SUSE-CU-2026:12374-1: Security update of suse/sles/16.0/virt-launcher

Fri Oct 16 09:11:12 UTC 2026

SUSE Container Update Advisory: suse/sles/16.0/virt-launcher
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:12374-1
Container Tags        : suse/sles/16.0/virt-launcher:1.8 , suse/sles/16.0/virt-launcher:1.8.4 , suse/sles/16.0/virt-launcher:1.8.4-11.10
Container Release     : 11.10
Severity              : important
Type                  : security
References            : 1221342 1251789 1263864 1266339 1271417 1275653 1279962 1282077
                        1282578 1282918 CVE-2026-75900 CVE-2026-81627 CVE-2026-93834
-----------------------------------------------------------------

The container suse/sles/16.0/virt-launcher was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: 1861
Released:    Wed Oct  7 11:30:38 2026
Summary:     Security update for swtpm
Type:        security
Severity:    moderate
References:  1221342,1251789,1266339,1271417,1275653,CVE-2026-75900
This update for swtpm fixes the following issues:

Security issue fixed:

- CVE-2026-75900: Out-of-bounds read in SWTPM_NVRAM_CheckHeader due to sizeof(pointer) vs sizeof(struct) mismatch
  (bsc#1275653).

Changes for swtpm:

Update to 0.10.2:

* Properly check for truncation following snprintf call
- add upstream signing key and validate source signature
- Fix SELinux policy for virtqemud_t swtpm_t setsched
 process and unix socket interactions. Allows virtqemud_t to: Signal and
 control swtpm_t processes (noatsecure, rlimitinh, siginh, signull, setsched),
 create and listen on Unix stream sockets with swtpm_t processes (bsc#1266339).
 Already accepted on upstream:
 https://github.com/stefanberger/swtpm/pull/1132
- Drop tunable in require to avoid policy loading issues
 with toolchain 3.11 (bsc#1271417).
 Can be dropped, once this is accepted upstream:
 https://github.com/stefanberger/swtpm/pull/1139
- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
 to /etc/selinux (bsc#1221342)
- Also load swtpm_libvirt in the selinux subpackage (bsc#1251789)
- Update to version 0.10.1:
 + swtpm: Fix build error on 32bit systems due to inconsistent
 _FILE_OFFSET_BITS.
 + swtpm_setup:
 - Use DISTRO_PROFILES_DIR when listing profiles (fix path
 issue).
 - Do not pass a TPM 2 profile to swtpm when reconfiguring.
 + selinux:
 - Add rule for swtpm to be able to read password from pipe.
 - allow to map state file.
 - add NFS permissions for swtpm_t.
 - Add rule to allow swtpm_t opening of virt_log_t files.

-----------------------------------------------------------------
Advisory ID: 1860
Released:    Wed Oct  7 11:57:02 2026
Summary:     Security update for qemu
Type:        security
Severity:    important
References:  1263864,1279962,1282077,1282578,1282918,CVE-2026-81627,CVE-2026-93834
This update for qemu fixes the following issues:

Security issues fixed:

- CVE-2026-81627: missing writable RAM alias validation in the VAPIC setup hypercall allows a privileged guest user to
  bypass chipset `D_LCK` protection and injecting code into System Management Mode memory (bsc#1282077).
- CVE-2026-93834: hw/9pfs: mutate FID path from main thread only (bsc#1282578).

Changes for qemu:

- Bugfixes:
 * [openSUSE][RPM] spec: drop qemu-ipxe Requires for ppc (bsc#1282918)
 * virtio: fix queue size validation against allocated maximum (bsc#1279962)
 * virtio-mmio: fix QUEUE_NUM_MAX (bsc#1279962)
 * target/ppc/kvm: Use host compatibility mode for nested guests (bsc#1263864)
 * target/ppc/kvm: Add support for querying host compatibility mode (bsc#1263864)
 * linux-headers: Update to include KVM_CAP_PPC_COMPAT_CAPS (bsc#1263864)
 * linux-headers: Update to Linux v7.2-rc1 with KVM_S390_VM_CPU_FEAT_ASTFLEIE2 (bsc#1263864)
 * linux-headers: Update to Linux v7.1-rc4 (bsc#1263864)
 * scripts/update-linux-headers: Add typelimits.h (bsc#1263864)
 * update-linux-headers: Inject VIRTIO_RING_NO_LEGACY in virtio_ring.h (bsc#1263864)
 * linux-headers: Add nitro_enclaves.h (bsc#1263864)
 * scripts/update-linux-headers: Add Nitro Enclaves header (bsc#1263864)
 * standard-headers: Update virtio_spi.h from Linux v6.18-rc3 (bsc#1263864)
 * linux-headers: Update to Linux v6.19-rc1 (bsc#1263864)
 * update-linux-headers: Remove 'asm-s390/unistd_32.h' (bsc#1263864)
 * linux-headers: Update to Linux v6.18-rc3 (bsc#1263864)
 * linux-headers/linux: Add mshv.h headers (bsc#1263864)
 * include/hw/hyperv: Add MSHV ABI header definitions (bsc#1263864)
 * linux-headers: Update to Linux v6.17-rc1 (bsc#1263864)
 * linux-headers: deal with counted_by annotation (bsc#1263864)
 * linux-headers: Remove the 32-bit arm headers (bsc#1263864)
 * update Linux headers to KVM tree master (bsc#1263864)

The following package changes have been done:

- qemu-hw-display-virtio-vga-10.0.13-160000.2.1 updated
- qemu-ipxe-10.0.13-160000.2.1 updated
- qemu-seabios-10.0.131.16.3_3_g3d33c746-160000.2.1 updated
- qemu-vgabios-10.0.131.16.3_3_g3d33c746-160000.2.1 updated
- qemu-hw-usb-redirect-10.0.13-160000.2.1 updated
- qemu-hw-usb-host-10.0.13-160000.2.1 updated
- qemu-hw-display-virtio-gpu-10.0.13-160000.2.1 updated
- qemu-hw-display-virtio-gpu-pci-10.0.13-160000.2.1 updated
- qemu-img-10.0.13-160000.2.1 updated
- swtpm-0.10.2-160000.1.1 updated
- qemu-x86-10.0.13-160000.2.1 updated
- qemu-10.0.13-160000.2.1 updated