openSUSE News

Planet News Roundup

admin@opensuse.org (Douglas DeMaio) — Fri, 18 Sep 2026 08:00:00 +0000

This is a roundup of articles from the openSUSE community listed on planet.opensuse.org. This community blog feed aggregator lists the featured highlights below from Sept. 11 - 17.

This week highlights the release of Agama 24 with a two-for-one announcement covering versions 23 and 24, the beta release of Plasma 6.8 along with its first “This Week in Plasma” review, the first bug-fix update of KDE Gear 26.08 plus feature overviews of Kdenlive and Minuet, the Tumbleweed week 37 review and a September ARM update roundup, Intel’s OpenVINO 2026.4.0 release, the openSUSE Kudos report for August, the reveal of the GNOME 51 wallpapers, and a fond farewell to the Linux Hispano comic strip after 1,144 installments.

Here is a summary and links for each post:

Introducing Enhanced Distribution Support

The Open Build Service blog introduces Enhanced Distribution Support, a beta feature that gives structure to distribution information through a vendor → distribution → release hierarchy, letting maintainers record what they ship, which repositories and architectures each release is built from, and dated lifecycle milestones. It’s an early, purely descriptive first iteration, and the OBS team is asking distribution maintainers what else they need to be able to describe.

OpenVINO 2026.4.0: A New Version Announced

Alessandro’s blog reports on Intel’s OpenVINO 2026.4.0 release, which broadens model support across Intel CPUs, GPUs and NPUs while adding speculative decoding with Multi-Token Prediction. The post also covers EAGLE-3 Tree Drafting, ITT tracing extended to the NPU for VTune, an ASR pipeline for Node.js and idle-model management in the OpenVINO Model Server.

Tumbleweed ARM Updates in September

The openSUSE News blog covers September’s Tumbleweed updates for the ARM port, led by a security-heavy kernel 7.2.5, glibc 2.44 with its large AArch64 push and QEMU 11.1.1. Raspberry Pi owners get a firmware fix that clears up a Wi-Fi scan error, Rockchip and other SBCs receive MediaTek Wi-Fi kernel fixes, and GIMP 3.2.6, shotwell 33.0 and kbd 2.10.0 land AArch64-specific improvements.

GNOME 51 Wallpapers

Jakub Steiner reveals the GNOME 51 wallpaper set, calling the collection evolution rather than revolution as it sticks to its geometric roots. The default is a stylistic touch-up of the GNOME 50 hexagons, images now carry an embedded thumbnail that helps the Appearance panel, and attribution and license data are embedded directly into the files.

Download a Random Linux Hispano Comic Strip in the Terminal

Victorhck shares a pair of scripts for revisiting the 1,144 Linux Hispano comic strips that Danigm published between 2004 and 2026 after the series came to an end. A Python scraper archived every strip into a GitHub repository, while a Bash script picks a random strip and displays it with feh along with its name and publication date.

Syslog-ng repo for Amazon Linux 2023 updated to syslog-ng version 4.12

Peter Czanik reports that his syslog-ng repository for Amazon Linux 2023 has been updated to version 4.12 after a GitHub request finally prompted an update. He recounts how the repo, first created two years ago, sat untouched due to a lack of feedback despite healthy download numbers from Copr, with Java support and slog disabled as in his other repositories.

Kudos August 2026

The openSUSE News blog presents the monthly Kudos report, in which 17 users received 24 kudos and 419 badges were awarded to 251 contributors during August. Bernhard Wiedemann tops the list with five kudos, mostly for his work on Slowroll, and four contributors reached the milestone of 100 Tumbleweed Contributions.

What’s New in Minuet from KDE Gear 26.08, “Enjoy Shiny Stuff” Edition

The KDE Blog closes its KDE Gear 26.08 feature series with Minuet, the music education app that trains the ear through interval, chord, scale and rhythm exercises. Minuet debuts a new interface that works on both desktops and phones, with a reworked home page and navigation sidebar, exercises shown as cards and a search field that filters by translated names and descriptions.

Software Freedom Day 2026

The KDE Blog announces the Dia de la Llibertat del Programari (Software Freedom Day) celebration organized by Caliu on September 19 at the Espai Jove La Fontana in Barcelona, an event where the KDE community is usually well represented. The post translates the Catalan agenda, listing three talks on teaching computing with values, bootstrapping a self-managed forge with Haz-CLI and security on GNU/Linux.

Happy Programmer’s Day

Alessandro’s blog celebrates Programmer’s Day, which falls on the 256th day of the year and explains why the number 256, or 2^8, matters in computing. The post thanks developers for turning coffee into software, errors into lessons and ideas into innovation.

Innit

Jakub Steiner shares how he produced the tune “Innit” for his weeklybeats 2026 project on the Elektron Analog Four rather than his usual Dirtywave M8. After years of avoiding them, he finally learned the box’s performance macros, which bundle up to five track parameters onto a single knob and make live performance far less stressful than pre-programming a sequence.

Plasma 6.8 Beta Released – This Week in Plasma

The KDE Blog translates Nate Graham’s weekly Plasma development report covering the 6.8 beta. Kup joins Plasma as its backup system, clipboard and MIME-action settings become far clearer, the on-screen keyboard button now behaves as expected on lock and login screens, and KWin gains support for the Wayland commit_timing protocol.

Linux Saloon 219 | Butterbian and ButterKnife Distribution Exploration

Nathan Wolf posts episode 219 of the Linux Saloon podcast, covering activities around the Vintage Computer Fest Midwest. The episode gathers user experiences with the Butterknife and Butterbian distributions through polls and links out to upcoming events and participant projects.

First Update of KDE Gear 26.08

The KDE Blog presents the first update of KDE Gear 26.08, released almost a month after the feature set, bringing more stability, better translations and small improvements. It lists resolved issues across apps, libraries and widgets, including an arrow-orientation fix in KDE Connect, room-map handling in Kongress and an unexpected crash when saving documents in Okular.

Plasma 6.8 Beta Released

The KDE Blog reports that the beta of Plasma 6.8 has been released and highlights changes drawn from its changelog, from the new Hanabi wallpaper replacing Waterfall in Breeze and Nepali calendar support to GTK4 window decoration fixes, an AppStream Preview backend in Discover and a QML rewrite of DrKonqi’s coredump viewer. It encourages users to install the beta and report bugs to help polish the release.

Tumbleweed – Review of the Week 2026/37

Dominique Leuenberger and Victorhck review the four Tumbleweed snapshots (0904, 0907, 0908 and 0909) of week 2026/37, which delivered Linux kernel 7.2.3 and 7.2.4, LibreOffice 26.8.0.3, QEMU 11.1.1, zypper 1.14.101 and more.

Tiny Wins for Packagers: End-of-Week Update

The Open Build Service blog shares its end-of-week “Tiny Wins” update, which shipped a fix preventing a second click on the repository dropdown after an autocomplete selection and ensured the generated SBOM includes the SPDX V3 createdBy field. It also reports that build.opensuse.org served 22.8 million HTTP requests and produced 2.38 million package builds over the last seven days.

Agama: Releasing Version 24

The Agama blog announces Agama 24 in a two-for-one post covering versions 23 and 24 after a stabilization phase focused on testing and polish. Language, keyboard and time zone now share a single searchable form, network connections can be bound to devices through a sortable device table, and JSON search sections gained much more expressive device matching.

View more blogs or learn to publish your own on planet.opensuse.org.

Tumbleweed ARM Updates in September

admin@opensuse.org (Douglas DeMaio) — Wed, 16 Sep 2026 12:00:00 +0000

There were a few software package updates for openSUSE Tumbleweed ARM this month with snapshots reaching the ARM port.

September’s snapshots of the ARM port carried the Linux kernel to a security-heavy 7.2.5. There was a jump to glibc 2.44 with its large AArch64 push, and QEMU reaching 11.1.1. Raspberry Pi owners get a firmware fix that clears up a Wi-Fi scan error, the Networking Stack received security patches, and GIMP 3.2.6 brings AArch64-specific fixes.

Raspberry Pi

This month’s raspberrypi-firmware update prevents the spurious “-52” error message that could appear during Wi-Fi scans (bsc#1215134), so scanning for networks is quieter on boards where the firmware reported a phantom failure. The Linux kernel 7.2.4 update fixed a memory leak in the brcmfmac driver’s SDIO control path, which reduces memory pressure over long uptimes on the onboard Cypress Wi-Fi chip used across recent Pi models.

Rockchip & Other SBCs

Owners of Rockchip and other single-board computers get kernel fixes for the MediaTek Wi-Fi chipsets that many boards ship with, including headroom fixes for USB/SDIO transfers on mt7925 and EEPROM size validation on the mt7915 and mt7996 drivers, which protects against malformed device data (bsc#1012628). kernel-firmware-qcom adds DSP firmware for the Qualcomm x1e80100, nord and qcs8300 platforms, improving modem, DSP and graphics support. dracut now includes leds-qcom-lpg in the aarch64 DRM module set, keeping RGB indicator LEDs working when booting from an initrd. Finally, wireless-regdb enables 320 MHz channels for Hong Kong, updates South Africa’s rules, and drops the 60 GHz DFS flag for Togo.

i.MX & NXP

Developers working with NXP hardware gain the imx8mp-evk machine type in QEMU 11.1.1, which emulates the i.MX 8M Plus Evaluation Kit and makes it easier to test software for that platform without physical hardware. The kernel 7.2.3 update fixed the mxs-dcp crypto engine’s source scatterlist length access and improved the Data Co-Processor security block on i.MX System on Chips that use it for accelerated encryption. These changes make NXP hardware slightly more accessible to both emulation and crypto workloads.

aarch64 Virtualization, UEFI & Toolchain

QEMU 11.1.1 is the virtualization highlight of the month, advancing the emulator with Universal Flash Storage emulation for Write Booster and Host-Initiated Defragmentation based on the UFS 4.1 specification, plus vhost-host-user support for offloading real-time clock handling through virtio-rtc. The ARM targets gain new architectural CPU features, and the virt board can now specify cache topology. The ARM-specific fixes include a regression test and boundary-case fix for the SVE2 whilewr/whilerw instructions and a fix for arm_gicv3 kconfig selection, and openSUSE disables GCS linker validation in the spec to keep the aarch64 build working.

glibc 2.44 delivers the strongest AArch64 additions in months. On targets with the Guarded Control Stack extension, glibc now locks all GCS operations, including status, write-on-shadow-stack and push-to-shadow-stack, immediately after enabling GCS with an ENFORCED or OVERRIDE policy, closing a window where a process could still mutate its own shadow stack. Special-case paths for log, exp, sin, cas, sinh, cosh, asinh, acosh and atanh are vectorized for both SVE and AdvSIMD, and vector powr variants are added, which speeds up floating-point-heavy code on capable Cortex-X and Neoverse cores.

ovmf advances to edk2-stable202608, refreshing the UEFI firmware that backs the qemu-uefi-aarch64 subpackage. The update adds AArch64 host test coverage across SecurityPkg, CryptoPkg, PrmPkg, DynamicTablesPkg, MdeModulePkg and MdePkg, plus UnitTestFrameworkPkg support for GCC AArch64, which strengthens firmware quality assurance for arm64 virtual machines. The EFI Memory Attributes Protocol workaround is dropped because GRUB2 now supports the protocol, so booting stays compatible with the cleaner firmware behavior.

sdbootutil improved its systemd-boot handling with a new status command, parallel test execution, a --repair parameter for cleanup, and better reporting of entries with missing files. The update prevents duplicate entries on non-snapper systems, keeps the exit status of sdbootutil calls intact, and avoids writing the recovery PIN to the journal, which is a meaningful privacy improvement for systems using PCR-based secure boot.

GTK4 4.22.5 fixes a build failure on 32-bit ARM and repairs 32-bit Vulkan image builds, so the toolkit and gskvulkanimage both compile cleanly on armv7. A Wayland session crash in gdk_wayland_toplevel_remove_from_session() and a memory buffer fix round out the release for desktop users on ARM.

LLVM 23.1.1 arrives as a bugfix release for the 23.1.0 series, remaining API and ABI compatible while dropping the obsolete i586 build patch.

GIMP 3.2.6 carries the first AArch64-specific wins for the image editor. The clipboard brush and pattern maximum size is bumped to 8192 on AArch64 as well, matching the ceiling that x86-64 and PPC64 have had since the 3.2.0 release candidates, so larger brushes and patterns survive clipboard round-trips on ARM desktops.

shotwell 33.0 makes the jump from the 0.32 series with a full port to GTK4 (requiring at least 4.22), a reworked printing flow, and fixes for the fullscreen toolbar auto-hide and disappearing slideshow icons. The release replaces its dedicated authentication helper with a small localhost web server for publishing, adds a “peek password” toggle to the Piwigo flow and fixes setting desktop backgrounds.

kbd 2.10.0 extends the console stack with XKB support: loadkeys can now generate console keymaps from XKB data, import XKB compose tables and handle XKB group switching, modifier handling, virtual console switching and keypad/editing remaps.

Snapshots at a Glance

Snapshot	Kernel	Headline changes
2026-09-08	7.2.3	glibc 2.44 with AArch64 GCS and SVE/AdvSIMD math, QEMU 11.1.1 with imx8mp-evk, Raspberry Pi firmware Wi-Fi scan fix
2026-09-12	7.2.4	edk2-stable202608 with AArch64 host tests, dracut aarch64 LED module, GTK4 32-bit ARM build fix, LLVM 23.1.1
2026-09-14	7.2.5	kernel security batch (Tegra241 CMDQV, iommufd, nvmet, Bluetooth RFCOMM, PCI, rndis_host), GIMP 3.2.6 with AArch64 fixes, shotwell 33.0, kbd 2.10.0

ARM Resources

For ARM-specific discussions and support, subscribe to the openSUSE ARM mailing list and check the openSUSE ARM wiki for device support information, image downloads, and documentation. New and existing ARM users can also join the openSUSE ARM IRC channel for real-time help.

Kudos August 2026

admin@opensuse.org (openSUSE Kudos Team) — Tue, 15 Sep 2026 08:00:00 +0000

Welcome to our monthly report from the openSUSE Kudos recognition platform, where we take a moment to put a spotlight on the people who stepped up, helped others, and made this community a little brighter.

During the month of August 2026, 17 users received 24 kudos, and 419 badges were awarded to 251 contributors. You can see stats for this and previous months.

Spotlight

Top of the list in August: Bernhard Wiedemann (@bmwiedemann) with 5 kudos, more than twice what anyone else collected. Most of them (4) landed in Code & Engineering. That alone accounts for 5 of the month’s 24 kudos. Second place was a three-way tie at 2 kudos each: @bigironman, Gertjan Lettink (@knurpht) and Martin Schreiner (@mschreiner). Behind them, thirteen more people each picked up a kudo of their own, and all of them are listed below.

A milestone is worth stopping for: @dirkmueller, @jengelh, @krop and @pluskalm reached 100 Tumbleweed Contributions. That is the kind of steady, long-haul contribution that rarely makes headlines. Congratulations!

Not all of it is code, either. Documentation, translation, artwork, moderation and event work keep openSUSE usable and welcoming for everyone, and this month @aplanas, @bmwiedemann, @jimed-rand and @lkocman earned Wiki Contributor.

Kudos

Here are the thank-you notes themselves: 24 peer-to-peer kudos written by contributors about contributors, grouped by the person being thanked. The order follows the standings above, so August’s most recognized contributor opens the list.

Bernhard Wiedemann (@bmwiedemann) received the following kudos:

From @levolet in Code & Engineering

“Thanks for all your great work in maintaining Slowroll. Your community spirit in thinking of it and creating it is also much appreciated.”

From @mdhup in Infrastructure Heroes

“Thank you for the work you do. Using slowroll has been a smooth experience. So much so that it ended my disro hopping. If it’s this good in beta, I can’t wait until it’s finished.”

From @PossiblePrinterPalace in Code & Engineering

“Thank you for the wonderful Slowroll. It has been my most pain-free Linux Desktop experience, in now more than 10 years of using different Linux distros.”

From @dnla in Code & Engineering

“Thanks for maintaining slowroll! Keep up the good work”

From @C7NhtpnK in Code & Engineering

“Thank you for offering Slowroll!”

@bigironman received the following kudos:

From @lkocman in Support & User Assistance

“Many thanks for your quick help with re-branching the Leap-Images Wolfgang!”

From @lkocman in Support & User Assistance

“Thanks you for the help with the SPICE devel project for Leap 16.X Wolfgang!”

Gertjan Lettink (@knurpht) received the following kudos:

From @lkocman in Support & User Assistance

“Thank you for raising the concern with spamminess of kudos bot. Thanks to our discussion and the spamminess we actually met a new friend in /bar. So the spam from kudos-bot is actually useful. And we also get to reduce the spamminess”

From @C7NhtpnK in Support & User Assistance

“Thank you for help and assistance at forums.o.o!”

Martin Schreiner (@mschreiner) received the following kudos:

From @C7NhtpnK in Code & Engineering

“Thank you for maintaining LibreOffice!”

From @lkocman in Code & Engineering

“Martin, thank you so much for going the extra mile here! It would have been much easier to simply ship the same LibreOffice version from Factory in Leap, but instead you’re putting in the effort to maintain a separate version that better fits what users expect from a long-term stable distribution. That’s a lot of extra work behind the scenes, and I and many other users really appreciate your work to make Leap an even better LTS-style distro. Thank you! <3”

Antonello Tartamo (@atartamo) received a kudo:

From @lkocman in Support & User Assistance

“Many thanks for your quick help on building an efficient query for OBS requests accepted within n-days Antonello! I’ll be using it for granting people Tumbleweed contributor badge in kudos. This will make sure we don’t keep OBS busy for too long:)”

@crameleon received a kudo:

From @lkocman in Infrastructure Heroes

“Many thanks for your help with whitelisting access from kudos-o-o to wiki and other services Georg!”

Dominique Leuenberger (@dimstar) received a kudo:

From @victorhck in Code & Engineering

“Thanks for your work keeping Tumbleweed rolling. and for your weekly reviews!”

@firstyear received a kudo:

From @lkocman in Support & User Assistance

“Many thanks you for the help with the 2factor recovery William!”

Imobach Gonzalez Sosa (@IGonzalezSosa) received a kudo:

From @victorhck in Code & Engineering

“Thanks Imobach & Ancor for their work developing Agama, and many other tools since many years..”

Thorsten Kukuk (@kukuk) received a kudo:

From @C7NhtpnK in Code & Engineering

“Thank you for os-update!”

Lubos Kocman (@lkocman) received a kudo:

From @C7NhtpnK in Code & Engineering

“Thank you for answering and moderating some user questions about maintenance!”

Malcolm Lewis (@malcolmlewis) received a kudo:

From @lkocman in Community Moderation

“Many thanks for your quick help with the locked SPICE thread on forums-o-o Malcolm. Users will be happy to find a pointer in case they find this thread in the future. Many thanks!”

Martin Pluskal (@pluskalm) received a kudo:

From @lkocman in Code & Engineering

“Many thanks for your work on the openSUSE-packaging-skill Martin! I’m really happy that we have somebody who’s proactively looking into how AI can actually improve general packaging experience in openSUSE.”

Stephan Hemeier (@Sauerland) received a kudo:

From @C7NhtpnK in Support & User Assistance

“Thank you for help and assistance at forums.o.o!”

@shundhammer received a kudo:

From @C7NhtpnK in Code & Engineering

“Thank you for offering Myrlyn!”

@tiwai received a kudo:

From @lkocman in Code & Engineering

“Many thanks for your support with anything kernel related Takashi! I always really appreciate your help! We might make rtl8812au users happy!”

@Tobi_Peter received a kudo:

From @lkocman in Code & Engineering

“Many thanks for all your work on broadcom-wl Tobi! I think many broadcom users will highly appreciate it.”

Badges

Here is an overview of the 8 badges earned in August. The full list of badges you can earn is on the badges page.

Wiki Contributor
Recognition for the first day/page documentation contribution on en.opensuse.org wiki.
Awarded this month to @aplanas, @bmwiedemann, @jimed-rand and @lkocman.

100 Tumbleweed Contributions
For submitting 100 Submit Requests to openSUSE:Factory.
Awarded this month to @dirkmueller, @jengelh, @krop and @pluskalm.

10 Tumbleweed Contributions
For submitting 10 Submit Requests to openSUSE:Factory.
35 contributors earned this badge this month, too many to list here, but every one of them counts.

First Tumbleweed Contribution
For submitting 1 Submit Request to openSUSE:Factory.
210 contributors earned this badge this month, too many to list here, but every one of them counts.

Leap 16.1 Contributor
Recognition for submitting at least one pull request to Leap 16.1 or related appliance repositories on src.opensuse.org.
76 contributors earned this badge this month, too many to list here, but every one of them counts.

Leap 16.0 Contributor
Recognition for submitting at least one pull request to Leap 16.0 or related appliance repositories on src.opensuse.org.
75 contributors earned this badge this month, too many to list here, but every one of them counts.

Got First Kudo
Received your first kudos.
Awarded this month to @atartamo, @bigironman, @firstyear, @IGonzalezSosa, @kukuk, @mschreiner, @pluskalm, @Sauerland and @Tobi_Peter.

First Kudos Given
Shared your first kudos.
Awarded this month to @C7NhtpnK, @dnla, @levolet, @mdhup, @PossiblePrinterPalace and @victorhck.

Congrats on your kudos and badges. Keep up the great work everyone, and don’t forget to have a lot of fun!

Generated by kudos-bot-news-o-o from https://kudos.opensuse.org/api/reports/monthly for the period 1-31 August 2026.

Planet News Roundup

admin@opensuse.org (Douglas DeMaio) — Fri, 11 Sep 2026 08:00:00 +0000

This is a roundup of articles from the openSUSE community listed on planet.opensuse.org. This community blog feed aggregator lists the featured highlights below from Sept. 4 - 10.

This week highlights the SUSE security spotlight covering the combined spring and summer review activity plus a command-injection vulnerability in wicked that allows remote root code execution via DHCP, the fifth bug-fix update of Plasma 6.7 and the release of KDE Frameworks 6.30, an openSUSE version-diff page that covers every package, the wrap-up of openSUSE’s Google Summer of Code, the release of Audacity 4.0, and Packman’s announcement that the repository will be discontinued unless a successor steps up.

Here is a summary and links for each post:

JPEG-XL, AppStream, and Better Media Processing

Matthias Klumpp reports on the AppStream 1.2.0 release, which makes JPEG-XL the new default image export format while redesigning the media processing pipeline with sandboxed workers. The post benchmarks JPEG-XL against PNG on Debian’s icon pool, showing bandwidth savings.

The syslog-ng Insider 2026-09: Performance; Openssl; Containers; Learning

Peter Czanik publishes the 141st issue of the syslog-ng Insider newsletter. It covers performance tuning options that can reach 7 million events per second in lab tests, nightly AlmaLinux-based containers published on Docker Hub, and the status of OpenSSL 4.0 support.

30th update of KDE Frameworks 6 and KCoreAddons library

The KDE Blog announces KDE Frameworks 6.30, the 30th monthly update of the libraries that underpin the KDE project, released on September 10. As part of a year-long series profiling each framework, the post introduces KCoreAddons library, which adds extensions and utilities on top of QtCore, from MIME management and automatic saving to backups, randomness generation and system user information.

The Other WTC Attack

Jakub Steiner shares a short, personal post recalling his 1993 visit to the top of the World Trade Center, unaware at the time that it had been bombed months earlier. He reflects on that 1993 attack, the truck bomb built from around 600 kilograms of homemade explosives plus hydrogen tanks, and how later events gave the story new weight.

SUSE Security Team Spotlight Spring/Summer 2026

The SUSE Security Team blog releases a combined spotlight covering its spring and summer review activity across dozens of D-Bus and Polkit policy rules, from upower and AppArmor’s aa-notify to fwupd and the transactional update notifier. The post also documents file-based root capabilities assigned in packages like cacti-spine’s CAP_NET_RAW and ksystemstats6’s CAP_PERFMON, and revisits the Apptainer setuid starter.

How to Keep a Script Running in the Background with SSH and tmux

Victorhck explains how to launch a script on a remote machine over SSH and keep it running in the background using a tmux session. The tutorial covers creating a named session, detaching with the tmux prefix and ‘d’, reconnecting later with tmux a -t, and closing the session when done.

“35 Years of Linux: 35 Curiosities That Changed Computing” by La Chica de Sistemas

The KDE Blog introduces the YouTuber La Chica de Sistemas, whose channel teaching Linux and Unix system administration it had long wanted to promote. It shares her video celebrating Linux’s 35th anniversary with 35 curiosities about the operating system that changed computing.

One Page, Every Package

The openSUSE News blog presents the openSUSE version diff tool, a machine-built comparison of source package versions across Tumbleweed and the current Leap releases. Pulled directly from the download.opensuse.org archive indexes, the page covers more than 17,500 source packages in a sortable, filterable table with downloadable JSON and CSV exports, categorizing each package as older, newer, equal or exclusive to one release.

Fifth Update of Plasma 6.7

The KDE Blog reports the fifth bug-fix update of Plasma 6.7 released on September 8. It recaps the branch’s recurring highlights such as independent virtual desktops per monitor, microphone volume testing, a light/dark theme switch, lunar calendar integration and print queue management, alongside the fixes in the new point release.

The Packman Repository Will Be Discontinued as of Jan 1, 2027

Victorhck translates the announcement from Packman’s maintainers that after 25 years, the project will be discontinued on January 1, 2027 unless a successor is found. The post recounts the history of the repository, the reasons behind stepping down, including the growth of Flatpak and the workload involved, and what a takeover would require.

Optimizing the sudo Test

Zoltán shares how the openQA sudo test for openSUSE and SLE was cut from about 9 minutes to 3 seconds while gaining broader coverage. He explains running the upstream test suite during the package build, porting functional tests to pytest, and adding a validator that checks the shipped sudoers file against common misconfigurations like targetpw.

Photos as a Substitute for KDE’s Gwenview Image Viewer

Victorhck looks at the Photos application as a substitute for KDE’s default Gwenview image viewer. The post examines what each viewer offers and what users should weigh before switching.

Synchronize the “scroll” in two tabs in the #KDE Kate editor

Victorhck shows how to synchronize the scroll position between two tabs in the KDE editor Kate. Using the View menu, Split View and Toggle Scroll Sync, Kate shows a chain icon and keeps both documents aligned so users can read and compare them together.

This Year’s Google Summer of Code Wrap Up

The openSUSE News blog wraps up the 2026 Google Summer of Code season in which openSUSE mentored eight contributors. Projects ranged from enhancing the git workflow build results page and benchmarking Uyuni on Kubernetes to an AI agent for root cause analysis, an MQTT publisher with Node-RED nodes, Uyuni’s API docs ported to OpenAPI, a new mgrctl get command and native LDAP support.

KDE Express Episode 75: Season 6 plus AkademyES and KDE Gear 26.08

The KDE Blog presents episode 75 of KDE Express, the podcast hosted by David Marzal returning after a hiatus. The episode spotlights Akademy-es 2026, scheduled for October 23-25 in Villaviciosa de Odón, and reviews KDE Gear 26.08 applications like Okular, Dolphin, Konsole and Minuet.

The Hacktivist Collective Autistici/Inventati Closes Its Services

Victorhck reports that after 25 years of providing privacy-preserving services to activists, the collective Autistici/Inventati is closing down. Following the U.S. government’s August 26 designation of the collective as a terrorist organization, it announced on September 6 that continuing to operate would endanger its users.

Audacity 4.0 Released, Renewing the Interface

The KDE Blog announces the release of Audacity 4.0, whose major update rebuilds the interface with Qt, introduces a new clip-based editing model, Guardable workspaces, HiDPI rendering and the new .aup4 project format. It lists the new recording, playback and effects features along with Audacity 3 functions not yet available.

Linux Saloon 218 | News Flight Night

Nathan Wolf posts episode 218 of the technology and Linux podcast and looks at California’s open-source legislation.

So Many Ways to Click and Scroll - This Week in Plasma

The KDE Blog translates this week’s Plasma development report, in which the last Plasma 6.8 features land along with fixes across the 6.6.7, 6.7.5 and 6.8 branches. It covers new ways to click and scroll, plus improvements to Discover, the task manager and other Plasma components.

Tumbleweed - Review of the Week 2026/36

Dominique Leuenberger and Victorhck review the six Tumbleweed snapshots of week 2026/36. Kernel 7.2.2, glibc 2.44, Rust 1.98, QEMU 11.1.0 and LLVM 23.1.0 were among the headline packages delivered to the rolling release.

Best Linux Distros for New Laptops in 2026 (Tested)

LinuxStans ranks seven distributions best suited to brand new laptops that need the freshest kernels, firmware and drivers. Fedora Workstation takes the top recommendation, with openSUSE Tumbleweed second for its rolling kernel updates and openQA snapshot testing, ahead of CachyOS, EndeavourOS, Pop!_OS, Ubuntu 26.04 LTS and Manjaro.

Complete Redesign of KDE Connect for Android

The KDE Blog reports on the complete redesign of KDE Connect for Android, the app that links a phone with Plasma desktops to share notifications, clipboard and files. The refresh brings a renewed visual interface to the app many users rely on daily.

Tiny Wins for Packagers: End-of-Week Update

The Open Build Service blog shares its end-of-week “Tiny Wins” update for packagers. Shipped fixes include preventing an encoding crash when writing YAML to temp files, repairing an osc branch crash for packages with an empty element, and updates to obs-service-node_modules and obs-service-source_validator.

View more blogs or learn to publish your own on planet.opensuse.org.

One Page, Every Package

admin@opensuse.org (Douglas DeMaio) — Wed, 09 Sep 2026 08:00:00 +0000

There is a question that comes up often in openSUSE forum threads or a Reddit comment section and that is what version of X does one actually get on Leap versus Tumbleweed?

Until recently the honest answer was very often “go look it up yourself, package by package” unless someone actually had the answer.

Now there is a better one.

The openSUSE version diff tool!!! Yes github.com/openSUSE/osdiff tooling generates a complete, machine-built comparison of source package versions across Tumbleweed and the current Leap releases.

The idea of listing source package versions in a consumable format grew out of a discussion community member Axel Braun raised at a weekly Release Engineering meeting. The site republishes itself automatically. No guessing, no anecdotes, no six-month-old blog post. Just the numbers.

The tool pulls the archive indexes straight from download.opensuse.org; this is for open-source software (oss) and non-oss, x86_64 and noarch and it’s done for Tumbleweed, Leap 16.1, and Leap 16.0; then it compares the upstream version of every source package it finds. The result is a single sortable, filterable table with a timestamp on it.

The scale is worth pausing on. A recent run covers 17,532 source packages: 17,143 in Tumbleweed, 10,574 in Leap 16.1, 10,551 in Leap 16.0, with 10,264 present in both Tumbleweed and Leap 16.1. Every package lands in one of five status buckets:

Status	Meaning
Older-in-Leap	Leap ships an earlier upstream version than Tumbleweed
Newer-in-Leap	Leap is actually ahead — rarer than people assume, but real
Same	Identical upstream version in both
Only-in-TW	Exists in Tumbleweed, not in Leap
Only-in-Leap	Exists in Leap, not in Tumbleweed

The page carries maintainer information and it is careful about what it claims: only the upstream version is compared, not the RPM release. That distinction matters, and the tool states it up front rather than quietly blurring it.

Open data changes the conversation. The single most valuable thing here isn’t the HTML page. It’s the downloads sitting at the bottom of it: diff.json, diff.json.gz, and diff.csv.

This open data turns a nice webpage into infrastructure. Anyone can pull the JSON, and the shape of the data is stable enough to build on. Which is where use cases start multiplying.

Prospective users deciding between Leap and Tumbleweed. Someone who needs a specific toolchain version for work can confirm it in ten seconds rather than installing and finding out.
Media, reviewers, and documentation writers can immediately find information they need to dive deeper into a related topic. This page gives a journalist instant information to help them determine if a flavor of openSUSE has exposure fixes. Distribution comparisons are notoriously prone to stale or half-remembered version numbers, and a wrong number in a review can stick around for years in search results. A citable, timestamped, auto-generated source removes the excuse for guessing. If you write about openSUSE, you now have a footnote you can actually point at.
Aggregators like DistroWatch where the site tracks package versions across dozens of distributions do enormous manual or semi-manual work to keep tables current. Machine-readable exports of an entire distribution’s package set, refreshed automatically, is exactly the kind of upstream cooperation that makes that work cheaper and more accurate. What do you say DistroWatch? Want to know “what’s in what” tables.
Packagers and maintainers get immediate knowledge. The tool attaches the maintainer names to those rows so somebody knows who to ask.
Contributors looking for a first task. One of the hardest parts of joining a distribution project is finding something concrete to do. A filtered list of packages that are behind, with maintainers listed, is a genuinely welcoming on-ramp.
Sysadmins and platform teams gain quick confirmation for their development. Before migrating a fleet from Leap 16.0 to 16.1, or evaluating whether a workload can move from Tumbleweed to Leap, the practical question is which dependencies shift and by how much. The 16.0-versus-16.1 columns answer that directly, and the CSV drops into a spreadsheet or a diff script without ceremony.
Developers targeting openSUSE will know which library versions your users will have, this is the compatibility matrix. It also tells you whether your own package is present in Leap at all.
Researchers and the merely curious can have a lot of fun with the open-data. Full-distribution version data, published openly on a recurring basis, is a dataset. Software-ecosystem researchers and people who just enjoy graphing things now have raw material that didn’t exist in convenient form before.

Having Leap package versions visible alongside Tumbleweed’s is a meaningful shift in how a release gets communicated. Historically, “what will be in the next Leap?” was answered in release notes near the end of the cycle, or reconstructed by people willing to dig through OBS. Publishing the state of the in-development distribution as it evolves means the community can see the release taking shape rather than being handed a finished summary.

Small tools like this rarely get the attention they deserve, but a table that is always correct, always current, and freely downloadable quietly removes an entire category of friction from a project. We hope you enjoy it.

This Year's Google Summer of Code Wrap Up

admin@opensuse.org (Cédric Bosdonnat) — Mon, 07 Sep 2026 10:00:00 +0000

Google Summer of Code is now over for openSUSE.

This summer, we had the privilege of mentoring eight contributors.

Mario Marín Hinojosa enhanced the openSUSE git workflow build results. He blogged about his progress and you can already see in it action on br.opensuse.org. See an example for devel:languages:python:Factory!

Akash Kumar wrote the foundation for an Uyuni on Kubernetes storage benchmark. This meant enhancing sumaform, the deployment tool used by the CI, to work with an existing Kubernetes cluster. He also wrote cucumber tests in the Uyuni test suite to benchmark the reposync and the download of packages from several minions. There are still other tests to add and he documented this all in the github mentoring issue. Akash will give a presentation at the openSUSE.Asia Summit in Yogyakarta in about a month; come and get to know him!

Digvijay Rawat worked on a AI agent to help with the root cause analysis of errors on Linux machines managed by Uyuni. He documented how it works, how to install it and what is left to be done in his repository. He also prepared a demo video to show how it off.

Geetansh Goyal added an MQTT publisher to Uyuni so its events can be used in automation. He also added Node Red nodes to use those events. His work is described in his repository. Tell us your use cases. Geetansh also presented at the openSUSE conference and would like to start buildin an openSUSE mirror and community in India. Find out how Geetansh described his Google Summer of Code experience.

Himanshu Jaiswal helped porting the Uyuni API docs to openAPI and Swagger. This was not just the matter of rewriting the doc from the current Javadoc to the new format, but also adding automation for it and fixing the many errors that came up. He documented the state of his project in a gist for the curious to take a look or help.

Jay Prakash added an mgrctl get command to wrap up the Uyuni API in a similar way to kubectl get. This only supports systems and system groups for now, but has been written with extensibility in mind to reduce the work needed for other Uyuni objects. He documented his work in a special git repository.

Surya Srinivasan worked on a native support of LDAP in Uyuni. With his work in, configuring the use of an LDAP server could be done from the Uyuni web interface! He described his work and what remains to be done in a gist.

Anuj Agrawal began the program this summer with us, but had to resign as he started working for Google. Congrats!! He started a chat bot project to help get started with openSUSE. The project uses a local SLM and RAG and was already nicely kicked out. To know more about the project, check out the code and documentation in his repository or read Anuj’s blog post about the openSUSE Assistant.

Many thanks to all eight of them for their involvement. We are looking forward to keep working with you all. Many thanks also to those who mentored them, gave time and patience to help them get started with contributing to openSUSE.

Planet News Roundup

admin@opensuse.org (Douglas DeMaio) — Fri, 04 Sep 2026 08:00:00 +0000

This is a roundup of articles from the openSUSE community listed on planet.opensuse.org. This community blog feed aggregator lists the featured highlights below from August 28 to Sept. 3.

This week highlights the SUSE security review that uncovers a local root exploits and a Polkit bypass in the LACT GPU tool, an update on expanding Intel AI stack with NPU and OpenVINO support, a translation of the U.S. government placing a label on an Italian collective for offering digital infrastructure to groups of activists, the August Tumbleweed monthly update and week 2026/35 review, and a wave of KDE Gear 26.08 application features alongside the monthly KDE Linux progress report.

Here is a summary and links for each post:

MultiCortex AI Intel Accelerated: CPU, GPU, and Intel NPU ready for Artificial Intelligence

Alessandro presents an Intel-accelerated Linux platform that bundles oneAPI, Level Zero, OpenVINO, Intel Arc and NPU drivers into a ready-to-use AI environment. The post details how a signed-integer overflow in the NPU driver’s ResourceCleaner thread triggered SIGABRT crashes, and how the fix submitted upstream via Pull Request #142 restored NPU availability for OpenVINO applications.

GSoC 2026, Event-Driven Automation for Uyuni via MQTT and Node-RED

The openSUSE News blog shares a Google Summer of Code student’s account of adding an MQTT publisher to Uyuni’s Java core so server events can push out in real time. On the consumer side, a custom set of Node-RED nodes lets users wire together workflows like “a minion registers, apply this state, then post to Slack” without touching the API, and the post reflects on lessons learned about transaction boundaries and deployment debugging.

This Month in KDE Linux: August 2026

The KDE Blog summarizes a monthly progress report on KDE Linux, the community’s upcoming distribution. Highlights include automatic Btrfs snapshots with a new kio-snapshot feature in Dolphin for restoring file versions, preinstalled CJKV text input, default Docker socket access removal for the wheel group, and several boot and installer refinements.

Defend the Autistici/Inventati Collective and the Right to Build Resilient Communication

Victorhck blogs about the U.S. Treasury designating the Italian digital-infrastructure collective Autistici/Inventati as Specially Designated Global Terrorists. The post translates parts of the collective’s open letter and raises concerns about treating privacy-preserving hosting infrastructure as “material support” for terrorism.

What’s New in Konsole of KDE Gear 26.08, the “Enjoy Shiny Stuff” Edition

The KDE Blog covers the Konsole improvements in KDE Gear 26.08. The terminal now supports holding Alt and dragging underlined filenames, and can also drag links, email addresses and color terms to other applications, opening pages, downloading HTML or filling layers in Krita.

Using syslog-ng with Elasticsearch 9.5

Peter Czanik writes about installing Elasticsearch 9.5 with Kibana to verify claims that using Elasticsearch has become more difficult, testing how syslog-ng works with it. The post runs through the setup and configuration needed to make the combination work smoothly.

Tumbleweed Monthly Update - August 2026

The openSUSE News blog recaps an August that delivered 23 Tumbleweed snapshots across 31 days. The month brought KDE Plasma 6.7.4, KDE Frameworks 6.29.0 and KDE Gear 26.08.0, plus GNOME Shell 50.4, Firefox 154.0 with over 40 security fixes, the Linux kernel 7.2.0, and a steady stream of CVE-driven updates.

Reverse Dependencies as a zypper Plugin

Zoltán revisits his rdepends hackweek tool now that zypper natively gained reverse-dependency support via the –requires-pkg flag. He explains how the built-in feature changed the project and what the updated plugin approach looks like today.

Mobile Linux Hackday #8: Record Turnout in SUSE’s New Prague Office

The openSUSE News blog recounts a record-attendance Mobile Linux Hackday #8 held in SUSE’s renovated Prague office. Attendees split into freeform working groups on AI tools, BengalOS and Qualcomm Snapdragon 845 kernel hacking, and shared feedback on how the Czech Linux community discovers such events.

100,000 Computers with Linux: The Miracle No Big Tech Could Stop - Episode 4 of the “The Age of the Dystres” Podcast

The KDE Blog promotes Episode 4 of the “The Age of the Dystres” podcast, which tells the story of the Spanish regional GNU/Linux distribution. The episode focuses on the technical side, covering the engineering, hardware challenges and teaching passion behind the project with several key contributors.

Translation of the Richard Stallman Interview at FOSS Force

Victorhck offers a Spanish translation of Christine Hall’s August 30 email interview with Richard Stallman published on FOSS Force. The interview covers GNU, the open-source split, large language models, SaaSS and digital surveillance, and argues that software freedom remains a moral question.

Vertical Clock for Your Desktop - Plasmoids for Plasma 6 (39)

The KDE Blog presents Vertical Clock. Created by cyberbessa, the widget handles narrow vertical panels well, offering eight visual styles, automatic scaling, and calendar integration, all built using only public API so it survives Plasma updates.

openSUSE Expands AI Support with Intel NPU Driver 1.35.0 and OpenVINO 2026.3.1

The openSUSE News blog reports that Intel NPU Driver 1.35.0 and OpenVINO 2026.3.1 are now packaged for Tumbleweed, Leap 16.0, and Leap 16.1. Testing uncovered a bug that prevented the NPU from initializing on some systems, which was fixed and submitted upstream to the Intel NPU driver project.

LACT: Polkit Authentication Bypass and Temporary File Handling Issues

The SUSE Security blog publishes a review of the LACT GPU control daemon that found a Polkit authentication bypass and a predictable temporary file issue. A PID-race flaw (CVE-2026-75037) could allow local root escalation via profile hooks, while a predictable tarball path (CVE-2026-75038) enabled denial of service and information leaks, with both fixed in upstream.

What’s New in Dolphin of KDE Gear 26.08, the “Enjoy Shiny Stuff” Edition

The KDE Blog rounds up the Dolphin improvements in KDE Gear 26.08. The file manager adds better KDE Connect integration, a filter bar supporting plain text, globbing and regular expressions, independent grouping and sorting, and the ability to close tabs on either side with a right-click.

Binary Function Coverage Part 2: Scaling Up, Fixing Daemons, and Asking the Kernel

Zoltán continues his series on binary function coverage with funkoverage eBPF tracing. He explains how daemons like sshd, cups and postgresql could not be wrapped until the shim was fixed to forward SIGTERM and relay sd_notify so systemd’s service lifecycle worked correctly.

Linux Saloon 217 | Application Potluck

Linux Saloon posts a roundup of technology and Linux updates, including a live weekend discussion about Fedora experiences and Linux security roles at Epic Games. It also covers IBM’s chip architecture advances and Dell overtaking HP in U.S. PC sales amid a shrinking market.

QtWidgets Applications Join Union - This Week in Plasma

The KDE Blog translates a weekly report on the work shaping Plasma 6.8. It highlights the first support for styling QtWidgets apps in the new Union theming system, plus a long list of interface, performance and bug-fix improvements across Plasma 6.6.7, 6.7.5 and 6.8.

My Plasma Desktop for August 2026

The KDE Blog shares the 75th installment of his monthly Plasma desktop showcase. Running on a Slimbook Evo with KDE Neon and Plasma 6.7.4 on Wayland, the post celebrates the huge variety of ways users organize their workspaces.

Tumbleweed - Review of the Week 2026/35

Dominique Leuenberger and Victorhck details Tumbleweed’s week 2026/35 with its five snapshots. Qt 6.11.2, KDE Gear 26.08.0, Linux Kernel 7.2.0 with Cache-Aware Scheduling and Firefox 154.0 were the headline deliveries, while Rust 1.98, Kernel 7.2.2, LLVM 23.1.0 and glibc 2.44 continue through the staging projects.

View more blogs or learn to publish your own on planet.opensuse.org.

GSoC 2026, Event-Driven Automation for Uyuni via MQTT and Node-RED

admin@opensuse.org (Geetansh Goyal) — Thu, 03 Sep 2026 07:00:00 +0000

Hello, openSUSE community!

My name is Geetansh Goyal, and I was a Google Summer of Code (GSoC) 2026 mentee with Uyuni and the openSUSE project. This is my first year contributing to a project of this size, and this post is my account of the summer working on “Event-Driven Automation for Uyuni via MQTT and Node-RED,” mentored by Ondrej Holecek and Abid Mehmood, both from the openSUSE community.

The problem

Uyuni already knows the moment something interesting happens: a system registers, a Salt job returns, a state applies, a software channel finishes building. None of that left the server. If you wanted to react to it, your only option was polling the XML-RPC API on a timer, which means either hammering the API for low latency or accepting a delay you didn’t choose. The goal of the project was to let events push out instead, so external tools can react as they happen.

What I built

The project has two halves. On the Uyuni side, I added an MQTT publisher to the Java core that publishes nine event types, five from the Salt reactor (system registration, job returns, state application, image deployment and batch starts) and four from domain code (org creation, user creation, and content lifecycle management builds starting and completing). Everything is off by default behind a set of configuration properties, so an existing installation notices nothing until an administrator explicitly turns it on.

On the consumer side, I built node-red-contrib-uyuni, a package of custom Node-RED nodes: one to subscribe to Uyuni events, one to call back into the API to apply a state or schedule a reboot, one to query system data, and two config nodes to hold credentials. The idea is that someone who has never touched Uyuni’s API can still wire together “a minion registers, then apply this state, then post to Slack” entirely by dragging nodes onto a canvas.

To make the whole thing easy to try, I also put together container images for a preconfigured Mosquitto broker and for Node-RED with the Uyuni nodes pre-installed, and a small library of example flows: a Slack alert on patch application, automatic Jira ticket creation, email notifications, and a couple more.

What I learned

I came into this as a first-year student who had never worked in a codebase anywhere near this size, and for the first few weeks I mostly felt like I was guessing. Uyuni’s Java core has years of history in it, and just finding where an event should be published, let alone where it safely could be, took longer than I want to admit.

The moment that actually changed how I think about code happened in review. Abid pointed out that my events were sometimes going out before the database transaction that produced them had even committed, meaning a subscriber could hear about something that, a moment later, technically hadn’t happened. I patched it the way I imagine a lot of people patch their first real bug: I found the closest thing that looked like “after commit” and hooked into that. It didn’t work, because I was deferring to the wrong transaction entirely, one that was never doing the actual write. Getting the real fix, which turned out to be as simple as changing the order a handler gets registered in, meant sitting with ActionExecutor until I actually understood what “each handler runs in its own transaction” meant for the code I’d written, instead of poking at it until the symptom went away. That’s the lesson I’ll carry past this project: a fix you don’t understand is just a different bug wearing the first one’s clothes.

The rest of what I learned came from being embarrassingly wrong in front of a real server. I’d copy a file into a running container, restart it to test, and watch my change vanish, because I didn’t yet know that a jar in there was a symlink and ant deploy was quietly doing nothing. I’d get a working config, restart the service to confirm it, and lose everything, because a line I hadn’t noticed in the systemd unit was wiping the container clean on every restart. I found a password sitting in a log file in plain text and realized I’d put it there myself, as a JVM argument, which is exactly why every credential in this project now also accepts an environment variable. None of that was in a diff anywhere. I only found it by breaking my own deployment enough times that I stopped trusting anything I hadn’t watched work end to end, which is how I ended up actually measuring it: about 0.112 seconds from a Salt job finishing to a subscriber hearing about it, checked with my own eyes on a real machine, not assumed.

Where the project stands

The implementation PR and the RFC are both open and under review as I write this, and the Administration Guide documentation is up for review too. Of the stretch goals, the example flow library is done, MQTT over TLS and a Grafana annotation node are still open for whoever picks this up next, including possibly me.

Thanks

Thank you to Ondrej and Abid for the review that actually made me fix the ordering bug properly instead of papering over it, and to openSUSE and GSoC for the chance to spend a summer inside a codebase this size as a first-year student. It was the first time I had to reason about transaction boundaries in someone else’s production system, and I’d do it again.

Tumbleweed Monthly Update - August 2026

admin@opensuse.org (Douglas DeMaio) — Wed, 02 Sep 2026 08:00:00 +0000

There were several software package updates for openSUSE Tumbleweed during the month of August, which delivered 23 snapshots across 31 days.

August delivered a packed month of snapshots across the desktop, developer tooling, and security surface. KDE Plasma 6.7.4 landed with KWin GPU management fixes and a workaround for libepoxy issues when a GPU reset happens. KDE Frameworks 6.29.0 and KDE Gear 26.08.0 also arrived in the month. GNOME Shell 50.4 and mutter 50.4 arrived with HiDPI cursor fixes and HDR output improvements. Mesa settled into its 26.2 series, and the Linux kernel progressed from 7.1.5 to 7.2.0 with a long tail of CVE fixes.

As always, be sure to roll back using snapper if any issues arise.

For more details on the change logs for the month, visit the openSUSE Factory mailing list.

New Features and Enhancements

KDE Plasma 6.7.4: The fourth bugfix release of the Plasma 6.7 series brings targeted stability improvements across the desktop. KWin no longer removes GPUs that have no outputs, which prevents a regression where external monitors connected via docks could disappear. A workaround for libepoxy failing when a GPU resets helps stabilize gaming and GPU-accelerated workloads on systems with multiple graphics adapters. The digital clock applet now applies its font family to the time zone label, and dragging items on the taskbar onto grouped tasks no longer breaks when floating applets are enabled. Spectacle gained QR code scanning when editing existing screenshots, and KScreen added a keyboard shortcut to trigger the Configure button from the OSD.

KDE Frameworks 6.29.0: A new feature release of the KDE component libraries arrived with refinements across KIO, Kirigami and KRunner. Solid now returns the mount point as filePath() for the root filesystem through its udisks2 backend, bluez-qt resolves a race condition in Bluetooth object manager initialization, and KTextEditor gained a disabledPlugins property. A separate KWin patch improved behavior after unplugging outputs by increasing the Wayland global removal timer timeout.

KDE Gear 26.08.0: The August feature release of the KDE applications collection brought updates across Dolphin, Konsole, Kate, Okular, and the Akonadi personal information management stack. Konsole implements the Kitty keyboard protocol and gains direct Copy and Open actions for URLs shown as escape-sequence hotspots. Okular adds copy-and-paste support for annotations and no longer executes load-scripts on signed documents, while Kate fixes working-directory handling when invoking git and possible out-of-bounds reads.

Firefox 154.0: The browser’s monthly milestone rolled out with a heavy load of Common Vulnerabilities and Exposures (CVE) fixes addressing more than 40 issues. The release covers a sandbox escape in the Remote Settings client, same-origin policy bypasses in service workers and cookie handling, use-after-free issues across WebAssembly, image loading, and layout text handling, plus multiple privilege escalation and site isolation issues in the graphics stack. It also refreshed mozilla-nss to 3.126.1 and mozjs140 to 140.14.0. Tumbleweed users should update to stay protected.

GNOME Shell 50.4 & mutter 50.4: The GNOME desktop received quality-of-life fixes that clean up day-to-day use. Switching to a minimized window on another workspace no longer causes a visual glitch, and the magnified cursor is correctly scaled on HiDPI displays. A sound glitch caused by pushing redundant volume changes has been eliminated, and menu animations are smoother. On the compositor side, mutter fixes blurred rendering with non-pixel-aligned monitors, fills in mastering display metadata for HDR output, and corrects invalid redraw clips on rotated monitors. GNOME Control Center 50.4 arrived alongside with updated translations.

GStreamer 1.28.6: A wide-ranging update across the core and plugin packages with both security and playback fixes. The playbin3 and playbin elements fix stalls that occurred after re-enabling previously disabled subtitles, and the h265parser resolves out-of-bounds writes in RPS parsing. RTP retransmission bitrate estimation is improved, and the Rust (f)mp4 muxers gain H.266/VVC muxing support. webrtcsink fixes H.264 level and profile negotiation and adds support for nvv4l2h265enc.

OpenSSH 10.5p1: A security-focused release addressing an important vulnerability in agent forwarding. The ssh-agent interaction between locking and the session-bind@openssh.com extension was broken, meaning operations intended to be limited to local use only could be performed remotely when the agent was locked. The restrict keyword in authorized_keys now correctly applies to tunnel forwarding. A potential realloc use-after-free in the client when a remote forwarding is added via the multiplexing socket is fixed, and ssh-keygen gains the ability to set or clear touch-required and verify-required flags on FIDO private keys during passphrase reset.

harfbuzz 14.3.0 & 14.3.1: The text shaping engine that underpins rendering in browsers, desktop environments, and document editors received important improvements. Mark positioning now respects lookup order in the cross-direction, improving compatibility with DirectWrite and Core Text. Mark attachment to ligatures formed from decomposed glyphs is fixed, and the calt feature in Hangul text is now disabled only for the Jamos rather than the entire buffer. The release also adds support for partially instancing of the avar table and the CFF2 table, relevant for variable font workflows. A follow-up 14.3.1 release arrived later in the month with fuzzing and subsetting fixes, a fix for AAT insertion at the end of the text, and rendering fixes in the experimental GPU library.

QEMU 11.1.0: The machine emulator advanced from 11.0.3 with a substantial feature release. Highlights include Universal Flash Storage (UFS) emulation support for Write Booster and Host-Initiated Defragmentation based on the UFS 4.1 specification, and vhost-host-user support for offloading real-time clock handling from the hypervisor when using virtio-rtc. The GUI subsystem gained improvements to virtual console handling and GTK/VNC. ARM support expanded with the new imx8mp-evk machine type and virt board cache topology specification.

Key Package Updates

Linux kernel 7.1.5 through 7.2.2: The kernel progressed through four point releases and a feature release during August with a sustained focus on security and stability. Version 7.1.6 carried fixes for KVM x86 module reload use-after-free, arm64 TLBI errata mitigation, and a virtiofs use-after-free on submount umount. Version 7.1.7 added CVE fixes for batman-adv, ntfs3, and several networking and driver subsystems. Version 7.1.8 addressed an extensive list of CVEs including Bluetooth btusb use-after-free, ksmbd deferred file use-after-free, rtl8723bs out-of-bounds reads and writes, and RDMA fixes across irdma, erdma, and mana_ib. The Btrfs filesystem received fixes for free space cache validation and root leaks during relocation. The 7.2.0 version refreshed the kernel configuration and carried updated AMD Display Core patches. The month closed with the 7.2.2 release, which resovled CVE-2026-80590.

Mesa 26.1.6, 26.2.0 & 26.2.1: The graphics stack made a major jump from 26.1.5 to the 26.2 series during the month. The 26.1.6 bugfix release addressed regressions from the previous stable series, while the 26.2.0 release brought a new batch of driver improvements for AMD, Intel, and Qualcomm hardware. The 26.2.1 bugfix release soon followed, and the VirtIO Vulkan driver is now enabled in openSUSE’s build, bringing Vulkan support to virtualized environments. Users on AMD and Intel GPUs who experienced rendering issues after earlier Mesa updates should find these releases more stable. The Vulkan drivers continue to see corrections for gaming workloads.

python-cryptography 50.0.0: A major version bump that deprecates Diffie-Hellman key exchange over finite fields and adds the Cobblestone recipe for streaming authenticated encryption. The most important change is a security fix for Bleichenbacher oracle in PKCS7 decryption; pkcs7_decrypt_der no longer exposes distinguishable errors or timing when unwrapping a RecipientInfo’s encryptedKey. X.509 verification APIs are now considered stable, and ML-DSA public keys and signatures are permitted by default.

libssh2: Received two rounds of critical security patches during August. The first batch addressed a heap buffer overflow and the second batch fixed arbitrary code execution via double-free in SFTP sessions, denial of service via integer underflow in AES-GCM cipher negotiation, a heap out-of-bounds read, and heap buffer overflow during SSH negotiation. These are essential updates for any system using libssh2 for SSH or SFTP operations.

vim 9.2.0901: A massive update carrying over 100 fixes including eight security patches. Security fixes address arbitrary code execution via keyword lookup, code injection in netrw via bookmarks, heap overflow when adding more than 65,535 text properties, stack buffer overflow in the socket server, and a use-after-free on JSON decode error. The update also fixes numerous memory leaks, a deeply nested regexp pattern stack overflow, and a GTK4 hardware rendering performance regression.

unbound 1.26.0: The DNS resolver received a major update with a large list of fixes and new features. New options include max-transfer-size and max-transfer-time for limiting auth-zone and RPZ transfers, and new local-zone types block_aaaa, block_a_wdata, and block_aaaa_wdata. A heap out-of-bounds write via size_t-to-int truncation is fixed, along with DNSSEC validation fixes for noncanonical RSA DNSKEYs and a race condition causing segfaults when starting threads.

Qt 6 6.11.2: The second bugfix release of the 6.11 series landed across the full module range from qt6-base through qt6-webengine. The update fixes a regression in icon loading and carries multiple stability corrections for the toolkit that Plasma and most KDE applications build on. qt6-webengine also merges an upstream fix for AMD VA-API flickering on Wayland.

wpa_supplicant 2.12: The Wi-Fi authentication daemon adds more complete EHT/IEEE 802.11be/Wi-Fi 7 support including fixes for message validation issues that could enable denial-of-service attacks, and group key rekeying is corrected. SAE group 20 is now enabled by default when SAE-EXT-KEY is available, and IEEE 802.11bi functionality is supported including changing SAE password identifiers, EPPKE, and association frame encryption. RSN overriding (WPA3-Personal Compatibility Mode) is supported, and Automated Frequency Coordination (AFC) on the 6 GHz band is now available. The build enables CONFIG_IEEE80211BE, CONFIG_SAE_PK, CONFIG_PMKSA_PRIVACY, and CONFIG_IEEE8021X_AUTH by default.

postgresql18 18.6: A major security release for PostgreSQL 18 that fixes more than two dozen CVEs covering remote code execution and denial of service issues. Notable fixes include heap buffer overflows in regular expression matching, to_char formatting, and pg_stat_statements that could execute arbitrary code, a psql issue where early failures in COPY FROM STDIN process data lines as command input, and a logical decoding flaw that could dlopen an arbitrary file. Database administrators on Tumbleweed should plan an update soon.

flatpak 1.18.1: A security-focused bugfix release addressing several sandbox escape and privilege escalation paths in the application framework. Fixes include a sandbox escape with full host filesystem read/write access via a symlink attack on app data directories, a local root privilege escalation via revokefs symlink path traversal and commit tampering, and arbitrary root writes through path traversal in extra-data extraction and flatpak build-init. The release also corrects an anti-downgrade bypass that allowed unprivileged users to downgrade system applications.

Security Updates

libssh2:

CVE-2026-58050: Fixes a heap buffer overflow via attacker-controlled attribute count from a publickey-subsystem response.
CVE-2026-58051: Addresses uninitialized pointer being freed when a malformed response is sent by an SSH server.
CVE-2026-66032: Resolves arbitrary code execution via double-free in SFTP session.
CVE-2026-66033: Fixes denial of service via integer underflow in AES-GCM cipher negotiation.
CVE-2026-66034: Addresses heap out-of-bounds read leading to information disclosure and potential arbitrary code execution.
CVE-2026-66035: Fixes heap buffer overflow during SSH negotiation.

Samba 4.24.5:

CVE-2026-6949: Fixes TSIG packet with crafted name compression crashing the internal DNS server.
CVE-2026-58224: Addresses CTDB heap out-of-bounds read via unchecked packet length fields.
CVE-2026-58216: Resolves 6-byte heap out-of-bounds read in kpasswd service packet parser.
CVE-2026-58218: Fixes DNS TKEY negotiation storing unauthenticated GSS contexts in a fixed FIFO before authentication completes.
CVE-2026-58221: Addresses authenticated LDAP access to internal LDB special DNs permitting domain takeover.
CVE-2026-58222: Resolves LDAP Compare filter injection and trusted-request confusion disclosing protected attributes.

vim 9.2.0901:

CVE-2026-8339: Fixes arbitrary code execution via keyword lookup.
CVE-2026-8340: Addresses code injection in netrw via bookmarks.
CVE-2026-8341: Resolves heap overflow when adding more than 65,535 text properties.
CVE-2026-8342: Fixes stack buffer overflow in the socket server.
CVE-2026-8343: Addresses popup opacity mask indexed out of bounds.
CVE-2026-8344: Resolves use-after-free on JSON decode error.
CVE-2026-8345: Fixes arbitrary Ex command execution during C omni-completion.
CVE-2026-8346: Addresses heap buffer overflow in set_sofo().

Linux kernel 7.1.6, 7.1.7 & 7.1.8:

CVE-2026-64490: Fixes ALSA virtio control metadata validation.
CVE-2026-64489: Addresses ALSA ymfpci snd_ctl_new1 return value check.
CVE-2026-64486: Resolves ALSA cmipci snd_ctl_new1 return value check.
CVE-2026-64481: Fixes ALSA hda-cs35l41 firmware load work teardown.
CVE-2026-64480: Addresses ALSA ice1712 snd_ctl_new1 return value check.
CVE-2026-64477: Resolves x86 fs/resctrl out-of-bounds access.
CVE-2026-64476: Fixes VFIO PCI disable_idle_d3 per-device latch.
CVE-2026-64475: Addresses VFIO PCI VGA arbiter client release on registration.
CVE-2026-64474: Resolves VFIO infinite loop in vfio_mig_get_next.
CVE-2026-64471: Fixes Bluetooth btusb use-after-free on registration.
CVE-2026-64466: Addresses Rust binder freeze listener cleanup on node removal.
CVE-2026-64437: Resolves ksmbd use-after-free of a deferred file location.
CVE-2026-64436: Fixes net af_key uninitialized alg_key_len for IPComp.
CVE-2026-64433: Addresses Bluetooth MGMT use-after-free of hci_conn_params.
CVE-2026-64432: Resolves ntfs3 Dirty Page Table capacity validation.
CVE-2026-64431: Fixes ntfs avoid calling post_write_mst_fixup for invalid ranges.
CVE-2026-64430: Addresses NTB EPF avoid calling pci_irq_vector from hardirq.
CVE-2026-64424: Resolves netpoll use-after-free on shutdown path.
CVE-2026-64449: Fixes staging vme_user bound slave read/write to the buffer size.
CVE-2026-64445: Addresses staging rtl8723bs WEP length underflow and buffer overflow.
CVE-2026-64444: Resolves staging rtl8723bs out-of-bounds read in OnAssocRsp IE.
CVE-2026-64441: Fixes staging rtl8723bs out-of-bounds reads in rtw_get_sec functions.
CVE-2026-64440: Addresses staging rtl8723bs out-of-bounds write in HT_caps_hand.
CVE-2026-64599: Resolves crypto amlogic double cleanup in meson_cr.

Firefox 154.0:

CVE-2026-75874: Fixes a sandbox escape in the Remote Settings client component.
CVE-2026-74934: Addresses a site isolation issue in the Graphics CanvasWebGL component.
CVE-2026-74936: Resolves a use-after-free in the JavaScript WebAssembly component.
CVE-2026-74937: Fixes a use-after-free in the JavaScript GC component.
CVE-2026-74939: Addresses a privilege escalation in the DOM Navigation component.
CVE-2026-74943: Resolves a use-after-free in the Graphics ImageLib component.
CVE-2026-74944: Fixes a use-after-free in the DOM Core & HTML component. https://github.com/KDE/kscreen
CVE-2026-74953: Addresses a privilege escalation in the Networking Cookies component.
CVE-2026-74956: Resolves a same-origin policy bypass in the DOM Service Workers component.
CVE-2026-74969: Fixes a use-after-free in the Layout Text and Fonts component.
CVE-2026-74976: Addresses a JIT miscompilation in the JavaScript Engine JIT component.

WebKitGTK 2.52.6:

CVE-2026-43804: Fixes a security vulnerability in the WebKit rendering engine.
CVE-2026-64713: Addresses a memory corruption issue in the WebKit rendering engine.
CVE-2026-64719: Resolves a security vulnerability in the WebKit rendering engine.
CVE-2026-64728: Fixes a memory safety issue in the WebKit rendering engine.
CVE-2026-64730: Addresses a security vulnerability in the JavaScriptCore engine.
CVE-2026-64757: Resolves a memory corruption issue in the WebKit rendering engine.
CVE-2026-64783: Fixes a security vulnerability in the WebKit rendering engine.

postgresql18 18.6:

CVE-2026-6464: Fixes psql processing data lines as command input after an early failure in COPY FROM STDIN.
CVE-2026-6471: Addresses logical decoding being able to dlopen an arbitrary file.
CVE-2026-14662: Resolves undersize allocations for tsvector and tsquery via integer wraparound.
CVE-2026-14664: Fixes a regexp heap buffer overflow that executes arbitrary code.
CVE-2026-14669: Addresses a to_char heap buffer overflow that executes arbitrary code.
CVE-2026-14676: Resolves a pg_stat_statements heap buffer overflow that executes arbitrary code.
CVE-2026-14679: Fixes a stack buffer overflow in argument match that writes to server memory.
CVE-2026-15741: Addresses SQL injection via an EXTRACT argument during expression deparse.
CVE-2026-18408: Resolves psql \unrestrict letting a superuser execute arbitrary code in the psql client.
CVE-2026-19385: Fixes a pg_dump heap buffer overflow that executes arbitrary code.

expat 2.8.2:

CVE-2026-50219: Fixes memory corruption affecting Expat bindings by disallowing reentrant calls to functions such as XML_GetBuffer, XML_Parse, and XML_ParserFree.
CVE-2026-56131: Addresses XML_ResumeParser being called from a handler, plugging a hole in the CVE-2026-50219 fix.
CVE-2026-56132: Resolves an out-of-bounds scaffolding index store in doProlog.
CVE-2026-56403: Fixes an integer overflow in storeAtts.
CVE-2026-56404: Addresses an integer overflow in addBinding.
CVE-2026-56405: Resolves an integer overflow in getAttributeId.
CVE-2026-56406: Fixes an integer overflow in XML_ParseBuffer.
CVE-2026-56407: Addresses an integer overflow in textLen handling.
CVE-2026-56408: Resolves an integer overflow in copyString.
CVE-2026-56409: Fixes an integer overflow in the xmlwf output path join.
CVE-2026-56410: Addresses an integer overflow in the xmlwf resolveSystemId.
CVE-2026-56411: Resolves an integer overflow in notation list allocation.
CVE-2026-56412: Fixes XML_TOK_DATA_CHARS handler calls in doCdataSection, plugging a hole in the CVE-2026-50219 fix.

c-ares 1.34.8:

CVE-2026-33630: Fixes a use-after-free and double-free in query-completion handling remotely triggerable via ares_getaddrinfo() over TCP.
CVE-2026-69184: Addresses a CPU-exhaustion denial of service via unbounded DNS name compression pointer chains.
CVE-2026-69186: Resolves a memory-amplification denial of service via unvalidated DNS header record counts.

busybox:

CVE-2026-38755: Fixes stack exhaustion in the ash applet caused by unbounded shell function recursion.
CVE-2026-38754: Addresses an out-of-bounds read in ifsbreakup().
CVE-2026-38753: Resolves a use-after-free in the awk applet regexp processing code during text replacement operations.
CVE-2026-38752: Fixes stack exhaustion in the awk applet caused by unbounded function call recursion.
CVE-2023-42366: Addresses a heap buffer overflow in the awk applet when a regexp ends with a backslash.

OpenEXR 3.4.14:

CVE-2026-68513: Fixes a PyOpenEXR prefixed literal RGB key collision heap buffer overflow.
CVE-2026-68514: Addresses a PyOpenEXR deep prefixed literal RGB key collision heap buffer overflow.
CVE-2026-59183: Resolves a signed integer overflow leading to out-of-bounds memory access in deep tile decoding.
CVE-2026-59186: Fixes an ILP32 TiledRgbaInputFile large tile Array2D heap out-of-bounds write.
CVE-2026-59187: Addresses an exrmetrics deep pixelmode heap buffer overflow.
CVE-2026-59981: Resolves an OpenEXRUtil SampleCountChannel row nonzero dataWindow heap out-of-bounds read.
CVE-2026-59985: Fixes an ILP32 OpenEXRCore RLE decode heap out-of-bounds read denial of service.
CVE-2026-61555: Addresses a crash on empty multiView viewFromChannelName files.
CVE-2026-62986: Resolves a PyOpenEXR deep prefixed RGB stale lane disclosure.

python313:

CVE-2026-0864: Fixes mixed line ending handling in configparser by normalizing all line endings.
CVE-2026-11972: Addresses tarfile._Stream.seek not breaking at end of file.
CVE-2026-4360: Resolves a missing filter_function pass-through to TarFile._extract_one() during .extract().
CVE-2026-15308: Fixes quadratic complexity in incremental HTMLParser parsing enabling CPU exhaustion.

gzip:

CVE-2026-41992: Fixes global buffer overflow in the LZH decompression logic.

libXfont2:

CVE-2026-59679: Fixes fs_read_glyphs() heap out-of-bounds read/write via encoding array index mismatch.
CVE-2026-44950: Addresses fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow.

glib2 2.88.3:

CVE-2026-15588: Fixes GDBusServer pre-authentication denial of service via unbounded SASL line buffering.

dracut:

CVE-2026-15816: Addresses root code execution via unescaped error message written to sourced emergency hook script in die().

python-cryptography 50.0.0:

CVE-2026-69247: Fixes Bleichenbacher oracle in PKCS7 decryption where distinguishable errors or timing could leak information when unwrapping a RecipientInfo’s encryptedKey.

libostree 2026.3:

CVE-2026-58055: Fixes unbounded LZMA decompression in static delta processing allowing denial of service.
CVE-2026-58056: Addresses heap buffer overflow via integer truncation in static delta bspatch on 32-bit systems.

gdm 50.2:

CVE-2026-58058: Fixes path traversal vulnerability where a compromised greeter could load arbitrary .desktop files via SelectSession.
CVE-2026-58059: Addresses autologin bypass where a compromised greeter could request autologin for any local account.
CVE-2026-58060: Resolves denial of service where an invalid session name from the greeter would cause the entire daemon to exit.

udisks2 2.11.2:

CVE-2026-7867: Fixes an unprivileged D-Bus caller using the as-user Filesystem.Mount() option combined with fstab entries containing user or users mount options to mount on behalf of another user without polkit authorization.

php8 8.5.9:

CVE-2026-17543: Fixes SQL injection via E'...' backslash breakout in PostgreSQL.
CVE-2026-17544: Addresses out-of-bounds write in bccomp().
CVE-2026-7260: Resolves crash via recursive symlinks in Phar.
CVE-2026-9672: Fixes a vulnerability in the GD library upgrade.

libssh2:

CVE-2026-58050: Fixes heap buffer overflow via attacker-controlled attribute count from a publickey-subsystem response.
CVE-2026-58051: Addresses uninitialized pointer freed when a malformed response is sent by an SSH server.

python-pip 26.2:

CVE-2026-13346: Fixes double decoding of the URL path while determining a link filename.

gimp:

CVE-2026-66757: Fixes a security vulnerability in GIMP image processing.
CVE-2026-66758: Addresses a security vulnerability in GIMP.
CVE-2026-66759: Resolves a security vulnerability in GIMP.
CVE-2026-59087: Fixes a security vulnerability in GIMP image processing.
CVE-2026-59088: Addresses a security vulnerability in GIMP.
CVE-2026-59090: Resolves a security vulnerability in GIMP.
CVE-2026-59091: Fixes a security vulnerability in GIMP.

libheif 1.23.1:

CVE-2026-62289: Fixes integer underflow in Fraction constructor via double clap transform application.
CVE-2026-62291: Addresses heap out-of-bounds write in uncompressed encoder when writing images with mismatched auxiliary alpha dimensions.
CVE-2026-62292: Resolves out-of-bounds read in uncompressed unci tile range slicing.
CVE-2026-62377: Fixes reachable assertion in HeifContext::get_track() aborting on a valid-but-empty HEIF sequence file.

nghttp2 1.70.0:

CVE-2026-58055: Fixes out-of-bounds read in the base64 decoder.

libgit2 1.9.7:

CVE-2026-5917: Fixes improper escaping of remote repository paths in libssh2.

bzip2:

CVE-2026-42250: Fixes an off-by-one error in the bzip2recover utility when processing a specially crafted file that can lead to a crash.

openssl-3 3.x:

CVE-2026-75803: Fixes AEAD forgeries with empty ciphertext when using EVP_Cipher().
CVE-2026-14456: Addresses unbounded memory growth in QUIC server incoming channel queue.
CVE-2026-14457: Resolves RPK server signature algorithm selection dereferencing a missing certificate.
CVE-2026-18798: Fixes QUIC server triggering a double free when processing an INITIAL packet.
CVE-2026-34181: Addresses PKCS#12 files with PBMAC1 being accepted with short HMAC keys.
CVE-2026-54874: Resolves excessive memory use buffering DTLS records for a future epoch.
CVE-2026-63072: Fixes a heap buffer overflow in CMS key unwrapping.
CVE-2026-63073: Addresses untrusted sender DN used as format string in CMP response validation.
CVE-2026-63074: Resolves CMP indefinite cache growth of ExtraCerts.
CVE-2026-63075: Fixes QUIC ACK-only packet retention causing memory exhaustion.
CVE-2026-63076: Addresses invalid pointer dereference in CMP server via crafted protectionAlg.

java-25-openjdk 25.0.4.1:

CVE-2026-60589: Fixes resource resolving vulnerability.
CVE-2026-61308: Addresses HTTP connection enhancement security issue.
CVE-2026-70907: Resolves TLS server security vulnerability.
CVE-2026-70906: Fixes font loading security vulnerability.

cpio:

CVE-2026-66484: Fixes path traversal allowing creation of hard links outside the intended directory via malicious tar archives.
CVE-2026-66485: Addresses denial of service via uncontrolled memory allocation from crafted archives.
CVE-2026-66486: Resolves terminal control sequence injection via crafted archive member names.

libvirt:

CVE-2026-77159: Fixes QEMU TPM following symlinks when chown’ing log files.
CVE-2026-18917: Addresses integer overflow in RPC handler for virNodeGetFreePages.

multipath-tools:

GHSA-hmcm-9cq4-r2xm: Fixes denial of service on multipathd socket by blocking IPC send operations.
GHSA-pvp6-c9p3-25fp: Addresses denial of service on multipathd socket by exhausting connections.
GHSA-g5mh-253r-jjw5: Resolves heap out-of-bounds read in custom format string parser via trailing %.
GHSA-pxwh-g75c-95pc: Fixes heap out-of-bounds read in device-mapper-multipath ALUA RTPG parsing.
GHSA-p6rh-9x9j-3hvx: Addresses kpartx heap out-of-bounds read in GPT header validation.
GHSA-gr7q-prfc-q636: Resolves path traversal in device-mapper-multipath failed_wwids management.
GHSA-hj7j-qr9h-5fv6: Fixes libmpathpersist PRIN READ FULL STATUS parser unbounded descriptor rewrite causing root heap overflow.

Users are advised to update to the latest versions to mitigate these vulnerabilities.

Conclusion

August was a busy month for openSUSE Tumbleweed with 23 snapshots delivering a steady cadence of desktop, developer, and security improvements. KDE Plasma 6.7.4 delivered targeted desktop fixes while KDE Gear 26.08.0 and KDE Frameworks 6.29.0 advanced the KDE application and library stacks, and GNOME Shell 50.4 polished the GNOME desktop. Mesa settled into its 26.2 series, the Linux kernel progressed through point releases to 7.2.0 with extensive CVE coverage, Firefox 154.0 shipped more than 40 security fixes, and GStreamer 1.28.6 brought playback and security fixes across the multimedia stack. Developer tools saw significant updates: Emacs jumped to 31.1, QEMU advanced to 11.1.0 with UFS emulation and RISC-V extensions, GCC reached 16.2, Qt 6 advanced to 6.11.2, OpenSSH 10.5p1 fixed critical agent forwarding issues, and vim addressed eight security vulnerabilities. FreeRDP 3.31.0 patched more than 20 CVEs while improving YUV decoding performance, wpa_supplicant 2.12 brought Wi-Fi 7 support, and chrony 4.9 added NTP-over-PTP and new stratum-bounding directives. Security remained a dominant theme, with critical patches in libssh2, Samba, postgresql18, openssl, expat, webkitgtk, openexr, flatpak, python-cryptography, openvpn, gdm, udisks2, multipath-tools, and php8.

Slowroll Arrivals

Please note that these updates also apply to Slowroll and arrive between an average of 5 to 10 days after being released in Tumbleweed snapshot. This monthly approach has been consistent for many months, ensuring stability and timely enhancements for users. Updated packages for Slowroll are regularly published in emails on openSUSE Factory mailing list.

Contributing to openSUSE Tumbleweed

Stay updated with the latest snapshots by subscribing to the openSUSE Factory mailing list. For those Tumbleweed users who want to contribute or want to engage with detailed technological discussions, subscribe to the openSUSE Factory mailing list . The openSUSE team encourages users to continue participating through bug reports, feature suggestions and discussions.

Your contributions and feedback make openSUSE Tumbleweed better with every update. Whether reporting bugs, suggesting features, or participating in community discussions, your involvement is highly valued.

Mobile Linux Hackday #8: Record Turnout in SUSE's New Prague Office

admin@opensuse.org (Lubos Kocman) — Tue, 01 Sep 2026 10:00:00 +0000

On Friday, August 28th, the SUSE Prague office hosted Mobile Linux Hackday #8. This event marked two major milestones: we hit a new record attendance for Prague, and attendees got their first hands-on experience in our freshly renovated Karlín space.

If you missed the event, here is a recap of the community highlights, kernel hacking sessions, and key takeaways from the day.

Renovated Prague Office: Great Coffee and Full Capacity

Returning attendees and newcomers were welcomed into our newly reconstructed Karlín office. The expanded social hub in the kitchen was an immediate favorite, providing comfortable sofas for breaks and technical discussions.

The highlight for many was the upgraded coffee station. Attendees put the manual lever espresso machine and external grinder through its paces, while a fully automatic machine served as a reliable backup.

Community Growth and Room Merging

With a peak crowd of 20 to 25 attendees, we set a new record for a Prague Mobile Linux Hackday and put our workspace flexibility to the test. The numbers were strong, especially when compared with earlier community gatherings such as the first Pilsen Mobile Hackday or the combined Budweis and SUSE Labs events, which had historically drawn larger crowds and set the benchmark for what a really “prime” event could look like. This turnout is a clear sign that our outreach and event marketing are gaining traction, and it is encouraging to see the community respond so strongly.

We originally booked the Mint meeting room, but as more people arrived, we pulled open the sliding partition panel and took over the adjoining Avocado room as well. Even after expanding into a double-sized room, we still had to borrow almost every chair from the surrounding area to seat everyone. Moving forward, we will definitely make sure we have plenty of extra seating ready for future gatherings.

Flexible Formats and the Kitchen Talk Dilemma

Unlike previous editions with rigid agendas, this Hackday was a bit more freestyle. Attendees naturally split into smaller working groups, alongside a remote session with David, who joined us from Switzerland and kindly made time for a deeper discussion on a more established topic.

This casual approach sparked fantastic side discussions, but it also highlighted a fun new challenge: the renovated kitchen space was so inviting that some attendees spent most of the day there, drifting into long hallway-track conversations. A big kudos to the facilities team for creating such a comfortable, social space that people simply did not want to leave!

While informal networking is a core part of community building, balancing casual chatter with structured technical sessions is something we plan to fine-tune for future events. We are actively looking into light-touch scheduling methods to help guide attendees smoothly between casual kitchen banter and hands-on coding.

Outreach Insights: Where the Czech Linux Community Gathers

During the event, we surveyed attendees on how they discovered the event to help refine our future community outreach.

Root.cz: The primary source for most attendees.
AbcLinuxu.cz: Brought in several key community members.
Word of Mouth: Direct recommendations from friends and colleagues played a major role in bringing in fresh faces.
LinuxExpres.cz: This was the first time we included it in our promotion mix. It did not produce a noticeable spike in attendance, but it was still a useful extra step in widening our reach beyond the usual community channels.
Mastodon: The main communication channel for the community, and many attendees learned about the event through the Mobile Linux CZ/SK Mastodon account.

Every newcomer made sure to leave with plenty of openSUSE swag to mark their first event.

Technical Highlights: AI Tools, BengalOS, and Snapdragon Hacking

Led by Petr Hodina, Mesa 3D GPU driver developer and community maintainer, the technical tracks covered several cutting-edge topics across mobile ecosystem development.

Key Topics Covered:

LLMs and Developer AI: Practical applications of Large Language Models to streamline daily developer workflows.
BengalOS Architecture: An overview of BengalOS, including instructions on how to build and test the OS on hardware.
Qualcomm Snapdragon 845 Kernel Hacking: Hands-on kernel debugging and testing focused on sdm845-based devices, including the OnePlus 6/6T, Xiaomi Poco F1, and Shift 6MQ.

Join the Next Mobile Linux Hackday

A huge thank you to Petr Hodina for driving the sessions, keeping the momentum high, and running an outstanding workshop. As a small token of our appreciation for his dedication to the community, Petr was awarded a giant plush openSUSE chameleon!

Photos from the event, along with broader shots of the refreshed SUSE Prague office, are available in our shared Google Photos album.

To stay updated on upcoming hackdays, follow the Mobile Linux CZ/SK community on Mastodon, or keep an eye out on local tech portals like Root.cz. See you at Hackday #9!