SUSE-SU-2026:3028-1

Details

Description of the patch:

This update for dnsmasq fixes the following issues

CVE-2026-12725: heap buffer overflow in log_query() when logging unsupported DS/DNSKEY replies (bsc#1268764).
CVE-2026-12969: out-of-bounds read in find_soa() due to missing extrabytes validation (bsc#1268882).

Changes for dnsmasq:

Update to 2.93:

Fix a corner-case in DNSSEC validation with wildcards.
Fix DNSSEC failure with spurious RRSIGs.
Fix DNSSEC fail with CNAME replies to DS queries.
Fix regression in 2.92 release which broke DHCPv6 when a DHCP relay is in use.
Modify the inotify implementation so that inotify watches are only created after dnsmasq has changed permissions and userid.

Affected Packages

dnsmasq

SUSE Linux Enterprise Desktop 15 SP7SUSE Linux Enterprise High Performance Computing 15 SP4SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5

Fixed in:

2.93-150400.16.17.1

References

ADVISORY

https://bugzilla.suse.com/1268764

ADVISORY

https://bugzilla.suse.com/1268882

ADVISORY

https://lists.suse.com/pipermail/sle-updates/2026-July/048304.html

ADVISORY

https://www.suse.com/security/cve/CVE-2026-12725/

ADVISORY

https://www.suse.com/security/cve/CVE-2026-12969/

WEB

https://www.suse.com/support/security/rating/

ADVISORY

https://www.suse.com/support/update/announcement/2026/suse-su-20263028-1/