🛡️ openSUSE-SU-2026:21146-1 — lldpd (CVE-2026-46433)

Security update for lldpd

This update for lldpd fixes the following issues:

Changes in lldpd:

• Update to version 1.0.22
• Fix CVE-2026-46433, out-of-bound read access when removing

VLAN tag (#787).

• Reject 0-length management address in LLDP.
• Fix race condition when creating the control socket.
• Fix FDP MAC address.
• Fix memory leak in the BSD bridge query path.
• Fix duplicate management addresses when merging EDP VLAN

frames.

• Update to version 1.0.21

Changes:

• Add "configure lldp portdescription-source" to choose how to

populate port description.

Fix:

• Fix path traversal vulnerabilities in the privileged process.
• Fix arbitrary file deletion in the privileged process.
• Fix accuracy of Dot3 MAU types advertised and add support for

200G and 400G.

• Fix detection of wireless interfaces.
• Update to version 1.0.20

Changes:

• Enable fast start unconditionally (and move its configuration

in "configure lldp").

• Make VLAN advertisements configurable.

Fix:

• Do not break zero-copy traffic on Linux.
• Fix crash on rapid addition/removal of interfaces.
• Fix management address selection when pattern is a negative

IP address.

• Update to version 1.0.19

Changes:

• Add cvlan/svlan/tpmr capabilities.
• Add lldpctl_watch_sync_unblock to liblldpctl.
• Add C++ wrapper for lldpctl.

Fix:

• Fix AppArmor policy for /run/lldpd/lldpd.socket.lock.
• Do not query stats for a down interface on Linux.