SUSE-SU-2026:3480-1: kubevirt&distro=SUSE Linux Enterprise Module for Containers 15 SP7 SUSE Linux Enterprise

Vulnerability summary

SUSE-SU-2026:3480-1 is a vulnerability in kubevirt&distro=SUSE Linux Enterprise Module for Containers 15 SP7 SUSE Linux Enterprise with no CVSS score yet.

Timeline

1. 04-08-2026
   PublishedVulnerability first disclosed.
2. 05-08-2026
   Last modifiedVulnerability information updated.

Description

Security update for kubevirt This update for kubevirt fixes the following issues: - Security update correcting a CVE over-claim from the previous update, verified by auditing the fix code actually present in the vendored tree: * CVE-2026-39821 (bsc#1266575): the previous entry claimed this fixed by the golang.org/x/net v0.55.0 re-vendor, but 0.55.0's idna fix is compile-time gated on Unicode 16 tables, which only exist for go1.27+ - it is inert in our go1.25 builds, so the claim was incorrect. Re-vendor golang.org/x/net v0.55.0 -> v0.57.0, whose idna package rejects all-ASCII Punycode labels unconditionally; the CVE is now actually fixed. - Re-vendor golang.org/x/text v0.37.0 -> v0.40.0: CVE-2026-56852 (bsc#1271661), infinite loop on invalid input in unicode/norm. - golang.org/x/crypto v0.52.0 -> v0.54.0 (pulled in by x/net 0.57.0; no additional CVE claims, all previously listed x/crypto fixes remain included). - CVE-2026-13201 (bsc#1269093), safepath resolves a path whose last component is a symlink without detecting it, allowing metadata operations via /proc/self/fd to act on the symlink target. Backports of upstream release-1.7 commits 9ecda4ad5e and 1494cee849. - x/net 0.57.0 also contains the fix for CVE-2026-46600 (bsc#1272415) in dns/dnsmessage; kubevirt does not vendor that package (not affected), the bump merely rides past it.

No weakness data has been published for this record.