openSUSE News

Tumbleweed Monthly Update - October 2026

admin@opensuse.org (Douglas DeMaio) — Sun, 01 Nov 2026 08:00:00 +0000

As openSUSE Tumbleweed barrels through the autumn, the month of October brought Linux enthusiasts several changes for this premier rolling release.

October was a heavy month for both features and fixes, with 23 snapshots landing between Oct. 1 and 28. KDE Plasma 6.8.0 and KDE Frameworks 6.31.0 arrived as new feature releases for the desktop, Qt jumped to 6.12.0, and Firefox shipped 157.0.1, 158.0 and 158.0.1 to close out three rounds of Mozilla security advisories. The Linux kernel advanced through 7.2.9, 7.2.10 and 7.2.11 before moving to 7.3.0 at the end of the month, Mesa moved to 26.2.5, OpenSSH reached 10.6p1, Git landed 2.56.0, and GnuPG 2.5.24 brought RFC 9980 post-quantum support. The late snapshots added KDE Plasma 6.8.1, sqlite3 3.54.1, harfbuzz 15.0.0 and mariadb 13.0.2, while Tumbleweed patterns stopped recommending YaST for new installations. Security work dominated the back half of the month, with curl fixing two dozen flaws, libsoup patching a long list of WebSocket heap overflows, Pillow correcting 28 issues, and the kernel carrying 91 CVEs across its three point releases.

As always, be sure to roll back using snapper if any issues arise.

For more details on the change logs for the month, visit the openSUSE Factory mailing list.

New Features and Enhancements

KDE Plasma 6.8.0 & 6.8.1: The big desktop release of the month improves how the Wayland session behaves under the cursor and on the clipboard. KWin now updates the effective pointer focus surface properly, handles implicit pointer grabs on subsurfaces, and lets pointer constraints lock and unlock without waiting for an extra commit, while locked pointers also land on the requested position after a warp. SVG cursors render at device resolution, which removes the blur that scaled cursors used to show, and the color pipeline gains YCbCr to RGB conversion so HDR output on wide-gamut displays looks closer to intent. Crashes in the screencast and screenshot plugins are fixed, and Qt applications now share a single persistent OpenGL context, which cuts down context churn. On the desktop side, the touchpad and tablet configuration panels work more reliably, the task manager and window list applets no longer misbehave on focus changes, and Plasma guards against concurrent logout, reboot, and shutdown requests. The 6.8.1 bugfix release followed later in the month and tightened the details: Klipper requests activation when its popup appears, scripted floating panels save and restore their configuration correctly, Spectacle keeps Save pointing at the current file after Save As, and PowerDevil shows the brightness OSD when a key is pressed at the minimum or maximum. Kickoff only sets drag MIME data when it has a URL, and Discover prepares its resource model before running headless updates.

KDE Frameworks 6.31.0: This feature release refreshes the libraries that the desktop and applications are built on. KIO keeps search results current when a file is deleted or renamed, resolves symlink targets when creating a new link, reports real modification timestamps for FTP files by speaking RFC 3659, watches physical trash directories for outside changes, and finally detects locally mounted remote filesystems when deciding whether a file is slow. Syntax Highlighting gains missing Perl operators, corrected heredoc handling, and a long list of Zsh rules, while KTextEditor lets vi-mode commands accept numpad digits as counts and adds a binary format option to the addition commands.

Qt 6.12.0: A major release of the toolkit that most Linux desktops and applications are built on. It brings the usual round of new APIs and platform work, and openSUSE carries a couple of extra patches on top, including a fix for touchpad scrolling and a build adjustment for the newer md4c. Applications built against Qt 6.12 should see better input handling and refreshed widget behavior on Wayland and X11 sessions alike.

Firefox 157.0.1, 158.0 & 158.0.1: The browser received three security-focused releases within the same month, and the fixes matter for everyday browsing. Version 157.0 arrived with Mozilla Foundation Security Advisory 2026-97 covering 39 issues, among them several sandbox escapes in the DOM and graphics layers, privilege escalation bugs in the WebGPU code, and use-after-free faults in the Widget, XSLT, and networking cache. A follow-up 157.0.1 release patched a mitigation bypass in file handling, and 158.0 then shipped with advisory 2026-106, closing 44 more issues including a sandbox escape, site isolation problems, and a batch of JavaScript engine JIT miscompilations. The month closed with 158.0.1, which shipped advisory 2026-111 and four more fixes, including an SVG boundary condition, a cryptographic state issue, uninitialized memory in the audio backend, and a PDF viewer denial of service. It also refreshed the OneCRL block list that disables compromised eMudhra intermediate certificates, corrected pages scrolling to the top while selecting text, and fixed Firefox opening windows on the wrong monitor in multi-monitor Linux setups. All three updates are worth applying promptly.

LibreOffice 26.8.1.1: The office suite received its first bugfix release on the 26.8 branch. The update concentrates on stability across Writer, Calc, and Impress rather than new features, and it is the sort of release that makes sense to take straight away given how much document handling most people do.

gedit 51.0: The GNOME text editor crossed a major version boundary. The Word Completion, Smart Spaces, Draw Spaces, and Bookmarks plugins are folded into the main package, so they no longer need to be installed separately, and the separate gedit-plugins repository is being retired. The project also published a guideline that no LLM-based AI tools are used in its development.

tmux 3.8: The terminal multiplexer gained the largest update in its recent history, and the change is mostly about the look and feel of your panes. Floating panes now support modal variants, titles, and border styles, and moving, resizing, splitting, and zooming them all behave better. There are light and dark themes, an event-based hook and monitor mechanism, a window and session switcher, and scrollbars that hide themselves when they are not needed. Layout strings are now JSON-based and can describe floating panes, although the classic layouts still work and remain the default in control mode. The mouse is enabled by default, and the old refresh-from-pane command gives way to copy-mode refresh commands.

harfbuzz 14.6.0 & 15.0.0: The text shaping engine that sits under browsers, desktop environments, and document editors picked up support for the final ISO Open Font Format 5th edition, including fonts with more than 65536 glyphs. Version 14.6.0 added the DMAP table, supported FeatureVariations 1.1 lookups including subsetting and instancing, and moved VARC to its revised variation-store format. Version 15.0.0 then enabled the full 5th-edition feature set by default: 24-bit glyph indices across the GLYF, LOCA, GVAR, MAXP, HHEA, HMTX, VHEA, and VMTX tables, cmap format 15, VORG version 2, COLR PaintGlyph2, the 24-bit layout table formats, and extended TrueType Collection directories. The raster, vector, and GPU libraries are no longer experimental, and fixes landed for a use-after-free in hb_font_set_face() and a heap buffer overflow in hb_font_set_variation() after switching faces.

sqlite3 3.54.1: The embedded database and its command-line shell picked up a feature release followed by a bugfix. The shell now lets the prompt strings expand to show state information, reads the initial prompt from the SQLITE_PS1 and SQLITE_PS2 environment variables, honors NO_COLOR, and shows column headers in columnar output even when a query returns no rows. A new .diskused dot-command replaces the separate sqlite3_analyzer utility, .mode gained --rowcount, --titles, --ifmt, and --fpfmt options, and the query planner handles expr OR TRUE/expr OR FALSE, expression indexes, and single-row UNION queries more efficiently. The 3.54.1 follow-up fixes a possible heap buffer overflow on 32-bit builds.

freetype 2.15.0: The font rendering library reached a new major version with ISO Open Font Format 5th edition support, including the new VARC table and mixed cubic and conic outline segments. OpenType fonts with more than 65536 glyphs can now be handled, the anti-aliased rasterizer uses dynamic heap memory for large glyphs to improve performance above 40 ppem, and TrueType version 40 interpreter rendering improves for ClearType.

expat 2.9.0: The XML parser gained a major version with a new Properties API for reading and setting scalar parser properties, plus five new 64-bit location API functions. The release also fixes an integer overflow in expat_realloc on 32-bit platforms and an out-of-bounds read in XML_ParseBuffer.

Graphviz 16.1.0: The graph description language tooling took a large jump that includes breaking changes for anyone linking against its libraries. The cgraph library moved to soname 8 to 10 and xdot to soname 4 to 5, the agmemconcat function was removed, support for the undocumented postaction attribute was dropped, and the never-implemented gvmap options -g, -l, and -p are gone. Most users only notice the tool itself, but projects embedding Graphviz will need to recompile.

memtest86+ 9.00: The memory testing utility reached a new major version and, for the first time, offers an AArch64 build. The new images are tested on Snapdragon X and Raspberry Pi 4 and 5 hardware, and the test suite was redesigned around 128-bit and 256-bit SIMD for SSE2, AVX2, NEON, and LASX. There is also a new bus stress test, an off-by-default RowHammer test, an improved bit fade test, a corrupted SPD detection test, and RAM details pulled from DMI when SPD data is unavailable.

mariadb 13.0.2: The database server moved to a new major series. The 13.0 branch adds single-table UPDATE ... RETURNING with OLD_VALUE() support, atomic CREATE OR REPLACE TABLE, reversed executable comments, and a new innodb_log_archive option for continuous WAL archiving and point-in-time recovery, although mariadb-backup cannot read that format yet. The query optimizer gained the QB_NAME() hint with implicit block names, PERFORMANCE_SCHEMA digests moved to XXH3_128, and the audit plugin log timestamp format is configurable. The release also folds in crash and correctness fixes from 12.3.3 and a large batch of security fixes.

YaST removal from default patterns: The late-month pattern updates stopped recommending YaST in new Tumbleweed installations. The enhanced_base, x11_enhanced, apparmor, multimedia, KDE, Xfce, and server patterns no longer pull in YaST modules or the control center, completing the change tracked for Tumbleweed defaults. YaST packages remain in the repository for anyone who has them or wants them, and the patterns also dropped a long list of obsolete packages and stale package names while moving the DHCP server pattern to Kea and recommending FRRouting over Quagga.

Key Package Updates

Linux kernel 7.2.9, 7.2.10, 7.2.11 & 7.3.0: The kernel progressed through three point releases during October before the 7.3.0 base landed in the closing days of the month, with security work dominating the point releases; version 7.2.9 brought fixes in NTFS filesystem code covering reparse index insertion failures, kmap_local leaks in the MFT write path, and volume cleanliness marking, along with hardening for the BPF verifier’s register invariants, sparse CPU ID handling in percpu maps, and speculative execution paths. The NVIDIA and AMD acceleration drivers, NVMe RDMA cleanup ordering, ppp_async errored frame handling, and the ARM SCMI firmware interface all received corrections. Version 7.2.10 turned to the networking and storage layers, patching a stack out-of-bounds read in the IPsec iptfs path, a use-after-free in the XFRM compatibility interface, a use-after-free in RDMA siw and rxe, a cfg80211 header size check, and a device reference count underflow in the DMA engine. Version 7.2.11 closed the month with fixes for a NULL versus ERR_PTR mixup in the virtio DRM driver, a stale transport header in IP tunneling, a file descriptor ordering problem in exec, an skcipher_walk return code bug on s390, a sched_cache accounting fix, an out-of-bounds write in drop_monitor, and an embedded URB problem in the ALSA USB 6fire driver. The jump to 7.3.0 brought the new base kernel into the distribution along with refreshed openSUSE patches and configuration, including disabling the Qualcomm firmware and secure monitor drivers on s390x where they broke the zfcpdump build.

Mesa 26.2.4 & 26.2.5: Two bugfix releases landed on the 26.2 branch, and the important change is in the OpenCL stack. The Rusticl driver no longer requires a specific libclc version, which removes a version coupling that had been holding up the combination of newer Mesa and newer LLVM. openSUSE also backported upstream patches so that newer libclc files are found correctly, and worked around the missing libclc.pc file in the meantime. The changelogs point to the Mesa 26.2.4 and Mesa 26.2.5 release notes for details.

OpenSSH 10.6p1: The SSH implementation reached a new release that begins deprecating a fragile option. scp -R for remote-to-remote copies still works but now prints a deprecation warning, because it requires credentials on the far host and depends on shell quoting rules that may differ from the local client’s expectations. Compression also becomes less effective due to a security-related change, and sshd is scheduled to drop support for platforms that cannot pass file descriptors and need root for PTY allocation.

GnuPG 2.5.23 & 2.5.24: The cryptographic toolchain gained its first post-quantum mode. Version 2.5.23 adds an --allow-9980 option for processing data structures defined by RFC 9980, and in that mode it supports post-quantum encryption using ML-KEM, also known as Kyber, with X448, X25519, Brainpool, or NIST curves, along with ED25519 and X25519 under the names RFC 9580 assigns them. There is also experimental --compliance=fips mode using GCM for bulk encryption, Nitrokey 3 support in the smartcard daemon, a fix for an exploitable printf bug in the gpgsm --debug x509 option, and out-of-bounds read fixes in the DNS CERT record parser and in smartcard parsing. Version 2.5.24 is a small follow-up that repairs a regression in the new Nitrokey detection.

systemd 261.3 & 261.4: The init system picked up two releases. Version 261.3 moved systemd-pcrextend and systemd-measure out of experimental into udev, which is what makes ukify work properly, and it added pam_rootok to the authentication stack for systemd-run0. Version 261.4 tightened the seccomp filters so that sched_setattr() is refused under RestrictRealtime=, setns() namespace types are masked to 32 bits under RestrictNamespaces=, socket() domains are masked under RestrictAddressFamilies=, and nspawn masks its netlink audit filter arguments to 32 bits.

GRUB 2.16: The bootloader jumped two minor releases. The update includes an upstream fix for CD-ROM read retries on the i386-pc BIOS disk path, skips the in-place verifier for the synthesized initrd to avoid a potential boot error, and backports upstream work so that the Linux initrd is verified in place instead of being copied, which avoids a potential out-of-memory condition. A patch refreshing the crypttab and Linux modules dependency handling also went in.

curl 8.23.0: The command-line transfer tool shipped a release that carries more than twenty security fixes along with a long list of behavior changes. On the security side, the highlights include an HTTP/2 upload use-after-free, a stack overflow through recursion in curl_mime_free, credential leaks in CURLINFO_EFFECTIVE_URL and to proxies, HSTS cache handling faults, and connection reuse mixups that could send client certificates or Negotiate credentials to the wrong origin. On the functional side, SMB support was dropped, the -J no-clobber guarantee no longer bypasses on a 103 early hint response, HSTS max-age is capped at two years, and TLS common name support is deprecated. The curl command also gained tool_cb_wrt improvements for no-clobber filenames.

Git 2.56.0: The version control system reached a new major release. Users will notice that git status now advises when the local branch is behind its remote, that git add learned a --resolved option for staging a single conflicted file, and that git branch -d reports failures better. The git refs toolbox grew create, edit, and move commands, git bisect gained a --no-checkout option, and a new git remote-object-info command helps with partial clones. On the protocol side, the handling of the promisor-remote capability changed, the ort merge backend was hardened against corrupt repositories, and git log --follow handles renames better.

GStreamer 1.28.8: The multimedia framework received a broad bugfix release. The adaptive demuxer resolves an HLS and DASH playback regression, FLAC seeking works again, and the RTP depayloader and RTSP client gained a long list of SDP handling fixes. The MXF demuxer reads AAF AIFF-AIFC audio, the VA-API compositor blends alpha correctly with the Intel driver, and the ISOBMFF muxers handle timestamp rollover in 2036. Various security and playback fixes landed alongside memory leak and stability work.

LLVM 23.1.3 & 23.1.4: The compiler infrastructure received two bugfix releases that collect everything found since the 23.1.0 release. Both remain API and ABI compatible with 23.1.0, so they are safe drop-ins for anyone building with the Clang compiler or the LLVM libraries. The 23.1.4 packaging also builds all targets on ppc64le, adds the SPIR-V target on ARMv6/7 and s390x, and ships compiler-rt builtins for wasm32-wasip1 so Clang can link WASI binaries against a sysroot.

GCC 16.2.1: The GNU Compiler Collection moved to the 16.2 branch head. The update pulls in a fix for a use-after-free in __gnu_pbds::priority_queue and an internal compiler error that could show up while building Firefox on ARM. It is the kind of point release that quietly keeps toolchain builds healthy.

python313 3.13.16: The Python interpreter received a release that is mostly security work in the standard library. The tarfile extraction filters were tightened against path escapes and hard-link tricks, zipfile now bounds the amount of data decompressed per read for bzip2, LZMA, and Zstandard members, asyncio and ssl validate the server hostname when a check-hostname context is supplied, and stringprep no longer accepts Unicode codepoint attributes outside RFC 3454. The bundled libexpat moved to 2.8.5, and a crash in ssl when an sni_callback swaps contexts was fixed.

Samba 4.25.0: The file server reached a new feature release. The work centers on persistent handles, with database layer bugs and byte-range lock problems in smbstatus fixed, and SMB3 SESSION SETUP responses now always signed. A winbindd_child_msg_filter crash when more than one domain connection is configured is resolved, upper-case 0X hex values in the kdc default domain supported enctypes parameter now parse correctly, and the temporary directory name smbd generates no longer overflows NAME_MAX for long client names.

QEMU 11.1.2: The machine emulator received a stable point release with security fixes. The VAPIC region is now confined to the correct memory range, the 9pfs file server mutates the FID path only from the main thread, and the xHCI USB controller sets a reentrancy guard in its timer functions to avoid a use-after-free.

NetworkManager 1.58.1: The network service jumped two minor releases and gained a long list of correctness fixes. Highlights include support for 464XLAT Customer-side Translator using a BPF program, an internal implementation of the connectivity check, and a new check-connectivity configuration option. IPv4 forwarding now works on modem data interfaces, auto-connect to WPA3 networks with key-mgmt=wpa-psk is fixed, the internal DHCPv4 client ignores the Router option when it is unsafe and no longer reads out of bounds, DNS server port numbers are forwarded to systemd-resolved correctly, and several crashes are gone.

poppler 26.10.0: The PDF rendering library gained a release with signature and rendering improvements. Support for eIDAS CAdES-B signatures was added, along with an API to query and select the CAdES-B or S/MIME signature type, font subsetting is enabled when using the Windows font backend, and brotli streams are now supported. Several malformed-document crashes are fixed and named destination resolution falls back to the destination dictionary correctly.

7-Zip 26.04: The archiver received a release that, in the words of the upstream notes, fixes some bugs and vulnerabilities without publishing further detail. It is worth taking regardless, since previous 7-Zip releases in Tumbleweed have carried Mark-of-the-Web problems that let extracted files slip past quarantine checks.

xterm 411: The venerable terminal emulator reached a new release with a long list of refinements. The emoji_width option calculation was corrected, DECSCUSR 7 was added for a “power-up” cursor configuration, regex-based selections no longer stop at the first row of a wrapped line, and the new brokenCopyArea resource controls whether XCopyArea is used for indexing and scrolling. GTK environment filtering was trimmed and several terminfo entries were corrected.

ffmpeg 8.1.3: The multimedia workhorse moved to a new point release that folds the outstanding media stack fixes into upstream code, so the SUSE patches for the two dozen advisories from last month could be retired. Format parsing became more robust across the board, and support for the APV encoder arrived with the liboapv dependency. Anyone running a media server or transcoding pipeline should take this release.

PipeWire 1.6.10: The audio and video server received a bugfix release that stays API and ABI compatible with the 1.6 series. It fixes potential crashes in the JACK layer, a regression in the PSD rear-delay upmixing code where a zero delay produced a large one, and pops and clicks when playing unsigned sample formats. The X11 module no longer risks calling error handlers twice, the PulseAudio server stops queueing unlimited requests for paused clients, and the GStreamer plugin sets plane strides and offsets correctly.

lvm2 2.03.43: The logical volume manager and device-mapper tools moved through several point releases. The update wipes stale signatures before formatting a VDO data logical volume on thin storage, allows a 4K stripe size smaller than the page size, and adds lvmconfig --edit for setting or removing a configuration entry. dmeventd gained raid repair fixes after partial replacement and snapshot extension backoff, pvmove works in shared volume groups with lvmlockd, and lvmpersist now rejects non-block devices and cleans up keys on interruption. Clustered mirror logging and the cmirrord daemon were removed.

e2fsprogs 1.47.4: The ext2, ext3, and ext4 utilities received a maintenance release. mke2fs now accepts multiple -E options and a new root_selinux option for setting the SELinux label of the root directory, and mke2fs -d handles copying files larger than 2 GiB. e2fsck no longer flags fast symlinks with large external extended attributes as corrupt, e4defrag no longer crashes on inline-data files, and fuse2fs and libext2fs collected a long list of correctness fixes found while running xfstests.

xorg-x11-server 21.1.25 & xwayland 24.1.14: Both X servers received security releases that fold in the fixes openSUSE had been carrying as individual patches. The releases cover the XKB, RandR, GLX, Present, XInput, and gesture-sprite issues detailed in the Security Updates section, so the separate patch set could be retired.

bind 9.20.30: The DNS server received a security release that fixes four vulnerabilities, including CPU exhaustion while parsing crafted DNS messages, a crash from concurrent GSS-TSIG traffic, a crash with redirect zones and strict QNAME minimization, and a crash when resuming a query initiated by response policy zones. The update also rejects URI records with an empty target, fixes an out-of-bounds read in dig +dns64prefix, and prevents the statistics channel from serving data on unregistered URL prefixes.

unbound 1.26.2: The validating recursive resolver fixed five CVEs, among them a use-after-free in DNS-over-QUIC path migration on multi-threaded deployments, possible insecure NXDOMAIN answers under an island trust anchor, a chained-pointer decompression denial of service, and a cache side-channel that could allow cache poisoning through unwanted-reply-threshold. It also closes a bypass of an island trust anchor from an attacker-controlled NSEC record.

FreeRDP 3.32.2: The remote desktop client shipped a release that references 44 security advisories alongside a broad set of channel fixes. USB redirection gained an input range check and configurable hotplug class filtering, smartcard transactions no longer deadlock with pcsc-lite, drive redirection works with FreeRDP-based servers, and the HTTP gateway no longer has a body-content use-after-free. The H.264 MediaCodec decoder and encoder were improved, the SDL client renegotiates the desktop size in fullscreen, and the X11 client fixes raw clipboard transfer.

python-Pillow 13.0.0: The Python imaging library crossed a major version and addressed 28 CVEs in the process. The release validates TIFF tag values against libtiff’s own field definitions, bounds retained TIFF tag data by stream size, fixes a heap buffer overflow in _tiffWriteProc, rejects TIFFs whose unpacker row is wider than libtiff’s decoded row, and limits PDF nesting to 900 while preventing infinite loops when rewriting pages. It also hardens JPEG, PSD, GIF, WMF, and XPM parsing and drops support for Python 3.10.

nano 9.3: The text editor received a small release that clips overlong filenames on the mini status bar and makes the keypad operator keys produce their inscribed characters.

transmission 4.1.4: The BitTorrent client fixed a local privilege issue in the macOS client, hardened the torrent-add RPC method against malformed requests, and corrected a 4.1.0 regression that mishandled torrents containing zero-byte files. Launching either the Qt or GTK client now hands new torrents to an already-running session, per-torrent speed limits apply to uploads again, and the Qt client uses less CPU.

bubblewrap 0.13.1: The sandboxing tool now accepts multiple --sync-fd arguments and uses O_PATH when opening parent directories in the new root, which fixes an error when read permission is missing. On kernels 5.12 and newer it remounts filesystems with mount_setattr(), and path arguments such as --bind and --overlay-src reject empty strings instead of treating them as the root directory.

virtualbox 7.2.22: The virtualization package received a maintenance release with security-related fixes, and the matching kernel modules were rebuilt against the 7.3.0 kernel.

lame 4.0: The MP3 encoder crossed a major version because the 9-byte encoder version field in MP3 files overflowed during the 3.100 series. The release adds ID3v2.4 support and upstream pkg-config support, gives mp3rtp IPv6 support with an incompatible command-line change, and fixes an AIFF header parser integer underflow plus a Windows-only Blade DLL stack overflow.

ndctl 85: The persistent memory utility added famfs mode support to daxctl and now applies CXL bus and port filters to anonymous memory devices, so enumeration returns exactly the scope an administrator asked for. It also prevents partial cxl/region teardown when destroy-region requests arrive out of order and reports whether a region is locked in cxl/list.

xfsprogs 7.2.0: The XFS userspace tools moved quota handling in xfs_quota, xfs_spaceman and libfrog to quotactl_fd with mount-fd support, so quota reporting keeps working as kernels move away from the older interface. mkfs can now read default options from a configuration file and runs autofsck earlier, while xfs_copy aligns page-size I/O and case-insensitive lookups use fileattr_get. The release also fixes a rtrefcount btree off-by-one, an INO1_WRITTEN reflink flag that was not cleared on exchange-range, a xfs_dqinode_metadir_create() leak, 32-bit pointer arithmetic, an exchmaps reservation check and growfs delta handling, and it zeroes padding in directory data blocks.

Security Updates

Linux kernel 7.2.9, 7.2.10 & 7.2.11:

CVE-2026-98151: Fixes a register invariants violation in the BPF verifier triggered by speculative execution.
CVE-2026-98150: Corrects BPF_F_CPU validation for sparse CPU ID sets.
CVE-2026-98149: Resolves percpu map update indexing errors with sparse CPU IDs.
CVE-2026-98134: Fixes the BPF verifier inferring register states incorrectly for conditional jump operations.
CVE-2026-98048: Addresses BPF fastcall patterns being rewritten when they should not be.
CVE-2026-98141: Fixes NTFS propagating reparse index insertion failures.
CVE-2026-98140: Corrects a kmap_local leak in the NTFS write_mft_record_no path.
CVE-2026-98138: Stops NTFS from marking a volume clean during sync_fs.
CVE-2026-98135: Rejects invalid sectors_per_cluster values in NTFS volumes.
CVE-2026-98162: Fixes a tree connection leak in the kernel SMB server.
CVE-2026-98405: Adds a missing IOV bounds check when the SMB client parses a response.
CVE-2026-98420: Aligns ksmbd with SMB2 session expiration semantics.
CVE-2026-98367: Clears the RDMA siw association under lock when the queue pair is torn down.
CVE-2026-98365: Fixes an integer overflow in the RDMA rxe memory region range check.
CVE-2026-98359: Rejects unregistering network devices in RDMA generic failure handling.
CVE-2026-98431: Fixes a lock ordering problem between mmap_lock and disassociation_lock in RDMA uverbs.
CVE-2026-98159: Validates CLC firmware records in the MediaTek mt76 mt7921 driver.
CVE-2026-98349: Rejects undersized beacon and probe responses in the libipw Wi-Fi helper.
CVE-2026-98345: Checks the IP header size in the cfg80211 handler.
CVE-2026-98407: Fixes a heap out-of-bounds write in the rsi Wi-Fi driver on key removal.
CVE-2026-98372: Fixes a stack out-of-bounds read in the IPsec iptfs path.
CVE-2026-98370: Addresses a use-after-free in the XFRM compatibility ALLOCSPI request handling.
CVE-2026-98368: Downgrades ESP zerocopy managed fragments before mutating them.
CVE-2026-98078: Fixes reversed sequence option serialization in IPVS.
CVE-2026-98375: Makes the Xen netfront driver drop RX packets with a short Ethernet header.
CVE-2026-98344: Corrects a device reference count underflow in the DMA engine.
CVE-2026-98343: Fixes a use-after-free in the DMA engine dma_chan_put path.
CVE-2026-98156: Moves the virtio DRM driver to the DMA API for resource backing.
CVE-2026-98404: Fixes a NULL versus ERR_PTR mixup in the virtio DRM driver.
CVE-2026-93093: Publishes ARM SCMI channel state before it is used.
CVE-2026-98363: Rejects ARM SCPI DVFS OPP counts above the maximum.
CVE-2026-98388: Closes file descriptors on exec before taking the exec_update lock.
CVE-2026-98427: Bounds the dropping loop per deque in the CoDel network scheduler.
CVE-2026-98428: Avoids embedded URBs in the ALSA USB 6fire driver.
CVE-2026-98419: Fixes an out-of-bounds write in drop_monitor during reset_packet.
CVE-2026-98387: Handles the skcipher_walk return code properly on s390.
CVE-2026-98158: Drops the errored frame instead of reusing it in ppp_async.
CVE-2026-98154: Fixes the EIO cleanup order in the NVMe RDMA queue request path.
CVE-2026-98414: Stops the root memory cgroup from being charged by object cgroups.

java-25-openjdk 25.0.5:

CVE-2026-87255: Hardens vector processing.
CVE-2026-87294: Strengthens certificate name checks.
CVE-2026-83395: Hardens HTTP client response handling.
CVE-2026-83387: Strengthens WebRowSet handling.
CVE-2026-83374: Hardens PKCS5 padding.
CVE-2026-87367: Hardens template handling.
CVE-2026-91379: Hardens JShell.
CVE-2026-83378: Improves C2 loop transformation handling.
CVE-2026-87290: Hardens XPath expression handling.
CVE-2026-83380: Hardens LDAP login handling.
CVE-2026-101516: Strengthens certificate constraint checking.
CVE-2026-91462: Hardens Kerberos token handling.
CVE-2026-91464: Strengthens Kerberos validation.
CVE-2026-91487: Hardens C2 comparison handling.
CVE-2026-91394: Hardens HTTP client caching.
CVE-2026-91453: Improves HTTP header handling.
CVE-2026-91461: Hardens TLS extension handling.
CVE-2026-91463: Hardens the Kerberos client.
CVE-2026-91451: Hardens HTTP server parsing.
CVE-2026-91332: Hardens the HTTP client.
CVE-2026-87292: Hardens network clients.
CVE-2026-87291: Hardens the HTTP server.
CVE-2026-91333: Improves ciphertext handling.
CVE-2026-91335: Hardens image handling.
CVE-2026-91380: Hardens preference handling.
CVE-2026-91418: Hardens GIF loading.
CVE-2026-91400: Hardens MIDI file handling.
CVE-2026-91375: Hardens jmod handling.
CVE-2026-91452: Hardens the HTTP server handler.
CVE-2026-91415: Hardens font rendering.
CVE-2026-91398: Hardens SOCKS5 support.
CVE-2026-91397: Hardens diagnostic session handling.
CVE-2026-91374: Hardens jstatd.
CVE-2026-91373: Hardens TLS handshakes.
CVE-2026-91334: Hardens JPEG loading.
CVE-2026-83400: Hardens XML processing.
CVE-2026-83381: Hardens SASL authentication.
CVE-2026-83376: Strengthens TLS certificate handling.

glibc 2.44:

CVE-2026-8674: Fixes an assertion failure when the resolver truncates a search list.
CVE-2026-86805: Opens the normalized $ORIGIN rpath in AT_SECURE programs.
CVE-2026-97399: Fixes a one byte overread in strncasecmp on powerpc.

Firefox 157.0 & 157.0.1:

CVE-2026-100758: Fixes a sandbox escape in the DOM Navigation component.
CVE-2026-100760: Addresses a sandbox escape in the Security Process Sandboxing component.
CVE-2026-100762: Resolves a sandbox escape caused by a use-after-free in DOM content processes.
CVE-2026-100775: Fixes a sandbox escape in the Graphics component.
CVE-2026-100781: Addresses a sandbox escape due to incorrect boundary conditions in the Graphics WebRender component.
CVE-2026-100786: Fixes a sandbox escape due to a use-after-free in the Graphics component.
CVE-2026-100787: Addresses a sandbox escape in the XUL component.
CVE-2026-100761: Corrects privilege escalation caused by a use-after-free in the Graphics WebGPU component.
CVE-2026-100764: Addresses privilege escalation due to incorrect boundary conditions in the Graphics WebGPU component.
CVE-2026-100782: Fixes privilege escalation caused by incorrect boundary conditions in the Graphics component.
CVE-2026-100766: Resolves information disclosure in the Networking JAR component.
CVE-2026-100759: Fixes uninitialized memory use in the Storage Quota Manager.
CVE-2026-100757: Addresses a use-after-free in the Widget component.
CVE-2026-100779: Fixes a use-after-free in the XSLT component.
CVE-2026-100792: Corrects a JIT miscompilation in the JavaScript WebAssembly component.
CVE-2026-100793: Resolves a JIT miscompilation in the JavaScript Engine.
CVE-2026-106016: Fixes a mitigation bypass in the File Handling component, shipped in Firefox 157.0.1.

Firefox 158.0:

CVE-2026-109705: Addresses a sandbox escape and a site isolation issue caused by incorrect boundary conditions and a use-after-free in the Networking component.
CVE-2026-109707: Fixes a sandbox escape due to a use-after-free in the Networking component.
CVE-2026-109708: Addresses a sandbox escape due to incorrect boundary conditions in the Networking component.
CVE-2026-109712: Resolves a sandbox escape due to uninitialized memory in the Graphics component.
CVE-2026-109740: Fixes a sandbox escape due to incorrect boundary conditions in the Widget Win32 component.
CVE-2026-109745: Addresses a sandbox escape due to uninitialized memory in the DOM Web Serial component.
CVE-2026-109704: Corrects privilege escalation in the Application Update component.
CVE-2026-109709: Fixes information disclosure and privilege escalation in the Security Process Sandboxing component.
CVE-2026-109739: Addresses privilege escalation in the WebExtensions component.
CVE-2026-109743: Corrects privilege escalation in the Panning and Zooming component.
CVE-2026-109742: Resolves information disclosure in the PDF Viewer component.
CVE-2026-109734: Fixes a mitigation bypass in the DOM Security component.
CVE-2026-109737: Addresses a mitigation bypass in the Enterprise Policies component.
CVE-2026-109746: Corrects a mitigation bypass in the DOM Security component.
CVE-2026-109736: Fixes frame poisoning in the Layout component.
CVE-2026-109720: Addresses a JIT miscompilation in the JavaScript WebAssembly component.
CVE-2026-109722: Resolves a JIT miscompilation in the JavaScript Engine JIT component.
CVE-2026-109733: Fixes a JIT miscompilation in the JavaScript Engine JIT component.
CVE-2026-109713: Addresses a use-after-free in the Crash Reporting component.

Firefox 158.0.1:

CVE-2026-113399: Fixes incorrect boundary conditions in the SVG component.
CVE-2026-113470: Addresses a cryptographic issue in the Security Block-lists, Allow-lists, and other State component.
CVE-2026-113400: Corrects uninitialized memory use in the Audio/Video cubeb component.
CVE-2026-113401: Resolves a denial-of-service condition in the PDF Viewer component.

bind 9.20.30:

CVE-2026-19630: Prevents CPU exhaustion while parsing crafted DNS messages.
CVE-2026-94300: Stops concurrent GSS-TSIG traffic from terminating named.
CVE-2026-96888: Fixes a crash with redirect zones and strict QNAME minimization.
CVE-2026-97313: Fixes a crash when resuming from a query initiated by RPZ.

unbound 1.26.2:

CVE-2026-97206: Fixes a use-after-free when DNS-over-QUIC path migration occurs on multi-threaded deployments.
CVE-2026-50106: Addresses a possible insecure NXDOMAIN for non-existent records under an island trust anchor beneath an insecure parent.
CVE-2026-96405: Resolves a denial of service through chained DNS name pointer decompression.
CVE-2026-109125: Fixes a possible cache-poisoning side-channel exposed by unwanted-reply-threshold.
CVE-2026-35501: Prevents a bypass of a configured island trust anchor from an attacker-controlled NSEC record.

mariadb 13.0.2:

CVE-2026-107814: Fixes a server vulnerability addressed in the 13.0.2 release.
CVE-2026-107815: Addresses a second server vulnerability in the 13.0.2 release.
CVE-2026-107816: Resolves a third server vulnerability in the 13.0.2 release.
CVE-2026-107817: Corrects a fourth server vulnerability in the 13.0.2 release.
CVE-2026-107818: Patches a fifth server vulnerability in the 13.0.2 release.
CVE-2026-107821: Fixes a sixth server vulnerability in the 13.0.2 release.
CVE-2026-107822: Addresses a seventh server vulnerability in the 13.0.2 release.
CVE-2026-107823: Resolves an eighth server vulnerability in the 13.0.2 release.
CVE-2026-102523: Corrects a server vulnerability fixed in the 13.0.2 release.
CVE-2026-97380: Fixes a server vulnerability addressed in the 13.0.2 release.
CVE-2026-92262: Addresses a server vulnerability fixed in the 13.0.2 release.
CVE-2026-86047: Resolves a server vulnerability fixed in the 13.0.2 release.
CVE-2026-85985: Corrects a server vulnerability fixed in the 13.0.2 release.
CVE-2026-85748: Fixes a server vulnerability fixed in the 13.0.2 release.
CVE-2026-85746: Addresses a server vulnerability fixed in the 13.0.2 release.
CVE-2026-85745: Resolves a server vulnerability fixed in the 13.0.2 release.
CVE-2026-61081: Corrects a server vulnerability fixed in the 13.0.2 release.
CVE-2026-60585: Fixes a server vulnerability fixed in the 13.0.2 release.
CVE-2026-60331: Addresses a server vulnerability fixed in the 13.0.2 release.
CVE-2026-60747: Resolves a server vulnerability fixed in the 13.0.2 release.
CVE-2026-47023: Corrects a server vulnerability fixed in the 13.0.2 release.
CVE-2026-60184: Fixes a server vulnerability fixed in the 13.0.2 release.

krb5 1.22:

CVE-2026-107778: Prevents denial of service through crafted forwarded credentials.
CVE-2026-107708: Prevents denial of service through a malformed PAC in S4U2Proxy.

spice 0.16.0:

CVE-2026-105958: Fixes heap corruption from insufficient bounds validation of client-supplied offsets in several migration data handlers.
CVE-2026-105959: Addresses a heap buffer overflow from incorrect truncation of a size_t allocation in the GLZ encoder dictionary restore path.

ruby4.0 4.0.9:

CVE-2026-89078: Fixes a regular expression compiler issue involving overflowed repeat and null-check IDs in large regexps.
CVE-2026-93577: Addresses a regular expression vulnerability fixed in the 4.0.9 release.
CVE-2026-97229: Resolves a regular expression vulnerability fixed in the 4.0.9 release.
CVE-2026-110264: Corrects a regular expression vulnerability fixed in the 4.0.9 release.

php8 8.5.12:

CVE-2026-109618: Fixes memory corruption that could lead to remote code execution.
CVE-2026-109619: Addresses a second memory corruption issue that could lead to remote code execution.

curl 8.23.0:

CVE-2026-92392: Fixes a use-after-free during HTTP/2 uploads.
CVE-2026-92391: Addresses a stack overflow caused by recursion in curl_mime_free.
CVE-2026-92390: Corrects the -J no-clobber guarantee being bypassed by a 103 early hints response.
CVE-2026-92389: Resolves a direction confusion in TFTP transfers.
CVE-2026-92388: Fixes a mixup in the FTP wildcard write callback.
CVE-2026-92387: Addresses a never-ending loop caused by a server omitting a response.
CVE-2026-92386: Fixes a server-set cookie aborting the cookie jar load.
CVE-2026-94266: Corrects a password leak through CURLINFO_EFFECTIVE_URL.
CVE-2026-94265: Stops the Authorization: Negotiate header from being sent to a foreign origin.
CVE-2026-86414: Addresses leaking host credentials to an HTTP proxy.
CVE-2026-86413: Fixes Negotiate credentials being sent to a redirected origin.
CVE-2026-86412: Resolves a server-set cookie erasing the cookie jar.
CVE-2026-86411: Fixes an FTP connection reuse inheriting the client certificate.
CVE-2026-86410: Addresses a redirect to SFTP or SCP bypassing host verification.
CVE-2026-86409: Corrects stale SigV4 headers being sent unintentionally.
CVE-2026-87866: Fixes a wolfSSL public-key pinning bypass.
CVE-2026-87865: Addresses the knownhost callback mismatching a key as missing.
CVE-2026-87864: Resolves command injection through IMAP APPEND plus CRLF conversion.
CVE-2026-87863: Fixes an HSTS response erasing persisted entries.
CVE-2026-87862: Addresses the HSTS cache import dropping a longer-lived child entry.
CVE-2026-87861: Corrects cross-origin reuse of a Negotiate connection.
CVE-2026-107929: Fixes a local interface connection reuse mixup.
CVE-2026-107928: Addresses an information leak when uploading over WebSockets with GnuTLS.

libsoup 2.4:

CVE-2026-102556: Fixes a heap buffer overflow triggered by a WebSocket pong signal.
CVE-2026-102557: Addresses a heap buffer overflow during a WebSocket message.
CVE-2026-102558: Fixes a heap buffer overflow during WebSocket handling.
CVE-2026-102559: Resolves a heap buffer overflow during WebSocket handling.
CVE-2026-102560: Addresses a heap buffer overflow during outgoing WebSocket data.
CVE-2026-15711: Fixes a WebSocket denial of service via an oversized control frame.
CVE-2026-15714: Corrects an out-of-bounds read in the WebSocket code.
CVE-2026-12547: Addresses the Proxy-Authorization header leading to a credential leak.
CVE-2026-66339: Fixes proxy credentials leaking to the destination server.
CVE-2026-103399: Corrects incomplete request body draining in HTTP/1.x.
CVE-2026-15713: Fixes the SoupCache HTTP/2 frame window accounting.

python313 3.13.16:

CVE-2026-82049: Fixes a tarfile archive using a hard link to a symbolic link to change permissions and modification time of a file outside the destination directory.
CVE-2026-19672: Addresses the tarfile extraction filters creating directories outside the destination for members whose name leaves and returns to it.
CVE-2026-15310: Bounds the amount of data zipfile decompresses per read for bzip2, LZMA, and Zstandard members.
CVE-2026-19553: Makes asyncio validate the server_hostname argument when a check-hostname SSL context is supplied.
CVE-2026-19445: Fixes a crash in ssl when an sni_callback switches a connection to another SSL context.
CVE-2026-17084: Stops stringprep and encodings.idna from considering Unicode codepoint attributes beyond RFC 3454.
CVE-2026-15806: Scopes HTTPPasswordMgr credentials to the URL scheme so HTTPS credentials are not reused for HTTP.

perl-Cpanel-JSON-XS 4.80:

CVE-2026-110672: Fixes a hash-key leak when duplicate keys are rejected or a colon is missing.
CVE-2026-110673: Charges allow_tags parenthesis nesting against max_depth to prevent a stack overflow.
CVE-2026-110674: Makes bare keys resolve as UTF-8 so the duplicate check no longer misses or crashes on non-ASCII keys.
CVE-2026-110675: Validates bare hash keys as UTF-8 like quoted keys.
CVE-2026-110676: Compacts allow_bignum Math::BigFloat values with huge exponents.
CVE-2026-110677: Fixes dupkeys_as_arrayref reference counts that leaked every array.
CVE-2026-110678: Applies max_size to buffered text in every incr_parse context.
CVE-2026-110680: Bounds the canonical key snapshot for growing tied or shared hashes.
CVE-2026-110681: Clones callbacks and buffer SVs on ithread clone instead of sharing the parent’s pointers.
CVE-2026-110682: Rejects a top-level number, true, false, or null unless allow_nonref was set explicitly.
CVE-2026-110684: Releases temporary references when stringifying overloaded objects.
CVE-2026-110685: Frees a tag and its arguments when THAW dies.
CVE-2026-110686: Keeps filter callbacks alive while they run to avoid a use-after-free when a filter removes itself.
CVE-2026-110687: Sorts byte-string keys as Latin-1 in canonical mode.
CVE-2026-110688: Validates UTF-8 only up to the end of decoded text in incr_parse, avoiding quadratic CPU use.

python-pypdf 6.21.2:

CVE-2026-113786: Opens /DCTDecode image data only with the Pillow JPEG plugin.
CVE-2026-113789: Improves performance and limits field work during parsing.
CVE-2026-113790: Limits the work performed while parsing streams.
CVE-2026-113791: Adds parsing limits to reduce resource exhaustion.
CVE-2026-113792: Prevents cyclic tree handling.
CVE-2026-113793: Further hardens tree traversal against cycles.
CVE-2026-113795: Limits filter counts and accumulated decoding work per stream.
CVE-2026-113794: Bounds streaming decode work to prevent resource exhaustion.

busybox:

CVE-2026-88830: Fixes a pre-authentication heap buffer overflow in the TLS code.
CVE-2026-88831: Corrects the httpd silently failing open when IP deny rules contain an invalid CIDR prefix length.
CVE-2026-88832: Addresses a heap buffer overflow when parsing the volume ID of crafted romfs filesystem images.
CVE-2026-88835: Fixes an out-of-bounds read in dpkg read_package_field() stepping past the buffer.
CVE-2026-88837: Corrects the httpd misidentifying yescrypt password hashes as plaintext.
CVE-2026-88839: Resolves an out-of-bounds write of heap pointers in the passwd and group parser.
CVE-2026-88841: Fixes an out-of-bounds read and silent corruption of the dpkg status file at a cursor between package stanzas.

xen 4.22.0:

CVE-2026-79607: Fixes Xenstore allowing guests to influence host state.
CVE-2026-79608: Addresses an ineffectual mitigation on x86 and AMD processors.
CVE-2026-79609: Resolves XPTI breaking on x86.
CVE-2026-79610: Fixes a double free in the grant table code.
CVE-2026-79611: Corrects a VMentry failure in the VMX code.

cups 2.4.20:

CVE-2026-55480: Fixes the scheduler not opening temporary PPD files in exclusive mode.
CVE-2026-61702: Addresses the scheduler not validating the request language value.
CVE-2026-87875: Fixes cupsUTF32toUTF8 incorrectly treating UTF-32 values as 64-bit.
CVE-2026-87876: Corrects quota and policy operations not treating usernames as case-sensitive.
CVE-2026-55453: Resolves the backend not sanitizing IPP attribute strings.
CVE-2026-55467: Fixes the scheduler not sanitizing fax numbers.
CVE-2026-105326: Addresses the mailto notifier not sanitizing the recipient address passed to the sendmail command.

expat 2.9.0:

CVE-2026-102633: Fixes an integer overflow in expat_realloc on 32-bit platforms.
CVE-2026-77214: Corrects an out-of-bounds read in XML_ParseBuffer due to missing validation of the length parameter.
CVE-2026-93990: Rejects high surrogates not followed by a low surrogate during UTF-16 decoding so malformed data cannot be smuggled into the application.

xorg-x11-server & xwayland:

CVE-2026-88812: Fixes an XKB SetGeometry text doodad double free.
CVE-2026-93515: Fixes a use-after-free in the Present extension.
CVE-2026-93516: Fixes a use-after-free in XInput passive grab handling.
CVE-2026-93517: Fixes a heap buffer overflow in GLX RenderLarge.
CVE-2026-93518: Fixes a numeric truncation in XKB ResizeKeyType.
CVE-2026-93519: Fixes a buffer overflow in the XFixes pointer barrier event list.
CVE-2026-93520: Fixes a heap out-of-bounds write in XKB ChangeKeycodeRange.
CVE-2026-93521: Fixes a heap buffer overflow in RandR ChangeProviderProperty.
CVE-2026-93522: Fixes a heap buffer overflow in the Glamor CopyArea path.
CVE-2026-93523: Fixes an out-of-bounds write in XInput2 PassiveUngrabDevice.
CVE-2026-93524: Fixes an out-of-bounds read in XKB SetMap.
CVE-2026-93536: Fixes a use-after-free in the gesture sprite build.

libXi:

CVE-2026-93541: Fixes XQueryDeviceState not checking the ValuatorClass num_valuators value.
CVE-2026-93542: Bounds XI2 class lengths when copying classes.
CVE-2026-93543: Enforces the XI2 per-type class limit when copying classes.
CVE-2026-93544: Corrects XIQueryDevice keeping padded name and class bytes.
CVE-2026-93545: Addresses XListInputDevices not validating device name lengths again.
CVE-2026-94281: Validates class lengths cumulatively in XListInputDevices.
CVE-2026-94282: Fixes wireToEnterLeave not validating buttons_len against the reply.
CVE-2026-109089: Addresses a heap buffer overflow when the XGetDeviceControl reply control type does not match the request.
CVE-2026-109090: Fixes a heap buffer overflow in the XGetDeviceControl DEVICE_ENABLE reply size.

libXtst:

CVE-2026-94286: Fixes parse_reply_call_callback not checking the element size against the reply.
CVE-2026-109088: Rejects zero-progress records in parse_reply_call_callback.

libX11 1.8.14:

CVE-2026-94283: Bounds the XIM_OPEN_REPLY attribute lengths in the ximcp code.
CVE-2026-94284: Bounds the XIM_REGISTER_TRIGGERKEYS keylist lengths in the ximcp code.
CVE-2026-94285: Corrects lcGenConv bounding the reads in byteM_parse_codeset().

libXpm 3.5.20:

CVE-2026-94287: Fixes ParsePixels accepting zero-dimension XPM images.

libpng16:

CVE-2026-46675: Fixes a use-after-free of zlib input in png_read_end after incomplete zTXt, iTXt, or iCCP decompression.

libaom 3.15.2:

CVE-2026-56208: Fixes a heap buffer overflow in the AV1 encoder LAP mode.
CVE-2026-56209: Addresses a bounds-check bypass in AV1E_SET_SVC_LAYER_ID.
CVE-2026-56210: Resolves an out-of-bounds heap read via an unchecked SVC layer ID.
CVE-2026-56211: Fixes an out-of-range SVC layer selection.
CVE-2026-13906: Addresses a heap out-of-bounds read in the AV1 decoder.

GIMP:

CVE-2026-96546: Fixes a one-byte out-of-bounds heap read in the uncompressed DDS loader.
CVE-2026-97185: Resolves an out-of-bounds write in the GIMPressionist plugin via a crafted preset file.

python-Pillow 13.0.0:

CVE-2026-112390: Fixes an imaging library vulnerability addressed in the 13.0.0 release.
CVE-2026-112391: Addresses an imaging library vulnerability addressed in the 13.0.0 release.
CVE-2026-112392: Resolves an imaging library vulnerability addressed in the 13.0.0 release.
CVE-2026-112393: Corrects an imaging library vulnerability addressed in the 13.0.0 release.
CVE-2026-112394: Patches an imaging library vulnerability addressed in the 13.0.0 release.
CVE-2026-112395: Fixes an imaging library vulnerability addressed in the 13.0.0 release.
CVE-2026-112396: Addresses an imaging library vulnerability addressed in the 13.0.0 release.
CVE-2026-112397: Resolves an imaging library vulnerability addressed in the 13.0.0 release.
CVE-2026-112398: Corrects an imaging library vulnerability addressed in the 13.0.0 release.
CVE-2026-112399: Patches an imaging library vulnerability addressed in the 13.0.0 release.
CVE-2026-112400: Fixes an imaging library vulnerability addressed in the 13.0.0 release.
CVE-2026-112401: Addresses an imaging library vulnerability addressed in the 13.0.0 release.
CVE-2026-112402: Resolves an imaging library vulnerability addressed in the 13.0.0 release.
CVE-2026-112403: Corrects an imaging library vulnerability addressed in the 13.0.0 release.
CVE-2026-112404: Patches an imaging library vulnerability addressed in the 13.0.0 release.
CVE-2026-112405: Fixes an imaging library vulnerability addressed in the 13.0.0 release.
CVE-2026-112406: Addresses an imaging library vulnerability addressed in the 13.0.0 release.
CVE-2026-112891: Resolves an imaging library vulnerability addressed in the 13.0.0 release.
CVE-2026-112892: Corrects an imaging library vulnerability addressed in the 13.0.0 release.
CVE-2026-112893: Patches an imaging library vulnerability addressed in the 13.0.0 release.
CVE-2026-112894: Fixes an imaging library vulnerability addressed in the 13.0.0 release.
CVE-2026-112895: Addresses an imaging library vulnerability addressed in the 13.0.0 release.
CVE-2026-112896: Resolves an imaging library vulnerability addressed in the 13.0.0 release.
CVE-2026-112897: Corrects an imaging library vulnerability addressed in the 13.0.0 release.
CVE-2026-112898: Patches an imaging library vulnerability addressed in the 13.0.0 release.
CVE-2026-112899: Fixes an imaging library vulnerability addressed in the 13.0.0 release.
CVE-2026-112900: Addresses an imaging library vulnerability addressed in the 13.0.0 release.
CVE-2026-112901: Resolves an imaging library vulnerability addressed in the 13.0.0 release.

brotli 1.2.1:

CVE-2026-111497: Fixes an out-of-bounds write that permitted remote code execution.

libtirpc 1.3.8:

CVE-2026-85977: Caps decoded pmap and rpcb XDR list lengths to 1024 nodes to prevent memory exhaustion.
CVE-2026-85231: Caps RPCSEC_GSS wrapped payload decoding at 16 MB to prevent an authenticated remote denial of service.

ghostscript 10.08.0:

CVE-2026-39919: Fixes a heap buffer overflow in the JPEG 2000 output adapter caused by a component subsampling mismatch.
CVE-2026-103226: Addresses a stack buffer overflow from an unbounded ipstack push in the pdfwrite Type 1 to Type 2 font converter.
CVE-2026-101258: Fixes a heap buffer overflow via an array-wrapped shading /Function.

QEMU 11.1.2:

CVE-2026-81627: Confines the VAPIC region to the 0xc0000..0xe0000 range.
CVE-2026-93834: Fixes the 9pfs device mutating the FID path from the main thread only.
CVE-2026-17588: Sets a reentrancy guard in the xHCI USB controller timer functions.

open-iscsi:

CVE-2026-18724: Fixes a stack buffer overflow in idbm record parsing.
CVE-2026-18725: Fixes an out-of-bounds access in iscsiuio ICMPv6 echo handling.
CVE-2026-18726: Fixes a denial of service in iscsiuio Router Advertisement parsing.
CVE-2026-18727: Fixes an integer underflow in iscsiuio DHCPv6 parsing.
CVE-2026-18728: Fixes an integer underflow in iscsiuio IPv4 DHCP parsing.

polkit 128:

CVE-2026-4897: Fixes an authentication-helper input overflow.
CVE-2026-85498: Addresses a second authentication-helper input vulnerability.

GraphicsMagick 1.3.49:

CVE-2026-103118: Fixes uncontrolled recursion in the WPG file handler when processing self-referencing crafted WPG files.
CVE-2026-109964: Addresses a heap buffer underwrite in the PICT decoder.
CVE-2026-42326: Resolves a heap buffer over-read in IPTC attribute parsing.

cups-filters:

CVE-2026-95511: Fixes a root arbitrary file overwrite through a serial device URI path that let the lpadmin user escalate privileges.

python-urllib3 2.8.0:

CVE-2026-97687: Fixes the TLS configuration for HTTPS proxies being ignored or overridden.
CVE-2026-97688: Addresses chunked Deflate streaming entering an infinite loop.
CVE-2026-97689: Corrects HTTPResponse.stream() and read_chunked() buffering a chunk-size line of unbounded length in memory.

libsndfile:

CVE-2026-88386: Fixes a misaligned memory access issue in psf_binheader_readf().
CVE-2026-88372: Fixes an integer overflow in mat4_read_header().
CVE-2022-33065: Adds another fix for the older header read overflow.

alsa:

CVE-2026-96674: Fixes an integer overflow in the topology control code.
CVE-2026-96675: Corrects binding index validation in the multi plugin.

gcc16 16.2.1:

CVE-2026-102010: Fixes a use-after-free in __gnu_pbds::priority_queue.

cyrus-sasl:

CVE-2026-107161: Fixes a heap-based buffer overflow in the DIGEST-MD5 add_to_challenge() function.

yast2-users:

CVE-2026-59680: Fixes an OS command injection via the LDAP-supplied shadowLastChange and shadowExpire attributes.

emacs:

CVE-2026-79992: Corrects an incomplete fix for the earlier Emacs vulnerability.

python-M2Crypto:

CVE-2026-109087: Fixes hostname verification being vulnerable to subjectAltName injection.

python-Twisted:

CVE-2026-106454: Addresses nested or otherwise expensive regular expression constructs causing catastrophic backtracking when matched against mailbox names.

oath-toolkit:

CVE-2026-109117: Fixes a PSKC signature verification bypass in libpskc.

poppler 26.10.0:

CVE-2026-107705: Fixes a stack buffer overflow when opening AESV3/R6 encrypted PDFs.

libvpx 1.17.0:

CVE-2026-2447: Fixes a heap buffer overflow from a missing buffer full check in write_superframe_index().

live555:

CVE-2025-65406: Makes the BasicTaskScheduler honor FD_SETSIZE in the select loop instead of a hardcoded descriptor limit.

freetype 2.15.0:

CVE-2026-27171: Applies the upstream zlib security fix to the internal gzip code.

pcre2 10.49:

GHSA-r9hj-j2rw-4q3m: Fixes an out-of-bounds write in JIT matching with large stack allocations.

ImageMagick 7.1.2.34:

CVE-2026-106570: Fixes a denial of service in the distributed pixel cache server.

sbc:

CVE-2026-16473: Fixes an off-by-one error in sbc_unpack_frame_internal.

libevent 2.1.13:

CVE-2026-63379: Discards HTTP trailers to block header smuggling attacks.
CVE-2026-63381: Fixes a dangling pointer in evbuffer_add_reference.
CVE-2026-63382: Restricts HTTP header parsing to prevent request smuggling.
CVE-2026-63383: Fixes an out-of-bounds read in decode_tag_internal.
CVE-2026-63384: Fixes an integer overflow in evtag_unmarshal_header.
CVE-2026-63385: Treats CRLF and %00 more strictly in HTTP headers to prevent parser mismatch attacks.
CVE-2026-63387: Fixes an out-of-bounds write in dnsname_to_labels when a DNS response reaches 65,536 bytes.
CVE-2026-63388: Fixes a heap out-of-bounds write with AF_UNIX sockets in -DNDEBUG builds.

binutils:

CVE-2026-91781: Fixes a null pointer dereference in elf_x86_64_common_section_index when reading ELF sections.
CVE-2026-90828: Fixes a null pointer dereference in the linker’s elf_orphan_compatible handling.
CVE-2026-19548: Fixes multiple use-after-free issues in add_archive_element when plugin claims free the original BFD object.
CVE-2026-15003: Fixes a heap buffer overflow read when the linker processes a crafted 32-bit XCOFF object.

libsolv 0.7.41:

CVE-2026-104621: Fixes XML parsing in the conda repository reader.
CVE-2026-104622: Hardens the APK v3 reader against malformed input.
CVE-2026-104624: Hardens the APK v3 reader against a related malformed input case.

389-ds:

CVE-2026-86344: Prevents worker thread exhaustion from incomplete LDAP messages sent in rapid succession.
CVE-2026-86345: Prevents response forgery and authentication bypass from plaintext commands smuggled alongside StartTLS requests.

samba 4.25.1:

CVE-2026-109411: Closes an access control bypass through vfs_ceph_rgw case-insensitive opens.

speex:

CVE-2026-116741: Fixes an out-of-bounds write in speex_bits_read_whole_bytes().

Users are advised to update to the latest versions to mitigate these vulnerabilities.

Conclusion

October was one of the busiest months of the year for openSUSE Tumbleweed, with twenty-three snapshots delivering new desktop features and a heavy security payload. KDE Plasma 6.8.0 improved Wayland pointer behavior and fixed screencast and screenshot crashes, KDE Plasma 6.8.1 then tightened Klipper, Spectacle, PowerDevil, and scripted panels, KDE Frameworks 6.31.0 refreshed KIO, Syntax Highlighting, and KTextEditor, and Qt reached 6.12.0. Firefox shipped 157.0.1, 158.0, and 158.0.1, closing out three rounds of Mozilla security advisories, while tmux 3.8 finally brought floating panes with modal variants, titles, border styles, and themes. On the toolchain side, GCC reached 16.2.1, LLVM 23.1.3 and 23.1.4 landed with bugfixes, Git 2.56.0 arrived with a rewritten git refs toolbox, and GnuPG 2.5.24 brought RFC 9980 post-quantum encryption; sqlite3 3.54.1, harfbuzz 15.0.0, and mariadb 13.0.2 closed the month with substantial feature work. The Linux kernel advanced through 7.2.9, 7.2.10, and 7.2.11 before the 7.3.0 base landed, with 91 CVEs addressed in the point releases, Mesa settled on 26.2.5 with Rusticl decoupled from a fixed libclc version, and OpenSSH 10.6p1 began deprecating the fragile scp -R remote copy option. Tumbleweed patterns also stopped recommending YaST for new installations, leaving the packages available without pulling them into defaults. Security dominated the second half of the month. curl 8.23.0 fixed 23 issues including an HTTP/2 upload use-after-free and several credential leaks, libsoup patched a run of WebSocket heap overflows, Pillow 13.0.0 addressed 28 CVEs, bind, unbound, krb5, spice, and mariadb all shipped focused security releases, busybox corrected seven flaws including a httpd rule that failed open, and the X.org libraries, xen, cups, and polkit all received substantial hardening. Users who keep their systems current with zypper will already have these fixes, and anyone who skipped updates over the month should make time to catch up.

Slowroll Arrivals

Please note that these updates also apply to Slowroll and arrive between an average of 5 to 10 days after being released in Tumbleweed snapshot. This monthly approach has been consistent for many months, ensuring stability and timely enhancements for users. Updated packages for Slowroll are regularly published in emails on openSUSE Factory mailing list.

Contributing to openSUSE Tumbleweed

Stay updated with the latest snapshots by subscribing to the openSUSE Factory mailing list. For those Tumbleweed users who want to contribute or want to engage with detailed technological discussions, subscribe to the openSUSE Factory mailing list . The openSUSE team encourages users to continue participating through bug reports, feature suggestions and discussions.

Your contributions and feedback make openSUSE Tumbleweed better with every update. Whether reporting bugs, suggesting features, or participating in community discussions, your involvement is highly valued.

Planet News Roundup

admin@opensuse.org (Douglas DeMaio) — Fri, 30 Oct 2026 08:00:00 +0000

This is a roundup of articles from the openSUSE community listed on planet.opensuse.org. This community blog feed aggregator lists the featured highlights below from Oct. 23 - 29.

This week highlights five Tumbleweed snapshots for week 43 headlined by KDE Plasma 6.8.0, Qt 6.12.0, Linux Kernel 7.2.11 and PHP 8.5.12, which fixes the critical “PHP2Shell” vulnerabilities, along with the second Plasma 6.8 update, Agama 25, the announcement that esLibre 2027 will be held in Barcelona, the Akademy-es 2026 Madrid group photos, the start of the 2026 openSUSE Board Election, a guide to installing VMware Remote Console on Tumbleweed, the final days of Slimbook Days, Linux Saloon 225 and a GNU/Linux València gaming event.

Here is a summary and links for each post:

Last Days of the October 2026 Slimbook Days

The KDE Blog highlights the final days of Slimbook Days, running Oct. 19-31 with discounts across the Slimbook lineup. Baltasar Ortega notes that Slimbook tunes its Linux systems for full GNU/Linux compatibility and that component prices keep rising, so waiting for a short-term drop is unlikely to pay off. He also states that the post is not sponsored and that his relationship with Slimbook is that of a regular customer and friend.

esLibre 2027 Congress Will Be Held in Barcelona

The KDE Blog announces that the esLibre 2027 congress will take place in Barcelona on April 9 and 10 at the Historic Building of the University of Barcelona. It notes that the event is being organized with Barcelona Free Software and the Faculty of Mathematics and Computer Science, recaps the conference’s history since 2019 and advises attendees to book accommodation early.

Second Plasma 6.8 Update

The KDE Blog announces Plasma 6.8.2, the second bugfix update to Plasma 6.8, released on Oct. 27, 2026. It recaps the 6.8 highlights, including the Hanabi wallpaper, Nepali calendar support, GTK4 decoration fixes, Discover’s AppStream previews, the redesigned Flatpak permissions page and DrKonqi improvements.

Install VMware Remote Console on openSUSE Tumbleweed

Nathan Wolf’s blog explains how to install VMware Remote Console (VMRC) on openSUSE Tumbleweed from a .bundle installer that requires root access. It notes that VMRC helps manage ESXi and vSphere virtual machines with features such as USB redirection and improves efficiency for users working in non-native Linux environments.

Official Group Photo of Akademy-es 2026 Madrid 20th Anniversary #akademyes

The KDE Blog shares the official group photo from Akademy-es 2026 Madrid, taken after Saturday’s talks in the Sierra de Madrid. Baltasar Ortega highlights the mix of familiar and new faces and says he is already looking forward to Akademy-es 2027.

Akademy-es 2026 Madrid 20th Anniversary Group Photo #akademyes

The KDE Blog shares a group photo from Akademy-es 2026 Madrid as the event closes with a hiking outing, showing attendees alongside cakes marking the 20th anniversary of Akademy-es and KDE’s 30th anniversary. Baltasar Ortega, who could not attend, describes the gathering as intimate and waits for the videos and presentation materials.

Linux Saloon 225 | Vim Motions Tutor

Nathan Wolf’s blog recaps Linux Saloon 225, where Mike Chilson demonstrated DevsFTP and participants discussed backup solutions and their Linux experiences. The show invites community suggestions for future application topics and shares project links for continued learning.

openSUSE Board Election 2026 Begins

openSUSE News announces the start of the 2026 openSUSE Board Election, with three Board seats up for election and a target completion date of Dec. 1, 2026. It lists the timeline from nominations on Oct. 24 through results on Nov. 23 and explains how eligible members can stand for election and publish a platform.

Fixing All the Bugs, PiP and Performance – This Week in Plasma

The KDE Blog translates Nate Graham’s latest “This Week in Plasma,” covering the Plasma 6.9 work that followed the 6.8 release. It highlights Wayland Picture-in-Picture support enabled by default in KWin, per-screen-layout window size and position memory, browser integration improvements and a long list of Plasma 6.8.1 and 6.8.2 bug fixes.

Tumbleweed – Review of the Week 2026/43

Dominique Leuenberger and Victorhck detail the five snapshots (1016, 1017, 1018, 1020 and 1021) and major arrivals such as KDE Plasma 6.8.0, Qt 6.12.0, Linux Kernel 7.2.11, Mesa 26.2.5 and PHP 8.5.12, which fixes the critical “PHP2Shell” remote code execution flaws. They also cover curl 8.23.0, Mozilla Firefox 158.0, polkit 128, containerd 2.3.3, systemd 261.4 and Memtest86+ 9.00, and preview staging work on GNOME 51.1, Linux Kernel 7.3.0, Ruby 4.0.9, Go 1.27.3 and VirtualBox 7.2.22.

Gaming on Linux + Help and Installation Workshop, New Event Organized by GNU/Linux València

The KDE Blog announces a GNU/Linux València event on Oct. 30 at Las Naves in Valencia, starting with a 17:00 install and help workshop followed by an 18:30 talk on the past, present and future of gaming on Linux. The free event covers tools such as Wine and Proton, the Steam Deck and challenges such as anti-cheat support.

Agama 25 Released

Victorhck’s blog announces Agama 25, the first release after openSUSE Leap 16.1 and the start of work toward Tumbleweed, Slowroll and Leap 16.2. It adds a terminal in the web interface, an exit option before installation begins, searchable multi-select port selection and reduced reliance on YaST packages.

View more blogs or learn to publish your own on planet.opensuse.org.

openSUSE Board Election 2026 Begins

admin@opensuse.org (openSUSE Election Committee) — Sat, 24 Oct 2026 12:00:00 +0000

The openSUSE Election Committee has announced the start of the 2026 openSUSE Board Election. Three Board seats are up for election, and all eligible openSUSE members are encouraged to take part.

The openSUSE Board asked for the election to be completed by Dec. 1, 2026, as outlined in Board ticket #108. More information is available on the openSUSE wiki.

Election Timeline

Oct. 24, 2026: Election announced; call for nominations and applications for Board candidacy; membership drive begins
Nov. 14, 2026: Final list of candidates announced; campaign begins; membership database sealed (new members can still apply and vote, but can no longer run as candidates in this election)
Nov. 15, 2026: Ballots open; campaign continues
Nov. 22, 2026: Ballots close
Nov. 23, 2026: Election results announced

How to Participate

The Election Committee encourages all eligible openSUSE members to consider standing for election or nominating fellow community members. Serving on the Board is an opportunity to contribute to the direction and governance of the openSUSE Project.

To stand for election, send your application to both:

project@lists.opensuse.org
election-officials@opensuse.org

Election Platforms

All candidates are expected to publish an election platform introducing themselves, their involvement in the openSUSE Project, and their motivation and priorities for serving on the Board. An example platform from the previous election is available on the wiki.

Platforms should be published before the final candidate list is announced on Nov. 14.

Election Rules

According to the openSUSE Board Election Rules, the nomination period may be extended if not enough candidates come forward. Any changes to the schedule will be communicated accordingly. The sitting Board may also appoint members to fill vacant seats if not enough candidates are elected.

The original announcement was sent to the project mailing list.

Planet News Roundup

admin@opensuse.org (Douglas DeMaio) — Fri, 23 Oct 2026 08:00:00 +0000

This is a roundup of articles from the openSUSE community listed on planet.opensuse.org. This community blog feed aggregator lists the featured highlights below from Oct. 16 - 22.

This week highlights seven Tumbleweed snapshots for week 42 headlined by Linux Kernel 7.2.10, KDE Gear 26.08.2 and Mozilla Firefox 157.0.1, the first Plasma 6.8 update and the seventh Plasma 6.6 update, Tellico’s 25th anniversary, the KDE documentary, Agama 25, the Akademy-es 2026 Madrid program and preview, a report from the openSUSE.Asia Summit and Open Source Summit Europe, September Kudos, a deep look at vllm.cpp and more.

Here is a summary and links for each post:

Akademy-es 2026 Madrid 20th Anniversary Begins Tomorrow

The KDE Blog reminds readers that Akademy-es 2026 Madrid kicks off tomorrow, Oct. 23, and runs through Oct. 25 at Camping Arco Iris in Villaviciosa de Odón. Baltasar Ortega recaps the build-up, including the talk program, gold sponsor openSUSE, silver sponsor Slimbook, registration and 10 reasons to attend. He notes he cannot attend in person this year and will live vicariously through the photos and updates from Madrid.

Building syslog-ng with bundled ivykis on FreeBSD

Peter Czanik’s blog explains that the syslog-ng FreeBSD port currently uses ivykis from ports, even though the project carries FreeBSD-specific fixes in its own ivykis fork. He is working on making the bundled ivykis selectable and invites testing and help.

VLLM.CPP: A New Engine Is Born

Alessandro’s blog examines vllm.cpp, LocalAI’s C++20 inference engine that brings vLLM-style continuous batching, paged KV caching and an OpenAI-compatible server without requiring Python or PyTorch inside the engine. It compares the project with vLLM and llama.cpp, reviews its C API, formats and hardware backends, and cautions that multi-GPU support, multimodal input and some KV-cache features remain incomplete.

First Plasma 6.8 Update

The KDE Blog announces Plasma 6.8.1, the first bugfix update to Plasma 6.8, released on Oct. 20, 2026. It recaps the 6.8 highlights, including the Hanabi wallpaper, Nepali calendar support, GTK4 decoration fixes, Discover’s AppStream previews and the redesigned Flatpak permissions page.

Releasing Agama 25

The Agama Installer announces Agama 25, the first release after openSUSE Leap 16.1 and the start of work toward Tumbleweed, Slowroll and Leap 16.2. It adds a web-based terminal, an exit option available before installation begins, searchable multi-select bond and bridge port selection, riscv64 support contributed by Andreas Schwab, and reduced reliance on YaST packages. It also publishes the OpenAPI specification and JSON schemas at stable URLs for autocompletion and validation in editors.

Seventh Plasma 6.6 Update

The KDE Blog covers Plasma 6.6.7, released Oct. 16, 2026, as the seventh maintenance update in the 6.6 series. It notes that the series has received extra updates through an agreement with KUbuntu Focus and lists 6.6 features such as Plasma Keyboard, OCR in Spectacle, Plasma Setup, custom global themes and colorblind filters.

Budapest Audio Expo 2026

Peter Czanik’s blog reports on the third Budapest Audio Expo, where his favorite room paired NCS Audio, Qualiton and Pixel cables for a clear, lively sound at a relatively affordable price. He also praises 72 Audio, the Natural Distortion prototype DAC and amp with Popori Acoustics speakers, and a Heed Audio Helikon and Zellaton setup, while criticizing overprocessed room-correction demos.

September Kudos, Recognition

openSUSE News publishes the September Kudos report, noting that 14 users received 14 kudos and 152 badges were awarded to 136 contributors. It lists thank-you notes for contributors such as Adrian Schröter, Bernhard Wiedemann, Dominique Leuenberger and Santiago Zarate, and highlights Tumbleweed, Leap 16.0/16.1 and LinuxDays badges.

The KDE Blog translates Nate Graham’s latest “This Week in Plasma,” covering the new Plasma 6.9 weather widget with hourly forecasts and Open-Meteo support, a redesigned on-screen keyboard, a temporary night-light toggle and smaller tray icons. It also covers Plasma 6.8.1 fixes, clipboard shortcut reorganization and Qt 6.13 font hinting improvements.

Tellico Turns 25 – Long Live Tellico!

The KDE Blog celebrates Tellico’s 25th anniversary with a timeline from the first Bookcase 0.1 release in November 2001 through its renaming to Tellico, its move to KDE Extragear and the Qt6/KDE Frameworks 6-based Tellico 4.0. The post also explains how the collection manager works and highlights its customizable fields and built-in collection types.

Linux Saloon 224 | Open Mic Night

Nathan Wolf hosts Linux Saloon 224 as an open mic night, where Mike Chilson demonstrated DevsFTP and discussed backup solutions. Participants shared their Linux experiences, and the show invites community suggestions for future application topics.

On GenAI LLMs and Knowledge Workers

Santiago Zarate reflects on how LLMs and agents may reshape knowledge work, starting from a Telegram poll of Venezuelan programmers about whether the future remains human. He compares the change to spreadsheets, factory robots and automated telephone exchanges, argues that automation changes jobs more than it eliminates them, and urges readers not to panic while warning that developers still need real fundamentals.

Tumbleweed – Review of the Week 2026/42

Dominique Leuenberger and Victorhck detail the seven snapshots and major arrivals such as libvirt 12.8.0, libnettle 4.0, KDE Gear 26.08.2, WebKitGTK 2.54.1, GStreamer 1.28.8 and Nautilus 50.4. They also explain the mutter revert that restored clipboard copy and paste, the ktextaddons ABI fix and the cups-filters hardening, and previews staging work on Plasma 6.8.0, Qt 6.12.0 and more.

The KDE Documentary

Martin Schlander’s blog recommends the KDE 30th-anniversary documentary, calling it a high-quality production that covers the project’s most significant events. He notes that it also touches on Qt, GNU, Linux and GNOME and features legendary SUSE developers.

Akademy-es 2026 Madrid 20th Anniversary Talk Program #akademyes

The KDE Blog shares the talk program for Akademy-es 2026, taking place Oct. 23-24 at Camping Arco Iris in Villaviciosa de Odón, Madrid. The 20th-anniversary event includes a QML workshop, talks on KDE España, Plasma and low vision, Okular, Autofirma on Flathub, data-center sustainability and plenty of time for socializing.

Liberec Dam

Jakub Steiner shares a drone video of the restored Harcovská přehrada dam in Liberec, Czechia, after a major reconstruction that removed 26,000 cubic meters of silt and replaced the dam’s outlets while preserving its landmark appearance. He also recalls filming the drained basin in 2022, notes the dam is now rated for a 10,000-year flood, and admits the dam has claimed another one of his drones.

KDE Documentary: A History of the Underdogs of Free Software

The KDE Blog highlights CultRepo’s KDE documentary, “A History of the Underdogs of Free Software,” which premiered on Oct. 14 for KDE’s 30th anniversary. The film traces KDE from Matthias Ettrich’s 1996 Usenet post through the Qt licensing struggle, the KHTML-to-WebKit story, the KDE 4 controversy and the community’s role in today’s Linux desktops.

From Yogyakarta to Prague: openSUSE.Asia Summit and Open Source Summit Europe 2026

openSUSE News reports on a two-continent trip to the openSUSE.Asia Summit in Yogyakarta and Open Source Summit Europe in Prague. The post covers the Asia summit’s community news, quiz, offsite turtle release and batik workshop, the adoption of Kudos, a new 14:00 CEST Tuesday meeting time, and a busy Prague booth featuring a 64-core RISC-V workstation running Tumbleweed and QtRvSim.

View more blogs or learn to publish your own on planet.opensuse.org.

September Kudos, Recognition

admin@opensuse.org (openSUSE Kudos Team) — Mon, 19 Oct 2026 11:00:00 +0000

Welcome to our monthly report from the openSUSE Kudos recognition platform, where we take a moment to put a spotlight on the people who stepped up, helped others, and made this community a little brighter.

During the month of September 2026, 14 users received 14 kudos, and 152 badges were awarded to 136 contributors. You can see stats for this and previous months.

Spotlight

September spread its thanks evenly, with fourteen people each receiving a kudo: @adrianSuSE, Bernhard Wiedemann (@bmwiedemann), Dominique Leuenberger (@dimstar), Geetansh Goyal (@geetxnshgoyal), @hennevogel, Imobach Gonzalez Sosa (@IGonzalezSosa) and eight more.

Kudos

Here are the thank-you notes themselves: 14 peer-to-peer kudos written by contributors about contributors, grouped by the person being thanked.

@adrianSuSE received a kudo:

From @lkocman in Infrastructure Heroes

“Many thanks for always being around and always willing to help Adrian!”

Bernhard Wiedemann (@bmwiedemann) received a kudo:

From @jsegitz in Code & Engineering

“Thank you for your tireless work on reproducible builds!”

Dominique Leuenberger (@dimstar) received a kudo:

From @lkocman in Code & Engineering

“Reporting a bug is great, but submitting a fix right out of the gate is next level. Especially if it is for a spicy architecture like s390x. Thank you DimStar!”

Geetansh Goyal (@geetxnshgoyal) received a kudo:

From @ddemaio in Documentation and Publishing

“Many thanks for sharing your Google Summer of Code experience on news.o.o. A fantastic & article”

@hennevogel received a kudo:

From @akarsh in Code & Engineering

“Thanks for the quick reviews on my first OBS PR”

Imobach Gonzalez Sosa (@IGonzalezSosa) received a kudo:

From @lkocman in Code & Engineering

“Many thanks for making Agama changelog shiny and actually useful Imo!”

Jan Baier (@jbaier_cz) received a kudo:

From @lkocman in Code & Engineering

“Many thanks for your night watch over os-autoinst-distri-opensuse PRs Jan! You just helped to make Leap 16.1 RC greener in openQA”

Gertjan Lettink (@knurpht) received a kudo:

From @lkocman in Code & Engineering

“Many thanks for your quick feedback about opensuse-version-diff Gertjan. Your quick eye caught an obvious issue. Many thanks!”

Lubos Kocman (@lkocman) received a kudo:

From @ddemaio in Code & Engineering

“Your new #diff code makes openSUSE stronger every day. Especially with people getting immediate facts about the software versions in Leap and Tumbleweed.”

Max Lin (@mlin7442) received a kudo:

From @lkocman in Support & User Assistance

“Many thanks for all your tireless help with getting Leap 16.1 RC out of the door Yuchen!”

Martin Pluskal (@pluskalm) received a kudo:

From @kskarthik in Code & Engineering

“thanks a lot for the openSUSE packaging skills! it’s a very valuable assist in packaging chores”

Santiago Zarate (@szarate) received a kudo:

From @lkocman in Code & Engineering

“Many thanks for your awesome help with the Leap 16.1 immutable modes in openQA Santi! I’m super happy that thanks to you we were able to release RC in the same day as it landed in openQA! Many thanks again!”

@wrosenauer received a kudo:

From @bbreinbauer in Code & Engineering

“Thanks for working on Firefox and Thunderbird!”

@Zaitor received a kudo:

From @dimstar in Code & Engineering

“Thank you very much for all your endless work to make GNOME better for openSUSE. You do tremendous work.”

Badges

Contributors earned 12 different badges in September, and here is an overview of the 8 most awarded ones. The full list of badges you can earn is on the badges page.

100 Tumbleweed Contributions
For submitting 100 Submit Requests to openSUSE:Factory.
Awarded this month to @dimstar, @fstrba, @iznogood, @mcalabkova, @ojkastl_buildservice, @pushman and @StevenK.

10 Tumbleweed Contributions
For submitting 10 Submit Requests to openSUSE:Factory.
34 contributors earned this badge this month, too many to list here, but every one of them counts.

First Tumbleweed Contribution
For submitting 1 Submit Request to openSUSE:Factory.
81 contributors earned this badge this month, too many to list here, but every one of them counts.

Leap 16.0 Contributor
Recognition for submitting at least one pull request to Leap 16.0 or related appliance repositories on src.opensuse.org.
Awarded this month to @abergmann, @dimstar, @jirislaby, @jsmeix, @mschreiner, @rn and @vcarvalho.

Leap 16.1 Contributor
Recognition for submitting at least one pull request to Leap 16.1 or related appliance repositories on src.opensuse.org.
Awarded this month to @abergmann, @alois, @jirislaby, @jsmeix and @vcarvalho.

linuxdays.cz 2026
For supporting LinuxDays.cz 2026.
Awarded this month to @dancermak, @jbaier_cz and @VPetras.

Got First Kudo
Received your first kudos.
Awarded this month to @geetxnshgoyal, @jbaier_cz, @szarate, @wrosenauer and @Zaitor.

First Kudos Given
Shared your first kudos.
Awarded this month to @akarsh, @bbreinbauer, @jsegitz and @kskarthik.

Congrats on your kudos and badges. Keep up the great work everyone, and don’t forget to have a lot of fun!

Generated by kudos-bot-news-o-o from https://kudos.opensuse.org/api/reports/monthly for the period 1-30 September 2026.

Planet News Roundup

admin@opensuse.org (Douglas DeMaio) — Sat, 17 Oct 2026 08:00:00 +0000

This is a roundup of articles from the openSUSE community listed on planet.opensuse.org. This community blog feed aggregator lists the featured highlights below from Oct. 9 - 15.

This week highlights KDE’s 30th anniversary and the premiere of the KDE documentary, the launch of Plasma 6.8 as the 30th Anniversary Edition, five Tumbleweed snapshots headlined by Linux Kernel 7.2.9, Samba 4.25.0 and LibreOffice 26.8.1.1, a mid-October Tumbleweed ARM update, the 31st KDE Frameworks 6 update, Open Build Service’s new Content Moderation feature, the Advanced Weather Widget plasmoid, episode 7 of the “La era de las distros” podcast on Madrid’s MAX distribution, Linux Saloon 223 on Omarchy, an openQA slow-test deep dive, GNOME’s refreshed Pixels wallpaper and more.

Here is a summary and links for each post:

30 Years and 1 Day: KDE Keeps Giving Me Freedom and Functionality with the Best Design

Victorhck shares a personal user’s tribute to KDE the day after the project’s 30th anniversary, reflecting on 15 years of using KDE with openSUSE since 2011. He expresses gratitude for the freedom, flexibility and polish of Plasma and KDE applications, praises the global community behind the project, and encourages readers to support KDE with donations, including a nod to celebrating 30 years with 30€.

KDE Documentary

Sebastian Kügler reflects on KDE’s 30th anniversary and the premiere of the KDE documentary, in which he was interviewed as a former release manager, Plasma core developer and KDE e.V. board member. He also hints at a return to Free Software development with two new apps tied to his hobbies.

Plasma 6.8 Released, 30th Anniversary Edition

The KDE Blog celebrates KDE’s 30th anniversary with the release of Plasma 6.8, highlighting dozens of improvements across the desktop experience. Key changes include the new Hanabi default wallpaper, Nepali calendar support, GTK4 window decoration fixes, a redesigned Discover with AppStream previews and a modernized Flatpak permissions panel.

Pixels Wallpaper Update

Jakub Steiner shares an early look at the updated Pixels wallpaper for GNOME, built from app icons redrawn as chunky pixel art. This time the wallpaper ships in nine color variants, and he asks the community for feedback on contrast, backgrounds and grain before the release.

KDE’s 30th Anniversary – Congratulations to the Whole Community!

The KDE Blog marks KDE’s 30th anniversary on Oct. 14, tracing the project from Matthias Ettrich’s original 1996 announcement to today’s worldwide community. Baltasar Ortega reflects on the people and values of KDE and previews the Plasma 6.8 launch arriving the next day.

Thirty Years of KDE

Cornelius Schumacher looks back on 30 years of KDE, from joining in 1999 to the project’s current strength with the Steam Deck reach and Sovereign Tech Fund investment. He reflects on how KDE’s commitment to freedom shaped his career and life, and notes the KDE documentary premiering for the anniversary.

Tumbleweed ARM Update by mid-October

openSUSE News details Tumbleweed ARM updates from mid-September through mid-October, covering the kernel’s move from 7.2.6 to 7.2.9 with a long list of SBC and AArch64 security fixes. Highlights include binutils 2.47 with Armv9.6 and Armv9.7 instructions, QEMU 11.1.2 virtualization fixes and refreshed Wi-Fi and Bluetooth firmware for Raspberry Pi, Qualcomm and MediaTek boards.

The KDE Blog presents Advanced Weather Widget, the 41st entry in its Plasma 6 plasmoids series, a feature-rich weather applet by pnedyalkov. It supports multiple providers with automatic failover, detailed current conditions, radar maps, configurable KDE notifications and translations in 18 languages.

The Golden Age of LINUX in Spain. How MAX Was Created (with Its Original Developers) – Episode 7 of the Podcast “La era de las distros”

The KDE Blog promotes episode 7 of the podcast “La era de las distros,” which tells the story of Madrid’s MAX educational distribution through its original developers Ismail Ali-Gago, Carlos Salamanca and Mario Izquierdo. The episode covers the project’s humble technical beginnings and its role in digital sovereignty for Madrid’s classrooms.

The Content Moderation Feature Is Out For Everyone

The Open Build Service announces that its Content Moderation feature is now available to all users, giving the community tools to report, review and act on spam, abuse and other misconduct. Any user can report comments, users, projects, packages and requests using predefined categories.

31st KDE Frameworks 6 Update and the KDBusAddons Library

The KDE Blog covers the 31st update of KDE Frameworks 6, released Oct. 9, and continues its library deep-dive series with KDBusAddons. The post explains how KDBusAddons simplifies D-Bus work in Qt and KDE applications and provides a full listing of the Frameworks library tiers.

Linux Saloon 223 | Omarchy

Nathan Wolf hosts Linux Saloon 223 focused on Omarchy, with news including Discord’s age verification, Thunderbird for iOS and Ubuntu’s wiki overhaul. The episode also notes the shrinking Linux share among Steam users, Reddit dropping RSS feeds and upcoming show topics.

Anatomy of a slow test module

Zoltán Balogh dissects a slow support-server test module, explaining why wasted seconds in setup cost roughly three times as much since parallel nodes wait on the master. Through small, measured iterations he cut the SLE 15 SP7 SAP HANA scenario setup from 7m 37s to about 5m 10s and shares the patterns and lessons learned.

Final Touches for 6.8 – This Week in Plasma

The KDE Blog translates Nate Graham’s latest “This Week in Plasma,” covering the final polish on Plasma 6.8 ahead of its Oct. 14 release. The roundup lists interface tweaks for the weather applet, KRunner and Spectacle, plus bug fixes spanning Plasma 6.6.7 through 6.9 and Frameworks 6.32.

Tumbleweed – Review of the Week 2026/41

Dominique Leuenberger and Victorhck review five Tumbleweed snapshots (1001, 1002, 1003, 1005 and 1007), headlined by systemd 261.3, Mesa 26.2.4, NetworkManager 1.58.1, LibreOffice 26.8.1.1, Linux Kernel 7.2.9 and Samba 4.25.0. The roundup also notes a cups-filters2 revert that restored PDF and image printing, and previews staging updates including Plasma 6.8 Beta 2, libvirt 12.8.0 and fmt 12.2.0.

Barcelona Free Software: 30 Years of KDE

The KDE Blog announces a Barcelona Free Software talk on Oct. 21 celebrating KDE’s 30th anniversary, featuring KDE e.V. member and former KDE España president Albert Astals Cid. The event at Akasha Hub will share history, anecdotes and reflections on 30 years of KDE, followed by pizza and drinks courtesy of KDE España.

Tiny Wins for Packagers: End-of-Week Update (2026-10-09)

The Open Build Service posts its end-of-week roundup for packagers, highlighting fixes like copying special collectbuildenv packages, correcting dates on the Blame page and retriggering scmsync package syncs. The update also lists improvements to osc request listings, “osc fork” arguments and git-obs configuration handling.

View more blogs or learn to publish your own on planet.opensuse.org.

From Yogyakarta to Prague: openSUSE.Asia Summit and Open Source Summit Europe 2026

admin@opensuse.org (Lubos Kocman) — Fri, 16 Oct 2026 06:00:00 +0000

This October I attended both the openSUSE.Asia Summit 2026 in Yogyakarta, Indonesia, and Open Source Summit Europe 2026 in Prague, practically back to back. Two conferences, two continents and one very long trip.

Getting to both was quite an adventure. The way there was a train from Mikulov to Břeclav, another train to Vienna and on to Vienna airport, a flight via Qatar to Jakarta and one more flight to Yogyakarta. On the way back on Tuesday it was Yogyakarta, Jakarta, Qatar, Vienna, then a three hour stop at home in Mikulov before getting in a car and driving to Prague. All in all I spent at least 35 hours on planes, trains and cars. It was worth every hour, because the conversations I had at both events were priceless.

openSUSE.Asia Summit 2026, Yogyakarta

We had two amazing days of conference in Yogyakarta. A huge thank you goes to the organizers, including Edwin, Siska and the whole openSUSE Indonesia team, for putting together such a well organized event. I have always been met with great hospitality in Indonesia, and this year was no exception.

The opening ceremony

The summit started with a proper opening ceremony. After the Indonesian national anthem, dancers dressed like princesses gave a lovely traditional performance, carrying a golden chest. During the performance they presented each special guest with a leaf. The special guests were the hosting professor from the university and most of the European speakers, who were seated in the first row.

We do not really have this kind of ceremony at the beginning of events in Europe, and I think that is a pity. It set a warm and festive tone for the whole summit.

Community news

Congratulations to Dhenandi, the newly appointed leader of the openSUSE Indonesia community, whose appointment was announced during the event. We are looking forward to seeing the community grow under your leadership.

A special congratulations also goes to Siska on her return from maternity leave. Her little son was with us at the conference, and as Siska put it, he was the reason she had been away. Welcome back, and welcome to the youngest summit attendee!

Each day of the summit also had a quiz prepared by the Indonesian team, and honestly, it is far superior to our existing quiz.opensuse.org. It combined knowledge with agility. You had to tap on a moving lizard, swipe in the direction the lizard was rotating, or tap the button with the name of the color matching the displayed chameleon, while the text itself was written in a different color. :-) We hope we can adopt their quiz for our European events as well.

I managed to win first place on the first day, but on the second day I only made it to the top 20, because I am really bad at finger agility. :-))) Either way, it was huge fun for everyone. I gave my first prize, a mechanical keyboard, to the youngest attendee of the conference, Siska’s son.

It was also wonderful to see a group of roughly 30 women taking part in the summit. They were everywhere: among the organizers like Siska, among the many volunteers who kept the event running, and on stage as speakers, including Hamnah. Thank you all for making the summit what it was!

If you could not make it to Yogyakarta, the organizers put together highlight videos from both days of the summit.

Day one highlights

Day two highlights

Recordings of the talks should follow in the upcoming days on the openSUSE Indonesia YouTube channel, so keep an eye on it.

Conversations that matter

I really appreciated the discussion with NevaCloud about communication and getting openSUSE Leap images published on their platform as early as possible. Having fresh Leap images available on day one at regional cloud providers makes a real difference for users in the region.

I also enjoyed meeting the BlankOn Linux team and showing them how to build custom images in the Open Build Service. That includes images based on dpkg, since KIWI supports them too. OBS is not only for RPM based distributions, and it was great to see their interest.

One talk I particularly enjoyed was about gaming. It led to a follow up hacking effort on a simple image that boots straight into Steam in fullscreen mode through gamescope. The image is based on my fork of the opensuse-oem-image in OBS.

It was amazing to finally meet so many people in person whom I usually only see online. James, Ayan (Himsec), Sunny, Simon from Australia and Edwin are all long time regulars at our openSUSE weekly meetings and in our virtual bar, so the summit was a super nice opportunity to finally see each other face to face. I spent pretty much every evening hacking on something with Himsec or having deep conversations, also with Siska and Hamnah.

A better time for our Tuesday weekly meeting

One big takeaway from those evening discussions is that our “Asia friendly” Tuesday weekly meeting was not so Asia friendly after all. Attending a meeting at 5pm Indonesian time, when most people are still at work or commuting home, is quite challenging.

As a result I have announced moving the meeting from 12:00 to 14:00 CEST, which is roughly 7pm in Indonesia. The first meeting in the new slot last Tuesday had more than 10 attendees, so it definitely works out. The feedback was that 8pm would be even better, so the meeting would not clash with dinner time. Something similar already works well in the other direction: the Thursday community meetup is at 9pm for Europeans, which is a cozy time to relax and have fun with others after work.

The current schedule of all our meetings is always available at calendar.opensuse.org.

Kudos takes off in Indonesia

One thing that made me really happy was the adoption of the openSUSE Kudos recognition platform by the openSUSE Indonesia community. People instantly started using it to thank each other, and it was great to watch the kudos flowing during the summit.

With the new teams feature, a few people also asked to join teams such as the openSUSE Board, the Election Officials or the openSUSE Release Team. The enthusiasm is very welcome, but a team in Kudos reflects work that is already happening, and joining one does not grant a role in the project. Many teams are open and you can simply join the ones you contribute to. Others have a process behind them. Board members are elected by the openSUSE members, Election Officials should be openSUSE members who want to help run the elections, and the Release Team grows out of work on the build and release pipeline.

To make this clearer, Kudos now supports invite only teams. Such teams do not accept join requests, and new members can only be added through an invitation from an existing member.

So please ask to join the teams you already contribute to. And if you would like to get involved with any of the teams above, reach out to them. They will be happy to help you get started.

Coffee, turtles and aquascaping

After the two days of conference, we went on an offsite trip, and it is something I will remember for a long time. We visited Sambisari Temple, an ancient Hindu temple that lay buried under volcanic ash for centuries before it was rediscovered. Then we headed to the beach and visited Kelompok Konservasi Penyu Mino Raharjo, a turtle conservation group at Pantai Goa Cemara, and released baby turtles from their sanctuary into the sea. It was a super nice ceremony, and watching the little turtles make their way into the waves was a beautiful way to close the summit. We wrapped up the day with a lovely seafood lunch at Rumah Makan Dapur Cemara, close to the turtle sanctuary.

Everybody there was very welcoming. While we were talking about coffee prices in Europe and the 2 EUR threshold for an espresso in Italy, the locals could not believe that people pay 2 EUR or more for a single coffee. A moment later I had a free coffee in front of me. That says a lot about the hospitality of the local people.

On the way back to the venue we made one more stop, at a workshop where we made our own scarves using the traditional batik technique. You simply apply wax to a template, and after dyeing, it turns into a beautiful blue scarf. Going home with a scarf you made yourself is pretty cool!

Indonesian coffee deserves its own paragraph. Every cup I had was of the highest standard, no matter if it was a small restaurant by the beach or a specialty coffee shop.

Aquascaping is my new private hobby, so of course I could not resist going on a little hunt for local aquascaping shops. Edwin picked me up in the middle of it and took me to a quick meetup with the local community at Hayati coffee. It was such a great place that I had to stop there more than once. :-)

Coffee at the summit itself was supplied by Kopi Toedjoeh, one of the event sponsors. I actually brought a few bags with me to Prague and gave them away at Open Source Summit Europe. People were super excited to get their hands on it!

Huge thanks to all the sponsors who made the summit possible.

LinuxDays 2026, Prague

I was sad that I could not make it to LinuxDays, which took place in Prague at the same time as the openSUSE.Asia Summit. The openSUSE booth crew led by Martin Pluskal did an excellent job there. Many thanks to Martin, Dan Čermák, Jan Baier, Avinesh Kumar, Martina Stuchlíková and everybody else who helped at LinuxDays.

Open Source Summit Europe 2026, Prague

openSUSE and SUSE have been a platinum sponsor of Open Source Summit Europe for many years, and this year we almost did not sponsor at all. I fought really hard to find the budget to make it happen, so I am very happy that we were there and that the booth turned out to be such a success.

The booth was led by Dan Čermák, who stepped up for the role long before I knew I would have a conflict with my trip back from Indonesia. Many thanks to Dan and to Martina Stuchlíková, who also took care of transporting all the booth material. I joined them from the second day on.

openSUSE on a 64 core RISC-V workstation

The highlight of the booth was Professor Pavel Píša from the Czech Technical University in Prague (ČVUT). He brought a Milk-V Pioneer, a 64 core RISC-V board running openSUSE Tumbleweed, and used it to demonstrate QtRvSim, the RISC-V simulator developed by him and his students. The university uses the Open Build Service to build and publish QtRvSim, which made it a perfect showcase of our collaboration in the education sector. It also showed that RISC-V is capable of being a decent workstation today.

This demo brought many, many guests to the booth. We scanned a bit over 300 visitors, and the real number was possibly closer to 400. We simply spent a lot of time talking to people and less time scanning their badges. :-) Booths with less interaction might have been more successful at scanning, but the conversations we had with our visitors were amazing.

RISC-V was a big hit at the whole event. openEuler, which had one of the largest booths at the summit, showcased Tekken running on RISC-V. And from what we saw at our own booth, people are really interested in seeing powerful RISC-V hardware rather than yet another small single board computer.

People and connections

Among the visitors were people from N26 bank, with whom we talked about “European Linux”.

I was happy to connect David Heidelberg from the Czech and Slovak mobile Linux community with Adrian Campos Garrido, who works on openSUSE images for devices such as the PinePhone.

It was awesome to meet Mr. Müller from Bender Robotics, who uses openQA for their embedded testing. He showed us their instance and was looking for best practices for writing tests that do not need to be changed too often. I connected him with Oliver Kurz from our QA department and invited the team to our public QE sessions on Jitsi, which happen every Friday. You can find them at calendar.opensuse.org.

There were many other interested companies as well, like the OpenAtom Foundation, who sent their regards to our Dr. T (Thomas Di Giacomo), whom they had met at other events before.

I also got in touch with the SAP Open Source team and invited them to have a booth at the openSUSE Conference 2027, which I am organizing in Prague from 11 to 13 June 2027. It is hard to say SUSE and not think of SAP, and it would be great to give the SAP team a chance to showcase the open source projects they are working on to our community. We would love to see them there!

Visitors at the SUSE booth could also take part in our digital sovereignty quiz, and everyone who reached a good enough score went home with a chameleon plushie.

Looking ahead

I came back from Prague with a big backlog of new LinkedIn contacts and plenty of new opportunities for collaboration. These include cloud providers, and also banks and other companies that are considering moving away from AWS and similar platforms. There is a lot of follow up work ahead, and I am looking forward to it.

If there is one thing we could really use next time, it is more space. Between the university collaboration, the RISC-V demo and the steady stream of visitors, the booth was busy most of the time.

If you missed the talks in Prague, the recordings should appear in the upcoming days on The Linux Foundation YouTube channel.

Thank you

Many thanks to all the speakers, organizers, volunteers and sponsors of the openSUSE.Asia Summit 2026, and to all the people who helped secure our presence at Open Source Summit Europe in Prague. Thank you also to everyone who staffed a booth or simply stopped by for a chat.

I hope to see many of you again at the openSUSE Conference 2027 in Prague from 11 to 13 June 2027!

Tumbleweed ARM Update by mid-October

admin@opensuse.org (Douglas DeMaio) — Wed, 14 Oct 2026 09:00:00 +0000

There were a few software package updates for openSUSE Tumbleweed ARM this month with snapshots reaching the ARM port.

The second half of September and the first half of October carried the Linux kernel from 7.2.6 through 7.2.9 with a steady run of SBC and AArch64 security fixes, while binutils 2.47 added the newest Armv9.6 and Armv9.7 instructions, QEMU reached 11.1.2 with Raspberry Pi and ARM virtualization fixes, and firmware updates refreshed Wi-Fi and Bluetooth support for Raspberry Pi and Qualcomm and MediaTek boards.

Raspberry Pi

The kernel-firmware-brcm update refreshes the Cypress cyfmac43455 SDIO firmware, the Wi-Fi chip used on the Raspberry Pi 3, 4 and 5, so wireless reliability improves on those boards. The raspberrypi-firmware-dt package fixes a regression in the SRAM range (bsc#1282097), and QEMU 11.1.2 hardens the emulated BCM2835 interrupt controller by rejecting out-of-range FIQ source values (hw/intc/bcm2835_ic). The GRUB2 aarch64-efi package also gained SBAT metadata to satisfy shim SBAT dependency checks (bsc#1278729).

Rockchip & Other SBCs

Firmware coverage widened across the boards. kernel-firmware-qcom added ADSP, CDSP and GPU firmware for the Hawi and Maili platforms, the Radxa Dragon Q8B (sc8280xp), QCM6490, sa8775p, qcs8300, qcs615 and Rubik Pi 3, plus GPU and Wi-Fi firmware for the SHIFT6mq (sdm845). Media firmware added Gen2 VPU binaries for Hawi, Maili, sc8280xp and Glymur, and the ath12k and Bluetooth firmware brought new board files and QCA2066 and WCN7750 (Maili) support.

Kernel 7.2.8 fixed an Allwinner sun4i timer issue (CVE-2026-93219), and kernel 7.2.9 hardened the MediaTek mt7921 Wi-Fi driver against malformed CLC firmware records (CVE-2026-98159). bluez made a large jump to 5.87 with LE Audio, BAP/BASS and HFP additions, then fixed a UUID discovery crash and an A2DP remote SEP cache issue that broke codec negotiation on some LE Audio headsets. NetworkManager 1.58.1 fixed auto-connect to SAE (WPA3) networks and the normalization of Bluetooth NAP connections.

i.MX & NXP

Kernel 7.2.7 fixed an IRQ leak in the nxp-pit clocksource driver used on i.MX SoCs (CVE-2026-89769), and kernel 7.2.8 stopped a USB Type-C switch leak in the fsl-imx8mq PHY driver (CVE-2026-93225). SDL3 3.4.18 fixed KMSDRM initialization on i.MX 6 hardware.

aarch64 Virtualization, UEFI & Toolchain

QEMU 11.1.2 is the virtualization highlight, fixing ARM register handling in the HVF and WHPX accelerators, treating MDCCSR_EL0 as read-as-zero, correcting the ARM_CP_CONST sync path and the ENCODE_AA64_CP_REG argument order, and adding an ARM regression test alongside the TCG fold_multiply2 fix.

binutils 2.47 brings the biggest toolchain news with the remaining Armv9.6 instructions (+sme-mop4, +sme-tmop, +ssve-bitperm, +ssve-fexpa), several Armv9.7 extensions (+f16f32dot, +f16f32mm, +f16mm, +gcie, +lscp, +mtetc, +sme2p3, +sve-b16mm, +sve2p3, +tlbid), future POE2 and vMTE extensions, and an aarch64 objdump -M annotate fix. A GNU Compiler Collection 16 update fixed an internal compiler error building Firefox on ARM (bsc#1268791).

ovmf dropped the DEBUG_TO_MEM build option for AArch64 because it caused softdog reboot failures (bsc#1272814). sdbootutil improved encrypted-device detection with RAID and btrfs RAID1, uses bootctl to generate the random seed, detects a full grubenv and fixes the GRUB2 EFI bootcounter and loader_conf_set for paths.

glibc patched a resolv search-list assertion failure (CVE-2026-8674) and a $ORIGIN rpath issue in AT_SECURE programs (CVE-2026-86805); elfutils 0.196 added AArch64 and 32-bit ARM support to libdwfl_stacktrace, and mozilla-nss 3.129 fixed non-Linux arm64 makefile builds. LLVM 23.1.2 and Mesa 26.2.3 and 26.2.4 were bugfix releases, and soxr and highway both gained aarch64/arm build fixes.

Snapshots at a Glance

Snapshot	Kernel	Headline changes
2026-09-19	7.2.6	ovmf drops AArch64 DEBUG_TO_MEM (softdog fix), grub2 SBAT Provides, bluez 5.87 LE Audio, nvidia-open-driver rebuilds
2026-09-21	7.2.6	Mesa 26.2.3, xxhash 0.8.4 prefers NEON over SVE on AArch64, mozilla-nss 3.128
2026-09-24	7.2.7	NXP PIT clocksource IRQ leak fix (CVE-2026-89769), gzip aarch64 build fix, nvidia driver rc rebuild
2026-09-30	7.2.8	binutils 2.47 Armv9.6/9.7, kernel-firmware-brcm cyfmac43455 and qcom ADSP, raspberrypi-firmware-dt SRAM fix, sdbootutil, Allwinner/Tegra/SMMU fixes
2026-10-03	7.2.8	NetworkManager 1.58.1 WPA3 and Bluetooth fixes, gcc16 ARM ICE fix, Mesa 26.2.4
2026-10-07	7.2.9	arm_scmi firmware fixes, mt7921 CLC validation, SDL3 i.MX 6 KMSDRM fix, elfutils ARM stack trace support, glibc CVEs
2026-10-11	7.2.9	QEMU 11.1.2 ARM/HVF and bcm2835 FIQ fixes, libvirt 12.8.0, highway aarch64 LTO workaround, mozilla-nss arm64 build fix

Conclusion

The second half of September and first half of October kept the ARM port moving with the Linux kernel advancing from 7.2.6 to 7.2.9 through a long list of SBC fixes covering Allwinner’s sun4i timer, the Tegra video driver, Arm SMMUv3 teardown, the arm64 page-table walk and a batch of arm_scmi firmware corrections. binutils 2.47 delivered the month’s biggest ARM headline with Armv9.6 and Armv9.7 instruction support, QEMU 11.1.2 fixed ARM HVF/WHPX register handling and the emulated Raspberry Pi interrupt controller, and ovmf removed an AArch64 build option that caused softdog reboot failures. Firmware refreshes for Broadcom, Qualcomm and MediaTek Wi-Fi and Bluetooth chips plus the raspberrypi-firmware-dt SRAM fix improved connectivity and stability on boards, while bluez 5.87, NetworkManager 1.58.1, sdbootutil, glibc, elfutils and mozilla-nss rounded out security and toolchain work.

ARM Resources

For ARM-specific discussions and support, subscribe to the openSUSE ARM mailing list and check the openSUSE ARM wiki for device support information, image downloads, and documentation. New and existing ARM users can also join the openSUSE ARM IRC channel for real-time help.

Your contributions and feedback make openSUSE Tumbleweed ARM better with every update. Whether reporting bugs, suggesting features, or participating in community discussions, your involvement is highly valued.

Post-Quantum Backups Land in openSUSE Factory with ZUPT

admin@opensuse.org (Alessandro de Oliveira Faria) — Sun, 04 Oct 2026 00:02:00 +0000

ZUPT, an open source backup, compression, and data protection utility, has officially been accepted into openSUSE Factory, bringing a new security-focused backup option to the openSUSE ecosystem. The project combines backup creation, compression, integrity verification, and encryption in a single tool, allowing users to package files and directories into compact archives that are easier to store, transfer, verify, and restore.

Security is one of ZUPT’s main technical highlights. In addition to AES-256-based encryption, the tool supports a hybrid cryptographic scheme based on ML-KEM-768 + X25519. This approach combines established public-key cryptography with a post-quantum key encapsulation mechanism designed to provide stronger protection against future cryptographic threats. For users handling long-lived or sensitive backups, this adds an additional layer of protection against so-called “harvest now, decrypt later” scenarios, in which encrypted data collected today could potentially be targeted by more powerful computing systems in the future. ZUPT also includes file integrity verification features to help detect corruption, modification, or unexpected changes in archived data.

ZUPT was also designed with performance in mind. The application uses multithreaded processing to take advantage of multiple CPU cores during backup, compression, and restore operations, reducing processing time on modern systems. It includes its own compression mechanism as well as commands for testing and validating archive contents. With its acceptance into openSUSE Factory, ZUPT becomes an officially integrated solution for users looking for a combination of backup, compression, integrity verification, encryption, and post-quantum data protection within the openSUSE ecosystem.

For more information, go to ZUPT!

Tumbleweed Monthly Update - September 2026

admin@opensuse.org (Douglas DeMaio) — Thu, 01 Oct 2026 08:00:00 +0000

There were several software package updates for openSUSE Tumbleweed during the month of September and with openSUSE.Asia Summit 2026 about to begin, we are bringing the monthly review to you early.

September delivered a stacked month of snapshots across the desktop, developer tooling, and security surface. KDE Plasma 6.7.5 landed with fixes for KWin display management and taskbar refinements, while KDE Frameworks 6.30.0 and KDE Gear 26.08.1 delivered new features and bugfixes across the KDE ecosystem. glibc jumped to 2.44 with Transparent Huge Pages tunables and optimized math functions, and LLVM 23.1.1 arrived with important bugfixes. Mesa progressed from 26.2.2 to 26.2.3 and the Linux kernel advanced through 7.2.5 to 7.2.7 with a sustained focus on security. Later in the month the GNOME desktop picked up 50.5 across gnome-shell and mutter, GIMP advanced to 3.2.6, coreutils jumped to 9.12, and rsync arrived at 3.5.1 after a sweeping audit of its path handling and daemon protocol. curl addressed seven CVEs, pcre2 patched six security issues, and ffmpeg rolled up more than 20 CVEs in one pass.

As always, be sure to roll back using snapper if any issues arise.

For more details on the change logs for the month, visit the openSUSE Factory mailing list.

New Features and Enhancements

KDE Plasma 6.7.5: The fifth bugfix release of the Plasma 6.7 series brings targeted refinements across the desktop. KWin fixes the global removal timer timeout for unplugged outputs, and Discover resolves update stalling when fwupd is unavailable and a regression where updates were mistaken for needing a reboot. Spectacle fixes a crash during window-under-pointer detection and annotation submenu overflow, while the taskbar applet corrects right-to-left layout rendering and prevents duplicate favorites launching on Space.

KDE Frameworks 6.30.0: A feature release of the KDE component libraries that arrives with refinements across KIO, Kirigami, and KTextEditor. KIO fixes FTP command case consistency, corrects folder size reporting to include filesystem overhead, and lets a folder with the setgid bit propagate its group to copied files. KTextEditor gains vi-mode filename registers and fixes block operations with tabs. Baloo now excludes .snapshots folders from indexing, KCalendarCore adds recurrenceDescription and translated enum names, and KCodecs improves encoding detection with better confidence scoring. Syntax Highlighting adds DotEnv, KDL, and Just language support, and KGuiAddons adds a geo: URI handler for Cartes.

KDE Gear 26.08.1: The first bugfix release of the 26.08 series arrives with targeted fixes across the KDE application collection. Dolphin fixes the active split pane not being set correctly, corrects default zoom level calculations based on preview state, and prevents zero icon sizes in item layouts. Okular fixes a crash on broken DVI files, addresses dangling form field pointers after saving, and backports a Synctex security fix. Konsole corrects OSC22 mouse cursor shapes for splits and fixes focus shortcut issues in ViewSplitter. Kitinerary adds parsers for Air Canada and Lufthansa PDF itineraries and optimizes Wikidata train station queries. KOrganizer fixes search dialog functionality after editing a result.

GNOME Shell & mutter 50.5: The GNOME desktop received quality-of-life fixes that clean up day-to-day use. The unlock dialog handles keyboard navigation correctly, the screen will no longer unlock once a screen time limit has been reached, and toggling the wireless switch no longer blocks. On the compositor side, mutter fixes a hang on external monitor hotplug, stops multiple monitors from all being reported as primary, corrects desaturated SDR content in HDR mode, and adds per-view control over the software cursor overlay. libadwaita 1.9.4 arrived alongside with annotation and idle-callback fixes in AdwAnimation, AdwActionRow, AdwTabBar and AdwTabGrid, and GNOME Maps 50.5 fixed the secondary icons shown for recent and favorite places in initial search results.

GIMP 3.2.6: The image editor continued its 3.2 series with a large batch of fixes and some preparation for a future GTK 4 port. The Heal tool no longer leaves a dark smudge at crop boundaries, the Crop tool keeps vector layers in place, and the Color Picker correctly honours the Sample Merged option on single-layer images. Layer groups with non-destructive filters no longer get an unwanted pass-through reduction, plug-in pipes and process watching are better managed on exit so fewer warnings appear when closing GIMP, and clipboard brush and pattern sizes are raised to 8192 on AArch64. The XCF format is bumped to version 26 to record path visibility locks and channel filters.

Shotwell 33.0: The GNOME photo manager completed its port to GTK 4, moving to version 33 after the long-running 0.32 series. Printing was reworked, the publishing targets gained a “peek password” icon and now use a simple localhost web server instead of a dedicated authentication helper, and toast notifications replace many of the simpler dialogs. Face detection and recognition see a long list of fixes around names, highlighting and random matching, and the viewer mode now shows system information and can be opened for arbitrary URIs.

glibc 2.44: A major version bump that brings system-wide tunables via /etc/tunables.conf and a new glibc.elf.thp tunable that maps read-only segments with Transparent Huge Pages when the kernel has not disabled THP. The malloc page size is now capped to MAX_THP_PAGESIZE, and the CORE-MATH project contributions bring additional optimized and correctly rounded math functions. On AArch64, log, exp, sin, cas, sinh, cosh, and other special cases are vectorized for SVE and AdvSIMD, while RISC-V gains vector extension optimized variants of memcmp, memcpy, strcmp, strlen, and more. The release also carries two security fixes for stack-based buffer clashing during tilde expansion in wordexp (CVE-2026-6791) and an invalid free() call with WRDE_APPEND (CVE-2026-6368).

LibreOffice 26.8.0.3: A major version bump from the 26.2 series that brings updated bundled pdfium to 7681 and Skia to m147 as required by the new download configuration. The release drops Qt 5 support in Tumbleweed in favor of Qt 6, aligning with the broader KDE ecosystem move away from Qt 5. Users of the office suite will see improved compatibility and performance across Writer, Calc, and Impress.

LLVM 23.1.1: A bugfix release for the LLVM 23.1.0 series that addresses issues found since the initial release. The update is API and ABI compatible with 23.1.0, making it a safe upgrade for developers who depend on the Clang compiler, LLVM libraries, and related tooling. This is particularly relevant for users building packages that depend on the LLVM infrastructure for compilation.

harfbuzz 14.4.0 & 14.5.0: The text shaping engine that underpins rendering in browsers, desktop environments, and document editors received important improvements. In 14.4.0, glyph positions and extents now saturate instead of overflowing, Arabic Windows-1256 fallback shaping is enabled on all platforms, the COLR sweep gradient truncation and unbounded memory use are fixed, and subsetting is faster especially for large GSUB/GPOS and CFF tables. Version 14.5.0 then updated the Unicode data to 18.0, adding script values for Jurchen, Proto-Cuneiform and Seal along with the matching shaping support, and introduced rendering work budgets shared across the raster, vector, GPU and Cairo renderers so nested outline work stays bounded. The DirectWrite backend no longer uses the C++ runtime, and the HarfRust integration shaper sees various improvements.

bubblewrap 0.12.0: The Linux sandboxing tool removes support for building a setuid binary, as all modern distributions now support unprivileged user namespaces. A security fix resolves a symlink issue where a file or directory creation during sandbox setup could follow parent symlinks out of the sandbox. The --not-a-security-boundary flag is added for cases where some sandbox setup failures should not be fatal.

Key Package Updates

Linux kernel 7.2.2 through 7.2.7: The kernel progressed through six point releases during September with a sustained focus on security and stability. Version 7.2.2 carried fixes for ptp vmclock read-only mapping vulnerability and GSO state stripping from fragments before forwarding . Version 7.2.3 addressed an extensive list of USB fixes including use-after-free in usbdev_release(), ALSA USB audio out-of-bounds write in snd_usbmidi_novation_output(), and KVM SEV improvements for SNP guests. Version 7.2.4 added fixes for dm-pcache use-after-free, wifi driver memory leaks across mt76, iwlwifi, and brcmfmac, and I3C device master use-after-free in the unregister path. Version 7.2.5 was dominated by backports, among them a large sweep of NFC fixes bounding device-reported lengths, rejecting undersized LLCP PDUs, and fixing an out-of-bounds write in nci_target_active, alongside futex priority-inheritance races and io_uring iovec leaks. Version 7.2.6 brought an exceptionally long list of nfsd hardening patches covering use-after-free in the fcache disposal path, layout_fence_worker double references, and nfsd_file leaks on inter-server COPY, plus a clocksource IRQ leak fix and an iomap integrity-payload fix. Version 7.2.7 wrapped up the month with a broad set covering Btrfs write-protection during data writeback, AppArmor credential use-after-free and a null-termination out-of-bounds write, mm and MGLRU correctness, and a large group of tracing use-after-free and crash fixes.

Mesa 26.2.2 & 26.2.3: Two bugfix releases landed on the 26.2 branch. Alongside the usual stream of regression fixes, openSUSE’s build gained the rocket Gallium driver for Rockchip NPUs on aarch64, and the new Mesa-teflon-delegate subpackage ships a TensorFlow Lite delegate for NPUs. The changelogs point to the Mesa 26.2.2 and Mesa 26.2.3 release notes for details, and the LLVM 23 build fix that unblocked both releases came along with them. Users on AMD, Intel, or Qualcomm hardware who experienced rendering issues after earlier Mesa updates should find these releases more stable.

rsync 3.5.1: The file synchronization tool received a sweeping security overhaul. A focused audit of path handling and the daemon protocol, a companion fuzzing pass and external reports produced 33 fixes covering restricted-directory escapes in rrsync, daemon module-root chdir escapes under use chroot = no, --relative implied-parent creation escaping the destination tree, daemon --filter merge file bypasses, and a range of symlink races on the sender and receiver sides. The release also fixes an unauthenticated TLS connection in rsync-ssl and a hosts deny rule that failed open when a configured hostname could not be resolved. A 3.5.1 follow-up in the same snapshot fixed several path-handling regressions from 3.5.0, restored access to /dev/stdin and friends inside user namespaces, tightened partial-directory validation on the receiver, added support for internationalised domain names, and bumped the protocol number to 33.

util-linux 2.42.3: The Linux utility suite received a security-focused point release. Four mount(8) and namespace-related CVEs are fixed, including post-mount hooks running after an external mount helper fails and a time-of-check/time-of-use race on the source path in restricted SUID mode. wall and write gained an additional fix for terminal escape sequence injection through the banner hostname, complementing the earlier CVE-2024-28085 work. Alongside the security work, the release fixes an out-of-bounds read of the ISO9660 root directory record in libblkid, an out-of-bounds write in get_line() on invalid multibyte input, and a pg out-of-bounds access on a trailing tab.

PipeWire 1.6.9: The sound and video server shipped a bugfix release that is API and ABI compatible with the rest of the 1.6 series. RAOP (AirPlay) support sees the most work, with encryption fixed for OpenSSL 3 and above, truncated audio and metadata update problems resolved, and RAOP over TCP fixed. The resampler cutoff frequencies were tweaked to preserve more high frequencies when upsampling, potential overflows in client node buffer checks were fixed, and pw-cat now handles EOF correctly for encoded files while pw-record supports A-law.

poppler 26.09.0: The PDF rendering library jumped two minor releases, picking up 26.08.0 on the way. Fonts are now subset when saving changes in annotations and forms through fontconfig, which required making harfbuzz a build dependency. pdftotext gains a -urls option to print link URLs next to their text, pdftohtml no longer crashes when using data URLs and skips tiling patterns earlier for speed, and pdfimages gains min-height and min-width options. The core also stops infinite looping on a wrong NSS password and fixes crashes on malformed documents.

BlueZ 5.87: The Bluetooth stack jumped five releases from 5.82, bringing LE Audio and profile work along with it. Version 5.83 added AVDTP TX timestamps and fixed handling of BAP PAC removal, broadcast receiver SIDs, and HID service records; 5.84 added unicast endpoint reconfiguration, encrypted broadcast sources and HFP Caller Line Identification; 5.85 added HFP call answer and simple 3-way call support and corrected battery charge level display; 5.86 added the Telephony, Ranging, GMAP and TMAP profiles and fixed the G.722 16 kHz codec ID; and 5.87 resolved a long list of BAP, BASS, PBAP, MCP, AVRCP and GATT database issues.

cryptsetup 2.8.8: The disk encryption tool received a feature and hardening release. integritysetup gained support for keyed discards via a new --allow-discards-keyed option, which permanently upgrades the superblock so that an integrity device in standalone mode with a keyed integrity algorithm can no longer have part of itself wiped with a discard pattern. The library also closes a time-of-check/time-of-use issue in LUKS header restore by opening the device only once, which affects both LUKS1 and LUKS2, hardens BITLK metadata validation against a wrong key buffer size and a deliberate infinite loop, and fixes a possible integer overflow in the anti-forensic data size calculation on 32-bit systems.

gzip 1.15: The ubiquitous compression utility reached a new major version, landing fixes for two earlier security issues and a batch of long-standing bugs. A buffer overflow when decompressing an .lzh file after a .Z file is fixed, as is a use of uninitialized memory on some malformed inputs. gzip -d no longer rejects PKZIP signatures and local headers that legitimately appear in well-formed streamed zip files, diagnostics now quote file names containing unusual characters, and gzip --synchronous works again on platforms with O_PATH. Behaviorally, gzip follows the locale from the environment instead of insisting on the C locale, and -l reports -Inf% rather than 0.0% for an empty file.

libinput 1.32: The input handling library arrived with input-device improvements. Circular scrolling now works on circular touchpads such as the Panasonic CF-SV1, dragging on a touchpad automatically enables a drag lock when a finger nears the edge, and disable-while-typing no longer cancels an interaction already in progress. Tablets can now map the physical eraser button to any button, and libinput record accepts a --no-events flag.

lightdm 1.33.1: The display manager received a bugfix release with a notable feature. A Qt6 client library is now shipped alongside the Qt5 one, and the release fixes user switching after logind dropped the CanMultiSession property. Wayland sessions are now allowed on seat0 without VTs, PAM modules that change the home directory are handled correctly, the VNC server command is honored with IPv6 tried first for the bind, a local X server is not reused when the hostname has changed, and memory leaks in session_child_run are plugged.

AppStream 1.2.0: The software metadata standard reached a new major version and marks the libappstream-compose API as stable. appstream-compose gains an out-of-process media worker with a basic Landlock-based sandbox, switches image processing from GdkPixbuf to VIPS, and makes JPEG XL the default output format. New <heading> markup is supported in AppStream descriptions, and the news tools gain inline Markdown support along with header handling across the XML, YAML and Markdown conversions.

xz 5.8.4: The compression library received a bugfix release that includes a security fix. An invalid memory access in lzma_alone_decoder(), lzma_lzip_decoder(), lzma_auto_decoder() and lzma_microlzma_decoder() after a failed allocation is followed by decoder reinitialization is fixed, along with two use-after-free bugs in xz itself via --files/--files0 and --verbose with redirected stderr. Landlock ABI 9 support is added, a performance issue and theoretical integer overflow in lzma_index_cat() are fixed, and xz --list no longer overflows its totals.

VirtualBox 7.2.18: The VirtualBox hypervisor received a bugfix release. Data corruption in VDI differencing images after writing full blocks of zeroes and reopening the image is fixed, a VM process crash on Linux hosts with 3D acceleration enabled is resolved, and the shared clipboard no longer strips the first character from a file name located directly in a filesystem root. Linux 7.3-rc support is added.

libgcrypt 1.12.4: The GnuPG cryptographic library received a follow-up point release. RSA PSS handling of very large salt lengths is fixed, the length of hashed input is validated for RSA PSS, and the RSA OAEP decoder validates all-zero padding for correctness. Padding in cSHAKE was corrected against NIST ACVP conformance vectors, and a build problem with some compiler versions around SM4 instructions is resolved.

GStreamer 1.28.7: A wide-ranging update across the core and plugin packages with both security and playback fixes. The appsrc element fixes a regression where pushing EOS into a blocked appsrc would stall, and glcolorconvert fixes compatibility with older OpenGL and GLSL versions. The mxfdemux element resolves keyframe detection regressions and possible artifacts after seeking, and rtpmanager fixes crashes on malformed RTCP SDES due to uninitialized values. The Rust-based plugins gain DoS protection in rtpsession and limit the number of remote sources tracked in rtprecv. Security fixes span multiple parsers including pnmdec and onnx, and the x264enc high bit depth support is fixed in binary packages.

ffmpeg 8: A massive security update carrying more than 20 CVE patches. Fixes address out-of-bounds reads and writes across numerous demuxers and decoders including HEVC, CineForm, TIFF, Screenpresso, and DVB subtitle parsers. The RTP muxer receives bounds checks for AV1, VC-2, and ASF objects, and the MPEG muxer rejects stream counts that overflow the system header. This is an essential update for any system that processes media files, as the vulnerabilities could be triggered by crafted input.

dracut: Received a security fix for CVE-2026-6893, a root code execution vulnerability via DHCP options command injection. The fix sanitizes values written to network override files, gateway files, and hostname files, and strips DHCP-supplied domains to a safe charset. This is important for any system that uses dracut-generated initrd images with network boot configurations.

Security Updates

rsync 3.5.1:

CVE-2026-53783: Fixes an rrsync restricted-directory escape via a validation-versus-execution race and an unsafe option allowlist.
CVE-2026-53784: Addresses a daemon module-root chdir escape under use chroot = no.
CVE-2026-53785: Resolves --relative implied-parent creation escaping the destination tree.
CVE-2026-53786: Fixes a daemon --filter merge file bypassing the module filter list.
CVE-2026-53788: Addresses the daemon name-converter accepting newline-bearing names into its line protocol.
CVE-2026-53789: Corrects a malicious sender expanding --delete scope by reclassifying an implied parent.
CVE-2026-53790: Fixes command and argument injection via unquoted peer- or host-controlled values.
CVE-2026-53791: Addresses PROXY-protocol mode letting a direct client spoof the daemon’s source address.
CVE-2026-53792: Resolves a receiver-supplied zero checksum block length driving the sender into a negative match.
CVE-2026-53793: Fixes a chroot /./ inner-module escape via a parent-component symlink.
CVE-2026-53794: Addresses a remote peer disabling the per-allocation sanity cap via --max-alloc=0.
CVE-2026-53795: Corrects a receiver write escape via an absolute --temp-dir or --link-dest disabling rename and link confinement.
CVE-2026-53796: Fixes a non-daemon receiver destination-chdir symlink race.
CVE-2026-53797: Addresses a sender source-tree parent-component symlink race leading to out-of-tree disclosure.
CVE-2026-53798: Resolves the daemon name-converter mapping an unknown name to uid/gid 0 on an empty response.
CVE-2026-53799: Fixes receiver ACL and xattr application following a symlink race for arbitrary ACL setting and local privilege escalation.
CVE-2026-53800: Addresses sender --remove-source-files unlink following a parent-component symlink race for arbitrary file deletion outside the source tree.
CVE-2026-53801: Corrects sender and daemon directory-scan enumeration escaping the transfer root for out-of-tree disclosure.
CVE-2026-53802: Fixes arbitrary file read and transfer shaping via symlinked operator-supplied input files.
CVE-2026-53803: Addresses arbitrary file write and privilege escalation via symlinked operator-supplied output paths.
CVE-2026-70463: Fixes auth users ignoring documented comma-only parsing and silently skipping a deny or read-only rule.
CVE-2026-70462: Addresses a peer-supplied MSG_IO_TIMEOUT defeating the client’s own I/O timeout through signed overflow and a non-positive value.
CVE-2026-70461: Resolves a peer-driven one-byte heap out-of-bounds write in add_implied_include().
CVE-2026-70460: Fixes a daemon module-root escape through a peer-supplied --partial-dir or --backup-dir resolving via an in-module symlink.
CVE-2026-70459: Addresses a per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root.
CVE-2026-70458: Corrects an out-of-bounds write from a FLAG_HLINKED file entry accepted without -H.
CVE-2026-70457: Patches an attacker-chosen-offset write in parse_size_arg() error formatting.
CVE-2026-70456: Fixes a remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs.
CVE-2026-70454: Addresses rsync-ssl establishing an unauthenticated TLS connection with no CA verification and no stunnel hostname binding.
CVE-2026-70453: Resolves quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain.
CVE-2026-70464: Fixes an unauthenticated pre-transfer handshake denial of service locking out an rsync daemon module.
CVE-2026-70455: Addresses peer-controlled Zstandard worker exhaustion on an rsync daemon.
CVE-2026-70452: Corrects hosts deny failing open when a configured hostname cannot be resolved, admitting the host it was meant to block.
CVE-2025-10158: Fixes an out-of-bounds array access via a negative index.
CVE-2026-41035: Addresses a count of entries mismatch leading to a use-after-free.
CVE-2026-43617: Resolves authorization bypass via hostname resolution.
CVE-2026-43618: Addresses a second authorization bypass, tracked separately from CVE-2026-43617.
CVE-2026-29518: Fixes integer overflow information disclosure.
CVE-2026-43619: Addresses a symlink race condition via path-based syscalls.
CVE-2026-43620: Corrects an out-of-bounds array read via recv_files().
CVE-2026-45232: Fixes an off-by-one stack out-of-bounds write in HTTP CONNECT proxy response parsing.

python313 3.13.15:

CVE-2026-19672: Fixes a tarfile member that leaves the destination directory and comes back.
CVE-2026-17084: Addresses Unicode codepoint attributes outside RFC 3454 being considered valid.
CVE-2026-15308: Resolves quadratic complexity in incremental parsing of long unterminated constructs in html.parser.HTMLParser, exploitable for denial of service.
CVE-2026-6879: Corrects quadratic behavior in xml.etree.ElementTree.Element findall(), iterfind() and find() when using XPath index predicates on documents with many same-tag siblings.
CVE-2026-4360: Fixes tarfile.TarFile.extract() not applying the given filter when it extracts a link target from the archive as a fallback.
CVE-2026-11972: Addresses tarfile seeking a stream continuing past the end of the stream.
CVE-2026-11940: Resolves a bypass of CVE-2025-4330 where crafted archives could create a symlink pointing outside the destination directory through the tarfile data and extraction filters.
CVE-2026-0864: Corrects line endings in multi-line configparser values not being normalized to LF+TAB.
CVE-2025-15366: Fixes NUL, CR and LF characters being accepted in IMAP commands.
libexpat 2.8.2: The bundled libexpat is updated to 2.8.2.

util-linux 2.42.3:

CVE-2026-76642: Fixes mount(8) post-mount hooks executing after an external mount helper fails, allowing privileged operations on the pre-existing target filesystem.
CVE-2026-78410: Addresses a mount(8) time-of-check/time-of-use race on the source path in restricted SUID mode, letting a local attacker redirect a privileged mount or post-mount ownership change.
CVE-2026-78409: Resolves an X-mount.subdir symlink escape from a detached mount tree in mount(8).
CVE-2026-78408: Fixes a file descriptor leak in nsenter(1) and unshare(1) where descriptors were not created with O_CLOEXEC.
Hostname escape sequence injection: An additional fix for CVE-2024-28085 sanitizes the hostname interpolated into the wall(1) and write(1) banner headers, which an unprivileged user could otherwise poison via a user namespace hostname.

tesseract-ocr:

CVE-2026-88047: Fixes a stack buffer overflow in Classify::ReadNormProtos on a crafted traineddata file.
CVE-2026-88048: Addresses a heap out-of-bounds write and read in FullyConnected::Forward via a dimension mismatch.
CVE-2026-88049: Resolves a heap out-of-bounds write in LSTM::Forward via an na_/gate-matrix dimension mismatch.
CVE-2026-88050: Fixes an out-of-bounds write in UnicharCompress via unvalidated recoder code values.
CVE-2026-88051: Corrects a heap out-of-bounds write in GenericVector<T>::read via a reserved/size_used mismatch.
CVE-2026-88052: Patches a heap out-of-bounds write in UNICHARSET::load_via_fgets via a count/insert desynchronization.
CVE-2026-88053: Addresses a heap out-of-bounds write in Classify::ReadIntTemplates via unvalidated counts in a crafted traineddata file.
CVE-2026-88054: Resolves a denial of service via an empty-stack dereference at model load.
CVE-2026-73067: Fixes a heap out-of-bounds read in SquishedDawg on a crafted model, already patched in the shipped 5.5.3.

hplip 3.26.6:

CVE-2026-91097: Fixes a security vulnerability in the HP Linux Imaging and Printing utilities.
CVE-2026-91098: Addresses a security vulnerability in the HP printer and scanner backend components.
CVE-2026-91099: Resolves a security vulnerability in HPLIP’s firmware and device handling code.
CVE-2026-91100: Corrects a security vulnerability in the HPLIP scan backend.
CVE-2026-91101: Patches a security vulnerability in the HPLIP print queue and status handling.
CVE-2026-91102: Fixes a security vulnerability in the HPLIP device discovery code.
CVE-2026-91103: Addresses a security vulnerability in the HPLIP model and capability database.
CVE-2026-91104: Resolves a security vulnerability in the HPLIP fax and scan utilities.
CVE-2026-91105: Corrects a security vulnerability in the HPLIP plugin download and verification path.
CVE-2026-91106: Patches a security vulnerability in the HPLIP status and configuration tools.

freeipmi 1.6.19:

CVE-2026-85504: Fixes a stack-based buffer overflow via malformed Fujitsu SEL long-text responses.
CVE-2026-85505: Addresses a denial of service via a stack-based buffer over-read in ipmi-oem.
CVE-2026-85506: Resolves arbitrary code execution via a stack-based buffer overflow in ipmi-oem.
CVE-2026-85507: Fixes a stack-based buffer overflow in _output_dell_system_info_cmc_info.
CVE-2026-85508: Corrects a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info.
CVE-2026-85509: Patches a stack-based buffer overflow when a BMC returns more bytes than requested.

gvfs 1.60.3:

CVE-2026-88924: Fixes the admin backend setting socket ownership after creation rather than before.
CVE-2026-84268: Addresses the sftp backend not clamping the read_reply count to the requested buffer size.
CVE-2026-84270: Corrects the mtp backend not validating the read size returned by the device.

flatpak 1.18.3:

CVE-2026-87766: Fixes a vulnerability in the bundled bubblewrap 0.12.0 sandbox component.
CVE-2026-93676: Addresses a vulnerability in the bundled xdg-dbus-proxy 0.1.8 filtering component.

libsoup:

CVE-2026-85534: Fixes libsoup 3 sending more body bytes than nghttp2 requested.
CVE-2026-85197: Resolves a crash in on_data_read after the connection has been destroyed.
CVE-2026-77680: Corrects a flaw in HTTP Range header processing in libsoup 2.
CVE-2026-77014: Addresses the same HTTP Range header processing flaw in libsoup 2.

p11-kit 0.26.5:

CVE-2026-18938: Fixes an overflow when decoding nested attributes.
CVE-2026-13757: Addresses server-side stack exhaustion via unbounded recursion in RPC attribute parsing by enforcing a recursion depth limit.

sssd:

CVE-2026-87853: Fixes cross-user impersonation in the IDP provider by correcting user matching in access token evaluation.

PackageKit 1.4.0:

CVE-2026-19816: Fixes the dnf5 backend executing repo-remove for simulated transactions.

curl 8.22.0:

CVE-2026-13608: Fixes OpenLDAP SASL authentication bypass.
CVE-2026-18924: Addresses HTTP/2 server push use-after-free.
CVE-2026-19931: Resolves Negotiate ambient user connection reuse.
CVE-2026-80229: Fixes OpenSSL provider use-after-free.
CVE-2026-80230: Addresses OpenSSL pinning bypass.
CVE-2026-80255: Resolves secure cookie attribute bypass with tab character.
CVE-2026-82209: Fixes domain-scoped PSL domain cookie issue.

NetworkManager:

CVE-2026-10805: Fixes dhclient accepting unsafe characters in URLs and hostnames.
CVE-2026-19685: Addresses 802.1x rejecting ca-path for private connections.

glibc 2.44:

CVE-2026-6791: Fixes stack-based buffer clash during tilde expansion in wordexp.
CVE-2026-6368: Resolves invalid call to free() when wordexp is used with WRDE_APPEND.
CVE-2026-18374: Fixes a heap buffer overflow in the libio ccs= handling.
CVE-2026-19499: Addresses incorrect right-justification in strfmon.
CVE-2026-19542: Resolves an out-of-bounds array write in tdelete.
CVE-2026-77117: Fixes SHIFT_JISX0213 decoding leaving a pending character set across conversions.
CVE-2026-80489: Corrects the same pending character reset problem for EUC_JISX0213 decoding.

exiv2 0.28.9:

CVE-2026-68547: Fixes a security vulnerability in EXIF metadata processing.
CVE-2026-68546: Addresses a security vulnerability in image metadata handling.
CVE-2026-49275: Resolves a security vulnerability in the metadata library.

dracut:

CVE-2026-6893: Fixes root code execution via DHCP options command injection.

libpcap 1.10.7:

CVE-2026-0799: Fixes safe M[] access in the BPF interpreter.
CVE-2026-31912: Addresses program bounds checking in pcap_offline_filter().
CVE-2026-31911: Resolves safe opcode failure handling in the BPF interpreter.
CVE-2026-6244: Fixes division by zero via pcap_offline_filter().
CVE-2026-6554: Addresses “ja L” looping limit in pcap_offline_filter().
CVE-2026-18313: Fixes memory leak in rpcapd.
CVE-2026-18238: Addresses RPCAP_MSG_PACKET validation.

ffmpeg 8:

CVE-2026-75147: Fixes OBU size bounding in AV1 RTP keyframe search loop.
CVE-2026-75146: Addresses negative fragment index in DASH demuxer.
CVE-2026-75145: Resolves OBU size narrowing to long in AV1 RTP muxer.
CVE-2026-75144: Fixes data units larger than RTP payload buffer in VC-2 muxer.
CVE-2026-75143: Addresses caller buffer size honoring in librist reader.
CVE-2026-75142: Resolves stream count overflow in MPEG muxer.
CVE-2026-75141: Fixes hvcC NAL array overflow in HEVC demuxer.
CVE-2026-70632: Addresses transform-2 output width validation in CineForm decoder.
CVE-2026-70631: Resolves inflate output length check in TIFF decoder.
CVE-2026-70630: Fixes deflate output length check in Screenpresso decoder.
CVE-2026-70629: Addresses uninitialized data on short input in rscc decoder.
CVE-2026-70628: Resolves signed overflow in DVB subtitle parser capacity check.
CVE-2026-66037: Fixes count_label validation in IAMF parser.
CVE-2026-66036: Addresses dynamic frame size support in hqdn3d filter.
CVE-2026-65706: Fixes temp row buffer sizing in swaprect filter.
CVE-2026-65705: Resolves unneeded variables in floodfill filter.
CVE-2026-65704: Fixes AC3 trim underflow in Ty demuxer.
CVE-2026-65703: Addresses reference frame handling in TDSC decoder.
CVE-2026-64834: Resolves ASF object size validation in RTP decoder.
CVE-2026-64833: Fixes DTS core_size bounding in SPDIF encoder.
CVE-2026-58049: Addresses DLTA access bounds checking in RASC decoder.

389-ds 3.3.1:

CVE-2026-18355: Fixes heap buffer overflow in the SASL I/O layer.
CVE-2026-18663: Addresses pre-authentication double-free via critical Session Tracking control.
CVE-2026-11770: Resolves pre-auth LDAP filter injection in CleanAllRUV status check.
CVE-2026-18453: Fixes pre-authentication NULL pointer dereference via paged results.
CVE-2026-15722: Addresses pre-authentication stack buffer overflow via unbounded replica ID parsing.
CVE-2026-18922: Resolves stale identity installation following SASL PLAIN authentication.
CVE-2026-19843: Fixes Cockpit LDAP editor shell command injection.
CVE-2026-76560: Addresses SELFDN ACI bind-rule evaluator incorrect matching.

xen 4.22.0_04:

CVE-2026-62437: Fixes memory leak caused by device model IRQ binding.
CVE-2026-79602: Addresses improper handling of HVM emulation return codes.
CVE-2026-79603: Resolves TLB flushing not happening before page scrubbing.

coreutils:

CVE-2026-56391: Fixes read buffer overrun in uniq -w in multibyte locales.
CVE-2026-56392: Addresses heap overflow in unexpand -t for tab values larger than SIZE_MAX/16.

gegl 0.4.72:

CVE-2026-18300: Fixes vulnerability in the RGBE loader for large report files.

cups-filters:

CVE-2026-64611: Fixes infinite-loop CPU-exhaustion denial of service in cfIEEE1284NormalizeMakeModel on empty MDL field.
CVE-2026-64612: Addresses malformed PNG aborting the CUPS image filter process due to missing libpng setjmp recovery.

alsa:

CVE-2026-90781: Fixes a denial of service via an off-by-one stack buffer overflow in the control interface parser.

cups 2.4.19:

CVE-2026-87875: Addresses a heap out-of-bounds read in cupsUTF32ToUTF8() due to a missing source-length bound, reachable from SNMP supply-description parsing.

7-Zip 26.03:

CVE-2026-58052: Fixes 7-Zip failing to preserve the Mark-of-the-Web when extracting a crafted archive, which let an extracted file bypass the trust check meant to keep it quarantined.

GIMP 3.2.6:

CVE-2026-80101: Fixes invalid guards on XWD parameters, which could lead to a buffer overflow when loading a crafted XWD file.

discount 3.0.2.0:

CVE-2026-4833: Addresses uncontrolled recursion in compile() on deeply nested input, leading to stack exhaustion and a crash. The parser now caps nesting depth, defaulting to 200 and tunable via --with-recursion.

libX11:

CVE-2026-88806: Fixes a heap-based buffer overflow in the XkbGetMap reply by checking the keysym range in _XkbReadKeyActions.

libXrender:

CVE-2026-88807: Fixes an out-of-bounds write into screen->subpixel when a malicious server replies to XRenderQueryFormat with a numSubpixels count greater than the number of screens.

libtpms:

CVE-2026-85769: Fixes a heap out-of-bounds read in TPM2 state unmarshalling via an unchecked block_skip_read() blocksize.

librsvg 2.62.4:

Use-after-free with nested Xinclude: Fixes a use-after-free when duplicate XML entities appear in nested Xinclude documents.

Users are advised to update to the latest versions to mitigate these vulnerabilities.

Conclusion

September was a busy month for openSUSE Tumbleweed with snapshots delivering a steady cadence of desktop, developer, and security improvements. KDE Plasma 6.7.5 and KDE Frameworks 6.30.0 refined the KDE desktop and added new features, while KDE Gear 26.08.1 stabilized the application suite with fixes across Dolphin, Okular, and Kitinerary. glibc jumped to 2.44 with Transparent Huge Pages tunables and vectorized math functions, and LLVM 23.1.1 arrived with important toolchain bugfixes. The Linux kernel progressed through 7.2.4 with extensive CVE coverage across USB, networking, and virtualization subsystems, and Mesa settled into its 26.2.2 release. LibreOffice advanced to 26.8.0.3 and harfbuzz improved text shaping performance and correctness. The second half of September carried the month’s heaviest security load. rsync 3.5.1 arrived after an audit of its path handling and daemon protocol that turned up more than 40 vulnerabilities, including a set of chroot and rrsync escapes, a hosts deny rule that failed open when a hostname could not be resolved, and an unauthenticated handshake denial of service against a daemon module. On the desktop side, the GNOME stack picked up 50.5 across gnome-shell and mutter, GIMP advanced to 3.2.6, Shotwell reached 33.0, bash-completion 2.17.0 and coreutils 9.12 landed alongside a burst of late-month updates across Mesa 26.2.3, PipeWire 1.6.9, Poppler 26.09.0, BlueZ 5.87, and xz 5.8.4.