SUSE-SU-2026:5090-1: Security update for parted
This update for parted fixes the following issues:
- CVE-2026-89085: heap-based buffer overflow via crafted FAT32 filesystem image (bsc#1286017). - CVE-2026-89088: denial of service via heap buffer overflow during FAT16 resize (bsc#1286018).
Other sources
This update for parted fixes the following issues: CVE-2026-89085: heap-based buffer overflow via crafted FAT32 filesystem image (bsc#1286017). CVE-2026-89088: denial of service via heap buffer overflow during FAT16 resize (bsc#1286018).
— SUSE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/partedto a version that resolves this vulnerability.Fixed in 3.1-37.29.1 - Upgrade
Upgrade
suse/parted-debugsourceto a version that resolves this vulnerability.Fixed in 3.1-37.29.1 - Upgrade
Upgrade
suse/libparted0-debuginfoto a version that resolves this vulnerability.Fixed in 3.1-37.29.1 - Upgrade
Upgrade
suse/libparted0to a version that resolves this vulnerability.Fixed in 3.1-37.29.1 - Upgrade
Upgrade
suse/parted-debuginfoto a version that resolves this vulnerability.Fixed in 3.1-37.29.1 - Upgrade
Upgrade
suse/parted-develto a version that resolves this vulnerability.Fixed in 3.1-37.29.1 - Upgrade
Upgrade
partedto a version that resolves this vulnerability.Patch SUSE-SLE-SERVER-12-SP5-LTSS-2026-5090 - Upgrade
Upgrade
partedto a version that resolves this vulnerability.Patch SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2026-5090
Event History
Frequently Asked Questions
Which systems and packages are in scope for this update?
The advisory applies to SUSE Linux Enterprise Server 12 SP5 LTSS on aarch64, ppc64le, s390x, and x86_64, plus the x86_64 LTSS Extended Security offering. Affected packages listed include parted, libparted0, parted-devel, and associated debug and debuginfo packages.
What attacker-controlled input is required to trigger these issues?
CVE-2026-89085 is triggered through a crafted FAT32 filesystem image. CVE-2026-89088 occurs during FAT16 resize operations; the advisory does not state whether a crafted image is required for that issue.
What is the known impact of each vulnerability?
CVE-2026-89085 is a heap-based buffer overflow involving a crafted FAT32 filesystem image. CVE-2026-89088 can cause denial of service through a heap buffer overflow during FAT16 resizing.