SUSE-CU-2026:12899-1: Security update of suse/sles/16.0/cdi-controller

sle-container-updates at lists.suse.com sle-container-updates at lists.suse.com
Sun Oct 25 12:13:01 UTC 2026 

SUSE Container Update Advisory: suse/sles/16.0/cdi-controller
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:12899-1
Container Tags        : suse/sles/16.0/cdi-controller:1.65 , suse/sles/16.0/cdi-controller:1.65.0 , suse/sles/16.0/cdi-controller:1.65.0-6.26
Container Release     : 6.26
Severity              : important
Type                  : security
References            : 1268867 1274723 1274726 1276892 1276946 1277247 1277262 1277707
                        1277708 1277709 1277710 1277711 1277712 1277713 1277921 1277922
                        1279893 1280049 1280050 1280051 1280052 1280053 1280054 1281297
                        1282509 CVE-2026-18374 CVE-2026-19499 CVE-2026-19542 CVE-2026-54369
                        CVE-2026-54370 CVE-2026-54371 CVE-2026-6368 CVE-2026-6791 CVE-2026-77117
                        CVE-2026-80489 CVE-2026-86145 CVE-2026-8674 CVE-2026-86805 CVE-2026-89156
                        CVE-2026-89157 CVE-2026-89158 CVE-2026-89160 CVE-2026-89161 CVE-2026-89162
-----------------------------------------------------------------

The container suse/sles/16.0/cdi-controller was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: 1661
Released:    Fri Sep 11 13:45:57 2026
Summary:     Security update for acl, attr
Type:        security
Severity:    important
References:  1268867,CVE-2026-54369,CVE-2026-54370,CVE-2026-54371
This update for acl, attr fixes the following issue:

- CVE-2026-54369,CVE-2026-54370,CVE-2026-54371: Symlink Traversal Privilege Escalation via getfattr/setfattr,
  getfacl/setfacl/chacl, libacl (bsc#1268867).

Changes for acl:

- Update to 2.4.0 (jsc#PED-16501):
 Major Issues Fixed:
 - The libacl library functions acl_get_file(), acl_set_file(),
 acl_extended_file(), and acl_delete_def_file() take a pathname argument
 and follow symbolic links. When a privileged user calls one of those
 functions, an attacker that controls a pathname component can replace a
 file or directory with a symbolic link and redirect the operation to a
 different file. This can lead to local privilege escalation.
 (CVE-2026-54369, bsc#1268867)
 The library functions cannot be fixed without breaking compatibility; the
 described behaviour is by design.
 Instead, version 2.4.0 of the acl package introduces the additional
 functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and
 acl_delete_def_file_at(). These functions each take a dirfd file
 descriptor argument and an at_flags argument and accept the
 AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to
 control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)
 In addition, the libacl functions acl_get_fd(), acl_set_fd(), and
 acl_extended_fd() functions always operate on the access ACL; the library
 previously did not offer a way to operate on the default ACL of a directory
 file descriptor. The new functions remove that restriction.
 It will be up to each individual program to start using these new library
 functions where appropriate.
 - When walking directory trees, the getfacl, setfacl, chacl, and getfattr
 utilities constructed the full pathname of each file in the tree and use that
 pathname to access the file. When a privileged user used those utilities,
 an attacker that controlled a pathname component could replace a directory with
 a symbolic link and redirect the operation to a different file, leading to
 a local privilege escalation. (CVE-2026-54371, bsc#1268867)
 This is fixed by using directory file descriptors and operating relative to
 those directory file descriptors.
 - When resolving the final pathname component, the getfacl, setfacl, chacl,
 getfattr, and setfattr utilities in some cases used functions that resolve
 symbolic links. This includes the above mentioned libacl functions, but
 also stat(), chmod(), and chown().
 This is fixed by using symlink-safe functions throughout the code.
 - When restoring a backup, the setfacl and setfattr utilities read the full
 pathnames of files from the backup. When those pathnames were resolved,
 pathname components that are symbolic links were traversed. An attacker
 that controlled a pathname component could replace it with a symbolic link,
 causing a privileged user to operate on a file other than the one intended.
 This could lead to the same kind of local privilege escalation as discussed
 before.
 This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the
 directory components of a pathname, but see Compatibility Notes below for
 the details.
Minor Issues Fixed:
 - When a symbolic link was specified on the command line but symbolic link
 traversal was disabled using option -P (--physical), the getfacl and
 setfacl utilities previously silently ignored the symlink. Now, an ELOOP
 ('Too many levels of symbolic links') error will result instead.
 - acl_delete_entry() now verifies that the specified entry belongs to the
 specified acl.
 - Numeric uids and gids that cannot be represented in types uid_t and gid_t
 are checked more carefully and invalid numbers are rejected.
 - Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry
 several times when the size of an ACL grows unexpectedly; previously, they
 only grew the allocated buffer once before giving up.
 - When passed a directory file descriptor, function perm_copy_fd() didn't
 copy the default ACL from one directory to the other. It now does.
 - setfacl --restore accidentally ignored leading whitespace in filenames. It
 no longer does.
 - setfacl --restore accidentally called chmod() when in --test mode. It no
 longer does.
 - When the setfattr --restore option was used multiple times, a buffer was
 accessed after being freed. This no longer happens.
 - When the setfattr -h (--no-dereference) option was given after --restore,
 it was ignored. Now, the options can be passed in any order.
 - The -h (--no-dereference) option of getfattr prevented getfattr from
 recursing into 'symbolic link directories'. This is wrong. When dirlink
 is a symbolic link that refers to a directory, 'getfattr -Rh dirlink' will now
 visit that directory. The -P (--physical) option can be used to prevent
 that.
 - Similarly, when a symbolic link referring to a directory was specified on
 the getfacl or setfacl command line, the -R option did not cause that
 directory to be visited. This has been fixed so that those directories
 will now be visited. The -P (--physical) option can be used to prevent

Changes for attr:

- Update to 2.6.0 (jsc#PED-16501):
Major Issues Fixed:
 - The libacl library functions acl_get_file(), acl_set_file(),
 acl_extended_file(), and acl_delete_def_file() take a pathname argument
 and follow symbolic links. When a privileged user calls one of those
 functions, an attacker that controls a pathname component can replace a
 file or directory with a symbolic link and redirect the operation to a
 different file. This can lead to local privilege escalation.
 (CVE-2026-54369, bsc#1268867)
 The library functions cannot be fixed without breaking compatibility; the
 described behaviour is by design.
 Instead, version 2.4.0 of the acl package introduces the additional
 functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and
 acl_delete_def_file_at(). These functions each take a dirfd file
 descriptor argument and an at_flags argument and accept the
 AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to
 control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)
 In addition, the libacl functions acl_get_fd(), acl_set_fd(), and
 acl_extended_fd() functions always operate on the access ACL; the library
 previously did not offer a way to operate on the default ACL of a directory
 file descriptor. The new functions remove that restriction.
 It will be up to each individual program to start using these new library
 functions where appropriate.
 - When walking directory trees, the getfacl, setfacl, chacl, and getfattr
 utilities constructed the full pathname of each file in the tree
and use that
 pathname to access the file. When a privileged user used those utilities,
 an attacker that controlled a pathname component could replace a
directory with
 a symbolic link and redirect the operation to a different file, leading to
 a local privilege escalation. (CVE-2026-54371, bsc#1268867)
 This is fixed by using directory file descriptors and operating relative to
 those directory file descriptors.
 - When resolving the final pathname component, the getfacl, setfacl, chacl,
 getfattr, and setfattr utilities in some cases used functions that resolve
 symbolic links. This includes the above mentioned libacl functions, but
 also stat(), chmod(), and chown().
 This is fixed by using symlink-safe functions throughout the code.
 - When restoring a backup, the setfacl and setfattr utilities read the full
 pathnames of files from the backup. When those pathnames were resolved,
 pathname components that are symbolic links were traversed. An attacker
 that controlled a pathname component could replace it with a symbolic link,
 causing a privileged user to operate on a file other than the one intended.
 This could lead to the same kind of local privilege escalation as discussed
 before.
 This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the
 directory components of a pathname, but see Compatibility Notes below for
 the details.
Minor Issues Fixed:
 - When a symbolic link was specified on the command line but symbolic link
 traversal was disabled using option -P (--physical), the getfacl and
 setfacl utilities previously silently ignored the symlink. Now, an ELOOP
 ('Too many levels of symbolic links') error will result instead.
 - acl_delete_entry() now verifies that the specified entry belongs to the
 specified acl.
 - Numeric uids and gids that cannot be represented in types uid_t and gid_t
 are checked more carefully and invalid numbers are rejected.
 - Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry
 several times when the size of an ACL grows unexpectedly; previously, they
 only grew the allocated buffer once before giving up.
 - When passed a directory file descriptor, function perm_copy_fd() didn't
 copy the default ACL from one directory to the other. It now does.
 - setfacl --restore accidentally ignored leading whitespace in filenames. It
 no longer does.
 - setfacl --restore accidentally called chmod() when in --test mode. It no
 longer does.
 - When the setfattr --restore option was used multiple times, a buffer was
 accessed after being freed. This no longer happens.
 - When the setfattr -h (--no-dereference) option was given after --restore,
 it was ignored. Now, the options can be passed in any order.
 - The -h (--no-dereference) option of getfattr prevented getfattr from
 recursing into 'symbolic link directories'. This is wrong. When dirlink
 is a symbolic link that refers to a directory, 'getfattr -Rh
dirlink' will now
 visit that directory. The -P (--physical) option can be used to prevent
 that.
 - Similarly, when a symbolic link referring to a directory was specified on
 the getfacl or setfacl command line, the -R option did not cause that
 directory to be visited. This has been fixed so that those directories
 will now be visited. The -P (--physical) option can be used to prevent

-----------------------------------------------------------------
Advisory ID: 1747
Released:    Wed Sep 23 21:42:24 2026
Summary:     Security update for pcre2
Type:        security
Severity:    important
References:  1277707,1277708,1277709,1277710,1277711,1277712,1277713,1279893,1280049,1280050,1280051,1280052,1280053,1280054,CVE-2026-86145,CVE-2026-89156,CVE-2026-89157,CVE-2026-89158,CVE-2026-89160,CVE-2026-89161,CVE-2026-89162
This update for pcre2 fixes the following issues:

- CVE-2026-86145: missing size checks in `pcre2_dfa_match` code can lead to an out-of-bounds write (bsc#1279893).
- CVE-2026-89156: out-of-bounds read via invalid UTF data during JIT fallback (bsc#1280054).
- CVE-2026-89157: out-of-bounds write via large pattern input (bsc#1280053).
- CVE-2026-89158: out-of-bounds write due to integer overflow in `pcre2_compile_32` for 32-bit platforms (bsc#1280052).
- CVE-2026-89160: out-of-bounds read during the `PCRE2_MATCH_INVALID_UTF` matching of an invalid UTF subject
  (bsc#1280051).
- CVE-2026-89161: incorrect free operation due to mishandling of a previously copied subject in `pcre2_jit_match`
  (bsc#1280050).
- CVE-2026-89162: information disclosure via `pcre2_serialize_encode` (bsc#1280049).

-----------------------------------------------------------------
Advisory ID: 1769
Released:    Tue Sep 29 14:25:10 2026
Summary:     Security update for glibc
Type:        security
Severity:    important
References:  1274723,1274726,1276892,1276946,1277247,1277262,1277921,1277922,1281297,1282509,CVE-2026-18374,CVE-2026-19499,CVE-2026-19542,CVE-2026-6368,CVE-2026-6791,CVE-2026-77117,CVE-2026-80489,CVE-2026-8674,CVE-2026-86805
This update for glibc fixes the following issues:

- CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
- CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
- CVE-2026-8674: reachable assert in `resolv/resolv_conf.c:update_from_conf` allows an attacker in a local network to
  trigger a process crash (bsc#1281297).
- CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
- CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
- CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
- CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
- CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).
- CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges
  (bsc#1282509).

Other changes:

- Add -flive-patching=inline-clone to avoid untraceable inter-procedural optimizations (bsc#1277247).


The following package changes have been done:

- compat-usrmerge-tools-84.87-160000.2.2 added
- system-user-root-20190513-160000.2.2 added
- filesystem-84.87-160000.2.2 added
- glibc-2.40-160000.7.1 added
- terminfo-base-6.5.20250531-160000.3.1 added
- libncurses6-6.5.20250531-160000.3.1 added
- libpcre2-8-0-10.45-160000.4.1 added
- libgmp10-6.3.0-160000.2.2 added
- libcap2-2.73-160000.3.1 added
- libattr1-2.6.0-160000.1.1 added
- libacl1-2.4.0-160000.1.1 added
- libreadline8-8.2.13-160000.2.2 added
- libselinux1-3.8.1-160000.4.1 added
- bash-5.2.37-160000.2.2 added
- bash-sh-5.2.37-160000.2.2 added
- container:registry.suse.com-bci-bci-micro-16.0-f88b68967fd8a6d5c7d6459ac7d1b9afcc26f7de6518b903a154be487900db0f-0 updated

More information about the sle-container-updates mailing list