SUSE-IU-2026:8388-1: Security update of suse/sl-micro/6.1/rt-os-container
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Wed Oct 28 08:36:09 UTC 2026
SUSE Image Update Advisory: suse/sl-micro/6.1/rt-os-container
-----------------------------------------------------------------
Image Advisory ID : SUSE-IU-2026:8388-1
Image Tags : suse/sl-micro/6.1/rt-os-container:2.2.1 , suse/sl-micro/6.1/rt-os-container:2.2.1-5.205 , suse/sl-micro/6.1/rt-os-container:latest
Image Release : 5.205
Severity : important
Type : security
References : 1215199 1233517 1244325 1249584 1249584 1251827 1255531 1257144
1257144 1257496 1257496 1259711 1259711 1259726 1259726 1259729
1259729 1259963 1262263 1264267 1264459 1264713 1264851 1266694
1266730 1267631 1268572 1268573 1269561 1272178 1273040 1273116
1273290 1273599 1273751 1273764 1273865 1274008 1274256 1274653
1275115 1275510 1275564 1275594 1275644 1275732 1275785 1275786
1275859 1275860 1275915 1275964 1276562 1276791 1276836 1276873
1276951 1277174 1277260 1277310 1277603 1277614 1277691 1277742
1277747 1277804 1277821 1277889 1277894 1277931 1278232 1279706
1280179 1280251 1280259 1280477 1280743 1280966 1281144 1281280
1281525 1281726 1281771 1281819 1281865 1281979 1282347 1282742
1282755 1282761 1282762 1282768 1282770 1282784 1282808 1282932
1283037 1283142 1283144 1283493 1283736 1283823 1283835 1283851
1283894 1283936 1283946 1283963 1283979 1284288 1284289 1284291
1284295 1284334 1284408 1284415 1284424 1284462 1284518 1284559
1284581 1284606 1284647 1284649 1284655 1284713 1284746 1284790
1284791 1285684 CVE-2025-11561 CVE-2025-23013 CVE-2025-59375
CVE-2025-59375 CVE-2025-68358 CVE-2026-102633 CVE-2026-24515
CVE-2026-24515 CVE-2026-25210 CVE-2026-25210 CVE-2026-32776 CVE-2026-32776
CVE-2026-32777 CVE-2026-32777 CVE-2026-32778 CVE-2026-32778 CVE-2026-41080
CVE-2026-43091 CVE-2026-43284 CVE-2026-43299 CVE-2026-45186 CVE-2026-45865
CVE-2026-45930 CVE-2026-50219 CVE-2026-53108 CVE-2026-56131 CVE-2026-56132
CVE-2026-56403 CVE-2026-56404 CVE-2026-56405 CVE-2026-56406 CVE-2026-56407
CVE-2026-56408 CVE-2026-56409 CVE-2026-56410 CVE-2026-56411 CVE-2026-56412
CVE-2026-63830 CVE-2026-63983 CVE-2026-64012 CVE-2026-64070 CVE-2026-64116
CVE-2026-64280 CVE-2026-64422 CVE-2026-64424 CVE-2026-64461 CVE-2026-64568
CVE-2026-66046 CVE-2026-68233 CVE-2026-68241 CVE-2026-68242 CVE-2026-68323
CVE-2026-72015 CVE-2026-72040 CVE-2026-72041 CVE-2026-72081 CVE-2026-72172
CVE-2026-72213 CVE-2026-72236 CVE-2026-72301 CVE-2026-72305 CVE-2026-72319
CVE-2026-72493 CVE-2026-72522 CVE-2026-74312 CVE-2026-74379 CVE-2026-74544
CVE-2026-74578 CVE-2026-74583 CVE-2026-74587 CVE-2026-74611 CVE-2026-74614
CVE-2026-74653 CVE-2026-74723 CVE-2026-76641 CVE-2026-76956 CVE-2026-76957
CVE-2026-77214 CVE-2026-80579 CVE-2026-80893 CVE-2026-80977 CVE-2026-89528
CVE-2026-89669 CVE-2026-89685 CVE-2026-89706 CVE-2026-89778 CVE-2026-89811
CVE-2026-89987 CVE-2026-90011 CVE-2026-90101 CVE-2026-90283 CVE-2026-90289
CVE-2026-90315 CVE-2026-92488 CVE-2026-93222 CVE-2026-93252 CVE-2026-93787
CVE-2026-93800 CVE-2026-93806 CVE-2026-93820 CVE-2026-93821 CVE-2026-93822
CVE-2026-93990 CVE-2026-97415 CVE-2026-97416 CVE-2026-97491 CVE-2026-97555
CVE-2026-97564 CVE-2026-97595 CVE-2026-97945 CVE-2026-98010 CVE-2026-98015
CVE-2026-98016 CVE-2026-98077 CVE-2026-98089 CVE-2026-98130 CVE-2026-98173
CVE-2026-98216 CVE-2026-98248 CVE-2026-98252 CVE-2026-98253 CVE-2026-98260
CVE-2026-98269 CVE-2026-98273 CVE-2026-98323 CVE-2026-98347 CVE-2026-98352
CVE-2026-98354 CVE-2026-98357 CVE-2026-98358 CVE-2026-98359 CVE-2026-98360
CVE-2026-98365 CVE-2026-98366 CVE-2026-98367 CVE-2026-99999
-----------------------------------------------------------------
The container suse/sl-micro/6.1/rt-os-container was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: 29
Released: Wed Mar 5 15:55:47 2025
Summary: Security update for pam_u2f
Type: security
Severity: important
References: 1233517,1249584,CVE-2025-23013,CVE-2025-59375
This update for pam_u2f fixes the following issues:
- CVE-2025-23013: Fixed problematic PAM_IGNORE return values in `pam_sm_authenticate()`(bsc#1233517).
-----------------------------------------------------------------
Advisory ID: 344
Released: Wed Nov 26 15:27:32 2025
Summary: Security update for sssd
Type: security
Severity: important
References: 1244325,1251827,1257144,1257496,CVE-2025-11561,CVE-2026-24515,CVE-2026-25210
This update for sssd fixes the following issues:
- CVE-2025-11561: Fixed default Kerberos configuration allowing
privilege escalation on AD-joined Linux systems (bsc#1251827)
Other fixes:
- Install file in krb5.conf.d to include sssd krb5 config snippets
(bsc#1244325)
-----------------------------------------------------------------
Advisory ID: 466
Released: Tue Mar 31 11:59:46 2026
Summary: Recommended update for rust-keylime
Type: recommended
Severity: moderate
References: 1259711,1259726,1259729,1259963,CVE-2026-32776,CVE-2026-32777,CVE-2026-32778
This update for rust-keylime fixes the following issues:
- Suggests only the IMA policy package, and keep it as example (bsc#1259963)
- Add a patch to re-generate TSS bindings
- Update to version 0.2.9+8:
* build(deps):
+ bump thiserror from 2.0.17 to 2.0.18
+ bump docker/login-action from 3 to 4
+ bump docker/metadata-action from 5 to 6
+ bump docker/build-push-action from 6 to 7
+ bump actions/upload-artifact from 6 to 7
+ bump mockoon/cli-action from 2 to 3
+ bump http from 1.3.1 to 1.4.0
+ bump serde from 1.0.219 to 1.0.228
+ bump clap from 4.5.45 to 4.5.54
+ bump actix-web from 4.11.0 to 4.12.1
* Remove generate-bindings feature from tss-esapi
* Use port constants instead of hardcoded values in tests
* push-attestation:
+ use registrar TLS port when TLS is enabled
+ drop support for mTLS to registrar
+ drop mTLS support and require PoP authentication
+ drop self-signed mTLS certificate generation
* dist: Make the services to conflict with each other
* cargo:
+ bump tracing_subscriber to version 0.3.20
+ bump time to version 0.3.47
* Update reqwest from 0.12 to 0.13
* auth:
+ load CA certificate in authentication client
+ reuse existing ContextInfo to avoid duplicate TPM objects
* packit: add missing e2e tests
* registrar: rename insecure option to disable_tls
* config:
+ add missing config options to keylime-agent.conf
+ add support for 'default' in registrar_api_versions option
+ add support for 'default' in registrar_tls_ca_cert option
+ drop unused config options and constants
* resilient_client: reauthenticate if a 403 error is received
-----------------------------------------------------------------
Advisory ID: kernel-721
Released: Tue Oct 27 13:24:35 2026
Summary: Security update for the Linux Kernel
Type: security
Severity: important
References: 1215199,1255531,1264267,1264851,1266694,1266730,1269561,1272178,1273040,1273116,1273290,1273599,1273751,1273764,1273865,1274008,1274256,1274653,1275510,1275564,1275644,1275785,1275786,1275964,1276562,1276791,1276836,1276873,1276951,1277174,1277260,1277310,1277603,1277614,1277691,1277742,1277747,1277804,1277821,1277889,1277894,1277931,1278232,1279706,1280179,1280251,1280259,1280477,1280743,1280966,1281144,1281280,1281525,1281726,1281771,1281819,1281865,1281979,1282742,1282755,1282761,1282762,1282768,1282770,1282784,1282808,1282932,1283037,1283142,1283144,1283736,1283823,1283835,1283851,1283894,1283936,1283946,1283963,1283979,1284288,1284289,1284291,1284295,1284408,1284415,1284424,1284462,1284518,1284559,1284581,1284606,1284647,1284649,1284655,1284713,1284746,1284790,1284791,1285684,CVE-2025-68358,CVE-2026-43091,CVE-2026-43299,CVE-2026-45865,CVE-2026-45930,CVE-2026-53108,CVE-2026-63830,CVE-2026-63983,CVE-2026-64012,CVE-2026-64070,CVE-2026-64116,CVE-2026-64280,CVE-2026-6442
2,CVE-2026-64424,CVE-2026-64461,CVE-2026-64568,CVE-2026-68233,CVE-2026-68241,CVE-2026-68242,CVE-2026-68323,CVE-2026-72015,CVE-2026-72040,CVE-2026-72041,CVE-2026-72081,CVE-2026-72172,CVE-2026-72213,CVE-2026-72236,CVE-2026-72301,CVE-2026-72305,CVE-2026-72319,CVE-2026-72493,CVE-2026-74312,CVE-2026-74379,CVE-2026-74544,CVE-2026-74578,CVE-2026-74583,CVE-2026-74587,CVE-2026-74611,CVE-2026-74614,CVE-2026-74653,CVE-2026-74723,CVE-2026-80579,CVE-2026-80893,CVE-2026-80977,CVE-2026-89528,CVE-2026-89669,CVE-2026-89685,CVE-2026-89706,CVE-2026-89778,CVE-2026-89811,CVE-2026-89987,CVE-2026-90011,CVE-2026-90101,CVE-2026-90283,CVE-2026-90289,CVE-2026-90315,CVE-2026-92488,CVE-2026-93222,CVE-2026-93252,CVE-2026-93787,CVE-2026-93800,CVE-2026-93806,CVE-2026-93820,CVE-2026-93821,CVE-2026-93822,CVE-2026-97415,CVE-2026-97416,CVE-2026-97491,CVE-2026-97555,CVE-2026-97564,CVE-2026-97595,CVE-2026-97945,CVE-2026-98010,CVE-2026-98015,CVE-2026-98016,CVE-2026-98077,CVE-2026-98089,CVE-2026-98130,CVE-2026-98173,CVE-2
026-98216,CVE-2026-98248,CVE-2026-98252,CVE-2026-98253,CVE-2026-98260,CVE-2026-98269,CVE-2026-98273,CVE-2026-98323,CVE-2026-98347,CVE-2026-98352,CVE-2026-98354,CVE-2026-98357,CVE-2026-98358,CVE-2026-98359,CVE-2026-98360,CVE-2026-98365,CVE-2026-98366,CVE-2026-98367,CVE-2026-99999
The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:
The following security issues were fixed:
- CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
- CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
- CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
- CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
- CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
- CVE-2026-53108: powerpc/64s: Fix unmap race with PMD migration entries (bsc#1269561).
- CVE-2026-63830: bpf, sockmap: Several fixes to bpf_msg_push_data (bsc#1272178).
- CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
- CVE-2026-64012: net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1273764).
- CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
- CVE-2026-64116: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() (bsc#1273751).
- CVE-2026-64280: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() (bsc#1273599).
- CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
- CVE-2026-64424: netpoll: fix a use-after-free on shutdown path (bsc#1274256).
- CVE-2026-64461: PCI: mediatek: Fix IRQ domain leak when port fails to enable (bsc#1273865).
- CVE-2026-64568: wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure (bsc#1274008).
- CVE-2026-68233: drm/vc4: Shut down BO cache timer before teardown (bsc#1275644).
- CVE-2026-68241: drm/i915/mst: limit DP MST ESI service loop (bsc#1275785).
- CVE-2026-68242: drm/i915/gt: Fix NULL deref on sched_engine alloc failure (bsc#1275786).
- CVE-2026-68323: tipc: serialize udp bearer replicast list updates (bsc#1274653).
- CVE-2026-72015: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (bsc#1276791).
- CVE-2026-72040: ipmi: fix refcount leak in i_ipmi_request() (bsc#1276836).
- CVE-2026-72041: espintcp: use sk_msg_free_partial to fix partial send (bsc#1275510).
- CVE-2026-72081: scsi: elx: efct: Fix I/O leak on unsupported additional CDB (bsc#1277174).
- CVE-2026-72172: mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE (bsc#1277691).
- CVE-2026-72213: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch (bsc#1277603).
- CVE-2026-72236: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() (bsc#1277614).
- CVE-2026-72301: ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (bsc#1277742).
- CVE-2026-72305: VDUSE: avoid leaking information to userspace (bsc#1277747).
- CVE-2026-72319: ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (bsc#1275964).
- CVE-2026-72493: net: serialize netif_running() check in enqueue_to_backlog() (bsc#1276951).
- CVE-2026-74312: vhost/vdpa: validate virtqueue index in mmap and fault paths (bsc#1276873).
- CVE-2026-74379: dax/kmem: account for partial discontiguous resource upon removal (bsc#1278232).
- CVE-2026-74544: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds (bsc#1277894).
- CVE-2026-74578: crypto: algif_skcipher - force synchronous processing on trees without ctx->state (bsc#1275564).
- CVE-2026-74583: net/sched: cls_route: fix fastmap use-after-free on filter (bsc#1277889).
- CVE-2026-74587: sctp: fix use-after-free of cached ASCONF chunk (bsc#1277821).
- CVE-2026-74611: tls: rx: restore msg_iter before TLS 1.3 optimistic retry (bsc#1277804).
- CVE-2026-74614: vsock/virtio: read virtqueues under worker locks (bsc#1277931).
- CVE-2026-74653: serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx (bsc#1277310).
- CVE-2026-74723: btrfs: lzo: reject inline extents without valid headers (bsc#1276562).
- CVE-2026-80579: fbdev: clear fb_info->mode before deleting a videomode (bsc#1277260).
- CVE-2026-80893: mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() (bsc#1279706).
- CVE-2026-80977: net: skbuff: don't touch shared zerocopy state in skb_tx_error() (bsc#1280259).
- CVE-2026-89528: svcrdma: Reject Read lists that exceed the page budget (bsc#1280743).
- CVE-2026-89669: nfsd: fix cpntf publish race in nfs4_init_cp_state (bsc#1280251).
- CVE-2026-89685: nfsd: fix clock domain mismatch in clients_still_reclaiming() (bsc#1280179).
- CVE-2026-89706: NFSD: Limit the number of concurrent async COPY operations (bsc#1280477).
- CVE-2026-89778: isofs: fix out-of-bounds page array access on empty zisofs block (bsc#1280966).
- CVE-2026-89811: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (bsc#1281144).
- CVE-2026-89987: mm/huge_memory: transfer the pmd dirty bit to the folio on zap (bsc#1281819).
- CVE-2026-90011: scsi: target: iscsi: Reserve a terminator byte for the login payload (bsc#1281280).
- CVE-2026-90101: bnxt_en: Fix call to hardware monitoring event handler (bsc#1281525).
- CVE-2026-90283: hugetlbfs: release subpool on fill_super failure (bsc#1281771).
- CVE-2026-90289: drm/amd/display: Resize MST HDCP per-connector arrays to 32 (bsc#1281726).
- CVE-2026-90315: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers (bsc#1281865).
- CVE-2026-92488: RDMA/erdma: complete object teardown when the destroy command fails (bsc#1281979).
- CVE-2026-93222: signal: avoid shared siginfo namespace rewrites (bsc#1282742).
- CVE-2026-93252: ocfs2: fix circular locking dependency in ocfs2_init_acl() (bsc#1282784).
- CVE-2026-93787: smb: client: bound dirent name against end of SMB response in cifs_filldir (bsc#1282932).
- CVE-2026-93800: btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() (bsc#1282808).
- CVE-2026-93806: wifi: cfg80211: validate assoc response length before status and IE access (bsc#1283037).
- CVE-2026-97415: btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF (bsc#1282768).
- CVE-2026-97416: btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk() (bsc#1282770).
- CVE-2026-97491: net/rds: Don't sleep inside rds_ib_conn_path_shutdown (bsc#1283142).
- CVE-2026-97555: smb: client: fix heap overflow in DACL owner/group rewrite (bsc#1283851).
- CVE-2026-97564: smb: client: reject userspace cifs.idmap descriptions (bsc#1283946).
- CVE-2026-97595: mac802154: fix use-after-free of sdata via queued RX frames (bsc#1283736).
- CVE-2026-97945: replace with mainline version and update References (bsc#1283144).
- CVE-2026-98010: net/sched: drr: clamp quantum in change class (bsc#1283823).
- CVE-2026-98015: net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put (bsc#1283963).
- CVE-2026-98016: net/mlx5e: Fix use-after-free race in sample_restore_put() (bsc#1283894).
- CVE-2026-98077: netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() (bsc#1283979).
- CVE-2026-98089: bonding: alb: fix uninitialized transport header access in alb_determine_nd() (bsc#1283936).
- CVE-2026-98130: sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START (bsc#1283835).
- CVE-2026-98173: smb: client: fix use-after-free of iface in cifs_try_adding_channels() (bsc#1284415).
- CVE-2026-98216: IB/hfi1: Fix the PIO_CRED credit-return mmap (bsc#1284559).
- CVE-2026-98252: RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() (bsc#1284581).
- CVE-2026-98253: RDMA/ucma: Serialize join and leave on copy_to_user failure (bsc#1284790).
- CVE-2026-98260: exec: Cleanup POSIX timers right after de_thread() (bsc#1284408).
- CVE-2026-98269: btrfs: abort transaction on failure to update inode for hole punching and reflinking (bsc#1284606).
- CVE-2026-98273: x86/kprobes: Fix crash when probing CS CALL instructions (bsc#1284462).
- CVE-2026-98323: RDMA/siw: Bound fragmented header copies by the remaining length (bsc#1284713).
- CVE-2026-98347: IB/IPoIB: Avoid restoring OPER_UP after multicast flush (bsc#1284295).
- CVE-2026-98352: RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted (bsc#1284647).
- CVE-2026-98354: RDMA/mad: Fix receive buffer leak when PKey enforcement fails (bsc#1284291).
- CVE-2026-98357: IB/isert: wait for deferred control PDU completions before releasing the connection (bsc#1284791).
- CVE-2026-98358: IB/iser: reject a remote invalidation of an unregistered direction (bsc#1284289).
- CVE-2026-98359: RDMA/core: Reject unregistering netdevs in ib_get_eth_speed (bsc#1284746).
- CVE-2026-98360: RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds (bsc#1284649).
- CVE-2026-98365: RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access (bsc#1284288).
- CVE-2026-98366: RDMA/rxe: validate access flags before swapping the MR's PD (bsc#1284655).
- CVE-2026-98367: RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept (bsc#1284424).
- CVE-2026-99999: ipv4: validate checksum_start before completing checksum (bsc#1285684).
The following non security issues were fixed:
- ASoC: adau1372: allow sleepy powerdown GPIOs (git-fixes).
- ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes (git-fixes).
- ASoC: cs42l52: Fix the NG Type Switch bit (git-fixes).
- ASoC: cs42l56: Put the Limiter Cushion control on the limiter register (git-fixes).
- ASoC: Intel: avs: Reset the stream unless it is already prepared (git-fixes).
- ASoC: max98371: Fix the Speaker DHT Min Volume bits (git-fixes).
- ASoC: nau8822: Fix the 128x oversampling switch bits (git-fixes).
- ASoC: pcm3168a: Fix the DAC zero flag polarity bit (git-fixes).
- ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM (git-fixes).
- ASoC: stm32: spdifrx: fix synchronization state check (git-fixes).
- ASoC: wm8978: Fix the 128x oversampling switch bits (git-fixes).
- Bluetooth: hci_sock: Serialize dead-device detachment (git-fixes).
- Bluetooth: MGMT: Fix status of pending commands flushed on power off (git-fixes).
- Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown (git-fixes).
- Bluetooth: RFCOMM: free the skb when the DLC has no owner (git-fixes).
- Drivers: hv: Avoid infinite retry loop in init_vp_index() (git-fixes).
- Drivers: hv: Don't reset VMBus connection state on error/exit paths (git-fixes).
- Drivers: hv: vmbus: fix typo 'substract' in comment (git-fixes).
- drm/amdgpu/uvd3.1: Fix checking whether UVD firmware keyselect was already set (git-fixes).
- drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks (git-fixes).
- drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr (git-fixes).
- drm/amdkfd: align SDMA doorbell base for shader doorbell writes (git-fixes).
- drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info (git-fixes).
- drm/aspeed: Balance the display clock enable on teardown (git-fixes).
- drm/dp: don't mark the AUX backlight enabled when enabling failed (git-fixes).
- drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN (git-fixes).
- drm/gud: don't keep a connector without a CRTC as connector_state (git-fixes).
- drm/i915/gem: Prevent overstepping exec array boundary (git-fixes).
- drm/i915/gt: Unmask interrupts only when ACTIVE is true (git-fixes).
- drm/vc4: drain the hangcheck timer and works on V3D unbind (git-fixes).
- drm/vc4: Free the BO cache size list on teardown (git-fixes).
- gpio: exar: initialize the ID before registering its cleanup (git-fixes).
- gpio: xilinx: fix runtime PM leak on request error path (git-fixes).
- IB/hfi1: Resolve the credit-return buffer through the send context's node (git-fixes).
- KVM: PPC: Book3S HV: Add H_VIRT mapping for tracing exits (bsc#1215199).
- KVM: PPC: Book3S HV: Add missing mappings for tracing exits (bsc#1215199).
- KVM: PPC: Book3S HV: Add preempt_disable() around virtual-mode HPTE bit-lock users (bsc#1215199).
- KVM: PPC: Book3S HV: Add SRCU protection for virtual-mode HPT hcalls (bsc#1215199).
- KVM: PPC: Book3S HV: Free the queue pages in error path (bsc#1215199).
- KVM: PPC: Fix get_d_signext() 12-bit displacement for paired-single D-form (bsc#1215199).
- KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy (git-fixes).
- KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails (git-fixes).
- memstick: core: wait for request completion before freeing card (git-fixes).
- memstick: rtsx_usb_ms: complete requests after eject instead of dropping them (git-fixes).
- mmc: cavium-octeon: destroy slot platform devices on remove (git-fixes).
- mmc: cavium-thunderx: destroy slot platform devices on remove (git-fixes).
- mmc: mtk-sd: Cancel request timeout work on remove (git-fixes).
- mmc: sdhci-sprd: disable runtime PM on remove (git-fixes).
- net: mana: reserve RX buffer headroom to fix forwarding performance (git-fixes).
- net: mctp-i2c: fix duplicate reception of old data (bsc#1266730).
- net: usb: ax88179_178a: fix rx frame length for non-last packets (git-fixes).
- netfilter: nfnetlink_queue: unbreak SCTP traffic (bsc#1285684).
- PCI: hv: Probe vPCI buses asynchronously (git-fixes).
- PCI: hv: Warn when wait_for_response() waits indefinitely (git-fixes).
- pinctrl: amd: Clear S4 wake bits when firmware has _AEI (git-fixes).
- power: supply: ds2780: Fix ds2780_get_capacity() returning raw value (git-fixes).
- power: supply: Fix maintenance charge table kernel-doc (git-fixes).
- power: supply: generic-adc-battery: Fix temperature IIO channel conversion (git-fixes).
- powerpc/interrupt: Use early_radix_enabled() in NMI real-mode guard (bsc#1215199).
- pseries/plpks: clear SED key data after use (bsc#1215199).
- pseries/plpks: clear sensitive PLPKS buffers (bsc#1215199).
- pseries/plpks: clear signed update authentication buffer (bsc#1215199).
- pseries/plpks: fix error handling in plpks_read_var() (bsc#1215199).
- pseries/plpks: make narrowing conversions explicit (bsc#1215199).
- pseries/plpks: validate input to plpks_signed_update_var() (bsc#1215199).
- regulator: ltc3676: don't read the write-only HRST and CLIRQ registers (git-fixes).
- serial: 8250: dispatch SysRq character in serial8250_handle_irq() (git-fixes).
- tools/hv: fix typo 'retrive' in comment (git-fixes).
- tools: gpio: fix building from the top level with O= (git-fixes).
- wifi: brcmfmac: fix P2P device removal race in brcmf_detach() (git-fixes).
- wifi: mt76: mt792x: pick the SAR table layout from the table itself (git-fixes).
- wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit (git-fixes).
- xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit (bsc#1264267).
-----------------------------------------------------------------
Advisory ID: 769
Released: Tue Oct 27 15:41:39 2026
Summary: Security update for expat
Type: security
Severity: important
References: 1249584,1257144,1257496,1259711,1259726,1259729,1262263,1264459,1264713,1267631,1268572,1268573,1275115,1275594,1275732,1275859,1275860,1275915,1282347,1283493,1284334,CVE-2025-59375,CVE-2026-102633,CVE-2026-24515,CVE-2026-25210,CVE-2026-32776,CVE-2026-32777,CVE-2026-32778,CVE-2026-41080,CVE-2026-43284,CVE-2026-45186,CVE-2026-50219,CVE-2026-56131,CVE-2026-56132,CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406,CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410,CVE-2026-56411,CVE-2026-56412,CVE-2026-66046,CVE-2026-72522,CVE-2026-76641,CVE-2026-76956,CVE-2026-76957,CVE-2026-77214,CVE-2026-93990
This update for expat fixes the following issues:
- CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).
- CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the
encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).
- CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).
- CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity
declaration value (bsc#1259726).
- CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).
- CVE-2026-32778: NULL pointer dereference in `setContext` on retry after an out-of-memory condition
(bsc#1259729).
- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).
- CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).
- CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a
policy violation (bsc#1267631).
- CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within
handlers in cases of a policy violation (bsc#1268572).
- CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).
- CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406,
CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410,
CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).
- CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts()
function (bsc#1275732).
- CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same
as high surrogates during Unicode processing (bsc#1275594).
- CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger
memory corruption (bsc#1275915).
- CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).
- CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use-
after-free can occur (bsc#1275859).
- CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334).
- CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).
- CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).
Changes for expat:
Update to 2.8.5 (jsc#PED-16154):
* Bug fixes:
* Fix an OOM-related memory leak on a failed overflow check
* Fix memory alignment for architectures with 128bit pointers
* Mark XML_SetHashSalt deprecated
* CMake: only add /source-charset:utf-8 when /utf-8 is not present
* lib: resolve undefined behavior from overshifting a signed int
* lib: support read-only hash table lookup with non-zero-terminated
keys
* lib: use a C99 bool for ENTITY.open
* version info bumped from 13:3:12 to 13:4:12
* fix support for 2+ GiB documents (regression from 2.8.2)
* reject empty version in the XML declaration
* fix printf format for AIX
* CMake|AIX: enable EXPAT_DEV_URANDOM by default
* version info bumped from 13:2:12 to 13:3:12
* Existing API function XML_SetHashSalt is now deprecated
* because of its limitations, and its use should be
* considered a vulnerability. Please either use the new API
* function XML_SetHashSalt16Bytes (with known-high-quality
* entropy input only!) instead, or leave the derivation of
* a 16-bytes hash salt from high quality entropy to Expat's
* internal machinery (by *not* calling either of the two
* XML_SetHashSalt* functions).
* xmlwf: Fix a memory leak
* WASI: Fix format specifiers for 32bit WASI SDK
* Fix alignment of internal allocations for some non-amd64
architectures (e.g. sparc32); fixes up on the fix to
CVE-2025-59375 (of Expat 2.7.2)
* Fix a class of false positives where input should have been
rejected with error XML_ERROR_ASYNC_ENTITY; regression from
CVE-2024-8176 (of Expat 2.7.0)
* Prove and regression-proof absence of integer overflow
from function expat_realloc
* Remove 'harmless' cast that truncated a size_t to unsigned
* xmlwf: Resolve use of functions XML_GetErrorLineNumber
and XML_GetErrorColumnNumber
* CVE-2025-59375 -- Disallow use of disproportional amounts of
dynamic memory from within an Expat parser
* xmlwf: Fix (internal) help generator
* xmlwf: Mention supported environment variables in
The following package changes have been done:
- libexpat1-2.8.5-slfo.1.1_1.1 updated
- SL-Micro-release-6.1-slfo.1.12.83 updated
- kernel-rt-6.4.0-159998.54.1 updated
- container:SL-Micro-container-2.2.1-7.194 updated
More information about the sle-container-updates
mailing list