This update for gimp fixes the following issues:
- CVE-2026-82328: undersized palette memory allocations in the ICO loader can cause heap out-of-bounds reads
(bsc#1277618).
- CVE-2026-82343: improper channel-count handling in the PSD loader can cause heap and stack out-of-bounds reads
(bsc#1277622).
- CVE-2026-106061: integer overflow in the X cursor thumbnail loader leads to out-of-bounds read and process crash when
generating a thumbnail for a crafted XMC file (bsc#1284473).
- CVE-2026-106062: heap-based buffer overflow in DirectDraw Surface loader when loading a crafted DDS image
(bsc#1284474).
- CVE-2026-106063: heap-based buffer
This update for emacs fixes the following issues:
- CVE-2026-79992: zero-click local command execution via TRAMP (bsc#1275927).
- CVE-2026-108976: flawed username input regex validation in TRAMP can cause arbitrary OS command injection
(bsc#1284345, bsc#1284990).
The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues:
The following security issues were fixed:
- CVE-2023-54158: btrfs: don't free qgroup space unless specified (bsc#1256076).
- CVE-2023-54180: btrfs: handle case when repair happens with dev-replace (bsc#1255995).
- CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
- CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
- CVE-2026-63948: Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (bsc#1272670).
- CVE-2026-63983: net: Introduce skb tc de
This update for aws-iam-authenticator fixes the following issues:
- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272130).
- CVE-2026-78669: golang.org/x/net/http2: excessive CPU consumption from repeated initial window changes (bsc#1285302).
Changes for aws-iam-authenticator:
- Updated to version 0.7.22
This update for cpupower fixes the following issue:
- CVE-2026-80663: tools/power/x86/intel-speed-select: Harden daemon pidfile open (bsc#1278335).
Changes for cpupower:
- Release to latest kernel-source including:
* intel-speed-select: Harden daemon pidfile open (CVE-2026-80663 bsc#1278335)
* cpupower: Fix incorrect size in cpuidle_state_disable()
* cpupower: fix error return value in cpupower_write_sysfs()
* cpupower: Fix a bug where the -t option of the set subcommand was not working
* cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop()
This update for docker fixes the following issues:
Security issues fixed:
- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
(bsc#1265782).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266625).
- CVE-2026-39984: github.com/sigstore/timestamp-authority/v2/pkg/verification: improper certificate validation can be
used to bypass some authorization controls (bsc#1262346).
- CVE-2026-41567: arbitrary code execution with full daemon privileges when a user uploads a compre
This update for docker fixes the following issues:
Security issues fixed:
- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
(bsc#1265782).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266625).
- CVE-2026-39984: github.com/sigstore/timestamp-authority/v2/pkg/verification: improper certificate validation can be
used to bypass some authorization controls (bsc#1262346).
- CVE-2026-41567: arbitrary code execution with full daemon privileges when a user uploads a compre
Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qt
An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity — no data disclosure, data modification, or code execution — and the impact is contained to the affected process.
This update for containerd fixes the following issues:
- CVE-2026-39882: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp: Memory exhaustion via uncapped HTTP
response body reading (bsc#1274214).
- CVE-2026-47262: Denial of Service (DoS) condition via a maliciously crafted image (bsc#1268441).
- CVE-2026-53488: CRI plugin propagates labels from an image config to a container without validation (bsc#1268430).
- CVE-2026-53493: a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container
start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability (bsc#1282
Security update for the Linux Kernel (Live Patch 20 for SUSE Linux Enterprise 15 SP7)
This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.78 fixes various security issues:
The following security issues were fixed:
- CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272386).
- CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1276303).
Security update for the Linux Kernel (Live Patch 30 for SUSE Linux Enterprise 15 SP6)
This update for the SUSE Linux Enterprise Kernel 6.4.0-150600.23.130 fixes various security issues:
The following security issues were fixed:
- CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1272136).
- CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272386).
- CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1276303).
The ca-certificates package contains a set of Certificate Authority (CA) certificates chosen by the Mozilla Foundation for use with the Internet Public Key Infrastructure (PKI).
Security Fix(es):
* ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns (CVE-2026-114406)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Important: qemu-kvm security, bug fix, and enhancement update
Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.
Security Fix(es):
* qemu-kvm: qemu-guest-agent: Local privilege escalation via symlink attack in guest-ssh-add-authorized-keys (CVE-2026-12080)
Bug Fix(es) and Enhancement(s):
* qemu-img can't create a qcow2 overlay with 'data_file' feature on top of a file without destroying the original image [rhel-9.8.z] (JIRA:Rocky Linux-164549)
* live migration of a VM with a scsi3pr to a node that previously held a reservation on that disk fail
The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.
Security Fix(es):
* crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)
* net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
* crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)
For more details about the security issue(s), in
Expat is a C library for parsing XML documents.
Security Fix(es):
* expat: expat: Denial of Service via integer overflow in expat_realloc (CVE-2026-102633)
* expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.
Security Fix(es):
* httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi (CVE-2026-63718)
* httpd: httpd: Denial of Service via integer overflow in mod_dav_fs (CVE-2026-93546)
* httpd: httpd: Authentication state corruption via concurrent Digest authentication requests (CVE-2026-73637)
* httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response (CVE-2026-63045)
* httpd: httpd: Arbitrary code execution via oversized Host header in mod_vhost_alias (CVE-2026-63292)
* h
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.
Security Fix(es):
* kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (CVE-2026-64114)
* kernel: fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266)
* kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572)
* kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202)
* kernel: xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536)
* kernel: inet: frags: strip GSO state from fragments before rea
The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.
Security Fix(es):
* crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)
* net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
* crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)
For more details about the security issue(s), in
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.
Security Fix(es):
* net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)
* crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)
* net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
* crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)
For more details about the security issue(s),