Release Notes #

SUSE Linux Enterprise Server 15 introduces many innovative changes compared to SUSE Linux Enterprise Server 12. The most important changes are listed below.

SUSE Linux Enterprise Server 15 SP7 introduces changes compared to SUSE Linux Enterprise Server 15 SP6. The most important changes are listed below:

The full list of changed packages compared to 15 SP6 can be seen at this URL:

The full list of changed modules compared to 15 SP6 can be seen at this URL:

As of 15 SP7, SUSE Linux Enterprise High Performance Computing is no longer a separate product. As a result:

The SLE HPC release notes are maintained separately as a supplement to the SLES release notes. For detailed information about packages and changes in the HPC Module, see the separate SUSE Linux Enterprise High Performance Computing Release Notes at https://documentation.suse.com/releasenotes/sle-hpc/15-SP7/index.html.

Modules

For an HPC installation the user should enable the following modules:

On SUSE Linux Enterprise Server system, make sure the following modules are all enabled:

Roles

The HPC system roles are no longer available:

It is recommended to start with a Text Mode or Minimal System istallation. The admin should make sure that the system is partitioned to the respective requirements and the firewall is configured appropriately. Also, the admin should select the software components required. This may include slurm for the management server, slurm-node for the compute nodes. For login and compute nodes the pattern HPC Modularized Libraries (patterns-hpc-libraries) is available.

SUSE provides quarterly updates for SUSE Linux Enterprise Server 15 SP7 until the end of General Support on 31 Jul 2031. SUSE refreshes the installation media, virtual machine (VM) images, and public cloud images at least quarterly.

Some packages and components shipped with SUSE Linux Enterprise Server have lifecycles that are not strictly aligned with the lifecycle of the product or its service packs. Some components (such as Java or Python) have specific, independent lifecycles. Others (such as Go, Rust, Node.js, and GCC) are updated in the released service packs to keep up with security and upstream developments.

For overall lifecycle information for SUSE products, refer to the SUSE Product Lifecycle page at https://www.suse.com/lifecycle/. For details on module-specific package lifecycles, see the SUSE Linux Enterprise Server 15 Modules Lifecycle page at https://scc.suse.com/docs/lifecycle/sle/15/modules.

To learn about supported features and limitations, refer to the following sections in this document:

Certain software delivered as part of SUSE Linux Enterprise Server may require an external contract. Check the support status of individual packages using the RPM metadata that can be viewed with rpm, zypper, or YaST.

Major packages and groups of packages affected by this are:

SUSE Linux Enterprise Server 15 SP7 (and the SUSE Linux Enterprise modules) includes the following software that is shipped only under a GNU AGPL software license:

SUSE Linux Enterprise Server 15 SP7 (and the SUSE Linux Enterprise modules) includes the following software that is shipped under multiple licenses that include a GNU AGPL software license:

The set of media has changed with 15 SP2. There still are two different installation media, but the way they can be used has changed:

The following checklist summarizes key action items and potential gotchas documented across these release notes, organized by migration phase.

The obsolete scsi_mod.use_blk_mq kernel parameter has been completely removed from the kernel. Multi-queue block I/O is now the only available block I/O framework. If configurations (such as the kernel command line or files under /etc/modprobe.d/) still reference scsi_mod.use_blk_mq, a warning is shown at boot: scsi_mod: unknown parameter 'use_blk_mq' ignored. This parameter can be safely removed from configurations as multi-queue block I/O is always active.

After upgrading from SLES 12 SP4 or earlier, regular user accounts cannot log in to the system. This is caused by the deprecation of pam_unix2 because of its issues with systemd. For information how to fix the issue, see https://www.suse.com/support/kb/doc/?id=000019703.

Upgrading the system is only supported from the most recent patch level. Make sure the latest system updates are installed by either running zypper patch or by starting the YaST module Online Update. An upgrade on a system that is not fully patched may fail.

Skipping service packs during an upgrade is only supported if you have a Long Term Service Pack Support contract. Otherwise, you need to first upgrade to SLE 15 SP6 before upgrading to SLE 15 SP7.

You can upgrade directly from SUSE Linux Enterprise Server 12 SP5 LTSS to SUSE Linux Enterprise Server 15 15 SP7. You cannot upgrade from SUSE Linux Enterprise Server 12 SP5 LTSS to SUSE Linux Enterprise Server 15 SP5 or older. Older service packs contain older package versions than SUSE Linux Enterprise Server 12 SP5 LTSS. Upgrading to those service packs causes package downgrades, which can break the system. To upgrade from SUSE Linux Enterprise Server 12 SP5 LTSS, you must upgrade directly to SUSE Linux Enterprise Server 15 SP6 or newer.

Note

RMT supports SUSE Linux Enterprise Server 16.0 clients.

SLE 12 is the last codestream that SMT (Subscription Management Tool) is available for.

When upgrading your OS installation to SLE 15, we recommend also upgrading from SMT to its replacement RMT (Repository Mirroring Tool). RMT provides the following functionality:

Note that unlike SMT, RMT does not support installations of SLE 11 and earlier.

For more feature comparison between RMT and SMT, see https://github.com/SUSE/rmt/blob/master/docs/smt_and_rmt.md.

For more information about RMT, see the RMT Guide at https://documentation.suse.com/sles/15-SP7/html/SLES-all/book-rmt.html.

Kerberos 5 (krb5) now disables deprecated encryption types by default. These encryption types do not meet current security standards.

SUSE removed the following encryption types from the default krb5 configuration:

To use these encryption types, add the following lines to the [libdefaults] section of the /etc/krb5.conf file:

[libdefaults]
allow_des3 = true
allow_rc4 = true

A STIG-compliant SUSE Linux Enterprise Base Container Image (SLE BCI) is now available via the DoD’s Iron Bank repository, supporting secure software supply chains for US Government agencies.

For more information see https://www.suse.com/c/sle-bci-base-container-available-for-us-government-agencies-on-iron-bank/.

The container registry entries for Docker Hub and openSUSE Registry, which were previously included by default, have now been removed. If you want to pull container images from either of them, add them to the /etc/containers/registries.conf file.

Starting with SUSE Linux Enterprise 15 SP3, the rpm package in the suse/sle15 container image no longer supports the BDB back-end (based on Berkeley DB) and switches to the NDB back-end. Tools for scanning, diffing, and building container image using the rpm binary of the host for introspection can fail or return incorrect results if the host’s version of rpm does not recognize the NDB format.

To use such tools, make sure that the host supports reading NDB databases, such as hosts with SUSE Linux Enterprise 15 SP2 and later.

The PostgreSQL database is now fully supported by SUSE. You no longer need an external support contract.

The pgadmin4 package has been updated to version 8.5. It is now part of the Python 3 Module.

The gtk4-lang package is now included. This provides the translation files necessary for GTK 4 applications to display localized user interfaces.

SUSE Linux Enterprise Server now includes the python311-apache-libcloud package. This package provides the Apache Libcloud library for Python 3.11. You can use this package to run salt-cloud in Python 3.11 environments.

The Ansible packages (ansible-core) are included in SUSE Linux Enterprise Server 15 SP6 and newer. Support is limited to any Ansible playbooks or roles that are provided by SUSE as part of SUSE Linux Enterprise Server or SUSE Multi-Linux Manager products, whether supplied directly (for example, via packages, ISO images, ready-to-run images) or dynamically generated by integrated tools within these products.

In SLES 15 SP7, Ruby version 3.4 has been added. This is in addition to the existing Ruby 2.5.

The python311-base and libpython3_11-1_0 packages have been moved to the Basesystem Module for technical reasons. These two packages still follow the lifecycle of the Python 3 Module (that is, until December 2029) and that is reflected in the metadata as well.

A new Python interpreter version 3.13 has been added. This interpreter has a shorter support period of 1.5 years and is there to support installing additional packages via pip.

The glibc package has been updated to version 2.38.

Before LTSS we provide concurrent support for up to 3 upstream versions of nodejs in SLES 15 SP7. In LTSS we only support the latest nodejs version.

Note that the upstream version naming might change but this will not change what is supported.

The nodejs24 package has been added to the Web and Scripting Module. This is now the default Node.js version in SLES 15 SP7. The nodejs-common package has been updated so that the nodejs default command points to Node.js 24.

The following Java implementations are available in SUSE Linux Enterprise Server 15 SP7:

Performance Monitoring Unit (PMU) features do not function correctly on systems with Intel hybrid CPUs in this release. The Linux kernel requires additional changes to fully support the PMU on these processors, which were only introduced in Linux kernel version 6.9.

Because SLES 15 SP7 is based on kernel 6.4, these improvements are not included.

The smc (Shared Memory Communication) kernel driver has been updated to the latest upstream version.

Note that currently using the smc driver can cause the system to freeze. This will be fixed in a future release.

The cgroups-v2 CPU load-balancing feature has been backported to the 15 SP7 kernel.

The externally supported flag is no longer stored as a taint flag now. This means that the kernel is no longer tainted after an externally-supported module is inserted.

Currently, libpulp supports user space live patching of glibc and openssl binaries on the following architectures:

For more information see https://documentation.suse.com/sles/15-SP7/html/SLES-all/cha-ulp.html

The SUSE Linux Enterprise Server 15 SP6 kernels diverged from latest CONFIG_HZ default settings for multiple architectures.

The SUSE Linux Enterprise Server for Arm 15 SP7 kernel changed the CONFIG_HZ value (Section 9.3, “Changed kernel CONFIG_HZ value”): x86-64 and Arm* architectures now use the same value of 250 Hz.

PowerPC and IBM Z architectures continue to share a value of 100 Hz.

These configuration values cannot be overridden from the kernel command line. If your applications run into issues, contact your SUSE representative.

This table summarizes the various limits which exist in our recent kernels and utilities (if related) for SUSE Linux Enterprise Server 15 SP7.

¹ By default, the user space memory limit on the POWER architecture is 128 TiB. However, you can explicitly request mmaps up to 4 PiB.

² The total number of all processes and all threads on a system may not be higher than the "maximum number of processes".

Previously in kernel 5.14, it was possible to disable compression by passing an empty string instead of explicitly mentioning none or no.

In SLES 15 SP7, this behavior is changed to the more expected one. From kernel 5.14 onwards, empty string will reset the default setting instead of disabling compression.

On HPE UV5 platforms (for example, Google Compute Engine (GCE) X4 bare-metal instances), the kernel clocksource watchdog monitored the Time Stamp Counter (TSC) clocksource. This monitoring could cause system instability. To prevent this instability, users had to disable the clocksource watchdog manually. This manual configuration required adding the tsc=nowatchdog parameter to the kernel command line and restarting the system.

Now, the kernel automatically disables the clocksource watchdog for the TSC on all HPE UV5 platforms. Users do not need to configure the kernel command line or restart their systems.

These two packages have been renamed:

The hwloc package has been updated to version 2.11.2:

Main configuration files have been moved from /etc to /usr. This ensures that main configuration files have lower precedence, allowing them to be overriden by package-supplied drop-in snippets.

Local configuration should be created by either modifying the default file in /usr (or a copy of it placed in /etc if the original file is shipped in /usr), or by creating drop-in snippets in the appropriate directory in (for example, /etc/systemd/coredump.conf.d/) - this is recommended.

Remove configurations in /etc to restore defaults.

The default for KDUMP_CPUS changed from 1 to 32, allowing kdump to use up to 32 threads to generate a kernel dump.

A new module called Systems Management Module has been added. This module will include systems-management packages, such as Ansible.

In SLES 15 SP7, Ansible has been added to the Systems Management Module.

Certain configurations can cause errors viewable using the dmesg command, with the following content:

IDXD: user: probe of wq1.0 failed with error -95

These can be safely ignored for now. They will be fixed in a future release.

The Apache HTTP Server (apache2) has been upgraded to version 2.4.66. This update addresses several stability issues, including a segmentation fault (SIGSEGV) when serving HTTP/2 requests under certain race conditions. Previously, connections could abort during complex subrequest error handling, causing mod_include to access freed memory. Upgrading to Apache 2.4.66 resolves this issue and ensures ongoing security and stability.

The firewalld package with the version 1.3.4 has been added to our repositories. We now provide this legacy version additionally to the existing package.

Due to high firewall reload times, some users are facing performance problems with the 2.x.x version series. Affected users can now downgrade to the legacy version but staying on the 2.x.x series is strongly recommended.

Execute the following commands to downgrade and to prevent the package from upgrading to the 2.x.x series:

zypper refresh
zypper install --oldpackage --allow-downgrade 'firewalld < 2'
zypper addlock 'firewalld >= 2'

During the downgrade, the firewall will stay active and the firewall configuration will be preserved. Check the firewall configuration and restart the relevant service to use the newly installed version. Execute the following command to restart the firewall:

systemctl restart firewalld.service

You are able to update your system as usual and the firewalld legacy package will receive updates but won’t be upgraded to version 2.x.x. Once the performance problems are resolved, revert back to using the latest version available in our repositories.

Execute the following commands to revert back to the lastest version in our repositories. The firewall stays active during this process.

zypper removelock 'firewalld >= 2'
zypper refresh
zypper update

After the update succeeded, check your firewall configuration and restart the relevant service to use the newly installed version. Execute the following command to restart the firewall:

systemctl restart firewalld.service

Kea DHCP (as package kea) is a DHCP server that is replacing the end-of-life dhcpd package (also known as ISC DHCP). For more information see https://www.isc.org/kea/

The bind package has been updated from version 9.16 to version 9.18. This is a major update that removes several options but also adds, among others, the following features:

See the full changelog for more information.

The systemd-resolved package has been split from the main systemd-network package into an independent, standalone sub-package. systemd-resolved provides network name resolution via a local stub resolver, enabling features such as DNS-over-TLS (DoT).

The version of Samba shipped with SUSE Linux Enterprise Server 15 SP7 delivers integration with Windows Active Directory domains. In addition, we provide the clustered version of Samba as part of SUSE Linux Enterprise High Availability 15 SP7.

The clamav package has been updated to version 1.0. This major version update introduces several new features, security enhancements, and bug fixes:

By default, system-wide cryptographic policies now enable the sntrup761x25519-sha512@openssh.com post-quantum cryptography (PQC) key exchange algorithm for SSH connections. This prevents connection warnings (such as WARNING: connection is not using a post-quantum key exchange algorithm) from modern external SSH clients that require post-quantum security by default. The algorithm is now enabled in the DEFAULT, FUTURE, and LEGACY system-wide cryptographic policies.

OpenSSH now supports the mlkem768x25519-sha256 post-quantum cryptography (PQC) hybrid key exchange algorithm. This algorithm combines ML-KEM-768 with X25519 to provide secure connections against future quantum computers. The system-wide cryptographic policies in the crypto-policies package enable this algorithm in the DEFAULT and FUTURE policies.

SSSD has been updated to version 2.10, which adds support for running as an unprivileged user instead of root. This allows containerized deployments to comply with security requirements that limit root privileges within containers.

By default, SSSD runs as root with the sssd supplementary group, which provides access to SSSD-owned files. To switch to unprivileged mode, create a systemd service override:

sudo systemctl edit sssd.service

Add the following:

[Service]
User=sssd
Group=sssd
SupplementaryGroups=

Then reload and restart the service:

sudo systemctl daemon-reload
sudo systemctl restart sssd

Note that running as an unprivileged user requires filesystem support for POSIX capabilities. On filesystems that do not support capabilities (such as NFS), SSSD must continue to run as root.

Microsoft Entra ID authentication capabilities have been added to SUSE Linux Enterprise Server.

We officially support authentication via Device Authorization Grant. Authentication via the project’s experimental MFA flow is not supported.

SUSE Linux Enterprise 15 product family switched over from a RSA 2048-bit signing key to a new RSA 4096-bit key. This change covers RPM packages, package repositories and ISO signatures. For more information see https://documentation.suse.com/sles/15-SP6/html/SLES-all/cha-update-preparation.html#sec-update-preparation-update

The openssh package has been updated to version 9.6p1, aligning with system crypto policies from the crypto-policies package. This update excludes insecure cryptographic algorithms, notably disallowing RSA keys under 2048 bits. This change may affect users with RSA host keys under 2048 bits for server connections.

To check for affected keys:

grep ssh-rsa ~/.ssh/known_hosts | ssh-keygen -lf -

The output lists key sizes and associated hostnames/IPs. After upgrade, connections to hosts with 1024 bit keys will fail if no alternative valid key exists.

Note: Troubleshooting

Before upgrade

1. Either update openssh to version 8.4p1, which enables UpdateHostkeys by default, allowing ssh to update known_hosts with all server’s host keys. Users must connect to the host with a 1024-bit RSA key after updating to this version and before upgrading to SP6.

2. Or, manually add host keys:

   ssh-keyscan hostname >> ~/.ssh/known_hosts

   Note that this method adds keys without verification; use only if manual host verification is possible.

After upgrade

1. Either temporarily use insecure algorithms by setting the crypto policy to LEGACY:

   sudo update-crypto-policies --set LEGACY

   Then, revert to the default secure policy after connecting:

   sudo update-crypto-policies --set DEFAULT

2. Or, remove the invalid host key from known_hosts and reconnect, manually verifying the new host key.

By default, the CPU mitigations setting to prevent CPU side-channel attacks is set to Auto. However, the kernel boot parameters included in the Auto option may change from one Service Pack to the next due to the necessity of applying new security patches. This may result in performance loss in some scenarios. You might want to change these to achieve a different tradeoff between performance and security.

For more information on how to configure these settings, see https://documentation.suse.com/sles/15-SP7/single-html/SLES-administration/#vle-grub2-yast2-cpu-mitigations.

Microsoft SQL Server 2025 requires legacy hashing algorithms (such as MD2, MD4, and MD5) for functions like HASHBYTE. To support this, OpenSSL 3 in SLES is now compiled with the enable-md2 option. Because these algorithms are disabled by default, the OpenSSL legacy provider must be explicitly enabled.

To enable the legacy provider, make the following modifications to /etc/ssl/openssl.cnf:

To verify the providers are active, run the openssl list -providers command. The output must display both default and legacy as active.

In SLES 15 SP7, OpenSSL has been updated to version 3.2.3, replacing OpenSSL 1.1.1.

Because the development packages of different versions are mutually exclusive and automatic conflict resolution is not performed during updates, libopenssl1_1-devel should be manually selected for de-installation.

The TLS 1.0 and 1.1 standards have been superseded by TLS 1.2 and TLS 1.3. TLS 1.2 has been available for considerable time now.

SUSE Linux Enterprise Server packages using OpenSSL, GnuTLS, or Mozilla NSS already support TLS 1.3. We recommend no longer using TLS 1.0 and TLS 1.1, as SUSE plans to disable these protocols in a future service pack. However, not all packages, for example, Python, are TLS 1.3-enabled yet as this is an ongoing process.

The haveged-switch-root.service has been removed from SUSE Linux Enterprise Server 15 SP4, SP5, and SP6. Implementing a robust switch-root service for haveged is difficult and was prone to security and synchronization issues. Since Linux kernel 5.4, a HAVEGED-inspired entropy gathering algorithm has been included directly in the kernel, making haveged-switch-root.service unnecessary.

To resolve any remaining early-boot entropy requirements safely, haveged-once.service has been introduced instead, which runs with the --once flag during early boot and exits cleanly before switching root.

The squid caching proxy has disabled and removed Edge Side Includes (ESI) processing. This change improves security. It addresses vulnerabilities in ESI processing, such as CVE-2024-45802. ESI processing is rare in modern setups because it requires content manipulation in transit.

SUSE Linux Enterprise maintains backward compatibility for legacy XFS v4 filesystems via the kernel configuration CONFIG_XFS_SUPPORT_V4=y. This support ensures uninterrupted access for existing environments. However, XFS v4 is deprecated, and creating new v4 filesystems is strongly discouraged.

September 2030 is the EOL target for upstream Linux kernel support for XFS v4. Any release post-September 2030 based on updated upstream kernels will omit XFS v4 support entirely. Legacy v4 filesystems will no longer be mountable on those versions.

Upgrading underlying filesystems from v4 to v5 is transparent to applications and requires no changes to userspace software.

To check the format version of an existing XFS filesystem, run:

xfs_info /path/to/mountpoint

An output including crc=1 indicates the modern v5 format, while crc=0 indicates the legacy v4 format.

There is no in-place or online upgrade path from XFS v4 to v5. Migration requires backing up data, reformatting the block device to XFS v5, and restoring the content. Migrating the root filesystem and any other critical data partitions requires planned downtime.

The operating system generates warnings when v4 format interaction occurs:

NFS over TLS is now supported for storage traffic.

The installer no longer tries to re-use existing LVM configurations. See the Deployment Guide at https://documentation.suse.com/sles/15-SP7/single-html/SLES-deployment/#yast-installer-reuse-lvm for more information.

LUKS2 is no longer technical preview but is now fully supported in YaST Partitioner.

For more information see the Partioning section of the AutoYaST Guide at https://documentation.suse.com/sles/15-SP7/single-html/SLES-autoyast/#CreateProfile-Partitioning

SUSE Linux Enterprise was the first enterprise Linux distribution to support journaling file systems and logical volume managers in 2000. Later, we introduced XFS to Linux, which allows for reliable large-scale file systems, systems with heavy load, and multiple parallel reading and writing operations. With SUSE Linux Enterprise 12, we started using the copy-on-write file system Btrfs as the default for the operating system, to support system snapshots and rollback.

The following table lists the file systems supported by SUSE Linux Enterprise.

Support status: + supported / ‒ unsupported

¹ OCFS 2 is fully supported as part of the SUSE Linux Enterprise High Availability.

² Btrfs is a copy-on-write file system. Instead of journaling changes before writing them in-place, it writes them to a new location and then links the new location in. Until the last write, the changes are not "committed". Because of the nature of the file system, quotas are implemented based on subvolumes (qgroups).

³ To extend an OCFS 2 file system, the cluster must be online but the file system itself must be unmounted.

⁴ The block size default varies with different host architectures. 64 KiB is used on POWER, 4 KiB on other systems. The actual size used can be checked with the command getconf PAGE_SIZE.

⁵ See gfs2_grow(8). It must be a mounted filesystem.

Additional notes

Maximum file size above can be larger than the file system’s actual size because of the use of sparse blocks. All standard file systems on SUSE Linux Enterprise Server have LFS, which gives a maximum file size of 2⁶³ bytes in theory.

The numbers in the table above assume that the file systems are using a 4 KiB block size which is the most common standard. When using different block sizes, the results are different.

In this document:

See also http://physics.nist.gov/cuu/Units/binary.html.

Some file system features are available in SUSE Linux Enterprise Server 15 SP7 but are not supported by SUSE. By default, the file system drivers in SUSE Linux Enterprise Server 15 SP7 will refuse mounting file systems that use unsupported features (in particular, in read-write mode). To enable unsupported features, set the module parameter allow_unsupported=1 in /etc/modprobe.d or write the value 1 to /sys/module/MODULE_NAME/parameters/allow_unsupported. However, note that setting this option will render your kernel and thus your system unsupported.

The following table lists supported and unsupported Btrfs features across multiple SLES versions.

Support status: + supported / ‒ unsupported

Installing the full KDE Plasma Desktop (using the kde pattern) requires an extra subscription for the Workstation Extension. Upgrading to 15 SP7 might fail if you have the kde pattern installed but do not have the required subscription.

A new kde_minimal pattern provides the KDE Plasma Desktop with fewer packages and does not require the Workstation Extension subscription. If your upgrade fails because of the missing subscription, finish the upgrade, then run these commands:

zypper rm -t pattern kde
zypper in -t pattern kde_minimal

Previously, systemd expected regular user accounts to be allocated within the UID range of 1000 to 60000. If user accounts were created with UIDs in the container range (524288 to 1879048191), journald would route their log messages to the system journal. As a result, these users could not access their own log messages via journalctl without administrator privileges. To address this, SUSE’s systemd has been updated to treat UIDs in the container range as regular users. User-specific journals are now correctly created for these accounts, allowing them to view their log messages using journalctl without special group memberships.

Before, the lookup of the effective session limit in a systemd setup was not trivial. Now these new properties have been added:

A maintenance update changes the rmt-server package from version 2 to version 3.1. RMT 3 uses Ruby 3.4 and Rails 7.1. RMT 2 uses Ruby 2.5, which is no longer maintained.

In SLE 15 SP7 you can search for packages both within and outside of currently enabled SLE modules using the following command:

zypper search-packages SEARCH_TERM

This command contacts the SCC and searches all modules for matching packages. This functionality makes it easier for administrators and system architects to find the software packages needed. This feature is now also available when a system is registered against RMT.

The configuration file /etc/sysconfig/service previously let system administrators control service updates globally. It contained the variables DISABLE_RESTART_ON_UPDATE and DISABLE_STOP_ON_REMOVAL. However, global service management can lead to inconsistent system states. It also prevents packages from applying security updates correctly. Therefore, the DISABLE_STOP_ON_REMOVAL variable has been removed. The DISABLE_RESTART_ON_UPDATE variable has also been deprecated. If a specific service must not restart or stop automatically, configure this behavior at the package level instead. Do not use global options in /etc/sysconfig/service.

The High Performance Computing (HPC) module has been updated with new package versions for openmpi, lmod (provided by the lua-lmod package), genders, and munge.

Xen has been updated to version 4.20, for more information: https://wiki.xenproject.org/wiki/Xen_Project_4.20_Release_Notes

QEMU has been updated to version 9.2.2, full list of changes are available at https://wiki.qemu.org/ChangeLog/9.2

Highlights include:

libvirt has been updated to version 11.0.0, this include many incremental improvements and bug fixes, see https://libvirt.org/news.html#v11-0-0-2025-01-15

Since SP6 libvirt provides two daemon deployment options: monolithic or modular daemons. Modular daemons are now enabled by default, but a deployment can be switched to the traditional monolithic daemon by disabling the individual daemons and enabling libvirtd.

SLES 15 SP7 adds support for the Intel Clearwater Forest (CWF) processor.

Broadcom Emulex Fibre Channel (FC) adapters might fail to be properly removed with DLPAR operations in SUSE Linux Enterprise Server 15 SP7. All POWER 9 and Power10 systems with any Emulex FC adapter are affected.

When you perform DLPAR remove operations on Emulex FC adapters, there is a possibility that the adapter is not properly removed from the system. This operation can cause future DLPAR operations to fail. A failing system can show the following error messages:

EEH: Recovering PHB#204-PE#800000
EEH: PE location: N/A, PHB location: N/A
EEH: Frozen PHB#204-PE#800000 detected
EEH: Call Trace:
EEH: [c00000000005674c] __eeh_send_failure_event+0x6c/0x120
EEH: [c00000000004f8a0] eeh_dev_check_failure+0x270/0x6b0
EEH: [c00000000004fd78] eeh_check_failure+0x98/0x110
EEH: [c008000023ba6e00] lpfc_sli4_wait_bmbx_ready+0x118/0x1c0 [lpfc]
EEH: [c008000023ba702c] lpfc_sli4_post_sync_mbox+0x184/0x5a0 [lpfc]
EEH: [c008000023ba99ac] lpfc_sli_issue_mbox_s4+0x7a4/0xce0 [lpfc]
EEH: [c008000023bb4574] lpfc_sli_issue_mbox+0x2c/0x50 [lpfc]
EEH: [c008000023c0220c] __lpfc_reg_congestion_buf+0xd4/0x1d0 [lpfc]
EEH: [c008000023c0ef58] lpfc_pci_remove_one+0xc0/0xe50 [lpfc]
EEH: [c000000000983dc4] pci_device_remove+0x64/0x110
EEH: [c000000000b0a7e4] device_remove+0x74/0xd0
EEH: [c000000000b0c350] device_release_driver_internal+0x120/0x210
EEH: [c000000000974b98] pci_stop_bus_device+0x98/0xf0
EEH: [c000000000974db8] pci_stop_and_remove_bus_device+0x28/0x40
EEH: [c000000000077df0] pci_hp_remove_devices+0x90/0x130
EEH: [c008000026510568] disable_slot+0x40/0x90 [rpaphp]
EEH: [c0000000009abaf8] power_write_file+0xa8/0x170
EEH: [c0000000009a1504] pci_slot_attr_store+0x44/0x60
EEH: [c0000000006a2ed4] sysfs_kf_write+0x64/0x90
EEH: [c0000000006a19e4] kernfs_fop_write_iter+0x204/0x2b0
EEH: [c0000000005a378c] vfs_write+0x36c/0x440
EEH: [c0000000005a3a8c] ksys_write+0xdc/0x130
EEH: [c000000000034b18] system_call_exception+0x158/0x320
EEH: [c00000000000d05c] system_call_vectored_common+0x15c/0x2ec
Kernel attempted to read user page (18) - exploit attempt? (uid: 0)
BUG: Kernel NULL pointer dereference on read at 0x00000018
Faulting instruction address: 0xc008000023baf314
Oops: Kernel access of bad area, sig: 11 [#1]

There is currently no workaround nor fix available for this issue. Instead of using the DLPAR operation, you can shutdown the logical partition before you remove or add Emulex FC adapters to the configuration.

There is a limit on the memory available to the GRUB bootloader. The installer ramdisk is particularly large because it includes kernel drivers for all possible installation scenarios as well as tools for loading the installer from different types of media. Enabling secure boot and vTPM on the LPAR further increases memory requirements.

When loading the OS from the installation medium the following message might appear:

Loading kernel ...
Loading initial ramdisk ...
error: ../../grub-core/kern/mm.c:548:out of memory.

Press any key to continue...

The recommended workaround is to disable vTPM support during installation.

Due to the use of uncompressed kernel modules in the initial ramdisk (initrd), the memory required during the installation process has increased. If the system has less than 2 GB of RAM, the installation might fail with errors such as Initramfs unpacking failed: write error or a kernel panic. To ensure a successful installation, the minimum RAM requirement for SUSE Linux Enterprise Server for POWER has been raised from 1 GB to 2 GB. This change applies to both SLES 15 SP6 and SLES 15 SP7.

Valgrind has been updated to support IBM z17 processor instructions. This allows profiling and debugging of applications built for the new IBM Z hardware.

SLES 15 SP7 now allows selecting the paes-xts-plain64 cipher for disk encryption in the YaST partitioner. This feature requires a Crypto Express adapter. The adapter can operate in CCA or EP11 mode. EP11 mode specifically needs a CEX7S adapter or newer.

When using LUKS2, you can choose between an AES data key or an AES cipher key. The crypto adapter must be correctly configured before installation. For configuration details, see https://www.ibm.com/docs/en/linux-on-systems?topic=utilities-master-key-administration.

Secure boot IPL has the following minimum system requirements, depending on the boot device to be IPLed:

If these requirements are not met, the system can be IPLed in non-secure mode only.

Plymouth has been dropped from the s390x image. When running a bare metal installation on IBM Z (s390x) with a fully encrypted disk, the password prompt to decrypt the disk is now correctly shown in the HMC terminal (Operating Messages). The previous workaround of adding plymouth.enable=0 to the boot command line is no longer required.

SUSE Linux Enterprise Server for Arm 15 SP4 and SP5 prepared their kernels for the Armv8.5 Memory Tagging Extension (FEAT_MTE). Their glibc packages were based on version 2.31 and did not yet support Memory Tagging.

SUSE Linux Enterprise Server for Arm 15 SP7 updates glibc base version to 2.38 and enables Memory Tagging in the GNU C Library as well.

The NVIDIA Grace Hopper* System-on-Chip contains an integrated, Hopper microarchitecture-based Graphics Processor Unit (GPU).

SUSE Linux Enterprise Server for Arm 15 SP7 maintenance updates currently provide packages nvidia-open-driver-G06-signed-kmp-default and kernel-firmware-nvidia-gspx-G06 in version 535.104.05, which does not yet enable NVIDIA Grace Hopper GH200.

Check for maintenance updates of those packages with version 545.29.02 or later, or contact the system vendor or chip vendor NVIDIA for whether third-party graphics drivers are available for SUSE Linux Enterprise Server for Arm 15 SP7.

Note: PCIe GPUs not affected

Discrete GPU cards with Hopper microarchitecture, such as NVIDIA H100, are already enabled in shipping package versions.

The NVIDIA* Tegra* System-on-Chip chipsets include an integrated Graphics Processor Unit (GPU).

SUSE Linux Enterprise Server for Arm 15 SP7 does not include graphics drivers for any of the NVIDIA Jetson*, NVIDIA IGX or NVIDIA DRIVE* platforms.

Contact the chip vendor NVIDIA for whether third-party graphics drivers are available for SUSE Linux Enterprise Server for Arm 15 SP7.

The NXP* Layerscape* LS1028A/LS1018A System-on-Chip contains an Arm* Mali*-DP500 Display Processor, whose output is connected to a DisplayPort* TX Controller (HDP-TX) based on Cadence* High Definition (HD) Display Intellectual Property (IP).

A Display Rendering Manager (DRM) driver for the Arm Mali-DP500 Display Processor is available as technology preview (Section 2.8.1.5, “mali-dp driver for Arm Mali Display Processors available”).

However, there was no HDP-TX physical-layer (PHY) controller driver ready yet. Therefore no graphics output will be available, for example, on the DisplayPort* connector of the NXP LS1028A Reference Design Board (RDB).

Contact the chip vendor NXP for whether third-party graphics drivers are available for SUSE Linux Enterprise Server for Arm 15 SP7.

Alternatively, contact your hardware vendor for whether a bootloader update is available that implements graphics output, allowing to instead use efifb framebuffer graphics in SUSE Linux Enterprise Server for Arm 15 SP7.

Note

The Vivante GC7000UL GPU driver (etnaviv) is available as a technology preview (Section 2.8.1.3, “etnaviv drivers for Vivante GPUs are available”).

Support for Intel’s True Scale fabric hardware (PSM1) has been removed. The libpsm_infinipath1, libinfinipath4, and infinipath-psm-devel packages have been removed from the distribution. Related software packages like libfabric, openmpi, and mvapich have been rebuilt to remove True Scale support. For modern Omni-Path (OPA) fabrics, use libpsm2 instead.

The release notes for SUSE Linux Enterprise Server 15 SP4-SP6 stated that the OpenLDAP server package was deprecated and would be removed in favor of the 389 Directory Server (389-ds).

Based on customer feedback, OpenLDAP server was reintroduced in SLES to provide an extended migration period to the 389 Directory Server. While the OpenLDAP server is available in SLES 15 SP7, we continue to strongly recommend that customers migrate to the 389-ds package. The inclusion of OpenLDAP server is designed to facilitate a smoother transition and neither should it be considered for new deployments, nor it is planned to be included in SLES 16.0.

Since SLE15 SP5, Intel stopped requesting updates for intel-opencl and intel-graphics-compiler packages, and thus the packages have been deprecated in 15 SP6. They have now been removed from 15 SP7, and moved to Package Hub.