Packages changed: MicroOS-release (20261013 -> 20261014) PackageKit ghostscript grub2 kernel-source (7.2.9 -> 7.2.10) openssh (10.5p1 -> 10.6p1) polkit-default-privs (1550+20261009.03465cb -> 1550+20261014.754cdd0) xen (4.22.0_04 -> 4.22.0_06) === Details === ==== MicroOS-release ==== Version update (20261013 -> 20261014) Subpackages: MicroOS-release-appliance MicroOS-release-dvd - automatically generated by openSUSE-release-tools/pkglistgen ==== PackageKit ==== Subpackages: PackageKit-backend-dnf5 libpackagekit-glib2-18 typelib-1_0-PackageKitGlib-1_0 - Update version dependencies according to meson.build. ==== ghostscript ==== - Ghostscript version 10.08.0 also fixes in particular the following two security issues, see the Ghostscript upstream git repository checkout of its 'ghostpdl-10.08.0' git tag which ends on Sep 8 2026 (not its 'gs10.08.0' branch which already ends Aug 18 2026), cf. the current https://ghostscript.com/releases/index.html "The latest release is Ghostscript 10.08.0 (2026-09-08)": - CVE-2026-103226 "Stack buffer overflow in gdevpsfx.c type1_callsubr(): unbounded ipstack push in pdfwrite Type 1->2 font converter" https://bugs.ghostscript.com/show_bug.cgi?id=709672 "stack-based buffer overflow in `pdfwrite` via crafted font data" (bsc#1283917) - CVE-2026-101258 "Heap buffer overflow (OOB write) via array-wrapped shading `/Function` (`base/gsfunc3.c`)" https://bugs.ghostscript.com/show_bug.cgi?id=709462 "-dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free" (bsc#1284397) - It seems the reason why the below CVE-2026-39919 and the above two CVE-2026-103226 CVE-2026-101258 are not listed in the Ghostscript upstream release notes is that those CVEs came after the Ghostscript 10.08.0 release date (Sep 8 2026) according to what the Ghostscript upstream bug reports show https://bugs.ghostscript.com/show_bug.cgi?id=709666 therein CVE-2026-39919 is mentioned on 2026-09-15 https://bugs.ghostscript.com/show_bug.cgi?id=709672 therein CVE-2026-103226 is mentioned on 2026-10-01 https://bugs.ghostscript.com/show_bug.cgi?id=709462 therein CVE-2026-101258 is mentioned on 2026-10-07 ==== grub2 ==== Subpackages: grub2-common grub2-i386-efi grub2-i386-efi-bls grub2-i386-pc grub2-snapper-plugin grub2-x86_64-efi grub2-x86_64-efi-bls - Fix PowerPC PCIe NVMe disk discovery (bsc#1239799 ltc#211961 bsc#1245357 ltc#214095) * 0001-ieee1275-ofdisk-fix-NULL-deref-and-use-after-free-in.patch * 0002-ieee1275-ofdisk-enumerate-all-PCIe-NVMe-namespaces.patch ==== kernel-source ==== Version update (7.2.9 -> 7.2.10) - Update patches.kernel.org/7.2.10-423-xen-netfront-drop-RX-packets-with-a-short-Ethe.patch (bsc#1012628 CVE-2026-98375 bsc#1284944). - Update patches.kernel.org/7.2.7-200-ipvs-fix-reversed-sequence-option-serialization.patch (bsc#1012628 CVE-2026-98078 bsc#1284150). - Update patches.kernel.org/7.2.7-247-bpf-don-t-rewrite-bpf_fastcall-patterns-entered.patch (bsc#1012628 CVE-2026-98048 bsc#1284235). - Update patches.kernel.org/7.2.8-005-xfrm-iptfs-fix-stack-OOB-read-in-iptfs_skb_rese.patch (bsc#1012628 CVE-2026-98372 bsc#1284282). - Update patches.kernel.org/7.2.8-007-xfrm-iptfs-fix-runt-reassembly-panic-from-short.patch (bsc#1012628 CVE-2026-98371 bsc#1284283). - Update patches.kernel.org/7.2.8-008-xfrm-fix-compat-ALLOCSPI-request-use-after-free.patch (bsc#1012628 CVE-2026-98370 bsc#1284744). - Update patches.kernel.org/7.2.8-009-xfrm-add-missing-rcu_read_lock-skb_dst_force-an.patch (bsc#1012628 CVE-2026-98369 bsc#1284656). - Update patches.kernel.org/7.2.8-010-esp-downgrade-zerocopy-managed-frags-before-mut.patch (bsc#1012628 CVE-2026-98368 bsc#1284498). - Update patches.kernel.org/7.2.8-017-RDMA-siw-Clear-association-under-lock-if-siw_qp.patch (bsc#1012628 CVE-2026-98367 bsc#1284424). - Update patches.kernel.org/7.2.8-018-RDMA-rxe-validate-access-flags-before-swapping-.patch (bsc#1012628 CVE-2026-98366 bsc#1284655). - Update patches.kernel.org/7.2.8-019-RDMA-rxe-Fix-integer-overflow-in-mr_check_range.patch (bsc#1012628 CVE-2026-98365 bsc#1284288). - Update patches.kernel.org/7.2.8-020-xfrm-hold-net_device-reference-under-RCU-in-bun.patch (bsc#1012628 CVE-2026-98364 bsc#1284653). - Update patches.kernel.org/7.2.8-021-firmware-arm_scpi-reject-DVFS-OPP-count-above-M.patch (bsc#1012628 CVE-2026-98363 bsc#1284652). - Update patches.kernel.org/7.2.8-022-clk-scpi-bound-check-DVFS-index-in-scpi_dvfs_re.patch (bsc#1012628 CVE-2026-98362 bsc#1284650). - Update patches.kernel.org/7.2.8-024-RDMA-rxe-Restore-HMM_PFN_WRITE-check-in-ODP-wri.patch (bsc#1012628 CVE-2026-98361 bsc#1284500). - Update patches.kernel.org/7.2.8-025-RDMA-rxe-insert-mcg-into-mcg_tree-only-after-rx.patch (bsc#1012628 CVE-2026-98360 bsc#1284649). - Update patches.kernel.org/7.2.8-027-RDMA-core-Reject-unregistering-netdevs-in-ib_ge.patch (bsc#1012628 CVE-2026-98359 bsc#1284746). - Update patches.kernel.org/7.2.8-035-IB-iser-reject-a-remote-invalidation-of-an-unre.patch (bsc#1012628 CVE-2026-98358 bsc#1284289). - Update patches.kernel.org/7.2.8-036-IB-isert-wait-for-deferred-control-PDU-completi.patch (bsc#1012628 CVE-2026-98357 bsc#1284791). - Update patches.kernel.org/7.2.8-037-RDMA-bnxt_re-check-create_singlethread_workqueu.patch (bsc#1012628 CVE-2026-98356 bsc#1284648). - Update patches.kernel.org/7.2.8-038-RDMA-rtrs-guard-against-null-kobj-name.patch (bsc#1012628 CVE-2026-98355 bsc#1284290). - Update patches.kernel.org/7.2.8-041-RDMA-mad-Fix-receive-buffer-leak-when-PKey-enfo.patch (bsc#1012628 CVE-2026-98354 bsc#1284291). - Update patches.kernel.org/7.2.8-042-RDMA-erdma-Use-IRQ-safe-XArray-helpers-for-QP-a.patch (bsc#1012628 git-fixes CVE-2026-98353 bsc#1284292). - Update patches.kernel.org/7.2.8-044-RDMA-rtrs-clt-Fix-CQ-pool-leak-when-connect-is-.patch (bsc#1012628 CVE-2026-98352 bsc#1284647). - Update patches.kernel.org/7.2.8-048-wifi-virt_wifi-free-skb-when-disconnected.patch (bsc#1012628 CVE-2026-98351 bsc#1284293). - Update patches.kernel.org/7.2.8-050-wifi-brcmfmac-cyw-pass-PMKID-to-firmware-if-pre.patch (bsc#1012628 CVE-2026-98350 bsc#1284646). - Update patches.kernel.org/7.2.8-051-wifi-libipw-reject-too-short-beacon-and-probe-r.patch (bsc#1012628 CVE-2026-98349 bsc#1284644). - Update patches.kernel.org/7.2.8-052-wifi-libipw-reject-too-short-association-respon.patch (bsc#1012628 CVE-2026-98348 bsc#1284643). - Update patches.kernel.org/7.2.8-053-IB-IPoIB-Avoid-restoring-OPER_UP-after-multicas.patch (bsc#1012628 CVE-2026-98347 bsc#1284295). - Update patches.kernel.org/7.2.8-054-wifi-cfg80211-don-t-get-the-radio-mask-for-netd.patch (bsc#1012628 CVE-2026-98346 bsc#1284642). - Update patches.kernel.org/7.2.8-055-wifi-cfg80211-check-IP-header-size-in-cfg80211_.patch (bsc#1012628 CVE-2026-98345 bsc#1284296). - Update patches.kernel.org/7.2.8-061-dmaengine-Fix-device-kref-underflow-in-dma_chan.patch (bsc#1012628 CVE-2026-98344 bsc#1284302). - Update patches.kernel.org/7.2.8-062-dmaengine-fix-use-after-free-in-dma_chan_put-an.patch (bsc#1012628 CVE-2026-98343 bsc#1284641). ... changelog too long, skipping 1352 lines ... - commit 8c0ce5c ==== openssh ==== Version update (10.5p1 -> 10.6p1) Subpackages: openssh-clients openssh-common openssh-server - Update to openssh 10.6p1: = Future deprecation notice * scp(1): begin deprecating the -R flag, which is used to perform a remote-to-remote copy by executing scp on a remote host. This option is a fragile optimisation that is difficult to use because it requires credentials on the remote host. It also creates security risks if the shell quoting rules on the remote system where the copy is performed differ from the client's expectations. From OpenSSH 10.6, this option will continue to work but will cause a deprecation warning to be emitted to standard error. In a future release, the option will be ignored and will leave in place the default remote-to-remote copy behaviour (copy via the host running scp). * sshd(8): support for platforms that do not allow file descriptor passing and that also require root privilege for PTY allocation will be removed in a future release. Affected platforms are known to include SCO OpenServer 5 and QNX 6 but may include other similarly old operating systems. This deprecation can be avoided if the user community for these platforms is able to assist us in building alternatives, such as avoiding the need for root in PTY allocation. = Potentially-incompatible changes * ssh(1), sshd(8): compression will be less effective as a result of the change noted below in the "Security" section * ssh(1): destination usernames entered on the commandline are now more strictly checked and will refuse usernames that include backslash and dollar symbols. Usernames that are specified by the "User" directive in configuration files are not subject to these restrictions. The motivation for this change is mentioned below in the "Security" section. * sshd(8): on platforms that do not support file descriptor passing and that require root for PTY allocation, the GatewayPorts and StreamLocalForwarding options are forcibly disabled. The motivation for this change is discussed below in the "Security" section. = Security * sftp(1): more strictly validate paths returned from the server to avoid some cases where a server could return paths that could manipulate a recursive copy operation into writing outside its target directory. Report and patch from Junghoon Cho. * sshd(8): when GSSAPIAuthentication is in use, only store GSSAPI credentials when authentication has succeeded. Avoids a situation where credentials from a failed GSSAPIAuthentication attempt may persist and be made inappropriately available if another authentication subsequently succeeds. Issue report and patch from Moritz Theile. * sshd(8): reset GSSAPIAuthentication before authentication, avoiding state from one authentication attempt being confused with that of a later attempt. Report and feedback from Moritz Theile. * sshd(8), ssh(1): disable LZ77 dictionary coder to mitigate the side-channel leaks described in "Crossing the Streams: SSH Plaintext Recovery via a Common Compression Context in Multiplexed Channels" by Fabian Bäumer and Marcus Brinkmann, preprint https://arxiv.org/abs/2609.07709 (2026) A chosen-plaintext attack method exists which makes use of dictionary-based compression to recover secrets from one channel by interacting with the SSH session's shared compression dictionary through another channel. Attacker-controlled input can recognizably reflect into the total length of transmitted ciphertexts by virtue of LZ77 replacing repeated strings with back-references into the SSH session's encoder search buffer, which is shared across all channels. For this reason, the documentation already recommended against enabling compression for connections that share trusted and untrusted traffic. This change will reduce the effectiveness of the Compression option. Users are encouraged to use application-level compression over the SSH protocol where possible, as this will typically be more effective and will be completely immune to this type of attack. * ssh(1): disallow '$' and '\' characters in usernames entered on the command-line to avoid usernames from untrusted sources yielding injection in shell context via ProxyCommand, Match exec, etc. Usernames specified via the configuration files are not subject this this control. Reported by SecBuddyF KeenLab Tencent (CodeBuddy Security) We continue to recommend against directly exposing ssh(1) and other tools' command-lines to untrusted input. Mitigations such as this can not be absolute given the variety of shells and user configurations in use. * ssh-keygen(1): correct handling of Daylight Saving Time when converting dates. Previous handling could cause errors of up to +/- 1 hour (unless you are in the Antarctica/Troll timezone, where the error could be +/- 2 hours). These errors could result in creation of certificates with incorrect expiry times. bz4004; from Khush Patel * sshd(8), ssh(1): ensure that compressed payloads don't inflate past the maximum supported packet length. Reported by Oleh Konko. * sshd(8): fully honor the authorized_keys "restrict" keyword, which was not being properly applied to tunnel forwarding (PermitTunnel, disabled by default). This is a separate problem to the one fixed in openssh-10.5. * sshd(8): correctly handle some options that accept "none". Some options, including AuthorizedPrincipalsFile, were documented as accepting "none" as a way to disable them; however, when ... changelog too long, skipping 158 lines ... * openssh-10.5p1-propagate-restrict-keyword.patch ==== polkit-default-privs ==== Version update (1550+20261009.03465cb -> 1550+20261014.754cdd0) - Update to version 1550+20261014.754cdd0: * profiles: add noctalia-greeter (bsc#1285400) ==== xen ==== Version update (4.22.0_04 -> 4.22.0_06) - bsc#1283315 - VUL-0: CVE-2026-79607: xen: Xenstore: Guests can crash xenstored during Live Update (XSA-514) 6aad1183-tools-xenstored-fix-live-update-with-watches-specifying-depth.patch - bsc#1283317 - VUL-0: CVE-2026-79608: xen: x86/AMD: ineffectual Zenbleed workaround (XSA-515) 6abbdd30-amd-Fix-inverted-condition-in-zenbleed_use_chickenbit.patch - bsc#1283321 - VUL-0: CVE-2026-79609: xen: x86: XPTI may break on huge-memory systems (XSA-516) 6abbe079-pv-map-each-vCPUs-root-page-table-in-its-per-domain-area.patch - bsc#1283322 - VUL-0: CVE-2026-79610: xen: grant-table: double version change race (XSA-517) 6abbe20c-gnttab-address-fallout-from-XSA-501.patch - bsc#1283323 - VUL-0: CVE-2026-79611: xen: VMX: VMentry failure with branch tracing and blocked states (XSA-518) 6abbe28e-vmx-Rework-#DB-intercept-logic-to-fix-VMEntry-failure-with-BTF.patch - Upstream bug fixes (bsc#1027519) 6aa28713-xen-sched-core-kill-unarmed-timers-on-sched_init_vcpu-failure.patch 6abceba2-xen-sched-core-skip-missing-vcpu-slots-in-sched_move_domain.patch 6abcebd8-vmx-Handle-TDX-instruction-exit-reasons.patch 6abcec00-boot-Force-error-checking-for-reserve_e820_ram.patch