SUSE alert openSUSE-SU-2026:21146-1 (lldpd)

From:
             
 
null@suse.de
To:
             
 
security-announce@lists.opensuse.org
Subject:
             
 
openSUSE-SU-2026:21146-1: moderate: Security update for lldpd
Date:
             
 
Tue, 30 Jun 2026 09:48:36 +0200
Message-ID:
             
 
<20260630074836.B9F09FF4B@maintenance.suse.de>
Archive-link:
             
 
Article
openSUSE security update: security update for lldpd
-------------------------------------------------------------

Announcement ID: openSUSE-SU-2026:21146-1
Rating: moderate

Cross-References:

  * CVE-2026-46433



Affected Products:

         openSUSE Leap 16.0

-------------------------------------------------------------

An update that solves one vulnerability can now be installed.

Description:

This update for lldpd fixes the following issues:

Changes in lldpd:

- Update to version 1.0.22
  * Fix CVE-2026-46433, out-of-bound read access when removing
    VLAN tag (#787).
  * Reject 0-length management address in LLDP.
  * Fix race condition when creating the control socket.
  * Fix FDP MAC address.
  * Fix memory leak in the BSD bridge query path.
  * Fix duplicate management addresses when merging EDP VLAN
    frames.

- Update to version 1.0.21
  Changes:
  * Add "configure lldp portdescription-source" to choose how to
    populate port description.
  Fix:
  * Fix path traversal vulnerabilities in the privileged process.
  * Fix arbitrary file deletion in the privileged process.
  * Fix accuracy of Dot3 MAU types advertised and add support for
    200G and 400G.
  * Fix detection of wireless interfaces.

- Update to version 1.0.20
  Changes:
  * Enable fast start unconditionally (and move its configuration
    in "configure lldp").
  * Make VLAN advertisements configurable.
  Fix:
  * Do not break zero-copy traffic on Linux.
  * Fix crash on rapid addition/removal of interfaces.
  * Fix management address selection when pattern is a negative
    IP address.

- Update to version 1.0.19
  Changes:
  * Add cvlan/svlan/tpmr capabilities.
  * Add lldpctl_watch_sync_unblock to liblldpctl.
  * Add C++ wrapper for lldpctl.
  Fix:
  * Fix AppArmor policy for /run/lldpd/lldpd.socket.lock.
  * Do not query stats for a down interface on Linux.


Patch instructions:

   To install this openSUSE security update use the suse recommended installation methods
   like YaST online_update or "zypper patch".
   Alternatively you can run the command listed for your product:

- openSUSE Leap 16.0

   zypper in -t patch openSUSE-Leap-16.0-packagehub-341=1

Package List:

- openSUSE Leap 16.0:

  liblldpctl4-1.0.22-bp160.1.1
  lldpd-1.0.22-bp160.1.1
  lldpd-devel-1.0.22-bp160.1.1

References:

  * https://www.suse.com/security/cve/CVE-2026-46433.html