Skip to main content
CVE-2026-41676VulnerabilityPublished Updated

SUSE · Security update for sdbootutil

Affects SUSESource GCVE Database

0
Compare

Mentioned vulnerabilities

Not known to be exploited.

Data as of 10 Nov 2026, 20:06 UTC

Severity
High

Rated by Threat Radar · CVSS not yet scored by NVD

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 23 Sep 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponized: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 10 Nov 2026.

Description

This update for sdbootutil fixes the following issues: Security issues fixed: - CVE-2026-41676: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1 (bsc#1270192). - CVE-2026-41677: out-of-bounds read in PEM password callback when returning an oversized length in rust-openssl crate (bsc#1270616). - CVE-2026-41678: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270670). - CVE-2026-41681: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270742). - CVE-2026-41898: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270863). - CVE-2026-42327: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270471). - CVE-2026-44662: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270922). - CVE-2026-45784: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270995). Non security issues fixed: - sdbootutil-update-predictions.service fails with Failed to start Update TPM predictions (bsc#1273384). - systemd ordering cycle and other service problems with snapshot 20260722 (bsc#1272525). - Unable to unlock multiple encrypted partitions with FIDO2 Key, Systemdboot+LUKS (bsc#1234010). Changes for sdbootutil: - Update to version 1+git20260908.c641fc2: * Update the shim when required * Warn when recovery PIN is different from recovery key * Improves extra boot entries support * Better report when the default snapshot diverges * Explain how to do re-enrolling if recovery PIN fails * Explain why update-prediction fails and how to solve it * Hide comparison output * Add bootctl default entry in the prediction - Update to version 1+git20260903.f91f636: * Include FIDO2 unlocked devices for ordering (bsc#1234010) * Test in parallel for speed up * Add --repair parameter to cleanup * Fix shellcheck complain * Report entries with missing files * Avoid duplicate entries in non-snapper systems * Add initial tests for sdbootutil * Report the error if bootctl clean fails - Update to version 1+git20260901.41540d5: * No warn if a component is not in the event log * Add status command * Select the new sdbootutil if available * Skip blank lines in measure-pcr-generator.sh * Do not change crypttab for unrelated entries * Report the bad PCR when update-prediction fail * Do not write the recovery PIN in the journal * Improves non snapshot system support * Update help message for --measure-pcr * Report when PCR 7 is dropped because shim update * Add --strict parameter for --pcr policy * Report dropped PCRs via a warn * Adjust the limits for PolicyOR issues * Avoid update predictions if the service is up * Keep the exit status of sdbootutil call - Update to version 1+git20260827.786f9a8: * Do not accept empty passwords * jeos-firstboot-enroll: report errors also in the journal * Restore old crypttab via the exit trap * Update CLAUDE data * Detect half created openssl keys * check_enrolled report when something was written in the LUKS2 header * Improve a bit the disk-encryption-tool keyslot detection * Avoid leak of env var secrets * Wipe the d-e-t key in the enroll service and jeos module * Remove the correct keyslot left by d-e-t * Differentiate tpm2 and tpm2+pin for unattended unlock * Use is_same_device in detect_tracked_device and drop greps * Refactor check to avoid shellcheck complain * Parse the entry file in a sigle place * Validate the entry with the new kernel name * Refactor enrollment interface and deprecate the old one * New kernels will have different hash * Warn If no crypttab entry found * Extend is_same_device * jeos-firstboot-enroll: validate the passwords * sdbootutil-enroll: report when no encryption method is provided * Write recovery pin after enrollment in jeos module * Write recovery pin after enrollment * Improve error detection in sdbootutil-enroll * Increase keyctl timeout * Merge require_unlock and set_unlock_method * Be sure that the terminal check works with snapper * Renerate initrd when new measure-pcr keys are created * Separate ask-* parameters * Fix reading credential and keyctl password * Get the device password for each enrolling mechanism * Drop elements from crypttab if the enrollment fails * Validate the enrollment for each method * Add warning when enrolling FIDO2 token - Update to version 1+git20260825.c7a5a97: * Refactor free space calculation * Do not use /proc/cmdline in half configured systems * Warning when the recovery PIN is not validated * Show default and booted snapshots with marks * Improve detection of snapshot systems * Fix when searching for a boot entry * Fix boot order and boot order entry * Create the entries directory in the ESP * Fix get_final_pcr parser * Keep btrfs error and sh

References

Community reviews

Loading reviews…