openSUSE News

Tumbleweed Monthly Update - August 2026

admin@opensuse.org (Douglas DeMaio) — Wed, 02 Sep 2026 08:00:00 +0000

There were several software package updates for openSUSE Tumbleweed during the month of August, which delivered 23 snapshots across 31 days.

August delivered a packed month of snapshots across the desktop, developer tooling, and security surface. KDE Plasma 6.7.4 landed with KWin GPU management fixes and a workaround for libepoxy issues when a GPU reset happens. KDE Frameworks 6.29.0 and KDE Gear 26.08.0 also arrived in the month. GNOME Shell 50.4 and mutter 50.4 arrived with HiDPI cursor fixes and HDR output improvements. Mesa settled into its 26.2 series, and the Linux kernel progressed from 7.1.5 to 7.2.0 with a long tail of CVE fixes.

As always, be sure to roll back using snapper if any issues arise.

For more details on the change logs for the month, visit the openSUSE Factory mailing list.

New Features and Enhancements

KDE Plasma 6.7.4: The fourth bugfix release of the Plasma 6.7 series brings targeted stability improvements across the desktop. KWin no longer removes GPUs that have no outputs, which prevents a regression where external monitors connected via docks could disappear. A workaround for libepoxy failing when a GPU resets helps stabilize gaming and GPU-accelerated workloads on systems with multiple graphics adapters. The digital clock applet now applies its font family to the time zone label, and dragging items on the taskbar onto grouped tasks no longer breaks when floating applets are enabled. Spectacle gained QR code scanning when editing existing screenshots, and KScreen added a keyboard shortcut to trigger the Configure button from the OSD.

KDE Frameworks 6.29.0: A new feature release of the KDE component libraries arrived with refinements across KIO, Kirigami and KRunner. Solid now returns the mount point as filePath() for the root filesystem through its udisks2 backend, bluez-qt resolves a race condition in Bluetooth object manager initialization, and KTextEditor gained a disabledPlugins property. A separate KWin patch improved behavior after unplugging outputs by increasing the Wayland global removal timer timeout.

KDE Gear 26.08.0: The August feature release of the KDE applications collection brought updates across Dolphin, Konsole, Kate, Okular, and the Akonadi personal information management stack. Konsole implements the Kitty keyboard protocol and gains direct Copy and Open actions for URLs shown as escape-sequence hotspots. Okular adds copy-and-paste support for annotations and no longer executes load-scripts on signed documents, while Kate fixes working-directory handling when invoking git and possible out-of-bounds reads.

Firefox 154.0: The browser’s monthly milestone rolled out with a heavy load of Common Vulnerabilities and Exposures (CVE) fixes addressing more than 40 issues. The release covers a sandbox escape in the Remote Settings client, same-origin policy bypasses in service workers and cookie handling, use-after-free issues across WebAssembly, image loading, and layout text handling, plus multiple privilege escalation and site isolation issues in the graphics stack. It also refreshed mozilla-nss to 3.126.1 and mozjs140 to 140.14.0. Tumbleweed users should update to stay protected.

GNOME Shell 50.4 & mutter 50.4: The GNOME desktop received quality-of-life fixes that clean up day-to-day use. Switching to a minimized window on another workspace no longer causes a visual glitch, and the magnified cursor is correctly scaled on HiDPI displays. A sound glitch caused by pushing redundant volume changes has been eliminated, and menu animations are smoother. On the compositor side, mutter fixes blurred rendering with non-pixel-aligned monitors, fills in mastering display metadata for HDR output, and corrects invalid redraw clips on rotated monitors. GNOME Control Center 50.4 arrived alongside with updated translations.

GStreamer 1.28.6: A wide-ranging update across the core and plugin packages with both security and playback fixes. The playbin3 and playbin elements fix stalls that occurred after re-enabling previously disabled subtitles, and the h265parser resolves out-of-bounds writes in RPS parsing. RTP retransmission bitrate estimation is improved, and the Rust (f)mp4 muxers gain H.266/VVC muxing support. webrtcsink fixes H.264 level and profile negotiation and adds support for nvv4l2h265enc.

OpenSSH 10.5p1: A security-focused release addressing an important vulnerability in agent forwarding. The ssh-agent interaction between locking and the session-bind@openssh.com extension was broken, meaning operations intended to be limited to local use only could be performed remotely when the agent was locked. The restrict keyword in authorized_keys now correctly applies to tunnel forwarding. A potential realloc use-after-free in the client when a remote forwarding is added via the multiplexing socket is fixed, and ssh-keygen gains the ability to set or clear touch-required and verify-required flags on FIDO private keys during passphrase reset.

harfbuzz 14.3.0 & 14.3.1: The text shaping engine that underpins rendering in browsers, desktop environments, and document editors received important improvements. Mark positioning now respects lookup order in the cross-direction, improving compatibility with DirectWrite and Core Text. Mark attachment to ligatures formed from decomposed glyphs is fixed, and the calt feature in Hangul text is now disabled only for the Jamos rather than the entire buffer. The release also adds support for partially instancing of the avar table and the CFF2 table, relevant for variable font workflows. A follow-up 14.3.1 release arrived later in the month with fuzzing and subsetting fixes, a fix for AAT insertion at the end of the text, and rendering fixes in the experimental GPU library.

QEMU 11.1.0: The machine emulator advanced from 11.0.3 with a substantial feature release. Highlights include Universal Flash Storage (UFS) emulation support for Write Booster and Host-Initiated Defragmentation based on the UFS 4.1 specification, and vhost-host-user support for offloading real-time clock handling from the hypervisor when using virtio-rtc. The GUI subsystem gained improvements to virtual console handling and GTK/VNC. ARM support expanded with the new imx8mp-evk machine type and virt board cache topology specification.

Key Package Updates

Linux kernel 7.1.5 through 7.2.2: The kernel progressed through four point releases and a feature release during August with a sustained focus on security and stability. Version 7.1.6 carried fixes for KVM x86 module reload use-after-free, arm64 TLBI errata mitigation, and a virtiofs use-after-free on submount umount. Version 7.1.7 added CVE fixes for batman-adv, ntfs3, and several networking and driver subsystems. Version 7.1.8 addressed an extensive list of CVEs including Bluetooth btusb use-after-free, ksmbd deferred file use-after-free, rtl8723bs out-of-bounds reads and writes, and RDMA fixes across irdma, erdma, and mana_ib. The Btrfs filesystem received fixes for free space cache validation and root leaks during relocation. The 7.2.0 version refreshed the kernel configuration and carried updated AMD Display Core patches. The month closed with the 7.2.2 release, which resovled CVE-2026-80590.

Mesa 26.1.6, 26.2.0 & 26.2.1: The graphics stack made a major jump from 26.1.5 to the 26.2 series during the month. The 26.1.6 bugfix release addressed regressions from the previous stable series, while the 26.2.0 release brought a new batch of driver improvements for AMD, Intel, and Qualcomm hardware. The 26.2.1 bugfix release soon followed, and the VirtIO Vulkan driver is now enabled in openSUSE’s build, bringing Vulkan support to virtualized environments. Users on AMD and Intel GPUs who experienced rendering issues after earlier Mesa updates should find these releases more stable. The Vulkan drivers continue to see corrections for gaming workloads.

python-cryptography 50.0.0: A major version bump that deprecates Diffie-Hellman key exchange over finite fields and adds the Cobblestone recipe for streaming authenticated encryption. The most important change is a security fix for Bleichenbacher oracle in PKCS7 decryption; pkcs7_decrypt_der no longer exposes distinguishable errors or timing when unwrapping a RecipientInfo’s encryptedKey. X.509 verification APIs are now considered stable, and ML-DSA public keys and signatures are permitted by default.

libssh2: Received two rounds of critical security patches during August. The first batch addressed a heap buffer overflow and the second batch fixed arbitrary code execution via double-free in SFTP sessions, denial of service via integer underflow in AES-GCM cipher negotiation, a heap out-of-bounds read, and heap buffer overflow during SSH negotiation. These are essential updates for any system using libssh2 for SSH or SFTP operations.

vim 9.2.0901: A massive update carrying over 100 fixes including eight security patches. Security fixes address arbitrary code execution via keyword lookup, code injection in netrw via bookmarks, heap overflow when adding more than 65,535 text properties, stack buffer overflow in the socket server, and a use-after-free on JSON decode error. The update also fixes numerous memory leaks, a deeply nested regexp pattern stack overflow, and a GTK4 hardware rendering performance regression.

unbound 1.26.0: The DNS resolver received a major update with a large list of fixes and new features. New options include max-transfer-size and max-transfer-time for limiting auth-zone and RPZ transfers, and new local-zone types block_aaaa, block_a_wdata, and block_aaaa_wdata. A heap out-of-bounds write via size_t-to-int truncation is fixed, along with DNSSEC validation fixes for noncanonical RSA DNSKEYs and a race condition causing segfaults when starting threads.

Qt 6 6.11.2: The second bugfix release of the 6.11 series landed across the full module range from qt6-base through qt6-webengine. The update fixes a regression in icon loading and carries multiple stability corrections for the toolkit that Plasma and most KDE applications build on. qt6-webengine also merges an upstream fix for AMD VA-API flickering on Wayland.

wpa_supplicant 2.12: The Wi-Fi authentication daemon adds more complete EHT/IEEE 802.11be/Wi-Fi 7 support including fixes for message validation issues that could enable denial-of-service attacks, and group key rekeying is corrected. SAE group 20 is now enabled by default when SAE-EXT-KEY is available, and IEEE 802.11bi functionality is supported including changing SAE password identifiers, EPPKE, and association frame encryption. RSN overriding (WPA3-Personal Compatibility Mode) is supported, and Automated Frequency Coordination (AFC) on the 6 GHz band is now available. The build enables CONFIG_IEEE80211BE, CONFIG_SAE_PK, CONFIG_PMKSA_PRIVACY, and CONFIG_IEEE8021X_AUTH by default.

postgresql18 18.6: A major security release for PostgreSQL 18 that fixes more than two dozen CVEs covering remote code execution and denial of service issues. Notable fixes include heap buffer overflows in regular expression matching, to_char formatting, and pg_stat_statements that could execute arbitrary code, a psql issue where early failures in COPY FROM STDIN process data lines as command input, and a logical decoding flaw that could dlopen an arbitrary file. Database administrators on Tumbleweed should plan an update soon.

flatpak 1.18.1: A security-focused bugfix release addressing several sandbox escape and privilege escalation paths in the application framework. Fixes include a sandbox escape with full host filesystem read/write access via a symlink attack on app data directories, a local root privilege escalation via revokefs symlink path traversal and commit tampering, and arbitrary root writes through path traversal in extra-data extraction and flatpak build-init. The release also corrects an anti-downgrade bypass that allowed unprivileged users to downgrade system applications.

Security Updates

libssh2:

CVE-2026-58050: Fixes a heap buffer overflow via attacker-controlled attribute count from a publickey-subsystem response.
CVE-2026-58051: Addresses uninitialized pointer being freed when a malformed response is sent by an SSH server.
CVE-2026-66032: Resolves arbitrary code execution via double-free in SFTP session.
CVE-2026-66033: Fixes denial of service via integer underflow in AES-GCM cipher negotiation.
CVE-2026-66034: Addresses heap out-of-bounds read leading to information disclosure and potential arbitrary code execution.
CVE-2026-66035: Fixes heap buffer overflow during SSH negotiation.

Samba 4.24.5:

CVE-2026-6949: Fixes TSIG packet with crafted name compression crashing the internal DNS server.
CVE-2026-58224: Addresses CTDB heap out-of-bounds read via unchecked packet length fields.
CVE-2026-58216: Resolves 6-byte heap out-of-bounds read in kpasswd service packet parser.
CVE-2026-58218: Fixes DNS TKEY negotiation storing unauthenticated GSS contexts in a fixed FIFO before authentication completes.
CVE-2026-58221: Addresses authenticated LDAP access to internal LDB special DNs permitting domain takeover.
CVE-2026-58222: Resolves LDAP Compare filter injection and trusted-request confusion disclosing protected attributes.

vim 9.2.0901:

CVE-2026-8339: Fixes arbitrary code execution via keyword lookup.
CVE-2026-8340: Addresses code injection in netrw via bookmarks.
CVE-2026-8341: Resolves heap overflow when adding more than 65,535 text properties.
CVE-2026-8342: Fixes stack buffer overflow in the socket server.
CVE-2026-8343: Addresses popup opacity mask indexed out of bounds.
CVE-2026-8344: Resolves use-after-free on JSON decode error.
CVE-2026-8345: Fixes arbitrary Ex command execution during C omni-completion.
CVE-2026-8346: Addresses heap buffer overflow in set_sofo().

Linux kernel 7.1.6, 7.1.7 & 7.1.8:

CVE-2026-64490: Fixes ALSA virtio control metadata validation.
CVE-2026-64489: Addresses ALSA ymfpci snd_ctl_new1 return value check.
CVE-2026-64486: Resolves ALSA cmipci snd_ctl_new1 return value check.
CVE-2026-64481: Fixes ALSA hda-cs35l41 firmware load work teardown.
CVE-2026-64480: Addresses ALSA ice1712 snd_ctl_new1 return value check.
CVE-2026-64477: Resolves x86 fs/resctrl out-of-bounds access.
CVE-2026-64476: Fixes VFIO PCI disable_idle_d3 per-device latch.
CVE-2026-64475: Addresses VFIO PCI VGA arbiter client release on registration.
CVE-2026-64474: Resolves VFIO infinite loop in vfio_mig_get_next.
CVE-2026-64471: Fixes Bluetooth btusb use-after-free on registration.
CVE-2026-64466: Addresses Rust binder freeze listener cleanup on node removal.
CVE-2026-64437: Resolves ksmbd use-after-free of a deferred file location.
CVE-2026-64436: Fixes net af_key uninitialized alg_key_len for IPComp.
CVE-2026-64433: Addresses Bluetooth MGMT use-after-free of hci_conn_params.
CVE-2026-64432: Resolves ntfs3 Dirty Page Table capacity validation.
CVE-2026-64431: Fixes ntfs avoid calling post_write_mst_fixup for invalid ranges.
CVE-2026-64430: Addresses NTB EPF avoid calling pci_irq_vector from hardirq.
CVE-2026-64424: Resolves netpoll use-after-free on shutdown path.
CVE-2026-64449: Fixes staging vme_user bound slave read/write to the buffer size.
CVE-2026-64445: Addresses staging rtl8723bs WEP length underflow and buffer overflow.
CVE-2026-64444: Resolves staging rtl8723bs out-of-bounds read in OnAssocRsp IE.
CVE-2026-64441: Fixes staging rtl8723bs out-of-bounds reads in rtw_get_sec functions.
CVE-2026-64440: Addresses staging rtl8723bs out-of-bounds write in HT_caps_hand.
CVE-2026-64599: Resolves crypto amlogic double cleanup in meson_cr.

Firefox 154.0:

CVE-2026-75874: Fixes a sandbox escape in the Remote Settings client component.
CVE-2026-74934: Addresses a site isolation issue in the Graphics CanvasWebGL component.
CVE-2026-74936: Resolves a use-after-free in the JavaScript WebAssembly component.
CVE-2026-74937: Fixes a use-after-free in the JavaScript GC component.
CVE-2026-74939: Addresses a privilege escalation in the DOM Navigation component.
CVE-2026-74943: Resolves a use-after-free in the Graphics ImageLib component.
CVE-2026-74944: Fixes a use-after-free in the DOM Core & HTML component. https://github.com/KDE/kscreen
CVE-2026-74953: Addresses a privilege escalation in the Networking Cookies component.
CVE-2026-74956: Resolves a same-origin policy bypass in the DOM Service Workers component.
CVE-2026-74969: Fixes a use-after-free in the Layout Text and Fonts component.
CVE-2026-74976: Addresses a JIT miscompilation in the JavaScript Engine JIT component.

WebKitGTK 2.52.6:

CVE-2026-43804: Fixes a security vulnerability in the WebKit rendering engine.
CVE-2026-64713: Addresses a memory corruption issue in the WebKit rendering engine.
CVE-2026-64719: Resolves a security vulnerability in the WebKit rendering engine.
CVE-2026-64728: Fixes a memory safety issue in the WebKit rendering engine.
CVE-2026-64730: Addresses a security vulnerability in the JavaScriptCore engine.
CVE-2026-64757: Resolves a memory corruption issue in the WebKit rendering engine.
CVE-2026-64783: Fixes a security vulnerability in the WebKit rendering engine.

postgresql18 18.6:

CVE-2026-6464: Fixes psql processing data lines as command input after an early failure in COPY FROM STDIN.
CVE-2026-6471: Addresses logical decoding being able to dlopen an arbitrary file.
CVE-2026-14662: Resolves undersize allocations for tsvector and tsquery via integer wraparound.
CVE-2026-14664: Fixes a regexp heap buffer overflow that executes arbitrary code.
CVE-2026-14669: Addresses a to_char heap buffer overflow that executes arbitrary code.
CVE-2026-14676: Resolves a pg_stat_statements heap buffer overflow that executes arbitrary code.
CVE-2026-14679: Fixes a stack buffer overflow in argument match that writes to server memory.
CVE-2026-15741: Addresses SQL injection via an EXTRACT argument during expression deparse.
CVE-2026-18408: Resolves psql \unrestrict letting a superuser execute arbitrary code in the psql client.
CVE-2026-19385: Fixes a pg_dump heap buffer overflow that executes arbitrary code.

expat 2.8.2:

CVE-2026-50219: Fixes memory corruption affecting Expat bindings by disallowing reentrant calls to functions such as XML_GetBuffer, XML_Parse, and XML_ParserFree.
CVE-2026-56131: Addresses XML_ResumeParser being called from a handler, plugging a hole in the CVE-2026-50219 fix.
CVE-2026-56132: Resolves an out-of-bounds scaffolding index store in doProlog.
CVE-2026-56403: Fixes an integer overflow in storeAtts.
CVE-2026-56404: Addresses an integer overflow in addBinding.
CVE-2026-56405: Resolves an integer overflow in getAttributeId.
CVE-2026-56406: Fixes an integer overflow in XML_ParseBuffer.
CVE-2026-56407: Addresses an integer overflow in textLen handling.
CVE-2026-56408: Resolves an integer overflow in copyString.
CVE-2026-56409: Fixes an integer overflow in the xmlwf output path join.
CVE-2026-56410: Addresses an integer overflow in the xmlwf resolveSystemId.
CVE-2026-56411: Resolves an integer overflow in notation list allocation.
CVE-2026-56412: Fixes XML_TOK_DATA_CHARS handler calls in doCdataSection, plugging a hole in the CVE-2026-50219 fix.

c-ares 1.34.8:

CVE-2026-33630: Fixes a use-after-free and double-free in query-completion handling remotely triggerable via ares_getaddrinfo() over TCP.
CVE-2026-69184: Addresses a CPU-exhaustion denial of service via unbounded DNS name compression pointer chains.
CVE-2026-69186: Resolves a memory-amplification denial of service via unvalidated DNS header record counts.

busybox:

CVE-2026-38755: Fixes stack exhaustion in the ash applet caused by unbounded shell function recursion.
CVE-2026-38754: Addresses an out-of-bounds read in ifsbreakup().
CVE-2026-38753: Resolves a use-after-free in the awk applet regexp processing code during text replacement operations.
CVE-2026-38752: Fixes stack exhaustion in the awk applet caused by unbounded function call recursion.
CVE-2023-42366: Addresses a heap buffer overflow in the awk applet when a regexp ends with a backslash.

OpenEXR 3.4.14:

CVE-2026-68513: Fixes a PyOpenEXR prefixed literal RGB key collision heap buffer overflow.
CVE-2026-68514: Addresses a PyOpenEXR deep prefixed literal RGB key collision heap buffer overflow.
CVE-2026-59183: Resolves a signed integer overflow leading to out-of-bounds memory access in deep tile decoding.
CVE-2026-59186: Fixes an ILP32 TiledRgbaInputFile large tile Array2D heap out-of-bounds write.
CVE-2026-59187: Addresses an exrmetrics deep pixelmode heap buffer overflow.
CVE-2026-59981: Resolves an OpenEXRUtil SampleCountChannel row nonzero dataWindow heap out-of-bounds read.
CVE-2026-59985: Fixes an ILP32 OpenEXRCore RLE decode heap out-of-bounds read denial of service.
CVE-2026-61555: Addresses a crash on empty multiView viewFromChannelName files.
CVE-2026-62986: Resolves a PyOpenEXR deep prefixed RGB stale lane disclosure.

python313:

CVE-2026-0864: Fixes mixed line ending handling in configparser by normalizing all line endings.
CVE-2026-11972: Addresses tarfile._Stream.seek not breaking at end of file.
CVE-2026-4360: Resolves a missing filter_function pass-through to TarFile._extract_one() during .extract().
CVE-2026-15308: Fixes quadratic complexity in incremental HTMLParser parsing enabling CPU exhaustion.

gzip:

CVE-2026-41992: Fixes global buffer overflow in the LZH decompression logic.

libXfont2:

CVE-2026-59679: Fixes fs_read_glyphs() heap out-of-bounds read/write via encoding array index mismatch.
CVE-2026-44950: Addresses fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow.

glib2 2.88.3:

CVE-2026-15588: Fixes GDBusServer pre-authentication denial of service via unbounded SASL line buffering.

dracut:

CVE-2026-15816: Addresses root code execution via unescaped error message written to sourced emergency hook script in die().

python-cryptography 50.0.0:

CVE-2026-69247: Fixes Bleichenbacher oracle in PKCS7 decryption where distinguishable errors or timing could leak information when unwrapping a RecipientInfo’s encryptedKey.

libostree 2026.3:

CVE-2026-58055: Fixes unbounded LZMA decompression in static delta processing allowing denial of service.
CVE-2026-58056: Addresses heap buffer overflow via integer truncation in static delta bspatch on 32-bit systems.

gdm 50.2:

CVE-2026-58058: Fixes path traversal vulnerability where a compromised greeter could load arbitrary .desktop files via SelectSession.
CVE-2026-58059: Addresses autologin bypass where a compromised greeter could request autologin for any local account.
CVE-2026-58060: Resolves denial of service where an invalid session name from the greeter would cause the entire daemon to exit.

udisks2 2.11.2:

CVE-2026-7867: Fixes an unprivileged D-Bus caller using the as-user Filesystem.Mount() option combined with fstab entries containing user or users mount options to mount on behalf of another user without polkit authorization.

php8 8.5.9:

CVE-2026-17543: Fixes SQL injection via E'...' backslash breakout in PostgreSQL.
CVE-2026-17544: Addresses out-of-bounds write in bccomp().
CVE-2026-7260: Resolves crash via recursive symlinks in Phar.
CVE-2026-9672: Fixes a vulnerability in the GD library upgrade.

libssh2:

CVE-2026-58050: Fixes heap buffer overflow via attacker-controlled attribute count from a publickey-subsystem response.
CVE-2026-58051: Addresses uninitialized pointer freed when a malformed response is sent by an SSH server.

python-pip 26.2:

CVE-2026-13346: Fixes double decoding of the URL path while determining a link filename.

gimp:

CVE-2026-66757: Fixes a security vulnerability in GIMP image processing.
CVE-2026-66758: Addresses a security vulnerability in GIMP.
CVE-2026-66759: Resolves a security vulnerability in GIMP.
CVE-2026-59087: Fixes a security vulnerability in GIMP image processing.
CVE-2026-59088: Addresses a security vulnerability in GIMP.
CVE-2026-59090: Resolves a security vulnerability in GIMP.
CVE-2026-59091: Fixes a security vulnerability in GIMP.

libheif 1.23.1:

CVE-2026-62289: Fixes integer underflow in Fraction constructor via double clap transform application.
CVE-2026-62291: Addresses heap out-of-bounds write in uncompressed encoder when writing images with mismatched auxiliary alpha dimensions.
CVE-2026-62292: Resolves out-of-bounds read in uncompressed unci tile range slicing.
CVE-2026-62377: Fixes reachable assertion in HeifContext::get_track() aborting on a valid-but-empty HEIF sequence file.

nghttp2 1.70.0:

CVE-2026-58055: Fixes out-of-bounds read in the base64 decoder.

libgit2 1.9.7:

CVE-2026-5917: Fixes improper escaping of remote repository paths in libssh2.

bzip2:

CVE-2026-42250: Fixes an off-by-one error in the bzip2recover utility when processing a specially crafted file that can lead to a crash.

openssl-3 3.x:

CVE-2026-75803: Fixes AEAD forgeries with empty ciphertext when using EVP_Cipher().
CVE-2026-14456: Addresses unbounded memory growth in QUIC server incoming channel queue.
CVE-2026-14457: Resolves RPK server signature algorithm selection dereferencing a missing certificate.
CVE-2026-18798: Fixes QUIC server triggering a double free when processing an INITIAL packet.
CVE-2026-34181: Addresses PKCS#12 files with PBMAC1 being accepted with short HMAC keys.
CVE-2026-54874: Resolves excessive memory use buffering DTLS records for a future epoch.
CVE-2026-63072: Fixes a heap buffer overflow in CMS key unwrapping.
CVE-2026-63073: Addresses untrusted sender DN used as format string in CMP response validation.
CVE-2026-63074: Resolves CMP indefinite cache growth of ExtraCerts.
CVE-2026-63075: Fixes QUIC ACK-only packet retention causing memory exhaustion.
CVE-2026-63076: Addresses invalid pointer dereference in CMP server via crafted protectionAlg.

java-25-openjdk 25.0.4.1:

CVE-2026-60589: Fixes resource resolving vulnerability.
CVE-2026-61308: Addresses HTTP connection enhancement security issue.
CVE-2026-70907: Resolves TLS server security vulnerability.
CVE-2026-70906: Fixes font loading security vulnerability.

cpio:

CVE-2026-66484: Fixes path traversal allowing creation of hard links outside the intended directory via malicious tar archives.
CVE-2026-66485: Addresses denial of service via uncontrolled memory allocation from crafted archives.
CVE-2026-66486: Resolves terminal control sequence injection via crafted archive member names.

libvirt:

CVE-2026-77159: Fixes QEMU TPM following symlinks when chown’ing log files.
CVE-2026-18917: Addresses integer overflow in RPC handler for virNodeGetFreePages.

multipath-tools:

GHSA-hmcm-9cq4-r2xm: Fixes denial of service on multipathd socket by blocking IPC send operations.
GHSA-pvp6-c9p3-25fp: Addresses denial of service on multipathd socket by exhausting connections.
GHSA-g5mh-253r-jjw5: Resolves heap out-of-bounds read in custom format string parser via trailing %.
GHSA-pxwh-g75c-95pc: Fixes heap out-of-bounds read in device-mapper-multipath ALUA RTPG parsing.
GHSA-p6rh-9x9j-3hvx: Addresses kpartx heap out-of-bounds read in GPT header validation.
GHSA-gr7q-prfc-q636: Resolves path traversal in device-mapper-multipath failed_wwids management.
GHSA-hj7j-qr9h-5fv6: Fixes libmpathpersist PRIN READ FULL STATUS parser unbounded descriptor rewrite causing root heap overflow.

Users are advised to update to the latest versions to mitigate these vulnerabilities.

Conclusion

August was a busy month for openSUSE Tumbleweed with 23 snapshots delivering a steady cadence of desktop, developer, and security improvements. KDE Plasma 6.7.4 delivered targeted desktop fixes while KDE Gear 26.08.0 and KDE Frameworks 6.29.0 advanced the KDE application and library stacks, and GNOME Shell 50.4 polished the GNOME desktop. Mesa settled into its 26.2 series, the Linux kernel progressed through point releases to 7.2.0 with extensive CVE coverage, Firefox 154.0 shipped more than 40 security fixes, and GStreamer 1.28.6 brought playback and security fixes across the multimedia stack. Developer tools saw significant updates: Emacs jumped to 31.1, QEMU advanced to 11.1.0 with UFS emulation and RISC-V extensions, GCC reached 16.2, Qt 6 advanced to 6.11.2, OpenSSH 10.5p1 fixed critical agent forwarding issues, and vim addressed eight security vulnerabilities. FreeRDP 3.31.0 patched more than 20 CVEs while improving YUV decoding performance, wpa_supplicant 2.12 brought Wi-Fi 7 support, and chrony 4.9 added NTP-over-PTP and new stratum-bounding directives. Security remained a dominant theme, with critical patches in libssh2, Samba, postgresql18, openssl, expat, webkitgtk, openexr, flatpak, python-cryptography, openvpn, gdm, udisks2, multipath-tools, and php8.

Slowroll Arrivals

Please note that these updates also apply to Slowroll and arrive between an average of 5 to 10 days after being released in Tumbleweed snapshot. This monthly approach has been consistent for many months, ensuring stability and timely enhancements for users. Updated packages for Slowroll are regularly published in emails on openSUSE Factory mailing list.

Contributing to openSUSE Tumbleweed

Stay updated with the latest snapshots by subscribing to the openSUSE Factory mailing list. For those Tumbleweed users who want to contribute or want to engage with detailed technological discussions, subscribe to the openSUSE Factory mailing list . The openSUSE team encourages users to continue participating through bug reports, feature suggestions and discussions.

Your contributions and feedback make openSUSE Tumbleweed better with every update. Whether reporting bugs, suggesting features, or participating in community discussions, your involvement is highly valued.

Mobile Linux Hackday #8: Record Turnout in SUSE's New Prague Office

admin@opensuse.org (Lubos Kocman) — Tue, 01 Sep 2026 10:00:00 +0000

On Friday, August 28th, the SUSE Prague office hosted Mobile Linux Hackday #8. This event marked two major milestones: we hit a new record attendance for Prague, and attendees got their first hands-on experience in our freshly renovated Karlín space.

If you missed the event, here is a recap of the community highlights, kernel hacking sessions, and key takeaways from the day.

Renovated Prague Office: Great Coffee and Full Capacity

Returning attendees and newcomers were welcomed into our newly reconstructed Karlín office. The expanded social hub in the kitchen was an immediate favorite, providing comfortable sofas for breaks and technical discussions.

The highlight for many was the upgraded coffee station. Attendees put the manual lever espresso machine and external grinder through its paces, while a fully automatic machine served as a reliable backup.

Community Growth and Room Merging

With a peak crowd of 20 to 25 attendees, we set a new record for a Prague Mobile Linux Hackday and put our workspace flexibility to the test. The numbers were strong, especially when compared with earlier community gatherings such as the first Pilsen Mobile Hackday or the combined Budweis and SUSE Labs events, which had historically drawn larger crowds and set the benchmark for what a really “prime” event could look like. This turnout is a clear sign that our outreach and event marketing are gaining traction, and it is encouraging to see the community respond so strongly.

We originally booked the Mint meeting room, but as more people arrived, we pulled open the sliding partition panel and took over the adjoining Avocado room as well. Even after expanding into a double-sized room, we still had to borrow almost every chair from the surrounding area to seat everyone. Moving forward, we will definitely make sure we have plenty of extra seating ready for future gatherings.

Flexible Formats and the Kitchen Talk Dilemma

Unlike previous editions with rigid agendas, this Hackday was a bit more freestyle. Attendees naturally split into smaller working groups, alongside a remote session with David, who joined us from Switzerland and kindly made time for a deeper discussion on a more established topic.

This casual approach sparked fantastic side discussions, but it also highlighted a fun new challenge: the renovated kitchen space was so inviting that some attendees spent most of the day there, drifting into long hallway-track conversations. A big kudos to the facilities team for creating such a comfortable, social space that people simply did not want to leave!

While informal networking is a core part of community building, balancing casual chatter with structured technical sessions is something we plan to fine-tune for future events. We are actively looking into light-touch scheduling methods to help guide attendees smoothly between casual kitchen banter and hands-on coding.

Outreach Insights: Where the Czech Linux Community Gathers

During the event, we surveyed attendees on how they discovered the event to help refine our future community outreach.

Root.cz: The primary source for most attendees.
AbcLinuxu.cz: Brought in several key community members.
Word of Mouth: Direct recommendations from friends and colleagues played a major role in bringing in fresh faces.
LinuxExpres.cz: This was the first time we included it in our promotion mix. It did not produce a noticeable spike in attendance, but it was still a useful extra step in widening our reach beyond the usual community channels.
Mastodon: The main communication channel for the community, and many attendees learned about the event through the Mobile Linux CZ/SK Mastodon account.

Every newcomer made sure to leave with plenty of openSUSE swag to mark their first event.

Technical Highlights: AI Tools, BengalOS, and Snapdragon Hacking

Led by Petr Hodina, Mesa 3D GPU driver developer and community maintainer, the technical tracks covered several cutting-edge topics across mobile ecosystem development.

Key Topics Covered:

LLMs and Developer AI: Practical applications of Large Language Models to streamline daily developer workflows.
BengalOS Architecture: An overview of BengalOS, including instructions on how to build and test the OS on hardware.
Qualcomm Snapdragon 845 Kernel Hacking: Hands-on kernel debugging and testing focused on sdm845-based devices, including the OnePlus 6/6T, Xiaomi Poco F1, and Shift 6MQ.

Join the Next Mobile Linux Hackday

A huge thank you to Petr Hodina for driving the sessions, keeping the momentum high, and running an outstanding workshop. As a small token of our appreciation for his dedication to the community, Petr was awarded a giant plush openSUSE chameleon!

Photos from the event, along with broader shots of the refreshed SUSE Prague office, are available in our shared Google Photos album.

To stay updated on upcoming hackdays, follow the Mobile Linux CZ/SK community on Mastodon, or keep an eye out on local tech portals like Root.cz. See you at Hackday #9!

openSUSE Expands AI Support with Intel NPU Driver 1.35.0 and OpenVINO 2026.3.1

admin@opensuse.org (Alessandro de Oliveira Faria) — Mon, 31 Aug 2026 00:42:00 +0000

Work carried out under the openSUSE Innovator initiative brings the next generation of Intel’s Artificial Intelligence stack to Tumbleweed, Leap 16.0, and Leap 16.1, while also resulting in an upstream contribution to the Intel NPU driver.

As an Intel Innovator and a member of the openSUSE Innovator initiative, I remain committed to bringing the openSUSE ecosystem closer to the latest technologies in Artificial Intelligence and heterogeneous computing.

In this latest work cycle, Intel Linux NPU Driver 1.35.0 has been made available for openSUSE Tumbleweed, openSUSE Leap 16.0, and openSUSE Leap 16.1. This gives users of these versions access to the infrastructure needed to utilize the NPU found in the new generations of Intel® Core™ Ultra processors.

However, this time, the work didn’t stop at packaging. While testing the Intel NPU 1.35.0 driver on openSUSE, I identified an issue that prevented the NPU from initializing correctly in certain Linux environments. The problem occurred within the ResourceCleaner—an internal thread of the NPU’s Level Zero driver—causing the process to terminate with a SIGABRT during startup.

Consequently, as an openSUSE member, I submitted a fix directly to the official intel/linux-npu-driver project via Pull Request #142 as an upstream contribution to Intel’s driver. This demonstrates something I consider essential in the open-source ecosystem: it is not just about using a technology or creating a package for a distribution, but also about investigating issues, identifying their root causes, and contributing the solution back to the original project so the entire community can benefit. ## OpenVINO 2026.3.1 Comes to openSUSE

Alongside work on the NPU driver, I also updated OpenVINO to version 2026.3.1, making packages available for openSUSE Tumbleweed, Leap 16.0, and Leap 16.1. OpenVINO is a cornerstone of Intel’s Artificial Intelligence strategy. It enables the development and execution of inference applications using various computing resources available on the machine, including CPU, GPU, and NPU.

For openSUSE, this means providing developers with a modern stack for building applications involving LLMs, multimodal models, computer vision, speech recognition, embeddings, quantized models, and local generative AI.

For more information, go to linux-npu-driver or openvino!

Planet News Roundup

admin@opensuse.org (Douglas DeMaio) — Fri, 28 Aug 2026 07:00:00 +0000

This is a roundup of articles from the openSUSE community listed on planet.opensuse.org. This community blog feed aggregator lists the featured highlights below from August 21 to 27.

This week highlights the SUSE security review that uncovered remote root exploits in OpenRGB, the release of LibreOffice 26.8, KDE’s continued work on the Wayland remote desktop and KDE Gear improvements, Matthias Klumpp’s Sovereign Tech Fellowship plans for Freedesktop, AppStream and PackageKit, and six Tumbleweed snapshots delivering KDE Frameworks 6.29.0.

Here is a summary and links for each post:

Script to monitor the power of the WIFI signal in the terminal

Victorhck writes a blog about trying what what he read in another blog from Tecno Y Soft. It goes over a Bash script monitoring real-time Wi-Fi signal strength in the Linux terminal, displaying a color-coded bar, SSID, and transfer rates. It improves upon basic aliases by auto-detecting network interfaces and root requirements for easy, universal execution.

Syslog-ng end of August news, and about scaling back Java support

Peter Czanik reports on the project’s news after the summer break and explains the decision to scale back Java support. With native C drivers now covering Elasticsearch and Kafka and HDFS being dropped, the team disabled packaging of the Java destination in the Debian, Ubuntu and RHEL packages, reducing both RAM and hard drive usage. The post also reviews the pull requests and new issues the team is working through.

LibreOffice 26.8 Released, Now with Professional Typography

The KDE Blog announces LibreOffice 26.8, released by The Document Foundation on August 26 and built by 206 contributors. The new version brings improved support for the world’s writing systems, the Paragraph Composer, native OpenType font variations and broader OOXML chart compatibility - all without any generative AI features, telemetry or account requirements.

Podcast Linux #35: Free Formats

The KDE Blog continues to keep the memory of the paused Podcast Linux project alive by gradually indexing its episodes. Episode 35, “Free Formats”, features Juan Febles explaining why file formats, containers and codecs should be free and internationally standardized, alongside an interview with Lorenzo Carbonell (Atareao) and coverage of Inkscape.

How KDE Improves the Remote Desktop in Wayland: Unattended Mode, Lower Latency and More Compatibility

The KDE Blog details a review of the remote desktop improvements heading to Plasma 6.8 under Wayland. The unattended mode now shows a login screen and then hides the host’s displays for privacy, while frame latency tracking, bidirectional clipboard support, RemoteFX Progressive and hardware-accelerated H.264 encoding, and the migration to libei round out the upgrade.

OpenRGB: Remote System Compromise via Custom Network Protocol

The SUSE Security blog publishes a security review that found high-severity flaws in OpenRGB’s custom network protocol, which runs as root and listens on port 6742. Three CVEs cover arbitrary file overwrite (CVE-2026-59682), remote and local root exploits via the UPDATEMODE and SAVE_PROFILE messages (CVE-2026-59683) and several denial-of-service vectors (CVE-2026-18794). Upstream’s 1.0rc3-hotfix release addresses the worst of the issues.

Sovereign Tech Fellowship for Freedesktop Tasks

Ximions Blog shares Matthias Klumpp’s plans for the second half of 2026 as a Sovereign Tech Fellow with significantly increased hours. He intends to tidy up the Freedesktop specifications and website, push AppStream close to its 1.2.0 release, and design PackageKit 2.0 with a modernized architecture and smoother offline updates.

The News of Okular in KDE Gear 26.08, the “Enjoy Shiny Stuff” Edition

The KDE Blog sums up the improvements in Okular from KDE Gear 26.08, “Enjoy Shiny Stuff”. Signing is now more secure and fluid, the two configuration dialogues are unified, triple-click selects an entire line, highlighted or underlined text is automatically added to an associated note, and annotations can be copied and pasted between documents.

Tellico 4.2.2 Released

The KDE Blog reports the release of Tellico 4.2.2, the KDE collection organizer. The update adds the default .tc extension when saving, an option to disable ISBN validation, improved ISBN formatting for all regions, better image caching in the icon view and drag-and-drop RIS import, while removing the defunct DVDFr data source.

UI and Performance Improvements - This Week in Plasma

The KDE Blog translates Nate Graham’s weekly report on the work shaping Plasma 6.8. Interface highlights include English keyword search in System Settings, disabling autostart entries without removing them, more responsive auto-hiding panels and improved lock screen authentication selection, alongside a long list of bug fixes across Plasma 6.6.7, 6.7.5 and 6.8.

Thunderbird 154.0 Released

Victorhck blogs about the release of Thunderbird 154.0. Highlights include an optional system tray mode that keeps the mail client running in the background when the last window is closed, plus a range of fixes for IMAP connections, calendars, CalDAV sync and RSS subscriptions.

Tumbleweed - Review of the Week 2026/34

Dominique Leuenberger and Victorhck review Tumbleweed’s week 2026/34 with its six snapshots. KDE Frameworks 6.29.0 shipped in snapshot 0817, libalternatives 2.0 and Go 1.27 landed on the core system side, and security updates patched Flatpak, Vim and Python 3.13. The upcoming integration of Qt 6.11.2, KDE Gear 26.08.0, Linux Kernel 7.2 and glibc 2.44 is also tracked.

Reverse Clock for Your Desktop with Girosur - Plasmoids for Plasma 6 (38)

The KDE Blog presents Girosur Clock, the 38th widget in its ongoing Plasma 6 plasmoid series. Created by teovisaires, the analog clock and its hands rotate counterclockwise - fitting for the southern hemisphere - as a playful and original addition to the desktop.

Tiny Wins for Packagers: End-of-Week Update (2026-08-21)

The Open Build Service team shares its end-of-week update with a welcome to new contributor Tanner Kvarfordt, whose first commit was merged. Shipments include the update to Rails 8.1, project authorization handling in Token::ServicePolicy and a new “nocontentchange” publish flag, while build.opensuse.org served 20.2 million HTTP requests and nearly two million package builds.

View more blogs or learn to publish your own on planet.opensuse.org.

Planet News Roundup

admin@opensuse.org (Douglas DeMaio) — Fri, 21 Aug 2026 08:00:00 +0000

This is a roundup of articles from the openSUSE community listed on planet.opensuse.org. This community blog feed aggregator lists the featured highlights below from August 14 to 20.

This week highlights KDE Gear 26.08, KDE Frameworks 6.29, openSUSE Asia Summit 2026 publishing its pre-schedule, a Google Summer of Code 2026 final report on modernizing openSUSE’s OBS status service and much more.

Here is a summary and links for each post:

Released KDE Gear 26.08, “Enjoy Shiny Stuff” Edition

The KDE Blog announces KDE Gear 26.08, the second major update of the KDE application suite this year, focusing on improving the small everyday tasks users perform. The release spans Okular, Dolphin, Konsole, Kdenlive, Minuet and more than a dozen other applications, with full changelogs available for those eager to explore every detail.

Reverse clock for your desk

The KDE Blog presents Girosur Clock, an analog clock plasmoid that rotates in the opposite direction to what Northern Hemisphere users are accustomed to. Created by teovisaires, this widget turns the clock face and its hands in reverse as a playful addition to the desktop, marking entry number 38 in the blog’s ongoing Plasma 6 plasmoid series.

Recycling an interview. Is it worth being a blogger?

Victorhck recycles a set of interview questions originally posed on Tecnoysoft and answers them from his own perspective as a long-time GNU/Linux blogger. He reflects on why maintaining a personal blog still matters in an era of short-form video and what keeps him publishing despite modest readership numbers.

Circular Alt-Tab Window Switch for Plasma 6

The KDE Blog introduces Circular Alt-Tab, a window switcher for Plasma 6 that arranges open windows in circular sectors around the cursor. Created by Lubdhak7414, it features live window thumbnails, multi-ring layouts for more than eight windows, middle-click close, and a “Desktop Peek” option that minimizes all applications for a quick look at the desktop.

Twenty-nine-year update of KDE Frameworks 6 and KConfig

The KDE Blog covers the 29th update to KDE Frameworks 6, the foundational library layer that supports the entire KDE ecosystem. This installment also dives into KConfig.

openSUSE Asia Summit 2026 Pre-Schedule Is Now Available

openSUSE News announces the preliminary schedule for the openSUSE.Asia Summit 2026, set for October 3–4 in Yogyakarta, Indonesia. The organizing committee received 114 proposals from 85 speakers, and attendees can now browse sessions and plan which talks and workshops to attend ahead of the conference.

Towards a true LTS support of the entire KDE ecosystem (again)

The KDE Blog reports on a new initiative to bring true long-term support to the entire KDE ecosystem, not just the Plasma desktop. A partnership between Kubuntu Focus and Techpaladin Software under the Bullet-Proof KDE Initiative will fund bug fixes and CI infrastructure for Plasma 6.6, KDE Frameworks 6.24, and KDE Gear 25.12, the versions shipped in Kubuntu 26.04.

Integration of NFC in Plasma Mobile

The KDE Blog details KDE developer Volker Krause’s investigation into the state of NFC technology in the Linux ecosystem and his plans to integrate it into Plasma Mobile. He examines shortcomings in current drivers, middleware and Qt NFC APIs, and presents an initial Plasma applet and session daemon for NFC management.

Linux Saloon 216 | Open Mic Night

CubicleNate hosts another community episode of Linux Saloon with an open mic format, featuring live discussions about Fedora user experiences, job openings at Epic Games focused on Linux security, and IBM’s new chip architecture advancements. The post also covers Dell surpassing HP in U.S. PC sales amid a shrinking market.

openSUSE Kudos Recognitions for July 2026

openSUSE News publishes a new monthly Kudos recognition report for July 2026. It spotlights four users who received kudos and three contributors who earned badges.

GSoC 2026 Final Report: Enhancing openSUSE Git Workflow

Mario’s Blog shares the final Google Summer of Code 2026 report about modernizing openSUSE’s obs-status-service under mentor Daniel García Moreno. The project replaced legacy SVG string concatenation with Go templates, added Gitea-native theming, introduced real-time polling for live badge updates, and contributed reputation label prototypes upstream to Gitea.

Two-way synchronization of clipboard in RDP – This week in Plasma

The KDE Blog translates Nate Graham’s weekly Plasma report, which highlights bidirectional clipboard sharing in remote desktop sessions via KRDP. Other notable changes include scroll speed sliders with numeric inputs in System Settings, Discover showing external application links, and numerous bug fixes across Plasma 6.6.7, 6.7.5 and 6.8.

Tumbleweed – Review of the week 2026/33

Victorhck and Dominique Leuenberger summarizes four Tumbleweed snapshots (0806, 0809, 0811, and 0812) that delivered KDE Plasma 6.7.4, GDM 50.2, Mesa 26.2.0, OpenSSH 10.5p1 and OpenVPN 2.7.5. Critical security patches included a root code execution fix in dracut and an RSA decryption fix in python-cryptography, while GCC 16.2.0 and Linux kernel 7.1.8 rounded out the updates.

How a rural region beat the tech giants

The KDE Blog promotes the third episode of the podcast “La era de las distros,” which tells the story of LinEx, the Linux distribution deployed by the regional government of Extremadura, Spain. The episode explores how a rural region challenged the dominance of proprietary software through a bold public technology initiative.

Tiny Wins for Packagers: End-of-Week Update (2026-08-14)

The Open Build Service team publishes its weekly roundup of fixed issues, small features and security updates. Highlights include lowering the threshold for the “Mark all” notifications button, restoring the Show more/less link on user profiles, and fixing osc copypac to error out when copying a package with an empty name.

View more blogs or learn to publish your own on planet.opensuse.org.

openSUSE Asia Summit Pre-Schedule Is Now Available

admin@opensuse.org (openSUSE Asia Summit Team) — Mon, 17 Aug 2026 08:00:00 +0000

openSUSE.Asia Summit 2026 Pre-Schedule Is Now Available

Hello Geeko!

After a long selection process, the openSUSE.Asia Summit 2026 Organizing Committee is pleased to announce that the Pre-Schedule is now available!

This year, we received 114 proposals from 85 speakers, making the selection process both exciting and challenging. We are grateful to everyone who shared their ideas and contributed to the program.

Curious about what will be presented at the summit? Explore the sessions and start planning which talks and workshops you would like to attend.

View the openSUSE.Asia Summit 2026 Schedule

Important Note

This is a preliminary schedule. Some changes to session times, rooms, speakers, or the overall program may still occur before the conference. We will share further updates as the schedule is finalized.

We look forward to welcoming the openSUSE and open source communities to Yogyakarta, Indonesia, on 3–4 October 2026.

See you at the summit!

openSUSE Kudos Recognitions for July 2026

admin@opensuse.org (openSUSE Kudos Team) — Sat, 15 Aug 2026 12:00:00 +0000

Welcome to our monthly report from the openSUSE Kudos recognition platform, where we take a moment to put a spotlight on the people who stepped up, helped others, and made this community a little brighter.

During 1-31 July 2026, 4 users received 4 kudos, and 4 badges were awarded to 3 contributors.

Badges

Got First Kudo: @bmwiedemann, @dgarcia, @voztuzun
First Kudos Given: @voztuzun

Congrats on your badges!

Kudos

@lkocman -> @bmwiedemann for Code & Engineering “Thank you for your quick help with Leap 16.0 respin torrents Bernhard! strong” (view recognition)

@lkocman -> @dgarcia for Code & Engineering “Many thanks for your work and creativity at fixing the beets CVE. Thanks to your extra steps we could avoid update of the problematic python-numpy. Community really appreciates your help Daniel!” (view recognition)

@lkocman -> @voztuzun for Code & Engineering “Many thanks for helping me out with the cecpes and python-requests-gssapi updates Volkan! Your quick help was very much appreciated!” (view recognition)

@voztuzun -> @lkocman for Code & Engineering “Thank you Lubos!!!! Please come to the next concert!” (view recognition)

Thank you to everyone who made this period so active and welcoming. The community is strongest when we notice each other’s work and celebrate it openly.

Generated by kudos-bot-news-o-o from https://kudos.opensuse.org/api/reports/monthly for the period 1-31 July 2026.

Planet News Roundup

admin@opensuse.org (Douglas DeMaio) — Fri, 14 Aug 2026 08:00:00 +0000

This is a roundup of articles from the openSUSE community listed on planet.opensuse.org. This community blog feed aggregator lists the featured highlights below from August 7 to 13.

This week highlights Tumbleweed’s five snapshots. Podman 6.0.0, which now defaults rootless networking to pasta and drops legacy components like slirp4netns and CNI, was a key change. On the KDE side, registration opened for Akademy-es 2026 in Madrid and KStars 3.8.4 arrived with what the project calls the world’s first AI-powered guiding assistant. The openSUSE.Asia Summit 2026 also announced a change of venue in Yogyakarta, and the Agama Installer showed how any distribution can restyle the installer without touching a line of its code.

Here is a summary and links for each post:

A Mix of New Features in Plasma 6.7

The KDE Blog closes out its Plasma 6.7 series with the traditional grab-bag of smaller changes that never got their own post. Highlights include duplicating network connections, syncing mouse and stylus pointers, setting a preferred calendar application, shortcuts for push-to-talk mic muting, and mixed skin-tone emoji selection.

Qwen3.8-2.4T-A95B: Raising the Stakes in Frontier AI

Alessandro examines Alibaba’s newly released open-weights model, which pairs 2.4 trillion total parameters with roughly 95 billion active per token thanks to a Mixture of Experts design. His conclusion is that the real contest is shifting from who builds the biggest model to who turns that capacity into efficient, private, genuinely useful systems.

Registration Opens for Akademy-es 2026 in Madrid

The KDE Blog announces that free but mandatory registration is now open for Akademy-es 2026, held Oct. 23–25 at Camping Arco Iris in Villaviciosa de Odón. Key deadlines include Sept. 5 for accommodation assistance requests, Sept. 30 for booking a spot at the campsite, and Oct. 20 for general registration. The Call for Papers is still open until Sept. 3.

Help Number Research Find Numbers With This Bash Script

Victorhck shares a Bash script he wrote to automate submissions to Number Research Inc., a site attempting to catalogue every positive integer. The script asks where to start, submits numbers sequentially, skips ahead by 100 when a number is already claimed, and saves your position and statistics when you stop it with Ctrl+C.

KStars 3.8.4 Arrives With an AI Guiding Assistant

The KDE Blog covers the latest release of KDE’s planetarium and astrophotography suite, which introduces what the project calls the world’s first AI-powered guiding. The release also adds an MCP server for connecting any large language model to KStars, though currently with a limited subset of functions.

H.264 Playback Works, but CPU Usage Is High

The Geeko Blog of the Japanese openSUSE user group explains why high-resolution, high-framerate H.264 video can pin a CPU at 100 percent on a default install. openSUSE ships OpenH264, but the official gstreamer and VLC packages are built with x264 and hardware-decoder paths for H.264 disabled to avoid patent-related IP risk.

Get Agama Dressed for Success

The Agama Installer blog explains how any distribution can restyle the whole installer without touching a line of Agama code. A single CSS file named after the product id, plus logos, is enough to apply your colors, typeface and other styles across light and dark schemes while keeping the accessibility floor intact.

Venue Update for openSUSE.Asia Summit 2026

openSUSE News announces that the summit moves to the Convention Hall at Universitas Islam Negeri Sunan Kalijaga in Yogyakarta, replacing the previously announced TILC venue at Universitas Gadjah Mada. The change was made for technical and logistical reasons, and the same hall hosted the very first openSUSE.Asia Summit in Indonesia back in 2016. Dates remain Oct. 3–4, 2026, and already-registered participants need to take no action.

How to Blur Your Wallpaper in Plasma

The KDE Blog walks through blurred wallpaper by 2N-r, a wallpaper plugin that blurs or dims the desktop background whenever an application is not fullscreen. Options cover blur radius, dimming color, transition time, and disabling the effect for slideshows, and installation is a matter of picking Active Blur from Get New Stuff in the wallpaper settings.

An Alternative Taskbar for Your Desktop, Punchi Dock – Plasmoids for Plasma 6 (37)

The KDE Blog reaches widget number 37 in its plasmoid series with Punchi Dock by punchipunchi, a native launcher and task dock for Plasma 6 aimed primarily at Wayland. It works either as a floating dock or integrated into a Plasma panel, and offers window cards, live thumbnails, configurable folders, MPRIS media cards, and an optional PipeWire audio visualizer.

Linux Saloon 215 | Odyssey Linux

CubicleNate recaps another community episode of Linux Saloon, with participants trading experiences and opinions on various distributions, Void Linux in particular. The post gathers links to the resources mentioned during the stream. It also points to upcoming events such as Open Mic Night and to participant project links.

Linux Saloon 214 | Early Edition August

CubicleNate covers an early-edition episode ranging over hardware projects like the War Thunder sim rig and the perennial question of font management on Linux. News topics included the retirement of the “Father of the Internet,” Firefox updates, and the Steam Machine launch. Fedora governance changes also came up, alongside the usual list of resources and upcoming events.

UI Improvements Galore – This Week in Plasma

The KDE Blog translates Nate Graham’s weekly Plasma report, which this time leans heavily on usability polish. Plasma 6.8 now tells you when you try to print to an unavailable printer instead of silently doing nothing, and new user account creation warns clearly about invalid username characters.

Measuring Binary Function Coverage of openSUSE Integration Tests

Zoltán Balogh opens by being explicit about what his measurement is and is not. A typical Tumbleweed install carries roughly 2,600 ELF executables in /usr/bin and /usr/sbin, while the test repository holds 2,343 test modules. Coverage is measured on 141 of those binaries using 98 test modules, which he stresses is a fraction of the picture rather than the distribution’s total test coverage.

Diagonal Icons for Your PC

The KDE Blog presents Diagonal Icon theme by tamascsabi, a colourful set built around two-tone backgrounds split by a diagonal line. The design takes inspiration from popular sets such as Yaru, Evolvere and WhiteSur. It ships with an interactive POSIX-compliant installer that auto-detects distribution and window manager, works on Linux and BSD, supports customisable folder colours, and includes matching light and dark cursor themes.

Tumbleweed – Review of the Week 2026/32

Dominique Leuenberger and Victorhck report on five snapshots (0731, 0802, 0803, 0804, 0805), headlined by Podman 6.0.0 defaulting rootless networking to pasta and dropping cgroups v1, slirp4netns and CNI. shadow 4.20.0 removed the PASS_MIN_DAYS setting and the associated –mindays flags outright, so automated user-management scripts relying on them will now fail intentionally. Plasma 6 Workspace also switched SDDM to default to the Wayland session, while glibc 2.44, LibreOffice 20.2.5.2 and kernel 7.1.7 wait in staging.

Tiny Wins for Packagers: End-of-Week Update (2026-08-07)

The Open Build Service team publishes its weekly roundup of fixed issues, small features and minor releases. Shipped last week were OBS 2.10.34 with two security updates and osc 1.27.3, along with a long-awaited move to Rails 8.0.5.1. Other changes include dropping the updating and deleting BsRequest API, a fix to the /trigger API, and osc now erroring out on the deprecated apisrv option.

View more blogs or learn to publish your own on planet.opensuse.org.

Venue Update for openSUSE.Asia Summit 2026

admin@opensuse.org (openSUSE Asia Summit Team) — Mon, 10 Aug 2026 17:00:00 +0000

The openSUSE.Asia Summit 2026 Organizing Committee would like to announce an important update regarding the summit venue.

After careful consideration, openSUSE.Asia Summit 2026 will now take place at:

Convention Hall Universitas Islam Negeri (UIN) Sunan Kalijaga Yogyakarta, Special Region of Yogyakarta, Indonesia

This replaces the previously announced venue at the Teaching Industry Learning Center (TILC), Vocational School, Universitas Gadjah Mada (UGM).

This change has been made due to technical considerations identified during the event preparation process. Our priority is to ensure the summit runs smoothly and provides the best possible experience for attendees, speakers, sponsors, exhibitors, and volunteers.

We would like to express our sincere appreciation to Universitas Gadjah Mada for their support and cooperation throughout the planning process. The venue change was made solely due to technical and logistical considerations as we worked to ensure the best possible experience for all participants.

Interestingly, the Convention Hall at UIN Sunan Kalijaga also hosted the very first openSUSE.Asia Summit in Indonesia back in 2016. We are excited to return to a venue that has become part of the summit’s history.

The summit dates remain unchanged:

- October 3-4 2026 - Yogyakarta, Indonesia

The new venue provides the facilities needed to accommodate summit sessions, sponsor exhibitions, community activities, and networking opportunities throughout the two-day event.

Participants who have already registered do not need to take any action. Registration, tickets, and all scheduled activities will continue as planned, with only the venue being updated.

We would also like to express our sincere gratitude to Universitas Islam Negeri Sunan Kalijaga for welcoming openSUSE.Asia Summit 2026 and supporting this year’s summit.

Thank you for your continued support. We look forward to welcoming the openSUSE community from across Asia to Yogyakarta this October.

Planet News Roundup

admin@opensuse.org (Douglas DeMaio) — Mon, 10 Aug 2026 08:00:00 +0000

This is a roundup of articles from the openSUSE community listed on planet.opensuse.org.

The community blog feed aggregator lists the featured highlights below from July 31 to August 6. This week highlights the winner of the openSUSE.Asia Summit 2026 logo competition ahead of the October summit in Yogyakarta, and Tumbleweed reached a major milestone with GCC 16 becoming the default system compiler. On the KDE side, Plasma 6.7.4 arrived as the fourth bugfix release, work moved forward on making KIO dramatically faster at copying small files, and the Call for Papers opened for Akademy-es 2026 in Madrid.

Here is a summary and links for each post:

3 Native Platformer Games for Linux

The KDE Blog continues its series on native Linux games with three platformers highlighted by the Planeta Tecno channel. The picks are Cow’s Revenge, a comedic run about a genetically enhanced cow taking revenge on butchers, Cave Story, an RPG-flavoured classic of the genre, and Frogatto & Friends, praised for its polished art and quest-driven story.

Submit Your Talk to Akademy-es 2026 in Madrid

The KDE Blog announces that the Call for Papers is open for Akademy-es 2026, held Oct. 23–25 at Camping Arco Iris in Villaviciosa de Odón, Madrid. The venue was chosen deliberately to emphasise the community side of KDE, marking both KDE’s 30th and Akademy-es’s 20th anniversary. Proposals for 45-minute talks or 10-minute lightning talks are accepted until September 3 at akademy-es-org@kde-espana.org.

openSUSE Asia Summit 2026 Logo Competition Winner Announced

openSUSE News reveals that A. Thalida won the openSUSE.Asia Summit 2026 logo competition. The design becomes the official visual identity of this year’s conference. Nine entries arrived from contributors across several countries. The winner was chosen by a vote of the openSUSE.Asia Committee and the local organising team. The summit takes place Oct. 3–4, 2026 in Yogyakarta, Indonesia.

Fourth Plasma 6.7 Update

The KDE Blog covers the fourth bugfix release of Plasma 6.7. The post also recaps the headline features of the 6.7 series, including per-screen virtual desktops, a microphone volume test, and a quick light/dark theme switcher.

KDE Will Be Faster at Copying Small Files

The KDE Blog reports on Méven Car’s work fixing a long-standing KIO slowdown when copying thousands of small files. The bug was first filed back in 2014. The fix replaces the socket pair still used between KIO workers and applications with a zero-copy in-memory transport, and cuts redundant filesystem checks on the destination.

Victorhck translates and summaries the FSF’s monthly supporter bulletin for August. Highlights include a call to oppose the GUARD Act and age-verification laws that could make anonymous use of machine learning tools impossible, and news that the German state of Mecklenburg-Vorpommern has moved around 5,000 employees to Nextcloud.

Geeko Magazine 2026 Summer Edition Announced

The Geeko Blog of the Japanese openSUSE user group announces the Summer 2026 special edition. Articles cover upgrading to Leap 16.0, making Samba servers browsable, terminal-based Linux desktops with bcon, KDE Plasma, and building with the Open Build Service.

This July in KDE Linux

The KDE Blog has a July report that highlights the community’s immutable “OS of the future”. New this month is an integrated QA system that catches critical performance and login regressions before they reach users, alongside kernel security tweaks, faster boot from trimmed modules, and on-demand CUPS.

Emoji Resizing – This Week in Plasma

The KDE Blog looks at Plasma 6.8 and the ability to make emojis in the picker larger or smaller. Other changes include pixel-by-pixel screen positioning with arrow keys in Display Configuration, QR code detection in Spectacle, and a modernised system tray widget.

Linux Saloon 213 | News Flight Night

CubicleNate recaps a wide-ranging community episode of Linux Saloon covering VPN usage and how people manage user accounts on their machines. News topics included Arch Linux disabling AUR package adoption as a countermeasure against malware and upcoming features in Ubuntu 26.10.

How Extremadura Changed Free Software Forever – Episode 2 of “La era de las distros”

The KDE Blog promotes the second episode of Lorenzo Carbonell’s podcast on Spain’s regional educational distributions, this time telling the story of LinEx. Guest Jesús Rubio, joined by Jesús González Barahona, explains how a largely rural region took on Microsoft in the early 2000s and turned technological sovereignty into something actually installed on thousands of machines.

openSUSE Tumbleweed Review of Week 31

Victorhck and Dominique Leuenberger report on the five snapshots released this week, headlined by GCC 16 landing as Tumbleweed’s new default system compiler in snapshot 0726. The full-repository rebuild made that snapshot exceptionally large, and linux-glibc-devel 7.1 followed in 0728 alongside the return of multipath-tools 0.15~1 after last week’s revert.

My Plasma Desktop for July 2026 #viernesdeescritorio

The KDE Blog shares the 74th installment of its monthly desktop showcase. This time on a new Slimbook Evo ultrabook running KDE Neon with Plasma 6.7.3 on Wayland. The vertical left-hand panel holds a digital clock, virtual desktop switcher, icons-only task manager, system tray, desktop view and application launcher.

Creating the Ultimate Vertical Monitor Workspace

CubicleNate chronicles a home office upgrade that began with a six-monitor rig built from inadequate screens. An LG DualUP monitor proved a step forward, which led to settling on a dual INNOCN display setup aimed at maximising productivity. Despite some connection trouble and mismatched pixel density, the new vertical layout markedly improved both usability and desk efficiency.

Tiny Wins for Packagers: End-of-Week Update (2026-07-31)

The Open Build Service team publishes its weekly roundup of small fixes, minor features and new external contributions. Shipped items include de-grouping when filter_search_text sits on top of filter_labels, fixed overlapping labels on image template radio buttons, clearer visual cues that attributes are expandable, and rejection of release targets pointing back at the same repository.

View more blogs or learn to publish your own on planet.opensuse.org.