🛡️ SUSE-SU-2026:2777-1 — cryptsetup (CVE-2026-41676)

Security update for cryptsetup, s390-tools

This update for cryptsetup, s390-tools fixes the following issue

Security fixes:

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270185).

Changes for s390-tools:

• Upgrade s390-tools to version 2.41.0 (jsc#PED-15860)
• Automatically set appropriate MTU for HSCI (bsc#1259314)
• Changes of existing tools:
• chreipl: Make --bootparms work for ECKD re-IPL
• cpacfstats: Add 'unauthorized' state to CPU-MF counters
• cpictl: Detect RHCOS using VARIANT_ID
• hsci: Automatically set appropriate MTU for HSCI
• libutil: Add util_readlink() and util_readlinkat() helpers
• libutil: Add util_startswith() to util_str
• libutil: Add utility parsing functions
• lschp: Add support for structured output (--format)
• lsreipl: Suppress 'clear' output if not supported
• pvimg: Add '--format text' support to 'pvimg info'
• pvimg: Add '--print-schema ' option to 'pvimg info'
• pvimg: Add '--show-secrets' flag to 'pvimg info'
• pvimg: Provide improved JSON output to 'pvimg info --format json'
• pvinfo: Improve User experience on non-SE enabled systems
• zipl/ngdump: Ensure ext4 file system is used on dump partition
• zkey: Add support for integrity protected disks using HMAC keys
• Bug Fixes:
• cpumf/pai: Handle different size of perf_event_attr
• lscss: Fix memory leak
• zipl: Fix dump job on tape devices

--- s390-tools 2.40 includes ---

• Add new tools / libraries:
• Add project-wide .clang-tidy configuration
• libutil: Introduce util_time for time related functionality
• libutil: Introduce zsh/bash autocompletion tooling based on util_opt
• pvinfo: Tool to display Secure Execution system information
• pvverify: Tool to verify host-key documents
• Changes of existing tools:
• cpumf: Implement zsh and bash autocompletion
• dasdfmt: Implement zsh and bash autocompletion
• dbginfo.sh: Add NetworkManager and netplan
• dbginfo.sh: Add kvm_stat
• dbginfo.sh: Adding stp time information
• dbginfo.sh: Simplify procfs collection
• hyptop: Add physical information row
• hyptop: Calculate sample time delta for physical partition
• hyptop: Replace long option names using _ with - for consistency

For example: --cpu_types > --cpu-types

(Options with _ are still supported for backward compatibility)

• libekmfweb: Add function to validate a certificate against the identity key
• netboot: Add longer kernel command lines support
• udev/rules.d: Make virtio-blk devices non-rotational
• udev/rules.d: Set default io scheduler to 'none' for virtio-blk
• ziomon: Add support to sample device symlinks (/dev/disk/...)
• ziorep_config: Add fcp-lun details to -M option output
• ziorep_config: Add port_id and failed attributes to -A option output
• netboot: Install on non-s390 architectures
• Bug Fixes:
• lib(ekmfweb|kmipclient): Use ln without -r
• s390-tools: Fix various compilation issues with musl libc
• zipl/boot: Fix unused loadparm when SCLP line-mode console is absent

--- s390-tools 2.39 includes ---

• Changes of existing tools:
• chpstat: Add options to select IEC units for scaling (SI units are default)
• chzdev: Introduce --no-module-load option
• cpi: Disable CPI for SEL guests by default
• dbginfo.sh: Enhance logging on timeout triggered
• iucvterm: Install symlink for lsiucvallow.8 man page
• lshwc: Add command line flag to specify individual counters
• lspai: Add command line flag for delta values
• lspai: Add command line flag for short counter names
• lspai: Add command line flag to specify individual counters
• lspai: Add command line flags for all cpus
• lspai: Add command line flags for hexadecimal output
• man: Use CR for constant width font
• pvimg: Add '--image-key' option
• zdev: Allow dynamic control of module load
• zipl/boot: Fix EBCDIC code page 500 conversion and decrease size by 200 bytes
• zipl: Add support of heterogeneous mirrors (remove technical limitations

on mirrored targets, thus allowing mirrored devices consist of partitions

at different offsets on disks of different types and geometry).

• zkey: Add support for generating and importing exportable secure keys
• Bug Fixes:
• chpstat: Fix scaling of DPU utilization calculation
• zdev/dracut: Prevent loading of unused kernel modules
• zdev: Fix double device configuration on DPM systems
• zdev: Fix double device configuration with rd.dasd
• zipl_helper.device-mapper: Fix segfault in an error path

--- s390-tools 2.38 includes ---

• Add new tools
• udev: New rule to set newly hotplugged CPUs online
• zmemtopo: Display memory topology information
• zpwr: Display power readings of a partition and CPC
• Removed tools / features
• check_hostkeydoc: Remove installation target
• scsi_logging_level: Delete SCSI logging script (available in sg3_utils)
• zdump: Drop build_arch for s390 DAS