SUSE-SU-2026:3480-1

Advisory lineage Upstream: 4 Downstream: 0
Published: 04 Aug 2026, 11:42
Last modified:05 Aug 2026, 18:23

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

04 Aug 2026, 11:42
Published
Vulnerability first disclosed
05 Aug 2026, 18:23
Last Modified
Vulnerability information updated

Description

Security update for kubevirt This update for kubevirt fixes the following issues: - Security update correcting a CVE over-claim from the previous update, verified by auditing the fix code actually present in the vendored tree: * CVE-2026-39821 (bsc#1266575): the previous entry claimed this fixed by the golang.org/x/net v0.55.0 re-vendor, but 0.55.0's idna fix is compile-time gated on Unicode 16 tables, which only exist for go1.27+ - it is inert in our go1.25 builds, so the claim was incorrect. Re-vendor golang.org/x/net v0.55.0 -> v0.57.0, whose idna package rejects all-ASCII Punycode labels unconditionally; the CVE is now actually fixed. - Re-vendor golang.org/x/text v0.37.0 -> v0.40.0: CVE-2026-56852 (bsc#1271661), infinite loop on invalid input in unicode/norm. - golang.org/x/crypto v0.52.0 -> v0.54.0 (pulled in by x/net 0.57.0; no additional CVE claims, all previously listed x/crypto fixes remain included). - CVE-2026-13201 (bsc#1269093), safepath resolves a path whose last component is a symlink without detecting it, allowing metadata operations via /proc/self/fd to act on the symlink target. Backports of upstream release-1.7 commits 9ecda4ad5e and 1494cee849. - x/net 0.57.0 also contains the fix for CVE-2026-46600 (bsc#1272415) in dns/dnsmessage; kubevirt does not vendor that package (not affected), the bump merely rides past it.

Affected Systems

  • suse•kubevirt&distro=SUSE Linux Enterprise Module for Containers 15 SP7

    < 1.7.4-150700.3.33.1

References (9)