CVE-2026-56109
ALSA Library < 1.2.16.1 Double-Free via parse_def() in conf.c
The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
ALSA Library < 1.2.16.1 Double-Free via parse_def() in conf.c
The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.
- Record
CVE-2026-56109- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-415
- Updated
- 2026-11-02
EUVDEUVD-2026-38301
The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.
- Record
EUVD-2026-38301- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-jfrh-w252-q2h4
The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free...
The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.
- Record
GHSA-jfrh-w252-q2h4- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-415
- Updated
- 2026-11-02
NVD
The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.
- Record
CVE-2026-56109- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-415
- Updated
- 2026-11-02
OSVBELL-CVE-2026-56109
- Record
BELL-CVE-2026-56109- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSV
ALSA Library < 1.2.16.1 Double-Free via parse_def() in conf.c
The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.
- Record
CVE-2026-56109- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-415
- Updated
- 2026-11-02
Show 18 moreShow less
OSVDEBIAN-CVE-2026-56109
The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.
- Record
DEBIAN-CVE-2026-56109- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVOESA-2026-2847
alsa-lib security update
The alsa-lib is a library to interface with ALSA in the Linux kernel and virtual devices using a plugin system. More detail: https://alsa.opensrc.org/Alsa-lib
Security Fix(es):
The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.(CVE-2026-56109)
- Record
OESA-2026-2847- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSVOESA-2026-2848
alsa-lib security update
The alsa-lib is a library to interface with ALSA in the Linux kernel and virtual devices using a plugin system. More detail: https://alsa.opensrc.org/Alsa-lib
Security Fix(es):
The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.(CVE-2026-56109)
- Record
OESA-2026-2848- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSVOESA-2026-2849
alsa-lib security update
The alsa-lib is a library to interface with ALSA in the Linux kernel and virtual devices using a plugin system. More detail: https://alsa.opensrc.org/Alsa-lib
Security Fix(es):
The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.(CVE-2026-56109)
- Record
OESA-2026-2849- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSVOESA-2026-2850
alsa-lib security update
The alsa-lib is a library to interface with ALSA in the Linux kernel and virtual devices using a plugin system. More detail: https://alsa.opensrc.org/Alsa-lib
Security Fix(es):
The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.(CVE-2026-56109)
- Record
OESA-2026-2850- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSVRHSA-2026:40573
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:40573- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-56109
The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.
- Record
UBUNTU-CVE-2026-56109- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSVAZL-90204 No score
CVE-2026-56109 affecting package alsa-lib for versions less than 1.2.16.1-1
The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.
- Record
AZL-90204- Updated
- 2026-11-05
OSVMGASA-2026-0369 No score
Updated libalsa2 packages fix security vulnerabilities
alsa-lib 1.2.15.2 Topology Decoder Heap-based Buffer Overflow. (CVE-2026-25068) ALSA Library < 1.2.16.1 Double-Free via parse_def() in conf.c. (CVE-2026-56109)
- Record
MGASA-2026-0369- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21075-1 No score
Security update for alsa
This update for alsa fixes the following issue
- CVE-2026-56109: double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory (bsc#1268853).
- Record
openSUSE-SU-2026:21075-1- Updated
- 2026-11-02
OSVROOT-OS-ALPINE-324-CVE-2026-56109 No score
CVE-2026-56109 in alsa-lib - Patched by Root
Root has patched CVE-2026-56109 in the alsa-lib package for Root:Alpine:3.24. Multiple fixed versions available.
- Record
ROOT-OS-ALPINE-324-CVE-2026-56109- Updated
- 2026-11-02
OSVSUSE-SU-2026:22291-1 No score
Security update for alsa
This update for alsa fixes the following issue
- CVE-2026-56109: double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory (bsc#1268853).
- Record
SUSE-SU-2026:22291-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:22381-1 No score
Security update for alsa
This update for alsa fixes the following issue
- CVE-2026-56109: double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory (bsc#1268853).
- Record
SUSE-SU-2026:22381-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:22667-1 No score
Security update for alsa
This update for alsa fixes the following issue
- CVE-2026-56109: double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory (bsc#1268853).
- Record
SUSE-SU-2026:22667-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:2885-1 No score
Security update for alsa
This update for alsa fixes the following issue
- CVE-2026-56109: double-free vulnerability in parse_def() in src/conf.c that can allow attackers to corrupt memory (bsc#1268853).
- Record
SUSE-SU-2026:2885-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:3270-1 No score
Security update for alsa
This update for alsa fixes the following issue
- CVE-2026-56109: double-free vulnerability in parse_def() in src/conf.c that can allow attackers to corrupt memory (bsc#1268853).
- Record
SUSE-SU-2026:3270-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:3492-1 No score
Security update for alsa
This update for alsa fixes the following issue
- CVE-2026-56109: double-free vulnerability in parse_def() in src/conf.c that can allow attackers to corrupt memory (bsc#1268853).
- Record
SUSE-SU-2026:3492-1- Updated
- 2026-11-02
OSVUSN-8538-1 No score
alsa-lib vulnerability
It was discovered that alsa-lib incorrectly handled certain ALSA configuration text. An attacker could use this issue to cause alsa-lib to crash, resulting in a denial of service, or possibly execute arbitrary code.
- Record
USN-8538-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
alsa-libAzure Linux:3 |
before 1.2.16.1-1 | 1.2.16.1-1 |
alsa-libAlpaquita:23 |
1.2.8-r0 up to 1.2.8-r2 | 1.2.8-r2 |
alsa-libAlpaquita:25 |
1.2.14-r0 up to 1.2.14-r2 | 1.2.14-r2 |
alsa-libAlpaquita:stream |
1.2.7.2-r0 up to 1.2.16.1-r0 | 1.2.16.1-r0 |
alsa-libDebian:12 |
All versions, plus listed versions 1.2.10-11.2.10-21.2.10-31.2.10-3.11.2.10-3.1~exp1 Show 18 moreShow less1.2.10-3.1~exp21.2.10-3.21.2.11-11.2.12-11.2.13-11.2.14-11.2.14-21.2.15-11.2.15-21.2.15.1-11.2.15.3-11.2.16-11.2.16.1-11.2.16.1-1~bpo13+11.2.16.1-21.2.8-11.2.9-11.2.9-2 |
None known |
alsa-libDebian:13 |
All versions, plus listed versions 1.2.14-11.2.14-1+deb13u11.2.14-21.2.15-11.2.15-2 Show 6 moreShow less1.2.15.1-11.2.15.3-11.2.16-11.2.16.1-11.2.16.1-1~bpo13+11.2.16.1-2 |
None known |
alsa-libDebian:14 |
before 1.2.16.1-1, plus listed versions 1.2.14-11.2.14-21.2.15-11.2.15-21.2.15.1-11.2.15.3-11.2.16-11.2.16.1-1~bpo13+1 |
1.2.16.1-1 |
libalsa2Mageia:10 From an advisory covering 2 CVEs |
before 1.2.15.2-1.1.mga10 | 1.2.15.2-1.1.mga10 |
libalsa2Mageia:9 From an advisory covering 2 CVEs |
before 1.2.9-1.1.mga9 | 1.2.9-1.1.mga9 |
alsa-libopenEuler:24.03-LTS-SP3 |
before 1.2.10-5.oe2403sp3 | 1.2.10-5.oe2403sp3 |
Show 26 moreShow less
| Package | Affected | Fixed |
|---|---|---|
alsa-libopenEuler:20.03-LTS-SP4 |
before 1.2.3-3.oe2003sp4 | 1.2.3-3.oe2003sp4 |
alsa-libopenEuler:22.03-LTS-SP4 |
before 1.2.5.1-5.oe2203sp4 | 1.2.5.1-5.oe2203sp4 |
alsa-libopenEuler:24.03-LTS-SP1 |
before 1.2.10-5.oe2403sp1 | 1.2.10-5.oe2403sp1 |
alsa-libRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:1.2.16.1-2.hum1 | 0:1.2.16.1-2.hum1 |
alsa-lib-develRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:1.2.16.1-2.hum1 | 0:1.2.16.1-2.hum1 |
alsa-topologyRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:1.2.16.1-2.hum1 | 0:1.2.16.1-2.hum1 |
alsa-ucmRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:1.2.16.1-2.hum1 | 0:1.2.16.1-2.hum1 |
alsa-libRoot:Alpine:3.24 |
before 1.2.15.3-r00071 | 1.2.15.3-r00071 |
rootio-alsa-libRoot:Alpine:3.24 |
before 1.2.15.3-r00071 | 1.2.15.3-r00071 |
alsaSUSE:Linux Micro 6.2 |
before 1.2.14-160000.3.1 | 1.2.14-160000.3.1 |
alsaSUSE:Linux Enterprise Server 16.0 |
before 1.2.14-160000.3.1 | 1.2.14-160000.3.1 |
alsaSUSE:Linux Enterprise Server for SAP applications 16.0 |
before 1.2.14-160000.3.1 | 1.2.14-160000.3.1 |
alsaSUSE:Linux Micro 6.1 |
before 1.2.10-slfo.1.1_2.1 | 1.2.10-slfo.1.1_2.1 |
alsaSUSE:Linux Enterprise Micro 5.3 |
before 1.2.6.1-150400.3.3.1 | 1.2.6.1-150400.3.3.1 |
alsaSUSE:Linux Enterprise Micro 5.4 |
before 1.2.6.1-150400.3.3.1 | 1.2.6.1-150400.3.3.1 |
alsaSUSE:Linux Enterprise Module for Basesystem 15 SP7 |
before 1.2.10-150600.4.3.1 | 1.2.10-150600.4.3.1 |
alsaSUSE:Linux Enterprise Micro 5.5 |
before 1.2.8-150500.3.3.1 | 1.2.8-150500.3.3.1 |
alsa-libUbuntu:14.04:LTS |
All versions, plus listed versions 1.0.27.2-1ubuntu61.0.27.2-1ubuntu71.0.27.2-3ubuntu11.0.27.2-3ubuntu21.0.27.2-3ubuntu51.0.27.2-3ubuntu61.0.27.2-3ubuntu7 |
None known |
alsa-libUbuntu:16.04:LTS |
All versions, plus listed versions 1.0.29-0ubuntu11.1.0-0ubuntu1 |
None known |
alsa-libUbuntu:18.04:LTS |
All versions, plus listed versions 1.1.3-51.1.3-5ubuntu0.11.1.3-5ubuntu0.21.1.3-5ubuntu0.41.1.3-5ubuntu0.51.1.3-5ubuntu0.6 |
None known |
alsa-libUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.1.9-0ubuntu11.2.1.2-2ubuntu21.2.2-2ubuntu11.2.2-2.11.2.2-2.1ubuntu1 Show 7 moreShow less1.2.2-2.1ubuntu21.2.2-2.1ubuntu2.11.2.2-2.1ubuntu2.21.2.2-2.1ubuntu2.31.2.2-2.1ubuntu2.41.2.2-2.1ubuntu2.51.2.2-2.1ubuntu2.5+esm1 |
None known |
alsa-libUbuntu:22.04:LTS |
before 1.2.6.1-1ubuntu1.2, plus listed versions 1.2.4-1.1ubuntu31.2.4-1.1ubuntu41.2.5.1-1ubuntu11.2.6.1-1ubuntu11.2.6.1-1ubuntu1.1 |
1.2.6.1-1ubuntu1.2 |
alsa-libUbuntu:24.04:LTS |
before 1.2.11-1ubuntu0.3, plus listed versions 1.2.9-21.2.10-11.2.10-21.2.10-31.2.10-3build1 Show 4 moreShow less1.2.11-1build11.2.11-1build21.2.11-1ubuntu0.11.2.11-1ubuntu0.2 |
1.2.11-1ubuntu0.3 |
alsa-libUbuntu:25.10 |
All versions, plus listed versions 1.2.13-1build11.2.14-11.2.14-1ubuntu11.2.14-1ubuntu1.1 |
None known |
alsa-libUbuntu:26.04:LTS |
before 1.2.15.3-1ubuntu1.1, plus listed versions 1.2.14-1ubuntu11.2.14-2ubuntu11.2.15-21.2.15.1-11.2.15.3-11.2.15.3-1build11.2.15.3-1ubuntu1 |
1.2.15.3-1ubuntu1.1 |
alsaopenSUSE:Leap 16.0 |
before 1.2.14-160000.3.1 | 1.2.14-160000.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| affected, aliases, products, published, references | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-56109 is a high vulnerability (CVSS 7.0) in Alsa Project Alsa-lib, published June 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.14%, the 3rd percentile. Fixed in alsa-lib 1.2.16.1-1.
References
lore.kernel.org/alsa-devel/CAGt8pqBU0p2voB+[email protected]
github.com/alsa-project/alsa-lib/releases/tag/v1.2.16.1
vulncheck.com/advisories/alsa-library-double-free-via-parse-def-in-conf-c
nvd.nist.gov/vuln/detail/CVE-2026-56109
Show 36 moreShow less
docs.bell-sw.com/security/cves/CVE-2026-56109
security-tracker.debian.org/tracker/CVE-2026-56109
advisories.mageia.org/MGASA-2026-0369.html
bugs.mageia.org/show_bug.cgi?id=35934
ubuntu.com/security/notices/USN-8044-1
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-2847
access.redhat.com/errata/RHSA-2026:40573
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_40573.json
bugzilla.redhat.com/show_bug.cgi?id=2491439
cve.org/CVERecord?id=CVE-2026-56109
suse.com/support/update/announcement/2026/suse-su-202622291-1
bugzilla.suse.com/1268853