SUSE Linux Enterprise Server 16.1

SUSE Linux Enterprise Server Release Notes #

Publication Date: 2026-11-04

Revision History: SUSE Linux Enterprise Server Release Notes

SUSE Linux Enterprise Server is a modern, modular operating system for both multimodal and traditional IT. This document provides a high-level overview of features, capabilities and limitations, and highlights important product updates.

1 About the release notes #

These Release Notes are identical across all architectures, and the most recent version is always available online at https://www.suse.com/releasenotes.

Entries are only listed once but they can be referenced in several places if they are important and belong to more than one section.

Release notes usually only list changes that happened between two subsequent releases. Certain important entries from the release notes of previous product versions are repeated. To make these entries easier to identify, they contain a note to that effect.

However, repeated entries are provided as a courtesy only. Therefore, if you are skipping one or more service packs, check the release notes of the skipped service packs as well. If you are only reading the release notes of the current release, you could miss important changes.

1.1 Documentation and other information #

For the most up-to-date version of the documentation for SUSE Linux Enterprise Server, see:

https://documentation.suse.com/sles/16-GA.

Find change logs for public cloud images at the Public Cloud Information Tracker (PINT) at https://pint.suse.com/.

2 What’s new? #

2.1 Comparison with SUSE Linux Enterprise Server 15 SP7 #

To read more about the differences and high-level changes between SUSE Linux Enterprise Server 16.0 and SUSE Linux Enterprise Server 15 SP7, see these documents:

3 Support and lifecycle #

SUSE Linux Enterprise Server is backed by award-winning support from SUSE, an established technology leader with a proven history of delivering enterprise-quality support services.

Each SUSE Linux Enterprise Server 16 release has the following lifecycle:

SUSE Linux Enterprise Server 16.0 through 16.5 receive 2 years of general support.
SUSE Linux Enterprise Server 16.6 receives 4 years of general support.

If you need additional time to design, validate, and test your upgrade plans, Long Term Support (LTS) can extend the support duration. You can purchase LTS in 12-month increments for up to 3 years (36 months).

Each SUSE Linux Enterprise Server for SAP applications 16 release has 5 years of support:

SUSE Linux Enterprise Server for SAP applications 16.0 through 16.5 receive 2 years of general support, followed by 3 years of Long Term Support (LTS) included in the subscription ("included LTS").
SUSE Linux Enterprise Server for SAP applications 16.6 receives 4 years of general support, followed by 1 year of LTS included in the subscription. Customers can purchase up to 2 additional years of LTS for 16.6.

For exact lifecycle dates, see SUSE Linux Enterprise Server Lifecycle and SUSE Linux Enterprise Server for SAP applications Lifecycle. For more information, see Support Policy, Long Term Support, and Lifecycles of SUSE Linux Enterprise Components.

3.1 Support statement for SUSE Linux Enterprise Server #

To receive support, you need an appropriate subscription with SUSE. For more information, see https://www.suse.com/support/policy.html.

The following definitions apply:

L1: Problem determination, which means technical support designed to provide compatibility information, usage support, ongoing maintenance, information gathering, and basic troubleshooting using the documentation.
L2: Problem isolation, which means technical support designed to analyze data, reproduce customer problems, isolate the problem area, and provide a resolution for problems not resolved by Level 1 or prepare for Level 3.
L3: Problem resolution, which means technical support designed to resolve problems by engaging engineering to resolve product defects which have been identified by Level 2 Support.

For contracted customers and partners, SUSE Linux Enterprise Server is delivered with L3 support for all packages, except for the following:

Technology Previews, see Section 3.3, “Technology previews”
Sound, graphics, fonts and artwork
Packages that require an additional customer contract, see Section 3.2.1, “Software requiring specific contracts”
Some packages shipped as part of the module Workstation Extension are L2-supported only
Packages with names ending in -devel (containing header files and similar developer resources) will only be supported together with their main packages.

SUSE will only support the usage of original packages. That is, packages that are unchanged and not recompiled.

3.2 General support #

To learn about supported features and limitations, refer to the following sections in this document:

3.2.1 Software requiring specific contracts #

Certain software delivered as part of SUSE Linux Enterprise Server may require an external contract. Check the support status of individual packages using the RPM metadata that can be viewed with rpm or zypper.

Currently, there are no major packages and groups of packages affected by this.

3.2.2 Software under GNU AGPL #

SUSE Linux Enterprise Server 16.1 (and the SLE modules) includes the following software that is shipped only under a GNU AGPL software license:

Ghostscript (including subpackages)
velociraptor and velociraptor-client
zypp-boot-plugin

SUSE Linux Enterprise Server 16.1 (and the SLE modules) includes the following software that is shipped under multiple licenses that include a GNU AGPL software license:

MySpell dictionaries and LightProof
ArgyllCMS

3.3 Technology previews #

Technology previews are packages, stacks, or features delivered by SUSE to provide glimpses into upcoming innovations. Technology previews are included for your convenience to give you a chance to test new technologies within your environment. We would appreciate your feedback! If you test a technology preview, contact your SUSE representative and let them know about your experience and use cases. Your input is helpful for future development.

Technology previews come with the following limitations:

Technology previews are still in development. Therefore, they may be functionally incomplete, unstable, or in other ways not suitable for production use.
Technology previews are not supported.
Technology previews may only be available for specific hardware architectures. Details and functionality of technology previews are subject to change. As a result, upgrading to subsequent releases of a technology preview may be impossible and require a fresh installation.
Technology previews can be removed from a product at any time. This may be the case, for example, if SUSE discovers that a preview does not meet the customer or market needs, or does not comply with enterprise standards.

3.4 Technology Previews for scheduling #

SUSE Linux Enterprise Server with the real-time kernel enables the SCHED_DEADLINE scheduling class as a Technology Preview (best-effort support). This scheduler predicts task scheduling based on application deadlines, which is particularly useful for realtime workload.

3.5 SMB over QUIC support in Samba (technology preview) #

The version of Samba shipped with SUSE Linux Enterprise Server 16.1 includes support for the SMB over QUIC protocol as a technology preview. This protocol enables secure and efficient access to file shares over public networks.

3.6 Boot Loader Specification (BLS) support with systemd-boot (technology preview) #

SUSE Linux Enterprise Server 16.1 includes systemd-boot as a technology preview for Boot Loader Specification (BLS) support on UEFI systems.

The following limitations apply to this technology preview:

Available only for UEFI-based x86-64 and AArch64 architectures.
Not available for IBM Z, POWER, or BIOS-based systems.
Switching from the traditional grub2 bootloader to systemd-boot is not supported during an upgrade.
A fresh installation is required to use systemd-boot.

Full support is planned for a future release.

3.7 Confidential Computing Remote and Local Attestation (technology preview) #

As a technology preview, remote and local attestation for AMD and Intel is available with the following packages in SUSE Linux Enterprise Server 16.1:

confidential-computing.sgx
confidential-computing.tee.dcap.pccs
grpcurl
guest-components
snpguest
snphost
suse-libsgx-prebuilt-signed
trustee

Full support is planned for a future release after validation.

4 Included packages and quarterly updates #

Both the online medium and the full medium are the same for all SUSE Linux 16.1 products and only need to be downloaded once. As the full medium includes all packages of the whole SUSE Linux 16.1 family, be aware that depending on your subscription the list of packages supported by SUSE varies. You can check packages included in products on https://scc.suse.com.

Installation media, VM images and public cloud images are usually refreshed every 3 months (Quarterly Updates).

5 Supported upgrade and migration paths #

SUSE Linux Enterprise Server 16.1 supports upgrading from SUSE Linux Enterprise Server 16.0, as well as migrating from preceding SUSE product releases.

Online (in-place) upgrade is supported from SUSE Linux Enterprise Server 16.0 (including SLES for SAP and SLE HA).
Offline migration (using offline installation media) is supported from:
- SUSE Linux Enterprise Server 15 SP5, SP6, and SP7 (including SLES for SAP and SLE HA)
- SUSE Linux Enterprise Micro 6.2
- SUSE Linux Enterprise Real Time 15 SP7
- openSUSE Leap 16.1

For detailed instructions, pre-upgrade checklists, and step-by-step migration procedures, see the Upgrade Guide.

6 Upgrade and migration checklist #

Before upgrading to SUSE Linux Enterprise Server 16.1, review the following checklist of potential migration issues and preparation steps.

6.1 Before upgrading #

6.2 During upgrade #

Section 7.44, “Agama live image includes Combustion”

6.3 After upgrading #

Section 7.42, “update-alternatives no longer used for PostgreSQL”.

7 Changes affecting all architectures #

rasdaemon has been updated to version 0.8.4. This version supports machine checks related to CXL memory. Since Intel® Optane™ Memory products have reached End of Life (EOL), SUSE Linux Enterprise Server 16.1 does not support them either.

7.1 `HAProxy` and `Keepalived` moved to `SUSE Linux Enterprise Server` #

Previously, only the SLE HA extension included HAProxy and Keepalived. The base SUSE Linux Enterprise Server distribution now includes both HAProxy and Keepalived. This change makes these packages available on standard installations without a separate High Availability subscription.

7.2 SLE BCI for kernel modules (Driver Toolkit) #

A new Base Container Image (BCI) is now available to build and run kernel modules on SUSE Linux Enterprise Server, comparable to the upstream driver-toolkit. The container includes the necessary kernel headers for both default and RT kernels on x86_64 and aarch64 architectures, providing a simple way to prototype and test drivers without giving access to SLE kernel binaries.

7.3 SUSE Linux Enterprise Server containerdisk image now available #

A SUSE Linux Enterprise Server containerdisk image is now available in the SUSE Registry (registry.suse.com). The image contains a minimal, bootable SUSE Linux Enterprise Server system in the OCI container format. Use the image to create virtual machines in cloud-native environments, for example SUSE Virtualization, Harvester, or KubeVirt.

To get the image, use the path registry.suse.com/suse/sles/16.1/containerdisk-minimal:latest.

7.4 `debugfs` is not mounted by default #

To reduce the attack surface and comply with Common Criteria requirements, SUSE Linux Enterprise Server 16.1 does not automatically mount debugfs at /sys/kernel/debug during boot. The debugfs file system can expose Address Space Layout Randomization (ASLR) information.

Tools that require debugfs do not operate until the file system is mounted. For example, on IBM Z, the hyptop utility fails with the following message:

hyptop: Debugfs is not mounted, try "mount none -t debugfs /sys/kernel/debug"

To use tools that require debugfs, mount the file system manually:

mount none -t debugfs /sys/kernel/debug

7.5 Support for AMD GPU Operator #

The AMD GPU Operator automates the management and configuration of AMD GPUs in Kubernetes clusters. SUSE Linux Enterprise Server 16.1 supports deploying the upstream AMD GPU Operator. The operator uses prebuilt amdgpu driver container images from the SUSE Registry (registry.suse.com). Kernel Module Management (KMM) loads the driver modules onto the host without recompiling the drivers across kernel updates within the same SLES codestream.

To deploy the operator on RKE2, see the RKE2 documentation. For installation instructions and configuration options, see the AMD GPU Operator documentation.

7.6 Security update and changes in mount behavior for `util-linux` #

An update of the util-linux package to version 2.42.2 fixes five critical security issues (CVE-2026-13595, CVE-2026-27456, CVE-2026-53612, CVE-2026-53613, CVE-2026-53614). These fixes change the behavior of mount operations for non-root processes. These changes stop privilege escalation and time-of-check-to-time-of-use (TOCTOU) race conditions.

The following changes apply:

Non-root mount operations must always use path canonicalization. The system ignores the X-mount.nocanonicalize option for non-root mounts.
Legacy mount paths reject multi-step mount sequences (such as bind+remount and propagation) for non-root mounts.
Non-root mounts do not support the detached subdirectory feature (X-mount.subdir).
Non-root mount target paths must not go through directories that unprivileged processes can write to.

If the system needs these restricted mount features, update to SUSE Linux Enterprise Server 16.2. The mountfd API in SUSE Linux Enterprise Server 16.2 uses file descriptors instead of paths, which makes operations safe against TOCTOU attacks.

For more information, see the upstream release notes at https://www.kernel.org/pub/linux/utils/util-linux/v2.42/v2.42.2-ReleaseNotes.

7.7 Increased timeout for installer boot menu #

The boot menu of the live installation medium now has a timeout of 60 seconds. Previously, the timeout was ten seconds. This change provides more time to select options from the boot menu. This change does not affect the boot timeout of the installed system.

7.8 `mozilla-nss` favors `p11-kit-nss-trust` over `mozilla-nss-certs` by default #

New installations of mozilla-nss now install p11-kit-nss-trust by default to provide libnssckbi.so. This change replaces the default installation of mozilla-nss-certs. The p11-kit-nss-trust package allows central configuration of system-wide root certificates. Firefox and other NSS consumers automatically inherit these central certificates. This avoids manual importing of enterprise certificates into individual profiles. Existing installations maintain their configuration during system upgrades. NSS static certificates remain available via the mozilla-nss-certs package and can be installed manually if required.

7.9 Reduced set of pre-built immutable system images #

To simplify selection and validation, the number of pre-built immutable system images is now smaller. This release removes the Default image variant. Only the Base image variant remains available. Additionally, on the POWER architecture (ppc64le), this release removes the pre-built images for 512-byte sector sizes. Only images for 4096-byte (4 kB) sector sizes are now provided for ppc64le.

7.10 Network UPS Tools (NUT) updated to version 2.8.5 #

SUSE Linux Enterprise Server 16.1 updates Network UPS Tools (NUT) to version 2.8.5. This version upgrade introduces new hardware drivers, STARTTLS handling improvements, and support for name aliasing. A security patch resolves CVE-2026-54161, which prevented a potential remote command injection vulnerability in NOTIFYCMD. For a complete list of changes, see the upstream release notes.

7.11 Linux kernel BPF subsystem updated to match upstream v6.13 to v6.18 #

The Berkeley Packet Filter (BPF) subsystem in the Linux kernel has been updated to align with the upstream kernel versions v6.13 through v6.18.

Key changes and system requirements:

To maintain compatibility and prevent breakage of third-party out-of-tree kernel modules, kABI padding has been applied to twelve key BPF structures (including bpf_insn_aux_data, bpf_link, bpf_mem_alloc, bpf_mprog_bundle, bpf_reg_state, bpf_verifier_log, and hid_bpf).
Bypassing global per-protocol socket memory accounting is now supported by configuring a network namespace sysctl.
See the upstream kernel changelogs from https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.13 through https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.

7.12 BPF tooling updated to the latest upstream versions #

This release updates BPF (Berkeley Packet Filter) tooling to the latest upstream versions. The following packages are updated:

libbpf to version 1.6.2
bpftool to version 7.6.0
bpftrace to version 0.24.1
bcc to version 0.35.0, which includes the new libbpf-tools package

These updates provide new features and bug fixes.

7.13 Pressure Stall Information (PSI) enabled by default #

The Pressure Stall Information (PSI) metric collection is now enabled by default. In SLES 16.0, PSI was compiled into the kernel but disabled by default (CONFIG_PSI_DEFAULT_DISABLED=y). In SLES 16.1, this default has been changed to enabled (CONFIG_PSI_DEFAULT_DISABLED=n).

Enabling PSI allows system monitoring tools (such as sysstat version 12.7.5 included in SLES 16.1) to consume global PSI values out of the box. Benchmarking shows that the performance impact of PSI is negligible for almost all workloads, including database and compute-heavy tasks. A minor performance overhead (mostly between 2% and 8%) is restricted to scheduling- and wakeup-intensive microbenchmarks.

If you encounter performance regressions on scheduling-intensive workloads, you can disable PSI at boot time by passing psi=0 to the kernel command line.

7.14 Reduced kernel lock delays during CPU restriction #

High CPU load can make a container wait when it shares kernel locks. Previously, a container with CPU limits could keep a shared kernel lock when the system restricted its CPU usage. Because the container kept the lock, other containers had to wait. This waiting occurred even if the other containers had no CPU limits. The new task-based model changes this behavior. The kernel does not restrict a task when the task holds a critical lock. This change prevents delays and improves the separation of container workloads.

7.15 Coexistence of zlib and zlib-ng libraries #

SUSE Linux Enterprise Server 16.1 now includes both the traditional zlib and the newer, high-performance zlib-ng compression libraries. The zlib-ng library provides substantial performance optimizations by utilizing modern CPU instruction sets. While both libraries are fully supported in this release, SUSE intends to only support zlib-ng in the future.

7.16 Unified systemd service presets between standard and immutable modes #

To provide a consistent administration experience, systemd service presets have been unified between standard and immutable installation modes. As part of this unification, several standard service presets have been newly enabled by default on standard installations, including the cloud-init stack, container-image-prune.timer, kubelet.service, and others. Similarly, standard service presets such as firewalld.service, chronyd.service, gdm.service, and virtualization helpers have been enabled by default on immutable installations. Only specific presets directly related to transactional system management (such as transactional-update.timer and health-checker.service) remain restricted to their respective modes.

7.17 Distrobox pre-installed by default #

SUSE Linux Enterprise Server now includes distrobox pre-installed by default, replacing the older toolbox utility. distrobox enables launching mutable, persistent containerized environments utilizing podman or docker. These environments are tightly integrated with the host system, sharing access to the home directory, external storage devices, audio and video streams, and graphical servers. This integration allows running and debugging tools from any Linux distribution directly within the terminal without modifying the underlying operating system.

7.18 NVIDIA drivers not available for real-time kernel #

With the introduction of the real-time kernel in SUSE Linux Enterprise Server 16.1, some third-party kernel modules are not compatible. The NVIDIA drivers are only built for the default kernel. Consequently, NVIDIA drivers are not available when running the real-time kernel.

7.19 Repository Mirroring Tool (RMT) server now available #

SUSE Linux Enterprise Server 16.1 includes the Repository Mirroring Tool (RMT) server. RMT allows mirroring of SUSE repositories and client registration inside a private network. RMT has been updated to version 3, which is compatible with Ruby 3, ensuring long-term support.

7.20 Firewalld default presets #

To ensure consistent security and management preset behavior, firewalld is now enabled by default. This unification aligns the default service states across standard and immutable operating modes on SUSE Linux Enterprise Server 16.1. You can customize the firewalld presets or disable the service if necessary.

7.21 Added iptables and nftables to SLES Minimal images #

The iptables and nftables packages have been added to SLES Minimal Cloud and VMware VM images. This addition enables the successful provisioning of Rancher-deployed RKE2 and K3s clusters on SLES Minimal images without requiring manual package installation or Subscription Management (RMT) registration.

7.22 Refactoring of clustering packages for Immutable Mode #

SUSE Linux Enterprise Server 16.1 introduces a transactional OS option. To support this option, clustering packages have been refactored to fully comply with Immutable Mode best practices. Specifically, the file placement and RPM scriptlets for crmsh, corosync-qdevice, resource-agents, and corosync have been updated. These packages can now be safely installed and updated via the transactional-update tool. This ensures they do not attempt to write to non-transactional or non-snapshotted areas (such as /var) during transactions.

7.23 SSH public key support for all accounts created during installation #

The Agama installer supports SSH public key authentication for all accounts created during installation, including the first non-root account. This eliminates the need for temporary passwords and improves post-installation security.

7.24 Automated generation and validation of Agama profiles #

The Agama installer uses JSON or Jsonnet profiles for automated installations. The agama config subcommand provides capabilities to export, convert, validate, and load these profiles. For detailed instructions, command usage, and complete working examples, see the Automated Installation Using Agama guide.

7.25 SAP patterns updated #

SAP installation patterns have been updated to optimize and simplify the installation process.

The libldap-sap-compat package is no longer included in any SAP patterns, as it is no longer required by default.
The libatomic package has been added to the SAP base pattern on SUSE Linux Enterprise Server to simplify the installation instructions for SAP HANA.

7.26 XFS log stripe unit alignment change #

mkfs.xfs now automatically aligns the log stripe unit (lsunit) to the hardware’s reported minimum I/O size (such as a RAID controller’s stripe unit) to optimize physical disk layout. While this prevents unaligned write cycles on write-through storage devices, it may impact performance for certain types of fsync-heavy workloads on systems equipped with battery-backed or non-volatile write-back caches.

For those types of storage systems, performance can be optimized by manually setting the log stripe unit back to the block size during formatting (e.g., mkfs.xfs -l sunit=8 for 4KB). Alternatively, for highly demanding transactional workloads, utilizing a dedicated external XFS log on a non-striped device is recommended in order to entirely bypass storage layout trade-offs.

7.27 Deprecation of legacy XFS v4 filesystem format #

SLE maintains backward compatibility for legacy XFS v4 filesystems via the kernel configuration CONFIG_XFS_SUPPORT_V4=y. This support ensures uninterrupted access for existing environments. However, XFS v4 is deprecated, and creating new v4 filesystems is strongly discouraged.

September 2030 is the EOL target for upstream Linux kernel support for XFS v4. Any release post-September 2030 based on updated upstream kernels will omit XFS v4 support entirely. Legacy v4 filesystems will no longer be mountable on those versions.

Upgrading underlying filesystems from v4 to v5 is transparent to applications and requires no changes to userspace software.

To check the format version of an existing XFS filesystem, run:

xfs_info /path/to/mountpoint

An output including crc=1 indicates the modern v5 format, while crc=0 indicates the legacy v4 format.

There is no in-place or online upgrade path from XFS v4 to v5. Migration requires backing up data, reformatting the block device to XFS v5, and restoring the content. Migrating the root filesystem and any other critical data partitions requires planned downtime.

The operating system generates warnings when v4 format interaction occurs:

mkfs.xfs displays a warning if forced to format as v4 (crc=0):

V4 filesystems are deprecated and will not be supported by future versions

The kernel logs a notification upon mounting a v4 filesystem (printed once per boot cycle, upon first mount of a v4 filesystem):
```
Deprecated V4 format (crc=0) will not be supported after September 2030.
```

7.28 Characters in the private use area disabled in the alternate German keymap #

The alternate German keymap qwertz/de_alt_UTF-8 no longer supports characters in the Private Use Area (characters equal to or greater than U+F000). This change aligns the keymap with the upstream configuration and drops the custom legacy patch. Configurations that rely on custom characters mapped to this range require manual adjustment.

7.29 SDL 3 and sdl2-compat update #

SUSE Linux Enterprise Server 16.1 includes Simple DirectMedia Layer 3 (SDL 3). Compatibility for SDL 2.0 applications is now provided through the sdl2-compat library layer. The legacy SDL2 package has been removed.

7.30 FreeRDP has been updated to version 3.26.0 #

FreeRDP has been updated to version 3.26.0. This update introduces support for FIDO2 redirection ([MS-RDPEWA]), experimental AV1 codec extension, and performance improvements for SDL3 client drawing.

7.31 Performance Co-Pilot (PCP) upgraded to version 6.3.8 #

Performance Co-Pilot (PCP) has been upgraded from version 6.2.0 to 6.3.8. This version upgrade introduces AMD GPU metric monitoring support in pcp-htop. It adds Valkey support alongside Redis in libpcp_web. This version upgrade also resolves multiple security vulnerabilities, including CVE-2024-45769 (bsc#1230551). For a complete list of changes, see the upstream release notes at https://pcp.io/ and the package changelog.

7.32 `curl` updated to version 8.21.0 #

SUSE Linux Enterprise Server 16.1 includes curl version 8.21.0. For a complete list of changes, see the curl 8.21.0 changelog.

7.33 PHP updated to version 8.5 #

SUSE Linux Enterprise Server 16.1 includes PHP version 8.5. For more information, see the PHP 8.5 release announcement and the PHP Packages Lifecycle documentation.

7.34 `poppler` updated to version 26.x #

SUSE Linux Enterprise Server 16.1 includes the poppler PDF rendering library version 26.x.

This version update introduces several important changes for system administrators:

Removal of piped output filenames: For security reasons, passing a piped command as a filename parameter (for example, | command) is no longer supported in pdftops. Use standard shell pipelines instead.
pdfsig exit codes: The pdfsig utility now returns a non-zero exit code on signature validation failure. This may affect automated verification scripts.
pdftotext line endings: The pdftotext tool now defaults to \n line endings.
New signature features: The pdfsig utility includes a new --assert-signer option to verify the identity of the signer.

7.35 Upcoming update of GNU `patch` to version 2.8 in SUSE Linux Enterprise Server 16.2 #

The GNU patch package will be updated to version 2.8 in SUSE Linux Enterprise Server 16.2. For a complete list of upcoming changes, see the GNU patch release announcement.

GNU patch version 2.8 enforces stricter header parsing. Ensure patch-generating tools do not inject NUL bytes or raw control characters into header lines or diff directives, as they are no longer accepted in version 2.8.

7.36 Login hint when attempting root login to Cockpit #

Direct root login to the Cockpit web interface is disabled by default. A login hint is now displayed upon a failed root login attempt to clarify that root access is disabled. The hint also provides instructions on logging in with a regular account, elevating privileges, or enabling root access via /etc/cockpit/disallowed-users.

7.37 Cockpit bootloader package added #

SUSE Linux Enterprise Server 16.1 includes the new cockpit-bootloader package. This package provides a Cockpit interface module to configure bootloader settings. This module replaces the previous YaST bootloader configuration functionality. SUSE Linux Enterprise Server 16.1 also includes the required dependency package bootkitd.

7.38 Curated set of Ansible development and testing tools #

Currently, SUSE Linux Enterprise Server ships only the Ansible runtime (ansible-core and ansible). SUSE Linux Enterprise Server 16.1 introduces a curated set of Ansible development and testing tools. These tools enable testing, linting, and building Ansible content.

The following packages are now included:

ansible-lint: Playbook and role linter.
molecule: Role and collection testing framework.
molecule-plugins: Test drivers (Podman, Docker, Vagrant).
ansible-navigator: TUI for playbook development and debugging.
ansible-builder: Execution environment (container image) builder.
ansible-runner: Ansible execution API (also a dependency of Navigator).
ansible-creator: Provides commands to scaffold new Ansible projects and content.

7.39 IO scheduler distribution default changed #

The distribution default has changed for a certain set of block devices: rotating disks that have only a single I/O queue. On SLES, such devices would previously be driven by the bfq I/O scheduler by default. Now we are using the same default as the kernel, which is mq-deadline for most devices, and none for some.

7.40 New GCC warnings for Year 2038 (Y2K38) issues #

To help identify and mitigate Year 2038 (Y2K38) 32-bit time_t rollover issues, GCC now provides new compile-time warnings. These warnings highlight legacy 32-bit timestamp interactions in C/C++ code (such as file or network I/O using int types). It is recommended to review these warnings and update affected code to use 64-bit structures where necessary.

7.41 Immutable mode is unsupported for SAP workloads #

Running of the SAP software stack is not supported in immutable mode:

SAP-specific packages including saptune and Trento are not supported in immutable mode.
SAP patterns are not supported in immutable mode.
Ansible automation for SAP is not supported in immutable mode.
Execution of SAP HANA, SAP S/4HANA and SAP NetWeaver is not supported in immutable mode.

Note that this applies to traditional software. SAP software running in containers (like SAP Edge Integration Cell) is supported in immutable mode.

7.42 `update-alternatives` no longer used for PostgreSQL #

To better support immutable systems and transactional updates, the update-alternatives mechanism is no longer used to set the default PostgreSQL version. For more details on how to set the default PostgreSQL version, refer to the README.SUSE file provided in the postgresql main package.

7.43 Agama installer supports both standard and immutable installation modes #

The Agama installer supports both standard and immutable installation modes. Standard mode installs the system with a traditional read-write root directory. Immutable mode installs the system with a read-only root directory and enables transactional updates. The Agama configuration profile supports specifying the installation mode. The installation mode cannot be changed after the installation is complete.

7.44 Agama live image includes Combustion #

To facilitate pre-installation configuration before launching the Agama installer, the Combustion tool is now included in the live installer image. This provides a convenient and reliable way to apply complex setups repeatedly without typing commands manually, which also covers advanced scenarios that standard graphical tools cannot handle.

Combustion does not run automatically by default. To run Combustion scripts, Combustion must be explicitly enabled by adding the rd.systemd.wants=firstboot.target boot option at the boot prompt. Ignition is not included because its configuration mechanism is unsuitable for live installer media, and Combustion is better suited for pre-installation scripting.

7.45 NVMeoF boot: network interfaces maintain standard names #

For root-over-NVMeoF setups, in SLES 16.0 and prior releases, the network interfaces were renamed to nbft0, nbft1, and so on. In SLES 16.1, on new installations, network interfaces keep their standard names.

7.46 Kernel switches to PREEMPT_LAZY preemption model #

The upstream kernel community has moved away from conservative scheduler preemption models (PREEMPT_NONE and PREEMPT_VOLUNTARY), and these models have been removed in kernel 7.0 for architectures that support PREEMPT_LAZY. To align with upstream changes, SUSE Linux Enterprise Server 16.1 switches the preemption model from PREEMPT_VOLUNTARY to PREEMPT_LAZY for all supported architectures, except for IBM Z (s390x), which lacks architectural support.

The PREEMPT_LAZY model provides a less conservative approach to preemption, while still being suitable for throughput-oriented workloads. If you experience performance issues with the new preemption model, you can optionally switch back to PREEMPT_VOLUNTARY by setting preempt=voluntary on the kernel command line.

7.47 Real-time kernel is available on standard SUSE Linux Enterprise Server installations #

Standard SUSE Linux Enterprise Server installations now include the real-time kernel (kernel-rt). Previously, the real-time kernel was only available on systems with the Transactional Server role. All system roles now support the real-time kernel. This change provides deterministic latency and predictable execution times for standard server installations.

7.48 Stable kABI for real-time kernel #

The real-time kernel (kernel-rt) now maintains a stable kernel Application Binary Interface (kABI) during maintenance updates. This stability ensures that compatible third-party kernel modules do not require recompilation for every kernel update. Note that the real-time kernel and the default kernel do not share a common kABI. Therefore, drivers built for the default kernel cannot be used with the real-time kernel and must be built separately. While SUSE aims to keep the real-time kABI stable, rare technical requirements might still require changes in future updates.

7.49 RAID configuration not supported in installer Web UI #

RAID configuration is currently not supported through the installer Web UI. As a workaround, you can configure RAID either manually via the command line or by using JSON or JSONNet storage profiles. For more information, see https://agama-project.github.io/docs/user/reference/profile/storage. RAID support in the installer Web UI is planned for a future release.

7.50 Support for NTP configuration in early boot and the Agama installer #

Network time synchronization is now supported during both the early boot phase and the installation process. Specifying an NTP server IP address or hostname using the new rd.ntp=<server> kernel command-line parameter enables time synchronization before the installer launches, ensuring accurate log timestamps and correct HTTPS certificate validation. The Agama installer supports NTP configuration through a dedicated ntp section in the installer profile or via input fields in the user interface. Legacy AutoYaST ntp-client configurations are automatically converted into the native ntp configuration block on profile import. The configured NTP settings are written to the target system to persist after installation.

7.51 Kiwi KubeVirt containerdisk format #

Kiwi now supports a new containerdisk format for building KubeVirt-compatible container images from OEM disk builds.

The new format combines qcow2 disk image creation with OCI container packaging in a single workflow. The resulting container image contains the disk image at /disk and includes the necessary KubeVirt metadata.

The disk format (e.g. qcow2, raw, vmdk) and target container transport (e.g. docker://, oci://, obs://) are configurable via the format parameter.

Example format syntax: format="oci:qcow2:docker://registry.example.com/kubevirt-disk:latest"

7.52 SSSD: support for running as unprivileged user #

SSSD has been updated to version 2.10, which adds support for running as an unprivileged user instead of root. This allows containerized deployments to comply with security requirements that limit root privileges within containers.

By default, SSSD runs as root with the sssd supplementary group, which provides access to SSSD-owned files. To switch to unprivileged mode, create a systemd service override:

sudo systemctl edit sssd.service

Add the following:

[Service]
User=sssd
Group=sssd
SupplementaryGroups=

Then reload and restart the service:

sudo systemctl daemon-reload
sudo systemctl restart sssd

Note that running as an unprivileged user requires filesystem support for POSIX capabilities. On filesystems that do not support capabilities (such as NFS), SSSD must continue to run as root.

7.53 Multiple LSMs enabled by default #

SELinux is now used as the primary LSM (Linux Security Module) as compared to AppArmor that was used previously.

Apart from SELinux, we have also enabled:

Yama
Landlock
Lockdown
other virtual ones like bpf, ima, evm, capability

7.53.1 Yama #

Yama is a global framework that collects system-wide DAC security protections that are not handled by the core kernel itself. Individual processes can disable Yama for themselves. The enablement of Yama disables the ptrace mechanism of processes by default, except in the following cases:

Processes explicitly allow it themselves via prctl(PR_SET_PTRACER).
The tracer is a parent of the traced process (for example, when running gdb program).

Global control is managed via the sysctl parameter /proc/sys/kernel/yama/ptrace_scope, which sits on top of standard ptrace permissions. It supports the following levels:

0: Normal, classical ptrace is possible.
1: Only a parent process can be traced.
2: Only administrators with the CAP_SYS_PTRACE capability can use ptrace.
3: No processes may be traced with ptrace. Once this level is set, a system reboot is required to enable tracing again.

To enable ptrace system-wide again after the next reboot, install the aaa_base-yama-enable-ptrace package.

7.53.2 Landlock #

Landlock is a local security framework where processes can voluntarily confine their own actions. It provides scoped access-control (sandboxing) limited to file system and socket actions. Refer to the landlock manual pages for more details.

7.53.3 Lockdown #

Lockdown is a kernel-based lockdown method. The kernel supports three lockdown states:

none
integrity: Maximum integrity protection, which avoids any kind of outside code injection into the kernel or physical RAM.
confidentiality: Same as integrity, but additionally prevents any extraction of information (even by the root user) from other processes or physical RAM.

The lockdown level can be set during boot. By default, the level is set to none, but for Secure Boot, integrity is the lowest default level. During runtime, the lockdown level can only be increased, and cannot be decreased.

7.54 Consistent location for kernel and initramfs across architectures #

Previously, location of kernel or initrams would differ based on architecture.

Now these are stored in the same location regardless of architecture: boot/$arch/loader/

7.55 Supported Java Versions #

The following table lists Java implementations available in SUSE Linux Enterprise Server 16.1:

Package Name	Version	Support
`java-17-openjdk`	17	SUSE, L3, until 2027-10-31
`java-21-openjdk`	21	SUSE, L3, until 2031-10-31
`java-25-openjdk`	25	SUSE, L3, until 2033-10-31

7.56 Python in SLES 16.1 #

SUSE Linux Enterprise Server 16.1 continues to use Python 3.13 as the primary Python interpreter and stack. SUSE supports the primary Python interpreter for the entire product lifecycle. This interpreter provides the default /usr/bin/python3 executable and a full stack of python3- packages (approximately 700 packages).

Additionally, SUSE Linux Enterprise Server 16.1 introduces Python 3.14 as a short-term interpreter. SUSE supports the short-term interpreter for a limited two-year lifecycle (until November 2028). This interpreter only includes the runtime and essential package management tools (setuptools, venv, pip, and pipx). It does not include the full library stack. SUSE does not provide additional python314- packages.

The Python support strategy for SUSE Linux Enterprise Server 16 introduces a new short-term interpreter with each minor version (every year). The primary Python interpreter changes every odd minor version (for example, version 3.13 in 16.0 and 16.1, and version 3.15 in 16.3 and 16.4).

8 x86-64-specific changes #

Information in this section applies to the x86-64 architecture.

8.1 Clocksource watchdog disabled on HPE UV5 platforms #

On HPE UV5 platforms (such as Google Compute Engine X4 bare-metal instances), the kernel clocksource watchdog previously monitored the Time Stamp Counter (TSC). This monitoring could cause system instability. Previously, preventing this instability required disabling the watchdog manually with the kernel command-line parameter tsc=nowatchdog and restarting the system. The kernel now automatically disables the clocksource watchdog for the TSC on all HPE UV5 platforms. Manual kernel parameter configuration and system restarts are no longer required.

8.2 Support for Intel "Wildcat Lake-U" CPU platform #

SUSE Linux Enterprise Server 16.1 now supports Intel’s "Wildcat Lake-U" CPU platform. This hardware enablement includes updated graphics drivers for Intel Xe3 integrated graphics via the DRM kernel driver and Mesa 26.0.1. It adds device ID support for SMBus and I3C input/output interfaces. Additionally, this release enables Intel Platform Monitoring Technology (PMT) features, including Crash Log and Telemetry Aggregator, by adding the required VSEC device IDs.

9 Arm-specific changes (AArch64) #

Information in this section applies to SUSE Linux Enterprise Server on Arm 16.1.

9.1 NVIDIA platform kernel enablement patches #

SUSE Linux Enterprise Server 16.1 incorporates platform enablement and performance patches for NVIDIA Grace and Tegra hardware. For the complete list of included patches, upstream commits, and issue references, refer to Section 14, “NVIDIA kernel patches in SUSE Linux Enterprise Server 16.1”.

9.2 System-on-Chip driver enablement #

SLES 16.1 includes driver enablement for the following System-on-Chip (SoC) chipsets:

Ampere* X-Gene*, eMAG*, Altra*, Altra Max, AmpereOne*
AWS* Graviton, Graviton2, Graviton3
Broadcom* BCM2837/BCM2710, BCM2711
Fujitsu* A64FX
Huawei* Kunpeng* 916, Kunpeng 920
Marvell* ThunderX*, ThunderX2*; OCTEON TX*; Armada* 7040, Armada 8040
NVIDIA* Grace; Tegra* X1, Tegra X2, Xavier*, Orin; BlueField*, BlueField-2, BlueField-3
NXP* i.MX 8M, 8M Mini; Layerscape* LS1012A, LS1027A/LS1017A, LS1028A/LS1018A, LS1043A, LS1046A, LS1088A, LS2080A/LS2040A, LS2088A, LX2160A
Rockchip RK3399, RK3588
Socionext* SynQuacer* SC2A11
Xilinx* Zynq* UltraScale*+ MPSoC

Note

Driver enablement is done as far as available and requested. Refer to the following sections for any known limitations.

Some systems might need additional drivers for external chips, such as a Power Management Integrated Chip (PMIC), which may differ between systems with the same SoC chipset.

For booting, systems need to fulfill either the Server Base Boot Requirements (SBBR) or the Embedded Base Boot Requirements (EBBR), that is, the Unified Extensible Firmware Interface (UEFI) either implementing the Advanced Configuration and Power Interface (ACPI) or providing a Flat Device Tree (FDT) table. If both are implemented, the kernel will default to the Device Tree; the kernel command line argument acpi=force can override this default behavior.

Check for SUSE YES! certified systems, which have undergone compatibility testing.

9.3 Non-blocking console support #

Non-blocking console (nbcon) support is enabled on the AArch64 architecture. The common AMBA PL011 serial console driver (amba-pl011) is converted to the new nbcon API. This allows the kernel to log messages atomically and reliably to the console even from non-maskable interrupt (NMI) contexts (such as during an nmi_panic). This ensures critical post-crash details are captured immediately without relying on legacy printing locks or threads.

10 IBM Z-specific changes (s390x) #

Information in this section applies to SUSE Linux Enterprise Server for IBM Z and LinuxONE 16.1. For more information, see https://www.ibm.com/docs/en/linux-on-systems?topic=distributions-suse-linux-enterprise-server

10.1 New `zpckey` tool and changed interface in `libzpc` 2 #

SUSE Linux Enterprise Server includes libzpc version 2 for IBM Z.

The new libzpc-tools package provides the zpckey tool. Use zpckey to create and manage protected key origins, such as Secure Execution retrievable secrets. zpckey writes each key origin to a file. The OpenSSL provider module in the libzpc-provider package then reads the file. For more information, see the zpckey(1) man page.

Version 2 does not provide the libzpc C API as a shared library. Applications must use the OpenSSL provider module instead. The libzpc-legacy package provides the version 1 packages libzpc1 and libzpc-devel. The package is deprecated and will be removed in a future release.

10.2 Secure Boot support for ECKD DASD disks on IBM Z #

SUSE Linux Enterprise Server now supports and automatically proposes Secure Boot during installation for ECKD DASD disks. This support is available on IBM z16, LinuxONE 4, or newer systems. The bootloader installer (zipl) automatically writes both secure boot (list-directed IPL) and non-secure boot (CCW) boot records. This ensures that the installed system remains bootable on older systems that do not support Secure Boot.

10.3 Removed support for IBM 3480 and 3590 tape drives #

Support for IBM 3480 and 3590 tape drives, including the tape390_display and tape390_crypt tools, has been removed. In s390-tools, support for 3480 and 3590 FICON tape devices as well as the related tape390 utilities is removed. Other tape technologies are not affected by this removal. Virtual tape servers, such as the emulated IBM TS7700 Virtual Tape Server, continue to be supported via the tape.ko, tape_34xx.ko, and tape_3590.ko kernel modules.

10.4 Installer support for pervasive encryption on IBM Z #

The Agama installer now supports pervasive encryption (PAES) for storage volumes on IBM Z. The unattended storage JSON profile supports pervasive encryption properties, such as Crypto Express APQNs and key types. The storage schema includes the new apqns and keyType properties under the pervasiveLuks2 encryption configuration. During installation, the encryption planner assigns the specified APQN objects and key types to the planned encrypted devices.

10.5 IBM z17 hardware support in libraries and development tools #

Several IBM libraries and development tools now support the IBM z17 hardware platform. The system libraries libzdnn, libzpc, and libica include updates for the new hardware capabilities. Development and debugging tools, such as the GNU C Library (glibc) and Valgrind, also support the new processor instructions.

10.6 Secure Initial Program Load (IPL) support #

IPL has the following minimum system requirements, depending on the boot device to be IPLed:

NVMe disk: IBM LinuxONE III or newer.
FC-attached SCSI disk: IBM LinuxONE III, IBM z15 or newer.
ECKD DASD with CDL layout: IBM z16, LinuxONE 4 or newer.

If these requirements are not met, the system can be IPLed in non-secure mode only.

11 POWER-specific changes (ppc64le) #

Information in this section applies to SUSE Linux Enterprise Server on POWER 16.1.

11.1 Boot fails when PReP partition and root filesystem use different storage devices #

On PowerVM, configuring the PReP boot partition and the root file system on different storage subsystems causes boot failures. During POST, the system firmware initializes only the boot storage subsystem, which prevents GRUB from accessing secondary devices such as SAN multipath storage.

To avoid this issue, configure the PReP boot partition and the root file system on the same storage subsystem.

11.2 Kdump capture fails on NVMe-oF targets #

During kdump execution, attempting to capture a dump file to an NVMe over Fibre Channel (NVMe-FC) target on a Horton adapter fails. This issue occurs because the NVMe-FC driver maps numerous buffers for DMA, but not enough Translation Control Entries (TCEs) are freed from the Dynamic DMA Window (DDW) at kdump time. As a workaround, use Firmware-Assisted Dump (FADUMP), which is unaffected by this limitation.

11.3 Login times out on HMC virtual terminal #

If you install SUSE Linux Enterprise Server 16.1 with the GNOME desktop on LPAR and try to login via the HMC virtual terminal, the login may time out while entering your credentials.

To work around this issue, disable the Plymouth graphical boot screen by appending the boot parameter plymouth.enable=0 to the kernel command line.

11.4 Automated provisioning with cloud-init in virtual machine guest images #

The raw and qcow2 virtual machine guest images for the POWER architecture (ppc64le) are now built with cloud-init integration. Previously, provisioning virtual machines on KVM using these images required manual configuration steps. Automated initial guest provisioning is now fully supported.

12 Virtualization #

iSCSI boot support is disabled in OVMF images.

12.1 Virtual persistent memory (vPMEM) in virtual machine guests #

SUSE Linux Enterprise Server 16.1 supports virtual persistent memory (vPMEM) in virtual machine guests on x86-64 and ppc64le. The guest kernel detects the vPMEM regions and loads the applicable driver without manual configuration. SUSE Linux Enterprise Server does not support physical Intel* Optane* Memory.

12.2 QEMU #

QEMU has been updated to version 11.0.0. For changes, see https://wiki.qemu.org/ChangeLog/11.0. For removed or deprecated features, see https://qemu-project.gitlab.io/qemu/about/removed-features.html and https://qemu-project.gitlab.io/qemu/about/deprecated.html.

12.3 libvirt #

libvirt has been updated to version 12.3.0, introducing modular daemons. For details, see https://libvirt.org/news.html#v12-3-0-2026-05-02.

12.3.1 Virtual machine confinement enabled by default in libvirt #

libvirt now enables confinement of virtual machines (VMs) by default using the system’s default security framework (SELinux in SUSE Linux Enterprise Server 16). This improves out-of-the-box VM isolation and security. Administrators can override this setting in /etc/libvirt/qemu.conf.

12.4 VMware #

12.4.1 open-vm-tools #

open-vm-tools has been updated to version 13.1.0. For details, see https://github.com/vmware/open-vm-tools/blob/stable-13.1.0/ReleaseNotes.md.

12.5 Confidential Computing #

12.5.1 AMD SEV-SNP packages update #

AMD SEV-SNP is supported in SUSE Linux Enterprise Server 16.1. The following AMD Secure Encrypted Virtualization (SEV-SNP) tools have been updated:

sevctl has been updated to version 0.6.2.
snpguest has been updated to version 0.10.0. For changes, see https://github.com/virtee/snpguest/compare/v0.9.1…v0.10.0.
snphost has been updated to version 0.7.0.

For details on AMD remote and local attestation, see Section 3.7, “Confidential Computing Remote and Local Attestation (technology preview)”.

12.5.2 Intel TDX Confidential Computing #

Intel TDX is supported in SUSE Linux Enterprise Server 16.1. For details on Intel TDX remote and local attestation, see Section 3.7, “Confidential Computing Remote and Local Attestation (technology preview)”.

12.6 Other tools #

The following virtualization utilities have been updated:

numatop has been updated to version 2.5, adding support for Intel GNR and SRF platforms.
numactl has been updated to version 2.0.19 (see https://github.com/numactl/numactl/releases/tag/v2.0.19).
libguestfs has been updated to version 1.58.1.
virt-v2v has been updated to version 2.10.0, introducing the --parallel=N parameter for parallel disk copies (see https://github.com/libguestfs/virt-v2v/tree/v2.10.0).
virtiofsd has been updated to version 1.12.0.
virt-manager has been updated to version 5.1.0. Direct XML editing via virsh and remote viewing via VNC are recommended (see https://github.com/virt-manager/virt-manager/releases/tag/v5.1.0).

12.6.1 `virt-bridge-setup` #

virt-bridge-setup is a new script designed to simplify network bridge creation on a specified interface using nmcli. It replaces the automatic bridge creation previously managed by yast2 virtualization.

Important considerations:

It supports IPv4 only.
It is not intended for complex network configurations (such as VLANs or bonding); manual bridge setup is recommended for these scenarios.
The script must be run locally (not over a remote connection) immediately after installation and before applying any custom network configurations.

12.6.2 `strace` updated to version 7.1 #

strace has been updated to version 7.1.

This update includes the following changes:

The summary report (-c or --summary-only) now supports wall-clock-aware columns (wall-total, wall-min, wall-max, and wall-avg). This allows comparison of wall-clock and system CPU times in a single run.
The summary report now includes out-of-range system calls.
This update improves decoding of the sched_getattr system call.
The utility now decodes the FS_IOC_SHUTDOWN, PIDFD_GET_INFO, and PIDFD_GET_*_NAMESPACE ioctl commands.
The utility now decodes the IFLA_BR_FDB_N_LEARNED, IFLA_BR_FDB_MAX_LEARNED, and IFLA_BR_STP_MODE netlink attributes.
This version updates the system call constant lists for CLONE_*, FSMOUNT_*, KT_*, KVM_*, LANDLOCK_*, NETDEV_*, NL80211_*, and PIDFD_*.
This version adds support for Linux kernel 7.1 ioctl commands.

13 Removed and deprecated features and packages #

This section lists features and packages that were removed from SUSE Linux Enterprise Server or will be removed in upcoming versions.

13.1 Removed features and packages #

The following features and packages have been removed in this release.

SUSE Linux Enterprise Server 16.1 removes the python-python-jose and python-python-jose-cryptography packages. Upstream does not maintain these packages. You can install them from SUSE Package Hub. As an alternative, use the python-PyJWT package.

The libmsgpack-c2 package has been removed from SUSE Linux Enterprise Server 16.1. This package was previously required to support AMD ROCm, which is no longer planned for SUSE Linux Enterprise Server. The package has been relocated to SUSE Package Hub.

The python-bleach package is removed from SUSE Linux Enterprise Server 16.1. Upstream does not maintain this package. To clean HTML, use the python313-nh3 package.

Due to being no longer maintained, the ceph and thrift packages have been removed from SUSE Package Hub.

The legacy SDL2 package has been removed in favor of sdl2-compat and the newer SDL3 package. Applications relying on SDL 2.0 now utilize the sdl2-compat compatibility layer.

These packages have been moved to SUSE Package Hub:
- fwts
- python-pytest-forked
- perl-Test-Output
- perl-Test-Needs
- perl-Test-Differences

The stress-ng package has been relocated from SUSE Linux Enterprise Server back to SUSE Package Hub. Consequently, it is no longer officially supported as part of the core product.

The DCCP protocol has been disabled in the SUSE Linux Enterprise Server 16.1 kernel. This protocol has been dropped from the upstream Linux kernel.

The UDP-Lite protocol (RFC 3828) has been disabled in the SUSE Linux Enterprise Server 16.1 kernel. This protocol has been dropped from the upstream Linux kernel.

13.1.1 Support for SUSE Rancher Prime: OS Manager 2.x removed #

This release removes SUSE Rancher Prime: OS Manager 2.x components and container images. To manage operating system deployments, use SUSE Rancher Prime: OS Manager 3.x. The coexistence of versions 2.x and 3.x in the previous release supported the migration path. Only SUSE Rancher Prime: OS Manager 3.x remains supported from this release onward.

13.2 Deprecated features and packages #

The following features and packages are deprecated and will be removed in a future version of SUSE Linux Enterprise Server.

Legacy XFS v4 filesystems are deprecated. For details, see Section 7.27, “Deprecation of legacy XFS v4 filesystem format”.

The following SSSD features and options are deprecated in SUSE Linux Enterprise Server 16.1 and are planned for removal in SUSE Linux Enterprise Server 16.2:
- The enumeration feature for the AD or IPA provider
- The sss_ssh_knownhostsproxy tool
- The files provider
- The ad_allow_remote_domain_local_groups option
- The default_domain_suffix option

Support for AF_ALG sockets (the CONFIG_CRYPTO_USER_API kernel configuration) is deprecated in SUSE Linux Enterprise Server 16.1 and will be removed in SUSE Linux Enterprise Server 16.2.

The packages qemu-ovmf-ia32 and qemu-uefi-aarch32 have been deprecated in SUSE Linux Enterprise Server 16.1 and will be dropped in a future release. This is because the edk2 upstream community is ending support for IA-32 and AArch32 OVMF.
The opa-fmgui package has been deprecated since 15 SP4 and will be removed in SLES 16.2.
nodejs22 has been removed.
The 2MB OVMF image has been removed in SUSE Linux Enterprise Server 16.1.
The openmpi4 package has been deprecated in SUSE Linux Enterprise Server 16.1 and will be dropped in SUSE Linux Enterprise Server 16.2.
The mvapich2 package has been deprecated in SUSE Linux Enterprise Server 16.1 and will be dropped in SUSE Linux Enterprise Server 16.2.
The dmraid package (Device-Mapper Software RAID Support Tool) has been deprecated in SUSE Linux Enterprise Server 16.1 and will be dropped in SUSE Linux Enterprise Server 16.2. Use mdadm instead to manage and monitor software RAID devices.
The qib driver has been deprecated in SUSE Linux Enterprise Server 16.1 and will be removed in SUSE Linux Enterprise Server 16.2.

14 NVIDIA kernel patches in SUSE Linux Enterprise Server 16.1 #

This section lists kernel patches included in SUSE Linux Enterprise Server 16.1 specifically for NVIDIA platforms and hardware enablement. These patches originate from the NVIDIA kernel enablement branch and supplement the baseline enterprise kernel.

Commit	Upstream	Reference	Subject
`0bbff9ed8165`	v6.13-rc1	jsc#NVIDIA-55	perf/arm_pmuv3: Add PMUv3.9 per counter EL0 access control
`bdc9a64c8b20`	v6.13-rc1	jsc#NVIDIA-55	ARM: pmuv3: Add missing write_pmuacr()
`d1b3dad9de79`	v6.13-rc1	jsc#PED-16989	iommufd: Move struct iommufd_object to public iommufd header
`7d4f46c2372d`	v6.13-rc1	jsc#PED-16989	iommufd: Move _iommufd_object_alloc helper to a sharable file
`6b22d562fcd6`	v6.13-rc1	jsc#PED-16989	iommufd: Introduce IOMMUFD_OBJ_VIOMMU and its related struct
`d56d1e8405a9`	v6.13-rc1	jsc#PED-16989	iommufd: Verify object in iommufd_object_finalize/abort()
`4db97c21ed07`	v6.13-rc1	jsc#PED-16989	iommufd/viommu: Add IOMMU_VIOMMU_ALLOC ioctl
`69d2689e57f5`	v6.13-rc1	jsc#PED-16989	iommufd: Add alloc_domain_nested op to iommufd_viommu_ops
`13a750180fc8`	v6.13-rc1	jsc#PED-16989	iommufd: Allow pt_id to carry viommu_id for IOMMU_HWPT_ALLOC
`fd6b853f50c8`	v6.13-rc1	jsc#PED-16989	iommufd/selftest: Add container_of helpers
`18f819901d53`	v6.13-rc1	jsc#PED-16989	iommufd/selftest: Prepare for mock_viommu_alloc_domain_nested()
`86070569450e`	v6.13-rc1	jsc#PED-16989	iommufd/selftest: Add refcount to mock_iommu_device
`db70827a8827`	v6.13-rc1	jsc#PED-16989	iommufd/selftest: Add IOMMU_VIOMMU_TYPE_SELFTEST
`7156cd9ef245`	v6.13-rc1	jsc#PED-16989	iommufd/selftest: Add IOMMU_VIOMMU_ALLOC test coverage
`0ce5c2477af2`	v6.13-rc1	jsc#PED-16989	iommufd/viommu: Add IOMMUFD_OBJ_VDEVICE and IOMMU_VDEVICE_ALLOC ioctl
`5778c75703c6`	v6.13-rc1	jsc#PED-16989	iommufd/selftest: Add IOMMU_VDEVICE_ALLOC test coverage
`67db79dc1a41`	v6.13-rc1	jsc#PED-16989	iommu/viommu: Add cache_invalidate to iommufd_viommu_ops
`54ce69e36c71`	v6.13-rc1	jsc#PED-16989	iommufd: Allow hwpt_id to carry viommu_id for IOMMU_HWPT_INVALIDATE
`4f2e59ccb698`	v6.13-rc1	jsc#PED-16989	iommu: Add iommu_copy_struct_from_full_user_array helper
`c747e67978ff`	v6.13-rc1	jsc#PED-16989	iommufd/viommu: Add iommufd_viommu_find_dev helper
`d6563aa2a830`	v6.13-rc1	jsc#PED-16989	iommufd/selftest: Add mock_viommu_cache_invalidate
`576ad6eb45d6`	v6.13-rc1	jsc#PED-16989	iommufd/selftest: Add IOMMU_TEST_OP_DEV_CHECK_CACHE test command
`49ad12771924`	v6.13-rc1	jsc#PED-16989	iommufd/selftest: Add vIOMMU coverage for IOMMU_HWPT_INVALIDATE ioctl
`35890f85573c`	v6.13-rc1	jsc#PED-16989	vfio: Remove VFIO_TYPE1_NESTING_IOMMU
`e89573cf4a13`	v6.13-rc1	jsc#PED-16989	iommu/arm-smmu-v3: Report IOMMU_CAP_ENFORCE_CACHE_COHERENCY for CANWBS
`6912ec91828b`	v6.13-rc1	jsc#PED-16989	iommu/arm-smmu-v3: Support IOMMU_GET_HW_INFO via struct arm_smmu_hw_info
`874b87c7539f`	v6.13-rc1	jsc#PED-16989	iommu/arm-smmu-v3: Implement IOMMU_HWPT_ALLOC_NEST_PARENT
`f6681abd4139`	v6.13-rc1	jsc#PED-16989	iommu/arm-smmu-v3: Expose the arm_smmu_attach interface
`69d9b312f38a`	v6.13-rc1	jsc#PED-16989	iommu/arm-smmu-v3: Support IOMMU_VIOMMU_ALLOC
`1e8be08d1c91`	v6.13-rc1	jsc#PED-16989	iommu/arm-smmu-v3: Support IOMMU_DOMAIN_NESTED
`67e4fe398513`	v6.13-rc1	jsc#PED-16989	iommu/arm-smmu-v3: Use S2FWB for NESTED domains
`f27298a82ba0`	v6.13-rc1	jsc#PED-16989	iommu/arm-smmu-v3: Allow ATS for IOMMU_DOMAIN_NESTED
`d68beb276ba2`	v6.13-rc1	jsc#PED-16989	iommu/arm-smmu-v3: Support IOMMU_HWPT_INVALIDATE using a VIOMMU object
`6d026e6d48cd`	v6.13-rc1	jsc#PED-16989 git-fixes	iommu/arm-smmu-v3: Import IOMMUFD module namespace
`ea1829d4d413`	v6.13-rc1	grace-baremetal.txt	cppc_cpufreq: Remove HiSilicon CPPC workaround
`b45a3777ceab`	v6.13-rc1	bsc#1272627 jsc#NVIDIA-77	iommu: Pass old domain to set_dev_pasid op
`12cd88a9116a`	v6.13-rc1	jsc#PED-16989	vfio/nvgrace-gpu: Add a new GH200 SKU to the devid table
`7937a1bf32e3`	v6.13-rc2	jsc#PED-16989 git-fixes	iommufd: Fix typos in kernel-doc comments
`09dfc8a5f2ce`	v6.13-rc7	jsc#PED-16989 git-fixes	vfio/pci: Fallback huge faults for unaligned pfn
`43ca55f5555b`	v6.14-rc1	jsc#PED-16989	iommu/arm-smmu-v3: Introduce struct arm_smmu_event
`d814b70b9b90`	v6.14-rc1	jsc#PED-16989	iommu/arm-smmu-v3: Log better event records
`fb3de9f9b085`	v6.14-rc1	bsc#1272627 jsc#NVIDIA-77	iommu: Prevent pasid attach if no ops→remove_dev_pasid
`1fbf73425f51`	v6.14-rc1	bsc#1272627 jsc#NVIDIA-77	iommu: Consolidate the ops→remove_dev_pasid usage into a helper
`442003f3a842`	v6.14-rc1	jsc#PED-16989	iommufd: Keep OBJ/IOCTL lists in an alphabetical order
`3d49020a327c`	v6.14-rc1	jsc#PED-16989 git-fixes	iommufd/fault: Use a separate spinlock to protect fault→deliver list
`bd53764a60ad`	v6.14-rc1	jsc#PED-16989	vfio/nvgrace-gpu: Read dvsec register to determine need for uncached resmem
`6a9eb2d125ba`	v6.14-rc1	jsc#PED-16989	vfio/nvgrace-gpu: Expose the blackwell device PF BAR1 to the VM
`d85f69d520e6`	v6.14-rc1	jsc#PED-16989	vfio/nvgrace-gpu: Check the HBM training and C2C link status
`2bb447540e71`	v6.14-rc1	jsc#PED-16989	vfio/nvgrace-gpu: Add GB200 SKU to the devid table
`1608f0230510`	v6.14-rc1	jsc#NVIDIA-64	cpufreq: Fix re-boost issue after hotplugging a CPU
`dd016f379ebc`	v6.14-rc1	jsc#NVIDIA-64	cpufreq: Introduce a more generic way to set default per-policy boost flag
`03d8b4e76266`	v6.14-rc1	jsc#NVIDIA-64	cpufreq: CPPC: Fix wrong max_freq in policy initialization
`2b16c631832d`	v6.14-rc1	jsc#NVIDIA-64	cpufreq: ACPI: Remove set_boost in acpi_cpufreq_cpu_init()
`0813fd2e14ca`	v6.14-rc2	jsc#NVIDIA-64	cpufreq: prevent NULL dereference in cpufreq_online()
`5deb9c789ae4`	v6.15-rc1	jsc#NVIDIA-79	arch_topology: Support SMT control for OF based system
`eed4583bcf9a`	v6.15-rc1	jsc#NVIDIA-79	arm64: Kconfig: Enable HOTPLUG_SMT
`858c7bfcb35e`	v6.15-rc1	jsc#NVIDIA-55	arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9
`4ba6d37ccca1`	v6.15-rc1	jsc#NVIDIA-64	cpufreq: Use str_enable_disable() helper
`dc47f23f1df6`	v6.15-rc1	jsc#NVIDIA-64	cpufreq: Always create freq-table related sysfs file
`991e0a064bf3`	v6.15-rc1	jsc#NVIDIA-64	cpufreq: dt: Stop setting cpufreq_driver→attr field
`5c840223abc5`	v6.15-rc1	jsc#NVIDIA-64	cpufreq: acpi: Stop setting common freq attributes
`50b8cd5c91d2`	v6.15-rc1	jsc#NVIDIA-64	cpufreq: scmi: Stop setting cpufreq_driver→attr field
`ad3f116fe3de`	v6.15-rc1	jsc#NVIDIA-64	cpufreq: scpi: Stop setting cpufreq_driver→attr field
`c3245e78b542`	v6.15-rc1	jsc#NVIDIA-64	cpufreq: spear: Stop setting cpufreq_driver→attr field
`f577fab0cc76`	v6.15-rc1	jsc#NVIDIA-64	cpufreq: tegra: Stop setting cpufreq_driver→attr field
`260d6cdc7b69`	v6.15-rc1	jsc#NVIDIA-64	cpufreq: vexpress: Stop setting cpufreq_driver→attr field
`486729c60120`	v6.15-rc1	jsc#NVIDIA-64	cpufreq: Remove cpufreq_generic_attrs
`38bcdb635ac6`	v6.15-rc1	jsc#NVIDIA-64	cpufreq: Stop checking for duplicate available/boost freq attributes
`1f04815057a4`	v6.15-rc1	jsc#NVIDIA-64	cpufreq: staticize cpufreq_boost_trigger_state()
`9a23eb8b2b5d`	v6.15-rc1	jsc#NVIDIA-64	cpufreq: Export cpufreq_boost_set_sw()
`1f7d1bab50e6`	v6.15-rc1	jsc#NVIDIA-64	cpufreq: Introduce policy→boost_supported flag
`be6b8681a0e4`	v6.15-rc1	jsc#NVIDIA-64	cpufreq: acpi: Set policy→boost_supported
`a3f48fb2e5b7`	v6.15-rc1	jsc#NVIDIA-64	cpufreq: cppc: Set policy→boost_supported
`691b32127812`	v6.15-rc1	jsc#NVIDIA-64	cpufreq: Restrict enabling boost on policies with no boost frequencies
`11847a5c1265`	v6.15-rc1	jsc#NVIDIA-64	cpufreq: scmi: Set .set_boost directly
`707e222314ff`	v6.15-rc1	jsc#NVIDIA-64	cpufreq: dt: Set .set_boost directly
`c952775a3d72`	v6.15-rc1	jsc#NVIDIA-64	cpufreq: staticize policy_has_boost_freq()
`0322f3e89b4e`	v6.15-rc1	jsc#NVIDIA-64	cpufreq: Remove cpufreq_enable_boost_support()
`45f589b7167f`	v6.15-rc1	jsc#NVIDIA-64	cpufreq: Init cpufreq only for present CPUs
`f48dcda8f6a4`	v6.15-rc1	bsc#1272627 jsc#NVIDIA-77	iommu/rockchip: Allocate per-device data sensibly
`f90aa59eb299`	v6.15-rc1	bsc#1272627 jsc#NVIDIA-77	iommu/rockchip: Register in a sensible order
`9349887e9300`	v6.15-rc1	jsc#PED-16989	genirq/msi: Refactor iommu_dma_compose_msi_msg()
`288683c92b1a`	v6.15-rc1	jsc#PED-16989	iommu: Make iommu_dma_prepare_msi() into a generic operation
`96093fe54f48`	v6.15-rc1	jsc#PED-16989	irqchip: Have CONFIG_IRQ_MSI_IOMMU be selected by irqchips that need it
`748706d7ca06`	v6.15-rc1	jsc#PED-16989	iommu: Turn fault_data to iommufd private pointer
`40f5175d0eb7`	v6.15-rc1	jsc#PED-16989	iommufd: Implement sw_msi support natively
`237603a46abf`	v6.15-rc1	bsc#1272627 jsc#NVIDIA-77	iommu: Make @handle mandatory in iommu_{attach\|replace}_group_handle()
`e1ea9d30d84c`	v6.15-rc1	bsc#1272627 jsc#NVIDIA-77	iommu: Store either domain or handle in group→pasid_array
`5e9f822c9c68`	v6.15-rc1	bsc#1272627 jsc#NVIDIA-77	iommu: Swap the order of setting group→pasid_array and calling attach op of iommu drivers
`fd598f71b669`	v6.15-rc1	bsc#1272627 jsc#NVIDIA-77	iommu: Resolve ops in iommu_init_device()
`3832862eb9c4`	v6.15-rc1	bsc#1272627 jsc#NVIDIA-77	iommu: Keep dev→iommu state consistent
`bcb81ac6ae3c`	v6.15-rc1	bsc#1272627 jsc#NVIDIA-77	iommu: Get DT/ACPI parsing into the proper probe path
`73d2f10957f5`	v6.15-rc1	bsc#1272627 jsc#NVIDIA-77	iommu: Don’t warn prematurely about dodgy probes
`27321c788b3a`	v6.15-rc1	jsc#NVIDIA-67	firmware: tegra: bpmp: Fix typo in bpmp-abi.h
`897008d0f767`	v6.15-rc1	jsc#PED-16989 git-fixes	iommufd: Set domain→iommufd_hwpt in all hwpt→domain allocators
`dbf00d7d8912`	v6.15-rc1	jsc#PED-16989	iommufd/fault: Move two fault functions out of the header
`927dabc9aa4d`	v6.15-rc1	jsc#PED-16989	iommufd/fault: Add an iommufd_fault_init() helper
`5426a78bebef`	v6.15-rc1	jsc#PED-16989	iommufd: Abstract an iommufd_eventq from iommufd_fault
`0507f337fc0c`	v6.15-rc1	jsc#PED-16989	iommufd: Rename fault.c to eventq.c
`e36ba5ab808e`	v6.15-rc1	jsc#PED-16989	iommufd: Add IOMMUFD_OBJ_VEVENTQ and IOMMUFD_CMD_VEVENTQ_ALLOC
`ea94b211c548`	v6.15-rc1	jsc#PED-16989	iommufd/viommu: Add iommufd_viommu_get_vdev_id helper
`e8e1ef9b77a7`	v6.15-rc1	jsc#PED-16989	iommufd/viommu: Add iommufd_viommu_report_event helper
`941d0719aa66`	v6.15-rc1	jsc#PED-16989	iommufd/selftest: Require vdev_id when attaching to a nested domain
`b3cc0b7599cc`	v6.15-rc1	jsc#PED-16989	iommufd/selftest: Add IOMMU_TEST_OP_TRIGGER_VEVENT for vEVENTQ coverage
`97717a1f283f`	v6.15-rc1	jsc#PED-16989	iommufd/selftest: Add IOMMU_VEVENTQ_ALLOC test coverage
`f0ea207ed781`	v6.15-rc1	jsc#PED-16989	iommu/arm-smmu-v3: Introduce struct arm_smmu_vmaster
`e7d3fa3d29d5`	v6.15-rc1	jsc#PED-16989	iommu/arm-smmu-v3: Report events that belong to devices attached to vIOMMU
`da0c56520e88`	v6.15-rc1	jsc#PED-16989	iommu/arm-smmu-v3: Set MEV bit in nested STE for DoS mitigations
`8a9e1e773f60`	v6.15-rc1	bsc#1272627 jsc#NVIDIA-77	iommu: Introduce a replace API for device pasid
`803f97298e7d`	v6.15-rc1	jsc#PED-16989	iommufd: Extend IOMMU_GET_HW_INFO to report PASID capability
`6d9500bb1ff8`	v6.15-rc1	jsc#PED-16989	iommufd/selftest: Add coverage for reporting max_pasid_log2 via IOMMU_HW_INFO
`41464a4628f3`	v6.15-rc1	jsc#PED-16989 git-fixes	iommufd: Initialize the flags of vevent in iommufd_viommu_report_event()
`6fc85bbbeaea`	v6.15-rc1	jsc#PED-16989 git-fixes	iommufd: Balance veventq→num_events inc/dec
`858c9c10c123`	v6.15-rc1	jsc#PED-16989 git-fixes	iommufd: Fix iommu_vevent_header tables markup
`d9d3cede4167`	v6.15-rc2	bsc#1272627 jsc#NVIDIA-77	iommu/ipmmu-vmsa: Register in a sensible order
`c8ba3f8aff67`	v6.15-rc2	bsc#1272627 jsc#NVIDIA-77	PCI: Run quirk_huawei_pcie_sva() before arm_smmu_probe_device()
`45e00e367189`	v6.15-rc5	jsc#PED-16989 git-fixes	iommu/arm-smmu-v3: Add missing S2FWB feature detection
`3d59224947b0`	v6.15-rc5	jsc#NVIDIA-64	cpufreq: ACPI: Re-sync CPU boost state on system resume
`c1d9dac0db16`	v6.15-rc6	jsc#PED-16989 git-fixes	vfio/pci: Align huge faults to order
`95deee37a123`	v6.15-rc6	bsc#1272627 jsc#NVIDIA-77	platform: Fix race condition during DMA configure at IOMMU probe time
`3a3ce10e7adc`	v6.16-rc1	jsc#NVIDIA-64 git-fixes	ACPI: CPPC: Simplify PCC shared memory region handling
`c347f31ae27f`	v6.16-rc1	jsc#NVIDIA-64	cpufreq: Don’t unnecessarily call set_boost()
`27241c8b63bd`	v6.16-rc1	jsc#NVIDIA-64	cpufreq: Introduce policy_set_boost()
`a0982afa0992`	v6.16-rc1	jsc#NVIDIA-64	cpufreq: drop redundant cpus_read_lock() from store_local_boost()
`da33e87bd2bf`	v6.16-rc1	bsc#1272627 jsc#NVIDIA-77	iommu: Handle yet another race around registration
`152f33ee30ee`	v6.16-rc1	bsc#1272627 jsc#NVIDIA-77	bus: fsl_mc: Fix driver_managed_dma check
`3d5978ea6cbc`	v6.17-rc1	jsc#NVIDIA-64	cpufreq: CPPC: Do not return a value from populate_efficiency_class()
`c83a92df2fc6`	v6.17-rc1	jsc#NVIDIA-64	cpufreq: CPPC: Remove forward declaration of cppc_cpufreq_register_em()
`6e235a772199`	v6.17-rc1	jsc#PED-16989	iommufd: Drop unused ictx in struct iommufd_vdevice
`fc9c40e3a4fa`	v6.17-rc1	jsc#PED-16989	iommufd: Use enum iommu_viommu_type for type in struct iommufd_viommu
`62b62a55bd30`	v6.17-rc1	jsc#PED-16989	iommufd: Use enum iommu_veventq_type for type in struct iommufd_veventq
`0c6e0ae7a7e4`	v6.17-rc1	jsc#PED-16989	iommufd: Return EOPNOTSUPP for failures due to driver bugs
`187f146d5de6`	v6.17-rc1	jsc#PED-16989	iommu: Introduce get_viommu_size and viommu_init ops
`63141fa741da`	v6.17-rc1	jsc#PED-16989	iommufd/viommu: Support get_viommu_size and viommu_init ops
`5983d1e7d758`	v6.17-rc1	jsc#PED-16989	iommufd/selftest: Drop parent domain from mock_iommu_domain_nested
`683cff7c3bf4`	v6.17-rc1	jsc#PED-16989	iommufd/selftest: Replace mock_viommu_alloc with mock_viommu_init
`3961f2f5dacc`	v6.17-rc1	jsc#PED-16989	iommu/arm-smmu-v3: Replace arm_vsmmu_alloc with arm_vsmmu_init
`f842ea208e43`	v6.17-rc1	jsc#PED-16989	iommu: Deprecate viommu_alloc op
`17a93473a552`	v6.17-rc1	jsc#PED-16989	iommufd: Move _iommufd_object_alloc out of driver.c
`c0d498a1b99d`	v6.17-rc1	jsc#PED-16989	iommufd: Introduce iommufd_object_alloc_ucmd helper
`3e2a9811f6a9`	v6.17-rc1	jsc#PED-16989	iommufd: Apply the new iommufd_object_alloc_ucmd helper
`b23e09f99977`	v6.17-rc1	jsc#PED-16989	iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range
`fca02263f27e`	v6.17-rc1	jsc#PED-16989	iommufd: Correct virt_id kdoc at struct iommu_vdevice_alloc
`c50a5de2c465`	v6.17-rc1	jsc#PED-16989	iommufd/viommu: Explicitly define vdev→virt_id
`4b57c057f9e6`	v6.17-rc1	jsc#PED-16989	iommu: Use enum iommu_hw_info_type for type in hw_info op
`3fcf56a2393b`	v6.17-rc1	jsc#PED-16989	iommu: Add iommu_copy_struct_to_user helper
`c3436d42f812`	v6.17-rc1	jsc#PED-16989	iommu: Pass in a driver-level user data structure to viommu_init op
`1976cdf61ce9`	v6.17-rc1	jsc#PED-16989	iommufd/viommu: Allow driver-specific user data for a vIOMMU object
`afeaf592c1d4`	v6.17-rc1	jsc#PED-16989	iommufd/selftest: Support user_data in mock_viommu_alloc
`0e3e0b0c08e3`	v6.17-rc1	jsc#PED-16989	iommufd/selftest: Add coverage for viommu data
`1c26c3bbdee1`	v6.17-rc1	jsc#PED-16989	iommufd/access: Add internal APIs for HW queue to use
`27b77ea5feaa`	v6.17-rc1	jsc#PED-16989	iommufd/access: Bypass access→ops→unmap for internal use
`ed42eee797ff`	v6.17-rc1	jsc#PED-16989	iommufd/viommu: Add driver-defined vDEVICE support
`e2e936002258`	v6.17-rc1	jsc#PED-16989	iommufd/viommu: Introduce IOMMUFD_OBJ_HW_QUEUE and its related struct
`2238ddc2b056`	v6.17-rc1	jsc#PED-16989	iommufd/viommu: Add IOMMUFD_CMD_HW_QUEUE_ALLOC ioctl
`0b37d892d042`	v6.17-rc1	jsc#PED-16989	iommufd/driver: Add iommufd_hw_queue_depend/undepend() helpers
`20896914da8a`	v6.17-rc1	jsc#PED-16989	iommufd/selftest: Add coverage for IOMMUFD_CMD_HW_QUEUE_ALLOC
`56e9a0d8e53f`	v6.17-rc1	jsc#PED-16989	iommufd: Add mmap interface
`80478a2b450e`	v6.17-rc1	jsc#PED-16989	iommufd/selftest: Add coverage for the new mmap interface
`62622a8753fa`	v6.17-rc1	jsc#PED-16989	iommu: Allow an input type in hw_info op
`a9f10bab2e50`	v6.17-rc1	jsc#PED-16989	iommufd: Allow an input data_type via iommu_hw_info
`3a35f7d4a467`	v6.17-rc1	jsc#PED-16989	iommufd/selftest: Update hw_info coverage for an input data_type
`61dd912ee02e`	v6.17-rc1	jsc#PED-16989	iommu/arm-smmu-v3-iommufd: Add vsmmu_size/type and vsmmu_init impl ops
`9eb6a666df7f`	v6.17-rc1	jsc#PED-16989	iommu/arm-smmu-v3-iommufd: Add hw_info to impl_ops
`1eb468744cca`	v6.17-rc1	jsc#PED-16989	iommu/tegra241-cmdqv: Use request_threaded_irq
`589899ee299e`	v6.17-rc1	jsc#PED-16989	iommu/tegra241-cmdqv: Simplify deinit flow in tegra241_cmdqv_remove_vintf()
`81f81db6328b`	v6.17-rc1	jsc#PED-16989	iommu/tegra241-cmdqv: Do not statically map LVCMDQs
`4dc0d12474f9`	v6.17-rc1	jsc#PED-16989	iommu/tegra241-cmdqv: Add user-space use support
`32b2d3a57e26`	v6.17-rc1	jsc#PED-16989	iommu/tegra241-cmdqv: Add IOMMU_VEVENTQ_TYPE_TEGRA241_CMDQV support
`b42497e3c0e7`	v6.17-rc1	jsc#PED-16989 git-fixes CVE-2025-38688 bsc#1249174	iommufd: Prevent ALIGN() overflow
`78447d4545b2`	v6.17-rc1	bsc#1272627 jsc#NVIDIA-77	PCI: Fix driver_managed_dma check
`72b6f7cd89ce`	v6.17-rc3	bsc#1272627 jsc#NVIDIA-77	iommu/virtio: Make instance lookup robust
`8fe8a092043f`	v6.17-rc3	jsc#PED-16989 git-fixes	iommufd: viommu: free memory allocated by kvcalloc() using kvfree()
`7a425ec75d2b`	v6.17	jsc#PED-16989 git-fixes	iommufd: Fix refcounting race during mmap
`fa84e534c3ec`	v6.18-rc1	vera-baremetal.txt	arm64: realm: ioremap: Allow mapping memory as encrypted
`9e8a3df3e7f7`	v6.18-rc1	vera-baremetal.txt	arm64: Enable EFI secret area Securityfs support
`f8f89e8cf3d6`	v6.18-rc1	jsc#NVIDIA-55	perf: arm_pmuv3: Factor out PMCCNTR_EL0 use conditions
`16d39e2bf960`	v6.18-rc1	jsc#NVIDIA-64	cpufreq: Remove unused parameter in cppc_perf_from_fbctrs()
`c8dc2368b23e`	v6.18-rc1	jsc#NVIDIA-64	cpufreq: CPPC: Use scope-based cleanup helper
`97248d05b70e`	v6.18-rc1	jsc#NVIDIA-64	cpufreq: Drop redundant freq_table parameter
`1d235d849425`	v6.18-rc1	jsc#PED-16989 git-fixes	iommu/selftest: prevent use of uninitialized variable
`407aa63018d1`	v6.18-rc1	jsc#PED-16989	vfio/nvgrace-gpu: Add GB300 SKU to the devid table
`bee8a520eb84`	v6.18-rc1	jsc#NVIDIA-73	rhashtable: Use rcu_dereference_all and rcu_dereference_all_check
`b09ed52db1e6`	v6.18-rc5	jsc#PED-16989 git-fixes	iommufd/selftest: Fix ioctl return value in _test_cmd_trigger_vevents()
`ac84ff453305`	v6.18	jsc#PED-16989 git-fixes	iommufd/driver: Fix counter initialization for counted_by annotation
`b07bf253ef8e`	v6.18	jsc#PED-16989 git-fixes	iommufd/iommufd_private.h: Avoid -Wflex-array-member-not-at-end warning
`c3d78c34ad00`	v6.19-rc1	jsc#NVIDIA-55	perf: arm_pmuv3: Don’t use PMCCNTR_EL0 on SMT cores
`7ab06ea41af5`	v6.19-rc1	jsc#NVIDIA-55	arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY
`52f77fb176ec`	v6.19-rc1	bsc#1272627 jsc#NVIDIA-77	iommu/arm-smmu-v3: Set release_domain to arm_smmu_blocked_domain
`680a6a60fc08`	v6.19-rc1	git-fixes	iommu/exynos-iommu: Set release_domain to exynos_identity_domain
`fd714986e4e4`	v6.19-rc1	bsc#1272627 jsc#NVIDIA-77	iommu: Pass in old domain to attach_dev callback functions
`9b92bc7554b5`	v6.19-rc1	jsc#PED-16989	vfio: refactor vfio_pci_mmap_huge_fault function
`9db65489b872`	v6.19-rc1	jsc#PED-16989	vfio/nvgrace-gpu: Add support for huge pfnmap
`7f5764e179c6`	v6.19-rc1	jsc#PED-16989	vfio: use vfio_pci_core_setup_barmap to map bar in mmap
`7d055071d73b`	v6.19-rc1	jsc#PED-16989	vfio/nvgrace-gpu: split the code to wait for GPU ready
`dfe765499abf`	v6.19-rc1	jsc#PED-16989	vfio/nvgrace-gpu: Inform devmem unmapped after reset
`a23b10608d42`	v6.19-rc1	jsc#PED-16989	vfio/nvgrace-gpu: wait for the GPU mem to be ready
`30d0a1291046`	v6.19-rc1	jsc#PED-16989	mm: change ghes code to allow poison of non-struct pfn
`2ec41967189c`	v6.19-rc1	jsc#PED-16989	mm: handle poisoning of pfn without struct pages
`e6dbcb7c0e7b`	v6.19-rc4	jsc#PED-16989 git-fixes	mm: fixup pfnmap memory failure handling to use pgoff
`f9cadb3d5691`	v7.0-rc1	jsc#NVIDIA-64	ACPI: CPPC: Factor out and export per-cpu cppc_perf_ctrs_in_pcc_cpu()
`206b66125563`	v7.0-rc1	jsc#NVIDIA-64	cpufreq: CPPC: Factor out cppc_fie_kworker_init()
`997c021abc6e`	v7.0-rc1	jsc#NVIDIA-64	cpufreq: CPPC: Update FIE arch_freq_scale in ticks for non-PCC regs
`71fedc41c23b`	v7.0-rc1	jsc#NVIDIA-73	sched/fair: Switch to rcu_dereference_all()
`5ac66ed8417f`	v7.0-rc1	linux-nvidia-6.18	iommu/arm-smmu-v3: Remove IAS
`2781f2a930ab`	v7.0-rc1	jsc#PED-16989 git-fixes	iommu/arm-smmu-v3: Add update_safe bits to fix STE update sequence
`f3c1d372dbb8`	v7.0-rc1	jsc#PED-16989 git-fixes	iommu/arm-smmu-v3: Mark STE MEV safe when computing the update sequence
`7cad80048595`	v7.0-rc1	jsc#PED-16989 git-fixes	iommu/arm-smmu-v3: Mark EATS_TRANS safe when computing the update sequence
`a45dd3466302`	v7.0-rc1	jsc#PED-16989 git-fixes	iommu/arm-smmu-v3: Do not set disable_ats unless vSTE is Translate
`5d5388b0e190`	v7.0-rc1	bsc#1272627 jsc#NVIDIA-77	iommu: Lock group→mutex in iommu_deferred_attach()
`4a73abb965b7`	v7.0-rc1	bsc#1272627 jsc#NVIDIA-77	iommu: Tidy domain for iommu_setup_dma_ops()
`a75b2be249d6`	v7.0-rc1	bsc#1272627 jsc#NVIDIA-77	iommu: Add iommu_driver_get_domain_for_dev() helper
`c279e83953d9`	v7.0-rc1	bsc#1272627 jsc#NVIDIA-77	iommu: Introduce pci_dev_reset_iommu_prepare/done()
`f5b16b802174`	v7.0-rc1	bsc#1272627 jsc#NVIDIA-77	PCI: Suspend iommu function prior to resetting a device
`205e6d17cdf5`	v7.0-rc1	jsc#PED-16989	mm: add stubs for PFNMAP memory failure registration functions
`e5f19b619fa0`	v7.0-rc1	jsc#PED-16989	vfio/nvgrace-gpu: register device memory for poison handling
`0f7afd80d81b`	v7.0-rc1	linux-nvidia-6.18	PCI: Move CXL DVSEC definitions into uapi/linux/pci_regs.h
`6612bd9ff0b1`	v7.0-rc1	linux-nvidia-6.18	PCI: Update CXL DVSEC definitions
`7c29ba02210c`	v7.0-rc1	vera-baremetal-addendum.txt	PCI: Introduce pcie_is_cxl()
`69050f8d6d07`	v7.0-rc1	jsc#NVIDIA-64 git-fixes	treewide: Replace kmalloc with kmalloc_obj for non-scalar types
`bf4afc53b77a`	v7.0-rc1	jsc#NVIDIA-64 git-fixes	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
`32a92f8c8932`	v7.0-rc1	jsc#NVIDIA-64 git-fixes	Convert more 'alloc_obj' cases to default GFP_KERNEL arguments
`df6e4ab654dc`	v7.0-rc2	linux-nvidia-6.18 git-fixes	arm64: topology: Fix false warning in counters_read_on_cpu() for same-CPU reads
`82f73ef9c41e`	v7.0-rc4	bsc#1272627 jsc#NVIDIA-77	powerpc/iommu: fix lockdep warning during PCI enumeration
`37beb4256016`	v7.1-rc1	bsc#1272533	randomize_kstack: Maintain kstack_offset per task
`a96ef5848cb0`	v7.1-rc1	bsc#1272533	randomize_kstack: Unify random source across arches
`8505bfb4e4ec`	v7.1-rc1	jsc#NVIDIA-64	ACPI: CPPC: Move reference performance to capabilities
`be473f0591f1`	v7.1-rc1	jsc#NVIDIA-64	ACPI: CPPC: Fix uninitialized ref variable in cppc_get_perf_caps()
`04aa9d0726cc`	v7.1-rc1	jsc#NVIDIA-64	cpufreq: Remove max_freq_req update for pre-existing policy
`6e39ba4e5a82`	v7.1-rc1	jsc#NVIDIA-64	cpufreq: Add boost_freq_req QoS request
`9266b4da051a`	v7.1-rc1	jsc#NVIDIA-64	cpufreq: Allocate QoS freq_req objects with policy
`8e8e23dea43e`	v7.1-rc1	linux-nvidia-6.18	sched/topology: Compute sd_weight considering cpuset partitions
`5a7b576b3ec1`	v7.1-rc1	jsc#NVIDIA-73	sched/topology: Extract "imb_numa_nr" calculation into a separate helper
`1cc8a33ca7e8`	v7.1-rc1	jsc#NVIDIA-73	sched/topology: Allocate per-CPU sched_domain_shared in s_data
`bb7a5e44fc6f`	v7.1-rc1	jsc#NVIDIA-73	sched/topology: Switch to assigning "sd→shared" from s_data
`f1320a8dd8ba`	v7.1-rc1	jsc#NVIDIA-73	sched/fair: Simplify the entry condition for update_idle_cpu_scan()
`fe7171d0d5df`	v7.1-rc1	jsc#NVIDIA-73	sched/fair: Simplify SIS_UTIL handling in select_idle_cpu()
`e379dce8af11`	v7.1-rc1	linux-nvidia-6.18	sched/topology: Fix sched_domain_span()
`d06b8e7c97c3`	v7.1-rc1	linux-nvidia-6.18	fs/resctrl: Report invalid domain ID when parsing io_alloc_cbm
`d2bf45d067c7`	v7.1-rc1	linux-nvidia-6.18	fs/resctrl: Add "*" shorthand to set io_alloc CBM for all domains
`79727019ce3d`	v7.1-rc1	linux-nvidia-6.18	fs/resctrl: Add missing return value descriptions
`d332424d1d06`	v7.1-rc1	jsc#NVIDIA-55	perf/arm_cspmu: nvidia: Rename doc to Tegra241
`f5caf26fd6c7`	v7.1-rc1	jsc#NVIDIA-55	perf/arm_cspmu: nvidia: Add Tegra410 UCF PMU
`bc86281fe4bd`	v7.1-rc1	jsc#NVIDIA-55	perf/arm_cspmu: Add arm_cspmu_acpi_dev_get
`bf585ba14726`	v7.1-rc1	jsc#NVIDIA-55	perf/arm_cspmu: nvidia: Add Tegra410 PCIE PMU
`3dd73022306b`	v7.1-rc1	jsc#NVIDIA-55	perf/arm_cspmu: nvidia: Add Tegra410 PCIE-TGT PMU
`429b7638b2df`	v7.1-rc1	jsc#NVIDIA-55	perf: add NVIDIA Tegra410 CPU Memory Latency PMU
`2f89b7f78c50`	v7.1-rc1	jsc#NVIDIA-55	perf: add NVIDIA Tegra410 C2C PMU
`702c1d56c717`	v7.1-rc1	vera-baremetal.txt	PCI/CXL: Hide SBR from reset_methods if masked by CXL
`6fabce53f6b9`	v7.1-rc1	jsc#PED-16989 git-fixes	iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update
`9dcef98dbee3`	v7.1-rc1	jsc#PED-16989 git-fixes	iommu/tegra241-cmdqv: Update uAPI to clarify HYP_OWN requirement
`d921f8d3b955`	v7.1-rc1	jsc#NVIDIA-67	firmware: tegra: bpmp: Rename Tegra239 to Tegra238
`83c18a324570`	v7.1-rc1	jsc#NVIDIA-67	soc/tegra: Update BPMP ABI header
`09c091fddb0b`	v7.1-rc1	jsc#PED-16989 git-fixes	iommufd/selftest: Fix page leaks in mock_viommu_{init,destroy}
`d769711fcddd`	v7.1-rc4	bsc#1272627 jsc#NVIDIA-77 CVE-2026-53280 bsc#1269524	iommu: Fix NULL group→domain dereference in pci_dev_reset_iommu_done()
`834ab85aa966`	v7.1-rc4	bsc#1272627 jsc#NVIDIA-77	iommu: Fix kdocs of pci_dev_reset_iommu_done()
`b296ca1fb43a`	v7.1-rc4	bsc#1272627 jsc#NVIDIA-77	iommu: Replace per-group resetting_domain with per-gdev blocked flag
`1615e8896a8f`	v7.1-rc4	bsc#1272627 jsc#NVIDIA-77	iommu: Fix pasid attach in pci_dev_reset_iommu_prepare/done()
`0d5fd7a9323c`	v7.1-rc4	bsc#1272627 jsc#NVIDIA-77	iommu: Fix nested pci_dev_reset_iommu_prepare/done()
`fc3523b16d2b`	v7.1-rc4	bsc#1272627 jsc#NVIDIA-77	iommu: Fix ATS invalidation timeouts during __iommu_remove_group_pasid()
`5474e6e17a26`	v7.1-rc4	bsc#1272627 jsc#NVIDIA-77 CVE-2026-52952 bsc#1269130	iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset
`15dd29ca6206`	v7.1-rc4	bsc#1272627 jsc#NVIDIA-77	iommu: Warn on premature unblock during DMA aliased sibling reset
`71e1815113f7`	v7.2-rc1	jsc#NVIDIA-64	ACPI: CPPC: Add support for CPPC v4
`70fa8a1860ed`	v7.2-rc1	jsc#NVIDIA-64	cpufreq: Extract cpufreq_policy_init_qos() function
`743a3cddb1f0`	v7.2-rc1	jsc#NVIDIA-64	cpufreq: Set default policy→min/max values for all drivers
`db80ad776cd2`	v7.2-rc1	jsc#NVIDIA-64	cpufreq: Remove driver default policy→min/max init
`8c83947c5dbb`	v7.2-rc1	jsc#NVIDIA-64	cpufreq: Use policy→min/max init as QoS request
`c9d93a73ce87`	v7.2-rc1	jsc#NVIDIA-73	sched/fair: Drop redundant RCU read lock in NOHZ kick path
`fdfe5a8cd873`	v7.2-rc1	jsc#NVIDIA-73	sched/fair: Attach sched_domain_shared to sd_asym_cpucapacity
`25a32e400a14`	v7.2-rc1	jsc#NVIDIA-73	sched/fair: Prefer fully-idle SMT cores in asym-capacity idle selection
`bf6aa722198d`	v7.2-rc1	jsc#NVIDIA-73	sched/fair: Reject misfit pulls onto busy SMT siblings on asym-capacity
`61ea17a63719`	v7.2-rc1	jsc#NVIDIA-73	sched/fair: Add SIS_UTIL support to select_idle_capacity()
`25139c11693a`	v7.2-rc1	jsc#NVIDIA-73	sched/fair: Fix RCU usage in NOHZ exit path on CPU offline
`50a42e03cdbd`	v7.2-rc1	linux-nvidia-6.18	arm_mpam: Update architecture version check for MPAM MSC
`7625632fed43`	v7.2-rc1	linux-nvidia-6.18	fs/resctrl: Tidy up the error path in resctrl_mkdir_event_configs()
`94a1206522d1`	v7.2-rc1	linux-nvidia-6.18	x86,fs/resctrl: Create 'event_filter' files read only if they’re not configurable
`f52abe650241`	v7.2-rc1	linux-nvidia-6.18	fs/resctrl: Disallow the software controller when MBM counters are assignable
`ee3d4c81d89c`	v7.2-rc1	linux-nvidia-6.18	fs/resctrl: Add monitor property 'mbm_cntr_assign_fixed'
`3aec86e4ea01`	v7.2-rc1	linux-nvidia-6.18	fs/resctrl: Continue counter allocation after failure
`9a1646211f8c`	v7.2-rc1	linux-nvidia-6.18	fs/resctrl: Document that automatic counter assignment is best effort
`1cfa74c683ea`	v7.2-rc1	linux-nvidia-6.18	fs/resctrl: Document tasks file behaviour for task id 0 and idle tasks
`8a3571618c2e`	v7.2-rc1	linux-nvidia-6.18	soc/tegra: fuse: Register nvmem lookups at probe
`8b8ee2e56f95`	v7.2-rc1	jsc#NVIDIA-66	soc/tegra: Use ARM SMCCC to get chip ID, revision, and platform info
`682ecb14e838`	v7.2-rc1	jsc#PED-16989	vfio/nvgrace-gpu: Add Blackwell-Next GPU readiness check via CXL DVSEC
`91561e1dc94b`	v7.2-rc1	bsc#1269026 jsc#NVIDIA-72	PCI: Add pci_ats_required() for CXL.cache capable devices
`073e63812525`	v7.2-rc1	bsc#1269026 jsc#NVIDIA-7	PCI: Allow ATS to be always on for pre-CXL devices
`5ff98a0da6b4`	v7.2-rc1	bsc#1269026 jsc#NVIDIA-72	iommu/arm-smmu-v3: Allow ATS to be always on
`be93d186ae88`	v7.2-rc1	jsc#PED-16989 git-fixes CVE-2026-64293 bsc#1274016	iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read
`85345becfead`	v7.2-rc1	jsc#PED-16989 git-fixes	iommufd: Fix data_len byte-count vs element-count mismatch
`47443565d10c`	v7.2-rc1	jsc#PED-16989 git-fixes CVE-2026-64292 bsc#1274064	iommufd: Move vevent memory allocation outside spinlock
`6ebf2eb46fbd`	v7.2-rc1	jsc#PED-16989 git-fixes CVE-2026-64291 bsc#1274025	iommufd: Set veventq_depth upper bound
`01e41ad76c12`	v7.2-rc1	jsc#PED-16989 git-fixes	iommufd: Rewind header length in done if iommufd_veventq_fops_read() fails
`00203ca8323f`	v7.2-rc1	jsc#PED-16989 git-fixes	iommufd: Reject invalid read count in iommufd_veventq_fops_read()
`489e63dd120b`	v7.2-rc1	jsc#PED-16989 git-fixes	iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch()
`e28bee5b4451`	v7.2-rc1	jsc#PED-16989 git-fixes	iommu: Avoid copying the user array twice in the full-array copy helper
`f9a82544c717`	v7.2-rc3	jsc#NVIDIA-79 CVE-2026-72016 bsc#1276529	cpu/hotplug: Fix NULL kobject warning in cpuhp_smt_enable()
`ca0676ae2e1a`	v7.2-rc3	linux-nvidia-6.18	fs/resctrl: Free mon_data structures on rdt_get_tree() failure
`265d5d4032c5`	v7.2-rc4	linux-nvidia-6.18	soc/tegra: fuse: Fix spurious straps warning on SMCCC platforms
`11055a46f398`	v7.2-rc6	jsc#NVIDIA-64 git-fixes	ACPI: CPPC: Check all controls for fast switching
`47d4e945dff8`	v7.2-rc6	jsc#NVIDIA-64 git-fixes	ACPI: CPPC: Skip writes to unsupported performance controls
`9be311cfbe61`	v7.2-rc6	jsc#PED-16989 git-fixes	iommufd/viommu: Publish a vDEVICE only after vdevice_init() succeeds
`c3b8ee84a965`	v7.2-rc6	jsc#PED-16989 git-fixes CVE-2026-74573 bsc#1275563	iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE
`df5a1d4a8cdf`	v7.3-rc1	jsc#NVIDIA-64 git-fixes	ACPI: CPPC: Reject desired_perf reads on _CPC revision 4+
`d3576424e8fa`	v7.3-rc1	jsc#NVIDIA-64 git-fixes	ACPI: CPPC: Skip desired_perf read in cppc_get_perf()
`334dd0ed87e4`	v7.3-rc1	jsc#NVIDIA-64 git-fixes	ACPI: CPPC: Stop reading desired_perf in cppc_get_perf()
`9d9157ee90e3`	v7.3-rc1	jsc#NVIDIA-64 git-fixes	ACPI: CPPC: Avoid unnecessary reads for full-width writes
`9c5ab33a6d2c`	v7.3-rc1	jsc#NVIDIA-64 git-fixes	ACPI: CPPC: Avoid locking standalone full-width registers
`b0f51f98fbc9`	v7.3-rc1	jsc#NVIDIA-64 git-fixes	ACPI: CPPC: Evaluate performance-control PCC use once
`49f2413f9b55`	v7.3-rc1	jsc#NVIDIA-55	perf/arm_pmu: Skip PMCCNTR_EL0 on NVIDIA Olympus
`293f9611ae73`	v7.3-rc1	jsc#NVIDIA-73	sched/fair: Prefer fully idle cores for NOHZ balancing
`445528627447`	v7.3-rc1	jsc#PED-16989 git-fixes	iommu/arm-smmu-v3: Declare eats_s1chk and eats_trans as host-endian u64
`9ff145a25c5c`	v7.3-rc1	jsc#PED-16989 git-fixes CVE-2026-80818 bsc#1279695	iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown
`a491be376abd`	v7.3-rc1	jsc#PED-16989 git-fixes CVE-2026-90429 bsc#1281990	iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)init
`4379610c79bd`	v7.3-rc1	jsc#PED-16989 git-fixes CVE-2026-89450 bsc#1280381	iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field
`fb292bfc9be9`	v7.3-rc1	jsc#PED-16989 git-fixes CVE-2026-90425 bsc#1282014	iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID
`773f2b9e3670`	v7.3-rc1	jsc#PED-16989 git-fixes	iommu/arm-smmu-v3: Support IDR5.DS and widen the TLBI SCALE field
`0dbcdf4473a6`	v7.3-rc1	jsc#PED-16989 git-fixes CVE-2026-89447 bsc#1280322	iommufd: Avoid locking internal accesses during unmap
`5a9e89ea34e0`	v7.3-rc1	jsc#PED-16989 git-fixes CVE-2026-90244 bsc#1281834	iommu/dma: Restore locking around msi_page_list
`2bc6b218717b`	v7.3-rc5	jsc#NVIDIA-55 git-fixes CVE-2026-98546 bsc#1286765	arm64/boot: Disable trapping of PMZR_EL0 writes to EL2
`b52ef450139f`	v7.3-rc7	jsc#NVIDIA-55 git-fixes	arm64/boot: Don’t set PMUv3p9 FGT2 bits without PMUv3
`32299b29a887`	v7.4-rc1	jsc#NVIDIA-64 git-fixes	ACPI: CPPC: Validate _CPC entry and control semantics
`3685d9829c71`	v7.4-rc1	jsc#NVIDIA-64 git-fixes	ACPI: CPPC: Propagate performance-control write errors
`50affbde6410`	v7.4-rc1	jsc#NVIDIA-64 git-fixes	ACPI: CPPC: Serialize PCC single-register payload updates
`76e6914a843e`	v7.4-rc1	jsc#NVIDIA-64 git-fixes	ACPI: CPPC: Serialize PCC EPP payload updates
`27954e29d7de`	v7.4-rc1	jsc#NVIDIA-64 git-fixes	ACPI: CPPC: Release CPC descriptors through kobject
`968e29db97bb`	v7.4-rc1	jsc#NVIDIA-64 git-fixes	ACPI: CPPC: Release PCC data after probe failures
`2221dc547b38`	v7.4-rc1	jsc#NVIDIA-64 git-fixes	ACPI: CPPC: Reject unsafe cross-CPU SystemMemory RMW
`09d911c99663`	v7.4-rc1	jsc#NVIDIA-64 git-fixes	ACPI: CPPC: Reject direct reads of write-only controls
`21e018235d99`	v7.4-rc1	jsc#NVIDIA-64 git-fixes	cpufreq: CPPC: Select the frequency-invariance callback per CPU
`995e7d468070`	v7.4-rc1	jsc#NVIDIA-64 git-fixes	cpufreq: CPPC: Create the FIE worker before enabling PCC callbacks
`26564d25cd81`	Queued in subsystem maintainer repository	jsc#PED-16989 git-fixes	iommu/arm-smmu-v3-iommufd: Reject unsupported bits in invalidation commands
`9c48b994b66d`	v7.4-rc1	jsc#PED-16989 git-fixes	vfio/nvgrace-gpu: Use a core-only open_device in fallback mode
`ab0dbf411ace`	v7.4-rc1	jsc#PED-16989 git-fixes	iommu/arm-smmu-v3: Disable the impl before disabling the SMMU on shutdown
-	not yet, testing	Nvidia config	qcom: Kconfig: Allow disabling QCOM_SCM
-	submitted https://lore.kernel.org/linux-arm-kernel/20260611130429.295516-1-aneesh.kumar@kernel.org	jsc#NVIDIA-56 jsc#PED-15478	firmware: smccc: Add an Arm SMCCC bus
-	submitted https://lore.kernel.org/linux-arm-kernel/20260611130429.295516-1-aneesh.kumar@kernel.org	jsc#NVIDIA-56 jsc#PED-15478	firmware: hwrng: arm_smccc_trng: Register as an SMCCC device
-	submitted https://lore.kernel.org/linux-arm-kernel/20260706134455.132091-1-andre.przywara@arm.com/	jsc#NVIDIA-56 jsc#PED-15478	dt-bindings: arm: Add Live Firmware Activation
-	submitted https://lore.kernel.org/linux-arm-kernel/20260706134455.132091-1-andre.przywara@arm.com/	jsc#NVIDIA-56 jsc#PED-15478	firmware: smccc: Add support for Live Firmware Activation (LFA)
-	submitted https://lore.kernel.org/linux-arm-kernel/20260706134455.132091-1-andre.przywara@arm.com/	jsc#NVIDIA-56 jsc#PED-15478	firmware: smccc: lfa: Add timeout and trigger watchdog
-	submitted https://lore.kernel.org/linux-arm-kernel/20260706134455.132091-1-andre.przywara@arm.com/	jsc#NVIDIA-56 jsc#PED-15478	firmware: smccc: lfa: Register ACPI notification
-	submitted https://lore.kernel.org/linux-arm-kernel/20260706134455.132091-1-andre.przywara@arm.com/	jsc#NVIDIA-56 jsc#PED-15478	firmware: smccc: lfa: Add auto_activate sysfs file
-	submitted https://lore.kernel.org/linux-arm-kernel/20260706134455.132091-1-andre.przywara@arm.com/	jsc#NVIDIA-56 jsc#PED-15478	firmware: smccc: lfa: Register DT interrupt
-	submitted https://lore.kernel.org/linux-arm-kernel/20260706134455.132091-1-andre.przywara@arm.com/	jsc#NVIDIA-56 jsc#PED-15478	firmware: smccc: lfa: introduce SMC access lock
-	submitted https://lore.kernel.org/linux-arm-kernel/20260706134455.132091-1-andre.przywara@arm.com/	jsc#NVIDIA-56 jsc#PED-15478	firmware: smccc: lfa: add sysfs ABI documentation
-	not yet, TBD	jsc#NVIDIA-56 jsc#PED-15478	NVIDIA: VR: SAUCE: firmware: smccc: lfa: Emit a uevent on inventory updates
-	Not yet, TBD	vera-baremetal-addendum.txt	NVIDIA: VR: SAUCE: arm64: Add workaround to convert MT_NORMAL_NC to Device-nGnRE
-	submitted https://lore.kernel.org/all/20260122110805.97899-1-kkartik@nvidia.com/	jsc#NVIDIA-66	soc/tegra: pmc: Add PMC support for Tegra410
-	submitted https://lore.kernel.org/linux-iommu/cover.1779265413.git.nicolinc@nvidia.com/#t	https://github.com/NVIDIA/NV-Kernels/pull/454	iommu/arm-smmu-v3: Add arm_smmu_kdump_adopt_strtab() for kdump
-	submitted https://lore.kernel.org/linux-iommu/cover.1779265413.git.nicolinc@nvidia.com/#t	https://github.com/NVIDIA/NV-Kernels/pull/454	iommu/arm-smmu-v3: Retain CR0_SMMUEN during kdump device reset
-	submitted https://lore.kernel.org/linux-iommu/cover.1779265413.git.nicolinc@nvidia.com/#t	https://github.com/NVIDIA/NV-Kernels/pull/454	iommu/arm-smmu-v3: Implement is_attach_deferred() for kdump
-	submitted https://lore.kernel.org/linux-iommu/cover.1779265413.git.nicolinc@nvidia.com/#t	https://github.com/NVIDIA/NV-Kernels/pull/454	iommu/arm-smmu-v3: Skip EVTQ/PRIQ setup in kdump kernel
-	submitted https://lore.kernel.org/linux-iommu/cover.1779265413.git.nicolinc@nvidia.com/#t	https://github.com/NVIDIA/NV-Kernels/pull/454	iommu/arm-smmu-v3: Skip RMR bypass for kdump adoption
-	submitted https://lore.kernel.org/linux-iommu/cover.1779265413.git.nicolinc@nvidia.com/#t	https://github.com/NVIDIA/NV-Kernels/pull/454	iommu/arm-smmu-v3: Do not enable EVTQ/PRIQ interrupts in kdump kernel
-	submitted https://lore.kernel.org/linux-iommu/cover.1779265413.git.nicolinc@nvidia.com/#t	https://github.com/NVIDIA/NV-Kernels/pull/454	iommu/arm-smmu-v3: Detect ARM_SMMU_OPT_KDUMP_ADOPT in probe()
-	Not yet, TBD	https://github.com/NVIDIA/NV-Kernels/pull/447	quirks: mirror PI7C9X3G606GPC Port 4 BAR0
-	Submitted https://lore.kernel.org/all/20260424201814.230071-1-sumitg@nvidia.com/	jsc#NVIDIA-64	cpufreq: CPPC: add autonomous mode boot parameter support
-	Submitted https://lore.kernel.org/r/20260710144520.917375-2-andre.przywara@arm.com	linux-nvidia-6.18	arm_mpam: let low level MSC read accessors return an error
-	Submitted https://lore.kernel.org/r/20260710144520.917375-2-andre.przywara@arm.com	linux-nvidia-6.18	arm_mpam: propagate MSC read errors for wrapper functions
-	Submitted https://lore.kernel.org/r/20260710144520.917375-2-andre.przywara@arm.com	linux-nvidia-6.18	arm_mpam: propagate MSC read errors for hw_probe functions
-	Submitted https://lore.kernel.org/r/20260710144520.917375-2-andre.przywara@arm.com	linux-nvidia-6.18	arm_mpam: propagate MSC read errors for mpam_msc_read_mbwu_l()
-	Submitted https://lore.kernel.org/r/20260710144520.917375-2-andre.przywara@arm.com	linux-nvidia-6.18	arm_mpam: propagate MSC read errors for msmon helpers
-	Submitted https://lore.kernel.org/r/20260710144520.917375-2-andre.przywara@arm.com	linux-nvidia-6.18	arm_mpam: propagate MSC read errors for __ris_msmon_read()
-	Submitted https://lore.kernel.org/r/20260710144520.917375-2-andre.przywara@arm.com	linux-nvidia-6.18	arm_mpam: __ris_msmon_read(): get rid of nrdy special handling
-	Submitted https://lore.kernel.org/r/20260710144520.917375-2-andre.przywara@arm.com	linux-nvidia-6.18	arm_mpam: propagate MSC read errors for state saving functions
-	Submitted https://lore.kernel.org/r/20260710144520.917375-2-andre.przywara@arm.com	linux-nvidia-6.18	arm_mpam: let low level MSC write accessors return an error
-	Submitted https://lore.kernel.org/r/20260710144520.917375-2-andre.przywara@arm.com	linux-nvidia-6.18	arm_mpam: propagate MSC write errors for ESR and part_sel wrappers
-	Submitted https://lore.kernel.org/r/20260710144520.917375-2-andre.przywara@arm.com	linux-nvidia-6.18	arm_mpam: propagate MSC write errors for hardware probe functions
-	Submitted https://lore.kernel.org/r/20260710144520.917375-2-andre.przywara@arm.com	linux-nvidia-6.18	arm_mpam: propagate MSC write errors for remaining MSC write users
-	Submitted https://lore.kernel.org/r/20260710144520.917375-2-andre.przywara@arm.com	linux-nvidia-6.18	arm_mpam: prepare mon_sel locking for MPAM-Fb
-	Submitted https://lore.kernel.org/r/20260710144520.917375-2-andre.przywara@arm.com	linux-nvidia-6.18	arm_mpam: add MPAM-Fb MSC firmware access support
-	Submitted https://lore.kernel.org/r/20260710144520.917375-2-andre.przywara@arm.com	linux-nvidia-6.18	arm_mpam: prevent MPAM-Fb accesses inside IRQ handler
-	Submitted https://lore.kernel.org/r/20260710144520.917375-2-andre.przywara@arm.com	linux-nvidia-6.18	arm_mpam: detect and enable MPAM-Fb PCC support
-	Submitted https://lore.kernel.org/all/8e36f71d-598b-45bf-a3ea-6d44ff728877@redhat.com/	linux-nvidia-6.18	arm_mpam: resctrl: Pick classes for use as MBM counters
-	Submitted https://lore.kernel.org/all/8e36f71d-598b-45bf-a3ea-6d44ff728877@redhat.com/	linux-nvidia-6.18	arm_mpam: resctrl: Pre-allocate assignable monitors
-	Submitted https://lore.kernel.org/all/8e36f71d-598b-45bf-a3ea-6d44ff728877@redhat.com/	linux-nvidia-6.18	arm_mpam: resctrl: Add resctrl_arch_config_cntr() for ABMC use
-	Submitted https://lore.kernel.org/all/8e36f71d-598b-45bf-a3ea-6d44ff728877@redhat.com/	linux-nvidia-6.18	arm_mpam: resctrl: Add resctrl_arch_cntr_read() & resctrl_arch_reset_cntr()
-	Submitted https://lore.kernel.org/all/8e36f71d-598b-45bf-a3ea-6d44ff728877@redhat.com/	linux-nvidia-6.18	arm64: mpam: Add memory bandwidth usage (MBWU) documentation
-	Submitted https://lore.kernel.org/all/20260814093625.1567353-1-anrao@nvidia.com/	jsc#NVIDIA-67	firmware: tegra: bpmp: Move channel initialization to helper
-	Submitted https://lore.kernel.org/all/20260814093625.1567353-1-anrao@nvidia.com/	jsc#NVIDIA-67	firmware: tegra: bpmp: Add the Memory Bandwidth Throttler ABI definitions
-	Submitted https://lore.kernel.org/all/20260814093625.1567353-1-anrao@nvidia.com/	jsc#NVIDIA-67	firmware: tegra: bpmp: Add MBWT sysfs interface
-	Submitted https://lore.kernel.org/all/20260814093625.1567353-1-anrao@nvidia.com/	jsc#NVIDIA-67	firmware: tegra: bpmp: Add MBWT BPMP helpers
-	Submitted https://lore.kernel.org/all/20260814093625.1567353-1-anrao@nvidia.com/	jsc#NVIDIA-67	firmware: tegra: bpmp: Add ACPI support

15 Obtaining source code #

This SUSE product includes materials licensed to SUSE under the GNU General Public License (GPL). The GPL requires SUSE to provide the source code that corresponds to the GPL-licensed material. The source code is available for download at https://www.suse.com/download/sles/ on Medium 2. For up to three years after distribution of the SUSE product, upon request, SUSE will mail a copy of the source code. Send requests by e-mail to sle_source_request@suse.com. SUSE may charge a reasonable fee to recover distribution costs.

16 Legal notices #

SUSE makes no representations or warranties with regard to the contents or use of this documentation, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, SUSE reserves the right to revise this publication and to make changes to its content, at any time, without the obligation to notify any person or entity of such revisions or changes.

Further, SUSE makes no representations or warranties with regard to any software, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, SUSE reserves the right to make changes to any and all parts of SUSE software, at any time, without any obligation to notify any person or entity of such changes.

Any products or technical information provided under this Agreement may be subject to U.S. export controls and the trade laws of other countries. You agree to comply with all export control regulations and to obtain any required licenses or classifications to export, re-export, or import deliverables. You agree not to export or re-export to entities on the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in U.S. export laws. You agree to not use deliverables for prohibited nuclear, missile, or chemical/biological weaponry end uses. Refer to https://www.suse.com/company/legal/ for more information on exporting SUSE software. SUSE assumes no responsibility for your failure to obtain any necessary export approvals.

This release notes document is licensed under a Creative Commons Attribution-NoDerivatives 4.0 International License (CC-BY-ND-4.0). You should have received a copy of the license along with this document. If not, see https://creativecommons.org/licenses/by-nd/4.0/.

SUSE has intellectual property rights relating to technology embodied in the product that is described in this document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S. patents listed at https://www.suse.com/company/legal/ and one or more additional patents or pending patent applications in the U.S. and other countries.

For SUSE trademarks, see the SUSE Trademark and Service Mark list (https://www.suse.com/company/legal/). All third-party trademarks are the property of their respective owners.