kernel-7.2.15-100.fc43
FEDORA-2026-81337e9cbe
Packages in this update:
- kernel-7.2.15-100.fc43
The 7.2.15 stable kernel update contains a number of important fixes across the tree.
Aggregator
kernel-7.2.15-300.fc45
FEDORA-2026-7a0f444c64
Packages in this update:
- kernel-7.2.15-300.fc45
The 7.2.15 stable kernel update contains a number of important fixes across the tree.
kernel-7.2.15-200.fc44
FEDORA-2026-778424cb43
Packages in this update:
- kernel-7.2.15-200.fc44
The 7.2.15 stable kernel update contains a number of important fixes across the tree.
libopenmpt-0.8.10-1.el10_2
FEDORA-EPEL-2026-4194d9df6f
Packages in this update:
- libopenmpt-0.8.10-1.el10_2
- [Sec] SymMOD: Potential divison by 0 when trying to decode an embedded IMA ADPCM WAV sample claiming to contain 0 audio channels (r25831).
- [Bug] SymMOD: It was possible that a fact chunk of an embedded WAV file claimed an impossibly big sample length for an IMA ADPCM sample, causing unnecessarily large memory allocations.
- Volume column portamento effect memory was not updated properly during seeking, causing notes to continue playing at the wrong pitch.
- [Sec] Possible heap out-of-bounds write when loading SymMOD files containing WAV IMA ADPCM samples (r25623, r25645). See also https://github.com/OpenMPT/openmpt/security/advisories/GHSA-fxf7-wc37-p2cx
- [Sec] Possible heap out-of-bounds read when loading custom tunings from MPTM files (r25609, r25615).
- IT: Due to an Impulse Tracker bug in Compatible Gxx mode, Envelope Carry may not resume the envelope from the correct position when there is both an instrument number and tone portamento next to a note.
- XM: NitroTracker ignores instrument numbers where there is no note next to them, so they are no longer imported. Fixes various NitroTracker-made XMs such as notominous-a19.xm.
- STK: Loosen heuristics a bit to allow STK.CRB-GreatMuzaxs6 to load.
-
GT2: Loading file versions 6 and later was broken since libopenmpt 0.8.0.
-
mpg123: Update to v1.33.7 (2026-08-03).
- miniz: Update to v3.1.2 (2026-07-01).
- pugixml: Update to v1.16 (2026-06-16).
libopenmpt-0.8.10-1.el8
FEDORA-EPEL-2026-3423413067
Packages in this update:
- libopenmpt-0.8.10-1.el8
- [Sec] SymMOD: Potential divison by 0 when trying to decode an embedded IMA ADPCM WAV sample claiming to contain 0 audio channels (r25831).
- [Bug] SymMOD: It was possible that a fact chunk of an embedded WAV file claimed an impossibly big sample length for an IMA ADPCM sample, causing unnecessarily large memory allocations.
- Volume column portamento effect memory was not updated properly during seeking, causing notes to continue playing at the wrong pitch.
- [Sec] Possible heap out-of-bounds write when loading SymMOD files containing WAV IMA ADPCM samples (r25623, r25645). See also https://github.com/OpenMPT/openmpt/security/advisories/GHSA-fxf7-wc37-p2cx
- [Sec] Possible heap out-of-bounds read when loading custom tunings from MPTM files (r25609, r25615).
- IT: Due to an Impulse Tracker bug in Compatible Gxx mode, Envelope Carry may not resume the envelope from the correct position when there is both an instrument number and tone portamento next to a note.
- XM: NitroTracker ignores instrument numbers where there is no note next to them, so they are no longer imported. Fixes various NitroTracker-made XMs such as notominous-a19.xm.
- STK: Loosen heuristics a bit to allow STK.CRB-GreatMuzaxs6 to load.
-
GT2: Loading file versions 6 and later was broken since libopenmpt 0.8.0.
-
mpg123: Update to v1.33.7 (2026-08-03).
- miniz: Update to v3.1.2 (2026-07-01).
- pugixml: Update to v1.16 (2026-06-16).
libopenmpt-0.8.10-1.el9
FEDORA-EPEL-2026-a0734f2f20
Packages in this update:
- libopenmpt-0.8.10-1.el9
- [Sec] SymMOD: Potential divison by 0 when trying to decode an embedded IMA ADPCM WAV sample claiming to contain 0 audio channels (r25831).
- [Bug] SymMOD: It was possible that a fact chunk of an embedded WAV file claimed an impossibly big sample length for an IMA ADPCM sample, causing unnecessarily large memory allocations.
- Volume column portamento effect memory was not updated properly during seeking, causing notes to continue playing at the wrong pitch.
- [Sec] Possible heap out-of-bounds write when loading SymMOD files containing WAV IMA ADPCM samples (r25623, r25645). See also https://github.com/OpenMPT/openmpt/security/advisories/GHSA-fxf7-wc37-p2cx
- [Sec] Possible heap out-of-bounds read when loading custom tunings from MPTM files (r25609, r25615).
- IT: Due to an Impulse Tracker bug in Compatible Gxx mode, Envelope Carry may not resume the envelope from the correct position when there is both an instrument number and tone portamento next to a note.
- XM: NitroTracker ignores instrument numbers where there is no note next to them, so they are no longer imported. Fixes various NitroTracker-made XMs such as notominous-a19.xm.
- STK: Loosen heuristics a bit to allow STK.CRB-GreatMuzaxs6 to load.
-
GT2: Loading file versions 6 and later was broken since libopenmpt 0.8.0.
-
mpg123: Update to v1.33.7 (2026-08-03).
- miniz: Update to v3.1.2 (2026-07-01).
- pugixml: Update to v1.16 (2026-06-16).
libopenmpt-0.8.10-1.el10_4
FEDORA-EPEL-2026-ba693411ed
Packages in this update:
- libopenmpt-0.8.10-1.el10_4
- [Sec] SymMOD: Potential divison by 0 when trying to decode an embedded IMA ADPCM WAV sample claiming to contain 0 audio channels (r25831).
- [Bug] SymMOD: It was possible that a fact chunk of an embedded WAV file claimed an impossibly big sample length for an IMA ADPCM sample, causing unnecessarily large memory allocations.
- Volume column portamento effect memory was not updated properly during seeking, causing notes to continue playing at the wrong pitch.
- [Sec] Possible heap out-of-bounds write when loading SymMOD files containing WAV IMA ADPCM samples (r25623, r25645). See also https://github.com/OpenMPT/openmpt/security/advisories/GHSA-fxf7-wc37-p2cx
- [Sec] Possible heap out-of-bounds read when loading custom tunings from MPTM files (r25609, r25615).
- IT: Due to an Impulse Tracker bug in Compatible Gxx mode, Envelope Carry may not resume the envelope from the correct position when there is both an instrument number and tone portamento next to a note.
- XM: NitroTracker ignores instrument numbers where there is no note next to them, so they are no longer imported. Fixes various NitroTracker-made XMs such as notominous-a19.xm.
- STK: Loosen heuristics a bit to allow STK.CRB-GreatMuzaxs6 to load.
-
GT2: Loading file versions 6 and later was broken since libopenmpt 0.8.0.
-
mpg123: Update to v1.33.7 (2026-08-03).
- miniz: Update to v3.1.2 (2026-07-01).
- pugixml: Update to v1.16 (2026-06-16).
libopenmpt-0.8.10-1.el10_3
FEDORA-EPEL-2026-6d0b6ab2fd
Packages in this update:
- libopenmpt-0.8.10-1.el10_3
- [Sec] SymMOD: Potential divison by 0 when trying to decode an embedded IMA ADPCM WAV sample claiming to contain 0 audio channels (r25831).
- [Bug] SymMOD: It was possible that a fact chunk of an embedded WAV file claimed an impossibly big sample length for an IMA ADPCM sample, causing unnecessarily large memory allocations.
- Volume column portamento effect memory was not updated properly during seeking, causing notes to continue playing at the wrong pitch.
- [Sec] Possible heap out-of-bounds write when loading SymMOD files containing WAV IMA ADPCM samples (r25623, r25645). See also https://github.com/OpenMPT/openmpt/security/advisories/GHSA-fxf7-wc37-p2cx
- [Sec] Possible heap out-of-bounds read when loading custom tunings from MPTM files (r25609, r25615).
- IT: Due to an Impulse Tracker bug in Compatible Gxx mode, Envelope Carry may not resume the envelope from the correct position when there is both an instrument number and tone portamento next to a note.
- XM: NitroTracker ignores instrument numbers where there is no note next to them, so they are no longer imported. Fixes various NitroTracker-made XMs such as notominous-a19.xm.
- STK: Loosen heuristics a bit to allow STK.CRB-GreatMuzaxs6 to load.
-
GT2: Loading file versions 6 and later was broken since libopenmpt 0.8.0.
-
mpg123: Update to v1.33.7 (2026-08-03).
- miniz: Update to v3.1.2 (2026-07-01).
- pugixml: Update to v1.16 (2026-06-16).
7.4-rc1: mainline
Version:7.4-rc1 (mainline)
Released:2026-11-01
Source:linux-7.4-rc1.tar.gz
Patch:full
partclone-0.3.52-1.el10_4
FEDORA-EPEL-2026-0892a8382c
Packages in this update:
- partclone-0.3.52-1.el10_4
- fix(btrfs): deduplicate extents scanned more than once when building the bitmap
- chore(btrfs): sync with btrfs-progs v6.17.1
- Fix static linking by renaming internal crc32 to pc_crc32
- exfat: clone the last two clusters of a volume
- Add JSON status output for progress monitoring
- Fix/ntfs backup bootsector
7.2.15: stable
Version:7.2.15 (EOL) (stable)
Released:2026-11-01
Source:linux-7.2.15.tar.xz
PGP Signature:linux-7.2.15.tar.sign
Patch:full (incremental)
ChangeLog:ChangeLog-7.2.15
perl-Net-IDN-Encode-2.600-1.fc45
FEDORA-2026-f6acaf8756
Packages in this update:
- perl-Net-IDN-Encode-2.600-1.fc45
Version 2.600 of Net::IDN::Encode fixes multiple CVEs: * CVE-2026-74766, a heap use-after-free in the XS decode_punycode * CVE-2026-74765, an integer overflow and out-of-bounds read in the XS encode_punycode * CVE-2026-87078, memory leaks when the XS functions reject input * CVE-2026-87079, quadratic decoding of large labels * CVE-2026-87080, the pure-Perl decoder accepting a truncated label * CVE-2026-87081, quadratic encoding of overlong labels in to_ascii * CVE-2026-87082, the XS encode_punycode looping for ever on malformed UTF-8 input
perl-Net-IDN-Encode-2.600-1.fc44
FEDORA-2026-effb380a7c
Packages in this update:
- perl-Net-IDN-Encode-2.600-1.fc44
Version 2.600 of Net::IDN::Encode fixes multiple CVEs: * CVE-2026-74766, a heap use-after-free in the XS decode_punycode * CVE-2026-74765, an integer overflow and out-of-bounds read in the XS encode_punycode * CVE-2026-87078, memory leaks when the XS functions reject input * CVE-2026-87079, quadratic decoding of large labels * CVE-2026-87080, the pure-Perl decoder accepting a truncated label * CVE-2026-87081, quadratic encoding of overlong labels in to_ascii * CVE-2026-87082, the XS encode_punycode looping for ever on malformed UTF-8 input
perl-Net-IDN-Encode-2.600-1.fc43
FEDORA-2026-3cb8ce0117
Packages in this update:
- perl-Net-IDN-Encode-2.600-1.fc43
Version 2.600 of Net::IDN::Encode fixes multiple CVEs: * CVE-2026-74766, a heap use-after-free in the XS decode_punycode * CVE-2026-74765, an integer overflow and out-of-bounds read in the XS encode_punycode * CVE-2026-87078, memory leaks when the XS functions reject input * CVE-2026-87079, quadratic decoding of large labels * CVE-2026-87080, the pure-Perl decoder accepting a truncated label * CVE-2026-87081, quadratic encoding of overlong labels in to_ascii * CVE-2026-87082, the XS encode_punycode looping for ever on malformed UTF-8 input
perl-Starlet-0.33-1.fc44
FEDORA-2026-bd36d053a1
Packages in this update:
- perl-Starlet-0.33-1.fc44
Starlet 0.33 fixes several security issues in the Starlet code: * prevent excessive CPU use when parsing malformed chunk-size lines * bound read allocations for large Content-Length values * stream chunk data to the body buffer and limit chunk-size lines to 4096 bytes
perl-Starlet-0.33-1.fc45
FEDORA-2026-7d9cd72397
Packages in this update:
- perl-Starlet-0.33-1.fc45
Starlet 0.33 fixes several security issues in the Starlet code: * prevent excessive CPU use when parsing malformed chunk-size lines * bound read allocations for large Content-Length values * stream chunk data to the body buffer and limit chunk-size lines to 4096 bytes
perl-Starlet-0.33-1.fc43
FEDORA-2026-092670ec3e
Packages in this update:
- perl-Starlet-0.33-1.fc43
Starlet 0.33 fixes several security issues in the Starlet code: * prevent excessive CPU use when parsing malformed chunk-size lines * bound read allocations for large Content-Length values * stream chunk data to the body buffer and limit chunk-size lines to 4096 bytes
DSA-6600-1 vim - security update
perl-Spreadsheet-XLSX-0.20-1.el10_3
FEDORA-EPEL-2026-559c31a5c6
Packages in this update:
- perl-Spreadsheet-XLSX-0.20-1.el10_3
- Security: limit ZIP entry counts and uncompressed sizes; read members incrementally and reject inconsistent size metadata.
- Security: validate number format IDs and escape regex lookups to prevent regex injection from crafted styles.
- Security: reject out-of-range date values to prevent excessive CPU usage.
- Security: validate cell references against XLSX worksheet limits before indexing cell arrays, preventing excessive allocation from invalid rows.
- Improve Readme.
- Security: replace string eval of number-format conditions with strict numeric comparisons; invalid conditions use the fallback format section. Prevents arbitrary Perl code execution when parsing crafted XLSX files.
- Add regression tests for numeric conditions and malicious XLSX formats.
perl-Spreadsheet-XLSX-0.20-1.el10_4
FEDORA-EPEL-2026-df61aac489
Packages in this update:
- perl-Spreadsheet-XLSX-0.20-1.el10_4
- Security: limit ZIP entry counts and uncompressed sizes; read members incrementally and reject inconsistent size metadata.
- Security: validate number format IDs and escape regex lookups to prevent regex injection from crafted styles.
- Security: reject out-of-range date values to prevent excessive CPU usage.
- Security: validate cell references against XLSX worksheet limits before indexing cell arrays, preventing excessive allocation from invalid rows.
- Improve Readme.
- Security: replace string eval of number-format conditions with strict numeric comparisons; invalid conditions use the fallback format section. Prevents arbitrary Perl code execution when parsing crafted XLSX files.
- Add regression tests for numeric conditions and malicious XLSX formats.