SUSE-IU-2026:6072-1: Security update of suse/sl-micro/6.0/baremetal-os-container
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Fri Aug 7 07:10:11 UTC 2026
SUSE Image Update Advisory: suse/sl-micro/6.0/baremetal-os-container
-----------------------------------------------------------------
Image Advisory ID : SUSE-IU-2026:6072-1
Image Tags : suse/sl-micro/6.0/baremetal-os-container:2.1.3 , suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.220 , suse/sl-micro/6.0/baremetal-os-container:latest
Image Release : 6.220
Severity : critical
Type : security
References : 1212854 1213265 1213809 1217377 1218326 1219142 1219289 1219348
1219796 1220374 1220810 1222458 1228926 1229898 1232063 1232227
1236321 1236390 1236392 1253260 1254094 1255285 1257007 1257153
1257244 1268144 1268145 1268275 CVE-2026-41579
-----------------------------------------------------------------
The container suse/sl-micro/6.0/baremetal-os-container was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: 827
Released: Mon Aug 3 09:15:23 2026
Summary: Security update for runc
Type: security
Severity: low
References: 1268275,CVE-2026-41579
This update for runc fixes the following issues:
- CVE-2026-41579: runc allows a malicious image with a /dev symlink to trigger limited host filesystem integrity
violations (bsc#1268275).
Changes for runc:
- update to 1.3.6:
* Various integration test improvements. (#5222, #5237, #5226,
#5229, #5239, #5249, #5269, #5287, #5295, #5304)
* When masking directories with `maskPaths`, runc will now re-
use a single `tmpfs` instance (which is not writeable) to
reduce the number `tmpfs` superblocks that need to be reaped
when containers die (in particular, Kubernetes applies masks
to per-CPU sysfs directories which get expensive quickly).
- update to 1.3.5
* Recursive atime-related mount flags (rrelatime et al.) are now applied
properly. (#5115, #5098)
* PR #4757 caused a regression that resulted in spurious
cannot start a container that has stopped errors when
running runc create and has thus been reverted. (#5158,
#5153, #5151, #4645, #4757)
* Updated builds to Go 1.25, libseccomp v2.6.0. (#5111, #5053)
* Minor signing keyring updates. (#5146, #5139, #5144, #5148)
-----------------------------------------------------------------
Advisory ID: 832
Released: Thu Aug 6 10:40:43 2026
Summary: Security update for multipath-tools
Type: security
Severity: critical
References: 1212854,1213265,1213809,1217377,1218326,1219142,1219289,1219348,1219796,1220374,1220810,1222458,1228926,1229898,1232063,1232227,1236321,1236390,1236392,1253260,1254094,1255285,1257007,1257153,1257244,1268144,1268145
This update for multipath-tools fixes the following issues:
Update to version 0.9.8+292+suse.c0523c1.
Security issues fixed:
- kpartx: integer overflow in the GPT partition table size calculation can lead to heap OOB read via crafted USB device
or disk image(bsc#1268145).
- kpartx: missing bounds check can lead to a DASD VOL1 unbounded array write via a crafted DASD disk with more than 256
consecutive format labels (bsc#1268144).
Other updates and bugfixes:
- [Build 32.2] System with multipath fails to boot during first boot during the installation (bsc#1232063).
- [Build 50.1] multipath btrfs i/o error on both Leap 15.6 and SLES 15 SP6 (bsc#1219289).
- Fix code that leads to `is_bit_set_in_bitfield: bitfield overflow: 1 >= 0` message showing up in syslog
(bsc#1255285).
- Version 0.9.8+266+suse.53479977 (bsc#1257007):
* kpartx: fix segfault when operating on regular files (bsc#1257244, bsc#1257153)
* multipathd: print path offline message even without a checker (bsc#1254094)
* Fix command descriptions in the multipathd man page.
* Fix ISO C23 compatibility issue causing errors with new compilers.
* Fix memory leak caused by not joining the 'init unwinder' thread.
* Fix memory leaks in kpartx.
* Print the warning 'setting scsi timeouts is unsupported for protocol' only once per protocol.
* Make sure multipath-tools is compiled with the compiler flag `-fno-strict-aliasing`.
(gh#opensvc/multipath-tools#130, bsc#1255285)
- Version 0.9.8+247+suse.863ae86f:
* Log offline path state if 'log_checker_err always' is set
- Version 0.9.8+246+suse.fb81edd2:
* CI: GitHub workflow updates. No code changes.
- Version 0.9.8+166+suse.95399ce1:
- Backported fixes from upstream 0.9.9 ... 0.10.5 (bsc#1253260)
* Updates to the built-in hardware table:
- add some NVMe storage array (VASTData, Infinidat, HITACHI VSP)
- add QSAN
- add EqualLogic PS
- Add Quantum devices
- Enable ALUA for AStor/NeoSapphire
- Update NFINIDAT/InfiniBox config
- Fix product blacklist of S/390 devices
- Add Seagate Lyve
- Add HITACHI VSP One SDS Block
- Add SCST (SCSI Target Subsystem for Linux)
- Huawei storage arrays
- XSG1 vendors
* Avoid a possible system hang during shutdown with queueing multipath maps.
* Failed paths should be checked every `polling_interval`. In certain cases,
this wouldn't happen, because the check interval wasn't reset by multipathd.
* It could happen that multipathd would accidentally release a SCSI persistent
reservation held by another node. Fix it.
* After manually failing some paths and then reinstating them, sometimes
the reinstated paths were immediately failed again by multipathd.
* Fixed the problem that, if there were multiple maps with deferred failback
(`failback` value > 0 in `multipath.conf`), some maps might fail back later
than configured.
* Fixed a problem in the marginal path detection algorithm that could cause
the io error check for a recently failed path to be delayed.
* Fixed a minor bug in the config file parser
* Fixed minor issues detected by coverity.
- Version 0.9.8+111+suse.b7ee850:
- Backported bug fixes from upstream 0.9.9 - 0.10.2
* Fixed old mpathpersist bug leading to the error message 'configured reservation
key doesn't match: 0x0' when `reservation_key` was configured in the
multipaths section of `multipath.conf`. (bsc#1228926, gh#opensvc/multipath-tools#92)
* Fixed bug that caused queueing to be always disabled if flushing a map failed
(bug introduced in 0.9.8). (bsc#1229898)
* Fixed output of `multipath -t` and `multipath -T` for the options
`force_sync` and `retrigger_tries`. (bsc#1229898, gh#opensvc/multipath-tools#88)
* libmultipath: don't print error message if WATCHDOG_USEC is 0 (bsc#1232227)
* Fix map failure count for no_path_retry > 0 (bsc#1229898)
* Fix reboot hang if uevent is processed for suspended device (bsc#1232063)
* libmultipath: don't set dev_loss_tmo to 0 for NO_PATH_RETRY_FAIL (bsc#1229898)
* Fixed a memory leak in the nvme foreign library. (bsc#1229898, bsc#1236390)
* Fix multipathd crash because of invalid path group index value, for example if an invalid
path device was removed from a map. (gh#opensvc/multipath-tools#105, bsc#1236392)
* Fix the problem that `group_by_tpg` might be disabled if one or more
paths were offline during initial configuration (bsc#1236392)
* Make sure udev and systemd notice changes in multipath path state
when devices are added to or removed from multipath maps (bsc#1236321)
- Version 0.9.8+88+suse.d504d83:
* Revert 'libmultipath: fix max_sectors_kb on adding path' (bsc#1222458)
- Update to version 0.9.8+87+suse.f72b9f3:
* fix misspelled DM_UDEV_DISABLE_OTHER_RULES_FLAG in udev rules (bsc#1220810)
- Remove libmpathpersist-example-old.c, which has been obsolete since multipath-tools 0.8.6.
- Version 0.9.8+83+suse.bcae610 (bsc#1220374):
* multipath-tools: added NEWS.md
- Version 0.9.8~1+82+suse.dcd98a3:
* Adapt package version such that it shows as a 0.9.8 prerelease
* Add missing udev rules file
- Version 0.9.7+148+suse.9780ae0:
* 11-dm-mpath.rules: Fix quoting mistake (bsc#1219142)
- Version 0.9.7+148+suse.7d9953e.obscpio
* This is a multipath-tools 0.9.8 pre-release
* fix fast_io_fail for Infinibox (bsc#1219348)
* Fix activation of LVM volume groups during coldplug (bsc#1219142)
- Version 0.9.7+140+suse.2d78457:
* Socket activation via multipathd.socket has been disabled by default
because it has undesirable side effects on systems without multipath.
Users with multipath hardware should enable multipathd.service
* The restorequeueing CLI command now only enables queueing if
disablequeueing had been sent before
* Avoid multipathd hang during map flush
* multipathd now tracks the queueing mode of maps in its internal features string
* Improve error messages in 'multipathd -k'
* Fix segfault in autoresize code (bsc#1219289)
* Fix missing map reloads (bsc#1219796)
* Documentation fixes, spelling fixes, minor code fixes
- Version 0.9.7+93+suse.e2f2272:
* fix ANA prioritizer enablement logic (bsc#1218326)
* avoid setting queue_if_no_path on multipath maps for which the
no_path_retry timeout has expired
* the interactive commands 'restorequeueing map X' and
'restorequeing maps' now only affect maps that had queueing
manually disabled using 'disablequeuing maps' or
'disablequeuing map X' beforehand
* Spelling fixes
- Version 0.9.7+76+suse.5f857af:
* Update to upstream 0.9.7 (jsc#PED-6464)
* added max_retries config option to limit SCSI retries
* added auto_resize config option to enable resizing multipath maps automatically
* fixed memory and error handling for code using aio (marginal path code,
directio path checker)
* dropped modules-load.d/multipath.conf; replaced by a dependency on
modprobe at dm-multipath.service (systemd >= 245: SLE15-SP3 and later only)
and a softdep on sd_mod for the SCSI device handlers (bsc#1217377)
* On SLE/Leap suse-module-tools doesn't ship a scsi_mod->sd_mod softdep yet.
Add it here, too. It will be overridden by s-m-t when it's added there.
* drop usr_prefix= setting in SLE build recipes (set to /usr by upstream
automatically)
- Version 0.9.6+115+suse.07776fb
* multipathd: Added support to handle FPIN-Li events for FC-NVMe
- Update to version 0.9.6+110+suse.5dfdf35:
* The options 'bindings_file', 'prkeys_file', and 'wwids_file',
which have been deprecated since multipath-tools 0.8.8,
aren't supported any more. The paths to these files are now
hard-coded to 'bindings', 'prkeys' and 'wwids' under
/etc/multipath.
* Strictly avoid assigning map aliases that are already taken
(bsc#1213265)
* Improve handling of user-friendly names
* avoid 'multipath -d' (dry-run) changing SCSI timeouts in sysfs (bsc#1213809)
- `spec` file:
* adapt prefix values to upstream changes
* fix compilation flags for `make check`
* pass EXTRAVERSION to build (bsc#1212854)
The following package changes have been done:
- kpartx-0.9.8+292+suse.c0523c1-1.1 updated
- runc-1.3.6-1.1 updated
- libmpath0-0.9.8+292+suse.c0523c1-1.1 updated
- multipath-tools-0.9.8+292+suse.c0523c1-1.1 updated
More information about the sle-container-updates
mailing list