CVE-2026-98017

In the Linux kernel, the following vulnerability has been resolved: net/sched: defer qdisc freeing after failed creation An RTM_NEWQDISC request can make clsact bind a populated shared ingress block during ->init(), publishing an embedded mini_Qdisc to lockless readers. If the same request has an invalid TCA_RATE, estimator setup fails after ->init(); the unwind removes the pointer but synchronously frees its containing qdisc while tc_run() may still hold it. Retire failed qdiscs through the same RCU helper as normal destruction. Inline the synchronous free into the callback now that no direct callers remain.

In the Linux kernel, the following vulnerability has been resolved: net/sched: defer qdisc freeing after failed creation An RTM_NEWQDISC request can make clsact bind a populated shared ingress block during ->init(), publishing an embedded mini_Qdisc to lockless readers. If the same request has an invalid TCA_RATE, estimator setup fails after ->init(); the unwind removes the pointer but synchronously frees its containing qdisc while tc_run() may still hold it. Retire failed qdiscs through the same RCU helper as normal destruction. Inline the synchronous free into the callback now that no direct callers remain.

In the Linux kernel, the following vulnerability has been resolved:

net/sched: defer qdisc freeing after failed creation

An RTM_NEWQDISC request can make clsact bind a populated shared ingress block during ->init(), publishing an embedded mini_Qdisc to lockless readers. If the same request has an invalid TCA_RATE, estimator setup fails after ->init(); the unwind removes the pointer but synchronously frees its containing qdisc while tc_run() may still hold it.

Retire failed qdiscs through the same RCU helper as normal destruction. Inline the synchronous free into the callback now that no direct callers remain.

• net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540}
• ocfs2: validate directory-index entry counts when reading metadata {CVE-2026-89492}
• ocfs2: validate dx_root extent list fields during block read {CVE-2026-89492}
• nvme-tcp: reject a read that transferred too few bytes {CVE-2026-89480}
• sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
• sctp: validate embedded INIT chunk and address list lengths in cookie {CVE-2026-53224}
• sctp: fix NULL deref on untransmitted RECONF completion {CVE-2026-89477}
• net/packet: defer vmalloc TX_RING free until skbs finish {CVE-2026-80841}
• netfilter: nf_log: unregister loggers before per-net teardown {CVE-2026-97608}
• netfilter: nf_tables: make nft_object rhltable per table {CVE-2026-74565}
• packet: use consistent hard_header_len in non-ring send paths {CVE-2026-74582}
• net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header {CVE-2026-80731}
• net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
• net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550}
• tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() {CVE-2026-72404}
• net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants {CVE-2026-72390}
• net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF {CVE-2026-72390}
• Drivers: hv: vmbus: use generic driver_override infrastructure {CVE-2026-80676}
• NFSD: Prevent client use-after-free during delegation revoke {CVE-2026-89659}
• sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
• sctp: fix stream->outcnt underflow on duplicate RECONF responses {CVE-2026-89476}
• sctp: distinguish sequence zero from wildcard in reconf lookup {CVE-2026-89476}
• ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}
• net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983}
• net: Introduce skb tc depth field to track packet loops {CVE-2026-63983}
• netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst {CVE-2026-72255}
• sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing {CVE-2026-53246}
• ipv6: mcast: Fix use-after-free when processing MLD queries {CVE-2026-53275}
• scsi: xen: scsiback: Free unsubmitted command instead of double-putting it {CVE-2026-72085}
• ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). {CVE-2026-74289}
• sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
• net/sched: defer qdisc freeing after failed creation {CVE-2026-98017}
• IB/isert: wait for deferred control PDU completions before releasing the connection {CVE-2026-98357}
• RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
• sctp: validate embedded address parameter length {CVE-2026-74287}
• nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget {CVE-2026-89674}
• IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
• drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() {CVE-2026-46209}
• RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() {CVE-2026-46181}
• nvmet-tcp: fix race between ICReq handling and queue teardown {CVE-2026-46135}
• ALSA: aloop: Fix peer runtime UAF during format-change stop {CVE-2026-46090}
• ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}
• drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
• gfs2: Fix use-after-free in iomap inline data write path {CVE-2026-45984}
• bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970}
• Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}
• Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() {CVE-2024-36013}
• mt76: fix use-after-free by removing a non-RCU wcid pointer {CVE-2022-49328}
• mt76: fix per-driver wcid range checks after wcid array size bump {CVE-2022-49328}
• af_unix: Fix UAF read of…

• CVE-2026-99999
  • ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
• CVE-2026-43250
  • usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() {CVE-2026-43250}
• CVE-2026-43281
  • mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() {CVE-2026-43281}
• CVE-2025-38595
  • xen: fix UAF in dmabuf_exp_from_pages() {CVE-2025-38595}
• CVE-2026-89610
  • ntfs: verify run length exceeding volume boundary {CVE-2026-89610}
• CVE-2026-74540
  • Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp {CVE-2026-74540}
• CVE-2023-52935
  • mm/khugepaged: fix ->anon_vma race {CVE-2023-52935}
• CVE-2026-64225
  • octeontx2-af: CGX: add bounds check to cgx_speed_mbps index {CVE-2026-64225}
• CVE-2026-31489
  • spi: meson-spicc: Fix double-put in remove path {CVE-2026-31489}
• CVE-2026-53068
  • drm/komeda: fix integer overflow in AFBC framebuffer size check {CVE-2026-53068}
• CVE-2026-64249
  • fpga: region: fix use-after-free in child_regions_with_firmware() {CVE-2026-64249}
• CVE-2026-64007
  • netfilter: synproxy: refresh tcphdr after skb_ensure_writable {CVE-2026-64007}
• CVE-2026-98320
  • netfilter: flowtable: hold reference on ct until flow is released {CVE-2026-98320}
• CVE-2026-98248
  • arm64: percpu: Fix LSE operations on {8,16}-bit types {CVE-2026-98248}
• CVE-2026-98375
  • xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
• CVE-2026-98312
  • ALSA: 6fire: fix OOB write from device-reported iso length {CVE-2026-98312}
• CVE-2026-98269
  • btrfs: abort transaction on failure to update inode for hole punching and reflinking {CVE-2026-98269}
• CVE-2026-98194
  • wifi: libertas_tf: fix UAF in lbtf_free_adapter() {CVE-2026-98194}
• CVE-2026-98354
  • RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
• CVE-2026-64015
  • security/keys: fix missed RCU read section on lookup {CVE-2026-64015}
• CVE-2026-63800
  • pNFS: Fix use-after-free in pnfs_update_layout() {CVE-2026-63800}
• CVE-2026-98349
  • wifi: libipw: reject too-short beacon and probe responses {CVE-2026-98349}
• CVE-2026-98348
  • wifi: libipw: reject too-short association responses {CVE-2026-98348}
• CVE-2026-98217
  • IB/mlx4: Fix use-after-free on pkey sysfs registration failure {CVE-2026-98217}
• CVE-2026-98196
  • wifi: brcmsmac: fix UAF in brcms_free_timer() {CVE-2026-98196}
• CVE-2026-64002
  • ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() {CVE-2026-64002}
• CVE-2026-52923
  • ipc: limit next_id allocation to the valid ID range {CVE-2026-52923}
• CVE-2026-98276
  • net: lock the socket in sock_gettstamp() {CVE-2026-98276}
• CVE-2026-63967
  • iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer {CVE-2026-63967}
• CVE-2026-63912
  • xfrm: esp: restore combined single-frag length gate {CVE-2026-63912}
• CVE-2026-98193
  • wifi: libipw: reject TKIP frames without a full MIC {CVE-2026-98193}
• CVE-2026-98185
  • wifi: mwifiex: validate scan response extents {CVE-2026-98185}
• CVE-2026-98171
  • smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs {CVE-2026-98171}
• CVE-2026-97540
  • net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540}
• CVE-2026-97608
  • netfilter: nf_log: unregister loggers before per-net teardown {CVE-2026-97608}
• CVE-2026-97908
  • Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev {CVE-2026-97908}
• CVE-2026-93830
  • net: stmmac: xgmac2: disable RBUE in default RX interrupt mask {CVE-2026-93830}
• CVE-2026-93817
  • perf: Fix addr_filter_ranges lifetime {CVE-2026-93817}
• CVE-2026-98017
  • net/sched:…

• ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
• slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
• mm/hugetlb: fix list corruption in allocate_file_region_entries() {CVE-2026-74518}
• mm/page_reporting: use system_freezable_wq to fix UAF during suspend {CVE-2026-74481}
• bpf: Fix UAF in sock clone early bailouts {CVE-2026-68399}
• xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
• net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983}
• net: Introduce skb tc depth field to track packet loops {CVE-2026-63983}
• ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
• netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst {CVE-2026-72255}
• net: thunderbolt: Fix frags[] overflow by bounding frame_count {CVE-2026-72157}
• SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
• rxrpc: serialize kernel accept preallocation with socket teardown {CVE-2026-74436}
• isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
• ata: libata-core: Reject an invalid concurrent positioning ranges count {CVE-2026-72030}
• wifi: mac80211: validate extension-frame layout before RX {CVE-2026-68470}
• wifi: mac80211: pass 'sta' to ieee80211_rx_data_set_sta() {CVE-2026-68470}
• drm/amd/pm: fix pptable use-after-free {CVE-2026-74450}
• smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
• smb: client: clear ce->tgthint in free_tgts() {CVE-2026-89636}
• smb: client: harden DFS cache against invalid target hints {CVE-2026-93210}
• smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
• nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553}
• HID: sony: clean up device list on probe failure {CVE-2026-90041}
• drm/amd/display: Fix dangling pointer in CRTC reset function {CVE-2026-93175}
• hwrng: core - fix rng list on registration error {CVE-2026-93163}
• RDMA/rvt: Return NULL after port allocation failure {CVE-2026-93104}
• fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() {CVE-2026-93100}
• bpf: Fix potential UAF when reading bpf link info {CVE-2026-90392}
• HID: synchronize input before cleaning up a failed probe {CVE-2026-90329}
• bpf: Don't predict JMP32 pointer vs zero comparisons {CVE-2026-98041}
• smb: client: cancel reconnect work in clean_demultiplex_info() {CVE-2026-98175}
• smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs {CVE-2026-98171}
• netfilter: cttimeout: prevent UAF during module unload {CVE-2026-97609}
• thunderbolt: Prevent XDomain delayed work use-after-free on disconnect {CVE-2026-74575}
• NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103}
• Squashfs: check block offset is not negative {CVE-2026-90203}
• RDMA/siw: Fix endpoint/socket association handling {CVE-2026-74345}
• HID: hidpp: fix potential UAF in hidpp_connect_event() {CVE-2026-93826}
• hid: hid-logitech-hidpp: avoid unnecessary assignments in hidpp_connect_event {CVE-2026-93826}
• configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
• ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
• smb: client: reject userspace cifs.idmap descriptions {CVE-2026-97564}
• scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536}
• RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept {CVE-2026-98367}
• ALSA: 6fire: fix OOB write from device-reported iso length {CVE-2026-98312}
• scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf {CVE-2026-63887}
• scsi: target: Fix hexadecimal CHAP_I handling {CVE-2026-63886}
• scsi: target: iscsi: Validate CHAP_R length before base64 decode {CVE-2026-63886}
• wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length {CVE-2026-90382}
• nfsd: RCU-protect cl_cb_session to fix…

• net: skbuff: propagate shared-frag marker in skb_zerocopy()
• net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480}
• net: ipv6: clear suppressed fib6 rule result {CVE-2026-74581}
• net/sched: fix pedit partial COW leading to page cache corruption {CVE-2026-46331}
• ipvs: do not propagate one-packet flag to synced conns {CVE-2026-80714}
• net: skbuff: propagate shared-frag marker through frag-transfer helpers {CVE-2026-43503}
• smb: client: harden POSIX SID length parsing {CVE-2026-64380}
• RDMA: Fix use-after-free in rxe_queue_cleanup {CVE-2021-47616}
• nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
• sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}
• isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
• configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
• netfilter: ipset: fix race between dump and ip_set_list resize {CVE-2026-64189}
• netfilter: conntrack_irc: fix possible out-of-bounds read {CVE-2026-53268}
• ipvs: clear the svc scheduler ptr early on edit {CVE-2026-53270}
• netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920}
• media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893}
• dmaengine: Fix possible use after free {CVE-2026-72476}
• net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring {CVE-2026-64047}
• tipc: prevent snt_unacked underflow on CONN_ACK {CVE-2026-74282}
• xfrm: hold net_device reference under RCU in bundle creation {CVE-2026-98364}
• xfrm: Check for underflow in xfrm_state_mtu {CVE-2026-64009}
• net: mpls: clear inner_protocol when the last label is popped {CVE-2026-97612}
• net: guard timestamp cmsgs to real error queue skbs {CVE-2026-53223}
• thunderbolt: Bound root directory content to block size {CVE-2026-53149}
• SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
• SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
• SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
• SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 {CVE-2026-89537}
• SUNRPC: make sure cache entry active before cache_show {CVE-2024-53174}
• ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940}
• ipv6: sr: restore network header before routing and forwarding {CVE-2026-98096}
• ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
• ipv6: mcast: Fix use-after-free when processing MLD queries {CVE-2026-53275}
• ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922}
• ip6_gre: Use cached t->net in ip6erspan_changelink(). {CVE-2026-46120}
• ipv6: fix possible UAF in icmpv6_rcv() {CVE-2026-53006}
• ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() {CVE-2026-64002}
• Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276}
• ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
• scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() {CVE-2026-46149}
• usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
• USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195}
• mrp: introduce active flags to prevent UAF when applicant uninit {CVE-2022-50697}
• HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature {CVE-2026-89729}
• net/sched: defer qdisc freeing after failed creation {CVE-2026-98017}
• Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp {CVE-2026-53071}
• Bluetooth: L2CAP: Fix invalid access if ECRED Reconfigure fails {CVE-2026-53071}
• scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation {CVE-2026-89856}
• drm: fix race between partial drm_dev_register() failure and ioctl {CVE-2026-89823}
• drm/amd/pm: bound pp_dpm_set_pp_table() memcpy {CVE-2026-97427}
• dm log: fix out-of-bounds write due to region_count overflow {CVE-2026-53059} -…

Upstream kernel 6.18.55 version fixes bugs and vulnerabilities. The kmod-xtables-addons, kmod-virtualbox, kmod-nvidia-current-wopengpu & drakx-installer-images packages have been updated to work with this new kernel.

Vanilla upstream kernel version 6.18.55 fixes vulnerabilities. For information about the vulnerabilities see the links.

These are all security issues fixed in the kernel-devel-7.2.9-1.1 package on the GA media of openSUSE Tumbleweed.

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• Memory management;
• Multiple devices driver;
• ARM64 architecture;
• EROFS file system;
• Networking core;
• eXpress Data Path;
• ARM32 architecture;
• M68K architecture;
• MIPS architecture;
• OpenRISC architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• Intel NPU Driver;
• Speakup Console Speech Driver;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• Micron PCIe SSD driver;
• Null block device driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• AMD CDX bus driver;
• Hardware random number generator core;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DAX dirext access to differentiated memory framework;
• DIBS (Direct Internal Buffer Sharing) drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• FireWire subsystem;
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• Google firmware drivers;
• Qualcomm firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Microsoft Hyper-V drivers;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Mouse) drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• Industry Pack bus drivers;
• IRQ chip drivers;
• Mailbox framework;
• Media drivers;
• MemoryStick subsystem;
• Multifunction device drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• Amazon Nitro Secure Module driver;
• SGI GRU driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• Operating Performance Points (OPP) driver;
• PA-RISC drivers;
• PCI subsystem;
• Performance monitor drivers;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• MediaTek PM domains;
• Power sequencing drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• MPAM driver;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Userspace I/O drivers;
• USB DSL drivers;
• Cypress C67X00 USB…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• Memory management;
• Multiple devices driver;
• ARM64 architecture;
• EROFS file system;
• Networking core;
• eXpress Data Path;
• ARM32 architecture;
• M68K architecture;
• MIPS architecture;
• OpenRISC architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• Intel NPU Driver;
• Speakup Console Speech Driver;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• Micron PCIe SSD driver;
• Null block device driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• AMD CDX bus driver;
• Hardware random number generator core;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DAX dirext access to differentiated memory framework;
• DIBS (Direct Internal Buffer Sharing) drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• FireWire subsystem;
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• Google firmware drivers;
• Qualcomm firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Microsoft Hyper-V drivers;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Mouse) drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• Industry Pack bus drivers;
• IRQ chip drivers;
• Mailbox framework;
• Media drivers;
• MemoryStick subsystem;
• Multifunction device drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• Amazon Nitro Secure Module driver;
• SGI GRU driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• Operating Performance Points (OPP) driver;
• PA-RISC drivers;
• PCI subsystem;
• Performance monitor drivers;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• MediaTek PM domains;
• Power sequencing drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• MPAM driver;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Userspace I/O drivers;
• USB DSL drivers;
• Cypress C67X00 USB…