SUSE-IU-2026:7690-1: Security update of suse/sl-micro/6.2/kvm-os-container

[sle-container-updates at lists.suse.com]

SUSE Image Update Advisory: suse/sl-micro/6.2/kvm-os-container
-----------------------------------------------------------------
Image Advisory ID : SUSE-IU-2026:7690-1
Image Tags        : suse/sl-micro/6.2/kvm-os-container:2.3.1 , suse/sl-micro/6.2/kvm-os-container:2.3.1-8.160 , suse/sl-micro/6.2/kvm-os-container:latest
Image Release     : 8.160
Severity          : important
Type              : security
References        : 1263864 1278729 1279962 1282077 1282578 1282918 CVE-2026-81627
                        CVE-2026-93834 
-----------------------------------------------------------------

The container suse/sl-micro/6.2/kvm-os-container was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: 1849
Released:    Tue Oct  6 15:07:44 2026
Summary:     Recommended update for grub2
Type:        recommended
Severity:    moderate
References:  1278729
This update for grub2 fixes the following issues:

Changes in grub2:

- Add SBAT Provides to support shim SBAT dependency checks (bsc#1278729)

-----------------------------------------------------------------
Advisory ID: 1860
Released:    Wed Oct  7 11:57:02 2026
Summary:     Security update for qemu
Type:        security
Severity:    important
References:  1263864,1279962,1282077,1282578,1282918,CVE-2026-81627,CVE-2026-93834
This update for qemu fixes the following issues:

Security issues fixed:

- CVE-2026-81627: missing writable RAM alias validation in the VAPIC setup hypercall allows a privileged guest user to
  bypass chipset `D_LCK` protection and injecting code into System Management Mode memory (bsc#1282077).
- CVE-2026-93834: hw/9pfs: mutate FID path from main thread only (bsc#1282578).

Changes for qemu:

- Bugfixes:
 * [openSUSE][RPM] spec: drop qemu-ipxe Requires for ppc (bsc#1282918)
 * virtio: fix queue size validation against allocated maximum (bsc#1279962)
 * virtio-mmio: fix QUEUE_NUM_MAX (bsc#1279962)
 * target/ppc/kvm: Use host compatibility mode for nested guests (bsc#1263864)
 * target/ppc/kvm: Add support for querying host compatibility mode (bsc#1263864)
 * linux-headers: Update to include KVM_CAP_PPC_COMPAT_CAPS (bsc#1263864)
 * linux-headers: Update to Linux v7.2-rc1 with KVM_S390_VM_CPU_FEAT_ASTFLEIE2 (bsc#1263864)
 * linux-headers: Update to Linux v7.1-rc4 (bsc#1263864)
 * scripts/update-linux-headers: Add typelimits.h (bsc#1263864)
 * update-linux-headers: Inject VIRTIO_RING_NO_LEGACY in virtio_ring.h (bsc#1263864)
 * linux-headers: Add nitro_enclaves.h (bsc#1263864)
 * scripts/update-linux-headers: Add Nitro Enclaves header (bsc#1263864)
 * standard-headers: Update virtio_spi.h from Linux v6.18-rc3 (bsc#1263864)
 * linux-headers: Update to Linux v6.19-rc1 (bsc#1263864)
 * update-linux-headers: Remove 'asm-s390/unistd_32.h' (bsc#1263864)
 * linux-headers: Update to Linux v6.18-rc3 (bsc#1263864)
 * linux-headers/linux: Add mshv.h headers (bsc#1263864)
 * include/hw/hyperv: Add MSHV ABI header definitions (bsc#1263864)
 * linux-headers: Update to Linux v6.17-rc1 (bsc#1263864)
 * linux-headers: deal with counted_by annotation (bsc#1263864)
 * linux-headers: Remove the 32-bit arm headers (bsc#1263864)
 * update Linux headers to KVM tree master (bsc#1263864)


The following package changes have been done:

- grub2-common-2.12-160000.8.1 updated
- grub2-i386-pc-2.12-160000.8.1 updated
- grub2-2.12-160000.8.1 updated
- qemu-guest-agent-10.0.13-160000.2.1 updated
- container:suse-sl-micro-6.2-base-os-container-latest-ca26de125a124fc840fadd6476be72ad8a8c7931fb2b4fe3ca5d5a24d017ed09-0 updated