{"id":"CVE-2023-54285","aliases":["BELL-CVE-2023-54285","DEBIAN-CVE-2023-54285","DLA-4476-1","DSA-6127-1","EUVD-2023-60519","GHSA-wfvh-f2f6-f56w","OESA-2026-2580","ROOT-OS-UBUNTU-2204-CVE-2023-54285","SUSE-SU-2026:0278-1","SUSE-SU-2026:0281-1","SUSE-SU-2026:0293-1","SUSE-SU-2026:0315-1","SUSE-SU-2026:20477-1","SUSE-SU-2026:20498-1","SUSE-SU-2026:20845-1","SUSE-SU-2026:20876-1","UBUNTU-CVE-2023-54285"],"status":"published","title":"iomap: Fix possible overflow condition in iomap_write_delalloc_scan","description":"In the Linux kernel, the following vulnerability has been resolved:\n\niomap: Fix possible overflow condition in iomap_write_delalloc_scan\n\nfolio_next_index() returns an unsigned long value which left shifted\nby PAGE_SHIFT could possibly cause an overflow on 32-bit system. Instead\nuse folio_pos(folio) + folio_size(folio), which does this correctly.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00179,"percentile":0.07547,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2025-12-30T12:23:25Z","modified":"2026-11-06T14:17:23Z","fixes":[{"ecosystem":"Alpaquita:stream","package":"linux-lts","fixed_in":["6.6.58-r0"],"sources":["osv"]},{"ecosystem":"Linux","package":"Kernel","fixed_in":["6.1.162","6.5.5"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"linux","fixed_in":["6.1.162-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["6.5.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["6.5.6-1"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:22.04","package":"linux","fixed_in":["5.15.0-203.213.aikido.119"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:22.04","package":"rootio-linux","fixed_in":["5.15.0-203.213.aikido.119"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:stream","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.112-r0"},{"fixed":"6.6.58-r0"}]}]},{"source":"osv","ecosystem":"Linux","package":"Kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.162"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.5.5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.162-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.119-1","6.1.123-1","6.1.124-1","6.1.128-1","6.1.129-1","6.1.133-1","6.1.135-1","6.1.137-1","6.1.139-1","6.1.140-1","6.1.147-1","6.1.148-1","6.1.153-1","6.1.158-1","6.1.159-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.6-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"linux-6.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.162-1~deb11u1"}]}],"versions":["6.1.106-3~deb11u1","6.1.106-3~deb11u2","6.1.106-3~deb11u3","6.1.112-1~deb11u1","6.1.119-1~deb11u1","6.1.128-1~deb11u1","6.1.129-1~deb11u1","6.1.137-1~deb11u1","6.1.140-1~deb11u1","6.1.147-1~deb11u1","6.1.148-1~deb11u1","6.1.153-1~deb11u1","6.1.158-1~deb11u1","6.1.159-1~deb11u1"],"bundled":252},{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.162-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.119-1","6.1.123-1","6.1.124-1","6.1.128-1","6.1.129-1","6.1.133-1","6.1.135-1","6.1.137-1","6.1.139-1","6.1.140-1","6.1.147-1","6.1.148-1","6.1.153-1","6.1.158-1","6.1.159-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"bundled":252},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-317.0.0.220.oe2203sp4"}]}],"bundled":59},{"source":"osv","ecosystem":"Root:Ubuntu:22.04","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-203.213.aikido.119"}]}]},{"source":"osv","ecosystem":"Root:Ubuntu:22.04","package":"rootio-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-203.213.aikido.119"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-livepatch-SLE15-SP7-RT_Update_8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150700.1.3.1"}]}],"bundled":395},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.28.1"}]}],"bundled":395},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.28.1"}]}],"bundled":395},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-syms-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.28.1"}]}],"bundled":395},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.20.24.1"}]}],"bundled":395},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"kernel-source-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.20.24.1"}]}],"bundled":395},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"kernel-syms-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.20.24.1"}]}],"bundled":395},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.84.1"}]}],"bundled":334},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6","package":"kernel-livepatch-SLE15-SP6_Update_19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150600.13.3.1"}]}],"bundled":334},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.84.1"}]}],"bundled":334},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.84.1"}]}],"bundled":334},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.84.1"}]}],"bundled":334},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.84.1.150600.12.38.1"}]}],"bundled":334},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.84.1"}]}],"bundled":334},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.84.1"}]}],"bundled":334},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.84.1"}]}],"bundled":334},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.84.1"}]}],"bundled":334},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.84.1"}]}],"bundled":334},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.84.1"}]}],"bundled":334},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.84.1.150600.12.38.1"}]}],"bundled":334},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.84.1"}]}],"bundled":334},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.84.1"}]}],"bundled":334},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.84.1"}]}],"bundled":334},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.84.1"}]}],"bundled":334},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"dtb-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.84.1"}]}],"bundled":334},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.84.1"}]}],"bundled":334},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.84.1"}]}],"bundled":334},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.84.1"}]}],"bundled":334},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.84.1.150600.12.38.1"}]}],"bundled":334},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.84.1"}]}],"bundled":334},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.84.1"}]}],"bundled":334},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.84.1"}]}],"bundled":334},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.84.1"}]}],"bundled":334},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.84.1"}]}],"bundled":334},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.84.1"}]}],"bundled":334},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.84.1"}]}],"bundled":334},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.28.1"}]}],"bundled":395},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.28.1"}]}],"bundled":395},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.28.1.150700.17.19.1"}]}],"bundled":395},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.28.1"}]}],"bundled":395},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.28.1"}]}],"bundled":395},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.28.1"}]}],"bundled":395},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.28.1"}]}],"bundled":395},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.28.1"}]}],"bundled":395},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.28.1"}]}],"bundled":395},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.28.1"}]}],"bundled":395},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.28.1"}]}],"bundled":395},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-livepatch-SLE15-SP7_Update_8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150700.15.3.1"}]}],"bundled":395},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.28.1"}]}],"bundled":395},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.28.1"}]}],"bundled":395},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-39.1"}]}],"bundled":524},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-39.1.21.16"}]}],"bundled":524},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-39.1"}]}],"bundled":524},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-39.1"}]}],"bundled":524},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-39.1"}]}],"bundled":524},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-39.1.21.16"}]}],"bundled":524},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-39.1"}]}],"bundled":524},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-39.1"}]}],"bundled":524},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-40.1"}]}],"bundled":655},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-40.1"}]}],"bundled":655},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-40.1"}]}],"bundled":655},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-40.1"}]}],"bundled":655},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.0-28.30~16.04.1","4.8.0-30.32~16.04.1","4.8.0-32.34~16.04.1","4.8.0-34.36~16.04.1","4.10.0-14.16~16.04.1","4.10.0-19.21~16.04.1","4.10.0-20.22~16.04.1","4.10.0-21.23~16.04.1","4.10.0-22.24~16.04.1","4.10.0-24.28~16.04.1","4.10.0-26.30~16.04.1","4.11.0-13.19~16.04.1","4.11.0-14.20~16.04.1","4.13.0-16.19~16.04.3","4.13.0-17.20~16.04.1","4.13.0-19.22~16.04.1","4.13.0-21.24~16.04.1","4.13.0-25.29~16.04.2","4.15.0-13.14~16.04.1","4.15.0-15.16~16.04.1","4.15.0-20.21~16.04.1","4.15.0-22.24~16.04.1","4.15.0-23.25~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1021.24~18.04.1","5.0.0-1022.25~18.04.1","5.0.0-1023.26~18.04.1","5.0.0-1024.27~18.04.1","5.0.0-1025.28","5.0.0-1027.30"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1019.21~18.04.1","5.3.0-1023.25~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.2","5.3.0-1033.35","5.3.0-1034.36","5.3.0-1035.37"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1012.12","4.15.0-1013.13","4.15.0-1014.14","4.15.0-1018.18","4.15.0-1019.19","4.15.0-1021.21","4.15.0-1022.23","4.15.0-1023.24","4.15.0-1025.26","4.15.0-1028.29","4.15.0-1030.31","4.15.0-1031.32","4.15.0-1032.33","4.15.0-1035.36","4.15.0-1036.38","4.15.0-1037.39","4.18.0-1011.11~18.04.1","4.18.0-1013.13~18.04.1","4.18.0-1014.14~18.04.1","4.18.0-1018.18~18.04.1","4.18.0-1019.19~18.04.1","4.18.0-1020.20~18.04.1","4.18.0-1023.24~18.04.1","4.18.0-1024.25~18.04.1","4.18.0-1025.27~18.04.1","5.0.0-1014.14~18.04.1","5.0.0-1016.17~18.04.1","5.0.0-1018.19~18.04.1","5.0.0-1020.21~18.04.1","5.0.0-1022.23~18.04.1","5.0.0-1023.24~18.04.1","5.0.0-1025.27~18.04.1","5.0.0-1027.29~18.04.1","5.0.0-1028.30~18.04.1","5.0.0-1029.31~18.04.1","5.0.0-1031.33","5.0.0-1032.34","5.0.0-1035.37","5.0.0-1036.38"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8~18.04.1","5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1019.20~18.04.1","5.3.0-1020.21~18.04.1","5.3.0-1022.23~18.04.1","5.3.0-1028.29~18.04.1","5.3.0-1031.32~18.04.1","5.3.0-1032.33~18.04.1","5.3.0-1034.35~18.04.1","5.3.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-1006.6~18.04.1","4.18.0-1007.7~18.04.1","4.18.0-1008.8~18.04.1","5.0.0-1012.12~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1014.14","4.15.0-1015.15","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1019.20","4.15.0-1021.22","4.15.0-1023.24","4.15.0-1024.25","4.15.0-1025.26","4.15.0-1026.27","4.15.0-1027.28","4.15.0-1028.29","4.15.0-1029.31","4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1042.45","4.15.0-1044.70","5.0.0-1020.20~18.04.1","5.0.0-1021.21~18.04.1","5.0.0-1025.26~18.04.1","5.0.0-1026.27~18.04.1","5.0.0-1028.29~18.04.1","5.0.0-1029.30~18.04.1","5.0.0-1031.32","5.0.0-1033.34","5.0.0-1034.35"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1020.22~18.04.1","5.3.0-1026.28~18.04.1","5.3.0-1029.31~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-4.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1041.43","4.15.0-1042.44","4.15.0-1044.46","4.15.0-1045.48","4.15.0-1046.49","4.15.0-1048.51","4.15.0-1049.52","4.15.0-1050.53","4.15.0-1052.55","4.15.0-1055.58","4.15.0-1057.60","4.15.0-1058.61","4.15.0-1059.62","4.15.0-1063.66","4.15.0-1064.67","4.15.0-1066.69","4.15.0-1067.70","4.15.0-1069.72","4.15.0-1070.73","4.15.0-1072.76","4.15.0-1073.78","4.15.0-1074.79","4.15.0-1076.81","4.15.0-1077.82","4.15.0-1078.83","4.15.0-1079.84"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1025.25~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.31~18.04.1","5.4.0-1030.32~18.04.1","5.4.0-1032.34~18.04.1","5.4.0-1033.35~18.04.1","5.4.0-1035.37~18.04.1","5.4.0-1036.38~18.04.1","5.4.0-1037.39~18.04.1","5.4.0-1039.41~18.04.1","5.4.0-1040.42~18.04.1","5.4.0-1042.44~18.04.1","5.4.0-1043.45~18.04.1","5.4.0-1044.46~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1","5.4.0-1052.55~18.04.1","5.4.0-1053.56~18.04.1","5.4.0-1054.57~18.04.1","5.4.0-1055.58~18.04.1","5.4.0-1056.59~18.04.1","5.4.0-1057.60~18.04.1","5.4.0-1059.62~18.04.1","5.4.0-1061.64~18.04.1","5.4.0-1062.65~18.04.1","5.4.0-1063.66~18.04.1","5.4.0-1065.68~18.04.1","5.4.0-1066.69~18.04.1","5.4.0-1067.70~18.04.1","5.4.0-1068.71~18.04.1","5.4.0-1071.76~18.04.3","5.4.0-1072.77~18.04.1","5.4.0-1074.79~18.04.1","5.4.0-1076.82~18.04.1","5.4.0-1078.84~18.04.1","5.4.0-1080.86~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gkeop-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1001.1","5.4.0-1003.3","5.4.0-1004.5","5.4.0-1005.6","5.4.0-1007.8~18.04.1","5.4.0-1008.9~18.04.1","5.4.0-1009.10~18.04.1","5.4.0-1010.11~18.04.1","5.4.0-1011.12~18.04.2","5.4.0-1012.13~18.04.1","5.4.0-1013.14~18.04.1","5.4.0-1014.15~18.04.1","5.4.0-1015.16~18.04.1","5.4.0-1016.17~18.04.1","5.4.0-1018.19~18.04.1","5.4.0-1021.22~18.04.1","5.4.0-1022.23~18.04.1","5.4.0-1023.24~18.04.1","5.4.0-1024.25~18.04.1","5.4.0-1025.26~18.04.1","5.4.0-1026.27~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.30~18.04.2","5.4.0-1031.32~18.04.1","5.4.0-1032.33~18.04.1","5.4.0-1033.34~18.04.1","5.4.0-1034.35~18.04.1","5.4.0-1036.37~18.04.1","5.4.0-1037.38~18.04.1","5.4.0-1038.39~18.04.1","5.4.0-1039.40~18.04.1","5.4.0-1040.41~18.04.1","5.4.0-1043.44~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1048.51~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-13.14~18.04.1","4.18.0-14.15~18.04.1","4.18.0-15.16~18.04.1","4.18.0-16.17~18.04.1","4.18.0-17.18~18.04.1","4.18.0-18.19~18.04.1","4.18.0-20.21~18.04.1","4.18.0-21.22~18.04.1","4.18.0-22.23~18.04.1","4.18.0-24.25~18.04.1","4.18.0-25.26~18.04.1","5.0.0-23.24~18.04.1","5.0.0-25.26~18.04.1","5.0.0-27.28~18.04.1","5.0.0-29.31~18.04.1","5.0.0-31.33~18.04.1","5.0.0-32.34~18.04.2","5.0.0-35.38~18.04.1","5.0.0-36.39~18.04.1","5.0.0-37.40~18.04.1","5.3.0-26.28~18.04.1","5.3.0-28.30~18.04.1","5.3.0-40.32~18.04.1","5.3.0-42.34~18.04.1","5.3.0-45.37~18.04.1","5.3.0-46.38~18.04.1","5.3.0-51.44~18.04.2","5.3.0-53.47~18.04.1","5.3.0-59.53~18.04.1","5.3.0-61.55~18.04.1","5.3.0-62.56~18.04.1","5.3.0-64.58~18.04.1","5.3.0-65.59","5.3.0-66.60","5.3.0-67.61","5.3.0-68.63","5.3.0-69.65","5.3.0-70.66","5.3.0-72.68","5.3.0-73.69","5.3.0-74.70","5.3.0-75.71","5.3.0-76.72"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-15.16~18.04.1","5.0.0-16.17~18.04.1","5.0.0-17.18~18.04.1","5.0.0-19.20~18.04.1","5.0.0-20.21~18.04.1","5.3.0-19.20~18.04.2","5.3.0-22.24~18.04.1","5.3.0-23.25~18.04.1","5.3.0-23.25~18.04.2","5.3.0-24.26~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.3","4.15.0-1004.5","4.15.0-1006.9","4.15.0-1008.11","4.15.0-1009.12","4.15.0-1012.15","4.15.0-1013.16","4.15.0-1015.18","4.15.0-1017.20","4.15.0-1018.21","4.15.0-1021.24","4.15.0-1024.29","4.15.0-1026.31","4.15.0-1028.33","4.15.0-1030.35","4.15.0-1033.38","4.15.0-1034.39","4.15.0-1035.40","4.15.0-1036.41","4.15.0-1038.43","4.15.0-1039.44","4.15.0-1043.48","4.15.0-1045.50","4.15.0-1050.57","4.15.0-1056.65","4.15.0-1057.66","4.15.0-1059.68","4.15.0-1063.72","4.15.0-1064.73","4.15.0-1065.75","4.15.0-1066.76","4.15.0-1067.77","4.15.0-1069.79","4.15.0-1073.83","4.15.0-1076.86","4.15.0-1079.89","4.15.0-1080.90","4.15.0-1081.91","4.15.0-1087.97","4.15.0-1090.100","4.15.0-1091.101","4.15.0-1093.103","4.15.0-1094.104","4.15.0-1096.106","4.15.0-1097.107","4.15.0-1099.109","4.15.0-1100.110","4.15.0-1101.112","4.15.0-1102.113","4.15.0-1103.114"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1007.12~18.04.1","5.0.0-1008.13~18.04.1","5.0.0-1009.14~18.04.1","5.0.0-1010.15~18.04.1","5.0.0-1011.16","5.0.0-1013.18","5.0.0-1014.19"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1011.12~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.18~18.04.1","5.3.0-1018.20~18.04.1","5.3.0-1024.26~18.04.1","5.3.0-1027.29~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.9~20.04.2","5.11.0-1014.15~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.2","5.11.0-1021.22~20.04.2","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.2","5.13.0-1011.12~20.04.1","5.13.0-1012.13~20.04.1","5.13.0-1014.15~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1019.21~20.04.1","5.13.0-1021.23~20.04.2","5.13.0-1022.24~20.04.1","5.13.0-1023.25~20.04.1","5.13.0-1025.27~20.04.1","5.13.0-1028.31~20.04.1","5.13.0-1029.32~20.04.1","5.13.0-1031.35~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1041.43~20.04.1","5.8.0-1042.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1007.7~20.04.2","5.11.0-1012.13~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10~20.04.2","5.13.0-1012.14~20.04.1","5.13.0-1013.15~20.04.1","5.13.0-1014.16~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1021.24~20.04.1","5.13.0-1022.26~20.04.1","5.13.0-1023.27~20.04.1","5.13.0-1025.29~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1029.34~20.04.1","5.13.0-1031.37~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1033.35~20.04.1","5.8.0-1036.38~20.04.1","5.8.0-1039.42~20.04.1","5.8.0-1040.43~20.04.1","5.8.0-1041.44~20.04.1","5.8.0-1042.45~20.04.1","5.8.0-1043.46~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1063.66+cvm2.2","5.4.0-1063.66+cvm3.2","5.4.0-1064.67+cvm1.1","5.4.0-1065.68+cvm2.1","5.4.0-1067.70+cvm1.1","5.4.0-1068.71+cvm1.1","5.4.0-1069.72+cvm1.1","5.4.0-1070.73+cvm1.1","5.4.0-1072.75+cvm1.1","5.4.0-1073.76+cvm1.1","5.4.0-1074.77+cvm1.1","5.4.0-1076.79+cvm1.1","5.4.0-1078.81+cvm1.1","5.4.0-1080.83+cvm1.1","5.4.0-1083.87+cvm1.1","5.4.0-1085.90+cvm1.1","5.4.0-1085.90+cvm2.1","5.4.0-1086.91+cvm1.1","5.4.0-1089.94+cvm1.2","5.4.0-1090.95+cvm1.1","5.4.0-1091.96+cvm1.1","5.4.0-1092.97+cvm1.1","5.4.0-1095.101+cvm1.1","5.4.0-1098.104+cvm1.1","5.4.0-1100.106+cvm1.1","5.4.0-1103.109+cvm1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.10~20.04.1","5.11.0-1014.16~20.04.1","5.11.0-1017.19~20.04.1","5.11.0-1018.20~20.04.2","5.11.0-1020.22~20.04.1","5.11.0-1021.23~20.04.1","5.11.0-1022.24~20.04.1","5.11.0-1023.25~20.04.1","5.11.0-1024.26~20.04.1","5.11.0-1026.29~20.04.1","5.11.0-1028.32~20.04.1","5.11.0-1029.33~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.3","5.13.0-1012.15~20.04.1","5.13.0-1013.16~20.04.1","5.13.0-1015.18~20.04.1","5.13.0-1019.23~20.04.1","5.13.0-1021.25~20.04.1","5.13.0-1023.28~20.04.1","5.13.0-1024.29~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1030.36~20.04.1","5.13.0-1031.37~20.04.1","5.13.0-1033.40~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1032.34~20.04.1","5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1039.41"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1033.35","5.4.0-1035.37","5.4.0-1036.38","5.4.0-1037.39","5.4.0-1039.41","5.4.0-1041.43","5.4.0-1042.44","5.4.0-1043.45","5.4.0-1044.46","5.4.0-1046.48","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1074.79","5.4.0-1076.82","5.4.0-1078.84","5.4.0-1080.86","5.4.0-1081.87","5.4.0-1083.89","5.4.0-1084.90","5.4.0-1086.93","5.4.0-1087.94","5.4.0-1090.97","5.4.0-1091.98","5.4.0-1094.101","5.4.0-1095.102","5.4.0-1096.103","5.4.0-1097.104","5.4.0-1098.105","5.4.0-1099.106","5.4.0-1100.107","5.4.0-1101.108","5.4.0-1102.109","5.4.0-1103.110","5.4.0-1104.111","5.4.0-1105.112"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1011.14~20.04.1","5.15.0-1014.17~20.04.1","5.15.0-1015.18~20.04.1","5.15.0-1016.19~20.04.1","5.15.0-1019.23~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1023.28~20.04.2","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1029.34~20.04.1","5.15.0-1031.36~20.04.1","5.15.0-1032.37~20.04.1","5.15.0-1033.38~20.04.1","5.15.0-1034.39~20.04.1","5.15.0-1036.41~20.04.1","5.15.0-1037.42~20.04.1","5.15.0-1038.43~20.04.1","5.15.0-1039.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1008.9","5.4.0-1009.10","5.4.0-1010.11","5.4.0-1011.12","5.4.0-1012.13","5.4.0-1013.14","5.4.0-1014.15","5.4.0-1015.16","5.4.0-1016.17","5.4.0-1018.19","5.4.0-1021.22","5.4.0-1022.23","5.4.0-1023.24","5.4.0-1024.25","5.4.0-1025.26","5.4.0-1026.27","5.4.0-1027.28","5.4.0-1029.30","5.4.0-1031.32","5.4.0-1032.33","5.4.0-1033.34","5.4.0-1034.35","5.4.0-1036.37","5.4.0-1037.38","5.4.0-1038.39","5.4.0-1039.40","5.4.0-1040.41","5.4.0-1043.44","5.4.0-1046.48","5.4.0-1048.51","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1056.60","5.4.0-1057.61","5.4.0-1060.64","5.4.0-1061.65","5.4.0-1062.66","5.4.0-1064.68","5.4.0-1065.69","5.4.0-1066.70","5.4.0-1067.71","5.4.0-1068.72","5.4.0-1069.73","5.4.0-1070.74","5.4.0-1071.75","5.4.0-1072.76","5.4.0-1073.77","5.4.0-1074.78","5.4.0-1075.79","5.4.0-1076.80","5.4.0-1077.81","5.4.0-1078.82","5.4.0-1079.83","5.4.0-1080.84","5.4.0-1081.85","5.4.0-1083.87","5.4.0-1084.88","5.4.0-1085.89","5.4.0-1086.90","5.4.0-1087.91","5.4.0-1088.92","5.4.0-1089.93","5.4.0-1090.94","5.4.0-1091.95","5.4.0-1092.96","5.4.0-1093.97","5.4.0-1094.98","5.4.0-1095.99","5.4.0-1096.100","5.4.0-1097.101","5.4.0-1098.102","5.4.0-1099.103","5.4.0-1100.104","5.4.0-1101.105","5.4.0-1102.106"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1003.5~20.04.2","5.15.0-1005.7~20.04.1","5.15.0-1007.10~20.04.1","5.15.0-1008.12~20.04.1","5.15.0-1011.15~20.04.2","5.15.0-1012.16~20.04.1","5.15.0-1013.17~20.04.1","5.15.0-1015.19~20.04.1","5.15.0-1016.21~20.04.1","5.15.0-1017.22~20.04.1","5.15.0-1018.23~20.04.1","5.15.0-1019.24~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1021.26~20.04.1","5.15.0-1022.27~20.04.1","5.15.0-1023.28~20.04.1","5.15.0-1024.29~20.04.1","5.15.0-1025.30~20.04.1","5.15.0-1026.31~20.04.1","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1030.35~20.04.1","5.15.0-1031.37~20.04.1","5.15.0-1032.38~20.04.1","5.15.0-1033.39~20.04.1","5.15.0-1034.40~20.04.1","5.15.0-1035.41~20.04.1","5.15.0-1036.42~20.04.1","5.15.0-1037.43~20.04.1","5.15.0-1038.44~20.04.1","5.15.0-1039.45~20.04.1","5.15.0-1040.46~20.04.1","5.15.0-1043.50~20.04.1","5.15.0-1044.51~20.04.1","5.15.0-1045.52~20.04.1","5.15.0-1046.53~20.04.1","5.15.0-1047.54~20.04.1","5.15.0-1048.55~20.04.1","5.15.0-1049.56~20.04.1","5.15.0-1050.57~20.04.1","5.15.0-1051.58~20.04.1","5.15.0-1052.59~20.04.1","5.15.0-1053.60~20.04.1","5.15.0-1054.61~20.04.1","5.15.0-1055.62~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-22.23~20.04.1","5.11.0-25.27~20.04.1","5.11.0-27.29~20.04.1","5.11.0-34.36~20.04.1","5.11.0-36.40~20.04.1","5.11.0-37.41~20.04.2","5.11.0-38.42~20.04.1","5.11.0-40.44~20.04.2","5.11.0-41.45~20.04.1","5.11.0-43.47~20.04.2","5.11.0-44.48~20.04.2","5.11.0-46.51~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-21.21~20.04.1","5.13.0-22.22~20.04.1","5.13.0-23.23~20.04.2","5.13.0-25.26~20.04.1","5.13.0-27.29~20.04.1","5.13.0-28.31~20.04.1","5.13.0-30.33~20.04.1","5.13.0-35.40~20.04.1","5.13.0-37.42~20.04.1","5.13.0-39.44~20.04.1","5.13.0-40.45~20.04.1","5.13.0-41.46~20.04.1","5.13.0-44.49~20.04.1","5.13.0-48.54~20.04.1","5.13.0-51.58~20.04.1","5.13.0-52.59~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-23.24~20.04.1","5.8.0-25.26~20.04.1","5.8.0-28.30~20.04.1","5.8.0-29.31~20.04.1","5.8.0-31.33~20.04.1","5.8.0-33.36~20.04.1","5.8.0-34.37~20.04.2","5.8.0-36.40~20.04.1","5.8.0-38.43~20.04.1","5.8.0-40.45~20.04.1","5.8.0-41.46~20.04.1","5.8.0-43.49~20.04.1","5.8.0-44.50~20.04.1","5.8.0-45.51~20.04.1","5.8.0-48.54~20.04.1","5.8.0-49.55~20.04.1","5.8.0-50.56~20.04.1","5.8.0-53.60~20.04.1","5.8.0-55.62~20.04.1","5.8.0-59.66~20.04.1","5.8.0-63.71~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-intel-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1007.7","5.13.0-1008.8","5.13.0-1009.9","5.13.0-1010.10","5.13.0-1011.11","5.13.0-1014.15","5.13.0-1017.19"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.0-1008.9","5.10.0-1011.12","5.10.0-1013.14","5.10.0-1014.15","5.10.0-1016.17","5.10.0-1017.18","5.10.0-1019.20","5.10.0-1021.22","5.10.0-1022.23","5.10.0-1023.24","5.10.0-1025.26","5.10.0-1026.27","5.10.0-1029.30","5.10.0-1032.33","5.10.0-1033.34","5.10.0-1034.35","5.10.0-1038.40","5.10.0-1044.46","5.10.0-1045.47","5.10.0-1049.51","5.10.0-1050.52","5.10.0-1051.53","5.10.0-1052.54","5.10.0-1053.55","5.10.0-1055.58","5.10.0-1057.61"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10","5.13.0-1010.11","5.13.0-1012.16","5.13.0-1014.18","5.13.0-1017.21","5.13.0-1019.23","5.13.0-1020.24","5.13.0-1021.25","5.13.0-1022.26","5.13.0-1026.32","5.13.0-1028.35","5.13.0-1029.36"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.14.0-1004.4","5.14.0-1005.5","5.14.0-1007.7","5.14.0-1008.8","5.14.0-1010.10","5.14.0-1011.11","5.14.0-1013.13","5.14.0-1018.19","5.14.0-1020.22","5.14.0-1022.24","5.14.0-1024.26","5.14.0-1027.30","5.14.0-1029.32","5.14.0-1031.34","5.14.0-1032.35","5.14.0-1033.36","5.14.0-1034.37","5.14.0-1036.40","5.14.0-1038.42","5.14.0-1042.47","5.14.0-1044.49","5.14.0-1045.51","5.14.0-1046.53","5.14.0-1047.54","5.14.0-1048.55","5.14.0-1049.56","5.14.0-1050.57","5.14.0-1051.58","5.14.0-1052.59","5.14.0-1054.61","5.14.0-1055.62","5.14.0-1056.63","5.14.0-1057.64","5.14.0-1058.66","5.14.0-1059.67"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.0-1007.7","5.6.0-1008.8","5.6.0-1010.10","5.6.0-1011.11","5.6.0-1013.13","5.6.0-1017.17","5.6.0-1018.18","5.6.0-1020.20","5.6.0-1021.21","5.6.0-1023.23","5.6.0-1026.26","5.6.0-1027.27","5.6.0-1028.28","5.6.0-1031.32","5.6.0-1032.33","5.6.0-1033.35","5.6.0-1034.36","5.6.0-1035.37","5.6.0-1036.39","5.6.0-1039.43","5.6.0-1042.46","5.6.0-1047.51","5.6.0-1048.52","5.6.0-1050.54","5.6.0-1052.56","5.6.0-1053.57","5.6.0-1054.58","5.6.0-1055.59","5.6.0-1056.60"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1008.8~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1011.13~20.04.2","5.13.0-1015.19~20.04.1","5.13.0-1016.20~20.04.1","5.13.0-1018.22~20.04.1","5.13.0-1021.26~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1030.35~20.04.1","5.13.0-1033.39~20.04.1","5.13.0-1034.40~20.04.1","5.13.0-1036.43~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1031.32~20.04.2","5.8.0-1033.34~20.04.1","5.8.0-1034.35~20.04.2","5.8.0-1037.38~20.04.1","5.8.0-1038.39~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8","5.3.0-1014.16","5.3.0-1015.17","5.3.0-1017.19","5.4.0-1004.4","5.4.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-24.28","5.4.0-26.30","5.4.0-27.31","5.4.0-28.32","5.4.0-30.34","5.4.0-31.35","5.4.0-33.37","5.4.0-34.38","5.4.0-36.41","5.4.0-37.42","5.4.0-39.44","5.4.0-40.45"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1018.19~20.04.2","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1024.25~20.04.1","5.11.0-1026.28~20.04.1","5.11.0-1028.31~20.04.1","5.11.0-1029.32~20.04.1","5.11.0-1030.34","5.11.0-1031.35"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14.16~20.04.1","5.8.0-14.16~20.04.3","5.8.0-16.18~20.04.1","5.8.0-17.19~20.04.1","5.8.0-18.20~20.04.1","5.8.0-20.22~20.04.1","5.8.0-22.24~20.04.1","5.8.0-25.27~20.04.1","5.8.0-26.28~20.04.1","5.8.0-29.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-allwinner-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1007.7~22.04.1","5.19.0-1009.9~22.04.1","5.19.0-1010.10~22.04.1","5.19.0-1011.11~22.04.1","5.19.0-1012.12~22.04.1","5.19.0-1013.13~22.04.1","5.19.0-1014.14~22.04.1","5.19.0-1015.15~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1019.20~22.04.1","5.19.0-1020.21~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1026.27~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1029.30~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1008.8~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1012.12~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.2","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1022.22~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.21~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1025.28~22.04.1","5.19.0-1026.29~22.04.1","5.19.0-1027.30~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1","6.2.0-1019.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.7~22.04.1","6.5.0-1009.9~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.19~22.04.2","6.5.0-1019.20~22.04.1","6.5.0-1021.22~22.04.1","6.5.0-1022.23~22.04.1","6.5.0-1023.24~22.04.1","6.5.0-1024.25~22.04.1","6.5.0-1025.26~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1025.28~22.04.1.1","5.19.0-1026.29~22.04.1.1","5.19.0-1027.30~22.04.2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1.1","6.2.0-1009.9~22.04.3.1","6.2.0-1011.11~22.04.1.1","6.2.0-1012.12~22.04.1.1","6.2.0-1014.14~22.04.1.1","6.2.0-1015.15~22.04.1.1","6.2.0-1016.16~22.04.1.1","6.2.0-1017.17~22.04.1.1","6.2.0-1018.18~22.04.1.1","6.2.0-1019.19~22.04.1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.22~22.04.2","5.19.0-1021.23~22.04.1","5.19.0-1022.24~22.04.1","5.19.0-1024.26~22.04.1","5.19.0-1025.27~22.04.1","5.19.0-1026.28~22.04.1","5.19.0-1027.29~22.04.1","5.19.0-1030.32~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1011.11~22.04.3","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1016.18~22.04.1","6.2.0-1017.19~22.04.1","6.2.0-1018.20~22.04.1","6.2.0-1019.21~22.04.1","6.2.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1010.10~22.04.3","6.5.0-1011.11~22.04.1","6.5.0-1013.13~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1022.24~22.04.1","6.5.0-1023.25~22.04.1","6.5.0-1024.26~22.04.1","6.5.0-1025.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-28.29~22.04.1","5.19.0-32.33~22.04.1","5.19.0-35.36~22.04.1","5.19.0-38.39~22.04.1","5.19.0-40.41~22.04.1","5.19.0-41.42~22.04.1","5.19.0-42.43~22.04.1","5.19.0-43.44~22.04.1","5.19.0-45.46~22.04.1","5.19.0-46.47~22.04.1","5.19.0-50.50"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-25.25~22.04.2","6.2.0-26.26~22.04.1","6.2.0-31.31~22.04.1","6.2.0-32.32~22.04.1","6.2.0-33.33~22.04.1","6.2.0-34.34~22.04.1","6.2.0-35.35~22.04.1","6.2.0-36.37~22.04.1","6.2.0-37.38~22.04.1","6.2.0-39.40~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14~22.04.1","6.5.0-15.15~22.04.1","6.5.0-17.17~22.04.1","6.5.0-18.18~22.04.1","6.5.0-21.21~22.04.1","6.5.0-25.25~22.04.1","6.5.0-26.26~22.04.1","6.5.0-27.28~22.04.1","6.5.0-28.29~22.04.1","6.5.0-35.35~22.04.1","6.5.0-41.41~22.04.2","6.5.0-44.44~22.04.1","6.5.0-45.45~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-intel-iot-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1073.75"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1030.30"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14.1~22.04.1","6.5.0-15.15.1.1~22.04.1","6.5.0-17.17.1.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-41.41.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-44.44.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1003.3~22.04.1","6.2.0-1009.9","6.2.0-1010.10","6.2.0-1011.11","6.2.0-1012.12","6.2.0-1013.13","6.2.0-1015.15"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1004.4","6.5.0-1007.7","6.5.0-1013.13","6.5.0-1014.14","6.5.0-1015.15","6.5.0-1018.18","6.5.0-1019.19","6.5.0-1021.22","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-5.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.17.0-1003.3","5.17.0-1004.4","5.17.0-1006.6","5.17.0-1011.12","5.17.0-1012.13","5.17.0-1013.14","5.17.0-1014.15","5.17.0-1015.16","5.17.0-1016.17","5.17.0-1017.18","5.17.0-1018.19","5.17.0-1019.20","5.17.0-1020.21","5.17.0-1021.22","5.17.0-1024.25","5.17.0-1025.26","5.17.0-1026.27","5.17.0-1027.28","5.17.0-1028.29","5.17.0-1029.30","5.17.0-1030.31","5.17.0-1031.32","5.17.0-1032.33","5.17.0-1033.34","5.17.0-1034.35","5.17.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.0-1006.6","6.0.0-1007.7","6.0.0-1008.8","6.0.0-1009.9","6.0.0-1010.10","6.0.0-1011.11","6.0.0-1012.12","6.0.0-1013.13","6.0.0-1014.14","6.0.0-1015.15","6.0.0-1016.16","6.0.0-1017.17","6.0.0-1018.18","6.0.0-1019.19","6.0.0-1020.20","6.0.0-1021.21"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.0-1004.4","6.1.0-1006.6","6.1.0-1007.7","6.1.0-1008.8","6.1.0-1009.9","6.1.0-1010.10","6.1.0-1012.12","6.1.0-1013.13","6.1.0-1014.14","6.1.0-1015.15","6.1.0-1016.16","6.1.0-1017.17","6.1.0-1019.19","6.1.0-1020.20","6.1.0-1021.21","6.1.0-1022.22","6.1.0-1023.23","6.1.0-1024.24","6.1.0-1025.25","6.1.0-1026.26","6.1.0-1027.27","6.1.0-1028.28","6.1.0-1029.29","6.1.0-1033.33","6.1.0-1034.34","6.1.0-1035.35","6.1.0-1036.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1003.3","6.5.0-1004.4","6.5.0-1006.6","6.5.0-1007.7","6.5.0-1008.8","6.5.0-1009.10","6.5.0-1011.12","6.5.0-1013.14","6.5.0-1014.15","6.5.0-1015.16","6.5.0-1016.17","6.5.0-1018.19","6.5.0-1019.20","6.5.0-1020.21","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25","6.5.0-1025.26","6.5.0-1027.28"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1013.13~22.04.4","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1019.19~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1","6.5.0-1025.25~22.04.1","6.5.0-1026.26~22.04.1","6.5.0-1027.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1032.35"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1011.12","5.15.0-1012.13","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1016.18","5.15.0-1017.19","5.15.0-1018.21","5.15.0-1019.22","5.15.0-1020.23","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1012.13~22.04.1","5.19.0-1015.16~22.04.1","5.19.0-1016.17~22.04.1","5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1","5.19.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-17.17.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-40.40.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1014.16~22.04.1","5.19.0-1015.17~22.04.1","5.19.0-1016.18~22.04.1","5.19.0-1017.19~22.04.1","5.19.0-1018.20~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1006.7~22.04.1","6.2.0-1007.8~22.04.1","6.2.0-1009.10~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.8~22.04.1","6.5.0-1008.9~22.04.1","6.5.0-1009.10~22.04.1","6.5.0-1010.11~22.04.1","6.5.0-1011.12~22.04.1","6.5.0-1012.13~22.04.1","6.5.0-1014.15~22.04.1","6.5.0-1015.16~22.04.1","6.5.0-1016.17~22.04.1","6.5.0-1017.18~22.04.1","6.5.0-1018.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1008.8~24.04.1","6.11.0-1012.12~24.04.1","6.11.0-1013.13~24.04.1","6.11.0-1014.14~24.04.1","6.11.0-1015.15~24.04.1","6.11.0-1017.17~24.04.1","6.11.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1006.6~24.04.2","6.11.0-1011.11~24.04.1","6.11.0-1013.13~24.04.1","6.11.0-1014.14~24.04.1","6.11.0-1015.15~24.04.1","6.11.0-1016.16~24.04.1","6.11.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-17.17~24.04.2","6.11.0-19.19~24.04.1","6.11.0-21.21~24.04.1","6.11.0-24.24~24.04.1","6.11.0-25.25~24.04.1","6.11.0-26.26~24.04.1","6.11.0-28.28~24.04.1","6.11.0-29.29~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency-hwe-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1009.10~24.04.1","6.11.0-1011.12~24.04.1","6.11.0-1012.13~24.04.1","6.11.0-1013.14~24.04.1","6.11.0-1014.15~24.04.1","6.11.0-1015.16~24.04.2","6.11.0-1016.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1002.2","6.11.0-1003.3","6.11.0-1007.7","6.11.0-1010.10","6.11.0-1011.11","6.11.0-1012.12","6.11.0-1013.13","6.11.0-1016.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1007.7","6.11.0-1008.8","6.11.0-1009.9","6.11.0-1010.10","6.11.0-1011.11","6.11.0-1012.12","6.11.0-1013.13","6.11.0-1015.15","6.11.0-1016.16","6.11.0-1017.17","6.11.0-1018.18","6.11.0-1020.20","6.11.0-1021.21","6.11.0-1022.22","6.11.0-1023.23","6.11.0-1024.24","6.11.0-1025.25","6.11.0-1027.27"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1016.16","6.8.0-1017.17","6.8.0-1018.18","6.8.0-1019.19","6.8.0-1020.20","6.8.0-1024.24","6.8.0-1025.25","6.8.0-1026.26","6.8.0-1027.27","6.8.0-1028.28","6.8.0-1029.29","6.8.0-1030.30","6.8.0-1031.31","6.8.0-1032.32"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-2019.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.1-1015.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-9.9.1","6.8.0-20.20.1","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-47.47.1","6.8.0-48.48.1","6.8.0-49.49.1","6.8.0-50.51.1","6.8.0-51.52.1","6.8.0-52.53.1","6.8.0-53.55.1","6.8.0-55.57.1","6.8.0-56.58.1","6.8.0-57.59.1","6.8.0-58.60.1","6.8.0-59.61.1","6.8.0-60.63.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-22.22.1~24.04.1","6.14.0-23.23.1~24.04.1","6.14.0-24.24.1~24.04.1","6.14.0-27.27.1~24.04.1","6.14.0-28.28.1~24.04.1","6.14.0-29.29.1~24.04.1","6.14.0-32.32.1~24.04.1","6.14.0-33.33.1~24.04.1","6.14.0-34.34.1~24.04.1","6.14.0-35.35.1~24.04.1","6.14.0-36.36.1~24.04.1","6.14.0-37.37.1~24.04.1"]}],"products":[{"vendor":"linux","product":"linux"},{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"https://git.kernel.org/stable/c/0c6cf409093f307ee05114f834516730c0da5b21","tags":["Patch","web"]},{"url":"https://git.kernel.org/stable/c/5c281b0c5d18c8eeb1cfd5023f4adb153e6d1240","tags":["Patch","web","report"]},{"url":"https://git.kernel.org/stable/c/eee2d2e6ea5550118170dbd5bb1316ceb38455fb","tags":["Patch","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54285","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wfvh-f2f6-f56w"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-54285","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54285.json","tags":["advisory"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-54285","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2580","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38263","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38459","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38512","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38602","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38652","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38734","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39738","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39788","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39864","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39957","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40168","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68223","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68340","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68789","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68813","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71067","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71085","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23001","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23074","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23107","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23272","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23318","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31466","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31588","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31619","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31662","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31678","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31712","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31759","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31777","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31778","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31781","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43033","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43037","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43038","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43180","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43194","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43281","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43287","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43328","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43334","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43336","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43427","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43466","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43475","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43503","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45856","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45968","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45981","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45984","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46021","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46033","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46052","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46151","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46167","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46181","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46187","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46214","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260278-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1012628","tags":["report"]},{"url":"https://bugzilla.suse.com/1065729","tags":["report"]},{"url":"https://bugzilla.suse.com/1194869","tags":["report"]},{"url":"https://bugzilla.suse.com/1205462","tags":["report"]},{"url":"https://bugzilla.suse.com/1214285","tags":["report"]},{"url":"https://bugzilla.suse.com/1214635","tags":["report"]},{"url":"https://bugzilla.suse.com/1214847","tags":["report"]},{"url":"https://bugzilla.suse.com/1215146","tags":["report"]},{"url":"https://bugzilla.suse.com/1215211","tags":["report"]},{"url":"https://bugzilla.suse.com/1215344","tags":["report"]},{"url":"https://bugzilla.suse.com/1216062","tags":["report"]},{"url":"https://bugzilla.suse.com/1216436","tags":["report"]},{"url":"https://bugzilla.suse.com/1219165","tags":["report"]},{"url":"https://bugzilla.suse.com/1220419","tags":["report"]},{"url":"https://bugzilla.suse.com/1223731","tags":["report"]},{"url":"https://bugzilla.suse.com/1232223","tags":["report"]},{"url":"https://bugzilla.suse.com/1234163","tags":["report"]},{"url":"https://bugzilla.suse.com/1243112","tags":["report"]},{"url":"https://bugzilla.suse.com/1245193","tags":["report"]},{"url":"https://bugzilla.suse.com/1245449","tags":["report"]},{"url":"https://bugzilla.suse.com/1246328","tags":["report"]},{"url":"https://bugzilla.suse.com/1247500","tags":["report"]},{"url":"https://bugzilla.suse.com/1248886","tags":["report"]},{"url":"https://bugzilla.suse.com/1249256","tags":["report"]},{"url":"https://bugzilla.suse.com/1251752","tags":["report"]},{"url":"https://bugzilla.suse.com/1252046","tags":["report"]},{"url":"https://bugzilla.suse.com/1252342","tags":["report"]},{"url":"https://bugzilla.suse.com/1252686","tags":["report"]},{"url":"https://bugzilla.suse.com/1252776","tags":["report"]},{"url":"https://bugzilla.suse.com/1252808","tags":["report"]},{"url":"https://bugzilla.suse.com/1252824","tags":["report"]},{"url":"https://bugzilla.suse.com/1252861","tags":["report"]},{"url":"https://bugzilla.suse.com/1252919","tags":["report"]},{"url":"https://bugzilla.suse.com/1252973","tags":["report"]},{"url":"https://bugzilla.suse.com/1253155","tags":["report"]},{"url":"https://bugzilla.suse.com/1253262","tags":["report"]},{"url":"https://bugzilla.suse.com/1253342","tags":["report"]},{"url":"https://bugzilla.suse.com/1253365","tags":["report"]},{"url":"https://bugzilla.suse.com/1253386","tags":["report"]},{"url":"https://bugzilla.suse.com/1253400","tags":["report"]},{"url":"https://bugzilla.suse.com/1253402","tags":["report"]},{"url":"https://bugzilla.suse.com/1253408","tags":["report"]},{"url":"https://bugzilla.suse.com/1253413","tags":["report"]},{"url":"https://bugzilla.suse.com/1253442","tags":["report"]},{"url":"https://bugzilla.suse.com/1253458","tags":["report"]},{"url":"https://bugzilla.suse.com/1253463","tags":["report"]},{"url":"https://bugzilla.suse.com/1253623","tags":["report"]},{"url":"https://bugzilla.suse.com/1253647","tags":["report"]},{"url":"https://bugzilla.suse.com/1253674","tags":["report"]},{"url":"https://bugzilla.suse.com/1253739","tags":["report"]},{"url":"https://bugzilla.suse.com/1254119","tags":["report"]},{"url":"https://bugzilla.suse.com/1254126","tags":["report"]},{"url":"https://bugzilla.suse.com/1254235","tags":["report"]},{"url":"https://bugzilla.suse.com/1254244","tags":["report"]},{"url":"https://bugzilla.suse.com/1254363","tags":["report"]},{"url":"https://bugzilla.suse.com/1254373","tags":["report"]},{"url":"https://bugzilla.suse.com/1254378","tags":["report"]},{"url":"https://bugzilla.suse.com/1254477","tags":["report"]},{"url":"https://bugzilla.suse.com/1254518","tags":["report"]},{"url":"https://bugzilla.suse.com/1254520","tags":["report"]},{"url":"https://bugzilla.suse.com/1254599","tags":["report"]},{"url":"https://bugzilla.suse.com/1254606","tags":["report"]},{"url":"https://bugzilla.suse.com/1254611","tags":["report"]},{"url":"https://bugzilla.suse.com/1254613","tags":["report"]},{"url":"https://bugzilla.suse.com/1254615","tags":["report"]},{"url":"https://bugzilla.suse.com/1254616","tags":["report"]},{"url":"https://bugzilla.suse.com/1254621","tags":["report"]},{"url":"https://bugzilla.suse.com/1254623","tags":["report"]},{"url":"https://bugzilla.suse.com/1254626","tags":["report"]},{"url":"https://bugzilla.suse.com/1254648","tags":["report"]},{"url":"https://bugzilla.suse.com/1254649","tags":["report"]},{"url":"https://bugzilla.suse.com/1254653","tags":["report"]},{"url":"https://bugzilla.suse.com/1254655","tags":["report"]},{"url":"https://bugzilla.suse.com/1254657","tags":["report"]},{"url":"https://bugzilla.suse.com/1254660","tags":["report"]},{"url":"https://bugzilla.suse.com/1254661","tags":["report"]},{"url":"https://bugzilla.suse.com/1254663","tags":["report"]},{"url":"https://bugzilla.suse.com/1254669","tags":["report"]},{"url":"https://bugzilla.suse.com/1254677","tags":["report"]},{"url":"https://bugzilla.suse.com/1254678","tags":["report"]},{"url":"https://bugzilla.suse.com/1254688","tags":["report"]},{"url":"https://bugzilla.suse.com/1254690","tags":["report"]},{"url":"https://bugzilla.suse.com/1254691","tags":["report"]},{"url":"https://bugzilla.suse.com/1254693","tags":["report"]},{"url":"https://bugzilla.suse.com/1254695","tags":["report"]},{"url":"https://bugzilla.suse.com/1254698","tags":["report"]},{"url":"https://bugzilla.suse.com/1254701","tags":["report"]},{"url":"https://bugzilla.suse.com/1254704","tags":["report"]},{"url":"https://bugzilla.suse.com/1254705","tags":["report"]},{"url":"https://bugzilla.suse.com/1254707","tags":["report"]},{"url":"https://bugzilla.suse.com/1254712","tags":["report"]},{"url":"https://bugzilla.suse.com/1254715","tags":["report"]},{"url":"https://bugzilla.suse.com/1254717","tags":["report"]},{"url":"https://bugzilla.suse.com/1254723","tags":["report"]},{"url":"https://bugzilla.suse.com/1254724","tags":["report"]},{"url":"https://bugzilla.suse.com/1254732","tags":["report"]},{"url":"https://bugzilla.suse.com/1254733","tags":["report"]},{"url":"https://bugzilla.suse.com/1254737","tags":["report"]},{"url":"https://bugzilla.suse.com/1254739","tags":["report"]},{"url":"https://bugzilla.suse.com/1254742","tags":["report"]},{"url":"https://bugzilla.suse.com/1254743","tags":["report"]},{"url":"https://bugzilla.suse.com/1254749","tags":["report"]},{"url":"https://bugzilla.suse.com/1254750","tags":["report"]},{"url":"https://bugzilla.suse.com/1254753","tags":["report"]},{"url":"https://bugzilla.suse.com/1254754","tags":["report"]},{"url":"https://bugzilla.suse.com/1254758","tags":["report"]},{"url":"https://bugzilla.suse.com/1254761","tags":["report"]},{"url":"https://bugzilla.suse.com/1254762","tags":["report"]},{"url":"https://bugzilla.suse.com/1254765","tags":["report"]},{"url":"https://bugzilla.suse.com/1254782","tags":["report"]},{"url":"https://bugzilla.suse.com/1254791","tags":["report"]},{"url":"https://bugzilla.suse.com/1254793","tags":["report"]},{"url":"https://bugzilla.suse.com/1254794","tags":["report"]},{"url":"https://bugzilla.suse.com/1254795","tags":["report"]},{"url":"https://bugzilla.suse.com/1254796","tags":["report"]},{"url":"https://bugzilla.suse.com/1254797","tags":["report"]},{"url":"https://bugzilla.suse.com/1254798","tags":["report"]},{"url":"https://bugzilla.suse.com/1254813","tags":["report"]},{"url":"https://bugzilla.suse.com/1254815","tags":["report"]},{"url":"https://bugzilla.suse.com/1254824","tags":["report"]},{"url":"https://bugzilla.suse.com/1254825","tags":["report"]},{"url":"https://bugzilla.suse.com/1254827","tags":["report"]},{"url":"https://bugzilla.suse.com/1254828","tags":["report"]},{"url":"https://bugzilla.suse.com/1254829","tags":["report"]},{"url":"https://bugzilla.suse.com/1254830","tags":["report"]},{"url":"https://bugzilla.suse.com/1254832","tags":["report"]},{"url":"https://bugzilla.suse.com/1254840","tags":["report"]},{"url":"https://bugzilla.suse.com/1254843","tags":["report"]},{"url":"https://bugzilla.suse.com/1254846","tags":["report"]},{"url":"https://bugzilla.suse.com/1254847","tags":["report"]},{"url":"https://bugzilla.suse.com/1254849","tags":["report"]},{"url":"https://bugzilla.suse.com/1254850","tags":["report"]},{"url":"https://bugzilla.suse.com/1254851","tags":["report"]},{"url":"https://bugzilla.suse.com/1254854","tags":["report"]},{"url":"https://bugzilla.suse.com/1254856","tags":["report"]},{"url":"https://bugzilla.suse.com/1254858","tags":["report"]},{"url":"https://bugzilla.suse.com/1254860","tags":["report"]},{"url":"https://bugzilla.suse.com/1254864","tags":["report"]},{"url":"https://bugzilla.suse.com/1254869","tags":["report"]},{"url":"https://bugzilla.suse.com/1254894","tags":["report"]},{"url":"https://bugzilla.suse.com/1254918","tags":["report"]},{"url":"https://bugzilla.suse.com/1254957","tags":["report"]},{"url":"https://bugzilla.suse.com/1254959","tags":["report"]},{"url":"https://bugzilla.suse.com/1254983","tags":["report"]},{"url":"https://bugzilla.suse.com/1254996","tags":["report"]},{"url":"https://bugzilla.suse.com/1255005","tags":["report"]},{"url":"https://bugzilla.suse.com/1255009","tags":["report"]},{"url":"https://bugzilla.suse.com/1255025","tags":["report"]},{"url":"https://bugzilla.suse.com/1255026","tags":["report"]},{"url":"https://bugzilla.suse.com/1255030","tags":["report"]},{"url":"https://bugzilla.suse.com/1255033","tags":["report"]},{"url":"https://bugzilla.suse.com/1255034","tags":["report"]},{"url":"https://bugzilla.suse.com/1255035","tags":["report"]},{"url":"https://bugzilla.suse.com/1255039","tags":["report"]},{"url":"https://bugzilla.suse.com/1255041","tags":["report"]},{"url":"https://bugzilla.suse.com/1255042","tags":["report"]},{"url":"https://bugzilla.suse.com/1255046","tags":["report"]},{"url":"https://bugzilla.suse.com/1255057","tags":["report"]},{"url":"https://bugzilla.suse.com/1255062","tags":["report"]},{"url":"https://bugzilla.suse.com/1255064","tags":["report"]},{"url":"https://bugzilla.suse.com/1255065","tags":["report"]},{"url":"https://bugzilla.suse.com/1255068","tags":["report"]},{"url":"https://bugzilla.suse.com/1255071","tags":["report"]},{"url":"https://bugzilla.suse.com/1255072","tags":["report"]},{"url":"https://bugzilla.suse.com/1255075","tags":["report"]},{"url":"https://bugzilla.suse.com/1255077","tags":["report"]},{"url":"https://bugzilla.suse.com/1255081","tags":["report"]},{"url":"https://bugzilla.suse.com/1255082","tags":["report"]},{"url":"https://bugzilla.suse.com/1255083","tags":["report"]},{"url":"https://bugzilla.suse.com/1255085","tags":["report"]},{"url":"https://bugzilla.suse.com/1255087","tags":["report"]},{"url":"https://bugzilla.suse.com/1255092","tags":["report"]},{"url":"https://bugzilla.suse.com/1255094","tags":["report"]},{"url":"https://bugzilla.suse.com/1255095","tags":["report"]},{"url":"https://bugzilla.suse.com/1255097","tags":["report"]},{"url":"https://bugzilla.suse.com/1255100","tags":["report"]},{"url":"https://bugzilla.suse.com/1255101","tags":["report"]},{"url":"https://bugzilla.suse.com/1255116","tags":["report"]},{"url":"https://bugzilla.suse.com/1255121","tags":["report"]},{"url":"https://bugzilla.suse.com/1255122","tags":["report"]},{"url":"https://bugzilla.suse.com/1255124","tags":["report"]},{"url":"https://bugzilla.suse.com/1255131","tags":["report"]},{"url":"https://bugzilla.suse.com/1255134","tags":["report"]},{"url":"https://bugzilla.suse.com/1255135","tags":["report"]},{"url":"https://bugzilla.suse.com/1255136","tags":["report"]},{"url":"https://bugzilla.suse.com/1255142","tags":["report"]},{"url":"https://bugzilla.suse.com/1255145","tags":["report"]},{"url":"https://bugzilla.suse.com/1255146","tags":["report"]},{"url":"https://bugzilla.suse.com/1255149","tags":["report"]},{"url":"https://bugzilla.suse.com/1255152","tags":["report"]},{"url":"https://bugzilla.suse.com/1255154","tags":["report"]},{"url":"https://bugzilla.suse.com/1255155","tags":["report"]},{"url":"https://bugzilla.suse.com/1255163","tags":["report"]},{"url":"https://bugzilla.suse.com/1255167","tags":["report"]},{"url":"https://bugzilla.suse.com/1255169","tags":["report"]},{"url":"https://bugzilla.suse.com/1255171","tags":["report"]},{"url":"https://bugzilla.suse.com/1255175","tags":["report"]},{"url":"https://bugzilla.suse.com/1255179","tags":["report"]},{"url":"https://bugzilla.suse.com/1255181","tags":["report"]},{"url":"https://bugzilla.suse.com/1255182","tags":["report"]},{"url":"https://bugzilla.suse.com/1255187","tags":["report"]},{"url":"https://bugzilla.suse.com/1255190","tags":["report"]},{"url":"https://bugzilla.suse.com/1255193","tags":["report"]},{"url":"https://bugzilla.suse.com/1255196","tags":["report"]},{"url":"https://bugzilla.suse.com/1255197","tags":["report"]},{"url":"https://bugzilla.suse.com/1255199","tags":["report"]},{"url":"https://bugzilla.suse.com/1255202","tags":["report"]},{"url":"https://bugzilla.suse.com/1255203","tags":["report"]},{"url":"https://bugzilla.suse.com/1255206","tags":["report"]},{"url":"https://bugzilla.suse.com/1255209","tags":["report"]},{"url":"https://bugzilla.suse.com/1255218","tags":["report"]},{"url":"https://bugzilla.suse.com/1255220","tags":["report"]},{"url":"https://bugzilla.suse.com/1255221","tags":["report"]},{"url":"https://bugzilla.suse.com/1255224","tags":["report"]},{"url":"https://bugzilla.suse.com/1255227","tags":["report"]},{"url":"https://bugzilla.suse.com/1255230","tags":["report"]},{"url":"https://bugzilla.suse.com/1255233","tags":["report"]},{"url":"https://bugzilla.suse.com/1255234","tags":["report"]},{"url":"https://bugzilla.suse.com/1255242","tags":["report"]},{"url":"https://bugzilla.suse.com/1255245","tags":["report"]},{"url":"https://bugzilla.suse.com/1255246","tags":["report"]},{"url":"https://bugzilla.suse.com/1255247","tags":["report"]},{"url":"https://bugzilla.suse.com/1255251","tags":["report"]},{"url":"https://bugzilla.suse.com/1255252","tags":["report"]},{"url":"https://bugzilla.suse.com/1255253","tags":["report"]},{"url":"https://bugzilla.suse.com/1255256","tags":["report"]},{"url":"https://bugzilla.suse.com/1255259","tags":["report"]},{"url":"https://bugzilla.suse.com/1255262","tags":["report"]},{"url":"https://bugzilla.suse.com/1255272","tags":["report"]},{"url":"https://bugzilla.suse.com/1255273","tags":["report"]},{"url":"https://bugzilla.suse.com/1255274","tags":["report"]},{"url":"https://bugzilla.suse.com/1255276","tags":["report"]},{"url":"https://bugzilla.suse.com/1255279","tags":["report"]},{"url":"https://bugzilla.suse.com/1255280","tags":["report"]},{"url":"https://bugzilla.suse.com/1255281","tags":["report"]},{"url":"https://bugzilla.suse.com/1255297","tags":["report"]},{"url":"https://bugzilla.suse.com/1255316","tags":["report"]},{"url":"https://bugzilla.suse.com/1255318","tags":["report"]},{"url":"https://bugzilla.suse.com/1255325","tags":["report"]},{"url":"https://bugzilla.suse.com/1255329","tags":["report"]},{"url":"https://bugzilla.suse.com/1255346","tags":["report"]},{"url":"https://bugzilla.suse.com/1255349","tags":["report"]},{"url":"https://bugzilla.suse.com/1255351","tags":["report"]},{"url":"https://bugzilla.suse.com/1255357","tags":["report"]},{"url":"https://bugzilla.suse.com/1255380","tags":["report"]},{"url":"https://bugzilla.suse.com/1255395","tags":["report"]},{"url":"https://bugzilla.suse.com/1255415","tags":["report"]},{"url":"https://bugzilla.suse.com/1255428","tags":["report"]},{"url":"https://bugzilla.suse.com/1255433","tags":["report"]},{"url":"https://bugzilla.suse.com/1255434","tags":["report"]},{"url":"https://bugzilla.suse.com/1255463","tags":["report"]},{"url":"https://bugzilla.suse.com/1255480","tags":["report"]},{"url":"https://bugzilla.suse.com/1255483","tags":["report"]},{"url":"https://bugzilla.suse.com/1255489","tags":["report"]},{"url":"https://bugzilla.suse.com/1255493","tags":["report"]},{"url":"https://bugzilla.suse.com/1255495","tags":["report"]},{"url":"https://bugzilla.suse.com/1255505","tags":["report"]},{"url":"https://bugzilla.suse.com/1255507","tags":["report"]},{"url":"https://bugzilla.suse.com/1255538","tags":["report"]},{"url":"https://bugzilla.suse.com/1255540","tags":["report"]},{"url":"https://bugzilla.suse.com/1255545","tags":["report"]},{"url":"https://bugzilla.suse.com/1255549","tags":["report"]},{"url":"https://bugzilla.suse.com/1255550","tags":["report"]},{"url":"https://bugzilla.suse.com/1255553","tags":["report"]},{"url":"https://bugzilla.suse.com/1255557","tags":["report"]},{"url":"https://bugzilla.suse.com/1255558","tags":["report"]},{"url":"https://bugzilla.suse.com/1255563","tags":["report"]},{"url":"https://bugzilla.suse.com/1255564","tags":["report"]},{"url":"https://bugzilla.suse.com/1255567","tags":["report"]},{"url":"https://bugzilla.suse.com/1255570","tags":["report"]},{"url":"https://bugzilla.suse.com/1255578","tags":["report"]},{"url":"https://bugzilla.suse.com/1255579","tags":["report"]},{"url":"https://bugzilla.suse.com/1255580","tags":["report"]},{"url":"https://bugzilla.suse.com/1255583","tags":["report"]},{"url":"https://bugzilla.suse.com/1255591","tags":["report"]},{"url":"https://bugzilla.suse.com/1255601","tags":["report"]},{"url":"https://bugzilla.suse.com/1255603","tags":["report"]},{"url":"https://bugzilla.suse.com/1255605","tags":["report"]},{"url":"https://bugzilla.suse.com/1255611","tags":["report"]},{"url":"https://bugzilla.suse.com/1255614","tags":["report"]},{"url":"https://bugzilla.suse.com/1255616","tags":["report"]},{"url":"https://bugzilla.suse.com/1255617","tags":["report"]},{"url":"https://bugzilla.suse.com/1255618","tags":["report"]},{"url":"https://bugzilla.suse.com/1255621","tags":["report"]},{"url":"https://bugzilla.suse.com/1255628","tags":["report"]},{"url":"https://bugzilla.suse.com/1255629","tags":["report"]},{"url":"https://bugzilla.suse.com/1255630","tags":["report"]},{"url":"https://bugzilla.suse.com/1255632","tags":["report"]},{"url":"https://bugzilla.suse.com/1255636","tags":["report"]},{"url":"https://bugzilla.suse.com/1255688","tags":["report"]},{"url":"https://bugzilla.suse.com/1255691","tags":["report"]},{"url":"https://bugzilla.suse.com/1255702","tags":["report"]},{"url":"https://bugzilla.suse.com/1255704","tags":["report"]},{"url":"https://bugzilla.suse.com/1255706","tags":["report"]},{"url":"https://bugzilla.suse.com/1255707","tags":["report"]},{"url":"https://bugzilla.suse.com/1255709","tags":["report"]},{"url":"https://bugzilla.suse.com/1255722","tags":["report"]},{"url":"https://bugzilla.suse.com/1255723","tags":["report"]},{"url":"https://bugzilla.suse.com/1255724","tags":["report"]},{"url":"https://bugzilla.suse.com/1255758","tags":["report"]},{"url":"https://bugzilla.suse.com/1255759","tags":["report"]},{"url":"https://bugzilla.suse.com/1255760","tags":["report"]},{"url":"https://bugzilla.suse.com/1255763","tags":["report"]},{"url":"https://bugzilla.suse.com/1255769","tags":["report"]},{"url":"https://bugzilla.suse.com/1255770","tags":["report"]},{"url":"https://bugzilla.suse.com/1255772","tags":["report"]},{"url":"https://bugzilla.suse.com/1255774","tags":["report"]},{"url":"https://bugzilla.suse.com/1255775","tags":["report"]},{"url":"https://bugzilla.suse.com/1255776","tags":["report"]},{"url":"https://bugzilla.suse.com/1255780","tags":["report"]},{"url":"https://bugzilla.suse.com/1255785","tags":["report"]},{"url":"https://bugzilla.suse.com/1255786","tags":["report"]},{"url":"https://bugzilla.suse.com/1255789","tags":["report"]},{"url":"https://bugzilla.suse.com/1255790","tags":["report"]},{"url":"https://bugzilla.suse.com/1255792","tags":["report"]},{"url":"https://bugzilla.suse.com/1255793","tags":["report"]},{"url":"https://bugzilla.suse.com/1255795","tags":["report"]},{"url":"https://bugzilla.suse.com/1255798","tags":["report"]},{"url":"https://bugzilla.suse.com/1255800","tags":["report"]},{"url":"https://bugzilla.suse.com/1255801","tags":["report"]},{"url":"https://bugzilla.suse.com/1255806","tags":["report"]},{"url":"https://bugzilla.suse.com/1255807","tags":["report"]},{"url":"https://bugzilla.suse.com/1255809","tags":["report"]},{"url":"https://bugzilla.suse.com/1255810","tags":["report"]},{"url":"https://bugzilla.suse.com/1255812","tags":["report"]},{"url":"https://bugzilla.suse.com/1255814","tags":["report"]},{"url":"https://bugzilla.suse.com/1255820","tags":["report"]},{"url":"https://bugzilla.suse.com/1255838","tags":["report"]},{"url":"https://bugzilla.suse.com/1255842","tags":["report"]},{"url":"https://bugzilla.suse.com/1255843","tags":["report"]},{"url":"https://bugzilla.suse.com/1255872","tags":["report"]},{"url":"https://bugzilla.suse.com/1255875","tags":["report"]},{"url":"https://bugzilla.suse.com/1255879","tags":["report"]},{"url":"https://bugzilla.suse.com/1255883","tags":["report"]},{"url":"https://bugzilla.suse.com/1255884","tags":["report"]},{"url":"https://bugzilla.suse.com/1255886","tags":["report"]},{"url":"https://bugzilla.suse.com/1255888","tags":["report"]},{"url":"https://bugzilla.suse.com/1255890","tags":["report"]},{"url":"https://bugzilla.suse.com/1255891","tags":["report"]},{"url":"https://bugzilla.suse.com/1255892","tags":["report"]},{"url":"https://bugzilla.suse.com/1255899","tags":["report"]},{"url":"https://bugzilla.suse.com/1255902","tags":["report"]},{"url":"https://bugzilla.suse.com/1255907","tags":["report"]},{"url":"https://bugzilla.suse.com/1255911","tags":["report"]},{"url":"https://bugzilla.suse.com/1255915","tags":["report"]},{"url":"https://bugzilla.suse.com/1255918","tags":["report"]},{"url":"https://bugzilla.suse.com/1255921","tags":["report"]},{"url":"https://bugzilla.suse.com/1255924","tags":["report"]},{"url":"https://bugzilla.suse.com/1255925","tags":["report"]},{"url":"https://bugzilla.suse.com/1255931","tags":["report"]},{"url":"https://bugzilla.suse.com/1255932","tags":["report"]},{"url":"https://bugzilla.suse.com/1255934","tags":["report"]},{"url":"https://bugzilla.suse.com/1255943","tags":["report"]},{"url":"https://bugzilla.suse.com/1255944","tags":["report"]},{"url":"https://bugzilla.suse.com/1255949","tags":["report"]},{"url":"https://bugzilla.suse.com/1255951","tags":["report"]},{"url":"https://bugzilla.suse.com/1255952","tags":["report"]},{"url":"https://bugzilla.suse.com/1255955","tags":["report"]},{"url":"https://bugzilla.suse.com/1255957","tags":["report"]},{"url":"https://bugzilla.suse.com/1255961","tags":["report"]},{"url":"https://bugzilla.suse.com/1255963","tags":["report"]},{"url":"https://bugzilla.suse.com/1255964","tags":["report"]},{"url":"https://bugzilla.suse.com/1255967","tags":["report"]},{"url":"https://bugzilla.suse.com/1255974","tags":["report"]},{"url":"https://bugzilla.suse.com/1255978","tags":["report"]},{"url":"https://bugzilla.suse.com/1255984","tags":["report"]},{"url":"https://bugzilla.suse.com/1255988","tags":["report"]},{"url":"https://bugzilla.suse.com/1255990","tags":["report"]},{"url":"https://bugzilla.suse.com/1255992","tags":["report"]},{"url":"https://bugzilla.suse.com/1255993","tags":["report"]},{"url":"https://bugzilla.suse.com/1255994","tags":["report"]},{"url":"https://bugzilla.suse.com/1255996","tags":["report"]},{"url":"https://bugzilla.suse.com/1256033","tags":["report"]},{"url":"https://bugzilla.suse.com/1256034","tags":["report"]},{"url":"https://bugzilla.suse.com/1256045","tags":["report"]},{"url":"https://bugzilla.suse.com/1256050","tags":["report"]},{"url":"https://bugzilla.suse.com/1256058","tags":["report"]},{"url":"https://bugzilla.suse.com/1256071","tags":["report"]},{"url":"https://bugzilla.suse.com/1256074","tags":["report"]},{"url":"https://bugzilla.suse.com/1256081","tags":["report"]},{"url":"https://bugzilla.suse.com/1256082","tags":["report"]},{"url":"https://bugzilla.suse.com/1256083","tags":["report"]},{"url":"https://bugzilla.suse.com/1256084","tags":["report"]},{"url":"https://bugzilla.suse.com/1256085","tags":["report"]},{"url":"https://bugzilla.suse.com/1256090","tags":["report"]},{"url":"https://bugzilla.suse.com/1256093","tags":["report"]},{"url":"https://bugzilla.suse.com/1256094","tags":["report"]},{"url":"https://bugzilla.suse.com/1256095","tags":["report"]},{"url":"https://bugzilla.suse.com/1256096","tags":["report"]},{"url":"https://bugzilla.suse.com/1256099","tags":["report"]},{"url":"https://bugzilla.suse.com/1256100","tags":["report"]},{"url":"https://bugzilla.suse.com/1256104","tags":["report"]},{"url":"https://bugzilla.suse.com/1256106","tags":["report"]},{"url":"https://bugzilla.suse.com/1256107","tags":["report"]},{"url":"https://bugzilla.suse.com/1256117","tags":["report"]},{"url":"https://bugzilla.suse.com/1256119","tags":["report"]},{"url":"https://bugzilla.suse.com/1256121","tags":["report"]},{"url":"https://bugzilla.suse.com/1256145","tags":["report"]},{"url":"https://bugzilla.suse.com/1256153","tags":["report"]},{"url":"https://bugzilla.suse.com/1256178","tags":["report"]},{"url":"https://bugzilla.suse.com/1256197","tags":["report"]},{"url":"https://bugzilla.suse.com/1256231","tags":["report"]},{"url":"https://bugzilla.suse.com/1256233","tags":["report"]},{"url":"https://bugzilla.suse.com/1256234","tags":["report"]},{"url":"https://bugzilla.suse.com/1256238","tags":["report"]},{"url":"https://bugzilla.suse.com/1256263","tags":["report"]},{"url":"https://bugzilla.suse.com/1256267","tags":["report"]},{"url":"https://bugzilla.suse.com/1256268","tags":["report"]},{"url":"https://bugzilla.suse.com/1256271","tags":["report"]},{"url":"https://bugzilla.suse.com/1256273","tags":["report"]},{"url":"https://bugzilla.suse.com/1256274","tags":["report"]},{"url":"https://bugzilla.suse.com/1256279","tags":["report"]},{"url":"https://bugzilla.suse.com/1256285","tags":["report"]},{"url":"https://bugzilla.suse.com/1256291","tags":["report"]},{"url":"https://bugzilla.suse.com/1256292","tags":["report"]},{"url":"https://bugzilla.suse.com/1256300","tags":["report"]},{"url":"https://bugzilla.suse.com/1256301","tags":["report"]},{"url":"https://bugzilla.suse.com/1256302","tags":["report"]},{"url":"https://bugzilla.suse.com/1256335","tags":["report"]},{"url":"https://bugzilla.suse.com/1256348","tags":["report"]},{"url":"https://bugzilla.suse.com/1256351","tags":["report"]},{"url":"https://bugzilla.suse.com/1256354","tags":["report"]},{"url":"https://bugzilla.suse.com/1256358","tags":["report"]},{"url":"https://bugzilla.suse.com/1256361","tags":["report"]},{"url":"https://bugzilla.suse.com/1256364","tags":["report"]},{"url":"https://bugzilla.suse.com/1256366","tags":["report"]},{"url":"https://bugzilla.suse.com/1256367","tags":["report"]},{"url":"https://bugzilla.suse.com/1256368","tags":["report"]},{"url":"https://bugzilla.suse.com/1256369","tags":["report"]},{"url":"https://bugzilla.suse.com/1256370","tags":["report"]},{"url":"https://bugzilla.suse.com/1256371","tags":["report"]},{"url":"https://bugzilla.suse.com/1256373","tags":["report"]},{"url":"https://bugzilla.suse.com/1256375","tags":["report"]},{"url":"https://bugzilla.suse.com/1256379","tags":["report"]},{"url":"https://bugzilla.suse.com/1256387","tags":["report"]},{"url":"https://bugzilla.suse.com/1256394","tags":["report"]},{"url":"https://bugzilla.suse.com/1256395","tags":["report"]},{"url":"https://bugzilla.suse.com/1256396","tags":["report"]},{"url":"https://bugzilla.suse.com/1256528","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-42752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53762","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53768","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53808","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53992","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53994","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54026","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54027","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54048","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54067","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54076","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54094","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54096","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54134","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54171","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54173","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54201","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54211","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54215","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54255","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54258","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54266","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54267","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54282","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54299","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54302","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54322","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54326","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39977","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40134","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40211","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40213","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40215","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40250","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40258","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40272","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40279","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40280","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40282","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40301","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40302","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40311","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40322","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40342","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68201","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68255","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68258","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68302","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68305","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68335","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68734","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68749","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68765","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68766","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260281-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260293-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1250334","tags":["report"]},{"url":"https://bugzilla.suse.com/1254624","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40328","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260315-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620477-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1215199","tags":["report"]},{"url":"https://bugzilla.suse.com/1223800","tags":["report"]},{"url":"https://bugzilla.suse.com/1228490","tags":["report"]},{"url":"https://bugzilla.suse.com/1233563","tags":["report"]},{"url":"https://bugzilla.suse.com/1234842","tags":["report"]},{"url":"https://bugzilla.suse.com/1241437","tags":["report"]},{"url":"https://bugzilla.suse.com/1242909","tags":["report"]},{"url":"https://bugzilla.suse.com/1243677","tags":["report"]},{"url":"https://bugzilla.suse.com/1243678","tags":["report"]},{"url":"https://bugzilla.suse.com/1246184","tags":["report"]},{"url":"https://bugzilla.suse.com/1246447","tags":["report"]},{"url":"https://bugzilla.suse.com/1247030","tags":["report"]},{"url":"https://bugzilla.suse.com/1247712","tags":["report"]},{"url":"https://bugzilla.suse.com/1248211","tags":["report"]},{"url":"https://bugzilla.suse.com/1249307","tags":["report"]},{"url":"https://bugzilla.suse.com/1250032","tags":["report"]},{"url":"https://bugzilla.suse.com/1250082","tags":["report"]},{"url":"https://bugzilla.suse.com/1250388","tags":["report"]},{"url":"https://bugzilla.suse.com/1250705","tags":["report"]},{"url":"https://bugzilla.suse.com/1250748","tags":["report"]},{"url":"https://bugzilla.suse.com/1252511","tags":["report"]},{"url":"https://bugzilla.suse.com/1252712","tags":["report"]},{"url":"https://bugzilla.suse.com/1252891","tags":["report"]},{"url":"https://bugzilla.suse.com/1252900","tags":["report"]},{"url":"https://bugzilla.suse.com/1253087","tags":["report"]},{"url":"https://bugzilla.suse.com/1253451","tags":["report"]},{"url":"https://bugzilla.suse.com/1254447","tags":["report"]},{"url":"https://bugzilla.suse.com/1254465","tags":["report"]},{"url":"https://bugzilla.suse.com/1254510","tags":["report"]},{"url":"https://bugzilla.suse.com/1254767","tags":["report"]},{"url":"https://bugzilla.suse.com/1254835","tags":["report"]},{"url":"https://bugzilla.suse.com/1254839","tags":["report"]},{"url":"https://bugzilla.suse.com/1254842","tags":["report"]},{"url":"https://bugzilla.suse.com/1254845","tags":["report"]},{"url":"https://bugzilla.suse.com/1254852","tags":["report"]},{"url":"https://bugzilla.suse.com/1254871","tags":["report"]},{"url":"https://bugzilla.suse.com/1255102","tags":["report"]},{"url":"https://bugzilla.suse.com/1255120","tags":["report"]},{"url":"https://bugzilla.suse.com/1255128","tags":["report"]},{"url":"https://bugzilla.suse.com/1255138","tags":["report"]},{"url":"https://bugzilla.suse.com/1255140","tags":["report"]},{"url":"https://bugzilla.suse.com/1255157","tags":["report"]},{"url":"https://bugzilla.suse.com/1255164","tags":["report"]},{"url":"https://bugzilla.suse.com/1255172","tags":["report"]},{"url":"https://bugzilla.suse.com/1255216","tags":["report"]},{"url":"https://bugzilla.suse.com/1255241","tags":["report"]},{"url":"https://bugzilla.suse.com/1255255","tags":["report"]},{"url":"https://bugzilla.suse.com/1255260","tags":["report"]},{"url":"https://bugzilla.suse.com/1255261","tags":["report"]},{"url":"https://bugzilla.suse.com/1255266","tags":["report"]},{"url":"https://bugzilla.suse.com/1255268","tags":["report"]},{"url":"https://bugzilla.suse.com/1255269","tags":["report"]},{"url":"https://bugzilla.suse.com/1255327","tags":["report"]},{"url":"https://bugzilla.suse.com/1255377","tags":["report"]},{"url":"https://bugzilla.suse.com/1255401","tags":["report"]},{"url":"https://bugzilla.suse.com/1255403","tags":["report"]},{"url":"https://bugzilla.suse.com/1255417","tags":["report"]},{"url":"https://bugzilla.suse.com/1255482","tags":["report"]},{"url":"https://bugzilla.suse.com/1255488","tags":["report"]},{"url":"https://bugzilla.suse.com/1255537","tags":["report"]},{"url":"https://bugzilla.suse.com/1255539","tags":["report"]},{"url":"https://bugzilla.suse.com/1255544","tags":["report"]},{"url":"https://bugzilla.suse.com/1255547","tags":["report"]},{"url":"https://bugzilla.suse.com/1255548","tags":["report"]},{"url":"https://bugzilla.suse.com/1255552","tags":["report"]},{"url":"https://bugzilla.suse.com/1255568","tags":["report"]},{"url":"https://bugzilla.suse.com/1255569","tags":["report"]},{"url":"https://bugzilla.suse.com/1255615","tags":["report"]},{"url":"https://bugzilla.suse.com/1255622","tags":["report"]},{"url":"https://bugzilla.suse.com/1255695","tags":["report"]},{"url":"https://bugzilla.suse.com/1255930","tags":["report"]},{"url":"https://bugzilla.suse.com/1256280","tags":["report"]},{"url":"https://bugzilla.suse.com/1256579","tags":["report"]},{"url":"https://bugzilla.suse.com/1256582","tags":["report"]},{"url":"https://bugzilla.suse.com/1256584","tags":["report"]},{"url":"https://bugzilla.suse.com/1256586","tags":["report"]},{"url":"https://bugzilla.suse.com/1256591","tags":["report"]},{"url":"https://bugzilla.suse.com/1256593","tags":["report"]},{"url":"https://bugzilla.suse.com/1256597","tags":["report"]},{"url":"https://bugzilla.suse.com/1256605","tags":["report"]},{"url":"https://bugzilla.suse.com/1256606","tags":["report"]},{"url":"https://bugzilla.suse.com/1256607","tags":["report"]},{"url":"https://bugzilla.suse.com/1256609","tags":["report"]},{"url":"https://bugzilla.suse.com/1256610","tags":["report"]},{"url":"https://bugzilla.suse.com/1256611","tags":["report"]},{"url":"https://bugzilla.suse.com/1256612","tags":["report"]},{"url":"https://bugzilla.suse.com/1256613","tags":["report"]},{"url":"https://bugzilla.suse.com/1256616","tags":["report"]},{"url":"https://bugzilla.suse.com/1256617","tags":["report"]},{"url":"https://bugzilla.suse.com/1256619","tags":["report"]},{"url":"https://bugzilla.suse.com/1256622","tags":["report"]},{"url":"https://bugzilla.suse.com/1256623","tags":["report"]},{"url":"https://bugzilla.suse.com/1256625","tags":["report"]},{"url":"https://bugzilla.suse.com/1256628","tags":["report"]},{"url":"https://bugzilla.suse.com/1256630","tags":["report"]},{"url":"https://bugzilla.suse.com/1256638","tags":["report"]},{"url":"https://bugzilla.suse.com/1256641","tags":["report"]},{"url":"https://bugzilla.suse.com/1256645","tags":["report"]},{"url":"https://bugzilla.suse.com/1256646","tags":["report"]},{"url":"https://bugzilla.suse.com/1256650","tags":["report"]},{"url":"https://bugzilla.suse.com/1256651","tags":["report"]},{"url":"https://bugzilla.suse.com/1256653","tags":["report"]},{"url":"https://bugzilla.suse.com/1256654","tags":["report"]},{"url":"https://bugzilla.suse.com/1256655","tags":["report"]},{"url":"https://bugzilla.suse.com/1256659","tags":["report"]},{"url":"https://bugzilla.suse.com/1256660","tags":["report"]},{"url":"https://bugzilla.suse.com/1256664","tags":["report"]},{"url":"https://bugzilla.suse.com/1256665","tags":["report"]},{"url":"https://bugzilla.suse.com/1256674","tags":["report"]},{"url":"https://bugzilla.suse.com/1256680","tags":["report"]},{"url":"https://bugzilla.suse.com/1256682","tags":["report"]},{"url":"https://bugzilla.suse.com/1256688","tags":["report"]},{"url":"https://bugzilla.suse.com/1256689","tags":["report"]},{"url":"https://bugzilla.suse.com/1256726","tags":["report"]},{"url":"https://bugzilla.suse.com/1256728","tags":["report"]},{"url":"https://bugzilla.suse.com/1256730","tags":["report"]},{"url":"https://bugzilla.suse.com/1256733","tags":["report"]},{"url":"https://bugzilla.suse.com/1256737","tags":["report"]},{"url":"https://bugzilla.suse.com/1256741","tags":["report"]},{"url":"https://bugzilla.suse.com/1256742","tags":["report"]},{"url":"https://bugzilla.suse.com/1256744","tags":["report"]},{"url":"https://bugzilla.suse.com/1256752","tags":["report"]},{"url":"https://bugzilla.suse.com/1256754","tags":["report"]},{"url":"https://bugzilla.suse.com/1256757","tags":["report"]},{"url":"https://bugzilla.suse.com/1256759","tags":["report"]},{"url":"https://bugzilla.suse.com/1256760","tags":["report"]},{"url":"https://bugzilla.suse.com/1256761","tags":["report"]},{"url":"https://bugzilla.suse.com/1256763","tags":["report"]},{"url":"https://bugzilla.suse.com/1256770","tags":["report"]},{"url":"https://bugzilla.suse.com/1256773","tags":["report"]},{"url":"https://bugzilla.suse.com/1256774","tags":["report"]},{"url":"https://bugzilla.suse.com/1256777","tags":["report"]},{"url":"https://bugzilla.suse.com/1256779","tags":["report"]},{"url":"https://bugzilla.suse.com/1256781","tags":["report"]},{"url":"https://bugzilla.suse.com/1256785","tags":["report"]},{"url":"https://bugzilla.suse.com/1256792","tags":["report"]},{"url":"https://bugzilla.suse.com/1256861","tags":["report"]},{"url":"https://bugzilla.suse.com/1256863","tags":["report"]},{"url":"https://bugzilla.suse.com/1257035","tags":["report"]},{"url":"https://bugzilla.suse.com/1257053","tags":["report"]},{"url":"https://bugzilla.suse.com/1257154","tags":["report"]},{"url":"https://bugzilla.suse.com/1257155","tags":["report"]},{"url":"https://bugzilla.suse.com/1257158","tags":["report"]},{"url":"https://bugzilla.suse.com/1257163","tags":["report"]},{"url":"https://bugzilla.suse.com/1257164","tags":["report"]},{"url":"https://bugzilla.suse.com/1257180","tags":["report"]},{"url":"https://bugzilla.suse.com/1257202","tags":["report"]},{"url":"https://bugzilla.suse.com/1257204","tags":["report"]},{"url":"https://bugzilla.suse.com/1257207","tags":["report"]},{"url":"https://bugzilla.suse.com/1257208","tags":["report"]},{"url":"https://bugzilla.suse.com/1257215","tags":["report"]},{"url":"https://bugzilla.suse.com/1257217","tags":["report"]},{"url":"https://bugzilla.suse.com/1257218","tags":["report"]},{"url":"https://bugzilla.suse.com/1257220","tags":["report"]},{"url":"https://bugzilla.suse.com/1257221","tags":["report"]},{"url":"https://bugzilla.suse.com/1257227","tags":["report"]},{"url":"https://bugzilla.suse.com/1257232","tags":["report"]},{"url":"https://bugzilla.suse.com/1257234","tags":["report"]},{"url":"https://bugzilla.suse.com/1257236","tags":["report"]},{"url":"https://bugzilla.suse.com/1257245","tags":["report"]},{"url":"https://bugzilla.suse.com/1257277","tags":["report"]},{"url":"https://bugzilla.suse.com/1257282","tags":["report"]},{"url":"https://bugzilla.suse.com/1257296","tags":["report"]},{"url":"https://bugzilla.suse.com/1257332","tags":["report"]},{"url":"https://bugzilla.suse.com/1257473","tags":["report"]},{"url":"https://bugzilla.suse.com/1257603","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-37813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38322","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40202","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40363","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68171","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68200","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68301","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68363","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68367","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68768","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68773","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68808","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71077","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71082","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71087","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71094","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71096","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22977","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22992","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22993","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23011","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620498-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620845-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1233640","tags":["report"]},{"url":"https://bugzilla.suse.com/1236022","tags":["report"]},{"url":"https://bugzilla.suse.com/1241345","tags":["report"]},{"url":"https://bugzilla.suse.com/1243055","tags":["report"]},{"url":"https://bugzilla.suse.com/1249587","tags":["report"]},{"url":"https://bugzilla.suse.com/1251966","tags":["report"]},{"url":"https://bugzilla.suse.com/1252911","tags":["report"]},{"url":"https://bugzilla.suse.com/1252924","tags":["report"]},{"url":"https://bugzilla.suse.com/1253622","tags":["report"]},{"url":"https://bugzilla.suse.com/1253691","tags":["report"]},{"url":"https://bugzilla.suse.com/1254992","tags":["report"]},{"url":"https://bugzilla.suse.com/1255129","tags":["report"]},{"url":"https://bugzilla.suse.com/1255265","tags":["report"]},{"url":"https://bugzilla.suse.com/1255379","tags":["report"]},{"url":"https://bugzilla.suse.com/1255530","tags":["report"]},{"url":"https://bugzilla.suse.com/1255698","tags":["report"]},{"url":"https://bugzilla.suse.com/1256564","tags":["report"]},{"url":"https://bugzilla.suse.com/1256640","tags":["report"]},{"url":"https://bugzilla.suse.com/1256679","tags":["report"]},{"url":"https://bugzilla.suse.com/1256683","tags":["report"]},{"url":"https://bugzilla.suse.com/1256708","tags":["report"]},{"url":"https://bugzilla.suse.com/1256716","tags":["report"]},{"url":"https://bugzilla.suse.com/1256755","tags":["report"]},{"url":"https://bugzilla.suse.com/1256802","tags":["report"]},{"url":"https://bugzilla.suse.com/1257159","tags":["report"]},{"url":"https://bugzilla.suse.com/1257179","tags":["report"]},{"url":"https://bugzilla.suse.com/1257209","tags":["report"]},{"url":"https://bugzilla.suse.com/1257228","tags":["report"]},{"url":"https://bugzilla.suse.com/1257231","tags":["report"]},{"url":"https://bugzilla.suse.com/1257246","tags":["report"]},{"url":"https://bugzilla.suse.com/1257552","tags":["report"]},{"url":"https://bugzilla.suse.com/1257554","tags":["report"]},{"url":"https://bugzilla.suse.com/1257557","tags":["report"]},{"url":"https://bugzilla.suse.com/1257559","tags":["report"]},{"url":"https://bugzilla.suse.com/1257560","tags":["report"]},{"url":"https://bugzilla.suse.com/1257562","tags":["report"]},{"url":"https://bugzilla.suse.com/1257570","tags":["report"]},{"url":"https://bugzilla.suse.com/1257573","tags":["report"]},{"url":"https://bugzilla.suse.com/1257576","tags":["report"]},{"url":"https://bugzilla.suse.com/1257579","tags":["report"]},{"url":"https://bugzilla.suse.com/1257580","tags":["report"]},{"url":"https://bugzilla.suse.com/1257586","tags":["report"]},{"url":"https://bugzilla.suse.com/1257635","tags":["report"]},{"url":"https://bugzilla.suse.com/1257679","tags":["report"]},{"url":"https://bugzilla.suse.com/1257687","tags":["report"]},{"url":"https://bugzilla.suse.com/1257704","tags":["report"]},{"url":"https://bugzilla.suse.com/1257706","tags":["report"]},{"url":"https://bugzilla.suse.com/1257707","tags":["report"]},{"url":"https://bugzilla.suse.com/1257714","tags":["report"]},{"url":"https://bugzilla.suse.com/1257715","tags":["report"]},{"url":"https://bugzilla.suse.com/1257716","tags":["report"]},{"url":"https://bugzilla.suse.com/1257718","tags":["report"]},{"url":"https://bugzilla.suse.com/1257722","tags":["report"]},{"url":"https://bugzilla.suse.com/1257723","tags":["report"]},{"url":"https://bugzilla.suse.com/1257729","tags":["report"]},{"url":"https://bugzilla.suse.com/1257735","tags":["report"]},{"url":"https://bugzilla.suse.com/1257739","tags":["report"]},{"url":"https://bugzilla.suse.com/1257740","tags":["report"]},{"url":"https://bugzilla.suse.com/1257741","tags":["report"]},{"url":"https://bugzilla.suse.com/1257743","tags":["report"]},{"url":"https://bugzilla.suse.com/1257745","tags":["report"]},{"url":"https://bugzilla.suse.com/1257749","tags":["report"]},{"url":"https://bugzilla.suse.com/1257750","tags":["report"]},{"url":"https://bugzilla.suse.com/1257757","tags":["report"]},{"url":"https://bugzilla.suse.com/1257758","tags":["report"]},{"url":"https://bugzilla.suse.com/1257759","tags":["report"]},{"url":"https://bugzilla.suse.com/1257761","tags":["report"]},{"url":"https://bugzilla.suse.com/1257762","tags":["report"]},{"url":"https://bugzilla.suse.com/1257763","tags":["report"]},{"url":"https://bugzilla.suse.com/1257765","tags":["report"]},{"url":"https://bugzilla.suse.com/1257768","tags":["report"]},{"url":"https://bugzilla.suse.com/1257770","tags":["report"]},{"url":"https://bugzilla.suse.com/1257772","tags":["report"]},{"url":"https://bugzilla.suse.com/1257775","tags":["report"]},{"url":"https://bugzilla.suse.com/1257776","tags":["report"]},{"url":"https://bugzilla.suse.com/1257788","tags":["report"]},{"url":"https://bugzilla.suse.com/1257789","tags":["report"]},{"url":"https://bugzilla.suse.com/1257790","tags":["report"]},{"url":"https://bugzilla.suse.com/1257805","tags":["report"]},{"url":"https://bugzilla.suse.com/1257808","tags":["report"]},{"url":"https://bugzilla.suse.com/1257809","tags":["report"]},{"url":"https://bugzilla.suse.com/1257811","tags":["report"]},{"url":"https://bugzilla.suse.com/1257813","tags":["report"]},{"url":"https://bugzilla.suse.com/1257816","tags":["report"]},{"url":"https://bugzilla.suse.com/1257830","tags":["report"]},{"url":"https://bugzilla.suse.com/1257891","tags":["report"]},{"url":"https://bugzilla.suse.com/1257952","tags":["report"]},{"url":"https://bugzilla.suse.com/1258153","tags":["report"]},{"url":"https://bugzilla.suse.com/1258181","tags":["report"]},{"url":"https://bugzilla.suse.com/1258184","tags":["report"]},{"url":"https://bugzilla.suse.com/1258222","tags":["report"]},{"url":"https://bugzilla.suse.com/1258234","tags":["report"]},{"url":"https://bugzilla.suse.com/1258237","tags":["report"]},{"url":"https://bugzilla.suse.com/1258245","tags":["report"]},{"url":"https://bugzilla.suse.com/1258249","tags":["report"]},{"url":"https://bugzilla.suse.com/1258252","tags":["report"]},{"url":"https://bugzilla.suse.com/1258256","tags":["report"]},{"url":"https://bugzilla.suse.com/1258259","tags":["report"]},{"url":"https://bugzilla.suse.com/1258272","tags":["report"]},{"url":"https://bugzilla.suse.com/1258273","tags":["report"]},{"url":"https://bugzilla.suse.com/1258277","tags":["report"]},{"url":"https://bugzilla.suse.com/1258278","tags":["report"]},{"url":"https://bugzilla.suse.com/1258279","tags":["report"]},{"url":"https://bugzilla.suse.com/1258299","tags":["report"]},{"url":"https://bugzilla.suse.com/1258304","tags":["report"]},{"url":"https://bugzilla.suse.com/1258309","tags":["report"]},{"url":"https://bugzilla.suse.com/1258313","tags":["report"]},{"url":"https://bugzilla.suse.com/1258317","tags":["report"]},{"url":"https://bugzilla.suse.com/1258321","tags":["report"]},{"url":"https://bugzilla.suse.com/1258326","tags":["report"]},{"url":"https://bugzilla.suse.com/1258338","tags":["report"]},{"url":"https://bugzilla.suse.com/1258349","tags":["report"]},{"url":"https://bugzilla.suse.com/1258354","tags":["report"]},{"url":"https://bugzilla.suse.com/1258358","tags":["report"]},{"url":"https://bugzilla.suse.com/1258374","tags":["report"]},{"url":"https://bugzilla.suse.com/1258377","tags":["report"]},{"url":"https://bugzilla.suse.com/1258379","tags":["report"]},{"url":"https://bugzilla.suse.com/1258394","tags":["report"]},{"url":"https://bugzilla.suse.com/1258395","tags":["report"]},{"url":"https://bugzilla.suse.com/1258397","tags":["report"]},{"url":"https://bugzilla.suse.com/1258411","tags":["report"]},{"url":"https://bugzilla.suse.com/1258415","tags":["report"]},{"url":"https://bugzilla.suse.com/1258419","tags":["report"]},{"url":"https://bugzilla.suse.com/1258422","tags":["report"]},{"url":"https://bugzilla.suse.com/1258424","tags":["report"]},{"url":"https://bugzilla.suse.com/1258429","tags":["report"]},{"url":"https://bugzilla.suse.com/1258442","tags":["report"]},{"url":"https://bugzilla.suse.com/1258464","tags":["report"]},{"url":"https://bugzilla.suse.com/1258465","tags":["report"]},{"url":"https://bugzilla.suse.com/1258468","tags":["report"]},{"url":"https://bugzilla.suse.com/1258469","tags":["report"]},{"url":"https://bugzilla.suse.com/1258484","tags":["report"]},{"url":"https://bugzilla.suse.com/1258518","tags":["report"]},{"url":"https://bugzilla.suse.com/1258519","tags":["report"]},{"url":"https://bugzilla.suse.com/1258520","tags":["report"]},{"url":"https://bugzilla.suse.com/1258524","tags":["report"]},{"url":"https://bugzilla.suse.com/1258544","tags":["report"]},{"url":"https://bugzilla.suse.com/1258660","tags":["report"]},{"url":"https://bugzilla.suse.com/1258824","tags":["report"]},{"url":"https://bugzilla.suse.com/1258928","tags":["report"]},{"url":"https://bugzilla.suse.com/1259070","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-37861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68295","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71071","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71198","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71200","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23026","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23057","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23071","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23076","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23082","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23094","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23096","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23129","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23171","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23173","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23198","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23202","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23213","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23229","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620876-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-54285","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-54285","tags":["report"]},{"url":"https://git.kernel.org/linus/eee2d2e6ea5550118170dbd5bb1316ceb38455fb","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-54285","title":"iomap: Fix possible overflow condition in iomap_write_delalloc_scan","description":"In the Linux kernel, the following vulnerability has been resolved:\n\niomap: Fix possible overflow condition in iomap_write_delalloc_scan\n\nfolio_next_index() returns an unsigned long value which left shifted\nby PAGE_SHIFT could possibly cause an overflow on 32-bit system. Instead\nuse folio_pos(folio) + folio_size(folio), which does this correctly.","status":"published","published":"2025-12-30T12:23:25.77Z","modified":"2026-10-15T21:41:44.022Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:35:15.066338Z"}],"euvd":[{"id":"EUVD-2023-60519","description":"In the Linux kernel, the following vulnerability has been resolved:\n\niomap: Fix possible overflow condition in iomap_write_delalloc_scan\n\nfolio_next_index() returns an unsigned long value which left shifted\nby PAGE_SHIFT could possibly cause an overflow on 32-bit system. Instead\nuse folio_pos(folio) + folio_size(folio), which does this correctly.","status":"published","published":"2025-12-30T12:23:25Z","modified":"2026-10-15T21:41:44Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:00:08.933024Z"}],"ghsa":[{"id":"GHSA-wfvh-f2f6-f56w","title":"In the Linux kernel, the following vulnerability has been resolved:\n\niomap: Fix possible overflow...","description":"In the Linux kernel, the following vulnerability has been resolved:\n\niomap: Fix possible overflow condition in iomap_write_delalloc_scan\n\nfolio_next_index() returns an unsigned long value which left shifted\nby PAGE_SHIFT could possibly cause an overflow on 32-bit system. Instead\nuse folio_pos(folio) + folio_size(folio), which does this correctly.","status":"published","published":"2025-12-30T15:30:34Z","modified":"2026-02-26T21:31:25Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:06:23.326773Z"}],"nvd":[{"id":"CVE-2023-54285","description":"In the Linux kernel, the following vulnerability has been resolved:\n\niomap: Fix possible overflow condition in iomap_write_delalloc_scan\n\nfolio_next_index() returns an unsigned long value which left shifted\nby PAGE_SHIFT could possibly cause an overflow on 32-bit system. Instead\nuse folio_pos(folio) + folio_size(folio), which does this correctly.","status":"published","published":"2025-12-30T13:16:17.52Z","modified":"2026-10-15T22:17:57.43Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:09:27.733183Z"}],"osv":[{"id":"BELL-CVE-2023-54285","status":"published","published":"2025-12-31T06:05:54.964501Z","modified":"2026-02-28T07:07:57.085639Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:19.288949Z"},{"id":"CVE-2023-54285","title":"iomap: Fix possible overflow condition in iomap_write_delalloc_scan","description":"In the Linux kernel, the following vulnerability has been resolved:\n\niomap: Fix possible overflow condition in iomap_write_delalloc_scan\n\nfolio_next_index() returns an unsigned long value which left shifted\nby PAGE_SHIFT could possibly cause an overflow on 32-bit system. Instead\nuse folio_pos(folio) + folio_size(folio), which does this correctly.","status":"published","published":"2025-12-30T12:23:25.77Z","modified":"2026-10-28T02:30:45.788295517Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:36.851042Z"},{"id":"DEBIAN-CVE-2023-54285","description":"In the Linux kernel, the following vulnerability has been resolved:  iomap: Fix possible overflow condition in iomap_write_delalloc_scan  folio_next_index() returns an unsigned long value which left shifted by PAGE_SHIFT could possibly cause an overflow on 32-bit system. Instead use folio_pos(folio) + folio_size(folio), which does this correctly.","status":"published","published":"2025-12-30T13:16:17.52Z","modified":"2026-10-26T18:03:01.877690841Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:41.533064Z"},{"id":"OESA-2026-2580","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niomap: Fix possible overflow condition in iomap_write_delalloc_scan\n\nfolio_next_index() returns an unsigned long value which left shifted\nby PAGE_SHIFT could possibly cause an overflow on 32-bit system. Instead\nuse folio_pos(folio) + folio_size(folio), which does this correctly.(CVE-2023-54285)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbcache: fix NULL pointer in cache_set_flush()\n\n1. LINE#1794 - LINE#1887 is some codes about function of\n   bch_cache_set_alloc().\n2. LINE#2078 - LINE#2142 is some codes about function of\n   register_cache_set().\n3. register_cache_set() will call bch_cache_set_alloc() in LINE#2098.\n\n 1794 struct cache_set *bch_cache_set_alloc(struct cache_sb *sb)\n 1795 {\n ...\n 1860         if (!(c-\u0026gt;devices = kcalloc(c-\u0026gt;nr_uuids, sizeof(void *), GFP_KERNEL)) ||\n 1861             mempool_init_slab_pool(\u0026amp;c-\u0026gt;search, 32, bch_search_cache) ||\n 1862             mempool_init_kmalloc_pool(\u0026amp;c-\u0026gt;bio_meta, 2,\n 1863                                 sizeof(struct bbio) + sizeof(struct bio_vec) *\n 1864                                 bucket_pages(c)) ||\n 1865             mempool_init_kmalloc_pool(\u0026amp;c-\u0026gt;fill_iter, 1, iter_size) ||\n 1866             bioset_init(\u0026amp;c-\u0026gt;bio_split, 4, offsetof(struct bbio, bio),\n 1867                         BIOSET_NEED_BVECS|BIOSET_NEED_RESCUER) ||\n 1868             !(c-\u0026gt;uuids = alloc_bucket_pages(GFP_KERNEL, c)) ||\n 1869             !(c-\u0026gt;moving_gc_wq = alloc_workqueue(\u0026quot;bcache_gc\u0026quot;,\n 1870                                                 WQ_MEM_RECLAIM, 0)) ||\n 1871             bch_journal_alloc(c) ||\n 1872             bch_btree_cache_alloc(c) ||\n 1873             bch_open_buckets_alloc(c) ||\n 1874             bch_bset_sort_state_init(\u0026amp;c-\u0026gt;sort, ilog2(c-\u0026gt;btree_pages)))\n 1875                 goto err;\n                      ^^^^^^^^\n 1876\n ...\n 1883         return c;\n 1884 err:\n 1885         bch_cache_set_unregister(c);\n              ^^^^^^^^^^^^^^^^^^^^^^^^^^^\n 1886         return NULL;\n 1887 }\n ...\n 2078 static const char *register_cache_set(struct cache *ca)\n 2079 {\n ...\n 2098         c = bch_cache_set_alloc(\u0026amp;ca-\u0026gt;sb);\n 2099         if (!c)\n 2100                 return err;\n                      ^^^^^^^^^^\n ...\n 2128         ca-\u0026gt;set = c;\n 2129         ca-\u0026gt;set-\u0026gt;cache[ca-\u0026gt;sb.nr_this_dev] = ca;\n              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n ...\n 2138         return NULL;\n 2139 err:\n 2140         bch_cache_set_unregister(c);\n 2141         return err;\n 2142 }\n\n(1) If LINE#1860 - LINE#1874 is true, then do \u0026apos;goto err\u0026apos;(LINE#1875) and\n    call bch_cache_set_unregister()(LINE#1885).\n(2) As (1) return NULL(LINE#1886), LINE#2098 - LINE#2100 would return.\n(3) As (2) has returned, LINE#2128 - LINE#2129 would do *not* give the\n    value to c-\u0026gt;cache[], it means that c-\u0026gt;cache[] is NULL.\n\nLINE#1624 - LINE#1665 is some codes about function of cache_set_flush().\nAs (1), in LINE#1885 call\nbch_cache_set_unregister()\n---\u0026gt; bch_cache_set_stop()\n     ---\u0026gt; closure_queue()\n          -.-\u0026gt; cache_set_flush() (as below LINE#1624)\n\n 1624 static void cache_set_flush(struct closure *cl)\n 1625 {\n ...\n 1654         for_each_cache(ca, c, i)\n 1655                 if (ca-\u0026gt;alloc_thread)\n                          ^^\n 1656                         kthread_stop(ca-\u0026gt;alloc_thread);\n ...\n 1665 }\n\n(4) In LINE#1655 ca is NULL(see (3)) in cache_set_flush() then the\n    kernel crash occurred as below:\n[  846.712887] bcache: register_cache() error drbd6: cannot allocate memory\n[  846.713242] bcache: register_bcache() error : failed to register device\n[  846.713336] bcache: cache_set_free() Cache set 2f84bdc1-498a-4f2f-98a7-01946bf54287 unregistered\n[  846.713768] BUG: unable to handle kernel NULL pointer dereference at 00000000000009f8\n[  846.714790] PGD 0 P4D 0\n[  846.715129] Oops: 0000 [#1] SMP PTI\n[  846.715472] CPU: 19 PID: 5057 Comm: kworker/19:16 Kdump: loaded Tainted: G           OE    --------- -  - 4.18.0-147.5.1.el8_1.5es.3.x86_64 #1\n[  846.716082] Hardware name: ESPAN GI-25212/X11DPL-i, BIOS 2.1 06/15/2018\n[  846.716451] Workqueue: events cache_set_flush [bcache]\n[  846.716808] RIP: 0010:cache_set_flush+0xc9/0x1b0 [bcache]\n[  846.717155] Code: 00 4c 89 a5 b0 03 00 00 48 8b 85 68 f6 ff ff a8 08 0f 84 88 00 00 00 31 db 66 83 bd 3c f7 ff ff 00 48 8b 85 48 ff ff ff 74 28 \u0026lt;48\u0026gt; 8b b8 f8 09 00 0\n---truncated---(CVE-2025-38263)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\natm: clip: Fix infinite recursive call of clip_push().\n\nsyzbot reported the splat below. [0]\n\nThis happens if we call ioctl(ATMARP_MKIP) more than once.\n\nDuring the first call, clip_mkip() sets clip_push() to vcc-\u0026gt;push(),\nand the second call copies it to clip_vcc-\u0026gt;old_push().\n\nLater, when the socket is close()d, vcc_destroy_socket() passes\nNULL skb to clip_push(), which calls clip_vcc-\u0026gt;old_push(),\ntriggering the infinite recursion.\n\nLet\u0026apos;s prevent the second ioctl(ATMARP_MKIP) by checking\nvcc-\u0026gt;user_back, which is allocated by the first call as clip_vcc.\n\nNote also that we use lock_sock() to prevent racy calls.\n\n[0]:\nBUG: TASK stack guard page was hit at ffffc9000d66fff8 (stack is ffffc9000d670000..ffffc9000d678000)\nOops: stack guard page: 0000 [#1] SMP KASAN NOPTI\nCPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted 6.16.0-rc4-syzkaller #0 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nRIP: 0010:clip_push+0x5/0x720 net/atm/clip.c:191\nCode: e0 8f aa 8c e8 1c ad 5b fa eb ae 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 \u0026lt;41\u0026gt; 57 41 56 41 55 41 54 53 48 83 ec 20 48 89 f3 49 89 fd 48 bd 00\nRSP: 0018:ffffc9000d670000 EFLAGS: 00010246\nRAX: 1ffff1100235a4a5 RBX: ffff888011ad2508 RCX: ffff8880003c0000\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888037f01000\nRBP: dffffc0000000000 R08: ffffffff8fa104f7 R09: 1ffffffff1f4209e\nR10: dffffc0000000000 R11: ffffffff8a99b300 R12: ffffffff8a99b300\nR13: ffff888037f01000 R14: ffff888011ad2500 R15: ffff888037f01578\nFS:  000055557ab6d500(0000) GS:ffff88808d250000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffc9000d66fff8 CR3: 0000000043172000 CR4: 0000000000352ef0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n clip_push+0x6dc/0x720 net/atm/clip.c:200\n clip_push+0x6dc/0x720 net/atm/clip.c:200\n clip_push+0x6dc/0x720 net/atm/clip.c:200\n...\n clip_push+0x6dc/0x720 net/atm/clip.c:200\n clip_push+0x6dc/0x720 net/atm/clip.c:200\n clip_push+0x6dc/0x720 net/atm/clip.c:200\n vcc_destroy_socket net/atm/common.c:183 [inline]\n vcc_release+0x157/0x460 net/atm/common.c:205\n __sock_release net/socket.c:647 [inline]\n sock_close+0xc0/0x240 net/socket.c:1391\n __fput+0x449/0xa70 fs/file_table.c:465\n task_work_run+0x1d1/0x260 kernel/task_work.c:227\n resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]\n exit_to_user_mode_loop+0xec/0x110 kernel/entry/common.c:114\n exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline]\n syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline]\n syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline]\n do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7ff31c98e929\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007fffb5aa1f78 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4\nRAX: 0000000000000000 RBX: 0000000000012747 RCX: 00007ff31c98e929\nRDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003\nRBP: 00007ff31cbb7ba0 R08: 0000000000000001 R09: 0000000db5aa226f\nR10: 00007ff31c7ff030 R11: 0000000000000246 R12: 00007ff31cbb608c\nR13: 00007ff31cbb6080 R14: ffffffffffffffff R15: 00007fffb5aa2090\n \u0026lt;/TASK\u0026gt;\nModules linked in:(CVE-2025-38459)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: prevent A-MSDU attacks in mesh networks\n\nThis patch is a mitigation to prevent the A-MSDU spoofing vulnerability\nfor mesh networks. The initial update to the IEEE 802.11 standard, in\nresponse to the FragAttacks, missed this case (CVE-2025-27558). It can\nbe considered a variant of CVE-2020-24588 but for mesh networks.\n\nThis patch tries to detect if a standard MSDU was turned into an A-MSDU\nby an adversary. This is done by parsing a received A-MSDU as a standard\nMSDU, calculating the length of the Mesh Control header, and seeing if\nthe 6 bytes after this header equal the start of an rfc1042 header. If\nequal, this is a strong indication of an ongoing attack attempt.\n\nThis defense was tested with mac80211_hwsim against a mesh network that\nuses an empty Mesh Address Extension field, i.e., when four addresses\nare used, and when using a 12-byte Mesh Address Extension field, i.e.,\nwhen six addresses are used. Functionality of normal MSDUs and A-MSDUs\nwas also tested, and confirmed working, when using both an empty and\n12-byte Mesh Address Extension field.\n\nIt was also tested with mac80211_hwsim that A-MSDU attacks in non-mesh\nnetworks keep being detected and prevented.\n\nNote that the vulnerability being patched, and the defense being\nimplemented, was also discussed in the following paper and in the\nfollowing IEEE 802.11 presentation:\n\nhttps://papers.mathyvanhoef.com/wisec2025.pdf\nhttps://mentor.ieee.org/802.11/dcn/25/11-25-0949-00-000m-a-msdu-mesh-spoof-protection.docx(CVE-2025-38512)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niwlwifi: Add missing check for alloc_ordered_workqueue\n\nAdd check for the return value of alloc_ordered_workqueue since it may\nreturn NULL pointer.(CVE-2025-38602)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid out-of-boundary access in devs.path\n\n- touch /mnt/f2fs/012345678901234567890123456789012345678901234567890123\n- truncate -s $((1024*1024*1024)) \\\n  /mnt/f2fs/012345678901234567890123456789012345678901234567890123\n- touch /mnt/f2fs/file\n- truncate -s $((1024*1024*1024)) /mnt/f2fs/file\n- mkfs.f2fs /mnt/f2fs/012345678901234567890123456789012345678901234567890123 \\\n  -c /mnt/f2fs/file\n- mount /mnt/f2fs/012345678901234567890123456789012345678901234567890123 \\\n  /mnt/f2fs/loop\n\n[16937.192225] F2FS-fs (loop0): Mount Device [ 0]: /mnt/f2fs/012345678901234567890123456789012345678901234567890123\\xff\\x01,      511,        0 -    3ffff\n[16937.192268] F2FS-fs (loop0): Failed to find devices\n\nIf device path length equals to MAX_PATH_LEN, sbi-\u0026gt;devs.path[] may\nnot end up w/ null character due to path array is fully filled, So\naccidently, fields locate after path[] may be treated as part of\ndevice path, result in parsing wrong device path.\n\nstruct f2fs_dev_info {\n...\n\tchar path[MAX_PATH_LEN];\n...\n};\n\nLet\u0026apos;s add one byte space for sbi-\u0026gt;devs.path[] to store null\ncharacter of device path string.(CVE-2025-38652)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix UAF on smcsk after smc_listen_out()\n\nBPF CI testing report a UAF issue:\n\n  [   16.446633] BUG: kernel NULL pointer dereference, address: 000000000000003  0\n  [   16.447134] #PF: supervisor read access in kernel mod  e\n  [   16.447516] #PF: error_code(0x0000) - not-present pag  e\n  [   16.447878] PGD 0 P4D   0\n  [   16.448063] Oops: Oops: 0000 [#1] PREEMPT SMP NOPT  I\n  [   16.448409] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Tainted: G           OE      6.13.0-rc3-g89e8a75fda73-dirty #4  2\n  [   16.449124] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODUL  E\n  [   16.449502] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/201  4\n  [   16.450201] Workqueue: smc_hs_wq smc_listen_wor  k\n  [   16.450531] RIP: 0010:smc_listen_work+0xc02/0x159  0\n  [   16.452158] RSP: 0018:ffffb5ab40053d98 EFLAGS: 0001024  6\n  [   16.452526] RAX: 0000000000000001 RBX: 0000000000000002 RCX: 000000000000030  0\n  [   16.452994] RDX: 0000000000000280 RSI: 00003513840053f0 RDI: 000000000000000  0\n  [   16.453492] RBP: ffffa097808e3800 R08: ffffa09782dba1e0 R09: 000000000000000  5\n  [   16.453987] R10: 0000000000000000 R11: 0000000000000000 R12: ffffa0978274640  0\n  [   16.454497] R13: 0000000000000000 R14: 0000000000000000 R15: ffffa09782d4092  0\n  [   16.454996] FS:  0000000000000000(0000) GS:ffffa097bbc00000(0000) knlGS:000000000000000  0\n  [   16.455557] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003  3\n  [   16.455961] CR2: 0000000000000030 CR3: 0000000102788004 CR4: 0000000000770ef  0\n  [   16.456459] PKRU: 5555555  4\n  [   16.456654] Call Trace  :\n  [   16.456832]  \u0026lt;TASK  \u0026gt;\n  [   16.456989]  ? __die+0x23/0x7  0\n  [   16.457215]  ? page_fault_oops+0x180/0x4c  0\n  [   16.457508]  ? __lock_acquire+0x3e6/0x249  0\n  [   16.457801]  ? exc_page_fault+0x68/0x20  0\n  [   16.458080]  ? asm_exc_page_fault+0x26/0x3  0\n  [   16.458389]  ? smc_listen_work+0xc02/0x159  0\n  [   16.458689]  ? smc_listen_work+0xc02/0x159  0\n  [   16.458987]  ? lock_is_held_type+0x8f/0x10  0\n  [   16.459284]  process_one_work+0x1ea/0x6d  0\n  [   16.459570]  worker_thread+0x1c3/0x38  0\n  [   16.459839]  ? __pfx_worker_thread+0x10/0x1  0\n  [   16.460144]  kthread+0xe0/0x11  0\n  [   16.460372]  ? __pfx_kthread+0x10/0x1  0\n  [   16.460640]  ret_from_fork+0x31/0x5  0\n  [   16.460896]  ? __pfx_kthread+0x10/0x1  0\n  [   16.461166]  ret_from_fork_asm+0x1a/0x3  0\n  [   16.461453]  \u0026lt;/TASK  \u0026gt;\n  [   16.461616] Modules linked in: bpf_testmod(OE) [last unloaded: bpf_testmod(OE)  ]\n  [   16.462134] CR2: 000000000000003  0\n  [   16.462380] ---[ end trace 0000000000000000 ]---\n  [   16.462710] RIP: 0010:smc_listen_work+0xc02/0x1590\n\nThe direct cause of this issue is that after smc_listen_out_connected(),\nnewclcsock-\u0026gt;sk may be NULL since it will releases the smcsk. Therefore,\nif the application closes the socket immediately after accept,\nnewclcsock-\u0026gt;sk can be NULL. A possible execution order could be as\nfollows:\n\nsmc_listen_work                                 | userspace\n-----------------------------------------------------------------\nlock_sock(sk)                                   |\nsmc_listen_out_connected()                      |\n| \\- smc_listen_out                             |\n|    | \\- release_sock                          |\n     | |- sk-\u0026gt;sk_data_ready()                   |\n                                                | fd = accept();\n                                                | close(fd);\n                                                |  \\- socket-\u0026gt;sk = NULL;\n/* newclcsock-\u0026gt;sk is NULL now */\nSMC_STAT_SERV_SUCC_INC(sock_net(newclcsock-\u0026gt;sk))\n\nSince smc_listen_out_connected() will not fail, simply swapping the order\nof the code can easily fix this issue.(CVE-2025-38734)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not allow relocation of partially dropped subvolumes\n\n[BUG]\nThere is an internal report that balance triggered transaction abort,\nwith the following call trace:\n\n  item 85 key (594509824 169 0) itemoff 12599 itemsize 33\n          extent refs 1 gen 197740 flags 2\n          ref#0: tree block backref root 7\n  item 86 key (594558976 169 0) itemoff 12566 itemsize 33\n          extent refs 1 gen 197522 flags 2\n          ref#0: tree block backref root 7\n ...\n BTRFS error (device loop0): extent item not found for insert, bytenr 594526208 num_bytes 16384 parent 449921024 root_objectid 934 owner 1 offset 0\n BTRFS error (device loop0): failed to run delayed ref for logical 594526208 num_bytes 16384 type 182 action 1 ref_mod 1: -117\n ------------[ cut here ]------------\n BTRFS: Transaction aborted (error -117)\n WARNING: CPU: 1 PID: 6963 at ../fs/btrfs/extent-tree.c:2168 btrfs_run_delayed_refs+0xfa/0x110 [btrfs]\n\nAnd btrfs check doesn\u0026apos;t report anything wrong related to the extent\ntree.\n\n[CAUSE]\nThe cause is a little complex, firstly the extent tree indeed doesn\u0026apos;t\nhave the backref for 594526208.\n\nThe extent tree only have the following two backrefs around that bytenr\non-disk:\n\n        item 65 key (594509824 METADATA_ITEM 0) itemoff 13880 itemsize 33\n                refs 1 gen 197740 flags TREE_BLOCK\n                tree block skinny level 0\n                (176 0x7) tree block backref root CSUM_TREE\n        item 66 key (594558976 METADATA_ITEM 0) itemoff 13847 itemsize 33\n                refs 1 gen 197522 flags TREE_BLOCK\n                tree block skinny level 0\n                (176 0x7) tree block backref root CSUM_TREE\n\nBut the such missing backref item is not an corruption on disk, as the\noffending delayed ref belongs to subvolume 934, and that subvolume is\nbeing dropped:\n\n        item 0 key (934 ROOT_ITEM 198229) itemoff 15844 itemsize 439\n                generation 198229 root_dirid 256 bytenr 10741039104 byte_limit 0 bytes_used 345571328\n                last_snapshot 198229 flags 0x1000000000001(RDONLY) refs 0\n                drop_progress key (206324 EXTENT_DATA 2711650304) drop_level 2\n                level 2 generation_v2 198229\n\nAnd that offending tree block 594526208 is inside the dropped range of\nthat subvolume.  That explains why there is no backref item for that\nbytenr and why btrfs check is not reporting anything wrong.\n\nBut this also shows another problem, as btrfs will do all the orphan\nsubvolume cleanup at a read-write mount.\n\nSo half-dropped subvolume should not exist after an RW mount, and\nbalance itself is also exclusive to subvolume cleanup, meaning we\nshouldn\u0026apos;t hit a subvolume half-dropped during relocation.\n\nThe root cause is, there is no orphan item for this subvolume.\nIn fact there are 5 subvolumes from around 2021 that have the same\nproblem.\n\nIt looks like the original report has some older kernels running, and\ncaused those zombie subvolumes.\n\nThankfully upstream commit 8d488a8c7ba2 (\u0026quot;btrfs: fix subvolume/snapshot\ndeletion not triggered on mount\u0026quot;) has long fixed the bug.\n\n[ENHANCEMENT]\nFor repairing such old fs, btrfs-progs will be enhanced.\n\nConsidering how delayed the problem will show up (at run delayed ref\ntime) and at that time we have to abort transaction already, it is too\nlate.\n\nInstead here we reject any half-dropped subvolume for reloc tree at the\nearliest time, preventing confusion and extra time wasted on debugging\nsimilar bugs.(CVE-2025-39738)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE\n\nOn Google gs101, the number of UTP transfer request slots (nutrs) is 32,\nand in this case the driver ends up programming the UTRL_NEXUS_TYPE\nincorrectly as 0.\n\nThis is because the left hand side of the shift is 1, which is of type\nint, i.e. 31 bits wide. Shifting by more than that width results in\nundefined behaviour.\n\nFix this by switching to the BIT() macro, which applies correct type\ncasting as required. This ensures the correct value is written to\nUTRL_NEXUS_TYPE (0xffffffff on gs101), and it also fixes a UBSAN shift\nwarning:\n\n    UBSAN: shift-out-of-bounds in drivers/ufs/host/ufs-exynos.c:1113:21\n    shift exponent 32 is too large for 32-bit type \u0026apos;int\u0026apos;\n\nFor consistency, apply the same change to the nutmrs / UTMRL_NEXUS_TYPE\nwrite.(CVE-2025-39788)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: fix use-after-free in cmp_bss()\n\nFollowing bss_free() quirk introduced in commit 776b3580178f\n(\u0026quot;cfg80211: track hidden SSID networks properly\u0026quot;), adjust\ncfg80211_update_known_bss() to free the last beacon frame\nelements only if they\u0026apos;re not shared via the corresponding\n\u0026apos;hidden_beacon_bss\u0026apos; pointer.(CVE-2025-39864)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: increase scan_ies_len for S1G\n\nCurrently the S1G capability element is not taken into account\nfor the scan_ies_len, which leads to a buffer length validation\nfailure in ieee80211_prep_hw_scan() and subsequent WARN in\n__ieee80211_start_scan(). This prevents hw scanning from functioning.\nTo fix ensure we accommodate for the S1G capability length.(CVE-2025-39957)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match().\n\nsmc_clc_prfx_match() is called from smc_listen_work() and\nnot under RCU nor RTNL.\n\nUsing sk_dst_get(sk)-\u0026gt;dev could trigger UAF.\n\nLet\u0026apos;s use __sk_dst_get() and dst_dev_rcu().\n\nNote that the returned value of smc_clc_prfx_match() is not\nused in the caller.(CVE-2025-40168)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/radeon: delete radeon_fence_process in is_signaled, no deadlock\n\nDelete the attempt to progress the queue when checking if fence is\nsignaled. This avoids deadlock.\n\ndma-fence_ops::signaled can be called with the fence lock in unknown\nstate. For radeon, the fence lock is also the wait queue lock. This can\ncause a self deadlock when signaled() tries to make forward progress on\nthe wait queue. But advancing the queue is unneeded because incorrectly\nreturning false from signaled() is perfectly acceptable.\n\n(cherry picked from commit 527ba26e50ec2ca2be9c7c82f3ad42998a75d0db)(CVE-2025-68223)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nteam: Move team device type change at the end of team_port_add\n\nAttempting to add a port device that is already up will expectedly fail,\nbut not before modifying the team device header_ops.\n\nIn the case of the syzbot reproducer the gre0 device is\nalready in state UP when it attempts to add it as a\nport device of team0, this fails but before that\nheader_ops-\u0026gt;create of team0 is changed from eth_header to ipgre_header\nin the call to team_dev_type_check_change.\n\nLater when we end up in ipgre_header() struct ip_tunnel* points to nonsense\nas the private data of the device still holds a struct team.\n\nExample sequence of iproute2 commands to reproduce the hang/BUG():\nip link add dev team0 type team\nip link add dev gre0 type gre\nip link set dev gre0 up\nip link set dev gre0 master team0\nip link set dev team0 up\nping -I team0 1.1.1.1\n\nMove team_dev_type_check_change down where all other checks have passed\nas it changes the dev type with no way to restore it in case\none of the checks that follow it fail.\n\nAlso make sure to preserve the origial mtu assignment:\n  - If port_dev is not the same type as dev, dev takes mtu from port_dev\n  - If port_dev is the same type as dev, port_dev takes mtu from dev\n\nThis is done by adding a conditional before the call to dev_set_mtu\nto prevent it from assigning port_dev-\u0026gt;mtu = dev-\u0026gt;mtu and instead\nletting team_dev_type_check_change assign dev-\u0026gt;mtu = port_dev-\u0026gt;mtu.\nThe conditional is needed because the patch moves the call to\nteam_dev_type_check_change past dev_set_mtu.\n\nTesting:\n  - team device driver in-tree selftests\n  - Add/remove various devices as slaves of team device\n  - syzbot(CVE-2025-68340)\n\nRejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.(CVE-2025-68789)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipvs: fix ipv4 null-ptr-deref in route error path\n\nThe IPv4 code path in __ip_vs_get_out_rt() calls dst_link_failure()\nwithout ensuring skb-\u0026gt;dev is set, leading to a NULL pointer dereference\nin fib_compute_spec_dst() when ipv4_link_failure() attempts to send\nICMP destination unreachable messages.\n\nThe issue emerged after commit ed0de45a1008 (\u0026quot;ipv4: recompile ip options\nin ipv4_link_failure\u0026quot;) started calling __ip_options_compile() from\nipv4_link_failure(). This code path eventually calls fib_compute_spec_dst()\nwhich dereferences skb-\u0026gt;dev. An attempt was made to fix the NULL skb-\u0026gt;dev\ndereference in commit 0113d9c9d1cc (\u0026quot;ipv4: fix null-deref in\nipv4_link_failure\u0026quot;), but it only addressed the immediate dev_net(skb-\u0026gt;dev)\ndereference by using a fallback device. The fix was incomplete because\nfib_compute_spec_dst() later in the call chain still accesses skb-\u0026gt;dev\ndirectly, which remains NULL when IPVS calls dst_link_failure().\n\nThe crash occurs when:\n1. IPVS processes a packet in NAT mode with a misconfigured destination\n2. Route lookup fails in __ip_vs_get_out_rt() before establishing a route\n3. The error path calls dst_link_failure(skb) with skb-\u0026gt;dev == NULL\n4. ipv4_link_failure() → ipv4_send_dest_unreach() →\n   __ip_options_compile() → fib_compute_spec_dst()\n5. fib_compute_spec_dst() dereferences NULL skb-\u0026gt;dev\n\nApply the same fix used for IPv6 in commit 326bf17ea5d4 (\u0026quot;ipvs: fix\nipv6 route unreach panic\u0026quot;): set skb-\u0026gt;dev from skb_dst(skb)-\u0026gt;dev before\ncalling dst_link_failure().\n\nKASAN: null-ptr-deref in range [0x0000000000000328-0x000000000000032f]\nCPU: 1 PID: 12732 Comm: syz.1.3469 Not tainted 6.6.114 #2\nRIP: 0010:__in_dev_get_rcu include/linux/inetdevice.h:233\nRIP: 0010:fib_compute_spec_dst+0x17a/0x9f0 net/ipv4/fib_frontend.c:285\nCall Trace:\n  \u0026lt;TASK\u0026gt;\n  spec_dst_fill net/ipv4/ip_options.c:232\n  spec_dst_fill net/ipv4/ip_options.c:229\n  __ip_options_compile+0x13a1/0x17d0 net/ipv4/ip_options.c:330\n  ipv4_send_dest_unreach net/ipv4/route.c:1252\n  ipv4_link_failure+0x702/0xb80 net/ipv4/route.c:1265\n  dst_link_failure include/net/dst.h:437\n  __ip_vs_get_out_rt+0x15fd/0x19e0 net/netfilter/ipvs/ip_vs_xmit.c:412\n  ip_vs_nat_xmit+0x1d8/0xc80 net/netfilter/ipvs/ip_vs_xmit.c:764(CVE-2025-68813)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nntfs: set dummy blocksize to read boot_block when mounting\n\nWhen mounting, sb-\u0026gt;s_blocksize is used to read the boot_block without\nbeing defined or validated. Set a dummy blocksize before attempting to\nread the boot_block.\n\nThe issue can be triggered with the following syz reproducer:\n\n  mkdirat(0xffffffffffffff9c, \u0026amp;(0x7f0000000080)=\u0026apos;./file1\\x00\u0026apos;, 0x0)\n  r4 = openat$nullb(0xffffffffffffff9c, \u0026amp;(0x7f0000000040), 0x121403, 0x0)\n  ioctl$FS_IOC_SETFLAGS(r4, 0x40081271, \u0026amp;(0x7f0000000980)=0x4000)\n  mount(\u0026amp;(0x7f0000000140)=@nullb, \u0026amp;(0x7f0000000040)=\u0026apos;./cgroup\\x00\u0026apos;,\n        \u0026amp;(0x7f0000000000)=\u0026apos;ntfs3\\x00\u0026apos;, 0x2208004, 0x0)\n  syz_clone(0x88200200, 0x0, 0x0, 0x0, 0x0, 0x0)\n\nHere, the ioctl sets the bdev block size to 16384. During mount,\nget_tree_bdev_flags() calls sb_set_blocksize(sb, block_size(bdev)),\nbut since block_size(bdev) \u0026gt; PAGE_SIZE, sb_set_blocksize() leaves\nsb-\u0026gt;s_blocksize at zero.\n\nLater, ntfs_init_from_boot() attempts to read the boot_block while\nsb-\u0026gt;s_blocksize is still zero, which triggers the bug.\n\n[(CVE-2025-71067)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()\n\nThere exists a kernel oops caused by a BUG_ON(nhead \u0026lt; 0) at\nnet/core/skbuff.c:2232 in pskb_expand_head().\nThis bug is triggered as part of the calipso_skbuff_setattr()\nroutine when skb_cow() is passed headroom \u0026gt; INT_MAX\n(i.e. (int)(skb_headroom(skb) + len_delta) \u0026lt; 0).\n\nThe root cause of the bug is due to an implicit integer cast in\n__skb_cow(). The check (headroom \u0026gt; skb_headroom(skb)) is meant to ensure\nthat delta = headroom - skb_headroom(skb) is never negative, otherwise\nwe will trigger a BUG_ON in pskb_expand_head(). However, if\nheadroom \u0026gt; INT_MAX and delta \u0026lt;= -NET_SKB_PAD, the check passes, delta\nbecomes negative, and pskb_expand_head() is passed a negative value for\nnhead.\n\nFix the trigger condition in calipso_skbuff_setattr(). Avoid passing\n\u0026quot;negative\u0026quot; headroom sizes to skb_cow() within calipso_skbuff_setattr()\nby only using skb_cow() to grow headroom.\n\nPoC:\n\tUsing `netlabelctl` tool:\n\n        netlabelctl map del default\n        netlabelctl calipso add pass doi:7\n        netlabelctl map add default address:0::1/128 protocol:calipso,7\n\n        Then run the following PoC:\n\n        int fd = socket(AF_INET6, SOCK_DGRAM, IPPROTO_UDP);\n\n        // setup msghdr\n        int cmsg_size = 2;\n        int cmsg_len = 0x60;\n        struct msghdr msg;\n        struct sockaddr_in6 dest_addr;\n        struct cmsghdr * cmsg = (struct cmsghdr *) calloc(1,\n                        sizeof(struct cmsghdr) + cmsg_len);\n        msg.msg_name = \u0026amp;dest_addr;\n        msg.msg_namelen = sizeof(dest_addr);\n        msg.msg_iov = NULL;\n        msg.msg_iovlen = 0;\n        msg.msg_control = cmsg;\n        msg.msg_controllen = cmsg_len;\n        msg.msg_flags = 0;\n\n        // setup sockaddr\n        dest_addr.sin6_family = AF_INET6;\n        dest_addr.sin6_port = htons(31337);\n        dest_addr.sin6_flowinfo = htonl(31337);\n        dest_addr.sin6_addr = in6addr_loopback;\n        dest_addr.sin6_scope_id = 31337;\n\n        // setup cmsghdr\n        cmsg-\u0026gt;cmsg_len = cmsg_len;\n        cmsg-\u0026gt;cmsg_level = IPPROTO_IPV6;\n        cmsg-\u0026gt;cmsg_type = IPV6_HOPOPTS;\n        char * hop_hdr = (char *)cmsg + sizeof(struct cmsghdr);\n        hop_hdr[1] = 0x9; //set hop size - (0x9 + 1) * 8 = 80\n\n        sendmsg(fd, \u0026amp;msg, 0);(CVE-2025-71085)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmacvlan: fix possible UAF in macvlan_forward_source()\n\nAdd RCU protection on (struct macvlan_source_entry)-\u0026gt;vlan.\n\nWhenever macvlan_hash_del_source() is called, we must clear\nentry-\u0026gt;vlan pointer before RCU grace period starts.\n\nThis allows macvlan_forward_source() to skip over\nentries queued for freeing.\n\nNote that macvlan_dev are already RCU protected, as they\nare embedded in a standard netdev (netdev_priv(ndev)).\n\nhttps: //lore.kernel.org/netdev/(CVE-2026-23001)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Enforce that teql can only be used as root qdisc\n\nDesign intent of teql is that it is only supposed to be used as root qdisc.\nWe need to check for that constraint.\n\nAlthough not important, I will describe the scenario that unearthed this\nissue for the curious.\n\nGangMin Kim \u0026lt;(CVE-2026-23074)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\narm64/fpsimd: signal: Allocate SSVE storage when restoring ZA\n\nThe code to restore a ZA context doesn\u0026apos;t attempt to allocate the task\u0026apos;s\nsve_state before setting TIF_SME. Consequently, restoring a ZA context\ncan place a task into an invalid state where TIF_SME is set but the\ntask\u0026apos;s sve_state is NULL.\n\nIn legitimate but uncommon cases where the ZA signal context was NOT\ncreated by the kernel in the context of the same task (e.g. if the task\nis saved/restored with something like CRIU), we have no guarantee that\nsve_state had been allocated previously. In these cases, userspace can\nenter streaming mode without trapping while sve_state is NULL, causing a\nlater NULL pointer dereference when the kernel attempts to store the\nregister state:\n\n| # ./sigreturn-za\n| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\n| Mem abort info:\n|   ESR = 0x0000000096000046\n|   EC = 0x25: DABT (current EL), IL = 32 bits\n|   SET = 0, FnV = 0\n|   EA = 0, S1PTW = 0\n|   FSC = 0x06: level 2 translation fault\n| Data abort info:\n|   ISV = 0, ISS = 0x00000046, ISS2 = 0x00000000\n|   CM = 0, WnR = 1, TnD = 0, TagAccess = 0\n|   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n| user pgtable: 4k pages, 52-bit VAs, pgdp=0000000101f47c00\n| [0000000000000000] pgd=08000001021d8403, p4d=0800000102274403, pud=0800000102275403, pmd=0000000000000000\n| Internal error: Oops: 0000000096000046 [#1]  SMP\n| Modules linked in:\n| CPU: 0 UID: 0 PID: 153 Comm: sigreturn-za Not tainted 6.19.0-rc1 #1 PREEMPT\n| Hardware name: linux,dummy-virt (DT)\n| pstate: 214000c9 (nzCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n| pc : sve_save_state+0x4/0xf0\n| lr : fpsimd_save_user_state+0xb0/0x1c0\n| sp : ffff80008070bcc0\n| x29: ffff80008070bcc0 x28: fff00000c1ca4c40 x27: 63cfa172fb5cf658\n| x26: fff00000c1ca5228 x25: 0000000000000000 x24: 0000000000000000\n| x23: 0000000000000000 x22: fff00000c1ca4c40 x21: fff00000c1ca4c40\n| x20: 0000000000000020 x19: fff00000ff6900f0 x18: 0000000000000000\n| x17: fff05e8e0311f000 x16: 0000000000000000 x15: 028fca8f3bdaf21c\n| x14: 0000000000000212 x13: fff00000c0209f10 x12: 0000000000000020\n| x11: 0000000000200b20 x10: 0000000000000000 x9 : fff00000ff69dcc0\n| x8 : 00000000000003f2 x7 : 0000000000000001 x6 : fff00000c1ca5b48\n| x5 : fff05e8e0311f000 x4 : 0000000008000000 x3 : 0000000000000000\n| x2 : 0000000000000001 x1 : fff00000c1ca5970 x0 : 0000000000000440\n| Call trace:\n|  sve_save_state+0x4/0xf0 (P)\n|  fpsimd_thread_switch+0x48/0x198\n|  __switch_to+0x20/0x1c0\n|  __schedule+0x36c/0xce0\n|  schedule+0x34/0x11c\n|  exit_to_user_mode_loop+0x124/0x188\n|  el0_interrupt+0xc8/0xd8\n|  __el0_irq_handler_common+0x18/0x24\n|  el0t_64_irq_handler+0x10/0x1c\n|  el0t_64_irq+0x198/0x19c\n| Code: 54000040 d51b4408 d65f03c0 d503245f (e5bb5800)\n| ---[ end trace 0000000000000000 ]---\n\nFix this by having restore_za_context() ensure that the task\u0026apos;s sve_state\nis allocated, matching what we do when taking an SME trap. Any live\nSVE/SSVE state (which is restored earlier from a separate signal\ncontext) must be preserved, and hence this is not zeroed.(CVE-2026-23107)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: unconditionally bump set-\u0026gt;nelems before insertion\n\nIn case that the set is full, a new element gets published then removed\nwithout waiting for the RCU grace period, while RCU reader can be\nwalking over it already.\n\nTo address this issue, add the element transaction even if set is full,\nbut toggle the set_full flag to report -ENFILE so the abort path safely\nunwinds the set to its previous state.\n\nAs for element updates, decrement set-\u0026gt;nelems to restore it.\n\nA simpler fix is to call synchronize_rcu() in the error path.\nHowever, with a large batch adding elements to already maxed-out set,\nthis could cause noticeable slowdown of such batches.(CVE-2026-23272)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Use correct version for UAC3 header validation\n\nThe entry of the validators table for UAC3 AC header descriptor is\ndefined with the wrong protocol version UAC_VERSION_2, while it should\nhave been UAC_VERSION_3.  This results in the validator never matching\nfor actual UAC3 devices (protocol == UAC_VERSION_3), causing their\nheader descriptors to bypass validation entirely.  A malicious USB\ndevice presenting a truncated UAC3 header could exploit this to cause\nout-of-bounds reads when the driver later accesses unvalidated\ndescriptor fields.\n\nThe bug was introduced in the same commit as the recently fixed UAC3\nfeature unit sub-type typo, and appears to be from the same copy-paste\nerror when the UAC3 section was created from the UAC2 section.(CVE-2026-23318)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: fix folio isn\u0026apos;t locked in softleaf_to_folio()\n\nOn arm64 server, we found folio that get from migration entry isn\u0026apos;t locked\nin softleaf_to_folio().  This issue triggers when mTHP splitting and\nzap_nonpresent_ptes() races, and the root cause is lack of memory barrier\nin softleaf_to_folio().  The race is as follows:\n\n\tCPU0                                             CPU1\n\ndeferred_split_scan()                              zap_nonpresent_ptes()\n  lock folio\n  split_folio()\n    unmap_folio()\n      change ptes to migration entries\n    __split_folio_to_order()                         softleaf_to_folio()\n      set flags(including PG_locked) for tail pages    folio = pfn_folio(softleaf_to_pfn(entry))\n      smp_wmb()                                        VM_WARN_ON_ONCE(!folio_test_locked(folio))\n      prep_compound_page() for tail pages\n\nIn __split_folio_to_order(), smp_wmb() guarantees page flags of tail pages\nare visible before the tail page becomes non-compound.  smp_wmb() should\nbe paired with smp_rmb() in softleaf_to_folio(), which is missed.  As a\nresult, if zap_nonpresent_ptes() accesses migration entry that stores tail\npfn, softleaf_to_folio() may see the updated compound_head of tail page\nbefore page-\u0026gt;flags.\n\nThis issue will trigger VM_WARN_ON_ONCE() in pfn_swap_entry_folio()\nbecause of the race between folio split and zap_nonpresent_ptes()\nleading to a folio incorrectly undergoing modification without a folio\nlock being held.\n\nThis is a BUG_ON() before commit 93976a20345b (\u0026quot;mm: eliminate further\nswapops predicates\u0026quot;), which in merged in v6.19-rc1.\n\nTo fix it, add missing smp_rmb() if the softleaf entry is migration entry\nin softleaf_to_folio() and softleaf_to_page().\n\n[(CVE-2026-31466)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Use scratch field in MMIO fragment to hold small write values\n\nWhen exiting to userspace to service an emulated MMIO write, copy the\nto-be-written value to a scratch field in the MMIO fragment if the size\nof the data payload is 8 bytes or less, i.e. can fit in a single chunk,\ninstead of pointing the fragment directly at the source value.\n\nThis fixes a class of use-after-free bugs that occur when the emulator\ninitiates a write using an on-stack, local variable as the source, the\nwrite splits a page boundary, *and* both pages are MMIO pages.  Because\nKVM\u0026apos;s ABI only allows for physically contiguous MMIO requests, accesses\nthat split MMIO pages are separated into two fragments, and are sent to\nuserspace one at a time.  When KVM attempts to complete userspace MMIO in\nresponse to KVM_RUN after the first fragment, KVM will detect the second\nfragment and generate a second userspace exit, and reference the on-stack\nvariable.\n\nThe issue is most visible if the second KVM_RUN is performed by a separate\ntask, in which case the stack of the initiating task can show up as truly\nfreed data.\n\n  ==================================================================\n  BUG: KASAN: use-after-free in complete_emulated_mmio+0x305/0x420\n  Read of size 1 at addr ffff888009c378d1 by task syz-executor417/984\n\n  CPU: 1 PID: 984 Comm: syz-executor417 Not tainted 5.10.0-182.0.0.95.h2627.eulerosv2r13.x86_64 #3\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 Call Trace:\n  dump_stack+0xbe/0xfd\n  print_address_description.constprop.0+0x19/0x170\n  __kasan_report.cold+0x6c/0x84\n  kasan_report+0x3a/0x50\n  check_memory_region+0xfd/0x1f0\n  memcpy+0x20/0x60\n  complete_emulated_mmio+0x305/0x420\n  kvm_arch_vcpu_ioctl_run+0x63f/0x6d0\n  kvm_vcpu_ioctl+0x413/0xb20\n  __se_sys_ioctl+0x111/0x160\n  do_syscall_64+0x30/0x40\n  entry_SYSCALL_64_after_hwframe+0x67/0xd1\n  RIP: 0033:0x42477d\n  Code: \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\n  RSP: 002b:00007faa8e6890e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\n  RAX: ffffffffffffffda RBX: 00000000004d7338 RCX: 000000000042477d\n  RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005\n  RBP: 00000000004d7330 R08: 00007fff28d546df R09: 0000000000000000\n  R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004d733c\n  R13: 0000000000000000 R14: 000000000040a200 R15: 00007fff28d54720\n\n  The buggy address belongs to the page:\n  page:0000000029f6a428 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9c37\n  flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff)\n  raw: 000fffffc0000000 0000000000000000 ffffea0000270dc8 0000000000000000\n  raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected\n\n  Memory state around the buggy address:\n  ffff888009c37780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n  ffff888009c37800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n  \u0026gt;ffff888009c37880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n                                                   ^\n  ffff888009c37900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n  ffff888009c37980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n  ==================================================================\n\nThe bug can also be reproduced with a targeted KVM-Unit-Test by hacking\nKVM to fill a large on-stack variable in complete_emulated_mmio(), i.e. by\noverwrite the data value with garbage.\n\nLimit the use of the scratch fields to 8-byte or smaller accesses, and to\njust writes, as larger accesses and reads are not affected thanks to\nimplementation details in the emulator, but add a sanity check to ensure\nthose details don\u0026apos;t change in the future.  Specifically, KVM never uses\non-stack variables for accesses larger that 8 bytes, e.g. uses an operand\nin the emulator context, and *al\n---truncated---(CVE-2026-31588)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nALSA: fireworks: bound device-supplied status before string array lookup\n\nThe status field in an EFW response is a 32-bit value supplied by the\nfirewire device.  efr_status_names[] has 17 entries so a status value\noutside that range goes off into the weeds when looking at the %s value.\n\nEven worse, the status could return EFR_STATUS_INCOMPLETE which is\n0x80000000, and is obviously not in that array of potential strings.\n\nFix this up by properly bounding the index against the array size and\nprinting \u0026quot;unknown\u0026quot; if it\u0026apos;s not recognized.(CVE-2026-31619)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG\n\nThe GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements\nbc_ackers on every inbound group ACK, even when the same member has\nalready acknowledged the current broadcast round.\n\nBecause bc_ackers is a u16, a duplicate ACK received after the last\nlegitimate ACK wraps the counter to 65535. Once wrapped,\ntipc_group_bc_cong() keeps reporting congestion and later group\nbroadcasts on the affected socket stay blocked until the group is\nrecreated.\n\nFix this by ignoring duplicate or stale ACKs before touching bc_acked or\nbc_ackers. This makes repeated GRP_ACK_MSG handling idempotent and\nprevents the underflow path.(CVE-2026-31662)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: defer tunnel netdev_put to RCU release\n\novs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already\ndetached the device. Dropping the netdev reference in destroy can race\nwith concurrent readers that still observe vport-\u0026gt;dev.\n\nDo not release vport-\u0026gt;dev in ovs_netdev_tunnel_destroy(). Instead, let\nvport_netdev_free() drop the reference from the RCU callback, matching\nthe non-tunnel destroy path and avoiding additional synchronization\nunder RTNL.(CVE-2026-31678)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: require minimum ACE size in smb_check_perm_dacl()\n\nBoth ACE-walk loops in smb_check_perm_dacl() only guard against an\nunder-sized remaining buffer, not against an ACE whose declared\n`ace-\u0026gt;size` is smaller than the struct it claims to describe:\n\n  if (offsetof(struct smb_ace, access_req) \u0026gt; aces_size)\n      break;\n  ace_size = le16_to_cpu(ace-\u0026gt;size);\n  if (ace_size \u0026gt; aces_size)\n      break;\n\nThe first check only requires the 4-byte ACE header to be in bounds;\nit does not require access_req (4 bytes at offset 4) to be readable.\nAn attacker who has set a crafted DACL on a file they own can declare\nace-\u0026gt;size == 4 with aces_size == 4, pass both checks, and then\n\n  granted |= le32_to_cpu(ace-\u0026gt;access_req);               /* upper loop */\n  compare_sids(\u0026amp;sid, \u0026amp;ace-\u0026gt;sid);                         /* lower loop */\n\nreads access_req at offset 4 (OOB by up to 4 bytes) and ace-\u0026gt;sid at\noffset 8 (OOB by up to CIFS_SID_BASE_SIZE + SID_MAX_SUB_AUTHORITIES\n* 4 bytes).\n\nTighten both loops to require\n\n  ace_size \u0026gt;= offsetof(struct smb_ace, sid) + CIFS_SID_BASE_SIZE\n\nwhich is the smallest valid on-wire ACE layout (4-byte header +\n4-byte access_req + 8-byte sid base with zero sub-auths).  Also\nreject ACEs whose sid.num_subauth exceeds SID_MAX_SUB_AUTHORITIES\nbefore letting compare_sids() dereference sub_auth[] entries.\n\nparse_sec_desc() already enforces an equivalent check (lines 441-448);\nsmb_check_perm_dacl() simply grew weaker validation over time.\n\nReachability: authenticated SMB client with permission to set an ACL\non a file.  On a subsequent CREATE against that file, the kernel\nwalks the stored DACL via smb_check_perm_dacl() and triggers the\nOOB read.  Not pre-auth, and the OOB read is not reflected to the\nattacker, but KASAN reports and kernel state corruption are\npossible.(CVE-2026-31712)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: ulpi: fix double free in ulpi_register_interface() error path\n\nWhen device_register() fails, ulpi_register() calls put_device() on\nulpi-\u0026gt;dev.\n\nThe device release callback ulpi_dev_release() drops the OF node\nreference and frees ulpi, but the current error path in\nulpi_register_interface() then calls kfree(ulpi) again, causing a\ndouble free.\n\nLet put_device() handle the cleanup through ulpi_dev_release() and\navoid freeing ulpi again in ulpi_register_interface().(CVE-2026-31759)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ctxfi: Check the error for index mapping\n\nThe ctxfi driver blindly assumed a proper value returned from\ndaio_device_index(), but it\u0026apos;s not always true.  Add a proper error\ncheck to deal with the error from the function.(CVE-2026-31777)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: fix stack out-of-bounds read in init_card\n\nThe loop creates a whitespace-stripped copy of the card shortname\nwhere `len \u0026lt; sizeof(card-\u0026gt;id)` is used for the bounds check. Since\nsizeof(card-\u0026gt;id) is 16 and the local id buffer is also 16 bytes,\nwriting 16 non-space characters fills the entire buffer,\noverwriting the terminating nullbyte.\n\nWhen this non-null-terminated string is later passed to\nsnd_card_set_id() -\u0026gt; copy_valid_id_string(), the function scans\nforward with `while (*nid \u0026amp;\u0026amp; ...)` and reads past the end of the\nstack buffer, reading the contents of the stack.\n\nA USB device with a product name containing many non-ASCII, non-space\ncharacters (e.g. multibyte UTF-8) will reliably trigger this as follows:\n\n  BUG: KASAN: stack-out-of-bounds in copy_valid_id_string\n       sound/core/init.c:696 [inline]\n  BUG: KASAN: stack-out-of-bounds in snd_card_set_id_no_lock+0x698/0x74c\n       sound/core/init.c:718\n\nThe off-by-one has been present since commit bafeee5b1f8d (\u0026quot;ALSA:\nsnd_usb_caiaq: give better shortname\u0026quot;) from June 2009 (v2.6.31-rc1),\nwhich first introduced this whitespace-stripping loop. The original\ncode never accounted for the null terminator when bounding the copy.\n\nFix this by changing the loop bound to `sizeof(card-\u0026gt;id) - 1`,\nensuring at least one byte remains as the null terminator.(CVE-2026-31778)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/ioc32: stop speculation on the drm_compat_ioctl path\n\nThe drm compat ioctl path takes a user controlled pointer, and then\ndereferences it into a table of function pointers, the signature method\nof spectre problems.  Fix this up by calling array_index_nospec() on the\nindex to the function pointer list.(CVE-2026-31781)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption\n\nWhen decrypting data that is not in-place (src != dst), there is\nno need to save the high-order sequence bits in dst as it could\nsimply be re-copied from the source.\n\nHowever, the data to be hashed need to be rearranged accordingly.\n\n\nThanks,(CVE-2026-43033)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nip6_tunnel: clear skb2-\u0026gt;cb[] in ip4ip6_err()\n\nOskar Kjos reported the following problem.\n\nip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written\nby the IPv6 receive path as struct inet6_skb_parm. icmp_send() passes\nIPCB(skb2) to __ip_options_echo(), which interprets that cb[] region\nas struct inet_skb_parm (IPv4). The layouts differ: inet6_skb_parm.nhoff\nat offset 14 overlaps inet_skb_parm.opt.rr, producing a non-zero rr\nvalue. __ip_options_echo() then reads optlen from attacker-controlled\npacket data at sptr[rr+1] and copies that many bytes into dopt-\u0026gt;__data,\na fixed 40-byte stack buffer (IP_OPTIONS_DATA_FIXED_SIZE).\n\nTo fix this we clear skb2-\u0026gt;cb[], as suggested by Oskar Kjos.\n\nAlso add minimal IPv4 header validation (version == 4, ihl \u0026gt;= 5).(CVE-2026-43037)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv6: icmp: clear skb2-\u0026gt;cb[] in ip6_err_gen_icmpv6_unreach()\n\nSashiko AI-review observed:\n\n  In ip6_err_gen_icmpv6_unreach(), the skb is an outer IPv4 ICMP error packet\n  where its cb contains an IPv4 inet_skb_parm. When skb is cloned into skb2\n  and passed to icmp6_send(), it uses IP6CB(skb2).\n\n  IP6CB interprets the IPv4 inet_skb_parm as an inet6_skb_parm. The cipso\n  offset in inet_skb_parm.opt directly overlaps with dsthao in inet6_skb_parm\n  at offset 18.\n\n  If an attacker sends a forged ICMPv4 error with a CIPSO IP option, dsthao\n  would be a non-zero offset. Inside icmp6_send(), mip6_addr_swap() is called\n  and uses ipv6_find_tlv(skb, opt-\u0026gt;dsthao, IPV6_TLV_HAO).\n\n  This would scan the inner, attacker-controlled IPv6 packet starting at that\n  offset, potentially returning a fake TLV without checking if the remaining\n  packet length can hold the full 18-byte struct ipv6_destopt_hao.\n\n  Could mip6_addr_swap() then perform a 16-byte swap that extends past the end\n  of the packet data into skb_shared_info?\n\n  Should the cb array also be cleared in ip6_err_gen_icmpv6_unreach() and\n  ip6ip6_err() to prevent this?\n\nThis patch implements the first suggestion.\n\nI am not sure if ip6ip6_err() needs to be changed.\nA separate patch would be better anyway.(CVE-2026-43038)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode\n\nkaweth_set_rx_mode(), the ndo_set_rx_mode callback, calls\nnetif_stop_queue() and netif_wake_queue(). These are TX queue flow\ncontrol functions unrelated to RX multicast configuration.\n\nThe premature netif_wake_queue() can re-enable TX while tx_urb is still\nin-flight, leading to a double usb_submit_urb() on the same URB:\n\nkaweth_start_xmit() {\n    netif_stop_queue();\n    usb_submit_urb(kaweth-\u0026gt;tx_urb);\n}\n\nkaweth_set_rx_mode() {\n    netif_stop_queue();\n    netif_wake_queue();             // wakes TX queue before URB is done\n}\n\nkaweth_start_xmit() {\n    netif_stop_queue();\n    usb_submit_urb(kaweth-\u0026gt;tx_urb); // URB submitted while active\n}\n\nThis triggers the WARN in usb_submit_urb():\n\n  \u0026quot;URB submitted while active\u0026quot;\n\nThis is a similar class of bug fixed in rtl8150 by\n\n- commit 958baf5eaee3 (\u0026quot;net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast\u0026quot;).\n\nAlso kaweth_set_rx_mode() is already functionally broken, the\nreal set_rx_mode action is performed by kaweth_async_set_rx_mode(),\nwhich in turn is not a no-op only at ndo_open() time.(CVE-2026-43180)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: consume xmit errors of GSO frames\n\nudpgro_frglist.sh and udpgro_bench.sh are the flakiest tests\ncurrently in NIPA. They fail in the same exact way, TCP GRO\ntest stalls occasionally and the test gets killed after 10min.\n\nThese tests use veth to simulate GRO. They attach a trivial\n(\u0026quot;return XDP_PASS;\u0026quot;) XDP program to the veth to force TSO off\nand NAPI on.\n\nDigging into the failure mode we can see that the connection\nis completely stuck after a burst of drops. The sender\u0026apos;s snd_nxt\nis at sequence number N [1], but the receiver claims to have\nreceived (rcv_nxt) up to N + 3 * MSS [2]. Last piece of the puzzle\nis that senders rtx queue is not empty (let\u0026apos;s say the block in\nthe rtx queue is at sequence number N - 4 * MSS [3]).\n\nIn this state, sender sends a retransmission from the rtx queue\nwith a single segment, and sequence numbers N-4*MSS:N-3*MSS [3].\nReceiver sees it and responds with an ACK all the way up to\nN + 3 * MSS [2]. But sender will reject this ack as TCP_ACK_UNSENT_DATA\nbecause it has no recollection of ever sending data that far out [1].\nAnd we are stuck.\n\nThe root cause is the mess of the xmit return codes. veth returns\nan error when it can\u0026apos;t xmit a frame. We end up with a loss event\nlike this:\n\n  -------------------------------------------------\n  |   GSO super frame 1   |   GSO super frame 2   |\n  |-----------------------------------------------|\n  | seg | seg | seg | seg | seg | seg | seg | seg |\n  |  1  |  2  |  3  |  4  |  5  |  6  |  7  |  8  |\n  -------------------------------------------------\n     x    ok    ok    \u0026lt;ok\u0026gt;|  ok    ok    ok   \u0026lt;x\u0026gt;\n                          \\\\\n\t\t\t   snd_nxt\n\n\u0026quot;x\u0026quot; means packet lost by veth, and \u0026quot;ok\u0026quot; means it went thru.\nSince veth has TSO disabled in this test it sees individual segments.\nSegment 1 is on the retransmit queue and will be resent.\n\nSo why did the sender not advance snd_nxt even tho it clearly did\nsend up to seg 8? tcp_write_xmit() interprets the return code\nfrom the core to mean that data has not been sent at all. Since\nTCP deals with GSO super frames, not individual segment the crux\nof the problem is that loss of a single segment can be interpreted\nas loss of all. TCP only sees the last return code for the last\nsegment of the GSO frame (in \u0026lt;\u0026gt; brackets in the diagram above).\n\nOf course for the problem to occur we need a setup or a device\nwithout a Qdisc. Otherwise Qdisc layer disconnects the protocol\nlayer from the device errors completely.\n\nWe have multiple ways to fix this.\n\n 1) make veth not return an error when it lost a packet.\n    While this is what I think we did in the past, the issue keeps\n    reappearing and it\u0026apos;s annoying to debug. The game of whack\n    a mole is not great.\n\n 2) fix the damn return codes\n    We only talk about NETDEV_TX_OK and NETDEV_TX_BUSY in the\n    documentation, so maybe we should make the return code from\n    ndo_start_xmit() a boolean. I like that the most, but perhaps\n    some ancient, not-really-networking protocol would suffer.\n\n 3) make TCP ignore the errors\n    It is not entirely clear to me what benefit TCP gets from\n    interpreting the result of ip_queue_xmit()? Specifically once\n    the connection is established and we\u0026apos;re pushing data - packet\n    loss is just packet loss?\n\n 4) this fix\n    Ignore the rc in the Qdisc-less+GSO case, since it\u0026apos;s unreliable.\n    We already always return OK in the TCQ_F_CAN_BYPASS case.\n    In the Qdisc-less case let\u0026apos;s be a bit more conservative and only\n    mask the GSO errors. This path is taken by non-IP-\u0026quot;networks\u0026quot;\n    like CAN, MCTP etc, so we could regress some ancient thing.\n    This is the simplest, but also maybe the hackiest fix?\n\nSimilar fix has been proposed by Eric in the past but never committed\nbecause original reporter was working with an OOT driver and wasn\u0026apos;t\nproviding feedback (see Link).(CVE-2026-43194)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()\n\nAlthough it is guided that `#mbox-cells` must be at least 1, there are\nmany instances of `#mbox-cells = \u0026lt;0\u0026gt;;` in the device tree. If that is\nthe case and the corresponding mailbox controller does not provide\n`fw_xlate` and of_xlate` function pointers, `fw_mbox_index_xlate()` will\nbe used by default and out-of-bounds accesses could occur due to lack of\nbounds check in that function.(CVE-2026-43281)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm: Account property blob allocations to memcg\n\nDRM_IOCTL_MODE_CREATEPROPBLOB allows userspace to allocate arbitrary-sized\nproperty blobs backed by kernel memory.\n\nCurrently, the blob data allocation is not accounted to the allocating\nprocess\u0026apos;s memory cgroup, allowing unprivileged users to trigger unbounded\nkernel memory consumption and potentially cause system-wide OOM.\n\nMark the property blob data allocation with GFP_KERNEL_ACCOUNT so that the memory\nis properly charged to the caller\u0026apos;s memcg. This ensures existing cgroup\nmemory limits apply and prevents uncontrolled kernel memory growth without\nintroducing additional policy or per-file limits.(CVE-2026-43287)\n\nIn the Linux kernel, there is a double free vulnerability in the error handling path of cpufreq_dbs_governor_init() function. When kobject_init_and_add() fails, cpufreq_dbs_governor_init() calls kobject_put(\u0026amp;dbs_data-\u0026gt;attr_set.kobj). The kobject release callback cpufreq_dbs_data_release() calls gov-\u0026gt;exit(dbs_data) and kfree(dbs_data), but the current error path then calls gov-\u0026gt;exit(dbs_data) and kfree(dbs_data) again, causing a double free. Keep the direct kfree(dbs_data) for the gov-\u0026gt;init() failure path, but after kobject_init_and_add() has been called, let kobject_put() handle the cleanup through cpufreq_dbs_data_release().(CVE-2026-43328)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SMP: force responder MITM requirements before building the pairing response\n\nsmp_cmd_pairing_req() currently builds the pairing response from the\ninitiator auth_req before enforcing the local BT_SECURITY_HIGH\nrequirement. If the initiator omits SMP_AUTH_MITM, the response can\nalso omit it even though the local side still requires MITM.\n\ntk_request() then sees an auth value without SMP_AUTH_MITM and may\nselect JUST_CFM, making method selection inconsistent with the pairing\npolicy the responder already enforces.\n\nWhen the local side requires HIGH security, first verify that MITM can\nbe achieved from the IO capabilities and then force SMP_AUTH_MITM in the\nresponse in both rsp.auth_req and auth. This keeps the responder auth bits\nand later method selection aligned.(CVE-2026-43334)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlib/crypto: chacha: Zeroize permuted_state before it leaves scope\n\nSince the ChaCha permutation is invertible, the local variable\n\u0026apos;permuted_state\u0026apos; is sufficient to compute the original \u0026apos;state\u0026apos;, and thus\nthe key, even after the permutation has been done.\n\nWhile the kernel is quite inconsistent about zeroizing secrets on the\nstack (and some prominent userspace crypto libraries don\u0026apos;t bother at all\nsince it\u0026apos;s not guaranteed to work anyway), the kernel does try to do it\nas a best practice, especially in cases involving the RNG.\n\nThus, explicitly zeroize \u0026apos;permuted_state\u0026apos; before it goes out of scope.(CVE-2026-43336)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: class: cdc-wdm: fix reordering issue in read code path\n\nQuoting the bug report:\n\nDue to compiler optimization or CPU out-of-order execution, the\ndesc-\u0026gt;length update can be reordered before the memmove. If this\nhappens, wdm_read() can see the new length and call copy_to_user() on\nuninitialized memory. This also violates LKMM data race rules [1].\n\nFix it by using WRITE_ONCE and memory barriers.(CVE-2026-43427)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery\n\nIn case of a TX error CQE, a recovery flow is triggered,\nmlx5e_reset_txqsq_cc_pc() resets dma_fifo_cc to 0 but not dma_fifo_pc,\ndesyncing the DMA FIFO producer and consumer.\n\nAfter recovery, the producer pushes new DMA entries at the old\ndma_fifo_pc, while the consumer reads from position 0.\nThis causes us to unmap stale DMA addresses from before the recovery.\n\nThe DMA FIFO is a purely software construct with no HW counterpart.\nAt the point of reset, all WQEs have been flushed so dma_fifo_cc is\nalready equal to dma_fifo_pc. There is no need to reset either counter,\nsimilar to how skb_fifo pc/cc are untouched.\n\nRemove the \u0026apos;dma_fifo_cc = 0\u0026apos; reset.\n\nThis fixes the following WARNING:\n    WARNING: CPU: 0 PID: 0 at drivers/iommu/dma-iommu.c:1240 iommu_dma_unmap_page+0x79/0x90\n    Modules linked in: mlx5_vdpa vringh vdpa bonding mlx5_ib mlx5_vfio_pci ipip mlx5_fwctl tunnel4 mlx5_core ib_ipoib geneve ip6_gre ip_gre gre nf_tables ip6_tunnel rdma_ucm ib_uverbs ib_umad vfio_pci vfio_pci_core act_mirred act_skbedit act_vlan vhost_net vhost tap ip6table_mangle ip6table_nat ip6table_filter ip6_tables iptable_mangle cls_matchall nfnetlink_cttimeout act_gact cls_flower sch_ingress vhost_iotlb iptable_raw tunnel6 vfio_iommu_type1 vfio openvswitch nsh rpcsec_gss_krb5 auth_rpcgss oid_registry xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat nf_nat xt_addrtype br_netfilter overlay zram zsmalloc rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm ib_core fuse [last unloaded: nf_tables]\n    CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.13.0-rc5_for_upstream_min_debug_2024_12_30_21_33 #1\n    Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n    RIP: 0010:iommu_dma_unmap_page+0x79/0x90\n    Code: 2b 4d 3b 21 72 26 4d 3b 61 08 73 20 49 89 d8 44 89 f9 5b 4c 89 f2 4c 89 e6 48 89 ef 5d 41 5c 41 5d 41 5e 41 5f e9 c7 ae 9e ff \u0026lt;0f\u0026gt; 0b 5b 5d 41 5c 41 5d 41 5e 41 5f c3 66 2e 0f 1f 84 00 00 00 00\n    Call Trace:\n     \u0026lt;IRQ\u0026gt;\n     ? __warn+0x7d/0x110\n     ? iommu_dma_unmap_page+0x79/0x90\n     ? report_bug+0x16d/0x180\n     ? handle_bug+0x4f/0x90\n     ? exc_invalid_op+0x14/0x70\n     ? asm_exc_invalid_op+0x16/0x20\n     ? iommu_dma_unmap_page+0x79/0x90\n     ? iommu_dma_unmap_page+0x2e/0x90\n     dma_unmap_page_attrs+0x10d/0x1b0\n     mlx5e_tx_wi_dma_unmap+0xbe/0x120 [mlx5_core]\n     mlx5e_poll_tx_cq+0x16d/0x690 [mlx5_core]\n     mlx5e_napi_poll+0x8b/0xac0 [mlx5_core]\n     __napi_poll+0x24/0x190\n     net_rx_action+0x32a/0x3b0\n     ? mlx5_eq_comp_int+0x7e/0x270 [mlx5_core]\n     ? notifier_call_chain+0x35/0xa0\n     handle_softirqs+0xc9/0x270\n     irq_exit_rcu+0x71/0xd0\n     common_interrupt+0x7f/0xa0\n     \u0026lt;/IRQ\u0026gt;\n     \u0026lt;TASK\u0026gt;\n     asm_common_interrupt+0x22/0x40(CVE-2026-43466)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: storvsc: Fix scheduling while atomic on PREEMPT_RT\n\nThis resolves the follow splat and lock-up when running with PREEMPT_RT\nenabled on Hyper-V:\n\n[  415.140818] BUG: scheduling while atomic: stress-ng-iomix/1048/0x00000002\n[  415.140822] INFO: lockdep is turned off.\n[  415.140823] Modules linked in: intel_rapl_msr intel_rapl_common intel_uncore_frequency_common intel_pmc_core pmt_telemetry pmt_discovery pmt_class intel_pmc_ssram_telemetry intel_vsec ghash_clmulni_intel aesni_intel rapl binfmt_misc nls_ascii nls_cp437 vfat fat snd_pcm hyperv_drm snd_timer drm_client_lib drm_shmem_helper snd sg soundcore drm_kms_helper pcspkr hv_balloon hv_utils evdev joydev drm configfs efi_pstore nfnetlink vsock_loopback vmw_vsock_virtio_transport_common hv_sock vmw_vsock_vmci_transport vsock vmw_vmci efivarfs autofs4 ext4 crc16 mbcache jbd2 sr_mod sd_mod cdrom hv_storvsc serio_raw hid_generic scsi_transport_fc hid_hyperv scsi_mod hid hv_netvsc hyperv_keyboard scsi_common\n[  415.140846] Preemption disabled at:\n[  415.140847] [\u0026lt;ffffffffc0656171\u0026gt;] storvsc_queuecommand+0x2e1/0xbe0 [hv_storvsc]\n[  415.140854] CPU: 8 UID: 0 PID: 1048 Comm: stress-ng-iomix Not tainted 6.19.0-rc7 #30 PREEMPT_{RT,(full)}\n[  415.140856] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 09/04/2024\n[  415.140857] Call Trace:\n[  415.140861]  \u0026lt;TASK\u0026gt;\n[  415.140861]  ? storvsc_queuecommand+0x2e1/0xbe0 [hv_storvsc]\n[  415.140863]  dump_stack_lvl+0x91/0xb0\n[  415.140870]  __schedule_bug+0x9c/0xc0\n[  415.140875]  __schedule+0xdf6/0x1300\n[  415.140877]  ? rtlock_slowlock_locked+0x56c/0x1980\n[  415.140879]  ? rcu_is_watching+0x12/0x60\n[  415.140883]  schedule_rtlock+0x21/0x40\n[  415.140885]  rtlock_slowlock_locked+0x502/0x1980\n[  415.140891]  rt_spin_lock+0x89/0x1e0\n[  415.140893]  hv_ringbuffer_write+0x87/0x2a0\n[  415.140899]  vmbus_sendpacket_mpb_desc+0xb6/0xe0\n[  415.140900]  ? rcu_is_watching+0x12/0x60\n[  415.140902]  storvsc_queuecommand+0x669/0xbe0 [hv_storvsc]\n[  415.140904]  ? HARDIRQ_verbose+0x10/0x10\n[  415.140908]  ? __rq_qos_issue+0x28/0x40\n[  415.140911]  scsi_queue_rq+0x760/0xd80 [scsi_mod]\n[  415.140926]  __blk_mq_issue_directly+0x4a/0xc0\n[  415.140928]  blk_mq_issue_direct+0x87/0x2b0\n[  415.140931]  blk_mq_dispatch_queue_requests+0x120/0x440\n[  415.140933]  blk_mq_flush_plug_list+0x7a/0x1a0\n[  415.140935]  __blk_flush_plug+0xf4/0x150\n[  415.140940]  __submit_bio+0x2b2/0x5c0\n[  415.140944]  ? submit_bio_noacct_nocheck+0x272/0x360\n[  415.140946]  submit_bio_noacct_nocheck+0x272/0x360\n[  415.140951]  ext4_read_bh_lock+0x3e/0x60 [ext4]\n[  415.140995]  ext4_block_write_begin+0x396/0x650 [ext4]\n[  415.141018]  ? __pfx_ext4_da_get_block_prep+0x10/0x10 [ext4]\n[  415.141038]  ext4_da_write_begin+0x1c4/0x350 [ext4]\n[  415.141060]  generic_perform_write+0x14e/0x2c0\n[  415.141065]  ext4_buffered_write_iter+0x6b/0x120 [ext4]\n[  415.141083]  vfs_write+0x2ca/0x570\n[  415.141087]  ksys_write+0x76/0xf0\n[  415.141089]  do_syscall_64+0x99/0x1490\n[  415.141093]  ? rcu_is_watching+0x12/0x60\n[  415.141095]  ? finish_task_switch.isra.0+0xdf/0x3d0\n[  415.141097]  ? rcu_is_watching+0x12/0x60\n[  415.141098]  ? lock_release+0x1f0/0x2a0\n[  415.141100]  ? rcu_is_watching+0x12/0x60\n[  415.141101]  ? finish_task_switch.isra.0+0xe4/0x3d0\n[  415.141103]  ? rcu_is_watching+0x12/0x60\n[  415.141104]  ? __schedule+0xb34/0x1300\n[  415.141106]  ? hrtimer_try_to_cancel+0x1d/0x170\n[  415.141109]  ? do_nanosleep+0x8b/0x160\n[  415.141111]  ? hrtimer_nanosleep+0x89/0x100\n[  415.141114]  ? __pfx_hrtimer_wakeup+0x10/0x10\n[  415.141116]  ? xfd_validate_state+0x26/0x90\n[  415.141118]  ? rcu_is_watching+0x12/0x60\n[  415.141120]  ? do_syscall_64+0x1e0/0x1490\n[  415.141121]  ? do_syscall_64+0x1e0/0x1490\n[  415.141123]  ? rcu_is_watching+0x12/0x60\n[  415.141124]  ? do_syscall_64+0x1e0/0x1490\n[  415.141125]  ? do_syscall_64+0x1e0/0x1490\n[  415.141127]  ? irqentry_exit+0x140/0\n---truncated---(CVE-2026-43475)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: propagate shared-frag marker through frag-transfer helpers\n\nTwo frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail\nto propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()-\u0026gt;flags when\nmoving frags from source to destination.  __pskb_copy_fclone() defers\nthe rest of the shinfo metadata to skb_copy_header() after copying\nfrag descriptors, but that helper only carries over gso_{size,segs,\ntype} and never touches skb_shinfo()-\u0026gt;flags; skb_shift() moves frag\ndescriptors directly and leaves flags untouched.  As a result, the\ndestination skb keeps a reference to the same externally-owned or\npage-cache-backed pages while reporting skb_has_shared_frag() as\nfalse.\n\nThe mismatch is harmful in any in-place writer that uses\nskb_has_shared_frag() to decide whether shared pages must be detoured\nthrough skb_cow_data().  ESP input is one such writer (esp4.c,\nesp6.c), and a single nft \u0026apos;dup to \u0026lt;local\u0026gt;\u0026apos; rule -- or any other\nnf_dup_ipv4() / xt_TEE caller -- is enough to land a pskb_copy()\u0026apos;d\nskb in esp_input() with the marker stripped, letting an unprivileged\nuser write into the page cache of a root-owned read-only file via\nauthencesn-ESN stray writes.\n\nSet SKBFL_SHARED_FRAG on the destination whenever frag descriptors\nwere actually moved from the source.  skb_copy() and skb_copy_expand()\nshare skb_copy_header() too but linearize all paged data into freshly\nallocated head storage and emerge with nr_frags == 0, so\nskb_has_shared_frag() returns false on its own; they need no change.\n\nThe same omission exists in skb_gro_receive() and skb_gro_receive_list().\nThe former moves the incoming skb\u0026apos;s frag descriptors into the\naccumulator\u0026apos;s last sub-skb via two paths (a direct frag-move loop and\nthe head_frag + memcpy path); the latter chains the incoming skb whole\nonto p\u0026apos;s frag_list.  Downstream skb_segment() reads only\nskb_shinfo(p)-\u0026gt;flags, and skb_segment_list() reuses each sub-skb\u0026apos;s\nshinfo as the nskb -- both p and lp must carry the marker.\n\nThe same omission also exists in tcp_clone_payload(), which builds an\nMTU probe skb by moving frag descriptors from skbs on sk_write_queue\ninto a freshly allocated nskb.  The helper falls into the same family\nand warrants the same fix for consistency; no TCP TX-side in-place\nwriter is currently known to reach a user page through this gap, but\na future consumer depending on the marker would regress silently.\n\nThe same omission exists in skb_segment(): the per-iteration flag\nmerge takes only head_skb\u0026apos;s flag, and the inner switch that rebinds\nfrag_skb to list_skb on head_skb-frags exhaustion does not fold the\nnew frag_skb\u0026apos;s flag into nskb.  Fold frag_skb\u0026apos;s flag at both sites\nso segments drawing frags from frag_list members carry the marker.(CVE-2026-43503)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send\n\nib_uverbs_post_send() uses cmd.wqe_size from userspace without any\nvalidation before passing it to kmalloc() and using the allocated\nbuffer as struct ib_uverbs_send_wr.\n\nIf a user provides a small wqe_size value (e.g., 1), kmalloc() will\nsucceed, but subsequent accesses to user_wr-\u0026gt;opcode, user_wr-\u0026gt;num_sge,\nand other fields will read beyond the allocated buffer, resulting in\nan out-of-bounds read from kernel heap memory. This could potentially\nleak sensitive kernel information to userspace.\n\nAdditionally, providing an excessively large wqe_size can trigger a\nWARNING in the memory allocation path, as reported by syzkaller.\n\nThis is inconsistent with ib_uverbs_unmarshall_recv() which properly\nvalidates that wqe_size \u0026gt;= sizeof(struct ib_uverbs_recv_wr) before\nproceeding.\n\nAdd the same validation for ib_uverbs_post_send() to ensure wqe_size\nis at least sizeof(struct ib_uverbs_send_wr).(CVE-2026-45856)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncpuidle: Skip governor when only one idle state is available\n\nOn certain platforms (PowerNV systems without a power-mgt DT node),\ncpuidle may register only a single idle state. In cases where that\nsingle state is a polling state (state 0), the ladder governor may\nincorrectly treat state 1 as the first usable state and pass an\nout-of-bounds index. This can lead to a NULL enter callback being\ninvoked, ultimately resulting in a system crash.\n\n[   13.342636] cpuidle-powernv : Only Snooze is available\n[   13.351854] Faulting instruction address: 0x00000000\n[   13.376489] NIP [0000000000000000] 0x0\n[   13.378351] LR  [c000000001e01974] cpuidle_enter_state+0x2c4/0x668\n\nFix this by adding a bail-out in cpuidle_select() that returns state 0\ndirectly when state_count \u0026lt;= 1, bypassing the governor and keeping the\ntick running.(CVE-2026-45968)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ns390/cio: Fix device lifecycle handling in css_alloc_subchannel()\n\n`css_alloc_subchannel()` calls `device_initialize()` before setting up\nthe DMA masks. If `dma_set_coherent_mask()` or `dma_set_mask()` fails,\nthe error path frees the subchannel structure directly, bypassing\nthe device model reference counting.\n\nOnce `device_initialize()` has been called, the embedded struct device\nmust be released via `put_device()`, allowing the release callback to\nfree the container structure.\n\nFix the error path by dropping the initial device reference with\n`put_device()` instead of calling `kfree()` directly.\n\nThis ensures correct device lifetime handling and avoids potential\nuse-after-free or double-free issues.(CVE-2026-45981)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix use-after-free in iomap inline data write path\n\nThe inline data buffer head (dibh) is being released prematurely in\ngfs2_iomap_begin() via release_metapath() while iomap-\u0026gt;inline_data\nstill points to dibh-\u0026gt;b_data. This causes a use-after-free when\niomap_write_end_inline() later attempts to write to the inline data\narea.\n\nThe bug sequence:\n1. gfs2_iomap_begin() calls gfs2_meta_inode_buffer() to read inode\n   metadata into dibh\n2. Sets iomap-\u0026gt;inline_data = dibh-\u0026gt;b_data + sizeof(struct gfs2_dinode)\n3. Calls release_metapath() which calls brelse(dibh), dropping refcount\n   to 0\n4. kswapd reclaims the page (~39ms later in the syzbot report)\n5. iomap_write_end_inline() tries to memcpy() to iomap-\u0026gt;inline_data\n6. KASAN detects use-after-free write to freed memory\n\nFix by storing dibh in iomap-\u0026gt;private and incrementing its refcount\nwith get_bh() in gfs2_iomap_begin(). The buffer is then properly\nreleased in gfs2_iomap_end() after the inline write completes,\nensuring the page stays alive for the entire iomap operation.\n\nNote: A C reproducer is not available for this issue. The fix is based\non analysis of the KASAN report and code review showing the buffer head\nis freed before use.\n\n[agruenba: Take buffer head reference in gfs2_iomap_begin() to avoid\nleaks in gfs2_iomap_get() and gfs2_iomap_alloc().](CVE-2026-45984)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nthermal: core: Fix thermal zone governor cleanup issues\n\nIf thermal_zone_device_register_with_trips() fails after adding\na thermal governor to the thermal zone being registered, the\ngovernor is not removed from it as appropriate which may lead to\na memory leak.\n\nIn turn, thermal_zone_device_unregister() calls thermal_set_governor()\nwithout acquiring the thermal zone lock beforehand which may race with\na governor update via sysfs and may lead to a use-after-free in that\ncase.\n\nAddress these issues by adding two thermal_set_governor() calls, one to\nthermal_release() to remove the governor from the given thermal zone,\nand one to the thermal zone registration error path to cover failures\npreceding the thermal zone device registration.(CVE-2026-46021)\n\nIn the Linux kernel, the following vulnerability has been resolved:  crypto: authencesn - reject short ahash digests during instance creation  authencesn requires either a zero authsize or an authsize of at least 4 bytes because the ESN encrypt/decrypt paths always move 4 bytes of high-order sequence number data at the end of the authenticated data.  While crypto_authenc_esn_setauthsize() already rejects explicit non-zero authsizes in the range 1..3, crypto_authenc_esn_create() still copied auth-\u0026gt;digestsize into inst-\u0026gt;alg.maxauthsize without validating it.  The AEAD core then initialized the tfm\u0026apos;s default authsize from that value.  As a result, selecting an ahash with digest size 1..3, such as cbcmac(cipher_null), exposed authencesn instances whose default authsize was invalid even though setauthsize() would have rejected the same value.  AF_ALG could then trigger the ESN tail handling with a too-short tag and hit an out-of-bounds access.  Reject authencesn instances whose ahash digest size is in the invalid non-zero range 1..3 so that no tfm can inherit an unsupported default authsize.  The Linux kernel CVE team has assigned CVE-2026-46033 to this issue.(CVE-2026-46033)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nceph: only d_add() negative dentries when they are unhashed\n\nCeph can call d_add(dentry, NULL) on a negative dentry that is already\npresent in the primary dcache hash.\n\nIn the current VFS that is not safe.  d_add() goes through __d_add()\nto __d_rehash(), which unconditionally reinserts dentry-\u0026gt;d_hash into\nthe hlist_bl bucket.  If the dentry is already hashed, reinserting the\nsame node can corrupt the bucket, including creating a self-loop.\nOnce that happens, __d_lookup() can spin forever in the hlist_bl walk,\ntypically looping only on the d_name.hash mismatch check and\neventually triggering RCU stall reports like this one:\n\n rcu: INFO: rcu_sched self-detected stall on CPU\n rcu:         87-....: (2100 ticks this GP) idle=3a4c/1/0x4000000000000000 softirq=25003319/25003319 fqs=829\n rcu:         (t=2101 jiffies g=79058445 q=698988 ncpus=192)\n CPU: 87 UID: 2952868916 PID: 3933303 Comm: php-cgi8.3 Not tainted 6.18.17-i1-amd #950 NONE\n Hardware name: Dell Inc. PowerEdge R7615/0G9DHV, BIOS 1.6.6 09/22/2023\n RIP: 0010:__d_lookup+0x46/0xb0\n Code: c1 e8 07 48 8d 04 c2 48 8b 00 49 89 fc 49 89 f5 48 89 c3 48 83 e3 fe 48 83 f8 01 77 0f eb 2d 0f 1f 44 00 00 48 8b 1b 48 85 db \u0026lt;74\u0026gt; 20 39 6b 18 75 f3 48 8d 7b 78 e8 ba 85 d0 00 4c 39 63 10 74 1f\n RSP: 0018:ff745a70c8253898 EFLAGS: 00000282\n RAX: ff26e470054cb208 RBX: ff26e470054cb208 RCX: 000000006e958966\n RDX: ff26e48267340000 RSI: ff745a70c82539b0 RDI: ff26e458f74655c0\n RBP: 000000006e958966 R08: 0000000000000180 R09: 9cd08d909b919a89\n R10: ff26e458f74655c0 R11: 0000000000000000 R12: ff26e458f74655c0\n R13: ff745a70c82539b0 R14: d0d0d0d0d0d0d0d0 R15: 2f2f2f2f2f2f2f2f\n FS:  00007f5770896980(0000) GS:ff26e482c5d88000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f5764de50c0 CR3: 000000a72abb5001 CR4: 0000000000771ef0\n PKRU: 55555554\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  lookup_fast+0x9f/0x100\n  walk_component+0x1f/0x150\n  link_path_walk+0x20e/0x3d0\n  path_lookupat+0x68/0x180\n  filename_lookup+0xdc/0x1e0\n  vfs_statx+0x6c/0x140\n  vfs_fstatat+0x67/0xa0\n  __do_sys_newfstatat+0x24/0x60\n  do_syscall_64+0x6a/0x230\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nThis is reachable with reused cached negative dentries.  A Ceph lookup\nor atomic_open can be handed a negative dentry that is already hashed,\nand fs/ceph/dir.c then hits one of two paths that incorrectly assume\n\u0026quot;negative\u0026quot; also means \u0026quot;unhashed\u0026quot;:\n\n  - ceph_finish_lookup():\n      MDS reply is -ENOENT with no trace\n      -\u0026gt; d_add(dentry, NULL)\n\n  - ceph_lookup():\n      local ENOENT fast path for a complete directory with shared caps\n      -\u0026gt; d_add(dentry, NULL)\n\nBoth paths can therefore re-add an already-hashed negative dentry.\n\nCeph already uses the correct pattern elsewhere: ceph_fill_trace() only\ncalls d_add(dn, NULL) for a negative null-dentry reply when d_unhashed(dn)\nis true.\n\nFix both fs/ceph/dir.c sites the same way: only call d_add() for a\nnegative dentry when it is actually unhashed.  If the negative dentry\nis already hashed, leave it in place and reuse it as-is.\n\nThis preserves the existing behavior for unhashed dentries while\navoiding d_hash list corruption for reused hashed negatives.(CVE-2026-46052)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: usblp: fix heap leak in IEEE 1284 device ID via short response\n\nusblp_ctrl_msg() collapses the usb_control_msg() return value to\n0/-errno, discarding the actual number of bytes transferred.  A broken\nprinter can complete the GET_DEVICE_ID control transfer short and the\ndriver has no way to know.\n\nusblp_cache_device_id_string() reads the 2-byte big-endian length prefix\nfrom the response and trusts it (clamped only to the buffer bounds).\nThe buffer is kmalloc(1024) at probe time. A device that sends exactly\ntwo bytes (e.g. 0x03 0xFF, claiming a 1023-byte ID) leaves\ndevice_id_string[2..1022] holding stale kmalloc heap.\n\nThat stale data is then exposed:\n  - via the ieee1284_id sysfs attribute (sprintf(\u0026quot;%s\u0026quot;, buf+2), truncated\n    at the first NUL in the stale heap), and\n  - via the IOCNR_GET_DEVICE_ID ioctl, which copy_to_user()s the full\n    claimed length regardless of NULs, up to 1021 bytes of uninitialized\n    heap, with the leak size chosen by the device.\n\nFix this up by just zapping the buffer with zeros before each request\nsent to the device.(CVE-2026-46151)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl\n\nJust like in a previous problem in this driver, usblp_ctrl_msg() will\ncollapse the usb_control_msg() return value to 0/-errno, discarding the\nactual number of bytes transferred.\n\nIdeally that short command should be detected and error out, but many\nprinters are known to send \u0026quot;incorrect\u0026quot; responses back so we can\u0026apos;t just\ndo that.\n\nstatusbuf is kmalloc(8) at probe time and never filled before the first\nLPGETSTATUS ioctl.\n\nusblp_read_status() requests 1 byte. If a malicious printer responds\nwith zero bytes, *statusbuf is one byte of stale kmalloc heap,\nsign-extended into the local int status, which the LPGETSTATUS path then\ncopy_to_user()s directly to the ioctl caller.\n\nFix this all by just zapping out the memory buffer when allocated at\nprobe time.  If a later call does a short read, the data will be\nidentical to what the device sent it the last time, so there is no\n\u0026quot;leak\u0026quot; of information happening.(CVE-2026-46167)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()\n\nSashiko points out the radix_tree itself is RCU safe, but nothing ever\nfrees the mlx4_srq struct with RCU, and it isn\u0026apos;t even accessed within the\nRCU critical section. It also will crash if an event is delivered before\nthe srq object is finished initializing.\n\nUse the spinlock since it isn\u0026apos;t easy to make RCU work, use\nrefcount_inc_not_zero() to protect against partially initialized objects,\nand order the refcount_set() to be after the srq is fully initialized.(CVE-2026-46181)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rsi: fix kthread lifetime race between self-exit and external-stop\n\nRSI driver use both self-exit(kthread_complete_and_exit) and external-stop\n(kthread_stop) when killing a kthread. Generally, kthread_stop() is called\nfirst, and in this case, no particular issues occur.\n\nHowever, in rare instances where kthread_complete_and_exit() is called\nfirst and then kthread_stop() is called, a UAF occurs because the kthread\nobject, which has already exited and been freed, is accessed again.\n\nTherefore, to prevent this with minimal modification, you must remove\nkthread_stop() and change the code to wait until the self-exit operation\nis completed.(CVE-2026-46187)\n\nIn the Linux kernel\u0026apos;s vsock/virtio implementation, virtio_transport_recv_listen() calls sk_acceptq_added() before vsock_assign_transport(). If vsock_assign_transport() fails or selects a different transport, the error path returns without calling sk_acceptq_removed(), permanently incrementing sk_ack_backlog. After approximately backlog+1 such failures, sk_acceptq_is_full() returns true, causing the listener to reject all new connections, leading to a denial of service.(CVE-2026-46214)","status":"published","published":"2026-06-05T11:11:31Z","modified":"2026-08-18T01:20:03.314979517Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"ROOT-OS-UBUNTU-2204-CVE-2023-54285","title":"CVE-2023-54285 in linux - Patched by Root","description":"Root has patched CVE-2023-54285 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.","status":"published","published":"2026-11-06T13:52:25Z","modified":"2026-11-06T14:17:23.557996079Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-06T14:57:20.626209Z"},{"id":"UBUNTU-CVE-2023-54285","description":"In the Linux kernel, the following vulnerability has been resolved: iomap: Fix possible overflow condition in iomap_write_delalloc_scan folio_next_index() returns an unsigned long value which left shifted by PAGE_SHIFT could possibly cause an overflow on 32-bit system. Instead use folio_pos(folio) + folio_size(folio), which does this correctly.","status":"published","published":"2025-12-30T13:16:00Z","modified":"2026-09-30T18:22:37.074373128Z","cvss":[{"version":"4.0","score":5.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:41.555387Z"},{"id":"DLA-4476-1","title":"linux-6.1 - security update","status":"published","published":"2026-02-10T00:00:00Z","modified":"2026-02-10T18:30:13.970662Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-6127-1","title":"linux - security update","status":"published","published":"2026-02-09T00:00:00Z","modified":"2026-03-09T02:09:43.378453Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"SUSE-SU-2026:0278-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).\n- CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).\n- CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).\n- CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).\n- CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).\n- CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).\n- CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).\n- CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).\n- CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).\n- CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).\n- CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).\n- CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).\n- CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).\n- CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).\n- CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).\n- CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).\n- CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).\n- CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).\n- CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).\n- CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).\n- CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).\n- CVE-2025-40215: kABI: xfrm: delete x-\u003etunnel as we delete x (bsc#1254959).\n- CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).\n- CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).\n- CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).\n- CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).\n- CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).\n- CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).\n- CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).\n- CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).\n- CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).\n- CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).\n- CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).\n- CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).\n- CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).\n- CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).\n- CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).\n- CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).\n- CVE-2025-40287: exfat: fix improper check of dentry.stream.valid_size (bsc#1255030).\n- CVE-2025-40289: drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (bsc#1255042).\n- CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).\n- CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).\n- CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187).\n- CVE-2025-40307: exfat: validate cluster allocation bits of the allocation bitmap (bsc#1255039).\n- CVE-2025-40319: bpf: Sync pending IRQ work before freeing ring buffer (bsc#1254794).\n- CVE-2025-40330: bnxt_en: Shutdown FW DMA in bnxt_shutdown() (bsc#1254616).\n- CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).\n- CVE-2025-40337: net: stmmac: Correctly handle Rx checksum offload errors (bsc#1255081).\n- CVE-2025-40338: ASoC: Intel: avs: Do not share the name pointer between components (bsc#1255273).\n- CVE-2025-40346: arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (bsc#1255318).\n- CVE-2025-40357: net/smc: fix general protection fault in __smc_diag_dump (bsc#1255097).\n- CVE-2025-68197: bnxt_en: Fix null pointer dereference in bnxt_bs_trace_check_wrap() (bsc#1255242).\n- CVE-2025-68204: pmdomain: arm: scmi: Fix genpd leak on provider registration failure (bsc#1255224).\n- CVE-2025-68206: netfilter: nft_ct: add seqadj extension for natted connections (bsc#1255142).\n- CVE-2025-68208: bpf: account for current allocated stack depth in widen_imprecise_scalars() (bsc#1255227).\n- CVE-2025-68209: mlx5: Fix default values in create CQ (bsc#1255230).\n- CVE-2025-68239: binfmt_misc: restore write access before closing files opened by open_exec() (bsc#1255272).\n- CVE-2025-68255: staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing (bsc#1255395).\n- CVE-2025-68259: KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced (bsc#1255199).\n- CVE-2025-68264: ext4: refresh inline data size before write operations (bsc#1255380).\n- CVE-2025-68302: net: sxgbe: fix potential NULL dereference in sxgbe_rx() (bsc#1255121).\n- CVE-2025-68340: team: Move team device type change at the end of team_port_add (bsc#1255507).\n- CVE-2025-68378: bpf: Refactor stack map trace depth calculation into helper function (bsc#1255614).\n- CVE-2025-68742: bpf: Improve program stats run-time calculation (bsc#1255707).\n- CVE-2025-68744: bpf: Free special fields when update [lru_,]percpu_hash maps (bsc#1255709).\n\nThe following non security issues were fixed:\n\n- ACPI: CPPC: Fix missing PCC check for guaranteed_perf (git-fixes).\n- ACPI: PCC: Fix race condition by removing static qualifier (git-fixes).\n- ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 (git-fixes).\n- ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() (git-fixes).\n- ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only (stable-fixes).\n- ACPICA: Avoid walking the Namespace if start_node is NULL (stable-fixes).\n- ALSA: ac97: fix a double free in snd_ac97_controller_register() (git-fixes).\n- ALSA: dice: fix buffer overflow in detect_stream_formats() (git-fixes).\n- ALSA: firewire-motu: add bounds check in put_user loop for DSP events (git-fixes).\n- ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (git-fixes).\n- ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() (git-fixes).\n- ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path (git-fixes).\n- ALSA: uapi: Fix typo in asound.h comment (git-fixes).\n- ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 (stable-fixes).\n- ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series (stable-fixes).\n- ALSA: usb-audio: fix uac2 clock source at terminal parser (git-fixes).\n- ALSA: usb-mixer: us16x08: validate meter packet indices (git-fixes).\n- ALSA: vxpocket: Fix resource leak in vxpocket_probe error path (git-fixes).\n- ASoC: Intel: catpt: Fix error path in hw_params() (git-fixes).\n- ASoC: ak4458: Disable regulator when error happens (git-fixes).\n- ASoC: ak4458: remove the reset operation in probe and remove (git-fixes).\n- ASoC: ak5558: Disable regulator when error happens (git-fixes).\n- ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() (git-fixes).\n- ASoC: codecs: lpass-tx-macro: fix SM6115 support (git-fixes).\n- ASoC: codecs: wcd938x: fix OF node leaks on probe failure (git-fixes).\n- ASoC: fsl_xcvr: clear the channel status control memory (git-fixes).\n- ASoC: qcom: q6adm: the the copp device only during last instance (git-fixes).\n- ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr (git-fixes).\n- ASoC: qcom: q6asm-dai: perform correct state check before closing (git-fixes).\n- ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment (git-fixes).\n- ASoC: stm32: sai: fix OF node leak on probe (git-fixes).\n- ASoC: stm32: sai: fix clk prepare imbalance on probe failure (git-fixes).\n- ASoC: stm32: sai: fix device leak on probe (git-fixes).\n- ASoC: sun4i-spdif: Add missing kerneldoc fields for sun4i_spdif_quirks (git-fixes).\n- Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 (git-fixes).\n- Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (git-fixes).\n- Bluetooth: SMP: Fix not generating mackey and ltk when repairing (git-fixes).\n- Bluetooth: btrtl: Avoid loading the config file on security chips (stable-fixes).\n- Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE (stable-fixes).\n- Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV (stable-fixes).\n- Bluetooth: btusb: mediatek: Avoid btusb_mtk_claim_iso_intf() NULL deref (git-fixes).\n- Bluetooth: btusb: mediatek: Fix kernel crash when releasing mtk iso interface (git-fixes).\n- Bluetooth: btusb: revert use of devm_kzalloc in btusb (git-fixes).\n- Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (git-fixes).\n- Documentation/kernel-parameters: fix typo in retbleed= kernel parameter description (git-fixes).\n- Documentation: hid-alps: Fix packet format section headings (git-fixes).\n- Documentation: parport-lowlevel: Separate function listing code blocks (git-fixes).\n- HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list (stable-fixes).\n- HID: elecom: Add support for ELECOM M-XT3URBK (018F) (stable-fixes).\n- HID: hid-input: Extend Elan ignore battery quirk to USB (stable-fixes).\n- HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen (stable-fixes).\n- HID: logitech-dj: Remove duplicate error logging (git-fixes).\n- HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync() (git-fixes).\n- HID: quirks: work around VID/PID conflict for appledisplay (git-fixes).\n- Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard (git-fixes).\n- Input: cros_ec_keyb - fix an invalid memory access (stable-fixes).\n- Input: goodix - add support for ACPI ID GDIX1003 (stable-fixes).\n- Input: goodix - add support for ACPI ID GDX9110 (stable-fixes).\n- Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table (stable-fixes).\n- Input: ti_am335x_tsc - fix off-by-one error in wire_order validation (git-fixes).\n- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (git-fixes).\n- KEYS: trusted_tpm1: Compare HMAC values in constant time (git-fixes).\n- KVM: SEV: Drop GHCB_VERSION_DEFAULT and open code it (bsc#1255463).\n- PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths (git-fixes).\n- PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition (git-fixes).\n- PCI: keystone: Exit ks_pcie_probe() for invalid mode (git-fixes).\n- PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2 (git-fixes).\n- PM: runtime: Do not clear needs_force_resume with enabled runtime PM (git-fixes).\n- Revert 'drm/amd/display: Fix pbn to kbps Conversion' (stable-fixes).\n- Revert 'drm/amd/display: Move setup_stream_attribute' (stable-fixes).\n- Revert 'drm/amd: Skip power ungate during suspend for VPE' (git-fixes).\n- Revert 'mtd: rawnand: marvell: fix layouts' (git-fixes).\n- Revert 'net: r8169: Disable multicast filter for RTL8168H and RTL8107E' (jsc#PED-14353).\n- Revert 'r8169: don't try to disable interrupts if NAPI is, scheduled already' (jsc#PED-14353).\n- USB: Fix descriptor count when handling invalid MBIM extended descriptor (git-fixes).\n- USB: lpc32xx_udc: Fix error handling in probe (git-fixes).\n- USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC (git-fixes).\n- USB: serial: ftdi_sio: add support for u-blox EVK-M101 (stable-fixes).\n- USB: serial: ftdi_sio: match on interface number for jtag (stable-fixes).\n- USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC (git-fixes).\n- USB: serial: option: add Foxconn T99W760 (stable-fixes).\n- USB: serial: option: add Quectel RG255C (stable-fixes).\n- USB: serial: option: add Telit Cinterion FE910C04 new compositions (stable-fixes).\n- USB: serial: option: add Telit FN920C04 ECM compositions (stable-fixes).\n- USB: serial: option: add UNISOC UIS7720 (stable-fixes).\n- USB: serial: option: add support for Rolling RW101R-GL (stable-fixes).\n- USB: serial: option: move Telit 0x10c7 composition in the right place (stable-fixes).\n- USB: storage: Remove subclass and protocol overrides from Novatek quirk (git-fixes).\n- accel/ivpu: Fix DCT active percent format (git-fixes).\n- accel/ivpu: Fix race condition when unbinding BOs (git-fixes).\n- arm64: zynqmp: Fix usb node drive strength and slew rate (git-fixes).\n- arm64: zynqmp: Revert usb node drive strength and slew rate for (git-fixes).\n- atm/fore200e: Fix possible data race in fore200e_open() (git-fixes).\n- atm: Fix dma_free_coherent() size (git-fixes).\n- atm: idt77252: Add missing `dma_map_error()` (stable-fixes).\n- backlight: led-bl: Add devlink to supplier LEDs (git-fixes).\n- backlight: lp855x: Fix lp855x.h kernel-doc warnings (git-fixes).\n- bpf: Do not limit bpf_cgroup_from_id to current's namespace (bsc#1255433).\n- bpf: Reject bpf_timer for PREEMPT_RT (git-fixes).\n- broadcom: b44: prevent uninitialized value usage (git-fixes).\n- btrfs: make sure extent and csum paths are always released in scrub_raid56_parity_stripe() (git-fixes).\n- can: gs_usb: gs_can_open(): fix error handling (git-fixes).\n- can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs (git-fixes).\n- can: j1939: make j1939_sk_bind() fail if device is no longer registered (git-fixes).\n- can: kvaser_usb: leaf: Fix potential infinite loop in command parsers (git-fixes).\n- can: sja1000: fix max irq loop handling (git-fixes).\n- can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling (git-fixes).\n- cgroup: rstat: use LOCK CMPXCHG in css_rstat_updated (bsc#1255434).\n- char: applicom: fix NULL pointer dereference in ac_ioctl (stable-fixes).\n- cifs: Fix uncached read into ITER_KVEC iterator (bsc#1245449).\n- clk: qcom: camcc-sm6350: Fix PLL config of PLL2 (git-fixes).\n- clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to other (git-fixes).\n- clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback (git-fixes).\n- clk: renesas: r9a06g032: Fix memory leak in error path (git-fixes).\n- clk: samsung: exynos-clkout: Assign .num before accessing .hws (git-fixes).\n- comedi: c6xdigio: Fix invalid PNP driver unregistration (git-fixes).\n- comedi: check device's attached status in compat ioctls (git-fixes).\n- comedi: multiq3: sanitize config options in multiq3_attach() (git-fixes).\n- comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel() (git-fixes).\n- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (git-fixes).\n- cpufreq: nforce2: fix reference count leak in nforce2 (git-fixes).\n- cpuidle: menu: Use residency threshold in polling state override decisions (bsc#1255026).\n- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (git-fixes).\n- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (git-fixes).\n- crypto: ccree - Correctly handle return of sg_nents_for_len (git-fixes).\n- crypto: hisilicon/qm - restore original qos values (git-fixes).\n- crypto: iaa - Fix incorrect return value in save_iaa_wq() (git-fixes).\n- crypto: qat - fix duplicate restarting msg during AER error (git-fixes).\n- crypto: rockchip - drop redundant crypto_skcipher_ivsize() calls (git-fixes).\n- crypto: seqiv - Do not use req-\u003eiv after crypto_aead_encrypt (git-fixes).\n- dm-integrity: limit MAX_TAG_SIZE to 255 (git-fixes).\n- dm-verity: fix unreliable memory allocation (git-fixes).\n- dm: fix queue start/stop imbalance under suspend/load/resume races (bsc#1253386).\n- drivers/usb/dwc3: fix PCI parent check (git-fixes).\n- drm/amd/amdgpu: reserve vm invalidation engine for uni_mes (stable-fixes).\n- drm/amd/display: Check NULL before accessing (stable-fixes).\n- drm/amd/display: Clear the CUR_ENABLE register on DCN20 on DPP5 (stable-fixes).\n- drm/amd/display: Don't change brightness for disabled connectors (stable-fixes).\n- drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() (git-fixes).\n- drm/amd/display: Fix pbn to kbps Conversion (stable-fixes).\n- drm/amd/display: Fix scratch registers offsets for DCN35 (stable-fixes).\n- drm/amd/display: Fix scratch registers offsets for DCN351 (stable-fixes).\n- drm/amd/display: Increase DPCD read retries (stable-fixes).\n- drm/amd/display: Insert dccg log for easy debug (stable-fixes).\n- drm/amd/display: Move sleep into each retry for retrieve_link_cap() (stable-fixes).\n- drm/amd/display: Prevent Gating DTBCLK before It Is Properly Latched (git-fixes).\n- drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() (stable-fixes).\n- drm/amd/display: avoid reset DTBCLK at clock init (stable-fixes).\n- drm/amd/display: disable DPP RCG before DPP CLK enable (stable-fixes).\n- drm/amd: Skip power ungate during suspend for VPE (stable-fixes).\n- drm/amdgpu/gmc11: add amdgpu_vm_handle_fault() handling (stable-fixes).\n- drm/amdgpu/gmc12: add amdgpu_vm_handle_fault() handling (stable-fixes).\n- drm/amdgpu: Forward VMID reservation errors (git-fixes).\n- drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled (stable-fixes).\n- drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma (git-fixes).\n- drm/amdgpu: fix cyan_skillfish2 gpu info fw handling (git-fixes).\n- drm/amdgpu: fix gpu page fault after hibernation on PF passthrough (stable-fixes).\n- drm/amdkfd: Export the cwsr_size and ctl_stack_size to userspace (stable-fixes).\n- drm/amdkfd: Fix GPU mappings for APU after prefetch (stable-fixes).\n- drm/amdkfd: Trap handler support for expert scheduling mode (stable-fixes).\n- drm/amdkfd: Use huge page size to check split svm range alignment (git-fixes).\n- drm/amdkfd: bump minimum vgpr size for gfx1151 (stable-fixes).\n- drm/displayid: add quirk to ignore DisplayID checksum errors (stable-fixes).\n- drm/displayid: pass iter to drm_find_displayid_extension() (stable-fixes).\n- drm/edid: add DRM_EDID_IDENT_INIT() to initialize struct drm_edid_ident (stable-fixes).\n- drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() (git-fixes).\n- drm/i915/dp: Initialize the source OUI write timestamp always (stable-fixes).\n- drm/i915/dp_mst: Disable Panel Replay (git-fixes).\n- drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer (git-fixes).\n- drm/i915: Fix format string truncation warning (git-fixes).\n- drm/imagination: Disallow exporting of PM/FW protected objects (git-fixes).\n- drm/imagination: Fix reference to devm_platform_get_and_ioremap_resource() (git-fixes).\n- drm/me/gsc: mei interrupt top half should be in irq disabled context (git-fixes).\n- drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue (git-fixes).\n- drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse() (git-fixes).\n- drm/mediatek: Fix probe device leaks (git-fixes).\n- drm/mediatek: Fix probe memory leak (git-fixes).\n- drm/mediatek: Fix probe resource leaks (git-fixes).\n- drm/mediatek: ovl_adaptor: Fix probe device leaks (git-fixes).\n- drm/mgag200: Fix big-endian support (git-fixes).\n- drm/msm/a2xx: stop over-complaining about the legacy firmware (git-fixes).\n- drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers (git-fixes).\n- drm/msm/a6xx: Fix the gemnoc workaround (git-fixes).\n- drm/msm/a6xx: Flush LRZ cache before PT switch (git-fixes).\n- drm/msm/a6xx: Improve MX rail fallback in RPMH vote init (git-fixes).\n- drm/msm/dpu: Add missing NULL pointer check for pingpong interface (git-fixes).\n- drm/msm/dpu: Remove dead-code in dpu_encoder_helper_reset_mixers() (git-fixes).\n- drm/msm/dpu: drop dpu_hw_dsc_destroy() prototype (git-fixes).\n- drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb (git-fixes).\n- drm/nouveau: refactor deprecated strcpy (git-fixes).\n- drm/nouveau: restrict the flush page to a 32-bit address (git-fixes).\n- drm/panel: sony-td4353-jdi: Enable prepare_prev_first (git-fixes).\n- drm/panel: visionox-rm69299: Don't clear all mode flags (git-fixes).\n- drm/panthor: Avoid adding of kernel BOs to extobj list (git-fixes).\n- drm/panthor: Fix UAF on kernel BO VA nodes (git-fixes).\n- drm/panthor: Fix group_free_queue() for partially initialized queues (git-fixes).\n- drm/panthor: Fix potential memleak of vma structure (git-fixes).\n- drm/panthor: Fix race with suspend during unplug (git-fixes).\n- drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (git-fixes).\n- drm/panthor: Handle errors returned by drm_sched_entity_init() (git-fixes).\n- drm/pl111: Fix error handling in pl111_amba_probe (git-fixes).\n- drm/plane: Fix IS_ERR() vs NULL check in drm_plane_create_hotspot_properties() (git-fixes).\n- drm/radeon: delete radeon_fence_process in is_signaled, no deadlock (stable-fixes).\n- drm/sched: Fix race in drm_sched_entity_select_rq() (git-fixes).\n- drm/tilcdc: Fix removal actions in case of failed probe (git-fixes).\n- drm/tilcdc: request and mapp iomem with devres (stable-fixes).\n- drm/ttm: Avoid NULL pointer deref for evicted BOs (git-fixes).\n- drm/vgem-fence: Fix potential deadlock on release (git-fixes).\n- drm/vmwgfx: Use kref in vmw_bo_dirty (stable-fixes).\n- drm/xe/bo: Don't include the CCS metadata in the dma-buf sg-table (git-fixes).\n- drm/xe/oa: Disallow 0 OA property values (git-fixes).\n- drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl() (git-fixes).\n- drm/xe/oa: Limit num_syncs to prevent oversized allocations (git-fixes).\n- drm/xe: Adjust long-running workload timeslices to reasonable values (git-fixes).\n- drm/xe: Drop preempt-fences when destroying imported dma-bufs (git-fixes).\n- drm/xe: Fix conversion from clock ticks to milliseconds (git-fixes).\n- drm/xe: Limit num_syncs to prevent oversized allocations (git-fixes).\n- drm/xe: Prevent BIT() overflow when handling invalid prefetch region (git-fixes).\n- drm/xe: Restore engine registers before restarting schedulers after GT reset (git-fixes).\n- drm/xe: Use usleep_range for accurate long-running workload timeslicing (git-fixes).\n- drm: atmel-hlcdc: fix atmel_xlcdc_plane_setup_scaler() (git-fixes).\n- drm: nouveau: Replace sprintf() with sysfs_emit() (git-fixes).\n- drm: sti: fix device leaks at component probe (git-fixes).\n- efi/libstub: Avoid physical address 0x0 when doing random allocation (stable-fixes).\n- efi/libstub: Describe missing 'out' parameter in efi_load_initrd (git-fixes).\n- efi/libstub: Fix page table access in 5-level to 4-level paging transition (git-fixes).\n- efi: stmm: Fix incorrect buffer allocation method (git-fixes).\n- efi: stmm: fix kernel-doc 'bad line' warnings (git-fixes).\n- exfat: add a check for invalid data size (git-fixes).\n- exfat: using hweight instead of internal logic (git-fixes).\n- ext4: use optimized mballoc scanning regardless of inode format (bsc#1254378).\n- ext4: wait for ongoing I/O to complete before freeing blocks (bsc#1256366).\n- fbdev: gbefb: fix to use physical address instead of dma address (stable-fixes).\n- fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing (git-fixes).\n- fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() (git-fixes).\n- fbdev: tcx.c fix mem_map to correct smem_start offset (git-fixes).\n- firewire: nosy: Fix dma_free_coherent() size (git-fixes).\n- firmware: imx: scu-irq: Init workqueue before request mbox channel (stable-fixes).\n- firmware: imx: scu-irq: fix OF node leak in (git-fixes).\n- firmware: stratix10-svc: Add mutex in stratix10 memory management (git-fixes).\n- firmware: stratix10-svc: fix bug in saving controller data (git-fixes).\n- firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc (git-fixes).\n- fs: dlm: allow to F_SETLKW getting interrupted (bsc#1255025).\n- ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct() (git-fixes).\n- genalloc.h: fix htmldocs warning (git-fixes).\n- gpio: rockchip: mark the GPIO controller as sleeping (git-fixes).\n- gpu: host1x: Fix race in syncpt alloc/free (git-fixes).\n- hwmon: (ibmpex) fix use-after-free in high/low store (git-fixes).\n- hwmon: (max16065) Use local variable to avoid TOCTOU (git-fixes).\n- hwmon: (tmp401) fix overflow caused by default conversion rate value (git-fixes).\n- hwmon: (w83791d) Convert macros to functions to avoid TOCTOU (git-fixes).\n- hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU (git-fixes).\n- hwmon: sy7636a: Fix regulator_enable resource leak on error path (git-fixes).\n- i2c: amd-mp2: fix reference leak in MP2 PCI device (git-fixes).\n- i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured firmware (stable-fixes).\n- i2c: i2c.h: fix a bad kernel-doc line (git-fixes).\n- i3c: fix refcount inconsistency in i3c_master_register (git-fixes).\n- i3c: master: Inherit DMA masks and parameters from parent device (stable-fixes).\n- i3c: master: svc: Prevent incomplete IBI transaction (git-fixes).\n- idr: fix idr_alloc() returning an ID out of range (git-fixes).\n- iio: accel: bmc150: Fix irq assumption regression (stable-fixes).\n- iio: accel: fix ADXL355 startup race condition (git-fixes).\n- iio: adc: ad7280a: fix ad7280_store_balance_timer() (git-fixes).\n- iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains (stable-fixes).\n- iio: core: Clean up device correctly on iio_device_alloc() failure (git-fixes).\n- iio: core: add missing mutex_destroy in iio_dev_release() (git-fixes).\n- iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member (git-fixes).\n- iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields (git-fixes).\n- iio: st_lsm6dsx: Fixed calibrated timestamp calculation (git-fixes).\n- ima: Handle error code returned by ima_filter_rule_match() (git-fixes).\n- intel_th: Fix error handling in intel_th_output_open (git-fixes).\n- ipmi: Fix __scan_channels() failing to rescan channels (stable-fixes).\n- ipmi: Fix handling of messages with provided receive message pointer (git-fixes).\n- ipmi: Fix the race between __scan_channels() and deliver_response() (stable-fixes).\n- ipmi: Rework user message limit handling (git-fixes).\n- irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() (git-fixes).\n- kconfig/mconf: Initialize the default locale at startup (stable-fixes).\n- kconfig/nconf: Initialize the default locale at startup (stable-fixes).\n- leds: leds-lp50xx: Allow LED 0 to be added to module bank (git-fixes).\n- leds: leds-lp50xx: Enable chip before any communication (git-fixes).\n- leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs (git-fixes).\n- leds: netxbig: Fix GPIO descriptor leak in error paths (git-fixes).\n- lib/vsprintf: Check pointer before dereferencing in time_and_date() (git-fixes).\n- mailbox: mailbox-test: Fix debugfs_create_dir error checking (git-fixes).\n- media: TDA1997x: Remove redundant cancel_delayed_work in probe (git-fixes).\n- media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() (git-fixes).\n- media: amphion: Add a frame flush mode for decoder (stable-fixes).\n- media: amphion: Cancel message work before releasing the VPU core (git-fixes).\n- media: amphion: Make some vpu_v4l2 functions static (stable-fixes).\n- media: amphion: Remove vpu_vb_is_codecconfig (git-fixes).\n- media: atomisp: Prefix firmware paths with 'intel/ipu/' (bsc#1252973).\n- media: atomisp: Remove firmware_name module parameter (bsc#1252973).\n- media: cec: Fix debugfs leak on bus_register() failure (git-fixes).\n- media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() (git-fixes).\n- media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe (git-fixes).\n- media: i2c: adv7842: Remove redundant cancel_delayed_work in probe (git-fixes).\n- media: imx-mipi-csis: Drop extra clock enable at probe() (git-fixes).\n- media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() (git-fixes).\n- media: nxp: imx8-isi: Mark all crossbar sink pads as MUST_CONNECT (stable-fixes).\n- media: ov5640: fix vblank unchange issue when work at dvp mode (git-fixes).\n- media: pci: ivtv: Don't create fake v4l2_fh (stable-fixes).\n- media: pvrusb2: Fix incorrect variable used in trace message (git-fixes).\n- media: qcom: camss: Fix genpd cleanup (git-fixes).\n- media: qcom: camss: Fix ordering of pm_runtime_enable (git-fixes).\n- media: qcom: camss: cleanup media device allocated resource on error path (git-fixes).\n- media: qcom: venus: fix incorrect return value (stable-fixes).\n- media: radio-isa: use dev_name to fill in bus_info (stable-fixes).\n- media: rc: st_rc: Fix reset control resource leak (git-fixes).\n- media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled (git-fixes).\n- media: s5p-mfc: Fix potential deadlock on condlock (stable-fixes).\n- media: samsung: exynos4-is: fix potential ABBA deadlock on init (git-fixes).\n- media: uvcvideo: Force UVC version to 1.0a for 0408:4033 (stable-fixes).\n- media: v4l2-mem2mem: Fix outdated documentation (git-fixes).\n- media: verisilicon: Fix CPU stalls on G2 bus error (git-fixes).\n- media: verisilicon: Protect G2 HEVC decoder against invalid DPB index (git-fixes).\n- media: verisilicon: Store chroma and motion vectors offset (stable-fixes).\n- media: verisilicon: g2: Use common helpers to compute chroma and mv offsets (stable-fixes).\n- media: videobuf2: Fix device reference leak in vb2_dc_alloc error path (git-fixes).\n- media: vidtv: initialize local pointers upon transfer of memory ownership (git-fixes).\n- media: vpif_capture: fix section mismatch (git-fixes).\n- media: vpif_display: fix section mismatch (git-fixes).\n- mei: gsc: add dependency on Xe driver (git-fixes).\n- mei: me: add wildcat lake P DID (stable-fixes).\n- mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup (git-fixes).\n- mfd: da9055: Fix missing regmap_del_irq_chip() in error path (git-fixes).\n- mfd: max77620: Fix potential IRQ chip conflict when probing two devices (git-fixes).\n- mfd: mt6358-irq: Fix missing irq_domain_remove() in error path (git-fixes).\n- mfd: mt6397-irq: Fix missing irq_domain_remove() in error path (git-fixes).\n- mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig (git-fixes).\n- mmc: sdhci-msm: Avoid early clock doubling during HS400 transition (stable-fixes).\n- most: usb: fix double free on late probe failure (git-fixes).\n- mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() (git-fixes).\n- mtd: lpddr_cmds: fix signed shifts in lpddr_cmds (git-fixes).\n- mtd: maps: pcmciamtd: fix potential memory leak in pcmciamtd_detach() (git-fixes).\n- mtd: nand: relax ECC parameter validation check (git-fixes).\n- mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove (git-fixes).\n- mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors (git-fixes).\n- net: mdio: aspeed: add dummy read to avoid read-after-write issue (git-fixes).\n- net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write (git-fixes).\n- net: phy: adin1100: Fix software power-down ready condition (git-fixes).\n- net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY (git-fixes).\n- net: phy: mxl-gpy: fix link properties on USXGMII and internal PHYs (git-fixes).\n- net: r8169: Disable multicast filter for RTL8168H and RTL8107E (jsc#PED-14353).\n- net: rose: fix invalid array index in rose_kill_by_device() (git-fixes).\n- net: usb: pegasus: fix memory leak in update_eth_regs_async() (git-fixes).\n- net: usb: rtl8150: fix memory leak on usb_submit_urb() failure (git-fixes).\n- net: usb: sr9700: fix incorrect command used to write single register (git-fixes).\n- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (git-fixes).\n- netdevsim: print human readable IP address (bsc#1255071).\n- nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() (git-fixes).\n- nfsd: do not defer requests during idmap lookup in v4 compound decode (bsc#1232223).\n- nfsd: fix return error codes for nfsd_map_name_to_id (bsc#1232223).\n- nvme: Use non zero KATO for persistent discovery connections (git-fixes).\n- orangefs: fix xattr related buffer overflow.. (git-fixes).\n- perf list: Add IBM z17 event descriptions (jsc#PED-13611).\n- perf/x86/intel: Fix KASAN global-out-of-bounds warning (git-fixes).\n- phy: broadcom: bcm63xx-usbh: fix section mismatches (git-fixes).\n- phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe() (git-fixes).\n- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (git-fixes).\n- pinctrl: qcom: msm: Fix deadlock in pinmux configuration (stable-fixes).\n- pinctrl: single: Fix PIN_CONFIG_BIAS_DISABLE handling (stable-fixes).\n- pinctrl: single: Fix incorrect type for error return variable (git-fixes).\n- pinctrl: stm32: fix hwspinlock resource leak in probe function (git-fixes).\n- platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver (git-fixes).\n- platform/mellanox: mlxbf-pmc: Remove trailing whitespaces from event names (git-fixes).\n- platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally (stable-fixes).\n- platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list (stable-fixes).\n- platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks (stable-fixes).\n- platform/x86: acer-wmi: Ignore backlight event (stable-fixes).\n- platform/x86: asus-wmi: use brightness_set_blocking() for kbd led (git-fixes).\n- platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing (git-fixes).\n- platform/x86: huawei-wmi: add keys for HONOR models (stable-fixes).\n- platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic (git-fixes).\n- platform/x86: intel: chtwc_int33fe: don't dereference swnode args (git-fixes).\n- platform/x86: intel: punit_ipc: fix memory corruption (git-fixes).\n- platform/x86: msi-laptop: add missing sysfs_remove_group() (git-fixes).\n- power: supply: apm_power: only unset own apm_get_power_status (git-fixes).\n- power: supply: cw2015: Check devm_delayed_work_autocancel() return code (git-fixes).\n- power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges() (git-fixes).\n- power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges() (git-fixes).\n- power: supply: wm831x: Check wm831x_set_bits() return value (git-fixes).\n- powerpc/64s/slb: Fix SLB multihit issue during SLB preload (bac#1236022 ltc#211187).\n- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (bsc#1253262 ltc#216029).\n- powerpc/kexec: Enable SMT before waking offline CPUs (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588 git-fixes bsc#1253739 ltc#211493 bsc#1254244 ltc#216496).\n- pwm: bcm2835: Make sure the channel is enabled after pwm_request() (git-fixes).\n- r8169: Fix spelling mistake: 'tx_underun' -\u003e 'tx_underrun' (jsc#PED-14353).\n- r8169: Use PCI_IRQ_INTX instead of PCI_IRQ_LEGACY (jsc#PED-14353).\n- r8169: add MODULE_FIRMWARE entry for RTL8126A (jsc#PED-14353).\n- r8169: add PHY c45 ops for MDIO_MMD_VENDOR2 registers (jsc#PED-14353).\n- r8169: add generic rtl_set_eee_txidle_timer function (jsc#PED-14353).\n- r8169: add missing MODULE_FIRMWARE entry for RTL8126A rev.b (jsc#PED-14353).\n- r8169: add support for Intel Killer E5000 (jsc#PED-14353).\n- r8169: add support for RTL8125BP rev.b (jsc#PED-14353).\n- r8169: add support for RTL8125D (jsc#PED-14353).\n- r8169: add support for RTL8125D rev.b (jsc#PED-14353).\n- r8169: add support for RTL8126A rev.b (jsc#PED-14353).\n- r8169: add support for RTL8168M (jsc#PED-14353).\n- r8169: add support for returning tx_lpi_timer in ethtool get_eee (jsc#PED-14353).\n- r8169: add support for the temperature sensor being available from RTL8125B (jsc#PED-14353).\n- r8169: adjust version numbering for RTL8126 (jsc#PED-14353).\n- r8169: align RTL8125 EEE config with vendor driver (jsc#PED-14353).\n- r8169: align RTL8125/RTL8126 PHY config with vendor driver (jsc#PED-14353).\n- r8169: align RTL8126 EEE config with vendor driver (jsc#PED-14353).\n- r8169: align WAKE_PHY handling with r8125/r8126 vendor drivers (jsc#PED-14353).\n- r8169: avoid duplicated messages if loading firmware fails and switch to warn level (jsc#PED-14353).\n- r8169: avoid unsolicited interrupts (jsc#PED-14353).\n- r8169: check for PCI read error in probe (jsc#PED-14353).\n- r8169: disable ALDPS per default for RTL8125 (jsc#PED-14353).\n- r8169: disable RTL8126 ZRX-DC timeout (jsc#PED-14353).\n- r8169: disable interrupt source RxOverflow (jsc#PED-14353).\n- r8169: don't apply UDP padding quirk on RTL8126A (jsc#PED-14353).\n- r8169: don't increment tx_dropped in case of NETDEV_TX_BUSY (jsc#PED-14353).\n- r8169: don't scan PHY addresses \u003e 0 (jsc#PED-14353).\n- r8169: don't take RTNL lock in rtl_task() (jsc#PED-14353).\n- r8169: enable EEE at 2.5G per default on RTL8125B (jsc#PED-14353).\n- r8169: enable RTL8168H/RTL8168EP/RTL8168FP ASPM support (jsc#PED-14353).\n- r8169: fix RTL8117 Wake-on-Lan in DASH mode (git-fixes).\n- r8169: fix inconsistent indenting in rtl8169_get_eth_mac_stats (jsc#PED-14353).\n- r8169: implement additional ethtool stats ops (jsc#PED-14353).\n- r8169: improve RTL8411b phy-down fixup (jsc#PED-14353).\n- r8169: improve __rtl8169_set_wol (jsc#PED-14353).\n- r8169: improve handling task scheduling (jsc#PED-14353).\n- r8169: improve initialization of RSS registers on RTL8125/RTL8126 (jsc#PED-14353).\n- r8169: improve rtl_set_d3_pll_down (jsc#PED-14353).\n- r8169: increase max jumbo packet size on RTL8125/RTL8126 (jsc#PED-14353).\n- r8169: remove detection of chip version 11 (early RTL8168b) (jsc#PED-14353).\n- r8169: remove leftover locks after reverted change (jsc#PED-14353).\n- r8169: remove multicast filter limit (jsc#PED-14353).\n- r8169: remove not needed check in rtl_fw_write_firmware (jsc#PED-14353).\n- r8169: remove original workaround for RTL8125 broken rx issue (jsc#PED-14353).\n- r8169: remove redundant hwmon support (jsc#PED-14353).\n- r8169: remove rtl_dash_loop_wait_high/low (jsc#PED-14353).\n- r8169: remove support for chip version 11 (jsc#PED-14353).\n- r8169: remove unused flag RTL_FLAG_TASK_RESET_NO_QUEUE_WAKE (jsc#PED-14353).\n- r8169: set EEE speed down ratio to 1 (stable-fixes).\n- r8169: simplify EEE handling (jsc#PED-14353).\n- r8169: simplify code by using core-provided pcpu stats allocation (jsc#PED-14353).\n- r8169: support setting the EEE tx idle timer on RTL8168h (jsc#PED-14353).\n- r8169: use dev_err_probe in all appropriate places in rtl_init_one() (jsc#PED-14353).\n- r8169: use helper r8169_mod_reg8_cond to simplify rtl_jumbo_config (jsc#PED-14353).\n- regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex (git-fixes).\n- regulator: core: disable supply if enabling main regulator fails (git-fixes).\n- reset: fix BIT macro reference (stable-fixes).\n- rpmsg: glink: fix rpmsg device leak (git-fixes).\n- rtc: gamecube: Check the return value of ioremap() (git-fixes).\n- scsi: lpfc: Add capability to register Platform Name ID to fabric (bsc#1254119).\n- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (bsc#1254119).\n- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (bsc#1254119).\n- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (bsc#1254119).\n- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (bsc#1254119).\n- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (bsc#1254119).\n- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (bsc#1254119).\n- scsi: lpfc: Revise discovery related function headers and comments (bsc#1254119).\n- scsi: lpfc: Update lpfc version to 14.4.0.12 (bsc#1254119).\n- scsi: lpfc: Update various NPIV diagnostic log messaging (bsc#1254119).\n- scsi: mpi3mr: Fix I/O failures during controller reset (bsc#1251752 jsc#PED-14280).\n- scsi: mpi3mr: Fix controller init failure on fault during queue creation (bsc#1251752 jsc#PED-14280).\n- scsi: mpi3mr: Fix device loss during enclosure reboot due to zero link speed (bsc#1251752 jsc#PED-14280).\n- scsi: mpi3mr: Fix premature TM timeouts on virtual drives (bsc#1251752 jsc#PED-14280).\n- scsi: mpi3mr: Update MPI headers to revision 37 (bsc#1251752 jsc#PED-14280).\n- scsi: mpi3mr: Update driver version to 8.14.0.5.50 (bsc#1251752 jsc#PED-14280).\n- scsi: mpi3mr: Update driver version to 8.15.0.5.50 (bsc#1251752 jsc#PED-14280).\n- selftests/bpf: Skip timer cases when bpf_timer is not supported (git-fixes).\n- selftests/net: calibrate txtimestamp (bsc#1255085).\n- selftests/net: convert fcnal-test.sh to run it in unique namespace (bsc#1254235).\n- selftests/net: convert fib-onlink-tests.sh to run it in unique namespace (bsc#1254235).\n- selftests/net: convert fib_nexthop_multiprefix to run it in unique namespace (bsc#1254235).\n- selftests/net: convert fib_nexthop_nongw.sh to run it in unique namespace (bsc#1254235).\n- selftests/net: convert fib_nexthops.sh to run it in unique namespace (bsc#1254235).\n- selftests/net: convert fib_rule_tests.sh to run it in unique namespace (bsc#1254235).\n- selftests/net: convert fib_tests.sh to run it in unique namespace (bsc#1254235).\n- selftests/net: convert srv6_end_dt46_l3vpn_test.sh to run it in unique namespace (bsc#1254235).\n- selftests/net: convert srv6_end_dt4_l3vpn_test.sh to run it in unique namespace (bsc#1254235).\n- selftests/net: convert srv6_end_dt6_l3vpn_test.sh to run it in unique namespace (bsc#1254235).\n- selftests/net: convert test_vxlan_vnifiltering.sh to run it in unique namespace (bsc#1255349).\n- selftests/net: convert vrf_route_leaking.sh to run it in unique namespace (bsc#1255349).\n- selftests/net: synchronize udpgro tests' tx and rx connection (bsc#1254235).\n- selftests: Introduce Makefile variable to list shared bash scripts (bsc#1254235).\n- selftests: bonding: Add net/forwarding/lib.sh to TEST_INCLUDES (bsc#1254235).\n- selftests: dsa: Replace test symlinks by wrapper script (bsc#1254235).\n- selftests: net: Remove executable bits from library scripts (bsc#1254235).\n- selftests: net: explicitly wait for listener ready (bsc#1254235).\n- selftests: net: fib-onlink-tests: Set high metric for default IPv6 route (bsc#1255346).\n- selftests: net: include forwarding lib (bsc#1254235).\n- selftests: net: included needed helper in the install targets (bsc#1254235).\n- selftests: net: more strict check in net_helper (bsc#1254235).\n- selftests: net: use slowwait to make sure IPv6 setup finished (bsc#1255349).\n- selftests: net: use slowwait to stabilize vrf_route_leaking test (bsc#1255349).\n- selftests: net: veth: test the ability to independently manipulate GRO and XDP (bsc#1255101).\n- selftests: team: Add shared library scripts to TEST_INCLUDES (bsc#1254235).\n- selftests: vrf_route_leaking: remove ipv6_ping_frag from default testing (bsc#1255349).\n- serial: add support of CPCI cards (stable-fixes).\n- serial: amba-pl011: prefer dma_mapping_error() over explicit address checking (git-fixes).\n- serial: core: Fix serial device initialization (git-fixes).\n- serial: core: Restore sysfs fwnode information (git-fixes).\n- serial: sprd: Return -EPROBE_DEFER when uart clock is not ready (stable-fixes).\n- slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves (git-fixes).\n- smc91x: fix broken irq-context in PREEMPT_RT (git-fixes).\n- soc/tegra: fuse: speedo-tegra210: Update speedo IDs (git-fixes).\n- soc: amlogic: canvas: fix device leak on lookup (git-fixes).\n- soc: qcom: ocmem: fix device leak on lookup (git-fixes).\n- soc: qcom: smem: fix hwspinlock resource leak in probe error paths (git-fixes).\n- spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors (git-fixes).\n- spi: bcm63xx: drop wrong casts in probe() (git-fixes).\n- spi: bcm63xx: fix premature CS deassertion on RX-only transactions (git-fixes).\n- spi: fsl-cpm: Check length parity before switching to 16 bit mode (git-fixes).\n- spi: imx: keep dma request disabled before dma transfer setup (stable-fixes).\n- spi: tegra210-qspi: Remove cache operations (git-fixes).\n- spi: tegra210-quad: Add support for internal DMA (git-fixes).\n- spi: tegra210-quad: Check hardware status on timeout (bsc#1253155).\n- spi: tegra210-quad: Fix timeout handling (bsc#1253155).\n- spi: tegra210-quad: Fix timeout handling (git-fixes).\n- spi: tegra210-quad: Refactor error handling into helper functions (bsc#1253155).\n- spi: tegra210-quad: Update dummy sequence configuration (git-fixes).\n- spi: xilinx: increase number of retries before declaring stall (stable-fixes).\n- staging: fbtft: core: fix potential memory leak in fbtft_probe_common() (git-fixes).\n- staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing (stable-fixes).\n- staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser (stable-fixes).\n- thunderbolt: Add support for Intel Wildcat Lake (stable-fixes).\n- tick/sched: Limit non-timekeeper CPUs calling jiffies update (bsc#1254477).\n- tracing: Fix access to trace_event_file (bsc#1254373).\n- uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe (git-fixes).\n- usb: cdns3: Fix double resource release in cdns3_pci_probe (git-fixes).\n- usb: chaoskey: fix locking for O_NONBLOCK (git-fixes).\n- usb: chipidea: udc: limit usb request length to max 16KB (stable-fixes).\n- usb: dwc2: disable platform lowlevel hw resources during shutdown (stable-fixes).\n- usb: dwc2: fix hang during shutdown if set as peripheral (git-fixes).\n- usb: dwc2: fix hang during suspend if set as peripheral (git-fixes).\n- usb: dwc3: Abort suspend on soft disconnect failure (git-fixes).\n- usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (git-fixes).\n- usb: dwc3: keep susphy enabled during exit to avoid controller faults (git-fixes).\n- usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe (git-fixes).\n- usb: dwc3: pci: Sort out the Intel device IDs (stable-fixes).\n- usb: dwc3: pci: add support for the Intel Nova Lake -S (stable-fixes).\n- usb: gadget: configfs: Correctly set use_os_string at bind (git-fixes).\n- usb: gadget: f_eem: Fix memory leak in eem_unwrap (git-fixes).\n- usb: gadget: lpc32xx_udc: fix clock imbalance in error path (git-fixes).\n- usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors (git-fixes).\n- usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt (git-fixes).\n- usb: ohci-nxp: Use helper function devm_clk_get_enabled() (stable-fixes).\n- usb: ohci-nxp: fix device leak on probe failure (git-fixes).\n- usb: phy: Initialize struct usb_phy list_head (git-fixes).\n- usb: phy: isp1301: fix non-OF device reference imbalance (git-fixes).\n- usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE (git-fixes).\n- usb: raw-gadget: do not limit transfer length (git-fixes).\n- usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() (git-fixes).\n- usb: storage: Fix memory leak in USB bulk transport (git-fixes).\n- usb: storage: sddr55: Reject out-of-bound new_pba (stable-fixes).\n- usb: typec: tipd: Clear interrupts first (git-fixes).\n- usb: typec: ucsi: Handle incorrect num_connectors capability (stable-fixes).\n- usb: typec: ucsi: psy: Set max current to zero when disconnected (git-fixes).\n- usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer (git-fixes).\n- usb: udc: Add trace event for usb_gadget_set_state (stable-fixes).\n- usb: usb-storage: Maintain minimal modifications to the bcdDevice range (git-fixes).\n- usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive (stable-fixes).\n- usb: vhci-hcd: Prevent suspending virtually attached devices (git-fixes).\n- usb: xhci: limit run_graceperiod for only usb 3.0 devices (stable-fixes).\n- usbip: Fix locking bug in RT-enabled kernels (stable-fixes).\n- via_wdt: fix critical boot hang due to unnamed resource allocation (stable-fixes).\n- virtio_console: fix order of fields cols and rows (stable-fixes).\n- watchdog: wdat_wdt: Fix ACPI table leak in probe function (git-fixes).\n- wifi: ath10k: Add missing include of export.h (stable-fixes).\n- wifi: ath10k: Avoid vdev delete timeout when firmware is already down (stable-fixes).\n- wifi: ath10k: move recovery check logic into a new work (git-fixes).\n- wifi: ath11k: fix peer HE MCS assignment (git-fixes).\n- wifi: ath11k: restore register window after global reset (git-fixes).\n- wifi: ath12k: fix potential memory leak in ath12k_wow_arp_ns_offload() (git-fixes).\n- wifi: avoid kernel-infoleak from struct iw_point (git-fixes).\n- wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet (stable-fixes).\n- wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() (git-fixes).\n- wifi: cfg80211: stop radar detection in cfg80211_leave() (stable-fixes).\n- wifi: cfg80211: use cfg80211_leave() in iftype change (stable-fixes).\n- wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() (git-fixes).\n- wifi: ieee80211: correct FILS status codes (git-fixes).\n- wifi: mac80211: do not use old MBSSID elements (git-fixes).\n- wifi: mac80211: fix CMAC functions not handling errors (git-fixes).\n- wifi: mac80211: restore non-chanctx injection behaviour (git-fixes).\n- wifi: mt76: Fix DTS power-limits on little endian systems (git-fixes).\n- wifi: mt76: mt7925: fix CLC command timeout when suspend/resume (stable-fixes).\n- wifi: mt76: mt7925: fix the unfinished command of regd_notifier before suspend (stable-fixes).\n- wifi: mt76: mt792x: fix wifi init fail by setting MCU_RUNNING after CLC load (stable-fixes).\n- wifi: nl80211: vendor-cmd: intel: fix a blank kernel-doc line warning (git-fixes).\n- wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() (git-fixes).\n- wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() (git-fixes).\n- wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() (git-fixes).\n- wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1 (stable-fixes).\n- wifi: rtw88: limit indirect IO under powered off for RTL8822CS (git-fixes).\n- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (git-fixes).\n- x86/microcode/AMD: Add TSA microcode SHAs (bsc#1256528).\n- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (bsc#1256528).\n- x86/microcode/AMD: Add more known models to entry sign checking (bsc#1256528).\n- x86/microcode/AMD: Add some forgotten models to the SHA check (bsc#1256528).\n- x86/microcode/AMD: Clean the cache if update did not load microcode (bsc#1256528).\n- x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (bsc#1256528).\n- x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (bsc#1256528).\n- x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (bsc#1256528).\n- x86/microcode/AMD: Limit Entrysign signature checking to known generations (bsc#1256528).\n- x86/microcode/AMD: Load only SHA256-checksummed patches (bsc#1256528).\n- x86/microcode/AMD: Select which microcode patch to load (bsc#1256528).\n- x86/microcode/AMD: Use sha256() instead of init/update/final (bsc#1256528).\n- x86/microcode: Fix Entrysign revision check for Zen1/Naples (bsc#1256528).\n- xhci: dbgtty: fix device unregister (git-fixes).\n- xhci: fix stale flag preventig URBs after link state error is cleared (git-fixes).\n","status":"published","published":"2026-01-23T15:08:32Z","modified":"2026-03-23T04:52:05.948424Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0281-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP7 Azure kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).\n- CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).\n- CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).\n- CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).\n- CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).\n- CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).\n- CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).\n- CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).\n- CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).\n- CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).\n- CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).\n- CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).\n- CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).\n- CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).\n- CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).\n- CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).\n- CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).\n- CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).\n- CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).\n- CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).\n- CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).\n- CVE-2025-40215: kABI: xfrm: delete x-\u003etunnel as we delete x (bsc#1254959).\n- CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).\n- CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).\n- CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).\n- CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).\n- CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).\n- CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).\n- CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).\n- CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).\n- CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).\n- CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).\n- CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).\n- CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).\n- CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).\n- CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).\n- CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).\n- CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).\n- CVE-2025-40287: exfat: fix improper check of dentry.stream.valid_size (bsc#1255030).\n- CVE-2025-40289: drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (bsc#1255042).\n- CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).\n- CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).\n- CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187).\n- CVE-2025-40307: exfat: validate cluster allocation bits of the allocation bitmap (bsc#1255039).\n- CVE-2025-40319: bpf: Sync pending IRQ work before freeing ring buffer (bsc#1254794).\n- CVE-2025-40330: bnxt_en: Shutdown FW DMA in bnxt_shutdown() (bsc#1254616).\n- CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).\n- CVE-2025-40337: net: stmmac: Correctly handle Rx checksum offload errors (bsc#1255081).\n- CVE-2025-40338: ASoC: Intel: avs: Do not share the name pointer between components (bsc#1255273).\n- CVE-2025-40346: arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (bsc#1255318).\n- CVE-2025-40357: net/smc: fix general protection fault in __smc_diag_dump (bsc#1255097).\n- CVE-2025-68197: bnxt_en: Fix null pointer dereference in bnxt_bs_trace_check_wrap() (bsc#1255242).\n- CVE-2025-68204: pmdomain: arm: scmi: Fix genpd leak on provider registration failure (bsc#1255224).\n- CVE-2025-68206: netfilter: nft_ct: add seqadj extension for natted connections (bsc#1255142).\n- CVE-2025-68208: bpf: account for current allocated stack depth in widen_imprecise_scalars() (bsc#1255227).\n- CVE-2025-68209: mlx5: Fix default values in create CQ (bsc#1255230).\n- CVE-2025-68239: binfmt_misc: restore write access before closing files opened by open_exec() (bsc#1255272).\n- CVE-2025-68255: staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing (bsc#1255395).\n- CVE-2025-68259: KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced (bsc#1255199).\n- CVE-2025-68264: ext4: refresh inline data size before write operations (bsc#1255380).\n- CVE-2025-68302: net: sxgbe: fix potential NULL dereference in sxgbe_rx() (bsc#1255121).\n- CVE-2025-68340: team: Move team device type change at the end of team_port_add (bsc#1255507).\n- CVE-2025-68378: bpf: Refactor stack map trace depth calculation into helper function (bsc#1255614).\n- CVE-2025-68742: bpf: Improve program stats run-time calculation (bsc#1255707).\n- CVE-2025-68744: bpf: Free special fields when update [lru_,]percpu_hash maps (bsc#1255709).\n\nThe following non security issues were fixed:\n\n- ACPI: CPPC: Fix missing PCC check for guaranteed_perf (git-fixes).\n- ACPI: PCC: Fix race condition by removing static qualifier (git-fixes).\n- ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 (git-fixes).\n- ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() (git-fixes).\n- ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only (stable-fixes).\n- ACPICA: Avoid walking the Namespace if start_node is NULL (stable-fixes).\n- ALSA: ac97: fix a double free in snd_ac97_controller_register() (git-fixes).\n- ALSA: dice: fix buffer overflow in detect_stream_formats() (git-fixes).\n- ALSA: firewire-motu: add bounds check in put_user loop for DSP events (git-fixes).\n- ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (git-fixes).\n- ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() (git-fixes).\n- ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path (git-fixes).\n- ALSA: uapi: Fix typo in asound.h comment (git-fixes).\n- ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 (stable-fixes).\n- ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series (stable-fixes).\n- ALSA: usb-mixer: us16x08: validate meter packet indices (git-fixes).\n- ALSA: vxpocket: Fix resource leak in vxpocket_probe error path (git-fixes).\n- ASoC: Intel: catpt: Fix error path in hw_params() (git-fixes).\n- ASoC: ak4458: Disable regulator when error happens (git-fixes).\n- ASoC: ak4458: remove the reset operation in probe and remove (git-fixes).\n- ASoC: ak5558: Disable regulator when error happens (git-fixes).\n- ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() (git-fixes).\n- ASoC: codecs: lpass-tx-macro: fix SM6115 support (git-fixes).\n- ASoC: codecs: wcd938x: fix OF node leaks on probe failure (git-fixes).\n- ASoC: fsl_xcvr: clear the channel status control memory (git-fixes).\n- ASoC: qcom: q6adm: the the copp device only during last instance (git-fixes).\n- ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr (git-fixes).\n- ASoC: qcom: q6asm-dai: perform correct state check before closing (git-fixes).\n- ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment (git-fixes).\n- ASoC: stm32: sai: fix OF node leak on probe (git-fixes).\n- ASoC: stm32: sai: fix clk prepare imbalance on probe failure (git-fixes).\n- ASoC: stm32: sai: fix device leak on probe (git-fixes).\n- ASoC: sun4i-spdif: Add missing kerneldoc fields for sun4i_spdif_quirks (git-fixes).\n- Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 (git-fixes).\n- Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (git-fixes).\n- Bluetooth: SMP: Fix not generating mackey and ltk when repairing (git-fixes).\n- Bluetooth: btrtl: Avoid loading the config file on security chips (stable-fixes).\n- Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE (stable-fixes).\n- Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV (stable-fixes).\n- Bluetooth: btusb: mediatek: Avoid btusb_mtk_claim_iso_intf() NULL deref (git-fixes).\n- Bluetooth: btusb: mediatek: Fix kernel crash when releasing mtk iso interface (git-fixes).\n- Bluetooth: btusb: revert use of devm_kzalloc in btusb (git-fixes).\n- Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (git-fixes).\n- Documentation/kernel-parameters: fix typo in retbleed= kernel parameter description (git-fixes).\n- Documentation: hid-alps: Fix packet format section headings (git-fixes).\n- Documentation: parport-lowlevel: Separate function listing code blocks (git-fixes).\n- HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list (stable-fixes).\n- HID: elecom: Add support for ELECOM M-XT3URBK (018F) (stable-fixes).\n- HID: hid-input: Extend Elan ignore battery quirk to USB (stable-fixes).\n- HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen (stable-fixes).\n- HID: logitech-dj: Remove duplicate error logging (git-fixes).\n- HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync() (git-fixes).\n- HID: quirks: work around VID/PID conflict for appledisplay (git-fixes).\n- Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard (git-fixes).\n- Input: cros_ec_keyb - fix an invalid memory access (stable-fixes).\n- Input: goodix - add support for ACPI ID GDIX1003 (stable-fixes).\n- Input: goodix - add support for ACPI ID GDX9110 (stable-fixes).\n- Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table (stable-fixes).\n- Input: ti_am335x_tsc - fix off-by-one error in wire_order validation (git-fixes).\n- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (git-fixes).\n- KEYS: trusted_tpm1: Compare HMAC values in constant time (git-fixes).\n- KVM: SEV: Drop GHCB_VERSION_DEFAULT and open code it (bsc#1255463).\n- PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths (git-fixes).\n- PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition (git-fixes).\n- PCI: keystone: Exit ks_pcie_probe() for invalid mode (git-fixes).\n- PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2 (git-fixes).\n- PM: runtime: Do not clear needs_force_resume with enabled runtime PM (git-fixes).\n- Revert 'drm/amd/display: Fix pbn to kbps Conversion' (stable-fixes).\n- Revert 'drm/amd/display: Move setup_stream_attribute' (stable-fixes).\n- Revert 'drm/amd: Skip power ungate during suspend for VPE' (git-fixes).\n- Revert 'mtd: rawnand: marvell: fix layouts' (git-fixes).\n- Revert 'net: r8169: Disable multicast filter for RTL8168H and RTL8107E' (jsc#PED-14353).\n- Revert 'r8169: don't try to disable interrupts if NAPI is, scheduled already' (jsc#PED-14353).\n- USB: Fix descriptor count when handling invalid MBIM extended descriptor (git-fixes).\n- USB: lpc32xx_udc: Fix error handling in probe (git-fixes).\n- USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC (git-fixes).\n- USB: serial: ftdi_sio: add support for u-blox EVK-M101 (stable-fixes).\n- USB: serial: ftdi_sio: match on interface number for jtag (stable-fixes).\n- USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC (git-fixes).\n- USB: serial: option: add Foxconn T99W760 (stable-fixes).\n- USB: serial: option: add Quectel RG255C (stable-fixes).\n- USB: serial: option: add Telit Cinterion FE910C04 new compositions (stable-fixes).\n- USB: serial: option: add Telit FN920C04 ECM compositions (stable-fixes).\n- USB: serial: option: add UNISOC UIS7720 (stable-fixes).\n- USB: serial: option: add support for Rolling RW101R-GL (stable-fixes).\n- USB: serial: option: move Telit 0x10c7 composition in the right place (stable-fixes).\n- USB: storage: Remove subclass and protocol overrides from Novatek quirk (git-fixes).\n- accel/ivpu: Fix DCT active percent format (git-fixes).\n- accel/ivpu: Fix race condition when unbinding BOs (git-fixes).\n- arm64: zynqmp: Fix usb node drive strength and slew rate (git-fixes).\n- arm64: zynqmp: Revert usb node drive strength and slew rate for (git-fixes).\n- atm/fore200e: Fix possible data race in fore200e_open() (git-fixes).\n- atm: Fix dma_free_coherent() size (git-fixes).\n- atm: idt77252: Add missing `dma_map_error()` (stable-fixes).\n- backlight: led-bl: Add devlink to supplier LEDs (git-fixes).\n- backlight: lp855x: Fix lp855x.h kernel-doc warnings (git-fixes).\n- bpf: Do not limit bpf_cgroup_from_id to current's namespace (bsc#1255433).\n- bpf: Reject bpf_timer for PREEMPT_RT (git-fixes).\n- broadcom: b44: prevent uninitialized value usage (git-fixes).\n- btrfs: make sure extent and csum paths are always released in scrub_raid56_parity_stripe() (git-fixes).\n- can: gs_usb: gs_can_open(): fix error handling (git-fixes).\n- can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs (git-fixes).\n- can: j1939: make j1939_sk_bind() fail if device is no longer registered (git-fixes).\n- can: kvaser_usb: leaf: Fix potential infinite loop in command parsers (git-fixes).\n- can: sja1000: fix max irq loop handling (git-fixes).\n- can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling (git-fixes).\n- cgroup: rstat: use LOCK CMPXCHG in css_rstat_updated (bsc#1255434).\n- char: applicom: fix NULL pointer dereference in ac_ioctl (stable-fixes).\n- cifs: Fix uncached read into ITER_KVEC iterator (bsc#1245449).\n- clk: qcom: camcc-sm6350: Fix PLL config of PLL2 (git-fixes).\n- clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to other (git-fixes).\n- clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback (git-fixes).\n- clk: renesas: r9a06g032: Fix memory leak in error path (git-fixes).\n- clk: samsung: exynos-clkout: Assign .num before accessing .hws (git-fixes).\n- comedi: c6xdigio: Fix invalid PNP driver unregistration (git-fixes).\n- comedi: check device's attached status in compat ioctls (git-fixes).\n- comedi: multiq3: sanitize config options in multiq3_attach() (git-fixes).\n- comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel() (git-fixes).\n- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (git-fixes).\n- cpufreq: nforce2: fix reference count leak in nforce2 (git-fixes).\n- cpuidle: menu: Use residency threshold in polling state override decisions (bsc#1255026).\n- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (git-fixes).\n- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (git-fixes).\n- crypto: ccree - Correctly handle return of sg_nents_for_len (git-fixes).\n- crypto: hisilicon/qm - restore original qos values (git-fixes).\n- crypto: iaa - Fix incorrect return value in save_iaa_wq() (git-fixes).\n- crypto: qat - fix duplicate restarting msg during AER error (git-fixes).\n- crypto: rockchip - drop redundant crypto_skcipher_ivsize() calls (git-fixes).\n- crypto: seqiv - Do not use req-\u003eiv after crypto_aead_encrypt (git-fixes).\n- dm-integrity: limit MAX_TAG_SIZE to 255 (git-fixes).\n- dm-verity: fix unreliable memory allocation (git-fixes).\n- dm: fix queue start/stop imbalance under suspend/load/resume races (bsc#1253386).\n- drivers/usb/dwc3: fix PCI parent check (git-fixes).\n- drm/amd/amdgpu: reserve vm invalidation engine for uni_mes (stable-fixes).\n- drm/amd/display: Check NULL before accessing (stable-fixes).\n- drm/amd/display: Clear the CUR_ENABLE register on DCN20 on DPP5 (stable-fixes).\n- drm/amd/display: Don't change brightness for disabled connectors (stable-fixes).\n- drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() (git-fixes).\n- drm/amd/display: Fix pbn to kbps Conversion (stable-fixes).\n- drm/amd/display: Fix scratch registers offsets for DCN35 (stable-fixes).\n- drm/amd/display: Fix scratch registers offsets for DCN351 (stable-fixes).\n- drm/amd/display: Increase DPCD read retries (stable-fixes).\n- drm/amd/display: Insert dccg log for easy debug (stable-fixes).\n- drm/amd/display: Move sleep into each retry for retrieve_link_cap() (stable-fixes).\n- drm/amd/display: Prevent Gating DTBCLK before It Is Properly Latched (git-fixes).\n- drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() (stable-fixes).\n- drm/amd/display: avoid reset DTBCLK at clock init (stable-fixes).\n- drm/amd/display: disable DPP RCG before DPP CLK enable (stable-fixes).\n- drm/amd: Skip power ungate during suspend for VPE (stable-fixes).\n- drm/amdgpu/gmc11: add amdgpu_vm_handle_fault() handling (stable-fixes).\n- drm/amdgpu/gmc12: add amdgpu_vm_handle_fault() handling (stable-fixes).\n- drm/amdgpu: Forward VMID reservation errors (git-fixes).\n- drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled (stable-fixes).\n- drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma (git-fixes).\n- drm/amdgpu: fix cyan_skillfish2 gpu info fw handling (git-fixes).\n- drm/amdgpu: fix gpu page fault after hibernation on PF passthrough (stable-fixes).\n- drm/amdkfd: Export the cwsr_size and ctl_stack_size to userspace (stable-fixes).\n- drm/amdkfd: Fix GPU mappings for APU after prefetch (stable-fixes).\n- drm/amdkfd: Trap handler support for expert scheduling mode (stable-fixes).\n- drm/amdkfd: Use huge page size to check split svm range alignment (git-fixes).\n- drm/amdkfd: bump minimum vgpr size for gfx1151 (stable-fixes).\n- drm/displayid: add quirk to ignore DisplayID checksum errors (stable-fixes).\n- drm/displayid: pass iter to drm_find_displayid_extension() (stable-fixes).\n- drm/edid: add DRM_EDID_IDENT_INIT() to initialize struct drm_edid_ident (stable-fixes).\n- drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() (git-fixes).\n- drm/i915/dp: Initialize the source OUI write timestamp always (stable-fixes).\n- drm/i915/dp_mst: Disable Panel Replay (git-fixes).\n- drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer (git-fixes).\n- drm/i915: Fix format string truncation warning (git-fixes).\n- drm/imagination: Disallow exporting of PM/FW protected objects (git-fixes).\n- drm/imagination: Fix reference to devm_platform_get_and_ioremap_resource() (git-fixes).\n- drm/me/gsc: mei interrupt top half should be in irq disabled context (git-fixes).\n- drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue (git-fixes).\n- drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse() (git-fixes).\n- drm/mediatek: Fix probe device leaks (git-fixes).\n- drm/mediatek: Fix probe memory leak (git-fixes).\n- drm/mediatek: Fix probe resource leaks (git-fixes).\n- drm/mediatek: ovl_adaptor: Fix probe device leaks (git-fixes).\n- drm/mgag200: Fix big-endian support (git-fixes).\n- drm/msm/a2xx: stop over-complaining about the legacy firmware (git-fixes).\n- drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers (git-fixes).\n- drm/msm/a6xx: Fix the gemnoc workaround (git-fixes).\n- drm/msm/a6xx: Flush LRZ cache before PT switch (git-fixes).\n- drm/msm/a6xx: Improve MX rail fallback in RPMH vote init (git-fixes).\n- drm/msm/dpu: Add missing NULL pointer check for pingpong interface (git-fixes).\n- drm/msm/dpu: Remove dead-code in dpu_encoder_helper_reset_mixers() (git-fixes).\n- drm/msm/dpu: drop dpu_hw_dsc_destroy() prototype (git-fixes).\n- drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb (git-fixes).\n- drm/nouveau: refactor deprecated strcpy (git-fixes).\n- drm/nouveau: restrict the flush page to a 32-bit address (git-fixes).\n- drm/panel: sony-td4353-jdi: Enable prepare_prev_first (git-fixes).\n- drm/panel: visionox-rm69299: Don't clear all mode flags (git-fixes).\n- drm/panthor: Avoid adding of kernel BOs to extobj list (git-fixes).\n- drm/panthor: Fix UAF on kernel BO VA nodes (git-fixes).\n- drm/panthor: Fix group_free_queue() for partially initialized queues (git-fixes).\n- drm/panthor: Fix potential memleak of vma structure (git-fixes).\n- drm/panthor: Fix race with suspend during unplug (git-fixes).\n- drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (git-fixes).\n- drm/panthor: Handle errors returned by drm_sched_entity_init() (git-fixes).\n- drm/pl111: Fix error handling in pl111_amba_probe (git-fixes).\n- drm/plane: Fix IS_ERR() vs NULL check in drm_plane_create_hotspot_properties() (git-fixes).\n- drm/radeon: delete radeon_fence_process in is_signaled, no deadlock (stable-fixes).\n- drm/sched: Fix race in drm_sched_entity_select_rq() (git-fixes).\n- drm/tilcdc: Fix removal actions in case of failed probe (git-fixes).\n- drm/tilcdc: request and mapp iomem with devres (stable-fixes).\n- drm/ttm: Avoid NULL pointer deref for evicted BOs (git-fixes).\n- drm/vgem-fence: Fix potential deadlock on release (git-fixes).\n- drm/vmwgfx: Use kref in vmw_bo_dirty (stable-fixes).\n- drm/xe/bo: Don't include the CCS metadata in the dma-buf sg-table (git-fixes).\n- drm/xe/oa: Disallow 0 OA property values (git-fixes).\n- drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl() (git-fixes).\n- drm/xe/oa: Limit num_syncs to prevent oversized allocations (git-fixes).\n- drm/xe: Adjust long-running workload timeslices to reasonable values (git-fixes).\n- drm/xe: Drop preempt-fences when destroying imported dma-bufs (git-fixes).\n- drm/xe: Fix conversion from clock ticks to milliseconds (git-fixes).\n- drm/xe: Limit num_syncs to prevent oversized allocations (git-fixes).\n- drm/xe: Prevent BIT() overflow when handling invalid prefetch region (git-fixes).\n- drm/xe: Restore engine registers before restarting schedulers after GT reset (git-fixes).\n- drm/xe: Use usleep_range for accurate long-running workload timeslicing (git-fixes).\n- drm: atmel-hlcdc: fix atmel_xlcdc_plane_setup_scaler() (git-fixes).\n- drm: nouveau: Replace sprintf() with sysfs_emit() (git-fixes).\n- drm: sti: fix device leaks at component probe (git-fixes).\n- efi/libstub: Avoid physical address 0x0 when doing random allocation (stable-fixes).\n- efi/libstub: Describe missing 'out' parameter in efi_load_initrd (git-fixes).\n- efi/libstub: Fix page table access in 5-level to 4-level paging transition (git-fixes).\n- efi: stmm: Fix incorrect buffer allocation method (git-fixes).\n- efi: stmm: fix kernel-doc 'bad line' warnings (git-fixes).\n- exfat: add a check for invalid data size (git-fixes).\n- exfat: using hweight instead of internal logic (git-fixes).\n- ext4: use optimized mballoc scanning regardless of inode format (bsc#1254378).\n- ext4: wait for ongoing I/O to complete before freeing blocks (bsc#1256366).\n- fbdev: gbefb: fix to use physical address instead of dma address (stable-fixes).\n- fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing (git-fixes).\n- fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() (git-fixes).\n- fbdev: tcx.c fix mem_map to correct smem_start offset (git-fixes).\n- firewire: nosy: Fix dma_free_coherent() size (git-fixes).\n- firmware: imx: scu-irq: Init workqueue before request mbox channel (stable-fixes).\n- firmware: imx: scu-irq: fix OF node leak in (git-fixes).\n- firmware: stratix10-svc: Add mutex in stratix10 memory management (git-fixes).\n- firmware: stratix10-svc: fix bug in saving controller data (git-fixes).\n- firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc (git-fixes).\n- fs: dlm: allow to F_SETLKW getting interrupted (bsc#1255025).\n- ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct() (git-fixes).\n- genalloc.h: fix htmldocs warning (git-fixes).\n- gpio: rockchip: mark the GPIO controller as sleeping (git-fixes).\n- gpu: host1x: Fix race in syncpt alloc/free (git-fixes).\n- hwmon: (ibmpex) fix use-after-free in high/low store (git-fixes).\n- hwmon: (max16065) Use local variable to avoid TOCTOU (git-fixes).\n- hwmon: (tmp401) fix overflow caused by default conversion rate value (git-fixes).\n- hwmon: (w83791d) Convert macros to functions to avoid TOCTOU (git-fixes).\n- hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU (git-fixes).\n- hwmon: sy7636a: Fix regulator_enable resource leak on error path (git-fixes).\n- i2c: amd-mp2: fix reference leak in MP2 PCI device (git-fixes).\n- i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured firmware (stable-fixes).\n- i2c: i2c.h: fix a bad kernel-doc line (git-fixes).\n- i3c: fix refcount inconsistency in i3c_master_register (git-fixes).\n- i3c: master: Inherit DMA masks and parameters from parent device (stable-fixes).\n- i3c: master: svc: Prevent incomplete IBI transaction (git-fixes).\n- idr: fix idr_alloc() returning an ID out of range (git-fixes).\n- iio: accel: bmc150: Fix irq assumption regression (stable-fixes).\n- iio: accel: fix ADXL355 startup race condition (git-fixes).\n- iio: adc: ad7280a: fix ad7280_store_balance_timer() (git-fixes).\n- iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains (stable-fixes).\n- iio: core: Clean up device correctly on iio_device_alloc() failure (git-fixes).\n- iio: core: add missing mutex_destroy in iio_dev_release() (git-fixes).\n- iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member (git-fixes).\n- iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields (git-fixes).\n- iio: st_lsm6dsx: Fixed calibrated timestamp calculation (git-fixes).\n- ima: Handle error code returned by ima_filter_rule_match() (git-fixes).\n- intel_th: Fix error handling in intel_th_output_open (git-fixes).\n- ipmi: Fix __scan_channels() failing to rescan channels (stable-fixes).\n- ipmi: Fix handling of messages with provided receive message pointer (git-fixes).\n- ipmi: Fix the race between __scan_channels() and deliver_response() (stable-fixes).\n- ipmi: Rework user message limit handling (git-fixes).\n- irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() (git-fixes).\n- kconfig/mconf: Initialize the default locale at startup (stable-fixes).\n- kconfig/nconf: Initialize the default locale at startup (stable-fixes).\n- leds: leds-lp50xx: Allow LED 0 to be added to module bank (git-fixes).\n- leds: leds-lp50xx: Enable chip before any communication (git-fixes).\n- leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs (git-fixes).\n- leds: netxbig: Fix GPIO descriptor leak in error paths (git-fixes).\n- lib/vsprintf: Check pointer before dereferencing in time_and_date() (git-fixes).\n- mailbox: mailbox-test: Fix debugfs_create_dir error checking (git-fixes).\n- media: TDA1997x: Remove redundant cancel_delayed_work in probe (git-fixes).\n- media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() (git-fixes).\n- media: amphion: Add a frame flush mode for decoder (stable-fixes).\n- media: amphion: Cancel message work before releasing the VPU core (git-fixes).\n- media: amphion: Make some vpu_v4l2 functions static (stable-fixes).\n- media: amphion: Remove vpu_vb_is_codecconfig (git-fixes).\n- media: atomisp: Prefix firmware paths with 'intel/ipu/' (bsc#1252973).\n- media: atomisp: Remove firmware_name module parameter (bsc#1252973).\n- media: cec: Fix debugfs leak on bus_register() failure (git-fixes).\n- media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() (git-fixes).\n- media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe (git-fixes).\n- media: i2c: adv7842: Remove redundant cancel_delayed_work in probe (git-fixes).\n- media: imx-mipi-csis: Drop extra clock enable at probe() (git-fixes).\n- media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() (git-fixes).\n- media: nxp: imx8-isi: Mark all crossbar sink pads as MUST_CONNECT (stable-fixes).\n- media: ov5640: fix vblank unchange issue when work at dvp mode (git-fixes).\n- media: pci: ivtv: Don't create fake v4l2_fh (stable-fixes).\n- media: pvrusb2: Fix incorrect variable used in trace message (git-fixes).\n- media: qcom: camss: Fix genpd cleanup (git-fixes).\n- media: qcom: camss: Fix ordering of pm_runtime_enable (git-fixes).\n- media: qcom: camss: cleanup media device allocated resource on error path (git-fixes).\n- media: qcom: venus: fix incorrect return value (stable-fixes).\n- media: radio-isa: use dev_name to fill in bus_info (stable-fixes).\n- media: rc: st_rc: Fix reset control resource leak (git-fixes).\n- media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled (git-fixes).\n- media: s5p-mfc: Fix potential deadlock on condlock (stable-fixes).\n- media: samsung: exynos4-is: fix potential ABBA deadlock on init (git-fixes).\n- media: uvcvideo: Force UVC version to 1.0a for 0408:4033 (stable-fixes).\n- media: v4l2-mem2mem: Fix outdated documentation (git-fixes).\n- media: verisilicon: Fix CPU stalls on G2 bus error (git-fixes).\n- media: verisilicon: Protect G2 HEVC decoder against invalid DPB index (git-fixes).\n- media: verisilicon: Store chroma and motion vectors offset (stable-fixes).\n- media: verisilicon: g2: Use common helpers to compute chroma and mv offsets (stable-fixes).\n- media: videobuf2: Fix device reference leak in vb2_dc_alloc error path (git-fixes).\n- media: vidtv: initialize local pointers upon transfer of memory ownership (git-fixes).\n- media: vpif_capture: fix section mismatch (git-fixes).\n- media: vpif_display: fix section mismatch (git-fixes).\n- mei: gsc: add dependency on Xe driver (git-fixes).\n- mei: me: add wildcat lake P DID (stable-fixes).\n- mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup (git-fixes).\n- mfd: da9055: Fix missing regmap_del_irq_chip() in error path (git-fixes).\n- mfd: max77620: Fix potential IRQ chip conflict when probing two devices (git-fixes).\n- mfd: mt6358-irq: Fix missing irq_domain_remove() in error path (git-fixes).\n- mfd: mt6397-irq: Fix missing irq_domain_remove() in error path (git-fixes).\n- mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig (git-fixes).\n- mmc: sdhci-msm: Avoid early clock doubling during HS400 transition (stable-fixes).\n- most: usb: fix double free on late probe failure (git-fixes).\n- mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() (git-fixes).\n- mtd: lpddr_cmds: fix signed shifts in lpddr_cmds (git-fixes).\n- mtd: maps: pcmciamtd: fix potential memory leak in pcmciamtd_detach() (git-fixes).\n- mtd: nand: relax ECC parameter validation check (git-fixes).\n- mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove (git-fixes).\n- mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors (git-fixes).\n- net: mdio: aspeed: add dummy read to avoid read-after-write issue (git-fixes).\n- net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write (git-fixes).\n- net: phy: adin1100: Fix software power-down ready condition (git-fixes).\n- net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY (git-fixes).\n- net: phy: mxl-gpy: fix link properties on USXGMII and internal PHYs (git-fixes).\n- net: r8169: Disable multicast filter for RTL8168H and RTL8107E (jsc#PED-14353).\n- net: rose: fix invalid array index in rose_kill_by_device() (git-fixes).\n- net: usb: pegasus: fix memory leak in update_eth_regs_async() (git-fixes).\n- net: usb: rtl8150: fix memory leak on usb_submit_urb() failure (git-fixes).\n- net: usb: sr9700: fix incorrect command used to write single register (git-fixes).\n- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (git-fixes).\n- netdevsim: print human readable IP address (bsc#1255071).\n- nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() (git-fixes).\n- nvme: Use non zero KATO for persistent discovery connections (git-fixes).\n- orangefs: fix xattr related buffer overflow.. (git-fixes).\n- perf list: Add IBM z17 event descriptions (jsc#PED-13611).\n- perf/x86/intel: Fix KASAN global-out-of-bounds warning (git-fixes).\n- phy: broadcom: bcm63xx-usbh: fix section mismatches (git-fixes).\n- phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe() (git-fixes).\n- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (git-fixes).\n- pinctrl: qcom: msm: Fix deadlock in pinmux configuration (stable-fixes).\n- pinctrl: single: Fix PIN_CONFIG_BIAS_DISABLE handling (stable-fixes).\n- pinctrl: single: Fix incorrect type for error return variable (git-fixes).\n- pinctrl: stm32: fix hwspinlock resource leak in probe function (git-fixes).\n- platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver (git-fixes).\n- platform/mellanox: mlxbf-pmc: Remove trailing whitespaces from event names (git-fixes).\n- platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally (stable-fixes).\n- platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list (stable-fixes).\n- platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks (stable-fixes).\n- platform/x86: acer-wmi: Ignore backlight event (stable-fixes).\n- platform/x86: asus-wmi: use brightness_set_blocking() for kbd led (git-fixes).\n- platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing (git-fixes).\n- platform/x86: huawei-wmi: add keys for HONOR models (stable-fixes).\n- platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic (git-fixes).\n- platform/x86: intel: chtwc_int33fe: don't dereference swnode args (git-fixes).\n- platform/x86: intel: punit_ipc: fix memory corruption (git-fixes).\n- platform/x86: msi-laptop: add missing sysfs_remove_group() (git-fixes).\n- power: supply: apm_power: only unset own apm_get_power_status (git-fixes).\n- power: supply: cw2015: Check devm_delayed_work_autocancel() return code (git-fixes).\n- power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges() (git-fixes).\n- power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges() (git-fixes).\n- power: supply: wm831x: Check wm831x_set_bits() return value (git-fixes).\n- powerpc/64s/slb: Fix SLB multihit issue during SLB preload (bac#1236022 ltc#211187).\n- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (bsc#1253262 ltc#216029).\n- powerpc/kexec: Enable SMT before waking offline CPUs (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588 git-fixes bsc#1253739 ltc#211493 bsc#1254244 ltc#216496).\n- pwm: bcm2835: Make sure the channel is enabled after pwm_request() (git-fixes).\n- r8169: Fix spelling mistake: 'tx_underun' -\u003e 'tx_underrun' (jsc#PED-14353).\n- r8169: Use PCI_IRQ_INTX instead of PCI_IRQ_LEGACY (jsc#PED-14353).\n- r8169: add MODULE_FIRMWARE entry for RTL8126A (jsc#PED-14353).\n- r8169: add PHY c45 ops for MDIO_MMD_VENDOR2 registers (jsc#PED-14353).\n- r8169: add generic rtl_set_eee_txidle_timer function (jsc#PED-14353).\n- r8169: add missing MODULE_FIRMWARE entry for RTL8126A rev.b (jsc#PED-14353).\n- r8169: add support for Intel Killer E5000 (jsc#PED-14353).\n- r8169: add support for RTL8125BP rev.b (jsc#PED-14353).\n- r8169: add support for RTL8125D (jsc#PED-14353).\n- r8169: add support for RTL8125D rev.b (jsc#PED-14353).\n- r8169: add support for RTL8126A rev.b (jsc#PED-14353).\n- r8169: add support for RTL8168M (jsc#PED-14353).\n- r8169: add support for returning tx_lpi_timer in ethtool get_eee (jsc#PED-14353).\n- r8169: add support for the temperature sensor being available from RTL8125B (jsc#PED-14353).\n- r8169: adjust version numbering for RTL8126 (jsc#PED-14353).\n- r8169: align RTL8125 EEE config with vendor driver (jsc#PED-14353).\n- r8169: align RTL8125/RTL8126 PHY config with vendor driver (jsc#PED-14353).\n- r8169: align RTL8126 EEE config with vendor driver (jsc#PED-14353).\n- r8169: align WAKE_PHY handling with r8125/r8126 vendor drivers (jsc#PED-14353).\n- r8169: avoid duplicated messages if loading firmware fails and switch to warn level (jsc#PED-14353).\n- r8169: avoid unsolicited interrupts (jsc#PED-14353).\n- r8169: check for PCI read error in probe (jsc#PED-14353).\n- r8169: disable ALDPS per default for RTL8125 (jsc#PED-14353).\n- r8169: disable RTL8126 ZRX-DC timeout (jsc#PED-14353).\n- r8169: disable interrupt source RxOverflow (jsc#PED-14353).\n- r8169: don't apply UDP padding quirk on RTL8126A (jsc#PED-14353).\n- r8169: don't increment tx_dropped in case of NETDEV_TX_BUSY (jsc#PED-14353).\n- r8169: don't scan PHY addresses \u003e 0 (jsc#PED-14353).\n- r8169: don't take RTNL lock in rtl_task() (jsc#PED-14353).\n- r8169: enable EEE at 2.5G per default on RTL8125B (jsc#PED-14353).\n- r8169: enable RTL8168H/RTL8168EP/RTL8168FP ASPM support (jsc#PED-14353).\n- r8169: fix RTL8117 Wake-on-Lan in DASH mode (git-fixes).\n- r8169: fix inconsistent indenting in rtl8169_get_eth_mac_stats (jsc#PED-14353).\n- r8169: implement additional ethtool stats ops (jsc#PED-14353).\n- r8169: improve RTL8411b phy-down fixup (jsc#PED-14353).\n- r8169: improve __rtl8169_set_wol (jsc#PED-14353).\n- r8169: improve handling task scheduling (jsc#PED-14353).\n- r8169: improve initialization of RSS registers on RTL8125/RTL8126 (jsc#PED-14353).\n- r8169: improve rtl_set_d3_pll_down (jsc#PED-14353).\n- r8169: increase max jumbo packet size on RTL8125/RTL8126 (jsc#PED-14353).\n- r8169: remove detection of chip version 11 (early RTL8168b) (jsc#PED-14353).\n- r8169: remove leftover locks after reverted change (jsc#PED-14353).\n- r8169: remove multicast filter limit (jsc#PED-14353).\n- r8169: remove not needed check in rtl_fw_write_firmware (jsc#PED-14353).\n- r8169: remove original workaround for RTL8125 broken rx issue (jsc#PED-14353).\n- r8169: remove redundant hwmon support (jsc#PED-14353).\n- r8169: remove rtl_dash_loop_wait_high/low (jsc#PED-14353).\n- r8169: remove support for chip version 11 (jsc#PED-14353).\n- r8169: remove unused flag RTL_FLAG_TASK_RESET_NO_QUEUE_WAKE (jsc#PED-14353).\n- r8169: set EEE speed down ratio to 1 (stable-fixes).\n- r8169: simplify EEE handling (jsc#PED-14353).\n- r8169: simplify code by using core-provided pcpu stats allocation (jsc#PED-14353).\n- r8169: support setting the EEE tx idle timer on RTL8168h (jsc#PED-14353).\n- r8169: use dev_err_probe in all appropriate places in rtl_init_one() (jsc#PED-14353).\n- r8169: use helper r8169_mod_reg8_cond to simplify rtl_jumbo_config (jsc#PED-14353).\n- regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex (git-fixes).\n- regulator: core: disable supply if enabling main regulator fails (git-fixes).\n- reset: fix BIT macro reference (stable-fixes).\n- rpmsg: glink: fix rpmsg device leak (git-fixes).\n- rtc: gamecube: Check the return value of ioremap() (git-fixes).\n- scsi: lpfc: Add capability to register Platform Name ID to fabric (bsc#1254119).\n- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (bsc#1254119).\n- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (bsc#1254119).\n- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (bsc#1254119).\n- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (bsc#1254119).\n- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (bsc#1254119).\n- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (bsc#1254119).\n- scsi: lpfc: Revise discovery related function headers and comments (bsc#1254119).\n- scsi: lpfc: Update lpfc version to 14.4.0.12 (bsc#1254119).\n- scsi: lpfc: Update various NPIV diagnostic log messaging (bsc#1254119).\n- scsi: mpi3mr: Fix I/O failures during controller reset (bsc#1251752 jsc#PED-14280).\n- scsi: mpi3mr: Fix controller init failure on fault during queue creation (bsc#1251752 jsc#PED-14280).\n- scsi: mpi3mr: Fix device loss during enclosure reboot due to zero link speed (bsc#1251752 jsc#PED-14280).\n- scsi: mpi3mr: Fix premature TM timeouts on virtual drives (bsc#1251752 jsc#PED-14280).\n- scsi: mpi3mr: Update MPI headers to revision 37 (bsc#1251752 jsc#PED-14280).\n- scsi: mpi3mr: Update driver version to 8.14.0.5.50 (bsc#1251752 jsc#PED-14280).\n- scsi: mpi3mr: Update driver version to 8.15.0.5.50 (bsc#1251752 jsc#PED-14280).\n- selftests/bpf: Skip timer cases when bpf_timer is not supported (git-fixes).\n- selftests/net: calibrate txtimestamp (bsc#1255085).\n- selftests/net: convert fcnal-test.sh to run it in unique namespace (bsc#1254235).\n- selftests/net: convert fib-onlink-tests.sh to run it in unique namespace (bsc#1254235).\n- selftests/net: convert fib_nexthop_multiprefix to run it in unique namespace (bsc#1254235).\n- selftests/net: convert fib_nexthop_nongw.sh to run it in unique namespace (bsc#1254235).\n- selftests/net: convert fib_nexthops.sh to run it in unique namespace (bsc#1254235).\n- selftests/net: convert fib_rule_tests.sh to run it in unique namespace (bsc#1254235).\n- selftests/net: convert fib_tests.sh to run it in unique namespace (bsc#1254235).\n- selftests/net: convert srv6_end_dt46_l3vpn_test.sh to run it in unique namespace (bsc#1254235).\n- selftests/net: convert srv6_end_dt4_l3vpn_test.sh to run it in unique namespace (bsc#1254235).\n- selftests/net: convert srv6_end_dt6_l3vpn_test.sh to run it in unique namespace (bsc#1254235).\n- selftests/net: convert test_vxlan_vnifiltering.sh to run it in unique namespace (bsc#1255349).\n- selftests/net: convert vrf_route_leaking.sh to run it in unique namespace (bsc#1255349).\n- selftests/net: synchronize udpgro tests' tx and rx connection (bsc#1254235).\n- selftests: Introduce Makefile variable to list shared bash scripts (bsc#1254235).\n- selftests: bonding: Add net/forwarding/lib.sh to TEST_INCLUDES (bsc#1254235).\n- selftests: dsa: Replace test symlinks by wrapper script (bsc#1254235).\n- selftests: net: Remove executable bits from library scripts (bsc#1254235).\n- selftests: net: explicitly wait for listener ready (bsc#1254235).\n- selftests: net: fib-onlink-tests: Set high metric for default IPv6 route (bsc#1255346).\n- selftests: net: include forwarding lib (bsc#1254235).\n- selftests: net: included needed helper in the install targets (bsc#1254235).\n- selftests: net: more strict check in net_helper (bsc#1254235).\n- selftests: net: use slowwait to make sure IPv6 setup finished (bsc#1255349).\n- selftests: net: use slowwait to stabilize vrf_route_leaking test (bsc#1255349).\n- selftests: net: veth: test the ability to independently manipulate GRO and XDP (bsc#1255101).\n- selftests: team: Add shared library scripts to TEST_INCLUDES (bsc#1254235).\n- selftests: vrf_route_leaking: remove ipv6_ping_frag from default testing (bsc#1255349).\n- serial: add support of CPCI cards (stable-fixes).\n- serial: amba-pl011: prefer dma_mapping_error() over explicit address checking (git-fixes).\n- serial: core: Fix serial device initialization (git-fixes).\n- serial: core: Restore sysfs fwnode information (git-fixes).\n- serial: sprd: Return -EPROBE_DEFER when uart clock is not ready (stable-fixes).\n- slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves (git-fixes).\n- smc91x: fix broken irq-context in PREEMPT_RT (git-fixes).\n- soc/tegra: fuse: speedo-tegra210: Update speedo IDs (git-fixes).\n- soc: amlogic: canvas: fix device leak on lookup (git-fixes).\n- soc: qcom: ocmem: fix device leak on lookup (git-fixes).\n- soc: qcom: smem: fix hwspinlock resource leak in probe error paths (git-fixes).\n- spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors (git-fixes).\n- spi: bcm63xx: drop wrong casts in probe() (git-fixes).\n- spi: bcm63xx: fix premature CS deassertion on RX-only transactions (git-fixes).\n- spi: fsl-cpm: Check length parity before switching to 16 bit mode (git-fixes).\n- spi: imx: keep dma request disabled before dma transfer setup (stable-fixes).\n- spi: tegra210-qspi: Remove cache operations (git-fixes).\n- spi: tegra210-quad: Add support for internal DMA (git-fixes).\n- spi: tegra210-quad: Check hardware status on timeout (bsc#1253155).\n- spi: tegra210-quad: Fix timeout handling (bsc#1253155).\n- spi: tegra210-quad: Fix timeout handling (git-fixes).\n- spi: tegra210-quad: Refactor error handling into helper functions (bsc#1253155).\n- spi: tegra210-quad: Update dummy sequence configuration (git-fixes).\n- spi: xilinx: increase number of retries before declaring stall (stable-fixes).\n- staging: fbtft: core: fix potential memory leak in fbtft_probe_common() (git-fixes).\n- staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing (stable-fixes).\n- staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser (stable-fixes).\n- thunderbolt: Add support for Intel Wildcat Lake (stable-fixes).\n- tick/sched: Limit non-timekeeper CPUs calling jiffies update (bsc#1254477).\n- tracing: Fix access to trace_event_file (bsc#1254373).\n- uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe (git-fixes).\n- usb: cdns3: Fix double resource release in cdns3_pci_probe (git-fixes).\n- usb: chaoskey: fix locking for O_NONBLOCK (git-fixes).\n- usb: chipidea: udc: limit usb request length to max 16KB (stable-fixes).\n- usb: dwc2: disable platform lowlevel hw resources during shutdown (stable-fixes).\n- usb: dwc2: fix hang during shutdown if set as peripheral (git-fixes).\n- usb: dwc2: fix hang during suspend if set as peripheral (git-fixes).\n- usb: dwc3: Abort suspend on soft disconnect failure (git-fixes).\n- usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (git-fixes).\n- usb: dwc3: keep susphy enabled during exit to avoid controller faults (git-fixes).\n- usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe (git-fixes).\n- usb: dwc3: pci: Sort out the Intel device IDs (stable-fixes).\n- usb: dwc3: pci: add support for the Intel Nova Lake -S (stable-fixes).\n- usb: gadget: configfs: Correctly set use_os_string at bind (git-fixes).\n- usb: gadget: f_eem: Fix memory leak in eem_unwrap (git-fixes).\n- usb: gadget: lpc32xx_udc: fix clock imbalance in error path (git-fixes).\n- usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors (git-fixes).\n- usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt (git-fixes).\n- usb: ohci-nxp: Use helper function devm_clk_get_enabled() (stable-fixes).\n- usb: ohci-nxp: fix device leak on probe failure (git-fixes).\n- usb: phy: Initialize struct usb_phy list_head (git-fixes).\n- usb: phy: isp1301: fix non-OF device reference imbalance (git-fixes).\n- usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE (git-fixes).\n- usb: raw-gadget: do not limit transfer length (git-fixes).\n- usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() (git-fixes).\n- usb: storage: Fix memory leak in USB bulk transport (git-fixes).\n- usb: storage: sddr55: Reject out-of-bound new_pba (stable-fixes).\n- usb: typec: tipd: Clear interrupts first (git-fixes).\n- usb: typec: ucsi: Handle incorrect num_connectors capability (stable-fixes).\n- usb: typec: ucsi: psy: Set max current to zero when disconnected (git-fixes).\n- usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer (git-fixes).\n- usb: udc: Add trace event for usb_gadget_set_state (stable-fixes).\n- usb: usb-storage: Maintain minimal modifications to the bcdDevice range (git-fixes).\n- usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive (stable-fixes).\n- usb: vhci-hcd: Prevent suspending virtually attached devices (git-fixes).\n- usb: xhci: limit run_graceperiod for only usb 3.0 devices (stable-fixes).\n- usbip: Fix locking bug in RT-enabled kernels (stable-fixes).\n- via_wdt: fix critical boot hang due to unnamed resource allocation (stable-fixes).\n- virtio_console: fix order of fields cols and rows (stable-fixes).\n- watchdog: wdat_wdt: Fix ACPI table leak in probe function (git-fixes).\n- wifi: ath10k: Add missing include of export.h (stable-fixes).\n- wifi: ath10k: Avoid vdev delete timeout when firmware is already down (stable-fixes).\n- wifi: ath10k: move recovery check logic into a new work (git-fixes).\n- wifi: ath11k: fix peer HE MCS assignment (git-fixes).\n- wifi: ath11k: restore register window after global reset (git-fixes).\n- wifi: ath12k: fix potential memory leak in ath12k_wow_arp_ns_offload() (git-fixes).\n- wifi: avoid kernel-infoleak from struct iw_point (git-fixes).\n- wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet (stable-fixes).\n- wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() (git-fixes).\n- wifi: cfg80211: stop radar detection in cfg80211_leave() (stable-fixes).\n- wifi: cfg80211: use cfg80211_leave() in iftype change (stable-fixes).\n- wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() (git-fixes).\n- wifi: ieee80211: correct FILS status codes (git-fixes).\n- wifi: mac80211: do not use old MBSSID elements (git-fixes).\n- wifi: mac80211: fix CMAC functions not handling errors (git-fixes).\n- wifi: mac80211: restore non-chanctx injection behaviour (git-fixes).\n- wifi: mt76: Fix DTS power-limits on little endian systems (git-fixes).\n- wifi: mt76: mt7925: fix CLC command timeout when suspend/resume (stable-fixes).\n- wifi: mt76: mt7925: fix the unfinished command of regd_notifier before suspend (stable-fixes).\n- wifi: mt76: mt792x: fix wifi init fail by setting MCU_RUNNING after CLC load (stable-fixes).\n- wifi: nl80211: vendor-cmd: intel: fix a blank kernel-doc line warning (git-fixes).\n- wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() (git-fixes).\n- wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() (git-fixes).\n- wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() (git-fixes).\n- wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1 (stable-fixes).\n- wifi: rtw88: limit indirect IO under powered off for RTL8822CS (git-fixes).\n- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (git-fixes).\n- x86/microcode/AMD: Add TSA microcode SHAs (bsc#1256528).\n- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (bsc#1256528).\n- x86/microcode/AMD: Add more known models to entry sign checking (bsc#1256528).\n- x86/microcode/AMD: Add some forgotten models to the SHA check (bsc#1256528).\n- x86/microcode/AMD: Clean the cache if update did not load microcode (bsc#1256528).\n- x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (bsc#1256528).\n- x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (bsc#1256528).\n- x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (bsc#1256528).\n- x86/microcode/AMD: Limit Entrysign signature checking to known generations (bsc#1256528).\n- x86/microcode/AMD: Load only SHA256-checksummed patches (bsc#1256528).\n- x86/microcode/AMD: Select which microcode patch to load (bsc#1256528).\n- x86/microcode/AMD: Use sha256() instead of init/update/final (bsc#1256528).\n- x86/microcode: Fix Entrysign revision check for Zen1/Naples (bsc#1256528).\n- xhci: dbgtty: fix device unregister (git-fixes).\n- xhci: fix stale flag preventig URBs after link state error is cleared (git-fixes).\n","status":"published","published":"2026-01-23T16:03:47Z","modified":"2026-03-23T04:52:06.223856Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0293-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).\n- CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).\n- CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).\n- CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).\n- CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).\n- CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).\n- CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).\n- CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).\n- CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).\n- CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).\n- CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).\n- CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).\n- CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).\n- CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).\n- CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).\n- CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).\n- CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).\n- CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).\n- CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).\n- CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).\n- CVE-2025-40215: kABI: xfrm: delete x-\u003etunnel as we delete x (bsc#1254959).\n- CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).\n- CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).\n- CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).\n- CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).\n- CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).\n- CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187).\n- CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).\n- CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).\n- CVE-2025-68259: KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced (bsc#1255199).\n\nThe following non security issues were fixed:\n\n- ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 (git-fixes).\n- ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() (git-fixes).\n- ALSA: dice: fix buffer overflow in detect_stream_formats() (git-fixes).\n- ALSA: firewire-motu: add bounds check in put_user loop for DSP events (git-fixes).\n- ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (git-fixes).\n- ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() (git-fixes).\n- ALSA: uapi: Fix typo in asound.h comment (git-fixes).\n- ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 (stable-fixes).\n- ASoC: Intel: catpt: Fix error path in hw_params() (git-fixes).\n- ASoC: ak4458: Disable regulator when error happens (git-fixes).\n- ASoC: ak5558: Disable regulator when error happens (git-fixes).\n- ASoC: codecs: wcd938x: fix OF node leaks on probe failure (git-fixes).\n- ASoC: fsl_xcvr: clear the channel status control memory (git-fixes).\n- ASoC: qcom: q6adm: the the copp device only during last instance (git-fixes).\n- ASoC: qcom: q6asm-dai: perform correct state check before closing (git-fixes).\n- ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment (git-fixes).\n- ASoC: stm32: sai: fix OF node leak on probe (git-fixes).\n- ASoC: stm32: sai: fix clk prepare imbalance on probe failure (git-fixes).\n- ASoC: stm32: sai: fix device leak on probe (git-fixes).\n- Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 (git-fixes).\n- Bluetooth: SMP: Fix not generating mackey and ltk when repairing (git-fixes).\n- Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (git-fixes).\n- Documentation/kernel-parameters: fix typo in retbleed= kernel parameter description (git-fixes).\n- Documentation: hid-alps: Fix packet format section headings (git-fixes).\n- Documentation: parport-lowlevel: Separate function listing code blocks (git-fixes).\n- HID: logitech-dj: Remove duplicate error logging (git-fixes).\n- HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync() (git-fixes).\n- Input: cros_ec_keyb - fix an invalid memory access (stable-fixes).\n- Input: goodix - add support for ACPI ID GDIX1003 (stable-fixes).\n- Input: goodix - add support for ACPI ID GDX9110 (stable-fixes).\n- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (git-fixes).\n- KEYS: trusted_tpm1: Compare HMAC values in constant time (git-fixes).\n- PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths (git-fixes).\n- PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition (git-fixes).\n- PCI: keystone: Exit ks_pcie_probe() for invalid mode (git-fixes).\n- PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2 (git-fixes).\n- Revert 'mtd: rawnand: marvell: fix layouts' (git-fixes).\n- USB: Fix descriptor count when handling invalid MBIM extended descriptor (git-fixes).\n- USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC (git-fixes).\n- USB: serial: ftdi_sio: add support for u-blox EVK-M101 (stable-fixes).\n- USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC (git-fixes).\n- USB: serial: option: add Quectel RG255C (stable-fixes).\n- USB: serial: option: add Telit FN920C04 ECM compositions (stable-fixes).\n- USB: serial: option: add UNISOC UIS7720 (stable-fixes).\n- USB: serial: option: add support for Rolling RW101R-GL (stable-fixes).\n- USB: storage: Remove subclass and protocol overrides from Novatek quirk (git-fixes).\n- arm64: zynqmp: Fix usb node drive strength and slew rate (git-fixes).\n- arm64: zynqmp: Revert usb node drive strength and slew rate for (git-fixes).\n- atm/fore200e: Fix possible data race in fore200e_open() (git-fixes).\n- atm: idt77252: Add missing `dma_map_error()` (stable-fixes).\n- backlight: led-bl: Add devlink to supplier LEDs (git-fixes).\n- backlight: lp855x: Fix lp855x.h kernel-doc warnings (git-fixes).\n- bs-upload-kernel: Fix cve branch uploads.\n- btrfs: make sure extent and csum paths are always released in scrub_raid56_parity_stripe() (git-fixes).\n- can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs (git-fixes).\n- can: kvaser_usb: leaf: Fix potential infinite loop in command parsers (git-fixes).\n- can: sja1000: fix max irq loop handling (git-fixes).\n- can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling (git-fixes).\n- cifs: Fix uncached read into ITER_KVEC iterator (bsc#1245449).\n- cifs: after disabling multichannel, mark tcon for reconnect (git-fixes).\n- cifs: avoid redundant calls to disable multichannel (git-fixes).\n- cifs: cifs_pick_channel should try selecting active channels (git-fixes).\n- cifs: deal with the channel loading lag while picking channels (git-fixes).\n- cifs: dns resolution is needed only for primary channel (git-fixes).\n- cifs: do not disable interface polling on failure (git-fixes).\n- cifs: do not search for channel if server is terminating (git-fixes).\n- cifs: fix a pending undercount of srv_count (git-fixes).\n- cifs: fix lock ordering while disabling multichannel (git-fixes).\n- cifs: fix stray unlock in cifs_chan_skip_or_disable (git-fixes).\n- cifs: fix use after free for iface while disabling secondary channels (git-fixes).\n- cifs: handle servers that still advertise multichannel after disabling (git-fixes).\n- cifs: handle when server starts supporting multichannel (git-fixes).\n- cifs: handle when server stops supporting multichannel (git-fixes).\n- cifs: make cifs_chan_update_iface() a void function (git-fixes).\n- cifs: make sure server interfaces are requested only for SMB3+ (git-fixes).\n- cifs: make sure that channel scaling is done only once (git-fixes).\n- cifs: reconnect worker should take reference on server struct unconditionally (git-fixes).\n- cifs: reset connections for all channels when reconnect requested (git-fixes).\n- cifs: reset iface weights when we cannot find a candidate (git-fixes).\n- cifs: serialize other channels when query server interfaces is pending (git-fixes).\n- cifs: update dstaddr whenever channel iface is updated (git-fixes).\n- clk: qcom: camcc-sm6350: Fix PLL config of PLL2 (git-fixes).\n- clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to other (git-fixes).\n- clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback (git-fixes).\n- clk: renesas: r9a06g032: Fix memory leak in error path (git-fixes).\n- comedi: c6xdigio: Fix invalid PNP driver unregistration (git-fixes).\n- comedi: check device's attached status in compat ioctls (git-fixes).\n- comedi: multiq3: sanitize config options in multiq3_attach() (git-fixes).\n- comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel() (git-fixes).\n- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (git-fixes).\n- cpuidle: menu: Use residency threshold in polling state override decisions (bsc#1255026).\n- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (git-fixes).\n- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (git-fixes).\n- crypto: ccree - Correctly handle return of sg_nents_for_len (git-fixes).\n- crypto: hisilicon/qm - restore original qos values (git-fixes).\n- crypto: iaa - Fix incorrect return value in save_iaa_wq() (git-fixes).\n- crypto: rockchip - drop redundant crypto_skcipher_ivsize() calls (git-fixes).\n- dm-integrity: limit MAX_TAG_SIZE to 255 (git-fixes).\n- dm-verity: fix unreliable memory allocation (git-fixes).\n- dm: fix queue start/stop imbalance under suspend/load/resume races (bsc#1253386).\n- drivers/usb/dwc3: fix PCI parent check (git-fixes).\n- drm/amd/display: Check NULL before accessing (stable-fixes).\n- drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() (git-fixes).\n- drm/amd/display: Increase DPCD read retries (stable-fixes).\n- drm/amd/display: Move sleep into each retry for retrieve_link_cap() (stable-fixes).\n- drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled (stable-fixes).\n- drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma (git-fixes).\n- drm/amdgpu: fix cyan_skillfish2 gpu info fw handling (git-fixes).\n- drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() (git-fixes).\n- drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue (git-fixes).\n- drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse() (git-fixes).\n- drm/mgag200: Fix big-endian support (git-fixes).\n- drm/msm/a2xx: stop over-complaining about the legacy firmware (git-fixes).\n- drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers (git-fixes).\n- drm/msm/a6xx: Flush LRZ cache before PT switch (git-fixes).\n- drm/msm/dpu: Remove dead-code in dpu_encoder_helper_reset_mixers() (git-fixes).\n- drm/nouveau: restrict the flush page to a 32-bit address (git-fixes).\n- drm/ttm: Avoid NULL pointer deref for evicted BOs (git-fixes).\n- drm/vgem-fence: Fix potential deadlock on release (git-fixes).\n- drm: nouveau: Replace sprintf() with sysfs_emit() (git-fixes).\n- drm: sti: fix device leaks at component probe (git-fixes).\n- efi/libstub: Describe missing 'out' parameter in efi_load_initrd (git-fixes).\n- efi/libstub: Fix page table access in 5-level to 4-level paging transition (git-fixes).\n- fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing (git-fixes).\n- fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() (git-fixes).\n- fbdev: tcx.c fix mem_map to correct smem_start offset (git-fixes).\n- firmware: imx: scu-irq: fix OF node leak in (git-fixes).\n- firmware: stratix10-svc: Add mutex in stratix10 memory management (git-fixes).\n- firmware: stratix10-svc: fix bug in saving controller data (git-fixes).\n- firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc (git-fixes).\n- gpu: host1x: Fix race in syncpt alloc/free (git-fixes).\n- hwmon: (max16065) Use local variable to avoid TOCTOU (git-fixes).\n- hwmon: (w83791d) Convert macros to functions to avoid TOCTOU (git-fixes).\n- hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU (git-fixes).\n- hwmon: sy7636a: Fix regulator_enable resource leak on error path (git-fixes).\n- i2c: amd-mp2: fix reference leak in MP2 PCI device (git-fixes).\n- i2c: i2c.h: fix a bad kernel-doc line (git-fixes).\n- i3c: master: svc: Prevent incomplete IBI transaction (git-fixes).\n- iio: accel: bmc150: Fix irq assumption regression (stable-fixes).\n- iio: accel: fix ADXL355 startup race condition (git-fixes).\n- iio: adc: ad7280a: fix ad7280_store_balance_timer() (git-fixes).\n- iio: core: Clean up device correctly on iio_device_alloc() failure (git-fixes).\n- iio: core: add missing mutex_destroy in iio_dev_release() (git-fixes).\n- iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member (git-fixes).\n- iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields (git-fixes).\n- iio: st_lsm6dsx: Fixed calibrated timestamp calculation (git-fixes).\n- ima: Handle error code returned by ima_filter_rule_match() (git-fixes).\n- intel_th: Fix error handling in intel_th_output_open (git-fixes).\n- ipmi: Fix handling of messages with provided receive message pointer (git-fixes).\n- ipmi: Rework user message limit handling (git-fixes).\n- irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() (git-fixes).\n- kconfig/mconf: Initialize the default locale at startup (stable-fixes).\n- kconfig/nconf: Initialize the default locale at startup (stable-fixes).\n- leds: leds-lp50xx: Allow LED 0 to be added to module bank (git-fixes).\n- leds: leds-lp50xx: Enable chip before any communication (git-fixes).\n- leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs (git-fixes).\n- leds: netxbig: Fix GPIO descriptor leak in error paths (git-fixes).\n- lib/vsprintf: Check pointer before dereferencing in time_and_date() (git-fixes).\n- mailbox: mailbox-test: Fix debugfs_create_dir error checking (git-fixes).\n- media: TDA1997x: Remove redundant cancel_delayed_work in probe (git-fixes).\n- media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() (git-fixes).\n- media: amphion: Cancel message work before releasing the VPU core (git-fixes).\n- media: atomisp: Prefix firmware paths with 'intel/ipu/' (bsc#1252973).\n- media: atomisp: Remove firmware_name module parameter (bsc#1252973).\n- media: cec: Fix debugfs leak on bus_register() failure (git-fixes).\n- media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() (git-fixes).\n- media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe (git-fixes).\n- media: i2c: adv7842: Remove redundant cancel_delayed_work in probe (git-fixes).\n- media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() (git-fixes).\n- media: pvrusb2: Fix incorrect variable used in trace message (git-fixes).\n- media: rc: st_rc: Fix reset control resource leak (git-fixes).\n- media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled (git-fixes).\n- media: samsung: exynos4-is: fix potential ABBA deadlock on init (git-fixes).\n- media: v4l2-mem2mem: Fix outdated documentation (git-fixes).\n- media: verisilicon: Protect G2 HEVC decoder against invalid DPB index (git-fixes).\n- media: videobuf2: Fix device reference leak in vb2_dc_alloc error path (git-fixes).\n- media: vidtv: initialize local pointers upon transfer of memory ownership (git-fixes).\n- media: vpif_capture: fix section mismatch (git-fixes).\n- media: vpif_display: fix section mismatch (git-fixes).\n- mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup (git-fixes).\n- mfd: da9055: Fix missing regmap_del_irq_chip() in error path (git-fixes).\n- mfd: max77620: Fix potential IRQ chip conflict when probing two devices (git-fixes).\n- mfd: mt6358-irq: Fix missing irq_domain_remove() in error path (git-fixes).\n- mfd: mt6397-irq: Fix missing irq_domain_remove() in error path (git-fixes).\n- most: usb: fix double free on late probe failure (git-fixes).\n- mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() (git-fixes).\n- mtd: lpddr_cmds: fix signed shifts in lpddr_cmds (git-fixes).\n- mtd: maps: pcmciamtd: fix potential memory leak in pcmciamtd_detach() (git-fixes).\n- mtd: nand: relax ECC parameter validation check (git-fixes).\n- mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove (git-fixes).\n- mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors (git-fixes).\n- net: phy: adin1100: Fix software power-down ready condition (git-fixes).\n- net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY (git-fixes).\n- net: phy: mxl-gpy: fix link properties on USXGMII and internal PHYs (git-fixes).\n- nvme: Use non zero KATO for persistent discovery connections (git-fixes).\n- orangefs: fix xattr related buffer overflow.. (git-fixes).\n- phy: broadcom: bcm63xx-usbh: fix section mismatches (git-fixes).\n- phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe() (git-fixes).\n- pinctrl: stm32: fix hwspinlock resource leak in probe function (git-fixes).\n- platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver (git-fixes).\n- platform/x86: asus-wmi: use brightness_set_blocking() for kbd led (git-fixes).\n- platform/x86: intel: chtwc_int33fe: don't dereference swnode args (git-fixes).\n- platform/x86: intel: punit_ipc: fix memory corruption (git-fixes).\n- power: supply: apm_power: only unset own apm_get_power_status (git-fixes).\n- power: supply: cw2015: Check devm_delayed_work_autocancel() return code (git-fixes).\n- power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges() (git-fixes).\n- power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges() (git-fixes).\n- power: supply: wm831x: Check wm831x_set_bits() return value (git-fixes).\n- powerpc/64s/slb: Fix SLB multihit issue during SLB preload (bac#1236022 ltc#211187).\n- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (bsc#1253262 ltc#216029).\n- pwm: bcm2835: Make sure the channel is enabled after pwm_request() (git-fixes).\n- regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex (git-fixes).\n- regulator: core: disable supply if enabling main regulator fails (git-fixes).\n- rpmsg: glink: fix rpmsg device leak (git-fixes).\n- rtc: gamecube: Check the return value of ioremap() (git-fixes).\n- scripts: teaapi: Add paging.\n- scrits: teaapi: Add list_repos.\n- scsi: lpfc: Add capability to register Platform Name ID to fabric (bsc#1254119).\n- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (bsc#1254119).\n- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (bsc#1254119).\n- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (bsc#1254119).\n- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (bsc#1254119).\n- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (bsc#1254119).\n- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (bsc#1254119).\n- scsi: lpfc: Revise discovery related function headers and comments (bsc#1254119).\n- scsi: lpfc: Update lpfc version to 14.4.0.12 (bsc#1254119).\n- scsi: lpfc: Update various NPIV diagnostic log messaging (bsc#1254119).\n- serial: amba-pl011: prefer dma_mapping_error() over explicit address checking (git-fixes).\n- slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves (git-fixes).\n- smb3: add missing null server pointer check (git-fixes).\n- smb: client: fix cifs_pick_channel when channel needs reconnect (git-fixes).\n- smb: client: fix warning when reconnecting channel (git-fixes).\n- smb: client: introduce close_cached_dir_locked() (git-fixes).\n- soc/tegra: fuse: speedo-tegra210: Update speedo IDs (git-fixes).\n- soc: amlogic: canvas: fix device leak on lookup (git-fixes).\n- soc: qcom: ocmem: fix device leak on lookup (git-fixes).\n- soc: qcom: smem: fix hwspinlock resource leak in probe error paths (git-fixes).\n- spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors (git-fixes).\n- spi: bcm63xx: drop wrong casts in probe() (git-fixes).\n- spi: bcm63xx: fix premature CS deassertion on RX-only transactions (git-fixes).\n- spi: tegra210-qspi: Remove cache operations (git-fixes).\n- spi: tegra210-quad: Add support for internal DMA (git-fixes).\n- spi: tegra210-quad: Check hardware status on timeout (bsc#1253155).\n- spi: tegra210-quad: Fix timeout handling (bsc#1253155).\n- spi: tegra210-quad: Fix timeout handling (git-fixes).\n- spi: tegra210-quad: Refactor error handling into helper functions (bsc#1253155).\n- spi: tegra210-quad: Update dummy sequence configuration (git-fixes).\n- staging: fbtft: core: fix potential memory leak in fbtft_probe_common() (git-fixes).\n- thunderbolt: Add support for Intel Wildcat Lake (stable-fixes).\n- tracing: Fix access to trace_event_file (bsc#1254373).\n- uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe (git-fixes).\n- usb: cdns3: Fix double resource release in cdns3_pci_probe (git-fixes).\n- usb: chaoskey: fix locking for O_NONBLOCK (git-fixes).\n- usb: chipidea: udc: limit usb request length to max 16KB (stable-fixes).\n- usb: dwc2: fix hang during suspend if set as peripheral (git-fixes).\n- usb: dwc3: Abort suspend on soft disconnect failure (git-fixes).\n- usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (git-fixes).\n- usb: dwc3: pci: Sort out the Intel device IDs (stable-fixes).\n- usb: dwc3: pci: add support for the Intel Nova Lake -S (stable-fixes).\n- usb: gadget: configfs: Correctly set use_os_string at bind (git-fixes).\n- usb: gadget: f_eem: Fix memory leak in eem_unwrap (git-fixes).\n- usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors (git-fixes).\n- usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt (git-fixes).\n- usb: phy: Initialize struct usb_phy list_head (git-fixes).\n- usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE (git-fixes).\n- usb: raw-gadget: do not limit transfer length (git-fixes).\n- usb: storage: Fix memory leak in USB bulk transport (git-fixes).\n- usb: storage: sddr55: Reject out-of-bound new_pba (stable-fixes).\n- usb: typec: tipd: Clear interrupts first (git-fixes).\n- usb: typec: ucsi: psy: Set max current to zero when disconnected (git-fixes).\n- usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer (git-fixes).\n- usb: udc: Add trace event for usb_gadget_set_state (stable-fixes).\n- usb: vhci-hcd: Prevent suspending virtually attached devices (git-fixes).\n- watchdog: wdat_wdt: Fix ACPI table leak in probe function (git-fixes).\n- wifi: ath11k: fix peer HE MCS assignment (git-fixes).\n- wifi: ath11k: restore register window after global reset (git-fixes).\n- wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() (git-fixes).\n- wifi: ieee80211: correct FILS status codes (git-fixes).\n- wifi: mac80211: fix CMAC functions not handling errors (git-fixes).\n- wifi: mt76: Fix DTS power-limits on little endian systems (git-fixes).\n- wifi: nl80211: vendor-cmd: intel: fix a blank kernel-doc line warning (git-fixes).\n- wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() (git-fixes).\n- wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() (git-fixes).\n- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (git-fixes).\n- x86/microcode/AMD: Add TSA microcode SHAs (bsc#1256528).\n- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (bsc#1256528).\n- x86/microcode/AMD: Add more known models to entry sign checking (bsc#1256528).\n- x86/microcode/AMD: Add some forgotten models to the SHA check (bsc#1256528).\n- x86/microcode/AMD: Clean the cache if update did not load microcode (bsc#1256528).\n- x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (bsc#1256528).\n- x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (bsc#1256528).\n- x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (bsc#1256528).\n- x86/microcode/AMD: Limit Entrysign signature checking to known generations (bsc#1256528).\n- x86/microcode/AMD: Load only SHA256-checksummed patches (bsc#1256528).\n- x86/microcode/AMD: Select which microcode patch to load (bsc#1256528).\n- x86/microcode/AMD: Use sha256() instead of init/update/final (bsc#1256528).\n- x86/microcode: Fix Entrysign revision check for Zen1/Naples (bsc#1256528).\n- xhci: dbgtty: fix device unregister (git-fixes).\n","status":"published","published":"2026-01-26T11:36:42Z","modified":"2026-03-23T04:52:07.026566Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0315-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).\n- CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).\n- CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).\n- CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).\n- CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).\n- CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).\n- CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).\n- CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).\n- CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).\n- CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).\n- CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).\n- CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).\n- CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).\n- CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).\n- CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).\n- CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).\n- CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).\n- CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).\n- CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).\n- CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).\n- CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).\n- CVE-2025-40215: kABI: xfrm: delete x-\u003etunnel as we delete x (bsc#1254959).\n- CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).\n- CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).\n- CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).\n- CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).\n- CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).\n- CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).\n- CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).\n- CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).\n- CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).\n- CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).\n- CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).\n- CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).\n- CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).\n- CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).\n- CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).\n- CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).\n- CVE-2025-40287: exfat: fix improper check of dentry.stream.valid_size (bsc#1255030).\n- CVE-2025-40289: drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (bsc#1255042).\n- CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).\n- CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).\n- CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187).\n- CVE-2025-40307: exfat: validate cluster allocation bits of the allocation bitmap (bsc#1255039).\n- CVE-2025-40319: bpf: Sync pending IRQ work before freeing ring buffer (bsc#1254794).\n- CVE-2025-40330: bnxt_en: Shutdown FW DMA in bnxt_shutdown() (bsc#1254616).\n- CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).\n- CVE-2025-40337: net: stmmac: Correctly handle Rx checksum offload errors (bsc#1255081).\n- CVE-2025-40338: ASoC: Intel: avs: Do not share the name pointer between components (bsc#1255273).\n- CVE-2025-40346: arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (bsc#1255318).\n- CVE-2025-40357: net/smc: fix general protection fault in __smc_diag_dump (bsc#1255097).\n- CVE-2025-68197: bnxt_en: Fix null pointer dereference in bnxt_bs_trace_check_wrap() (bsc#1255242).\n- CVE-2025-68204: pmdomain: arm: scmi: Fix genpd leak on provider registration failure (bsc#1255224).\n- CVE-2025-68206: netfilter: nft_ct: add seqadj extension for natted connections (bsc#1255142).\n- CVE-2025-68208: bpf: account for current allocated stack depth in widen_imprecise_scalars() (bsc#1255227).\n- CVE-2025-68209: mlx5: Fix default values in create CQ (bsc#1255230).\n- CVE-2025-68239: binfmt_misc: restore write access before closing files opened by open_exec() (bsc#1255272).\n- CVE-2025-68255: staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing (bsc#1255395).\n- CVE-2025-68259: KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced (bsc#1255199).\n- CVE-2025-68264: ext4: refresh inline data size before write operations (bsc#1255380).\n- CVE-2025-68302: net: sxgbe: fix potential NULL dereference in sxgbe_rx() (bsc#1255121).\n- CVE-2025-68340: team: Move team device type change at the end of team_port_add (bsc#1255507).\n- CVE-2025-68378: bpf: Refactor stack map trace depth calculation into helper function (bsc#1255614).\n- CVE-2025-68742: bpf: Improve program stats run-time calculation (bsc#1255707).\n- CVE-2025-68744: bpf: Free special fields when update [lru_,]percpu_hash maps (bsc#1255709).\n\nThe following non security issues were fixed:\n\n- ACPI: CPPC: Fix missing PCC check for guaranteed_perf (git-fixes).\n- ACPI: PCC: Fix race condition by removing static qualifier (git-fixes).\n- ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 (git-fixes).\n- ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() (git-fixes).\n- ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only (stable-fixes).\n- ACPICA: Avoid walking the Namespace if start_node is NULL (stable-fixes).\n- ALSA: ac97: fix a double free in snd_ac97_controller_register() (git-fixes).\n- ALSA: dice: fix buffer overflow in detect_stream_formats() (git-fixes).\n- ALSA: firewire-motu: add bounds check in put_user loop for DSP events (git-fixes).\n- ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (git-fixes).\n- ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() (git-fixes).\n- ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path (git-fixes).\n- ALSA: uapi: Fix typo in asound.h comment (git-fixes).\n- ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 (stable-fixes).\n- ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series (stable-fixes).\n- ALSA: usb-audio: fix uac2 clock source at terminal parser (git-fixes).\n- ALSA: usb-mixer: us16x08: validate meter packet indices (git-fixes).\n- ALSA: vxpocket: Fix resource leak in vxpocket_probe error path (git-fixes).\n- ASoC: Intel: catpt: Fix error path in hw_params() (git-fixes).\n- ASoC: ak4458: Disable regulator when error happens (git-fixes).\n- ASoC: ak4458: remove the reset operation in probe and remove (git-fixes).\n- ASoC: ak5558: Disable regulator when error happens (git-fixes).\n- ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() (git-fixes).\n- ASoC: codecs: lpass-tx-macro: fix SM6115 support (git-fixes).\n- ASoC: codecs: wcd938x: fix OF node leaks on probe failure (git-fixes).\n- ASoC: fsl_xcvr: clear the channel status control memory (git-fixes).\n- ASoC: qcom: q6adm: the the copp device only during last instance (git-fixes).\n- ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr (git-fixes).\n- ASoC: qcom: q6asm-dai: perform correct state check before closing (git-fixes).\n- ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment (git-fixes).\n- ASoC: stm32: sai: fix OF node leak on probe (git-fixes).\n- ASoC: stm32: sai: fix clk prepare imbalance on probe failure (git-fixes).\n- ASoC: stm32: sai: fix device leak on probe (git-fixes).\n- ASoC: sun4i-spdif: Add missing kerneldoc fields for sun4i_spdif_quirks (git-fixes).\n- Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 (git-fixes).\n- Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (git-fixes).\n- Bluetooth: SMP: Fix not generating mackey and ltk when repairing (git-fixes).\n- Bluetooth: btrtl: Avoid loading the config file on security chips (stable-fixes).\n- Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE (stable-fixes).\n- Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV (stable-fixes).\n- Bluetooth: btusb: mediatek: Avoid btusb_mtk_claim_iso_intf() NULL deref (git-fixes).\n- Bluetooth: btusb: mediatek: Fix kernel crash when releasing mtk iso interface (git-fixes).\n- Bluetooth: btusb: revert use of devm_kzalloc in btusb (git-fixes).\n- Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (git-fixes).\n- Documentation/kernel-parameters: fix typo in retbleed= kernel parameter description (git-fixes).\n- Documentation: hid-alps: Fix packet format section headings (git-fixes).\n- Documentation: parport-lowlevel: Separate function listing code blocks (git-fixes).\n- HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list (stable-fixes).\n- HID: elecom: Add support for ELECOM M-XT3URBK (018F) (stable-fixes).\n- HID: hid-input: Extend Elan ignore battery quirk to USB (stable-fixes).\n- HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen (stable-fixes).\n- HID: logitech-dj: Remove duplicate error logging (git-fixes).\n- HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync() (git-fixes).\n- HID: quirks: work around VID/PID conflict for appledisplay (git-fixes).\n- Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard (git-fixes).\n- Input: cros_ec_keyb - fix an invalid memory access (stable-fixes).\n- Input: goodix - add support for ACPI ID GDIX1003 (stable-fixes).\n- Input: goodix - add support for ACPI ID GDX9110 (stable-fixes).\n- Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table (stable-fixes).\n- Input: ti_am335x_tsc - fix off-by-one error in wire_order validation (git-fixes).\n- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (git-fixes).\n- KEYS: trusted_tpm1: Compare HMAC values in constant time (git-fixes).\n- KVM: SEV: Drop GHCB_VERSION_DEFAULT and open code it (bsc#1255463).\n- PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths (git-fixes).\n- PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition (git-fixes).\n- PCI: keystone: Exit ks_pcie_probe() for invalid mode (git-fixes).\n- PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2 (git-fixes).\n- PM: runtime: Do not clear needs_force_resume with enabled runtime PM (git-fixes).\n- Revert 'drm/amd/display: Fix pbn to kbps Conversion' (stable-fixes).\n- Revert 'drm/amd/display: Move setup_stream_attribute' (stable-fixes).\n- Revert 'drm/amd: Skip power ungate during suspend for VPE' (git-fixes).\n- Revert 'mtd: rawnand: marvell: fix layouts' (git-fixes).\n- Revert 'net: r8169: Disable multicast filter for RTL8168H and RTL8107E' (jsc#PED-14353).\n- Revert 'r8169: don't try to disable interrupts if NAPI is, scheduled already' (jsc#PED-14353).\n- USB: Fix descriptor count when handling invalid MBIM extended descriptor (git-fixes).\n- USB: lpc32xx_udc: Fix error handling in probe (git-fixes).\n- USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC (git-fixes).\n- USB: serial: ftdi_sio: add support for u-blox EVK-M101 (stable-fixes).\n- USB: serial: ftdi_sio: match on interface number for jtag (stable-fixes).\n- USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC (git-fixes).\n- USB: serial: option: add Foxconn T99W760 (stable-fixes).\n- USB: serial: option: add Quectel RG255C (stable-fixes).\n- USB: serial: option: add Telit Cinterion FE910C04 new compositions (stable-fixes).\n- USB: serial: option: add Telit FN920C04 ECM compositions (stable-fixes).\n- USB: serial: option: add UNISOC UIS7720 (stable-fixes).\n- USB: serial: option: add support for Rolling RW101R-GL (stable-fixes).\n- USB: serial: option: move Telit 0x10c7 composition in the right place (stable-fixes).\n- USB: storage: Remove subclass and protocol overrides from Novatek quirk (git-fixes).\n- accel/ivpu: Fix DCT active percent format (git-fixes).\n- accel/ivpu: Fix race condition when unbinding BOs (git-fixes).\n- arm64: zynqmp: Fix usb node drive strength and slew rate (git-fixes).\n- arm64: zynqmp: Revert usb node drive strength and slew rate for (git-fixes).\n- atm/fore200e: Fix possible data race in fore200e_open() (git-fixes).\n- atm: Fix dma_free_coherent() size (git-fixes).\n- atm: idt77252: Add missing `dma_map_error()` (stable-fixes).\n- backlight: led-bl: Add devlink to supplier LEDs (git-fixes).\n- backlight: lp855x: Fix lp855x.h kernel-doc warnings (git-fixes).\n- bpf: Do not limit bpf_cgroup_from_id to current's namespace (bsc#1255433).\n- bpf: Reject bpf_timer for PREEMPT_RT (git-fixes).\n- broadcom: b44: prevent uninitialized value usage (git-fixes).\n- btrfs: make sure extent and csum paths are always released in scrub_raid56_parity_stripe() (git-fixes).\n- can: gs_usb: gs_can_open(): fix error handling (git-fixes).\n- can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs (git-fixes).\n- can: j1939: make j1939_sk_bind() fail if device is no longer registered (git-fixes).\n- can: kvaser_usb: leaf: Fix potential infinite loop in command parsers (git-fixes).\n- can: sja1000: fix max irq loop handling (git-fixes).\n- can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling (git-fixes).\n- cgroup: rstat: use LOCK CMPXCHG in css_rstat_updated (bsc#1255434).\n- char: applicom: fix NULL pointer dereference in ac_ioctl (stable-fixes).\n- cifs: Fix uncached read into ITER_KVEC iterator (bsc#1245449).\n- clk: qcom: camcc-sm6350: Fix PLL config of PLL2 (git-fixes).\n- clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to other (git-fixes).\n- clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback (git-fixes).\n- clk: renesas: r9a06g032: Fix memory leak in error path (git-fixes).\n- clk: samsung: exynos-clkout: Assign .num before accessing .hws (git-fixes).\n- comedi: c6xdigio: Fix invalid PNP driver unregistration (git-fixes).\n- comedi: check device's attached status in compat ioctls (git-fixes).\n- comedi: multiq3: sanitize config options in multiq3_attach() (git-fixes).\n- comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel() (git-fixes).\n- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (git-fixes).\n- cpufreq: nforce2: fix reference count leak in nforce2 (git-fixes).\n- cpuidle: menu: Use residency threshold in polling state override decisions (bsc#1255026).\n- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (git-fixes).\n- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (git-fixes).\n- crypto: ccree - Correctly handle return of sg_nents_for_len (git-fixes).\n- crypto: hisilicon/qm - restore original qos values (git-fixes).\n- crypto: iaa - Fix incorrect return value in save_iaa_wq() (git-fixes).\n- crypto: qat - fix duplicate restarting msg during AER error (git-fixes).\n- crypto: rockchip - drop redundant crypto_skcipher_ivsize() calls (git-fixes).\n- crypto: seqiv - Do not use req-\u003eiv after crypto_aead_encrypt (git-fixes).\n- dm-integrity: limit MAX_TAG_SIZE to 255 (git-fixes).\n- dm-verity: fix unreliable memory allocation (git-fixes).\n- dm: fix queue start/stop imbalance under suspend/load/resume races (bsc#1253386).\n- drivers/usb/dwc3: fix PCI parent check (git-fixes).\n- drm/amd/amdgpu: reserve vm invalidation engine for uni_mes (stable-fixes).\n- drm/amd/display: Check NULL before accessing (stable-fixes).\n- drm/amd/display: Clear the CUR_ENABLE register on DCN20 on DPP5 (stable-fixes).\n- drm/amd/display: Don't change brightness for disabled connectors (stable-fixes).\n- drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() (git-fixes).\n- drm/amd/display: Fix pbn to kbps Conversion (stable-fixes).\n- drm/amd/display: Fix scratch registers offsets for DCN35 (stable-fixes).\n- drm/amd/display: Fix scratch registers offsets for DCN351 (stable-fixes).\n- drm/amd/display: Increase DPCD read retries (stable-fixes).\n- drm/amd/display: Insert dccg log for easy debug (stable-fixes).\n- drm/amd/display: Move sleep into each retry for retrieve_link_cap() (stable-fixes).\n- drm/amd/display: Prevent Gating DTBCLK before It Is Properly Latched (git-fixes).\n- drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() (stable-fixes).\n- drm/amd/display: avoid reset DTBCLK at clock init (stable-fixes).\n- drm/amd/display: disable DPP RCG before DPP CLK enable (stable-fixes).\n- drm/amd: Skip power ungate during suspend for VPE (stable-fixes).\n- drm/amdgpu/gmc11: add amdgpu_vm_handle_fault() handling (stable-fixes).\n- drm/amdgpu/gmc12: add amdgpu_vm_handle_fault() handling (stable-fixes).\n- drm/amdgpu: Forward VMID reservation errors (git-fixes).\n- drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled (stable-fixes).\n- drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma (git-fixes).\n- drm/amdgpu: fix cyan_skillfish2 gpu info fw handling (git-fixes).\n- drm/amdgpu: fix gpu page fault after hibernation on PF passthrough (stable-fixes).\n- drm/amdkfd: Export the cwsr_size and ctl_stack_size to userspace (stable-fixes).\n- drm/amdkfd: Fix GPU mappings for APU after prefetch (stable-fixes).\n- drm/amdkfd: Trap handler support for expert scheduling mode (stable-fixes).\n- drm/amdkfd: Use huge page size to check split svm range alignment (git-fixes).\n- drm/amdkfd: bump minimum vgpr size for gfx1151 (stable-fixes).\n- drm/displayid: add quirk to ignore DisplayID checksum errors (stable-fixes).\n- drm/displayid: pass iter to drm_find_displayid_extension() (stable-fixes).\n- drm/edid: add DRM_EDID_IDENT_INIT() to initialize struct drm_edid_ident (stable-fixes).\n- drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() (git-fixes).\n- drm/i915/dp: Initialize the source OUI write timestamp always (stable-fixes).\n- drm/i915/dp_mst: Disable Panel Replay (git-fixes).\n- drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer (git-fixes).\n- drm/i915: Fix format string truncation warning (git-fixes).\n- drm/imagination: Disallow exporting of PM/FW protected objects (git-fixes).\n- drm/imagination: Fix reference to devm_platform_get_and_ioremap_resource() (git-fixes).\n- drm/me/gsc: mei interrupt top half should be in irq disabled context (git-fixes).\n- drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue (git-fixes).\n- drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse() (git-fixes).\n- drm/mediatek: Fix probe device leaks (git-fixes).\n- drm/mediatek: Fix probe memory leak (git-fixes).\n- drm/mediatek: Fix probe resource leaks (git-fixes).\n- drm/mediatek: ovl_adaptor: Fix probe device leaks (git-fixes).\n- drm/mgag200: Fix big-endian support (git-fixes).\n- drm/msm/a2xx: stop over-complaining about the legacy firmware (git-fixes).\n- drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers (git-fixes).\n- drm/msm/a6xx: Fix the gemnoc workaround (git-fixes).\n- drm/msm/a6xx: Flush LRZ cache before PT switch (git-fixes).\n- drm/msm/a6xx: Improve MX rail fallback in RPMH vote init (git-fixes).\n- drm/msm/dpu: Add missing NULL pointer check for pingpong interface (git-fixes).\n- drm/msm/dpu: Remove dead-code in dpu_encoder_helper_reset_mixers() (git-fixes).\n- drm/msm/dpu: drop dpu_hw_dsc_destroy() prototype (git-fixes).\n- drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb (git-fixes).\n- drm/nouveau: refactor deprecated strcpy (git-fixes).\n- drm/nouveau: restrict the flush page to a 32-bit address (git-fixes).\n- drm/panel: sony-td4353-jdi: Enable prepare_prev_first (git-fixes).\n- drm/panel: visionox-rm69299: Don't clear all mode flags (git-fixes).\n- drm/panthor: Avoid adding of kernel BOs to extobj list (git-fixes).\n- drm/panthor: Fix UAF on kernel BO VA nodes (git-fixes).\n- drm/panthor: Fix group_free_queue() for partially initialized queues (git-fixes).\n- drm/panthor: Fix potential memleak of vma structure (git-fixes).\n- drm/panthor: Fix race with suspend during unplug (git-fixes).\n- drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (git-fixes).\n- drm/panthor: Handle errors returned by drm_sched_entity_init() (git-fixes).\n- drm/pl111: Fix error handling in pl111_amba_probe (git-fixes).\n- drm/plane: Fix IS_ERR() vs NULL check in drm_plane_create_hotspot_properties() (git-fixes).\n- drm/radeon: delete radeon_fence_process in is_signaled, no deadlock (stable-fixes).\n- drm/sched: Fix race in drm_sched_entity_select_rq() (git-fixes).\n- drm/tilcdc: Fix removal actions in case of failed probe (git-fixes).\n- drm/tilcdc: request and mapp iomem with devres (stable-fixes).\n- drm/ttm: Avoid NULL pointer deref for evicted BOs (git-fixes).\n- drm/vgem-fence: Fix potential deadlock on release (git-fixes).\n- drm/vmwgfx: Use kref in vmw_bo_dirty (stable-fixes).\n- drm/xe/bo: Don't include the CCS metadata in the dma-buf sg-table (git-fixes).\n- drm/xe/oa: Disallow 0 OA property values (git-fixes).\n- drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl() (git-fixes).\n- drm/xe/oa: Limit num_syncs to prevent oversized allocations (git-fixes).\n- drm/xe: Adjust long-running workload timeslices to reasonable values (git-fixes).\n- drm/xe: Drop preempt-fences when destroying imported dma-bufs (git-fixes).\n- drm/xe: Fix conversion from clock ticks to milliseconds (git-fixes).\n- drm/xe: Limit num_syncs to prevent oversized allocations (git-fixes).\n- drm/xe: Prevent BIT() overflow when handling invalid prefetch region (git-fixes).\n- drm/xe: Restore engine registers before restarting schedulers after GT reset (git-fixes).\n- drm/xe: Use usleep_range for accurate long-running workload timeslicing (git-fixes).\n- drm: atmel-hlcdc: fix atmel_xlcdc_plane_setup_scaler() (git-fixes).\n- drm: nouveau: Replace sprintf() with sysfs_emit() (git-fixes).\n- drm: sti: fix device leaks at component probe (git-fixes).\n- efi/libstub: Avoid physical address 0x0 when doing random allocation (stable-fixes).\n- efi/libstub: Describe missing 'out' parameter in efi_load_initrd (git-fixes).\n- efi/libstub: Fix page table access in 5-level to 4-level paging transition (git-fixes).\n- efi: stmm: Fix incorrect buffer allocation method (git-fixes).\n- efi: stmm: fix kernel-doc 'bad line' warnings (git-fixes).\n- exfat: add a check for invalid data size (git-fixes).\n- exfat: using hweight instead of internal logic (git-fixes).\n- ext4: use optimized mballoc scanning regardless of inode format (bsc#1254378).\n- ext4: wait for ongoing I/O to complete before freeing blocks (bsc#1256366).\n- fbdev: gbefb: fix to use physical address instead of dma address (stable-fixes).\n- fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing (git-fixes).\n- fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() (git-fixes).\n- fbdev: tcx.c fix mem_map to correct smem_start offset (git-fixes).\n- firewire: nosy: Fix dma_free_coherent() size (git-fixes).\n- firmware: imx: scu-irq: Init workqueue before request mbox channel (stable-fixes).\n- firmware: imx: scu-irq: fix OF node leak in (git-fixes).\n- firmware: stratix10-svc: Add mutex in stratix10 memory management (git-fixes).\n- firmware: stratix10-svc: fix bug in saving controller data (git-fixes).\n- firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc (git-fixes).\n- fs: dlm: allow to F_SETLKW getting interrupted (bsc#1255025).\n- ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct() (git-fixes).\n- genalloc.h: fix htmldocs warning (git-fixes).\n- gpio: rockchip: mark the GPIO controller as sleeping (git-fixes).\n- gpu: host1x: Fix race in syncpt alloc/free (git-fixes).\n- hwmon: (ibmpex) fix use-after-free in high/low store (git-fixes).\n- hwmon: (max16065) Use local variable to avoid TOCTOU (git-fixes).\n- hwmon: (tmp401) fix overflow caused by default conversion rate value (git-fixes).\n- hwmon: (w83791d) Convert macros to functions to avoid TOCTOU (git-fixes).\n- hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU (git-fixes).\n- hwmon: sy7636a: Fix regulator_enable resource leak on error path (git-fixes).\n- i2c: amd-mp2: fix reference leak in MP2 PCI device (git-fixes).\n- i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured firmware (stable-fixes).\n- i2c: i2c.h: fix a bad kernel-doc line (git-fixes).\n- i3c: fix refcount inconsistency in i3c_master_register (git-fixes).\n- i3c: master: Inherit DMA masks and parameters from parent device (stable-fixes).\n- i3c: master: svc: Prevent incomplete IBI transaction (git-fixes).\n- idr: fix idr_alloc() returning an ID out of range (git-fixes).\n- iio: accel: bmc150: Fix irq assumption regression (stable-fixes).\n- iio: accel: fix ADXL355 startup race condition (git-fixes).\n- iio: adc: ad7280a: fix ad7280_store_balance_timer() (git-fixes).\n- iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains (stable-fixes).\n- iio: core: Clean up device correctly on iio_device_alloc() failure (git-fixes).\n- iio: core: add missing mutex_destroy in iio_dev_release() (git-fixes).\n- iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member (git-fixes).\n- iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields (git-fixes).\n- iio: st_lsm6dsx: Fixed calibrated timestamp calculation (git-fixes).\n- ima: Handle error code returned by ima_filter_rule_match() (git-fixes).\n- intel_th: Fix error handling in intel_th_output_open (git-fixes).\n- ipmi: Fix __scan_channels() failing to rescan channels (stable-fixes).\n- ipmi: Fix handling of messages with provided receive message pointer (git-fixes).\n- ipmi: Fix the race between __scan_channels() and deliver_response() (stable-fixes).\n- ipmi: Rework user message limit handling (git-fixes).\n- irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() (git-fixes).\n- kconfig/mconf: Initialize the default locale at startup (stable-fixes).\n- kconfig/nconf: Initialize the default locale at startup (stable-fixes).\n- leds: leds-lp50xx: Allow LED 0 to be added to module bank (git-fixes).\n- leds: leds-lp50xx: Enable chip before any communication (git-fixes).\n- leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs (git-fixes).\n- leds: netxbig: Fix GPIO descriptor leak in error paths (git-fixes).\n- lib/vsprintf: Check pointer before dereferencing in time_and_date() (git-fixes).\n- mailbox: mailbox-test: Fix debugfs_create_dir error checking (git-fixes).\n- media: TDA1997x: Remove redundant cancel_delayed_work in probe (git-fixes).\n- media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() (git-fixes).\n- media: amphion: Add a frame flush mode for decoder (stable-fixes).\n- media: amphion: Cancel message work before releasing the VPU core (git-fixes).\n- media: amphion: Make some vpu_v4l2 functions static (stable-fixes).\n- media: amphion: Remove vpu_vb_is_codecconfig (git-fixes).\n- media: atomisp: Prefix firmware paths with 'intel/ipu/' (bsc#1252973).\n- media: atomisp: Remove firmware_name module parameter (bsc#1252973).\n- media: cec: Fix debugfs leak on bus_register() failure (git-fixes).\n- media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() (git-fixes).\n- media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe (git-fixes).\n- media: i2c: adv7842: Remove redundant cancel_delayed_work in probe (git-fixes).\n- media: imx-mipi-csis: Drop extra clock enable at probe() (git-fixes).\n- media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() (git-fixes).\n- media: nxp: imx8-isi: Mark all crossbar sink pads as MUST_CONNECT (stable-fixes).\n- media: ov5640: fix vblank unchange issue when work at dvp mode (git-fixes).\n- media: pci: ivtv: Don't create fake v4l2_fh (stable-fixes).\n- media: pvrusb2: Fix incorrect variable used in trace message (git-fixes).\n- media: qcom: camss: Fix genpd cleanup (git-fixes).\n- media: qcom: camss: Fix ordering of pm_runtime_enable (git-fixes).\n- media: qcom: camss: cleanup media device allocated resource on error path (git-fixes).\n- media: qcom: venus: fix incorrect return value (stable-fixes).\n- media: radio-isa: use dev_name to fill in bus_info (stable-fixes).\n- media: rc: st_rc: Fix reset control resource leak (git-fixes).\n- media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled (git-fixes).\n- media: s5p-mfc: Fix potential deadlock on condlock (stable-fixes).\n- media: samsung: exynos4-is: fix potential ABBA deadlock on init (git-fixes).\n- media: uvcvideo: Force UVC version to 1.0a for 0408:4033 (stable-fixes).\n- media: v4l2-mem2mem: Fix outdated documentation (git-fixes).\n- media: verisilicon: Fix CPU stalls on G2 bus error (git-fixes).\n- media: verisilicon: Protect G2 HEVC decoder against invalid DPB index (git-fixes).\n- media: verisilicon: Store chroma and motion vectors offset (stable-fixes).\n- media: verisilicon: g2: Use common helpers to compute chroma and mv offsets (stable-fixes).\n- media: videobuf2: Fix device reference leak in vb2_dc_alloc error path (git-fixes).\n- media: vidtv: initialize local pointers upon transfer of memory ownership (git-fixes).\n- media: vpif_capture: fix section mismatch (git-fixes).\n- media: vpif_display: fix section mismatch (git-fixes).\n- mei: gsc: add dependency on Xe driver (git-fixes).\n- mei: me: add wildcat lake P DID (stable-fixes).\n- mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup (git-fixes).\n- mfd: da9055: Fix missing regmap_del_irq_chip() in error path (git-fixes).\n- mfd: max77620: Fix potential IRQ chip conflict when probing two devices (git-fixes).\n- mfd: mt6358-irq: Fix missing irq_domain_remove() in error path (git-fixes).\n- mfd: mt6397-irq: Fix missing irq_domain_remove() in error path (git-fixes).\n- mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig (git-fixes).\n- mmc: sdhci-msm: Avoid early clock doubling during HS400 transition (stable-fixes).\n- most: usb: fix double free on late probe failure (git-fixes).\n- mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() (git-fixes).\n- mtd: lpddr_cmds: fix signed shifts in lpddr_cmds (git-fixes).\n- mtd: maps: pcmciamtd: fix potential memory leak in pcmciamtd_detach() (git-fixes).\n- mtd: nand: relax ECC parameter validation check (git-fixes).\n- mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove (git-fixes).\n- mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors (git-fixes).\n- net: mdio: aspeed: add dummy read to avoid read-after-write issue (git-fixes).\n- net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write (git-fixes).\n- net: phy: adin1100: Fix software power-down ready condition (git-fixes).\n- net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY (git-fixes).\n- net: phy: mxl-gpy: fix link properties on USXGMII and internal PHYs (git-fixes).\n- net: r8169: Disable multicast filter for RTL8168H and RTL8107E (jsc#PED-14353).\n- net: rose: fix invalid array index in rose_kill_by_device() (git-fixes).\n- net: usb: pegasus: fix memory leak in update_eth_regs_async() (git-fixes).\n- net: usb: rtl8150: fix memory leak on usb_submit_urb() failure (git-fixes).\n- net: usb: sr9700: fix incorrect command used to write single register (git-fixes).\n- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (git-fixes).\n- netdevsim: print human readable IP address (bsc#1255071).\n- nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() (git-fixes).\n- nfsd: do not defer requests during idmap lookup in v4 compound decode (bsc#1232223).\n- nfsd: fix return error codes for nfsd_map_name_to_id (bsc#1232223).\n- nvme: Use non zero KATO for persistent discovery connections (git-fixes).\n- orangefs: fix xattr related buffer overflow.. (git-fixes).\n- perf list: Add IBM z17 event descriptions (jsc#PED-13611).\n- perf/x86/intel: Fix KASAN global-out-of-bounds warning (git-fixes).\n- phy: broadcom: bcm63xx-usbh: fix section mismatches (git-fixes).\n- phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe() (git-fixes).\n- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (git-fixes).\n- pinctrl: qcom: msm: Fix deadlock in pinmux configuration (stable-fixes).\n- pinctrl: single: Fix PIN_CONFIG_BIAS_DISABLE handling (stable-fixes).\n- pinctrl: single: Fix incorrect type for error return variable (git-fixes).\n- pinctrl: stm32: fix hwspinlock resource leak in probe function (git-fixes).\n- platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver (git-fixes).\n- platform/mellanox: mlxbf-pmc: Remove trailing whitespaces from event names (git-fixes).\n- platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally (stable-fixes).\n- platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list (stable-fixes).\n- platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks (stable-fixes).\n- platform/x86: acer-wmi: Ignore backlight event (stable-fixes).\n- platform/x86: asus-wmi: use brightness_set_blocking() for kbd led (git-fixes).\n- platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing (git-fixes).\n- platform/x86: huawei-wmi: add keys for HONOR models (stable-fixes).\n- platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic (git-fixes).\n- platform/x86: intel: chtwc_int33fe: don't dereference swnode args (git-fixes).\n- platform/x86: intel: punit_ipc: fix memory corruption (git-fixes).\n- platform/x86: msi-laptop: add missing sysfs_remove_group() (git-fixes).\n- power: supply: apm_power: only unset own apm_get_power_status (git-fixes).\n- power: supply: cw2015: Check devm_delayed_work_autocancel() return code (git-fixes).\n- power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges() (git-fixes).\n- power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges() (git-fixes).\n- power: supply: wm831x: Check wm831x_set_bits() return value (git-fixes).\n- powerpc/64s/slb: Fix SLB multihit issue during SLB preload (bac#1236022 ltc#211187).\n- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (bsc#1253262 ltc#216029).\n- powerpc/kexec: Enable SMT before waking offline CPUs (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588 git-fixes bsc#1253739 ltc#211493 bsc#1254244 ltc#216496).\n- pwm: bcm2835: Make sure the channel is enabled after pwm_request() (git-fixes).\n- r8169: Fix spelling mistake: 'tx_underun' -\u003e 'tx_underrun' (jsc#PED-14353).\n- r8169: Use PCI_IRQ_INTX instead of PCI_IRQ_LEGACY (jsc#PED-14353).\n- r8169: add MODULE_FIRMWARE entry for RTL8126A (jsc#PED-14353).\n- r8169: add PHY c45 ops for MDIO_MMD_VENDOR2 registers (jsc#PED-14353).\n- r8169: add generic rtl_set_eee_txidle_timer function (jsc#PED-14353).\n- r8169: add missing MODULE_FIRMWARE entry for RTL8126A rev.b (jsc#PED-14353).\n- r8169: add support for Intel Killer E5000 (jsc#PED-14353).\n- r8169: add support for RTL8125BP rev.b (jsc#PED-14353).\n- r8169: add support for RTL8125D (jsc#PED-14353).\n- r8169: add support for RTL8125D rev.b (jsc#PED-14353).\n- r8169: add support for RTL8126A rev.b (jsc#PED-14353).\n- r8169: add support for RTL8168M (jsc#PED-14353).\n- r8169: add support for returning tx_lpi_timer in ethtool get_eee (jsc#PED-14353).\n- r8169: add support for the temperature sensor being available from RTL8125B (jsc#PED-14353).\n- r8169: adjust version numbering for RTL8126 (jsc#PED-14353).\n- r8169: align RTL8125 EEE config with vendor driver (jsc#PED-14353).\n- r8169: align RTL8125/RTL8126 PHY config with vendor driver (jsc#PED-14353).\n- r8169: align RTL8126 EEE config with vendor driver (jsc#PED-14353).\n- r8169: align WAKE_PHY handling with r8125/r8126 vendor drivers (jsc#PED-14353).\n- r8169: avoid duplicated messages if loading firmware fails and switch to warn level (jsc#PED-14353).\n- r8169: avoid unsolicited interrupts (jsc#PED-14353).\n- r8169: check for PCI read error in probe (jsc#PED-14353).\n- r8169: disable ALDPS per default for RTL8125 (jsc#PED-14353).\n- r8169: disable RTL8126 ZRX-DC timeout (jsc#PED-14353).\n- r8169: disable interrupt source RxOverflow (jsc#PED-14353).\n- r8169: don't apply UDP padding quirk on RTL8126A (jsc#PED-14353).\n- r8169: don't increment tx_dropped in case of NETDEV_TX_BUSY (jsc#PED-14353).\n- r8169: don't scan PHY addresses \u003e 0 (jsc#PED-14353).\n- r8169: don't take RTNL lock in rtl_task() (jsc#PED-14353).\n- r8169: enable EEE at 2.5G per default on RTL8125B (jsc#PED-14353).\n- r8169: enable RTL8168H/RTL8168EP/RTL8168FP ASPM support (jsc#PED-14353).\n- r8169: fix RTL8117 Wake-on-Lan in DASH mode (git-fixes).\n- r8169: fix inconsistent indenting in rtl8169_get_eth_mac_stats (jsc#PED-14353).\n- r8169: implement additional ethtool stats ops (jsc#PED-14353).\n- r8169: improve RTL8411b phy-down fixup (jsc#PED-14353).\n- r8169: improve __rtl8169_set_wol (jsc#PED-14353).\n- r8169: improve handling task scheduling (jsc#PED-14353).\n- r8169: improve initialization of RSS registers on RTL8125/RTL8126 (jsc#PED-14353).\n- r8169: improve rtl_set_d3_pll_down (jsc#PED-14353).\n- r8169: increase max jumbo packet size on RTL8125/RTL8126 (jsc#PED-14353).\n- r8169: remove detection of chip version 11 (early RTL8168b) (jsc#PED-14353).\n- r8169: remove leftover locks after reverted change (jsc#PED-14353).\n- r8169: remove multicast filter limit (jsc#PED-14353).\n- r8169: remove not needed check in rtl_fw_write_firmware (jsc#PED-14353).\n- r8169: remove original workaround for RTL8125 broken rx issue (jsc#PED-14353).\n- r8169: remove redundant hwmon support (jsc#PED-14353).\n- r8169: remove rtl_dash_loop_wait_high/low (jsc#PED-14353).\n- r8169: remove support for chip version 11 (jsc#PED-14353).\n- r8169: remove unused flag RTL_FLAG_TASK_RESET_NO_QUEUE_WAKE (jsc#PED-14353).\n- r8169: set EEE speed down ratio to 1 (stable-fixes).\n- r8169: simplify EEE handling (jsc#PED-14353).\n- r8169: simplify code by using core-provided pcpu stats allocation (jsc#PED-14353).\n- r8169: support setting the EEE tx idle timer on RTL8168h (jsc#PED-14353).\n- r8169: use dev_err_probe in all appropriate places in rtl_init_one() (jsc#PED-14353).\n- r8169: use helper r8169_mod_reg8_cond to simplify rtl_jumbo_config (jsc#PED-14353).\n- regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex (git-fixes).\n- regulator: core: disable supply if enabling main regulator fails (git-fixes).\n- reset: fix BIT macro reference (stable-fixes).\n- rpmsg: glink: fix rpmsg device leak (git-fixes).\n- rtc: gamecube: Check the return value of ioremap() (git-fixes).\n- scsi: lpfc: Add capability to register Platform Name ID to fabric (bsc#1254119).\n- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (bsc#1254119).\n- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (bsc#1254119).\n- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (bsc#1254119).\n- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (bsc#1254119).\n- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (bsc#1254119).\n- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (bsc#1254119).\n- scsi: lpfc: Revise discovery related function headers and comments (bsc#1254119).\n- scsi: lpfc: Update lpfc version to 14.4.0.12 (bsc#1254119).\n- scsi: lpfc: Update various NPIV diagnostic log messaging (bsc#1254119).\n- scsi: mpi3mr: Fix I/O failures during controller reset (bsc#1251752 jsc#PED-14280).\n- scsi: mpi3mr: Fix controller init failure on fault during queue creation (bsc#1251752 jsc#PED-14280).\n- scsi: mpi3mr: Fix device loss during enclosure reboot due to zero link speed (bsc#1251752 jsc#PED-14280).\n- scsi: mpi3mr: Fix premature TM timeouts on virtual drives (bsc#1251752 jsc#PED-14280).\n- scsi: mpi3mr: Update MPI headers to revision 37 (bsc#1251752 jsc#PED-14280).\n- scsi: mpi3mr: Update driver version to 8.14.0.5.50 (bsc#1251752 jsc#PED-14280).\n- scsi: mpi3mr: Update driver version to 8.15.0.5.50 (bsc#1251752 jsc#PED-14280).\n- selftests/bpf: Skip timer cases when bpf_timer is not supported (git-fixes).\n- selftests/net: calibrate txtimestamp (bsc#1255085).\n- selftests/net: convert fcnal-test.sh to run it in unique namespace (bsc#1254235).\n- selftests/net: convert fib-onlink-tests.sh to run it in unique namespace (bsc#1254235).\n- selftests/net: convert fib_nexthop_multiprefix to run it in unique namespace (bsc#1254235).\n- selftests/net: convert fib_nexthop_nongw.sh to run it in unique namespace (bsc#1254235).\n- selftests/net: convert fib_nexthops.sh to run it in unique namespace (bsc#1254235).\n- selftests/net: convert fib_rule_tests.sh to run it in unique namespace (bsc#1254235).\n- selftests/net: convert fib_tests.sh to run it in unique namespace (bsc#1254235).\n- selftests/net: convert srv6_end_dt46_l3vpn_test.sh to run it in unique namespace (bsc#1254235).\n- selftests/net: convert srv6_end_dt4_l3vpn_test.sh to run it in unique namespace (bsc#1254235).\n- selftests/net: convert srv6_end_dt6_l3vpn_test.sh to run it in unique namespace (bsc#1254235).\n- selftests/net: convert test_vxlan_vnifiltering.sh to run it in unique namespace (bsc#1255349).\n- selftests/net: convert vrf_route_leaking.sh to run it in unique namespace (bsc#1255349).\n- selftests/net: synchronize udpgro tests' tx and rx connection (bsc#1254235).\n- selftests: Introduce Makefile variable to list shared bash scripts (bsc#1254235).\n- selftests: bonding: Add net/forwarding/lib.sh to TEST_INCLUDES (bsc#1254235).\n- selftests: dsa: Replace test symlinks by wrapper script (bsc#1254235).\n- selftests: net: Remove executable bits from library scripts (bsc#1254235).\n- selftests: net: explicitly wait for listener ready (bsc#1254235).\n- selftests: net: fib-onlink-tests: Set high metric for default IPv6 route (bsc#1255346).\n- selftests: net: include forwarding lib (bsc#1254235).\n- selftests: net: included needed helper in the install targets (bsc#1254235).\n- selftests: net: more strict check in net_helper (bsc#1254235).\n- selftests: net: use slowwait to make sure IPv6 setup finished (bsc#1255349).\n- selftests: net: use slowwait to stabilize vrf_route_leaking test (bsc#1255349).\n- selftests: net: veth: test the ability to independently manipulate GRO and XDP (bsc#1255101).\n- selftests: team: Add shared library scripts to TEST_INCLUDES (bsc#1254235).\n- selftests: vrf_route_leaking: remove ipv6_ping_frag from default testing (bsc#1255349).\n- serial: add support of CPCI cards (stable-fixes).\n- serial: amba-pl011: prefer dma_mapping_error() over explicit address checking (git-fixes).\n- serial: core: Fix serial device initialization (git-fixes).\n- serial: core: Restore sysfs fwnode information (git-fixes).\n- serial: sprd: Return -EPROBE_DEFER when uart clock is not ready (stable-fixes).\n- slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves (git-fixes).\n- smc91x: fix broken irq-context in PREEMPT_RT (git-fixes).\n- soc/tegra: fuse: speedo-tegra210: Update speedo IDs (git-fixes).\n- soc: amlogic: canvas: fix device leak on lookup (git-fixes).\n- soc: qcom: ocmem: fix device leak on lookup (git-fixes).\n- soc: qcom: smem: fix hwspinlock resource leak in probe error paths (git-fixes).\n- spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors (git-fixes).\n- spi: bcm63xx: drop wrong casts in probe() (git-fixes).\n- spi: bcm63xx: fix premature CS deassertion on RX-only transactions (git-fixes).\n- spi: fsl-cpm: Check length parity before switching to 16 bit mode (git-fixes).\n- spi: imx: keep dma request disabled before dma transfer setup (stable-fixes).\n- spi: tegra210-qspi: Remove cache operations (git-fixes).\n- spi: tegra210-quad: Add support for internal DMA (git-fixes).\n- spi: tegra210-quad: Check hardware status on timeout (bsc#1253155).\n- spi: tegra210-quad: Fix timeout handling (bsc#1253155).\n- spi: tegra210-quad: Fix timeout handling (git-fixes).\n- spi: tegra210-quad: Refactor error handling into helper functions (bsc#1253155).\n- spi: tegra210-quad: Update dummy sequence configuration (git-fixes).\n- spi: xilinx: increase number of retries before declaring stall (stable-fixes).\n- staging: fbtft: core: fix potential memory leak in fbtft_probe_common() (git-fixes).\n- staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing (stable-fixes).\n- staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser (stable-fixes).\n- thunderbolt: Add support for Intel Wildcat Lake (stable-fixes).\n- tick/sched: Limit non-timekeeper CPUs calling jiffies update (bsc#1254477).\n- tracing: Fix access to trace_event_file (bsc#1254373).\n- uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe (git-fixes).\n- usb: cdns3: Fix double resource release in cdns3_pci_probe (git-fixes).\n- usb: chaoskey: fix locking for O_NONBLOCK (git-fixes).\n- usb: chipidea: udc: limit usb request length to max 16KB (stable-fixes).\n- usb: dwc2: disable platform lowlevel hw resources during shutdown (stable-fixes).\n- usb: dwc2: fix hang during shutdown if set as peripheral (git-fixes).\n- usb: dwc2: fix hang during suspend if set as peripheral (git-fixes).\n- usb: dwc3: Abort suspend on soft disconnect failure (git-fixes).\n- usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (git-fixes).\n- usb: dwc3: keep susphy enabled during exit to avoid controller faults (git-fixes).\n- usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe (git-fixes).\n- usb: dwc3: pci: Sort out the Intel device IDs (stable-fixes).\n- usb: dwc3: pci: add support for the Intel Nova Lake -S (stable-fixes).\n- usb: gadget: configfs: Correctly set use_os_string at bind (git-fixes).\n- usb: gadget: f_eem: Fix memory leak in eem_unwrap (git-fixes).\n- usb: gadget: lpc32xx_udc: fix clock imbalance in error path (git-fixes).\n- usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors (git-fixes).\n- usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt (git-fixes).\n- usb: ohci-nxp: Use helper function devm_clk_get_enabled() (stable-fixes).\n- usb: ohci-nxp: fix device leak on probe failure (git-fixes).\n- usb: phy: Initialize struct usb_phy list_head (git-fixes).\n- usb: phy: isp1301: fix non-OF device reference imbalance (git-fixes).\n- usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE (git-fixes).\n- usb: raw-gadget: do not limit transfer length (git-fixes).\n- usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() (git-fixes).\n- usb: storage: Fix memory leak in USB bulk transport (git-fixes).\n- usb: storage: sddr55: Reject out-of-bound new_pba (stable-fixes).\n- usb: typec: tipd: Clear interrupts first (git-fixes).\n- usb: typec: ucsi: Handle incorrect num_connectors capability (stable-fixes).\n- usb: typec: ucsi: psy: Set max current to zero when disconnected (git-fixes).\n- usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer (git-fixes).\n- usb: udc: Add trace event for usb_gadget_set_state (stable-fixes).\n- usb: usb-storage: Maintain minimal modifications to the bcdDevice range (git-fixes).\n- usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive (stable-fixes).\n- usb: vhci-hcd: Prevent suspending virtually attached devices (git-fixes).\n- usb: xhci: limit run_graceperiod for only usb 3.0 devices (stable-fixes).\n- usbip: Fix locking bug in RT-enabled kernels (stable-fixes).\n- via_wdt: fix critical boot hang due to unnamed resource allocation (stable-fixes).\n- virtio_console: fix order of fields cols and rows (stable-fixes).\n- watchdog: wdat_wdt: Fix ACPI table leak in probe function (git-fixes).\n- wifi: ath10k: Add missing include of export.h (stable-fixes).\n- wifi: ath10k: Avoid vdev delete timeout when firmware is already down (stable-fixes).\n- wifi: ath10k: move recovery check logic into a new work (git-fixes).\n- wifi: ath11k: fix peer HE MCS assignment (git-fixes).\n- wifi: ath11k: restore register window after global reset (git-fixes).\n- wifi: ath12k: fix potential memory leak in ath12k_wow_arp_ns_offload() (git-fixes).\n- wifi: avoid kernel-infoleak from struct iw_point (git-fixes).\n- wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet (stable-fixes).\n- wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() (git-fixes).\n- wifi: cfg80211: stop radar detection in cfg80211_leave() (stable-fixes).\n- wifi: cfg80211: use cfg80211_leave() in iftype change (stable-fixes).\n- wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() (git-fixes).\n- wifi: ieee80211: correct FILS status codes (git-fixes).\n- wifi: mac80211: do not use old MBSSID elements (git-fixes).\n- wifi: mac80211: fix CMAC functions not handling errors (git-fixes).\n- wifi: mac80211: restore non-chanctx injection behaviour (git-fixes).\n- wifi: mt76: Fix DTS power-limits on little endian systems (git-fixes).\n- wifi: mt76: mt7925: fix CLC command timeout when suspend/resume (stable-fixes).\n- wifi: mt76: mt7925: fix the unfinished command of regd_notifier before suspend (stable-fixes).\n- wifi: mt76: mt792x: fix wifi init fail by setting MCU_RUNNING after CLC load (stable-fixes).\n- wifi: nl80211: vendor-cmd: intel: fix a blank kernel-doc line warning (git-fixes).\n- wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() (git-fixes).\n- wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() (git-fixes).\n- wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() (git-fixes).\n- wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1 (stable-fixes).\n- wifi: rtw88: limit indirect IO under powered off for RTL8822CS (git-fixes).\n- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (git-fixes).\n- x86/microcode/AMD: Add TSA microcode SHAs (bsc#1256528).\n- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (bsc#1256528).\n- x86/microcode/AMD: Add more known models to entry sign checking (bsc#1256528).\n- x86/microcode/AMD: Add some forgotten models to the SHA check (bsc#1256528).\n- x86/microcode/AMD: Clean the cache if update did not load microcode (bsc#1256528).\n- x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (bsc#1256528).\n- x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (bsc#1256528).\n- x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (bsc#1256528).\n- x86/microcode/AMD: Limit Entrysign signature checking to known generations (bsc#1256528).\n- x86/microcode/AMD: Load only SHA256-checksummed patches (bsc#1256528).\n- x86/microcode/AMD: Select which microcode patch to load (bsc#1256528).\n- x86/microcode/AMD: Use sha256() instead of init/update/final (bsc#1256528).\n- x86/microcode: Fix Entrysign revision check for Zen1/Naples (bsc#1256528).\n- xhci: dbgtty: fix device unregister (git-fixes).\n- xhci: fix stale flag preventig URBs after link state error is cleared (git-fixes).\n","status":"published","published":"2026-01-28T14:34:30Z","modified":"2026-03-23T04:51:44.683854Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:20477-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2023-54013: interconnect: Fix locking for runpm vs reclaim (bsc#1256280).\n- CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).\n- CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).\n- CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).\n- CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).\n- CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).\n- CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).\n- CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).\n- CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).\n- CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).\n- CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).\n- CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).\n- CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).\n- CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).\n- CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).\n- CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).\n- CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).\n- CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).\n- CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).\n- CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).\n- CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).\n- CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).\n- CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).\n- CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).\n- CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).\n- CVE-2025-40215: kABI: xfrm: delete x-\u003etunnel as we delete x (bsc#1254959).\n- CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).\n- CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).\n- CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).\n- CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).\n- CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).\n- CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).\n- CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).\n- CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).\n- CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).\n- CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).\n- CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).\n- CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).\n- CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).\n- CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).\n- CVE-2025-40261: nvme: nvme-fc: Ensure -\u003eioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).\n- CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).\n- CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).\n- CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).\n- CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).\n- CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).\n- CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).\n- CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).\n- CVE-2025-40287: exfat: fix improper check of dentry.stream.valid_size (bsc#1255030).\n- CVE-2025-40289: drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (bsc#1255042).\n- CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).\n- CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).\n- CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187).\n- CVE-2025-40307: exfat: validate cluster allocation bits of the allocation bitmap (bsc#1255039).\n- CVE-2025-40319: bpf: Sync pending IRQ work before freeing ring buffer (bsc#1254794).\n- CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).\n- CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).\n- CVE-2025-40337: net: stmmac: Correctly handle Rx checksum offload errors (bsc#1255081).\n- CVE-2025-40338: ASoC: Intel: avs: Do not share the name pointer between components (bsc#1255273).\n- CVE-2025-40339: drm/amdgpu: fix nullptr err of vm_handle_moved (bsc#1255428).\n- CVE-2025-40346: arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (bsc#1255318).\n- CVE-2025-40350: net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (bsc#1255260).\n- CVE-2025-40355: sysfs: check visibility before changing group attribute ownership (bsc#1255261).\n- CVE-2025-40360: drm/sysfb: Do not dereference NULL pointer in plane reset (bsc#1255095).\n- CVE-2025-40363: net: ipv6: fix field-spanning memcpy warning in AH output (bsc#1255102).\n- CVE-2025-68171: x86/fpu: Ensure XFD state on signal delivery (bsc#1255255).\n- CVE-2025-68174: amd/amdkfd: enhance kfd process check in switch partition (bsc#1255327).\n- CVE-2025-68178: blk-cgroup: fix possible deadlock while configuring policy (bsc#1255266).\n- CVE-2025-68188: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (bsc#1255269).\n- CVE-2025-68190: drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (bsc#1255131).\n- CVE-2025-68200: bpf: Add bpf_prog_run_data_pointers() (bsc#1255241).\n- CVE-2025-68201: drm/amdgpu: remove two invalid BUG_ON()s (bsc#1255136).\n- CVE-2025-68204: pmdomain: arm: scmi: Fix genpd leak on provider registration failure (bsc#1255224).\n- CVE-2025-68206: netfilter: nft_ct: add seqadj extension for natted connections (bsc#1255142).\n- CVE-2025-68208: bpf: account for current allocated stack depth in widen_imprecise_scalars() (bsc#1255227).\n- CVE-2025-68209: mlx5: Fix default values in create CQ (bsc#1255230).\n- CVE-2025-68227: mptcp: Fix proto fallback detection with BPF (bsc#1255216).\n- CVE-2025-68230: drm/amdgpu: fix gpu page fault after hibernation on PF passthrough (bsc#1255134).\n- CVE-2025-68239: binfmt_misc: restore write access before closing files opened by open_exec() (bsc#1255272).\n- CVE-2025-68241: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (bsc#1255157).\n- CVE-2025-68245: net: netpoll: fix incorrect refcount handling causing incorrect cleanup (bsc#1255268).\n- CVE-2025-68255: staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing (bsc#1255395).\n- CVE-2025-68259: KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced (bsc#1255199).\n- CVE-2025-68261: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164).\n- CVE-2025-68264: ext4: refresh inline data size before write operations (bsc#1255380).\n- CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255377).\n- CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401).\n- CVE-2025-68296: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128).\n- CVE-2025-68297: ceph: fix crash in process_v2_sparse_read() for encrypted directories (bsc#1255403).\n- CVE-2025-68301: net: atlantic: fix fragment overflow handling in RX path (bsc#1255120).\n- CVE-2025-68320: lan966x: Fix sleeping in atomic context (bsc#1255172).\n- CVE-2025-68325: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (bsc#1255417).\n- CVE-2025-68327: usb: renesas_usbhs: Fix synchronous external abort on unbind (bsc#1255488).\n- CVE-2025-68337: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (bsc#1255482).\n- CVE-2025-68340: team: Move team device type change at the end of team_port_add (bsc#1255507).\n- CVE-2025-68349: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (bsc#1255544).\n- CVE-2025-68363: bpf: Check skb-\u003etransport_header is set in bpf_skb_check_mtu (bsc#1255552).\n- CVE-2025-68365: fs/ntfs3: Initialize allocated memory before use (bsc#1255548).\n- CVE-2025-68366: nbd: defer config unlock in nbd_genl_connect (bsc#1255622).\n- CVE-2025-68367: macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (bsc#1255547).\n- CVE-2025-68372: nbd: defer config put in recv_work (bsc#1255537).\n- CVE-2025-68378: bpf: Refactor stack map trace depth calculation into helper function (bsc#1255614).\n- CVE-2025-68379: RDMA/rxe: Fix null deref on srq-\u003erq.queue after resize failure (bsc#1255695).\n- CVE-2025-68727: ntfs3: Fix uninit buffer allocated by __getname() (bsc#1255568).\n- CVE-2025-68728: ntfs3: fix uninit memory after failed mi_read in mi_format_new (bsc#1255539).\n- CVE-2025-68733: smack: fix bug: unprivileged task can create labels (bsc#1255615).\n- CVE-2025-68742: bpf: Improve program stats run-time calculation (bsc#1255707).\n- CVE-2025-68744: bpf: Free special fields when update [lru_,]percpu_hash maps (bsc#1255709).\n- CVE-2025-68764: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (bsc#1255930).\n- CVE-2025-68768: inet: frags: add inet_frag_queue_flush() (bsc#1256579).\n- CVE-2025-68770: bnxt_en: Fix XDP_TX path (bsc#1256584).\n- CVE-2025-68771: ocfs2: fix kernel BUG in ocfs2_find_victim_chain (bsc#1256582).\n- CVE-2025-68775: net/handshake: duplicate handshake cancellations leak socket (bsc#1256665).\n- CVE-2025-68776: net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (bsc#1256659).\n- CVE-2025-68788: fsnotify: do not generate ACCESS/MODIFY events on child for special files (bsc#1256638).\n- CVE-2025-68795: ethtool: Avoid overflowing userspace buffer on stats query (bsc#1256688).\n- CVE-2025-68798: perf/x86/amd: Check event before enable to avoid GPF (bsc#1256689).\n- CVE-2025-68800: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (bsc#1256646).\n- CVE-2025-68801: mlxsw: spectrum_router: Fix neighbour use-after-free (bsc#1256653).\n- CVE-2025-68803: nfsd: set security label during create operations (bsc#1256770).\n- CVE-2025-68813: ipvs: fix ipv4 null-ptr-deref in route error path (bsc#1256641).\n- CVE-2025-68814: io_uring: fix filename leak in __io_openat_prep() (bsc#1256651).\n- CVE-2025-68815: net/sched: ets: Remove drr class from the active list if it changes to strict (bsc#1256680).\n- CVE-2025-68816: net/mlx5: fw_tracer, Validate format string parameters (bsc#1256674).\n- CVE-2025-68820: ext4: xattr: fix null pointer deref in ext4_raw_inode() (bsc#1256754).\n- CVE-2025-71064: net: hns3: using the num_tqps in the vf driver to apply for resources (bsc#1256654).\n- CVE-2025-71066: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (bsc#1256645).\n- CVE-2025-71077: tpm: Cap the number of PCR banks (bsc#1256613).\n- CVE-2025-71084: RDMA/cm: Fix leaking the multicast GID table reference (bsc#1256622).\n- CVE-2025-71085: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (bsc#1256623).\n- CVE-2025-71087: iavf: fix off-by-one issues in iavf_config_rss_reg() (bsc#1256628).\n- CVE-2025-71088: mptcp: fallback earlier on simult connection (bsc#1256630).\n- CVE-2025-71089: iommu: disable SVA when CONFIG_X86 is set (bsc#1256612).\n- CVE-2025-71091: team: fix check for port enabled in team_queue_override_port_prio_changed() (bsc#1256773).\n- CVE-2025-71093: e1000: fix OOB in e1000_tbi_should_accept() (bsc#1256777).\n- CVE-2025-71094: net: usb: asix: ax88772: Increase phy_name size (bsc#1256597).\n- CVE-2025-71095: net: stmmac: fix the crash issue for zero copy XDP_TX action (bsc#1256605).\n- CVE-2025-71096: RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (bsc#1256606).\n- CVE-2025-71097: ipv4: Fix reference count leak when using error routes with nexthop objects (bsc#1256607).\n- CVE-2025-71098: ip6_gre: make ip6gre_header() robust (bsc#1256591).\n- CVE-2025-71112: net: hns3: add VLAN id validation before using (bsc#1256726).\n- CVE-2025-71116: libceph: make decode_pool() more resilient against corrupted osdmaps (bsc#1256744).\n- CVE-2025-71120: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (bsc#1256779).\n- CVE-2025-71123: ext4: fix string copying in parse_apply_sb_mount_options() (bsc#1256757).\n- CVE-2025-71133: RDMA/irdma: avoid invalid read in irdma_net_event (bsc#1256733).\n- CVE-2025-71135: md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt() (bsc#1256761).\n- CVE-2025-71137: octeontx2-pf: fix \"UBSAN: shift-out-of-bounds error\" (bsc#1256760).\n- CVE-2025-71149: io_uring/poll: correctly handle io_poll_add() return value on update (bsc#1257164).\n- CVE-2026-22976: net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (bsc#1257035).\n- CVE-2026-22977: net: sock: fix hardened usercopy panic in sock_recv_errqueue (bsc#1257053).\n- CVE-2026-22984: libceph: prevent potential out-of-bounds reads in handle_auth_done() (bsc#1257217).\n- CVE-2026-22990: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (bsc#1257221).\n- CVE-2026-22991: libceph: make free_choose_arg_map() resilient to partial allocation (bsc#1257220).\n- CVE-2026-22992: libceph: return the handler error from mon_handle_auth_done() (bsc#1257218).\n- CVE-2026-22993: idpf: Fix RSS LUT NULL pointer crash on early ethtool operations (bsc#1257180).\n- CVE-2026-22996: net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv.\n- CVE-2026-22999: net/sched: sch_qfq: do not free existing class in qfq_change_class() (bsc#1257236).\n- CVE-2026-23000: net/mlx5e: Fix crash on profile change rollback failure (bsc#1257234).\n- CVE-2026-23001: macvlan: fix possible UAF in macvlan_forward_source() (bsc#1257232).\n- CVE-2026-23005: x86/fpu: Clear XSTATE_BV in guest XSAVE state whenever XFD[i]=1 (bsc#1257245).\n- CVE-2026-23010: ipv6: Fix use-after-free in inet6_addr_del() (bsc#1257332).\n- CVE-2026-23011: ipv4: ip_gre: make ipgre_header() robust (bsc#1257207).\n\nThe following non security issues were fixed:\n\n- ALSA: usb-audio: Update for native DSD support quirks (stable-fixes).\n- Disable CONFIG_CPU5_WDT The cpu5wdt driver doesn't implement a\n  proper watchdog interface and has many code issues. It only handles\n  obscure and obsolete hardware. Stop building and supporting this driver\n  (jsc#PED-14062).\n- Update config files (jsc#PED-12554 jsc#PED-6996\n  bsc#1243677 ltc#213602 bsc#1243678 ltc#213596)\n  CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY=y\n  CONFIG_INTEGRITY_CA_MACHINE_KEYRING_MAX=y\n- Update config files: disable CONFIG_DEVPORT for arm64 (bsc#1256792)\n- bpf/selftests: test_select_reuseport_kern: Remove unused header (bsc#1257603).\n- bpf: Do not let BPF test infra emit invalid GSO types to stack (bsc#1255569).\n- cifs: Fix copy offload to flush destination region (bsc#1252511).\n- cifs: Fix flushing, invalidation and file size with copy_file_range() (bsc#1252511).\n- cifs: Fix uncached read into ITER_KVEC iterator (bsc#1245449).\n- cifs: make cifs_chan_update_iface() a void function (git-fixes).\n- cifs: update dstaddr whenever channel iface is updated (git-fixes).\n- cpuidle: menu: Use residency threshold in polling state override decisions (bsc#1255026).\n- dm: fix queue start/stop imbalance under suspend/load/resume races (bsc#1253386)\n- drm/amdgpu: update mappings not managed by KFD (bsc#1255428)\n- ext4: use optimized mballoc scanning regardless of inode format (bsc#1254378).\n- ext4: wait for ongoing I/O to complete before freeing blocks (bsc#1256366).\n- fs: dlm: allow to F_SETLKW getting interrupted (bsc#1255025).\n- ice: use netif_get_num_default_rss_queues() (bsc#1247712).\n- media: atomisp: Prefix firmware paths with \"intel/ipu/\" (bsc#1252973).\n- media: atomisp: Remove firmware_name module parameter (bsc#1252973).\n- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (bsc#1254447 bsc#1253087).\n- net: hv_netvsc: reject RSS hash key programming without RX indirection table (bsc#1257473).\n- net: tcp: allow zero-window ACK update the window (bsc#1254767).\n- net: usb: pegasus: fix memory leak in update_eth_regs_async() (git-fixes).\n- powerpc/addnote: Fix overflow on 32-bit builds (bsc#1215199).\n- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event\n  handling (bsc#1253262 ltc#216029).\n- powerpc/kexec: Enable SMT before waking offline CPUs (bsc#1214285\n  bsc#1205462 ltc#200161 ltc#200588 git-fixes bsc#1253739 ltc#211493\n  bsc#1254244 ltc#216496).\n- sched: Increase sched_tick_remote timeout (bsc#1254510).\n- scsi: lpfc: Add capability to register Platform Name ID to fabric (bsc#1254119).\n- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (bsc#1254119).\n- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (bsc#1254119).\n- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (bsc#1254119).\n- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (bsc#1254119).\n- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (bsc#1254119).\n- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (bsc#1254119).\n- scsi: lpfc: Revise discovery related function headers and comments (bsc#1254119).\n- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (bsc#1256861).\n- scsi: lpfc: Update lpfc version to 14.4.0.12 (bsc#1254119).\n- scsi: lpfc: Update lpfc version to 14.4.0.13 (bsc#1256861).\n- scsi: lpfc: Update various NPIV diagnostic log messaging (bsc#1254119).\n- scsi: qla2xxx: Add Speed in SFP print information (bsc#1256863).\n- scsi: qla2xxx: Add bsg interface to support firmware img validation (bsc#1256863).\n- scsi: qla2xxx: Add load flash firmware mailbox support for 28xxx (bsc#1256863).\n- scsi: qla2xxx: Add support for 64G SFP speed (bsc#1256863).\n- scsi: qla2xxx: Allow recovery for tape devices (bsc#1256863).\n- scsi: qla2xxx: Delay module unload while fabric scan in progress (bsc#1256863).\n- scsi: qla2xxx: Fix bsg_done() causing double free (bsc#1256863).\n- scsi: qla2xxx: Free sp in error path to fix system crash (bsc#1256863).\n- scsi: qla2xxx: Query FW again before proceeding with login (bsc#1256863).\n- scsi: qla2xxx: Update version to 10.02.10.100-k (bsc#1256863).\n- scsi: qla2xxx: Validate MCU signature before executing MBC 03h (bsc#1256863).\n- scsi: qla2xxx: Validate sp before freeing associated memory (bsc#1256863).\n- scsi: storvsc: Process unsupported MODE_SENSE_10 (bsc#1257296).\n- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (bsc#1250748,bsc#1257154).\n- smb: client: update cfid-\u003elast_access_time in open_cached_dir_by_dentry() (git-fixes).\n- smb: improve directory cache reuse for readdir operations (bsc#1252712).\n- soc/tegra: fuse: speedo-tegra210: Update speedo IDs (git-fixes).\n- spi: tegra210-quad: Check hardware status on timeout (bsc#1253155)\n- spi: tegra210-quad: Fix timeout handling (bsc#1253155)\n- spi: tegra210-quad: Refactor error handling into helper functions (bsc#1253155)\n- spi: tegra210-quad: Update dummy sequence configuration (git-fixes)\n- supported.conf: Mark lan 743x supported (jsc#PED-14571)\n- tracing: Fix access to trace_event_file (bsc#1254373).\n- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (git-fixes).\n- x86/microcode/AMD: Add TSA microcode SHAs (bsc#1256528).\n- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (bsc#1256528).\n- x86/microcode/AMD: Add more known models to entry sign checking (bsc#1256528).\n- x86/microcode/AMD: Add some forgotten models to the SHA check (bsc#1256528).\n- x86/microcode/AMD: Clean the cache if update did not load microcode (bsc#1256528).\n- x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any\n  unreleased standalone Zen5 microcode patches (bsc#1256528).\n- x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (bsc#1256528).\n- x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (bsc#1256528).\n- x86/microcode/AMD: Limit Entrysign signature checking to known generations (bsc#1256528).\n- x86/microcode/AMD: Load only SHA256-checksummed patches (bsc#1256528).\n- x86/microcode/AMD: Select which microcode patch to load (bsc#1256528).\n- x86/microcode/AMD: Use sha256() instead of init/update/final (bsc#1256528).\n- x86/microcode: Fix Entrysign revision check for Zen1/Naples (bsc#1256528).\n","status":"published","published":"2026-02-24T10:42:46Z","modified":"2026-03-23T04:52:59.338344Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20498-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2023-54013: interconnect: Fix locking for runpm vs reclaim (bsc#1256280).\n- CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).\n- CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).\n- CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).\n- CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).\n- CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).\n- CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).\n- CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).\n- CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).\n- CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).\n- CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).\n- CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).\n- CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).\n- CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).\n- CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).\n- CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).\n- CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).\n- CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).\n- CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).\n- CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).\n- CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).\n- CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).\n- CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).\n- CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).\n- CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).\n- CVE-2025-40215: kABI: xfrm: delete x-\u003etunnel as we delete x (bsc#1254959).\n- CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).\n- CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).\n- CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).\n- CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).\n- CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).\n- CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).\n- CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).\n- CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).\n- CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).\n- CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).\n- CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).\n- CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).\n- CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).\n- CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).\n- CVE-2025-40261: nvme: nvme-fc: Ensure -\u003eioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).\n- CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).\n- CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).\n- CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).\n- CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).\n- CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).\n- CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).\n- CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).\n- CVE-2025-40287: exfat: fix improper check of dentry.stream.valid_size (bsc#1255030).\n- CVE-2025-40289: drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (bsc#1255042).\n- CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).\n- CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).\n- CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187).\n- CVE-2025-40307: exfat: validate cluster allocation bits of the allocation bitmap (bsc#1255039).\n- CVE-2025-40319: bpf: Sync pending IRQ work before freeing ring buffer (bsc#1254794).\n- CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).\n- CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).\n- CVE-2025-40337: net: stmmac: Correctly handle Rx checksum offload errors (bsc#1255081).\n- CVE-2025-40338: ASoC: Intel: avs: Do not share the name pointer between components (bsc#1255273).\n- CVE-2025-40339: drm/amdgpu: fix nullptr err of vm_handle_moved (bsc#1255428).\n- CVE-2025-40346: arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (bsc#1255318).\n- CVE-2025-40350: net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (bsc#1255260).\n- CVE-2025-40355: sysfs: check visibility before changing group attribute ownership (bsc#1255261).\n- CVE-2025-40360: drm/sysfb: Do not dereference NULL pointer in plane reset (bsc#1255095).\n- CVE-2025-40363: net: ipv6: fix field-spanning memcpy warning in AH output (bsc#1255102).\n- CVE-2025-68171: x86/fpu: Ensure XFD state on signal delivery (bsc#1255255).\n- CVE-2025-68174: amd/amdkfd: enhance kfd process check in switch partition (bsc#1255327).\n- CVE-2025-68178: blk-cgroup: fix possible deadlock while configuring policy (bsc#1255266).\n- CVE-2025-68188: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (bsc#1255269).\n- CVE-2025-68190: drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (bsc#1255131).\n- CVE-2025-68200: bpf: Add bpf_prog_run_data_pointers() (bsc#1255241).\n- CVE-2025-68201: drm/amdgpu: remove two invalid BUG_ON()s (bsc#1255136).\n- CVE-2025-68204: pmdomain: arm: scmi: Fix genpd leak on provider registration failure (bsc#1255224).\n- CVE-2025-68206: netfilter: nft_ct: add seqadj extension for natted connections (bsc#1255142).\n- CVE-2025-68208: bpf: account for current allocated stack depth in widen_imprecise_scalars() (bsc#1255227).\n- CVE-2025-68209: mlx5: Fix default values in create CQ (bsc#1255230).\n- CVE-2025-68227: mptcp: Fix proto fallback detection with BPF (bsc#1255216).\n- CVE-2025-68230: drm/amdgpu: fix gpu page fault after hibernation on PF passthrough (bsc#1255134).\n- CVE-2025-68239: binfmt_misc: restore write access before closing files opened by open_exec() (bsc#1255272).\n- CVE-2025-68241: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (bsc#1255157).\n- CVE-2025-68245: net: netpoll: fix incorrect refcount handling causing incorrect cleanup (bsc#1255268).\n- CVE-2025-68255: staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing (bsc#1255395).\n- CVE-2025-68259: KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced (bsc#1255199).\n- CVE-2025-68261: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164).\n- CVE-2025-68264: ext4: refresh inline data size before write operations (bsc#1255380).\n- CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255377).\n- CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401).\n- CVE-2025-68296: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128).\n- CVE-2025-68297: ceph: fix crash in process_v2_sparse_read() for encrypted directories (bsc#1255403).\n- CVE-2025-68301: net: atlantic: fix fragment overflow handling in RX path (bsc#1255120).\n- CVE-2025-68320: lan966x: Fix sleeping in atomic context (bsc#1255172).\n- CVE-2025-68325: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (bsc#1255417).\n- CVE-2025-68327: usb: renesas_usbhs: Fix synchronous external abort on unbind (bsc#1255488).\n- CVE-2025-68337: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (bsc#1255482).\n- CVE-2025-68340: team: Move team device type change at the end of team_port_add (bsc#1255507).\n- CVE-2025-68349: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (bsc#1255544).\n- CVE-2025-68363: bpf: Check skb-\u003etransport_header is set in bpf_skb_check_mtu (bsc#1255552).\n- CVE-2025-68365: fs/ntfs3: Initialize allocated memory before use (bsc#1255548).\n- CVE-2025-68366: nbd: defer config unlock in nbd_genl_connect (bsc#1255622).\n- CVE-2025-68367: macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (bsc#1255547).\n- CVE-2025-68372: nbd: defer config put in recv_work (bsc#1255537).\n- CVE-2025-68378: bpf: Refactor stack map trace depth calculation into helper function (bsc#1255614).\n- CVE-2025-68379: RDMA/rxe: Fix null deref on srq-\u003erq.queue after resize failure (bsc#1255695).\n- CVE-2025-68727: ntfs3: Fix uninit buffer allocated by __getname() (bsc#1255568).\n- CVE-2025-68728: ntfs3: fix uninit memory after failed mi_read in mi_format_new (bsc#1255539).\n- CVE-2025-68733: smack: fix bug: unprivileged task can create labels (bsc#1255615).\n- CVE-2025-68742: bpf: Improve program stats run-time calculation (bsc#1255707).\n- CVE-2025-68744: bpf: Free special fields when update [lru_,]percpu_hash maps (bsc#1255709).\n- CVE-2025-68764: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (bsc#1255930).\n- CVE-2025-68768: inet: frags: add inet_frag_queue_flush() (bsc#1256579).\n- CVE-2025-68770: bnxt_en: Fix XDP_TX path (bsc#1256584).\n- CVE-2025-68771: ocfs2: fix kernel BUG in ocfs2_find_victim_chain (bsc#1256582).\n- CVE-2025-68775: net/handshake: duplicate handshake cancellations leak socket (bsc#1256665).\n- CVE-2025-68776: net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (bsc#1256659).\n- CVE-2025-68788: fsnotify: do not generate ACCESS/MODIFY events on child for special files (bsc#1256638).\n- CVE-2025-68795: ethtool: Avoid overflowing userspace buffer on stats query (bsc#1256688).\n- CVE-2025-68798: perf/x86/amd: Check event before enable to avoid GPF (bsc#1256689).\n- CVE-2025-68800: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (bsc#1256646).\n- CVE-2025-68801: mlxsw: spectrum_router: Fix neighbour use-after-free (bsc#1256653).\n- CVE-2025-68803: nfsd: set security label during create operations (bsc#1256770).\n- CVE-2025-68813: ipvs: fix ipv4 null-ptr-deref in route error path (bsc#1256641).\n- CVE-2025-68814: io_uring: fix filename leak in __io_openat_prep() (bsc#1256651).\n- CVE-2025-68815: net/sched: ets: Remove drr class from the active list if it changes to strict (bsc#1256680).\n- CVE-2025-68816: net/mlx5: fw_tracer, Validate format string parameters (bsc#1256674).\n- CVE-2025-68820: ext4: xattr: fix null pointer deref in ext4_raw_inode() (bsc#1256754).\n- CVE-2025-71064: net: hns3: using the num_tqps in the vf driver to apply for resources (bsc#1256654).\n- CVE-2025-71066: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (bsc#1256645).\n- CVE-2025-71077: tpm: Cap the number of PCR banks (bsc#1256613).\n- CVE-2025-71084: RDMA/cm: Fix leaking the multicast GID table reference (bsc#1256622).\n- CVE-2025-71085: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (bsc#1256623).\n- CVE-2025-71087: iavf: fix off-by-one issues in iavf_config_rss_reg() (bsc#1256628).\n- CVE-2025-71088: mptcp: fallback earlier on simult connection (bsc#1256630).\n- CVE-2025-71089: iommu: disable SVA when CONFIG_X86 is set (bsc#1256612).\n- CVE-2025-71091: team: fix check for port enabled in team_queue_override_port_prio_changed() (bsc#1256773).\n- CVE-2025-71093: e1000: fix OOB in e1000_tbi_should_accept() (bsc#1256777).\n- CVE-2025-71094: net: usb: asix: ax88772: Increase phy_name size (bsc#1256597).\n- CVE-2025-71095: net: stmmac: fix the crash issue for zero copy XDP_TX action (bsc#1256605).\n- CVE-2025-71096: RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (bsc#1256606).\n- CVE-2025-71097: ipv4: Fix reference count leak when using error routes with nexthop objects (bsc#1256607).\n- CVE-2025-71098: ip6_gre: make ip6gre_header() robust (bsc#1256591).\n- CVE-2025-71112: net: hns3: add VLAN id validation before using (bsc#1256726).\n- CVE-2025-71116: libceph: make decode_pool() more resilient against corrupted osdmaps (bsc#1256744).\n- CVE-2025-71120: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (bsc#1256779).\n- CVE-2025-71123: ext4: fix string copying in parse_apply_sb_mount_options() (bsc#1256757).\n- CVE-2025-71133: RDMA/irdma: avoid invalid read in irdma_net_event (bsc#1256733).\n- CVE-2025-71135: md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt() (bsc#1256761).\n- CVE-2025-71137: octeontx2-pf: fix \"UBSAN: shift-out-of-bounds error\" (bsc#1256760).\n- CVE-2025-71149: io_uring/poll: correctly handle io_poll_add() return value on update (bsc#1257164).\n- CVE-2026-22976: net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (bsc#1257035).\n- CVE-2026-22977: net: sock: fix hardened usercopy panic in sock_recv_errqueue (bsc#1257053).\n- CVE-2026-22984: libceph: prevent potential out-of-bounds reads in handle_auth_done() (bsc#1257217).\n- CVE-2026-22990: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (bsc#1257221).\n- CVE-2026-22991: libceph: make free_choose_arg_map() resilient to partial allocation (bsc#1257220).\n- CVE-2026-22992: libceph: return the handler error from mon_handle_auth_done() (bsc#1257218).\n- CVE-2026-22993: idpf: Fix RSS LUT NULL pointer crash on early ethtool operations (bsc#1257180).\n- CVE-2026-22996: net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv.\n- CVE-2026-22999: net/sched: sch_qfq: do not free existing class in qfq_change_class() (bsc#1257236).\n- CVE-2026-23000: net/mlx5e: Fix crash on profile change rollback failure (bsc#1257234).\n- CVE-2026-23001: macvlan: fix possible UAF in macvlan_forward_source() (bsc#1257232).\n- CVE-2026-23005: x86/fpu: Clear XSTATE_BV in guest XSAVE state whenever XFD[i]=1 (bsc#1257245).\n- CVE-2026-23010: ipv6: Fix use-after-free in inet6_addr_del() (bsc#1257332).\n- CVE-2026-23011: ipv4: ip_gre: make ipgre_header() robust (bsc#1257207).\n\nThe following non security issues were fixed:\n\n- ALSA: usb-audio: Update for native DSD support quirks (stable-fixes).\n- Disable CONFIG_CPU5_WDT The cpu5wdt driver doesn't implement a\n  proper watchdog interface and has many code issues. It only handles\n  obscure and obsolete hardware. Stop building and supporting this driver\n  (jsc#PED-14062).\n- Update config files (jsc#PED-12554 jsc#PED-6996\n  bsc#1243677 ltc#213602 bsc#1243678 ltc#213596)\n  CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY=y\n  CONFIG_INTEGRITY_CA_MACHINE_KEYRING_MAX=y\n- Update config files: disable CONFIG_DEVPORT for arm64 (bsc#1256792)\n- bpf/selftests: test_select_reuseport_kern: Remove unused header (bsc#1257603).\n- bpf: Do not let BPF test infra emit invalid GSO types to stack (bsc#1255569).\n- cifs: Fix copy offload to flush destination region (bsc#1252511).\n- cifs: Fix flushing, invalidation and file size with copy_file_range() (bsc#1252511).\n- cifs: Fix uncached read into ITER_KVEC iterator (bsc#1245449).\n- cifs: make cifs_chan_update_iface() a void function (git-fixes).\n- cifs: update dstaddr whenever channel iface is updated (git-fixes).\n- cpuidle: menu: Use residency threshold in polling state override decisions (bsc#1255026).\n- dm: fix queue start/stop imbalance under suspend/load/resume races (bsc#1253386)\n- drm/amdgpu: update mappings not managed by KFD (bsc#1255428)\n- ext4: use optimized mballoc scanning regardless of inode format (bsc#1254378).\n- ext4: wait for ongoing I/O to complete before freeing blocks (bsc#1256366).\n- fs: dlm: allow to F_SETLKW getting interrupted (bsc#1255025).\n- ice: use netif_get_num_default_rss_queues() (bsc#1247712).\n- media: atomisp: Prefix firmware paths with \"intel/ipu/\" (bsc#1252973).\n- media: atomisp: Remove firmware_name module parameter (bsc#1252973).\n- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (bsc#1254447 bsc#1253087).\n- net: hv_netvsc: reject RSS hash key programming without RX indirection table (bsc#1257473).\n- net: tcp: allow zero-window ACK update the window (bsc#1254767).\n- net: usb: pegasus: fix memory leak in update_eth_regs_async() (git-fixes).\n- powerpc/addnote: Fix overflow on 32-bit builds (bsc#1215199).\n- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event\n  handling (bsc#1253262 ltc#216029).\n- powerpc/kexec: Enable SMT before waking offline CPUs (bsc#1214285\n  bsc#1205462 ltc#200161 ltc#200588 git-fixes bsc#1253739 ltc#211493\n  bsc#1254244 ltc#216496).\n- sched: Increase sched_tick_remote timeout (bsc#1254510).\n- scsi: lpfc: Add capability to register Platform Name ID to fabric (bsc#1254119).\n- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (bsc#1254119).\n- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (bsc#1254119).\n- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (bsc#1254119).\n- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (bsc#1254119).\n- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (bsc#1254119).\n- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (bsc#1254119).\n- scsi: lpfc: Revise discovery related function headers and comments (bsc#1254119).\n- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (bsc#1256861).\n- scsi: lpfc: Update lpfc version to 14.4.0.12 (bsc#1254119).\n- scsi: lpfc: Update lpfc version to 14.4.0.13 (bsc#1256861).\n- scsi: lpfc: Update various NPIV diagnostic log messaging (bsc#1254119).\n- scsi: qla2xxx: Add Speed in SFP print information (bsc#1256863).\n- scsi: qla2xxx: Add bsg interface to support firmware img validation (bsc#1256863).\n- scsi: qla2xxx: Add load flash firmware mailbox support for 28xxx (bsc#1256863).\n- scsi: qla2xxx: Add support for 64G SFP speed (bsc#1256863).\n- scsi: qla2xxx: Allow recovery for tape devices (bsc#1256863).\n- scsi: qla2xxx: Delay module unload while fabric scan in progress (bsc#1256863).\n- scsi: qla2xxx: Fix bsg_done() causing double free (bsc#1256863).\n- scsi: qla2xxx: Free sp in error path to fix system crash (bsc#1256863).\n- scsi: qla2xxx: Query FW again before proceeding with login (bsc#1256863).\n- scsi: qla2xxx: Update version to 10.02.10.100-k (bsc#1256863).\n- scsi: qla2xxx: Validate MCU signature before executing MBC 03h (bsc#1256863).\n- scsi: qla2xxx: Validate sp before freeing associated memory (bsc#1256863).\n- scsi: storvsc: Process unsupported MODE_SENSE_10 (bsc#1257296).\n- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (bsc#1250748,bsc#1257154).\n- smb: client: update cfid-\u003elast_access_time in open_cached_dir_by_dentry() (git-fixes).\n- smb: improve directory cache reuse for readdir operations (bsc#1252712).\n- soc/tegra: fuse: speedo-tegra210: Update speedo IDs (git-fixes).\n- spi: tegra210-quad: Check hardware status on timeout (bsc#1253155)\n- spi: tegra210-quad: Fix timeout handling (bsc#1253155)\n- spi: tegra210-quad: Refactor error handling into helper functions (bsc#1253155)\n- spi: tegra210-quad: Update dummy sequence configuration (git-fixes)\n- supported.conf: Mark lan 743x supported (jsc#PED-14571)\n- tracing: Fix access to trace_event_file (bsc#1254373).\n- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (git-fixes).\n- x86/microcode/AMD: Add TSA microcode SHAs (bsc#1256528).\n- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (bsc#1256528).\n- x86/microcode/AMD: Add more known models to entry sign checking (bsc#1256528).\n- x86/microcode/AMD: Add some forgotten models to the SHA check (bsc#1256528).\n- x86/microcode/AMD: Clean the cache if update did not load microcode (bsc#1256528).\n- x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any\n  unreleased standalone Zen5 microcode patches (bsc#1256528).\n- x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (bsc#1256528).\n- x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (bsc#1256528).\n- x86/microcode/AMD: Limit Entrysign signature checking to known generations (bsc#1256528).\n- x86/microcode/AMD: Load only SHA256-checksummed patches (bsc#1256528).\n- x86/microcode/AMD: Select which microcode patch to load (bsc#1256528).\n- x86/microcode/AMD: Use sha256() instead of init/update/final (bsc#1256528).\n- x86/microcode: Fix Entrysign revision check for Zen1/Naples (bsc#1256528).\n","status":"published","published":"2026-02-24T09:10:01Z","modified":"2026-03-23T04:53:00.283571Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20845-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).\n- CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).\n- CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).\n- CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).\n- CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).\n- CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).\n- CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).\n- CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).\n- CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).\n- CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).\n- CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).\n- CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).\n- CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).\n- CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).\n- CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).\n- CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).\n- CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).\n- CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).\n- CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).\n- CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).\n- CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).\n- CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).\n- CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).\n- CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).\n- CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).\n- CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).\n- CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).\n- CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).\n- CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).\n- CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).\n- CVE-2025-40192: Revert \"ipmi: fix msg stack when IPMI is disconnected\" (bsc#1253622).\n- CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).\n- CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).\n- CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).\n- CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).\n- CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).\n- CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).\n- CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).\n- CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).\n- CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).\n- CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).\n- CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).\n- CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).\n- CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).\n- CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).\n- CVE-2025-40261: nvme: nvme-fc: Ensure -\u003eioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).\n- CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).\n- CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).\n- CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).\n- CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).\n- CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).\n- CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).\n- CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).\n- CVE-2025-40289: drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (bsc#1255042).\n- CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).\n- CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).\n- CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187).\n- CVE-2025-40307: exfat: validate cluster allocation bits of the allocation bitmap (bsc#1255039).\n- CVE-2025-40319: bpf: Sync pending IRQ work before freeing ring buffer (bsc#1254794).\n- CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).\n- CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).\n- CVE-2025-40338: ASoC: Intel: avs: Do not share the name pointer between components (bsc#1255273).\n- CVE-2025-40339: drm/amdgpu: fix nullptr err of vm_handle_moved (bsc#1255428).\n- CVE-2025-40346: arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (bsc#1255318).\n- CVE-2025-40350: net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (bsc#1255260).\n- CVE-2025-40355: sysfs: check visibility before changing group attribute ownership (bsc#1255261).\n- CVE-2025-40360: drm/sysfb: Do not dereference NULL pointer in plane reset (bsc#1255095).\n- CVE-2025-40363: net: ipv6: fix field-spanning memcpy warning in AH output (bsc#1255102).\n- CVE-2025-68171: x86/fpu: Ensure XFD state on signal delivery (bsc#1255255).\n- CVE-2025-68174: amd/amdkfd: enhance kfd process check in switch partition (bsc#1255327).\n- CVE-2025-68178: blk-cgroup: fix possible deadlock while configuring policy (bsc#1255266).\n- CVE-2025-68188: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (bsc#1255269).\n- CVE-2025-68190: drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (bsc#1255131).\n- CVE-2025-68200: bpf: Add bpf_prog_run_data_pointers() (bsc#1255241).\n- CVE-2025-68201: drm/amdgpu: remove two invalid BUG_ON()s (bsc#1255136).\n- CVE-2025-68204: pmdomain: arm: scmi: Fix genpd leak on provider registration failure (bsc#1255224).\n- CVE-2025-68206: netfilter: nft_ct: add seqadj extension for natted connections (bsc#1255142).\n- CVE-2025-68208: bpf: account for current allocated stack depth in widen_imprecise_scalars() (bsc#1255227).\n- CVE-2025-68209: mlx5: Fix default values in create CQ (bsc#1255230).\n- CVE-2025-68227: mptcp: Fix proto fallback detection with BPF (bsc#1255216).\n- CVE-2025-68230: drm/amdgpu: fix gpu page fault after hibernation on PF passthrough (bsc#1255134).\n- CVE-2025-68239: binfmt_misc: restore write access before closing files opened by open_exec() (bsc#1255272).\n- CVE-2025-68241: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (bsc#1255157).\n- CVE-2025-68245: net: netpoll: fix incorrect refcount handling causing incorrect cleanup (bsc#1255268).\n- CVE-2025-68255: staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing (bsc#1255395).\n- CVE-2025-68259: KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced (bsc#1255199).\n- CVE-2025-68261: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164).\n- CVE-2025-68264: ext4: refresh inline data size before write operations (bsc#1255380).\n- CVE-2025-68283: libceph: replace BUG_ON with bounds check for map-\u003emax_osd (bsc#1255379).\n- CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255377).\n- CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401).\n- CVE-2025-68295: smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129).\n- CVE-2025-68296: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128).\n- CVE-2025-68297: ceph: fix crash in process_v2_sparse_read() for encrypted directories (bsc#1255403).\n- CVE-2025-68301: net: atlantic: fix fragment overflow handling in RX path (bsc#1255120).\n- CVE-2025-68320: lan966x: Fix sleeping in atomic context (bsc#1255172).\n- CVE-2025-68325: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (bsc#1255417).\n- CVE-2025-68327: usb: renesas_usbhs: Fix synchronous external abort on unbind (bsc#1255488).\n- CVE-2025-68337: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (bsc#1255482).\n- CVE-2025-68340: team: Move team device type change at the end of team_port_add (bsc#1255507).\n- CVE-2025-68349: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (bsc#1255544).\n- CVE-2025-68363: bpf: Check skb-\u003etransport_header is set in bpf_skb_check_mtu (bsc#1255552).\n- CVE-2025-68365: fs/ntfs3: Initialize allocated memory before use (bsc#1255548).\n- CVE-2025-68366: nbd: defer config unlock in nbd_genl_connect (bsc#1255622).\n- CVE-2025-68367: macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (bsc#1255547).\n- CVE-2025-68372: nbd: defer config put in recv_work (bsc#1255537).\n- CVE-2025-68374: md: fix rcu protection in md_wakeup_thread (bsc#1255530).\n- CVE-2025-68378: bpf: Refactor stack map trace depth calculation into helper function (bsc#1255614).\n- CVE-2025-68379: RDMA/rxe: Fix null deref on srq-\u003erq.queue after resize failure (bsc#1255695).\n- CVE-2025-68727: ntfs3: Fix uninit buffer allocated by __getname() (bsc#1255568).\n- CVE-2025-68728: ntfs3: fix uninit memory after failed mi_read in mi_format_new (bsc#1255539).\n- CVE-2025-68733: smack: fix bug: unprivileged task can create labels (bsc#1255615).\n- CVE-2025-68736: landlock: Fix handling of disconnected directories (bsc#1255698).\n- CVE-2025-68742: bpf: Improve program stats run-time calculation (bsc#1255707).\n- CVE-2025-68744: bpf: Free special fields when update [lru_,]percpu_hash maps (bsc#1255709).\n- CVE-2025-68764: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (bsc#1255930).\n- CVE-2025-68768: inet: frags: add inet_frag_queue_flush() (bsc#1256579).\n- CVE-2025-68770: bnxt_en: Fix XDP_TX path (bsc#1256584).\n- CVE-2025-68771: ocfs2: fix kernel BUG in ocfs2_find_victim_chain (bsc#1256582).\n- CVE-2025-68775: net/handshake: duplicate handshake cancellations leak socket (bsc#1256665).\n- CVE-2025-68776: net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (bsc#1256659).\n- CVE-2025-68778: btrfs: don't log conflicting inode if it's a dir moved in the current transaction (bsc#1256683).\n- CVE-2025-68785: net: openvswitch: fix middle attribute validation in push_nsh() action (bsc#1256640).\n- CVE-2025-68788: fsnotify: do not generate ACCESS/MODIFY events on child for special files (bsc#1256638).\n- CVE-2025-68795: ethtool: Avoid overflowing userspace buffer on stats query (bsc#1256688).\n- CVE-2025-68798: perf/x86/amd: Check event before enable to avoid GPF (bsc#1256689).\n- CVE-2025-68800: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (bsc#1256646).\n- CVE-2025-68801: mlxsw: spectrum_router: Fix neighbour use-after-free (bsc#1256653).\n- CVE-2025-68803: nfsd: set security label during create operations (bsc#1256770).\n- CVE-2025-68810: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (bsc#1256679).\n- CVE-2025-68813: ipvs: fix ipv4 null-ptr-deref in route error path (bsc#1256641).\n- CVE-2025-68814: io_uring: fix filename leak in __io_openat_prep() (bsc#1256651).\n- CVE-2025-68815: net/sched: ets: Remove drr class from the active list if it changes to strict (bsc#1256680).\n- CVE-2025-68816: net/mlx5: fw_tracer, Validate format string parameters (bsc#1256674).\n- CVE-2025-68820: ext4: xattr: fix null pointer deref in ext4_raw_inode() (bsc#1256754).\n- CVE-2025-71064: net: hns3: using the num_tqps in the vf driver to apply for resources (bsc#1256654).\n- CVE-2025-71066: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (bsc#1256645).\n- CVE-2025-71071: iommu/mediatek: fix use-after-free on probe deferral (bsc#1256802).\n- CVE-2025-71077: tpm: Cap the number of PCR banks (bsc#1256613).\n- CVE-2025-71084: RDMA/cm: Fix leaking the multicast GID table reference (bsc#1256622).\n- CVE-2025-71085: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (bsc#1256623).\n- CVE-2025-71087: iavf: fix off-by-one issues in iavf_config_rss_reg() (bsc#1256628).\n- CVE-2025-71088: mptcp: fallback earlier on simult connection (bsc#1256630).\n- CVE-2025-71089: iommu: disable SVA when CONFIG_X86 is set (bsc#1256612).\n- CVE-2025-71091: team: fix check for port enabled in team_queue_override_port_prio_changed() (bsc#1256773).\n- CVE-2025-71093: e1000: fix OOB in e1000_tbi_should_accept() (bsc#1256777).\n- CVE-2025-71094: net: usb: asix: ax88772: Increase phy_name size (bsc#1256597).\n- CVE-2025-71095: net: stmmac: fix the crash issue for zero copy XDP_TX action (bsc#1256605).\n- CVE-2025-71096: RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (bsc#1256606).\n- CVE-2025-71097: ipv4: Fix reference count leak when using error routes with nexthop objects (bsc#1256607).\n- CVE-2025-71104: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (bsc#1256708).\n- CVE-2025-71112: net: hns3: add VLAN id validation before using (bsc#1256726).\n- CVE-2025-71113: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (bsc#1256716).\n- CVE-2025-71116: libceph: make decode_pool() more resilient against corrupted osdmaps (bsc#1256744).\n- CVE-2025-71120: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (bsc#1256779).\n- CVE-2025-71123: ext4: fix string copying in parse_apply_sb_mount_options() (bsc#1256757).\n- CVE-2025-71126: mptcp: reset fallback status gracefully at disconnect() time (bsc#1256755).\n- CVE-2025-71133: RDMA/irdma: avoid invalid read in irdma_net_event (bsc#1256733).\n- CVE-2025-71135: md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt() (bsc#1256761).\n- CVE-2025-71137: octeontx2-pf: fix \"UBSAN: shift-out-of-bounds error\" (bsc#1256760).\n- CVE-2025-71148: net/handshake: restore destructor on submit failure (bsc#1257159).\n- CVE-2025-71149: io_uring/poll: correctly handle io_poll_add() return value on update (bsc#1257164).\n- CVE-2025-71184: btrfs: fix NULL dereference on root when tracing inode eviction (bsc#1257635).\n- CVE-2025-71194: btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (bsc#1257687).\n- CVE-2025-71225: md: suspend array while updating raid_disks via sysfs (bsc#1258411).\n- CVE-2026-22976: net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (bsc#1257035).\n- CVE-2026-22977: net: sock: fix hardened usercopy panic in sock_recv_errqueue (bsc#1257053).\n- CVE-2026-22979: net: fix memory leak in skb_segment_list for GRO packets (bsc#1257228).\n- CVE-2026-22982: net: mscc: ocelot: Fix crash when adding interface under a lag (bsc#1257179).\n- CVE-2026-22984: libceph: prevent potential out-of-bounds reads in handle_auth_done() (bsc#1257217).\n- CVE-2026-22990: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (bsc#1257221).\n- CVE-2026-22991: libceph: make free_choose_arg_map() resilient to partial allocation (bsc#1257220).\n- CVE-2026-22992: libceph: return the handler error from mon_handle_auth_done() (bsc#1257218).\n- CVE-2026-22996: net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv.\n- CVE-2026-22998: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (bsc#1257209).\n- CVE-2026-22999: net/sched: sch_qfq: do not free existing class in qfq_change_class() (bsc#1257236).\n- CVE-2026-23000: net/mlx5e: Fix crash on profile change rollback failure (bsc#1257234).\n- CVE-2026-23001: macvlan: Use 'hash' iterators to simplify code (bsc#1257232).\n- CVE-2026-23003: geneve: Fix incorrect inner network header offset when innerprotoinherit is set (bsc#1257246).\n- CVE-2026-23004: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231).\n- CVE-2026-23005: x86/fpu: Clear XSTATE_BV in guest XSAVE state whenever XFD[i]=1 (bsc#1257245).\n- CVE-2026-23010: ipv6: Fix use-after-free in inet6_addr_del() (bsc#1257332).\n- CVE-2026-23011: ipv4: ip_gre: make ipgre_header() robust (bsc#1257207).\n- CVE-2026-23017: idpf: fix error handling in the init_task on load (bsc#1257552).\n- CVE-2026-23035: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (bsc#1257559).\n- CVE-2026-23053: NFS: Fix a deadlock involving nfs_release_folio() (bsc#1257718).\n- CVE-2026-23057: vsock/virtio: Coalesce only linear skb (bsc#1257740).\n- CVE-2026-23060: crypto: authencesn - reject too-short AAD (assoclen\u003c8) to match ESP/ESN spec (bsc#1257735).\n- CVE-2026-23064: net/sched: act_ife: avoid possible NULL deref (bsc#1257765).\n- CVE-2026-23074: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749).\n- CVE-2026-23083: fou: Don't allow 0 for FOU_ATTR_IPPROTO (bsc#1257745).\n- CVE-2026-23084: be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (bsc#1257830).\n- CVE-2026-23085: irqchip/gic-v3-its: Avoid truncating memory addresses (bsc#1257758).\n- CVE-2026-23086: vsock/virtio: cap TX credit to local buffer size (bsc#1257757).\n- CVE-2026-23089: ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (bsc#1257790).\n- CVE-2026-23095: gue: Fix skb memleak with inner IP protocol 0 (bsc#1257808).\n- CVE-2026-23099: bonding: limit BOND_MODE_8023AD to Ethernet devices (bsc#1257816).\n- CVE-2026-23102: arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state (bsc#1257772).\n- CVE-2026-23104: ice: fix devlink reload call trace (bsc#1257763).\n- CVE-2026-23105: net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (bsc#1257775).\n- CVE-2026-23107: arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (bsc#1257762).\n- CVE-2026-23110: scsi: core: Wake up the error handler when final completions race against each other (bsc#1257761).\n- CVE-2026-23111: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (bsc#1258181).\n- CVE-2026-23112: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1258184).\n- CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).\n- CVE-2026-23116: pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (bsc#1258277).\n- CVE-2026-23119: bonding: provide a net pointer to __skb_flow_dissect() (bsc#1258273).\n- CVE-2026-23139: netfilter: nf_conncount: update last_gc only when GC has been performed (bsc#1258304).\n- CVE-2026-23141: btrfs: send: check for inline extents in range_is_hole_in_parent() (bsc#1258377).\n- CVE-2026-23166: ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (bsc#1258272).\n- CVE-2026-23171: net: bonding: update the slave array for broadcast mode (bsc#1258349).\n- CVE-2026-23173: net/mlx5e: TC, delete flows only for existing peers (bsc#1258520).\n- CVE-2026-23179: nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (bsc#1258394).\n- CVE-2026-23191: ALSA: aloop: Fix racy access at PCM trigger (bsc#1258395).\n- CVE-2026-23198: KVM: Don't clobber irqfd routing type when deassigning irqfd (bsc#1258321).\n- CVE-2026-23208: ALSA: usb-audio: Prevent excessive number of frames (bsc#1258468).\n- CVE-2026-23209: macvlan: fix error recovery in macvlan_common_newlink() (bsc#1258518).\n- CVE-2026-23213: drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (bsc#1258465).\n- CVE-2026-23214: btrfs: reject new transactions if the fs is fully read-only (bsc#1258464).\n\nThe following non-security bugs were fixed:\n\n- ACPI: CPPC: Fix missing PCC check for guaranteed_perf (git-fixes).\n- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (git-fixes).\n- ACPI: PCC: Fix race condition by removing static qualifier (git-fixes).\n- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (git-fixes).\n- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (stable-fixes).\n- ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 (git-fixes).\n- ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() (git-fixes).\n- ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only (stable-fixes).\n- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (stable-fixes).\n- ACPICA: Avoid walking the Namespace if start_node is NULL (stable-fixes).\n- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (git-fixes).\n- ALSA: ac97: fix a double free in snd_ac97_controller_register() (git-fixes).\n- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (stable-fixes).\n- ALSA: dice: fix buffer overflow in detect_stream_formats() (git-fixes).\n- ALSA: firewire-motu: add bounds check in put_user loop for DSP events (git-fixes).\n- ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (git-fixes).\n- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (stable-fixes).\n- ALSA: hda/realtek - fixed speaker no sound (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (stable-fixes).\n- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (stable-fixes).\n- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU (git-fixes).\n- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (stable-fixes).\n- ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP machine (stable-fixes).\n- ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() (git-fixes).\n- ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path (git-fixes).\n- ALSA: scarlett2: Fix buffer overflow in config retrieval (git-fixes).\n- ALSA: uapi: Fix typo in asound.h comment (git-fixes).\n- ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 (stable-fixes).\n- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (stable-fixes).\n- ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series (stable-fixes).\n- ALSA: usb-audio: Add sanity check for OOB writes at silencing (stable-fixes).\n- ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 (stable-fixes).\n- ALSA: usb-audio: Cap the packet size pre-calculations (git-fixes).\n- ALSA: usb-audio: Check max frame size for implicit feedback mode, too (stable-fixes).\n- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (git-fixes).\n- ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices (git-fixes).\n- ALSA: usb-audio: Update for native DSD support quirks (stable-fixes).\n- ALSA: usb-audio: Update the number of packets properly at receiving (stable-fixes).\n- ALSA: usb-audio: Use correct version for UAC3 header validation (git-fixes).\n- ALSA: usb-audio: Use inclusive terms (git-fixes).\n- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (git-fixes).\n- ALSA: usb-mixer: us16x08: validate meter packet indices (git-fixes).\n- ALSA: usb: Increase volume range that triggers a warning (git-fixes).\n- ALSA: vxpocket: Fix resource leak in vxpocket_probe error path (git-fixes).\n- APEI/GHES: ensure that won't go past CPER allocated record (stable-fixes).\n- ASoC: Intel: catpt: Fix error path in hw_params() (git-fixes).\n- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (stable-fixes).\n- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (git-fixes).\n- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (git-fixes).\n- ASoC: SOF: ipc4-control: Keep the payload size up to date (git-fixes).\n- ASoC: SOF: ipc4-control: Use the correct size for scontrol-\u003eipc_control_data (git-fixes).\n- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (git-fixes).\n- ASoC: ak4458: Disable regulator when error happens (git-fixes).\n- ASoC: ak5558: Disable regulator when error happens (git-fixes).\n- ASoC: amd: drop unused Kconfig symbols (git-fixes).\n- ASoC: amd: fix memory leak in acp3x pdm dma ops (git-fixes).\n- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (stable-fixes).\n- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (stable-fixes).\n- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (stable-fixes).\n- ASoC: amd: yc: Fix microphone on ASUS M6500RE (stable-fixes).\n- ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() (git-fixes).\n- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (stable-fixes).\n- ASoC: codecs: wcd938x: fix OF node leaks on probe failure (git-fixes).\n- ASoC: codecs: wsa881x: Drop unused version readout (stable-fixes).\n- ASoC: codecs: wsa881x: fix unnecessary initialisation (git-fixes).\n- ASoC: codecs: wsa883x: fix unnecessary initialisation (git-fixes).\n- ASoC: codecs: wsa884x: fix codec initialisation (git-fixes).\n- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (stable-fixes).\n- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (stable-fixes).\n- ASoC: fsl: imx-card: Do not force slot width to sample width (git-fixes).\n- ASoC: fsl_sai: Add missing registers to cache default (stable-fixes).\n- ASoC: fsl_xcvr: clear the channel status control memory (git-fixes).\n- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (stable-fixes).\n- ASoC: nau8821: Cancel delayed work on component remove (git-fixes).\n- ASoC: nau8821: Cancel pending work before suspend (git-fixes).\n- ASoC: nau8821: Consistently clear interrupts before unmasking (git-fixes).\n- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (git-fixes).\n- ASoC: pxa: drop unused Kconfig symbol (git-fixes).\n- ASoC: qcom: q6adm: the the copp device only during last instance (git-fixes).\n- ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr (git-fixes).\n- ASoC: qcom: q6asm-dai: perform correct state check before closing (git-fixes).\n- ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment (git-fixes).\n- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (git-fixes).\n- ASoC: stm32: sai: fix OF node leak on probe (git-fixes).\n- ASoC: stm32: sai: fix clk prepare imbalance on probe failure (git-fixes).\n- ASoC: stm32: sai: fix device leak on probe (git-fixes).\n- ASoC: sun4i-spdif: Add missing kerneldoc fields for sun4i_spdif_quirks (git-fixes).\n- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (stable-fixes).\n- ASoC: tlv320adcx140: Propagate error codes during probe (stable-fixes).\n- ASoC: tlv320adcx140: fix null pointer (git-fixes).\n- ASoC: tlv320adcx140: fix word length (git-fixes).\n- ASoC: wm8962: Add WM8962_ADC_MONOMIX to \"3D Coefficients\" mask (stable-fixes).\n- ASoC: wm8962: Do not report a microphone if it's shorted to ground on plug (stable-fixes).\n- Add dtb-spacemit SpacemiT boards include MilkV-Jupiter, Banana Pi F3 and Orange Pi RV2.\n- Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 (git-fixes).\n- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (git-fixes).\n- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (git-fixes).\n- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (git-fixes).\n- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (git-fixes).\n- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (git-fixes).\n- Bluetooth: SMP: Fix not generating mackey and ltk when repairing (git-fixes).\n- Bluetooth: btrtl: Avoid loading the config file on security chips (stable-fixes).\n- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (stable-fixes).\n- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (stable-fixes).\n- Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE (stable-fixes).\n- Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV (stable-fixes).\n- Bluetooth: btusb: Add new VID/PID for RTL8852CE (stable-fixes).\n- Bluetooth: btusb: revert use of devm_kzalloc in btusb (git-fixes).\n- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (stable-fixes).\n- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (stable-fixes).\n- Bluetooth: hci_qca: Cleanup on all setup failures (git-fixes).\n- Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (git-fixes).\n- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (git-fixes).\n- Documentation/kernel-parameters: fix typo in retbleed= kernel parameter description (git-fixes).\n- Documentation: PCI: endpoint: Fix ntb/vntb copy \u0026 paste errors (git-fixes).\n- Documentation: hid-alps: Fix packet format section headings (git-fixes).\n- Documentation: mailbox: mbox_chan_ops.flush() is optional (git-fixes).\n- Documentation: parport-lowlevel: Separate function listing code blocks (git-fixes).\n- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (stable-fixes).\n- HID: apple: Add \"SONiX KN85 Keyboard\" to the list of non-apple keyboards (stable-fixes).\n- HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list (stable-fixes).\n- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (stable-fixes).\n- HID: elecom: Add support for ELECOM M-XT3URBK (018F) (stable-fixes).\n- HID: hid-input: Extend Elan ignore battery quirk to USB (stable-fixes).\n- HID: hid-pl: handle probe errors (git-fixes).\n- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (stable-fixes).\n- HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen (stable-fixes).\n- HID: intel-ish-hid: Reset enum_devices_done before enumeration (stable-fixes).\n- HID: intel-ish-hid: Update ishtp bus match to support device ID table (stable-fixes).\n- HID: logitech-dj: Remove duplicate error logging (git-fixes).\n- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (stable-fixes).\n- HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync() (git-fixes).\n- HID: magicmouse: Do not crash on missing msc-\u003einput (stable-fixes).\n- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (stable-fixes).\n- HID: multitouch: add eGalaxTouch EXC3188 support (stable-fixes).\n- HID: playstation: Add missing check for input_ff_create_memless (git-fixes).\n- HID: playstation: Center initial joystick axes to prevent spurious events (stable-fixes).\n- HID: prodikeys: Check presence of pm-\u003einput_ep82 (stable-fixes).\n- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (stable-fixes).\n- HID: quirks: work around VID/PID conflict for appledisplay (git-fixes).\n- HID: usbhid: paper over wrong bNumDescriptor field (stable-fixes).\n- Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard (git-fixes).\n- Input: cros_ec_keyb - fix an invalid memory access (stable-fixes).\n- Input: goodix - add support for ACPI ID GDIX1003 (stable-fixes).\n- Input: goodix - add support for ACPI ID GDX9110 (stable-fixes).\n- Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table (stable-fixes).\n- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (stable-fixes).\n- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (stable-fixes).\n- Input: stmfts - correct wording for the warning message (git-fixes).\n- Input: stmfts - make comments correct (git-fixes).\n- Input: ti_am335x_tsc - fix off-by-one error in wire_order validation (git-fixes).\n- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (git-fixes).\n- KEYS: trusted_tpm1: Compare HMAC values in constant time (git-fixes).\n- Move upstreamed SCSI patches into sorted section\n- Move upstreamed ath12k patch into sorted section\n- Move upstreamed mm and SCSI patches into sorted section\n- NTB: ntb_transport: Fix too small buffer for debugfs_name (git-fixes).\n- PCI/ACPI: Restrict program_hpx_type2() to AER bits (git-fixes).\n- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (git-fixes).\n- PCI/MSI: Unmap MSI-X region on error (stable-fixes).\n- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (git-fixes).\n- PCI/PM: Avoid redundant delays on D3hot-\u003eD3cold (git-fixes).\n- PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths (git-fixes).\n- PCI/portdrv: Fix potential resource leak (git-fixes).\n- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (git-fixes).\n- PCI: Add ACS quirk for Qualcomm Hamoa \u0026 Glymur (stable-fixes).\n- PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros (stable-fixes).\n- PCI: Add defines for bridge window indexing (stable-fixes).\n- PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value (git-fixes).\n- PCI: Do not attempt to set ExtTag for VFs (git-fixes).\n- PCI: Enable ACS after configuring IOMMU for OF platforms (stable-fixes).\n- PCI: Fix pci_slot_lock () device locking (stable-fixes).\n- PCI: Fix pci_slot_trylock() error handling (git-fixes).\n- PCI: Initialize RCB from pci_configure_device() (git-fixes).\n- PCI: Log bridge info when first enumerating bridge (stable-fixes).\n- PCI: Log bridge windows conditionally (stable-fixes).\n- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (git-fixes).\n- PCI: Mark ASM1164 SATA controller to avoid bus reset (stable-fixes).\n- PCI: Mark Nvidia GB10 to avoid bus reset (stable-fixes).\n- PCI: Move pci_read_bridge_windows() below individual window accessors (stable-fixes).\n- PCI: Supply bridge device, not secondary bus, to read window details (stable-fixes).\n- PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port (stable-fixes).\n- PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition (git-fixes).\n- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (git-fixes).\n- PCI: keystone: Exit ks_pcie_probe() for invalid mode (git-fixes).\n- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (git-fixes).\n- PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2 (git-fixes).\n- PM: runtime: Do not clear needs_force_resume with enabled runtime PM (git-fixes).\n- PM: sleep: wakeirq: Update outdated documentation comments (git-fixes).\n- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (git-fixes).\n- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (git-fixes).\n- USB: Fix descriptor count when handling invalid MBIM extended descriptor (git-fixes).\n- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (stable-fixes).\n- USB: lpc32xx_udc: Fix error handling in probe (git-fixes).\n- USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC (git-fixes).\n- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (stable-fixes).\n- USB: serial: ftdi_sio: add support for u-blox EVK-M101 (stable-fixes).\n- USB: serial: ftdi_sio: match on interface number for jtag (stable-fixes).\n- USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC (git-fixes).\n- USB: serial: option: add Foxconn T99W760 (stable-fixes).\n- USB: serial: option: add Quectel RG255C (stable-fixes).\n- USB: serial: option: add Telit Cinterion FE910C04 new compositions (stable-fixes).\n- USB: serial: option: add Telit FN920C04 ECM compositions (stable-fixes).\n- USB: serial: option: add Telit FN920C04 RNDIS compositions (stable-fixes).\n- USB: serial: option: add Telit LE910 MBIM composition (stable-fixes).\n- USB: serial: option: add UNISOC UIS7720 (stable-fixes).\n- USB: serial: option: add support for Rolling RW101R-GL (stable-fixes).\n- USB: serial: option: move Telit 0x10c7 composition in the right place (stable-fixes).\n- USB: storage: Remove subclass and protocol overrides from Novatek quirk (git-fixes).\n- Update config files: disable CONFIG_DEVPORT for arm64 (bsc#1256792)\n- Workaround for hybrid git workflow in SLFO 1.0/1.1\n- arm64: zynqmp: Fix usb node drive strength and slew rate (git-fixes)\n- arm64: zynqmp: Revert usb node drive strength and slew rate for (git-fixes)\n- ata: libata: Add cpr_log to ata_dev_print_features() early return (git-fixes).\n- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (stable-fixes).\n- ata: pata_ftide010: Fix some DMA timings (git-fixes).\n- atm/fore200e: Fix possible data race in fore200e_open() (git-fixes).\n- atm: Fix dma_free_coherent() size (git-fixes).\n- atm: fore200e: fix use-after-free in tasklets during device removal (git-fixes).\n- atm: idt77252: Add missing `dma_map_error()` (stable-fixes).\n- auxdisplay: arm-charlcd: fix release_mem_region() size (git-fixes).\n- backlight: led-bl: Add devlink to supplier LEDs (git-fixes).\n- backlight: lp855x: Fix lp855x.h kernel-doc warnings (git-fixes).\n- backlight: qcom-wled: Change PM8950 WLED configurations (git-fixes).\n- backlight: qcom-wled: Support ovp values for PMI8994 (git-fixes).\n- bonding: only set speed/duplex to unknown, if getting speed failed (bsc#1253691).\n- bpf/selftests: test_select_reuseport_kern: Remove unused header (bsc#1257603).\n- bpf: Do not let BPF test infra emit invalid GSO types to stack (bsc#1255569).\n- bpf: Reject bpf_timer for PREEMPT_RT (git-fixes).\n- broadcom: b44: prevent uninitialized value usage (git-fixes).\n- bs-upload-kernel: Fix cve branch uploads\n- btrfs: do not strictly require dirty metadata threshold for metadata writepages (stable-fixes).\n- btrfs: make sure extent and csum paths are always released in scrub_raid56_parity_stripe() (git-fixes).\n- btrfs: scrub: always update btrfs_scrub_progress::last_physical (git-fixes).\n- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (stable-fixes).\n- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (git-fixes).\n- bus: fsl-mc: fix use-after-free in driver_override_show() (git-fixes).\n- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit (git-fixes).\n- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (git-fixes).\n- can: etas_es58x: allow partial RX URB allocation to succeed (git-fixes).\n- can: gs_usb: gs_can_open(): fix error handling (git-fixes).\n- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (git-fixes).\n- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (git-fixes).\n- can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs (git-fixes).\n- can: j1939: make j1939_session_activate() fail if device is no longer registered (stable-fixes).\n- can: j1939: make j1939_sk_bind() fail if device is no longer registered (git-fixes).\n- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (git-fixes).\n- can: kvaser_usb: leaf: Fix potential infinite loop in command parsers (git-fixes).\n- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (git-fixes).\n- can: sja1000: fix max irq loop handling (git-fixes).\n- can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling (git-fixes).\n- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (git-fixes).\n- char: applicom: fix NULL pointer dereference in ac_ioctl (stable-fixes).\n- char: tpm: cr50: Remove IRQF_ONESHOT (stable-fixes).\n- cifs: Fix copy offload to flush destination region (bsc#1252511).\n- cifs: Fix flushing, invalidation and file size with copy_file_range() (bsc#1252511).\n- cifs: Fix uncached read into ITER_KVEC iterator (bsc#1245449).\n- cifs: add new field to track the last access time of cfid (git-fixes).\n- cifs: add xid to query server interface call (git-fixes).\n- cifs: after disabling multichannel, mark tcon for reconnect (git-fixes).\n- cifs: avoid redundant calls to disable multichannel (git-fixes).\n- cifs: cifs_pick_channel should try selecting active channels (git-fixes).\n- cifs: deal with the channel loading lag while picking channels (git-fixes).\n- cifs: dns resolution is needed only for primary channel (git-fixes).\n- cifs: do not disable interface polling on failure (git-fixes).\n- cifs: do not search for channel if server is terminating (git-fixes).\n- cifs: fix a pending undercount of srv_count (git-fixes).\n- cifs: fix lock ordering while disabling multichannel (git-fixes).\n- cifs: fix stray unlock in cifs_chan_skip_or_disable (git-fixes).\n- cifs: fix use after free for iface while disabling secondary channels (git-fixes).\n- cifs: handle servers that still advertise multichannel after disabling (git-fixes).\n- cifs: handle when server starts supporting multichannel (git-fixes).\n- cifs: handle when server stops supporting multichannel (git-fixes).\n- cifs: make cifs_chan_update_iface() a void function (git-fixes).\n- cifs: make sure server interfaces are requested only for SMB3+ (git-fixes).\n- cifs: make sure that channel scaling is done only once (git-fixes).\n- cifs: reconnect worker should take reference on server struct unconditionally (git-fixes).\n- cifs: reset connections for all channels when reconnect requested (git-fixes).\n- cifs: reset iface weights when we cannot find a candidate (git-fixes).\n- cifs: serialize other channels when query server interfaces is pending (git-fixes).\n- cifs: update dstaddr whenever channel iface is updated (git-fixes).\n- clk: clk-apple-nco: Add \"apple,t8103-nco\" compatible (git-fixes).\n- clk: mediatek: Fix error handling in runtime PM setup (git-fixes).\n- clk: meson: g12a: Limit the HDMI PLL OD to /4 (git-fixes).\n- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (git-fixes).\n- clk: qcom: camcc-sm6350: Fix PLL config of PLL2 (git-fixes).\n- clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to other (git-fixes).\n- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (git-fixes).\n- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (git-fixes).\n- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (git-fixes).\n- clk: qcom: gfx3d: add parent to parent request map (git-fixes).\n- clk: qcom: rcg2: compute 2d using duty fraction directly (git-fixes).\n- clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback (git-fixes).\n- clk: renesas: r9a06g032: Fix memory leak in error path (git-fixes).\n- clk: renesas: rzg2l: Fix intin variable size (git-fixes).\n- clk: renesas: rzg2l: Select correct div round macro (git-fixes).\n- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (git-fixes).\n- clk: tegra: tegra124-emc: fix device leak on set_rate() (git-fixes).\n- clocksource: Print durations for sync check unconditionally (bsc#1241345).\n- clocksource: Reduce watchdog readout delay limit to prevent false positives (bsc#1241345).\n- comedi: Fix getting range information for subdevices 16 to 255 (git-fixes).\n- comedi: c6xdigio: Fix invalid PNP driver unregistration (git-fixes).\n- comedi: check device's attached status in compat ioctls (git-fixes).\n- comedi: dmm32at: serialize use of paged registers (git-fixes).\n- comedi: fix divide-by-zero in comedi_buf_munge() (stable-fixes).\n- comedi: multiq3: sanitize config options in multiq3_attach() (git-fixes).\n- comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel() (git-fixes).\n- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (git-fixes).\n- cpuidle: menu: Use residency threshold in polling state override decisions (bsc#1255026).\n- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (git-fixes).\n- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (git-fixes).\n- crypto: authencesn - reject too-short AAD (assoclen\u0026lt;8) to match ESP/ESN spec (git-fixes).\n- crypto: cavium - fix dma_free_coherent() size (git-fixes).\n- crypto: ccp - Add an S4 restore flow (git-fixes).\n- crypto: ccree - Correctly handle return of sg_nents_for_len (git-fixes).\n- crypto: hisilicon/qm - restore original qos values (git-fixes).\n- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (git-fixes).\n- crypto: iaa - Fix incorrect return value in save_iaa_wq() (git-fixes).\n- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (git-fixes).\n- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (git-fixes).\n- crypto: octeontx - fix dma_free_coherent() size (git-fixes).\n- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (git-fixes).\n- crypto: qat - fix duplicate restarting msg during AER error (git-fixes).\n- crypto: qat - fix parameter order used in ICP_QAT_FW_COMN_FLAGS_BUILD (git-fixes).\n- crypto: qat - fix warning on adf_pfvf_pf_proto.c (git-fixes).\n- crypto: rockchip - drop redundant crypto_skcipher_ivsize() calls (git-fixes).\n- crypto: seqiv - Do not use req-\u003eiv after crypto_aead_encrypt (git-fixes).\n- crypto: virtio - Add spinlock protection with virtqueue notification (git-fixes).\n- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (git-fixes).\n- device property: Allow secondary lookup in fwnode_get_next_child_node() (git-fixes).\n- dm-integrity: limit MAX_TAG_SIZE to 255 (git-fixes).\n- dm-verity: fix unreliable memory allocation (git-fixes).\n- dm: fix queue start/stop imbalance under suspend/load/resume races (bsc#1253386)\n- dma: dma-axi-dmac: fix SW cyclic transfers (git-fixes).\n- dmaengine: apple-admac: Add \"apple,t8103-admac\" compatible (git-fixes).\n- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (git-fixes).\n- dmaengine: bcm-sba-raid: fix device leak on probe (git-fixes).\n- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (git-fixes).\n- dmaengine: idxd: fix device leaks on compat bind and unbind (git-fixes).\n- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (git-fixes).\n- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (git-fixes).\n- dmaengine: omap-dma: fix dma_pool resource leak in error paths (git-fixes).\n- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (git-fixes).\n- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (git-fixes).\n- dmaengine: sun6i: Choose appropriate burst length under maxburst (stable-fixes).\n- dmaengine: tegra-adma: Fix use-after-free (git-fixes).\n- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (git-fixes).\n- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (git-fixes).\n- dmaengine: ti: k3-udma: fix device leak on udma lookup (git-fixes).\n- dmaengine: xilinx: xdma: Fix regmap max_register (git-fixes).\n- dmaengine: xilinx_dma: Fix uninitialized addr_width when \"xlnx,addrwidth\" property is missing (git-fixes).\n- docs: ABI: sysfs-devices-soc: Fix swapped sample values (git-fixes).\n- docs: fix WARNING document not included in any toctree (stable-fixes).\n- docs: w1: fix w1-netlink invalid URL (git-fixes).\n- dpll: Prevent duplicate registrations (git-fixes).\n- dpll: fix device-id-get and pin-id-get to return errors properly (git-fixes).\n- dpll: fix return value check for kmemdup (git-fixes).\n- dpll: indent DPLL option type by a tab (git-fixes).\n- dpll: spec: add missing module-name and clock-id to pin-get reply (git-fixes).\n- drivers/usb/dwc3: fix PCI parent check (git-fixes).\n- drivers: iio: mpu3050: use dev_err_probe for regulator request (git-fixes).\n- drm/amd/display: Avoid updating surface with the same surface under MPO (stable-fixes).\n- drm/amd/display: Bump the HDMI clock to 340MHz (stable-fixes).\n- drm/amd/display: Check NULL before accessing (stable-fixes).\n- drm/amd/display: Fix DP no audio issue (stable-fixes).\n- drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() (git-fixes).\n- drm/amd/display: Increase DPCD read retries (stable-fixes).\n- drm/amd/display: Move sleep into each retry for retrieve_link_cap() (stable-fixes).\n- drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() (stable-fixes).\n- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (git-fixes).\n- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (git-fixes).\n- drm/amd/pm: Do not clear SI SMC table when setting power limit (git-fixes).\n- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (git-fixes).\n- drm/amd/pm: fix race in power state check before mutex lock (git-fixes).\n- drm/amd: Clean up kfd node on surprise disconnect (stable-fixes).\n- drm/amd: Fix hang on amdgpu unload by using pci_dev_is_disconnected() (git-fixes).\n- drm/amdgpu/gfx10: fix wptr reset in KGQ init (stable-fixes).\n- drm/amdgpu/gfx11: fix wptr reset in KGQ init (stable-fixes).\n- drm/amdgpu/soc21: fix xclk for APUs (stable-fixes).\n- drm/amdgpu: Add HAINAN clock adjustment (stable-fixes).\n- drm/amdgpu: Adjust usleep_range in fence wait (stable-fixes).\n- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (git-fixes).\n- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (git-fixes).\n- drm/amdgpu: Forward VMID reservation errors (git-fixes).\n- drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled (stable-fixes).\n- drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma (git-fixes).\n- drm/amdgpu: add support for HDP IP version 6.1.1 (stable-fixes).\n- drm/amdgpu: avoid a warning in timedout job handler (stable-fixes).\n- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (git-fixes).\n- drm/amdgpu: fix cyan_skillfish2 gpu info fw handling (git-fixes).\n- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (git-fixes).\n- drm/amdgpu: update mappings not managed by KFD (bsc#1255428)\n- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (stable-fixes).\n- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (stable-fixes).\n- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (git-fixes).\n- drm/amdkfd: fix a memory leak in device_queue_manager_init() (git-fixes).\n- drm/amdkfd: fix debug watchpoints for logical devices (stable-fixes).\n- drm/atmel-hlcdc: do not reject the commit if the src rect has fractional parts (stable-fixes).\n- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (stable-fixes).\n- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (stable-fixes).\n- drm/bridge: samsung-dsim: Fix memory leak in error path (git-fixes).\n- drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used (git-fixes).\n- drm/buddy: Prevent BUG_ON by validating rounded allocation (git-fixes).\n- drm/display/dp_mst: Add protection against 0 vcpi (stable-fixes).\n- drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() (git-fixes).\n- drm/i915/acpi: free _DSM package when no connectors (git-fixes).\n- drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer (git-fixes).\n- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (stable-fixes).\n- drm/imx/tve: fix probe device leak (git-fixes).\n- drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse() (git-fixes).\n- drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue (git-fixes).\n- drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse() (git-fixes).\n- drm/mgag200: Fix big-endian support (git-fixes).\n- drm/mgag200: fix mgag200_bmc_stop_scanout() (git-fixes).\n- drm/msm/a2xx: fix pixel shader start on A225 (git-fixes).\n- drm/msm/a2xx: stop over-complaining about the legacy firmware (git-fixes).\n- drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers (git-fixes).\n- drm/msm/a6xx: Flush LRZ cache before PT switch (git-fixes).\n- drm/msm/dpu: Add missing NULL pointer check for pingpong interface (git-fixes).\n- drm/msm/dpu: Remove dead-code in dpu_encoder_helper_reset_mixers() (git-fixes).\n- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (git-fixes).\n- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (git-fixes).\n- drm/nouveau/dispnv50: Do not call drm_atomic_get_crtc_state() in prepare_fb (git-fixes).\n- drm/nouveau: add missing DCB connector types (git-fixes).\n- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (git-fixes).\n- drm/nouveau: restrict the flush page to a 32-bit address (git-fixes).\n- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (git-fixes).\n- drm/panel: sony-td4353-jdi: Enable prepare_prev_first (git-fixes).\n- drm/pl111: Fix error handling in pl111_amba_probe (git-fixes).\n- drm/radeon: Add HAINAN clock adjustment (stable-fixes).\n- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (stable-fixes).\n- drm/radeon: delete radeon_fence_process in is_signaled, no deadlock (stable-fixes).\n- drm/tegra: dsi: fix device leak on probe (git-fixes).\n- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (stable-fixes).\n- drm/tilcdc: request and mapp iomem with devres (stable-fixes).\n- drm/ttm: Avoid NULL pointer deref for evicted BOs (git-fixes).\n- drm/v3d: Set DMA segment size to avoid debug warnings (stable-fixes).\n- drm/vgem-fence: Fix potential deadlock on release (git-fixes).\n- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (git-fixes).\n- drm/vmwgfx: Fix invalid kref_put callback in vmw_bo_dirty_release (git-fixes).\n- drm/vmwgfx: Return the correct value in vmw_translate_ptr functions (git-fixes).\n- drm/vmwgfx: Use kref in vmw_bo_dirty (stable-fixes).\n- drm: Account property blob allocations to memcg (stable-fixes).\n- drm: nouveau: Replace sprintf() with sysfs_emit() (git-fixes).\n- drm: sti: fix device leaks at component probe (git-fixes).\n- efi/libstub: Describe missing 'out' parameter in efi_load_initrd (git-fixes).\n- efi/libstub: Fix page table access in 5-level to 4-level paging transition (git-fixes).\n- efi: Fix reservation of unaccepted memory table (git-fixes).\n- efivarfs: fix error propagation in efivar_entry_get() (git-fixes).\n- exfat: add a check for invalid data size (git-fixes).\n- exfat: using hweight instead of internal logic (git-fixes).\n- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (git-fixes).\n- ext4: use optimized mballoc scanning regardless of inode format (bsc#1254378).\n- ext4: wait for ongoing I/O to complete before freeing blocks (bsc#1256366).\n- fbcon: check return value of con2fb_acquire_newinfo() (git-fixes).\n- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (git-fixes).\n- fbdev: ffb: fix corrupted video output on Sun FFB1 (stable-fixes).\n- fbdev: gbefb: fix to use physical address instead of dma address (stable-fixes).\n- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (git-fixes).\n- fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing (git-fixes).\n- fbdev: rivafb: fix divide error in nv3_arb() (git-fixes).\n- fbdev: smscufx: properly copy ioctl memory to kernelspace (stable-fixes).\n- fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() (git-fixes).\n- fbdev: tcx.c fix mem_map to correct smem_start offset (git-fixes).\n- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (git-fixes).\n- firewire: nosy: Fix dma_free_coherent() size (git-fixes).\n- firmware: imx: scu-irq: Init workqueue before request mbox channel (stable-fixes).\n- firmware: imx: scu-irq: fix OF node leak in (git-fixes).\n- firmware: stratix10-svc: Add mutex in stratix10 memory management (git-fixes).\n- firmware: stratix10-svc: fix bug in saving controller data (git-fixes).\n- firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc (git-fixes).\n- fix it87_wdt early reboot by reporting running timer (stable-fixes).\n- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (git-fixes).\n- fpga: of-fpga-region: Fail if any bridge is missing (stable-fixes).\n- fs: dlm: allow to F_SETLKW getting interrupted (bsc#1255025).\n- genalloc.h: fix htmldocs warning (git-fixes).\n- gpio: aspeed-sgpio: Change the macro to support deferred probe (stable-fixes).\n- gpio: omap: do not register driver in probe() (git-fixes).\n- gpio: pca953x: Add support for level-triggered interrupts (stable-fixes).\n- gpio: pca953x: Utilise dev_err_probe() where it makes sense (stable-fixes).\n- gpio: pca953x: Utilise temporary variable for struct device (stable-fixes).\n- gpio: pca953x: fix wrong error probe return value (git-fixes).\n- gpio: pca953x: handle short interrupt pulses on PCAL devices (git-fixes).\n- gpio: pca953x: mask interrupts in irq shutdown (stable-fixes).\n- gpio: rockchip: Stop calling pinctrl for set_direction (git-fixes).\n- gpio: rockchip: mark the GPIO controller as sleeping (git-fixes).\n- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (stable-fixes).\n- gpu: host1x: Fix race in syncpt alloc/free (git-fixes).\n- hwmon: (f71882fg) Add F81968 support (stable-fixes).\n- hwmon: (ibmpex) fix use-after-free in high/low store (git-fixes).\n- hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced race (git-fixes).\n- hwmon: (max16065) Use local variable to avoid TOCTOU (git-fixes).\n- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (stable-fixes).\n- hwmon: (occ) Mark occ_init_attribute() as __printf (git-fixes).\n- hwmon: (tmp401) fix overflow caused by default conversion rate value (git-fixes).\n- hwmon: (w83791d) Convert macros to functions to avoid TOCTOU (git-fixes).\n- hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU (git-fixes).\n- hwmon: sy7636a: Fix regulator_enable resource leak on error path (git-fixes).\n- i2c: amd-mp2: fix reference leak in MP2 PCI device (git-fixes).\n- i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured firmware (stable-fixes).\n- i2c: i2c.h: fix a bad kernel-doc line (git-fixes).\n- i3c: Move device name assignment after i3c_bus_init (git-fixes).\n- i3c: dw: Initialize spinlock to avoid upsetting lockdep (git-fixes).\n- i3c: fix refcount inconsistency in i3c_master_register (git-fixes).\n- i3c: master: Inherit DMA masks and parameters from parent device (stable-fixes).\n- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (stable-fixes).\n- i3c: master: svc: Prevent incomplete IBI transaction (git-fixes).\n- ice: use netif_get_num_default_rss_queues() (bsc#1247712).\n- idr: fix idr_alloc() returning an ID out of range (git-fixes).\n- iio: Use IRQF_NO_THREAD (stable-fixes).\n- iio: accel: bmc150: Fix irq assumption regression (stable-fixes).\n- iio: accel: fix ADXL355 startup race condition (git-fixes).\n- iio: accel: iis328dq: fix gain values (git-fixes).\n- iio: adc: ad7280a: fix ad7280_store_balance_timer() (git-fixes).\n- iio: adc: ad7280a: handle spi_setup() errors in probe() (git-fixes).\n- iio: adc: ad9467: fix ad9434 vref mask (git-fixes).\n- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (git-fixes).\n- iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains (stable-fixes).\n- iio: core: Clean up device correctly on iio_device_alloc() failure (git-fixes).\n- iio: core: add missing mutex_destroy in iio_dev_release() (git-fixes).\n- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (git-fixes).\n- iio: gyro: itg3200: Fix unchecked return value in read_raw (git-fixes).\n- iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member (git-fixes).\n- iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields (git-fixes).\n- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (git-fixes).\n- iio: magnetometer: Remove IRQF_ONESHOT (stable-fixes).\n- iio: sca3000: Fix a resource leak in sca3000_probe() (git-fixes).\n- iio: st_lsm6dsx: Fixed calibrated timestamp calculation (git-fixes).\n- iio:common:ssp_sensors: Fix an error handling path ssp_probe() (git-fixes).\n- ima: Handle error code returned by ima_filter_rule_match() (git-fixes).\n- intel_th: Fix error handling in intel_th_output_open (git-fixes).\n- intel_th: fix device leak on output open() (git-fixes).\n- iomap: account for unaligned end offsets when truncating read range (git-fixes).\n- ipmi: Fix __scan_channels() failing to rescan channels (stable-fixes).\n- ipmi: Fix handling of messages with provided receive message pointer (git-fixes).\n- ipmi: Fix the race between __scan_channels() and deliver_response() (stable-fixes).\n- ipmi: Rework user message limit handling (git-fixes).\n- ipmi: ipmb: initialise event handler read bytes (git-fixes).\n- irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() (git-fixes).\n- kABI workaround for HCI_LE_ADV_0 addition (git-fixes).\n- kconfig/mconf: Initialize the default locale at startup (stable-fixes).\n- kconfig/nconf: Initialize the default locale at startup (stable-fixes).\n- kernel-binary: Require libdw in Factory Libdw is required for gendwarfksyms\n- kernel-binary: Support building gendwarfksyms on SLE/Leap 15\n- landlock: Optimize file path walks and prepare for audit support (bsc#1255698).\n- leds: led-class: Only Add LED to leds_list when it is fully ready (git-fixes).\n- leds: leds-lp50xx: Allow LED 0 to be added to module bank (git-fixes).\n- leds: leds-lp50xx: Enable chip before any communication (git-fixes).\n- leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs (git-fixes).\n- leds: netxbig: Fix GPIO descriptor leak in error paths (git-fixes).\n- leds: qcom-lpg: Check the return value of regmap_bulk_write() (git-fixes).\n- lib/crypto: aes: Fix missing MMU protection for AES S-box (git-fixes).\n- lib/vsprintf: Check pointer before dereferencing in time_and_date() (git-fixes).\n- mISDN: annotate data-race around dev-\u003ework (git-fixes).\n- mailbox: mailbox-test: Fix debugfs_create_dir error checking (git-fixes).\n- media: TDA1997x: Remove redundant cancel_delayed_work in probe (git-fixes).\n- media: adv7180: fix frame interval in progressive mode (stable-fixes).\n- media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() (git-fixes).\n- media: amphion: Add a frame flush mode for decoder (stable-fixes).\n- media: amphion: Cancel message work before releasing the VPU core (git-fixes).\n- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (stable-fixes).\n- media: amphion: Make some vpu_v4l2 functions static (stable-fixes).\n- media: amphion: Remove vpu_vb_is_codecconfig (git-fixes).\n- media: atomisp: Prefix firmware paths with \"intel/ipu/\" (bsc#1252973).\n- media: atomisp: Remove firmware_name module parameter (bsc#1252973).\n- media: ccs: Accommodate C-PHY into the calculation (git-fixes).\n- media: ccs: Avoid possible division by zero (git-fixes).\n- media: cec: Fix debugfs leak on bus_register() failure (git-fixes).\n- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (git-fixes).\n- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (git-fixes).\n- media: cx25821: Fix a resource leak in cx25821_dev_setup() (stable-fixes).\n- media: cx88: Add missing unmap in snd_cx88_hw_params() (git-fixes).\n- media: dvb-core: dmxdevfilter must always flush bufs (stable-fixes).\n- media: dvb-core: fix wrong reinitialization of ringbuffer on reopen (git-fixes).\n- media: dvb-net: fix OOB access in ULE extension header tables (git-fixes).\n- media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() (git-fixes).\n- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (git-fixes).\n- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (git-fixes).\n- media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe (git-fixes).\n- media: i2c: adv7842: Remove redundant cancel_delayed_work in probe (git-fixes).\n- media: i2c: ov5647: Correct minimum VBLANK value (git-fixes).\n- media: i2c: ov5647: Correct pixel array offset (git-fixes).\n- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (git-fixes).\n- media: i2c: ov5647: Initialize subdev before controls (git-fixes).\n- media: i2c: ov5647: Sensor should report RAW color space (git-fixes).\n- media: i2c: ov5647: use our own mutex for the ctrl lock (git-fixes).\n- media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() (git-fixes).\n- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (git-fixes).\n- media: mtk-mdp: Fix error handling in probe function (git-fixes).\n- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (stable-fixes).\n- media: omap3isp: isppreview: always clamp in preview_try_format() (stable-fixes).\n- media: omap3isp: set initial format (stable-fixes).\n- media: pvrusb2: Fix incorrect variable used in trace message (git-fixes).\n- media: pvrusb2: fix URB leak in pvr2_send_request_ex (stable-fixes).\n- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (git-fixes).\n- media: radio-keene: fix memory leak in error path (git-fixes).\n- media: rc: st_rc: Fix reset control resource leak (git-fixes).\n- media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled (git-fixes).\n- media: rkisp1: Fix filter mode register configuration (stable-fixes).\n- media: samsung: exynos4-is: fix potential ABBA deadlock on init (git-fixes).\n- media: solo6x10: Check for out of bounds chip_id (stable-fixes).\n- media: uvcvideo: Fix allocation for small frame sizes (git-fixes).\n- media: v4l2-mem2mem: Fix outdated documentation (git-fixes).\n- media: venus: vdec: fix error state assignment for zero bytesused (git-fixes).\n- media: verisilicon: Fix CPU stalls on G2 bus error (git-fixes).\n- media: verisilicon: Protect G2 HEVC decoder against invalid DPB index (git-fixes).\n- media: verisilicon: Store chroma and motion vectors offset (stable-fixes).\n- media: verisilicon: g2: Use common helpers to compute chroma and mv offsets (stable-fixes).\n- media: videobuf2: Fix device reference leak in vb2_dc_alloc error path (git-fixes).\n- media: vidtv: initialize local pointers upon transfer of memory ownership (git-fixes).\n- media: vpif_capture: fix section mismatch (git-fixes).\n- media: vpif_display: fix section mismatch (git-fixes).\n- mei: me: add nova lake point S DID (stable-fixes).\n- mei: me: add wildcat lake P DID (stable-fixes).\n- mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup (git-fixes).\n- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (git-fixes).\n- mfd: core: Add locking around 'mfd_of_node_list' (git-fixes).\n- mfd: da9055: Fix missing regmap_del_irq_chip() in error path (git-fixes).\n- mfd: max77620: Fix potential IRQ chip conflict when probing two devices (git-fixes).\n- mfd: mt6358-irq: Fix missing irq_domain_remove() in error path (git-fixes).\n- mfd: mt6397-irq: Fix missing irq_domain_remove() in error path (git-fixes).\n- mfd: tps6105x: Fix kernel-doc warnings relating to the core struct and tps6105x_mode (git-fixes).\n- mfd: wm8350-core: Use IRQF_ONESHOT (git-fixes).\n- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (stable-fixes).\n- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (stable-fixes).\n- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (bsc#1254447 bsc#1253087).\n- mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() (git-fixes).\n- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (git-fixes).\n- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (git-fixes).\n- mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig (git-fixes).\n- mmc: sdhci-msm: Avoid early clock doubling during HS400 transition (stable-fixes).\n- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (git-fixes).\n- most: usb: fix double free on late probe failure (git-fixes).\n- mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() (git-fixes).\n- mtd: lpddr_cmds: fix signed shifts in lpddr_cmds (git-fixes).\n- mtd: maps: pcmciamtd: fix potential memory leak in pcmciamtd_detach() (git-fixes).\n- mtd: nand: relax ECC parameter validation check (git-fixes).\n- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (git-fixes).\n- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (git-fixes).\n- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (git-fixes).\n- mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove (git-fixes).\n- mtd: rawnand: pl353: Fix software ECC support (git-fixes).\n- mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors (git-fixes).\n- mtd: spinand: Fix kernel doc (git-fixes).\n- myri10ge: avoid uninitialized variable use (stable-fixes).\n- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (git-fixes).\n- net: hv_netvsc: reject RSS hash key programming without RX indirection table (bsc#1257473).\n- net: mdio: aspeed: add dummy read to avoid read-after-write issue (git-fixes).\n- net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write (git-fixes).\n- net: nfc: nci: Fix parameter validation for packet data (git-fixes).\n- net: phy: adin1100: Fix software power-down ready condition (git-fixes).\n- net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY (git-fixes).\n- net: phy: mxl-gpy: fix link properties on USXGMII and internal PHYs (git-fixes).\n- net: rose: fix invalid array index in rose_kill_by_device() (git-fixes).\n- net: tcp: allow zero-window ACK update the window (bsc#1254767).\n- net: usb: catc: enable basic endpoint checking (git-fixes).\n- net: usb: dm9601: remove broken SR9700 support (git-fixes).\n- net: usb: kalmia: validate USB endpoints (git-fixes).\n- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (git-fixes).\n- net: usb: kaweth: validate USB endpoints (git-fixes).\n- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (git-fixes).\n- net: usb: pegasus: enable basic endpoint checking (git-fixes).\n- net: usb: pegasus: fix memory leak in update_eth_regs_async() (git-fixes).\n- net: usb: r8152: fix transmit queue timeout (stable-fixes).\n- net: usb: rtl8150: fix memory leak on usb_submit_urb() failure (git-fixes).\n- net: usb: sr9700: fix incorrect command used to write single register (git-fixes).\n- net: usb: sr9700: remove code to drive nonexistent multicast filter (stable-fixes).\n- net: usb: sr9700: support devices with virtual driver CD (stable-fixes).\n- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (git-fixes).\n- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (git-fixes).\n- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (git-fixes).\n- net: wwan: t7xx: fix potential skb-\u003efrags overflow in RX path (git-fixes).\n- nfc: hci: shdlc: Stop timers and work before freeing context (git-fixes).\n- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame() (git-fixes).\n- nfc: nci: Fix race between rfkill and nci_unregister_device() (git-fixes).\n- nfc: nxp-nci: remove interrupt trigger type (stable-fixes).\n- nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() (git-fixes).\n- nfc: pn533: properly drop the usb interface reference on disconnect (git-fixes).\n- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (stable-fixes).\n- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (stable-fixes).\n- nvme: Use non zero KATO for persistent discovery connections (git-fixes).\n- of: fix reference count leak in of_alias_scan() (git-fixes).\n- of: platform: Use default match table for /firmware (git-fixes).\n- orangefs: fix xattr related buffer overflow.. (git-fixes).\n- phy: broadcom: bcm63xx-usbh: fix section mismatches (git-fixes).\n- phy: freescale: imx8m-pcie: assert phy reset during power on (stable-fixes).\n- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (stable-fixes).\n- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (stable-fixes).\n- phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe() (git-fixes).\n- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (git-fixes).\n- phy: rockchip: inno-usb2: fix disconnection in gadget mode (git-fixes).\n- phy: stm32-usphyc: Fix off by one in probe() (git-fixes).\n- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (git-fixes).\n- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (git-fixes).\n- pinctrl: meson: mark the GPIO controller as sleeping (git-fixes).\n- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (git-fixes).\n- pinctrl: qcom: msm: Fix deadlock in pinmux configuration (stable-fixes).\n- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (git-fixes).\n- pinctrl: single: Fix PIN_CONFIG_BIAS_DISABLE handling (stable-fixes).\n- pinctrl: single: Fix incorrect type for error return variable (git-fixes).\n- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (git-fixes).\n- pinctrl: stm32: fix hwspinlock resource leak in probe function (git-fixes).\n- platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver (git-fixes).\n- platform/chrome: cros_ec_lightbar: Fix response size initialization (git-fixes).\n- platform/chrome: cros_typec_switch: Do not touch struct fwnode_handle::dev (git-fixes).\n- platform/mellanox: mlxbf-pmc: Remove trailing whitespaces from event names (git-fixes).\n- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (stable-fixes).\n- platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally (stable-fixes).\n- platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list (stable-fixes).\n- platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks (stable-fixes).\n- platform/x86: acer-wmi: Ignore backlight event (stable-fixes).\n- platform/x86: asus-wmi: use brightness_set_blocking() for kbd led (git-fixes).\n- platform/x86: classmate-laptop: Add missing NULL pointer checks (stable-fixes).\n- platform/x86: huawei-wmi: add keys for HONOR models (stable-fixes).\n- platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic (git-fixes).\n- platform/x86: intel: chtwc_int33fe: do not dereference swnode args (git-fixes).\n- platform/x86: intel: punit_ipc: fix memory corruption (git-fixes).\n- platform/x86: intel_telemetry: Fix PSS event register mask (git-fixes).\n- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (git-fixes).\n- platform/x86: msi-laptop: add missing sysfs_remove_group() (git-fixes).\n- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (stable-fixes).\n- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (git-fixes).\n- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (git-fixes).\n- power: supply: ab8500: Fix use-after-free in power_supply_changed() (git-fixes).\n- power: supply: act8945a: Fix use-after-free in power_supply_changed() (git-fixes).\n- power: supply: apm_power: only unset own apm_get_power_status (git-fixes).\n- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (git-fixes).\n- power: supply: bq25980: Fix use-after-free in power_supply_changed() (git-fixes).\n- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (git-fixes).\n- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (git-fixes).\n- power: supply: cw2015: Check devm_delayed_work_autocancel() return code (git-fixes).\n- power: supply: goldfish: Fix use-after-free in power_supply_changed() (git-fixes).\n- power: supply: qcom_battmgr: Recognize \"LiP\" as lithium-polymer (git-fixes).\n- power: supply: rt9455: Fix use-after-free in power_supply_changed() (git-fixes).\n- power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges() (git-fixes).\n- power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges() (git-fixes).\n- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (git-fixes).\n- power: supply: wm831x: Check wm831x_set_bits() return value (git-fixes).\n- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (git-fixes).\n- powercap: fix race condition in register_control_type() (stable-fixes).\n- powercap: fix sscanf() error return value handling (stable-fixes).\n- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (git-fixes).\n- powerpc/64s/slb: Fix SLB multihit issue during SLB preload (bac#1236022 ltc#211187).\n- powerpc/addnote: Fix overflow on 32-bit builds (bsc#1215199).\n- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (bsc#1253262 ltc#216029).\n- powerpc/kexec: Enable SMT before waking offline CPUs (bsc#1214285 bsc#1205462 bsc#1253739 bsc#1254244).\n- pwm: bcm2835: Make sure the channel is enabled after pwm_request() (git-fixes).\n- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (git-fixes).\n- regmap: Fix race condition in hwspinlock irqsave routine (git-fixes).\n- regmap: maple: free entry on mas_store_gfp() failure (stable-fixes).\n- regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex (git-fixes).\n- regulator: core: disable supply if enabling main regulator fails (git-fixes).\n- regulator: core: fix locking in regulator_resolve_supply() error path (git-fixes).\n- regulator: core: move supply check earlier in set_machine_constraints() (git-fixes).\n- remove a bpf CVE change which is already part of the base kernel\n- remove an Intel CPU model change which is already part of the base kernel\n- reset: fix BIT macro reference (stable-fixes).\n- rpm/mkspec-dtb: add riscv64 dtb-thead subpackage\n- rpmsg: core: fix race in driver_override_show() and use core helper (git-fixes).\n- rpmsg: glink: fix rpmsg device leak (git-fixes).\n- rtc: gamecube: Check the return value of ioremap() (git-fixes).\n- rtc: interface: Alarm race handling should not discard preceding error (git-fixes).\n- rtc: zynqmp: correct frequency value (stable-fixes).\n- sched: Increase sched_tick_remote timeout (bsc#1254510).\n- scripts/python/git_sort/git_sort.yaml: add cifs for-next repository\n- scripts: obsapi: Support URL trailing / in oscrc\n- scripts: teaapi: Add paging\n- scripts: uploader: Fix no change condition for _maintainership.json\n- scripts: uploader: Handle missing upstream in is_pr_open\n- scrits: teaapi: Add list_repos\n- scsi: lpfc: Add capability to register Platform Name ID to fabric (bsc#1254119).\n- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (bsc#1254119).\n- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (bsc#1254119).\n- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (bsc#1254119).\n- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (bsc#1254119).\n- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (bsc#1254119).\n- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (bsc#1254119).\n- scsi: lpfc: Revise discovery related function headers and comments (bsc#1254119).\n- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (bsc#1256861).\n- scsi: lpfc: Update lpfc version to 14.4.0.12 (bsc#1254119).\n- scsi: lpfc: Update lpfc version to 14.4.0.13 (bsc#1256861).\n- scsi: lpfc: Update various NPIV diagnostic log messaging (bsc#1254119).\n- scsi: qla2xxx: Add Speed in SFP print information (bsc#1256863).\n- scsi: qla2xxx: Add bsg interface to support firmware img validation (bsc#1256863).\n- scsi: qla2xxx: Add load flash firmware mailbox support for 28xxx (bsc#1256863).\n- scsi: qla2xxx: Add support for 64G SFP speed (bsc#1256863).\n- scsi: qla2xxx: Allow recovery for tape devices (bsc#1256863).\n- scsi: qla2xxx: Delay module unload while fabric scan in progress (bsc#1256863).\n- scsi: qla2xxx: Fix bsg_done() causing double free (bsc#1256863).\n- scsi: qla2xxx: Free sp in error path to fix system crash (bsc#1256863).\n- scsi: qla2xxx: Query FW again before proceeding with login (bsc#1256863).\n- scsi: qla2xxx: Update version to 10.02.10.100-k (bsc#1256863).\n- scsi: qla2xxx: Validate MCU signature before executing MBC 03h (bsc#1256863).\n- scsi: qla2xxx: Validate sp before freeing associated memory (bsc#1256863).\n- scsi: storvsc: Process unsupported MODE_SENSE_10 (bsc#1257296).\n- selftests/bpf: Skip timer cases when bpf_timer is not supported (git-fixes).\n- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (stable-fixes).\n- serial: 8250_dw: handle clock enable errors in runtime_resume (stable-fixes).\n- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (git-fixes).\n- serial: SH_SCI: improve \"DMA support\" prompt (git-fixes).\n- serial: add support of CPCI cards (stable-fixes).\n- serial: amba-pl011: prefer dma_mapping_error() over explicit address checking (git-fixes).\n- serial: imx: change SERIAL_IMX_CONSOLE to bool (git-fixes).\n- serial: sprd: Return -EPROBE_DEFER when uart clock is not ready (stable-fixes).\n- shrink_slab_memcg: clear_bits of skipped shrinkers (bsc#1256564).\n- slimbus: core: fix OF node leak on registration failure (git-fixes).\n- slimbus: core: fix device reference leak on report present (git-fixes).\n- slimbus: core: fix of_slim_get_device() kernel doc (git-fixes).\n- slimbus: core: fix runtime PM imbalance on report present (git-fixes).\n- slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves (git-fixes).\n- smb3: add missing null server pointer check (git-fixes).\n- smb: change return type of cached_dir_lease_break() to bool (git-fixes).\n- smb: client: ensure open_cached_dir_by_dentry() only returns valid cfid (git-fixes).\n- smb: client: fix cifs_pick_channel when channel needs reconnect (git-fixes).\n- smb: client: fix warning when reconnecting channel (git-fixes).\n- smb: client: introduce close_cached_dir_locked() (git-fixes).\n- smb: client: remove unused fid_lock (git-fixes).\n- smb: client: short-circuit in open_cached_dir_by_dentry() if !dentry (git-fixes).\n- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (bsc#1250748,bsc#1257154).\n- smb: client: update cfid-\u003elast_access_time in open_cached_dir_by_dentry() (git-fixes).\n- smb: improve directory cache reuse for readdir operations (bsc#1252712).\n- smc91x: fix broken irq-context in PREEMPT_RT (git-fixes).\n- soc/tegra: fuse: speedo-tegra210: Update speedo IDs (git-fixes).\n- soc: amlogic: canvas: fix device leak on lookup (git-fixes).\n- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (git-fixes).\n- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (git-fixes).\n- soc: qcom: ocmem: fix device leak on lookup (git-fixes).\n- soc: qcom: smem: fix hwspinlock resource leak in probe error paths (git-fixes).\n- soc: qcom: smem: handle ENOMEM error during probe (git-fixes).\n- soc: ti: k3-socinfo: Fix regmap leak on probe failure (git-fixes).\n- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (git-fixes).\n- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (stable-fixes).\n- spi-geni-qcom: initialize mode related registers to 0 (stable-fixes).\n- spi-geni-qcom: use xfer-\u003ebits_per_word for can_dma() (stable-fixes).\n- spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors (git-fixes).\n- spi: bcm63xx: drop wrong casts in probe() (git-fixes).\n- spi: bcm63xx: fix premature CS deassertion on RX-only transactions (git-fixes).\n- spi: fsl-cpm: Check length parity before switching to 16 bit mode (git-fixes).\n- spi: imx: keep dma request disabled before dma transfer setup (stable-fixes).\n- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (stable-fixes).\n- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (stable-fixes).\n- spi: spi-sprd-adi: Fix double free in probe error path (git-fixes).\n- spi: sprd-adi: switch to use spi_alloc_host() (stable-fixes).\n- spi: sprd: adi: Use devm_register_restart_handler() (stable-fixes).\n- spi: stm32: fix Overrun issue at \u0026lt; 8bpw (stable-fixes).\n- spi: tegra114: Preserve SPI mode bits in def_command1_reg (git-fixes).\n- spi: tegra210-qspi: Remove cache operations (git-fixes)\n- spi: tegra210-quad: Add support for internal DMA (git-fixes)\n- spi: tegra210-quad: Check hardware status on timeout (bsc#1253155)\n- spi: tegra210-quad: Fix timeout handling (bsc#1253155)\n- spi: tegra210-quad: Fix timeout handling (git-fixes).\n- spi: tegra210-quad: Move curr_xfer read inside spinlock (bsc#1257952)\n- spi: tegra210-quad: Move curr_xfer read inside spinlock (git-fixes).\n- spi: tegra210-quad: Protect curr_xfer assignment in (bsc#1257952)\n- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (git-fixes).\n- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (bsc#1257952)\n- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (git-fixes).\n- spi: tegra210-quad: Protect curr_xfer clearing in (bsc#1257952)\n- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (git-fixes).\n- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (bsc#1257952)\n- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (git-fixes).\n- spi: tegra210-quad: Refactor error handling into helper functions (bsc#1253155)\n- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed (bsc#1257952)\n- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (git-fixes).\n- spi: tegra210-quad: Update dummy sequence configuration (git-fixes)\n- spi: tegra: Fix a memory leak in tegra_slink_probe() (git-fixes).\n- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (git-fixes).\n- spi: wpcm-fiu: Fix uninitialized res (git-fixes).\n- spi: wpcm-fiu: Simplify with dev_err_probe() (stable-fixes).\n- spi: wpcm-fiu: Use devm_platform_ioremap_resource_byname() (stable-fixes).\n- spi: xilinx: increase number of retries before declaring stall (stable-fixes).\n- staging: fbtft: core: fix potential memory leak in fbtft_probe_common() (git-fixes).\n- staging: rtl8723bs: fix memory leak on failure path (stable-fixes).\n- staging: rtl8723bs: fix null dereference in find_network (git-fixes).\n- staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing (stable-fixes).\n- staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser (stable-fixes).\n- supported.conf: Mark lan 743x supported (jsc#PED-14571)\n- thermal: int340x: Fix sysfs group leak on DLVR registration failure (stable-fixes).\n- thunderbolt: Add support for Intel Wildcat Lake (stable-fixes).\n- tools/power cpupower: Reset errno before strtoull() (stable-fixes).\n- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (git-fixes).\n- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (git-fixes).\n- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (git-fixes).\n- tracing: Fix access to trace_event_file (bsc#1254373).\n- uacce: ensure safe queue release with state management (git-fixes).\n- uacce: fix cdev handling in the cleanup path (git-fixes).\n- uacce: fix isolate sysfs check condition (git-fixes).\n- uacce: implement mremap in uacce_vm_ops to return -EPERM (git-fixes).\n- uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe (git-fixes).\n- usb: bdc: fix sleep during atomic (git-fixes).\n- usb: cdns3: Fix double resource release in cdns3_pci_probe (git-fixes).\n- usb: chaoskey: fix locking for O_NONBLOCK (git-fixes).\n- usb: chipidea: udc: limit usb request length to max 16KB (stable-fixes).\n- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (stable-fixes).\n- usb: dwc2: disable platform lowlevel hw resources during shutdown (stable-fixes).\n- usb: dwc2: fix hang during shutdown if set as peripheral (git-fixes).\n- usb: dwc2: fix hang during suspend if set as peripheral (git-fixes).\n- usb: dwc2: fix resume failure if dr_mode is host (git-fixes).\n- usb: dwc3: Abort suspend on soft disconnect failure (git-fixes).\n- usb: dwc3: Check for USB4 IP_NAME (stable-fixes).\n- usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (git-fixes).\n- usb: dwc3: keep susphy enabled during exit to avoid controller faults (git-fixes).\n- usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe (git-fixes).\n- usb: dwc3: pci: Sort out the Intel device IDs (stable-fixes).\n- usb: dwc3: pci: add support for the Intel Nova Lake -S (stable-fixes).\n- usb: gadget: configfs: Correctly set use_os_string at bind (git-fixes).\n- usb: gadget: f_eem: Fix memory leak in eem_unwrap (git-fixes).\n- usb: gadget: lpc32xx_udc: fix clock imbalance in error path (git-fixes).\n- usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors (git-fixes).\n- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (git-fixes).\n- usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt (git-fixes).\n- usb: ohci-nxp: Use helper function devm_clk_get_enabled() (stable-fixes).\n- usb: ohci-nxp: fix device leak on probe failure (git-fixes).\n- usb: phy: Initialize struct usb_phy list_head (git-fixes).\n- usb: phy: isp1301: fix non-OF device reference imbalance (git-fixes).\n- usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE (git-fixes).\n- usb: raw-gadget: do not limit transfer length (git-fixes).\n- usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() (git-fixes).\n- usb: storage: Fix memory leak in USB bulk transport (git-fixes).\n- usb: storage: sddr55: Reject out-of-bound new_pba (stable-fixes).\n- usb: typec: tipd: Clear interrupts first (git-fixes).\n- usb: typec: ucsi: Handle incorrect num_connectors capability (stable-fixes).\n- usb: typec: ucsi: psy: Set max current to zero when disconnected (git-fixes).\n- usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer (git-fixes).\n- usb: udc: Add trace event for usb_gadget_set_state (stable-fixes).\n- usb: usb-storage: Maintain minimal modifications to the bcdDevice range (git-fixes).\n- usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive (stable-fixes).\n- usb: vhci-hcd: Prevent suspending virtually attached devices (git-fixes).\n- usb: xhci: limit run_graceperiod for only usb 3.0 devices (stable-fixes).\n- usbip: Fix locking bug in RT-enabled kernels (stable-fixes).\n- usbnet: limit max_mtu based on device's hard_mtu (git-fixes).\n- via_wdt: fix critical boot hang due to unnamed resource allocation (stable-fixes).\n- virtio_console: fix order of fields cols and rows (stable-fixes).\n- w1: fix redundant counter decrement in w1_attach_slave_device() (git-fixes).\n- w1: therm: Fix off-by-one buffer overflow in alarms_store (git-fixes).\n- watchdog: imx7ulp_wdt: handle the nowayout option (stable-fixes).\n- watchdog: wdat_wdt: Fix ACPI table leak in probe function (git-fixes).\n- wifi: ath10k: fix dma_free_coherent() pointer (git-fixes).\n- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (stable-fixes).\n- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (git-fixes).\n- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (stable-fixes).\n- wifi: ath11k: fix peer HE MCS assignment (git-fixes).\n- wifi: ath11k: restore register window after global reset (git-fixes).\n- wifi: ath12k: fix dma_free_coherent() pointer (git-fixes).\n- wifi: ath12k: fix preferred hardware mode calculation (stable-fixes).\n- wifi: ath9k: debug.h: fix kernel-doc bad lines and struct ath_tx_stats (git-fixes).\n- wifi: ath9k: fix kernel-doc warnings in common-debug.h (git-fixes).\n- wifi: avoid kernel-infoleak from struct iw_point (git-fixes).\n- wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet (stable-fixes).\n- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (stable-fixes).\n- wifi: cfg80211: Fix use_for flag update on BSS refresh (git-fixes).\n- wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() (git-fixes).\n- wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() (git-fixes).\n- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (git-fixes).\n- wifi: cfg80211: wext: fix IGTK key ID off-by-one (git-fixes).\n- wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() (git-fixes).\n- wifi: ieee80211: correct FILS status codes (git-fixes).\n- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (stable-fixes).\n- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (stable-fixes).\n- wifi: iwlwifi: mvm: check the validity of noa_len (stable-fixes).\n- wifi: libertas: fix WARNING in usb_tx_block (stable-fixes).\n- wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration (git-fixes).\n- wifi: mac80211: collect station statistics earlier when disconnect (stable-fixes).\n- wifi: mac80211: correctly check if CSA is active (stable-fixes).\n- wifi: mac80211: correctly decode TTLM with default link map (git-fixes).\n- wifi: mac80211: do not increment crypto_tx_tailroom_needed_cnt twice (stable-fixes).\n- wifi: mac80211: do not use old MBSSID elements (git-fixes).\n- wifi: mac80211: fix CMAC functions not handling errors (git-fixes).\n- wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() (git-fixes).\n- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (stable-fixes).\n- wifi: mac80211: restore non-chanctx injection behaviour (git-fixes).\n- wifi: mt76: Fix DTS power-limits on little endian systems (git-fixes).\n- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (git-fixes).\n- wifi: nl80211: vendor-cmd: intel: fix a blank kernel-doc line warning (git-fixes).\n- wifi: radiotap: reject radiotap with unknown bits (git-fixes).\n- wifi: rsi: Fix memory corruption due to not set vif driver data size (git-fixes).\n- wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() (git-fixes).\n- wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() (git-fixes).\n- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (git-fixes).\n- wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() (git-fixes).\n- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (stable-fixes).\n- wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1 (stable-fixes).\n- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (git-fixes).\n- wifi: rtw88: fix DTIM period handling when conf-\u003edtim_period is zero (stable-fixes).\n- wifi: rtw88: limit indirect IO under powered off for RTL8822CS (git-fixes).\n- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (stable-fixes).\n- wifi: rtw89: pci: restore LDO setting after device resume (stable-fixes).\n- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (stable-fixes).\n- wifi: wlcore: ensure skb headroom before skb_push (stable-fixes).\n- workqueue: mark power efficient workqueue as unbounded if (bsc#1257891)\n- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (git-fixes).\n- x86/microcode/AMD: Add TSA microcode SHAs (bsc#1256528).\n- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (bsc#1256528).\n- x86/microcode/AMD: Add more known models to entry sign checking (bsc#1256528).\n- x86/microcode/AMD: Add some forgotten models to the SHA check (bsc#1256528).\n- x86/microcode/AMD: Clean the cache if update did not load microcode (bsc#1256528).\n- x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (bsc#1256528).\n- x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (bsc#1256528).\n- x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (bsc#1256528).\n- x86/microcode/AMD: Limit Entrysign signature checking to known generations (bsc#1256528).\n- x86/microcode/AMD: Load only SHA256-checksummed patches (bsc#1256528).\n- x86/microcode/AMD: Select which microcode patch to load (bsc#1256528).\n- x86/microcode/AMD: Use sha256() instead of init/update/final (bsc#1256528).\n- x86/microcode: Fix Entrysign revision check for Zen1/Naples (bsc#1256528).\n- x86: make page fault handling disable interrupts properly (git-fixes).\n- xhci: dbgtty: fix device unregister (git-fixes).\n","status":"published","published":"2026-03-24T16:48:38Z","modified":"2026-03-28T17:24:51.593455Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20876-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).\n- CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).\n- CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).\n- CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).\n- CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).\n- CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).\n- CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).\n- CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).\n- CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).\n- CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).\n- CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).\n- CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).\n- CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).\n- CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).\n- CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).\n- CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).\n- CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).\n- CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).\n- CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).\n- CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).\n- CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).\n- CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).\n- CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).\n- CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).\n- CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).\n- CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).\n- CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).\n- CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).\n- CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).\n- CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).\n- CVE-2025-40192: Revert \"ipmi: fix msg stack when IPMI is disconnected\" (bsc#1253622).\n- CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).\n- CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).\n- CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).\n- CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).\n- CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).\n- CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).\n- CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).\n- CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).\n- CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).\n- CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).\n- CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).\n- CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).\n- CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).\n- CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).\n- CVE-2025-40261: nvme: nvme-fc: Ensure -\u003eioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).\n- CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).\n- CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).\n- CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).\n- CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).\n- CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).\n- CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).\n- CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).\n- CVE-2025-40289: drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (bsc#1255042).\n- CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).\n- CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).\n- CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187).\n- CVE-2025-40307: exfat: validate cluster allocation bits of the allocation bitmap (bsc#1255039).\n- CVE-2025-40319: bpf: Sync pending IRQ work before freeing ring buffer (bsc#1254794).\n- CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).\n- CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).\n- CVE-2025-40338: ASoC: Intel: avs: Do not share the name pointer between components (bsc#1255273).\n- CVE-2025-40339: drm/amdgpu: fix nullptr err of vm_handle_moved (bsc#1255428).\n- CVE-2025-40346: arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (bsc#1255318).\n- CVE-2025-40350: net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (bsc#1255260).\n- CVE-2025-40355: sysfs: check visibility before changing group attribute ownership (bsc#1255261).\n- CVE-2025-40360: drm/sysfb: Do not dereference NULL pointer in plane reset (bsc#1255095).\n- CVE-2025-40363: net: ipv6: fix field-spanning memcpy warning in AH output (bsc#1255102).\n- CVE-2025-68171: x86/fpu: Ensure XFD state on signal delivery (bsc#1255255).\n- CVE-2025-68174: amd/amdkfd: enhance kfd process check in switch partition (bsc#1255327).\n- CVE-2025-68178: blk-cgroup: fix possible deadlock while configuring policy (bsc#1255266).\n- CVE-2025-68188: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (bsc#1255269).\n- CVE-2025-68190: drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (bsc#1255131).\n- CVE-2025-68200: bpf: Add bpf_prog_run_data_pointers() (bsc#1255241).\n- CVE-2025-68201: drm/amdgpu: remove two invalid BUG_ON()s (bsc#1255136).\n- CVE-2025-68204: pmdomain: arm: scmi: Fix genpd leak on provider registration failure (bsc#1255224).\n- CVE-2025-68206: netfilter: nft_ct: add seqadj extension for natted connections (bsc#1255142).\n- CVE-2025-68208: bpf: account for current allocated stack depth in widen_imprecise_scalars() (bsc#1255227).\n- CVE-2025-68209: mlx5: Fix default values in create CQ (bsc#1255230).\n- CVE-2025-68227: mptcp: Fix proto fallback detection with BPF (bsc#1255216).\n- CVE-2025-68230: drm/amdgpu: fix gpu page fault after hibernation on PF passthrough (bsc#1255134).\n- CVE-2025-68239: binfmt_misc: restore write access before closing files opened by open_exec() (bsc#1255272).\n- CVE-2025-68241: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (bsc#1255157).\n- CVE-2025-68245: net: netpoll: fix incorrect refcount handling causing incorrect cleanup (bsc#1255268).\n- CVE-2025-68255: staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing (bsc#1255395).\n- CVE-2025-68259: KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced (bsc#1255199).\n- CVE-2025-68261: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164).\n- CVE-2025-68264: ext4: refresh inline data size before write operations (bsc#1255380).\n- CVE-2025-68283: libceph: replace BUG_ON with bounds check for map-\u003emax_osd (bsc#1255379).\n- CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255377).\n- CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401).\n- CVE-2025-68295: smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129).\n- CVE-2025-68296: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128).\n- CVE-2025-68297: ceph: fix crash in process_v2_sparse_read() for encrypted directories (bsc#1255403).\n- CVE-2025-68301: net: atlantic: fix fragment overflow handling in RX path (bsc#1255120).\n- CVE-2025-68320: lan966x: Fix sleeping in atomic context (bsc#1255172).\n- CVE-2025-68325: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (bsc#1255417).\n- CVE-2025-68327: usb: renesas_usbhs: Fix synchronous external abort on unbind (bsc#1255488).\n- CVE-2025-68337: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (bsc#1255482).\n- CVE-2025-68340: team: Move team device type change at the end of team_port_add (bsc#1255507).\n- CVE-2025-68349: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (bsc#1255544).\n- CVE-2025-68363: bpf: Check skb-\u003etransport_header is set in bpf_skb_check_mtu (bsc#1255552).\n- CVE-2025-68365: fs/ntfs3: Initialize allocated memory before use (bsc#1255548).\n- CVE-2025-68366: nbd: defer config unlock in nbd_genl_connect (bsc#1255622).\n- CVE-2025-68367: macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (bsc#1255547).\n- CVE-2025-68372: nbd: defer config put in recv_work (bsc#1255537).\n- CVE-2025-68374: md: fix rcu protection in md_wakeup_thread (bsc#1255530).\n- CVE-2025-68378: bpf: Refactor stack map trace depth calculation into helper function (bsc#1255614).\n- CVE-2025-68379: RDMA/rxe: Fix null deref on srq-\u003erq.queue after resize failure (bsc#1255695).\n- CVE-2025-68727: ntfs3: Fix uninit buffer allocated by __getname() (bsc#1255568).\n- CVE-2025-68728: ntfs3: fix uninit memory after failed mi_read in mi_format_new (bsc#1255539).\n- CVE-2025-68733: smack: fix bug: unprivileged task can create labels (bsc#1255615).\n- CVE-2025-68736: landlock: Fix handling of disconnected directories (bsc#1255698).\n- CVE-2025-68742: bpf: Improve program stats run-time calculation (bsc#1255707).\n- CVE-2025-68744: bpf: Free special fields when update [lru_,]percpu_hash maps (bsc#1255709).\n- CVE-2025-68764: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (bsc#1255930).\n- CVE-2025-68768: inet: frags: add inet_frag_queue_flush() (bsc#1256579).\n- CVE-2025-68770: bnxt_en: Fix XDP_TX path (bsc#1256584).\n- CVE-2025-68771: ocfs2: fix kernel BUG in ocfs2_find_victim_chain (bsc#1256582).\n- CVE-2025-68775: net/handshake: duplicate handshake cancellations leak socket (bsc#1256665).\n- CVE-2025-68776: net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (bsc#1256659).\n- CVE-2025-68778: btrfs: don't log conflicting inode if it's a dir moved in the current transaction (bsc#1256683).\n- CVE-2025-68785: net: openvswitch: fix middle attribute validation in push_nsh() action (bsc#1256640).\n- CVE-2025-68788: fsnotify: do not generate ACCESS/MODIFY events on child for special files (bsc#1256638).\n- CVE-2025-68795: ethtool: Avoid overflowing userspace buffer on stats query (bsc#1256688).\n- CVE-2025-68798: perf/x86/amd: Check event before enable to avoid GPF (bsc#1256689).\n- CVE-2025-68800: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (bsc#1256646).\n- CVE-2025-68801: mlxsw: spectrum_router: Fix neighbour use-after-free (bsc#1256653).\n- CVE-2025-68803: nfsd: set security label during create operations (bsc#1256770).\n- CVE-2025-68810: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (bsc#1256679).\n- CVE-2025-68813: ipvs: fix ipv4 null-ptr-deref in route error path (bsc#1256641).\n- CVE-2025-68814: io_uring: fix filename leak in __io_openat_prep() (bsc#1256651).\n- CVE-2025-68815: net/sched: ets: Remove drr class from the active list if it changes to strict (bsc#1256680).\n- CVE-2025-68816: net/mlx5: fw_tracer, Validate format string parameters (bsc#1256674).\n- CVE-2025-68820: ext4: xattr: fix null pointer deref in ext4_raw_inode() (bsc#1256754).\n- CVE-2025-71064: net: hns3: using the num_tqps in the vf driver to apply for resources (bsc#1256654).\n- CVE-2025-71066: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (bsc#1256645).\n- CVE-2025-71071: iommu/mediatek: fix use-after-free on probe deferral (bsc#1256802).\n- CVE-2025-71077: tpm: Cap the number of PCR banks (bsc#1256613).\n- CVE-2025-71084: RDMA/cm: Fix leaking the multicast GID table reference (bsc#1256622).\n- CVE-2025-71085: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (bsc#1256623).\n- CVE-2025-71087: iavf: fix off-by-one issues in iavf_config_rss_reg() (bsc#1256628).\n- CVE-2025-71088: mptcp: fallback earlier on simult connection (bsc#1256630).\n- CVE-2025-71089: iommu: disable SVA when CONFIG_X86 is set (bsc#1256612).\n- CVE-2025-71091: team: fix check for port enabled in team_queue_override_port_prio_changed() (bsc#1256773).\n- CVE-2025-71093: e1000: fix OOB in e1000_tbi_should_accept() (bsc#1256777).\n- CVE-2025-71094: net: usb: asix: ax88772: Increase phy_name size (bsc#1256597).\n- CVE-2025-71095: net: stmmac: fix the crash issue for zero copy XDP_TX action (bsc#1256605).\n- CVE-2025-71096: RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (bsc#1256606).\n- CVE-2025-71097: ipv4: Fix reference count leak when using error routes with nexthop objects (bsc#1256607).\n- CVE-2025-71104: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (bsc#1256708).\n- CVE-2025-71112: net: hns3: add VLAN id validation before using (bsc#1256726).\n- CVE-2025-71113: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (bsc#1256716).\n- CVE-2025-71116: libceph: make decode_pool() more resilient against corrupted osdmaps (bsc#1256744).\n- CVE-2025-71120: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (bsc#1256779).\n- CVE-2025-71123: ext4: fix string copying in parse_apply_sb_mount_options() (bsc#1256757).\n- CVE-2025-71126: mptcp: reset fallback status gracefully at disconnect() time (bsc#1256755).\n- CVE-2025-71133: RDMA/irdma: avoid invalid read in irdma_net_event (bsc#1256733).\n- CVE-2025-71135: md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt() (bsc#1256761).\n- CVE-2025-71137: octeontx2-pf: fix \"UBSAN: shift-out-of-bounds error\" (bsc#1256760).\n- CVE-2025-71148: net/handshake: restore destructor on submit failure (bsc#1257159).\n- CVE-2025-71149: io_uring/poll: correctly handle io_poll_add() return value on update (bsc#1257164).\n- CVE-2025-71184: btrfs: fix NULL dereference on root when tracing inode eviction (bsc#1257635).\n- CVE-2025-71194: btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (bsc#1257687).\n- CVE-2025-71225: md: suspend array while updating raid_disks via sysfs (bsc#1258411).\n- CVE-2026-22976: net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (bsc#1257035).\n- CVE-2026-22977: net: sock: fix hardened usercopy panic in sock_recv_errqueue (bsc#1257053).\n- CVE-2026-22979: net: fix memory leak in skb_segment_list for GRO packets (bsc#1257228).\n- CVE-2026-22982: net: mscc: ocelot: Fix crash when adding interface under a lag (bsc#1257179).\n- CVE-2026-22984: libceph: prevent potential out-of-bounds reads in handle_auth_done() (bsc#1257217).\n- CVE-2026-22990: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (bsc#1257221).\n- CVE-2026-22991: libceph: make free_choose_arg_map() resilient to partial allocation (bsc#1257220).\n- CVE-2026-22992: libceph: return the handler error from mon_handle_auth_done() (bsc#1257218).\n- CVE-2026-22996: net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv.\n- CVE-2026-22998: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (bsc#1257209).\n- CVE-2026-22999: net/sched: sch_qfq: do not free existing class in qfq_change_class() (bsc#1257236).\n- CVE-2026-23000: net/mlx5e: Fix crash on profile change rollback failure (bsc#1257234).\n- CVE-2026-23001: macvlan: Use 'hash' iterators to simplify code (bsc#1257232).\n- CVE-2026-23003: geneve: Fix incorrect inner network header offset when innerprotoinherit is set (bsc#1257246).\n- CVE-2026-23004: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231).\n- CVE-2026-23005: x86/fpu: Clear XSTATE_BV in guest XSAVE state whenever XFD[i]=1 (bsc#1257245).\n- CVE-2026-23010: ipv6: Fix use-after-free in inet6_addr_del() (bsc#1257332).\n- CVE-2026-23011: ipv4: ip_gre: make ipgre_header() robust (bsc#1257207).\n- CVE-2026-23017: idpf: fix error handling in the init_task on load (bsc#1257552).\n- CVE-2026-23035: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (bsc#1257559).\n- CVE-2026-23053: NFS: Fix a deadlock involving nfs_release_folio() (bsc#1257718).\n- CVE-2026-23057: vsock/virtio: Coalesce only linear skb (bsc#1257740).\n- CVE-2026-23060: crypto: authencesn - reject too-short AAD (assoclen\u003c8) to match ESP/ESN spec (bsc#1257735).\n- CVE-2026-23064: net/sched: act_ife: avoid possible NULL deref (bsc#1257765).\n- CVE-2026-23074: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749).\n- CVE-2026-23083: fou: Don't allow 0 for FOU_ATTR_IPPROTO (bsc#1257745).\n- CVE-2026-23084: be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (bsc#1257830).\n- CVE-2026-23085: irqchip/gic-v3-its: Avoid truncating memory addresses (bsc#1257758).\n- CVE-2026-23086: vsock/virtio: cap TX credit to local buffer size (bsc#1257757).\n- CVE-2026-23089: ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (bsc#1257790).\n- CVE-2026-23095: gue: Fix skb memleak with inner IP protocol 0 (bsc#1257808).\n- CVE-2026-23099: bonding: limit BOND_MODE_8023AD to Ethernet devices (bsc#1257816).\n- CVE-2026-23102: arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state (bsc#1257772).\n- CVE-2026-23104: ice: fix devlink reload call trace (bsc#1257763).\n- CVE-2026-23105: net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (bsc#1257775).\n- CVE-2026-23107: arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (bsc#1257762).\n- CVE-2026-23110: scsi: core: Wake up the error handler when final completions race against each other (bsc#1257761).\n- CVE-2026-23111: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (bsc#1258181).\n- CVE-2026-23112: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1258184).\n- CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).\n- CVE-2026-23116: pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (bsc#1258277).\n- CVE-2026-23119: bonding: provide a net pointer to __skb_flow_dissect() (bsc#1258273).\n- CVE-2026-23139: netfilter: nf_conncount: update last_gc only when GC has been performed (bsc#1258304).\n- CVE-2026-23141: btrfs: send: check for inline extents in range_is_hole_in_parent() (bsc#1258377).\n- CVE-2026-23166: ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (bsc#1258272).\n- CVE-2026-23171: net: bonding: update the slave array for broadcast mode (bsc#1258349).\n- CVE-2026-23173: net/mlx5e: TC, delete flows only for existing peers (bsc#1258520).\n- CVE-2026-23179: nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (bsc#1258394).\n- CVE-2026-23191: ALSA: aloop: Fix racy access at PCM trigger (bsc#1258395).\n- CVE-2026-23198: KVM: Don't clobber irqfd routing type when deassigning irqfd (bsc#1258321).\n- CVE-2026-23208: ALSA: usb-audio: Prevent excessive number of frames (bsc#1258468).\n- CVE-2026-23209: macvlan: fix error recovery in macvlan_common_newlink() (bsc#1258518).\n- CVE-2026-23213: drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (bsc#1258465).\n- CVE-2026-23214: btrfs: reject new transactions if the fs is fully read-only (bsc#1258464).\n\nThe following non-security bugs were fixed:\n\n- ACPI: CPPC: Fix missing PCC check for guaranteed_perf (git-fixes).\n- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (git-fixes).\n- ACPI: PCC: Fix race condition by removing static qualifier (git-fixes).\n- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (git-fixes).\n- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (stable-fixes).\n- ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 (git-fixes).\n- ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() (git-fixes).\n- ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only (stable-fixes).\n- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (stable-fixes).\n- ACPICA: Avoid walking the Namespace if start_node is NULL (stable-fixes).\n- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (git-fixes).\n- ALSA: ac97: fix a double free in snd_ac97_controller_register() (git-fixes).\n- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (stable-fixes).\n- ALSA: dice: fix buffer overflow in detect_stream_formats() (git-fixes).\n- ALSA: firewire-motu: add bounds check in put_user loop for DSP events (git-fixes).\n- ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (git-fixes).\n- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (stable-fixes).\n- ALSA: hda/realtek - fixed speaker no sound (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (stable-fixes).\n- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (stable-fixes).\n- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU (git-fixes).\n- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (stable-fixes).\n- ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP machine (stable-fixes).\n- ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() (git-fixes).\n- ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path (git-fixes).\n- ALSA: scarlett2: Fix buffer overflow in config retrieval (git-fixes).\n- ALSA: uapi: Fix typo in asound.h comment (git-fixes).\n- ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 (stable-fixes).\n- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (stable-fixes).\n- ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series (stable-fixes).\n- ALSA: usb-audio: Add sanity check for OOB writes at silencing (stable-fixes).\n- ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 (stable-fixes).\n- ALSA: usb-audio: Cap the packet size pre-calculations (git-fixes).\n- ALSA: usb-audio: Check max frame size for implicit feedback mode, too (stable-fixes).\n- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (git-fixes).\n- ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices (git-fixes).\n- ALSA: usb-audio: Update for native DSD support quirks (stable-fixes).\n- ALSA: usb-audio: Update the number of packets properly at receiving (stable-fixes).\n- ALSA: usb-audio: Use correct version for UAC3 header validation (git-fixes).\n- ALSA: usb-audio: Use inclusive terms (git-fixes).\n- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (git-fixes).\n- ALSA: usb-mixer: us16x08: validate meter packet indices (git-fixes).\n- ALSA: usb: Increase volume range that triggers a warning (git-fixes).\n- ALSA: vxpocket: Fix resource leak in vxpocket_probe error path (git-fixes).\n- APEI/GHES: ensure that won't go past CPER allocated record (stable-fixes).\n- ASoC: Intel: catpt: Fix error path in hw_params() (git-fixes).\n- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (stable-fixes).\n- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (git-fixes).\n- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (git-fixes).\n- ASoC: SOF: ipc4-control: Keep the payload size up to date (git-fixes).\n- ASoC: SOF: ipc4-control: Use the correct size for scontrol-\u003eipc_control_data (git-fixes).\n- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (git-fixes).\n- ASoC: ak4458: Disable regulator when error happens (git-fixes).\n- ASoC: ak5558: Disable regulator when error happens (git-fixes).\n- ASoC: amd: drop unused Kconfig symbols (git-fixes).\n- ASoC: amd: fix memory leak in acp3x pdm dma ops (git-fixes).\n- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (stable-fixes).\n- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (stable-fixes).\n- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (stable-fixes).\n- ASoC: amd: yc: Fix microphone on ASUS M6500RE (stable-fixes).\n- ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() (git-fixes).\n- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (stable-fixes).\n- ASoC: codecs: wcd938x: fix OF node leaks on probe failure (git-fixes).\n- ASoC: codecs: wsa881x: Drop unused version readout (stable-fixes).\n- ASoC: codecs: wsa881x: fix unnecessary initialisation (git-fixes).\n- ASoC: codecs: wsa883x: fix unnecessary initialisation (git-fixes).\n- ASoC: codecs: wsa884x: fix codec initialisation (git-fixes).\n- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (stable-fixes).\n- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (stable-fixes).\n- ASoC: fsl: imx-card: Do not force slot width to sample width (git-fixes).\n- ASoC: fsl_sai: Add missing registers to cache default (stable-fixes).\n- ASoC: fsl_xcvr: clear the channel status control memory (git-fixes).\n- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (stable-fixes).\n- ASoC: nau8821: Cancel delayed work on component remove (git-fixes).\n- ASoC: nau8821: Cancel pending work before suspend (git-fixes).\n- ASoC: nau8821: Consistently clear interrupts before unmasking (git-fixes).\n- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (git-fixes).\n- ASoC: pxa: drop unused Kconfig symbol (git-fixes).\n- ASoC: qcom: q6adm: the the copp device only during last instance (git-fixes).\n- ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr (git-fixes).\n- ASoC: qcom: q6asm-dai: perform correct state check before closing (git-fixes).\n- ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment (git-fixes).\n- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (git-fixes).\n- ASoC: stm32: sai: fix OF node leak on probe (git-fixes).\n- ASoC: stm32: sai: fix clk prepare imbalance on probe failure (git-fixes).\n- ASoC: stm32: sai: fix device leak on probe (git-fixes).\n- ASoC: sun4i-spdif: Add missing kerneldoc fields for sun4i_spdif_quirks (git-fixes).\n- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (stable-fixes).\n- ASoC: tlv320adcx140: Propagate error codes during probe (stable-fixes).\n- ASoC: tlv320adcx140: fix null pointer (git-fixes).\n- ASoC: tlv320adcx140: fix word length (git-fixes).\n- ASoC: wm8962: Add WM8962_ADC_MONOMIX to \"3D Coefficients\" mask (stable-fixes).\n- ASoC: wm8962: Do not report a microphone if it's shorted to ground on plug (stable-fixes).\n- Add dtb-spacemit SpacemiT boards include MilkV-Jupiter, Banana Pi F3 and Orange Pi RV2.\n- Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 (git-fixes).\n- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (git-fixes).\n- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (git-fixes).\n- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (git-fixes).\n- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (git-fixes).\n- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (git-fixes).\n- Bluetooth: SMP: Fix not generating mackey and ltk when repairing (git-fixes).\n- Bluetooth: btrtl: Avoid loading the config file on security chips (stable-fixes).\n- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (stable-fixes).\n- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (stable-fixes).\n- Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE (stable-fixes).\n- Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV (stable-fixes).\n- Bluetooth: btusb: Add new VID/PID for RTL8852CE (stable-fixes).\n- Bluetooth: btusb: revert use of devm_kzalloc in btusb (git-fixes).\n- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (stable-fixes).\n- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (stable-fixes).\n- Bluetooth: hci_qca: Cleanup on all setup failures (git-fixes).\n- Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (git-fixes).\n- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (git-fixes).\n- Documentation/kernel-parameters: fix typo in retbleed= kernel parameter description (git-fixes).\n- Documentation: PCI: endpoint: Fix ntb/vntb copy \u0026 paste errors (git-fixes).\n- Documentation: hid-alps: Fix packet format section headings (git-fixes).\n- Documentation: mailbox: mbox_chan_ops.flush() is optional (git-fixes).\n- Documentation: parport-lowlevel: Separate function listing code blocks (git-fixes).\n- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (stable-fixes).\n- HID: apple: Add \"SONiX KN85 Keyboard\" to the list of non-apple keyboards (stable-fixes).\n- HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list (stable-fixes).\n- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (stable-fixes).\n- HID: elecom: Add support for ELECOM M-XT3URBK (018F) (stable-fixes).\n- HID: hid-input: Extend Elan ignore battery quirk to USB (stable-fixes).\n- HID: hid-pl: handle probe errors (git-fixes).\n- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (stable-fixes).\n- HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen (stable-fixes).\n- HID: intel-ish-hid: Reset enum_devices_done before enumeration (stable-fixes).\n- HID: intel-ish-hid: Update ishtp bus match to support device ID table (stable-fixes).\n- HID: logitech-dj: Remove duplicate error logging (git-fixes).\n- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (stable-fixes).\n- HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync() (git-fixes).\n- HID: magicmouse: Do not crash on missing msc-\u003einput (stable-fixes).\n- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (stable-fixes).\n- HID: multitouch: add eGalaxTouch EXC3188 support (stable-fixes).\n- HID: playstation: Add missing check for input_ff_create_memless (git-fixes).\n- HID: playstation: Center initial joystick axes to prevent spurious events (stable-fixes).\n- HID: prodikeys: Check presence of pm-\u003einput_ep82 (stable-fixes).\n- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (stable-fixes).\n- HID: quirks: work around VID/PID conflict for appledisplay (git-fixes).\n- HID: usbhid: paper over wrong bNumDescriptor field (stable-fixes).\n- Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard (git-fixes).\n- Input: cros_ec_keyb - fix an invalid memory access (stable-fixes).\n- Input: goodix - add support for ACPI ID GDIX1003 (stable-fixes).\n- Input: goodix - add support for ACPI ID GDX9110 (stable-fixes).\n- Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table (stable-fixes).\n- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (stable-fixes).\n- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (stable-fixes).\n- Input: stmfts - correct wording for the warning message (git-fixes).\n- Input: stmfts - make comments correct (git-fixes).\n- Input: ti_am335x_tsc - fix off-by-one error in wire_order validation (git-fixes).\n- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (git-fixes).\n- KEYS: trusted_tpm1: Compare HMAC values in constant time (git-fixes).\n- Move upstreamed SCSI patches into sorted section\n- Move upstreamed ath12k patch into sorted section\n- Move upstreamed mm and SCSI patches into sorted section\n- NTB: ntb_transport: Fix too small buffer for debugfs_name (git-fixes).\n- PCI/ACPI: Restrict program_hpx_type2() to AER bits (git-fixes).\n- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (git-fixes).\n- PCI/MSI: Unmap MSI-X region on error (stable-fixes).\n- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (git-fixes).\n- PCI/PM: Avoid redundant delays on D3hot-\u003eD3cold (git-fixes).\n- PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths (git-fixes).\n- PCI/portdrv: Fix potential resource leak (git-fixes).\n- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (git-fixes).\n- PCI: Add ACS quirk for Qualcomm Hamoa \u0026 Glymur (stable-fixes).\n- PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros (stable-fixes).\n- PCI: Add defines for bridge window indexing (stable-fixes).\n- PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value (git-fixes).\n- PCI: Do not attempt to set ExtTag for VFs (git-fixes).\n- PCI: Enable ACS after configuring IOMMU for OF platforms (stable-fixes).\n- PCI: Fix pci_slot_lock () device locking (stable-fixes).\n- PCI: Fix pci_slot_trylock() error handling (git-fixes).\n- PCI: Initialize RCB from pci_configure_device() (git-fixes).\n- PCI: Log bridge info when first enumerating bridge (stable-fixes).\n- PCI: Log bridge windows conditionally (stable-fixes).\n- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (git-fixes).\n- PCI: Mark ASM1164 SATA controller to avoid bus reset (stable-fixes).\n- PCI: Mark Nvidia GB10 to avoid bus reset (stable-fixes).\n- PCI: Move pci_read_bridge_windows() below individual window accessors (stable-fixes).\n- PCI: Supply bridge device, not secondary bus, to read window details (stable-fixes).\n- PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port (stable-fixes).\n- PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition (git-fixes).\n- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (git-fixes).\n- PCI: keystone: Exit ks_pcie_probe() for invalid mode (git-fixes).\n- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (git-fixes).\n- PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2 (git-fixes).\n- PM: runtime: Do not clear needs_force_resume with enabled runtime PM (git-fixes).\n- PM: sleep: wakeirq: Update outdated documentation comments (git-fixes).\n- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (git-fixes).\n- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (git-fixes).\n- USB: Fix descriptor count when handling invalid MBIM extended descriptor (git-fixes).\n- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (stable-fixes).\n- USB: lpc32xx_udc: Fix error handling in probe (git-fixes).\n- USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC (git-fixes).\n- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (stable-fixes).\n- USB: serial: ftdi_sio: add support for u-blox EVK-M101 (stable-fixes).\n- USB: serial: ftdi_sio: match on interface number for jtag (stable-fixes).\n- USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC (git-fixes).\n- USB: serial: option: add Foxconn T99W760 (stable-fixes).\n- USB: serial: option: add Quectel RG255C (stable-fixes).\n- USB: serial: option: add Telit Cinterion FE910C04 new compositions (stable-fixes).\n- USB: serial: option: add Telit FN920C04 ECM compositions (stable-fixes).\n- USB: serial: option: add Telit FN920C04 RNDIS compositions (stable-fixes).\n- USB: serial: option: add Telit LE910 MBIM composition (stable-fixes).\n- USB: serial: option: add UNISOC UIS7720 (stable-fixes).\n- USB: serial: option: add support for Rolling RW101R-GL (stable-fixes).\n- USB: serial: option: move Telit 0x10c7 composition in the right place (stable-fixes).\n- USB: storage: Remove subclass and protocol overrides from Novatek quirk (git-fixes).\n- Update config files: disable CONFIG_DEVPORT for arm64 (bsc#1256792)\n- Workaround for hybrid git workflow in SLFO 1.0/1.1\n- arm64: zynqmp: Fix usb node drive strength and slew rate (git-fixes)\n- arm64: zynqmp: Revert usb node drive strength and slew rate for (git-fixes)\n- ata: libata: Add cpr_log to ata_dev_print_features() early return (git-fixes).\n- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (stable-fixes).\n- ata: pata_ftide010: Fix some DMA timings (git-fixes).\n- atm/fore200e: Fix possible data race in fore200e_open() (git-fixes).\n- atm: Fix dma_free_coherent() size (git-fixes).\n- atm: fore200e: fix use-after-free in tasklets during device removal (git-fixes).\n- atm: idt77252: Add missing `dma_map_error()` (stable-fixes).\n- auxdisplay: arm-charlcd: fix release_mem_region() size (git-fixes).\n- backlight: led-bl: Add devlink to supplier LEDs (git-fixes).\n- backlight: lp855x: Fix lp855x.h kernel-doc warnings (git-fixes).\n- backlight: qcom-wled: Change PM8950 WLED configurations (git-fixes).\n- backlight: qcom-wled: Support ovp values for PMI8994 (git-fixes).\n- bonding: only set speed/duplex to unknown, if getting speed failed (bsc#1253691).\n- bpf/selftests: test_select_reuseport_kern: Remove unused header (bsc#1257603).\n- bpf: Do not let BPF test infra emit invalid GSO types to stack (bsc#1255569).\n- bpf: Reject bpf_timer for PREEMPT_RT (git-fixes).\n- broadcom: b44: prevent uninitialized value usage (git-fixes).\n- bs-upload-kernel: Fix cve branch uploads\n- btrfs: do not strictly require dirty metadata threshold for metadata writepages (stable-fixes).\n- btrfs: make sure extent and csum paths are always released in scrub_raid56_parity_stripe() (git-fixes).\n- btrfs: scrub: always update btrfs_scrub_progress::last_physical (git-fixes).\n- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (stable-fixes).\n- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (git-fixes).\n- bus: fsl-mc: fix use-after-free in driver_override_show() (git-fixes).\n- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit (git-fixes).\n- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (git-fixes).\n- can: etas_es58x: allow partial RX URB allocation to succeed (git-fixes).\n- can: gs_usb: gs_can_open(): fix error handling (git-fixes).\n- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (git-fixes).\n- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (git-fixes).\n- can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs (git-fixes).\n- can: j1939: make j1939_session_activate() fail if device is no longer registered (stable-fixes).\n- can: j1939: make j1939_sk_bind() fail if device is no longer registered (git-fixes).\n- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (git-fixes).\n- can: kvaser_usb: leaf: Fix potential infinite loop in command parsers (git-fixes).\n- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (git-fixes).\n- can: sja1000: fix max irq loop handling (git-fixes).\n- can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling (git-fixes).\n- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (git-fixes).\n- char: applicom: fix NULL pointer dereference in ac_ioctl (stable-fixes).\n- char: tpm: cr50: Remove IRQF_ONESHOT (stable-fixes).\n- cifs: Fix copy offload to flush destination region (bsc#1252511).\n- cifs: Fix flushing, invalidation and file size with copy_file_range() (bsc#1252511).\n- cifs: Fix uncached read into ITER_KVEC iterator (bsc#1245449).\n- cifs: add new field to track the last access time of cfid (git-fixes).\n- cifs: add xid to query server interface call (git-fixes).\n- cifs: after disabling multichannel, mark tcon for reconnect (git-fixes).\n- cifs: avoid redundant calls to disable multichannel (git-fixes).\n- cifs: cifs_pick_channel should try selecting active channels (git-fixes).\n- cifs: deal with the channel loading lag while picking channels (git-fixes).\n- cifs: dns resolution is needed only for primary channel (git-fixes).\n- cifs: do not disable interface polling on failure (git-fixes).\n- cifs: do not search for channel if server is terminating (git-fixes).\n- cifs: fix a pending undercount of srv_count (git-fixes).\n- cifs: fix lock ordering while disabling multichannel (git-fixes).\n- cifs: fix stray unlock in cifs_chan_skip_or_disable (git-fixes).\n- cifs: fix use after free for iface while disabling secondary channels (git-fixes).\n- cifs: handle servers that still advertise multichannel after disabling (git-fixes).\n- cifs: handle when server starts supporting multichannel (git-fixes).\n- cifs: handle when server stops supporting multichannel (git-fixes).\n- cifs: make cifs_chan_update_iface() a void function (git-fixes).\n- cifs: make sure server interfaces are requested only for SMB3+ (git-fixes).\n- cifs: make sure that channel scaling is done only once (git-fixes).\n- cifs: reconnect worker should take reference on server struct unconditionally (git-fixes).\n- cifs: reset connections for all channels when reconnect requested (git-fixes).\n- cifs: reset iface weights when we cannot find a candidate (git-fixes).\n- cifs: serialize other channels when query server interfaces is pending (git-fixes).\n- cifs: update dstaddr whenever channel iface is updated (git-fixes).\n- clk: clk-apple-nco: Add \"apple,t8103-nco\" compatible (git-fixes).\n- clk: mediatek: Fix error handling in runtime PM setup (git-fixes).\n- clk: meson: g12a: Limit the HDMI PLL OD to /4 (git-fixes).\n- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (git-fixes).\n- clk: qcom: camcc-sm6350: Fix PLL config of PLL2 (git-fixes).\n- clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to other (git-fixes).\n- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (git-fixes).\n- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (git-fixes).\n- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (git-fixes).\n- clk: qcom: gfx3d: add parent to parent request map (git-fixes).\n- clk: qcom: rcg2: compute 2d using duty fraction directly (git-fixes).\n- clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback (git-fixes).\n- clk: renesas: r9a06g032: Fix memory leak in error path (git-fixes).\n- clk: renesas: rzg2l: Fix intin variable size (git-fixes).\n- clk: renesas: rzg2l: Select correct div round macro (git-fixes).\n- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (git-fixes).\n- clk: tegra: tegra124-emc: fix device leak on set_rate() (git-fixes).\n- clocksource: Print durations for sync check unconditionally (bsc#1241345).\n- clocksource: Reduce watchdog readout delay limit to prevent false positives (bsc#1241345).\n- comedi: Fix getting range information for subdevices 16 to 255 (git-fixes).\n- comedi: c6xdigio: Fix invalid PNP driver unregistration (git-fixes).\n- comedi: check device's attached status in compat ioctls (git-fixes).\n- comedi: dmm32at: serialize use of paged registers (git-fixes).\n- comedi: fix divide-by-zero in comedi_buf_munge() (stable-fixes).\n- comedi: multiq3: sanitize config options in multiq3_attach() (git-fixes).\n- comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel() (git-fixes).\n- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (git-fixes).\n- cpuidle: menu: Use residency threshold in polling state override decisions (bsc#1255026).\n- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (git-fixes).\n- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (git-fixes).\n- crypto: authencesn - reject too-short AAD (assoclen\u0026lt;8) to match ESP/ESN spec (git-fixes).\n- crypto: cavium - fix dma_free_coherent() size (git-fixes).\n- crypto: ccp - Add an S4 restore flow (git-fixes).\n- crypto: ccree - Correctly handle return of sg_nents_for_len (git-fixes).\n- crypto: hisilicon/qm - restore original qos values (git-fixes).\n- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (git-fixes).\n- crypto: iaa - Fix incorrect return value in save_iaa_wq() (git-fixes).\n- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (git-fixes).\n- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (git-fixes).\n- crypto: octeontx - fix dma_free_coherent() size (git-fixes).\n- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (git-fixes).\n- crypto: qat - fix duplicate restarting msg during AER error (git-fixes).\n- crypto: qat - fix parameter order used in ICP_QAT_FW_COMN_FLAGS_BUILD (git-fixes).\n- crypto: qat - fix warning on adf_pfvf_pf_proto.c (git-fixes).\n- crypto: rockchip - drop redundant crypto_skcipher_ivsize() calls (git-fixes).\n- crypto: seqiv - Do not use req-\u003eiv after crypto_aead_encrypt (git-fixes).\n- crypto: virtio - Add spinlock protection with virtqueue notification (git-fixes).\n- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (git-fixes).\n- device property: Allow secondary lookup in fwnode_get_next_child_node() (git-fixes).\n- dm-integrity: limit MAX_TAG_SIZE to 255 (git-fixes).\n- dm-verity: fix unreliable memory allocation (git-fixes).\n- dm: fix queue start/stop imbalance under suspend/load/resume races (bsc#1253386)\n- dma: dma-axi-dmac: fix SW cyclic transfers (git-fixes).\n- dmaengine: apple-admac: Add \"apple,t8103-admac\" compatible (git-fixes).\n- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (git-fixes).\n- dmaengine: bcm-sba-raid: fix device leak on probe (git-fixes).\n- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (git-fixes).\n- dmaengine: idxd: fix device leaks on compat bind and unbind (git-fixes).\n- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (git-fixes).\n- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (git-fixes).\n- dmaengine: omap-dma: fix dma_pool resource leak in error paths (git-fixes).\n- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (git-fixes).\n- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (git-fixes).\n- dmaengine: sun6i: Choose appropriate burst length under maxburst (stable-fixes).\n- dmaengine: tegra-adma: Fix use-after-free (git-fixes).\n- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (git-fixes).\n- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (git-fixes).\n- dmaengine: ti: k3-udma: fix device leak on udma lookup (git-fixes).\n- dmaengine: xilinx: xdma: Fix regmap max_register (git-fixes).\n- dmaengine: xilinx_dma: Fix uninitialized addr_width when \"xlnx,addrwidth\" property is missing (git-fixes).\n- docs: ABI: sysfs-devices-soc: Fix swapped sample values (git-fixes).\n- docs: fix WARNING document not included in any toctree (stable-fixes).\n- docs: w1: fix w1-netlink invalid URL (git-fixes).\n- dpll: Prevent duplicate registrations (git-fixes).\n- dpll: fix device-id-get and pin-id-get to return errors properly (git-fixes).\n- dpll: fix return value check for kmemdup (git-fixes).\n- dpll: indent DPLL option type by a tab (git-fixes).\n- dpll: spec: add missing module-name and clock-id to pin-get reply (git-fixes).\n- drivers/usb/dwc3: fix PCI parent check (git-fixes).\n- drivers: iio: mpu3050: use dev_err_probe for regulator request (git-fixes).\n- drm/amd/display: Avoid updating surface with the same surface under MPO (stable-fixes).\n- drm/amd/display: Bump the HDMI clock to 340MHz (stable-fixes).\n- drm/amd/display: Check NULL before accessing (stable-fixes).\n- drm/amd/display: Fix DP no audio issue (stable-fixes).\n- drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() (git-fixes).\n- drm/amd/display: Increase DPCD read retries (stable-fixes).\n- drm/amd/display: Move sleep into each retry for retrieve_link_cap() (stable-fixes).\n- drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() (stable-fixes).\n- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (git-fixes).\n- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (git-fixes).\n- drm/amd/pm: Do not clear SI SMC table when setting power limit (git-fixes).\n- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (git-fixes).\n- drm/amd/pm: fix race in power state check before mutex lock (git-fixes).\n- drm/amd: Clean up kfd node on surprise disconnect (stable-fixes).\n- drm/amd: Fix hang on amdgpu unload by using pci_dev_is_disconnected() (git-fixes).\n- drm/amdgpu/gfx10: fix wptr reset in KGQ init (stable-fixes).\n- drm/amdgpu/gfx11: fix wptr reset in KGQ init (stable-fixes).\n- drm/amdgpu/soc21: fix xclk for APUs (stable-fixes).\n- drm/amdgpu: Add HAINAN clock adjustment (stable-fixes).\n- drm/amdgpu: Adjust usleep_range in fence wait (stable-fixes).\n- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (git-fixes).\n- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (git-fixes).\n- drm/amdgpu: Forward VMID reservation errors (git-fixes).\n- drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled (stable-fixes).\n- drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma (git-fixes).\n- drm/amdgpu: add support for HDP IP version 6.1.1 (stable-fixes).\n- drm/amdgpu: avoid a warning in timedout job handler (stable-fixes).\n- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (git-fixes).\n- drm/amdgpu: fix cyan_skillfish2 gpu info fw handling (git-fixes).\n- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (git-fixes).\n- drm/amdgpu: update mappings not managed by KFD (bsc#1255428)\n- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (stable-fixes).\n- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (stable-fixes).\n- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (git-fixes).\n- drm/amdkfd: fix a memory leak in device_queue_manager_init() (git-fixes).\n- drm/amdkfd: fix debug watchpoints for logical devices (stable-fixes).\n- drm/atmel-hlcdc: do not reject the commit if the src rect has fractional parts (stable-fixes).\n- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (stable-fixes).\n- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (stable-fixes).\n- drm/bridge: samsung-dsim: Fix memory leak in error path (git-fixes).\n- drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used (git-fixes).\n- drm/buddy: Prevent BUG_ON by validating rounded allocation (git-fixes).\n- drm/display/dp_mst: Add protection against 0 vcpi (stable-fixes).\n- drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() (git-fixes).\n- drm/i915/acpi: free _DSM package when no connectors (git-fixes).\n- drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer (git-fixes).\n- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (stable-fixes).\n- drm/imx/tve: fix probe device leak (git-fixes).\n- drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse() (git-fixes).\n- drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue (git-fixes).\n- drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse() (git-fixes).\n- drm/mgag200: Fix big-endian support (git-fixes).\n- drm/mgag200: fix mgag200_bmc_stop_scanout() (git-fixes).\n- drm/msm/a2xx: fix pixel shader start on A225 (git-fixes).\n- drm/msm/a2xx: stop over-complaining about the legacy firmware (git-fixes).\n- drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers (git-fixes).\n- drm/msm/a6xx: Flush LRZ cache before PT switch (git-fixes).\n- drm/msm/dpu: Add missing NULL pointer check for pingpong interface (git-fixes).\n- drm/msm/dpu: Remove dead-code in dpu_encoder_helper_reset_mixers() (git-fixes).\n- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (git-fixes).\n- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (git-fixes).\n- drm/nouveau/dispnv50: Do not call drm_atomic_get_crtc_state() in prepare_fb (git-fixes).\n- drm/nouveau: add missing DCB connector types (git-fixes).\n- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (git-fixes).\n- drm/nouveau: restrict the flush page to a 32-bit address (git-fixes).\n- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (git-fixes).\n- drm/panel: sony-td4353-jdi: Enable prepare_prev_first (git-fixes).\n- drm/pl111: Fix error handling in pl111_amba_probe (git-fixes).\n- drm/radeon: Add HAINAN clock adjustment (stable-fixes).\n- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (stable-fixes).\n- drm/radeon: delete radeon_fence_process in is_signaled, no deadlock (stable-fixes).\n- drm/tegra: dsi: fix device leak on probe (git-fixes).\n- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (stable-fixes).\n- drm/tilcdc: request and mapp iomem with devres (stable-fixes).\n- drm/ttm: Avoid NULL pointer deref for evicted BOs (git-fixes).\n- drm/v3d: Set DMA segment size to avoid debug warnings (stable-fixes).\n- drm/vgem-fence: Fix potential deadlock on release (git-fixes).\n- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (git-fixes).\n- drm/vmwgfx: Fix invalid kref_put callback in vmw_bo_dirty_release (git-fixes).\n- drm/vmwgfx: Return the correct value in vmw_translate_ptr functions (git-fixes).\n- drm/vmwgfx: Use kref in vmw_bo_dirty (stable-fixes).\n- drm: Account property blob allocations to memcg (stable-fixes).\n- drm: nouveau: Replace sprintf() with sysfs_emit() (git-fixes).\n- drm: sti: fix device leaks at component probe (git-fixes).\n- efi/libstub: Describe missing 'out' parameter in efi_load_initrd (git-fixes).\n- efi/libstub: Fix page table access in 5-level to 4-level paging transition (git-fixes).\n- efi: Fix reservation of unaccepted memory table (git-fixes).\n- efivarfs: fix error propagation in efivar_entry_get() (git-fixes).\n- exfat: add a check for invalid data size (git-fixes).\n- exfat: using hweight instead of internal logic (git-fixes).\n- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (git-fixes).\n- ext4: use optimized mballoc scanning regardless of inode format (bsc#1254378).\n- ext4: wait for ongoing I/O to complete before freeing blocks (bsc#1256366).\n- fbcon: check return value of con2fb_acquire_newinfo() (git-fixes).\n- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (git-fixes).\n- fbdev: ffb: fix corrupted video output on Sun FFB1 (stable-fixes).\n- fbdev: gbefb: fix to use physical address instead of dma address (stable-fixes).\n- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (git-fixes).\n- fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing (git-fixes).\n- fbdev: rivafb: fix divide error in nv3_arb() (git-fixes).\n- fbdev: smscufx: properly copy ioctl memory to kernelspace (stable-fixes).\n- fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() (git-fixes).\n- fbdev: tcx.c fix mem_map to correct smem_start offset (git-fixes).\n- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (git-fixes).\n- firewire: nosy: Fix dma_free_coherent() size (git-fixes).\n- firmware: imx: scu-irq: Init workqueue before request mbox channel (stable-fixes).\n- firmware: imx: scu-irq: fix OF node leak in (git-fixes).\n- firmware: stratix10-svc: Add mutex in stratix10 memory management (git-fixes).\n- firmware: stratix10-svc: fix bug in saving controller data (git-fixes).\n- firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc (git-fixes).\n- fix it87_wdt early reboot by reporting running timer (stable-fixes).\n- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (git-fixes).\n- fpga: of-fpga-region: Fail if any bridge is missing (stable-fixes).\n- fs: dlm: allow to F_SETLKW getting interrupted (bsc#1255025).\n- genalloc.h: fix htmldocs warning (git-fixes).\n- gpio: aspeed-sgpio: Change the macro to support deferred probe (stable-fixes).\n- gpio: omap: do not register driver in probe() (git-fixes).\n- gpio: pca953x: Add support for level-triggered interrupts (stable-fixes).\n- gpio: pca953x: Utilise dev_err_probe() where it makes sense (stable-fixes).\n- gpio: pca953x: Utilise temporary variable for struct device (stable-fixes).\n- gpio: pca953x: fix wrong error probe return value (git-fixes).\n- gpio: pca953x: handle short interrupt pulses on PCAL devices (git-fixes).\n- gpio: pca953x: mask interrupts in irq shutdown (stable-fixes).\n- gpio: rockchip: Stop calling pinctrl for set_direction (git-fixes).\n- gpio: rockchip: mark the GPIO controller as sleeping (git-fixes).\n- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (stable-fixes).\n- gpu: host1x: Fix race in syncpt alloc/free (git-fixes).\n- hwmon: (f71882fg) Add F81968 support (stable-fixes).\n- hwmon: (ibmpex) fix use-after-free in high/low store (git-fixes).\n- hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced race (git-fixes).\n- hwmon: (max16065) Use local variable to avoid TOCTOU (git-fixes).\n- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (stable-fixes).\n- hwmon: (occ) Mark occ_init_attribute() as __printf (git-fixes).\n- hwmon: (tmp401) fix overflow caused by default conversion rate value (git-fixes).\n- hwmon: (w83791d) Convert macros to functions to avoid TOCTOU (git-fixes).\n- hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU (git-fixes).\n- hwmon: sy7636a: Fix regulator_enable resource leak on error path (git-fixes).\n- i2c: amd-mp2: fix reference leak in MP2 PCI device (git-fixes).\n- i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured firmware (stable-fixes).\n- i2c: i2c.h: fix a bad kernel-doc line (git-fixes).\n- i3c: Move device name assignment after i3c_bus_init (git-fixes).\n- i3c: dw: Initialize spinlock to avoid upsetting lockdep (git-fixes).\n- i3c: fix refcount inconsistency in i3c_master_register (git-fixes).\n- i3c: master: Inherit DMA masks and parameters from parent device (stable-fixes).\n- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (stable-fixes).\n- i3c: master: svc: Prevent incomplete IBI transaction (git-fixes).\n- ice: use netif_get_num_default_rss_queues() (bsc#1247712).\n- idr: fix idr_alloc() returning an ID out of range (git-fixes).\n- iio: Use IRQF_NO_THREAD (stable-fixes).\n- iio: accel: bmc150: Fix irq assumption regression (stable-fixes).\n- iio: accel: fix ADXL355 startup race condition (git-fixes).\n- iio: accel: iis328dq: fix gain values (git-fixes).\n- iio: adc: ad7280a: fix ad7280_store_balance_timer() (git-fixes).\n- iio: adc: ad7280a: handle spi_setup() errors in probe() (git-fixes).\n- iio: adc: ad9467: fix ad9434 vref mask (git-fixes).\n- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (git-fixes).\n- iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains (stable-fixes).\n- iio: core: Clean up device correctly on iio_device_alloc() failure (git-fixes).\n- iio: core: add missing mutex_destroy in iio_dev_release() (git-fixes).\n- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (git-fixes).\n- iio: gyro: itg3200: Fix unchecked return value in read_raw (git-fixes).\n- iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member (git-fixes).\n- iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields (git-fixes).\n- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (git-fixes).\n- iio: magnetometer: Remove IRQF_ONESHOT (stable-fixes).\n- iio: sca3000: Fix a resource leak in sca3000_probe() (git-fixes).\n- iio: st_lsm6dsx: Fixed calibrated timestamp calculation (git-fixes).\n- iio:common:ssp_sensors: Fix an error handling path ssp_probe() (git-fixes).\n- ima: Handle error code returned by ima_filter_rule_match() (git-fixes).\n- intel_th: Fix error handling in intel_th_output_open (git-fixes).\n- intel_th: fix device leak on output open() (git-fixes).\n- iomap: account for unaligned end offsets when truncating read range (git-fixes).\n- ipmi: Fix __scan_channels() failing to rescan channels (stable-fixes).\n- ipmi: Fix handling of messages with provided receive message pointer (git-fixes).\n- ipmi: Fix the race between __scan_channels() and deliver_response() (stable-fixes).\n- ipmi: Rework user message limit handling (git-fixes).\n- ipmi: ipmb: initialise event handler read bytes (git-fixes).\n- irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() (git-fixes).\n- kABI workaround for HCI_LE_ADV_0 addition (git-fixes).\n- kconfig/mconf: Initialize the default locale at startup (stable-fixes).\n- kconfig/nconf: Initialize the default locale at startup (stable-fixes).\n- kernel-binary: Require libdw in Factory Libdw is required for gendwarfksyms\n- kernel-binary: Support building gendwarfksyms on SLE/Leap 15\n- landlock: Optimize file path walks and prepare for audit support (bsc#1255698).\n- leds: led-class: Only Add LED to leds_list when it is fully ready (git-fixes).\n- leds: leds-lp50xx: Allow LED 0 to be added to module bank (git-fixes).\n- leds: leds-lp50xx: Enable chip before any communication (git-fixes).\n- leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs (git-fixes).\n- leds: netxbig: Fix GPIO descriptor leak in error paths (git-fixes).\n- leds: qcom-lpg: Check the return value of regmap_bulk_write() (git-fixes).\n- lib/crypto: aes: Fix missing MMU protection for AES S-box (git-fixes).\n- lib/vsprintf: Check pointer before dereferencing in time_and_date() (git-fixes).\n- mISDN: annotate data-race around dev-\u003ework (git-fixes).\n- mailbox: mailbox-test: Fix debugfs_create_dir error checking (git-fixes).\n- media: TDA1997x: Remove redundant cancel_delayed_work in probe (git-fixes).\n- media: adv7180: fix frame interval in progressive mode (stable-fixes).\n- media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() (git-fixes).\n- media: amphion: Add a frame flush mode for decoder (stable-fixes).\n- media: amphion: Cancel message work before releasing the VPU core (git-fixes).\n- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (stable-fixes).\n- media: amphion: Make some vpu_v4l2 functions static (stable-fixes).\n- media: amphion: Remove vpu_vb_is_codecconfig (git-fixes).\n- media: atomisp: Prefix firmware paths with \"intel/ipu/\" (bsc#1252973).\n- media: atomisp: Remove firmware_name module parameter (bsc#1252973).\n- media: ccs: Accommodate C-PHY into the calculation (git-fixes).\n- media: ccs: Avoid possible division by zero (git-fixes).\n- media: cec: Fix debugfs leak on bus_register() failure (git-fixes).\n- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (git-fixes).\n- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (git-fixes).\n- media: cx25821: Fix a resource leak in cx25821_dev_setup() (stable-fixes).\n- media: cx88: Add missing unmap in snd_cx88_hw_params() (git-fixes).\n- media: dvb-core: dmxdevfilter must always flush bufs (stable-fixes).\n- media: dvb-core: fix wrong reinitialization of ringbuffer on reopen (git-fixes).\n- media: dvb-net: fix OOB access in ULE extension header tables (git-fixes).\n- media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() (git-fixes).\n- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (git-fixes).\n- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (git-fixes).\n- media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe (git-fixes).\n- media: i2c: adv7842: Remove redundant cancel_delayed_work in probe (git-fixes).\n- media: i2c: ov5647: Correct minimum VBLANK value (git-fixes).\n- media: i2c: ov5647: Correct pixel array offset (git-fixes).\n- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (git-fixes).\n- media: i2c: ov5647: Initialize subdev before controls (git-fixes).\n- media: i2c: ov5647: Sensor should report RAW color space (git-fixes).\n- media: i2c: ov5647: use our own mutex for the ctrl lock (git-fixes).\n- media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() (git-fixes).\n- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (git-fixes).\n- media: mtk-mdp: Fix error handling in probe function (git-fixes).\n- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (stable-fixes).\n- media: omap3isp: isppreview: always clamp in preview_try_format() (stable-fixes).\n- media: omap3isp: set initial format (stable-fixes).\n- media: pvrusb2: Fix incorrect variable used in trace message (git-fixes).\n- media: pvrusb2: fix URB leak in pvr2_send_request_ex (stable-fixes).\n- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (git-fixes).\n- media: radio-keene: fix memory leak in error path (git-fixes).\n- media: rc: st_rc: Fix reset control resource leak (git-fixes).\n- media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled (git-fixes).\n- media: rkisp1: Fix filter mode register configuration (stable-fixes).\n- media: samsung: exynos4-is: fix potential ABBA deadlock on init (git-fixes).\n- media: solo6x10: Check for out of bounds chip_id (stable-fixes).\n- media: uvcvideo: Fix allocation for small frame sizes (git-fixes).\n- media: v4l2-mem2mem: Fix outdated documentation (git-fixes).\n- media: venus: vdec: fix error state assignment for zero bytesused (git-fixes).\n- media: verisilicon: Fix CPU stalls on G2 bus error (git-fixes).\n- media: verisilicon: Protect G2 HEVC decoder against invalid DPB index (git-fixes).\n- media: verisilicon: Store chroma and motion vectors offset (stable-fixes).\n- media: verisilicon: g2: Use common helpers to compute chroma and mv offsets (stable-fixes).\n- media: videobuf2: Fix device reference leak in vb2_dc_alloc error path (git-fixes).\n- media: vidtv: initialize local pointers upon transfer of memory ownership (git-fixes).\n- media: vpif_capture: fix section mismatch (git-fixes).\n- media: vpif_display: fix section mismatch (git-fixes).\n- mei: me: add nova lake point S DID (stable-fixes).\n- mei: me: add wildcat lake P DID (stable-fixes).\n- mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup (git-fixes).\n- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (git-fixes).\n- mfd: core: Add locking around 'mfd_of_node_list' (git-fixes).\n- mfd: da9055: Fix missing regmap_del_irq_chip() in error path (git-fixes).\n- mfd: max77620: Fix potential IRQ chip conflict when probing two devices (git-fixes).\n- mfd: mt6358-irq: Fix missing irq_domain_remove() in error path (git-fixes).\n- mfd: mt6397-irq: Fix missing irq_domain_remove() in error path (git-fixes).\n- mfd: tps6105x: Fix kernel-doc warnings relating to the core struct and tps6105x_mode (git-fixes).\n- mfd: wm8350-core: Use IRQF_ONESHOT (git-fixes).\n- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (stable-fixes).\n- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (stable-fixes).\n- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (bsc#1254447 bsc#1253087).\n- mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() (git-fixes).\n- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (git-fixes).\n- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (git-fixes).\n- mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig (git-fixes).\n- mmc: sdhci-msm: Avoid early clock doubling during HS400 transition (stable-fixes).\n- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (git-fixes).\n- most: usb: fix double free on late probe failure (git-fixes).\n- mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() (git-fixes).\n- mtd: lpddr_cmds: fix signed shifts in lpddr_cmds (git-fixes).\n- mtd: maps: pcmciamtd: fix potential memory leak in pcmciamtd_detach() (git-fixes).\n- mtd: nand: relax ECC parameter validation check (git-fixes).\n- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (git-fixes).\n- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (git-fixes).\n- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (git-fixes).\n- mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove (git-fixes).\n- mtd: rawnand: pl353: Fix software ECC support (git-fixes).\n- mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors (git-fixes).\n- mtd: spinand: Fix kernel doc (git-fixes).\n- myri10ge: avoid uninitialized variable use (stable-fixes).\n- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (git-fixes).\n- net: hv_netvsc: reject RSS hash key programming without RX indirection table (bsc#1257473).\n- net: mdio: aspeed: add dummy read to avoid read-after-write issue (git-fixes).\n- net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write (git-fixes).\n- net: nfc: nci: Fix parameter validation for packet data (git-fixes).\n- net: phy: adin1100: Fix software power-down ready condition (git-fixes).\n- net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY (git-fixes).\n- net: phy: mxl-gpy: fix link properties on USXGMII and internal PHYs (git-fixes).\n- net: rose: fix invalid array index in rose_kill_by_device() (git-fixes).\n- net: tcp: allow zero-window ACK update the window (bsc#1254767).\n- net: usb: catc: enable basic endpoint checking (git-fixes).\n- net: usb: dm9601: remove broken SR9700 support (git-fixes).\n- net: usb: kalmia: validate USB endpoints (git-fixes).\n- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (git-fixes).\n- net: usb: kaweth: validate USB endpoints (git-fixes).\n- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (git-fixes).\n- net: usb: pegasus: enable basic endpoint checking (git-fixes).\n- net: usb: pegasus: fix memory leak in update_eth_regs_async() (git-fixes).\n- net: usb: r8152: fix transmit queue timeout (stable-fixes).\n- net: usb: rtl8150: fix memory leak on usb_submit_urb() failure (git-fixes).\n- net: usb: sr9700: fix incorrect command used to write single register (git-fixes).\n- net: usb: sr9700: remove code to drive nonexistent multicast filter (stable-fixes).\n- net: usb: sr9700: support devices with virtual driver CD (stable-fixes).\n- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (git-fixes).\n- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (git-fixes).\n- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (git-fixes).\n- net: wwan: t7xx: fix potential skb-\u003efrags overflow in RX path (git-fixes).\n- nfc: hci: shdlc: Stop timers and work before freeing context (git-fixes).\n- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame() (git-fixes).\n- nfc: nci: Fix race between rfkill and nci_unregister_device() (git-fixes).\n- nfc: nxp-nci: remove interrupt trigger type (stable-fixes).\n- nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() (git-fixes).\n- nfc: pn533: properly drop the usb interface reference on disconnect (git-fixes).\n- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (stable-fixes).\n- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (stable-fixes).\n- nvme: Use non zero KATO for persistent discovery connections (git-fixes).\n- of: fix reference count leak in of_alias_scan() (git-fixes).\n- of: platform: Use default match table for /firmware (git-fixes).\n- orangefs: fix xattr related buffer overflow.. (git-fixes).\n- phy: broadcom: bcm63xx-usbh: fix section mismatches (git-fixes).\n- phy: freescale: imx8m-pcie: assert phy reset during power on (stable-fixes).\n- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (stable-fixes).\n- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (stable-fixes).\n- phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe() (git-fixes).\n- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (git-fixes).\n- phy: rockchip: inno-usb2: fix disconnection in gadget mode (git-fixes).\n- phy: stm32-usphyc: Fix off by one in probe() (git-fixes).\n- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (git-fixes).\n- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (git-fixes).\n- pinctrl: meson: mark the GPIO controller as sleeping (git-fixes).\n- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (git-fixes).\n- pinctrl: qcom: msm: Fix deadlock in pinmux configuration (stable-fixes).\n- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (git-fixes).\n- pinctrl: single: Fix PIN_CONFIG_BIAS_DISABLE handling (stable-fixes).\n- pinctrl: single: Fix incorrect type for error return variable (git-fixes).\n- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (git-fixes).\n- pinctrl: stm32: fix hwspinlock resource leak in probe function (git-fixes).\n- platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver (git-fixes).\n- platform/chrome: cros_ec_lightbar: Fix response size initialization (git-fixes).\n- platform/chrome: cros_typec_switch: Do not touch struct fwnode_handle::dev (git-fixes).\n- platform/mellanox: mlxbf-pmc: Remove trailing whitespaces from event names (git-fixes).\n- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (stable-fixes).\n- platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally (stable-fixes).\n- platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list (stable-fixes).\n- platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks (stable-fixes).\n- platform/x86: acer-wmi: Ignore backlight event (stable-fixes).\n- platform/x86: asus-wmi: use brightness_set_blocking() for kbd led (git-fixes).\n- platform/x86: classmate-laptop: Add missing NULL pointer checks (stable-fixes).\n- platform/x86: huawei-wmi: add keys for HONOR models (stable-fixes).\n- platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic (git-fixes).\n- platform/x86: intel: chtwc_int33fe: do not dereference swnode args (git-fixes).\n- platform/x86: intel: punit_ipc: fix memory corruption (git-fixes).\n- platform/x86: intel_telemetry: Fix PSS event register mask (git-fixes).\n- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (git-fixes).\n- platform/x86: msi-laptop: add missing sysfs_remove_group() (git-fixes).\n- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (stable-fixes).\n- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (git-fixes).\n- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (git-fixes).\n- power: supply: ab8500: Fix use-after-free in power_supply_changed() (git-fixes).\n- power: supply: act8945a: Fix use-after-free in power_supply_changed() (git-fixes).\n- power: supply: apm_power: only unset own apm_get_power_status (git-fixes).\n- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (git-fixes).\n- power: supply: bq25980: Fix use-after-free in power_supply_changed() (git-fixes).\n- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (git-fixes).\n- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (git-fixes).\n- power: supply: cw2015: Check devm_delayed_work_autocancel() return code (git-fixes).\n- power: supply: goldfish: Fix use-after-free in power_supply_changed() (git-fixes).\n- power: supply: qcom_battmgr: Recognize \"LiP\" as lithium-polymer (git-fixes).\n- power: supply: rt9455: Fix use-after-free in power_supply_changed() (git-fixes).\n- power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges() (git-fixes).\n- power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges() (git-fixes).\n- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (git-fixes).\n- power: supply: wm831x: Check wm831x_set_bits() return value (git-fixes).\n- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (git-fixes).\n- powercap: fix race condition in register_control_type() (stable-fixes).\n- powercap: fix sscanf() error return value handling (stable-fixes).\n- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (git-fixes).\n- powerpc/64s/slb: Fix SLB multihit issue during SLB preload (bac#1236022 ltc#211187).\n- powerpc/addnote: Fix overflow on 32-bit builds (bsc#1215199).\n- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (bsc#1253262 ltc#216029).\n- powerpc/kexec: Enable SMT before waking offline CPUs (bsc#1214285 bsc#1205462 bsc#1253739 bsc#1254244).\n- pwm: bcm2835: Make sure the channel is enabled after pwm_request() (git-fixes).\n- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (git-fixes).\n- regmap: Fix race condition in hwspinlock irqsave routine (git-fixes).\n- regmap: maple: free entry on mas_store_gfp() failure (stable-fixes).\n- regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex (git-fixes).\n- regulator: core: disable supply if enabling main regulator fails (git-fixes).\n- regulator: core: fix locking in regulator_resolve_supply() error path (git-fixes).\n- regulator: core: move supply check earlier in set_machine_constraints() (git-fixes).\n- remove a bpf CVE change which is already part of the base kernel\n- remove an Intel CPU model change which is already part of the base kernel\n- reset: fix BIT macro reference (stable-fixes).\n- rpm/mkspec-dtb: add riscv64 dtb-thead subpackage\n- rpmsg: core: fix race in driver_override_show() and use core helper (git-fixes).\n- rpmsg: glink: fix rpmsg device leak (git-fixes).\n- rtc: gamecube: Check the return value of ioremap() (git-fixes).\n- rtc: interface: Alarm race handling should not discard preceding error (git-fixes).\n- rtc: zynqmp: correct frequency value (stable-fixes).\n- sched: Increase sched_tick_remote timeout (bsc#1254510).\n- scripts/python/git_sort/git_sort.yaml: add cifs for-next repository\n- scripts: obsapi: Support URL trailing / in oscrc\n- scripts: teaapi: Add paging\n- scripts: uploader: Fix no change condition for _maintainership.json\n- scripts: uploader: Handle missing upstream in is_pr_open\n- scrits: teaapi: Add list_repos\n- scsi: lpfc: Add capability to register Platform Name ID to fabric (bsc#1254119).\n- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (bsc#1254119).\n- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (bsc#1254119).\n- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (bsc#1254119).\n- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (bsc#1254119).\n- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (bsc#1254119).\n- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (bsc#1254119).\n- scsi: lpfc: Revise discovery related function headers and comments (bsc#1254119).\n- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (bsc#1256861).\n- scsi: lpfc: Update lpfc version to 14.4.0.12 (bsc#1254119).\n- scsi: lpfc: Update lpfc version to 14.4.0.13 (bsc#1256861).\n- scsi: lpfc: Update various NPIV diagnostic log messaging (bsc#1254119).\n- scsi: qla2xxx: Add Speed in SFP print information (bsc#1256863).\n- scsi: qla2xxx: Add bsg interface to support firmware img validation (bsc#1256863).\n- scsi: qla2xxx: Add load flash firmware mailbox support for 28xxx (bsc#1256863).\n- scsi: qla2xxx: Add support for 64G SFP speed (bsc#1256863).\n- scsi: qla2xxx: Allow recovery for tape devices (bsc#1256863).\n- scsi: qla2xxx: Delay module unload while fabric scan in progress (bsc#1256863).\n- scsi: qla2xxx: Fix bsg_done() causing double free (bsc#1256863).\n- scsi: qla2xxx: Free sp in error path to fix system crash (bsc#1256863).\n- scsi: qla2xxx: Query FW again before proceeding with login (bsc#1256863).\n- scsi: qla2xxx: Update version to 10.02.10.100-k (bsc#1256863).\n- scsi: qla2xxx: Validate MCU signature before executing MBC 03h (bsc#1256863).\n- scsi: qla2xxx: Validate sp before freeing associated memory (bsc#1256863).\n- scsi: storvsc: Process unsupported MODE_SENSE_10 (bsc#1257296).\n- selftests/bpf: Skip timer cases when bpf_timer is not supported (git-fixes).\n- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (stable-fixes).\n- serial: 8250_dw: handle clock enable errors in runtime_resume (stable-fixes).\n- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (git-fixes).\n- serial: SH_SCI: improve \"DMA support\" prompt (git-fixes).\n- serial: add support of CPCI cards (stable-fixes).\n- serial: amba-pl011: prefer dma_mapping_error() over explicit address checking (git-fixes).\n- serial: imx: change SERIAL_IMX_CONSOLE to bool (git-fixes).\n- serial: sprd: Return -EPROBE_DEFER when uart clock is not ready (stable-fixes).\n- shrink_slab_memcg: clear_bits of skipped shrinkers (bsc#1256564).\n- slimbus: core: fix OF node leak on registration failure (git-fixes).\n- slimbus: core: fix device reference leak on report present (git-fixes).\n- slimbus: core: fix of_slim_get_device() kernel doc (git-fixes).\n- slimbus: core: fix runtime PM imbalance on report present (git-fixes).\n- slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves (git-fixes).\n- smb3: add missing null server pointer check (git-fixes).\n- smb: change return type of cached_dir_lease_break() to bool (git-fixes).\n- smb: client: ensure open_cached_dir_by_dentry() only returns valid cfid (git-fixes).\n- smb: client: fix cifs_pick_channel when channel needs reconnect (git-fixes).\n- smb: client: fix warning when reconnecting channel (git-fixes).\n- smb: client: introduce close_cached_dir_locked() (git-fixes).\n- smb: client: remove unused fid_lock (git-fixes).\n- smb: client: short-circuit in open_cached_dir_by_dentry() if !dentry (git-fixes).\n- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (bsc#1250748,bsc#1257154).\n- smb: client: update cfid-\u003elast_access_time in open_cached_dir_by_dentry() (git-fixes).\n- smb: improve directory cache reuse for readdir operations (bsc#1252712).\n- smc91x: fix broken irq-context in PREEMPT_RT (git-fixes).\n- soc/tegra: fuse: speedo-tegra210: Update speedo IDs (git-fixes).\n- soc: amlogic: canvas: fix device leak on lookup (git-fixes).\n- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (git-fixes).\n- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (git-fixes).\n- soc: qcom: ocmem: fix device leak on lookup (git-fixes).\n- soc: qcom: smem: fix hwspinlock resource leak in probe error paths (git-fixes).\n- soc: qcom: smem: handle ENOMEM error during probe (git-fixes).\n- soc: ti: k3-socinfo: Fix regmap leak on probe failure (git-fixes).\n- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (git-fixes).\n- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (stable-fixes).\n- spi-geni-qcom: initialize mode related registers to 0 (stable-fixes).\n- spi-geni-qcom: use xfer-\u003ebits_per_word for can_dma() (stable-fixes).\n- spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors (git-fixes).\n- spi: bcm63xx: drop wrong casts in probe() (git-fixes).\n- spi: bcm63xx: fix premature CS deassertion on RX-only transactions (git-fixes).\n- spi: fsl-cpm: Check length parity before switching to 16 bit mode (git-fixes).\n- spi: imx: keep dma request disabled before dma transfer setup (stable-fixes).\n- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (stable-fixes).\n- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (stable-fixes).\n- spi: spi-sprd-adi: Fix double free in probe error path (git-fixes).\n- spi: sprd-adi: switch to use spi_alloc_host() (stable-fixes).\n- spi: sprd: adi: Use devm_register_restart_handler() (stable-fixes).\n- spi: stm32: fix Overrun issue at \u0026lt; 8bpw (stable-fixes).\n- spi: tegra114: Preserve SPI mode bits in def_command1_reg (git-fixes).\n- spi: tegra210-qspi: Remove cache operations (git-fixes)\n- spi: tegra210-quad: Add support for internal DMA (git-fixes)\n- spi: tegra210-quad: Check hardware status on timeout (bsc#1253155)\n- spi: tegra210-quad: Fix timeout handling (bsc#1253155)\n- spi: tegra210-quad: Fix timeout handling (git-fixes).\n- spi: tegra210-quad: Move curr_xfer read inside spinlock (bsc#1257952)\n- spi: tegra210-quad: Move curr_xfer read inside spinlock (git-fixes).\n- spi: tegra210-quad: Protect curr_xfer assignment in (bsc#1257952)\n- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (git-fixes).\n- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (bsc#1257952)\n- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (git-fixes).\n- spi: tegra210-quad: Protect curr_xfer clearing in (bsc#1257952)\n- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (git-fixes).\n- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (bsc#1257952)\n- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (git-fixes).\n- spi: tegra210-quad: Refactor error handling into helper functions (bsc#1253155)\n- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed (bsc#1257952)\n- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (git-fixes).\n- spi: tegra210-quad: Update dummy sequence configuration (git-fixes)\n- spi: tegra: Fix a memory leak in tegra_slink_probe() (git-fixes).\n- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (git-fixes).\n- spi: wpcm-fiu: Fix uninitialized res (git-fixes).\n- spi: wpcm-fiu: Simplify with dev_err_probe() (stable-fixes).\n- spi: wpcm-fiu: Use devm_platform_ioremap_resource_byname() (stable-fixes).\n- spi: xilinx: increase number of retries before declaring stall (stable-fixes).\n- staging: fbtft: core: fix potential memory leak in fbtft_probe_common() (git-fixes).\n- staging: rtl8723bs: fix memory leak on failure path (stable-fixes).\n- staging: rtl8723bs: fix null dereference in find_network (git-fixes).\n- staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing (stable-fixes).\n- staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser (stable-fixes).\n- supported.conf: Mark lan 743x supported (jsc#PED-14571)\n- thermal: int340x: Fix sysfs group leak on DLVR registration failure (stable-fixes).\n- thunderbolt: Add support for Intel Wildcat Lake (stable-fixes).\n- tools/power cpupower: Reset errno before strtoull() (stable-fixes).\n- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (git-fixes).\n- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (git-fixes).\n- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (git-fixes).\n- tracing: Fix access to trace_event_file (bsc#1254373).\n- uacce: ensure safe queue release with state management (git-fixes).\n- uacce: fix cdev handling in the cleanup path (git-fixes).\n- uacce: fix isolate sysfs check condition (git-fixes).\n- uacce: implement mremap in uacce_vm_ops to return -EPERM (git-fixes).\n- uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe (git-fixes).\n- usb: bdc: fix sleep during atomic (git-fixes).\n- usb: cdns3: Fix double resource release in cdns3_pci_probe (git-fixes).\n- usb: chaoskey: fix locking for O_NONBLOCK (git-fixes).\n- usb: chipidea: udc: limit usb request length to max 16KB (stable-fixes).\n- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (stable-fixes).\n- usb: dwc2: disable platform lowlevel hw resources during shutdown (stable-fixes).\n- usb: dwc2: fix hang during shutdown if set as peripheral (git-fixes).\n- usb: dwc2: fix hang during suspend if set as peripheral (git-fixes).\n- usb: dwc2: fix resume failure if dr_mode is host (git-fixes).\n- usb: dwc3: Abort suspend on soft disconnect failure (git-fixes).\n- usb: dwc3: Check for USB4 IP_NAME (stable-fixes).\n- usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (git-fixes).\n- usb: dwc3: keep susphy enabled during exit to avoid controller faults (git-fixes).\n- usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe (git-fixes).\n- usb: dwc3: pci: Sort out the Intel device IDs (stable-fixes).\n- usb: dwc3: pci: add support for the Intel Nova Lake -S (stable-fixes).\n- usb: gadget: configfs: Correctly set use_os_string at bind (git-fixes).\n- usb: gadget: f_eem: Fix memory leak in eem_unwrap (git-fixes).\n- usb: gadget: lpc32xx_udc: fix clock imbalance in error path (git-fixes).\n- usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors (git-fixes).\n- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (git-fixes).\n- usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt (git-fixes).\n- usb: ohci-nxp: Use helper function devm_clk_get_enabled() (stable-fixes).\n- usb: ohci-nxp: fix device leak on probe failure (git-fixes).\n- usb: phy: Initialize struct usb_phy list_head (git-fixes).\n- usb: phy: isp1301: fix non-OF device reference imbalance (git-fixes).\n- usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE (git-fixes).\n- usb: raw-gadget: do not limit transfer length (git-fixes).\n- usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() (git-fixes).\n- usb: storage: Fix memory leak in USB bulk transport (git-fixes).\n- usb: storage: sddr55: Reject out-of-bound new_pba (stable-fixes).\n- usb: typec: tipd: Clear interrupts first (git-fixes).\n- usb: typec: ucsi: Handle incorrect num_connectors capability (stable-fixes).\n- usb: typec: ucsi: psy: Set max current to zero when disconnected (git-fixes).\n- usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer (git-fixes).\n- usb: udc: Add trace event for usb_gadget_set_state (stable-fixes).\n- usb: usb-storage: Maintain minimal modifications to the bcdDevice range (git-fixes).\n- usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive (stable-fixes).\n- usb: vhci-hcd: Prevent suspending virtually attached devices (git-fixes).\n- usb: xhci: limit run_graceperiod for only usb 3.0 devices (stable-fixes).\n- usbip: Fix locking bug in RT-enabled kernels (stable-fixes).\n- usbnet: limit max_mtu based on device's hard_mtu (git-fixes).\n- via_wdt: fix critical boot hang due to unnamed resource allocation (stable-fixes).\n- virtio_console: fix order of fields cols and rows (stable-fixes).\n- w1: fix redundant counter decrement in w1_attach_slave_device() (git-fixes).\n- w1: therm: Fix off-by-one buffer overflow in alarms_store (git-fixes).\n- watchdog: imx7ulp_wdt: handle the nowayout option (stable-fixes).\n- watchdog: wdat_wdt: Fix ACPI table leak in probe function (git-fixes).\n- wifi: ath10k: fix dma_free_coherent() pointer (git-fixes).\n- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (stable-fixes).\n- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (git-fixes).\n- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (stable-fixes).\n- wifi: ath11k: fix peer HE MCS assignment (git-fixes).\n- wifi: ath11k: restore register window after global reset (git-fixes).\n- wifi: ath12k: fix dma_free_coherent() pointer (git-fixes).\n- wifi: ath12k: fix preferred hardware mode calculation (stable-fixes).\n- wifi: ath9k: debug.h: fix kernel-doc bad lines and struct ath_tx_stats (git-fixes).\n- wifi: ath9k: fix kernel-doc warnings in common-debug.h (git-fixes).\n- wifi: avoid kernel-infoleak from struct iw_point (git-fixes).\n- wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet (stable-fixes).\n- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (stable-fixes).\n- wifi: cfg80211: Fix use_for flag update on BSS refresh (git-fixes).\n- wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() (git-fixes).\n- wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() (git-fixes).\n- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (git-fixes).\n- wifi: cfg80211: wext: fix IGTK key ID off-by-one (git-fixes).\n- wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() (git-fixes).\n- wifi: ieee80211: correct FILS status codes (git-fixes).\n- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (stable-fixes).\n- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (stable-fixes).\n- wifi: iwlwifi: mvm: check the validity of noa_len (stable-fixes).\n- wifi: libertas: fix WARNING in usb_tx_block (stable-fixes).\n- wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration (git-fixes).\n- wifi: mac80211: collect station statistics earlier when disconnect (stable-fixes).\n- wifi: mac80211: correctly check if CSA is active (stable-fixes).\n- wifi: mac80211: correctly decode TTLM with default link map (git-fixes).\n- wifi: mac80211: do not increment crypto_tx_tailroom_needed_cnt twice (stable-fixes).\n- wifi: mac80211: do not use old MBSSID elements (git-fixes).\n- wifi: mac80211: fix CMAC functions not handling errors (git-fixes).\n- wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() (git-fixes).\n- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (stable-fixes).\n- wifi: mac80211: restore non-chanctx injection behaviour (git-fixes).\n- wifi: mt76: Fix DTS power-limits on little endian systems (git-fixes).\n- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (git-fixes).\n- wifi: nl80211: vendor-cmd: intel: fix a blank kernel-doc line warning (git-fixes).\n- wifi: radiotap: reject radiotap with unknown bits (git-fixes).\n- wifi: rsi: Fix memory corruption due to not set vif driver data size (git-fixes).\n- wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() (git-fixes).\n- wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() (git-fixes).\n- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (git-fixes).\n- wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() (git-fixes).\n- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (stable-fixes).\n- wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1 (stable-fixes).\n- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (git-fixes).\n- wifi: rtw88: fix DTIM period handling when conf-\u003edtim_period is zero (stable-fixes).\n- wifi: rtw88: limit indirect IO under powered off for RTL8822CS (git-fixes).\n- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (stable-fixes).\n- wifi: rtw89: pci: restore LDO setting after device resume (stable-fixes).\n- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (stable-fixes).\n- wifi: wlcore: ensure skb headroom before skb_push (stable-fixes).\n- workqueue: mark power efficient workqueue as unbounded if (bsc#1257891)\n- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (git-fixes).\n- x86/microcode/AMD: Add TSA microcode SHAs (bsc#1256528).\n- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (bsc#1256528).\n- x86/microcode/AMD: Add more known models to entry sign checking (bsc#1256528).\n- x86/microcode/AMD: Add some forgotten models to the SHA check (bsc#1256528).\n- x86/microcode/AMD: Clean the cache if update did not load microcode (bsc#1256528).\n- x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (bsc#1256528).\n- x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (bsc#1256528).\n- x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (bsc#1256528).\n- x86/microcode/AMD: Limit Entrysign signature checking to known generations (bsc#1256528).\n- x86/microcode/AMD: Load only SHA256-checksummed patches (bsc#1256528).\n- x86/microcode/AMD: Select which microcode patch to load (bsc#1256528).\n- x86/microcode/AMD: Use sha256() instead of init/update/final (bsc#1256528).\n- x86/microcode: Fix Entrysign revision check for Zen1/Naples (bsc#1256528).\n- x86: make page fault handling disable interrupts properly (git-fixes).\n- xhci: dbgtty: fix device unregister (git-fixes).\n","status":"published","published":"2026-03-24T16:48:29Z","modified":"2026-03-31T17:23:42.028094Z","updated_at":"2026-11-02T15:54:01.953589Z"}]}}