openSUSE-SU-2026:22048-1

This update for swtpm fixes the following issues:

Security issue fixed:

• CVE-2026-75900: Out-of-bounds read in SWTPM_NVRAM_CheckHeader due to sizeof(pointer) vs sizeof(struct) mismatch (bsc#1275653).

Changes for swtpm:

Update to 0.10.2:

• Properly check for truncation following snprintf call

• add upstream signing key and validate source signature
• Fix SELinux policy for virtqemud_t swtpm_t setsched process and unix socket interactions. Allows virtqemud_t to: Signal and control swtpm_t processes (noatsecure, rlimitinh, siginh, signull, setsched), create and listen on Unix stream sockets with swtpm_t processes (bsc#1266339). Already accepted on upstream: https://github.com/stefanberger/swtpm/pull/1132
• Drop tunable in require to avoid policy loading issues with toolchain 3.11 (bsc#1271417). Can be dropped, once this is accepted upstream: https://github.com/stefanberger/swtpm/pull/1139
• Update SELinux module dir as macro to allow root path move from /var/lib/selinux to /etc/selinux (bsc#1221342)
• Also load swtpm_libvirt in the selinux subpackage (bsc#1251789)
• Update to version 0.10.1:

• swtpm: Fix build error on 32bit systems due to inconsistent _FILE_OFFSET_BITS.
• swtpm_setup:

• Use DISTRO_PROFILES_DIR when listing profiles (fix path issue).
• Do not pass a TPM 2 profile to swtpm when reconfiguring.

• selinux:

• Add rule for swtpm to be able to read password from pipe.
• allow to map state file.
• add NFS permissions for swtpm_t.
• Add rule to allow swtpm_t opening of virt_log_t files.