SUSE-SU-2026:24127-1
- Source
- https://www.suse.com/support/update/announcement/2026/suse-su-202624127-1/
- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:24127-1.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/SUSE-SU-2026:24127-1
- Upstream
- Related
- Published
- 2026-10-09T12:52:47Z
- Modified
- 2026-10-13T17:23:30Z
- Summary
- Security update for virtiofsd
- Details
-
This update for virtiofsd fixes the following issue:
- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257912).
Changes for virtiofsd:
- Update the time crate (bsc#1257912, CVE-2026-25727)
- Add command line options for UID/GID translation (bsc#1283239)
- PassthroughFs: Add IdMap structures (bsc#1283239)
- Add host/guest UID/GID translation code (bsc#1283239)
- Custom UID/GID mapping for Attr (bsc#1283239)
- Add UID/GID mapping functions to PassthroughFs (bsc#1283239)
- Use explicit UID/GID types (bsc#1283239)
- Introduce explicit UID/GID types (bsc#1283239)
- Use SetattrIn without conversion (bsc#1283239)
- Use fuse::Attr in FileSystem interfaces (bsc#1283239)
- References