Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package dpdk for openSUSE:Factory checked in at 2026-10-16 20:07:07 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/dpdk (Old) and /work/SRC/openSUSE:Factory/.dpdk.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "dpdk" Fri Oct 16 20:07:07 2026 rev:80 rq:1385153 version:25.11.4 Changes: -------- --- /work/SRC/openSUSE:Factory/dpdk/dpdk.changes 2026-08-27 18:50:46.797321847 +0200 +++ /work/SRC/openSUSE:Factory/.dpdk.new.3698736/dpdk.changes 2026-10-16 20:07:25.615470551 +0200 @@ -1,0 +2,32 @@ +Fri Oct 16 06:57:28 UTC 2026 - Clemens Famulla-Conrad <[email protected]> + +- Update to version 25.11.4 + * Full changelog https://doc.dpdk.org/guides-25.11/rel_notes/release_25_11.html#id7 + * GSO library heap out-of-bounds read/write with small mbuf pools + (CVE-2026-100236, bsc#1285679) + * stack and heap buffer overflow in nfp vDPA driver (CVE-2026-86856, + bsc#1285659) + * integer overflow and missing validation in vhost-crypto request handling + (CVE-2026-86849, bsc#1285658) + * use-after-free and type confusion in vhost-crypto session handling + (CVE-2026-86845, bsc#1285666) + * vhost-crypto TOCTOU out-of-bounds write in finalize path (CVE-2026-86846, + bsc#1285664, CVE-2026-86848, bsc#1285657) + * infinite cleanup loop in vhost-crypto writeback chain (CVE-2026-86847, + bsc#1285663) + * double-fetch leading to heap buffer overflow in virtio_net_ctrl_pop + (VDUSE) (CVE-2026-86562, bsc#1285677) + * copy length underflow in vhost enqueue (mbuf_to_desc) (CVE-2026-86566, + bsc#1285671 ) + * indirect descriptor table double-fetch (TOCTOU) (CVE-2026-93683, + bsc#1285660) + * split-ring inflight descriptor table overflow (CVE-2026-86565, + bsc#1285672) + * double offset bug in vhost log mapping calculation (CVE-2026-86563, + bsc#1285676) + * missing memory size validation before mmap in vhost memory region setup + (CVE-2026-86561, bsc#1285678) + * VDUSE vring stale pointer rebinding (use-after-unmap) (CVE-2026-86567, + bsc#1285670) + +------------------------------------------------------------------- Old: ---- dpdk-25.11.3.tar.xz New: ---- dpdk-25.11.4.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ dpdk.spec ++++++ --- /var/tmp/diff_new_pack.3WysFm/_old 2026-10-16 20:07:26.454505610 +0200 +++ /var/tmp/diff_new_pack.3WysFm/_new 2026-10-16 20:07:26.462505945 +0200 @@ -43,7 +43,7 @@ # Add option to build without tools %bcond_without tools Name: dpdk -Version: 25.11.3 +Version: 25.11.4 Release: 0 Summary: Set of libraries and drivers for fast packet processing License: BSD-3-Clause AND GPL-2.0-only AND LGPL-2.1-only ++++++ dpdk-25.11.3.tar.xz -> dpdk-25.11.4.tar.xz ++++++ /work/SRC/openSUSE:Factory/dpdk/dpdk-25.11.3.tar.xz /work/SRC/openSUSE:Factory/.dpdk.new.3698736/dpdk-25.11.4.tar.xz differ: char 26, line 1
