Aggregator

Version:7.3-rc7 (mainline) Released:2026-10-12 Source:linux-7.3-rc7.tar.gz Patch:full (incremental)

FEDORA-EPEL-2026-602703bf01 Packages in this update:

• ImageMagick-6.9.13.58-1.el9

Update description:

Automatic update for ImageMagick-6.9.13.58-1.el9.

Changelog for ImageMagick * Sun Oct 11 2026 Luya Tshimbalanga <luya@fedoraproject.org> - 1:6.9.13.58-1 - Update to version 6.9.13.58 - Resolves: rhbz#2391125 - Resolves: rhbz#2392773 - Resolves: rhbz#2393600 - Resolves: rhbz#2404847 - Resolves: rhbz#2418553 - Resolves: rhbz#2421113

FEDORA-EPEL-2026-5497815500 Packages in this update:

• ImageMagick-6.9.13.58-1.el8

Update description:

Automatic update for ImageMagick-6.9.13.58-1.el8.

Changelog for ImageMagick * Sun Oct 11 2026 Luya Tshimbalanga <luya@fedoraproject.org> - 1:6.9.13.58-1 - Update to version 6.9.13.58 - Resolves: rhbz#2391124 - Resolves: rhbz#2392772 - Resolves: rhbz#2393599 - Resolves: rhbz#2404847 - Resolves: rhbz#2418552

FEDORA-2026-9729761538 Packages in this update:

• libpng12-1.2.57-27.fc46

Update description:

Automatic update for libpng12-1.2.57-27.fc46.

Changelog * Sun Oct 11 2026 Michal Hlavinka <mhlavink@redhat.com> - 1.2.57-27 - fix CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE (rhbz#2452156) - fix CVE-2025-64505: heap buffer overflow via malformed palette index (rhbz#2418423)

FEDORA-2026-bc7bd292d6 Packages in this update:

• kernel-7.2.10-100.fc43

Update description:

The 7.2.10 stable kernel updates contain a number of important fixes across the tree.

FEDORA-2026-7b153c4ce6 Packages in this update:

• kernel-7.2.10-200.fc44

Update description:

The 7.2.10 stable kernel updates contain a number of important fixes across the tree.

FEDORA-2026-a9ca0db4f1 Packages in this update:

• kernel-7.2.10-300.fc45

Update description:

The 7.2.10 stable kernel updates contain a number of important fixes across the tree.

FEDORA-2026-fc041839f8 Packages in this update:

• libpng15-1.5.30-27.fc46

Update description:

Automatic update for libpng15-1.5.30-27.fc46.

Changelog * Sun Oct 11 2026 Michal Hlavinka <mhlavink@redhat.com> - 1.5.30-27 - fix CVE-2025-64505: heap buffer overflow via malformed palette index (rhbz#2418424) - fix CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE (rhbz#2452157)

FEDORA-2026-3dbdc5d71d Packages in this update:

• nebula-1.11.2-1.fc44

Update description:

Windows tracks NLMTU per address family and Nebula only ever set it for AF_INET, so the IPv6 MTU on every Windows adapter sat at the adapter default of 65535 regardless of tun.mtu and the stack could hand Nebula packets far larger than configured. An IPv6 enabled overlay with tun.mtu under 1280 now refuses to start, matching the other platforms. (#1871) Android 11+ denies bind() on netlink route sockets inside the app sandbox, so local address discovery failed and an Android node advertised no underlay addresses, leaving peers on the same LAN to reach it only at the address a lighthouse observed. (#1881) Recompute the transport checksum on packets a host sends to its own overlay address. On macOS the kernel leaves the checksum unfinished for hardware offload, which does not survive the trip through userspace, so TCP and UDP to a host's own IPv6 overlay address were dropped as corrupt. (#1862)

FEDORA-2026-1aa327b369 Packages in this update:

• nebula-1.11.2-1.fc45

Update description:

Windows tracks NLMTU per address family and Nebula only ever set it for AF_INET, so the IPv6 MTU on every Windows adapter sat at the adapter default of 65535 regardless of tun.mtu and the stack could hand Nebula packets far larger than configured. An IPv6 enabled overlay with tun.mtu under 1280 now refuses to start, matching the other platforms. (#1871) Android 11+ denies bind() on netlink route sockets inside the app sandbox, so local address discovery failed and an Android node advertised no underlay addresses, leaving peers on the same LAN to reach it only at the address a lighthouse observed. (#1881) Recompute the transport checksum on packets a host sends to its own overlay address. On macOS the kernel leaves the checksum unfinished for hardware offload, which does not survive the trip through userspace, so TCP and UDP to a host's own IPv6 overlay address were dropped as corrupt. (#1862)

FEDORA-2026-1a11502f81 Packages in this update:

• gopass-1.17.4-1.fc44
• gopass-jsonapi-1.17.4-1.fc44

Update description:

Update

FEDORA-2026-3bf1e0b3f9 Packages in this update:

• perl-GD-SecurityImage-1.75-23.fc44

Update description:

Until now, GD::SecurityImage used Perl's built-in rand function to generate secrets. The rand function is unsuitable for security applications because it is predictable and reversible. With this update, the module is patched to use Crypt::URandom::MonkeyPatch to override built-in rand (CVE-2026-13082)

FEDORA-2026-bdeade52d9 Packages in this update:

• perl-GD-SecurityImage-1.75-22.fc43

Update description:

Until now, GD::SecurityImage used Perl's built-in rand function to generate secrets. The rand function is unsuitable for security applications because it is predictable and reversible. With this update, the module is patched to use Crypt::URandom::MonkeyPatch to override built-in rand (CVE-2026-13082)

FEDORA-2026-825527e021 Packages in this update:

• perl-GD-SecurityImage-1.75-24.fc45

Update description:

Until now, GD::SecurityImage used Perl's built-in rand function to generate secrets. The rand function is unsuitable for security applications because it is predictable and reversible. With this update, the module is patched to use Crypt::URandom::MonkeyPatch to override built-in rand (CVE-2026-13082)

Version:7.2.10 (stable) Released:2026-10-11 Source:linux-7.2.10.tar.xz PGP Signature:linux-7.2.10.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-7.2.10

Version:6.18.56 (longterm) Released:2026-10-11 Source:linux-6.18.56.tar.xz PGP Signature:linux-6.18.56.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-6.18.56

FEDORA-2026-535e7d2281 Packages in this update:

• perl-Net-Whois-Raw-2.99.044-1.fc45

Update description:

Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names. This tool now uses Net::IDN::Encode instead of Net::IDN::Punycode, which fixes the issue.

FEDORA-2026-78d9d79627 Packages in this update:

• perl-Net-Whois-Raw-2.99.044-1.fc44

Update description:

Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names. This tool now uses Net::IDN::Encode instead of Net::IDN::Punycode, which fixes the issue.

FEDORA-2026-c330a15c68 Packages in this update:

• perl-Net-Whois-Raw-2.99.044-1.fc43

Update description:

Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names. This tool now uses Net::IDN::Encode instead of Net::IDN::Punycode, which fixes the issue.

FEDORA-2026-8918b368f4 Packages in this update:

• mkvtoolnix-96.0-2.fc43

Update description:

Backported fix for CVE-2026-90783.