This update for util-linux fixes the following issues:
- CVE-2026-13595: heap use-after-free in `libblkid` nested partition probing (bsc#1269583).
- CVE-2026-27456: TOCTOU in the mount program when setting up loop devices (bsc#1261606).
- CVE-2026-53612: local privilege escalation via TOCTOU in mount(8) hook_owner.c chmod/chown (bsc#1268886).
- CVE-2026-53613: local privilege escalation via TOCTOU in mount(8) - Target Path Redirection (bsc#1268886).
- CVE-2026-53614: local privilege escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec
Bypass in SUID mount(8) (bsc#1268886).
- CVE-2026-76642: failed external mount helper triggers privileged `X-mount` post-hooks, which enables local privilege
escalation (bsc#1278349).
- CVE-2026-78408: `nsenter --join-cgroup` leaks root `cgroup` migration authority, which allows for migration or
termination of root processes (bsc#1278348).
- CVE-2026-78410: restricted `bind` mounts do not pin the source, which allows for `X-mount.owner`/`group`/`mode`
redirection (bsc#1278347).
Changes for util-linux:
- lib/fileutils: add ul_openat_resolve() openat2 wrapper (bsc#1275441)
- lib/fileutils: fix RESOLVE_NO_SYMLINKS fallback value
- lib/fileutils: fix unused parameter warnings without SYS_openat2
- libmount: add missing fileutils.h include to hook_idmap.c
- libmount: add mnt_open_tree() helper for safe tree opening
- libmount: pin source path with openat2() for restricted users
(bsc#1275441, bsc#1278347, CVE-2026-78410)
- libmount: restrict source path canonicalization for non-root
users (bsc#1275441, bsc#1278347, CVE-2026-78410)
- libmount: skip post-mount hooks after failed mount helper
(bsc#1275441, bsc#1278349, CVE-2026-76642)
- libmount: use USE_LIBMOUNT_MOUNTFD_SUPPORT for idmap hook
- nsenter: close cgroup.procs fd after join to prevent authority
leak (bsc#1275441, bsc#1278348, CVE-2026-78408)
- nsenter, unshare: add O_CLOEXEC to all open() calls (bsc#1275441,
bsc#1278348, CVE-2026-78408)
- wall, write: sanitize hostname in banner header (bsc#1275441)
- Add missing function. (bsc#1275441)
- ipcutils: Prevent using uninitialized variable (bsc#1268886)
- BREAKING CHANGE:
Paths must always be canonicalized for unprivileged users to
ensure safe target resolution. X-mount.nocanonicalize is ignored
for them.
- INCOMAPTIBLE CHANGE (linux < 6.15):
X-mount.subdir: The safe detached subdirectory is no more
supported for unprivileged users for safety reasons.
- liblastlog2: Wait on busy SQLite connections (bsc#1268886).
- libmount: Fix subvolid buffer overflow in get_btrfs_fs_root
(bsc#1268886).
- libblkid: Fix use-after-free in nested partition probing
(bsc#1269583, bsc#1268886, CVE-2026-13595)
- libmount: fix SUID bypass via LIBMOUNT_FORCE_MOUNT2 and legacy
mount path (bsc#1268886, CVE-2026-53614, GHSA-67r7-8m5w-22wx).
- fileutils: add ul_open_no_symlinks() needed by other patches
(bsc#1268886).
- libmount: add fd_target to context for TOCTOU race condition
prevention (bsc#1268886, CVE-2026-53613, GHSA-8gj5-72r3-428g).
- libmount: ignore X-mount.nocanonicalize for restricted users
- libmount: use fd-based fchownat/chmod in hook_owner (bsc#1268886,
CVE-2026-53612, GHSA-g8wm-75wr-g2vh).
- libmount: restrict X-mount.subdir for non-root (bsc#1268886).
- libmount: use fd_target in hook_idmap for move_mount()
- libmount: add mount ID verification and man page TOCTOU note
- loopdev: use openat2(RESOLVE_NO_SYMLINKS) for backing file
(bsc#1268886#c2, bsc#1261606).
- Ignore pam-config error that prevents update failure if common*
pam configuration is not symlink to common-*-pc (bsc#1270219).
Multiple vulnerabilities in zstd-jni have been addressed in version v1.5.7.16. These include denial of service and information disclosure via out-of-bounds reads, as well as use-after-free issues that can cause memory corruption, silent data corruption, or JVM crashes.
A security vulnerability identified as CVE-2026-53587 exists in libgit2, a Git core methods library included with Rust. This vulnerability allows a denial of service via a heap out-of-bounds read triggered by a malicious Git server. The issue affects specific Rust package versions distributed by Red Hat and Ubuntu. A patch is available to address this vulnerability.
A security vulnerability exists in libsoup's WebSocket frame processing when the maximum incoming payload size is unset or set to zero. This can lead to out-of-bounds memory reads, potentially causing memory exposure or application crashes. The issue requires a non-default configuration and is not enabled by default in typical deployments. The vulnerability is rated medium severity and affects certain versions of libsoup used in SUSE products.
Multiple security vulnerabilities have been identified and fixed in libheif, a library for handling HEIF image files. These vulnerabilities include heap buffer overflows, out-of-bounds reads and writes, decompression bomb risks causing denial of service, unbounded memory usage, and potential crashes. The affected components include image scaling, encoding, decoding, and metadata processing. Exploitation could lead to crashes, denial of service, or potentially code execution. Fixes are included in libheif versions 1.23.2, 1.23.3, and 1.23.4.
A vulnerability in GStreamer's gst-plugins-good (avidemux) component allows crafted AVI files with specific FUJIFILM metadata to cause heap out-of-bounds reads and writes due to an unsigned integer underflow in the gst_avi_demux_parse_strd() function. This memory corruption can lead to application crashes. The flaw affects versions prior to 1.28.6 and has a CVSS score of 6.6 (medium severity).
A security update addresses CVE-2026-8177 in perl-XML-LibXML, which involves a read out-of-bounds heap memory issue triggered by parsing XML node names containing truncated UTF-8 byte sequences. This vulnerability can cause a denial of service. The issue affects multiple versions of perl-XML-LibXML used in SUSE and Red Hat Enterprise Linux 9 distributions. An official fix is available and has been released by Red Hat and SUSE.
This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.29.1 fixes various security issues:
The following security issues were fixed:
- CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267388).
- CVE-2026-53360: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (bsc#1270303).
- CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1275458).
- CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Zapscape) (bsc#1273232).
- CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (SCTPhantom) (bsc#1274074).
- CVE-2026-68138: net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274942).
A high severity arbitrary code execution vulnerability exists in gstreamer1-plugins-base due to a buffer overflow during OGG file parsing. This affects Red Hat Enterprise Linux 8 and related distributions. A security update addressing this issue is available from Red Hat as detailed in advisory RHSA-2026:59487.
An integer overflow/underflow vulnerability (CVE-2026-19389) exists in the asfdemux bounds checks of the gstreamer1-plugins-ugly-free package in the GStreamer streaming media framework. This flaw can lead to an out-of-bounds read. Red Hat has issued an important security update for Red Hat Enterprise Linux 10 to address this issue across multiple architectures including x86_64, ppc64le, and aarch64. The vulnerability is rated as high severity by the source, though no CVSS score is provided.
Multiple security vulnerabilities have been fixed in Mozilla Firefox Extended Support Release 153.2.0 ESR, including sandbox escapes, use-after-free bugs, privilege escalations, information disclosures, site isolation issues, spoofing, clickjacking, and integer overflows across various components such as Remote Settings Client, JavaScript engine, DOM, Graphics, Networking, and Application Update. These issues are addressed in Firefox 154 and Firefox ESR 153.2. The vulnerabilities range in impact from moderate to high severity.
This security update for kronosnet addresses three vulnerabilities: improper sanitization of sensitive memory that could expose encryption keys, improper verification of packet origins allowing ACL bypass via ID spoofing, and improper validation during fragment reassembly that may cause memory corruption or out-of-bounds access. These issues could lead to unauthorized access or memory safety problems. The severity is assessed as medium based on the described impacts. No affected versions or patch details are provided in the input data.
A security update for the keybase-client addresses multiple vulnerabilities including authentication bypass and deadlocks in the crypto/ssh library. The update involves patching the affected crypto dependency and upgrading to Go 1.26 to incorporate the updated crypto library. These vulnerabilities are identified by CVE-2026-56854, CVE-2026-56855, and CVE-2026-78662. The issues could potentially allow bypassing authentication mechanisms and cause deadlocks, impacting the reliability and security of the client.
A security update for GIMP addresses a signed integer overflow vulnerability in the file-sgi plugin. This flaw causes the plugin to crash when processing RLE-compressed SGI images. The issue is identified as CVE-2026-66757 and is rated with high severity. No CVSS score is provided. No affected versions are explicitly stated, and no exploit is known to be in the wild.
This security update for the hauler component addresses multiple vulnerabilities including authentication bypass and deadlocks in the golang.org/x/crypto/ssh library, as well as denial of service (DoS) issues in google.golang.org/grpc caused by missing ':authority' and 'Host' headers. The update advances hauler to version 2.1.0 and fixes several CVEs (CVE-2026-41888, CVE-2026-56854, CVE-2026-56855, CVE-2026-78662, CVE-2026-84303, CVE-2026-84304, CVE-2026-84445). The vulnerabilities are rated critical and a patch is available. No known exploits in the wild have been reported.
This security update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.62 addresses multiple security vulnerabilities affecting the kernel live patch for SUSE Linux Enterprise 15 SP7. The fixed issues include vulnerabilities in KVM SEV, IPv4 IGMP, KVM x86 MMU page handling, SCTP transport freeing, and network scheduler serialization. These fixes resolve potential security weaknesses that could impact system stability and security.
Multiple security issues were addressed in the liblzmasdk26-26.03-1.1 package included in the GA media of openSUSE Tumbleweed. The vulnerabilities fixed in this package affect the SUSE product but specific technical details and affected versions are not provided. The overall severity is assessed as medium.
Multiple security vulnerabilities affecting GIMP, including remote code execution and arbitrary code execution via crafted image files, have been fixed in the gimp-3.2.6-1.1 package. These issues involve integer overflows, heap-based buffer overflows, and unsigned underflows in PSD, TIF, and SGI file parsing. The vulnerabilities were addressed in updates available for various architectures and distributions, including Red Hat Enterprise Linux 9. No known exploits in the wild have been reported.