# openSUSE Tumbleweed October 2026: kernel 7.3, KDE Plasma 6.8, Qt 6.12, and 91 CVE fixes

> **Key takeaway:** Tumbleweed's 23 October snapshots delivered Linux kernel 7.3.0, KDE Plasma 6.8 with Wayland pointer and HDR improvements, Qt 6.12.0, and patches for 91 kernel CVEs plus critical Firefox and curl security updates.

**Published:** 2026-11-01T08:00:00+00:00 
**Source:** Planet openSUSE 
**Category:** distro-planet 
**Canonical URL:** https://fosswire.org/news/opensuse-tumbleweed-october-2026-kernel-73-kde-plasma-68-qt-.html 

## Summary
openSUSE Tumbleweed published 23 snapshots during October 2026, advancing the rolling distribution through major component updates and an unusually heavy security workload. The Linux kernel progressed from 7.2.9 through 7.2.11 to 7.3.0, carrying 91 CVE fixes across those point releases. Desktop users received KDE Plasma 6.8.0 and 6.8.1 with substantial Wayland session improvements, KDE Frameworks 6.31.0, and Qt 6.12.0 with openSUSE-specific touchpad scrolling patches. Mozilla shipped three Firefox security releases (157.0.1, 158.0, 158.0.1) addressing 87 total vulnerabilities including sandbox escapes and WebGPU privilege escalation bugs.

System infrastructure updates included Mesa 26.2.5, OpenSSH 10.6p1, Git 2.56.0, GnuPG 2.5.24 with RFC 9980 post-quantum cryptography support, and tmux 3.8 with floating pane enhancements. The distribution also stopped recommending YaST for new installations in its default patterns. Security patches extended to curl (two dozen flaws), libsoup (WebSocket heap overflows), and Pillow (28 issues). Late snapshots added sqlite3 3.54.1, harfbuzz 15.0.0, and MariaDB 13.0.2.

## Kernel, desktop, and security changes in Tumbleweed October snapshots
- **Linux kernel 7.2.9 through 7.3.0:** The rolling release advanced through three 7.2 point releases before landing 7.3.0, carrying 91 CVE fixes total across the kernel updates in this monthly cycle.
- **KDE Plasma 6.8 Wayland improvements:** KWin now properly updates pointer focus surfaces, handles implicit pointer grabs on subsurfaces, allows pointer constraints to lock and unlock without extra commits, and renders SVG cursors at device resolution to eliminate scaling blur; the color pipeline adds YCbCr to RGB conversion for more accurate HDR on wide-gamut displays.
- **Qt 6.12.0 with openSUSE patches:** The toolkit major release includes new APIs and platform work, plus distribution-specific patches for touchpad scrolling and md4c build compatibility affecting both Wayland and X11 sessions.
- **Firefox security cascade:** Three releases addressed Mozilla advisories 2026-97 (39 issues), 2026-106 (44 issues), and 2026-111 (4 issues), covering sandbox escapes, WebGPU privilege escalation, use-after-free faults in Widget/XSLT/networking cache, JIT miscompilations, and a cryptographic state bug.
- **Infrastructure and policy shifts:** GnuPG 2.5.24 implements RFC 9980 post-quantum support; tmux 3.8 introduces JSON-based layout strings for floating panes with modal variants, themes, and scrollbars; Tumbleweed patterns no longer recommend YaST for new installations.

## Why it matters
For rolling-release users and system administrators, the density of security fixes—91 kernel CVEs plus extensive browser and library patches—makes this monthly batch unusually critical to deploy promptly, with snapper rollback available as mitigation if regressions appear. The KDE Plasma 6.8 Wayland refinements and Qt 6.12.0 input handling improvements directly benefit Linux desktop adoption, while the removal of YaST as a recommended default signals a gradual installation experience shift for one of the longest-standing Linux distribution toolchains.