Packages changed: MicroOS-release (20260916 -> 20260917) aaa_base (84.87+git20260610.3b5a868c -> 84.87+git20260916.e122202) apparmor bluez (5.82 -> 5.87) cryptsetup (2.8.7 -> 2.8.8) glslang (16.5.0 -> 16.6.0) kdump (2.1.9 -> 2.1.10) kernel-source (7.2.5 -> 7.2.6) libapparmor shaderc (2026.3 -> 2026.4) === Details === ==== MicroOS-release ==== Version update (20260916 -> 20260917) Subpackages: MicroOS-release-appliance MicroOS-release-dvd - automatically generated by openSUSE-release-tools/pkglistgen ==== aaa_base ==== Version update (84.87+git20260610.3b5a868c -> 84.87+git20260916.e122202) - Update to version 84.87+git20260916.e122202: * For new GNU Emacs 31.1: use lexical-binding * Let us now fix this syntax error in ls.bash - Update to version 84.87+git20260812.c6d42af: * added requires for gzip and tar to aaa_base-extras (boo#1274604) * fix(ls): deprecate ls.zsh * fix(ls.bash): use alias, func breaks sudo alias * fix(ls.bash): avoid breaking sudo alias expansion * drop dirs from the specfile, they live in the filesystem package ==== apparmor ==== - update wg-quick.diff to fix setting DNS (boo#1265394) ==== bluez ==== Version update (5.82 -> 5.87) Subpackages: bluez-cups libbluetooth3 - ver 5.87: * Patches removed: hcidump-Fix-memory-leak-with-malformed-packet.patch (Source file does not exist anymore) hcidump-Fixed-malformed-segment-frame-length.patch (Source file does not exist anymore) bluez-mainloop-Only-connect-to-NOTIFY_SOCKET-if-STATUS-Sta.patch (included in upstream) CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch (Source file does not exist anymore) CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch (Source file does not exist anymore) upstream changes: Fix issue with GATT database and out of sync errors. Fix issue with BASS and setting a stream to idle. Fix issue with BASS and rescanning broadcast sources. Fix issue with BAP and broadcast sink cleanup. Fix issue with BAP and endpoint configuration. Fix issue with BAP and ASE control point properties. Fix issue with BAP and BIG/BIS receiver QoS structures. Fix issue with AVRCP and tracking of TG and CT events. Fix issue with PBAP and Database Identifier length. Fix issue with MCP and ATT disconnect events. ver 5.86: Fix issue with number of retries on authentication failures. Fix issue with G.722 @ 16 kHz codec ID value reported by transport. Add support for Telephony interface. Add support for Ranging profile. Add support for GMAP service. Add support for TMAP service. ver 5.85: Fix issue with handling display of battery charge level. Fix issue with BASS permissions not requiring encryption. Fix issue with handling abort for OBEX SRM operation. Fix issue with handling device privacy. Add support for HFP call answer support. Add support for HFP simple 3-way call support. ver 5.84: Fix issue with AVRCP and handling invalid UTF-8 item name. Fix issue with exposing coordinate sets if LE Audio is disabled. Fix issue with BAP and not responding to SetConfiguration. Add support for BAP unicast endpoint reconfiguration. Add support for BASS and encrypted broadcast source. Add support for HFP and Call Line Identification. ver 5.83: Fix issue with handling BAP and removal of PAC. Fix issue with handling SID for broadcast receiver. Fix issue with handling HSP/HFP reconnection policy. Fix issue with handling cable pairing and Sixaxis controllers. Fix issue with handling virtual cable unplug for HID devices. Fix issue with handling service records for HID devices. Add support for AVDTP and TX timestamps. ==== cryptsetup ==== Version update (2.8.7 -> 2.8.8) Subpackages: libcryptsetup12 - Update to 2.8.8: * integritysetup: add support for keyed discards. An integrity device in standalone mode, with a keyed integrity algorithm like HMAC and enabled discards (TRIM), could be vulnerable to wiping part of the device using a discard pattern. This issue can be worked around by using a keyed discards filler. Once set, it is set permanently for the integrity device and cannot be reverted. Integritysetup now supports a new --allow-discards-keyed option. Once used, it will upgrade the superblock and activate keyed discards. After the upgrade, keyed discards are always used, even with the old --allow-discards option. Keyed discard is available since Linux kernel 7.3. Note: Integritysetup was intended to be used with non-cryptographic integrity protection only. If you need cryptographic protection, use LUKS2 and AEAD (discards are not supported). * Avoid time-of-check/time-of-use (TOCTOU) issue in LUKS header restore. The LUKS header restore function validates the provided header file and then reopens the same file path to restore the LUKS header. In a specifically crafted environment, a symlink flip could occur between validating and restoring the header, resulting in a different file being used for the LUKS header restore (potentially leaking the file content). The libcryptsetup now opens the device only once. The issue affects both LUKS1 and LUKS2. Note: LUKS header backup/restore is a system administrative task (similar to filesystem backup/restore) that must run in a secure environment. Such a backup is usually a multi-step process, and it is up to the caller to ensure security of that environment. * BITLK: harden metadata validation. If a crafted BITLK (BitLocker-compatible) image is opened, the allocated buffer size for the key can be incorrect. This can happen if the encryption is changed from AES-CBC-128 to a mode with an Elephant diffuser, without recalculating the stored key. Also, the data offset can be intentionally wrong, which could lead to an infinite loop when parsing metadata. Note that creating such an incorrect image requires knowledge of the disk password, as MAC protects the metadata, and this MAC is checked by cryptsetup. * Fix possible integer overflow in LUKS metadata parsing. On systems with a 32-bit integer size, the anti-forensic (AF) data size calculation could overflow, causing an application crash. * cryptsetup: fix local memory corruption bug in reencrypt init. If a device intended for reencryption contains more than 16 active LUKS2 keyslots or tokens, the reencryption initialization could corrupt internal memory, leading to an application crash. ==== glslang ==== Version update (16.5.0 -> 16.6.0) - Update to release 16.6.0 * Implemented `GL_EXT_cooperative_matrix_maintenance1`, `GL_EXT_optional_input_attachment_index`, and `DebugEntryPoint` for `NonSemantic.Shader.DebugInfo` 102. ==== kdump ==== Version update (2.1.9 -> 2.1.10) - upgrade to version 2.1.10 * calibrate: measure per-cpu requirements * kdumptool calibrate: take KDUMP_CPUS into account for PPC * PPC: round up KDUMP_CPUS on SMT systems to nearest threads-per-cpu * Set default KDUMP_CPUs to 4 (jsc#PED-16732, bsc#1239999) * add KDUMP_USE_CMA: experimental support for CMA reservation (jsc#PED-14553) - update calibrate values ==== kernel-source ==== Version update (7.2.5 -> 7.2.6) - RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables (git-fixes). - commit 3d19f11 - Update patches.kernel.org/7.2.4-160-nfsd-add-fh_want_write-for-early-verified-SETAT.patch (bsc#1012628 CVE-2026-89697 bsc#1280148). - Update patches.kernel.org/7.2.4-163-nfsd-block-non-SAVEFH-ops-after-FOREIGN-PUTFH-t.patch (bsc#1012628 CVE-2026-89696 bsc#1280146). - Update patches.kernel.org/7.2.4-164-nfsd-cap-decoded-POSIX-ACL-count-to-bound-sort-.patch (bsc#1012628 CVE-2026-89695 bsc#1280155). - Update patches.kernel.org/7.2.4-165-nfsd-check-client-ownership-when-cancelling-a-c.patch (bsc#1012628 CVE-2026-89694 bsc#1280151). - Update patches.kernel.org/7.2.4-166-nfsd-check-nfsd4_acl_to_attr-return-value-in-nf.patch (bsc#1012628 CVE-2026-89693 bsc#1280153). - Update patches.kernel.org/7.2.4-167-nfsd-clear-CALLBACK_RUNNING-on-failed-delegatio.patch (bsc#1012628 CVE-2026-89692 bsc#1280167). - Update patches.kernel.org/7.2.4-168-nfsd-clear-opcnt-on-compound-arg-release-to-pre.patch (bsc#1012628 CVE-2026-89691 bsc#1280163). - Update patches.kernel.org/7.2.4-172-nfsd-defer-vfree-of-compound-ops-to-fix-rpc_sta.patch (bsc#1012628 CVE-2026-89690 bsc#1280166). - Update patches.kernel.org/7.2.4-173-nfsd-don-t-free-session-slots-that-are-still-in.patch (bsc#1012628 CVE-2026-89689 bsc#1280174). - Update patches.kernel.org/7.2.4-174-nfsd-drop-the-stateid-not-the-stateowner-on-seq.patch (bsc#1012628 CVE-2026-89688 bsc#1280171). - Update patches.kernel.org/7.2.4-175-nfsd-ensure-nfsd_file_do_acquire-does-not-use-a.patch (bsc#1012628 CVE-2026-89687 bsc#1280173). - Update patches.kernel.org/7.2.4-176-nfsd-fix-BUG_ON-in-nfsd4_alloc_layout_stateid-o.patch (bsc#1012628 CVE-2026-89686 bsc#1280184). - Update patches.kernel.org/7.2.4-177-nfsd-fix-clock-domain-mismatch-in-clients_still.patch (bsc#1012628 CVE-2026-89685 bsc#1280179). - Update patches.kernel.org/7.2.4-178-nfsd-fix-cpntf-publish-race-in-nfs4_init_cp_sta.patch (bsc#1012628 CVE-2026-89684 bsc#1280178). - Update patches.kernel.org/7.2.4-179-nfsd-fix-dentry-ref-leak-on-V4ROOT-export-fileh.patch (bsc#1012628 CVE-2026-89683 bsc#1280193). - Update patches.kernel.org/7.2.4-180-nfsd-fix-fcache_disposal-UAF-by-inlining-dispos.patch (bsc#1012628 CVE-2026-89682 bsc#1280191). - Update patches.kernel.org/7.2.4-182-nfsd-fix-layout-fence-worker-double-reference-r.patch (bsc#1012628 CVE-2026-89681 bsc#1280189). - Update patches.kernel.org/7.2.4-184-nfsd-fix-nfsd_file-leak-on-inter-server-COPY-se.patch (bsc#1012628 CVE-2026-89680 bsc#1280206). - Update patches.kernel.org/7.2.4-185-nfsd-fix-null-dereference-in-nfsd4_setattr-for-.patch (bsc#1012628 CVE-2026-89679 bsc#1280203). - Update patches.kernel.org/7.2.4-186-nfsd-fix-partial-write-detection-in-nfsd_direct.patch (bsc#1012628 CVE-2026-89678 bsc#1280199). - Update patches.kernel.org/7.2.4-187-nfsd-fix-possible-fh_compose-of-wrong-dentry-in.patch (bsc#1012628 CVE-2026-89677 bsc#1280224). - Update patches.kernel.org/7.2.4-190-nfsd-fix-stale-s2s_cp_stateids-IDR-entry-for-as.patch (bsc#1012628 CVE-2026-89676 bsc#1280219). - Update patches.kernel.org/7.2.4-191-nfsd-fix-UAF-in-async-copy-cancel-and-shutdown.patch (bsc#1012628 CVE-2026-89675 bsc#1280216). - Update patches.kernel.org/7.2.4-193-nfsd-fix-XDR-length-calculation-in-nfsd4_ff_enc.patch (bsc#1012628 CVE-2026-89674 bsc#1280243). - Update patches.kernel.org/7.2.4-194-nfsd-fix-XDR-padding-calculation-in-ff_encode_g.patch (bsc#1012628 CVE-2026-89673 bsc#1280237). - Update patches.kernel.org/7.2.4-195-nfsd-gate-nfs2-setacl-by-argp-mask.patch (bsc#1012628 CVE-2026-89672 bsc#1280235). - Update patches.kernel.org/7.2.4-196-nfsd-gate-nfs3-setacl-by-argp-mask.patch (bsc#1012628 CVE-2026-89671 bsc#1280252). - Update patches.kernel.org/7.2.4-197-nfsd-hold-rcu-across-localio-cmpxchg-retry.patch (bsc#1012628 CVE-2026-89670 bsc#1280250). - Update patches.kernel.org/7.2.4-198-nfsd-initialize-copy-notify-stateid-before-publ.patch (bsc#1012628 CVE-2026-89669 bsc#1280251). - Update patches.kernel.org/7.2.4-200-nfsd-move-nfsd_debugfs_init-after-nfsd4_init_sl.patch (bsc#1012628 CVE-2026-89668 bsc#1280279). - Update patches.kernel.org/7.2.4-201-nfsd-close-shrinker-GC-fsnotify-vs-per-net-shut.patch (bsc#1012628 CVE-2026-89667 bsc#1280261). - Update patches.kernel.org/7.2.4-205-nfsd-release-OPEN-decoded-posix-ACLs-via-op_rel.patch (bsc#1012628 CVE-2026-89664 bsc#1280272). ... changelog too long, skipping 3681 lines ... - commit 16c1085 ==== libapparmor ==== - update wg-quick.diff to fix setting DNS (boo#1265394) ==== shaderc ==== Version update (2026.3 -> 2026.4) - Update to release 2026.4 * Incorporate fixes for SPV_KHR_abort abortEXT(...) * glslc: option -fshader-stage now accepts all shader stage names as allowed in #pragma shader_stage()> This includes ray tracing, task, and mesh shader stages.