SUSE-SU-2026:24196-1: important: Security update for pacemaker
SLE-SECURITY-UPDATES
null at suse.de
Tue Oct 20 20:56:40 UTC 2026
# Security update for pacemaker
Announcement ID: SUSE-SU-2026:24196-1
Release Date: 2026-10-09T12:10:03Z
Rating: important
References:
* bsc#1180966
* bsc#1249217
* bsc#1255371
* bsc#1259345
* bsc#1265183
* bsc#1265201
* bsc#1268381
* bsc#1270354
* bsc#1271652
* bsc#1272452
* bsc#1279543
Cross-References:
* CVE-2026-10649
CVSS scores:
* CVE-2026-10649 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-10649 ( NVD ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
* CVE-2026-10649 ( NVD ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Affected Products:
* SUSE Linux Enterprise Server 16.0
* SUSE Linux Enterprise Server High Availability Extension 16.0
An update that solves one vulnerability and has 10 fixes can now be installed.
## Description:
This update for pacemaker fixes the following issues:
Security issue fixed:
* CVE-2026-10649: denial of service via integer overflow in remote message
decompression (bsc#1268381).
Changes for pacemaker:
Update to version 3.0.3+20260728.7052efa194:
* cts: make cts-scheduler -o/--out-dir default to a temporary directory
(bsc#1272452)
* spec: Add symlinks for test support files in the pacemaker-cts sub-package
(bsc#1272452)
* cts: Do not install test support files into /usr at runtime (bsc#1272452)
* libcrmcommon: Make pcmk__auto_fencing_watchdog_timeout() static
* libcrmcommon: Functionize parsing "fencing-watchdog-timeout"
* liblrmd: Check watchdog-based self-fencing device for remote nodes only if
"fencing-watchdog-timeout" is enabled (bsc#1270354,
gh#ClusterLabs/pacemaker#4146)
* controller: Check for watchdog-based self-fencing device only if "fencing-
watchdog-timeout" is enabled (bsc#1270354, gh#ClusterLabs/pacemaker#4146)
* fencer: Avoid use-after-free in debug log (bsc#1279543,
gh#ClusterLabs/pacemaker#4172)
* fenced: Prevent segfault by not merging with in-flight fencing actions
(bsc#1271652, gh#ClusterLabs/pacemaker##4152)
* ChangeLog: update for 3.0.3 release
* Build: update version information for 3.0.3
* libraries: update shared object versions for 3.0.3
* NLS: update translations before 3.0.3-rc1
* cibadmin: allow altering status section without triggering refresh
(gh#ClusterLabs/pacemaker#4147)
* tools: Use g_spawn_sync in cibsecret.
* tools: Handle UTF-8 parameters in crm_resource.
* tools: Handle UTF-8 parameters in cibsecret.
* agents: Move pid file management into ClusterMon.in.
* libcib: Remove an unnecessary coverity suppression. (CVE-2026-10649,
bsc#1268381, rh#2462817, gh#ClusterLabs/pacemaker#4129)
* libcrmcommon: Fix an integer overflow in pcmk__remote_send_xml.
(CVE-2026-10649, bsc#1268381, rh#2462817, gh#ClusterLabs/pacemaker#4129)
* libcrmcommon: Limit the max size of a remote message. (CVE-2026-10649,
bsc#1268381, rh#2462817, gh#ClusterLabs/pacemaker#4129)
* libcrmcommon: Fix integer overflow in remote message code. (CVE-2026-10649,
bsc#1268381, rh#2462817, gh#ClusterLabs/pacemaker#4129)
* libcrmcommon: Fix checks in localized_remote_header. (CVE-2026-10649,
bsc#1268381, rh#2462817, gh#ClusterLabs/pacemaker#4129)
* liblrmd: Don't include internal header in lrmd.h
* Low: libcrmcommon, tools: Fix NULL dereference in crm_resource.c
* pacemakerd: Properly find and track all existing sub-daemons (bsc#1265201,
gh#ClusterLabs/pacemaker#4115)
* tools: Use the VERSION variable instead of invoking `crm_attribute
--version` (bsc#1265183, gh#ClusterLabs/pacemaker#4114)
* libcib: Handle cib_xpath_address for an XPath query for an attribute
(gh#ClusterLabs/pacemaker#4108)
* libcib: Prevent based or cibadmin from crashing when handling an XPath query
for an attribute (bsc#1249217, gh#ClusterLabs/pacemaker#4108)
* libcrmcommon: Deprecate PCMK_dh_max_bits.
* libcib: Full-CIB replace op no longer segfaults with cib_xpath
* libpe_status: Avoid leaking a pcmk_resource_t's xml/orig_xml
* Revert "API: libraries: Update version numbers in so names"
* ChangeLog: update for 3.0.2-rc1 release
* tools: Avoid memory leak in crm_resource --clear
* libpacemaker, tools: Avoid mem leak in crm_simulate/pcmk_simulate()
* libcib: Avoid memory leak when processing CIB upgrade
* libpe_status: Use first operations child when expanding template
* libpe_status: Improve no resources message in unpack_template()
* daemons: Only log a message if we're falling back.
* update version information for 3.0.2
* libraries: Update version numbers in so names
* libraries: update shared object versions for 3.0.2
* NLS: update translations before 3.0.2-rc1
* libcrmcommon: Deprecate anonymous authentication.
* libcrmcommon: Deprecate remote-clear-port.
* libcib: Add support for PSK authentication for remote CIB ops.
* daemons: Add support for PSK authentication for remote CIB ops.
* libpacemaker: Fix a memory leak in inject_action.
* tools: Free the list at the end of cli_resource_print_operations.
* tools: Fix memory leaks when printing crm_verify warnings/errors.
* libpe: If pe__clone_default exits early, free the lists.
* libpacemaker: Fix a segfault in order_resource_actions_after.
* libcrmcommon: Properly return errno from pcmk__bare_output_new.
* libpe: Free elements of rsc->priv->ticket_constraints...
* libpacemaker: If process_rsc_history exits early, free the list.
* daemons,libcib: Fix memory leaks in IPC code.
* libservices: Deal with fgets errors in services__get_lsb_metadata.
* libpacemaker: Check that instance is not NULL.
* libcrmcommon: Avoid overflow when negating INT_MIN
* libcrmcommon: Avoid overflow in crm_time_add_months()
* libcib: Explicitly handle receiving a NACK from based.
* libcib: Explicitly handle receiving a NACK from fenced.
* daemons: Don't NACK an invalid remote message.
* libcrmcommon: Don't log on error in pcmk__ipc_send_iov.
* daemons: Don't return a NACK if execd gets an unknown message.
* liblrmd: Explicitly handle receiving a NACK from execd.
* liblrmd: Fix log messages in remote_proxy_cb.
* daemons: Delay creating an xmlNode in handle_register_request.
* libcrmcommon: Ignore empty time spec
* tools: Don't wait on certain "pending" monitor actions.
(gh#ClusterLabs/pacemaker#4073)
* libcrmcommon: Create a log file if it doesn't exist.
* fencer: Disable watchdog-based self-fencing if "fencing-watchdog-timeout" is
unset (gh#ClusterLabs/pacemaker#4067)
* fencer: Make the deprecated "stonith-watchdog-timeout" option work again
(gh#ClusterLabs/pacemaker#4068)
* libcrmcommon: Move deprecatd PCMK_OPT_STONITH_TIMEOUT back to options.h
* pacemakerd: Correctly detect ping requests from sbd
(gh#ClusterLabs/pacemaker#4066)
* libcrmcommon: Improve message for qb_log_file_open() fail
* libcrmcommon: Improve pcmk__add_logfile() message for fopen() fail
* libcrmcommon: More specific error for set_logfile_permissions()
* libcrmcommon: Improve validation of PCMK_logfile_mode
* liblrmd: Don't assert if queue_time is < 0.
* based: Don't log specially for PCMK__XA_CIB_UPDATE
* controller: Don't treat patchset-apply errors as OK
* libcrmcommon: xml_apply_patchset doesn't return diff_resync err
* libcib: Don't convert -pcmk_err_diff_resync to pcmk_ok
* libcrmcommon: Handle NULL PCMK_XA_FORMAT and PCMK_XA_DIGEST
* libcib, tools: Empty CIB contains admin_epoch before epoch
* daemons: Fix user/group checking in based.
* libcrmcommon: Fix a glib logging build error.
* libcrmcommon: Don't delete unchanged attributes when applying patch
* libcrmcommon: Fix potential use-after-free and double-free
(gh#ClusterLabs/pacemaker#4044)
* executor: Fix the typos in the logs.
* libcrmcommon: Set config warnings on mismatched ACL perm specs
* libcrmcommon: xml_acl_filtered_copy() returns false for NULL source
(gh#ClusterLabs/pacemaker#4039)
* libcrmcommon: Make parse_acl_entry() non-recursive
* libcrmcommon: Set config warnings and errors for acl_permission
* libcib: Log correct error message in replace_cib()
* libcib: Fix setting origin attributes in CIB updates
(gh#ClusterLabs/pacemaker#4028)
* tools: Drop crm_attribute --inhibit-policy-engine/-i option
* libcrmcommon: Fix memory leak in pcmk__read_series_sequence()
(gh#ClusterLabs/pacemaker#4032)
* liblrmd: Check that pcmk__init_tls doesn't set native->tls to NULL.
* tools: Drop crm_attribute --attr-value/--delete-attr options
* tools: Drop crm_attribute --attr-id option
* based: Drop unhelpful trace messages
* based: Improve a log message for IPC call options
* libcib: {add,del}_notify_callback support only cib_diff_notify
* based: Return correct code from write_cib_async()
* daemons: Use crm_ipc_client_response in lrmd_remote_client_msg.
* daemons: Set ipc_flags in lrmd_remote_client_msg to 0.
* daemons: Clean up XML memory in IPC dispatch functions.
* daemons: Fix a segfault displaying fencer metadata.
* based: Drop redundant messages from based_diff_notify()
* build: Handle CMocka deprecations
* various: Always NULL-check return value of pcmk__find_client()
* libcrmcommon: Improve messages in child_kill_helper()
* tools: Free memory in crm_resource.c:handle_metadata()
* pacemakerd: Use g_str_has_prefix() in handle_ping_request()
* libpacemaker: Correctly check node types in pcmk__list_nodes()
* pacemakerd: Match correctly in PCMK_{valgrind,callgrind}_enabled
* libcrmcommon: Match correctly in PCMK_debug, stderr, blackbox
* spec: Requires libxml2-tools since DLM controld RA requires xmllint
(bsc#1259345)
* daemons: Fix a typo if no existing attrd is found.
* daemons: Call pcmk_cluster_disconnect at the end of fenced.
* libcrmcommon: Fix underflow in crm_time_add_days()
* libcrmcommon: Avoid integer overflow in seconds_to_hms()
* spec: do not treat fillup templates as configuration files
* build: install the default logrotate config into /usr/etc/logrotate.d
* build: create directories in /var via tmpfiles.d
* build: create hacluster user and haclient group via sysusers.d
* agents: Deprecate allow_stonith_disabled param for controld RA
* agents: New allow_fencing_disabled param for controld RA
* agents: Use case-insensitive property matching in controld RA
* schemas: Deprecate stonith-timeout-ms in crm_mon output
* schemas: Deprecate stonith-enabled in crm_mon output
* various: New fencing-timeout-ms in crm_mon/pcmk_status output
* schemas: New fencing-timeout-ms attribute in crm_mon schema
* various: New fencing-enabled in crm_mon/pcmk_status output
* schemas: New fencing-enabled attribute in crm_mon schema
* tools: cibadmin --xpath --delete-all deletes all matches again
* various: Use const for a few string pointer variables
* cts: Respect cts-lab --nic option if specified for IPv4
(gh#ClusterLabs/pacemaker#3986)
* cts: cts-lab --nic option defaults to eth0 only for an IPv6 link local
address (gh#ClusterLabs/pacemaker#3986)
* controller: Ask attribute manager to purge fenced nodes' attributes
* controller: Don't purge transient attributes on node loss
(gh#ClusterLabs/pacemaker#3991)
* controller: Allow purging node attrs without cache removal
* controller: don't need to erase node attributes for remote nodes
* pacemaker-attrd: Drop "requesting shutdown" code
* pacemaker-attrd: Wipe CIB along with memory (gh#ClusterLabs/pacemaker#3991)
* libcrmservice: Correctly check the return value of stat.
* fencer: Improve validation of pcmk_host_map
* fencer: Drop support for escaped characters in pcmk_host_map
* fencer: Drop unhelpful message from build_port_aliases()
* fencer: Fix ISO 8601 interval parsing in pcmk_delay_base
* daemons: When checking for duplicate messages, we might be prepending.
* daemons: Don't add repeated I_PE_CALC messages to the fsa queue.
* scheduler: promoted state with promoted state with attribute
* fencer: Log an error for empty pcmk_delay_base mapping key
* fencer: Fix a format string
* libcrmservice: List only the requested directory contents
* build, libcrmservice: initdir must be a single directory
* libcrmservice: Fix memory leaks when listing directory contents
* cts: Add cts-lab --nic option used for generated IP address resources
(gh#ClusterLabs/pacemaker#3982)
* libcrmcommon: Loop on EAGAIN in mainloop_gio_callback.
* daemons: Get rid of some logged warnings in execd.
* libcrmcommon: Bump feature set to 3.20.5
* libcrmcommon: Deprecate stop-removed-resources cluster property
* libcrmcommon: Deprecate cancel-removed-actions cluster property
* libpe_status: Warn if concurrent-fencing is false
* libcrmcommon: Deprecate enable-startup-probes cluster property
* libcrmcommon: Rename stop-removed-actions to cancel-removed-actions
* libcrmcommon: Deprecate cluster-ipc-limit cluster option
* cts-cli: Escape special characters in the path for a pattern
(gh#ClusterLabs/pacemaker#3971)
* tools: Handle large timeouts correctly in crm_resource --wait
* controller: NULL-check lrm_state before dereferencing it
* tools: cibsecret should work with CIB_file set.
* controller: Avoid "stonith" in log messages
* tools: Use "fencing" in stonith_admin/crm_resource
* libpe_status: Use "fencing" instead of "STONITH" in some logs
* libcrmcommon: New "fencing-reaction" cluster property
* libcrmcommon: New "fencing-watchdog-timeout" cluster property
* libcrmcommon: New "fencing-timeout" cluster property
* libcrmcommon: New "fencing-max-attempts" cluster property
* libcrmcommon: New "fencing-action" cluster property
* libcrmcommon: New "fencing-enabled" cluster property
* libcrmcommon: Update documentation for cluster-ipc-limit.
* libcrmcommon: Be more lenient in evicting IPC clients.
* tools: Deprecate iso8601 command line tool
* libcrmcommon: Show deprecated option aliases in outputs
* libcrmcommon: Parse iso8601 strings according to spec.
* fencer: Prevent unsigned int overflow in get_action_timeout()
* libcrmcommon: Fix integer overflow of alert timeouts
* libcrmcommon: Ensure stonith watchdog timeout is in long range
* controller, fencer: Ignore negative/unparsable pcmk_monitor_timeout
* cts: Drop cts script
* tools: Drop crm_report -T/--cts and --cts-log options
* schemas: Deprecate "orphaned" attribute
* schemas: resource XML element has new "removed" attribute
* schemas: Deprecate "orphan" attribute in crm_mon and crm_simulate
* schemas: resource_history XML element has new "removed" attribute
* libcrmcommon: Fix a segfault in internal_ipc_get_reply. (bsc#1255371,
gh#ClusterLabs/pacemaker#3949)
* libcrmcommon: New "stop-removed-resources" cluster property
* libcrmcommon: New "stop-removed-actions" cluster property
* sysconfig: Remove --leak-check=full from default VALGRIND_OPTS.
* tools: Hide crm_mon --as-xml option
* crm_mon: Deprecate --pid-file/-p option
* tools: Fix CIB validation in crm_mon.c
* libcib, libcrmcommon: Improve a couple of log messages
* libcrmcommon: pcmk__quote_cmdline() returns valid shell string
* libcrmcommon: Bump feature set to 3.20.4
* schemas: Add a schema for cibadmin
* tools: Use formatted output in cibadmin
* tools: Formatted output for cibadmin --show-access --query
* tools: Formatted output for cibadmin --node-path
* tools: Basic cibadmin XML formatted output
* tools: Formatted output for cibadmin --empty
* tools: Formatted output for cibadmin --md5-sum{,-versioned}
* tools: Deprecate cibadmin -e/--node-path option
* libcrmcommon: bump feature set to 3.20.3
* schemas: Add a schema for cibsecret.
* libcrmcommon: Return a value for md5sum of empty input.
* tools: Remove the shell version of cibsecret.
* tools: Improve some cibadmin error messages
* tools: cibadmin renders ACLs only when output is cib element
* tools: cibadmin now errors if unable to compute md5 sum
* libcib, tools: Resolve cibadmin TODO re: ACL rendering and input
* controller: Avoid crash due to GSource double-free
* tools: Deprecate cibadmin -N/--node option
* tools: Drop "Digest: " from cibadmin --md5-sum stderr
* tools: cibadmin ignores --node-path for non-XPath-query command
* tools: Change exit codes for failure to create cib_t object
* libcib: Fix cib__signon_retry() return code
* tools: Deprecate cibadmin --show-access as non-privileged user
* tools: Don't require --force for non-privileged cibadmin ACLs
* tools: Default cibadmin command is now --query
* tools: Deprecate current input source precedence in cibadmin
* tools: Drop cibadmin --extended-version/-! option
* libcrmcommon: Bump feature set to 3.20.2
* schemas: Add a schema for crm_diff
* tools: Use formatted output in crm_diff.c
* libcrmcommon: Standardize remote environment variable parsing
* libcrmcommon: Allow empty string values in pcmk__scan_nvpair()
* libcrmcommon: Keep trailing newlines in pcmk__scan_nvpair()
* fencer: Fix fence delay range off-by-one
* daemons: Return CRM_EX_PROTOCOL when ACKing an unknown request.
* daemons: Correct result error string on unknown IPC messages.
* daemons: Add a return to do_pe_invoke_callback.
* tools: Deprecate crm_diff --stdin
* tools: Improve error handling in crm_diff.c
* tools: Be stricter about crm_diff --cib/--no-version
* libcrmcommon: Don't require version info when applying CIB patches
* agents: Error check calling attrd_updater in HealthSMART.
* agents: Error check calling attrd_updater in HealthIOWait.
* agents: Error out if CPU I/O wait time isn't available.
* agents: Error check calling attrd_updater in HealthCPU.
* agents: Error out if CPU idleness isn't available.
* daemons: Don't log the unresponsive message for a daemon we killed
* controller: Avoid blocking wait in controller for CIB re-request
* cts: Remove --valgrind-tests
* cts: Leave valgrind results around if they're not empty.
* NLS: update translations before 3.0.1-rc1
* libpacemaker: Prevent CIB growth during crm_simulate --profile
* daemons: Fix a toctou bug when fetching additional schemas.
* Address coverity issues.
* Address certain clang static analysis errors.
* libs: Fix cppcheck warnings.
* libcrmcommon: bump feature set to 3.20.1
* scheduler: Require a cluster option for old remote fencing behavior.
* scheduler: Don't always fence online remote nodes.
* daemons: Convert schedulerd to support multipart IPC messages.
* daemons: Convert attrd to support multipart IPC messages.
* daemons: Convert pacemakerd to support multipart IPC messages.
* daemons: Convert execd to support multipart IPC messages.
* daemons: Convert fenced to support multipart IPC messages.
* daemons: Convert controld to support multipart IPC messages.
* daemons: Convert based to support multipart IPC messages.
* libcrmcommon: Retry on EAGAIN in crm_ipcs_flush_events.
* libcrmcommon: All parts of a multipart event should have the same ID
* libcrmcommon: Don't immediately overwrite request ID.
* libcrmcommon: Check the client buffer in crm_ipc_buffer.
* libcrmcommon: Handle sending multi-part IPC server events.
* libcrmcommon: crm_ipc_read can receive large IPC messages.
* libcrmcommon: Elements should never match if IDs differ
* libcrmcommon: Consistently free iov on error.
* libcrmcommon: Always free temp node in mark_child_deleted()
* libcrmcommon: Fix XML matching when marking changes
* fencer: Don't remove device if child is deleted
* controller: Populate nodes from peer cache if can't from cluster
* libcib: Don't match element based on XPath matching an attribute
* tools: Use correct error code for command lookup failure
* tools: Dry-run crm_resource --fail if CIB_file is set
* libcrmcommon: Sort schema transformations on non-glibc systems
* libcrmcommon: Ensure schema transform numbers are in valid range
* libcrmcommon: Match literal dots in schema transform filter
* spec: Provides user(hacluster) and group(haclient)
* libcrmservice: Fix overrides for systemd resources
* libcrmservice: Fail systemd rsc start if create override fails
* Build: Run cts-cli verbosely.
* controller: improve resource action execution logs
* controller: improve start-up/exit messages
* controller: drop dot file logs
* controller: simplify join finalization messages
* pacemaker-based: improve a few messages
* pacemaker-based: improve exit messages
* pacemaker-based: improve messages when reading CIB from disk
* libpacemaker: Reset scheduler object in pcmk_simulate()
* libpe_status: Make cluster_status() idempotent
* tools: Fix overflow in crm_simulate --repeat
* libpacemaker: Handle scandir() error in pcmk__profile_dir()
* libpacemaker: Fix mem leak in pcmk__profile_dir()
* tools: Avoid crash in crm_simulate --profile
* Makefile: drop asciidoc references
* crm_diff: Replace variable name
* Drop deprecated '\--sync-call' option from cibadmin
* Drop deprecated '-l/--local' option from cibadmin in multiple places
* raise minimum GnuTLS dependency to 3.4.6
* sysconfig: document when logs may show sensitive info
* pacemaker-attrd: reduce log spam at shutdown
* executor: avoid misleading log when cancelling a recurring monitor
* scheduler: improve restart-needed log
* scheduler: don't show node capacity for bundle nodes
* scheduler: clarify no-quorum effects
* libcrmcommon: improve flag set/clear messages
* libcrmcommon: improve message for unsupported XPath match
* libstonithd: improve action re-attempt message
* libcib: Don't send CRM_OP_REGISTER from cib_remote client
* tools: mention potential issues with crm_resource --restart
* tools: indicate crm_resource --interval can take units
* tools: clarify that crm_mon updates are automatic when interactive
* agents: Replace the egrep command with the EGREP definition in ping RA
* libcrmcluster: fix format typos
* doc: drop Inkscape dependency
* tools: validate stonith_admin --timeout value
* libpacemaker: set fail-count to INFINITY for fatal failures
* libpacemaker: add PCMK__XA_FAILED_START_OFFSET and
PCMK__XA_FAILED_STOP_OFFSET
* tools: Deprecate cibadmin --sync-call
* OCF: controld.in: Remove gfs_controld command as it's already obsoleted
* xml: Warn about post-transform behavior changes for ACLs with xpath
* sysconfig: Document using certificates for remote nodes.
* sysconfig: Explain permissions needed on TLS-related files.
* libcrmcluster: restore CPG header size compatibility
* libcrmcluster: improve messages in pcmk__cpg_message_data()
* liblrmd: Enable TLS support for Pacemaker Remote clients.
* daemons: Enable TLS support for Pacemaker Remote nodes.
* libcrmcommon: Set *tls = NULL in a few more locations.
* libcib: Enable TLS certs for remote CIB operations.
* libs: Log if a TLS certificate is close to expiration.
* libcrmcommon: If the server supports certs, require them...
* daemons: Set up X509 auth in based if enabled.
* sysconfig: Add env settings needed for X509 authentication.
* libcrmcluster: don't assert for CPG decompression error
* libcrmcluster: avoid redundant log for invalid CPG messages
* libcrmcluster: initialize from in pcmk__cpg_message_data()
* scheduler: avoid memory leak in bundles
* xml: Preserve ACL reference behavior for replaced constraints
* xml: Ensure ACL permissions are valid after XSL transformations
* xml: Warn if schema transformation drops remove-after-stop property
* xml: Warn if schema transformation drops moon phase
* xml: Info if schema transformation drops empty groups or clones
* xml: Warn if schema transformation drops colocation/order lifetimes
* xml: Warn if schema transformation drops can_fail or...
* xml: Warn if schema transformation drops restart-type meta-attr
* xml: Warn if schema transformation drops rkt bundles
* xml: Warn if schema transformation drops nagios/upstart resources
* log: Allow CIB upgrade messages to start with W, I, D
* various: clean up library memory at child exit
* pacemaker-remoted: improve exit codes for schema failures
* controller: avoid memory leak when updating join phase
* scheduler: avoid memory leak when freeing node copies
* libcrmcommon: drop unhelpful trace message
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* SUSE Linux Enterprise Server High Availability Extension 16.0
zypper in -t patch SUSE-SLES-HA-16.0-1882
## Package List:
* SUSE Linux Enterprise Server High Availability Extension 16.0 (ppc64le s390x
x86_64)
* pacemaker-3.0.3+20260728.7052efa194-160000.1.1
* pacemaker-libs-3.0.3+20260728.7052efa194-160000.1.1
* pacemaker-cli-debuginfo-3.0.3+20260728.7052efa194-160000.1.1
* pacemaker-devel-3.0.3+20260728.7052efa194-160000.1.1
* pacemaker-debuginfo-3.0.3+20260728.7052efa194-160000.1.1
* pacemaker-libs-debuginfo-3.0.3+20260728.7052efa194-160000.1.1
* pacemaker-remote-debuginfo-3.0.3+20260728.7052efa194-160000.1.1
* pacemaker-debugsource-3.0.3+20260728.7052efa194-160000.1.1
* pacemaker-cli-3.0.3+20260728.7052efa194-160000.1.1
* pacemaker-remote-3.0.3+20260728.7052efa194-160000.1.1
* SUSE Linux Enterprise Server High Availability Extension 16.0 (noarch)
* python3-pacemaker-3.0.3+20260728.7052efa194-160000.1.1
* pacemaker-cts-3.0.3+20260728.7052efa194-160000.1.1
* pacemaker-schemas-3.0.3+20260728.7052efa194-160000.1.1
## References:
* https://www.suse.com/security/cve/CVE-2026-10649.html
* https://bugzilla.suse.com/show_bug.cgi?id=1180966
* https://bugzilla.suse.com/show_bug.cgi?id=1249217
* https://bugzilla.suse.com/show_bug.cgi?id=1255371
* https://bugzilla.suse.com/show_bug.cgi?id=1259345
* https://bugzilla.suse.com/show_bug.cgi?id=1265183
* https://bugzilla.suse.com/show_bug.cgi?id=1265201
* https://bugzilla.suse.com/show_bug.cgi?id=1268381
* https://bugzilla.suse.com/show_bug.cgi?id=1270354
* https://bugzilla.suse.com/show_bug.cgi?id=1271652
* https://bugzilla.suse.com/show_bug.cgi?id=1272452
* https://bugzilla.suse.com/show_bug.cgi?id=1279543
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-security-updates/attachments/20261020/5070fed5/attachment.htm>
More information about the sle-security-updates
mailing list