SUSE-CU-2026:12377-1: Security update of suse/sles/16.0/pr-helper

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: suse/sles/16.0/pr-helper
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:12377-1
Container Tags        : suse/sles/16.0/pr-helper:1.8 , suse/sles/16.0/pr-helper:1.8.4 , suse/sles/16.0/pr-helper:1.8.4-11.10
Container Release     : 11.10
Severity              : important
Type                  : security
References            : 1263864 1279962 1282077 1282578 1282918 CVE-2026-81627 CVE-2026-93834
-----------------------------------------------------------------

The container suse/sles/16.0/pr-helper was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: 1860
Released:    Wed Oct  7 11:57:02 2026
Summary:     Security update for qemu
Type:        security
Severity:    important
References:  1263864,1279962,1282077,1282578,1282918,CVE-2026-81627,CVE-2026-93834
This update for qemu fixes the following issues:

Security issues fixed:

- CVE-2026-81627: missing writable RAM alias validation in the VAPIC setup hypercall allows a privileged guest user to
  bypass chipset `D_LCK` protection and injecting code into System Management Mode memory (bsc#1282077).
- CVE-2026-93834: hw/9pfs: mutate FID path from main thread only (bsc#1282578).

Changes for qemu:

- Bugfixes:
 * [openSUSE][RPM] spec: drop qemu-ipxe Requires for ppc (bsc#1282918)
 * virtio: fix queue size validation against allocated maximum (bsc#1279962)
 * virtio-mmio: fix QUEUE_NUM_MAX (bsc#1279962)
 * target/ppc/kvm: Use host compatibility mode for nested guests (bsc#1263864)
 * target/ppc/kvm: Add support for querying host compatibility mode (bsc#1263864)
 * linux-headers: Update to include KVM_CAP_PPC_COMPAT_CAPS (bsc#1263864)
 * linux-headers: Update to Linux v7.2-rc1 with KVM_S390_VM_CPU_FEAT_ASTFLEIE2 (bsc#1263864)
 * linux-headers: Update to Linux v7.1-rc4 (bsc#1263864)
 * scripts/update-linux-headers: Add typelimits.h (bsc#1263864)
 * update-linux-headers: Inject VIRTIO_RING_NO_LEGACY in virtio_ring.h (bsc#1263864)
 * linux-headers: Add nitro_enclaves.h (bsc#1263864)
 * scripts/update-linux-headers: Add Nitro Enclaves header (bsc#1263864)
 * standard-headers: Update virtio_spi.h from Linux v6.18-rc3 (bsc#1263864)
 * linux-headers: Update to Linux v6.19-rc1 (bsc#1263864)
 * update-linux-headers: Remove 'asm-s390/unistd_32.h' (bsc#1263864)
 * linux-headers: Update to Linux v6.18-rc3 (bsc#1263864)
 * linux-headers/linux: Add mshv.h headers (bsc#1263864)
 * include/hw/hyperv: Add MSHV ABI header definitions (bsc#1263864)
 * linux-headers: Update to Linux v6.17-rc1 (bsc#1263864)
 * linux-headers: deal with counted_by annotation (bsc#1263864)
 * linux-headers: Remove the 32-bit arm headers (bsc#1263864)
 * update Linux headers to KVM tree master (bsc#1263864)


The following package changes have been done:

- qemu-pr-helper-10.0.13-160000.2.1 updated