openSUSE News

Post-Quantum Backups Land in openSUSE Factory with ZUPT

admin@opensuse.org (Alessandro de Oliveira Faria) — Sun, 04 Oct 2026 00:02:00 +0000

ZUPT, an open source backup, compression, and data protection utility, has officially been accepted into openSUSE Factory, bringing a new security-focused backup option to the openSUSE ecosystem. The project combines backup creation, compression, integrity verification, and encryption in a single tool, allowing users to package files and directories into compact archives that are easier to store, transfer, verify, and restore.

Security is one of ZUPT’s main technical highlights. In addition to AES-256-based encryption, the tool supports a hybrid cryptographic scheme based on ML-KEM-768 + X25519. This approach combines established public-key cryptography with a post-quantum key encapsulation mechanism designed to provide stronger protection against future cryptographic threats. For users handling long-lived or sensitive backups, this adds an additional layer of protection against so-called “harvest now, decrypt later” scenarios, in which encrypted data collected today could potentially be targeted by more powerful computing systems in the future. ZUPT also includes file integrity verification features to help detect corruption, modification, or unexpected changes in archived data.

ZUPT was also designed with performance in mind. The application uses multithreaded processing to take advantage of multiple CPU cores during backup, compression, and restore operations, reducing processing time on modern systems. It includes its own compression mechanism as well as commands for testing and validating archive contents. With its acceptance into openSUSE Factory, ZUPT becomes an officially integrated solution for users looking for a combination of backup, compression, integrity verification, encryption, and post-quantum data protection within the openSUSE ecosystem.

For more information, go to ZUPT!

Tumbleweed Monthly Update - September 2026

admin@opensuse.org (Douglas DeMaio) — Thu, 01 Oct 2026 08:00:00 +0000

There were several software package updates for openSUSE Tumbleweed during the month of September and with openSUSE.Asia Summit 2026 about to begin, we are bringing the monthly review to you early.

September delivered a stacked month of snapshots across the desktop, developer tooling, and security surface. KDE Plasma 6.7.5 landed with fixes for KWin display management and taskbar refinements, while KDE Frameworks 6.30.0 and KDE Gear 26.08.1 delivered new features and bugfixes across the KDE ecosystem. glibc jumped to 2.44 with Transparent Huge Pages tunables and optimized math functions, and LLVM 23.1.1 arrived with important bugfixes. Mesa progressed from 26.2.2 to 26.2.3 and the Linux kernel advanced through 7.2.5 to 7.2.7 with a sustained focus on security. Later in the month the GNOME desktop picked up 50.5 across gnome-shell and mutter, GIMP advanced to 3.2.6, coreutils jumped to 9.12, and rsync arrived at 3.5.1 after a sweeping audit of its path handling and daemon protocol. curl addressed seven CVEs, pcre2 patched six security issues, and ffmpeg rolled up more than 20 CVEs in one pass.

As always, be sure to roll back using snapper if any issues arise.

For more details on the change logs for the month, visit the openSUSE Factory mailing list.

New Features and Enhancements

KDE Plasma 6.7.5: The fifth bugfix release of the Plasma 6.7 series brings targeted refinements across the desktop. KWin fixes the global removal timer timeout for unplugged outputs, and Discover resolves update stalling when fwupd is unavailable and a regression where updates were mistaken for needing a reboot. Spectacle fixes a crash during window-under-pointer detection and annotation submenu overflow, while the taskbar applet corrects right-to-left layout rendering and prevents duplicate favorites launching on Space.

KDE Frameworks 6.30.0: A feature release of the KDE component libraries that arrives with refinements across KIO, Kirigami, and KTextEditor. KIO fixes FTP command case consistency, corrects folder size reporting to include filesystem overhead, and lets a folder with the setgid bit propagate its group to copied files. KTextEditor gains vi-mode filename registers and fixes block operations with tabs. Baloo now excludes .snapshots folders from indexing, KCalendarCore adds recurrenceDescription and translated enum names, and KCodecs improves encoding detection with better confidence scoring. Syntax Highlighting adds DotEnv, KDL, and Just language support, and KGuiAddons adds a geo: URI handler for Cartes.

KDE Gear 26.08.1: The first bugfix release of the 26.08 series arrives with targeted fixes across the KDE application collection. Dolphin fixes the active split pane not being set correctly, corrects default zoom level calculations based on preview state, and prevents zero icon sizes in item layouts. Okular fixes a crash on broken DVI files, addresses dangling form field pointers after saving, and backports a Synctex security fix. Konsole corrects OSC22 mouse cursor shapes for splits and fixes focus shortcut issues in ViewSplitter. Kitinerary adds parsers for Air Canada and Lufthansa PDF itineraries and optimizes Wikidata train station queries. KOrganizer fixes search dialog functionality after editing a result.

GNOME Shell & mutter 50.5: The GNOME desktop received quality-of-life fixes that clean up day-to-day use. The unlock dialog handles keyboard navigation correctly, the screen will no longer unlock once a screen time limit has been reached, and toggling the wireless switch no longer blocks. On the compositor side, mutter fixes a hang on external monitor hotplug, stops multiple monitors from all being reported as primary, corrects desaturated SDR content in HDR mode, and adds per-view control over the software cursor overlay. libadwaita 1.9.4 arrived alongside with annotation and idle-callback fixes in AdwAnimation, AdwActionRow, AdwTabBar and AdwTabGrid, and GNOME Maps 50.5 fixed the secondary icons shown for recent and favorite places in initial search results.

GIMP 3.2.6: The image editor continued its 3.2 series with a large batch of fixes and some preparation for a future GTK 4 port. The Heal tool no longer leaves a dark smudge at crop boundaries, the Crop tool keeps vector layers in place, and the Color Picker correctly honours the Sample Merged option on single-layer images. Layer groups with non-destructive filters no longer get an unwanted pass-through reduction, plug-in pipes and process watching are better managed on exit so fewer warnings appear when closing GIMP, and clipboard brush and pattern sizes are raised to 8192 on AArch64. The XCF format is bumped to version 26 to record path visibility locks and channel filters.

Shotwell 33.0: The GNOME photo manager completed its port to GTK 4, moving to version 33 after the long-running 0.32 series. Printing was reworked, the publishing targets gained a “peek password” icon and now use a simple localhost web server instead of a dedicated authentication helper, and toast notifications replace many of the simpler dialogs. Face detection and recognition see a long list of fixes around names, highlighting and random matching, and the viewer mode now shows system information and can be opened for arbitrary URIs.

glibc 2.44: A major version bump that brings system-wide tunables via /etc/tunables.conf and a new glibc.elf.thp tunable that maps read-only segments with Transparent Huge Pages when the kernel has not disabled THP. The malloc page size is now capped to MAX_THP_PAGESIZE, and the CORE-MATH project contributions bring additional optimized and correctly rounded math functions. On AArch64, log, exp, sin, cas, sinh, cosh, and other special cases are vectorized for SVE and AdvSIMD, while RISC-V gains vector extension optimized variants of memcmp, memcpy, strcmp, strlen, and more. The release also carries two security fixes for stack-based buffer clashing during tilde expansion in wordexp (CVE-2026-6791) and an invalid free() call with WRDE_APPEND (CVE-2026-6368).

LibreOffice 26.8.0.3: A major version bump from the 26.2 series that brings updated bundled pdfium to 7681 and Skia to m147 as required by the new download configuration. The release drops Qt 5 support in Tumbleweed in favor of Qt 6, aligning with the broader KDE ecosystem move away from Qt 5. Users of the office suite will see improved compatibility and performance across Writer, Calc, and Impress.

LLVM 23.1.1: A bugfix release for the LLVM 23.1.0 series that addresses issues found since the initial release. The update is API and ABI compatible with 23.1.0, making it a safe upgrade for developers who depend on the Clang compiler, LLVM libraries, and related tooling. This is particularly relevant for users building packages that depend on the LLVM infrastructure for compilation.

harfbuzz 14.4.0 & 14.5.0: The text shaping engine that underpins rendering in browsers, desktop environments, and document editors received important improvements. In 14.4.0, glyph positions and extents now saturate instead of overflowing, Arabic Windows-1256 fallback shaping is enabled on all platforms, the COLR sweep gradient truncation and unbounded memory use are fixed, and subsetting is faster especially for large GSUB/GPOS and CFF tables. Version 14.5.0 then updated the Unicode data to 18.0, adding script values for Jurchen, Proto-Cuneiform and Seal along with the matching shaping support, and introduced rendering work budgets shared across the raster, vector, GPU and Cairo renderers so nested outline work stays bounded. The DirectWrite backend no longer uses the C++ runtime, and the HarfRust integration shaper sees various improvements.

bubblewrap 0.12.0: The Linux sandboxing tool removes support for building a setuid binary, as all modern distributions now support unprivileged user namespaces. A security fix resolves a symlink issue where a file or directory creation during sandbox setup could follow parent symlinks out of the sandbox. The --not-a-security-boundary flag is added for cases where some sandbox setup failures should not be fatal.

Key Package Updates

Linux kernel 7.2.2 through 7.2.7: The kernel progressed through six point releases during September with a sustained focus on security and stability. Version 7.2.2 carried fixes for ptp vmclock read-only mapping vulnerability and GSO state stripping from fragments before forwarding . Version 7.2.3 addressed an extensive list of USB fixes including use-after-free in usbdev_release(), ALSA USB audio out-of-bounds write in snd_usbmidi_novation_output(), and KVM SEV improvements for SNP guests. Version 7.2.4 added fixes for dm-pcache use-after-free, wifi driver memory leaks across mt76, iwlwifi, and brcmfmac, and I3C device master use-after-free in the unregister path. Version 7.2.5 was dominated by backports, among them a large sweep of NFC fixes bounding device-reported lengths, rejecting undersized LLCP PDUs, and fixing an out-of-bounds write in nci_target_active, alongside futex priority-inheritance races and io_uring iovec leaks. Version 7.2.6 brought an exceptionally long list of nfsd hardening patches covering use-after-free in the fcache disposal path, layout_fence_worker double references, and nfsd_file leaks on inter-server COPY, plus a clocksource IRQ leak fix and an iomap integrity-payload fix. Version 7.2.7 wrapped up the month with a broad set covering Btrfs write-protection during data writeback, AppArmor credential use-after-free and a null-termination out-of-bounds write, mm and MGLRU correctness, and a large group of tracing use-after-free and crash fixes.

Mesa 26.2.2 & 26.2.3: Two bugfix releases landed on the 26.2 branch. Alongside the usual stream of regression fixes, openSUSE’s build gained the rocket Gallium driver for Rockchip NPUs on aarch64, and the new Mesa-teflon-delegate subpackage ships a TensorFlow Lite delegate for NPUs. The changelogs point to the Mesa 26.2.2 and Mesa 26.2.3 release notes for details, and the LLVM 23 build fix that unblocked both releases came along with them. Users on AMD, Intel, or Qualcomm hardware who experienced rendering issues after earlier Mesa updates should find these releases more stable.

rsync 3.5.1: The file synchronization tool received a sweeping security overhaul. A focused audit of path handling and the daemon protocol, a companion fuzzing pass and external reports produced 33 fixes covering restricted-directory escapes in rrsync, daemon module-root chdir escapes under use chroot = no, --relative implied-parent creation escaping the destination tree, daemon --filter merge file bypasses, and a range of symlink races on the sender and receiver sides. The release also fixes an unauthenticated TLS connection in rsync-ssl and a hosts deny rule that failed open when a configured hostname could not be resolved. A 3.5.1 follow-up in the same snapshot fixed several path-handling regressions from 3.5.0, restored access to /dev/stdin and friends inside user namespaces, tightened partial-directory validation on the receiver, added support for internationalised domain names, and bumped the protocol number to 33.

util-linux 2.42.3: The Linux utility suite received a security-focused point release. Four mount(8) and namespace-related CVEs are fixed, including post-mount hooks running after an external mount helper fails and a time-of-check/time-of-use race on the source path in restricted SUID mode. wall and write gained an additional fix for terminal escape sequence injection through the banner hostname, complementing the earlier CVE-2024-28085 work. Alongside the security work, the release fixes an out-of-bounds read of the ISO9660 root directory record in libblkid, an out-of-bounds write in get_line() on invalid multibyte input, and a pg out-of-bounds access on a trailing tab.

PipeWire 1.6.9: The sound and video server shipped a bugfix release that is API and ABI compatible with the rest of the 1.6 series. RAOP (AirPlay) support sees the most work, with encryption fixed for OpenSSL 3 and above, truncated audio and metadata update problems resolved, and RAOP over TCP fixed. The resampler cutoff frequencies were tweaked to preserve more high frequencies when upsampling, potential overflows in client node buffer checks were fixed, and pw-cat now handles EOF correctly for encoded files while pw-record supports A-law.

poppler 26.09.0: The PDF rendering library jumped two minor releases, picking up 26.08.0 on the way. Fonts are now subset when saving changes in annotations and forms through fontconfig, which required making harfbuzz a build dependency. pdftotext gains a -urls option to print link URLs next to their text, pdftohtml no longer crashes when using data URLs and skips tiling patterns earlier for speed, and pdfimages gains min-height and min-width options. The core also stops infinite looping on a wrong NSS password and fixes crashes on malformed documents.

BlueZ 5.87: The Bluetooth stack jumped five releases from 5.82, bringing LE Audio and profile work along with it. Version 5.83 added AVDTP TX timestamps and fixed handling of BAP PAC removal, broadcast receiver SIDs, and HID service records; 5.84 added unicast endpoint reconfiguration, encrypted broadcast sources and HFP Caller Line Identification; 5.85 added HFP call answer and simple 3-way call support and corrected battery charge level display; 5.86 added the Telephony, Ranging, GMAP and TMAP profiles and fixed the G.722 16 kHz codec ID; and 5.87 resolved a long list of BAP, BASS, PBAP, MCP, AVRCP and GATT database issues.

cryptsetup 2.8.8: The disk encryption tool received a feature and hardening release. integritysetup gained support for keyed discards via a new --allow-discards-keyed option, which permanently upgrades the superblock so that an integrity device in standalone mode with a keyed integrity algorithm can no longer have part of itself wiped with a discard pattern. The library also closes a time-of-check/time-of-use issue in LUKS header restore by opening the device only once, which affects both LUKS1 and LUKS2, hardens BITLK metadata validation against a wrong key buffer size and a deliberate infinite loop, and fixes a possible integer overflow in the anti-forensic data size calculation on 32-bit systems.

gzip 1.15: The ubiquitous compression utility reached a new major version, landing fixes for two earlier security issues and a batch of long-standing bugs. A buffer overflow when decompressing an .lzh file after a .Z file is fixed, as is a use of uninitialized memory on some malformed inputs. gzip -d no longer rejects PKZIP signatures and local headers that legitimately appear in well-formed streamed zip files, diagnostics now quote file names containing unusual characters, and gzip --synchronous works again on platforms with O_PATH. Behaviorally, gzip follows the locale from the environment instead of insisting on the C locale, and -l reports -Inf% rather than 0.0% for an empty file.

libinput 1.32: The input handling library arrived with input-device improvements. Circular scrolling now works on circular touchpads such as the Panasonic CF-SV1, dragging on a touchpad automatically enables a drag lock when a finger nears the edge, and disable-while-typing no longer cancels an interaction already in progress. Tablets can now map the physical eraser button to any button, and libinput record accepts a --no-events flag.

lightdm 1.33.1: The display manager received a bugfix release with a notable feature. A Qt6 client library is now shipped alongside the Qt5 one, and the release fixes user switching after logind dropped the CanMultiSession property. Wayland sessions are now allowed on seat0 without VTs, PAM modules that change the home directory are handled correctly, the VNC server command is honored with IPv6 tried first for the bind, a local X server is not reused when the hostname has changed, and memory leaks in session_child_run are plugged.

AppStream 1.2.0: The software metadata standard reached a new major version and marks the libappstream-compose API as stable. appstream-compose gains an out-of-process media worker with a basic Landlock-based sandbox, switches image processing from GdkPixbuf to VIPS, and makes JPEG XL the default output format. New <heading> markup is supported in AppStream descriptions, and the news tools gain inline Markdown support along with header handling across the XML, YAML and Markdown conversions.

xz 5.8.4: The compression library received a bugfix release that includes a security fix. An invalid memory access in lzma_alone_decoder(), lzma_lzip_decoder(), lzma_auto_decoder() and lzma_microlzma_decoder() after a failed allocation is followed by decoder reinitialization is fixed, along with two use-after-free bugs in xz itself via --files/--files0 and --verbose with redirected stderr. Landlock ABI 9 support is added, a performance issue and theoretical integer overflow in lzma_index_cat() are fixed, and xz --list no longer overflows its totals.

VirtualBox 7.2.18: The VirtualBox hypervisor received a bugfix release. Data corruption in VDI differencing images after writing full blocks of zeroes and reopening the image is fixed, a VM process crash on Linux hosts with 3D acceleration enabled is resolved, and the shared clipboard no longer strips the first character from a file name located directly in a filesystem root. Linux 7.3-rc support is added.

libgcrypt 1.12.4: The GnuPG cryptographic library received a follow-up point release. RSA PSS handling of very large salt lengths is fixed, the length of hashed input is validated for RSA PSS, and the RSA OAEP decoder validates all-zero padding for correctness. Padding in cSHAKE was corrected against NIST ACVP conformance vectors, and a build problem with some compiler versions around SM4 instructions is resolved.

GStreamer 1.28.7: A wide-ranging update across the core and plugin packages with both security and playback fixes. The appsrc element fixes a regression where pushing EOS into a blocked appsrc would stall, and glcolorconvert fixes compatibility with older OpenGL and GLSL versions. The mxfdemux element resolves keyframe detection regressions and possible artifacts after seeking, and rtpmanager fixes crashes on malformed RTCP SDES due to uninitialized values. The Rust-based plugins gain DoS protection in rtpsession and limit the number of remote sources tracked in rtprecv. Security fixes span multiple parsers including pnmdec and onnx, and the x264enc high bit depth support is fixed in binary packages.

ffmpeg 8: A massive security update carrying more than 20 CVE patches. Fixes address out-of-bounds reads and writes across numerous demuxers and decoders including HEVC, CineForm, TIFF, Screenpresso, and DVB subtitle parsers. The RTP muxer receives bounds checks for AV1, VC-2, and ASF objects, and the MPEG muxer rejects stream counts that overflow the system header. This is an essential update for any system that processes media files, as the vulnerabilities could be triggered by crafted input.

dracut: Received a security fix for CVE-2026-6893, a root code execution vulnerability via DHCP options command injection. The fix sanitizes values written to network override files, gateway files, and hostname files, and strips DHCP-supplied domains to a safe charset. This is important for any system that uses dracut-generated initrd images with network boot configurations.

Security Updates

rsync 3.5.1:

CVE-2026-53783: Fixes an rrsync restricted-directory escape via a validation-versus-execution race and an unsafe option allowlist.
CVE-2026-53784: Addresses a daemon module-root chdir escape under use chroot = no.
CVE-2026-53785: Resolves --relative implied-parent creation escaping the destination tree.
CVE-2026-53786: Fixes a daemon --filter merge file bypassing the module filter list.
CVE-2026-53788: Addresses the daemon name-converter accepting newline-bearing names into its line protocol.
CVE-2026-53789: Corrects a malicious sender expanding --delete scope by reclassifying an implied parent.
CVE-2026-53790: Fixes command and argument injection via unquoted peer- or host-controlled values.
CVE-2026-53791: Addresses PROXY-protocol mode letting a direct client spoof the daemon’s source address.
CVE-2026-53792: Resolves a receiver-supplied zero checksum block length driving the sender into a negative match.
CVE-2026-53793: Fixes a chroot /./ inner-module escape via a parent-component symlink.
CVE-2026-53794: Addresses a remote peer disabling the per-allocation sanity cap via --max-alloc=0.
CVE-2026-53795: Corrects a receiver write escape via an absolute --temp-dir or --link-dest disabling rename and link confinement.
CVE-2026-53796: Fixes a non-daemon receiver destination-chdir symlink race.
CVE-2026-53797: Addresses a sender source-tree parent-component symlink race leading to out-of-tree disclosure.
CVE-2026-53798: Resolves the daemon name-converter mapping an unknown name to uid/gid 0 on an empty response.
CVE-2026-53799: Fixes receiver ACL and xattr application following a symlink race for arbitrary ACL setting and local privilege escalation.
CVE-2026-53800: Addresses sender --remove-source-files unlink following a parent-component symlink race for arbitrary file deletion outside the source tree.
CVE-2026-53801: Corrects sender and daemon directory-scan enumeration escaping the transfer root for out-of-tree disclosure.
CVE-2026-53802: Fixes arbitrary file read and transfer shaping via symlinked operator-supplied input files.
CVE-2026-53803: Addresses arbitrary file write and privilege escalation via symlinked operator-supplied output paths.
CVE-2026-70463: Fixes auth users ignoring documented comma-only parsing and silently skipping a deny or read-only rule.
CVE-2026-70462: Addresses a peer-supplied MSG_IO_TIMEOUT defeating the client’s own I/O timeout through signed overflow and a non-positive value.
CVE-2026-70461: Resolves a peer-driven one-byte heap out-of-bounds write in add_implied_include().
CVE-2026-70460: Fixes a daemon module-root escape through a peer-supplied --partial-dir or --backup-dir resolving via an in-module symlink.
CVE-2026-70459: Addresses a per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root.
CVE-2026-70458: Corrects an out-of-bounds write from a FLAG_HLINKED file entry accepted without -H.
CVE-2026-70457: Patches an attacker-chosen-offset write in parse_size_arg() error formatting.
CVE-2026-70456: Fixes a remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs.
CVE-2026-70454: Addresses rsync-ssl establishing an unauthenticated TLS connection with no CA verification and no stunnel hostname binding.
CVE-2026-70453: Resolves quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain.
CVE-2026-70464: Fixes an unauthenticated pre-transfer handshake denial of service locking out an rsync daemon module.
CVE-2026-70455: Addresses peer-controlled Zstandard worker exhaustion on an rsync daemon.
CVE-2026-70452: Corrects hosts deny failing open when a configured hostname cannot be resolved, admitting the host it was meant to block.
CVE-2025-10158: Fixes an out-of-bounds array access via a negative index.
CVE-2026-41035: Addresses a count of entries mismatch leading to a use-after-free.
CVE-2026-43617: Resolves authorization bypass via hostname resolution.
CVE-2026-43618: Addresses a second authorization bypass, tracked separately from CVE-2026-43617.
CVE-2026-29518: Fixes integer overflow information disclosure.
CVE-2026-43619: Addresses a symlink race condition via path-based syscalls.
CVE-2026-43620: Corrects an out-of-bounds array read via recv_files().
CVE-2026-45232: Fixes an off-by-one stack out-of-bounds write in HTTP CONNECT proxy response parsing.

python313 3.13.15:

CVE-2026-19672: Fixes a tarfile member that leaves the destination directory and comes back.
CVE-2026-17084: Addresses Unicode codepoint attributes outside RFC 3454 being considered valid.
CVE-2026-15308: Resolves quadratic complexity in incremental parsing of long unterminated constructs in html.parser.HTMLParser, exploitable for denial of service.
CVE-2026-6879: Corrects quadratic behavior in xml.etree.ElementTree.Element findall(), iterfind() and find() when using XPath index predicates on documents with many same-tag siblings.
CVE-2026-4360: Fixes tarfile.TarFile.extract() not applying the given filter when it extracts a link target from the archive as a fallback.
CVE-2026-11972: Addresses tarfile seeking a stream continuing past the end of the stream.
CVE-2026-11940: Resolves a bypass of CVE-2025-4330 where crafted archives could create a symlink pointing outside the destination directory through the tarfile data and extraction filters.
CVE-2026-0864: Corrects line endings in multi-line configparser values not being normalized to LF+TAB.
CVE-2025-15366: Fixes NUL, CR and LF characters being accepted in IMAP commands.
libexpat 2.8.2: The bundled libexpat is updated to 2.8.2.

util-linux 2.42.3:

CVE-2026-76642: Fixes mount(8) post-mount hooks executing after an external mount helper fails, allowing privileged operations on the pre-existing target filesystem.
CVE-2026-78410: Addresses a mount(8) time-of-check/time-of-use race on the source path in restricted SUID mode, letting a local attacker redirect a privileged mount or post-mount ownership change.
CVE-2026-78409: Resolves an X-mount.subdir symlink escape from a detached mount tree in mount(8).
CVE-2026-78408: Fixes a file descriptor leak in nsenter(1) and unshare(1) where descriptors were not created with O_CLOEXEC.
Hostname escape sequence injection: An additional fix for CVE-2024-28085 sanitizes the hostname interpolated into the wall(1) and write(1) banner headers, which an unprivileged user could otherwise poison via a user namespace hostname.

tesseract-ocr:

CVE-2026-88047: Fixes a stack buffer overflow in Classify::ReadNormProtos on a crafted traineddata file.
CVE-2026-88048: Addresses a heap out-of-bounds write and read in FullyConnected::Forward via a dimension mismatch.
CVE-2026-88049: Resolves a heap out-of-bounds write in LSTM::Forward via an na_/gate-matrix dimension mismatch.
CVE-2026-88050: Fixes an out-of-bounds write in UnicharCompress via unvalidated recoder code values.
CVE-2026-88051: Corrects a heap out-of-bounds write in GenericVector<T>::read via a reserved/size_used mismatch.
CVE-2026-88052: Patches a heap out-of-bounds write in UNICHARSET::load_via_fgets via a count/insert desynchronization.
CVE-2026-88053: Addresses a heap out-of-bounds write in Classify::ReadIntTemplates via unvalidated counts in a crafted traineddata file.
CVE-2026-88054: Resolves a denial of service via an empty-stack dereference at model load.
CVE-2026-73067: Fixes a heap out-of-bounds read in SquishedDawg on a crafted model, already patched in the shipped 5.5.3.

hplip 3.26.6:

CVE-2026-91097: Fixes a security vulnerability in the HP Linux Imaging and Printing utilities.
CVE-2026-91098: Addresses a security vulnerability in the HP printer and scanner backend components.
CVE-2026-91099: Resolves a security vulnerability in HPLIP’s firmware and device handling code.
CVE-2026-91100: Corrects a security vulnerability in the HPLIP scan backend.
CVE-2026-91101: Patches a security vulnerability in the HPLIP print queue and status handling.
CVE-2026-91102: Fixes a security vulnerability in the HPLIP device discovery code.
CVE-2026-91103: Addresses a security vulnerability in the HPLIP model and capability database.
CVE-2026-91104: Resolves a security vulnerability in the HPLIP fax and scan utilities.
CVE-2026-91105: Corrects a security vulnerability in the HPLIP plugin download and verification path.
CVE-2026-91106: Patches a security vulnerability in the HPLIP status and configuration tools.

freeipmi 1.6.19:

CVE-2026-85504: Fixes a stack-based buffer overflow via malformed Fujitsu SEL long-text responses.
CVE-2026-85505: Addresses a denial of service via a stack-based buffer over-read in ipmi-oem.
CVE-2026-85506: Resolves arbitrary code execution via a stack-based buffer overflow in ipmi-oem.
CVE-2026-85507: Fixes a stack-based buffer overflow in _output_dell_system_info_cmc_info.
CVE-2026-85508: Corrects a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info.
CVE-2026-85509: Patches a stack-based buffer overflow when a BMC returns more bytes than requested.

gvfs 1.60.3:

CVE-2026-88924: Fixes the admin backend setting socket ownership after creation rather than before.
CVE-2026-84268: Addresses the sftp backend not clamping the read_reply count to the requested buffer size.
CVE-2026-84270: Corrects the mtp backend not validating the read size returned by the device.

flatpak 1.18.3:

CVE-2026-87766: Fixes a vulnerability in the bundled bubblewrap 0.12.0 sandbox component.
CVE-2026-93676: Addresses a vulnerability in the bundled xdg-dbus-proxy 0.1.8 filtering component.

libsoup:

CVE-2026-85534: Fixes libsoup 3 sending more body bytes than nghttp2 requested.
CVE-2026-85197: Resolves a crash in on_data_read after the connection has been destroyed.
CVE-2026-77680: Corrects a flaw in HTTP Range header processing in libsoup 2.
CVE-2026-77014: Addresses the same HTTP Range header processing flaw in libsoup 2.

p11-kit 0.26.5:

CVE-2026-18938: Fixes an overflow when decoding nested attributes.
CVE-2026-13757: Addresses server-side stack exhaustion via unbounded recursion in RPC attribute parsing by enforcing a recursion depth limit.

sssd:

CVE-2026-87853: Fixes cross-user impersonation in the IDP provider by correcting user matching in access token evaluation.

PackageKit 1.4.0:

CVE-2026-19816: Fixes the dnf5 backend executing repo-remove for simulated transactions.

curl 8.22.0:

CVE-2026-13608: Fixes OpenLDAP SASL authentication bypass.
CVE-2026-18924: Addresses HTTP/2 server push use-after-free.
CVE-2026-19931: Resolves Negotiate ambient user connection reuse.
CVE-2026-80229: Fixes OpenSSL provider use-after-free.
CVE-2026-80230: Addresses OpenSSL pinning bypass.
CVE-2026-80255: Resolves secure cookie attribute bypass with tab character.
CVE-2026-82209: Fixes domain-scoped PSL domain cookie issue.

NetworkManager:

CVE-2026-10805: Fixes dhclient accepting unsafe characters in URLs and hostnames.
CVE-2026-19685: Addresses 802.1x rejecting ca-path for private connections.

glibc 2.44:

CVE-2026-6791: Fixes stack-based buffer clash during tilde expansion in wordexp.
CVE-2026-6368: Resolves invalid call to free() when wordexp is used with WRDE_APPEND.
CVE-2026-18374: Fixes a heap buffer overflow in the libio ccs= handling.
CVE-2026-19499: Addresses incorrect right-justification in strfmon.
CVE-2026-19542: Resolves an out-of-bounds array write in tdelete.
CVE-2026-77117: Fixes SHIFT_JISX0213 decoding leaving a pending character set across conversions.
CVE-2026-80489: Corrects the same pending character reset problem for EUC_JISX0213 decoding.

exiv2 0.28.9:

CVE-2026-68547: Fixes a security vulnerability in EXIF metadata processing.
CVE-2026-68546: Addresses a security vulnerability in image metadata handling.
CVE-2026-49275: Resolves a security vulnerability in the metadata library.

dracut:

CVE-2026-6893: Fixes root code execution via DHCP options command injection.

libpcap 1.10.7:

CVE-2026-0799: Fixes safe M[] access in the BPF interpreter.
CVE-2026-31912: Addresses program bounds checking in pcap_offline_filter().
CVE-2026-31911: Resolves safe opcode failure handling in the BPF interpreter.
CVE-2026-6244: Fixes division by zero via pcap_offline_filter().
CVE-2026-6554: Addresses “ja L” looping limit in pcap_offline_filter().
CVE-2026-18313: Fixes memory leak in rpcapd.
CVE-2026-18238: Addresses RPCAP_MSG_PACKET validation.

ffmpeg 8:

CVE-2026-75147: Fixes OBU size bounding in AV1 RTP keyframe search loop.
CVE-2026-75146: Addresses negative fragment index in DASH demuxer.
CVE-2026-75145: Resolves OBU size narrowing to long in AV1 RTP muxer.
CVE-2026-75144: Fixes data units larger than RTP payload buffer in VC-2 muxer.
CVE-2026-75143: Addresses caller buffer size honoring in librist reader.
CVE-2026-75142: Resolves stream count overflow in MPEG muxer.
CVE-2026-75141: Fixes hvcC NAL array overflow in HEVC demuxer.
CVE-2026-70632: Addresses transform-2 output width validation in CineForm decoder.
CVE-2026-70631: Resolves inflate output length check in TIFF decoder.
CVE-2026-70630: Fixes deflate output length check in Screenpresso decoder.
CVE-2026-70629: Addresses uninitialized data on short input in rscc decoder.
CVE-2026-70628: Resolves signed overflow in DVB subtitle parser capacity check.
CVE-2026-66037: Fixes count_label validation in IAMF parser.
CVE-2026-66036: Addresses dynamic frame size support in hqdn3d filter.
CVE-2026-65706: Fixes temp row buffer sizing in swaprect filter.
CVE-2026-65705: Resolves unneeded variables in floodfill filter.
CVE-2026-65704: Fixes AC3 trim underflow in Ty demuxer.
CVE-2026-65703: Addresses reference frame handling in TDSC decoder.
CVE-2026-64834: Resolves ASF object size validation in RTP decoder.
CVE-2026-64833: Fixes DTS core_size bounding in SPDIF encoder.
CVE-2026-58049: Addresses DLTA access bounds checking in RASC decoder.

389-ds 3.3.1:

CVE-2026-18355: Fixes heap buffer overflow in the SASL I/O layer.
CVE-2026-18663: Addresses pre-authentication double-free via critical Session Tracking control.
CVE-2026-11770: Resolves pre-auth LDAP filter injection in CleanAllRUV status check.
CVE-2026-18453: Fixes pre-authentication NULL pointer dereference via paged results.
CVE-2026-15722: Addresses pre-authentication stack buffer overflow via unbounded replica ID parsing.
CVE-2026-18922: Resolves stale identity installation following SASL PLAIN authentication.
CVE-2026-19843: Fixes Cockpit LDAP editor shell command injection.
CVE-2026-76560: Addresses SELFDN ACI bind-rule evaluator incorrect matching.

xen 4.22.0_04:

CVE-2026-62437: Fixes memory leak caused by device model IRQ binding.
CVE-2026-79602: Addresses improper handling of HVM emulation return codes.
CVE-2026-79603: Resolves TLB flushing not happening before page scrubbing.

coreutils:

CVE-2026-56391: Fixes read buffer overrun in uniq -w in multibyte locales.
CVE-2026-56392: Addresses heap overflow in unexpand -t for tab values larger than SIZE_MAX/16.

gegl 0.4.72:

CVE-2026-18300: Fixes vulnerability in the RGBE loader for large report files.

cups-filters:

CVE-2026-64611: Fixes infinite-loop CPU-exhaustion denial of service in cfIEEE1284NormalizeMakeModel on empty MDL field.
CVE-2026-64612: Addresses malformed PNG aborting the CUPS image filter process due to missing libpng setjmp recovery.

alsa:

CVE-2026-90781: Fixes a denial of service via an off-by-one stack buffer overflow in the control interface parser.

cups 2.4.19:

CVE-2026-87875: Addresses a heap out-of-bounds read in cupsUTF32ToUTF8() due to a missing source-length bound, reachable from SNMP supply-description parsing.

7-Zip 26.03:

CVE-2026-58052: Fixes 7-Zip failing to preserve the Mark-of-the-Web when extracting a crafted archive, which let an extracted file bypass the trust check meant to keep it quarantined.

GIMP 3.2.6:

CVE-2026-80101: Fixes invalid guards on XWD parameters, which could lead to a buffer overflow when loading a crafted XWD file.

discount 3.0.2.0:

CVE-2026-4833: Addresses uncontrolled recursion in compile() on deeply nested input, leading to stack exhaustion and a crash. The parser now caps nesting depth, defaulting to 200 and tunable via --with-recursion.

libX11:

CVE-2026-88806: Fixes a heap-based buffer overflow in the XkbGetMap reply by checking the keysym range in _XkbReadKeyActions.

libXrender:

CVE-2026-88807: Fixes an out-of-bounds write into screen->subpixel when a malicious server replies to XRenderQueryFormat with a numSubpixels count greater than the number of screens.

libtpms:

CVE-2026-85769: Fixes a heap out-of-bounds read in TPM2 state unmarshalling via an unchecked block_skip_read() blocksize.

librsvg 2.62.4:

Use-after-free with nested Xinclude: Fixes a use-after-free when duplicate XML entities appear in nested Xinclude documents.

Users are advised to update to the latest versions to mitigate these vulnerabilities.

Conclusion

September was a busy month for openSUSE Tumbleweed with snapshots delivering a steady cadence of desktop, developer, and security improvements. KDE Plasma 6.7.5 and KDE Frameworks 6.30.0 refined the KDE desktop and added new features, while KDE Gear 26.08.1 stabilized the application suite with fixes across Dolphin, Okular, and Kitinerary. glibc jumped to 2.44 with Transparent Huge Pages tunables and vectorized math functions, and LLVM 23.1.1 arrived with important toolchain bugfixes. The Linux kernel progressed through 7.2.4 with extensive CVE coverage across USB, networking, and virtualization subsystems, and Mesa settled into its 26.2.2 release. LibreOffice advanced to 26.8.0.3 and harfbuzz improved text shaping performance and correctness. The second half of September carried the month’s heaviest security load. rsync 3.5.1 arrived after an audit of its path handling and daemon protocol that turned up more than 40 vulnerabilities, including a set of chroot and rrsync escapes, a hosts deny rule that failed open when a hostname could not be resolved, and an unauthenticated handshake denial of service against a daemon module. On the desktop side, the GNOME stack picked up 50.5 across gnome-shell and mutter, GIMP advanced to 3.2.6, Shotwell reached 33.0, bash-completion 2.17.0 and coreutils 9.12 landed alongside a burst of late-month updates across Mesa 26.2.3, PipeWire 1.6.9, Poppler 26.09.0, BlueZ 5.87, and xz 5.8.4.

Slowroll Arrivals

Please note that these updates also apply to Slowroll and arrive between an average of 5 to 10 days after being released in Tumbleweed snapshot. This monthly approach has been consistent for many months, ensuring stability and timely enhancements for users. Updated packages for Slowroll are regularly published in emails on openSUSE Factory mailing list.

Contributing to openSUSE Tumbleweed

Stay updated with the latest snapshots by subscribing to the openSUSE Factory mailing list. For those Tumbleweed users who want to contribute or want to engage with detailed technological discussions, subscribe to the openSUSE Factory mailing list . The openSUSE team encourages users to continue participating through bug reports, feature suggestions and discussions.

Your contributions and feedback make openSUSE Tumbleweed better with every update. Whether reporting bugs, suggesting features, or participating in community discussions, your involvement is highly valued.

Welcome to openSUSE Asia Summit in Yogyakarta

admin@opensuse.org (openSUSE Asia Summit Team) — Wed, 30 Sep 2026 08:00:00 +0000

The wait is almost over! 🎉

The openSUSE.Asia Summit 2026 will begin on Oct. 3-4 at UIN Sunan Kalijaga, Yogyakarta.

On behalf of the organizing committee, we would like to warmly welcome everyone to Yogyakarta and to this year’s Summit. We hope you enjoy the talks, workshops, discussions, and all the activities we have prepared for you.

For those visiting Yogyakarta for the first time, don’t forget to enjoy the city as well. Take some time to explore its food, culture, streets, and atmosphere. Yogyakarta has plenty to offer beyond the conference venue.

And for those meeting old friends again, we hope this summit becomes a warm opportunity to reconnect, catch up, share stories, and spend some good time together with the community. ❤️

Let’s make openSUSE.Asia Summit 2026 a memorable gathering!

Welcome to Yogyakarta, and enjoy the Summit! 🦎💚

Kudos Now Recognizes Whole Teams

admin@opensuse.org (openSUSE Kudos Team) — Wed, 30 Sep 2026 08:00:00 +0000

The openSUSE Kudos recognition platform has a new feature: teams. You can now thank a whole team at once, see who is part of which team, and join or start a team yourself.

Why teams

Peer-to-peer recognition is at the heart of Kudos, and it works well when the work was done by one person. A lot of what happens in openSUSE is not like that, though. A release, an installer, a conference booth or a wiki cleanup is usually the effort of an entire group.

One piece of feedback kept coming back: when someone wanted to thank a team, the kudos landed on the one or two people they happened to know by name. The rest of the people who did the work got nothing, simply because the person saying thanks could not name them.

Some contributors are also simply less visible than others. They do not post much, they do not show up in every chat, and their work happens quietly in the background. That does not mean they do less. Recognizing the team as a whole makes sure that thanks reaches them too.

What you can do

Thank a team, or a team and individuals together. When giving kudos, teams show up in the recipient picker next to people. You can thank a team on its own, or combine it with individual contributors in the same kudo. That comes in handy because teams rarely work alone: a release team may get help from translators, testers or packagers outside the team, and now one thank-you can include all of them. Team members can thank their own team as well.
See who is in which team. Every team has its own page with its roster, and every profile now shows the teams that person belongs to. Former members stay listed as alumni, so past contributions are not forgotten.
Join or start a team. Click the Join Team button in the header, search for your team, and ask to join. If your team is not there yet, create it right from the same box. No admin approval is needed to start a team; only linking it to a badge goes through an admin (more on that below).
Invite people. Team members can invite other Kudos users by their username. The invitation arrives by email and in the app, and the person joins once they accept.

Once you are in a team, the button in the header turns into My Teams, and it lets you know when an invitation or a join request is waiting for you.

Self-managed teams

Teams run themselves. There is no owner and no manager role. Any member can approve people who asked to join, invite others, or tidy up the roster, and anyone can leave at any time. Requests that nobody answers are approved automatically after 14 days, so nobody gets stuck waiting.

Teams can also be linked with a badge. This is the one step that needs an admin, and for a good reason: a linked badge adds every holder of that badge to the team. If anyone could link any badge, a brand-new team could claim the Tumbleweed contributor badge and instantly “have” hundreds of members who never asked to join. So an admin checks that the badge really belongs to the team before linking it.

Once an admin links a badge to a team, everyone on the roster gets it, and anyone who later earns the badge through other means is added to the team automatically. Until now, team badges were handed out by hand, one person at a time. Now the team keeps its own roster, and the badge follows.

Every team page has a badge slot, and for most teams it still reads “Badge: TBD”. Badges live in openSUSE/kudos-badges on GitHub, where new ideas and artwork arrive as ordinary pull requests, so a team that wants to fill its slot is only a pull request away. Designing the badge together can be a fun first thing for a new team to do.

Badges are never taken away when someone leaves a team. A badge records what you did; the team roster shows who is there now.

Get started

Log in to kudos.opensuse.org, click Join Team, and find your team or start a new one. Then invite the people you work with, and the next time your team ships something great, thank all of them at once.

Feedback is welcome, as always. Kudos is developed in the open at github.com/openSUSE/kudos.

Deadline Extended Call for Host openSUSE Asia Summit 2027

admin@opensuse.org (openSUSE Asia Summit Team) — Mon, 28 Sep 2026 10:00:00 +0000

The openSUSE.Asia Summit Organizing Committee has extended the deadline for the Call for Host to submit proposals for the 2027 Summit. Communities now have until 30 November, 2026 to apply.

The extension comes in response to requests from local communities seeking more time to prepare their proposals. This is a great opportunity to showcase your region and bring the openSUSE community together in your city.

If your community is interested in hosting the openSUSE.Asia Summit 2027, come and join us at openSUSE.Asia Summit 2026 in Yogyakarta this October. The organizing committee can provide presentation slots for communities interested in hosting the 2027 Summit, giving them an opportunity to introduce their community, city, and vision for the next Summit.

For more information, visit https://news.opensuse.org/2026/07/14/osas-cfh/.

Try Immutable Mode with openSUSE Leap 16.1 RC

admin@opensuse.org (Lubos Kocman) — Mon, 28 Sep 2026 04:00:00 +0000

Entering RC Phase

openSUSE Leap 16.1 has entered the Release Candidate phase. Release Candidate images can be found at get.opensuse.org.

We know that people really start testing a new release with the RC, so this is the right time to grab an image and give it a try.

Users can expect that we’ll continue publishing roughly one build a week during the RC phase. Once SUSE Linux Enterprise Server 16.1 announces their Gold Master, we’ll be working toward the Leap 16.1 Gold Master Candidate (GMC).

Based on feedback from the Leap 16.0 retrospective, we’ll sync the Leap 16.1 release day with the SLES 16.1 release day, even if that means a slight delay. This way, there is no obvious gap in receiving maintenance updates after the release.

Details about the schedule can be found in our roadmap.

Usecase: Try the new Immutable mode

Leap 16.1 is the first Leap release to offer an Immutable Mode, a transactionally updated system with a read-only root filesystem. This is essentially what our users know from Leap Micro, just integrated directly into Leap.

Leap 16.1 in Immutable mode is replacing Leap Micro. There won’t be a Leap Micro 6.3 or 7.0; Leap Immutable is the way forward for container and virtual machine hosts, edge devices and anyone who prefers atomic updates with easy rollback.

The Immutable mode was added to Agama rather recently, which is exactly why we’d like you to try it. Simply boot the usual Leap 16.1 install image and pick the Immutable mode in the installer.

Doesn’t agama with dark theme look amazing? Once installed, the system is updated with transactional-update, which creates a new snapshot for every update and lets you roll back if something goes wrong.

sudo transactional-update dup    # update the system into a new snapshot
sudo reboot                      # boot into the new snapshot
sudo transactional-update rollback  # go back if something went wrong

Additional software is best consumed via containers with podman or distrobox, or via Flatpak on desktops. Packages can still be installed with sudo transactional-update pkg install <package>.

Leap Micro users: appliances are still here

Users who are used to the Leap Micro images will feel at home. The usual preconfigured appliances can be found in the alternative downloads section at get.opensuse.org. This includes the Immutable Self-install image, which is recommended for USB installations, as well as images for KVM/Xen, MS Hyper-V, VMware, Harvester and Cloud, and a fully encrypted raw disk image.

The appliances can be configured on first boot via Ignition or Combustion, just like Leap Micro.

Existing Leap Micro 6.2 installations can be migrated to Leap 16.1 in Immutable mode with the opensuse-migration-tool.

sudo transactional-update shell
# Inside the shell:
zypper in opensuse-migration-tool
opensuse-migration-tool --dry-run # optionally check how it looks
opensuse-migration-tool
exit && reboot # boot into the new snapshot

The tool is still experimental, so please make sure to have a backup and let us know how the migration went.

Desktops: Same GNOME, newer Plasma

Some users may expect a big GNOME update in Leap 16.1. In fact, Leap 16.1 ships the same GNOME 48 as Leap 16.0, with bug fix updates (gnome-shell 48.8 vs. 48.4 in 16.0).

Just like in Leap 15.X and the respective SUSE Linux Enterprise 15 service packs, the big GNOME update is planned over two releases.

Leap 16.0 and 16.1 share the same GNOME major version, and users can expect the next big GNOME update in a future release.

KDE Plasma users, on the other hand, get a noticeable bump from Plasma 6.4 to Plasma 6.6 with Qt 6.11 and KDE Frameworks 6.25.

LXQt moved from 2.2 to 2.4, and Xfce on Wayland continues with 4.20.

What’s new in Leap 16.1

Wondering which version of your favorite package you’ll get in Leap 16.1? Rather than listing a handful of packages here, we’d like to point you to our new openSUSE version diff tool.

It’s a single page comparing source package versions across Leap 16.1, Leap 16.0 and Tumbleweed, including the latest upstream versions from Repology.

The page republishes itself automatically, so it stays up to date during the whole RC phase and beyond. You can filter packages by status, e.g. to see what was updated compared to 16.0, or download the data as JSON or CSV.

The tool grew out of a community discussion at our weekly Release Engineering meeting; read more about it in One Page, Every Package.

Ideas and contributions are welcome at github.com/openSUSE/osdiff.

Help us with testing

Your feedback is critical at this stage. Help us with testing by following our manual test plan.

The plan covers scenarios that are hard to automate in openQA, so every test case marked as done on as many hardware combinations as possible helps us to ship a better release.

Simply record your result with your openSUSE ID; we intend to award Kudos badges to everyone participating in manual testing.

Alternatively, simply install Leap 16.1 RC, try the Immutable mode, your favorite desktop or your usual server workload, and let us know how it goes.

Please report any issues on bugzilla.opensuse.org.

Please make sure to check the Known bugs wiki page prior to reporting a new bug.

Thank you for testing and being part of the openSUSE community. Let’s shape Leap 16.1 together!

Planet News Roundup

admin@opensuse.org (Douglas DeMaio) — Fri, 25 Sep 2026 08:00:00 +0000

This is a roundup of articles from the openSUSE community listed on planet.opensuse.org. This community blog feed aggregator lists the featured highlights below from Sept. 18 - 24.

This week highlights Xiaomi’s MiMo V2.6 AI family, a brightness-flickering fix for VRR on Plasma, two guides to building Flatpaks locally with Foundry, the history of Madrid’s MAX classroom distribution, AkademyES 2026’s 30/20 anniversary gathering and KDE’s Marknote notebook, a sleep-mode fix for openSUSE Leap, the Flip Clock plasmoid, a weeklybeats track and more.

Here is a summary and links for each post:

Leap Heads Into Release Candidate Phase

The openSUSE News blog covers openSUSE Leap 16.1 nearing its Release Candidate stage. The release brings major package updates, including KDE Plasma 6.6.4, QEMU 11, MariaDB 12, and PHP 8.5, and the team is asking testers to help find any remaining issues.

Plasma 6.8 Beta 2 released

The KDE Blog covers the releases of the second beta of Plasma 6.8. It points out the improved GTK4 window decorations, a redesigned Flatpak permissions page, and Discover enhancements. This release also continues the public technical preview of the Union theming system.

Xiaomi MiMo V2.6: Xiaomi Fully Enters the Race for Open AI Models

Alessandro’s blog introduces Xiaomi’s MiMo V2.6 family, headlined by the trillion-parameter MoE-based MiMo-V2.6-Pro with a 1-million-token window and native text, image, video and audio support. The post details the 42-billion-active-parameter architecture, large-scale reinforcement learning and aggressive API pricing, and notes MIT-licensed weights and RL infrastructure released for the community.

KDE Express Episode 76: Brightness Flickering with VRR Adaptive Sync

The KDE Blog presents episode 76 of KDE Express, where David Marzal shares a personal fix for brightness flickering with VRR, HDR and adaptive brightness on Plasma. The episode traces the issue to bug 477016 on an AMD RX 580 over DisplayPort and asks listeners with VRR monitors for feedback.

Building Flatpaks Locally, Part 2

Jakub Steiner follows up his flatpak-builder guide with a simpler path on GNOME OS using the developer sysext. With foundry init && foundry build he shows how projects can be built locally without the manual builder setup.

Windows or Linux? The Digital Sovereignty Dilemma in Madrid’s Classrooms – Episode 6 of the Podcast “The Era of the Distros”

The KDE Blog highlights episode 6 of “La era de las distros,” which explores Madrid’s MAX distribution for schools and Spain’s early-2000s free-software classroom push. Host Lorenzo Carbonell is joined by Jose Quirino Vargas Ibáñez, Ismail Ali and Jesús González-Barahona to discuss digital sovereignty beyond license costs.

Tiny Wins for Packagers: End-of-Week Update (2026-09-18)

The Open Build Service blog welcomes new contributor wineee and notes a fix to avoid crashing on build logs for scmsync-related packages. The short update is part of the service’s regular end-of-week roundup for packagers.

Victorhck announces AkademyES 2026, set for October 23-25 at Camping Arco Iris in the Madrid mountains to mark KDE’s 30th and KDE España’s 20th anniversaries. The post outlines lodging, mandatory registration and a call for talks for the community-focused camping event.

KDE’s Markdown Notebook, Marknote

The KDE Blog introduces Marknote, KDE’s Markdown notebook for organizing notes in local .md files under Documents. It covers notebooks with icons and accent colors, rich-text and source editing, wiki-style links, a KRunner plugin and import from KNotes and maildir.

Sleep Mode in openSUSE

Alexander Tolstoy details an intermittent resume-from-suspend hang on openSUSE Leap on an Intel 9th-gen system without NVIDIA, which never appeared on Fedora. After ruling out the kernel, he resolved it by disabling and masking power-profiles-daemon and enabling tuned instead.

The Classic HTC Clock on Your Desktop, Flip Clock – Plasmoids for Plasma 6 (40)

The KDE Blog presents Flip Clock, the 40th entry in its Plasma 6 plasmoids series, which brings the HTC Sense flip-card clock to the desktop. The widget shows hours and minutes on animated flaps with optional date, weather, 12/24-hour and animation settings, requiring Plasma 6.7 or newer.

Stolen!

Jakub Steiner shares his weeklybeats track “Stolen!”, sampling the AI-industry debate with extra polish time on the Dirtywave M8. He describes mimicking an Analog Four filter and volume pulse technique using the M8’s four LFOs and modulator routing.

Bonsai 2 27B: A New Metric for Artificial Intelligence

Alessandro’s blog introduces PrismML’s Bonsai 2 27B, a ternary-compressed build of Qwen3.8-27B that shrinks a 54 GB FP16 model to about 5.9 GB while retaining 98.2% performance. The post explains Hadamard rotation, GGUF and MLX variants, up to 262K context and the need for a custom llama.cpp fork.

Linux Saloon 220 | Early Edition

Nathan Wolf posts the Early Edition of Linux Saloon 220, reflecting on a theater outing to the 1986 Transformers movie, browser use in 2026 and mobile trends. The episode also notes retro hardware, GOG’s big-box revival and an upcoming open mic night.

Let the Polishing Begin – This Week in Plasma

The KDE Blog translates Nate Graham’s “This Week in Plasma” report, which focuses on polishing Plasma 6.8 ahead of release. With only four open regressions, it lists UI tweaks for Wi-Fi and KWin Overview, Kup backup timing improvements and fixes across Plasma 6.6.7 through 6.9.

Tumbleweed – Review of the Week 2026/38

Dominique Leuenberger and Victorhck review six Tumbleweed snapshots (0910, 0911, 0912, 0914, 0915 and 0916), headlined by Plasma 6.7.5, Frameworks 6.30 and Gear 26.08.1 followed by security updates for glibc, cups and xz. The roundup also notes Mesa’s Rockchip and Teflon additions, OpenCV’s JPEG XL/AVIF support and kernel 7.2.5.

Krita 5.3.4 and Krita 6.0.4 Released

The KDE Blog notes the simultaneous releases of Krita 5.3.4 and 6.0.4, bringing bug fixes across the digital painting suite and video export on Android. The update also drops the unmaintained GIMP XCF import plugin for security reasons.

Building Flatpaks Locally

Jakub Steiner explains building Flatpaks locally with flatpak-builder distributed as a Flathub Flatpak_org.flatpak.Builder. He walks through installing the builder and building the GNOME icon tool Shaper with flatpak-builder --user --install.

View more blogs or learn to publish your own on planet.opensuse.org.

Leap Heads Into Release Candidate Phase

admin@opensuse.org (Douglas DeMaio) — Thu, 24 Sep 2026 23:00:00 +0000

The openSUSE Release Team says openSUSE Leap 16.1 is close to its Release Candidate (RC) stage, with general availability planned for November.

Leap Release Manager Luboš Kocman told the openSUSE project mailing list that the next build was expected to qualify as the RC. He said it should reach openQA, which is openSUSE’s automated testing system soon.

Kocman said recent changes merged into SUSE Linux Enterprise Server (SLES) 16.1 had caused an additional delay.

The RC build is expect to arrive this week.

Testers can help by grabbing the latest image from get.opensuse.org/testing, picking a test from the Leap 16.1 manual test plan (high-priority and untried tests help most), and recording their result with their openSUSE username and build number; participants will receive an openSUSE Kudos badge as a thank-you.

The official roadmap had the RC build set for Sept. 16. The build is now running about a week behind that date.

The team plans to produce about one build per week during the RC phase to find and fix any remaining release blockers.

The release team says testing matters most at this stage. Users and contributors can help by:

Running their usual workflows on the RC builds and reporting critical issues to openSUSE Bugzilla.
Checking the non-blocking bug list for items assigned to them.

Saved bug queries and known issues are on the openSUSE Known Bugs 16.1 wiki page, and the full schedule is on the openSUSE Roadmap.

Leap 16.1 and SLES 16.1 will launch on the same day because of feedback from the Leap 16.0 release retrospective. Shipping together means Leap users won’t face a gap between the release and the first maintenance updates. Those updates arrive with the SLES 16.1 GA and flow directly to Leap.

What’s New: Notable Package Updates

Leap 16.1 brings a range of desktop, developer, and server updates compared with Leap 16.0:

Package	Leap 16.0	Leap 16.1
KDE Plasma	6.4.2	6.6.4
KDE Frameworks	6.16.0	6.25.0
Qt	6.9.1	6.11.0
GNOME Shell	48.4	48.8
LibreOffice	25.2.5	26.2.5
PipeWire	1.4.6	1.6.8
NetworkManager	1.52.0	1.54.3
GRUB	2.12	2.14
QEMU	10.0.13	11.0.3
Podman	5.4.2	5.8.2
LLVM	19	21
PHP	8.4.24	8.5.8
MariaDB	11.8.8	12.3.2
Samba	4.22.11	4.23.10
Git	2.51.0	2.53.0

KDE users get the biggest jump: two Plasma feature releases and nine Frameworks releases, built on a newer Qt 6.11. On the server and virtualization side, QEMU moves to a new major version, MariaDB jumps to the 12 series, and PHP moves to 8.5.

There are currently no known release blockers.

The original announcement and follow-up are in the openSUSE project mailing list thread.

Planet News Roundup

admin@opensuse.org (Douglas DeMaio) — Fri, 18 Sep 2026 08:00:00 +0000

This is a roundup of articles from the openSUSE community listed on planet.opensuse.org. This community blog feed aggregator lists the featured highlights below from Sept. 11 - 17.

This week highlights the release of Agama 24 with a two-for-one announcement covering versions 23 and 24, the beta release of Plasma 6.8 along with its first “This Week in Plasma” review, the first bug-fix update of KDE Gear 26.08 plus feature overviews of Kdenlive and Minuet, the Tumbleweed week 37 review and a September ARM update roundup, Intel’s OpenVINO 2026.4.0 release, the openSUSE Kudos report for August, the reveal of the GNOME 51 wallpapers, and a fond farewell to the Linux Hispano comic strip after 1,144 installments.

Here is a summary and links for each post:

Introducing Enhanced Distribution Support

The Open Build Service blog introduces Enhanced Distribution Support, a beta feature that gives structure to distribution information through a vendor → distribution → release hierarchy, letting maintainers record what they ship, which repositories and architectures each release is built from, and dated lifecycle milestones. It’s an early, purely descriptive first iteration, and the OBS team is asking distribution maintainers what else they need to be able to describe.

OpenVINO 2026.4.0: A New Version Announced

Alessandro’s blog reports on Intel’s OpenVINO 2026.4.0 release, which broadens model support across Intel CPUs, GPUs and NPUs while adding speculative decoding with Multi-Token Prediction. The post also covers EAGLE-3 Tree Drafting, ITT tracing extended to the NPU for VTune, an ASR pipeline for Node.js and idle-model management in the OpenVINO Model Server.

Tumbleweed ARM Updates in September

The openSUSE News blog covers September’s Tumbleweed updates for the ARM port, led by a security-heavy kernel 7.2.5, glibc 2.44 with its large AArch64 push and QEMU 11.1.1. Raspberry Pi owners get a firmware fix that clears up a Wi-Fi scan error, Rockchip and other SBCs receive MediaTek Wi-Fi kernel fixes, and GIMP 3.2.6, shotwell 33.0 and kbd 2.10.0 land AArch64-specific improvements.

GNOME 51 Wallpapers

Jakub Steiner reveals the GNOME 51 wallpaper set, calling the collection evolution rather than revolution as it sticks to its geometric roots. The default is a stylistic touch-up of the GNOME 50 hexagons, images now carry an embedded thumbnail that helps the Appearance panel, and attribution and license data are embedded directly into the files.

Download a Random Linux Hispano Comic Strip in the Terminal

Victorhck shares a pair of scripts for revisiting the 1,144 Linux Hispano comic strips that Danigm published between 2004 and 2026 after the series came to an end. A Python scraper archived every strip into a GitHub repository, while a Bash script picks a random strip and displays it with feh along with its name and publication date.

Syslog-ng repo for Amazon Linux 2023 updated to syslog-ng version 4.12

Peter Czanik reports that his syslog-ng repository for Amazon Linux 2023 has been updated to version 4.12 after a GitHub request finally prompted an update. He recounts how the repo, first created two years ago, sat untouched due to a lack of feedback despite healthy download numbers from Copr, with Java support and slog disabled as in his other repositories.

Kudos August 2026

The openSUSE News blog presents the monthly Kudos report, in which 17 users received 24 kudos and 419 badges were awarded to 251 contributors during August. Bernhard Wiedemann tops the list with five kudos, mostly for his work on Slowroll, and four contributors reached the milestone of 100 Tumbleweed Contributions.

What’s New in Minuet from KDE Gear 26.08, “Enjoy Shiny Stuff” Edition

The KDE Blog closes its KDE Gear 26.08 feature series with Minuet, the music education app that trains the ear through interval, chord, scale and rhythm exercises. Minuet debuts a new interface that works on both desktops and phones, with a reworked home page and navigation sidebar, exercises shown as cards and a search field that filters by translated names and descriptions.

Software Freedom Day 2026

The KDE Blog announces the Dia de la Llibertat del Programari (Software Freedom Day) celebration organized by Caliu on September 19 at the Espai Jove La Fontana in Barcelona, an event where the KDE community is usually well represented. The post translates the Catalan agenda, listing three talks on teaching computing with values, bootstrapping a self-managed forge with Haz-CLI and security on GNU/Linux.

Happy Programmer’s Day

Alessandro’s blog celebrates Programmer’s Day, which falls on the 256th day of the year and explains why the number 256, or 2^8, matters in computing. The post thanks developers for turning coffee into software, errors into lessons and ideas into innovation.

Innit

Jakub Steiner shares how he produced the tune “Innit” for his weeklybeats 2026 project on the Elektron Analog Four rather than his usual Dirtywave M8. After years of avoiding them, he finally learned the box’s performance macros, which bundle up to five track parameters onto a single knob and make live performance far less stressful than pre-programming a sequence.

Plasma 6.8 Beta Released – This Week in Plasma

The KDE Blog translates Nate Graham’s weekly Plasma development report covering the 6.8 beta. Kup joins Plasma as its backup system, clipboard and MIME-action settings become far clearer, the on-screen keyboard button now behaves as expected on lock and login screens, and KWin gains support for the Wayland commit_timing protocol.

Linux Saloon 219 | Butterbian and ButterKnife Distribution Exploration

Nathan Wolf posts episode 219 of the Linux Saloon podcast, covering activities around the Vintage Computer Fest Midwest. The episode gathers user experiences with the Butterknife and Butterbian distributions through polls and links out to upcoming events and participant projects.

First Update of KDE Gear 26.08

The KDE Blog presents the first update of KDE Gear 26.08, released almost a month after the feature set, bringing more stability, better translations and small improvements. It lists resolved issues across apps, libraries and widgets, including an arrow-orientation fix in KDE Connect, room-map handling in Kongress and an unexpected crash when saving documents in Okular.

Plasma 6.8 Beta Released

The KDE Blog reports that the beta of Plasma 6.8 has been released and highlights changes drawn from its changelog, from the new Hanabi wallpaper replacing Waterfall in Breeze and Nepali calendar support to GTK4 window decoration fixes, an AppStream Preview backend in Discover and a QML rewrite of DrKonqi’s coredump viewer. It encourages users to install the beta and report bugs to help polish the release.

Tumbleweed – Review of the Week 2026/37

Dominique Leuenberger and Victorhck review the four Tumbleweed snapshots (0904, 0907, 0908 and 0909) of week 2026/37, which delivered Linux kernel 7.2.3 and 7.2.4, LibreOffice 26.8.0.3, QEMU 11.1.1, zypper 1.14.101 and more.

Tiny Wins for Packagers: End-of-Week Update

The Open Build Service blog shares its end-of-week “Tiny Wins” update, which shipped a fix preventing a second click on the repository dropdown after an autocomplete selection and ensured the generated SBOM includes the SPDX V3 createdBy field. It also reports that build.opensuse.org served 22.8 million HTTP requests and produced 2.38 million package builds over the last seven days.

Agama: Releasing Version 24

The Agama blog announces Agama 24 in a two-for-one post covering versions 23 and 24 after a stabilization phase focused on testing and polish. Language, keyboard and time zone now share a single searchable form, network connections can be bound to devices through a sortable device table, and JSON search sections gained much more expressive device matching.

View more blogs or learn to publish your own on planet.opensuse.org.

Tumbleweed ARM Updates in September

admin@opensuse.org (Douglas DeMaio) — Wed, 16 Sep 2026 12:00:00 +0000

There were a few software package updates for openSUSE Tumbleweed ARM this month with snapshots reaching the ARM port.

September’s snapshots of the ARM port carried the Linux kernel to a security-heavy 7.2.5. There was a jump to glibc 2.44 with its large AArch64 push, and QEMU reaching 11.1.1. Raspberry Pi owners get a firmware fix that clears up a Wi-Fi scan error, the Networking Stack received security patches, and GIMP 3.2.6 brings AArch64-specific fixes.

Raspberry Pi

This month’s raspberrypi-firmware update prevents the spurious “-52” error message that could appear during Wi-Fi scans (bsc#1215134), so scanning for networks is quieter on boards where the firmware reported a phantom failure. The Linux kernel 7.2.4 update fixed a memory leak in the brcmfmac driver’s SDIO control path, which reduces memory pressure over long uptimes on the onboard Cypress Wi-Fi chip used across recent Pi models.

Rockchip & Other SBCs

Owners of Rockchip and other single-board computers get kernel fixes for the MediaTek Wi-Fi chipsets that many boards ship with, including headroom fixes for USB/SDIO transfers on mt7925 and EEPROM size validation on the mt7915 and mt7996 drivers, which protects against malformed device data (bsc#1012628). kernel-firmware-qcom adds DSP firmware for the Qualcomm x1e80100, nord and qcs8300 platforms, improving modem, DSP and graphics support. dracut now includes leds-qcom-lpg in the aarch64 DRM module set, keeping RGB indicator LEDs working when booting from an initrd. Finally, wireless-regdb enables 320 MHz channels for Hong Kong, updates South Africa’s rules, and drops the 60 GHz DFS flag for Togo.

i.MX & NXP

Developers working with NXP hardware gain the imx8mp-evk machine type in QEMU 11.1.1, which emulates the i.MX 8M Plus Evaluation Kit and makes it easier to test software for that platform without physical hardware. The kernel 7.2.3 update fixed the mxs-dcp crypto engine’s source scatterlist length access and improved the Data Co-Processor security block on i.MX System on Chips that use it for accelerated encryption. These changes make NXP hardware slightly more accessible to both emulation and crypto workloads.

aarch64 Virtualization, UEFI & Toolchain

QEMU 11.1.1 is the virtualization highlight of the month, advancing the emulator with Universal Flash Storage emulation for Write Booster and Host-Initiated Defragmentation based on the UFS 4.1 specification, plus vhost-host-user support for offloading real-time clock handling through virtio-rtc. The ARM targets gain new architectural CPU features, and the virt board can now specify cache topology. The ARM-specific fixes include a regression test and boundary-case fix for the SVE2 whilewr/whilerw instructions and a fix for arm_gicv3 kconfig selection, and openSUSE disables GCS linker validation in the spec to keep the aarch64 build working.

glibc 2.44 delivers the strongest AArch64 additions in months. On targets with the Guarded Control Stack extension, glibc now locks all GCS operations, including status, write-on-shadow-stack and push-to-shadow-stack, immediately after enabling GCS with an ENFORCED or OVERRIDE policy, closing a window where a process could still mutate its own shadow stack. Special-case paths for log, exp, sin, cas, sinh, cosh, asinh, acosh and atanh are vectorized for both SVE and AdvSIMD, and vector powr variants are added, which speeds up floating-point-heavy code on capable Cortex-X and Neoverse cores.

ovmf advances to edk2-stable202608, refreshing the UEFI firmware that backs the qemu-uefi-aarch64 subpackage. The update adds AArch64 host test coverage across SecurityPkg, CryptoPkg, PrmPkg, DynamicTablesPkg, MdeModulePkg and MdePkg, plus UnitTestFrameworkPkg support for GCC AArch64, which strengthens firmware quality assurance for arm64 virtual machines. The EFI Memory Attributes Protocol workaround is dropped because GRUB2 now supports the protocol, so booting stays compatible with the cleaner firmware behavior.

sdbootutil improved its systemd-boot handling with a new status command, parallel test execution, a --repair parameter for cleanup, and better reporting of entries with missing files. The update prevents duplicate entries on non-snapper systems, keeps the exit status of sdbootutil calls intact, and avoids writing the recovery PIN to the journal, which is a meaningful privacy improvement for systems using PCR-based secure boot.

GTK4 4.22.5 fixes a build failure on 32-bit ARM and repairs 32-bit Vulkan image builds, so the toolkit and gskvulkanimage both compile cleanly on armv7. A Wayland session crash in gdk_wayland_toplevel_remove_from_session() and a memory buffer fix round out the release for desktop users on ARM.

LLVM 23.1.1 arrives as a bugfix release for the 23.1.0 series, remaining API and ABI compatible while dropping the obsolete i586 build patch.

GIMP 3.2.6 carries the first AArch64-specific wins for the image editor. The clipboard brush and pattern maximum size is bumped to 8192 on AArch64 as well, matching the ceiling that x86-64 and PPC64 have had since the 3.2.0 release candidates, so larger brushes and patterns survive clipboard round-trips on ARM desktops.

shotwell 33.0 makes the jump from the 0.32 series with a full port to GTK4 (requiring at least 4.22), a reworked printing flow, and fixes for the fullscreen toolbar auto-hide and disappearing slideshow icons. The release replaces its dedicated authentication helper with a small localhost web server for publishing, adds a “peek password” toggle to the Piwigo flow and fixes setting desktop backgrounds.

kbd 2.10.0 extends the console stack with XKB support: loadkeys can now generate console keymaps from XKB data, import XKB compose tables and handle XKB group switching, modifier handling, virtual console switching and keypad/editing remaps.

Snapshots at a Glance

Snapshot	Kernel	Headline changes
2026-09-08	7.2.3	glibc 2.44 with AArch64 GCS and SVE/AdvSIMD math, QEMU 11.1.1 with imx8mp-evk, Raspberry Pi firmware Wi-Fi scan fix
2026-09-12	7.2.4	edk2-stable202608 with AArch64 host tests, dracut aarch64 LED module, GTK4 32-bit ARM build fix, LLVM 23.1.1
2026-09-14	7.2.5	kernel security batch (Tegra241 CMDQV, iommufd, nvmet, Bluetooth RFCOMM, PCI, rndis_host), GIMP 3.2.6 with AArch64 fixes, shotwell 33.0, kbd 2.10.0

ARM Resources

For ARM-specific discussions and support, subscribe to the openSUSE ARM mailing list and check the openSUSE ARM wiki for device support information, image downloads, and documentation. New and existing ARM users can also join the openSUSE ARM IRC channel for real-time help.