{"id":"openSUSE-SU-2026:22203-1","summary":"Security update for tailscale","details":"This update for tailscale fixes the following issues:\n\nChanges in tailscale:\n\nUpdate to version 1.104.1:\n\n  + Go is updated to version 1.27\n  + WireGuard packet buffering uses less memory while waiting for peer\n    handshakes\n  + WireGuard packet queue depth scales with CPU core count, reducing peak\n    memory usage under heavy traffic\n  + Client-side netmap caching improves start up speed and connectivity when\n    the Tailscale control plane is unreachable\n  + WireGuard allocates a single packet buffer for batched I/O, improving\n    throughput and reducing memory usage\n  + An issue that could prevent traffic over IPv6 link-local addresses from\n    flowing through direct and Tailscale Peer Relay connections is resolved\n  + An issue preventing Linux desktop detection from working on Wayland\n    environments is resolved\n\nUpdate 1.102.5:\n\n  - The container no longer stops tailscaled when it falls behind\n    on status updates and the connection is closed, which was\n    common on large tailnets. It reconnects instead, and exits only\n    if it cannot reconnect within one minute.\n\nUpdate 1.102.4:\n\n  - All Platforms\n    - Resolved an issue that could cause a loss in connectivity\n      when a netmap update occurs near the time of\n      reauthentication.\n\nUpdate 1.102.3:\n\n  - All Platforms\n  \n    - Changed: Go is updated to version 1.26.6.\n    - Fixed: Tailscale refuses host-scoped IPv4 destinations at\n      every point that acts on an unmapped 4via6 address. This fix\n      addresses a security vulnerability described in TS-2026-011.\n    - Fixed: When MagicDNS is disabled, unqualified hostnames are\n      correctly forwarded to the configured nameservers.\n    - Fixed: Resolved an issue where nodes with Tailnet Lock\n      enabled on large tailnets would experience startup failures.\n\nUpdate 1.102.2:\n\n  - Fixed: A regression causing incoming Tailscale Funnel\n    connections to fail is resolved.\n\nUpdate 1.102.1:\n\n  - All Platforms\n  \n    - tailscaled_serve_outbound_bytes_total and\n      tailscaled_serve_inbound_bytes_total client metrics report\n      bytes sent to and received from peers on Tailscale Serve\n      connections for Tailscale Services.\n    - The tailscale get CLI command returns the current node's\n      preferences.\n    - The tailscale whoami CLI command displays information about\n      the current user and device.\n    - The tailscale service list CLI command displays Tailscale\n      Services visible to the current node.\n    - Node additions and removals are processed in constant time,\n      significantly reducing CPU usage on large tailnets.\n    - Tailscale Funnel domains use TLS-ALPN-01 for faster HTTPS\n      certificate renewals.\n    - Deprecated formats for 4via6 MagicDNS names are no longer\n      available to use.\n    - TLS certificates on idle servers proactively auto-renew in\n      the absence of traffic. Warnings are issued when there is no\n      valid cached certificate.\n    - Dials to dual-stack DNS names through an IPv4-only exit node\n      connect to the correct address when using tailscaled in\n      userspace mode.\n    - Certificate issuance for multiple domains runs in parallel.\n      Provisioning multiple domains does not stall each certificate\n      behind the previous one.\n    - Resolved an issue causing connectivity issues from the\n      operating system waking from sleep in wireguard-go.\n    - A node's home DERP region is reported to the coordination\n      server after a profile switch or login, allowing for peers to\n      immediately connect to the node.\n    - A memory leak that occurred after a failed WireGuard\n      handshake has been resolved.\n    - tailscale status --peers=false command shows the current\n      device name in the output.\n    - Resolved an issue that prevented connectivity via Tailscale\n      Peer Relays after a client restart.\n      \n  - Linux\n  \n    - Assembly crypto routines for 32-bit ARM are available,\n      improving performance on these platforms.\n    - Userspace TUN optimizations improve throughput and\n      performance.\n    - Resolved an issue impacting performance of UDP GSO on Linux\n      v7.0.x through v7.1.4.\n\nUpdate to version 1.98.10: (boo#1272825)\n\n  - Tailscale SSH Unix socket forwarding respects symlink\n    permissions. This fix addresses a security vulnerability\n    described in TS-2026-004.\n  - Tailscale SSH preforms additional checks to disallow UIDs and\n    numeric-only usernames. This fix covers additional scenarios\n    described in TS-2026-006.\n\nUpdate to version 1.98.9: (boo#1272825)\n\n  - Tailscale SSH Unix socket forwarding respects symlink\n    permissions. This fix addresses a security vulnerability\n    described in TS-2026-004.\n  - Tailscale Serve Unix socket proxy targets are restricted to the\n    root user. This fix addresses a security vulnerability\n    described in TS-2026-005.\n  - Tailscale SSH does not allow the use of UIDs or numeric-only\n    usernames. This fix addresses a security vulnerability\n    described in TS-2026-006.\n  - Nodes advertising Tailscale Services filter and reject packets\n    from service IPs on ports they do not advertise. This fix\n    addresses a security vulnerability described in TS-2026-007.\n  - Tailscale Serve and Tailscale Funnel terminate path walks for\n    non-absolute paths, preventing CPU core pinning. This fix\n    addresses a security vulnerability described in TS-2026-008.\n  - Tailscale SSH does not allow the use of usernames with leading\n    dashes. This fix addresses a security vulnerability described\n    in TS-2026-009.\n  - An issue where a user could be logged out of Tailscale when\n    changing the tag on a device via CLI has been resolved.\n  - An issue that could cause a crash on 32-bit ARM platforms is\n    resolved.\n    \nUpdate to version 1.98.8:\n\n  - An issue causing connectivity disruptions when the operating\n    system wakes from sleep in wireguard-go is resolved.\n  - An issue causing excessive handshake initiation retries in\n    wireguard-go is resolved.\n  - An issue causing connection leaks in Tailscale SSH Session\n    Recording is resolved.\n\nUpdate to version 1.98.6:\n\n  + ssh/tailssh: reject dangerous LD_/DYLD_ env vars in acceptEnv filtering\n  + go.mod,wgengine/magicsock: pull wireguard-go fix for roaming endpoints\n  + wgengine/magicsock: suppress TSMP disco advert when bestAddr is peer\n  + control/controlknobs,wgengine/magicsock: disable TSMP disco advert if\n    netmap caching is disabled\n\nUpdate to version 1.98.4:\n\n  + An issue causing a deadlock when processing peer changes and disconnecting\n    from the Tailscale control server is resolved\n\nUpdate to version 1.98.3:\n\n  + An issue where netfilter rules could be applied inconsistently after a\n    netfilter mode change failed has been resolved\n\nUpdate to version 1.98.2:\n\n  + Ensure MagicDNS resolves tailnet hostnames after a network change\n\nUpdate to version 1.98.1:\n  \n  + Expired preferred peer addresses are cleared, reducing the time to elect an\n    alternative\n  + IP forwarding for subnet routers and exit nodes is reported as a health check\n  + src_valid_mark sysctl is set in addition to connmark firewall rules to\n    improve reverse path filtering and prevent dropped packets\n\nUpdate to verison 1.96.4:\n\n  * An issue on forks of Linux caused by fallback-on-ENOSYS logic is resolved\n  * An issue that could cause a segmentation violation during startup on MIPS\n    devices is resolved\n\nUpdate to version 1.96.3:\n\n  * DNS resolution issue caused by NRPT rule formatting is resolved\n\nUpdate to version 1.96.2:\n\n  * tailscale dns query|status command supports --json flag to return JSON\n    output\n  * tailscale wait [flags] command waits for Tailscale resources to become\n    available for binding\n  * tailscale ip command supports --assert=\u003cspecific-ip-address\u003e flag to assert\n    that one or more of the node's IP addresses matches the specified IP\n    address\n  * Tailscale Peer Relays advertise addresses discovered via Amazon EC2\n    Instance Metadata Service\n  * tailscaled_peer_relay_endpoints gauge user metrics are available for\n    Tailscale Peer Relays\n  * The AuthKey system policy applies only when a user is not in a logged in\n    state\n  * UPnP routes as expected during long lived port mapping sessions scenarios,\n    including hard NAT\n  * Launch the systray application on startup using autostart file with the\n    tailscale configure systray --enable-startup=freedesktop command\n  * Scaling of Tailscale Peer Relays UDP sockets is gated by container-aware\n    GOMAXPROCS defaults\n  * Firewall rules created on Linux platforms correctly mark their traffic,\n    avoiding reverse path filtering dropping connections and producing health\n    warnings and risk prompts\n\nUpdate to version 1.94.2:\n\n  * Memory leak caused by high network map response rates is resolved\n\nUpdate to version 1.94.1.\n","modified":"2026-10-31T18:00:09.495513101Z","published":"2026-10-29T19:17:37Z","related":["CVE-2026-33747"],"upstream":["CVE-2026-33747"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1260968"},{"type":"REPORT","url":"https://bugzilla.suse.com/1272825"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-33747"}],"affected":[{"package":{"name":"tailscale","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/tailscale&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.104.1-bp160.1.1"}]}],"ecosystem_specific":{"binaries":[{"tailscale-fish-completion":"1.104.1-bp160.1.1","tailscale-zsh-completion":"1.104.1-bp160.1.1","tailscale":"1.104.1-bp160.1.1","tailscale-bash-completion":"1.104.1-bp160.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22203-1.json"}}],"schema_version":"1.9.2"}