free-of-JFS_IP-ipimap-i_imap-in-diUnmount.patch (git-fixes CVE-2023-53616 bsc#1251215). - Update patches.suse/md-don-t-dereference-mddev-after-export_rdev-7dea.patch (jsc#PED-7542 CVE-2023-53665 bsc#1251270). - Update patches.suse/media-amphion-fix-REVERSE_INULL-issues-reported-by-c.patch (git-fixes CVE-2023-53653 bsc#1251755). - Update patches.suse/memcontrol-ensure-memcg-acquired-by-id-is-properly-s.patch (git-fixes CVE-2023-53621 bsc#1251323). - Update patches.suse/mm-damon-core-initialize-damo_filter-list-from.patch (bsc#1012628 CVE-2023-53555 bsc#1251056). - Update patches.suse/msft-hv-2870-Drivers-hv-vmbus-Don-t-dereference-ACPI-root-object-.patch (git-fixes CVE-2023-53647 bsc#1251732). - Update patches.suse/mtd-rawnand-brcmnand-Fix-potential-out-of-bounds-acc.patch (git-fixes CVE-2023-53541 bsc#1251043). - Update patches.suse/net-handshake-fix-null-ptr-deref-in-handshake_nl_don.patch (bsc#1220419 CVE-2023-53686 bsc#1251771). - Update patches.suse/net-mlx5-DR-fix-memory-leak-in-mlx5dr_cmd_crea.patch (bsc#1012628 CVE-2023-53546 bsc#1251079). - Update patches.suse/net-mlx5e-Check-for-NOT_READY-flag-state-after-.patch (bsc#1012628 CVE-2023-53581 bsc#1251106). - Update patches.suse/net-mlx5e-Take-RTNL-lock-when-needed-before-ca.patch (bsc#1012628 CVE-2023-53632 bsc#1251269). - Update patches.suse/net-rfkill-gpio-Fix-crash-due-to-dereferencering-uni.patch (git-fixes CVE-2025-39937 bsc#1251143). - Update patches.suse/net-usbnet-Fix-WARNING-in-usbnet_start_xmit-us.patch (bsc#1012628 CVE-2023-53548 bsc#1251066). - Update patches.suse/netfilter-conntrack-Avoid-nf_ct_helper_hash-use.patch (bsc#1012628 CVE-2023-53619 bsc#1251743). - Update patches.suse/nvme-core-fix-dev_pm_qos-memleak.patch (bsc#1012628 CVE-2023-53670 bsc#1251762). - Update patches.suse/octeon_ep-cancel-queued-works-in-probe-error-p.patch (bsc#1012628 CVE-2023-53638 bsc#1251328). - Update patches.suse/octeontx2-af-Add-validation-before-accessing-cg.patch (bsc#1012628 CVE-2023-53654 bsc#1251756). - Update patches.suse/perf-RISC-V-Remove-PERF_HES_STOPPED-flag-checki.patch (bsc#1012628 CVE-2023-53583 bsc#1251108). - Update patches.suse/perf-trace-Really-free-the-evsel-priv-area.patch (perf-v6.7 (jsc#PED-6012 jsc#PED-6121) CVE-2023-53649 bsc#1251749). - Update patches.suse/platform-x86-dell-sysman-Fix-reference-leak.patch (git-fixes CVE-2023-53631 bsc#1251529). - Update patches.suse/rcu-tasks-Avoid-pr_info-with-spin-lock-in-cblis.patch (bsc#1012628 CVE-2023-53558 bsc#1251081). - Update patches.suse/ring-buffer-Fix-deadloop-issue-on-reading-trace.patch (bsc#1012628 CVE-2023-53668 bsc#1251286). - Update patches.suse/s390-zcrypt-don-t-leak-memory-if-dev_set_name-fails.patch (git-fixes bsc#1215143 CVE-2023-53568 bsc#1251035). - Update patches.suse/scsi-qla2xxx-Avoid-fcport-pointer-dereference.patch (bsc#1012628 CVE-2023-53603 bsc#1251180). - Update patches.suse/scsi-qla2xxx-Fix-deletion-race-condition.patch (git-fixes CVE-2023-53615 bsc#1251113). - Update patches.suse/soc-aspeed-socinfo-Add-kfree-for-kstrdup.patch (bsc#1012628 CVE-2023-53617 bsc#1251268). - Update patches.suse/spi-bcm-qspi-return-error-if-neither-hif_mspi-n.patch (bsc#1012628 CVE-2023-53658 bsc#1251759). - Update patches.suse/staging-ks7010-potential-buffer-overflow-in-ks_.patch (bsc#1012628 CVE-2023-53554 bsc#1251057). - Update patches.suse/tracing-histograms-Add-histograms-to-hist_vars-.patch (bsc#1012628 CVE-2023-53560 bsc#1251045). - Update patches.suse/tty-serial-samsung_tty-Fix-a-memory-leak-in-s3c-832e231.patch (bsc#1012628 CVE-2023-53687 bsc#1251772). - Update patches.suse/tunnels-fix-kasan-splat-when-generating-ipv4-p.patch (bsc#1012628 CVE-2023-53600 bsc#1251152). - Update patches.suse/vdpa-Add-features-attr-to-vdpa_nl_policy-for-n.patch (bsc#1012628 CVE-2023-53652 bsc#1251754). - Update patches.suse/vdpa-Add-max-vqp-attr-to-vdpa_nl_policy-for-nl.patch (bsc#1012628 CVE-2023-53543 bsc#1251083). - Update patches.suse/wifi-ath11k-fix-memory-leak-in-WMI-firmware-sta.patch (bsc#1012628 CVE-2023-53602 bsc#1251076). - Update patches.suse/wifi-cfg80211-reject-auth-assoc-to-AP-with-our-addre.patch (git-fixes CVE-2023-53540 bsc#1251053). - Update patches.suse/wifi-iwlwifi-mvm-fix-potential-array-out-of-bou.patch (bsc#1012628 CVE-2023-53575 bsc#1251067). - Update patches.suse/wifi-mac80211-check-for-station-first-in-client-prob.patch (git-fixes CVE-2023-53588 bsc#1251206). - Update patches.suse/wifi-mac80211-increase-scan_ies_len-for-S1G.patch (stable-fixes CVE-2025-39957 bsc#1251810). - Update patches.suse/wifi-nl80211-fix-integer-overflow-in-nl80211_p.patch (bsc#1012628 CVE-2023-53570 bsc#1251031). - Update patches.suse/wifi-rtw88-delete-timer-and-free-skb-queue-when-unlo.patch (git-fixes CVE-2023-53574 bsc#1251222). - Update patches.suse/wifi-wilc1000-avoid-buffer-overflow-in-WID-string-co.patch (stable-fixes CVE-2025-39952 bsc#1251216). - commit 56ea93d - iommu/vt-d: Disallow dirty tracking if incoherent page walk (git-fixes). - iommu/vt-d: PRS isn't usable if PDS isn't supported (git-fixes). - commit 9da1184 - mm/page_alloc: fix race condition in unaccepted memory handling (CVE-2025-38008 bsc#1244939). - commit b445cb1 - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (CVE-2025-39902 bsc#1250702). - commit 46c39b3 - NFSD: Define a proc_layoutcommit for the FlexFiles layout type (git-fixes). - commit b115f79 - tracing: Fix filter string testing (git-fixes). - commit 864d37b - selftests/tracing: Fix event filter test to retry up to 10 times (git-fixes). - commit a9de969 - tracing/selftests: Fix kprobe event name test for .isra. functions (git-fixes). - commit 6a094d4 - bpf: Check link_create.flags parameter for multi_kprobe (git-fixes). - commit 0e75825 - bpf: Check link_create.flags parameter for multi_uprobe (git-fixes). - commit 10550c7 - ftrace: fix incorrect hash size in register_ftrace_direct() (git-fixes). - commit 9288055 - bpf: Use preempt_count() directly in bpf_send_signal_common() (git-fixes). - commit 9258f2a - tracing: Correct the refcount if the hist/hist_debug file fails to open (git-fixes). - commit 6e8ac35 - module: Prevent silent truncation of module name in delete_module(2) (git-fixes). - commit 44dc7b7 - tracing: Add down_write(trace_event_sem) when adding trace event (bsc#1248211 CVE-2025-38539). - commit b1816b0 - tracing: Limit access to parser->buffer when trace_get_user failed (bsc#1249286 CVE-2025-39683). - tracing: Remove unneeded goto out logic (bsc#1249286). - commit 8eaad3a ++++ kernel-rt: - Update patches.suse/ALSA-ac97-Fix-possible-NULL-dereference-in-snd_.patch (bsc#1012628 CVE-2023-53648 bsc#1251750). - Update patches.suse/ASoC-codecs-wcd938x-fix-missing-mbhc-init-error.patch (bsc#1012628 CVE-2023-53666 bsc#1251760). - Update patches.suse/ASoC-qcom-q6apm-lpass-dais-Fix-NULL-pointer-derefere.patch (git-fixes CVE-2025-39938 bsc#1251134). - Update patches.suse/Bluetooth-hci_event-call-disconnect-callback-be.patch (bsc#1012628 CVE-2023-53673 bsc#1251763). - Update patches.suse/HID-hyperv-avoid-struct-memcpy-overrun-warning.patch (bsc#1012628 CVE-2023-53553 bsc#1251068). - Update patches.suse/KVM-nSVM-Check-instead-of-asserting-on-nested-TSC-sc.patch (git-fixes CVE-2023-53663 bsc#1251290). - Update patches.suse/RDMA-rxe-Fix-incomplete-state-save-in-rxe_requester.patch (git-fixes CVE-2023-53539 bsc#1251060). - Update patches.suse/USB-Gadget-core-Help-prevent-panic-during-UVC-.patch (bsc#1012628 CVE-2023-53580 bsc#1251105). - Update patches.suse/accel-qaic-Fix-a-leak-in-map_user_pages.patch (bsc#1012628 CVE-2023-53633 bsc#1251746). - Update patches.suse/bcache-Fix-__bch_btree_node_alloc-to-make-the-f.patch (bsc#1012628 CVE-2023-53681 bsc#1251769). - Update patches.suse/bonding-do-not-assume-skb-mac_header-is-set.patch (bsc#1012628 CVE-2023-53601 bsc#1251153). - Update patches.suse/bpf-Make-bpf_refcount_acquire-fallible-for-non-.patch (bsc#1012628 CVE-2023-53645 bsc#1251321). - Update patches.suse/bpf-cpumap-Handle-skb-as-well-when-clean-up-pt.patch (bsc#1012628 CVE-2023-53660 bsc#1251721). - Update patches.suse/bpf-cpumap-Make-sure-kthread-is-running-before.patch (bsc#1012628 CVE-2023-53577 bsc#1251028). - Update patches.suse/bpf-reject-unhashed-sockets-in-bpf_sk_assign.patch (jsc#PED-6811 CVE-2023-53585 bsc#1251126). - Update patches.suse/btrfs-insert-tree-mod-log-move-in-push_node_lef.patch (bsc#1012628 CVE-2023-53538 bsc#1251024). - Update patches.suse/btrfs-output-extra-debug-info-if-we-failed-to-find-a.patch (git-fixes CVE-2023-53672 bsc#1251780). - Update patches.suse/btrfs-reject-invalid-reloc-tree-root-keys-with.patch (bsc#1012628 CVE-2023-53618 bsc#1251748). - Update patches.suse/cifs-Release-folio-lock-on-fscache-read-hit.patch (bsc#1012628 CVE-2023-53593 bsc#1251132). - Update patches.suse/cifs-fix-mid-leak-during-reconnection-after-tim.patch (bsc#1012628 CVE-2023-53597 bsc#1251159). - Update patches.suse/clk-Fix-memory-leak-in-devm_clk_notifier_regist.patch (bsc#1012628 CVE-2023-53674 bsc#1251764). - Update patches.suse/clk-imx-scu-use-_safe-list-iterator-to-avoid-a-.patch (bsc#1012628 CVE-2023-53572 bsc#1251027). - Update patches.suse/cpufreq-amd-pstate-fix-global-sysfs-attribute-.patch (bsc#1012628 CVE-2023-53550 bsc#1251071). - Update patches.suse/cpufreq-amd-pstate-ut-Fix-kernel-panic-when-loading-.patch (git-fixes CVE-2023-53563 bsc#1251038). - Update patches.suse/crypto-af_alg-Fix-missing-initialisation-affecting-g.patch (bsc#1216396 CVE-2023-53599 bsc#1251150). - Update patches.suse/crypto-af_alg-Set-merge-to-zero-early-in-af_alg_send.patch (git-fixes CVE-2025-39931 bsc#1251100). - Update patches.suse/dax-Fix-dax_mapping_release-use-after-free.patch (bsc#1012628 CVE-2023-53613 bsc#1251119). - Update patches.suse/drivers-base-Free-devm-resources-when-unregistering-.patch (jsc#PED-6054 CVE-2023-53596 bsc#1251161). - Update patches.suse/drivers-perf-hisi-Don-t-migrate-perf-to-the-CPU.patch (bsc#1012628 CVE-2023-53656 bsc#1251758). - Update patches.suse/drm-amdgpu-unmap-and-remove-csa_va-properly.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-53545 bsc#1251084). - Update patches.suse/drm-bridge-anx7625-Fix-NULL-pointer-dereference-with.patch (git-fixes CVE-2025-39934 bsc#1251146). - Update patches.suse/drm-i915-mark-requests-for-GuC-virtual-engines-to-av.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-53552 bsc#1251065). - Update patches.suse/drm-i915-perf-add-sentinel-to-xehp_oa_b_counter.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-53646 bsc#1251742). - Update patches.suse/ext4-fix-memory-leaks-in-ext4_fname_-setup_filename-.patch (bsc#1214954 CVE-2023-53662 bsc#1251282). - Update patches.suse/fbdev-omapfb-lcd_mipid-Fix-an-error-handling-pa.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-53650 bsc#1251283). - Update patches.suse/fprobe-Release-rethook-after-the-ftrace_ops-is-.patch (bsc#1012628 CVE-2023-53557 bsc#1251054). - Update patches.suse/gfs2-Fix-possible-data-races-in-gfs2_show_opti.patch (bsc#1012628 CVE-2023-53622 bsc#1251777). - Update patches.suse/gpio-mvebu-fix-irq-domain-leak.patch (bsc#1012628 CVE-2023-53579 bsc#1251170). - Update patches.suse/iavf-Fix-out-of-bounds-when-setting-channels-on.patch (bsc#1012628 CVE-2023-53659 bsc#1251247). - Update patches.suse/iavf-Fix-use-after-free-in-free_netdev.patch (bsc#1012628 CVE-2023-53556 bsc#1251059). - Update patches.suse/ice-Don-t-tx-before-switchdev-is-fully-configured.patch (jsc#PED-4876 CVE-2023-53657 bsc#1251319). - Update patches.suse/ip_vti-fix-potential-slab-use-after-free-in-de.patch (bsc#1012628 CVE-2023-53559 bsc#1251052). - Update patches.suse/ipmi_si-fix-a-memleak-in-try_smi_init.patch (git-fixes CVE-2023-53611 bsc#1251123). - Update patches.suse/jfs-fix-invalid-free-of-JFS_IP-ipimap-i_imap-in-diUnmount.patch (git-fixes CVE-2023-53616 bsc#1251215). - Update patches.suse/md-don-t-dereference-mddev-after-export_rdev-7dea.patch (jsc#PED-7542 CVE-2023-53665 bsc#1251270). - Update patches.suse/media-amphion-fix-REVERSE_INULL-issues-reported-by-c.patch (git-fixes CVE-2023-53653 bsc#1251755). - Update patches.suse/memcontrol-ensure-memcg-acquired-by-id-is-properly-s.patch (git-fixes CVE-2023-53621 bsc#1251323). - Update patches.suse/mm-damon-core-initialize-damo_filter-list-from.patch (bsc#1012628 CVE-2023-53555 bsc#1251056). - Update patches.suse/msft-hv-2870-Drivers-hv-vmbus-Don-t-dereference-ACPI-root-object-.patch (git-fixes CVE-2023-53647 bsc#1251732). - Update patches.suse/mtd-rawnand-brcmnand-Fix-potential-out-of-bounds-acc.patch (git-fixes CVE-2023-53541 bsc#1251043). - Update patches.suse/net-handshake-fix-null-ptr-deref-in-handshake_nl_don.patch (bsc#1220419 CVE-2023-53686 bsc#1251771). - Update patches.suse/net-mlx5-DR-fix-memory-leak-in-mlx5dr_cmd_crea.patch (bsc#1012628 CVE-2023-53546 bsc#1251079). - Update patches.suse/net-mlx5e-Check-for-NOT_READY-flag-state-after-.patch (bsc#1012628 CVE-2023-53581 bsc#1251106). - Update patches.suse/net-mlx5e-Take-RTNL-lock-when-needed-before-ca.patch (bsc#1012628 CVE-2023-53632 bsc#1251269). - Update patches.suse/net-rfkill-gpio-Fix-crash-due-to-dereferencering-uni.patch (git-fixes CVE-2025-39937 bsc#1251143). - Update patches.suse/net-usbnet-Fix-WARNING-in-usbnet_start_xmit-us.patch (bsc#1012628 CVE-2023-53548 bsc#1251066). - Update patches.suse/netfilter-conntrack-Avoid-nf_ct_helper_hash-use.patch (bsc#1012628 CVE-2023-53619 bsc#1251743). - Update patches.suse/nvme-core-fix-dev_pm_qos-memleak.patch (bsc#1012628 CVE-2023-53670 bsc#1251762). - Update patches.suse/octeon_ep-cancel-queued-works-in-probe-error-p.patch (bsc#1012628 CVE-2023-53638 bsc#1251328). - Update patches.suse/octeontx2-af-Add-validation-before-accessing-cg.patch (bsc#1012628 CVE-2023-53654 bsc#1251756). - Update patches.suse/perf-RISC-V-Remove-PERF_HES_STOPPED-flag-checki.patch (bsc#1012628 CVE-2023-53583 bsc#1251108). - Update patches.suse/perf-trace-Really-free-the-evsel-priv-area.patch (perf-v6.7 (jsc#PED-6012 jsc#PED-6121) CVE-2023-53649 bsc#1251749). - Update patches.suse/platform-x86-dell-sysman-Fix-reference-leak.patch (git-fixes CVE-2023-53631 bsc#1251529). - Update patches.suse/rcu-tasks-Avoid-pr_info-with-spin-lock-in-cblis.patch (bsc#1012628 CVE-2023-53558 bsc#1251081). - Update patches.suse/ring-buffer-Fix-deadloop-issue-on-reading-trace.patch (bsc#1012628 CVE-2023-53668 bsc#1251286). - Update patches.suse/s390-zcrypt-don-t-leak-memory-if-dev_set_name-fails.patch (git-fixes bsc#1215143 CVE-2023-53568 bsc#1251035). - Update patches.suse/scsi-qla2xxx-Avoid-fcport-pointer-dereference.patch (bsc#1012628 CVE-2023-53603 bsc#1251180). - Update patches.suse/scsi-qla2xxx-Fix-deletion-race-condition.patch (git-fixes CVE-2023-53615 bsc#1251113). - Update patches.suse/soc-aspeed-socinfo-Add-kfree-for-kstrdup.patch (bsc#1012628 CVE-2023-53617 bsc#1251268). - Update patches.suse/spi-bcm-qspi-return-error-if-neither-hif_mspi-n.patch (bsc#1012628 CVE-2023-53658 bsc#1251759). - Update patches.suse/staging-ks7010-potential-buffer-overflow-in-ks_.patch (bsc#1012628 CVE-2023-53554 bsc#1251057). - Update patches.suse/tracing-histograms-Add-histograms-to-hist_vars-.patch (bsc#1012628 CVE-2023-53560 bsc#1251045). - Update patches.suse/tty-serial-samsung_tty-Fix-a-memory-leak-in-s3c-832e231.patch (bsc#1012628 CVE-2023-53687 bsc#1251772). - Update patches.suse/tunnels-fix-kasan-splat-when-generating-ipv4-p.patch (bsc#1012628 CVE-2023-53600 bsc#1251152). - Update patches.suse/vdpa-Add-features-attr-to-vdpa_nl_policy-for-n.patch (bsc#1012628 CVE-2023-53652 bsc#1251754). - Update patches.suse/vdpa-Add-max-vqp-attr-to-vdpa_nl_policy-for-nl.patch (bsc#1012628 CVE-2023-53543 bsc#1251083). - Update patches.suse/wifi-ath11k-fix-memory-leak-in-WMI-firmware-sta.patch (bsc#1012628 CVE-2023-53602 bsc#1251076). - Update patches.suse/wifi-cfg80211-reject-auth-assoc-to-AP-with-our-addre.patch (git-fixes CVE-2023-53540 bsc#1251053). - Update patches.suse/wifi-iwlwifi-mvm-fix-potential-array-out-of-bou.patch (bsc#1012628 CVE-2023-53575 bsc#1251067). - Update patches.suse/wifi-mac80211-check-for-station-first-in-client-prob.patch (git-fixes CVE-2023-53588 bsc#1251206). - Update patches.suse/wifi-mac80211-increase-scan_ies_len-for-S1G.patch (stable-fixes CVE-2025-39957 bsc#1251810). - Update patches.suse/wifi-nl80211-fix-integer-overflow-in-nl80211_p.patch (bsc#1012628 CVE-2023-53570 bsc#1251031). - Update patches.suse/wifi-rtw88-delete-timer-and-free-skb-queue-when-unlo.patch (git-fixes CVE-2023-53574 bsc#1251222). - Update patches.suse/wifi-wilc1000-avoid-buffer-overflow-in-WID-string-co.patch (stable-fixes CVE-2025-39952 bsc#1251216). - commit 56ea93d - iommu/vt-d: Disallow dirty tracking if incoherent page walk (git-fixes). - iommu/vt-d: PRS isn't usable if PDS isn't supported (git-fixes). - commit 9da1184 - mm/page_alloc: fix race condition in unaccepted memory handling (CVE-2025-38008 bsc#1244939). - commit b445cb1 - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (CVE-2025-39902 bsc#1250702). - commit 46c39b3 - NFSD: Define a proc_layoutcommit for the FlexFiles layout type (git-fixes). - commit b115f79 - tracing: Fix filter string testing (git-fixes). - commit 864d37b - selftests/tracing: Fix event filter test to retry up to 10 times (git-fixes). - commit a9de969 - tracing/selftests: Fix kprobe event name test for .isra. functions (git-fixes). - commit 6a094d4 - bpf: Check link_create.flags parameter for multi_kprobe (git-fixes). - commit 0e75825 - bpf: Check link_create.flags parameter for multi_uprobe (git-fixes). - commit 10550c7 - ftrace: fix incorrect hash size in register_ftrace_direct() (git-fixes). - commit 9288055 - bpf: Use preempt_count() directly in bpf_send_signal_common() (git-fixes). - commit 9258f2a - tracing: Correct the refcount if the hist/hist_debug file fails to open (git-fixes). - commit 6e8ac35 - module: Prevent silent truncation of module name in delete_module(2) (git-fixes). - commit 44dc7b7 - tracing: Add down_write(trace_event_sem) when adding trace event (bsc#1248211 CVE-2025-38539). - commit b1816b0 - tracing: Limit access to parser->buffer when trace_get_user failed (bsc#1249286 CVE-2025-39683). - tracing: Remove unneeded goto out logic (bsc#1249286). - commit 8eaad3a ++++ kernel-rt_debug: - Update patches.suse/ALSA-ac97-Fix-possible-NULL-dereference-in-snd_.patch (bsc#1012628 CVE-2023-53648 bsc#1251750). - Update patches.suse/ASoC-codecs-wcd938x-fix-missing-mbhc-init-error.patch (bsc#1012628 CVE-2023-53666 bsc#1251760). - Update patches.suse/ASoC-qcom-q6apm-lpass-dais-Fix-NULL-pointer-derefere.patch (git-fixes CVE-2025-39938 bsc#1251134). - Update patches.suse/Bluetooth-hci_event-call-disconnect-callback-be.patch (bsc#1012628 CVE-2023-53673 bsc#1251763). - Update patches.suse/HID-hyperv-avoid-struct-memcpy-overrun-warning.patch (bsc#1012628 CVE-2023-53553 bsc#1251068). - Update patches.suse/KVM-nSVM-Check-instead-of-asserting-on-nested-TSC-sc.patch (git-fixes CVE-2023-53663 bsc#1251290). - Update patches.suse/RDMA-rxe-Fix-incomplete-state-save-in-rxe_requester.patch (git-fixes CVE-2023-53539 bsc#1251060). - Update patches.suse/USB-Gadget-core-Help-prevent-panic-during-UVC-.patch (bsc#1012628 CVE-2023-53580 bsc#1251105). - Update patches.suse/accel-qaic-Fix-a-leak-in-map_user_pages.patch (bsc#1012628 CVE-2023-53633 bsc#1251746). - Update patches.suse/bcache-Fix-__bch_btree_node_alloc-to-make-the-f.patch (bsc#1012628 CVE-2023-53681 bsc#1251769). - Update patches.suse/bonding-do-not-assume-skb-mac_header-is-set.patch (bsc#1012628 CVE-2023-53601 bsc#1251153). - Update patches.suse/bpf-Make-bpf_refcount_acquire-fallible-for-non-.patch (bsc#1012628 CVE-2023-53645 bsc#1251321). - Update patches.suse/bpf-cpumap-Handle-skb-as-well-when-clean-up-pt.patch (bsc#1012628 CVE-2023-53660 bsc#1251721). - Update patches.suse/bpf-cpumap-Make-sure-kthread-is-running-before.patch (bsc#1012628 CVE-2023-53577 bsc#1251028). - Update patches.suse/bpf-reject-unhashed-sockets-in-bpf_sk_assign.patch (jsc#PED-6811 CVE-2023-53585 bsc#1251126). - Update patches.suse/btrfs-insert-tree-mod-log-move-in-push_node_lef.patch (bsc#1012628 CVE-2023-53538 bsc#1251024). - Update patches.suse/btrfs-output-extra-debug-info-if-we-failed-to-find-a.patch (git-fixes CVE-2023-53672 bsc#1251780). - Update patches.suse/btrfs-reject-invalid-reloc-tree-root-keys-with.patch (bsc#1012628 CVE-2023-53618 bsc#1251748). - Update patches.suse/cifs-Release-folio-lock-on-fscache-read-hit.patch (bsc#1012628 CVE-2023-53593 bsc#1251132). - Update patches.suse/cifs-fix-mid-leak-during-reconnection-after-tim.patch (bsc#1012628 CVE-2023-53597 bsc#1251159). - Update patches.suse/clk-Fix-memory-leak-in-devm_clk_notifier_regist.patch (bsc#1012628 CVE-2023-53674 bsc#1251764). - Update patches.suse/clk-imx-scu-use-_safe-list-iterator-to-avoid-a-.patch (bsc#1012628 CVE-2023-53572 bsc#1251027). - Update patches.suse/cpufreq-amd-pstate-fix-global-sysfs-attribute-.patch (bsc#1012628 CVE-2023-53550 bsc#1251071). - Update patches.suse/cpufreq-amd-pstate-ut-Fix-kernel-panic-when-loading-.patch (git-fixes CVE-2023-53563 bsc#1251038). - Update patches.suse/crypto-af_alg-Fix-missing-initialisation-affecting-g.patch (bsc#1216396 CVE-2023-53599 bsc#1251150). - Update patches.suse/crypto-af_alg-Set-merge-to-zero-early-in-af_alg_send.patch (git-fixes CVE-2025-39931 bsc#1251100). - Update patches.suse/dax-Fix-dax_mapping_release-use-after-free.patch (bsc#1012628 CVE-2023-53613 bsc#1251119). - Update patches.suse/drivers-base-Free-devm-resources-when-unregistering-.patch (jsc#PED-6054 CVE-2023-53596 bsc#1251161). - Update patches.suse/drivers-perf-hisi-Don-t-migrate-perf-to-the-CPU.patch (bsc#1012628 CVE-2023-53656 bsc#1251758). - Update patches.suse/drm-amdgpu-unmap-and-remove-csa_va-properly.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-53545 bsc#1251084). - Update patches.suse/drm-bridge-anx7625-Fix-NULL-pointer-dereference-with.patch (git-fixes CVE-2025-39934 bsc#1251146). - Update patches.suse/drm-i915-mark-requests-for-GuC-virtual-engines-to-av.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-53552 bsc#1251065). - Update patches.suse/drm-i915-perf-add-sentinel-to-xehp_oa_b_counter.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-53646 bsc#1251742). - Update patches.suse/ext4-fix-memory-leaks-in-ext4_fname_-setup_filename-.patch (bsc#1214954 CVE-2023-53662 bsc#1251282). - Update patches.suse/fbdev-omapfb-lcd_mipid-Fix-an-error-handling-pa.patch (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070 jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511 jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-53650 bsc#1251283). - Update patches.suse/fprobe-Release-rethook-after-the-ftrace_ops-is-.patch (bsc#1012628 CVE-2023-53557 bsc#1251054). - Update patches.suse/gfs2-Fix-possible-data-races-in-gfs2_show_opti.patch (bsc#1012628 CVE-2023-53622 bsc#1251777). - Update patches.suse/gpio-mvebu-fix-irq-domain-leak.patch (bsc#1012628 CVE-2023-53579 bsc#1251170). - Update patches.suse/iavf-Fix-out-of-bounds-when-setting-channels-on.patch (bsc#1012628 CVE-2023-53659 bsc#1251247). - Update patches.suse/iavf-Fix-use-after-free-in-free_netdev.patch (bsc#1012628 CVE-2023-53556 bsc#1251059). - Update patches.suse/ice-Don-t-tx-before-switchdev-is-fully-configured.patch (jsc#PED-4876 CVE-2023-53657 bsc#1251319). - Update patches.suse/ip_vti-fix-potential-slab-use-after-free-in-de.patch (bsc#1012628 CVE-2023-53559 bsc#1251052). - Update patches.suse/ipmi_si-fix-a-memleak-in-try_smi_init.patch (git-fixes CVE-2023-53611 bsc#1251123). - Update patches.suse/jfs-fix-invalid-free-of-JFS_IP-ipimap-i_imap-in-diUnmount.patch (git-fixes CVE-2023-53616 bsc#1251215). - Update patches.suse/md-don-t-dereference-mddev-after-export_rdev-7dea.patch (jsc#PED-7542 CVE-2023-53665 bsc#1251270). - Update patches.suse/media-amphion-fix-REVERSE_INULL-issues-reported-by-c.patch (git-fixes CVE-2023-53653 bsc#1251755). - Update patches.suse/memcontrol-ensure-memcg-acquired-by-id-is-properly-s.patch (git-fixes CVE-2023-53621 bsc#1251323). - Update patches.suse/mm-damon-core-initialize-damo_filter-list-from.patch (bsc#1012628 CVE-2023-53555 bsc#1251056). - Update patches.suse/msft-hv-2870-Drivers-hv-vmbus-Don-t-dereference-ACPI-root-object-.patch (git-fixes CVE-2023-53647 bsc#1251732). - Update patches.suse/mtd-rawnand-brcmnand-Fix-potential-out-of-bounds-acc.patch (git-fixes CVE-2023-53541 bsc#1251043). - Update patches.suse/net-handshake-fix-null-ptr-deref-in-handshake_nl_don.patch (bsc#1220419 CVE-2023-53686 bsc#1251771). - Update patches.suse/net-mlx5-DR-fix-memory-leak-in-mlx5dr_cmd_crea.patch (bsc#1012628 CVE-2023-53546 bsc#1251079). - Update patches.suse/net-mlx5e-Check-for-NOT_READY-flag-state-after-.patch (bsc#1012628 CVE-2023-53581 bsc#1251106). - Update patches.suse/net-mlx5e-Take-RTNL-lock-when-needed-before-ca.patch (bsc#1012628 CVE-2023-53632 bsc#1251269). - Update patches.suse/net-rfkill-gpio-Fix-crash-due-to-dereferencering-uni.patch (git-fixes CVE-2025-39937 bsc#1251143). - Update patches.suse/net-usbnet-Fix-WARNING-in-usbnet_start_xmit-us.patch (bsc#1012628 CVE-2023-53548 bsc#1251066). - Update patches.suse/netfilter-conntrack-Avoid-nf_ct_helper_hash-use.patch (bsc#1012628 CVE-2023-53619 bsc#1251743). - Update patches.suse/nvme-core-fix-dev_pm_qos-memleak.patch (bsc#1012628 CVE-2023-53670 bsc#1251762). - Update patches.suse/octeon_ep-cancel-queued-works-in-probe-error-p.patch (bsc#1012628 CVE-2023-53638 bsc#1251328). - Update patches.suse/octeontx2-af-Add-validation-before-accessing-cg.patch (bsc#1012628 CVE-2023-53654 bsc#1251756). - Update patches.suse/perf-RISC-V-Remove-PERF_HES_STOPPED-flag-checki.patch (bsc#1012628 CVE-2023-53583 bsc#1251108). - Update patches.suse/perf-trace-Really-free-the-evsel-priv-area.patch (perf-v6.7 (jsc#PED-6012 jsc#PED-6121) CVE-2023-53649 bsc#1251749). - Update patches.suse/platform-x86-dell-sysman-Fix-reference-leak.patch (git-fixes CVE-2023-53631 bsc#1251529). - Update patches.suse/rcu-tasks-Avoid-pr_info-with-spin-lock-in-cblis.patch (bsc#1012628 CVE-2023-53558 bsc#1251081). - Update patches.suse/ring-buffer-Fix-deadloop-issue-on-reading-trace.patch (bsc#1012628 CVE-2023-53668 bsc#1251286). - Update patches.suse/s390-zcrypt-don-t-leak-memory-if-dev_set_name-fails.patch (git-fixes bsc#1215143 CVE-2023-53568 bsc#1251035). - Update patches.suse/scsi-qla2xxx-Avoid-fcport-pointer-dereference.patch (bsc#1012628 CVE-2023-53603 bsc#1251180). - Update patches.suse/scsi-qla2xxx-Fix-deletion-race-condition.patch (git-fixes CVE-2023-53615 bsc#1251113). - Update patches.suse/soc-aspeed-socinfo-Add-kfree-for-kstrdup.patch (bsc#1012628 CVE-2023-53617 bsc#1251268). - Update patches.suse/spi-bcm-qspi-return-error-if-neither-hif_mspi-n.patch (bsc#1012628 CVE-2023-53658 bsc#1251759). - Update patches.suse/staging-ks7010-potential-buffer-overflow-in-ks_.patch (bsc#1012628 CVE-2023-53554 bsc#1251057). - Update patches.suse/tracing-histograms-Add-histograms-to-hist_vars-.patch (bsc#1012628 CVE-2023-53560 bsc#1251045). - Update patches.suse/tty-serial-samsung_tty-Fix-a-memory-leak-in-s3c-832e231.patch (bsc#1012628 CVE-2023-53687 bsc#1251772). - Update patches.suse/tunnels-fix-kasan-splat-when-generating-ipv4-p.patch (bsc#1012628 CVE-2023-53600 bsc#1251152). - Update patches.suse/vdpa-Add-features-attr-to-vdpa_nl_policy-for-n.patch (bsc#1012628 CVE-2023-53652 bsc#1251754). - Update patches.suse/vdpa-Add-max-vqp-attr-to-vdpa_nl_policy-for-nl.patch (bsc#1012628 CVE-2023-53543 bsc#1251083). - Update patches.suse/wifi-ath11k-fix-memory-leak-in-WMI-firmware-sta.patch (bsc#1012628 CVE-2023-53602 bsc#1251076). - Update patches.suse/wifi-cfg80211-reject-auth-assoc-to-AP-with-our-addre.patch (git-fixes CVE-2023-53540 bsc#1251053). - Update patches.suse/wifi-iwlwifi-mvm-fix-potential-array-out-of-bou.patch (bsc#1012628 CVE-2023-53575 bsc#1251067). - Update patches.suse/wifi-mac80211-check-for-station-first-in-client-prob.patch (git-fixes CVE-2023-53588 bsc#1251206). - Update patches.suse/wifi-mac80211-increase-scan_ies_len-for-S1G.patch (stable-fixes CVE-2025-39957 bsc#1251810). - Update patches.suse/wifi-nl80211-fix-integer-overflow-in-nl80211_p.patch (bsc#1012628 CVE-2023-53570 bsc#1251031). - Update patches.suse/wifi-rtw88-delete-timer-and-free-skb-queue-when-unlo.patch (git-fixes CVE-2023-53574 bsc#1251222). - Update patches.suse/wifi-wilc1000-avoid-buffer-overflow-in-WID-string-co.patch (stable-fixes CVE-2025-39952 bsc#1251216). - commit 56ea93d - iommu/vt-d: Disallow dirty tracking if incoherent page walk (git-fixes). - iommu/vt-d: PRS isn't usable if PDS isn't supported (git-fixes). - commit 9da1184 - mm/page_alloc: fix race condition in unaccepted memory handling (CVE-2025-38008 bsc#1244939). - commit b445cb1 - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (CVE-2025-39902 bsc#1250702). - commit 46c39b3 - NFSD: Define a proc_layoutcommit for the FlexFiles layout type (git-fixes). - commit b115f79 - tracing: Fix filter string testing (git-fixes). - commit 864d37b - selftests/tracing: Fix event filter test to retry up to 10 times (git-fixes). - commit a9de969 - tracing/selftests: Fix kprobe event name test for .isra. functions (git-fixes). - commit 6a094d4 - bpf: Check link_create.flags parameter for multi_kprobe (git-fixes). - commit 0e75825 - bpf: Check link_create.flags parameter for multi_uprobe (git-fixes). - commit 10550c7 - ftrace: fix incorrect hash size in register_ftrace_direct() (git-fixes). - commit 9288055 - bpf: Use preempt_count() directly in bpf_send_signal_common() (git-fixes). - commit 9258f2a - tracing: Correct the refcount if the hist/hist_debug file fails to open (git-fixes). - commit 6e8ac35 - module: Prevent silent truncation of module name in delete_module(2) (git-fixes). - commit 44dc7b7 - tracing: Add down_write(trace_event_sem) when adding trace event (bsc#1248211 CVE-2025-38539). - commit b1816b0 - tracing: Limit access to parser->buffer when trace_get_user failed (bsc#1249286 CVE-2025-39683). - tracing: Remove unneeded goto out logic (bsc#1249286). - commit 8eaad3a ++++ libxslt: - security update - added patches CVE-2025-11731 [bsc#1251979], type confusion in exsltFuncResultCompfunction leading to denial of service * libxslt-CVE-2025-11731.patch ++++ python311-core: - Update to 3.11.14: - Security - gh-139700: Check consistency of the zip64 end of central directory record. Support records with “zip64 extensible data” if there are no bytes prepended to the ZIP file (CVE-2025-8291, bsc#1251305). - gh-139400: xml.parsers.expat: Make sure that parent Expat parsers are only garbage-collected once they are no longer referenced by subparsers created by ExternalEntityParserCreate(). Patch by Sebastian Pipping. - gh-135661: Fix parsing start and end tags in html.parser.HTMLParser according to the HTML5 standard. * Whitespaces no longer accepted between does not end the script section. * Vertical tabulation (\v) and non-ASCII whitespaces no longer recognized as whitespaces. The only whitespaces are \t\n\r\f and space. * Null character (U+0000) no longer ends the tag name. * Attributes and slashes after the tag name in end tags are now ignored, instead of terminating after the first > in quoted attribute value. E.g. . * Multiple slashes and whitespaces between the last attribute and closing > are now ignored in both start and end tags. E.g. . * Multiple = between attribute name and value are no longer collapsed. E.g. produces attribute “foo” with value “=bar”. - gh-135661: Fix CDATA section parsing in html.parser.HTMLParser according to the HTML5 standard: ] ]> and ]] > no longer end the CDATA section. Add private method _set_support_cdata() which can be used to specify how to parse <[CDATA[ — as a CDATA section in foreign content (SVG or MathML) or as a bogus comment in the HTML namespace. - gh-102555: Fix comment parsing in html.parser.HTMLParser according to the HTML5 standard. --!> now ends the comment. -- > no longer ends the comment. Support abnormally ended empty comments <--> and <--->. - gh-135462: Fix quadratic complexity in processing specially crafted input in html.parser.HTMLParser. End-of-file errors are now handled according to the HTML5 specs – comments and declarations are automatically closed, tags are ignored. - gh-118350: Fix support of escapable raw text mode (elements “textarea” and “title”) in html.parser.HTMLParser. - gh-86155: html.parser.HTMLParser.close() no longer loses data when the . * Multiple slashes and whitespaces between the last attribute and closing > are now ignored in both start and end tags. E.g. . * Multiple = between attribute name and value are no longer collapsed. E.g. produces attribute “foo” with value “=bar”. - gh-135661: Fix CDATA section parsing in html.parser.HTMLParser according to the HTML5 standard: ] ]> and ]] > no longer end the CDATA section. Add private method _set_support_cdata() which can be used to specify how to parse <[CDATA[ — as a CDATA section in foreign content (SVG or MathML) or as a bogus comment in the HTML namespace. - gh-102555: Fix comment parsing in html.parser.HTMLParser according to the HTML5 standard. --!> now ends the comment. -- > no longer ends the comment. Support abnormally ended empty comments <--> and <--->. - gh-135462: Fix quadratic complexity in processing specially crafted input in html.parser.HTMLParser. End-of-file errors are now handled according to the HTML5 specs – comments and declarations are automatically closed, tags are ignored. - gh-118350: Fix support of escapable raw text mode (elements “textarea” and “title”) in html.parser.HTMLParser. - gh-86155: html.parser.HTMLParser.close() no longer loses data when the