SUSE-RU-2026:23977-1: important: Recommended update for s390-tools

[SLE-UPDATES]

# Recommended update for s390-tools

Announcement ID: SUSE-RU-2026:23977-1  
Release Date: 2026-10-01T11:10:40Z  
Rating: important  
References:

  * bsc#1273204
  * bsc#1273205
  * bsc#1273206
  * bsc#1273207
  * bsc#1275476

  
Affected Products:

  * SUSE Linux Micro 6.2

  
  
An update that has five fixes can now be installed.

## Description:

This update for s390-tools fixes the following issues:

Changes in s390-tools:

  * Upgrade to version 2.44.1 (bsc#1273204, bsc#1273205, bsc#1273206,
    bsc#1273207, bsc#1275476): For Linux kernel version: 7.2
    * Changes of existing tools:
      * cpumf/lshwc: Add -c as short option for --counters
      * cpumf/lspai: Handle CPU hotplug gracefully
      * dbginfo.sh: Change grep for OS name
      * dbginfo.sh: Change tar generation via temp file
      * dbginfo.sh: Correct dump counter
      * dbginfo.sh: Detect the openCryptoki STDLL directory at runtime
      * dbginfo.sh: Redirect stderr on command existence checks
      * dbginfo.sh: Replace deprecated backtick command substitution
      * dbginfo.sh: Secure the directory input variable
      * zipl: Detect and display partition table type for disk and device
    * Bug Fixes:
      * cmsfs-fuse: Fix out-of-bounds access when reading variable-length files
      * cpumf/lscpumf: Fix exit status and error reporting
      * cpumf/lshwc: Fix --allcpu to --all in man page
      * cpumf/lspai: Add input validation for interval parameter
      * cpumf/lspai: Fix --allcpu to --all in man page
      * cpumf/lspai: Fix integer overflow in file descriptor calculation
      * cpumf/lspai: Fix output formatting with minimum indent
      * dasdview: Fix buffer overflow in dasdview_read_vtoc()
      * dumpconf: Harden locking during delayed activation to prevent symlink attacks
      * fdasd: Fix potential buffer overflow in fdasd_change_part_type()
      * ipl_tools: Fix buffer overflow vulnerabilities in chreipl and is_lpar()
      * ip_watcher: Use mktemp for cleanup files to avoid collisions
      * libkmipclient: Fix NULL pointer dereference in kmip_v2_attr_from_v1_attr()
      * libkmipclient: Fix heap buffer overflow
      * libutil/util_lockfile: Prevent buffer overflow in lockfile handling
      * libzds: Add bounds checking and validate used_bytes in PDS directory parsing
      * pvattest: Write attestation request private key (arpk) with 0600 permissions
      * pvebc: Fix executable permission on sel-ebc-modules.conf
      * pvics: Fix incorrect exit values for --version and --help options
      * pvsecret: Write secret with 0600 permissions
      * sclpdbf: Harden against invalid trace data
      * vmur: Fix buffer over-read in get_minor()
      * zdump/dfi_s390: Add a check for zlib entry size in the dump header
      * zdump/dfi_s390: Fix out-of-bounds upon dump entry decompression
      * zdump/dfo_elf: Fix 32-bit truncation in ELF header allocation size
      * zdump: Reject multi-volume dumps with out-of-range vol_cnt
      * ziomon/ziomon_zfcpdd: Validate message lengths before processing
      * ziomon/ziorep_config: Replace unsafe open() and regex match with safer idioms
      * ziomon: Validate message layout and aggregate message lengths before processing
      * zipl: Fix memory leak in free_bootloader()
      * zipl: Replace popen(3) with safer invocation for targetbase scripts and ngdump
      * zkey-ekmfweb: Fix insecure default: TLS host name verification now enabled by default
      * zkey-kmip: Fix insecure default: TLS host name verification now enabled by default
      * zkey: Fix memory leaks when generating keys or reenciphering integrity volumes
      * zkey: Harden 'zkey kms unbind' command against symlink traversal
      * zkey: Harden KMS config directory handling against symlink attacks
      * zkey: Harden KMS plugin file handling against symlink attacks
      * zkey: Install initrd integration with the configured plugin directory
  * Full Changelog: v2.44.0...v2.44.1:
    https://github.com/ibm-s390-linux/s390-tools/compare/v2.44.0...v2.44.1
  * Removed obsolete patches for Security vulnerabilities for zkey and friends
    * zkey: Harden KMS config directory handling - Commit `0eef784`
    * zkey: Harden 'zkey kms unbind' command - Commit `1b90d15`
    * zkey/ekmfweb, zkey/kmip: Harden KMS plugin file handling - Commit `bc81c32`

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".  
Alternatively you can run the command listed for your product:

  * SUSE Linux Micro 6.2  
    zypper in -t patch SUSE-SL-Micro-6.2-1799

## Package List:

  * SUSE Linux Micro 6.2 (s390x)
    * libekmfweb1-debuginfo-2.44.1-160000.1.1
    * libkmipclient1-2.44.1-160000.1.1
    * s390-tools-debugsource-2.44.1-160000.1.1
    * libkmipclient1-debuginfo-2.44.1-160000.1.1
    * libekmfweb1-2.44.1-160000.1.1
    * s390-tools-2.44.1-160000.1.1
    * s390-tools-debuginfo-2.44.1-160000.1.1
  * SUSE Linux Micro 6.2 (noarch)
    * s390-tools-chreipl-fcp-mpath-2.44.1-160000.1.1
    * s390-tools-genprotimg-data-2.44.1-160000.1.1

## References:

  * https://bugzilla.suse.com/show_bug.cgi?id=1273204
  * https://bugzilla.suse.com/show_bug.cgi?id=1273205
  * https://bugzilla.suse.com/show_bug.cgi?id=1273206
  * https://bugzilla.suse.com/show_bug.cgi?id=1273207
  * https://bugzilla.suse.com/show_bug.cgi?id=1275476

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-updates/attachments/20261005/947fa63e/attachment.htm>