{"id":"CVE-2024-26697","aliases":["BELL-CVE-2024-26697","CLSA-2024-1716269479","CLSA-2024-1716269925","CLSA-2024-1716270232","CLSA-2024-1716270655","CLSA-2024-1716270851","DEBIAN-CVE-2024-26697","DLA-3840-1","DLA-3842-1","DSA-5681-1","EUVD-2024-23959","GHSA-xg7r-7865-v6c7","OESA-2024-1617","OESA-2024-1618","OESA-2024-1622","OESA-2024-1647","OESA-2024-1648","OESA-2024-1649","SUSE-SU-2024:1490-1","SUSE-SU-2024:1659-1","SUSE-SU-2024:1663-1","SUSE-SU-2024:2135-1","UBUNTU-CVE-2024-26697","USN-6766-1","USN-6766-2","USN-6766-3","USN-6767-1","USN-6767-2","USN-6795-1","USN-6828-1","USN-6895-1","USN-6895-2","USN-6895-3","USN-6895-4","USN-6900-1"],"status":"published","title":"nilfs2: fix data corruption in dsync block recovery for small block sizes","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix data corruption in dsync block recovery for small block sizes\n\nThe helper function nilfs_recovery_copy_block() of\nnilfs_recovery_dsync_blocks(), which recovers data from logs created by\ndata sync writes during a mount after an unclean shutdown, incorrectly\ncalculates the on-page offset when copying repair data to the file's page\ncache.  In environments where the block size is smaller than the page\nsize, this flaw can cause data corruption and leak uninitialized memory\nbytes during the recovery process.\n\nFix these issues by correcting this byte offset calculation on the page.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00263,"percentile":0.18198,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2024-04-03T14:54:57Z","modified":"2026-11-11T09:38:13Z","fixes":[{"ecosystem":"Alpaquita:23","package":"linux-lts","fixed_in":["6.1.81-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"linux-lts","fixed_in":["6.12.41-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"linux-lts","fixed_in":["6.12.41-r0"],"sources":["osv"]},{"ecosystem":"Linux","package":"Kernel","fixed_in":["4.19.307","5.4.269","5.10.210","5.15.149","6.1.79","6.6.18","6.7.6"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"linux","fixed_in":["6.1.82-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["6.7.7-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["6.7.7-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-aws-5.4","fixed_in":["5.4.0-1124.134~18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-azure-5.4","fixed_in":["5.4.0-1129.136~18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-gcp-5.4","fixed_in":["5.4.0-1128.137~18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-hwe-5.4","fixed_in":["5.4.0-181.201~18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-ibm-5.4","fixed_in":["5.4.0-1071.76~18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-oracle-5.4","fixed_in":["5.4.0-1123.132~18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-raspi-5.4","fixed_in":["5.4.0-1108.120~18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux","fixed_in":["5.4.0-181.201"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws","fixed_in":["5.4.0-1124.134"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.15","fixed_in":["5.15.0-1061.67~20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure","fixed_in":["5.4.0-1129.136"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.15","fixed_in":["5.15.0-1063.72~20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-bluefield","fixed_in":["5.4.0-1084.91"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp","fixed_in":["5.4.0-1128.137"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.15","fixed_in":["5.15.0-1059.67~20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop","fixed_in":["5.4.0-1091.95"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop-5.15","fixed_in":["5.15.0-1044.51~20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.15","fixed_in":["5.15.0-106.116~20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-ibm","fixed_in":["5.4.0-1071.76"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-ibm-5.15","fixed_in":["5.15.0-1054.57~20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-intel-iotg-5.15","fixed_in":["5.15.0-1058.64~20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-iot","fixed_in":["5.4.0-1036.37"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-kvm","fixed_in":["5.4.0-1112.119"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-lowlatency-hwe-5.15","fixed_in":["5.15.0-106.116~20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-nvidia-tegra-5.15","fixed_in":["5.15.0-1027.27~20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle","fixed_in":["5.4.0-1123.132"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.15","fixed_in":["5.15.0-1059.65~20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi","fixed_in":["5.4.0-1108.120"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.15","fixed_in":["5.15.0-1057.61~20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-xilinx-zynqmp","fixed_in":["5.4.0-1043.47"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:20.04:LTS","package":"linux-aws-fips","fixed_in":["5.4.0-1124.134+fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:20.04:LTS","package":"linux-azure-fips","fixed_in":["5.4.0-1129.136+fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:20.04:LTS","package":"linux-fips","fixed_in":["5.4.0-1098.108"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:20.04:LTS","package":"linux-gcp-fips","fixed_in":["5.4.0-1128.137+fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux","fixed_in":["5.15.0-106.116"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws","fixed_in":["5.15.0-1061.67"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.5","fixed_in":["6.5.0-1023.23~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure","fixed_in":["5.15.0-1063.72"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.5","fixed_in":["6.5.0-1024.25~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde","fixed_in":["5.15.0-1063.72.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp","fixed_in":["5.15.0-1059.67"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.5","fixed_in":["6.5.0-1024.26~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-gke","fixed_in":["5.15.0-1058.63"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-gkeop","fixed_in":["5.15.0-1044.51"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.5","fixed_in":["6.5.0-44.44~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-ibm","fixed_in":["5.15.0-1054.57"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-intel-iotg","fixed_in":["5.15.0-1057.63"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-kvm","fixed_in":["5.15.0-1058.63"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency","fixed_in":["5.15.0-106.116"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.5","fixed_in":["6.5.0-44.44.1~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia","fixed_in":["5.15.0-1054.55"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.5","fixed_in":["6.5.0-1023.24"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-tegra","fixed_in":["5.15.0-1026.26"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-tegra-igx","fixed_in":["5.15.0-1015.15"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.5","fixed_in":["6.5.0-1027.28"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle","fixed_in":["5.15.0-1059.65"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.5","fixed_in":["6.5.0-1026.26~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-raspi","fixed_in":["5.15.0-1054.57"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.5","fixed_in":["6.5.0-1017.18~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-xilinx-zynqmp","fixed_in":["5.15.0-1030.34"],"sources":["osv"]},{"ecosystem":"Ubuntu:Nvidia-BlueField:22.04:LTS","package":"linux-bluefield","fixed_in":["5.15.0-1043.45"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:Realtime:22.04:LTS","package":"linux-intel-iot-realtime","fixed_in":["5.15.0-1054.56"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:Realtime:22.04:LTS","package":"linux-realtime","fixed_in":["5.15.0-1062.70"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"linux-aws-fips","fixed_in":["5.15.0-1061.67+fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"linux-azure-fips","fixed_in":["5.15.0-1063.72+fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"linux-fips","fixed_in":["5.15.0-106.116+fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"linux-gcp-fips","fixed_in":["5.15.0-1059.67+fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-raspi-realtime","fixed_in":["6.8.0-2001.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:23","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.74-r0"},{"fixed":"6.1.81-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.6.89-r0"},{"fixed":"6.12.41-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.6.100-r0"},{"fixed":"6.12.41-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-buildinfo-4.4.0-256-tuxcare.els27-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-buildinfo-4.4.0-256-tuxcare.els27-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-cloud-tools-4.4.0-256-tuxcare.els27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-cloud-tools-4.4.0-256-tuxcare.els27-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-cloud-tools-4.4.0-256-tuxcare.els27-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-cloud-tools-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-cloud-tools-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0.256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-cloud-tools-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0.256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-crashdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0.256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0.256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-headers-4.4.0-256-tuxcare.els27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-headers-4.4.0-256-tuxcare.els27-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-headers-4.4.0-256-tuxcare.els27-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-headers-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0.256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-headers-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0.256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-image-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0.256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-image-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0.256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-image-unsigned-4.4.0-256-tuxcare.els27-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-image-unsigned-4.4.0-256-tuxcare.els27-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-libc-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0.256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-modules-4.4.0-256-tuxcare.els27-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-modules-4.4.0-256-tuxcare.els27-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-modules-extra-4.4.0-256-tuxcare.els27-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0.256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-source-4.4.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-tools-4.4.0-256-tuxcare.els27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-tools-4.4.0-256-tuxcare.els27-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-tools-4.4.0-256-tuxcare.els27-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-tools-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-tools-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0.256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-tools-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-tools-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0.256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-buildinfo-4.4.0-256-tuxcare.els27-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-buildinfo-4.4.0-256-tuxcare.els27-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-cloud-tools-4.4.0-256-tuxcare.els27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-cloud-tools-4.4.0-256-tuxcare.els27-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-cloud-tools-4.4.0-256-tuxcare.els27-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-cloud-tools-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-cloud-tools-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0.256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-cloud-tools-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0.256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-crashdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0.256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0.256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-headers-4.4.0-256-tuxcare.els27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-headers-4.4.0-256-tuxcare.els27-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-headers-4.4.0-256-tuxcare.els27-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-headers-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0.256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-headers-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0.256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-image-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0.256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-image-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0.256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-image-unsigned-4.4.0-256-tuxcare.els27-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-image-unsigned-4.4.0-256-tuxcare.els27-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-libc-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0.256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-modules-4.4.0-256-tuxcare.els27-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-modules-4.4.0-256-tuxcare.els27-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-modules-extra-4.4.0-256-tuxcare.els27-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0.256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-source-4.4.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-tools-4.4.0-256-tuxcare.els27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-tools-4.4.0-256-tuxcare.els27-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-tools-4.4.0-256-tuxcare.els27-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-tools-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-tools-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0.256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-tools-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-tools-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0.256.290"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-buildinfo-4.15.0-228-tuxcare.els16-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-buildinfo-4.15.0-228-tuxcare.els16-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-cloud-tools-4.15.0-228-tuxcare.els16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-cloud-tools-4.15.0-228-tuxcare.els16-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-cloud-tools-4.15.0-228-tuxcare.els16-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-cloud-tools-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-cloud-tools-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0.228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-cloud-tools-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0.228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-crashdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0.228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0.228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-headers-4.15.0-228-tuxcare.els16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-headers-4.15.0-228-tuxcare.els16-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-headers-4.15.0-228-tuxcare.els16-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-headers-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0.228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-headers-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0.228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-image-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0.228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-image-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0.228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-image-unsigned-4.15.0-228-tuxcare.els16-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-image-unsigned-4.15.0-228-tuxcare.els16-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-libc-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0.228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-modules-4.15.0-228-tuxcare.els16-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-modules-4.15.0-228-tuxcare.els16-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-modules-extra-4.15.0-228-tuxcare.els16-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0.228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-source-4.15.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-tools-4.15.0-228-tuxcare.els16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-tools-4.15.0-228-tuxcare.els16-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-tools-4.15.0-228-tuxcare.els16-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-tools-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-tools-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0.228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-tools-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-tools-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0.228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-buildinfo-4.15.0-228-tuxcare.els16-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-buildinfo-4.15.0-228-tuxcare.els16-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-cloud-tools-4.15.0-228-tuxcare.els16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-cloud-tools-4.15.0-228-tuxcare.els16-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-cloud-tools-4.15.0-228-tuxcare.els16-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-cloud-tools-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-cloud-tools-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0.228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-cloud-tools-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0.228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-crashdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0.228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0.228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-headers-4.15.0-228-tuxcare.els16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-headers-4.15.0-228-tuxcare.els16-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-headers-4.15.0-228-tuxcare.els16-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-headers-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0.228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-headers-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0.228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-image-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0.228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-image-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0.228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-image-unsigned-4.15.0-228-tuxcare.els16-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-image-unsigned-4.15.0-228-tuxcare.els16-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-libc-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0.228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-modules-4.15.0-228-tuxcare.els16-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-modules-4.15.0-228-tuxcare.els16-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-modules-extra-4.15.0-228-tuxcare.els16-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0.228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-source-4.15.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-tools-4.15.0-228-tuxcare.els16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-tools-4.15.0-228-tuxcare.els16-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-tools-4.15.0-228-tuxcare.els16-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-tools-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-tools-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0.228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-tools-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"linux-tools-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0.228.239"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-buildinfo-4.15.0-228-tuxcare.els26-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239~16.04.1"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-buildinfo-4.15.0-228-tuxcare.els26-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239~16.04.1"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-cloud-tools-4.15.0-228-tuxcare.els26-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239~16.04.1"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-cloud-tools-4.15.0-228-tuxcare.els26-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239~16.04.1"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-headers-4.15.0-228-tuxcare.els26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239~16.04.1"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-headers-4.15.0-228-tuxcare.els26-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239~16.04.1"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-headers-4.15.0-228-tuxcare.els26-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239~16.04.1"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-hwe-cloud-tools-4.15.0-228-tuxcare.els26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239~16.04.1"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-hwe-tools-4.15.0-228-tuxcare.els26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239~16.04.1"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-image-unsigned-4.15.0-228-tuxcare.els26-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239~16.04.1"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-image-unsigned-4.15.0-228-tuxcare.els26-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239~16.04.1"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-modules-4.15.0-228-tuxcare.els26-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239~16.04.1"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-modules-4.15.0-228-tuxcare.els26-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239~16.04.1"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-modules-extra-4.15.0-228-tuxcare.els26-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239~16.04.1"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-source-4.15.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239~16.04.1"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-tools-4.15.0-228-tuxcare.els26-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239~16.04.1"}]}],"bundled":48},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"linux-tools-4.15.0-228-tuxcare.els26-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.0-228.239~16.04.1"}]}],"bundled":48},{"source":"osv","ecosystem":"Linux","package":"Kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.30"},{"fixed":"4.19.307"}]},{"type":"ECOSYSTEM","events":[{"introduced":"4.20.0"},{"fixed":"5.4.269"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0"},{"fixed":"5.10.210"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.149"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.79"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.18"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.7.6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.82-1"}]}],"versions":["6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1"]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.7-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.7-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.19.316-1"}]}],"versions":["4.19.118-1","4.19.118-2","4.19.118-2+deb10u1","4.19.118-2+deb10u1~bpo9+1","4.19.118-2~bpo9+1","4.19.131-1","4.19.131-2","4.19.132-1","4.19.146-1","4.19.152-1","4.19.160-1","4.19.160-2","4.19.171-1","4.19.171-2","4.19.177-1","4.19.181-1","4.19.194-1","4.19.194-2","4.19.194-3","4.19.208-1","4.19.232-1","4.19.235-1","4.19.249-1","4.19.249-2","4.19.260-1","4.19.269-1","4.19.282-1","4.19.289-1","4.19.289-2","4.19.304-1","4.19.37-5","4.19.37-5+deb10u1","4.19.37-5+deb10u2","4.19.37-5+deb10u2~bpo9+1","4.19.37-6","4.19.67-1","4.19.67-2","4.19.67-2+deb10u1","4.19.67-2+deb10u1~bpo9+1","4.19.67-2+deb10u2","4.19.67-2+deb10u2~bpo9+1","4.19.67-2~bpo9+1","4.19.87-1","4.19.98-1","4.19.98-1+deb10u1","4.19.98-1~bpo9+1"],"bundled":258},{"source":"osv","ecosystem":"Debian:10","package":"linux-5.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.216-1~deb10u1"}]}],"versions":["5.10.136-1~deb10u1","5.10.136-1~deb10u2","5.10.136-1~deb10u3","5.10.149-2~deb10u1","5.10.158-2~deb10u1","5.10.162-1~deb10u1","5.10.178-3~deb10u1","5.10.179-1~deb10u1","5.10.179-3~deb10u1","5.10.179-5~deb10u1","5.10.197-1~deb10u1","5.10.205-2~deb10u1","5.10.209-2~deb10u1"],"bundled":344},{"source":"osv","ecosystem":"Debian:11","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.216-1"}]}],"versions":["5.10.103-1","5.10.103-1~bpo10+1","5.10.106-1","5.10.113-1","5.10.120-1","5.10.120-1~bpo10+1","5.10.127-1","5.10.127-2","5.10.127-2~bpo10+1","5.10.136-1","5.10.140-1","5.10.148-1","5.10.149-1","5.10.149-2","5.10.158-1","5.10.158-2","5.10.162-1","5.10.178-1","5.10.178-2","5.10.178-3","5.10.179-1","5.10.179-2","5.10.179-3","5.10.179-4","5.10.179-5","5.10.191-1","5.10.197-1","5.10.205-1","5.10.205-2","5.10.209-1","5.10.209-2","5.10.46-4","5.10.46-5","5.10.70-1","5.10.70-1~bpo10+1","5.10.84-1","5.10.92-1","5.10.92-1~bpo10+1","5.10.92-2"],"bundled":246},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.19.90-2405.3.0.0249.oe1"}]}],"bundled":61},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.19.90-2405.3.0.0276.oe2003sp4"}]}],"bundled":63},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-199.0.0.112.oe2203sp3"}]}],"bundled":77},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-60.138.0.165.oe2203"}]}],"bundled":76},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-136.76.0.156.oe2203sp1"}]}],"bundled":71},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-153.55.0.133.oe2203sp2"}]}],"bundled":64},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.33.48.1"}]}],"bundled":183},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"kernel-source-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.33.48.1"}]}],"bundled":183},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"kernel-syms-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.33.48.1"}]}],"bundled":183},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.33.48.1"}]}],"bundled":183},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-source-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.33.48.1"}]}],"bundled":183},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-syms-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.33.48.1"}]}],"bundled":183},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2.150500.6.27.2"}]}],"bundled":218},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2.150500.6.27.2"}]}],"bundled":218},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.1"}]}],"bundled":218},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP5","package":"kernel-livepatch-SLE15-SP5_Update_13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150500.11.3.2"}]}],"bundled":218},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"dtb-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.1"}]}],"bundled":218},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2.150500.6.27.2"}]}],"bundled":218},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.1"}]}],"bundled":218},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.1"}]}],"bundled":218},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.52.1"}]}],"bundled":219},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.52.1"}]}],"bundled":219},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP5","package":"kernel-livepatch-SLE15-SP5-RT_Update_14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150500.11.5.1"}]}],"bundled":219},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP5","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.52.1"}]}],"bundled":219},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP5","package":"kernel-rt_debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.52.1"}]}],"bundled":219},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP5","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.52.1"}]}],"bundled":219},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP5","package":"kernel-syms-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.52.1"}]}],"bundled":219},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.52.1"}]}],"bundled":219},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-rt_debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.52.1"}]}],"bundled":219},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.52.1"}]}],"bundled":219},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-syms-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.52.1"}]}],"bundled":219},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.8.5.4"}]}],"bundled":428},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"kernel-source-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.8.5.4"}]}],"bundled":428},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"kernel-syms-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.8.5.1"}]}],"bundled":428},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.8.5.4"}]}],"bundled":428},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-source-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.8.5.4"}]}],"bundled":428},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-syms-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.8.5.1"}]}],"bundled":428},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.11.0-12.19","3.12.0-1.3","3.12.0-2.5","3.12.0-2.7","3.12.0-3.8","3.12.0-3.9","3.12.0-4.10","3.12.0-4.12","3.12.0-5.13","3.12.0-7.15","3.13.0-1.16","3.13.0-2.17","3.13.0-3.18","3.13.0-4.19","3.13.0-5.20","3.13.0-6.23","3.13.0-7.25","3.13.0-7.26","3.13.0-8.27","3.13.0-8.28","3.13.0-10.30","3.13.0-11.31","3.13.0-12.32","3.13.0-13.33","3.13.0-14.34","3.13.0-15.35","3.13.0-16.36","3.13.0-17.37","3.13.0-18.38","3.13.0-19.39","3.13.0-19.40","3.13.0-20.42","3.13.0-21.43","3.13.0-22.44","3.13.0-23.45","3.13.0-24.46","3.13.0-24.47","3.13.0-27.50","3.13.0-29.53","3.13.0-30.54","3.13.0-30.55","3.13.0-32.57","3.13.0-33.58","3.13.0-34.60","3.13.0-35.62","3.13.0-36.63","3.13.0-37.64","3.13.0-39.66","3.13.0-40.69","3.13.0-41.70","3.13.0-43.72","3.13.0-44.73","3.13.0-45.74","3.13.0-46.75","3.13.0-46.76","3.13.0-46.77","3.13.0-46.79","3.13.0-48.80","3.13.0-49.81","3.13.0-49.83","3.13.0-51.84","3.13.0-52.85","3.13.0-52.86","3.13.0-53.88","3.13.0-53.89","3.13.0-54.91","3.13.0-55.92","3.13.0-55.94","3.13.0-57.95","3.13.0-58.97","3.13.0-59.98","3.13.0-61.100","3.13.0-62.102","3.13.0-63.103","3.13.0-65.105","3.13.0-65.106","3.13.0-66.108","3.13.0-67.110","3.13.0-68.111","3.13.0-70.113","3.13.0-71.114","3.13.0-73.116","3.13.0-74.118","3.13.0-76.120","3.13.0-77.121","3.13.0-79.123","3.13.0-83.127","3.13.0-85.129","3.13.0-86.130","3.13.0-86.131","3.13.0-87.133","3.13.0-88.135","3.13.0-91.138","3.13.0-92.139","3.13.0-93.140","3.13.0-95.142","3.13.0-96.143","3.13.0-98.145","3.13.0-100.147","3.13.0-101.148","3.13.0-103.150","3.13.0-105.152","3.13.0-106.153","3.13.0-107.154","3.13.0-108.155","3.13.0-109.156","3.13.0-110.157","3.13.0-111.158","3.13.0-112.159","3.13.0-113.160","3.13.0-115.162","3.13.0-116.163","3.13.0-117.164","3.13.0-119.166","3.13.0-121.170","3.13.0-123.172","3.13.0-125.174","3.13.0-126.175","3.13.0-128.177","3.13.0-129.178","3.13.0-132.181","3.13.0-133.182","3.13.0-135.184","3.13.0-137.186","3.13.0-139.188","3.13.0-141.190","3.13.0-142.191","3.13.0-143.192","3.13.0-144.193","3.13.0-145.194","3.13.0-147.196","3.13.0-149.199","3.13.0-151.201","3.13.0-153.203","3.13.0-155.205","3.13.0-156.206","3.13.0-157.207","3.13.0-158.208","3.13.0-160.210","3.13.0-161.211","3.13.0-162.212","3.13.0-163.213","3.13.0-164.214","3.13.0-165.215","3.13.0-166.216","3.13.0-167.217","3.13.0-168.218","3.13.0-169.219","3.13.0-170.220","3.13.0-171.222","3.13.0-172.223","3.13.0-173.224","3.13.0-174.225","3.13.0-175.226","3.13.0-176.227","3.13.0-180.231","3.13.0-181.232","3.13.0-182.233","3.13.0-183.234","3.13.0-184.235","3.13.0-185.236","3.13.0-186.237","3.13.0-187.238","3.13.0-188.239","3.13.0-189.240","3.13.0-190.241","3.13.0-191.242","3.13.0-192.243","3.13.0-193.244","3.13.0-194.245","3.13.0-195.246","3.13.0-196.247","3.13.0-197.248","3.13.0-198.249","3.13.0-199.250","3.13.0-200.251","3.13.0-201.252","3.13.0-202.253","3.13.0-203.254","3.13.0-204.255","3.13.0-205.256","3.13.0-206.257","3.13.0-207.258","3.13.0-208.259","3.13.0-209.260","3.13.0-210.261","3.13.0-211.262","3.13.0-212.263","3.13.0-214.265","3.13.0-215.266","3.13.0-217.268","3.13.0-218.269","3.13.0-219.270","3.13.0-220.271"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.0-1002.2","4.4.0-1003.3","4.4.0-1005.5","4.4.0-1006.6","4.4.0-1009.9","4.4.0-1010.10","4.4.0-1011.11","4.4.0-1012.12","4.4.0-1014.14","4.4.0-1016.16","4.4.0-1017.17","4.4.0-1019.19","4.4.0-1022.22","4.4.0-1023.23","4.4.0-1024.25","4.4.0-1025.26","4.4.0-1027.30","4.4.0-1028.31","4.4.0-1029.32","4.4.0-1031.34","4.4.0-1032.35","4.4.0-1034.37","4.4.0-1036.39","4.4.0-1037.40","4.4.0-1038.41","4.4.0-1039.42","4.4.0-1040.43","4.4.0-1042.45","4.4.0-1044.47","4.4.0-1045.48","4.4.0-1046.50","4.4.0-1048.52","4.4.0-1050.54","4.4.0-1052.56","4.4.0-1054.58","4.4.0-1055.59","4.4.0-1056.60","4.4.0-1058.62","4.4.0-1059.63","4.4.0-1060.64","4.4.0-1061.65","4.4.0-1062.66","4.4.0-1064.68","4.4.0-1065.69","4.4.0-1066.70","4.4.0-1067.71","4.4.0-1073.77","4.4.0-1074.78","4.4.0-1075.79","4.4.0-1076.80","4.4.0-1077.81","4.4.0-1078.82","4.4.0-1081.85","4.4.0-1082.86","4.4.0-1083.87","4.4.0-1085.89","4.4.0-1086.90","4.4.0-1087.91","4.4.0-1088.92","4.4.0-1090.94","4.4.0-1091.95","4.4.0-1092.96","4.4.0-1093.97","4.4.0-1094.99","4.4.0-1095.100","4.4.0-1096.101","4.4.0-1097.102","4.4.0-1098.103","4.4.0-1099.104","4.4.0-1101.106","4.4.0-1102.107","4.4.0-1103.108","4.4.0-1104.109","4.4.0-1107.113","4.4.0-1109.115","4.4.0-1110.116","4.4.0-1111.117","4.4.0-1112.118","4.4.0-1113.119","4.4.0-1114.120","4.4.0-1115.121","4.4.0-1116.122","4.4.0-1117.123","4.4.0-1118.124","4.4.0-1119.125","4.4.0-1120.126","4.4.0-1121.127","4.4.0-1122.128","4.4.0-1123.129","4.4.0-1124.130","4.4.0-1125.131","4.4.0-1127.133","4.4.0-1128.134","4.4.0-1129.135","4.4.0-1130.136","4.4.0-1131.137","4.4.0-1133.139","4.4.0-1134.140","4.4.0-1135.141","4.4.0-1136.142","4.4.0-1137.143","4.4.0-1138.144","4.4.0-1139.145","4.4.0-1140.146","4.4.0-1141.147","4.4.0-1142.148","4.4.0-1143.149","4.4.0-1144.150","4.4.0-1145.151","4.4.0-1146.152","4.4.0-1147.153","4.4.0-1148.154","4.4.0-1149.155","4.4.0-1150.156","4.4.0-1151.157","4.4.0-1152.158","4.4.0-1153.159","4.4.0-1154.160","4.4.0-1155.161","4.4.0-1156.162","4.4.0-1157.163","4.4.0-1158.164","4.4.0-1159.165","4.4.0-1160.166","4.4.0-1161.167","4.4.0-1162.168"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1023.24~14.04.1","4.15.0-1030.31~14.04.1","4.15.0-1031.32~14.04.1","4.15.0-1032.33~14.04.2","4.15.0-1035.36~14.04.2","4.15.0-1036.38~14.04.2","4.15.0-1037.39~14.04.2","4.15.0-1039.41~14.04.2","4.15.0-1040.44~14.04.1","4.15.0-1041.45~14.04.1","4.15.0-1042.46~14.04.1","4.15.0-1045.49~14.04.1","4.15.0-1046.50~14.04.1","4.15.0-1047.51~14.04.1","4.15.0-1049.54~14.04.1","4.15.0-1050.55~14.04.1","4.15.0-1051.56~14.04.1","4.15.0-1052.57~14.04.1","4.15.0-1055.60~14.04.1","4.15.0-1056.61~14.04.1","4.15.0-1057.62~14.04.1","4.15.0-1059.64~14.04.1","4.15.0-1060.65~14.04.1","4.15.0-1061.66~14.04.1","4.15.0-1063.68~14.04.1","4.15.0-1064.69~14.04.1","4.15.0-1066.71~14.04.1","4.15.0-1067.72~14.04.1","4.15.0-1069.74~14.04.1","4.15.0-1071.76~14.04.1","4.15.0-1074.79~14.04.1","4.15.0-1077.82~14.04.1","4.15.0-1082.92~14.04.1","4.15.0-1083.93~14.04.1","4.15.0-1089.99~14.04.1","4.15.0-1091.101~14.04.1","4.15.0-1092.102~14.04.1","4.15.0-1093.103~14.04.1","4.15.0-1095.105~14.04.1","4.15.0-1096.106~14.04.1","4.15.0-1098.109~14.04.1","4.15.0-1100.111~14.04.1","4.15.0-1102.113~14.04.1","4.15.0-1103.114~14.04.1","4.15.0-1106.118~14.04.1","4.15.0-1108.120~14.04.1","4.15.0-1109.121~14.04.1","4.15.0-1110.122~14.04.1","4.15.0-1111.123~14.04.1","4.15.0-1112.124~14.04.1","4.15.0-1113.126~14.04.1","4.15.0-1114.127~14.04.1","4.15.0-1115.128~14.04.1","4.15.0-1118.131~14.04.1","4.15.0-1121.134~14.04.1","4.15.0-1122.135~14.04.1","4.15.0-1123.136~14.04.1","4.15.0-1124.137~14.04.1","4.15.0-1125.138~14.04.1","4.15.0-1126.139~14.04.1","4.15.0-1127.140~14.04.1","4.15.0-1129.142~14.04.1","4.15.0-1130.143~14.04.1","4.15.0-1131.144~14.04.1","4.15.0-1133.146~14.04.1","4.15.0-1134.147~14.04.1","4.15.0-1136.149~14.04.1","4.15.0-1137.150~14.04.1","4.15.0-1138.151~14.04.1","4.15.0-1139.152~14.04.1","4.15.0-1142.156~14.04.1","4.15.0-1145.160~14.04.1","4.15.0-1146.161~14.04.1","4.15.0-1149.164~14.04.1","4.15.0-1150.165~14.04.1","4.15.0-1151.166~14.04.1","4.15.0-1153.168~14.04.1","4.15.0-1157.172~14.04.2","4.15.0-1158.173~14.04.1","4.15.0-1159.174~14.04.1","4.15.0-1162.177~14.04.1","4.15.0-1163.178~14.04.1","4.15.0-1164.179~14.04.1","4.15.0-1165.180~14.04.1","4.15.0-1166.181~14.04.1","4.15.0-1167.182~14.04.1","4.15.0-1168.183~14.04.1","4.15.0-1169.184~14.04.1","4.15.0-1170.185~14.04.1","4.15.0-1171.186~14.04.1","4.15.0-1172.187~14.04.1","4.15.0-1173.188~14.04.1","4.15.0-1174.189~14.04.1","4.15.0-1175.190~14.04.1","4.15.0-1176.191~14.04.1","4.15.0-1177.192~14.04.1","4.15.0-1178.193~14.04.1","4.15.0-1179.194~14.04.1","4.15.0-1180.195~14.04.1","4.15.0-1181.196~14.04.1","4.15.0-1182.197~14.04.1","4.15.0-1183.198~14.04.1","4.15.0-1184.199~14.04.1","4.15.0-1185.200~14.04.1","4.15.0-1186.201~14.04.1","4.15.0-1187.202~14.04.1","4.15.0-1188.203~14.04.1","4.15.0-1189.204~14.04.1","4.15.0-1190.205~14.04.1","4.15.0-1191.206~14.04.1","4.15.0-1192.207~14.04.1","4.15.0-1193.208~14.04.1","4.15.0-1194.209~14.04.1","4.15.0-1195.210~14.04.1","4.15.0-1196.211~14.04.1","4.15.0-1197.212~14.04.1","4.15.0-1199.214~14.04.1","4.15.0-1200.215~14.04.1","4.15.0-1201.216~14.04.1","4.15.0-1202.217~14.04.1","4.15.0-1205.220~14.04.1","4.15.0-1206.221~14.04.1","4.15.0-1207.222~14.04.1","4.15.0-1208.223~14.04.1","4.15.0-1209.224~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"linux-lts-xenial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.0-13.29~14.04.1","4.4.0-14.30~14.04.2","4.4.0-15.31~14.04.1","4.4.0-18.34~14.04.1","4.4.0-21.37~14.04.1","4.4.0-22.39~14.04.1","4.4.0-22.40~14.04.1","4.4.0-24.43~14.04.1","4.4.0-28.47~14.04.1","4.4.0-31.50~14.04.1","4.4.0-34.53~14.04.1","4.4.0-36.55~14.04.1","4.4.0-38.57~14.04.1","4.4.0-42.62~14.04.1","4.4.0-45.66~14.04.1","4.4.0-47.68~14.04.1","4.4.0-51.72~14.04.1","4.4.0-53.74~14.04.1","4.4.0-57.78~14.04.1","4.4.0-59.80~14.04.1","4.4.0-62.83~14.04.1","4.4.0-63.84~14.04.2","4.4.0-64.85~14.04.1","4.4.0-66.87~14.04.1","4.4.0-67.88~14.04.1","4.4.0-70.91~14.04.1","4.4.0-71.92~14.04.1","4.4.0-72.93~14.04.1","4.4.0-75.96~14.04.1","4.4.0-78.99~14.04.2","4.4.0-79.100~14.04.1","4.4.0-81.104~14.04.1","4.4.0-83.106~14.04.1","4.4.0-87.110~14.04.1","4.4.0-89.112~14.04.1","4.4.0-91.114~14.04.1","4.4.0-92.115~14.04.1","4.4.0-93.116~14.04.1","4.4.0-96.119~14.04.1","4.4.0-97.120~14.04.1","4.4.0-98.121~14.04.1","4.4.0-101.124~14.04.1","4.4.0-103.126~14.04.1","4.4.0-104.127~14.04.1","4.4.0-108.131~14.04.1","4.4.0-109.132~14.04.1","4.4.0-111.134~14.04.1","4.4.0-112.135~14.04.1","4.4.0-116.140~14.04.1","4.4.0-119.143~14.04.1","4.4.0-121.145~14.04.1","4.4.0-124.148~14.04.1","4.4.0-127.153~14.04.1","4.4.0-128.154~14.04.1","4.4.0-130.156~14.04.1","4.4.0-131.157~14.04.1","4.4.0-133.159~14.04.1","4.4.0-134.160~14.04.1","4.4.0-135.161~14.04.1","4.4.0-137.163~14.04.1","4.4.0-138.164~14.04.1","4.4.0-139.165~14.04.1","4.4.0-140.166~14.04.1","4.4.0-141.167~14.04.1","4.4.0-142.168~14.04.1","4.4.0-143.169~14.04.2","4.4.0-144.170~14.04.1","4.4.0-146.172~14.04.1","4.4.0-148.174~14.04.1","4.4.0-150.176~14.04.1","4.4.0-151.178~14.04.1","4.4.0-154.181~14.04.1","4.4.0-157.185~14.04.1","4.4.0-159.187~14.04.1","4.4.0-161.189~14.04.1","4.4.0-164.192~14.04.1","4.4.0-165.193~14.04.1","4.4.0-166.195~14.04.1","4.4.0-168.197~14.04.1","4.4.0-169.198~14.04.1","4.4.0-170.199~14.04.1","4.4.0-171.200~14.04.1","4.4.0-173.203~14.04.1","4.4.0-174.204~14.04.1","4.4.0-176.206~14.04.1","4.4.0-177.207~14.04.1","4.4.0-178.208~14.04.1","4.4.0-179.209~14.04.1","4.4.0-184.214~14.04.1","4.4.0-185.215~14.04.1","4.4.0-186.216~14.04.1","4.4.0-187.217~14.04.1","4.4.0-189.219~14.04.1","4.4.0-190.220~14.04.1","4.4.0-193.224~14.04.1","4.4.0-194.226~14.04.1","4.4.0-197.229~14.04.1","4.4.0-198.230~14.04.1","4.4.0-200.232~14.04.1","4.4.0-201.233~14.04.1","4.4.0-203.235~14.04.1","4.4.0-204.236~14.04.1","4.4.0-206.238~14.04.1","4.4.0-208.240~14.04.1","4.4.0-209.241~14.04.1","4.4.0-210.242~14.04.1","4.4.0-211.243~14.04.1","4.4.0-212.244~14.04.1","4.4.0-213.245~14.04.1","4.4.0-214.246~14.04.1","4.4.0-215.247~14.04.1","4.4.0-218.251~14.04.1","4.4.0-219.252~14.04.1","4.4.0-221.254~14.04.1","4.4.0-222.255~14.04.1","4.4.0-223.256~14.04.1","4.4.0-224.257~14.04.1","4.4.0-227.261~14.04.1","4.4.0-229.263~14.04.1","4.4.0-230.264~14.04.1","4.4.0-231.265~14.04.1","4.4.0-233.267~14.04.1","4.4.0-234.268~14.04.1","4.4.0-235.269~14.04.1","4.4.0-236.270~14.04.1","4.4.0-237.271~14.04.1","4.4.0-239.273~14.04.1","4.4.0-240.274~14.04.1","4.4.0-241.275~14.04.1","4.4.0-242.276~14.04.1","4.4.0-243.277~14.04.1","4.4.0-244.278~14.04.1","4.4.0-245.279~14.04.1","4.4.0-246.280~14.04.1","4.4.0-248.282~14.04.1","4.4.0-250.284~14.04.1","4.4.0-251.285~14.04.1","4.4.0-252.286~14.04.1","4.4.0-253.287~14.04.1","4.4.0-254.288~14.04.1","4.4.0-256.290~14.04.1","4.4.0-257.291~14.04.1","4.4.0-258.292~14.04.2","4.4.0-259.293~14.04.1","4.4.0-260.294~14.04.1","4.4.0-261.295~14.04.1","4.4.0-262.296~14.04.1","4.4.0-263.297~14.04.1","4.4.0-264.298~14.04.1","4.4.0-266.300~14.04.1","4.4.0-267.301~14.04.1","4.4.0-268.302~14.04.1","4.4.0-269.303~14.04.1","4.4.0-270.304~14.04.1","4.4.0-271.305~14.04.1","4.4.0-272.306~14.04.1","4.4.0-273.307~14.04.1","4.4.0-274.308~14.04.1","4.4.0-276.310~14.04.1","4.4.0-277.311~14.04.1","4.4.0-278.312~14.04.1","4.4.0-279.313~14.04.1","4.4.0-280.314~14.04.1","4.4.0-281.315~14.04.1","4.4.0-283.317~14.04.1","4.4.0-284.318~14.04.1","4.4.0-287.321~14.04.1","4.4.0-288.322~14.04.1","4.4.0-289.323~14.04.1","4.4.0-290.324~14.04.1","4.4.0-291.325~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.0-16.19","4.2.0-17.21","4.2.0-19.23","4.3.0-1.10","4.3.0-2.11","4.3.0-5.16","4.3.0-6.17","4.3.0-7.18","4.4.0-2.16","4.4.0-4.19","4.4.0-6.21","4.4.0-7.22","4.4.0-8.23","4.4.0-9.24","4.4.0-10.25","4.4.0-11.26","4.4.0-12.28","4.4.0-13.29","4.4.0-14.30","4.4.0-15.31","4.4.0-16.32","4.4.0-17.33","4.4.0-18.34","4.4.0-21.37","4.4.0-22.39","4.4.0-22.40","4.4.0-24.43","4.4.0-28.47","4.4.0-31.50","4.4.0-34.53","4.4.0-36.55","4.4.0-38.57","4.4.0-42.62","4.4.0-43.63","4.4.0-45.66","4.4.0-47.68","4.4.0-51.72","4.4.0-53.74","4.4.0-57.78","4.4.0-59.80","4.4.0-62.83","4.4.0-63.84","4.4.0-64.85","4.4.0-65.86","4.4.0-66.87","4.4.0-67.88","4.4.0-70.91","4.4.0-71.92","4.4.0-72.93","4.4.0-75.96","4.4.0-77.98","4.4.0-78.99","4.4.0-79.100","4.4.0-81.104","4.4.0-83.106","4.4.0-87.110","4.4.0-89.112","4.4.0-91.114","4.4.0-92.115","4.4.0-93.116","4.4.0-96.119","4.4.0-97.120","4.4.0-98.121","4.4.0-101.124","4.4.0-103.126","4.4.0-104.127","4.4.0-108.131","4.4.0-109.132","4.4.0-112.135","4.4.0-116.140","4.4.0-119.143","4.4.0-121.145","4.4.0-122.146","4.4.0-124.148","4.4.0-127.153","4.4.0-128.154","4.4.0-130.156","4.4.0-131.157","4.4.0-133.159","4.4.0-134.160","4.4.0-135.161","4.4.0-137.163","4.4.0-138.164","4.4.0-139.165","4.4.0-140.166","4.4.0-141.167","4.4.0-142.168","4.4.0-143.169","4.4.0-145.171","4.4.0-146.172","4.4.0-148.174","4.4.0-150.176","4.4.0-151.178","4.4.0-154.181","4.4.0-157.185","4.4.0-159.187","4.4.0-161.189","4.4.0-164.192","4.4.0-165.193","4.4.0-166.195","4.4.0-168.197","4.4.0-169.198","4.4.0-170.199","4.4.0-171.200","4.4.0-173.203","4.4.0-174.204","4.4.0-176.206","4.4.0-177.207","4.4.0-178.208","4.4.0-179.209","4.4.0-184.214","4.4.0-185.215","4.4.0-186.216","4.4.0-187.217","4.4.0-189.219","4.4.0-190.220","4.4.0-193.224","4.4.0-194.226","4.4.0-197.229","4.4.0-198.230","4.4.0-200.232","4.4.0-201.233","4.4.0-203.235","4.4.0-204.236","4.4.0-206.238","4.4.0-208.240","4.4.0-209.241","4.4.0-210.242","4.4.0-211.243","4.4.0-212.244","4.4.0-213.245","4.4.0-214.246","4.4.0-216.249","4.4.0-217.250","4.4.0-218.251","4.4.0-219.252","4.4.0-221.254","4.4.0-222.255","4.4.0-223.256","4.4.0-224.257","4.4.0-227.261","4.4.0-229.263","4.4.0-230.264","4.4.0-231.265","4.4.0-233.267","4.4.0-234.268","4.4.0-235.269","4.4.0-236.270","4.4.0-237.271","4.4.0-239.273","4.4.0-240.274","4.4.0-241.275","4.4.0-242.276","4.4.0-243.277","4.4.0-244.278","4.4.0-245.279","4.4.0-246.280","4.4.0-248.282","4.4.0-250.284","4.4.0-251.285","4.4.0-252.286","4.4.0-253.287","4.4.0-254.288","4.4.0-256.290","4.4.0-257.291","4.4.0-258.292","4.4.0-259.293","4.4.0-260.294","4.4.0-261.295","4.4.0-262.296","4.4.0-263.297","4.4.0-264.298","4.4.0-266.300","4.4.0-267.301","4.4.0-268.302","4.4.0-269.303","4.4.0-270.304","4.4.0-271.305","4.4.0-272.306","4.4.0-273.307","4.4.0-274.308","4.4.0-276.310","4.4.0-277.311","4.4.0-278.312","4.4.0-279.313","4.4.0-280.314","4.4.0-281.315","4.4.0-283.317","4.4.0-284.318","4.4.0-287.321","4.4.0-288.322","4.4.0-289.323","4.4.0-290.324","4.4.0-291.325"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.0-1001.10","4.4.0-1003.12","4.4.0-1004.13","4.4.0-1007.16","4.4.0-1009.18","4.4.0-1011.20","4.4.0-1012.21","4.4.0-1013.22","4.4.0-1016.25","4.4.0-1017.26","4.4.0-1018.27","4.4.0-1020.29","4.4.0-1022.31","4.4.0-1026.35","4.4.0-1028.37","4.4.0-1030.39","4.4.0-1031.40","4.4.0-1032.41","4.4.0-1035.44","4.4.0-1037.46","4.4.0-1038.47","4.4.0-1039.48","4.4.0-1041.50","4.4.0-1043.52","4.4.0-1044.53","4.4.0-1047.56","4.4.0-1048.57","4.4.0-1049.58","4.4.0-1050.59","4.4.0-1052.61","4.4.0-1054.63","4.4.0-1055.64","4.4.0-1057.66","4.4.0-1060.69","4.4.0-1061.70","4.4.0-1062.71","4.4.0-1063.72","4.4.0-1065.75","4.4.0-1066.76","4.4.0-1067.77","4.4.0-1069.79","4.4.0-1070.80","4.4.0-1072.82","4.4.0-1073.83","4.4.0-1074.84","4.4.0-1075.85","4.4.0-1077.87","4.4.0-1079.89","4.4.0-1081.91","4.4.0-1083.93","4.4.0-1084.94","4.4.0-1085.96","4.4.0-1087.98","4.4.0-1088.99","4.4.0-1090.101","4.4.0-1092.103","4.4.0-1094.105","4.4.0-1095.106","4.4.0-1096.107","4.4.0-1098.109","4.4.0-1099.110","4.4.0-1100.111","4.4.0-1101.112","4.4.0-1102.113","4.4.0-1104.115","4.4.0-1105.116","4.4.0-1106.117","4.4.0-1107.118","4.4.0-1109.120","4.4.0-1110.121","4.4.0-1111.123","4.4.0-1112.124","4.4.0-1113.126","4.4.0-1114.127","4.4.0-1117.131","4.4.0-1118.132","4.4.0-1119.133","4.4.0-1121.135","4.4.0-1122.136","4.4.0-1123.137","4.4.0-1124.138","4.4.0-1126.140","4.4.0-1127.141","4.4.0-1128.142","4.4.0-1129.143","4.4.0-1130.144","4.4.0-1131.145","4.4.0-1132.146","4.4.0-1133.147","4.4.0-1134.148","4.4.0-1135.149","4.4.0-1137.151","4.4.0-1138.152","4.4.0-1139.153","4.4.0-1140.154","4.4.0-1143.158","4.4.0-1145.160","4.4.0-1146.161","4.4.0-1147.162","4.4.0-1148.163","4.4.0-1150.165","4.4.0-1151.166","4.4.0-1152.167","4.4.0-1153.168","4.4.0-1154.169","4.4.0-1155.170","4.4.0-1156.171","4.4.0-1157.172","4.4.0-1158.173","4.4.0-1159.174","4.4.0-1160.175","4.4.0-1161.176","4.4.0-1162.177","4.4.0-1163.178","4.4.0-1164.179","4.4.0-1165.180","4.4.0-1166.181","4.4.0-1167.182","4.4.0-1168.183","4.4.0-1169.184","4.4.0-1171.186","4.4.0-1172.187","4.4.0-1173.188","4.4.0-1174.189","4.4.0-1175.190","4.4.0-1176.191","4.4.0-1177.192","4.4.0-1178.193","4.4.0-1179.194","4.4.0-1180.195","4.4.0-1181.196","4.4.0-1182.197","4.4.0-1183.198","4.4.0-1184.199","4.4.0-1185.200","4.4.0-1186.201","4.4.0-1187.202","4.4.0-1188.203","4.4.0-1189.204","4.4.0-1190.205","4.4.0-1191.206","4.4.0-1192.207","4.4.0-1193.208","4.4.0-1194.209","4.4.0-1195.210","4.4.0-1196.211","4.4.0-1197.212","4.4.0-1198.213","4.4.0-1199.214","4.4.0-1200.215"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"linux-aws-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1030.31~16.04.1","4.15.0-1031.33~16.04.1","4.15.0-1032.34~16.04.1","4.15.0-1033.35~16.04.1","4.15.0-1035.37~16.04.1","4.15.0-1036.38~16.04.1","4.15.0-1039.41~16.04.1","4.15.0-1040.42~16.04.1","4.15.0-1041.43~16.04.1","4.15.0-1043.45~16.04.1","4.15.0-1044.46~16.04.1","4.15.0-1045.47~16.04.1","4.15.0-1047.49~16.04.1","4.15.0-1048.50~16.04.1","4.15.0-1050.52~16.04.1","4.15.0-1051.53~16.04.1","4.15.0-1052.54~16.04.1","4.15.0-1054.56~16.04.1","4.15.0-1056.58~16.04.1","4.15.0-1057.59~16.04.1","4.15.0-1058.60~16.04.1","4.15.0-1060.62~16.04.1","4.15.0-1063.67~16.04.1","4.15.0-1065.69~16.04.1","4.15.0-1066.70~16.04.1","4.15.0-1067.71~16.04.1","4.15.0-1073.77~16.04.1","4.15.0-1074.78~16.04.1","4.15.0-1079.83~16.04.1","4.15.0-1080.84~16.04.1","4.15.0-1082.86~16.04.1","4.15.0-1083.87~16.04.1","4.15.0-1085.90~16.04.1","4.15.0-1088.93~16.04.1","4.15.0-1090.95~16.04.1","4.15.0-1091.96~16.04.1","4.15.0-1093.99~16.04.1","4.15.0-1094.101~16.04.1","4.15.0-1095.102~16.04.1","4.15.0-1096.103~16.04.1","4.15.0-1097.104~16.04.1","4.15.0-1098.105~16.04.1","4.15.0-1099.106~16.04.1","4.15.0-1102.109~16.04.1","4.15.0-1103.110~16.04.1","4.15.0-1106.113~16.04.1","4.15.0-1109.116~16.04.1","4.15.0-1110.117~16.04.1","4.15.0-1111.118~16.04.1","4.15.0-1112.119~16.04.1","4.15.0-1113.120~16.04.1","4.15.0-1115.122~16.04.1","4.15.0-1116.123~16.04.1","4.15.0-1118.125~16.04.1","4.15.0-1119.126~16.04.2","4.15.0-1120.128~16.04.1","4.15.0-1123.132~16.04.1","4.15.0-1124.133~16.04.1","4.15.0-1126.135~16.04.2","4.15.0-1127.136~16.04.1","4.15.0-1128.137~16.04.1","4.15.0-1130.139~16.04.1","4.15.0-1133.143~16.04.1","4.15.0-1136.147~16.04.1","4.15.0-1137.148~16.04.1","4.15.0-1139.150~16.04.1","4.15.0-1140.151~16.04.1","4.15.0-1141.152~16.04.1","4.15.0-1142.154~16.04.1","4.15.0-1143.155~16.04.1","4.15.0-1146.158~16.04.2","4.15.0-1147.159~16.04.1","4.15.0-1148.160~16.04.1","4.15.0-1151.164~16.04.1","4.15.0-1153.166~16.04.1","4.15.0-1154.167~16.04.1","4.15.0-1155.168~16.04.1","4.15.0-1156.169~16.04.1","4.15.0-1157.170~16.04.1","4.15.0-1158.171~16.04.1","4.15.0-1159.172~16.04.1","4.15.0-1160.173~16.04.1","4.15.0-1161.174~16.04.1","4.15.0-1162.175~16.04.1","4.15.0-1163.176~16.04.1","4.15.0-1164.177~16.04.1","4.15.0-1165.178~16.04.1","4.15.0-1166.179~16.04.1","4.15.0-1167.180~16.04.1","4.15.0-1168.181~16.04.1","4.15.0-1169.182~16.04.1","4.15.0-1170.183~16.04.1","4.15.0-1172.185~16.04.1","4.15.0-1173.186~16.04.1","4.15.0-1174.187~16.04.1","4.15.0-1175.188~16.04.1","4.15.0-1176.189~16.04.1","4.15.0-1177.190~16.04.1","4.15.0-1178.191~16.04.1","4.15.0-1179.192~16.04.1","4.15.0-1180.193~16.04.1","4.15.0-1181.194~16.04.1","4.15.0-1182.195~16.04.1","4.15.0-1183.196~16.04.1","4.15.0-1184.197~16.04.1","4.15.0-1185.198~16.04.1","4.15.0-1186.199~16.04.1","4.15.0-1187.200~16.04.1","4.15.0-1188.201~16.04.1","4.15.0-1189.202~16.04.1","4.15.0-1190.203~16.04.1","4.15.0-1191.204~16.04.1","4.15.0-1192.205~16.04.1","4.15.0-1194.207~16.04.1","4.15.0-1195.208~16.04.1","4.15.0-1196.209~16.04.1","4.15.0-1197.210~16.04.1","4.15.0-1198.211~16.04.1","4.15.0-1199.212~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.11.0-1009.9","4.11.0-1011.11","4.11.0-1013.13","4.11.0-1014.14","4.11.0-1015.15","4.11.0-1016.16","4.13.0-1005.7","4.13.0-1006.8","4.13.0-1007.9","4.13.0-1009.12","4.13.0-1011.14","4.13.0-1012.15","4.13.0-1014.17","4.13.0-1016.19","4.13.0-1018.21","4.15.0-1013.13~16.04.2","4.15.0-1014.14~16.04.1","4.15.0-1018.18~16.04.1","4.15.0-1019.19~16.04.1","4.15.0-1021.21~16.04.1","4.15.0-1022.22~16.04.1","4.15.0-1023.24~16.04.1","4.15.0-1025.26~16.04.1","4.15.0-1028.29~16.04.1","4.15.0-1030.31~16.04.1","4.15.0-1031.32~16.04.1","4.15.0-1032.33~16.04.1","4.15.0-1035.36~16.04.1","4.15.0-1036.38~16.04.1","4.15.0-1037.39~16.04.1","4.15.0-1039.43","4.15.0-1040.44","4.15.0-1041.45","4.15.0-1042.46","4.15.0-1045.49","4.15.0-1046.50","4.15.0-1047.51","4.15.0-1049.54","4.15.0-1050.55","4.15.0-1051.56","4.15.0-1052.57","4.15.0-1055.60","4.15.0-1056.61","4.15.0-1057.62","4.15.0-1059.64","4.15.0-1060.65","4.15.0-1061.66","4.15.0-1063.68","4.15.0-1064.69","4.15.0-1066.71","4.15.0-1067.72","4.15.0-1069.74","4.15.0-1071.76","4.15.0-1075.80","4.15.0-1077.82","4.15.0-1082.92~16.04.1","4.15.0-1083.93~16.04.1","4.15.0-1089.99~16.04.1","4.15.0-1091.101~16.04.1","4.15.0-1092.102~16.04.1","4.15.0-1093.103~16.04.1","4.15.0-1095.105~16.04.1","4.15.0-1096.106~16.04.1","4.15.0-1098.109~16.04.1","4.15.0-1100.111~16.04.1","4.15.0-1102.113~16.04.1","4.15.0-1103.114~16.04.1","4.15.0-1106.118~16.04.1","4.15.0-1108.120~16.04.1","4.15.0-1109.121~16.04.1","4.15.0-1110.122~16.04.1","4.15.0-1111.123~16.04.1","4.15.0-1112.124~16.04.1","4.15.0-1113.126~16.04.1","4.15.0-1114.127~16.04.1","4.15.0-1115.128~16.04.1","4.15.0-1118.131~16.04.1","4.15.0-1121.134~16.04.1","4.15.0-1122.135~16.04.1","4.15.0-1123.136~16.04.1","4.15.0-1124.137~16.04.1","4.15.0-1125.138~16.04.1","4.15.0-1126.139~16.04.1","4.15.0-1127.140~16.04.1","4.15.0-1129.142~16.04.1","4.15.0-1130.143~16.04.1","4.15.0-1131.144~16.04.1","4.15.0-1133.146~16.04.1","4.15.0-1134.147~16.04.1","4.15.0-1136.149~16.04.1","4.15.0-1137.150~16.04.1","4.15.0-1138.151~16.04.1","4.15.0-1139.152~16.04.1","4.15.0-1142.156~16.04.1","4.15.0-1145.160~16.04.1","4.15.0-1146.161~16.04.1","4.15.0-1149.164~16.04.1","4.15.0-1150.165~16.04.1","4.15.0-1151.166~16.04.1","4.15.0-1153.168~16.04.1","4.15.0-1159.174~16.04.1","4.15.0-1162.177~16.04.1","4.15.0-1163.178~16.04.1","4.15.0-1164.179~16.04.1","4.15.0-1165.180~16.04.1","4.15.0-1166.181~16.04.1","4.15.0-1167.182~16.04.1","4.15.0-1168.183~16.04.1","4.15.0-1169.184~16.04.1","4.15.0-1170.185~16.04.1","4.15.0-1171.186~16.04.1","4.15.0-1172.187~16.04.1","4.15.0-1173.188~16.04.1","4.15.0-1174.189~16.04.1","4.15.0-1175.190~16.04.1","4.15.0-1176.191~16.04.1","4.15.0-1177.192~16.04.1","4.15.0-1178.193~16.04.1","4.15.0-1179.194~16.04.1","4.15.0-1180.195~16.04.1","4.15.0-1181.196~16.04.1","4.15.0-1182.197~16.04.1","4.15.0-1183.198~16.04.1","4.15.0-1184.199~16.04.1","4.15.0-1185.200~16.04.1","4.15.0-1186.201~16.04.1","4.15.0-1187.202~16.04.1","4.15.0-1188.203~16.04.1","4.15.0-1189.204~16.04.1","4.15.0-1190.205~16.04.1","4.15.0-1191.206~16.04.1","4.15.0-1192.207~16.04.1","4.15.0-1193.208~16.04.1","4.15.0-1194.209~16.04.1","4.15.0-1195.210~16.04.1","4.15.0-1196.211~16.04.1","4.15.0-1197.212~16.04.1","4.15.0-1200.215~16.04.1","4.15.0-1204.219~16.04.1","4.15.0-1205.220~16.04.1","4.15.0-1206.221~16.04.1","4.15.0-1208.223~16.04.1","4.15.0-1209.224~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.10.0-1004.4","4.10.0-1006.6","4.10.0-1007.7","4.10.0-1008.8","4.10.0-1009.9","4.13.0-1002.5","4.13.0-1006.9","4.13.0-1007.10","4.13.0-1008.11","4.13.0-1011.15","4.13.0-1012.16","4.13.0-1013.17","4.13.0-1015.19","4.13.0-1017.21","4.13.0-1019.23","4.15.0-1014.14~16.04.1","4.15.0-1015.15~16.04.1","4.15.0-1017.18~16.04.1","4.15.0-1018.19~16.04.2","4.15.0-1019.20~16.04.1","4.15.0-1021.22~16.04.1","4.15.0-1023.24~16.04.1","4.15.0-1024.25~16.04.2","4.15.0-1025.26~16.04.1","4.15.0-1026.27~16.04.1","4.15.0-1027.28~16.04.1","4.15.0-1028.29~16.04.1","4.15.0-1029.31~16.04.1","4.15.0-1030.32~16.04.1","4.15.0-1032.34~16.04.1","4.15.0-1033.35~16.04.1","4.15.0-1034.36~16.04.1","4.15.0-1036.38~16.04.1","4.15.0-1037.39~16.04.1","4.15.0-1040.42~16.04.1","4.15.0-1041.43","4.15.0-1042.44","4.15.0-1044.46","4.15.0-1046.49","4.15.0-1047.50","4.15.0-1049.52","4.15.0-1050.53","4.15.0-1052.56","4.15.0-1055.59","4.15.0-1058.62","4.15.0-1060.64","4.15.0-1061.65","4.15.0-1071.81~16.04.1","4.15.0-1077.87~16.04.1","4.15.0-1078.88~16.04.1","4.15.0-1080.90~16.04.1","4.15.0-1081.92~16.04.1","4.15.0-1083.94~16.04.1","4.15.0-1084.95~16.04.1","4.15.0-1086.98~16.04.1","4.15.0-1087.100~16.04.1","4.15.0-1088.101~16.04.1","4.15.0-1090.103~16.04.1","4.15.0-1091.104~16.04.1","4.15.0-1092.105~16.04.1","4.15.0-1093.106~16.04.1","4.15.0-1094.107~16.04.1","4.15.0-1095.108~16.04.1","4.15.0-1096.109~16.04.1","4.15.0-1097.110~16.04.1","4.15.0-1098.111~16.04.1","4.15.0-1099.112~16.04.1","4.15.0-1100.113~16.04.1","4.15.0-1103.116~16.04.1","4.15.0-1106.120~16.04.1","4.15.0-1107.121~16.04.1","4.15.0-1108.122~16.04.1","4.15.0-1109.123~16.04.1","4.15.0-1110.124~16.04.1","4.15.0-1111.125~16.04.1","4.15.0-1112.126~16.04.1","4.15.0-1114.128~16.04.1","4.15.0-1115.129~16.04.1","4.15.0-1116.130~16.04.1","4.15.0-1118.132~16.04.1","4.15.0-1119.133~16.04.1","4.15.0-1120.134~16.04.1","4.15.0-1121.135~16.04.1","4.15.0-1122.136~16.04.1","4.15.0-1124.138~16.04.1","4.15.0-1127.142~16.04.1","4.15.0-1130.146~16.04.1","4.15.0-1131.147~16.04.1","4.15.0-1134.150~16.04.2","4.15.0-1135.151~16.04.2","4.15.0-1136.152~16.04.1","4.15.0-1137.153~16.04.1","4.15.0-1138.154~16.04.1","4.15.0-1141.157~16.04.2","4.15.0-1142.158~16.04.1","4.15.0-1143.159~16.04.1","4.15.0-1146.162~16.04.1","4.15.0-1147.163~16.04.1","4.15.0-1148.164~16.04.1","4.15.0-1149.165~16.04.1","4.15.0-1150.166~16.04.1","4.15.0-1151.167~16.04.1","4.15.0-1152.168~16.04.1","4.15.0-1153.170~16.04.1","4.15.0-1154.171~16.04.1","4.15.0-1155.172~16.04.1","4.15.0-1156.173~16.04.1","4.15.0-1157.174~16.04.1","4.15.0-1158.175~16.04.1","4.15.0-1159.176~16.04.1","4.15.0-1160.177~16.04.1","4.15.0-1161.178~16.04.1","4.15.0-1162.179~16.04.1","4.15.0-1163.180~16.04.1","4.15.0-1164.181~16.04.1","4.15.0-1165.182~16.04.1","4.15.0-1166.183~16.04.1","4.15.0-1167.184~16.04.2","4.15.0-1168.185~16.04.1","4.15.0-1169.186~16.04.1","4.15.0-1170.187~16.04.1","4.15.0-1171.188~16.04.1","4.15.0-1172.189~16.04.1","4.15.0-1173.190~16.04.1","4.15.0-1174.191~16.04.1","4.15.0-1175.192~16.04.1","4.15.0-1176.193~16.04.1","4.15.0-1177.194~16.04.1","4.15.0-1178.195~16.04.1","4.15.0-1179.196~16.04.1","4.15.0-1180.197~16.04.1","4.15.0-1181.198~16.04.1","4.15.0-1182.199~16.04.1","4.15.0-1183.200~16.04.2","4.15.0-1184.201~16.04.1","4.15.0-1185.202~16.04.1","4.15.0-1187.204~16.04.1","4.15.0-1188.205~16.04.1","4.15.0-1189.206~16.04.1","4.15.0-1190.207~16.04.1","4.15.0-1191.208~16.04.1","4.15.0-1192.209~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.0-36.36~16.04.1","4.8.0-39.42~16.04.1","4.8.0-41.44~16.04.1","4.8.0-42.45~16.04.1","4.8.0-44.47~16.04.1","4.8.0-45.48~16.04.1","4.8.0-46.49~16.04.1","4.8.0-49.52~16.04.1","4.8.0-51.54~16.04.1","4.8.0-52.55~16.04.1","4.8.0-53.56~16.04.1","4.8.0-54.57~16.04.1","4.8.0-56.61~16.04.1","4.8.0-58.63~16.04.1","4.10.0-27.30~16.04.2","4.10.0-28.32~16.04.2","4.10.0-30.34~16.04.1","4.10.0-32.36~16.04.1","4.10.0-33.37~16.04.1","4.10.0-35.39~16.04.1","4.10.0-37.41~16.04.1","4.10.0-38.42~16.04.1","4.10.0-40.44~16.04.1","4.10.0-42.46~16.04.1","4.13.0-26.29~16.04.2","4.13.0-31.34~16.04.1","4.13.0-32.35~16.04.1","4.13.0-36.40~16.04.1","4.13.0-37.42~16.04.1","4.13.0-38.43~16.04.1","4.13.0-39.44~16.04.1","4.13.0-41.46~16.04.1","4.13.0-43.48~16.04.1","4.13.0-45.50~16.04.1","4.15.0-24.26~16.04.1","4.15.0-29.31~16.04.1","4.15.0-30.32~16.04.1","4.15.0-32.35~16.04.1","4.15.0-33.36~16.04.1","4.15.0-34.37~16.04.1","4.15.0-36.39~16.04.1","4.15.0-38.41~16.04.1","4.15.0-39.42~16.04.1","4.15.0-42.45~16.04.1","4.15.0-43.46~16.04.1","4.15.0-45.48~16.04.1","4.15.0-46.49~16.04.1","4.15.0-47.50~16.04.1","4.15.0-48.51~16.04.1","4.15.0-50.54~16.04.1","4.15.0-51.55~16.04.1","4.15.0-52.56~16.04.1","4.15.0-54.58~16.04.1","4.15.0-55.60~16.04.2","4.15.0-58.64~16.04.1","4.15.0-60.67~16.04.1","4.15.0-62.69~16.04.1","4.15.0-64.73~16.04.1","4.15.0-65.74~16.04.1","4.15.0-66.75~16.04.1","4.15.0-69.78~16.04.1","4.15.0-70.79~16.04.1","4.15.0-72.81~16.04.1","4.15.0-74.83~16.04.1","4.15.0-76.86~16.04.1","4.15.0-88.88~16.04.1","4.15.0-91.92~16.04.1","4.15.0-96.97~16.04.1","4.15.0-99.100~16.04.1","4.15.0-101.102~16.04.1","4.15.0-106.107~16.04.1","4.15.0-107.108~16.04.1","4.15.0-112.113~16.04.1","4.15.0-115.116~16.04.1","4.15.0-117.118~16.04.1","4.15.0-118.119~16.04.1","4.15.0-120.122~16.04.1","4.15.0-122.124~16.04.1","4.15.0-123.126~16.04.1","4.15.0-126.129~16.04.1","4.15.0-128.131~16.04.1","4.15.0-129.132~16.04.1","4.15.0-132.136~16.04.1","4.15.0-133.137~16.04.1","4.15.0-136.140~16.04.1","4.15.0-137.141~16.04.1","4.15.0-139.143~16.04.1","4.15.0-140.144~16.04.1","4.15.0-142.146~16.04.1","4.15.0-143.147~16.04.3","4.15.0-144.148~16.04.1","4.15.0-147.151~16.04.1","4.15.0-151.157~16.04.1","4.15.0-153.160~16.04.1","4.15.0-154.161~16.04.1","4.15.0-156.163~16.04.1","4.15.0-158.166~16.04.1","4.15.0-159.167~16.04.1","4.15.0-161.169~16.04.1","4.15.0-162.170~16.04.1","4.15.0-163.171~16.04.1","4.15.0-166.174~16.04.1","4.15.0-167.175~16.04.1","4.15.0-169.177~16.04.1","4.15.0-171.180~16.04.1","4.15.0-173.182~16.04.1","4.15.0-175.184~16.04.1","4.15.0-176.185~16.04.1","4.15.0-177.186~16.04.1","4.15.0-180.189~16.04.1","4.15.0-184.194~16.04.1","4.15.0-187.198~16.04.1","4.15.0-188.199~16.04.1","4.15.0-189.200~16.04.1","4.15.0-191.202~16.04.1","4.15.0-192.203~16.04.1","4.15.0-193.204~16.04.1","4.15.0-194.205~16.04.1","4.15.0-196.207~16.04.1","4.15.0-197.208~16.04.1","4.15.0-200.211~16.04.2","4.15.0-201.212~16.04.1","4.15.0-202.213~16.04.1","4.15.0-206.217~16.04.1","4.15.0-208.219~16.04.1","4.15.0-209.220~16.04.1","4.15.0-210.221~16.04.1","4.15.0-211.222~16.04.1","4.15.0-212.223~16.04.1","4.15.0-213.224~16.04.1","4.15.0-214.225~16.04.1","4.15.0-216.227~16.04.1","4.15.0-218.229~16.04.1","4.15.0-219.230~16.04.1","4.15.0-220.231~16.04.1","4.15.0-221.232~16.04.1","4.15.0-222.233~16.04.1","4.15.0-223.235~16.04.1","4.15.0-224.236~16.04.1","4.15.0-225.237~16.04.1","4.15.0-226.238~16.04.1","4.15.0-227.239~16.04.1","4.15.0-228.240~16.04.1","4.15.0-229.241~16.04.1","4.15.0-230.242~16.04.1","4.15.0-231.243~16.04.1","4.15.0-232.244~16.04.1","4.15.0-233.245~16.04.1","4.15.0-234.246~16.04.1","4.15.0-235.247~16.04.1","4.15.0-236.248~16.04.1","4.15.0-237.249~16.04.1","4.15.0-238.250~16.04.1","4.15.0-239.251~16.04.1","4.15.0-240.252~16.04.1","4.15.0-241.253~16.04.1","4.15.0-242.254~16.04.1","4.15.0-243.255~16.04.1","4.15.0-245.257~16.04.1","4.15.0-246.258~16.04.1","4.15.0-247.259~16.04.1","4.15.0-248.260~16.04.1","4.15.0-249.261~16.04.1","4.15.0-250.262~16.04.1","4.15.0-253.265~16.04.1","4.15.0-254.266~16.04.1","4.15.0-257.269~16.04.1","4.15.0-260.272~16.04.2","4.15.0-261.273~16.04.1","4.15.0-262.274~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.0-28.30~16.04.1","4.8.0-30.32~16.04.1","4.8.0-32.34~16.04.1","4.8.0-34.36~16.04.1","4.10.0-14.16~16.04.1","4.10.0-19.21~16.04.1","4.10.0-20.22~16.04.1","4.10.0-21.23~16.04.1","4.10.0-22.24~16.04.1","4.10.0-24.28~16.04.1","4.10.0-26.30~16.04.1","4.11.0-13.19~16.04.1","4.11.0-14.20~16.04.1","4.13.0-16.19~16.04.3","4.13.0-17.20~16.04.1","4.13.0-19.22~16.04.1","4.13.0-21.24~16.04.1","4.13.0-25.29~16.04.2","4.15.0-13.14~16.04.1","4.15.0-15.16~16.04.1","4.15.0-20.21~16.04.1","4.15.0-22.24~16.04.1","4.15.0-23.25~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"linux-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.0-1004.9","4.4.0-1007.12","4.4.0-1008.13","4.4.0-1009.14","4.4.0-1010.15","4.4.0-1012.17","4.4.0-1013.18","4.4.0-1015.20","4.4.0-1017.22","4.4.0-1019.24","4.4.0-1020.25","4.4.0-1021.26","4.4.0-1023.28","4.4.0-1026.31","4.4.0-1027.32","4.4.0-1029.34","4.4.0-1031.37","4.4.0-1032.38","4.4.0-1033.39","4.4.0-1035.41","4.4.0-1036.42","4.4.0-1037.43","4.4.0-1038.44","4.4.0-1039.45","4.4.0-1040.46","4.4.0-1041.47","4.4.0-1043.49","4.4.0-1044.50","4.4.0-1046.52","4.4.0-1047.53","4.4.0-1048.55","4.4.0-1051.58","4.4.0-1052.59","4.4.0-1054.61","4.4.0-1056.63","4.4.0-1058.65","4.4.0-1059.66","4.4.0-1060.67","4.4.0-1062.69","4.4.0-1063.70","4.4.0-1064.71","4.4.0-1065.72","4.4.0-1066.73","4.4.0-1068.75","4.4.0-1069.76","4.4.0-1070.77","4.4.0-1071.78","4.4.0-1075.82","4.4.0-1076.83","4.4.0-1077.84","4.4.0-1078.85","4.4.0-1079.86","4.4.0-1080.87","4.4.0-1082.91","4.4.0-1084.93","4.4.0-1085.94","4.4.0-1087.96","4.4.0-1088.97","4.4.0-1089.98","4.4.0-1090.99","4.4.0-1091.100","4.4.0-1092.101","4.4.0-1093.102","4.4.0-1094.103","4.4.0-1095.104","4.4.0-1096.105","4.4.0-1097.106","4.4.0-1098.107","4.4.0-1099.108","4.4.0-1100.109","4.4.0-1102.111","4.4.0-1103.112","4.4.0-1104.113","4.4.0-1105.114","4.4.0-1108.118","4.4.0-1110.120","4.4.0-1111.121","4.4.0-1112.122","4.4.0-1113.123","4.4.0-1114.124","4.4.0-1115.125","4.4.0-1116.126","4.4.0-1117.127","4.4.0-1118.128","4.4.0-1119.129","4.4.0-1120.130","4.4.0-1121.131","4.4.0-1122.132","4.4.0-1123.133","4.4.0-1124.134","4.4.0-1125.135","4.4.0-1126.136","4.4.0-1128.138","4.4.0-1129.139","4.4.0-1130.140","4.4.0-1131.141","4.4.0-1132.142","4.4.0-1134.144","4.4.0-1135.145","4.4.0-1136.146","4.4.0-1137.147","4.4.0-1138.148","4.4.0-1139.149","4.4.0-1140.151","4.4.0-1141.152","4.4.0-1142.153","4.4.0-1143.154","4.4.0-1144.155","4.4.0-1145.156","4.4.0-1146.157","4.4.0-1147.158","4.4.0-1148.159","4.4.0-1149.160","4.4.0-1150.161","4.4.0-1151.162","4.4.0-1152.163","4.4.0-1153.164","4.4.0-1154.165","4.4.0-1155.166","4.4.0-1156.167","4.4.0-1157.168","4.4.0-1158.169","4.4.0-1159.170","4.4.0-1160.171","4.4.0-1161.172","4.4.0-1162.173","4.4.0-1163.174"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1007.9~16.04.1","4.15.0-1008.10~16.04.1","4.15.0-1009.11~16.04.1","4.15.0-1010.12~16.04.1","4.15.0-1011.13~16.04.1","4.15.0-1013.15~16.04.1","4.15.0-1014.16~16.04.1","4.15.0-1015.17~16.04.1","4.15.0-1017.19~16.04.2","4.15.0-1018.20~16.04.1","4.15.0-1021.23~16.04.1","4.15.0-1022.25~16.04.1","4.15.0-1023.26~16.04.1","4.15.0-1025.28~16.04.1","4.15.0-1026.29~16.04.1","4.15.0-1027.30~16.04.1","4.15.0-1029.32~16.04.1","4.15.0-1030.33~16.04.1","4.15.0-1031.34~16.04.1","4.15.0-1033.36~16.04.1","4.15.0-1035.38~16.04.1","4.15.0-1037.41~16.04.1","4.15.0-1038.42~16.04.1","4.15.0-1039.43~16.04.1","4.15.0-1045.49~16.04.1","4.15.0-1046.50~16.04.1","4.15.0-1050.54~16.04.1","4.15.0-1051.55~16.04.1","4.15.0-1053.57~16.04.1","4.15.0-1054.58~16.04.1","4.15.0-1056.61~16.04.1","4.15.0-1058.64~16.04.1","4.15.0-1059.65~16.04.1","4.15.0-1061.67~16.04.1","4.15.0-1062.68~16.04.1","4.15.0-1064.71~16.04.1","4.15.0-1065.73~16.04.1","4.15.0-1066.74~16.04.1","4.15.0-1067.75~16.04.1","4.15.0-1068.76~16.04.1","4.15.0-1069.77~16.04.1","4.15.0-1070.78~16.04.1","4.15.0-1071.79~16.04.1","4.15.0-1072.80~16.04.1","4.15.0-1075.83~16.04.1","4.15.0-1078.86~16.04.1","4.15.0-1079.87~16.04.1","4.15.0-1080.88~16.04.1","4.15.0-1081.89~16.04.1","4.15.0-1082.90~16.04.1","4.15.0-1083.91~16.04.1","4.15.0-1084.92~16.04.1","4.15.0-1085.93~16.04.1","4.15.0-1086.94~16.04.1","4.15.0-1087.95~16.04.1","4.15.0-1089.98~16.04.1","4.15.0-1090.99~16.04.1","4.15.0-1091.100~16.04.1","4.15.0-1092.101~16.04.1","4.15.0-1093.102~16.04.1","4.15.0-1095.104~16.04.1","4.15.0-1098.108~16.04.1","4.15.0-1101.112~16.04.1","4.15.0-1102.113~16.04.1","4.15.0-1104.115~16.04.1","4.15.0-1105.116~16.04.1","4.15.0-1106.117~16.04.1","4.15.0-1107.118~16.04.1","4.15.0-1108.119~16.04.1","4.15.0-1111.122~16.04.2","4.15.0-1112.123~16.04.1","4.15.0-1113.124~16.04.1","4.15.0-1115.126~16.04.1","4.15.0-1116.127~16.04.1","4.15.0-1117.128~16.04.1","4.15.0-1118.129~16.04.1","4.15.0-1119.130~16.04.1","4.15.0-1120.131~16.04.1","4.15.0-1121.132~16.04.1","4.15.0-1122.133~16.04.1","4.15.0-1123.134~16.04.1","4.15.0-1124.135~16.04.1","4.15.0-1125.136~16.04.1","4.15.0-1126.137~16.04.1","4.15.0-1127.138~16.04.1","4.15.0-1128.139~16.04.1","4.15.0-1129.140~16.04.1","4.15.0-1130.141~16.04.1","4.15.0-1131.142~16.04.1","4.15.0-1132.143~16.04.1","4.15.0-1133.144~16.04.1","4.15.0-1134.145~16.04.1","4.15.0-1135.146~16.04.1","4.15.0-1136.147~16.04.1","4.15.0-1137.148~16.04.1","4.15.0-1138.149~16.04.1","4.15.0-1139.150~16.04.1","4.15.0-1140.151~16.04.1","4.15.0-1141.152~16.04.1","4.15.0-1142.153~16.04.1","4.15.0-1143.154~16.04.1","4.15.0-1144.155~16.04.1","4.15.0-1145.156~16.04.1","4.15.0-1148.159~16.04.1","4.15.0-1149.160~16.04.1","4.15.0-1150.161~16.04.1","4.15.0-1151.162~16.04.1","4.15.0-1153.164~16.04.1","4.15.0-1154.165~16.04.1","4.15.0-1156.167~16.04.1","4.15.0-1158.169~16.04.1","4.15.0-1160.171~16.04.1","4.15.0-1161.172~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:16.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.0-1003.3","4.4.0-1005.5","4.4.0-1006.6","4.4.0-1008.10","4.4.0-1010.13","4.4.0-1011.14","4.4.0-1012.16","4.4.0-1013.17","4.4.0-1015.20","4.4.0-1017.22","4.4.0-1019.24","4.4.0-1021.26","4.4.0-1022.27","4.4.0-1023.28","4.4.0-1025.30","4.4.0-1026.31","4.4.0-1027.32","4.4.0-1028.33","4.4.0-1029.34","4.4.0-1031.36","4.4.0-1032.37","4.4.0-1033.38","4.4.0-1034.39","4.4.0-1041.46","4.4.0-1042.47","4.4.0-1043.48","4.4.0-1044.49","4.4.0-1045.50","4.4.0-1046.51","4.4.0-1048.53","4.4.0-1049.55","4.4.0-1051.57","4.4.0-1052.58","4.4.0-1054.60","4.4.0-1055.61","4.4.0-1056.62","4.4.0-1057.63","4.4.0-1058.64","4.4.0-1060.66","4.4.0-1061.67","4.4.0-1062.68","4.4.0-1063.69","4.4.0-1064.70","4.4.0-1065.71","4.4.0-1066.72","4.4.0-1067.73","4.4.0-1068.74","4.4.0-1069.75","4.4.0-1071.77","4.4.0-1072.78","4.4.0-1073.79","4.4.0-1074.80","4.4.0-1077.84","4.4.0-1079.86","4.4.0-1080.87","4.4.0-1081.88","4.4.0-1082.89","4.4.0-1083.90","4.4.0-1084.91","4.4.0-1085.92","4.4.0-1086.93","4.4.0-1088.95","4.4.0-1089.96","4.4.0-1090.97","4.4.0-1091.98","4.4.0-1092.99","4.4.0-1093.100","4.4.0-1094.101","4.4.0-1095.102","4.4.0-1097.104","4.4.0-1099.106","4.4.0-1100.107","4.4.0-1101.108","4.4.0-1102.109","4.4.0-1103.110","4.4.0-1104.111","4.4.0-1105.112","4.4.0-1106.113","4.4.0-1107.114","4.4.0-1108.115","4.4.0-1109.116","4.4.0-1110.117","4.4.0-1111.118","4.4.0-1112.119","4.4.0-1113.120","4.4.0-1114.121","4.4.0-1115.122","4.4.0-1116.123","4.4.0-1117.124","4.4.0-1119.126","4.4.0-1120.127","4.4.0-1121.128","4.4.0-1122.129","4.4.0-1123.130","4.4.0-1124.131","4.4.0-1125.132","4.4.0-1126.133","4.4.0-1127.134","4.4.0-1128.135","4.4.0-1129.136","4.4.0-1130.137","4.4.0-1131.138"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:16.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.0-1001.1","4.4.0-1002.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.13.0-16.19","4.13.0-17.20","4.13.0-25.29","4.13.0-32.35","4.15.0-10.11","4.15.0-12.13","4.15.0-13.14","4.15.0-15.16","4.15.0-19.20","4.15.0-20.21","4.15.0-22.24","4.15.0-23.25","4.15.0-24.26","4.15.0-29.31","4.15.0-30.32","4.15.0-32.35","4.15.0-33.36","4.15.0-34.37","4.15.0-36.39","4.15.0-38.41","4.15.0-39.42","4.15.0-42.45","4.15.0-43.46","4.15.0-44.47","4.15.0-45.48","4.15.0-46.49","4.15.0-47.50","4.15.0-48.51","4.15.0-50.54","4.15.0-51.55","4.15.0-52.56","4.15.0-54.58","4.15.0-55.60","4.15.0-58.64","4.15.0-60.67","4.15.0-62.69","4.15.0-64.73","4.15.0-65.74","4.15.0-66.75","4.15.0-69.78","4.15.0-70.79","4.15.0-72.81","4.15.0-74.84","4.15.0-76.86","4.15.0-88.88","4.15.0-91.92","4.15.0-96.97","4.15.0-99.100","4.15.0-101.102","4.15.0-106.107","4.15.0-108.109","4.15.0-109.110","4.15.0-111.112","4.15.0-112.113","4.15.0-115.116","4.15.0-117.118","4.15.0-118.119","4.15.0-121.123","4.15.0-122.124","4.15.0-123.126","4.15.0-124.127","4.15.0-126.129","4.15.0-128.131","4.15.0-129.132","4.15.0-130.134","4.15.0-132.136","4.15.0-134.138","4.15.0-135.139","4.15.0-136.140","4.15.0-137.141","4.15.0-139.143","4.15.0-140.144","4.15.0-141.145","4.15.0-142.146","4.15.0-143.147","4.15.0-144.148","4.15.0-147.151","4.15.0-151.157","4.15.0-153.160","4.15.0-154.161","4.15.0-156.163","4.15.0-158.166","4.15.0-159.167","4.15.0-161.169","4.15.0-162.170","4.15.0-163.171","4.15.0-166.174","4.15.0-167.175","4.15.0-169.177","4.15.0-171.180","4.15.0-173.182","4.15.0-175.184","4.15.0-176.185","4.15.0-177.186","4.15.0-180.189","4.15.0-184.194","4.15.0-187.198","4.15.0-188.199","4.15.0-189.200","4.15.0-191.202","4.15.0-192.203","4.15.0-193.204","4.15.0-194.205","4.15.0-196.207","4.15.0-197.208","4.15.0-200.211","4.15.0-201.212","4.15.0-202.213","4.15.0-204.215","4.15.0-206.217","4.15.0-208.220","4.15.0-209.220","4.15.0-210.221","4.15.0-211.222","4.15.0-212.223","4.15.0-213.224","4.15.0-214.225","4.15.0-216.227","4.15.0-218.229","4.15.0-219.230","4.15.0-220.231","4.15.0-221.232","4.15.0-222.233","4.15.0-223.235","4.15.0-224.236","4.15.0-225.237","4.15.0-226.238","4.15.0-227.239","4.15.0-228.240","4.15.0-229.241","4.15.0-230.242","4.15.0-231.243","4.15.0-232.244","4.15.0-233.245","4.15.0-234.246","4.15.0-235.247","4.15.0-236.248","4.15.0-237.249","4.15.0-238.250","4.15.0-239.251","4.15.0-240.252","4.15.0-241.253","4.15.0-242.254","4.15.0-243.255","4.15.0-245.257","4.15.0-246.258","4.15.0-247.259","4.15.0-248.260","4.15.0-249.261","4.15.0-250.262","4.15.0-251.263","4.15.0-253.265","4.15.0-254.266","4.15.0-257.269","4.15.0-260.272","4.15.0-261.273","4.15.0-262.274"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1007.7","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1011.11","4.15.0-1016.16","4.15.0-1017.17","4.15.0-1019.19","4.15.0-1020.20","4.15.0-1021.21","4.15.0-1023.23","4.15.0-1025.25","4.15.0-1027.27","4.15.0-1029.30","4.15.0-1031.33","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1035.37","4.15.0-1037.39","4.15.0-1039.41","4.15.0-1040.42","4.15.0-1041.43","4.15.0-1043.45","4.15.0-1044.46","4.15.0-1045.47","4.15.0-1047.49","4.15.0-1048.50","4.15.0-1050.52","4.15.0-1051.53","4.15.0-1052.54","4.15.0-1054.56","4.15.0-1056.58","4.15.0-1057.59","4.15.0-1058.60","4.15.0-1060.62","4.15.0-1063.67","4.15.0-1065.69","4.15.0-1066.70","4.15.0-1067.71","4.15.0-1073.77","4.15.0-1076.80","4.15.0-1077.81","4.15.0-1079.83","4.15.0-1080.84","4.15.0-1082.86","4.15.0-1083.87","4.15.0-1086.91","4.15.0-1087.92","4.15.0-1088.93","4.15.0-1090.95","4.15.0-1091.96","4.15.0-1092.98","4.15.0-1093.99","4.15.0-1094.101","4.15.0-1095.102","4.15.0-1096.103","4.15.0-1097.104","4.15.0-1098.105","4.15.0-1099.106","4.15.0-1101.108","4.15.0-1102.109","4.15.0-1103.110","4.15.0-1106.113","4.15.0-1109.116","4.15.0-1110.117","4.15.0-1111.118","4.15.0-1112.119","4.15.0-1114.121","4.15.0-1115.122","4.15.0-1116.123","4.15.0-1118.125","4.15.0-1119.127","4.15.0-1121.129","4.15.0-1123.132","4.15.0-1124.133","4.15.0-1126.135","4.15.0-1127.136","4.15.0-1128.137","4.15.0-1130.139","4.15.0-1133.143","4.15.0-1136.147","4.15.0-1137.148","4.15.0-1139.150","4.15.0-1140.151","4.15.0-1141.152","4.15.0-1142.154","4.15.0-1143.155","4.15.0-1144.156","4.15.0-1146.158","4.15.0-1147.159","4.15.0-1148.160","4.15.0-1150.163","4.15.0-1151.164","4.15.0-1153.166","4.15.0-1154.167","4.15.0-1155.168","4.15.0-1156.169","4.15.0-1157.170","4.15.0-1158.171","4.15.0-1159.172","4.15.0-1160.173","4.15.0-1161.174","4.15.0-1162.175","4.15.0-1163.176","4.15.0-1164.177","4.15.0-1165.178","4.15.0-1166.179","4.15.0-1167.180","4.15.0-1168.181","4.15.0-1169.182","4.15.0-1170.183","4.15.0-1172.185","4.15.0-1173.186","4.15.0-1174.187","4.15.0-1175.188","4.15.0-1176.189","4.15.0-1177.190","4.15.0-1178.191","4.15.0-1179.192","4.15.0-1180.193","4.15.0-1181.194","4.15.0-1182.195","4.15.0-1183.196","4.15.0-1184.197","4.15.0-1185.198","4.15.0-1186.199","4.15.0-1187.200","4.15.0-1188.201","4.15.0-1189.202","4.15.0-1190.203","4.15.0-1191.204","4.15.0-1192.205","4.15.0-1194.207","4.15.0-1195.208","4.15.0-1196.209","4.15.0-1197.210","4.15.0-1198.211","4.15.0-1199.212"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1021.24~18.04.1","5.0.0-1022.25~18.04.1","5.0.0-1023.26~18.04.1","5.0.0-1024.27~18.04.1","5.0.0-1025.28","5.0.0-1027.30"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1019.21~18.04.1","5.3.0-1023.25~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.2","5.3.0-1033.35","5.3.0-1034.36","5.3.0-1035.37"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-aws-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1124.134~18.04.1"}]}],"versions":["5.4.0-1018.18~18.04.1","5.4.0-1020.20~18.04.2","5.4.0-1022.22~18.04.1","5.4.0-1024.24~18.04.1","5.4.0-1025.25~18.04.1","5.4.0-1028.29~18.04.1","5.4.0-1029.30~18.04.1","5.4.0-1030.31~18.04.1","5.4.0-1032.33~18.04.1","5.4.0-1034.35~18.04.1","5.4.0-1035.37~18.04.1","5.4.0-1037.39~18.04.1","5.4.0-1038.40~18.04.1","5.4.0-1039.41~18.04.1","5.4.0-1041.43~18.04.1","5.4.0-1043.45~18.04.1","5.4.0-1045.47~18.04.1","5.4.0-1047.49~18.04.1","5.4.0-1048.50~18.04.1","5.4.0-1049.51~18.04.1","5.4.0-1051.53~18.04.1","5.4.0-1054.57~18.04.1","5.4.0-1055.58~18.04.1","5.4.0-1056.59~18.04.1","5.4.0-1057.60~18.04.1","5.4.0-1058.61~18.04.3","5.4.0-1059.62~18.04.1","5.4.0-1060.63~18.04.1","5.4.0-1061.64~18.04.1","5.4.0-1063.66~18.04.1","5.4.0-1064.67~18.04.1","5.4.0-1065.68~18.04.1","5.4.0-1066.69~18.04.1","5.4.0-1068.72~18.04.1","5.4.0-1069.73~18.04.1","5.4.0-1071.76~18.04.1","5.4.0-1072.77~18.04.1","5.4.0-1075.80~18.04.1","5.4.0-1078.84~18.04.1","5.4.0-1080.87~18.04.1","5.4.0-1081.88~18.04.1","5.4.0-1083.90~18.04.1","5.4.0-1084.91~18.04.1","5.4.0-1085.92~18.04.1","5.4.0-1086.93~18.04.1","5.4.0-1088.96~18.04.1","5.4.0-1089.97~18.04.1","5.4.0-1090.98~18.04.1","5.4.0-1092.100~18.04.2","5.4.0-1093.102~18.04.2","5.4.0-1094.102~18.04.1","5.4.0-1096.104~18.04.1","5.4.0-1097.105~18.04.1","5.4.0-1099.107~18.04.1","5.4.0-1100.108~18.04.1","5.4.0-1101.109~18.04.1","5.4.0-1103.111~18.04.1","5.4.0-1104.112~18.04.1","5.4.0-1105.113~18.04.1","5.4.0-1106.114~18.04.1","5.4.0-1107.115~18.04.1","5.4.0-1108.116~18.04.1","5.4.0-1109.118~18.04.1","5.4.0-1110.119~18.04.1","5.4.0-1111.120~18.04.1","5.4.0-1112.121~18.04.2","5.4.0-1113.123~18.04.1","5.4.0-1114.124~18.04.1","5.4.0-1116.126~18.04.1","5.4.0-1117.127~18.04.1","5.4.0-1118.128~18.04.1","5.4.0-1119.129~18.04.1","5.4.0-1120.130~18.04.1","5.4.0-1121.131~18.04.1","5.4.0-1122.132~18.04.1","5.4.0-1123.133~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1012.12","4.15.0-1013.13","4.15.0-1014.14","4.15.0-1018.18","4.15.0-1019.19","4.15.0-1021.21","4.15.0-1022.23","4.15.0-1023.24","4.15.0-1025.26","4.15.0-1028.29","4.15.0-1030.31","4.15.0-1031.32","4.15.0-1032.33","4.15.0-1035.36","4.15.0-1036.38","4.15.0-1037.39","4.18.0-1011.11~18.04.1","4.18.0-1013.13~18.04.1","4.18.0-1014.14~18.04.1","4.18.0-1018.18~18.04.1","4.18.0-1019.19~18.04.1","4.18.0-1020.20~18.04.1","4.18.0-1023.24~18.04.1","4.18.0-1024.25~18.04.1","4.18.0-1025.27~18.04.1","5.0.0-1014.14~18.04.1","5.0.0-1016.17~18.04.1","5.0.0-1018.19~18.04.1","5.0.0-1020.21~18.04.1","5.0.0-1022.23~18.04.1","5.0.0-1023.24~18.04.1","5.0.0-1025.27~18.04.1","5.0.0-1027.29~18.04.1","5.0.0-1028.30~18.04.1","5.0.0-1029.31~18.04.1","5.0.0-1031.33","5.0.0-1032.34","5.0.0-1035.37","5.0.0-1036.38"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-azure-4.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1082.92","4.15.0-1083.93","4.15.0-1089.99","4.15.0-1091.101","4.15.0-1092.102","4.15.0-1093.103","4.15.0-1095.105","4.15.0-1096.106","4.15.0-1099.110","4.15.0-1100.111","4.15.0-1102.113","4.15.0-1103.114","4.15.0-1104.116","4.15.0-1106.118","4.15.0-1108.120","4.15.0-1109.121","4.15.0-1110.122","4.15.0-1111.123","4.15.0-1112.125","4.15.0-1113.126","4.15.0-1114.127","4.15.0-1115.128","4.15.0-1118.131","4.15.0-1121.134","4.15.0-1122.135","4.15.0-1123.136","4.15.0-1124.137","4.15.0-1125.138","4.15.0-1126.139","4.15.0-1127.140","4.15.0-1129.142","4.15.0-1130.143","4.15.0-1131.144","4.15.0-1133.146","4.15.0-1134.147","4.15.0-1136.149","4.15.0-1137.150","4.15.0-1138.151","4.15.0-1139.152","4.15.0-1142.156","4.15.0-1145.160","4.15.0-1146.161","4.15.0-1149.164","4.15.0-1150.165","4.15.0-1151.166","4.15.0-1153.168","4.15.0-1157.172","4.15.0-1158.173","4.15.0-1159.174","4.15.0-1161.176","4.15.0-1162.177","4.15.0-1163.178","4.15.0-1164.179","4.15.0-1165.180","4.15.0-1166.181","4.15.0-1167.182","4.15.0-1168.183","4.15.0-1169.184","4.15.0-1170.185","4.15.0-1171.186","4.15.0-1172.187","4.15.0-1173.188","4.15.0-1174.189","4.15.0-1175.190","4.15.0-1176.191","4.15.0-1177.192","4.15.0-1178.193","4.15.0-1179.194","4.15.0-1180.195","4.15.0-1181.196","4.15.0-1182.197","4.15.0-1183.198","4.15.0-1184.199","4.15.0-1185.200","4.15.0-1186.201","4.15.0-1187.202","4.15.0-1188.203","4.15.0-1189.204","4.15.0-1190.205","4.15.0-1191.206","4.15.0-1192.207","4.15.0-1193.208","4.15.0-1194.209","4.15.0-1195.210","4.15.0-1196.211","4.15.0-1197.212","4.15.0-1199.214","4.15.0-1200.215","4.15.0-1201.216","4.15.0-1202.217","4.15.0-1204.219","4.15.0-1205.220","4.15.0-1206.221","4.15.0-1207.222","4.15.0-1208.223","4.15.0-1209.224"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8~18.04.1","5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1019.20~18.04.1","5.3.0-1020.21~18.04.1","5.3.0-1022.23~18.04.1","5.3.0-1028.29~18.04.1","5.3.0-1031.32~18.04.1","5.3.0-1032.33~18.04.1","5.3.0-1034.35~18.04.1","5.3.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-azure-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1129.136~18.04.1"}]}],"versions":["5.4.0-1020.20~18.04.1","5.4.0-1022.22~18.04.1","5.4.0-1023.23~18.04.1","5.4.0-1025.25~18.04.1","5.4.0-1026.26~18.04.1","5.4.0-1031.32~18.04.1","5.4.0-1032.33~18.04.1","5.4.0-1034.35~18.04.1","5.4.0-1035.36~18.04.1","5.4.0-1036.38~18.04.1","5.4.0-1039.41~18.04.1","5.4.0-1040.42~18.04.1","5.4.0-1041.43~18.04.1","5.4.0-1043.45~18.04.1","5.4.0-1044.46~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1047.49~18.04.1","5.4.0-1048.50~18.04.1","5.4.0-1049.51~18.04.1","5.4.0-1051.53~18.04.1","5.4.0-1055.57~18.04.1","5.4.0-1056.58~18.04.1","5.4.0-1058.60~18.04.1","5.4.0-1059.62~18.04.1","5.4.0-1061.64~18.04.1","5.4.0-1062.65~18.04.1","5.4.0-1063.66~18.04.1","5.4.0-1064.67~18.04.1","5.4.0-1065.68~18.04.1","5.4.0-1067.70~18.04.1","5.4.0-1068.71~18.04.1","5.4.0-1069.72~18.04.1","5.4.0-1070.73~18.04.1","5.4.0-1072.75~18.04.1","5.4.0-1073.76~18.04.1","5.4.0-1074.77~18.04.1","5.4.0-1077.80~18.04.1","5.4.0-1078.81~18.04.1","5.4.0-1080.83~18.04.2","5.4.0-1083.87~18.04.1","5.4.0-1085.90~18.04.1","5.4.0-1086.91~18.04.1","5.4.0-1089.94~18.04.1","5.4.0-1090.95~18.04.1","5.4.0-1091.96~18.04.1","5.4.0-1094.100~18.04.1","5.4.0-1095.101~18.04.1","5.4.0-1098.104~18.04.2","5.4.0-1100.106~18.04.1","5.4.0-1101.107~18.04.1","5.4.0-1103.109~18.04.1","5.4.0-1104.110~18.04.1","5.4.0-1105.111~18.04.1","5.4.0-1106.112~18.04.1","5.4.0-1107.113~18.04.1","5.4.0-1108.114~18.04.1","5.4.0-1109.115~18.04.1","5.4.0-1110.116~18.04.1","5.4.0-1111.117~18.04.1","5.4.0-1112.118~18.04.1","5.4.0-1113.119~18.04.1","5.4.0-1115.122~18.04.1","5.4.0-1116.123~18.04.1","5.4.0-1117.124~18.04.1","5.4.0-1118.125~18.04.1","5.4.0-1119.126~18.04.2","5.4.0-1120.127~18.04.1","5.4.0-1121.128~18.04.1","5.4.0-1122.129~18.04.1","5.4.0-1123.130~18.04.1","5.4.0-1124.131~18.04.1","5.4.0-1126.133~18.04.1","5.4.0-1127.134~18.04.1","5.4.0-1128.135~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-1006.6~18.04.1","4.18.0-1007.7~18.04.1","4.18.0-1008.8~18.04.1","5.0.0-1012.12~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1014.14","4.15.0-1015.15","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1019.20","4.15.0-1021.22","4.15.0-1023.24","4.15.0-1024.25","4.15.0-1025.26","4.15.0-1026.27","4.15.0-1027.28","4.15.0-1028.29","4.15.0-1029.31","4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1042.45","4.15.0-1044.70","5.0.0-1020.20~18.04.1","5.0.0-1021.21~18.04.1","5.0.0-1025.26~18.04.1","5.0.0-1026.27~18.04.1","5.0.0-1028.29~18.04.1","5.0.0-1029.30~18.04.1","5.0.0-1031.32","5.0.0-1033.34","5.0.0-1034.35"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-gcp-4.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1071.81","4.15.0-1077.87","4.15.0-1078.88","4.15.0-1080.90","4.15.0-1081.92","4.15.0-1083.94","4.15.0-1084.95","4.15.0-1086.98","4.15.0-1087.100","4.15.0-1088.101","4.15.0-1090.103","4.15.0-1091.104","4.15.0-1092.105","4.15.0-1093.106","4.15.0-1094.107","4.15.0-1095.108","4.15.0-1096.109","4.15.0-1097.110","4.15.0-1098.111","4.15.0-1099.112","4.15.0-1100.113","4.15.0-1103.116","4.15.0-1106.120","4.15.0-1107.121","4.15.0-1108.122","4.15.0-1109.123","4.15.0-1110.124","4.15.0-1111.125","4.15.0-1112.126","4.15.0-1114.128","4.15.0-1115.129","4.15.0-1116.130","4.15.0-1118.132","4.15.0-1119.133","4.15.0-1120.134","4.15.0-1121.135","4.15.0-1122.136","4.15.0-1124.138","4.15.0-1127.142","4.15.0-1130.146","4.15.0-1131.147","4.15.0-1134.150","4.15.0-1135.151","4.15.0-1136.152","4.15.0-1137.153","4.15.0-1138.154","4.15.0-1141.157","4.15.0-1142.158","4.15.0-1143.159","4.15.0-1145.161","4.15.0-1146.162","4.15.0-1147.163","4.15.0-1148.164","4.15.0-1149.165","4.15.0-1150.166","4.15.0-1151.167","4.15.0-1152.168","4.15.0-1153.170","4.15.0-1154.171","4.15.0-1155.172","4.15.0-1156.173","4.15.0-1157.174","4.15.0-1158.175","4.15.0-1159.176","4.15.0-1160.177","4.15.0-1161.178","4.15.0-1162.179","4.15.0-1163.180","4.15.0-1164.181","4.15.0-1165.182","4.15.0-1166.183","4.15.0-1167.184","4.15.0-1168.185","4.15.0-1169.186","4.15.0-1170.187","4.15.0-1171.188","4.15.0-1172.189","4.15.0-1173.190","4.15.0-1174.191","4.15.0-1175.192","4.15.0-1176.193","4.15.0-1177.194","4.15.0-1178.195","4.15.0-1179.196","4.15.0-1180.197","4.15.0-1181.198","4.15.0-1182.199","4.15.0-1183.200","4.15.0-1184.201","4.15.0-1185.202","4.15.0-1186.203","4.15.0-1187.204","4.15.0-1188.205","4.15.0-1189.206","4.15.0-1190.207","4.15.0-1191.208","4.15.0-1192.209"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1020.22~18.04.1","5.3.0-1026.28~18.04.1","5.3.0-1029.31~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-gcp-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1128.137~18.04.1"}]}],"versions":["5.4.0-1019.19~18.04.2","5.4.0-1021.21~18.04.1","5.4.0-1022.22~18.04.1","5.4.0-1024.24~18.04.1","5.4.0-1025.25~18.04.1","5.4.0-1028.29~18.04.1","5.4.0-1029.31~18.04.1","5.4.0-1030.32~18.04.1","5.4.0-1032.34~18.04.1","5.4.0-1033.35~18.04.1","5.4.0-1034.37~18.04.1","5.4.0-1036.39~18.04.1","5.4.0-1037.40~18.04.1","5.4.0-1038.41~18.04.1","5.4.0-1040.43~18.04.1","5.4.0-1041.44~18.04.1","5.4.0-1042.45~18.04.1","5.4.0-1043.46~18.04.1","5.4.0-1044.47~18.04.2","5.4.0-1046.49~18.04.1","5.4.0-1049.53~18.04.1","5.4.0-1051.55~18.04.1","5.4.0-1052.56~18.04.1","5.4.0-1053.57~18.04.1","5.4.0-1055.59~18.04.1","5.4.0-1056.60~18.04.1","5.4.0-1057.61~18.04.1","5.4.0-1058.62~18.04.1","5.4.0-1059.63~18.04.1","5.4.0-1060.64~18.04.1","5.4.0-1062.66~18.04.1","5.4.0-1063.67~18.04.1","5.4.0-1064.68~18.04.1","5.4.0-1065.69~18.04.1","5.4.0-1067.71~18.04.1","5.4.0-1068.72~18.04.1","5.4.0-1069.73~18.04.1","5.4.0-1072.77~18.04.1","5.4.0-1073.78~18.04.1","5.4.0-1075.80~18.04.1","5.4.0-1078.84~18.04.1","5.4.0-1080.87~18.04.1","5.4.0-1083.91~18.04.1","5.4.0-1084.92~18.04.1","5.4.0-1086.94~18.04.1","5.4.0-1087.95~18.04.1","5.4.0-1089.97~18.04.1","5.4.0-1092.101~18.04.1","5.4.0-1093.102~18.04.1","5.4.0-1096.105~18.04.2","5.4.0-1097.106~18.04.1","5.4.0-1098.107~18.04.1","5.4.0-1100.109~18.04.1","5.4.0-1101.110~18.04.1","5.4.0-1102.111~18.04.2","5.4.0-1103.112~18.04.1","5.4.0-1104.113~18.04.1","5.4.0-1105.114~18.04.1","5.4.0-1106.115~18.04.1","5.4.0-1107.116~18.04.1","5.4.0-1108.117~18.04.1","5.4.0-1109.118~18.04.1","5.4.0-1110.119~18.04.1","5.4.0-1111.120~18.04.1","5.4.0-1112.121~18.04.1","5.4.0-1113.122~18.04.1","5.4.0-1115.124~18.04.1","5.4.0-1116.125~18.04.1","5.4.0-1117.126~18.04.1","5.4.0-1118.127~18.04.1","5.4.0-1120.129~18.04.1","5.4.0-1121.130~18.04.1","5.4.0-1122.131~18.04.1","5.4.0-1123.132~18.04.1","5.4.0-1124.133~18.04.1","5.4.0-1125.134~18.04.1","5.4.0-1126.135~18.04.1","5.4.0-1127.136~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-4.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1041.43","4.15.0-1042.44","4.15.0-1044.46","4.15.0-1045.48","4.15.0-1046.49","4.15.0-1048.51","4.15.0-1049.52","4.15.0-1050.53","4.15.0-1052.55","4.15.0-1055.58","4.15.0-1057.60","4.15.0-1058.61","4.15.0-1059.62","4.15.0-1063.66","4.15.0-1064.67","4.15.0-1066.69","4.15.0-1067.70","4.15.0-1069.72","4.15.0-1070.73","4.15.0-1072.76","4.15.0-1073.78","4.15.0-1074.79","4.15.0-1076.81","4.15.0-1077.82","4.15.0-1078.83","4.15.0-1079.84"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1025.25~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.31~18.04.1","5.4.0-1030.32~18.04.1","5.4.0-1032.34~18.04.1","5.4.0-1033.35~18.04.1","5.4.0-1035.37~18.04.1","5.4.0-1036.38~18.04.1","5.4.0-1037.39~18.04.1","5.4.0-1039.41~18.04.1","5.4.0-1040.42~18.04.1","5.4.0-1042.44~18.04.1","5.4.0-1043.45~18.04.1","5.4.0-1044.46~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1","5.4.0-1052.55~18.04.1","5.4.0-1053.56~18.04.1","5.4.0-1054.57~18.04.1","5.4.0-1055.58~18.04.1","5.4.0-1056.59~18.04.1","5.4.0-1057.60~18.04.1","5.4.0-1059.62~18.04.1","5.4.0-1061.64~18.04.1","5.4.0-1062.65~18.04.1","5.4.0-1063.66~18.04.1","5.4.0-1065.68~18.04.1","5.4.0-1066.69~18.04.1","5.4.0-1067.70~18.04.1","5.4.0-1068.71~18.04.1","5.4.0-1071.76~18.04.3","5.4.0-1072.77~18.04.1","5.4.0-1074.79~18.04.1","5.4.0-1076.82~18.04.1","5.4.0-1078.84~18.04.1","5.4.0-1080.86~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gkeop-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1001.1","5.4.0-1003.3","5.4.0-1004.5","5.4.0-1005.6","5.4.0-1007.8~18.04.1","5.4.0-1008.9~18.04.1","5.4.0-1009.10~18.04.1","5.4.0-1010.11~18.04.1","5.4.0-1011.12~18.04.2","5.4.0-1012.13~18.04.1","5.4.0-1013.14~18.04.1","5.4.0-1014.15~18.04.1","5.4.0-1015.16~18.04.1","5.4.0-1016.17~18.04.1","5.4.0-1018.19~18.04.1","5.4.0-1021.22~18.04.1","5.4.0-1022.23~18.04.1","5.4.0-1023.24~18.04.1","5.4.0-1024.25~18.04.1","5.4.0-1025.26~18.04.1","5.4.0-1026.27~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.30~18.04.2","5.4.0-1031.32~18.04.1","5.4.0-1032.33~18.04.1","5.4.0-1033.34~18.04.1","5.4.0-1034.35~18.04.1","5.4.0-1036.37~18.04.1","5.4.0-1037.38~18.04.1","5.4.0-1038.39~18.04.1","5.4.0-1039.40~18.04.1","5.4.0-1040.41~18.04.1","5.4.0-1043.44~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1048.51~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-13.14~18.04.1","4.18.0-14.15~18.04.1","4.18.0-15.16~18.04.1","4.18.0-16.17~18.04.1","4.18.0-17.18~18.04.1","4.18.0-18.19~18.04.1","4.18.0-20.21~18.04.1","4.18.0-21.22~18.04.1","4.18.0-22.23~18.04.1","4.18.0-24.25~18.04.1","4.18.0-25.26~18.04.1","5.0.0-23.24~18.04.1","5.0.0-25.26~18.04.1","5.0.0-27.28~18.04.1","5.0.0-29.31~18.04.1","5.0.0-31.33~18.04.1","5.0.0-32.34~18.04.2","5.0.0-35.38~18.04.1","5.0.0-36.39~18.04.1","5.0.0-37.40~18.04.1","5.3.0-26.28~18.04.1","5.3.0-28.30~18.04.1","5.3.0-40.32~18.04.1","5.3.0-42.34~18.04.1","5.3.0-45.37~18.04.1","5.3.0-46.38~18.04.1","5.3.0-51.44~18.04.2","5.3.0-53.47~18.04.1","5.3.0-59.53~18.04.1","5.3.0-61.55~18.04.1","5.3.0-62.56~18.04.1","5.3.0-64.58~18.04.1","5.3.0-65.59","5.3.0-66.60","5.3.0-67.61","5.3.0-68.63","5.3.0-69.65","5.3.0-70.66","5.3.0-72.68","5.3.0-73.69","5.3.0-74.70","5.3.0-75.71","5.3.0-76.72"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-hwe-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-181.201~18.04.1"}]}],"versions":["5.4.0-37.41~18.04.1","5.4.0-39.43~18.04.1","5.4.0-40.44~18.04.1","5.4.0-42.46~18.04.1","5.4.0-45.49~18.04.2","5.4.0-47.51~18.04.1","5.4.0-48.52~18.04.1","5.4.0-51.56~18.04.1","5.4.0-52.57~18.04.1","5.4.0-53.59~18.04.1","5.4.0-54.60~18.04.1","5.4.0-56.62~18.04.1","5.4.0-58.64~18.04.1","5.4.0-59.65~18.04.1","5.4.0-60.67~18.04.1","5.4.0-62.70~18.04.1","5.4.0-64.72~18.04.1","5.4.0-65.73~18.04.1","5.4.0-66.74~18.04.2","5.4.0-67.75~18.04.1","5.4.0-70.78~18.04.1","5.4.0-71.79~18.04.1","5.4.0-72.80~18.04.1","5.4.0-73.82~18.04.1","5.4.0-74.83~18.04.1","5.4.0-77.86~18.04.1","5.4.0-80.90~18.04.1","5.4.0-81.91~18.04.1","5.4.0-84.94~18.04.1","5.4.0-86.97~18.04.1","5.4.0-87.98~18.04.1","5.4.0-89.100~18.04.1","5.4.0-90.101~18.04.1","5.4.0-91.102~18.04.1","5.4.0-92.103~18.04.2","5.4.0-94.106~18.04.1","5.4.0-96.109~18.04.1","5.4.0-97.110~18.04.1","5.4.0-99.112~18.04.1","5.4.0-100.113~18.04.1","5.4.0-104.118~18.04.1","5.4.0-105.119~18.04.1","5.4.0-107.121~18.04.1","5.4.0-109.123~18.04.1","5.4.0-110.124~18.04.1","5.4.0-113.127~18.04.1","5.4.0-117.132~18.04.1","5.4.0-120.136~18.04.1","5.4.0-121.137~18.04.1","5.4.0-122.138~18.04.1","5.4.0-124.140~18.04.1","5.4.0-125.141~18.04.1","5.4.0-126.142~18.04.1","5.4.0-128.144~18.04.1","5.4.0-131.147~18.04.1","5.4.0-132.148~18.04.1","5.4.0-133.149~18.04.1","5.4.0-135.152~18.04.2","5.4.0-136.153~18.04.1","5.4.0-137.154~18.04.1","5.4.0-139.156~18.04.1","5.4.0-144.161~18.04.1","5.4.0-146.163~18.04.1","5.4.0-147.164~18.04.1","5.4.0-148.165~18.04.1","5.4.0-149.166~18.04.1","5.4.0-150.167~18.04.1","5.4.0-152.169~18.04.1","5.4.0-153.170~18.04.1","5.4.0-155.172~18.04.1","5.4.0-156.173~18.04.1","5.4.0-159.176~18.04.1","5.4.0-162.179~18.04.1","5.4.0-163.180~18.04.1","5.4.0-164.181~18.04.1","5.4.0-165.182~18.04.1","5.4.0-166.183~18.04.2","5.4.0-167.184~18.04.1","5.4.0-169.187~18.04.1","5.4.0-170.188~18.04.1","5.4.0-171.189~18.04.1","5.4.0-172.190~18.04.1","5.4.0-173.191~18.04.1","5.4.0-174.193~18.04.1","5.4.0-175.195~18.04.1","5.4.0-177.197~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-15.16~18.04.1","5.0.0-16.17~18.04.1","5.0.0-17.18~18.04.1","5.0.0-19.20~18.04.1","5.0.0-20.21~18.04.1","5.3.0-19.20~18.04.2","5.3.0-22.24~18.04.1","5.3.0-23.25~18.04.1","5.3.0-23.25~18.04.2","5.3.0-24.26~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-ibm-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1071.76~18.04.1"}]}],"versions":["5.4.0-1010.11~18.04.2","5.4.0-1012.13~18.04.1","5.4.0-1014.15~18.04.1","5.4.0-1015.16~18.04.1","5.4.0-1017.19~18.04.1","5.4.0-1018.20~18.04.1","5.4.0-1019.21~18.04.1","5.4.0-1020.22~18.04.1","5.4.0-1021.23~18.04.1","5.4.0-1023.25~18.04.1","5.4.0-1026.29~18.04.1","5.4.0-1028.32~18.04.1","5.4.0-1029.33~18.04.1","5.4.0-1031.35~18.04.1","5.4.0-1032.36~18.04.1","5.4.0-1033.37~18.04.1","5.4.0-1034.38~18.04.1","5.4.0-1036.41~18.04.1","5.4.0-1037.42~18.04.1","5.4.0-1040.45~18.04.2","5.4.0-1041.46~18.04.1","5.4.0-1042.47~18.04.1","5.4.0-1044.49~18.04.1","5.4.0-1045.50~18.04.1","5.4.0-1046.51~18.04.1","5.4.0-1047.52~18.04.1","5.4.0-1048.53~18.04.1","5.4.0-1049.54~18.04.1","5.4.0-1050.55~18.04.1","5.4.0-1051.56~18.04.1","5.4.0-1052.57~18.04.1","5.4.0-1053.58~18.04.1","5.4.0-1054.59~18.04.1","5.4.0-1056.61~18.04.1","5.4.0-1057.62~18.04.1","5.4.0-1058.63~18.04.1","5.4.0-1059.64~18.04.1","5.4.0-1060.65~18.04.1","5.4.0-1061.66~18.04.1","5.4.0-1063.68~18.04.1","5.4.0-1064.69~18.04.1","5.4.0-1065.70~18.04.1","5.4.0-1066.71~18.04.1","5.4.0-1067.72~18.04.1","5.4.0-1068.73~18.04.1","5.4.0-1069.74~18.04.1","5.4.0-1070.75~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1010.10","4.15.0-1011.11","4.15.0-1012.12","4.15.0-1016.16","4.15.0-1017.17","4.15.0-1019.19","4.15.0-1020.20","4.15.0-1021.21","4.15.0-1023.23","4.15.0-1025.25","4.15.0-1026.26","4.15.0-1027.27","4.15.0-1028.28","4.15.0-1029.29","4.15.0-1030.30","4.15.0-1031.31","4.15.0-1032.32","4.15.0-1034.34","4.15.0-1035.35","4.15.0-1036.36","4.15.0-1038.38","4.15.0-1039.39","4.15.0-1042.42","4.15.0-1043.43","4.15.0-1044.44","4.15.0-1046.46","4.15.0-1047.47","4.15.0-1048.48","4.15.0-1050.50","4.15.0-1051.51","4.15.0-1052.52","4.15.0-1053.53","4.15.0-1056.57","4.15.0-1058.59","4.15.0-1059.60","4.15.0-1060.61","4.15.0-1067.68","4.15.0-1069.70","4.15.0-1071.72","4.15.0-1072.73","4.15.0-1074.75","4.15.0-1075.76","4.15.0-1077.79","4.15.0-1079.81","4.15.0-1081.83","4.15.0-1082.84","4.15.0-1084.86","4.15.0-1085.87","4.15.0-1086.88","4.15.0-1087.89","4.15.0-1088.90","4.15.0-1089.91","4.15.0-1090.92","4.15.0-1091.93","4.15.0-1092.94","4.15.0-1094.96","4.15.0-1097.99","4.15.0-1098.100","4.15.0-1099.101","4.15.0-1100.102","4.15.0-1101.103","4.15.0-1102.104","4.15.0-1103.105","4.15.0-1105.107","4.15.0-1106.108","4.15.0-1107.109","4.15.0-1109.112","4.15.0-1110.113","4.15.0-1112.115","4.15.0-1113.116","4.15.0-1114.117","4.15.0-1116.119","4.15.0-1119.123","4.15.0-1122.127","4.15.0-1123.128","4.15.0-1125.130","4.15.0-1126.131","4.15.0-1127.132","4.15.0-1128.133","4.15.0-1129.134","4.15.0-1132.137","4.15.0-1133.138","4.15.0-1134.139","4.15.0-1135.140","4.15.0-1136.141","4.15.0-1137.142","4.15.0-1138.143","4.15.0-1139.144","4.15.0-1140.145","4.15.0-1141.146","4.15.0-1142.147","4.15.0-1143.148","4.15.0-1144.149","4.15.0-1145.150","4.15.0-1146.151","4.15.0-1147.152","4.15.0-1148.153","4.15.0-1149.154","4.15.0-1150.155","4.15.0-1151.156","4.15.0-1152.157","4.15.0-1153.158","4.15.0-1154.159","4.15.0-1155.160","4.15.0-1156.161","4.15.0-1157.162","4.15.0-1158.163","4.15.0-1159.164","4.15.0-1160.165","4.15.0-1161.166","4.15.0-1162.167","4.15.0-1163.168","4.15.0-1164.169","4.15.0-1165.170","4.15.0-1166.171","4.15.0-1167.172","4.15.0-1168.173","4.15.0-1169.174","4.15.0-1170.175","4.15.0-1171.176","4.15.0-1172.177","4.15.0-1173.178","4.15.0-1174.179","4.15.0-1175.180","4.15.0-1176.181","4.15.0-1177.182","4.15.0-1178.183","4.15.0-1179.184","4.15.0-1180.185","4.15.0-1181.186"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.3","4.15.0-1004.5","4.15.0-1006.9","4.15.0-1008.11","4.15.0-1009.12","4.15.0-1012.15","4.15.0-1013.16","4.15.0-1015.18","4.15.0-1017.20","4.15.0-1018.21","4.15.0-1021.24","4.15.0-1024.29","4.15.0-1026.31","4.15.0-1028.33","4.15.0-1030.35","4.15.0-1033.38","4.15.0-1034.39","4.15.0-1035.40","4.15.0-1036.41","4.15.0-1038.43","4.15.0-1039.44","4.15.0-1043.48","4.15.0-1045.50","4.15.0-1050.57","4.15.0-1056.65","4.15.0-1057.66","4.15.0-1059.68","4.15.0-1063.72","4.15.0-1064.73","4.15.0-1065.75","4.15.0-1066.76","4.15.0-1067.77","4.15.0-1069.79","4.15.0-1073.83","4.15.0-1076.86","4.15.0-1079.89","4.15.0-1080.90","4.15.0-1081.91","4.15.0-1087.97","4.15.0-1090.100","4.15.0-1091.101","4.15.0-1093.103","4.15.0-1094.104","4.15.0-1096.106","4.15.0-1097.107","4.15.0-1099.109","4.15.0-1100.110","4.15.0-1101.112","4.15.0-1102.113","4.15.0-1103.114"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1007.9","4.15.0-1008.10","4.15.0-1009.11","4.15.0-1010.12","4.15.0-1011.13","4.15.0-1013.15","4.15.0-1014.16","4.15.0-1015.17","4.15.0-1017.19","4.15.0-1018.20","4.15.0-1021.23","4.15.0-1022.25","4.15.0-1023.26","4.15.0-1025.28","4.15.0-1026.29","4.15.0-1027.30","4.15.0-1029.32","4.15.0-1030.33","4.15.0-1031.34","4.15.0-1033.36","4.15.0-1035.39","4.15.0-1037.41","4.15.0-1038.42","4.15.0-1039.43","4.15.0-1045.49","4.15.0-1047.51","4.15.0-1048.52","4.15.0-1050.54","4.15.0-1051.55","4.15.0-1053.57","4.15.0-1054.58","4.15.0-1057.62","4.15.0-1058.64","4.15.0-1059.65","4.15.0-1061.67","4.15.0-1062.68","4.15.0-1063.70","4.15.0-1064.71","4.15.0-1065.73","4.15.0-1066.74","4.15.0-1067.75","4.15.0-1068.76","4.15.0-1069.77","4.15.0-1070.78","4.15.0-1071.79","4.15.0-1072.80","4.15.0-1075.83","4.15.0-1078.86","4.15.0-1079.87","4.15.0-1080.88","4.15.0-1081.89","4.15.0-1082.90","4.15.0-1083.91","4.15.0-1084.92","4.15.0-1085.93","4.15.0-1086.94","4.15.0-1087.95","4.15.0-1089.98","4.15.0-1090.99","4.15.0-1091.100","4.15.0-1092.101","4.15.0-1093.102","4.15.0-1095.104","4.15.0-1098.108","4.15.0-1101.112","4.15.0-1102.113","4.15.0-1104.115","4.15.0-1105.116","4.15.0-1106.117","4.15.0-1107.118","4.15.0-1108.119","4.15.0-1111.122","4.15.0-1112.123","4.15.0-1113.124","4.15.0-1114.125","4.15.0-1115.126","4.15.0-1116.127","4.15.0-1117.128","4.15.0-1118.129","4.15.0-1119.130","4.15.0-1120.131","4.15.0-1121.132","4.15.0-1122.133","4.15.0-1123.134","4.15.0-1124.135","4.15.0-1125.136","4.15.0-1126.137","4.15.0-1127.138","4.15.0-1128.139","4.15.0-1129.140","4.15.0-1130.141","4.15.0-1131.142","4.15.0-1132.143","4.15.0-1133.144","4.15.0-1134.145","4.15.0-1135.146","4.15.0-1136.147","4.15.0-1137.148","4.15.0-1138.149","4.15.0-1139.150","4.15.0-1140.151","4.15.0-1141.152","4.15.0-1142.153","4.15.0-1143.154","4.15.0-1144.155","4.15.0-1145.156","4.15.0-1146.157","4.15.0-1147.158","4.15.0-1148.159","4.15.0-1149.160","4.15.0-1150.161","4.15.0-1151.162","4.15.0-1152.163","4.15.0-1153.164","4.15.0-1154.165","4.15.0-1155.166","4.15.0-1156.167","4.15.0-1158.169","4.15.0-1160.171","4.15.0-1161.172"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1007.12~18.04.1","5.0.0-1008.13~18.04.1","5.0.0-1009.14~18.04.1","5.0.0-1010.15~18.04.1","5.0.0-1011.16","5.0.0-1013.18","5.0.0-1014.19"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1011.12~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.18~18.04.1","5.3.0-1018.20~18.04.1","5.3.0-1024.26~18.04.1","5.3.0-1027.29~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-oracle-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1123.132~18.04.1"}]}],"versions":["5.4.0-1019.19~18.04.1","5.4.0-1021.21~18.04.1","5.4.0-1022.22~18.04.1","5.4.0-1024.24~18.04.1","5.4.0-1025.25~18.04.1","5.4.0-1028.29~18.04.1","5.4.0-1029.31~18.04.1","5.4.0-1030.32~18.04.1","5.4.0-1033.35","5.4.0-1034.36~18.04.1","5.4.0-1035.38~18.04.1","5.4.0-1037.40~18.04.1","5.4.0-1038.41~18.04.1","5.4.0-1039.42~18.04.1","5.4.0-1041.44~18.04.1","5.4.0-1042.45~18.04.1","5.4.0-1043.46~18.04.1","5.4.0-1044.47~18.04.1","5.4.0-1046.50~18.04.2","5.4.0-1048.52~18.04.1","5.4.0-1049.53~18.04.1","5.4.0-1052.56~18.04.1","5.4.0-1053.57~18.04.1","5.4.0-1054.58~18.04.1","5.4.0-1055.59~18.04.1","5.4.0-1056.60~18.04.1","5.4.0-1057.61~18.04.1","5.4.0-1058.62~18.04.1","5.4.0-1059.63~18.04.1","5.4.0-1061.65~18.04.1","5.4.0-1062.66~18.04.1","5.4.0-1063.67~18.04.1","5.4.0-1064.68~18.04.1","5.4.0-1066.71~18.04.1","5.4.0-1067.72~18.04.1","5.4.0-1069.75~18.04.1","5.4.0-1070.76~18.04.1","5.4.0-1071.77~18.04.1","5.4.0-1073.79~18.04.1","5.4.0-1076.83~18.04.1","5.4.0-1078.86~18.04.1","5.4.0-1079.87~18.04.1","5.4.0-1081.89~18.04.1","5.4.0-1082.90~18.04.1","5.4.0-1083.91~18.04.1","5.4.0-1084.92~18.04.1","5.4.0-1086.95~18.04.1","5.4.0-1087.96~18.04.1","5.4.0-1090.99~18.04.2","5.4.0-1091.100~18.04.1","5.4.0-1092.101~18.04.1","5.4.0-1093.102~18.04.1","5.4.0-1094.103~18.04.1","5.4.0-1098.107~18.04.1","5.4.0-1099.108~18.04.1","5.4.0-1100.109~18.04.1","5.4.0-1101.110~18.04.1","5.4.0-1102.111~18.04.1","5.4.0-1103.112~18.04.1","5.4.0-1104.113~18.04.1","5.4.0-1105.114~18.04.1","5.4.0-1106.115~18.04.1","5.4.0-1107.116~18.04.1","5.4.0-1108.117~18.04.1","5.4.0-1109.118~18.04.1","5.4.0-1110.119~18.04.1","5.4.0-1111.120~18.04.1","5.4.0-1112.121~18.04.4","5.4.0-1113.122~18.04.1","5.4.0-1115.124~18.04.1","5.4.0-1116.125~18.04.1","5.4.0-1117.126~18.04.1","5.4.0-1118.127~18.04.1","5.4.0-1119.128~18.04.1","5.4.0-1120.129~18.04.1","5.4.0-1121.130~18.04.1","5.4.0-1122.131~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-raspi-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1108.120~18.04.1"}]}],"versions":["5.4.0-1013.13~18.04.1","5.4.0-1015.15~18.04.1","5.4.0-1016.17~18.04.1","5.4.0-1018.20~18.04.1","5.4.0-1019.21~18.04.1","5.4.0-1021.24~18.04.1","5.4.0-1022.25~18.04.1","5.4.0-1023.26~18.04.1","5.4.0-1025.28~18.04.1","5.4.0-1026.29~18.04.1","5.4.0-1028.31~18.04.1","5.4.0-1029.32~18.04.1","5.4.0-1030.33~18.04.1","5.4.0-1032.35~18.04.1","5.4.0-1033.36~18.04.1","5.4.0-1034.37~18.04.1","5.4.0-1035.38~18.04.1","5.4.0-1036.39~18.04.1","5.4.0-1038.41~18.04.1","5.4.0-1041.45~18.04.1","5.4.0-1042.46~18.04.3","5.4.0-1043.47~18.04.1","5.4.0-1044.48~18.04.1","5.4.0-1045.49~18.04.1","5.4.0-1046.50~18.04.1","5.4.0-1047.52~18.04.1","5.4.0-1048.53~18.04.1","5.4.0-1050.56~18.04.1","5.4.0-1052.58~18.04.1","5.4.0-1053.60~18.04.1","5.4.0-1055.62~18.04.1","5.4.0-1056.63~18.04.1","5.4.0-1058.65~18.04.1","5.4.0-1059.66~18.04.1","5.4.0-1060.68~18.04.1","5.4.0-1062.70~18.04.1","5.4.0-1065.75~18.04.1","5.4.0-1066.76~18.04.1","5.4.0-1068.78~18.04.1","5.4.0-1069.79~18.04.1","5.4.0-1070.80~18.04.1","5.4.0-1071.81~18.04.1","5.4.0-1073.84~18.04.1","5.4.0-1074.85~18.04.1","5.4.0-1077.88~18.04.2","5.4.0-1078.89~18.04.1","5.4.0-1079.90~18.04.1","5.4.0-1080.91~18.04.1","5.4.0-1081.92~18.04.1","5.4.0-1082.93~18.04.1","5.4.0-1083.94~18.04.1","5.4.0-1084.95~18.04.1","5.4.0-1085.96~18.04.1","5.4.0-1086.97~18.04.1","5.4.0-1088.99~18.04.1","5.4.0-1089.100~18.04.1","5.4.0-1090.101~18.04.1","5.4.0-1091.102~18.04.1","5.4.0-1092.103~18.04.1","5.4.0-1093.104~18.04.1","5.4.0-1094.105~18.04.1","5.4.0-1095.106~18.04.1","5.4.0-1096.107~18.04.1","5.4.0-1097.109~18.04.2","5.4.0-1098.110~18.04.2","5.4.0-1100.112~18.04.1","5.4.0-1101.113~18.04.1","5.4.0-1102.114~18.04.1","5.4.0-1103.115~18.04.1","5.4.0-1104.116~18.04.1","5.4.0-1105.117~18.04.1","5.4.0-1106.118~18.04.1","5.4.0-1107.119~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:18.04:LTS","package":"linux-aws-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-2000.4","4.15.0-2018.18","4.15.0-2021.21","4.15.0-2022.22","4.15.0-2024.24","4.15.0-2025.25","4.15.0-2026.26","4.15.0-2027.27","4.15.0-2030.31","4.15.0-2031.32","4.15.0-2033.34","4.15.0-2034.35","4.15.0-2035.37","4.15.0-2036.38","4.15.0-2037.39","4.15.0-2038.40","4.15.0-2039.41","4.15.0-2040.42","4.15.0-2041.43","4.15.0-2042.44","4.15.0-2044.46","4.15.0-2045.47","4.15.0-2048.50","4.15.0-2051.53","4.15.0-2052.54","4.15.0-2053.55","4.15.0-2054.56","4.15.0-2055.57","4.15.0-2056.58","4.15.0-2057.59","4.15.0-2059.61","4.15.0-2060.62","4.15.0-2061.63","4.15.0-2063.66","4.15.0-2064.67","4.15.0-2065.68","4.15.0-2066.69","4.15.0-2067.70","4.15.0-2069.72","4.15.0-2072.76","4.15.0-2075.80","4.15.0-2076.81","4.15.0-2078.83","4.15.0-2079.84","4.15.0-2080.85","4.15.0-2081.87","4.15.0-2082.88","4.15.0-2083.89","4.15.0-2085.91","4.15.0-2087.93","4.15.0-2089.95","4.15.0-2090.96","4.15.0-2092.98","4.15.0-2093.99","4.15.0-2094.100","4.15.0-2095.101","4.15.0-2096.102","4.15.0-2097.103","4.15.0-2098.104","4.15.0-2099.105","4.15.0-2100.106","4.15.0-2101.107","4.15.0-2102.108","4.15.0-2103.109","4.15.0-2104.110","4.15.0-2105.111","4.15.0-2106.112","4.15.0-2107.113","4.15.0-2108.114","4.15.0-2109.115","4.15.0-2110.116","4.15.0-2111.117","4.15.0-2112.118","4.15.0-2113.119","4.15.0-2114.120","4.15.0-2115.121","4.15.0-2116.122","4.15.0-2117.123","4.15.0-2118.124","4.15.0-2119.125","4.15.0-2120.126","4.15.0-2121.127","4.15.0-2122.128","4.15.0-2123.129","4.15.0-2124.130","4.15.0-2125.131","4.15.0-2126.132","4.15.0-2127.133","4.15.0-2128.134","4.15.0-2129.135","4.15.0-2130.136","4.15.0-2132.138","4.15.0-2133.139","4.15.0-2134.140","4.15.0-2135.141","4.15.0-2136.142","4.15.0-2137.143"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:18.04:LTS","package":"linux-azure-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2","4.15.0-2006.7","4.15.0-2007.8","4.15.0-2008.9","4.15.0-2009.10","4.15.0-2012.14","4.15.0-2013.15","4.15.0-2015.17","4.15.0-2016.18","4.15.0-2017.20","4.15.0-2018.21","4.15.0-2020.23","4.15.0-2021.24","4.15.0-2022.25","4.15.0-2023.26","4.15.0-2024.27","4.15.0-2025.28","4.15.0-2026.29","4.15.0-2027.30","4.15.0-2030.33","4.15.0-2033.37","4.15.0-2034.38","4.15.0-2035.39","4.15.0-2036.40","4.15.0-2037.41","4.15.0-2038.42","4.15.0-2039.43","4.15.0-2041.45","4.15.0-2042.46","4.15.0-2043.47","4.15.0-2045.49","4.15.0-2046.50","4.15.0-2047.51","4.15.0-2048.52","4.15.0-2049.53","4.15.0-2050.54","4.15.0-2053.58","4.15.0-2056.62","4.15.0-2057.63","4.15.0-2059.65","4.15.0-2060.66","4.15.0-2062.68","4.15.0-2066.72","4.15.0-2067.73","4.15.0-2068.74","4.15.0-2070.76","4.15.0-2071.77","4.15.0-2072.78","4.15.0-2073.79","4.15.0-2074.80","4.15.0-2075.81","4.15.0-2076.82","4.15.0-2077.83","4.15.0-2078.84","4.15.0-2079.85","4.15.0-2080.86","4.15.0-2081.87","4.15.0-2082.88","4.15.0-2084.90","4.15.0-2085.91","4.15.0-2086.92","4.15.0-2087.93","4.15.0-2088.94","4.15.0-2089.95","4.15.0-2090.96","4.15.0-2091.97","4.15.0-2092.98","4.15.0-2093.99","4.15.0-2094.100","4.15.0-2095.101","4.15.0-2096.102","4.15.0-2097.103","4.15.0-2098.104","4.15.0-2099.105","4.15.0-2100.106","4.15.0-2101.107","4.15.0-2102.108","4.15.0-2104.110","4.15.0-2105.111","4.15.0-2106.112","4.15.0-2109.115","4.15.0-2110.116","4.15.0-2111.117","4.15.0-2112.118","4.15.0-2113.119","4.15.0-2114.120","4.15.0-2115.121","4.15.0-2116.122","4.15.0-2117.123"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:18.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1027.32","4.15.0-1029.34","4.15.0-1034.39","4.15.0-1035.40","4.15.0-1037.42","4.15.0-1038.43","4.15.0-1039.44","4.15.0-1040.45","4.15.0-1041.46","4.15.0-1044.50","4.15.0-1045.52","4.15.0-1046.53","4.15.0-1048.55","4.15.0-1049.56","4.15.0-1050.58","4.15.0-1051.59","4.15.0-1052.60","4.15.0-1053.61","4.15.0-1054.62","4.15.0-1055.63","4.15.0-1056.64","4.15.0-1057.65","4.15.0-1058.66","4.15.0-1059.67","4.15.0-1060.68","4.15.0-1063.71","4.15.0-1066.75","4.15.0-1067.76","4.15.0-1068.77","4.15.0-1069.78","4.15.0-1070.79","4.15.0-1071.80","4.15.0-1072.81","4.15.0-1073.82","4.15.0-1075.84","4.15.0-1076.85","4.15.0-1078.87","4.15.0-1080.89","4.15.0-1081.90","4.15.0-1083.92","4.15.0-1084.93","4.15.0-1085.94","4.15.0-1087.96","4.15.0-1090.100","4.15.0-1093.104","4.15.0-1094.105","4.15.0-1096.107","4.15.0-1097.108","4.15.0-1098.109","4.15.0-1099.110","4.15.0-1100.111","4.15.0-1103.114","4.15.0-1104.115","4.15.0-1105.116","4.15.0-1107.118","4.15.0-1108.119","4.15.0-1109.120","4.15.0-1110.121","4.15.0-1111.122","4.15.0-1112.123","4.15.0-1113.124","4.15.0-1114.125","4.15.0-1115.126","4.15.0-1116.127","4.15.0-1117.128","4.15.0-1118.129","4.15.0-1119.130","4.15.0-1121.132","4.15.0-1122.133","4.15.0-1123.134","4.15.0-1124.135","4.15.0-1125.136","4.15.0-1126.137","4.15.0-1127.138","4.15.0-1128.139","4.15.0-1129.140","4.15.0-1130.141","4.15.0-1131.142","4.15.0-1132.143","4.15.0-1133.144","4.15.0-1134.145","4.15.0-1135.146","4.15.0-1136.147","4.15.0-1137.148","4.15.0-1138.149","4.15.0-1139.150","4.15.0-1140.151","4.15.0-1141.153","4.15.0-1142.154","4.15.0-1143.155","4.15.0-1144.156","4.15.0-1145.157","4.15.0-1146.158","4.15.0-1147.159","4.15.0-1148.160","4.15.0-1149.161","4.15.0-1150.162","4.15.0-1151.163","4.15.0-1152.164","4.15.0-1153.165","4.15.0-1154.166"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:18.04:LTS","package":"linux-gcp-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-2013.14","4.15.0-2016.18","4.15.0-2017.19","4.15.0-2018.20","4.15.0-2019.21","4.15.0-2020.22","4.15.0-2021.23","4.15.0-2022.24","4.15.0-2024.26","4.15.0-2025.27","4.15.0-2026.28","4.15.0-2028.31","4.15.0-2029.32","4.15.0-2030.33","4.15.0-2031.34","4.15.0-2032.35","4.15.0-2034.37","4.15.0-2037.41","4.15.0-2040.45","4.15.0-2041.46","4.15.0-2043.48","4.15.0-2044.49","4.15.0-2045.50","4.15.0-2047.52","4.15.0-2050.55","4.15.0-2052.57","4.15.0-2054.59","4.15.0-2055.60","4.15.0-2056.61","4.15.0-2057.62","4.15.0-2058.63","4.15.0-2059.64","4.15.0-2060.65","4.15.0-2061.66","4.15.0-2062.67","4.15.0-2063.68","4.15.0-2064.69","4.15.0-2065.70","4.15.0-2066.71","4.15.0-2067.72","4.15.0-2068.73","4.15.0-2069.74","4.15.0-2070.75","4.15.0-2071.76","4.15.0-2072.77","4.15.0-2073.78","4.15.0-2074.79","4.15.0-2075.80","4.15.0-2076.81","4.15.0-2077.83","4.15.0-2078.84","4.15.0-2079.85","4.15.0-2080.86","4.15.0-2081.87","4.15.0-2082.88","4.15.0-2083.89","4.15.0-2084.90","4.15.0-2085.91","4.15.0-2086.92","4.15.0-2087.93","4.15.0-2088.94","4.15.0-2089.95","4.15.0-2090.96","4.15.0-2091.97","4.15.0-2092.98","4.15.0-2093.99","4.15.0-2094.100","4.15.0-2095.101","4.15.0-2096.102","4.15.0-2097.103","4.15.0-2098.104","4.15.0-2099.105","4.15.0-2100.106"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:18.04:LTS","package":"linux-aws-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-2000.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:18.04:LTS","package":"linux-azure-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:18.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1011.12"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:18.04:LTS","package":"linux-gcp-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1001.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-181.201"}]}],"versions":["5.3.0-18.19","5.3.0-24.26","5.4.0-9.12","5.4.0-18.22","5.4.0-21.25","5.4.0-24.28","5.4.0-25.29","5.4.0-26.30","5.4.0-28.32","5.4.0-29.33","5.4.0-31.35","5.4.0-33.37","5.4.0-37.41","5.4.0-39.43","5.4.0-40.44","5.4.0-42.46","5.4.0-45.49","5.4.0-47.51","5.4.0-48.52","5.4.0-51.56","5.4.0-52.57","5.4.0-53.59","5.4.0-54.60","5.4.0-56.62","5.4.0-58.64","5.4.0-59.65","5.4.0-60.67","5.4.0-62.70","5.4.0-64.72","5.4.0-65.73","5.4.0-66.74","5.4.0-67.75","5.4.0-70.78","5.4.0-71.79","5.4.0-72.80","5.4.0-73.82","5.4.0-74.83","5.4.0-77.86","5.4.0-80.90","5.4.0-81.91","5.4.0-84.94","5.4.0-86.97","5.4.0-88.99","5.4.0-89.100","5.4.0-90.101","5.4.0-91.102","5.4.0-92.103","5.4.0-94.106","5.4.0-96.109","5.4.0-97.110","5.4.0-99.112","5.4.0-100.113","5.4.0-104.118","5.4.0-105.119","5.4.0-107.121","5.4.0-109.123","5.4.0-110.124","5.4.0-113.127","5.4.0-117.132","5.4.0-120.136","5.4.0-121.137","5.4.0-122.138","5.4.0-124.140","5.4.0-125.141","5.4.0-126.142","5.4.0-128.144","5.4.0-131.147","5.4.0-132.148","5.4.0-135.152","5.4.0-136.153","5.4.0-137.154","5.4.0-139.156","5.4.0-144.161","5.4.0-146.163","5.4.0-147.164","5.4.0-148.165","5.4.0-149.166","5.4.0-150.167","5.4.0-152.169","5.4.0-153.170","5.4.0-155.172","5.4.0-156.173","5.4.0-159.176","5.4.0-162.179","5.4.0-163.180","5.4.0-164.181","5.4.0-165.182","5.4.0-166.183","5.4.0-167.184","5.4.0-169.187","5.4.0-170.188","5.4.0-171.189","5.4.0-172.190","5.4.0-173.191","5.4.0-174.193","5.4.0-176.196","5.4.0-177.197"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1124.134"}]}],"versions":["5.3.0-1003.3","5.3.0-1008.9","5.3.0-1009.10","5.3.0-1010.11","5.4.0-1005.5","5.4.0-1007.7","5.4.0-1008.8","5.4.0-1009.9","5.4.0-1011.11","5.4.0-1015.15","5.4.0-1017.17","5.4.0-1018.18","5.4.0-1020.20","5.4.0-1021.21","5.4.0-1022.22","5.4.0-1024.24","5.4.0-1025.25","5.4.0-1028.29","5.4.0-1029.30","5.4.0-1030.31","5.4.0-1032.33","5.4.0-1034.35","5.4.0-1035.37","5.4.0-1037.39","5.4.0-1038.40","5.4.0-1039.41","5.4.0-1041.43","5.4.0-1043.45","5.4.0-1045.47","5.4.0-1047.49","5.4.0-1048.50","5.4.0-1049.51","5.4.0-1051.53","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1058.61","5.4.0-1059.62","5.4.0-1060.63","5.4.0-1061.64","5.4.0-1063.66","5.4.0-1064.67","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1068.72","5.4.0-1069.73","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1073.78","5.4.0-1075.80","5.4.0-1078.84","5.4.0-1080.87","5.4.0-1081.88","5.4.0-1083.90","5.4.0-1084.91","5.4.0-1085.92","5.4.0-1086.93","5.4.0-1088.96","5.4.0-1089.97","5.4.0-1092.100","5.4.0-1093.101","5.4.0-1094.102","5.4.0-1096.104","5.4.0-1097.105","5.4.0-1099.107","5.4.0-1100.108","5.4.0-1101.109","5.4.0-1102.110","5.4.0-1103.111","5.4.0-1104.112","5.4.0-1105.113","5.4.0-1106.114","5.4.0-1107.115","5.4.0-1108.116","5.4.0-1109.118","5.4.0-1110.119","5.4.0-1111.120","5.4.0-1112.121","5.4.0-1113.123","5.4.0-1114.124","5.4.0-1116.126","5.4.0-1117.127","5.4.0-1118.128","5.4.0-1119.129","5.4.0-1120.130","5.4.0-1121.131","5.4.0-1122.132","5.4.0-1123.133"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1061.67~20.04.1"}]}],"versions":["5.15.0-1014.18~20.04.1","5.15.0-1015.19~20.04.1","5.15.0-1017.21~20.04.1","5.15.0-1019.23~20.04.1","5.15.0-1020.24~20.04.1","5.15.0-1021.25~20.04.1","5.15.0-1022.26~20.04.1","5.15.0-1023.27~20.04.1","5.15.0-1026.30~20.04.2","5.15.0-1027.31~20.04.1","5.15.0-1028.32~20.04.1","5.15.0-1030.34~20.04.1","5.15.0-1031.35~20.04.1","5.15.0-1033.37~20.04.1","5.15.0-1034.38~20.04.1","5.15.0-1035.39~20.04.1","5.15.0-1036.40~20.04.1","5.15.0-1037.41~20.04.1","5.15.0-1038.43~20.04.1","5.15.0-1039.44~20.04.1","5.15.0-1040.45~20.04.1","5.15.0-1041.46~20.04.1","5.15.0-1043.48~20.04.1","5.15.0-1044.49~20.04.1","5.15.0-1045.50~20.04.1","5.15.0-1047.52~20.04.1","5.15.0-1048.53~20.04.1","5.15.0-1049.54~20.04.1","5.15.0-1050.55~20.04.1","5.15.0-1051.56~20.04.1","5.15.0-1052.57~20.04.1","5.15.0-1053.58~20.04.1","5.15.0-1055.60~20.04.1","5.15.0-1056.61~20.04.1","5.15.0-1057.63~20.04.1","5.15.0-1058.64~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1129.136"}]}],"versions":["5.3.0-1003.3","5.3.0-1008.9","5.3.0-1009.10","5.4.0-1006.6","5.4.0-1008.8","5.4.0-1009.9","5.4.0-1010.10","5.4.0-1012.12","5.4.0-1016.16","5.4.0-1019.19","5.4.0-1020.20","5.4.0-1022.22","5.4.0-1023.23","5.4.0-1025.25","5.4.0-1026.26","5.4.0-1031.32","5.4.0-1032.33","5.4.0-1034.35","5.4.0-1035.36","5.4.0-1036.38","5.4.0-1039.41","5.4.0-1040.42","5.4.0-1041.43","5.4.0-1043.45","5.4.0-1044.46","5.4.0-1046.48","5.4.0-1047.49","5.4.0-1048.50","5.4.0-1049.51","5.4.0-1051.53","5.4.0-1055.57","5.4.0-1056.58","5.4.0-1058.60","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1064.67","5.4.0-1065.68","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1069.72","5.4.0-1070.73","5.4.0-1072.75","5.4.0-1073.76","5.4.0-1074.77","5.4.0-1077.80","5.4.0-1078.81","5.4.0-1080.83","5.4.0-1083.87","5.4.0-1085.90","5.4.0-1086.91","5.4.0-1089.94","5.4.0-1090.95","5.4.0-1091.96","5.4.0-1094.100","5.4.0-1095.101","5.4.0-1098.104","5.4.0-1100.106","5.4.0-1101.107","5.4.0-1103.109","5.4.0-1104.110","5.4.0-1105.111","5.4.0-1106.112","5.4.0-1107.113","5.4.0-1108.114","5.4.0-1109.115","5.4.0-1110.116","5.4.0-1111.117","5.4.0-1112.118","5.4.0-1113.119","5.4.0-1114.120","5.4.0-1115.122","5.4.0-1116.123","5.4.0-1117.124","5.4.0-1118.125","5.4.0-1119.126","5.4.0-1120.127","5.4.0-1121.128","5.4.0-1122.129","5.4.0-1123.130","5.4.0-1124.131","5.4.0-1126.133","5.4.0-1127.134","5.4.0-1128.135"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1063.72~20.04.1"}]}],"versions":["5.15.0-1007.8~20.04.1","5.15.0-1008.9~20.04.1","5.15.0-1013.16~20.04.1","5.15.0-1014.17~20.04.1","5.15.0-1017.20~20.04.1","5.15.0-1019.24~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1021.26~20.04.1","5.15.0-1022.27~20.04.1","5.15.0-1023.29~20.04.1","5.15.0-1029.36~20.04.1","5.15.0-1030.37~20.04.1","5.15.0-1031.38~20.04.1","5.15.0-1033.40~20.04.1","5.15.0-1034.41~20.04.1","5.15.0-1035.42~20.04.1","5.15.0-1036.43~20.04.1","5.15.0-1037.44~20.04.1","5.15.0-1038.45~20.04.1","5.15.0-1039.46~20.04.1","5.15.0-1040.47~20.04.1","5.15.0-1041.48~20.04.1","5.15.0-1042.49~20.04.1","5.15.0-1043.50~20.04.1","5.15.0-1045.52~20.04.1","5.15.0-1046.53~20.04.1","5.15.0-1047.54~20.04.1","5.15.0-1049.56~20.04.1","5.15.0-1050.57~20.04.1","5.15.0-1051.59~20.04.1","5.15.0-1052.60~20.04.1","5.15.0-1053.61~20.04.1","5.15.0-1054.62~20.04.1","5.15.0-1056.64~20.04.1","5.15.0-1057.65~20.04.1","5.15.0-1058.66~20.04.2","5.15.0-1059.67~20.04.1","5.15.0-1060.69~20.04.1","5.15.0-1061.70~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-bluefield","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1084.91"}]}],"versions":["5.4.0-1007.10","5.4.0-1011.14","5.4.0-1012.15","5.4.0-1013.16","5.4.0-1016.19","5.4.0-1019.22","5.4.0-1020.23","5.4.0-1021.24","5.4.0-1022.25","5.4.0-1023.26","5.4.0-1025.28","5.4.0-1026.29","5.4.0-1028.31","5.4.0-1030.33","5.4.0-1032.35","5.4.0-1035.38","5.4.0-1036.39","5.4.0-1040.44","5.4.0-1042.47","5.4.0-1044.49","5.4.0-1045.50","5.4.0-1046.51","5.4.0-1047.52","5.4.0-1049.55","5.4.0-1050.56","5.4.0-1054.60","5.4.0-1058.64","5.4.0-1059.65","5.4.0-1060.66","5.4.0-1062.68","5.4.0-1064.70","5.4.0-1065.71","5.4.0-1066.72","5.4.0-1068.74","5.4.0-1070.76","5.4.0-1071.77","5.4.0-1072.78","5.4.0-1073.79","5.4.0-1074.80","5.4.0-1075.81","5.4.0-1076.82","5.4.0-1077.83","5.4.0-1078.84","5.4.0-1079.85","5.4.0-1080.87","5.4.0-1081.88","5.4.0-1082.89","5.4.0-1083.90"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1128.137"}]}],"versions":["5.3.0-1004.4","5.3.0-1009.10","5.3.0-1011.12","5.4.0-1005.5","5.4.0-1007.7","5.4.0-1008.8","5.4.0-1009.9","5.4.0-1011.11","5.4.0-1015.15","5.4.0-1018.18","5.4.0-1019.19","5.4.0-1021.21","5.4.0-1022.22","5.4.0-1024.24","5.4.0-1025.25","5.4.0-1028.29","5.4.0-1029.31","5.4.0-1030.32","5.4.0-1032.34","5.4.0-1033.35","5.4.0-1034.37","5.4.0-1036.39","5.4.0-1037.40","5.4.0-1038.41","5.4.0-1040.43","5.4.0-1041.44","5.4.0-1042.45","5.4.0-1043.46","5.4.0-1044.47","5.4.0-1046.49","5.4.0-1049.53","5.4.0-1051.55","5.4.0-1052.56","5.4.0-1053.57","5.4.0-1055.59","5.4.0-1056.60","5.4.0-1057.61","5.4.0-1058.62","5.4.0-1059.63","5.4.0-1060.64","5.4.0-1062.66","5.4.0-1063.67","5.4.0-1064.68","5.4.0-1065.69","5.4.0-1067.71","5.4.0-1068.72","5.4.0-1069.73","5.4.0-1072.77","5.4.0-1073.78","5.4.0-1075.80","5.4.0-1078.84","5.4.0-1080.87","5.4.0-1083.91","5.4.0-1084.92","5.4.0-1086.94","5.4.0-1087.95","5.4.0-1089.97","5.4.0-1090.98","5.4.0-1092.101","5.4.0-1093.102","5.4.0-1096.105","5.4.0-1097.106","5.4.0-1098.107","5.4.0-1100.109","5.4.0-1101.110","5.4.0-1102.111","5.4.0-1103.112","5.4.0-1104.113","5.4.0-1105.114","5.4.0-1106.115","5.4.0-1107.116","5.4.0-1108.117","5.4.0-1109.118","5.4.0-1110.119","5.4.0-1111.120","5.4.0-1112.121","5.4.0-1113.122","5.4.0-1115.124","5.4.0-1116.125","5.4.0-1117.126","5.4.0-1118.127","5.4.0-1120.129","5.4.0-1121.130","5.4.0-1122.131","5.4.0-1123.132","5.4.0-1124.133","5.4.0-1125.134","5.4.0-1126.135","5.4.0-1127.136"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1059.67~20.04.1"}]}],"versions":["5.15.0-1006.9~20.04.1","5.15.0-1012.17~20.04.1","5.15.0-1013.18~20.04.1","5.15.0-1016.21~20.04.1","5.15.0-1017.23~20.04.2","5.15.0-1018.24~20.04.1","5.15.0-1021.28~20.04.1","5.15.0-1022.29~20.04.1","5.15.0-1025.32~20.04.2","5.15.0-1026.33~20.04.1","5.15.0-1027.34~20.04.1","5.15.0-1029.36~20.04.1","5.15.0-1030.37~20.04.1","5.15.0-1031.38~20.04.1","5.15.0-1032.40~20.04.1","5.15.0-1033.41~20.04.1","5.15.0-1034.42~20.04.1","5.15.0-1035.43~20.04.1","5.15.0-1036.44~20.04.1","5.15.0-1037.45~20.04.1","5.15.0-1038.46~20.04.1","5.15.0-1039.47~20.04.1","5.15.0-1040.48~20.04.1","5.15.0-1041.49~20.04.1","5.15.0-1042.50~20.04.1","5.15.0-1044.52~20.04.1","5.15.0-1045.53~20.04.2","5.15.0-1046.54~20.04.1","5.15.0-1047.55~20.04.1","5.15.0-1048.56~20.04.1","5.15.0-1049.57~20.04.1","5.15.0-1051.59~20.04.1","5.15.0-1052.60~20.04.1","5.15.0-1053.61~20.04.1","5.15.0-1054.62~20.04.1","5.15.0-1055.63~20.04.1","5.15.0-1058.66~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1091.95"}]}],"versions":["5.4.0-1008.9","5.4.0-1009.10","5.4.0-1010.11","5.4.0-1011.12","5.4.0-1012.13","5.4.0-1013.14","5.4.0-1014.15","5.4.0-1015.16","5.4.0-1016.17","5.4.0-1018.19","5.4.0-1021.22","5.4.0-1022.23","5.4.0-1023.24","5.4.0-1024.25","5.4.0-1025.26","5.4.0-1026.27","5.4.0-1027.28","5.4.0-1029.30","5.4.0-1031.32","5.4.0-1032.33","5.4.0-1033.34","5.4.0-1034.35","5.4.0-1036.37","5.4.0-1037.38","5.4.0-1038.39","5.4.0-1039.40","5.4.0-1040.41","5.4.0-1043.44","5.4.0-1046.48","5.4.0-1048.51","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1056.60","5.4.0-1057.61","5.4.0-1060.64","5.4.0-1061.65","5.4.0-1062.66","5.4.0-1064.68","5.4.0-1065.69","5.4.0-1066.70","5.4.0-1067.71","5.4.0-1068.72","5.4.0-1069.73","5.4.0-1070.74","5.4.0-1071.75","5.4.0-1072.76","5.4.0-1073.77","5.4.0-1074.78","5.4.0-1075.79","5.4.0-1076.80","5.4.0-1077.81","5.4.0-1078.82","5.4.0-1079.83","5.4.0-1080.84","5.4.0-1081.85","5.4.0-1083.87","5.4.0-1084.88","5.4.0-1085.89","5.4.0-1086.90","5.4.0-1087.91","5.4.0-1088.92","5.4.0-1089.93","5.4.0-1090.94"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1044.51~20.04.1"}]}],"versions":["5.15.0-1003.5~20.04.2","5.15.0-1005.7~20.04.1","5.15.0-1007.10~20.04.1","5.15.0-1008.12~20.04.1","5.15.0-1011.15~20.04.2","5.15.0-1012.16~20.04.1","5.15.0-1013.17~20.04.1","5.15.0-1015.19~20.04.1","5.15.0-1016.21~20.04.1","5.15.0-1017.22~20.04.1","5.15.0-1018.23~20.04.1","5.15.0-1019.24~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1021.26~20.04.1","5.15.0-1022.27~20.04.1","5.15.0-1023.28~20.04.1","5.15.0-1024.29~20.04.1","5.15.0-1025.30~20.04.1","5.15.0-1026.31~20.04.1","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1030.35~20.04.1","5.15.0-1031.37~20.04.1","5.15.0-1032.38~20.04.1","5.15.0-1033.39~20.04.1","5.15.0-1034.40~20.04.1","5.15.0-1035.41~20.04.1","5.15.0-1036.42~20.04.1","5.15.0-1037.43~20.04.1","5.15.0-1038.44~20.04.1","5.15.0-1039.45~20.04.1","5.15.0-1040.46~20.04.1","5.15.0-1043.50~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-106.116~20.04.1"}]}],"versions":["5.15.0-33.34~20.04.1","5.15.0-41.44~20.04.1","5.15.0-43.46~20.04.1","5.15.0-46.49~20.04.1","5.15.0-48.54~20.04.1","5.15.0-50.56~20.04.1","5.15.0-52.58~20.04.1","5.15.0-53.59~20.04.1","5.15.0-56.62~20.04.1","5.15.0-57.63~20.04.1","5.15.0-58.64~20.04.1","5.15.0-60.66~20.04.1","5.15.0-67.74~20.04.1","5.15.0-69.76~20.04.1","5.15.0-70.77~20.04.1","5.15.0-71.78~20.04.1","5.15.0-72.79~20.04.1","5.15.0-73.80~20.04.1","5.15.0-75.82~20.04.1","5.15.0-76.83~20.04.1","5.15.0-78.85~20.04.1","5.15.0-79.86~20.04.2","5.15.0-82.91~20.04.1","5.15.0-83.92~20.04.1","5.15.0-84.93~20.04.1","5.15.0-86.96~20.04.1","5.15.0-87.97~20.04.1","5.15.0-88.98~20.04.1","5.15.0-89.99~20.04.1","5.15.0-91.101~20.04.1","5.15.0-92.102~20.04.1","5.15.0-94.104~20.04.1","5.15.0-97.107~20.04.1","5.15.0-100.110~20.04.1","5.15.0-101.111~20.04.1","5.15.0-102.112~20.04.1","5.15.0-105.115~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1071.76"}]}],"versions":["5.4.0-1003.4","5.4.0-1004.5","5.4.0-1005.6","5.4.0-1006.7","5.4.0-1007.8","5.4.0-1008.9","5.4.0-1010.11","5.4.0-1012.13","5.4.0-1013.14","5.4.0-1014.15","5.4.0-1015.16","5.4.0-1017.19","5.4.0-1018.20","5.4.0-1019.21","5.4.0-1020.22","5.4.0-1021.23","5.4.0-1023.25","5.4.0-1026.29","5.4.0-1028.32","5.4.0-1029.33","5.4.0-1031.35","5.4.0-1032.36","5.4.0-1033.37","5.4.0-1034.38","5.4.0-1036.41","5.4.0-1037.42","5.4.0-1040.45","5.4.0-1041.46","5.4.0-1042.47","5.4.0-1044.49","5.4.0-1045.50","5.4.0-1046.51","5.4.0-1047.52","5.4.0-1048.53","5.4.0-1049.54","5.4.0-1050.55","5.4.0-1051.56","5.4.0-1052.57","5.4.0-1053.58","5.4.0-1054.59","5.4.0-1056.61","5.4.0-1057.62","5.4.0-1058.63","5.4.0-1059.64","5.4.0-1060.65","5.4.0-1061.66","5.4.0-1063.68","5.4.0-1064.69","5.4.0-1065.70","5.4.0-1066.71","5.4.0-1067.72","5.4.0-1068.73","5.4.0-1069.74","5.4.0-1070.75"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-ibm-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1054.57~20.04.1"}]}],"versions":["5.15.0-1033.36~20.04.1","5.15.0-1034.37~20.04.1","5.15.0-1035.38~20.04.1","5.15.0-1036.39~20.04.1","5.15.0-1037.40~20.04.1","5.15.0-1038.41~20.04.1","5.15.0-1040.43~20.04.1","5.15.0-1041.44~20.04.1","5.15.0-1042.45~20.04.1","5.15.0-1043.46~20.04.1","5.15.0-1044.47~20.04.1","5.15.0-1045.48~20.04.1","5.15.0-1046.49~20.04.1","5.15.0-1047.50~20.04.1","5.15.0-1048.51~20.04.1","5.15.0-1049.52~20.04.1","5.15.0-1050.53~20.04.1","5.15.0-1053.56~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-intel-iotg-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1058.64~20.04.1"}]}],"versions":["5.15.0-1003.5~20.04.1","5.15.0-1008.11~20.04.1","5.15.0-1010.14~20.04.1","5.15.0-1015.20~20.04.2","5.15.0-1016.21~20.04.1","5.15.0-1017.22~20.04.1","5.15.0-1018.23~20.04.1","5.15.0-1021.26~20.04.1","5.15.0-1023.28~20.04.1","5.15.0-1025.30~20.04.1","5.15.0-1026.31~20.04.1","5.15.0-1027.32~20.04.1","5.15.0-1030.35~20.04.1","5.15.0-1031.36~20.04.1","5.15.0-1033.38~20.04.1","5.15.0-1034.39~20.04.1","5.15.0-1036.41~20.04.1","5.15.0-1037.42~20.04.1","5.15.0-1038.43~20.04.1","5.15.0-1040.46~20.04.1","5.15.0-1043.49~20.04.1","5.15.0-1045.51~20.04.1","5.15.0-1046.52~20.04.1","5.15.0-1048.54~20.04.1","5.15.0-1049.55~20.04.1","5.15.0-1050.56~20.04.1","5.15.0-1051.57~20.04.1","5.15.0-1052.58~20.04.1","5.15.0-1055.61~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-iot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1036.37"}]}],"versions":["5.4.0-1001.3","5.4.0-1004.6","5.4.0-1005.7","5.4.0-1006.8","5.4.0-1009.11","5.4.0-1010.12","5.4.0-1011.13","5.4.0-1012.14","5.4.0-1013.15","5.4.0-1014.16","5.4.0-1017.18","5.4.0-1018.19","5.4.0-1019.20","5.4.0-1021.22","5.4.0-1022.23","5.4.0-1023.24","5.4.0-1024.25","5.4.0-1025.26","5.4.0-1026.27","5.4.0-1028.29","5.4.0-1029.30","5.4.0-1030.31","5.4.0-1031.32","5.4.0-1032.33","5.4.0-1033.34","5.4.0-1034.35","5.4.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1112.119"}]}],"versions":["5.3.0-1003.3","5.3.0-1008.9","5.3.0-1009.10","5.4.0-1004.4","5.4.0-1006.6","5.4.0-1007.7","5.4.0-1008.8","5.4.0-1009.9","5.4.0-1011.11","5.4.0-1015.15","5.4.0-1018.18","5.4.0-1020.20","5.4.0-1021.21","5.4.0-1023.23","5.4.0-1024.24","5.4.0-1026.27","5.4.0-1028.29","5.4.0-1030.31","5.4.0-1031.32","5.4.0-1032.33","5.4.0-1033.34","5.4.0-1034.35","5.4.0-1036.37","5.4.0-1037.38","5.4.0-1038.39","5.4.0-1039.40","5.4.0-1040.41","5.4.0-1041.42","5.4.0-1044.46","5.4.0-1045.47","5.4.0-1046.48","5.4.0-1047.49","5.4.0-1048.50","5.4.0-1049.51","5.4.0-1050.52","5.4.0-1051.53","5.4.0-1053.55","5.4.0-1054.56","5.4.0-1055.57","5.4.0-1056.58","5.4.0-1058.61","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1065.68","5.4.0-1068.72","5.4.0-1070.75","5.4.0-1071.76","5.4.0-1073.78","5.4.0-1074.79","5.4.0-1075.80","5.4.0-1076.81","5.4.0-1078.84","5.4.0-1079.85","5.4.0-1082.88","5.4.0-1083.89","5.4.0-1084.90","5.4.0-1086.92","5.4.0-1087.93","5.4.0-1088.94","5.4.0-1089.95","5.4.0-1090.96","5.4.0-1091.97","5.4.0-1092.98","5.4.0-1093.99","5.4.0-1094.100","5.4.0-1095.101","5.4.0-1096.102","5.4.0-1097.103","5.4.0-1098.104","5.4.0-1099.105","5.4.0-1100.106","5.4.0-1101.107","5.4.0-1102.108","5.4.0-1103.110","5.4.0-1104.111","5.4.0-1105.112","5.4.0-1106.113","5.4.0-1107.114","5.4.0-1108.115","5.4.0-1109.116","5.4.0-1110.117","5.4.0-1111.118"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-lowlatency-hwe-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-106.116~20.04.1"}]}],"versions":["5.15.0-33.34~20.04.1","5.15.0-42.45~20.04.1","5.15.0-43.46~20.04.1","5.15.0-46.49~20.04.1","5.15.0-48.54~20.04.1","5.15.0-50.56~20.04.1","5.15.0-52.58~20.04.1","5.15.0-53.59~20.04.1","5.15.0-56.62~20.04.1","5.15.0-58.64~20.04.1","5.15.0-60.66~20.04.1","5.15.0-67.74~20.04.1","5.15.0-69.76~20.04.1","5.15.0-70.77~20.04.1","5.15.0-71.78~20.04.1","5.15.0-72.79~20.04.1","5.15.0-73.80~20.04.1","5.15.0-75.82~20.04.1","5.15.0-76.83~20.04.1","5.15.0-78.85~20.04.1","5.15.0-79.88~20.04.1","5.15.0-82.91~20.04.1","5.15.0-83.92~20.04.1","5.15.0-84.93~20.04.1","5.15.0-86.95~20.04.1","5.15.0-87.96~20.04.1","5.15.0-88.98~20.04.1","5.15.0-89.99~20.04.1","5.15.0-91.101~20.04.1","5.15.0-92.102~20.04.1","5.15.0-94.104~20.04.1","5.15.0-97.107~20.04.1","5.15.0-100.110~20.04.1","5.15.0-101.111~20.04.1","5.15.0-102.112~20.04.1","5.15.0-105.115~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-nvidia-tegra-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1027.27~20.04.1"}]}],"versions":["5.15.0-1009.9~20.04.1","5.15.0-1010.10~20.04.1","5.15.0-1012.12~20.04.1","5.15.0-1014.14~20.04.1","5.15.0-1015.15~20.04.1","5.15.0-1016.16~20.04.1","5.15.0-1017.17~20.04.1","5.15.0-1018.18~20.04.1","5.15.0-1019.19~20.04.1","5.15.0-1020.20~20.04.1","5.15.0-1022.22~20.04.1","5.15.0-1025.25~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1123.132"}]}],"versions":["5.3.0-1002.2","5.3.0-1007.8","5.3.0-1008.9","5.4.0-1005.5","5.4.0-1007.7","5.4.0-1008.8","5.4.0-1009.9","5.4.0-1011.11","5.4.0-1015.15","5.4.0-1018.18","5.4.0-1019.19","5.4.0-1021.21","5.4.0-1022.22","5.4.0-1024.24","5.4.0-1025.25","5.4.0-1028.29","5.4.0-1029.31","5.4.0-1030.32","5.4.0-1032.34","5.4.0-1034.36","5.4.0-1035.38","5.4.0-1037.40","5.4.0-1038.41","5.4.0-1039.42","5.4.0-1041.44","5.4.0-1042.45","5.4.0-1043.46","5.4.0-1045.49","5.4.0-1046.50","5.4.0-1048.52","5.4.0-1049.53","5.4.0-1052.56","5.4.0-1053.57","5.4.0-1054.58","5.4.0-1055.59","5.4.0-1056.60","5.4.0-1057.61","5.4.0-1058.62","5.4.0-1059.63","5.4.0-1061.65","5.4.0-1062.66","5.4.0-1063.67","5.4.0-1064.68","5.4.0-1066.71","5.4.0-1067.72","5.4.0-1069.75","5.4.0-1070.76","5.4.0-1071.77","5.4.0-1073.79","5.4.0-1076.83","5.4.0-1078.86","5.4.0-1079.87","5.4.0-1081.89","5.4.0-1082.90","5.4.0-1083.91","5.4.0-1084.92","5.4.0-1086.95","5.4.0-1087.96","5.4.0-1090.99","5.4.0-1091.100","5.4.0-1092.101","5.4.0-1093.102","5.4.0-1094.103","5.4.0-1097.106","5.4.0-1098.107","5.4.0-1099.108","5.4.0-1100.109","5.4.0-1101.110","5.4.0-1102.111","5.4.0-1103.112","5.4.0-1104.113","5.4.0-1105.114","5.4.0-1106.115","5.4.0-1107.116","5.4.0-1108.117","5.4.0-1109.118","5.4.0-1110.119","5.4.0-1111.120","5.4.0-1112.121","5.4.0-1113.122","5.4.0-1115.124","5.4.0-1116.125","5.4.0-1117.126","5.4.0-1118.127","5.4.0-1119.128","5.4.0-1120.129","5.4.0-1121.130","5.4.0-1122.131"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1059.65~20.04.1"}]}],"versions":["5.15.0-1007.9~20.04.1","5.15.0-1013.17~20.04.1","5.15.0-1016.20~20.04.1","5.15.0-1017.22~20.04.1","5.15.0-1018.23~20.04.1","5.15.0-1019.24~20.04.1","5.15.0-1021.27~20.04.1","5.15.0-1022.28~20.04.1","5.15.0-1025.31~20.04.2","5.15.0-1027.33~20.04.1","5.15.0-1029.35~20.04.1","5.15.0-1030.36~20.04.1","5.15.0-1032.38~20.04.1","5.15.0-1033.39~20.04.1","5.15.0-1034.40~20.04.1","5.15.0-1035.41~20.04.1","5.15.0-1036.42~20.04.1","5.15.0-1037.43~20.04.1","5.15.0-1038.44~20.04.1","5.15.0-1039.45~20.04.1","5.15.0-1040.46~20.04.1","5.15.0-1041.47~20.04.1","5.15.0-1042.48~20.04.1","5.15.0-1044.50~20.04.1","5.15.0-1045.51~20.04.1","5.15.0-1046.52~20.04.1","5.15.0-1047.53~20.04.1","5.15.0-1048.54~20.04.1","5.15.0-1049.55~20.04.1","5.15.0-1050.56~20.04.1","5.15.0-1051.57~20.04.1","5.15.0-1052.58~20.04.1","5.15.0-1053.59~20.04.1","5.15.0-1054.60~20.04.1","5.15.0-1055.61~20.04.1","5.15.0-1058.64~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1108.120"}]}],"versions":["5.4.0-1007.7","5.4.0-1008.8","5.4.0-1011.11","5.4.0-1012.12","5.4.0-1013.13","5.4.0-1015.15","5.4.0-1016.17","5.4.0-1018.20","5.4.0-1019.21","5.4.0-1021.24","5.4.0-1022.25","5.4.0-1023.26","5.4.0-1025.28","5.4.0-1026.29","5.4.0-1028.31","5.4.0-1029.32","5.4.0-1030.33","5.4.0-1032.35","5.4.0-1033.36","5.4.0-1034.37","5.4.0-1035.38","5.4.0-1036.39","5.4.0-1038.41","5.4.0-1041.45","5.4.0-1042.46","5.4.0-1043.47","5.4.0-1044.48","5.4.0-1045.49","5.4.0-1046.50","5.4.0-1047.52","5.4.0-1048.53","5.4.0-1050.56","5.4.0-1052.58","5.4.0-1053.60","5.4.0-1055.62","5.4.0-1056.63","5.4.0-1058.65","5.4.0-1059.67","5.4.0-1060.68","5.4.0-1062.70","5.4.0-1065.75","5.4.0-1066.76","5.4.0-1068.78","5.4.0-1069.79","5.4.0-1070.80","5.4.0-1071.81","5.4.0-1073.84","5.4.0-1074.85","5.4.0-1077.88","5.4.0-1078.89","5.4.0-1079.90","5.4.0-1080.91","5.4.0-1081.92","5.4.0-1082.93","5.4.0-1083.94","5.4.0-1084.95","5.4.0-1085.96","5.4.0-1086.97","5.4.0-1088.99","5.4.0-1089.100","5.4.0-1090.101","5.4.0-1091.102","5.4.0-1092.103","5.4.0-1093.104","5.4.0-1094.105","5.4.0-1095.106","5.4.0-1096.107","5.4.0-1097.109","5.4.0-1098.110","5.4.0-1100.112","5.4.0-1101.113","5.4.0-1102.114","5.4.0-1103.115","5.4.0-1104.116","5.4.0-1105.117","5.4.0-1106.118","5.4.0-1107.119"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1057.61~20.04.1"}]}],"versions":["5.15.0-1015.17~20.04.1","5.15.0-1017.19~20.04.1","5.15.0-1018.21~20.04.1","5.15.0-1019.22~20.04.1","5.15.0-1022.26~20.04.1","5.15.0-1023.27~20.04.1","5.15.0-1026.30~20.04.2","5.15.0-1027.31~20.04.1","5.15.0-1028.32~20.04.1","5.15.0-1029.33~20.04.1","5.15.0-1030.34~20.04.1","5.15.0-1031.35~20.04.1","5.15.0-1032.36~20.04.1","5.15.0-1033.37~20.04.1","5.15.0-1034.38~20.04.1","5.15.0-1035.39~20.04.1","5.15.0-1036.40~20.04.2","5.15.0-1037.41~20.04.2","5.15.0-1038.42~20.04.2","5.15.0-1039.43~20.04.2","5.15.0-1040.44~20.04.3","5.15.0-1041.45~20.04.1","5.15.0-1043.47~20.04.1","5.15.0-1044.48~20.04.1","5.15.0-1045.49~20.04.1","5.15.0-1046.50~20.04.1","5.15.0-1047.51~20.04.1","5.15.0-1048.52~20.04.1","5.15.0-1049.53~20.04.2","5.15.0-1050.54~20.04.1","5.15.0-1051.55~20.04.1","5.15.0-1052.56~20.04.1","5.15.0-1053.57~20.04.1","5.15.0-1056.60~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-xilinx-zynqmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1043.47"}]}],"versions":["5.4.0-1020.24","5.4.0-1021.25","5.4.0-1022.26","5.4.0-1023.27","5.4.0-1024.28","5.4.0-1025.29","5.4.0-1026.30","5.4.0-1027.31","5.4.0-1028.32","5.4.0-1029.33","5.4.0-1030.34","5.4.0-1031.35","5.4.0-1032.36","5.4.0-1033.37","5.4.0-1034.38","5.4.0-1035.39","5.4.0-1036.40","5.4.0-1037.41","5.4.0-1038.42","5.4.0-1039.43","5.4.0-1040.44","5.4.0-1041.45","5.4.0-1042.46"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.9~20.04.2","5.11.0-1014.15~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.2","5.11.0-1021.22~20.04.2","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.2","5.13.0-1011.12~20.04.1","5.13.0-1012.13~20.04.1","5.13.0-1014.15~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1019.21~20.04.1","5.13.0-1021.23~20.04.2","5.13.0-1022.24~20.04.1","5.13.0-1023.25~20.04.1","5.13.0-1025.27~20.04.1","5.13.0-1028.31~20.04.1","5.13.0-1029.32~20.04.1","5.13.0-1031.35~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1041.43~20.04.1","5.8.0-1042.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1007.7~20.04.2","5.11.0-1012.13~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10~20.04.2","5.13.0-1012.14~20.04.1","5.13.0-1013.15~20.04.1","5.13.0-1014.16~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1021.24~20.04.1","5.13.0-1022.26~20.04.1","5.13.0-1023.27~20.04.1","5.13.0-1025.29~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1029.34~20.04.1","5.13.0-1031.37~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1033.35~20.04.1","5.8.0-1036.38~20.04.1","5.8.0-1039.42~20.04.1","5.8.0-1040.43~20.04.1","5.8.0-1041.44~20.04.1","5.8.0-1042.45~20.04.1","5.8.0-1043.46~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1063.66+cvm2.2","5.4.0-1063.66+cvm3.2","5.4.0-1064.67+cvm1.1","5.4.0-1065.68+cvm2.1","5.4.0-1067.70+cvm1.1","5.4.0-1068.71+cvm1.1","5.4.0-1069.72+cvm1.1","5.4.0-1070.73+cvm1.1","5.4.0-1072.75+cvm1.1","5.4.0-1073.76+cvm1.1","5.4.0-1074.77+cvm1.1","5.4.0-1076.79+cvm1.1","5.4.0-1078.81+cvm1.1","5.4.0-1080.83+cvm1.1","5.4.0-1083.87+cvm1.1","5.4.0-1085.90+cvm1.1","5.4.0-1085.90+cvm2.1","5.4.0-1086.91+cvm1.1","5.4.0-1089.94+cvm1.2","5.4.0-1090.95+cvm1.1","5.4.0-1091.96+cvm1.1","5.4.0-1092.97+cvm1.1","5.4.0-1095.101+cvm1.1","5.4.0-1098.104+cvm1.1","5.4.0-1100.106+cvm1.1","5.4.0-1103.109+cvm1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.10~20.04.1","5.11.0-1014.16~20.04.1","5.11.0-1017.19~20.04.1","5.11.0-1018.20~20.04.2","5.11.0-1020.22~20.04.1","5.11.0-1021.23~20.04.1","5.11.0-1022.24~20.04.1","5.11.0-1023.25~20.04.1","5.11.0-1024.26~20.04.1","5.11.0-1026.29~20.04.1","5.11.0-1028.32~20.04.1","5.11.0-1029.33~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.3","5.13.0-1012.15~20.04.1","5.13.0-1013.16~20.04.1","5.13.0-1015.18~20.04.1","5.13.0-1019.23~20.04.1","5.13.0-1021.25~20.04.1","5.13.0-1023.28~20.04.1","5.13.0-1024.29~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1030.36~20.04.1","5.13.0-1031.37~20.04.1","5.13.0-1033.40~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1032.34~20.04.1","5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1039.41"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1033.35","5.4.0-1035.37","5.4.0-1036.38","5.4.0-1037.39","5.4.0-1039.41","5.4.0-1041.43","5.4.0-1042.44","5.4.0-1043.45","5.4.0-1044.46","5.4.0-1046.48","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1074.79","5.4.0-1076.82","5.4.0-1078.84","5.4.0-1080.86","5.4.0-1081.87","5.4.0-1083.89","5.4.0-1084.90","5.4.0-1086.93","5.4.0-1087.94","5.4.0-1090.97","5.4.0-1091.98","5.4.0-1094.101","5.4.0-1095.102","5.4.0-1096.103","5.4.0-1097.104","5.4.0-1098.105","5.4.0-1099.106","5.4.0-1100.107","5.4.0-1101.108","5.4.0-1102.109","5.4.0-1103.110","5.4.0-1104.111","5.4.0-1105.112"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1011.14~20.04.1","5.15.0-1014.17~20.04.1","5.15.0-1015.18~20.04.1","5.15.0-1016.19~20.04.1","5.15.0-1019.23~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1023.28~20.04.2","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1029.34~20.04.1","5.15.0-1031.36~20.04.1","5.15.0-1032.37~20.04.1","5.15.0-1033.38~20.04.1","5.15.0-1034.39~20.04.1","5.15.0-1036.41~20.04.1","5.15.0-1037.42~20.04.1","5.15.0-1038.43~20.04.1","5.15.0-1039.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-22.23~20.04.1","5.11.0-25.27~20.04.1","5.11.0-27.29~20.04.1","5.11.0-34.36~20.04.1","5.11.0-36.40~20.04.1","5.11.0-37.41~20.04.2","5.11.0-38.42~20.04.1","5.11.0-40.44~20.04.2","5.11.0-41.45~20.04.1","5.11.0-43.47~20.04.2","5.11.0-44.48~20.04.2","5.11.0-46.51~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-21.21~20.04.1","5.13.0-22.22~20.04.1","5.13.0-23.23~20.04.2","5.13.0-25.26~20.04.1","5.13.0-27.29~20.04.1","5.13.0-28.31~20.04.1","5.13.0-30.33~20.04.1","5.13.0-35.40~20.04.1","5.13.0-37.42~20.04.1","5.13.0-39.44~20.04.1","5.13.0-40.45~20.04.1","5.13.0-41.46~20.04.1","5.13.0-44.49~20.04.1","5.13.0-48.54~20.04.1","5.13.0-51.58~20.04.1","5.13.0-52.59~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-23.24~20.04.1","5.8.0-25.26~20.04.1","5.8.0-28.30~20.04.1","5.8.0-29.31~20.04.1","5.8.0-31.33~20.04.1","5.8.0-33.36~20.04.1","5.8.0-34.37~20.04.2","5.8.0-36.40~20.04.1","5.8.0-38.43~20.04.1","5.8.0-40.45~20.04.1","5.8.0-41.46~20.04.1","5.8.0-43.49~20.04.1","5.8.0-44.50~20.04.1","5.8.0-45.51~20.04.1","5.8.0-48.54~20.04.1","5.8.0-49.55~20.04.1","5.8.0-50.56~20.04.1","5.8.0-53.60~20.04.1","5.8.0-55.62~20.04.1","5.8.0-59.66~20.04.1","5.8.0-63.71~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-intel-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1007.7","5.13.0-1008.8","5.13.0-1009.9","5.13.0-1010.10","5.13.0-1011.11","5.13.0-1014.15","5.13.0-1017.19"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.0-1008.9","5.10.0-1011.12","5.10.0-1013.14","5.10.0-1014.15","5.10.0-1016.17","5.10.0-1017.18","5.10.0-1019.20","5.10.0-1021.22","5.10.0-1022.23","5.10.0-1023.24","5.10.0-1025.26","5.10.0-1026.27","5.10.0-1029.30","5.10.0-1032.33","5.10.0-1033.34","5.10.0-1034.35","5.10.0-1038.40","5.10.0-1044.46","5.10.0-1045.47","5.10.0-1049.51","5.10.0-1050.52","5.10.0-1051.53","5.10.0-1052.54","5.10.0-1053.55","5.10.0-1055.58","5.10.0-1057.61"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10","5.13.0-1010.11","5.13.0-1012.16","5.13.0-1014.18","5.13.0-1017.21","5.13.0-1019.23","5.13.0-1020.24","5.13.0-1021.25","5.13.0-1022.26","5.13.0-1026.32","5.13.0-1028.35","5.13.0-1029.36"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.14.0-1004.4","5.14.0-1005.5","5.14.0-1007.7","5.14.0-1008.8","5.14.0-1010.10","5.14.0-1011.11","5.14.0-1013.13","5.14.0-1018.19","5.14.0-1020.22","5.14.0-1022.24","5.14.0-1024.26","5.14.0-1027.30","5.14.0-1029.32","5.14.0-1031.34","5.14.0-1032.35","5.14.0-1033.36","5.14.0-1034.37","5.14.0-1036.40","5.14.0-1038.42","5.14.0-1042.47","5.14.0-1044.49","5.14.0-1045.51","5.14.0-1046.53","5.14.0-1047.54","5.14.0-1048.55","5.14.0-1049.56","5.14.0-1050.57","5.14.0-1051.58","5.14.0-1052.59","5.14.0-1054.61","5.14.0-1055.62","5.14.0-1056.63","5.14.0-1057.64","5.14.0-1058.66","5.14.0-1059.67"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.0-1007.7","5.6.0-1008.8","5.6.0-1010.10","5.6.0-1011.11","5.6.0-1013.13","5.6.0-1017.17","5.6.0-1018.18","5.6.0-1020.20","5.6.0-1021.21","5.6.0-1023.23","5.6.0-1026.26","5.6.0-1027.27","5.6.0-1028.28","5.6.0-1031.32","5.6.0-1032.33","5.6.0-1033.35","5.6.0-1034.36","5.6.0-1035.37","5.6.0-1036.39","5.6.0-1039.43","5.6.0-1042.46","5.6.0-1047.51","5.6.0-1048.52","5.6.0-1050.54","5.6.0-1052.56","5.6.0-1053.57","5.6.0-1054.58","5.6.0-1055.59","5.6.0-1056.60"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1008.8~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1011.13~20.04.2","5.13.0-1015.19~20.04.1","5.13.0-1016.20~20.04.1","5.13.0-1018.22~20.04.1","5.13.0-1021.26~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1030.35~20.04.1","5.13.0-1033.39~20.04.1","5.13.0-1034.40~20.04.1","5.13.0-1036.43~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1031.32~20.04.2","5.8.0-1033.34~20.04.1","5.8.0-1034.35~20.04.2","5.8.0-1037.38~20.04.1","5.8.0-1038.39~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8","5.3.0-1014.16","5.3.0-1015.17","5.3.0-1017.19","5.4.0-1004.4","5.4.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-24.28","5.4.0-26.30","5.4.0-27.31","5.4.0-28.32","5.4.0-30.34","5.4.0-31.35","5.4.0-33.37","5.4.0-34.38","5.4.0-36.41","5.4.0-37.42","5.4.0-39.44","5.4.0-40.45"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1018.19~20.04.2","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1024.25~20.04.1","5.11.0-1026.28~20.04.1","5.11.0-1028.31~20.04.1","5.11.0-1029.32~20.04.1","5.11.0-1030.34","5.11.0-1031.35"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14.16~20.04.1","5.8.0-14.16~20.04.3","5.8.0-16.18~20.04.1","5.8.0-17.19~20.04.1","5.8.0-18.20~20.04.1","5.8.0-20.22~20.04.1","5.8.0-22.24~20.04.1","5.8.0-25.27~20.04.1","5.8.0-26.28~20.04.1","5.8.0-29.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:20.04:LTS","package":"linux-aws-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1124.134+fips1"}]}],"versions":["5.4.0-1021.21+fips2","5.4.0-1069.73+fips2","5.4.0-1071.76+fips1","5.4.0-1072.77+fips1","5.4.0-1073.78+fips1","5.4.0-1078.84+fips1","5.4.0-1080.87+fips1","5.4.0-1081.88+fips1","5.4.0-1083.90+fips1","5.4.0-1085.92+fips1","5.4.0-1086.93+fips1","5.4.0-1088.96+fips1","5.4.0-1089.97+fips1","5.4.0-1092.100+fips1","5.4.0-1093.101+fips1","5.4.0-1094.102+fips1","5.4.0-1096.104+fips1","5.4.0-1099.107+fips1","5.4.0-1100.108+fips1","5.4.0-1101.109+fips1","5.4.0-1102.110+fips1","5.4.0-1103.111+fips1","5.4.0-1104.112+fips1","5.4.0-1105.113+fips1","5.4.0-1106.114+fips1","5.4.0-1107.115+fips1","5.4.0-1108.116+fips1","5.4.0-1109.118+fips1","5.4.0-1110.119+fips1","5.4.0-1111.120+fips1","5.4.0-1112.121+fips1","5.4.0-1113.123+fips1","5.4.0-1114.124+fips1","5.4.0-1116.126+fips1","5.4.0-1117.127+fips1","5.4.0-1118.128+fips1","5.4.0-1119.129+fips1","5.4.0-1120.130+fips1","5.4.0-1121.131+fips1","5.4.0-1122.132+fips1","5.4.0-1123.133+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:20.04:LTS","package":"linux-azure-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1129.136+fips1"}]}],"versions":["5.4.0-1022.22+fips1","5.4.0-1073.76+fips1","5.4.0-1074.77+fips1","5.4.0-1076.79+fips1","5.4.0-1078.81+fips1","5.4.0-1080.83+fips1","5.4.0-1083.87+fips1","5.4.0-1085.90+fips1","5.4.0-1086.91+fips1","5.4.0-1089.94+fips1","5.4.0-1090.95+fips1","5.4.0-1091.96+fips1","5.4.0-1094.100+fips1","5.4.0-1095.101+fips1","5.4.0-1098.104+fips1","5.4.0-1100.106+fips1","5.4.0-1101.107+fips1","5.4.0-1103.109+fips1","5.4.0-1104.110+fips1","5.4.0-1105.111+fips1","5.4.0-1106.112+fips1","5.4.0-1107.113+fips1","5.4.0-1108.114+fips1","5.4.0-1109.115+fips1","5.4.0-1110.116+fips1","5.4.0-1111.117+fips1","5.4.0-1112.118+fips1","5.4.0-1113.119+fips1","5.4.0-1114.120+fips1","5.4.0-1115.122+fips1","5.4.0-1116.123+fips1","5.4.0-1117.124+fips1","5.4.0-1118.125+fips1","5.4.0-1119.126+fips1","5.4.0-1121.128+fips1","5.4.0-1122.129+fips1","5.4.0-1123.130+fips1","5.4.0-1124.131+fips1","5.4.0-1126.133+fips1","5.4.0-1127.134+fips1","5.4.0-1128.135+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:20.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1098.108"}]}],"versions":["5.4.0-1026.30","5.4.0-1028.32","5.4.0-1031.36","5.4.0-1032.37","5.4.0-1033.38","5.4.0-1034.40","5.4.0-1035.41","5.4.0-1036.42","5.4.0-1037.43","5.4.0-1038.44","5.4.0-1040.46","5.4.0-1041.47","5.4.0-1042.48","5.4.0-1043.49","5.4.0-1045.51","5.4.0-1046.52","5.4.0-1047.53","5.4.0-1048.54","5.4.0-1049.55","5.4.0-1051.57","5.4.0-1054.61","5.4.0-1056.64","5.4.0-1057.65","5.4.0-1059.67","5.4.0-1060.68","5.4.0-1061.69","5.4.0-1062.70","5.4.0-1064.73","5.4.0-1065.74","5.4.0-1068.77","5.4.0-1069.78","5.4.0-1070.79","5.4.0-1072.81","5.4.0-1073.82","5.4.0-1074.83","5.4.0-1075.84","5.4.0-1076.85","5.4.0-1077.86","5.4.0-1078.87","5.4.0-1079.88","5.4.0-1080.89","5.4.0-1081.90","5.4.0-1082.91","5.4.0-1083.92","5.4.0-1084.93","5.4.0-1085.94","5.4.0-1086.95","5.4.0-1087.96","5.4.0-1088.97","5.4.0-1089.98","5.4.0-1090.100","5.4.0-1091.101","5.4.0-1092.102","5.4.0-1094.104","5.4.0-1095.105","5.4.0-1096.106","5.4.0-1097.107"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:20.04:LTS","package":"linux-gcp-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1128.137+fips1"}]}],"versions":["5.4.0-1021.21+fips1","5.4.0-1067.71~20.04.1","5.4.0-1069.73+fips2","5.4.0-1071.75+fips1","5.4.0-1073.78+fips1","5.4.0-1075.80+fips1","5.4.0-1078.84+fips1","5.4.0-1080.87+fips1","5.4.0-1081.88+fips1","5.4.0-1086.94+fips1","5.4.0-1087.95+fips1","5.4.0-1089.97+fips1","5.4.0-1092.101+fips1","5.4.0-1093.102+fips1","5.4.0-1096.105+fips1","5.4.0-1097.106+fips1","5.4.0-1098.107+fips1","5.4.0-1100.109+fips1","5.4.0-1101.110+fips1","5.4.0-1102.111+fips1","5.4.0-1103.112+fips1","5.4.0-1104.113+fips1","5.4.0-1105.114+fips1","5.4.0-1106.115+fips1","5.4.0-1107.116+fips1","5.4.0-1108.117+fips1","5.4.0-1109.118+fips1","5.4.0-1110.119+fips1","5.4.0-1111.120+fips1","5.4.0-1112.121+fips1","5.4.0-1113.122+fips1","5.4.0-1115.124+fips1","5.4.0-1116.125+fips1","5.4.0-1117.126+fips1","5.4.0-1118.127+fips1","5.4.0-1120.129+fips1","5.4.0-1121.130+fips1","5.4.0-1122.131+fips1","5.4.0-1124.133+fips1","5.4.0-1125.134+fips1","5.4.0-1126.135+fips1","5.4.0-1127.136+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:20.04:LTS","package":"linux-aws-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1021.21+fips2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:20.04:LTS","package":"linux-azure-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1022.22+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:20.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1007.8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:20.04:LTS","package":"linux-gcp-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1021.21+fips1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-106.116"}]}],"versions":["5.13.0-19.19","5.15.0-17.17","5.15.0-18.18","5.15.0-22.22","5.15.0-23.23","5.15.0-25.25","5.15.0-27.28","5.15.0-30.31","5.15.0-33.34","5.15.0-35.36","5.15.0-37.39","5.15.0-39.42","5.15.0-40.43","5.15.0-41.44","5.15.0-43.46","5.15.0-46.49","5.15.0-47.51","5.15.0-48.54","5.15.0-50.56","5.15.0-52.58","5.15.0-53.59","5.15.0-56.62","5.15.0-57.63","5.15.0-58.64","5.15.0-60.66","5.15.0-67.74","5.15.0-69.76","5.15.0-70.77","5.15.0-71.78","5.15.0-72.79","5.15.0-73.80","5.15.0-75.82","5.15.0-76.83","5.15.0-78.85","5.15.0-79.86","5.15.0-82.91","5.15.0-83.92","5.15.0-84.93","5.15.0-86.96","5.15.0-87.97","5.15.0-88.98","5.15.0-89.99","5.15.0-91.101","5.15.0-92.102","5.15.0-94.104","5.15.0-97.107","5.15.0-100.110","5.15.0-101.111","5.15.0-102.112","5.15.0-105.115"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-allwinner-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1007.7~22.04.1","5.19.0-1009.9~22.04.1","5.19.0-1010.10~22.04.1","5.19.0-1011.11~22.04.1","5.19.0-1012.12~22.04.1","5.19.0-1013.13~22.04.1","5.19.0-1014.14~22.04.1","5.19.0-1015.15~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1061.67"}]}],"versions":["5.13.0-1005.6","5.15.0-1002.4","5.15.0-1003.5","5.15.0-1004.6","5.15.0-1005.7","5.15.0-1008.10","5.15.0-1009.11","5.15.0-1011.14","5.15.0-1013.17","5.15.0-1014.18","5.15.0-1015.19","5.15.0-1017.21","5.15.0-1019.23","5.15.0-1020.24","5.15.0-1021.25","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32","5.15.0-1030.34","5.15.0-1031.35","5.15.0-1033.37","5.15.0-1034.38","5.15.0-1035.39","5.15.0-1036.40","5.15.0-1037.41","5.15.0-1038.43","5.15.0-1039.44","5.15.0-1040.45","5.15.0-1042.47","5.15.0-1043.48","5.15.0-1044.49","5.15.0-1045.50","5.15.0-1047.52","5.15.0-1048.53","5.15.0-1049.54","5.15.0-1050.55","5.15.0-1051.56","5.15.0-1052.57","5.15.0-1053.58","5.15.0-1055.60","5.15.0-1056.61","5.15.0-1057.63","5.15.0-1060.66"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1019.20~22.04.1","5.19.0-1020.21~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1026.27~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1029.30~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.0-1023.23~22.04.1"}]}],"versions":["6.5.0-1008.8~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1012.12~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.2","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1022.22~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1063.72"}]}],"versions":["5.13.0-1006.7","5.15.0-1001.2","5.15.0-1002.3","5.15.0-1003.4","5.15.0-1005.6","5.15.0-1007.8","5.15.0-1008.9","5.15.0-1010.12","5.15.0-1012.15","5.15.0-1013.16","5.15.0-1014.17","5.15.0-1017.20","5.15.0-1019.24","5.15.0-1020.25","5.15.0-1021.26","5.15.0-1022.27","5.15.0-1023.29","5.15.0-1024.30","5.15.0-1029.36","5.15.0-1030.37","5.15.0-1031.38","5.15.0-1033.40","5.15.0-1034.41","5.15.0-1035.42","5.15.0-1036.43","5.15.0-1037.44","5.15.0-1038.45","5.15.0-1039.46","5.15.0-1040.47","5.15.0-1041.48","5.15.0-1042.49","5.15.0-1044.51","5.15.0-1045.52","5.15.0-1046.53","5.15.0-1047.54","5.15.0-1049.56","5.15.0-1050.57","5.15.0-1051.59","5.15.0-1052.60","5.15.0-1053.61","5.15.0-1054.62","5.15.0-1056.64","5.15.0-1057.65","5.15.0-1058.66","5.15.0-1059.67","5.15.0-1060.69","5.15.0-1061.70"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.21~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1025.28~22.04.1","5.19.0-1026.29~22.04.1","5.19.0-1027.30~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1","6.2.0-1019.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.0-1024.25~22.04.1"}]}],"versions":["6.5.0-1007.7~22.04.1","6.5.0-1009.9~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.19~22.04.2","6.5.0-1019.20~22.04.1","6.5.0-1021.22~22.04.1","6.5.0-1022.23~22.04.1","6.5.0-1023.24~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1063.72.1"}]}],"versions":["5.15.0-1019.24.1","5.15.0-1024.30.1","5.15.0-1029.36.1","5.15.0-1030.37.1","5.15.0-1031.38.1","5.15.0-1033.40.1","5.15.0-1034.41.1","5.15.0-1035.42.1","5.15.0-1036.43.1","5.15.0-1037.44.1","5.15.0-1038.45.1","5.15.0-1039.46.1","5.15.0-1041.48.1","5.15.0-1042.49.1","5.15.0-1044.51.1","5.15.0-1045.52.1","5.15.0-1046.53.1","5.15.0-1047.54.1","5.15.0-1049.56.1","5.15.0-1050.57.1","5.15.0-1051.59.1","5.15.0-1052.60.1","5.15.0-1053.61.1","5.15.0-1054.62.1","5.15.0-1056.64.1","5.15.0-1057.65.1","5.15.0-1058.66.1","5.15.0-1059.67.1","5.15.0-1060.69.1","5.15.0-1061.70.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1025.28~22.04.1.1","5.19.0-1026.29~22.04.1.1","5.19.0-1027.30~22.04.2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1.1","6.2.0-1009.9~22.04.3.1","6.2.0-1011.11~22.04.1.1","6.2.0-1012.12~22.04.1.1","6.2.0-1014.14~22.04.1.1","6.2.0-1015.15~22.04.1.1","6.2.0-1016.16~22.04.1.1","6.2.0-1017.17~22.04.1.1","6.2.0-1018.18~22.04.1.1","6.2.0-1019.19~22.04.1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1059.67"}]}],"versions":["5.13.0-1005.6","5.15.0-1001.3","5.15.0-1002.5","5.15.0-1003.6","5.15.0-1004.7","5.15.0-1005.8","5.15.0-1006.9","5.15.0-1008.12","5.15.0-1010.15","5.15.0-1013.18","5.15.0-1016.21","5.15.0-1017.23","5.15.0-1018.24","5.15.0-1019.25","5.15.0-1021.28","5.15.0-1022.29","5.15.0-1025.32","5.15.0-1026.33","5.15.0-1027.34","5.15.0-1029.36","5.15.0-1030.37","5.15.0-1031.38","5.15.0-1032.40","5.15.0-1034.42","5.15.0-1035.43","5.15.0-1036.44","5.15.0-1037.45","5.15.0-1038.46","5.15.0-1039.47","5.15.0-1040.48","5.15.0-1041.49","5.15.0-1042.50","5.15.0-1044.52","5.15.0-1045.53","5.15.0-1046.54","5.15.0-1047.55","5.15.0-1048.56","5.15.0-1049.57","5.15.0-1051.59","5.15.0-1052.60","5.15.0-1053.61","5.15.0-1054.62","5.15.0-1055.63","5.15.0-1058.66"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.22~22.04.2","5.19.0-1021.23~22.04.1","5.19.0-1022.24~22.04.1","5.19.0-1024.26~22.04.1","5.19.0-1025.27~22.04.1","5.19.0-1026.28~22.04.1","5.19.0-1027.29~22.04.1","5.19.0-1030.32~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1011.11~22.04.3","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1016.18~22.04.1","6.2.0-1017.19~22.04.1","6.2.0-1018.20~22.04.1","6.2.0-1019.21~22.04.1","6.2.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.0-1024.26~22.04.1"}]}],"versions":["6.5.0-1010.10~22.04.3","6.5.0-1011.11~22.04.1","6.5.0-1013.13~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1022.24~22.04.1","6.5.0-1023.25~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1058.63"}]}],"versions":["5.15.0-1002.2","5.15.0-1003.3","5.15.0-1004.5","5.15.0-1005.6","5.15.0-1006.7","5.15.0-1008.10","5.15.0-1010.13","5.15.0-1011.14","5.15.0-1014.17","5.15.0-1015.18","5.15.0-1016.19","5.15.0-1017.20","5.15.0-1019.23","5.15.0-1020.25","5.15.0-1023.28","5.15.0-1024.29","5.15.0-1027.32","5.15.0-1028.33","5.15.0-1030.35","5.15.0-1031.36","5.15.0-1032.37","5.15.0-1033.38","5.15.0-1034.39","5.15.0-1035.40","5.15.0-1036.41","5.15.0-1037.42","5.15.0-1038.43","5.15.0-1039.44","5.15.0-1040.45","5.15.0-1041.46","5.15.0-1042.47","5.15.0-1044.49","5.15.0-1045.50","5.15.0-1046.51","5.15.0-1047.52","5.15.0-1048.53","5.15.0-1049.54","5.15.0-1050.55","5.15.0-1051.56","5.15.0-1052.57","5.15.0-1053.58","5.15.0-1054.59","5.15.0-1057.62"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1044.51"}]}],"versions":["5.15.0-1001.2","5.15.0-1002.4","5.15.0-1003.5","5.15.0-1004.6","5.15.0-1005.7","5.15.0-1007.10","5.15.0-1008.12","5.15.0-1011.15","5.15.0-1012.16","5.15.0-1013.17","5.15.0-1015.19","5.15.0-1016.21","5.15.0-1017.22","5.15.0-1018.23","5.15.0-1019.24","5.15.0-1020.25","5.15.0-1021.26","5.15.0-1022.27","5.15.0-1023.28","5.15.0-1024.29","5.15.0-1025.30","5.15.0-1026.31","5.15.0-1027.32","5.15.0-1028.33","5.15.0-1030.35","5.15.0-1031.37","5.15.0-1032.38","5.15.0-1033.39","5.15.0-1034.40","5.15.0-1035.41","5.15.0-1036.42","5.15.0-1037.43","5.15.0-1038.44","5.15.0-1039.45","5.15.0-1040.46","5.15.0-1043.50"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-28.29~22.04.1","5.19.0-32.33~22.04.1","5.19.0-35.36~22.04.1","5.19.0-38.39~22.04.1","5.19.0-40.41~22.04.1","5.19.0-41.42~22.04.1","5.19.0-42.43~22.04.1","5.19.0-43.44~22.04.1","5.19.0-45.46~22.04.1","5.19.0-46.47~22.04.1","5.19.0-50.50"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-25.25~22.04.2","6.2.0-26.26~22.04.1","6.2.0-31.31~22.04.1","6.2.0-32.32~22.04.1","6.2.0-33.33~22.04.1","6.2.0-34.34~22.04.1","6.2.0-35.35~22.04.1","6.2.0-36.37~22.04.1","6.2.0-37.38~22.04.1","6.2.0-39.40~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.0-44.44~22.04.1"}]}],"versions":["6.5.0-14.14~22.04.1","6.5.0-15.15~22.04.1","6.5.0-17.17~22.04.1","6.5.0-18.18~22.04.1","6.5.0-21.21~22.04.1","6.5.0-25.25~22.04.1","6.5.0-26.26~22.04.1","6.5.0-27.28~22.04.1","6.5.0-28.29~22.04.1","6.5.0-35.35~22.04.1","6.5.0-41.41~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1054.57"}]}],"versions":["5.15.0-1002.2","5.15.0-1003.3","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1007.8","5.15.0-1009.11","5.15.0-1010.12","5.15.0-1012.14","5.15.0-1013.15","5.15.0-1015.17","5.15.0-1017.20","5.15.0-1018.21","5.15.0-1021.24","5.15.0-1022.25","5.15.0-1023.26","5.15.0-1025.28","5.15.0-1026.29","5.15.0-1027.30","5.15.0-1028.31","5.15.0-1029.32","5.15.0-1030.33","5.15.0-1031.34","5.15.0-1032.35","5.15.0-1033.36","5.15.0-1034.37","5.15.0-1035.38","5.15.0-1036.39","5.15.0-1037.40","5.15.0-1038.41","5.15.0-1040.43","5.15.0-1041.44","5.15.0-1042.45","5.15.0-1043.46","5.15.0-1044.47","5.15.0-1045.48","5.15.0-1046.49","5.15.0-1047.50","5.15.0-1048.51","5.15.0-1049.52","5.15.0-1050.53","5.15.0-1053.56"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-intel-iotg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1057.63"}]}],"versions":["5.15.0-1004.6","5.15.0-1008.11","5.15.0-1010.14","5.15.0-1013.17","5.15.0-1015.20","5.15.0-1016.21","5.15.0-1017.22","5.15.0-1018.23","5.15.0-1021.26","5.15.0-1023.28","5.15.0-1025.30","5.15.0-1026.31","5.15.0-1027.32","5.15.0-1028.33","5.15.0-1030.35","5.15.0-1031.36","5.15.0-1033.38","5.15.0-1034.39","5.15.0-1035.40","5.15.0-1036.41","5.15.0-1037.42","5.15.0-1038.43","5.15.0-1039.45","5.15.0-1040.46","5.15.0-1043.49","5.15.0-1045.51","5.15.0-1046.52","5.15.0-1047.53","5.15.0-1048.54","5.15.0-1049.55","5.15.0-1050.56","5.15.0-1051.57","5.15.0-1052.58","5.15.0-1055.61"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1058.63"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1002.2","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1010.11","5.15.0-1012.14","5.15.0-1013.16","5.15.0-1016.19","5.15.0-1017.21","5.15.0-1018.22","5.15.0-1019.23","5.15.0-1020.24","5.15.0-1021.26","5.15.0-1024.29","5.15.0-1025.30","5.15.0-1026.31","5.15.0-1028.33","5.15.0-1029.34","5.15.0-1030.35","5.15.0-1031.36","5.15.0-1032.37","5.15.0-1033.38","5.15.0-1034.39","5.15.0-1035.40","5.15.0-1037.42","5.15.0-1038.43","5.15.0-1039.44","5.15.0-1040.45","5.15.0-1041.46","5.15.0-1042.47","5.15.0-1044.49","5.15.0-1045.50","5.15.0-1046.51","5.15.0-1047.52","5.15.0-1048.53","5.15.0-1049.54","5.15.0-1050.55","5.15.0-1051.56","5.15.0-1052.57","5.15.0-1053.58","5.15.0-1054.59","5.15.0-1057.62"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-106.116"}]}],"versions":["5.15.0-22.22","5.15.0-23.23","5.15.0-24.24","5.15.0-27.28","5.15.0-30.31","5.15.0-33.34","5.15.0-35.36","5.15.0-37.39","5.15.0-39.42","5.15.0-40.43","5.15.0-41.44","5.15.0-43.46","5.15.0-46.49","5.15.0-47.53","5.15.0-48.54","5.15.0-50.56","5.15.0-52.58","5.15.0-53.59","5.15.0-56.62","5.15.0-57.63","5.15.0-58.64","5.15.0-60.66","5.15.0-67.74","5.15.0-69.76","5.15.0-70.77","5.15.0-71.78","5.15.0-72.79","5.15.0-73.80","5.15.0-75.82","5.15.0-76.83","5.15.0-78.85","5.15.0-79.88","5.15.0-82.91","5.15.0-83.92","5.15.0-84.93","5.15.0-86.95","5.15.0-87.96","5.15.0-88.98","5.15.0-89.99","5.15.0-91.101","5.15.0-92.102","5.15.0-94.104","5.15.0-97.107","5.15.0-100.110","5.15.0-101.111","5.15.0-102.112","5.15.0-105.115"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1030.30"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.0-44.44.1~22.04.1"}]}],"versions":["6.5.0-14.14.1~22.04.1","6.5.0-15.15.1.1~22.04.1","6.5.0-17.17.1.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-41.41.1~22.04.1","6.5.0-42.42.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1054.55"}]}],"versions":["5.15.0-1005.5","5.15.0-1007.7","5.15.0-1010.10","5.15.0-1015.15","5.15.0-1017.17","5.15.0-1018.18","5.15.0-1023.23","5.15.0-1025.25","5.15.0-1026.26","5.15.0-1027.27","5.15.0-1028.28","5.15.0-1029.29","5.15.0-1030.30","5.15.0-1031.31","5.15.0-1032.32","5.15.0-1033.33","5.15.0-1037.37","5.15.0-1039.39","5.15.0-1040.40","5.15.0-1041.41","5.15.0-1042.42","5.15.0-1043.43","5.15.0-1044.44","5.15.0-1045.45","5.15.0-1046.46","5.15.0-1047.47","5.15.0-1048.48","5.15.0-1053.54"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1003.3~22.04.1","6.2.0-1009.9","6.2.0-1010.10","6.2.0-1011.11","6.2.0-1012.12","6.2.0-1013.13","6.2.0-1015.15"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.0-1023.24"}]}],"versions":["6.5.0-1004.4","6.5.0-1007.7","6.5.0-1013.13","6.5.0-1014.14","6.5.0-1015.15","6.5.0-1018.18","6.5.0-1019.19","6.5.0-1021.22","6.5.0-1022.23"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-tegra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1026.26"}]}],"versions":["5.15.0-1009.9","5.15.0-1010.10","5.15.0-1012.12","5.15.0-1013.13","5.15.0-1014.14","5.15.0-1015.15","5.15.0-1016.16","5.15.0-1017.17","5.15.0-1018.18","5.15.0-1019.19","5.15.0-1020.20","5.15.0-1021.21","5.15.0-1022.22","5.15.0-1025.25"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-tegra-igx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1015.15"}]}],"versions":["5.15.0-1001.1","5.15.0-1002.2","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1009.9","5.15.0-1012.12","5.15.0-1013.13"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-5.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.17.0-1003.3","5.17.0-1004.4","5.17.0-1006.6","5.17.0-1011.12","5.17.0-1012.13","5.17.0-1013.14","5.17.0-1014.15","5.17.0-1015.16","5.17.0-1016.17","5.17.0-1017.18","5.17.0-1018.19","5.17.0-1019.20","5.17.0-1020.21","5.17.0-1021.22","5.17.0-1024.25","5.17.0-1025.26","5.17.0-1026.27","5.17.0-1027.28","5.17.0-1028.29","5.17.0-1029.30","5.17.0-1030.31","5.17.0-1031.32","5.17.0-1032.33","5.17.0-1033.34","5.17.0-1034.35","5.17.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.0-1006.6","6.0.0-1007.7","6.0.0-1008.8","6.0.0-1009.9","6.0.0-1010.10","6.0.0-1011.11","6.0.0-1012.12","6.0.0-1013.13","6.0.0-1014.14","6.0.0-1015.15","6.0.0-1016.16","6.0.0-1017.17","6.0.0-1018.18","6.0.0-1019.19","6.0.0-1020.20","6.0.0-1021.21"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.0-1004.4","6.1.0-1006.6","6.1.0-1007.7","6.1.0-1008.8","6.1.0-1009.9","6.1.0-1010.10","6.1.0-1012.12","6.1.0-1013.13","6.1.0-1014.14","6.1.0-1015.15","6.1.0-1016.16","6.1.0-1017.17","6.1.0-1019.19","6.1.0-1020.20","6.1.0-1021.21","6.1.0-1022.22","6.1.0-1023.23","6.1.0-1024.24","6.1.0-1025.25","6.1.0-1026.26","6.1.0-1027.27","6.1.0-1028.28","6.1.0-1029.29","6.1.0-1033.33","6.1.0-1034.34","6.1.0-1035.35","6.1.0-1036.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.0-1027.28"}]}],"versions":["6.5.0-1003.3","6.5.0-1004.4","6.5.0-1006.6","6.5.0-1007.7","6.5.0-1008.8","6.5.0-1009.10","6.5.0-1011.12","6.5.0-1013.14","6.5.0-1014.15","6.5.0-1015.16","6.5.0-1016.17","6.5.0-1018.19","6.5.0-1019.20","6.5.0-1020.21","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25","6.5.0-1025.26"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1059.65"}]}],"versions":["5.13.0-1008.10","5.15.0-1001.3","5.15.0-1002.4","5.15.0-1003.5","5.15.0-1006.8","5.15.0-1007.9","5.15.0-1009.12","5.15.0-1011.15","5.15.0-1013.17","5.15.0-1016.20","5.15.0-1017.22","5.15.0-1018.23","5.15.0-1019.24","5.15.0-1021.27","5.15.0-1022.28","5.15.0-1025.31","5.15.0-1026.32","5.15.0-1027.33","5.15.0-1029.35","5.15.0-1030.36","5.15.0-1032.38","5.15.0-1033.39","5.15.0-1034.40","5.15.0-1035.41","5.15.0-1036.42","5.15.0-1037.43","5.15.0-1038.44","5.15.0-1039.45","5.15.0-1040.46","5.15.0-1041.47","5.15.0-1042.48","5.15.0-1044.50","5.15.0-1045.51","5.15.0-1046.52","5.15.0-1047.53","5.15.0-1048.54","5.15.0-1049.55","5.15.0-1050.56","5.15.0-1051.57","5.15.0-1052.58","5.15.0-1053.59","5.15.0-1054.60","5.15.0-1055.61","5.15.0-1058.64"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.0-1026.26~22.04.1"}]}],"versions":["6.5.0-1013.13~22.04.4","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1019.19~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1","6.5.0-1025.25~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1054.57"}]}],"versions":["5.13.0-1008.9","5.15.0-1002.2","5.15.0-1003.3","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1008.8","5.15.0-1011.13","5.15.0-1012.14","5.15.0-1013.15","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1016.18","5.15.0-1017.19","5.15.0-1018.20","5.15.0-1021.23","5.15.0-1022.24","5.15.0-1023.25","5.15.0-1024.26","5.15.0-1025.27","5.15.0-1026.28","5.15.0-1027.29","5.15.0-1028.30","5.15.0-1029.31","5.15.0-1030.32","5.15.0-1032.35","5.15.0-1033.36","5.15.0-1034.37","5.15.0-1035.38","5.15.0-1036.39","5.15.0-1037.40","5.15.0-1038.41","5.15.0-1040.43","5.15.0-1041.44","5.15.0-1042.45","5.15.0-1043.46","5.15.0-1044.47","5.15.0-1045.48","5.15.0-1046.49","5.15.0-1047.50","5.15.0-1048.51","5.15.0-1049.52","5.15.0-1050.53","5.15.0-1053.56"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1032.35"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1011.12","5.15.0-1012.13","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1016.18","5.15.0-1017.19","5.15.0-1018.21","5.15.0-1019.22","5.15.0-1020.23","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1012.13~22.04.1","5.19.0-1015.16~22.04.1","5.19.0-1016.17~22.04.1","5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1","5.19.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-17.17.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-40.40.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1014.16~22.04.1","5.19.0-1015.17~22.04.1","5.19.0-1016.18~22.04.1","5.19.0-1017.19~22.04.1","5.19.0-1018.20~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1006.7~22.04.1","6.2.0-1007.8~22.04.1","6.2.0-1009.10~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.0-1017.18~22.04.1"}]}],"versions":["6.5.0-1007.8~22.04.1","6.5.0-1008.9~22.04.1","6.5.0-1009.10~22.04.1","6.5.0-1010.11~22.04.1","6.5.0-1011.12~22.04.1","6.5.0-1012.13~22.04.1","6.5.0-1014.15~22.04.1","6.5.0-1015.16~22.04.1","6.5.0-1016.17~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-xilinx-zynqmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1030.34"}]}],"versions":["5.15.0-1022.26","5.15.0-1023.27","5.15.0-1025.29","5.15.0-1027.31"]},{"source":"osv","ecosystem":"Ubuntu:Nvidia-BlueField:22.04:LTS","package":"linux-bluefield","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1043.45"}]}],"versions":["5.15.0-1011.13","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1017.19","5.15.0-1019.21","5.15.0-1021.23","5.15.0-1022.24","5.15.0-1023.25","5.15.0-1024.26","5.15.0-1027.29","5.15.0-1028.30","5.15.0-1031.33","5.15.0-1032.34","5.15.0-1033.35","5.15.0-1035.37","5.15.0-1036.38","5.15.0-1037.39","5.15.0-1038.40","5.15.0-1040.42","5.15.0-1042.44"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:22.04:LTS","package":"linux-intel-iot-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1054.56"}]}],"versions":["5.15.0-1021.26","5.15.0-1022.27","5.15.0-1023.28","5.15.0-1024.29","5.15.0-1028.33","5.15.0-1033.35","5.15.0-1034.36","5.15.0-1035.37","5.15.0-1036.38","5.15.0-1037.39","5.15.0-1038.40","5.15.0-1039.41","5.15.0-1040.42","5.15.0-1041.43","5.15.0-1042.44","5.15.0-1043.45","5.15.0-1044.46","5.15.0-1046.48","5.15.0-1047.49","5.15.0-1048.50","5.15.0-1049.51","5.15.0-1050.52","5.15.0-1053.55"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:22.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1062.70"}]}],"versions":["5.15.0-1006.6","5.15.0-1007.7","5.15.0-1009.9","5.15.0-1011.11","5.15.0-1014.14","5.15.0-1015.15","5.15.0-1016.16","5.15.0-1019.19","5.15.0-1020.20","5.15.0-1021.21","5.15.0-1022.22","5.15.0-1024.25","5.15.0-1025.28","5.15.0-1028.31","5.15.0-1029.32","5.15.0-1030.33","5.15.0-1032.35","5.15.0-1033.36","5.15.0-1034.37","5.15.0-1036.39","5.15.0-1037.40","5.15.0-1038.41","5.15.0-1039.42","5.15.0-1040.45","5.15.0-1041.46","5.15.0-1042.47","5.15.0-1043.48","5.15.0-1044.49","5.15.0-1045.50","5.15.0-1046.52","5.15.0-1048.54","5.15.0-1049.55","5.15.0-1050.56","5.15.0-1051.57","5.15.0-1052.58","5.15.0-1053.59","5.15.0-1054.60","5.15.0-1055.62","5.15.0-1056.63","5.15.0-1057.64","5.15.0-1058.66","5.15.0-1061.69"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","package":"linux-aws-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1042.47+fips1","5.15.0-1051.56+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","package":"linux-azure-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1053.61+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-73.80+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","package":"linux-gcp-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1048.56+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"linux-aws-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1061.67+fips1"}]}],"versions":["5.15.0-1051.56+fips1","5.15.0-1052.57+fips1","5.15.0-1053.58+fips1","5.15.0-1055.60+fips1","5.15.0-1056.61+fips1","5.15.0-1057.63+fips1","5.15.0-1060.66+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"linux-azure-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1063.72+fips1"}]}],"versions":["5.15.0-1053.61+fips1","5.15.0-1058.66+fips1","5.15.0-1059.67+fips1","5.15.0-1060.69+fips1","5.15.0-1061.70+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-106.116+fips1"}]}],"versions":["5.15.0-73.80+fips1","5.15.0-92.102+fips1","5.15.0-94.104+fips1","5.15.0-97.107+fips1","5.15.0-100.110+fips1","5.15.0-101.111+fips1","5.15.0-102.112+fips1","5.15.0-105.115+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"linux-gcp-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1059.67+fips1"}]}],"versions":["5.15.0-1048.56+fips1","5.15.0-1055.63+fips2","5.15.0-1058.66+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-2001.1"}]}],"versions":["6.7.0-2001.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"linux-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1063.72~20.04.1"}]}],"versions":["5.15.0-1007.8~20.04.1","5.15.0-1008.9~20.04.1","5.15.0-1013.16~20.04.1","5.15.0-1014.17~20.04.1","5.15.0-1017.20~20.04.1","5.15.0-1019.24~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1021.26~20.04.1","5.15.0-1022.27~20.04.1","5.15.0-1023.29~20.04.1","5.15.0-1029.36~20.04.1","5.15.0-1030.37~20.04.1","5.15.0-1031.38~20.04.1","5.15.0-1033.40~20.04.1","5.15.0-1034.41~20.04.1","5.15.0-1035.42~20.04.1","5.15.0-1036.43~20.04.1","5.15.0-1037.44~20.04.1","5.15.0-1038.45~20.04.1","5.15.0-1039.46~20.04.1","5.15.0-1040.47~20.04.1","5.15.0-1041.48~20.04.1","5.15.0-1042.49~20.04.1","5.15.0-1043.50~20.04.1","5.15.0-1045.52~20.04.1","5.15.0-1046.53~20.04.1","5.15.0-1047.54~20.04.1","5.15.0-1049.56~20.04.1","5.15.0-1050.57~20.04.1","5.15.0-1051.59~20.04.1","5.15.0-1052.60~20.04.1","5.15.0-1053.61~20.04.1","5.15.0-1054.62~20.04.1","5.15.0-1056.64~20.04.1","5.15.0-1057.65~20.04.1","5.15.0-1058.66~20.04.2","5.15.0-1059.67~20.04.1","5.15.0-1060.69~20.04.1","5.15.0-1061.70~20.04.1"],"bundled":91},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-fde-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1063.72~20.04.1.1"}]}],"versions":["5.15.0-1019.24~20.04.1.1","5.15.0-1020.25~20.04.1.1","5.15.0-1021.26~20.04.1.1","5.15.0-1029.36~20.04.1.1","5.15.0-1030.37~20.04.1.1","5.15.0-1031.38~20.04.1.1","5.15.0-1033.40~20.04.1.1","5.15.0-1034.41~20.04.1.2","5.15.0-1035.42~20.04.1.1","5.15.0-1036.43~20.04.1.1","5.15.0-1037.44~20.04.1.1","5.15.0-1038.45~20.04.1.1","5.15.0-1039.46~20.04.1.1","5.15.0-1040.47~20.04.1.1","5.15.0-1041.48~20.04.1.1","5.15.0-1042.49~20.04.1.1","5.15.0-1043.50~20.04.1.1","5.15.0-1046.53~20.04.1.1","5.15.0-1047.54~20.04.1.1","5.15.0-1049.56~20.04.1.1","5.15.0-1050.57~20.04.1.1","5.15.0-1051.59~20.04.1.1","5.15.0-1052.60~20.04.1.1","5.15.0-1053.61~20.04.1.1","5.15.0-1054.62~20.04.1.1","5.15.0-1056.64~20.04.1.1","5.15.0-1057.65~20.04.1.1","5.15.0-1058.66~20.04.2.1","5.15.0-1059.67~20.04.1.1","5.15.0-1060.69~20.04.1.1","5.15.0-1061.70~20.04.1.1"],"bundled":91},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1059.67~20.04.1"}]}],"versions":["5.15.0-1006.9~20.04.1","5.15.0-1012.17~20.04.1","5.15.0-1013.18~20.04.1","5.15.0-1016.21~20.04.1","5.15.0-1017.23~20.04.2","5.15.0-1018.24~20.04.1","5.15.0-1021.28~20.04.1","5.15.0-1022.29~20.04.1","5.15.0-1025.32~20.04.2","5.15.0-1026.33~20.04.1","5.15.0-1027.34~20.04.1","5.15.0-1029.36~20.04.1","5.15.0-1030.37~20.04.1","5.15.0-1031.38~20.04.1","5.15.0-1032.40~20.04.1","5.15.0-1033.41~20.04.1","5.15.0-1034.42~20.04.1","5.15.0-1035.43~20.04.1","5.15.0-1036.44~20.04.1","5.15.0-1037.45~20.04.1","5.15.0-1038.46~20.04.1","5.15.0-1039.47~20.04.1","5.15.0-1040.48~20.04.1","5.15.0-1041.49~20.04.1","5.15.0-1042.50~20.04.1","5.15.0-1044.52~20.04.1","5.15.0-1045.53~20.04.2","5.15.0-1046.54~20.04.1","5.15.0-1047.55~20.04.1","5.15.0-1048.56~20.04.1","5.15.0-1049.57~20.04.1","5.15.0-1051.59~20.04.1","5.15.0-1052.60~20.04.1","5.15.0-1053.61~20.04.1","5.15.0-1054.62~20.04.1","5.15.0-1055.63~20.04.1","5.15.0-1058.66~20.04.1"],"bundled":91},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1044.51~20.04.1"}]}],"versions":["5.15.0-1003.5~20.04.2","5.15.0-1005.7~20.04.1","5.15.0-1007.10~20.04.1","5.15.0-1008.12~20.04.1","5.15.0-1011.15~20.04.2","5.15.0-1012.16~20.04.1","5.15.0-1013.17~20.04.1","5.15.0-1015.19~20.04.1","5.15.0-1016.21~20.04.1","5.15.0-1017.22~20.04.1","5.15.0-1018.23~20.04.1","5.15.0-1019.24~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1021.26~20.04.1","5.15.0-1022.27~20.04.1","5.15.0-1023.28~20.04.1","5.15.0-1024.29~20.04.1","5.15.0-1025.30~20.04.1","5.15.0-1026.31~20.04.1","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1030.35~20.04.1","5.15.0-1031.37~20.04.1","5.15.0-1032.38~20.04.1","5.15.0-1033.39~20.04.1","5.15.0-1034.40~20.04.1","5.15.0-1035.41~20.04.1","5.15.0-1036.42~20.04.1","5.15.0-1037.43~20.04.1","5.15.0-1038.44~20.04.1","5.15.0-1039.45~20.04.1","5.15.0-1040.46~20.04.1","5.15.0-1043.50~20.04.1"],"bundled":91},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-ibm-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1054.57~20.04.1"}]}],"versions":["5.15.0-1033.36~20.04.1","5.15.0-1034.37~20.04.1","5.15.0-1035.38~20.04.1","5.15.0-1036.39~20.04.1","5.15.0-1037.40~20.04.1","5.15.0-1038.41~20.04.1","5.15.0-1040.43~20.04.1","5.15.0-1041.44~20.04.1","5.15.0-1042.45~20.04.1","5.15.0-1043.46~20.04.1","5.15.0-1044.47~20.04.1","5.15.0-1045.48~20.04.1","5.15.0-1046.49~20.04.1","5.15.0-1047.50~20.04.1","5.15.0-1048.51~20.04.1","5.15.0-1049.52~20.04.1","5.15.0-1050.53~20.04.1","5.15.0-1053.56~20.04.1"],"bundled":91},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-lowlatency-hwe-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-106.116~20.04.1"}]}],"versions":["5.15.0-33.34~20.04.1","5.15.0-42.45~20.04.1","5.15.0-43.46~20.04.1","5.15.0-46.49~20.04.1","5.15.0-48.54~20.04.1","5.15.0-50.56~20.04.1","5.15.0-52.58~20.04.1","5.15.0-53.59~20.04.1","5.15.0-56.62~20.04.1","5.15.0-58.64~20.04.1","5.15.0-60.66~20.04.1","5.15.0-67.74~20.04.1","5.15.0-69.76~20.04.1","5.15.0-70.77~20.04.1","5.15.0-71.78~20.04.1","5.15.0-72.79~20.04.1","5.15.0-73.80~20.04.1","5.15.0-75.82~20.04.1","5.15.0-76.83~20.04.1","5.15.0-78.85~20.04.1","5.15.0-79.88~20.04.1","5.15.0-82.91~20.04.1","5.15.0-83.92~20.04.1","5.15.0-84.93~20.04.1","5.15.0-86.95~20.04.1","5.15.0-87.96~20.04.1","5.15.0-88.98~20.04.1","5.15.0-89.99~20.04.1","5.15.0-91.101~20.04.1","5.15.0-92.102~20.04.1","5.15.0-94.104~20.04.1","5.15.0-97.107~20.04.1","5.15.0-100.110~20.04.1","5.15.0-101.111~20.04.1","5.15.0-102.112~20.04.1","5.15.0-105.115~20.04.1"],"bundled":91},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1059.65~20.04.1"}]}],"versions":["5.15.0-1007.9~20.04.1","5.15.0-1013.17~20.04.1","5.15.0-1016.20~20.04.1","5.15.0-1017.22~20.04.1","5.15.0-1018.23~20.04.1","5.15.0-1019.24~20.04.1","5.15.0-1021.27~20.04.1","5.15.0-1022.28~20.04.1","5.15.0-1025.31~20.04.2","5.15.0-1027.33~20.04.1","5.15.0-1029.35~20.04.1","5.15.0-1030.36~20.04.1","5.15.0-1032.38~20.04.1","5.15.0-1033.39~20.04.1","5.15.0-1034.40~20.04.1","5.15.0-1035.41~20.04.1","5.15.0-1036.42~20.04.1","5.15.0-1037.43~20.04.1","5.15.0-1038.44~20.04.1","5.15.0-1039.45~20.04.1","5.15.0-1040.46~20.04.1","5.15.0-1041.47~20.04.1","5.15.0-1042.48~20.04.1","5.15.0-1044.50~20.04.1","5.15.0-1045.51~20.04.1","5.15.0-1046.52~20.04.1","5.15.0-1047.53~20.04.1","5.15.0-1048.54~20.04.1","5.15.0-1049.55~20.04.1","5.15.0-1050.56~20.04.1","5.15.0-1051.57~20.04.1","5.15.0-1052.58~20.04.1","5.15.0-1053.59~20.04.1","5.15.0-1054.60~20.04.1","5.15.0-1055.61~20.04.1","5.15.0-1058.64~20.04.1"],"bundled":91},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-106.116"}]}],"versions":["5.13.0-19.19","5.15.0-17.17","5.15.0-18.18","5.15.0-22.22","5.15.0-23.23","5.15.0-25.25","5.15.0-27.28","5.15.0-30.31","5.15.0-33.34","5.15.0-35.36","5.15.0-37.39","5.15.0-39.42","5.15.0-40.43","5.15.0-41.44","5.15.0-43.46","5.15.0-46.49","5.15.0-47.51","5.15.0-48.54","5.15.0-50.56","5.15.0-52.58","5.15.0-53.59","5.15.0-56.62","5.15.0-57.63","5.15.0-58.64","5.15.0-60.66","5.15.0-67.74","5.15.0-69.76","5.15.0-70.77","5.15.0-71.78","5.15.0-72.79","5.15.0-73.80","5.15.0-75.82","5.15.0-76.83","5.15.0-78.85","5.15.0-79.86","5.15.0-82.91","5.15.0-83.92","5.15.0-84.93","5.15.0-86.96","5.15.0-87.97","5.15.0-88.98","5.15.0-89.99","5.15.0-91.101","5.15.0-92.102","5.15.0-94.104","5.15.0-97.107","5.15.0-100.110","5.15.0-101.111","5.15.0-102.112","5.15.0-105.115"],"bundled":91},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1063.72"}]}],"versions":["5.13.0-1006.7","5.15.0-1001.2","5.15.0-1002.3","5.15.0-1003.4","5.15.0-1005.6","5.15.0-1007.8","5.15.0-1008.9","5.15.0-1010.12","5.15.0-1012.15","5.15.0-1013.16","5.15.0-1014.17","5.15.0-1017.20","5.15.0-1019.24","5.15.0-1020.25","5.15.0-1021.26","5.15.0-1022.27","5.15.0-1023.29","5.15.0-1024.30","5.15.0-1029.36","5.15.0-1030.37","5.15.0-1031.38","5.15.0-1033.40","5.15.0-1034.41","5.15.0-1035.42","5.15.0-1036.43","5.15.0-1037.44","5.15.0-1038.45","5.15.0-1039.46","5.15.0-1040.47","5.15.0-1041.48","5.15.0-1042.49","5.15.0-1044.51","5.15.0-1045.52","5.15.0-1046.53","5.15.0-1047.54","5.15.0-1049.56","5.15.0-1050.57","5.15.0-1051.59","5.15.0-1052.60","5.15.0-1053.61","5.15.0-1054.62","5.15.0-1056.64","5.15.0-1057.65","5.15.0-1058.66","5.15.0-1059.67","5.15.0-1060.69","5.15.0-1061.70"],"bundled":91},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1063.72.1"}]}],"versions":["5.15.0-1019.24.1","5.15.0-1024.30.1","5.15.0-1029.36.1","5.15.0-1030.37.1","5.15.0-1031.38.1","5.15.0-1033.40.1","5.15.0-1034.41.1","5.15.0-1035.42.1","5.15.0-1036.43.1","5.15.0-1037.44.1","5.15.0-1038.45.1","5.15.0-1039.46.1","5.15.0-1041.48.1","5.15.0-1042.49.1","5.15.0-1044.51.1","5.15.0-1045.52.1","5.15.0-1046.53.1","5.15.0-1047.54.1","5.15.0-1049.56.1","5.15.0-1050.57.1","5.15.0-1051.59.1","5.15.0-1052.60.1","5.15.0-1053.61.1","5.15.0-1054.62.1","5.15.0-1056.64.1","5.15.0-1057.65.1","5.15.0-1058.66.1","5.15.0-1059.67.1","5.15.0-1060.69.1","5.15.0-1061.70.1"],"bundled":91},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1059.67"}]}],"versions":["5.13.0-1005.6","5.15.0-1001.3","5.15.0-1002.5","5.15.0-1003.6","5.15.0-1004.7","5.15.0-1005.8","5.15.0-1006.9","5.15.0-1008.12","5.15.0-1010.15","5.15.0-1013.18","5.15.0-1016.21","5.15.0-1017.23","5.15.0-1018.24","5.15.0-1019.25","5.15.0-1021.28","5.15.0-1022.29","5.15.0-1025.32","5.15.0-1026.33","5.15.0-1027.34","5.15.0-1029.36","5.15.0-1030.37","5.15.0-1031.38","5.15.0-1032.40","5.15.0-1034.42","5.15.0-1035.43","5.15.0-1036.44","5.15.0-1037.45","5.15.0-1038.46","5.15.0-1039.47","5.15.0-1040.48","5.15.0-1041.49","5.15.0-1042.50","5.15.0-1044.52","5.15.0-1045.53","5.15.0-1046.54","5.15.0-1047.55","5.15.0-1048.56","5.15.0-1049.57","5.15.0-1051.59","5.15.0-1052.60","5.15.0-1053.61","5.15.0-1054.62","5.15.0-1055.63","5.15.0-1058.66"],"bundled":91},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1058.63"}]}],"versions":["5.15.0-1002.2","5.15.0-1003.3","5.15.0-1004.5","5.15.0-1005.6","5.15.0-1006.7","5.15.0-1008.10","5.15.0-1010.13","5.15.0-1011.14","5.15.0-1014.17","5.15.0-1015.18","5.15.0-1016.19","5.15.0-1017.20","5.15.0-1019.23","5.15.0-1020.25","5.15.0-1023.28","5.15.0-1024.29","5.15.0-1027.32","5.15.0-1028.33","5.15.0-1030.35","5.15.0-1031.36","5.15.0-1032.37","5.15.0-1033.38","5.15.0-1034.39","5.15.0-1035.40","5.15.0-1036.41","5.15.0-1037.42","5.15.0-1038.43","5.15.0-1039.44","5.15.0-1040.45","5.15.0-1041.46","5.15.0-1042.47","5.15.0-1044.49","5.15.0-1045.50","5.15.0-1046.51","5.15.0-1047.52","5.15.0-1048.53","5.15.0-1049.54","5.15.0-1050.55","5.15.0-1051.56","5.15.0-1052.57","5.15.0-1053.58","5.15.0-1054.59","5.15.0-1057.62"],"bundled":91},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1044.51"}]}],"versions":["5.15.0-1001.2","5.15.0-1002.4","5.15.0-1003.5","5.15.0-1004.6","5.15.0-1005.7","5.15.0-1007.10","5.15.0-1008.12","5.15.0-1011.15","5.15.0-1012.16","5.15.0-1013.17","5.15.0-1015.19","5.15.0-1016.21","5.15.0-1017.22","5.15.0-1018.23","5.15.0-1019.24","5.15.0-1020.25","5.15.0-1021.26","5.15.0-1022.27","5.15.0-1023.28","5.15.0-1024.29","5.15.0-1025.30","5.15.0-1026.31","5.15.0-1027.32","5.15.0-1028.33","5.15.0-1030.35","5.15.0-1031.37","5.15.0-1032.38","5.15.0-1033.39","5.15.0-1034.40","5.15.0-1035.41","5.15.0-1036.42","5.15.0-1037.43","5.15.0-1038.44","5.15.0-1039.45","5.15.0-1040.46","5.15.0-1043.50"],"bundled":91},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1054.57"}]}],"versions":["5.15.0-1002.2","5.15.0-1003.3","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1007.8","5.15.0-1009.11","5.15.0-1010.12","5.15.0-1012.14","5.15.0-1013.15","5.15.0-1015.17","5.15.0-1017.20","5.15.0-1018.21","5.15.0-1021.24","5.15.0-1022.25","5.15.0-1023.26","5.15.0-1025.28","5.15.0-1026.29","5.15.0-1027.30","5.15.0-1028.31","5.15.0-1029.32","5.15.0-1030.33","5.15.0-1031.34","5.15.0-1032.35","5.15.0-1033.36","5.15.0-1034.37","5.15.0-1035.38","5.15.0-1036.39","5.15.0-1037.40","5.15.0-1038.41","5.15.0-1040.43","5.15.0-1041.44","5.15.0-1042.45","5.15.0-1043.46","5.15.0-1044.47","5.15.0-1045.48","5.15.0-1046.49","5.15.0-1047.50","5.15.0-1048.51","5.15.0-1049.52","5.15.0-1050.53","5.15.0-1053.56"],"bundled":91},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1058.63"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1002.2","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1010.11","5.15.0-1012.14","5.15.0-1013.16","5.15.0-1016.19","5.15.0-1017.21","5.15.0-1018.22","5.15.0-1019.23","5.15.0-1020.24","5.15.0-1021.26","5.15.0-1024.29","5.15.0-1025.30","5.15.0-1026.31","5.15.0-1028.33","5.15.0-1029.34","5.15.0-1030.35","5.15.0-1031.36","5.15.0-1032.37","5.15.0-1033.38","5.15.0-1034.39","5.15.0-1035.40","5.15.0-1037.42","5.15.0-1038.43","5.15.0-1039.44","5.15.0-1040.45","5.15.0-1041.46","5.15.0-1042.47","5.15.0-1044.49","5.15.0-1045.50","5.15.0-1046.51","5.15.0-1047.52","5.15.0-1048.53","5.15.0-1049.54","5.15.0-1050.55","5.15.0-1051.56","5.15.0-1052.57","5.15.0-1053.58","5.15.0-1054.59","5.15.0-1057.62"],"bundled":91},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-106.116"}]}],"versions":["5.15.0-22.22","5.15.0-23.23","5.15.0-24.24","5.15.0-27.28","5.15.0-30.31","5.15.0-33.34","5.15.0-35.36","5.15.0-37.39","5.15.0-39.42","5.15.0-40.43","5.15.0-41.44","5.15.0-43.46","5.15.0-46.49","5.15.0-47.53","5.15.0-48.54","5.15.0-50.56","5.15.0-52.58","5.15.0-53.59","5.15.0-56.62","5.15.0-57.63","5.15.0-58.64","5.15.0-60.66","5.15.0-67.74","5.15.0-69.76","5.15.0-70.77","5.15.0-71.78","5.15.0-72.79","5.15.0-73.80","5.15.0-75.82","5.15.0-76.83","5.15.0-78.85","5.15.0-79.88","5.15.0-82.91","5.15.0-83.92","5.15.0-84.93","5.15.0-86.95","5.15.0-87.96","5.15.0-88.98","5.15.0-89.99","5.15.0-91.101","5.15.0-92.102","5.15.0-94.104","5.15.0-97.107","5.15.0-100.110","5.15.0-101.111","5.15.0-102.112","5.15.0-105.115"],"bundled":91},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1054.55"}]}],"versions":["5.15.0-1005.5","5.15.0-1007.7","5.15.0-1010.10","5.15.0-1015.15","5.15.0-1017.17","5.15.0-1018.18","5.15.0-1023.23","5.15.0-1025.25","5.15.0-1026.26","5.15.0-1027.27","5.15.0-1028.28","5.15.0-1029.29","5.15.0-1030.30","5.15.0-1031.31","5.15.0-1032.32","5.15.0-1033.33","5.15.0-1037.37","5.15.0-1039.39","5.15.0-1040.40","5.15.0-1041.41","5.15.0-1042.42","5.15.0-1043.43","5.15.0-1044.44","5.15.0-1045.45","5.15.0-1046.46","5.15.0-1047.47","5.15.0-1048.48","5.15.0-1053.54"],"bundled":91},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1059.65"}]}],"versions":["5.13.0-1008.10","5.15.0-1001.3","5.15.0-1002.4","5.15.0-1003.5","5.15.0-1006.8","5.15.0-1007.9","5.15.0-1009.12","5.15.0-1011.15","5.15.0-1013.17","5.15.0-1016.20","5.15.0-1017.22","5.15.0-1018.23","5.15.0-1019.24","5.15.0-1021.27","5.15.0-1022.28","5.15.0-1025.31","5.15.0-1026.32","5.15.0-1027.33","5.15.0-1029.35","5.15.0-1030.36","5.15.0-1032.38","5.15.0-1033.39","5.15.0-1034.40","5.15.0-1035.41","5.15.0-1036.42","5.15.0-1037.43","5.15.0-1038.44","5.15.0-1039.45","5.15.0-1040.46","5.15.0-1041.47","5.15.0-1042.48","5.15.0-1044.50","5.15.0-1045.51","5.15.0-1046.52","5.15.0-1047.53","5.15.0-1048.54","5.15.0-1049.55","5.15.0-1050.56","5.15.0-1051.57","5.15.0-1052.58","5.15.0-1053.59","5.15.0-1054.60","5.15.0-1055.61","5.15.0-1058.64"],"bundled":91},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-106.116~20.04.1"}]}],"versions":["5.15.0-33.34~20.04.1","5.15.0-41.44~20.04.1","5.15.0-43.46~20.04.1","5.15.0-46.49~20.04.1","5.15.0-48.54~20.04.1","5.15.0-50.56~20.04.1","5.15.0-52.58~20.04.1","5.15.0-53.59~20.04.1","5.15.0-56.62~20.04.1","5.15.0-57.63~20.04.1","5.15.0-58.64~20.04.1","5.15.0-60.66~20.04.1","5.15.0-67.74~20.04.1","5.15.0-69.76~20.04.1","5.15.0-70.77~20.04.1","5.15.0-71.78~20.04.1","5.15.0-72.79~20.04.1","5.15.0-73.80~20.04.1","5.15.0-75.82~20.04.1","5.15.0-76.83~20.04.1","5.15.0-78.85~20.04.1","5.15.0-79.86~20.04.2","5.15.0-82.91~20.04.1","5.15.0-83.92~20.04.1","5.15.0-84.93~20.04.1","5.15.0-86.96~20.04.1","5.15.0-87.97~20.04.1","5.15.0-88.98~20.04.1","5.15.0-89.99~20.04.1","5.15.0-91.101~20.04.1","5.15.0-92.102~20.04.1","5.15.0-94.104~20.04.1","5.15.0-97.107~20.04.1","5.15.0-100.110~20.04.1","5.15.0-101.111~20.04.1","5.15.0-102.112~20.04.1","5.15.0-105.115~20.04.1"],"bundled":91},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1054.57"}]}],"versions":["5.13.0-1008.9","5.15.0-1002.2","5.15.0-1003.3","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1008.8","5.15.0-1011.13","5.15.0-1012.14","5.15.0-1013.15","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1016.18","5.15.0-1017.19","5.15.0-1018.20","5.15.0-1021.23","5.15.0-1022.24","5.15.0-1023.25","5.15.0-1024.26","5.15.0-1025.27","5.15.0-1026.28","5.15.0-1027.29","5.15.0-1028.30","5.15.0-1029.31","5.15.0-1030.32","5.15.0-1032.35","5.15.0-1033.36","5.15.0-1034.37","5.15.0-1035.38","5.15.0-1036.39","5.15.0-1037.40","5.15.0-1038.41","5.15.0-1040.43","5.15.0-1041.44","5.15.0-1042.45","5.15.0-1043.46","5.15.0-1044.47","5.15.0-1045.48","5.15.0-1046.49","5.15.0-1047.50","5.15.0-1048.51","5.15.0-1049.52","5.15.0-1050.53","5.15.0-1053.56"],"bundled":91},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1061.67~20.04.1"}]}],"versions":["5.15.0-1014.18~20.04.1","5.15.0-1015.19~20.04.1","5.15.0-1017.21~20.04.1","5.15.0-1019.23~20.04.1","5.15.0-1020.24~20.04.1","5.15.0-1021.25~20.04.1","5.15.0-1022.26~20.04.1","5.15.0-1023.27~20.04.1","5.15.0-1026.30~20.04.2","5.15.0-1027.31~20.04.1","5.15.0-1028.32~20.04.1","5.15.0-1030.34~20.04.1","5.15.0-1031.35~20.04.1","5.15.0-1033.37~20.04.1","5.15.0-1034.38~20.04.1","5.15.0-1035.39~20.04.1","5.15.0-1036.40~20.04.1","5.15.0-1037.41~20.04.1","5.15.0-1038.43~20.04.1","5.15.0-1039.44~20.04.1","5.15.0-1040.45~20.04.1","5.15.0-1041.46~20.04.1","5.15.0-1043.48~20.04.1","5.15.0-1044.49~20.04.1","5.15.0-1045.50~20.04.1","5.15.0-1047.52~20.04.1","5.15.0-1048.53~20.04.1","5.15.0-1049.54~20.04.1","5.15.0-1050.55~20.04.1","5.15.0-1051.56~20.04.1","5.15.0-1052.57~20.04.1","5.15.0-1053.58~20.04.1","5.15.0-1055.60~20.04.1","5.15.0-1056.61~20.04.1","5.15.0-1057.63~20.04.1","5.15.0-1058.64~20.04.1"],"bundled":91},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1061.67"}]}],"versions":["5.13.0-1005.6","5.15.0-1002.4","5.15.0-1003.5","5.15.0-1004.6","5.15.0-1005.7","5.15.0-1008.10","5.15.0-1009.11","5.15.0-1011.14","5.15.0-1013.17","5.15.0-1014.18","5.15.0-1015.19","5.15.0-1017.21","5.15.0-1019.23","5.15.0-1020.24","5.15.0-1021.25","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32","5.15.0-1030.34","5.15.0-1031.35","5.15.0-1033.37","5.15.0-1034.38","5.15.0-1035.39","5.15.0-1036.40","5.15.0-1037.41","5.15.0-1038.43","5.15.0-1039.44","5.15.0-1040.45","5.15.0-1042.47","5.15.0-1043.48","5.15.0-1044.49","5.15.0-1045.50","5.15.0-1047.52","5.15.0-1048.53","5.15.0-1049.54","5.15.0-1050.55","5.15.0-1051.56","5.15.0-1052.57","5.15.0-1053.58","5.15.0-1055.60","5.15.0-1056.61","5.15.0-1057.63","5.15.0-1060.66"],"bundled":91},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-aws-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1124.134~18.04.1"}]}],"versions":["5.4.0-1018.18~18.04.1","5.4.0-1020.20~18.04.2","5.4.0-1022.22~18.04.1","5.4.0-1024.24~18.04.1","5.4.0-1025.25~18.04.1","5.4.0-1028.29~18.04.1","5.4.0-1029.30~18.04.1","5.4.0-1030.31~18.04.1","5.4.0-1032.33~18.04.1","5.4.0-1034.35~18.04.1","5.4.0-1035.37~18.04.1","5.4.0-1037.39~18.04.1","5.4.0-1038.40~18.04.1","5.4.0-1039.41~18.04.1","5.4.0-1041.43~18.04.1","5.4.0-1043.45~18.04.1","5.4.0-1045.47~18.04.1","5.4.0-1047.49~18.04.1","5.4.0-1048.50~18.04.1","5.4.0-1049.51~18.04.1","5.4.0-1051.53~18.04.1","5.4.0-1054.57~18.04.1","5.4.0-1055.58~18.04.1","5.4.0-1056.59~18.04.1","5.4.0-1057.60~18.04.1","5.4.0-1058.61~18.04.3","5.4.0-1059.62~18.04.1","5.4.0-1060.63~18.04.1","5.4.0-1061.64~18.04.1","5.4.0-1063.66~18.04.1","5.4.0-1064.67~18.04.1","5.4.0-1065.68~18.04.1","5.4.0-1066.69~18.04.1","5.4.0-1068.72~18.04.1","5.4.0-1069.73~18.04.1","5.4.0-1071.76~18.04.1","5.4.0-1072.77~18.04.1","5.4.0-1075.80~18.04.1","5.4.0-1078.84~18.04.1","5.4.0-1080.87~18.04.1","5.4.0-1081.88~18.04.1","5.4.0-1083.90~18.04.1","5.4.0-1084.91~18.04.1","5.4.0-1085.92~18.04.1","5.4.0-1086.93~18.04.1","5.4.0-1088.96~18.04.1","5.4.0-1089.97~18.04.1","5.4.0-1090.98~18.04.1","5.4.0-1092.100~18.04.2","5.4.0-1093.102~18.04.2","5.4.0-1094.102~18.04.1","5.4.0-1096.104~18.04.1","5.4.0-1097.105~18.04.1","5.4.0-1099.107~18.04.1","5.4.0-1100.108~18.04.1","5.4.0-1101.109~18.04.1","5.4.0-1103.111~18.04.1","5.4.0-1104.112~18.04.1","5.4.0-1105.113~18.04.1","5.4.0-1106.114~18.04.1","5.4.0-1107.115~18.04.1","5.4.0-1108.116~18.04.1","5.4.0-1109.118~18.04.1","5.4.0-1110.119~18.04.1","5.4.0-1111.120~18.04.1","5.4.0-1112.121~18.04.2","5.4.0-1113.123~18.04.1","5.4.0-1114.124~18.04.1","5.4.0-1116.126~18.04.1","5.4.0-1117.127~18.04.1","5.4.0-1118.128~18.04.1","5.4.0-1119.129~18.04.1","5.4.0-1120.130~18.04.1","5.4.0-1121.131~18.04.1","5.4.0-1122.132~18.04.1","5.4.0-1123.133~18.04.1"],"bundled":48},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-azure-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1129.136~18.04.1"}]}],"versions":["5.4.0-1020.20~18.04.1","5.4.0-1022.22~18.04.1","5.4.0-1023.23~18.04.1","5.4.0-1025.25~18.04.1","5.4.0-1026.26~18.04.1","5.4.0-1031.32~18.04.1","5.4.0-1032.33~18.04.1","5.4.0-1034.35~18.04.1","5.4.0-1035.36~18.04.1","5.4.0-1036.38~18.04.1","5.4.0-1039.41~18.04.1","5.4.0-1040.42~18.04.1","5.4.0-1041.43~18.04.1","5.4.0-1043.45~18.04.1","5.4.0-1044.46~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1047.49~18.04.1","5.4.0-1048.50~18.04.1","5.4.0-1049.51~18.04.1","5.4.0-1051.53~18.04.1","5.4.0-1055.57~18.04.1","5.4.0-1056.58~18.04.1","5.4.0-1058.60~18.04.1","5.4.0-1059.62~18.04.1","5.4.0-1061.64~18.04.1","5.4.0-1062.65~18.04.1","5.4.0-1063.66~18.04.1","5.4.0-1064.67~18.04.1","5.4.0-1065.68~18.04.1","5.4.0-1067.70~18.04.1","5.4.0-1068.71~18.04.1","5.4.0-1069.72~18.04.1","5.4.0-1070.73~18.04.1","5.4.0-1072.75~18.04.1","5.4.0-1073.76~18.04.1","5.4.0-1074.77~18.04.1","5.4.0-1077.80~18.04.1","5.4.0-1078.81~18.04.1","5.4.0-1080.83~18.04.2","5.4.0-1083.87~18.04.1","5.4.0-1085.90~18.04.1","5.4.0-1086.91~18.04.1","5.4.0-1089.94~18.04.1","5.4.0-1090.95~18.04.1","5.4.0-1091.96~18.04.1","5.4.0-1094.100~18.04.1","5.4.0-1095.101~18.04.1","5.4.0-1098.104~18.04.2","5.4.0-1100.106~18.04.1","5.4.0-1101.107~18.04.1","5.4.0-1103.109~18.04.1","5.4.0-1104.110~18.04.1","5.4.0-1105.111~18.04.1","5.4.0-1106.112~18.04.1","5.4.0-1107.113~18.04.1","5.4.0-1108.114~18.04.1","5.4.0-1109.115~18.04.1","5.4.0-1110.116~18.04.1","5.4.0-1111.117~18.04.1","5.4.0-1112.118~18.04.1","5.4.0-1113.119~18.04.1","5.4.0-1115.122~18.04.1","5.4.0-1116.123~18.04.1","5.4.0-1117.124~18.04.1","5.4.0-1118.125~18.04.1","5.4.0-1119.126~18.04.2","5.4.0-1120.127~18.04.1","5.4.0-1121.128~18.04.1","5.4.0-1122.129~18.04.1","5.4.0-1123.130~18.04.1","5.4.0-1124.131~18.04.1","5.4.0-1126.133~18.04.1","5.4.0-1127.134~18.04.1","5.4.0-1128.135~18.04.1"],"bundled":48},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-gcp-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1128.137~18.04.1"}]}],"versions":["5.4.0-1019.19~18.04.2","5.4.0-1021.21~18.04.1","5.4.0-1022.22~18.04.1","5.4.0-1024.24~18.04.1","5.4.0-1025.25~18.04.1","5.4.0-1028.29~18.04.1","5.4.0-1029.31~18.04.1","5.4.0-1030.32~18.04.1","5.4.0-1032.34~18.04.1","5.4.0-1033.35~18.04.1","5.4.0-1034.37~18.04.1","5.4.0-1036.39~18.04.1","5.4.0-1037.40~18.04.1","5.4.0-1038.41~18.04.1","5.4.0-1040.43~18.04.1","5.4.0-1041.44~18.04.1","5.4.0-1042.45~18.04.1","5.4.0-1043.46~18.04.1","5.4.0-1044.47~18.04.2","5.4.0-1046.49~18.04.1","5.4.0-1049.53~18.04.1","5.4.0-1051.55~18.04.1","5.4.0-1052.56~18.04.1","5.4.0-1053.57~18.04.1","5.4.0-1055.59~18.04.1","5.4.0-1056.60~18.04.1","5.4.0-1057.61~18.04.1","5.4.0-1058.62~18.04.1","5.4.0-1059.63~18.04.1","5.4.0-1060.64~18.04.1","5.4.0-1062.66~18.04.1","5.4.0-1063.67~18.04.1","5.4.0-1064.68~18.04.1","5.4.0-1065.69~18.04.1","5.4.0-1067.71~18.04.1","5.4.0-1068.72~18.04.1","5.4.0-1069.73~18.04.1","5.4.0-1072.77~18.04.1","5.4.0-1073.78~18.04.1","5.4.0-1075.80~18.04.1","5.4.0-1078.84~18.04.1","5.4.0-1080.87~18.04.1","5.4.0-1083.91~18.04.1","5.4.0-1084.92~18.04.1","5.4.0-1086.94~18.04.1","5.4.0-1087.95~18.04.1","5.4.0-1089.97~18.04.1","5.4.0-1092.101~18.04.1","5.4.0-1093.102~18.04.1","5.4.0-1096.105~18.04.2","5.4.0-1097.106~18.04.1","5.4.0-1098.107~18.04.1","5.4.0-1100.109~18.04.1","5.4.0-1101.110~18.04.1","5.4.0-1102.111~18.04.2","5.4.0-1103.112~18.04.1","5.4.0-1104.113~18.04.1","5.4.0-1105.114~18.04.1","5.4.0-1106.115~18.04.1","5.4.0-1107.116~18.04.1","5.4.0-1108.117~18.04.1","5.4.0-1109.118~18.04.1","5.4.0-1110.119~18.04.1","5.4.0-1111.120~18.04.1","5.4.0-1112.121~18.04.1","5.4.0-1113.122~18.04.1","5.4.0-1115.124~18.04.1","5.4.0-1116.125~18.04.1","5.4.0-1117.126~18.04.1","5.4.0-1118.127~18.04.1","5.4.0-1120.129~18.04.1","5.4.0-1121.130~18.04.1","5.4.0-1122.131~18.04.1","5.4.0-1123.132~18.04.1","5.4.0-1124.133~18.04.1","5.4.0-1125.134~18.04.1","5.4.0-1126.135~18.04.1","5.4.0-1127.136~18.04.1"],"bundled":48},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-hwe-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-181.201~18.04.1"}]}],"versions":["5.4.0-37.41~18.04.1","5.4.0-39.43~18.04.1","5.4.0-40.44~18.04.1","5.4.0-42.46~18.04.1","5.4.0-45.49~18.04.2","5.4.0-47.51~18.04.1","5.4.0-48.52~18.04.1","5.4.0-51.56~18.04.1","5.4.0-52.57~18.04.1","5.4.0-53.59~18.04.1","5.4.0-54.60~18.04.1","5.4.0-56.62~18.04.1","5.4.0-58.64~18.04.1","5.4.0-59.65~18.04.1","5.4.0-60.67~18.04.1","5.4.0-62.70~18.04.1","5.4.0-64.72~18.04.1","5.4.0-65.73~18.04.1","5.4.0-66.74~18.04.2","5.4.0-67.75~18.04.1","5.4.0-70.78~18.04.1","5.4.0-71.79~18.04.1","5.4.0-72.80~18.04.1","5.4.0-73.82~18.04.1","5.4.0-74.83~18.04.1","5.4.0-77.86~18.04.1","5.4.0-80.90~18.04.1","5.4.0-81.91~18.04.1","5.4.0-84.94~18.04.1","5.4.0-86.97~18.04.1","5.4.0-87.98~18.04.1","5.4.0-89.100~18.04.1","5.4.0-90.101~18.04.1","5.4.0-91.102~18.04.1","5.4.0-92.103~18.04.2","5.4.0-94.106~18.04.1","5.4.0-96.109~18.04.1","5.4.0-97.110~18.04.1","5.4.0-99.112~18.04.1","5.4.0-100.113~18.04.1","5.4.0-104.118~18.04.1","5.4.0-105.119~18.04.1","5.4.0-107.121~18.04.1","5.4.0-109.123~18.04.1","5.4.0-110.124~18.04.1","5.4.0-113.127~18.04.1","5.4.0-117.132~18.04.1","5.4.0-120.136~18.04.1","5.4.0-121.137~18.04.1","5.4.0-122.138~18.04.1","5.4.0-124.140~18.04.1","5.4.0-125.141~18.04.1","5.4.0-126.142~18.04.1","5.4.0-128.144~18.04.1","5.4.0-131.147~18.04.1","5.4.0-132.148~18.04.1","5.4.0-133.149~18.04.1","5.4.0-135.152~18.04.2","5.4.0-136.153~18.04.1","5.4.0-137.154~18.04.1","5.4.0-139.156~18.04.1","5.4.0-144.161~18.04.1","5.4.0-146.163~18.04.1","5.4.0-147.164~18.04.1","5.4.0-148.165~18.04.1","5.4.0-149.166~18.04.1","5.4.0-150.167~18.04.1","5.4.0-152.169~18.04.1","5.4.0-153.170~18.04.1","5.4.0-155.172~18.04.1","5.4.0-156.173~18.04.1","5.4.0-159.176~18.04.1","5.4.0-162.179~18.04.1","5.4.0-163.180~18.04.1","5.4.0-164.181~18.04.1","5.4.0-165.182~18.04.1","5.4.0-166.183~18.04.2","5.4.0-167.184~18.04.1","5.4.0-169.187~18.04.1","5.4.0-170.188~18.04.1","5.4.0-171.189~18.04.1","5.4.0-172.190~18.04.1","5.4.0-173.191~18.04.1","5.4.0-174.193~18.04.1","5.4.0-175.195~18.04.1","5.4.0-177.197~18.04.1"],"bundled":48},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-ibm-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1071.76~18.04.1"}]}],"versions":["5.4.0-1010.11~18.04.2","5.4.0-1012.13~18.04.1","5.4.0-1014.15~18.04.1","5.4.0-1015.16~18.04.1","5.4.0-1017.19~18.04.1","5.4.0-1018.20~18.04.1","5.4.0-1019.21~18.04.1","5.4.0-1020.22~18.04.1","5.4.0-1021.23~18.04.1","5.4.0-1023.25~18.04.1","5.4.0-1026.29~18.04.1","5.4.0-1028.32~18.04.1","5.4.0-1029.33~18.04.1","5.4.0-1031.35~18.04.1","5.4.0-1032.36~18.04.1","5.4.0-1033.37~18.04.1","5.4.0-1034.38~18.04.1","5.4.0-1036.41~18.04.1","5.4.0-1037.42~18.04.1","5.4.0-1040.45~18.04.2","5.4.0-1041.46~18.04.1","5.4.0-1042.47~18.04.1","5.4.0-1044.49~18.04.1","5.4.0-1045.50~18.04.1","5.4.0-1046.51~18.04.1","5.4.0-1047.52~18.04.1","5.4.0-1048.53~18.04.1","5.4.0-1049.54~18.04.1","5.4.0-1050.55~18.04.1","5.4.0-1051.56~18.04.1","5.4.0-1052.57~18.04.1","5.4.0-1053.58~18.04.1","5.4.0-1054.59~18.04.1","5.4.0-1056.61~18.04.1","5.4.0-1057.62~18.04.1","5.4.0-1058.63~18.04.1","5.4.0-1059.64~18.04.1","5.4.0-1060.65~18.04.1","5.4.0-1061.66~18.04.1","5.4.0-1063.68~18.04.1","5.4.0-1064.69~18.04.1","5.4.0-1065.70~18.04.1","5.4.0-1066.71~18.04.1","5.4.0-1067.72~18.04.1","5.4.0-1068.73~18.04.1","5.4.0-1069.74~18.04.1","5.4.0-1070.75~18.04.1"],"bundled":48},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-oracle-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1123.132~18.04.1"}]}],"versions":["5.4.0-1019.19~18.04.1","5.4.0-1021.21~18.04.1","5.4.0-1022.22~18.04.1","5.4.0-1024.24~18.04.1","5.4.0-1025.25~18.04.1","5.4.0-1028.29~18.04.1","5.4.0-1029.31~18.04.1","5.4.0-1030.32~18.04.1","5.4.0-1033.35","5.4.0-1034.36~18.04.1","5.4.0-1035.38~18.04.1","5.4.0-1037.40~18.04.1","5.4.0-1038.41~18.04.1","5.4.0-1039.42~18.04.1","5.4.0-1041.44~18.04.1","5.4.0-1042.45~18.04.1","5.4.0-1043.46~18.04.1","5.4.0-1044.47~18.04.1","5.4.0-1046.50~18.04.2","5.4.0-1048.52~18.04.1","5.4.0-1049.53~18.04.1","5.4.0-1052.56~18.04.1","5.4.0-1053.57~18.04.1","5.4.0-1054.58~18.04.1","5.4.0-1055.59~18.04.1","5.4.0-1056.60~18.04.1","5.4.0-1057.61~18.04.1","5.4.0-1058.62~18.04.1","5.4.0-1059.63~18.04.1","5.4.0-1061.65~18.04.1","5.4.0-1062.66~18.04.1","5.4.0-1063.67~18.04.1","5.4.0-1064.68~18.04.1","5.4.0-1066.71~18.04.1","5.4.0-1067.72~18.04.1","5.4.0-1069.75~18.04.1","5.4.0-1070.76~18.04.1","5.4.0-1071.77~18.04.1","5.4.0-1073.79~18.04.1","5.4.0-1076.83~18.04.1","5.4.0-1078.86~18.04.1","5.4.0-1079.87~18.04.1","5.4.0-1081.89~18.04.1","5.4.0-1082.90~18.04.1","5.4.0-1083.91~18.04.1","5.4.0-1084.92~18.04.1","5.4.0-1086.95~18.04.1","5.4.0-1087.96~18.04.1","5.4.0-1090.99~18.04.2","5.4.0-1091.100~18.04.1","5.4.0-1092.101~18.04.1","5.4.0-1093.102~18.04.1","5.4.0-1094.103~18.04.1","5.4.0-1098.107~18.04.1","5.4.0-1099.108~18.04.1","5.4.0-1100.109~18.04.1","5.4.0-1101.110~18.04.1","5.4.0-1102.111~18.04.1","5.4.0-1103.112~18.04.1","5.4.0-1104.113~18.04.1","5.4.0-1105.114~18.04.1","5.4.0-1106.115~18.04.1","5.4.0-1107.116~18.04.1","5.4.0-1108.117~18.04.1","5.4.0-1109.118~18.04.1","5.4.0-1110.119~18.04.1","5.4.0-1111.120~18.04.1","5.4.0-1112.121~18.04.4","5.4.0-1113.122~18.04.1","5.4.0-1115.124~18.04.1","5.4.0-1116.125~18.04.1","5.4.0-1117.126~18.04.1","5.4.0-1118.127~18.04.1","5.4.0-1119.128~18.04.1","5.4.0-1120.129~18.04.1","5.4.0-1121.130~18.04.1","5.4.0-1122.131~18.04.1"],"bundled":48},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-raspi-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1108.120~18.04.1"}]}],"versions":["5.4.0-1013.13~18.04.1","5.4.0-1015.15~18.04.1","5.4.0-1016.17~18.04.1","5.4.0-1018.20~18.04.1","5.4.0-1019.21~18.04.1","5.4.0-1021.24~18.04.1","5.4.0-1022.25~18.04.1","5.4.0-1023.26~18.04.1","5.4.0-1025.28~18.04.1","5.4.0-1026.29~18.04.1","5.4.0-1028.31~18.04.1","5.4.0-1029.32~18.04.1","5.4.0-1030.33~18.04.1","5.4.0-1032.35~18.04.1","5.4.0-1033.36~18.04.1","5.4.0-1034.37~18.04.1","5.4.0-1035.38~18.04.1","5.4.0-1036.39~18.04.1","5.4.0-1038.41~18.04.1","5.4.0-1041.45~18.04.1","5.4.0-1042.46~18.04.3","5.4.0-1043.47~18.04.1","5.4.0-1044.48~18.04.1","5.4.0-1045.49~18.04.1","5.4.0-1046.50~18.04.1","5.4.0-1047.52~18.04.1","5.4.0-1048.53~18.04.1","5.4.0-1050.56~18.04.1","5.4.0-1052.58~18.04.1","5.4.0-1053.60~18.04.1","5.4.0-1055.62~18.04.1","5.4.0-1056.63~18.04.1","5.4.0-1058.65~18.04.1","5.4.0-1059.66~18.04.1","5.4.0-1060.68~18.04.1","5.4.0-1062.70~18.04.1","5.4.0-1065.75~18.04.1","5.4.0-1066.76~18.04.1","5.4.0-1068.78~18.04.1","5.4.0-1069.79~18.04.1","5.4.0-1070.80~18.04.1","5.4.0-1071.81~18.04.1","5.4.0-1073.84~18.04.1","5.4.0-1074.85~18.04.1","5.4.0-1077.88~18.04.2","5.4.0-1078.89~18.04.1","5.4.0-1079.90~18.04.1","5.4.0-1080.91~18.04.1","5.4.0-1081.92~18.04.1","5.4.0-1082.93~18.04.1","5.4.0-1083.94~18.04.1","5.4.0-1084.95~18.04.1","5.4.0-1085.96~18.04.1","5.4.0-1086.97~18.04.1","5.4.0-1088.99~18.04.1","5.4.0-1089.100~18.04.1","5.4.0-1090.101~18.04.1","5.4.0-1091.102~18.04.1","5.4.0-1092.103~18.04.1","5.4.0-1093.104~18.04.1","5.4.0-1094.105~18.04.1","5.4.0-1095.106~18.04.1","5.4.0-1096.107~18.04.1","5.4.0-1097.109~18.04.2","5.4.0-1098.110~18.04.2","5.4.0-1100.112~18.04.1","5.4.0-1101.113~18.04.1","5.4.0-1102.114~18.04.1","5.4.0-1103.115~18.04.1","5.4.0-1104.116~18.04.1","5.4.0-1105.117~18.04.1","5.4.0-1106.118~18.04.1","5.4.0-1107.119~18.04.1"],"bundled":48},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-181.201"}]}],"versions":["5.3.0-18.19","5.3.0-24.26","5.4.0-9.12","5.4.0-18.22","5.4.0-21.25","5.4.0-24.28","5.4.0-25.29","5.4.0-26.30","5.4.0-28.32","5.4.0-29.33","5.4.0-31.35","5.4.0-33.37","5.4.0-37.41","5.4.0-39.43","5.4.0-40.44","5.4.0-42.46","5.4.0-45.49","5.4.0-47.51","5.4.0-48.52","5.4.0-51.56","5.4.0-52.57","5.4.0-53.59","5.4.0-54.60","5.4.0-56.62","5.4.0-58.64","5.4.0-59.65","5.4.0-60.67","5.4.0-62.70","5.4.0-64.72","5.4.0-65.73","5.4.0-66.74","5.4.0-67.75","5.4.0-70.78","5.4.0-71.79","5.4.0-72.80","5.4.0-73.82","5.4.0-74.83","5.4.0-77.86","5.4.0-80.90","5.4.0-81.91","5.4.0-84.94","5.4.0-86.97","5.4.0-88.99","5.4.0-89.100","5.4.0-90.101","5.4.0-91.102","5.4.0-92.103","5.4.0-94.106","5.4.0-96.109","5.4.0-97.110","5.4.0-99.112","5.4.0-100.113","5.4.0-104.118","5.4.0-105.119","5.4.0-107.121","5.4.0-109.123","5.4.0-110.124","5.4.0-113.127","5.4.0-117.132","5.4.0-120.136","5.4.0-121.137","5.4.0-122.138","5.4.0-124.140","5.4.0-125.141","5.4.0-126.142","5.4.0-128.144","5.4.0-131.147","5.4.0-132.148","5.4.0-135.152","5.4.0-136.153","5.4.0-137.154","5.4.0-139.156","5.4.0-144.161","5.4.0-146.163","5.4.0-147.164","5.4.0-148.165","5.4.0-149.166","5.4.0-150.167","5.4.0-152.169","5.4.0-153.170","5.4.0-155.172","5.4.0-156.173","5.4.0-159.176","5.4.0-162.179","5.4.0-163.180","5.4.0-164.181","5.4.0-165.182","5.4.0-166.183","5.4.0-167.184","5.4.0-169.187","5.4.0-170.188","5.4.0-171.189","5.4.0-172.190","5.4.0-173.191","5.4.0-174.193","5.4.0-176.196","5.4.0-177.197"],"bundled":48},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1124.134"}]}],"versions":["5.3.0-1003.3","5.3.0-1008.9","5.3.0-1009.10","5.3.0-1010.11","5.4.0-1005.5","5.4.0-1007.7","5.4.0-1008.8","5.4.0-1009.9","5.4.0-1011.11","5.4.0-1015.15","5.4.0-1017.17","5.4.0-1018.18","5.4.0-1020.20","5.4.0-1021.21","5.4.0-1022.22","5.4.0-1024.24","5.4.0-1025.25","5.4.0-1028.29","5.4.0-1029.30","5.4.0-1030.31","5.4.0-1032.33","5.4.0-1034.35","5.4.0-1035.37","5.4.0-1037.39","5.4.0-1038.40","5.4.0-1039.41","5.4.0-1041.43","5.4.0-1043.45","5.4.0-1045.47","5.4.0-1047.49","5.4.0-1048.50","5.4.0-1049.51","5.4.0-1051.53","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1058.61","5.4.0-1059.62","5.4.0-1060.63","5.4.0-1061.64","5.4.0-1063.66","5.4.0-1064.67","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1068.72","5.4.0-1069.73","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1073.78","5.4.0-1075.80","5.4.0-1078.84","5.4.0-1080.87","5.4.0-1081.88","5.4.0-1083.90","5.4.0-1084.91","5.4.0-1085.92","5.4.0-1086.93","5.4.0-1088.96","5.4.0-1089.97","5.4.0-1092.100","5.4.0-1093.101","5.4.0-1094.102","5.4.0-1096.104","5.4.0-1097.105","5.4.0-1099.107","5.4.0-1100.108","5.4.0-1101.109","5.4.0-1102.110","5.4.0-1103.111","5.4.0-1104.112","5.4.0-1105.113","5.4.0-1106.114","5.4.0-1107.115","5.4.0-1108.116","5.4.0-1109.118","5.4.0-1110.119","5.4.0-1111.120","5.4.0-1112.121","5.4.0-1113.123","5.4.0-1114.124","5.4.0-1116.126","5.4.0-1117.127","5.4.0-1118.128","5.4.0-1119.129","5.4.0-1120.130","5.4.0-1121.131","5.4.0-1122.132","5.4.0-1123.133"],"bundled":48},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1129.136"}]}],"versions":["5.3.0-1003.3","5.3.0-1008.9","5.3.0-1009.10","5.4.0-1006.6","5.4.0-1008.8","5.4.0-1009.9","5.4.0-1010.10","5.4.0-1012.12","5.4.0-1016.16","5.4.0-1019.19","5.4.0-1020.20","5.4.0-1022.22","5.4.0-1023.23","5.4.0-1025.25","5.4.0-1026.26","5.4.0-1031.32","5.4.0-1032.33","5.4.0-1034.35","5.4.0-1035.36","5.4.0-1036.38","5.4.0-1039.41","5.4.0-1040.42","5.4.0-1041.43","5.4.0-1043.45","5.4.0-1044.46","5.4.0-1046.48","5.4.0-1047.49","5.4.0-1048.50","5.4.0-1049.51","5.4.0-1051.53","5.4.0-1055.57","5.4.0-1056.58","5.4.0-1058.60","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1064.67","5.4.0-1065.68","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1069.72","5.4.0-1070.73","5.4.0-1072.75","5.4.0-1073.76","5.4.0-1074.77","5.4.0-1077.80","5.4.0-1078.81","5.4.0-1080.83","5.4.0-1083.87","5.4.0-1085.90","5.4.0-1086.91","5.4.0-1089.94","5.4.0-1090.95","5.4.0-1091.96","5.4.0-1094.100","5.4.0-1095.101","5.4.0-1098.104","5.4.0-1100.106","5.4.0-1101.107","5.4.0-1103.109","5.4.0-1104.110","5.4.0-1105.111","5.4.0-1106.112","5.4.0-1107.113","5.4.0-1108.114","5.4.0-1109.115","5.4.0-1110.116","5.4.0-1111.117","5.4.0-1112.118","5.4.0-1113.119","5.4.0-1114.120","5.4.0-1115.122","5.4.0-1116.123","5.4.0-1117.124","5.4.0-1118.125","5.4.0-1119.126","5.4.0-1120.127","5.4.0-1121.128","5.4.0-1122.129","5.4.0-1123.130","5.4.0-1124.131","5.4.0-1126.133","5.4.0-1127.134","5.4.0-1128.135"],"bundled":48},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1128.137"}]}],"versions":["5.3.0-1004.4","5.3.0-1009.10","5.3.0-1011.12","5.4.0-1005.5","5.4.0-1007.7","5.4.0-1008.8","5.4.0-1009.9","5.4.0-1011.11","5.4.0-1015.15","5.4.0-1018.18","5.4.0-1019.19","5.4.0-1021.21","5.4.0-1022.22","5.4.0-1024.24","5.4.0-1025.25","5.4.0-1028.29","5.4.0-1029.31","5.4.0-1030.32","5.4.0-1032.34","5.4.0-1033.35","5.4.0-1034.37","5.4.0-1036.39","5.4.0-1037.40","5.4.0-1038.41","5.4.0-1040.43","5.4.0-1041.44","5.4.0-1042.45","5.4.0-1043.46","5.4.0-1044.47","5.4.0-1046.49","5.4.0-1049.53","5.4.0-1051.55","5.4.0-1052.56","5.4.0-1053.57","5.4.0-1055.59","5.4.0-1056.60","5.4.0-1057.61","5.4.0-1058.62","5.4.0-1059.63","5.4.0-1060.64","5.4.0-1062.66","5.4.0-1063.67","5.4.0-1064.68","5.4.0-1065.69","5.4.0-1067.71","5.4.0-1068.72","5.4.0-1069.73","5.4.0-1072.77","5.4.0-1073.78","5.4.0-1075.80","5.4.0-1078.84","5.4.0-1080.87","5.4.0-1083.91","5.4.0-1084.92","5.4.0-1086.94","5.4.0-1087.95","5.4.0-1089.97","5.4.0-1090.98","5.4.0-1092.101","5.4.0-1093.102","5.4.0-1096.105","5.4.0-1097.106","5.4.0-1098.107","5.4.0-1100.109","5.4.0-1101.110","5.4.0-1102.111","5.4.0-1103.112","5.4.0-1104.113","5.4.0-1105.114","5.4.0-1106.115","5.4.0-1107.116","5.4.0-1108.117","5.4.0-1109.118","5.4.0-1110.119","5.4.0-1111.120","5.4.0-1112.121","5.4.0-1113.122","5.4.0-1115.124","5.4.0-1116.125","5.4.0-1117.126","5.4.0-1118.127","5.4.0-1120.129","5.4.0-1121.130","5.4.0-1122.131","5.4.0-1123.132","5.4.0-1124.133","5.4.0-1125.134","5.4.0-1126.135","5.4.0-1127.136"],"bundled":48},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1091.95"}]}],"versions":["5.4.0-1008.9","5.4.0-1009.10","5.4.0-1010.11","5.4.0-1011.12","5.4.0-1012.13","5.4.0-1013.14","5.4.0-1014.15","5.4.0-1015.16","5.4.0-1016.17","5.4.0-1018.19","5.4.0-1021.22","5.4.0-1022.23","5.4.0-1023.24","5.4.0-1024.25","5.4.0-1025.26","5.4.0-1026.27","5.4.0-1027.28","5.4.0-1029.30","5.4.0-1031.32","5.4.0-1032.33","5.4.0-1033.34","5.4.0-1034.35","5.4.0-1036.37","5.4.0-1037.38","5.4.0-1038.39","5.4.0-1039.40","5.4.0-1040.41","5.4.0-1043.44","5.4.0-1046.48","5.4.0-1048.51","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1056.60","5.4.0-1057.61","5.4.0-1060.64","5.4.0-1061.65","5.4.0-1062.66","5.4.0-1064.68","5.4.0-1065.69","5.4.0-1066.70","5.4.0-1067.71","5.4.0-1068.72","5.4.0-1069.73","5.4.0-1070.74","5.4.0-1071.75","5.4.0-1072.76","5.4.0-1073.77","5.4.0-1074.78","5.4.0-1075.79","5.4.0-1076.80","5.4.0-1077.81","5.4.0-1078.82","5.4.0-1079.83","5.4.0-1080.84","5.4.0-1081.85","5.4.0-1083.87","5.4.0-1084.88","5.4.0-1085.89","5.4.0-1086.90","5.4.0-1087.91","5.4.0-1088.92","5.4.0-1089.93","5.4.0-1090.94"],"bundled":48},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1071.76"}]}],"versions":["5.4.0-1003.4","5.4.0-1004.5","5.4.0-1005.6","5.4.0-1006.7","5.4.0-1007.8","5.4.0-1008.9","5.4.0-1010.11","5.4.0-1012.13","5.4.0-1013.14","5.4.0-1014.15","5.4.0-1015.16","5.4.0-1017.19","5.4.0-1018.20","5.4.0-1019.21","5.4.0-1020.22","5.4.0-1021.23","5.4.0-1023.25","5.4.0-1026.29","5.4.0-1028.32","5.4.0-1029.33","5.4.0-1031.35","5.4.0-1032.36","5.4.0-1033.37","5.4.0-1034.38","5.4.0-1036.41","5.4.0-1037.42","5.4.0-1040.45","5.4.0-1041.46","5.4.0-1042.47","5.4.0-1044.49","5.4.0-1045.50","5.4.0-1046.51","5.4.0-1047.52","5.4.0-1048.53","5.4.0-1049.54","5.4.0-1050.55","5.4.0-1051.56","5.4.0-1052.57","5.4.0-1053.58","5.4.0-1054.59","5.4.0-1056.61","5.4.0-1057.62","5.4.0-1058.63","5.4.0-1059.64","5.4.0-1060.65","5.4.0-1061.66","5.4.0-1063.68","5.4.0-1064.69","5.4.0-1065.70","5.4.0-1066.71","5.4.0-1067.72","5.4.0-1068.73","5.4.0-1069.74","5.4.0-1070.75"],"bundled":48},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-iot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1036.37"}]}],"versions":["5.4.0-1001.3","5.4.0-1004.6","5.4.0-1005.7","5.4.0-1006.8","5.4.0-1009.11","5.4.0-1010.12","5.4.0-1011.13","5.4.0-1012.14","5.4.0-1013.15","5.4.0-1014.16","5.4.0-1017.18","5.4.0-1018.19","5.4.0-1019.20","5.4.0-1021.22","5.4.0-1022.23","5.4.0-1023.24","5.4.0-1024.25","5.4.0-1025.26","5.4.0-1026.27","5.4.0-1028.29","5.4.0-1029.30","5.4.0-1030.31","5.4.0-1031.32","5.4.0-1032.33","5.4.0-1033.34","5.4.0-1034.35","5.4.0-1035.36"],"bundled":48},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1112.119"}]}],"versions":["5.3.0-1003.3","5.3.0-1008.9","5.3.0-1009.10","5.4.0-1004.4","5.4.0-1006.6","5.4.0-1007.7","5.4.0-1008.8","5.4.0-1009.9","5.4.0-1011.11","5.4.0-1015.15","5.4.0-1018.18","5.4.0-1020.20","5.4.0-1021.21","5.4.0-1023.23","5.4.0-1024.24","5.4.0-1026.27","5.4.0-1028.29","5.4.0-1030.31","5.4.0-1031.32","5.4.0-1032.33","5.4.0-1033.34","5.4.0-1034.35","5.4.0-1036.37","5.4.0-1037.38","5.4.0-1038.39","5.4.0-1039.40","5.4.0-1040.41","5.4.0-1041.42","5.4.0-1044.46","5.4.0-1045.47","5.4.0-1046.48","5.4.0-1047.49","5.4.0-1048.50","5.4.0-1049.51","5.4.0-1050.52","5.4.0-1051.53","5.4.0-1053.55","5.4.0-1054.56","5.4.0-1055.57","5.4.0-1056.58","5.4.0-1058.61","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1065.68","5.4.0-1068.72","5.4.0-1070.75","5.4.0-1071.76","5.4.0-1073.78","5.4.0-1074.79","5.4.0-1075.80","5.4.0-1076.81","5.4.0-1078.84","5.4.0-1079.85","5.4.0-1082.88","5.4.0-1083.89","5.4.0-1084.90","5.4.0-1086.92","5.4.0-1087.93","5.4.0-1088.94","5.4.0-1089.95","5.4.0-1090.96","5.4.0-1091.97","5.4.0-1092.98","5.4.0-1093.99","5.4.0-1094.100","5.4.0-1095.101","5.4.0-1096.102","5.4.0-1097.103","5.4.0-1098.104","5.4.0-1099.105","5.4.0-1100.106","5.4.0-1101.107","5.4.0-1102.108","5.4.0-1103.110","5.4.0-1104.111","5.4.0-1105.112","5.4.0-1106.113","5.4.0-1107.114","5.4.0-1108.115","5.4.0-1109.116","5.4.0-1110.117","5.4.0-1111.118"],"bundled":48},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1123.132"}]}],"versions":["5.3.0-1002.2","5.3.0-1007.8","5.3.0-1008.9","5.4.0-1005.5","5.4.0-1007.7","5.4.0-1008.8","5.4.0-1009.9","5.4.0-1011.11","5.4.0-1015.15","5.4.0-1018.18","5.4.0-1019.19","5.4.0-1021.21","5.4.0-1022.22","5.4.0-1024.24","5.4.0-1025.25","5.4.0-1028.29","5.4.0-1029.31","5.4.0-1030.32","5.4.0-1032.34","5.4.0-1034.36","5.4.0-1035.38","5.4.0-1037.40","5.4.0-1038.41","5.4.0-1039.42","5.4.0-1041.44","5.4.0-1042.45","5.4.0-1043.46","5.4.0-1045.49","5.4.0-1046.50","5.4.0-1048.52","5.4.0-1049.53","5.4.0-1052.56","5.4.0-1053.57","5.4.0-1054.58","5.4.0-1055.59","5.4.0-1056.60","5.4.0-1057.61","5.4.0-1058.62","5.4.0-1059.63","5.4.0-1061.65","5.4.0-1062.66","5.4.0-1063.67","5.4.0-1064.68","5.4.0-1066.71","5.4.0-1067.72","5.4.0-1069.75","5.4.0-1070.76","5.4.0-1071.77","5.4.0-1073.79","5.4.0-1076.83","5.4.0-1078.86","5.4.0-1079.87","5.4.0-1081.89","5.4.0-1082.90","5.4.0-1083.91","5.4.0-1084.92","5.4.0-1086.95","5.4.0-1087.96","5.4.0-1090.99","5.4.0-1091.100","5.4.0-1092.101","5.4.0-1093.102","5.4.0-1094.103","5.4.0-1097.106","5.4.0-1098.107","5.4.0-1099.108","5.4.0-1100.109","5.4.0-1101.110","5.4.0-1102.111","5.4.0-1103.112","5.4.0-1104.113","5.4.0-1105.114","5.4.0-1106.115","5.4.0-1107.116","5.4.0-1108.117","5.4.0-1109.118","5.4.0-1110.119","5.4.0-1111.120","5.4.0-1112.121","5.4.0-1113.122","5.4.0-1115.124","5.4.0-1116.125","5.4.0-1117.126","5.4.0-1118.127","5.4.0-1119.128","5.4.0-1120.129","5.4.0-1121.130","5.4.0-1122.131"],"bundled":48},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1108.120"}]}],"versions":["5.4.0-1007.7","5.4.0-1008.8","5.4.0-1011.11","5.4.0-1012.12","5.4.0-1013.13","5.4.0-1015.15","5.4.0-1016.17","5.4.0-1018.20","5.4.0-1019.21","5.4.0-1021.24","5.4.0-1022.25","5.4.0-1023.26","5.4.0-1025.28","5.4.0-1026.29","5.4.0-1028.31","5.4.0-1029.32","5.4.0-1030.33","5.4.0-1032.35","5.4.0-1033.36","5.4.0-1034.37","5.4.0-1035.38","5.4.0-1036.39","5.4.0-1038.41","5.4.0-1041.45","5.4.0-1042.46","5.4.0-1043.47","5.4.0-1044.48","5.4.0-1045.49","5.4.0-1046.50","5.4.0-1047.52","5.4.0-1048.53","5.4.0-1050.56","5.4.0-1052.58","5.4.0-1053.60","5.4.0-1055.62","5.4.0-1056.63","5.4.0-1058.65","5.4.0-1059.67","5.4.0-1060.68","5.4.0-1062.70","5.4.0-1065.75","5.4.0-1066.76","5.4.0-1068.78","5.4.0-1069.79","5.4.0-1070.80","5.4.0-1071.81","5.4.0-1073.84","5.4.0-1074.85","5.4.0-1077.88","5.4.0-1078.89","5.4.0-1079.90","5.4.0-1080.91","5.4.0-1081.92","5.4.0-1082.93","5.4.0-1083.94","5.4.0-1084.95","5.4.0-1085.96","5.4.0-1086.97","5.4.0-1088.99","5.4.0-1089.100","5.4.0-1090.101","5.4.0-1091.102","5.4.0-1092.103","5.4.0-1093.104","5.4.0-1094.105","5.4.0-1095.106","5.4.0-1096.107","5.4.0-1097.109","5.4.0-1098.110","5.4.0-1100.112","5.4.0-1101.113","5.4.0-1102.114","5.4.0-1103.115","5.4.0-1104.116","5.4.0-1105.117","5.4.0-1106.118","5.4.0-1107.119"],"bundled":48},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-xilinx-zynqmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1043.47"}]}],"versions":["5.4.0-1020.24","5.4.0-1021.25","5.4.0-1022.26","5.4.0-1023.27","5.4.0-1024.28","5.4.0-1025.29","5.4.0-1026.30","5.4.0-1027.31","5.4.0-1028.32","5.4.0-1029.33","5.4.0-1030.34","5.4.0-1031.35","5.4.0-1032.36","5.4.0-1033.37","5.4.0-1034.38","5.4.0-1035.39","5.4.0-1036.40","5.4.0-1037.41","5.4.0-1038.42","5.4.0-1039.43","5.4.0-1040.44","5.4.0-1041.45","5.4.0-1042.46"],"bundled":48},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-bluefield","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1084.91"}]}],"versions":["5.4.0-1007.10","5.4.0-1011.14","5.4.0-1012.15","5.4.0-1013.16","5.4.0-1016.19","5.4.0-1019.22","5.4.0-1020.23","5.4.0-1021.24","5.4.0-1022.25","5.4.0-1023.26","5.4.0-1025.28","5.4.0-1026.29","5.4.0-1028.31","5.4.0-1030.33","5.4.0-1032.35","5.4.0-1035.38","5.4.0-1036.39","5.4.0-1040.44","5.4.0-1042.47","5.4.0-1044.49","5.4.0-1045.50","5.4.0-1046.51","5.4.0-1047.52","5.4.0-1049.55","5.4.0-1050.56","5.4.0-1054.60","5.4.0-1058.64","5.4.0-1059.65","5.4.0-1060.66","5.4.0-1062.68","5.4.0-1064.70","5.4.0-1065.71","5.4.0-1066.72","5.4.0-1068.74","5.4.0-1070.76","5.4.0-1071.77","5.4.0-1072.78","5.4.0-1073.79","5.4.0-1074.80","5.4.0-1075.81","5.4.0-1076.82","5.4.0-1077.83","5.4.0-1078.84","5.4.0-1079.85","5.4.0-1080.87","5.4.0-1081.88","5.4.0-1082.89","5.4.0-1083.90"],"bundled":48},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-intel-iotg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1057.63"}]}],"versions":["5.15.0-1004.6","5.15.0-1008.11","5.15.0-1010.14","5.15.0-1013.17","5.15.0-1015.20","5.15.0-1016.21","5.15.0-1017.22","5.15.0-1018.23","5.15.0-1021.26","5.15.0-1023.28","5.15.0-1025.30","5.15.0-1026.31","5.15.0-1027.32","5.15.0-1028.33","5.15.0-1030.35","5.15.0-1031.36","5.15.0-1033.38","5.15.0-1034.39","5.15.0-1035.40","5.15.0-1036.41","5.15.0-1037.42","5.15.0-1038.43","5.15.0-1039.45","5.15.0-1040.46","5.15.0-1043.49","5.15.0-1045.51","5.15.0-1046.52","5.15.0-1047.53","5.15.0-1048.54","5.15.0-1049.55","5.15.0-1050.56","5.15.0-1051.57","5.15.0-1052.58","5.15.0-1055.61"],"bundled":94},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-intel-iotg-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1058.64~20.04.1"}]}],"versions":["5.15.0-1003.5~20.04.1","5.15.0-1008.11~20.04.1","5.15.0-1010.14~20.04.1","5.15.0-1015.20~20.04.2","5.15.0-1016.21~20.04.1","5.15.0-1017.22~20.04.1","5.15.0-1018.23~20.04.1","5.15.0-1021.26~20.04.1","5.15.0-1023.28~20.04.1","5.15.0-1025.30~20.04.1","5.15.0-1026.31~20.04.1","5.15.0-1027.32~20.04.1","5.15.0-1030.35~20.04.1","5.15.0-1031.36~20.04.1","5.15.0-1033.38~20.04.1","5.15.0-1034.39~20.04.1","5.15.0-1036.41~20.04.1","5.15.0-1037.42~20.04.1","5.15.0-1038.43~20.04.1","5.15.0-1040.46~20.04.1","5.15.0-1043.49~20.04.1","5.15.0-1045.51~20.04.1","5.15.0-1046.52~20.04.1","5.15.0-1048.54~20.04.1","5.15.0-1049.55~20.04.1","5.15.0-1050.56~20.04.1","5.15.0-1051.57~20.04.1","5.15.0-1052.58~20.04.1","5.15.0-1055.61~20.04.1"],"bundled":245},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.0-1023.24"}]}],"versions":["6.5.0-1004.4","6.5.0-1007.7","6.5.0-1013.13","6.5.0-1014.14","6.5.0-1015.15","6.5.0-1018.18","6.5.0-1019.19","6.5.0-1021.22","6.5.0-1022.23"],"bundled":100},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.0-1024.25~22.04.1"}]}],"versions":["6.5.0-1007.7~22.04.1","6.5.0-1009.9~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.19~22.04.2","6.5.0-1019.20~22.04.1","6.5.0-1021.22~22.04.1","6.5.0-1022.23~22.04.1","6.5.0-1023.24~22.04.1"],"bundled":100},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.0-1024.26~22.04.1"}]}],"versions":["6.5.0-1010.10~22.04.3","6.5.0-1011.11~22.04.1","6.5.0-1013.13~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1022.24~22.04.1","6.5.0-1023.25~22.04.1"],"bundled":100},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.0-1023.23~22.04.1"}]}],"versions":["6.5.0-1008.8~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1012.12~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.2","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1022.22~22.04.1"],"bundled":100},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.0-44.44.1~22.04.1"}]}],"versions":["6.5.0-14.14.1~22.04.1","6.5.0-15.15.1.1~22.04.1","6.5.0-17.17.1.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-41.41.1~22.04.1","6.5.0-42.42.1~22.04.1"],"bundled":100},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.0-1026.26~22.04.1"}]}],"versions":["6.5.0-1013.13~22.04.4","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1019.19~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1","6.5.0-1025.25~22.04.1"],"bundled":100},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.0-1017.18~22.04.1"}]}],"versions":["6.5.0-1007.8~22.04.1","6.5.0-1008.9~22.04.1","6.5.0-1009.10~22.04.1","6.5.0-1010.11~22.04.1","6.5.0-1011.12~22.04.1","6.5.0-1012.13~22.04.1","6.5.0-1014.15~22.04.1","6.5.0-1015.16~22.04.1","6.5.0-1016.17~22.04.1"],"bundled":100},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.0-1027.28"}]}],"versions":["6.5.0-1003.3","6.5.0-1004.4","6.5.0-1006.6","6.5.0-1007.7","6.5.0-1008.8","6.5.0-1009.10","6.5.0-1011.12","6.5.0-1013.14","6.5.0-1014.15","6.5.0-1015.16","6.5.0-1016.17","6.5.0-1018.19","6.5.0-1019.20","6.5.0-1020.21","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25","6.5.0-1025.26"],"bundled":100},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.0-44.44~22.04.1"}]}],"versions":["6.5.0-14.14~22.04.1","6.5.0-15.15~22.04.1","6.5.0-17.17~22.04.1","6.5.0-18.18~22.04.1","6.5.0-21.21~22.04.1","6.5.0-25.25~22.04.1","6.5.0-26.26~22.04.1","6.5.0-27.28~22.04.1","6.5.0-28.29~22.04.1","6.5.0-35.35~22.04.1","6.5.0-41.41~22.04.2"],"bundled":104}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"linux","product":"linux"},{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"https://git.kernel.org/stable/c/5278c3eb6bf5896417572b52adb6be9d26e92f65","tags":["x_transferred","Patch","web","report"]},{"url":"https://git.kernel.org/stable/c/a6efe6dbaaf504f5b3f8a5c3f711fe54e7dda0ba","tags":["x_transferred","Patch","web","report"]},{"url":"https://git.kernel.org/stable/c/364a66be2abdcd4fd426ffa44d9b8f40aafb3caa","tags":["x_transferred","Patch","web","report"]},{"url":"https://git.kernel.org/stable/c/120f7fa2008e3bd8b7680b4ab5df942decf60fd5","tags":["x_transferred","Patch","web","report"]},{"url":"https://git.kernel.org/stable/c/9c9c68d64fd3284f7097ed6ae057c8441f39fcd3","tags":["x_transferred","Patch","web","report"]},{"url":"https://git.kernel.org/stable/c/2e1480538ef60bfee5473dfe02b1ecbaf1a4aa0d","tags":["x_transferred","Patch","web","report"]},{"url":"https://git.kernel.org/stable/c/2000016bab499074e6248ea85aeea7dd762355d9","tags":["x_transferred","Patch","web","report"]},{"url":"https://git.kernel.org/stable/c/67b8bcbaed4777871bb0dcc888fb02a614a98ab1","tags":["x_transferred","Patch","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html","tags":["x_transferred","Mailing List","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html","tags":["x_transferred","Mailing List","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26697","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xg7r-7865-v6c7"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-26697","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16-els/CLSA-2024-1716269479.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16-els/CLSA-2024-1716269925.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu18-els/CLSA-2024-1716270232.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu18-els/CLSA-2024-1716270655.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2024-1716270851.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-46981","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47173","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-47233","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52486","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52524","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52530","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52566","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52583","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52587","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52594","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52595","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52599","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52601","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52602","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52604","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52615","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52617","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52619","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52622","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52623","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6270","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22099","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26614","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26622","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26625","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26635","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26636","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26663","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26671","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26675","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26679","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26685","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26696","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26704","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26735","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26801","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26805","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26825","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26882","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26883","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26884","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26898","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26901","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26903","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26910","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26920","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35811","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26697.json","tags":["advisory"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-26697","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1617","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47110","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47184","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48674","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52620","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52628","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52629","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52635","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52637","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52638","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52639","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52642","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52644","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24858","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26642","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26645","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26668","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26686","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26720","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26726","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26733","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26739","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26740","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26743","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26744","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26754","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26763","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26791","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26793","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26804","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26812","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26813","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26817","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26828","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26839","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26840","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26846","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26852","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26857","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26859","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26863","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26872","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26875","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26876","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26878","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26880","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26897","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26915","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26922","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27074","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1618","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47082","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26752","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1622","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48655","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52477","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52631","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52633","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26665","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26669","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26680","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26684","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26688","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26689","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26706","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26707","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26734","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26776","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26782","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26787","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26792","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26808","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26809","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26811","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26814","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26829","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26843","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26855","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26862","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26865","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26869","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26870","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26893","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26895","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26896","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26917","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26921","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1647","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48632","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48659","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48660","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52609","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52616","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52618","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52621","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52630","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52655","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52675","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52676","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24860","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26610","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26633","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26640","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26641","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26661","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26702","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26712","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26851","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26881","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26900","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26907","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26908","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27395","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27396","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27431","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1648","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52685","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52690","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52694","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26937","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27398","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35849","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35943","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1649","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35845","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241490-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1177529","tags":["report"]},{"url":"https://bugzilla.suse.com/1192145","tags":["report"]},{"url":"https://bugzilla.suse.com/1194869","tags":["report"]},{"url":"https://bugzilla.suse.com/1200465","tags":["report"]},{"url":"https://bugzilla.suse.com/1205316","tags":["report"]},{"url":"https://bugzilla.suse.com/1207948","tags":["report"]},{"url":"https://bugzilla.suse.com/1209635","tags":["report"]},{"url":"https://bugzilla.suse.com/1209657","tags":["report"]},{"url":"https://bugzilla.suse.com/1212514","tags":["report"]},{"url":"https://bugzilla.suse.com/1213456","tags":["report"]},{"url":"https://bugzilla.suse.com/1214852","tags":["report"]},{"url":"https://bugzilla.suse.com/1215221","tags":["report"]},{"url":"https://bugzilla.suse.com/1215322","tags":["report"]},{"url":"https://bugzilla.suse.com/1217339","tags":["report"]},{"url":"https://bugzilla.suse.com/1217829","tags":["report"]},{"url":"https://bugzilla.suse.com/1217959","tags":["report"]},{"url":"https://bugzilla.suse.com/1217987","tags":["report"]},{"url":"https://bugzilla.suse.com/1217988","tags":["report"]},{"url":"https://bugzilla.suse.com/1217989","tags":["report"]},{"url":"https://bugzilla.suse.com/1218321","tags":["report"]},{"url":"https://bugzilla.suse.com/1218336","tags":["report"]},{"url":"https://bugzilla.suse.com/1218479","tags":["report"]},{"url":"https://bugzilla.suse.com/1218643","tags":["report"]},{"url":"https://bugzilla.suse.com/1218777","tags":["report"]},{"url":"https://bugzilla.suse.com/1219126","tags":["report"]},{"url":"https://bugzilla.suse.com/1219169","tags":["report"]},{"url":"https://bugzilla.suse.com/1219170","tags":["report"]},{"url":"https://bugzilla.suse.com/1219264","tags":["report"]},{"url":"https://bugzilla.suse.com/1219834","tags":["report"]},{"url":"https://bugzilla.suse.com/1220114","tags":["report"]},{"url":"https://bugzilla.suse.com/1220176","tags":["report"]},{"url":"https://bugzilla.suse.com/1220237","tags":["report"]},{"url":"https://bugzilla.suse.com/1220251","tags":["report"]},{"url":"https://bugzilla.suse.com/1220320","tags":["report"]},{"url":"https://bugzilla.suse.com/1220337","tags":["report"]},{"url":"https://bugzilla.suse.com/1220340","tags":["report"]},{"url":"https://bugzilla.suse.com/1220365","tags":["report"]},{"url":"https://bugzilla.suse.com/1220366","tags":["report"]},{"url":"https://bugzilla.suse.com/1220398","tags":["report"]},{"url":"https://bugzilla.suse.com/1220411","tags":["report"]},{"url":"https://bugzilla.suse.com/1220413","tags":["report"]},{"url":"https://bugzilla.suse.com/1220439","tags":["report"]},{"url":"https://bugzilla.suse.com/1220443","tags":["report"]},{"url":"https://bugzilla.suse.com/1220445","tags":["report"]},{"url":"https://bugzilla.suse.com/1220466","tags":["report"]},{"url":"https://bugzilla.suse.com/1220478","tags":["report"]},{"url":"https://bugzilla.suse.com/1220482","tags":["report"]},{"url":"https://bugzilla.suse.com/1220484","tags":["report"]},{"url":"https://bugzilla.suse.com/1220486","tags":["report"]},{"url":"https://bugzilla.suse.com/1220487","tags":["report"]},{"url":"https://bugzilla.suse.com/1220492","tags":["report"]},{"url":"https://bugzilla.suse.com/1220703","tags":["report"]},{"url":"https://bugzilla.suse.com/1220775","tags":["report"]},{"url":"https://bugzilla.suse.com/1220790","tags":["report"]},{"url":"https://bugzilla.suse.com/1220797","tags":["report"]},{"url":"https://bugzilla.suse.com/1220831","tags":["report"]},{"url":"https://bugzilla.suse.com/1220833","tags":["report"]},{"url":"https://bugzilla.suse.com/1220836","tags":["report"]},{"url":"https://bugzilla.suse.com/1220839","tags":["report"]},{"url":"https://bugzilla.suse.com/1220840","tags":["report"]},{"url":"https://bugzilla.suse.com/1220843","tags":["report"]},{"url":"https://bugzilla.suse.com/1220870","tags":["report"]},{"url":"https://bugzilla.suse.com/1220871","tags":["report"]},{"url":"https://bugzilla.suse.com/1220872","tags":["report"]},{"url":"https://bugzilla.suse.com/1220878","tags":["report"]},{"url":"https://bugzilla.suse.com/1220879","tags":["report"]},{"url":"https://bugzilla.suse.com/1220883","tags":["report"]},{"url":"https://bugzilla.suse.com/1220885","tags":["report"]},{"url":"https://bugzilla.suse.com/1220887","tags":["report"]},{"url":"https://bugzilla.suse.com/1220898","tags":["report"]},{"url":"https://bugzilla.suse.com/1220901","tags":["report"]},{"url":"https://bugzilla.suse.com/1220915","tags":["report"]},{"url":"https://bugzilla.suse.com/1220918","tags":["report"]},{"url":"https://bugzilla.suse.com/1220920","tags":["report"]},{"url":"https://bugzilla.suse.com/1220921","tags":["report"]},{"url":"https://bugzilla.suse.com/1220926","tags":["report"]},{"url":"https://bugzilla.suse.com/1220927","tags":["report"]},{"url":"https://bugzilla.suse.com/1220929","tags":["report"]},{"url":"https://bugzilla.suse.com/1220932","tags":["report"]},{"url":"https://bugzilla.suse.com/1220935","tags":["report"]},{"url":"https://bugzilla.suse.com/1220937","tags":["report"]},{"url":"https://bugzilla.suse.com/1220938","tags":["report"]},{"url":"https://bugzilla.suse.com/1220940","tags":["report"]},{"url":"https://bugzilla.suse.com/1220954","tags":["report"]},{"url":"https://bugzilla.suse.com/1220955","tags":["report"]},{"url":"https://bugzilla.suse.com/1220959","tags":["report"]},{"url":"https://bugzilla.suse.com/1220960","tags":["report"]},{"url":"https://bugzilla.suse.com/1220961","tags":["report"]},{"url":"https://bugzilla.suse.com/1220965","tags":["report"]},{"url":"https://bugzilla.suse.com/1220969","tags":["report"]},{"url":"https://bugzilla.suse.com/1220978","tags":["report"]},{"url":"https://bugzilla.suse.com/1220979","tags":["report"]},{"url":"https://bugzilla.suse.com/1220981","tags":["report"]},{"url":"https://bugzilla.suse.com/1220982","tags":["report"]},{"url":"https://bugzilla.suse.com/1220983","tags":["report"]},{"url":"https://bugzilla.suse.com/1220985","tags":["report"]},{"url":"https://bugzilla.suse.com/1220986","tags":["report"]},{"url":"https://bugzilla.suse.com/1220987","tags":["report"]},{"url":"https://bugzilla.suse.com/1220989","tags":["report"]},{"url":"https://bugzilla.suse.com/1220990","tags":["report"]},{"url":"https://bugzilla.suse.com/1221009","tags":["report"]},{"url":"https://bugzilla.suse.com/1221012","tags":["report"]},{"url":"https://bugzilla.suse.com/1221015","tags":["report"]},{"url":"https://bugzilla.suse.com/1221022","tags":["report"]},{"url":"https://bugzilla.suse.com/1221039","tags":["report"]},{"url":"https://bugzilla.suse.com/1221040","tags":["report"]},{"url":"https://bugzilla.suse.com/1221044","tags":["report"]},{"url":"https://bugzilla.suse.com/1221045","tags":["report"]},{"url":"https://bugzilla.suse.com/1221046","tags":["report"]},{"url":"https://bugzilla.suse.com/1221048","tags":["report"]},{"url":"https://bugzilla.suse.com/1221055","tags":["report"]},{"url":"https://bugzilla.suse.com/1221056","tags":["report"]},{"url":"https://bugzilla.suse.com/1221058","tags":["report"]},{"url":"https://bugzilla.suse.com/1221060","tags":["report"]},{"url":"https://bugzilla.suse.com/1221061","tags":["report"]},{"url":"https://bugzilla.suse.com/1221062","tags":["report"]},{"url":"https://bugzilla.suse.com/1221066","tags":["report"]},{"url":"https://bugzilla.suse.com/1221067","tags":["report"]},{"url":"https://bugzilla.suse.com/1221068","tags":["report"]},{"url":"https://bugzilla.suse.com/1221069","tags":["report"]},{"url":"https://bugzilla.suse.com/1221070","tags":["report"]},{"url":"https://bugzilla.suse.com/1221071","tags":["report"]},{"url":"https://bugzilla.suse.com/1221077","tags":["report"]},{"url":"https://bugzilla.suse.com/1221082","tags":["report"]},{"url":"https://bugzilla.suse.com/1221090","tags":["report"]},{"url":"https://bugzilla.suse.com/1221097","tags":["report"]},{"url":"https://bugzilla.suse.com/1221156","tags":["report"]},{"url":"https://bugzilla.suse.com/1221162","tags":["report"]},{"url":"https://bugzilla.suse.com/1221252","tags":["report"]},{"url":"https://bugzilla.suse.com/1221273","tags":["report"]},{"url":"https://bugzilla.suse.com/1221274","tags":["report"]},{"url":"https://bugzilla.suse.com/1221276","tags":["report"]},{"url":"https://bugzilla.suse.com/1221277","tags":["report"]},{"url":"https://bugzilla.suse.com/1221291","tags":["report"]},{"url":"https://bugzilla.suse.com/1221293","tags":["report"]},{"url":"https://bugzilla.suse.com/1221298","tags":["report"]},{"url":"https://bugzilla.suse.com/1221337","tags":["report"]},{"url":"https://bugzilla.suse.com/1221338","tags":["report"]},{"url":"https://bugzilla.suse.com/1221375","tags":["report"]},{"url":"https://bugzilla.suse.com/1221379","tags":["report"]},{"url":"https://bugzilla.suse.com/1221551","tags":["report"]},{"url":"https://bugzilla.suse.com/1221553","tags":["report"]},{"url":"https://bugzilla.suse.com/1221613","tags":["report"]},{"url":"https://bugzilla.suse.com/1221614","tags":["report"]},{"url":"https://bugzilla.suse.com/1221616","tags":["report"]},{"url":"https://bugzilla.suse.com/1221618","tags":["report"]},{"url":"https://bugzilla.suse.com/1221631","tags":["report"]},{"url":"https://bugzilla.suse.com/1221633","tags":["report"]},{"url":"https://bugzilla.suse.com/1221713","tags":["report"]},{"url":"https://bugzilla.suse.com/1221725","tags":["report"]},{"url":"https://bugzilla.suse.com/1221777","tags":["report"]},{"url":"https://bugzilla.suse.com/1221791","tags":["report"]},{"url":"https://bugzilla.suse.com/1221814","tags":["report"]},{"url":"https://bugzilla.suse.com/1221816","tags":["report"]},{"url":"https://bugzilla.suse.com/1221830","tags":["report"]},{"url":"https://bugzilla.suse.com/1221951","tags":["report"]},{"url":"https://bugzilla.suse.com/1222011","tags":["report"]},{"url":"https://bugzilla.suse.com/1222033","tags":["report"]},{"url":"https://bugzilla.suse.com/1222051","tags":["report"]},{"url":"https://bugzilla.suse.com/1222056","tags":["report"]},{"url":"https://bugzilla.suse.com/1222060","tags":["report"]},{"url":"https://bugzilla.suse.com/1222070","tags":["report"]},{"url":"https://bugzilla.suse.com/1222073","tags":["report"]},{"url":"https://bugzilla.suse.com/1222117","tags":["report"]},{"url":"https://bugzilla.suse.com/1222247","tags":["report"]},{"url":"https://bugzilla.suse.com/1222266","tags":["report"]},{"url":"https://bugzilla.suse.com/1222274","tags":["report"]},{"url":"https://bugzilla.suse.com/1222291","tags":["report"]},{"url":"https://bugzilla.suse.com/1222300","tags":["report"]},{"url":"https://bugzilla.suse.com/1222304","tags":["report"]},{"url":"https://bugzilla.suse.com/1222317","tags":["report"]},{"url":"https://bugzilla.suse.com/1222331","tags":["report"]},{"url":"https://bugzilla.suse.com/1222355","tags":["report"]},{"url":"https://bugzilla.suse.com/1222356","tags":["report"]},{"url":"https://bugzilla.suse.com/1222360","tags":["report"]},{"url":"https://bugzilla.suse.com/1222366","tags":["report"]},{"url":"https://bugzilla.suse.com/1222373","tags":["report"]},{"url":"https://bugzilla.suse.com/1222416","tags":["report"]},{"url":"https://bugzilla.suse.com/1222422","tags":["report"]},{"url":"https://bugzilla.suse.com/1222427","tags":["report"]},{"url":"https://bugzilla.suse.com/1222428","tags":["report"]},{"url":"https://bugzilla.suse.com/1222431","tags":["report"]},{"url":"https://bugzilla.suse.com/1222437","tags":["report"]},{"url":"https://bugzilla.suse.com/1222445","tags":["report"]},{"url":"https://bugzilla.suse.com/1222449","tags":["report"]},{"url":"https://bugzilla.suse.com/1222503","tags":["report"]},{"url":"https://bugzilla.suse.com/1222520","tags":["report"]},{"url":"https://bugzilla.suse.com/1222536","tags":["report"]},{"url":"https://bugzilla.suse.com/1222549","tags":["report"]},{"url":"https://bugzilla.suse.com/1222550","tags":["report"]},{"url":"https://bugzilla.suse.com/1222557","tags":["report"]},{"url":"https://bugzilla.suse.com/1222585","tags":["report"]},{"url":"https://bugzilla.suse.com/1222586","tags":["report"]},{"url":"https://bugzilla.suse.com/1222596","tags":["report"]},{"url":"https://bugzilla.suse.com/1222609","tags":["report"]},{"url":"https://bugzilla.suse.com/1222610","tags":["report"]},{"url":"https://bugzilla.suse.com/1222619","tags":["report"]},{"url":"https://bugzilla.suse.com/1222630","tags":["report"]},{"url":"https://bugzilla.suse.com/1222632","tags":["report"]},{"url":"https://bugzilla.suse.com/1222660","tags":["report"]},{"url":"https://bugzilla.suse.com/1222662","tags":["report"]},{"url":"https://bugzilla.suse.com/1222664","tags":["report"]},{"url":"https://bugzilla.suse.com/1222669","tags":["report"]},{"url":"https://bugzilla.suse.com/1222677","tags":["report"]},{"url":"https://bugzilla.suse.com/1222678","tags":["report"]},{"url":"https://bugzilla.suse.com/1222680","tags":["report"]},{"url":"https://bugzilla.suse.com/1222706","tags":["report"]},{"url":"https://bugzilla.suse.com/1222720","tags":["report"]},{"url":"https://bugzilla.suse.com/1222724","tags":["report"]},{"url":"https://bugzilla.suse.com/1222726","tags":["report"]},{"url":"https://bugzilla.suse.com/1222727","tags":["report"]},{"url":"https://bugzilla.suse.com/1222764","tags":["report"]},{"url":"https://bugzilla.suse.com/1222772","tags":["report"]},{"url":"https://bugzilla.suse.com/1222781","tags":["report"]},{"url":"https://bugzilla.suse.com/1222784","tags":["report"]},{"url":"https://bugzilla.suse.com/1222798","tags":["report"]},{"url":"https://bugzilla.suse.com/1222801","tags":["report"]},{"url":"https://bugzilla.suse.com/1222952","tags":["report"]},{"url":"https://bugzilla.suse.com/1223030","tags":["report"]},{"url":"https://bugzilla.suse.com/1223067","tags":["report"]},{"url":"https://bugzilla.suse.com/1223068","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-46925","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-46926","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-46927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-46929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-46930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-46931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-46933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-46936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47082","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47087","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47094","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47096","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-4744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48626","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-0160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-35827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-4881","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52453","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52486","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52488","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52504","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52519","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52520","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52532","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52561","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52575","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52576","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52582","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52587","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52591","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52599","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52608","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52612","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52627","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52628","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-7042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-7192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-0841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-2201","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-25739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-25742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26599","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26612","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26627","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26642","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26645","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26654","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26670","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26695","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26697","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26737","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26749","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26769","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26790","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26848","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241659-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1211592","tags":["report"]},{"url":"https://bugzilla.suse.com/1217408","tags":["report"]},{"url":"https://bugzilla.suse.com/1218562","tags":["report"]},{"url":"https://bugzilla.suse.com/1218917","tags":["report"]},{"url":"https://bugzilla.suse.com/1219104","tags":["report"]},{"url":"https://bugzilla.suse.com/1220342","tags":["report"]},{"url":"https://bugzilla.suse.com/1220569","tags":["report"]},{"url":"https://bugzilla.suse.com/1220761","tags":["report"]},{"url":"https://bugzilla.suse.com/1221042","tags":["report"]},{"url":"https://bugzilla.suse.com/1221080","tags":["report"]},{"url":"https://bugzilla.suse.com/1221084","tags":["report"]},{"url":"https://bugzilla.suse.com/1221088","tags":["report"]},{"url":"https://bugzilla.suse.com/1221299","tags":["report"]},{"url":"https://bugzilla.suse.com/1221612","tags":["report"]},{"url":"https://bugzilla.suse.com/1221617","tags":["report"]},{"url":"https://bugzilla.suse.com/1221645","tags":["report"]},{"url":"https://bugzilla.suse.com/1221825","tags":["report"]},{"url":"https://bugzilla.suse.com/1222294","tags":["report"]},{"url":"https://bugzilla.suse.com/1222307","tags":["report"]},{"url":"https://bugzilla.suse.com/1222357","tags":["report"]},{"url":"https://bugzilla.suse.com/1222368","tags":["report"]},{"url":"https://bugzilla.suse.com/1222379","tags":["report"]},{"url":"https://bugzilla.suse.com/1222424","tags":["report"]},{"url":"https://bugzilla.suse.com/1222430","tags":["report"]},{"url":"https://bugzilla.suse.com/1222435","tags":["report"]},{"url":"https://bugzilla.suse.com/1222482","tags":["report"]},{"url":"https://bugzilla.suse.com/1222559","tags":["report"]},{"url":"https://bugzilla.suse.com/1222613","tags":["report"]},{"url":"https://bugzilla.suse.com/1222615","tags":["report"]},{"url":"https://bugzilla.suse.com/1222618","tags":["report"]},{"url":"https://bugzilla.suse.com/1222624","tags":["report"]},{"url":"https://bugzilla.suse.com/1222666","tags":["report"]},{"url":"https://bugzilla.suse.com/1222671","tags":["report"]},{"url":"https://bugzilla.suse.com/1222703","tags":["report"]},{"url":"https://bugzilla.suse.com/1222704","tags":["report"]},{"url":"https://bugzilla.suse.com/1222709","tags":["report"]},{"url":"https://bugzilla.suse.com/1222710","tags":["report"]},{"url":"https://bugzilla.suse.com/1222721","tags":["report"]},{"url":"https://bugzilla.suse.com/1222773","tags":["report"]},{"url":"https://bugzilla.suse.com/1222776","tags":["report"]},{"url":"https://bugzilla.suse.com/1222785","tags":["report"]},{"url":"https://bugzilla.suse.com/1222787","tags":["report"]},{"url":"https://bugzilla.suse.com/1222790","tags":["report"]},{"url":"https://bugzilla.suse.com/1222791","tags":["report"]},{"url":"https://bugzilla.suse.com/1222792","tags":["report"]},{"url":"https://bugzilla.suse.com/1222796","tags":["report"]},{"url":"https://bugzilla.suse.com/1222812","tags":["report"]},{"url":"https://bugzilla.suse.com/1222824","tags":["report"]},{"url":"https://bugzilla.suse.com/1222829","tags":["report"]},{"url":"https://bugzilla.suse.com/1222832","tags":["report"]},{"url":"https://bugzilla.suse.com/1222836","tags":["report"]},{"url":"https://bugzilla.suse.com/1222838","tags":["report"]},{"url":"https://bugzilla.suse.com/1222866","tags":["report"]},{"url":"https://bugzilla.suse.com/1222867","tags":["report"]},{"url":"https://bugzilla.suse.com/1222869","tags":["report"]},{"url":"https://bugzilla.suse.com/1222876","tags":["report"]},{"url":"https://bugzilla.suse.com/1222878","tags":["report"]},{"url":"https://bugzilla.suse.com/1222879","tags":["report"]},{"url":"https://bugzilla.suse.com/1222881","tags":["report"]},{"url":"https://bugzilla.suse.com/1222883","tags":["report"]},{"url":"https://bugzilla.suse.com/1222888","tags":["report"]},{"url":"https://bugzilla.suse.com/1222894","tags":["report"]},{"url":"https://bugzilla.suse.com/1222901","tags":["report"]},{"url":"https://bugzilla.suse.com/1222968","tags":["report"]},{"url":"https://bugzilla.suse.com/1223012","tags":["report"]},{"url":"https://bugzilla.suse.com/1223014","tags":["report"]},{"url":"https://bugzilla.suse.com/1223016","tags":["report"]},{"url":"https://bugzilla.suse.com/1223024","tags":["report"]},{"url":"https://bugzilla.suse.com/1223033","tags":["report"]},{"url":"https://bugzilla.suse.com/1223034","tags":["report"]},{"url":"https://bugzilla.suse.com/1223035","tags":["report"]},{"url":"https://bugzilla.suse.com/1223036","tags":["report"]},{"url":"https://bugzilla.suse.com/1223037","tags":["report"]},{"url":"https://bugzilla.suse.com/1223041","tags":["report"]},{"url":"https://bugzilla.suse.com/1223042","tags":["report"]},{"url":"https://bugzilla.suse.com/1223051","tags":["report"]},{"url":"https://bugzilla.suse.com/1223052","tags":["report"]},{"url":"https://bugzilla.suse.com/1223056","tags":["report"]},{"url":"https://bugzilla.suse.com/1223057","tags":["report"]},{"url":"https://bugzilla.suse.com/1223058","tags":["report"]},{"url":"https://bugzilla.suse.com/1223060","tags":["report"]},{"url":"https://bugzilla.suse.com/1223061","tags":["report"]},{"url":"https://bugzilla.suse.com/1223065","tags":["report"]},{"url":"https://bugzilla.suse.com/1223066","tags":["report"]},{"url":"https://bugzilla.suse.com/1223076","tags":["report"]},{"url":"https://bugzilla.suse.com/1223078","tags":["report"]},{"url":"https://bugzilla.suse.com/1223111","tags":["report"]},{"url":"https://bugzilla.suse.com/1223115","tags":["report"]},{"url":"https://bugzilla.suse.com/1223118","tags":["report"]},{"url":"https://bugzilla.suse.com/1223187","tags":["report"]},{"url":"https://bugzilla.suse.com/1223189","tags":["report"]},{"url":"https://bugzilla.suse.com/1223190","tags":["report"]},{"url":"https://bugzilla.suse.com/1223191","tags":["report"]},{"url":"https://bugzilla.suse.com/1223196","tags":["report"]},{"url":"https://bugzilla.suse.com/1223197","tags":["report"]},{"url":"https://bugzilla.suse.com/1223198","tags":["report"]},{"url":"https://bugzilla.suse.com/1223275","tags":["report"]},{"url":"https://bugzilla.suse.com/1223323","tags":["report"]},{"url":"https://bugzilla.suse.com/1223369","tags":["report"]},{"url":"https://bugzilla.suse.com/1223380","tags":["report"]},{"url":"https://bugzilla.suse.com/1223473","tags":["report"]},{"url":"https://bugzilla.suse.com/1223474","tags":["report"]},{"url":"https://bugzilla.suse.com/1223475","tags":["report"]},{"url":"https://bugzilla.suse.com/1223477","tags":["report"]},{"url":"https://bugzilla.suse.com/1223478","tags":["report"]},{"url":"https://bugzilla.suse.com/1223479","tags":["report"]},{"url":"https://bugzilla.suse.com/1223481","tags":["report"]},{"url":"https://bugzilla.suse.com/1223482","tags":["report"]},{"url":"https://bugzilla.suse.com/1223484","tags":["report"]},{"url":"https://bugzilla.suse.com/1223487","tags":["report"]},{"url":"https://bugzilla.suse.com/1223490","tags":["report"]},{"url":"https://bugzilla.suse.com/1223496","tags":["report"]},{"url":"https://bugzilla.suse.com/1223498","tags":["report"]},{"url":"https://bugzilla.suse.com/1223499","tags":["report"]},{"url":"https://bugzilla.suse.com/1223501","tags":["report"]},{"url":"https://bugzilla.suse.com/1223502","tags":["report"]},{"url":"https://bugzilla.suse.com/1223503","tags":["report"]},{"url":"https://bugzilla.suse.com/1223505","tags":["report"]},{"url":"https://bugzilla.suse.com/1223509","tags":["report"]},{"url":"https://bugzilla.suse.com/1223511","tags":["report"]},{"url":"https://bugzilla.suse.com/1223512","tags":["report"]},{"url":"https://bugzilla.suse.com/1223513","tags":["report"]},{"url":"https://bugzilla.suse.com/1223516","tags":["report"]},{"url":"https://bugzilla.suse.com/1223517","tags":["report"]},{"url":"https://bugzilla.suse.com/1223518","tags":["report"]},{"url":"https://bugzilla.suse.com/1223519","tags":["report"]},{"url":"https://bugzilla.suse.com/1223520","tags":["report"]},{"url":"https://bugzilla.suse.com/1223522","tags":["report"]},{"url":"https://bugzilla.suse.com/1223523","tags":["report"]},{"url":"https://bugzilla.suse.com/1223525","tags":["report"]},{"url":"https://bugzilla.suse.com/1223539","tags":["report"]},{"url":"https://bugzilla.suse.com/1223574","tags":["report"]},{"url":"https://bugzilla.suse.com/1223595","tags":["report"]},{"url":"https://bugzilla.suse.com/1223598","tags":["report"]},{"url":"https://bugzilla.suse.com/1223634","tags":["report"]},{"url":"https://bugzilla.suse.com/1223643","tags":["report"]},{"url":"https://bugzilla.suse.com/1223644","tags":["report"]},{"url":"https://bugzilla.suse.com/1223645","tags":["report"]},{"url":"https://bugzilla.suse.com/1223646","tags":["report"]},{"url":"https://bugzilla.suse.com/1223648","tags":["report"]},{"url":"https://bugzilla.suse.com/1223655","tags":["report"]},{"url":"https://bugzilla.suse.com/1223657","tags":["report"]},{"url":"https://bugzilla.suse.com/1223660","tags":["report"]},{"url":"https://bugzilla.suse.com/1223661","tags":["report"]},{"url":"https://bugzilla.suse.com/1223663","tags":["report"]},{"url":"https://bugzilla.suse.com/1223664","tags":["report"]},{"url":"https://bugzilla.suse.com/1223668","tags":["report"]},{"url":"https://bugzilla.suse.com/1223686","tags":["report"]},{"url":"https://bugzilla.suse.com/1223693","tags":["report"]},{"url":"https://bugzilla.suse.com/1223705","tags":["report"]},{"url":"https://bugzilla.suse.com/1223714","tags":["report"]},{"url":"https://bugzilla.suse.com/1223735","tags":["report"]},{"url":"https://bugzilla.suse.com/1223745","tags":["report"]},{"url":"https://bugzilla.suse.com/1223784","tags":["report"]},{"url":"https://bugzilla.suse.com/1223785","tags":["report"]},{"url":"https://bugzilla.suse.com/1223790","tags":["report"]},{"url":"https://bugzilla.suse.com/1223816","tags":["report"]},{"url":"https://bugzilla.suse.com/1223821","tags":["report"]},{"url":"https://bugzilla.suse.com/1223822","tags":["report"]},{"url":"https://bugzilla.suse.com/1223824","tags":["report"]},{"url":"https://bugzilla.suse.com/1223827","tags":["report"]},{"url":"https://bugzilla.suse.com/1223834","tags":["report"]},{"url":"https://bugzilla.suse.com/1223875","tags":["report"]},{"url":"https://bugzilla.suse.com/1223876","tags":["report"]},{"url":"https://bugzilla.suse.com/1223877","tags":["report"]},{"url":"https://bugzilla.suse.com/1223878","tags":["report"]},{"url":"https://bugzilla.suse.com/1223879","tags":["report"]},{"url":"https://bugzilla.suse.com/1223894","tags":["report"]},{"url":"https://bugzilla.suse.com/1223921","tags":["report"]},{"url":"https://bugzilla.suse.com/1223922","tags":["report"]},{"url":"https://bugzilla.suse.com/1223923","tags":["report"]},{"url":"https://bugzilla.suse.com/1223924","tags":["report"]},{"url":"https://bugzilla.suse.com/1223929","tags":["report"]},{"url":"https://bugzilla.suse.com/1223931","tags":["report"]},{"url":"https://bugzilla.suse.com/1223932","tags":["report"]},{"url":"https://bugzilla.suse.com/1223934","tags":["report"]},{"url":"https://bugzilla.suse.com/1223941","tags":["report"]},{"url":"https://bugzilla.suse.com/1223948","tags":["report"]},{"url":"https://bugzilla.suse.com/1223949","tags":["report"]},{"url":"https://bugzilla.suse.com/1223950","tags":["report"]},{"url":"https://bugzilla.suse.com/1223951","tags":["report"]},{"url":"https://bugzilla.suse.com/1223952","tags":["report"]},{"url":"https://bugzilla.suse.com/1223953","tags":["report"]},{"url":"https://bugzilla.suse.com/1223956","tags":["report"]},{"url":"https://bugzilla.suse.com/1223957","tags":["report"]},{"url":"https://bugzilla.suse.com/1223960","tags":["report"]},{"url":"https://bugzilla.suse.com/1223962","tags":["report"]},{"url":"https://bugzilla.suse.com/1223963","tags":["report"]},{"url":"https://bugzilla.suse.com/1223964","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47198","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47200","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47201","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47202","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47211","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47212","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47215","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48638","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48642","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48644","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48647","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48648","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48653","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48654","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48655","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48675","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48690","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48692","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48695","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48697","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48700","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-2860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52585","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52589","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52590","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52593","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52635","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52645","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-0639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26610","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26675","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26772","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26773","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26881","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26966","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26993","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27389","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241663-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1141539","tags":["report"]},{"url":"https://bugzilla.suse.com/1190576","tags":["report"]},{"url":"https://bugzilla.suse.com/1192837","tags":["report"]},{"url":"https://bugzilla.suse.com/1193629","tags":["report"]},{"url":"https://bugzilla.suse.com/1196869","tags":["report"]},{"url":"https://bugzilla.suse.com/1200313","tags":["report"]},{"url":"https://bugzilla.suse.com/1201308","tags":["report"]},{"url":"https://bugzilla.suse.com/1201489","tags":["report"]},{"url":"https://bugzilla.suse.com/1203906","tags":["report"]},{"url":"https://bugzilla.suse.com/1203935","tags":["report"]},{"url":"https://bugzilla.suse.com/1204614","tags":["report"]},{"url":"https://bugzilla.suse.com/1207361","tags":["report"]},{"url":"https://bugzilla.suse.com/1213573","tags":["report"]},{"url":"https://bugzilla.suse.com/1219141","tags":["report"]},{"url":"https://bugzilla.suse.com/1223536","tags":["report"]},{"url":"https://bugzilla.suse.com/1223640","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-267600","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242135-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1012628","tags":["report"]},{"url":"https://bugzilla.suse.com/1065729","tags":["report"]},{"url":"https://bugzilla.suse.com/1181674","tags":["report"]},{"url":"https://bugzilla.suse.com/1187716","tags":["report"]},{"url":"https://bugzilla.suse.com/1193599","tags":["report"]},{"url":"https://bugzilla.suse.com/1208593","tags":["report"]},{"url":"https://bugzilla.suse.com/1215199","tags":["report"]},{"url":"https://bugzilla.suse.com/1216196","tags":["report"]},{"url":"https://bugzilla.suse.com/1216358","tags":["report"]},{"url":"https://bugzilla.suse.com/1216702","tags":["report"]},{"url":"https://bugzilla.suse.com/1217169","tags":["report"]},{"url":"https://bugzilla.suse.com/1217384","tags":["report"]},{"url":"https://bugzilla.suse.com/1217489","tags":["report"]},{"url":"https://bugzilla.suse.com/1217750","tags":["report"]},{"url":"https://bugzilla.suse.com/1218205","tags":["report"]},{"url":"https://bugzilla.suse.com/1218447","tags":["report"]},{"url":"https://bugzilla.suse.com/1218779","tags":["report"]},{"url":"https://bugzilla.suse.com/1219596","tags":["report"]},{"url":"https://bugzilla.suse.com/1219623","tags":["report"]},{"url":"https://bugzilla.suse.com/1220021","tags":["report"]},{"url":"https://bugzilla.suse.com/1220045","tags":["report"]},{"url":"https://bugzilla.suse.com/1220120","tags":["report"]},{"url":"https://bugzilla.suse.com/1220148","tags":["report"]},{"url":"https://bugzilla.suse.com/1220328","tags":["report"]},{"url":"https://bugzilla.suse.com/1220428","tags":["report"]},{"url":"https://bugzilla.suse.com/1220430","tags":["report"]},{"url":"https://bugzilla.suse.com/1220587","tags":["report"]},{"url":"https://bugzilla.suse.com/1220738","tags":["report"]},{"url":"https://bugzilla.suse.com/1220783","tags":["report"]},{"url":"https://bugzilla.suse.com/1221303","tags":["report"]},{"url":"https://bugzilla.suse.com/1221504","tags":["report"]},{"url":"https://bugzilla.suse.com/1221615","tags":["report"]},{"url":"https://bugzilla.suse.com/1221635","tags":["report"]},{"url":"https://bugzilla.suse.com/1221649","tags":["report"]},{"url":"https://bugzilla.suse.com/1221765","tags":["report"]},{"url":"https://bugzilla.suse.com/1221783","tags":["report"]},{"url":"https://bugzilla.suse.com/1221829","tags":["report"]},{"url":"https://bugzilla.suse.com/1221858","tags":["report"]},{"url":"https://bugzilla.suse.com/1222115","tags":["report"]},{"url":"https://bugzilla.suse.com/1222173","tags":["report"]},{"url":"https://bugzilla.suse.com/1222264","tags":["report"]},{"url":"https://bugzilla.suse.com/1222273","tags":["report"]},{"url":"https://bugzilla.suse.com/1222301","tags":["report"]},{"url":"https://bugzilla.suse.com/1222303","tags":["report"]},{"url":"https://bugzilla.suse.com/1222371","tags":["report"]},{"url":"https://bugzilla.suse.com/1222378","tags":["report"]},{"url":"https://bugzilla.suse.com/1222385","tags":["report"]},{"url":"https://bugzilla.suse.com/1222426","tags":["report"]},{"url":"https://bugzilla.suse.com/1222459","tags":["report"]},{"url":"https://bugzilla.suse.com/1222464","tags":["report"]},{"url":"https://bugzilla.suse.com/1222489","tags":["report"]},{"url":"https://bugzilla.suse.com/1222522","tags":["report"]},{"url":"https://bugzilla.suse.com/1222525","tags":["report"]},{"url":"https://bugzilla.suse.com/1222527","tags":["report"]},{"url":"https://bugzilla.suse.com/1222531","tags":["report"]},{"url":"https://bugzilla.suse.com/1222532","tags":["report"]},{"url":"https://bugzilla.suse.com/1222563","tags":["report"]},{"url":"https://bugzilla.suse.com/1222606","tags":["report"]},{"url":"https://bugzilla.suse.com/1222608","tags":["report"]},{"url":"https://bugzilla.suse.com/1222622","tags":["report"]},{"url":"https://bugzilla.suse.com/1222627","tags":["report"]},{"url":"https://bugzilla.suse.com/1222635","tags":["report"]},{"url":"https://bugzilla.suse.com/1222769","tags":["report"]},{"url":"https://bugzilla.suse.com/1222771","tags":["report"]},{"url":"https://bugzilla.suse.com/1222775","tags":["report"]},{"url":"https://bugzilla.suse.com/1222777","tags":["report"]},{"url":"https://bugzilla.suse.com/1222780","tags":["report"]},{"url":"https://bugzilla.suse.com/1222782","tags":["report"]},{"url":"https://bugzilla.suse.com/1222793","tags":["report"]},{"url":"https://bugzilla.suse.com/1222799","tags":["report"]},{"url":"https://bugzilla.suse.com/1223007","tags":["report"]},{"url":"https://bugzilla.suse.com/1223011","tags":["report"]},{"url":"https://bugzilla.suse.com/1223015","tags":["report"]},{"url":"https://bugzilla.suse.com/1223020","tags":["report"]},{"url":"https://bugzilla.suse.com/1223023","tags":["report"]},{"url":"https://bugzilla.suse.com/1223038","tags":["report"]},{"url":"https://bugzilla.suse.com/1223039","tags":["report"]},{"url":"https://bugzilla.suse.com/1223045","tags":["report"]},{"url":"https://bugzilla.suse.com/1223046","tags":["report"]},{"url":"https://bugzilla.suse.com/1223077","tags":["report"]},{"url":"https://bugzilla.suse.com/1223084","tags":["report"]},{"url":"https://bugzilla.suse.com/1223113","tags":["report"]},{"url":"https://bugzilla.suse.com/1223138","tags":["report"]},{"url":"https://bugzilla.suse.com/1223143","tags":["report"]},{"url":"https://bugzilla.suse.com/1223202","tags":["report"]},{"url":"https://bugzilla.suse.com/1223285","tags":["report"]},{"url":"https://bugzilla.suse.com/1223315","tags":["report"]},{"url":"https://bugzilla.suse.com/1223338","tags":["report"]},{"url":"https://bugzilla.suse.com/1223384","tags":["report"]},{"url":"https://bugzilla.suse.com/1223390","tags":["report"]},{"url":"https://bugzilla.suse.com/1223439","tags":["report"]},{"url":"https://bugzilla.suse.com/1223462","tags":["report"]},{"url":"https://bugzilla.suse.com/1223532","tags":["report"]},{"url":"https://bugzilla.suse.com/1223575","tags":["report"]},{"url":"https://bugzilla.suse.com/1223590","tags":["report"]},{"url":"https://bugzilla.suse.com/1223591","tags":["report"]},{"url":"https://bugzilla.suse.com/1223592","tags":["report"]},{"url":"https://bugzilla.suse.com/1223593","tags":["report"]},{"url":"https://bugzilla.suse.com/1223625","tags":["report"]},{"url":"https://bugzilla.suse.com/1223628","tags":["report"]},{"url":"https://bugzilla.suse.com/1223629","tags":["report"]},{"url":"https://bugzilla.suse.com/1223633","tags":["report"]},{"url":"https://bugzilla.suse.com/1223637","tags":["report"]},{"url":"https://bugzilla.suse.com/1223641","tags":["report"]},{"url":"https://bugzilla.suse.com/1223649","tags":["report"]},{"url":"https://bugzilla.suse.com/1223650","tags":["report"]},{"url":"https://bugzilla.suse.com/1223651","tags":["report"]},{"url":"https://bugzilla.suse.com/1223652","tags":["report"]},{"url":"https://bugzilla.suse.com/1223653","tags":["report"]},{"url":"https://bugzilla.suse.com/1223654","tags":["report"]},{"url":"https://bugzilla.suse.com/1223665","tags":["report"]},{"url":"https://bugzilla.suse.com/1223666","tags":["report"]},{"url":"https://bugzilla.suse.com/1223669","tags":["report"]},{"url":"https://bugzilla.suse.com/1223670","tags":["report"]},{"url":"https://bugzilla.suse.com/1223671","tags":["report"]},{"url":"https://bugzilla.suse.com/1223675","tags":["report"]},{"url":"https://bugzilla.suse.com/1223677","tags":["report"]},{"url":"https://bugzilla.suse.com/1223678","tags":["report"]},{"url":"https://bugzilla.suse.com/1223692","tags":["report"]},{"url":"https://bugzilla.suse.com/1223695","tags":["report"]},{"url":"https://bugzilla.suse.com/1223696","tags":["report"]},{"url":"https://bugzilla.suse.com/1223698","tags":["report"]},{"url":"https://bugzilla.suse.com/1223712","tags":["report"]},{"url":"https://bugzilla.suse.com/1223718","tags":["report"]},{"url":"https://bugzilla.suse.com/1223728","tags":["report"]},{"url":"https://bugzilla.suse.com/1223732","tags":["report"]},{"url":"https://bugzilla.suse.com/1223739","tags":["report"]},{"url":"https://bugzilla.suse.com/1223741","tags":["report"]},{"url":"https://bugzilla.suse.com/1223744","tags":["report"]},{"url":"https://bugzilla.suse.com/1223747","tags":["report"]},{"url":"https://bugzilla.suse.com/1223748","tags":["report"]},{"url":"https://bugzilla.suse.com/1223749","tags":["report"]},{"url":"https://bugzilla.suse.com/1223750","tags":["report"]},{"url":"https://bugzilla.suse.com/1223752","tags":["report"]},{"url":"https://bugzilla.suse.com/1223754","tags":["report"]},{"url":"https://bugzilla.suse.com/1223757","tags":["report"]},{"url":"https://bugzilla.suse.com/1223759","tags":["report"]},{"url":"https://bugzilla.suse.com/1223761","tags":["report"]},{"url":"https://bugzilla.suse.com/1223762","tags":["report"]},{"url":"https://bugzilla.suse.com/1223774","tags":["report"]},{"url":"https://bugzilla.suse.com/1223782","tags":["report"]},{"url":"https://bugzilla.suse.com/1223787","tags":["report"]},{"url":"https://bugzilla.suse.com/1223788","tags":["report"]},{"url":"https://bugzilla.suse.com/1223789","tags":["report"]},{"url":"https://bugzilla.suse.com/1223802","tags":["report"]},{"url":"https://bugzilla.suse.com/1223805","tags":["report"]},{"url":"https://bugzilla.suse.com/1223810","tags":["report"]},{"url":"https://bugzilla.suse.com/1223831","tags":["report"]},{"url":"https://bugzilla.suse.com/1223838","tags":["report"]},{"url":"https://bugzilla.suse.com/1223869","tags":["report"]},{"url":"https://bugzilla.suse.com/1223870","tags":["report"]},{"url":"https://bugzilla.suse.com/1223871","tags":["report"]},{"url":"https://bugzilla.suse.com/1223872","tags":["report"]},{"url":"https://bugzilla.suse.com/1223874","tags":["report"]},{"url":"https://bugzilla.suse.com/1223944","tags":["report"]},{"url":"https://bugzilla.suse.com/1223945","tags":["report"]},{"url":"https://bugzilla.suse.com/1223946","tags":["report"]},{"url":"https://bugzilla.suse.com/1223991","tags":["report"]},{"url":"https://bugzilla.suse.com/1224076","tags":["report"]},{"url":"https://bugzilla.suse.com/1224096","tags":["report"]},{"url":"https://bugzilla.suse.com/1224098","tags":["report"]},{"url":"https://bugzilla.suse.com/1224099","tags":["report"]},{"url":"https://bugzilla.suse.com/1224137","tags":["report"]},{"url":"https://bugzilla.suse.com/1224166","tags":["report"]},{"url":"https://bugzilla.suse.com/1224174","tags":["report"]},{"url":"https://bugzilla.suse.com/1224177","tags":["report"]},{"url":"https://bugzilla.suse.com/1224180","tags":["report"]},{"url":"https://bugzilla.suse.com/1224181","tags":["report"]},{"url":"https://bugzilla.suse.com/1224331","tags":["report"]},{"url":"https://bugzilla.suse.com/1224348","tags":["report"]},{"url":"https://bugzilla.suse.com/1224423","tags":["report"]},{"url":"https://bugzilla.suse.com/1224429","tags":["report"]},{"url":"https://bugzilla.suse.com/1224430","tags":["report"]},{"url":"https://bugzilla.suse.com/1224432","tags":["report"]},{"url":"https://bugzilla.suse.com/1224433","tags":["report"]},{"url":"https://bugzilla.suse.com/1224437","tags":["report"]},{"url":"https://bugzilla.suse.com/1224438","tags":["report"]},{"url":"https://bugzilla.suse.com/1224442","tags":["report"]},{"url":"https://bugzilla.suse.com/1224443","tags":["report"]},{"url":"https://bugzilla.suse.com/1224445","tags":["report"]},{"url":"https://bugzilla.suse.com/1224449","tags":["report"]},{"url":"https://bugzilla.suse.com/1224477","tags":["report"]},{"url":"https://bugzilla.suse.com/1224479","tags":["report"]},{"url":"https://bugzilla.suse.com/1224480","tags":["report"]},{"url":"https://bugzilla.suse.com/1224481","tags":["report"]},{"url":"https://bugzilla.suse.com/1224482","tags":["report"]},{"url":"https://bugzilla.suse.com/1224486","tags":["report"]},{"url":"https://bugzilla.suse.com/1224487","tags":["report"]},{"url":"https://bugzilla.suse.com/1224488","tags":["report"]},{"url":"https://bugzilla.suse.com/1224491","tags":["report"]},{"url":"https://bugzilla.suse.com/1224492","tags":["report"]},{"url":"https://bugzilla.suse.com/1224493","tags":["report"]},{"url":"https://bugzilla.suse.com/1224494","tags":["report"]},{"url":"https://bugzilla.suse.com/1224495","tags":["report"]},{"url":"https://bugzilla.suse.com/1224500","tags":["report"]},{"url":"https://bugzilla.suse.com/1224501","tags":["report"]},{"url":"https://bugzilla.suse.com/1224502","tags":["report"]},{"url":"https://bugzilla.suse.com/1224504","tags":["report"]},{"url":"https://bugzilla.suse.com/1224505","tags":["report"]},{"url":"https://bugzilla.suse.com/1224506","tags":["report"]},{"url":"https://bugzilla.suse.com/1224507","tags":["report"]},{"url":"https://bugzilla.suse.com/1224508","tags":["report"]},{"url":"https://bugzilla.suse.com/1224509","tags":["report"]},{"url":"https://bugzilla.suse.com/1224511","tags":["report"]},{"url":"https://bugzilla.suse.com/1224513","tags":["report"]},{"url":"https://bugzilla.suse.com/1224517","tags":["report"]},{"url":"https://bugzilla.suse.com/1224519","tags":["report"]},{"url":"https://bugzilla.suse.com/1224521","tags":["report"]},{"url":"https://bugzilla.suse.com/1224524","tags":["report"]},{"url":"https://bugzilla.suse.com/1224525","tags":["report"]},{"url":"https://bugzilla.suse.com/1224526","tags":["report"]},{"url":"https://bugzilla.suse.com/1224530","tags":["report"]},{"url":"https://bugzilla.suse.com/1224531","tags":["report"]},{"url":"https://bugzilla.suse.com/1224534","tags":["report"]},{"url":"https://bugzilla.suse.com/1224537","tags":["report"]},{"url":"https://bugzilla.suse.com/1224541","tags":["report"]},{"url":"https://bugzilla.suse.com/1224542","tags":["report"]},{"url":"https://bugzilla.suse.com/1224543","tags":["report"]},{"url":"https://bugzilla.suse.com/1224546","tags":["report"]},{"url":"https://bugzilla.suse.com/1224550","tags":["report"]},{"url":"https://bugzilla.suse.com/1224552","tags":["report"]},{"url":"https://bugzilla.suse.com/1224553","tags":["report"]},{"url":"https://bugzilla.suse.com/1224555","tags":["report"]},{"url":"https://bugzilla.suse.com/1224557","tags":["report"]},{"url":"https://bugzilla.suse.com/1224558","tags":["report"]},{"url":"https://bugzilla.suse.com/1224559","tags":["report"]},{"url":"https://bugzilla.suse.com/1224562","tags":["report"]},{"url":"https://bugzilla.suse.com/1224565","tags":["report"]},{"url":"https://bugzilla.suse.com/1224566","tags":["report"]},{"url":"https://bugzilla.suse.com/1224567","tags":["report"]},{"url":"https://bugzilla.suse.com/1224568","tags":["report"]},{"url":"https://bugzilla.suse.com/1224569","tags":["report"]},{"url":"https://bugzilla.suse.com/1224571","tags":["report"]},{"url":"https://bugzilla.suse.com/1224573","tags":["report"]},{"url":"https://bugzilla.suse.com/1224576","tags":["report"]},{"url":"https://bugzilla.suse.com/1224577","tags":["report"]},{"url":"https://bugzilla.suse.com/1224578","tags":["report"]},{"url":"https://bugzilla.suse.com/1224579","tags":["report"]},{"url":"https://bugzilla.suse.com/1224580","tags":["report"]},{"url":"https://bugzilla.suse.com/1224581","tags":["report"]},{"url":"https://bugzilla.suse.com/1224582","tags":["report"]},{"url":"https://bugzilla.suse.com/1224585","tags":["report"]},{"url":"https://bugzilla.suse.com/1224586","tags":["report"]},{"url":"https://bugzilla.suse.com/1224587","tags":["report"]},{"url":"https://bugzilla.suse.com/1224588","tags":["report"]},{"url":"https://bugzilla.suse.com/1224592","tags":["report"]},{"url":"https://bugzilla.suse.com/1224596","tags":["report"]},{"url":"https://bugzilla.suse.com/1224598","tags":["report"]},{"url":"https://bugzilla.suse.com/1224600","tags":["report"]},{"url":"https://bugzilla.suse.com/1224601","tags":["report"]},{"url":"https://bugzilla.suse.com/1224602","tags":["report"]},{"url":"https://bugzilla.suse.com/1224603","tags":["report"]},{"url":"https://bugzilla.suse.com/1224605","tags":["report"]},{"url":"https://bugzilla.suse.com/1224607","tags":["report"]},{"url":"https://bugzilla.suse.com/1224608","tags":["report"]},{"url":"https://bugzilla.suse.com/1224609","tags":["report"]},{"url":"https://bugzilla.suse.com/1224611","tags":["report"]},{"url":"https://bugzilla.suse.com/1224613","tags":["report"]},{"url":"https://bugzilla.suse.com/1224615","tags":["report"]},{"url":"https://bugzilla.suse.com/1224617","tags":["report"]},{"url":"https://bugzilla.suse.com/1224618","tags":["report"]},{"url":"https://bugzilla.suse.com/1224620","tags":["report"]},{"url":"https://bugzilla.suse.com/1224621","tags":["report"]},{"url":"https://bugzilla.suse.com/1224622","tags":["report"]},{"url":"https://bugzilla.suse.com/1224623","tags":["report"]},{"url":"https://bugzilla.suse.com/1224624","tags":["report"]},{"url":"https://bugzilla.suse.com/1224626","tags":["report"]},{"url":"https://bugzilla.suse.com/1224627","tags":["report"]},{"url":"https://bugzilla.suse.com/1224628","tags":["report"]},{"url":"https://bugzilla.suse.com/1224629","tags":["report"]},{"url":"https://bugzilla.suse.com/1224630","tags":["report"]},{"url":"https://bugzilla.suse.com/1224632","tags":["report"]},{"url":"https://bugzilla.suse.com/1224633","tags":["report"]},{"url":"https://bugzilla.suse.com/1224634","tags":["report"]},{"url":"https://bugzilla.suse.com/1224636","tags":["report"]},{"url":"https://bugzilla.suse.com/1224637","tags":["report"]},{"url":"https://bugzilla.suse.com/1224638","tags":["report"]},{"url":"https://bugzilla.suse.com/1224639","tags":["report"]},{"url":"https://bugzilla.suse.com/1224640","tags":["report"]},{"url":"https://bugzilla.suse.com/1224643","tags":["report"]},{"url":"https://bugzilla.suse.com/1224644","tags":["report"]},{"url":"https://bugzilla.suse.com/1224645","tags":["report"]},{"url":"https://bugzilla.suse.com/1224646","tags":["report"]},{"url":"https://bugzilla.suse.com/1224647","tags":["report"]},{"url":"https://bugzilla.suse.com/1224648","tags":["report"]},{"url":"https://bugzilla.suse.com/1224649","tags":["report"]},{"url":"https://bugzilla.suse.com/1224650","tags":["report"]},{"url":"https://bugzilla.suse.com/1224651","tags":["report"]},{"url":"https://bugzilla.suse.com/1224652","tags":["report"]},{"url":"https://bugzilla.suse.com/1224653","tags":["report"]},{"url":"https://bugzilla.suse.com/1224654","tags":["report"]},{"url":"https://bugzilla.suse.com/1224657","tags":["report"]},{"url":"https://bugzilla.suse.com/1224660","tags":["report"]},{"url":"https://bugzilla.suse.com/1224663","tags":["report"]},{"url":"https://bugzilla.suse.com/1224664","tags":["report"]},{"url":"https://bugzilla.suse.com/1224665","tags":["report"]},{"url":"https://bugzilla.suse.com/1224666","tags":["report"]},{"url":"https://bugzilla.suse.com/1224667","tags":["report"]},{"url":"https://bugzilla.suse.com/1224668","tags":["report"]},{"url":"https://bugzilla.suse.com/1224671","tags":["report"]},{"url":"https://bugzilla.suse.com/1224672","tags":["report"]},{"url":"https://bugzilla.suse.com/1224674","tags":["report"]},{"url":"https://bugzilla.suse.com/1224675","tags":["report"]},{"url":"https://bugzilla.suse.com/1224676","tags":["report"]},{"url":"https://bugzilla.suse.com/1224677","tags":["report"]},{"url":"https://bugzilla.suse.com/1224678","tags":["report"]},{"url":"https://bugzilla.suse.com/1224679","tags":["report"]},{"url":"https://bugzilla.suse.com/1224680","tags":["report"]},{"url":"https://bugzilla.suse.com/1224681","tags":["report"]},{"url":"https://bugzilla.suse.com/1224682","tags":["report"]},{"url":"https://bugzilla.suse.com/1224683","tags":["report"]},{"url":"https://bugzilla.suse.com/1224685","tags":["report"]},{"url":"https://bugzilla.suse.com/1224686","tags":["report"]},{"url":"https://bugzilla.suse.com/1224687","tags":["report"]},{"url":"https://bugzilla.suse.com/1224688","tags":["report"]},{"url":"https://bugzilla.suse.com/1224692","tags":["report"]},{"url":"https://bugzilla.suse.com/1224696","tags":["report"]},{"url":"https://bugzilla.suse.com/1224697","tags":["report"]},{"url":"https://bugzilla.suse.com/1224699","tags":["report"]},{"url":"https://bugzilla.suse.com/1224701","tags":["report"]},{"url":"https://bugzilla.suse.com/1224703","tags":["report"]},{"url":"https://bugzilla.suse.com/1224704","tags":["report"]},{"url":"https://bugzilla.suse.com/1224705","tags":["report"]},{"url":"https://bugzilla.suse.com/1224706","tags":["report"]},{"url":"https://bugzilla.suse.com/1224707","tags":["report"]},{"url":"https://bugzilla.suse.com/1224709","tags":["report"]},{"url":"https://bugzilla.suse.com/1224710","tags":["report"]},{"url":"https://bugzilla.suse.com/1224712","tags":["report"]},{"url":"https://bugzilla.suse.com/1224714","tags":["report"]},{"url":"https://bugzilla.suse.com/1224716","tags":["report"]},{"url":"https://bugzilla.suse.com/1224717","tags":["report"]},{"url":"https://bugzilla.suse.com/1224718","tags":["report"]},{"url":"https://bugzilla.suse.com/1224719","tags":["report"]},{"url":"https://bugzilla.suse.com/1224720","tags":["report"]},{"url":"https://bugzilla.suse.com/1224721","tags":["report"]},{"url":"https://bugzilla.suse.com/1224722","tags":["report"]},{"url":"https://bugzilla.suse.com/1224723","tags":["report"]},{"url":"https://bugzilla.suse.com/1224725","tags":["report"]},{"url":"https://bugzilla.suse.com/1224727","tags":["report"]},{"url":"https://bugzilla.suse.com/1224728","tags":["report"]},{"url":"https://bugzilla.suse.com/1224729","tags":["report"]},{"url":"https://bugzilla.suse.com/1224730","tags":["report"]},{"url":"https://bugzilla.suse.com/1224731","tags":["report"]},{"url":"https://bugzilla.suse.com/1224732","tags":["report"]},{"url":"https://bugzilla.suse.com/1224733","tags":["report"]},{"url":"https://bugzilla.suse.com/1224736","tags":["report"]},{"url":"https://bugzilla.suse.com/1224738","tags":["report"]},{"url":"https://bugzilla.suse.com/1224739","tags":["report"]},{"url":"https://bugzilla.suse.com/1224740","tags":["report"]},{"url":"https://bugzilla.suse.com/1224741","tags":["report"]},{"url":"https://bugzilla.suse.com/1224742","tags":["report"]},{"url":"https://bugzilla.suse.com/1224747","tags":["report"]},{"url":"https://bugzilla.suse.com/1224749","tags":["report"]},{"url":"https://bugzilla.suse.com/1224763","tags":["report"]},{"url":"https://bugzilla.suse.com/1224764","tags":["report"]},{"url":"https://bugzilla.suse.com/1224765","tags":["report"]},{"url":"https://bugzilla.suse.com/1224766","tags":["report"]},{"url":"https://bugzilla.suse.com/1224790","tags":["report"]},{"url":"https://bugzilla.suse.com/1224792","tags":["report"]},{"url":"https://bugzilla.suse.com/1224793","tags":["report"]},{"url":"https://bugzilla.suse.com/1224803","tags":["report"]},{"url":"https://bugzilla.suse.com/1224804","tags":["report"]},{"url":"https://bugzilla.suse.com/1224866","tags":["report"]},{"url":"https://bugzilla.suse.com/1224936","tags":["report"]},{"url":"https://bugzilla.suse.com/1224989","tags":["report"]},{"url":"https://bugzilla.suse.com/1225007","tags":["report"]},{"url":"https://bugzilla.suse.com/1225053","tags":["report"]},{"url":"https://bugzilla.suse.com/1225133","tags":["report"]},{"url":"https://bugzilla.suse.com/1225134","tags":["report"]},{"url":"https://bugzilla.suse.com/1225136","tags":["report"]},{"url":"https://bugzilla.suse.com/1225172","tags":["report"]},{"url":"https://bugzilla.suse.com/1225502","tags":["report"]},{"url":"https://bugzilla.suse.com/1225578","tags":["report"]},{"url":"https://bugzilla.suse.com/1225579","tags":["report"]},{"url":"https://bugzilla.suse.com/1225580","tags":["report"]},{"url":"https://bugzilla.suse.com/1225593","tags":["report"]},{"url":"https://bugzilla.suse.com/1225605","tags":["report"]},{"url":"https://bugzilla.suse.com/1225607","tags":["report"]},{"url":"https://bugzilla.suse.com/1225610","tags":["report"]},{"url":"https://bugzilla.suse.com/1225616","tags":["report"]},{"url":"https://bugzilla.suse.com/1225618","tags":["report"]},{"url":"https://bugzilla.suse.com/1225640","tags":["report"]},{"url":"https://bugzilla.suse.com/1225642","tags":["report"]},{"url":"https://bugzilla.suse.com/1225692","tags":["report"]},{"url":"https://bugzilla.suse.com/1225694","tags":["report"]},{"url":"https://bugzilla.suse.com/1225695","tags":["report"]},{"url":"https://bugzilla.suse.com/1225696","tags":["report"]},{"url":"https://bugzilla.suse.com/1225698","tags":["report"]},{"url":"https://bugzilla.suse.com/1225699","tags":["report"]},{"url":"https://bugzilla.suse.com/1225704","tags":["report"]},{"url":"https://bugzilla.suse.com/1225705","tags":["report"]},{"url":"https://bugzilla.suse.com/1225708","tags":["report"]},{"url":"https://bugzilla.suse.com/1225710","tags":["report"]},{"url":"https://bugzilla.suse.com/1225712","tags":["report"]},{"url":"https://bugzilla.suse.com/1225714","tags":["report"]},{"url":"https://bugzilla.suse.com/1225715","tags":["report"]},{"url":"https://bugzilla.suse.com/1225720","tags":["report"]},{"url":"https://bugzilla.suse.com/1225722","tags":["report"]},{"url":"https://bugzilla.suse.com/1225728","tags":["report"]},{"url":"https://bugzilla.suse.com/1225734","tags":["report"]},{"url":"https://bugzilla.suse.com/1225735","tags":["report"]},{"url":"https://bugzilla.suse.com/1225736","tags":["report"]},{"url":"https://bugzilla.suse.com/1225747","tags":["report"]},{"url":"https://bugzilla.suse.com/1225748","tags":["report"]},{"url":"https://bugzilla.suse.com/1225749","tags":["report"]},{"url":"https://bugzilla.suse.com/1225750","tags":["report"]},{"url":"https://bugzilla.suse.com/1225756","tags":["report"]},{"url":"https://bugzilla.suse.com/1225765","tags":["report"]},{"url":"https://bugzilla.suse.com/1225766","tags":["report"]},{"url":"https://bugzilla.suse.com/1225769","tags":["report"]},{"url":"https://bugzilla.suse.com/1225773","tags":["report"]},{"url":"https://bugzilla.suse.com/1225775","tags":["report"]},{"url":"https://bugzilla.suse.com/1225842","tags":["report"]},{"url":"https://bugzilla.suse.com/1225945","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52463","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52641","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52653","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52654","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52655","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52661","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52670","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52675","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52690","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52692","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52695","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52697","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52772","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6531","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26611","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26638","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26643","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26692","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26726","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26731","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26925","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26992","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26994","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27027","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27057","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27067","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27396","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27400","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27413","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35790","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35796","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35808","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35837","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35838","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35887","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35915","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35916","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35953","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35966","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35977","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35992","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36007","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36026","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36959","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-26697","tags":["report"]},{"url":"https://git.kernel.org/linus/67b8bcbaed4777871bb0dcc888fb02a614a98ab1","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-26697","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6766-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6767-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6767-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6766-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6766-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6795-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6828-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6895-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6895-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6900-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6895-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6895-4","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-52435","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52486","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52489","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52491","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52492","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52493","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52494","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52498","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52583","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52587","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52588","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52594","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52595","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52597","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52598","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52599","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52601","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52602","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52604","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52606","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52607","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52608","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52614","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52615","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52616","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52617","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52618","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52619","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52622","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52623","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52627","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52631","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52633","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52635","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52637","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52638","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52642","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52643","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-1151","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-2201","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-23849","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26592","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26593","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26594","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26600","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26602","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26606","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26608","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26610","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26614","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26615","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26625","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26627","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26635","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26636","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26640","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26641","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26644","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26645","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26660","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26663","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26664","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26665","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26668","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26671","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26673","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26675","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26676","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26679","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26684","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26685","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26689","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26695","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26696","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26698","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26702","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26704","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26707","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26712","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26715","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26717","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26720","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26722","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26808","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26825","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26826","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26829","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26910","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26916","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26920","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26598","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-47233","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52530","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26622","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-6270","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-7042","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52434","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52447","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52497","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52620","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52640","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52641","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52644","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52645","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52650","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52652","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52656","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52662","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-0841","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-22099","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26583","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26584","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26585","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26601","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26603","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26651","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26659","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26688","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26733","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26735","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26736","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26737","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26743","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26744","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26747","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26748","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26749","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26750","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26751","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26752","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26754","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26763","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26764","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26766","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26769","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26771","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26772","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26773","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26774","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26776","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26777","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26778","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26779","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26782","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26787","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26788","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26790","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26791","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26792","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26793","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26795","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26798","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26801","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26802","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26803","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26804","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26805","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26809","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26816","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26820","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26833","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26835","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26838","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26839","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26840","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26843","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26845","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26846","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26851","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26852","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26855","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26856","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26857","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26859","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26861","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26862","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26863","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26870","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26872","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26874","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26875","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26877","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26878","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26879","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26880","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26881","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26882","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26883","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26884","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26885","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26889","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26891","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26894","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26895","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26897","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26898","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26901","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26903","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26906","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26907","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26915","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27024","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27028","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27030","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27034","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27037","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27038","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27039","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27043","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27044","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27045","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27046","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27047","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27051","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27052","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27053","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27054","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27065","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27073","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27074","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27075","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27076","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27077","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27078","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27388","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27390","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27403","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27405","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27410","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27412","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27413","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27414","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27415","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27416","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27417","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27419","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27431","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27432","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27436","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-35811","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-35828","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-35829","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-35830","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-35844","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-35845","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52880","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-23307","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-24861","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26642","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26661","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26662","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26666","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26667","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26674","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26677","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26680","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26681","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26691","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26693","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26694","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26700","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26703","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26708","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26710","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26711","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26714","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26716","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26718","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26719","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26723","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26726","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26734","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26789","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26818","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26822","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26824","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26828","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26830","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26831","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26890","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26917","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26919","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26922","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26923","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26926","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-35833","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26643","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26924","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26925","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-26697","title":"nilfs2: fix data corruption in dsync block recovery for small block sizes","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix data corruption in dsync block recovery for small block sizes\n\nThe helper function nilfs_recovery_copy_block() of\nnilfs_recovery_dsync_blocks(), which recovers data from logs created by\ndata sync writes during a mount after an unclean shutdown, incorrectly\ncalculates the on-page offset when copying repair data to the file's page\ncache.  In environments where the block size is smaller than the page\nsize, this flaw can cause data corruption and leak uninitialized memory\nbytes during the recovery process.\n\nFix these issues by correcting this byte offset calculation on the page.","status":"published","published":"2024-04-03T14:54:57.848Z","modified":"2026-08-05T11:26:45.33Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:33:59.884489Z"}],"euvd":[{"id":"EUVD-2024-23959","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix data corruption in dsync block recovery for small block sizes\n\nThe helper function nilfs_recovery_copy_block() of\nnilfs_recovery_dsync_blocks(), which recovers data from logs created by\ndata sync writes during a mount after an unclean shutdown, incorrectly\ncalculates the on-page offset when copying repair data to the file's page\ncache.  In environments where the block size is smaller than the page\nsize, this flaw can cause data corruption and leak uninitialized memory\nbytes during the recovery process.\n\nFix these issues by correcting this byte offset calculation on the page.","status":"published","published":"2024-04-03T14:54:57Z","modified":"2026-08-05T11:26:45Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:02:18.377151Z"}],"ghsa":[{"id":"GHSA-xg7r-7865-v6c7","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix data corruption...","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix data corruption in dsync block recovery for small block sizes\n\nThe helper function nilfs_recovery_copy_block() of\nnilfs_recovery_dsync_blocks(), which recovers data from logs created by\ndata sync writes during a mount after an unclean shutdown, incorrectly\ncalculates the on-page offset when copying repair data to the file's page\ncache.  In environments where the block size is smaller than the page\nsize, this flaw can cause data corruption and leak uninitialized memory\nbytes during the recovery process.\n\nFix these issues by correcting this byte offset calculation on the page.","status":"published","published":"2024-04-03T15:30:42Z","modified":"2025-03-17T18:32:45Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:00:19.533375Z"}],"nvd":[{"id":"CVE-2024-26697","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix data corruption in dsync block recovery for small block sizes\n\nThe helper function nilfs_recovery_copy_block() of\nnilfs_recovery_dsync_blocks(), which recovers data from logs created by\ndata sync writes during a mount after an unclean shutdown, incorrectly\ncalculates the on-page offset when copying repair data to the file's page\ncache.  In environments where the block size is smaller than the page\nsize, this flaw can cause data corruption and leak uninitialized memory\nbytes during the recovery process.\n\nFix these issues by correcting this byte offset calculation on the page.","status":"published","published":"2024-04-03T15:15:52.88Z","modified":"2026-08-04T11:16:57.093Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:09:46.373977Z"}],"osv":[{"id":"BELL-CVE-2024-26697","status":"published","published":"2024-04-04T05:57:02.977766Z","modified":"2026-01-26T09:36:10.798522Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:19.66992Z"},{"id":"CVE-2024-26697","title":"nilfs2: fix data corruption in dsync block recovery for small block sizes","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix data corruption in dsync block recovery for small block sizes\n\nThe helper function nilfs_recovery_copy_block() of\nnilfs_recovery_dsync_blocks(), which recovers data from logs created by\ndata sync writes during a mount after an unclean shutdown, incorrectly\ncalculates the on-page offset when copying repair data to the file's page\ncache.  In environments where the block size is smaller than the page\nsize, this flaw can cause data corruption and leak uninitialized memory\nbytes during the recovery process.\n\nFix these issues by correcting this byte offset calculation on the page.","status":"published","published":"2024-04-03T14:54:57.848Z","modified":"2026-10-28T02:30:42.436775301Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:39.244433Z"},{"id":"DEBIAN-CVE-2024-26697","description":"In the Linux kernel, the following vulnerability has been resolved:  nilfs2: fix data corruption in dsync block recovery for small block sizes  The helper function nilfs_recovery_copy_block() of nilfs_recovery_dsync_blocks(), which recovers data from logs created by data sync writes during a mount after an unclean shutdown, incorrectly calculates the on-page offset when copying repair data to the file's page cache.  In environments where the block size is smaller than the page size, this flaw can cause data corruption and leak uninitialized memory bytes during the recovery process.  Fix these issues by correcting this byte offset calculation on the page.","status":"published","published":"2024-04-03T15:15:52.88Z","modified":"2026-11-02T12:01:24.721987048Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:42.204259Z"},{"id":"OESA-2024-1617","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nx86/kvm: Disable kvmclock on all CPUs on shutdown\r\n\r\nCurrenly, we disable kvmclock from machine_shutdown() hook and this\nonly happens for boot CPU. We need to disable it for all CPUs to\nguard against memory corruption e.g. on restore from hibernate.\r\n\r\nNote, writing \u0026apos;0\u0026apos; to kvmclock MSR doesn\u0026apos;t clear memory location, it\njust prevents hypervisor from updating the location so for the short\nwhile after write and while CPU is still alive, the clock remains usable\nand correct so we don\u0026apos;t need to switch to some other clocksource.(CVE-2021-47110)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ni40e: Fix NULL ptr dereference on VSI filter sync\r\n\r\nRemove the reason of null pointer dereference in sync VSI filters.\nAdded new I40E_VSI_RELEASING flag to signalize deleting and releasing\nof VSI resources to sync this thread with sync filters subtask.\nWithout this patch it is possible to start update the VSI filter list\nafter VSI is removed, that\u0026apos;s causing a kernel oops.(CVE-2021-47184)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nerofs: fix pcluster use-after-free on UP platforms\r\n\r\nDuring stress testing with CONFIG_SMP disabled, KASAN reports as below:\r\n\r\n==================================================================\nBUG: KASAN: use-after-free in __mutex_lock+0xe5/0xc30\nRead of size 8 at addr ffff8881094223f8 by task stress/7789\r\n\r\nCPU: 0 PID: 7789 Comm: stress Not tainted 6.0.0-rc1-00002-g0d53d2e882f9 #3\nHardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011\nCall Trace:\n \u0026lt;TASK\u0026gt;\n..\n __mutex_lock+0xe5/0xc30\n..\n z_erofs_do_read_page+0x8ce/0x1560\n..\n z_erofs_readahead+0x31c/0x580\n..\nFreed by task 7787\n kasan_save_stack+0x1e/0x40\n kasan_set_track+0x20/0x30\n kasan_set_free_info+0x20/0x40\n __kasan_slab_free+0x10c/0x190\n kmem_cache_free+0xed/0x380\n rcu_core+0x3d5/0xc90\n __do_softirq+0x12d/0x389\r\n\r\nLast potentially related work creation:\n kasan_save_stack+0x1e/0x40\n __kasan_record_aux_stack+0x97/0xb0\n call_rcu+0x3d/0x3f0\n erofs_shrink_workstation+0x11f/0x210\n erofs_shrink_scan+0xdc/0x170\n shrink_slab.constprop.0+0x296/0x530\n drop_slab+0x1c/0x70\n drop_caches_sysctl_handler+0x70/0x80\n proc_sys_call_handler+0x20a/0x2f0\n vfs_write+0x555/0x6c0\n ksys_write+0xbe/0x160\n do_syscall_64+0x3b/0x90\r\n\r\nThe root cause is that erofs_workgroup_unfreeze() doesn\u0026apos;t reset to\norig_val thus it causes a race that the pcluster reuses unexpectedly\nbefore freeing.\r\n\r\nSince UP platforms are quite rare now, such path becomes unnecessary.\nLet\u0026apos;s drop such specific-designed path directly instead.(CVE-2022-48674)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nhwrng: core - Fix page fault dead lock on mmap-ed hwrng\r\n\r\nThere is a dead-lock in the hwrng device read path.  This triggers\nwhen the user reads from /dev/hwrng into memory also mmap-ed from\n/dev/hwrng.  The resulting page fault triggers a recursive read\nwhich then dead-locks.\r\n\r\nFix this by using a stack buffer when calling copy_to_user.(CVE-2023-52615)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nf_tables: disallow timeout for anonymous sets\r\n\r\nNever used from userspace, disallow these parameters.(CVE-2023-52620)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nSUNRPC: Fix a suspicious RCU usage warning\r\n\r\nI received the following warning while running cthon against an ontap\nserver running pNFS:\r\n\r\n[   57.202521] =============================\n[   57.202522] WARNING: suspicious RCU usage\n[   57.202523] 6.7.0-rc3-g2cc14f52aeb7 #41492 Not tainted\n[   57.202525] -----------------------------\n[   57.202525] net/sunrpc/xprtmultipath.c:349 RCU-list traversed in non-reader section!!\n[   57.202527]\n               other info that might help us debug this:\r\n\r\n[   57.202528]\n               rcu_scheduler_active = 2, debug_locks = 1\n[   57.202529] no locks held by test5/3567.\n[   57.202530]\n               stack backtrace:\n[   57.202532] CPU: 0 PID: 3567 Comm: test5 Not tainted 6.7.0-rc3-g2cc14f52aeb7 #41492 5b09971b4965c0aceba19f3eea324a4a806e227e\n[   57.202534] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 2/2/2022\n[   57.202536] Call Trace:\n[   57.202537]  \u0026lt;TASK\u0026gt;\n[   57.202540]  dump_stack_lvl+0x77/0xb0\n[   57.202551]  lockdep_rcu_suspicious+0x154/0x1a0\n[   57.202556]  rpc_xprt_switch_has_addr+0x17c/0x190 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]\n[   57.202596]  rpc_clnt_setup_test_and_add_xprt+0x50/0x180 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]\n[   57.202621]  ? rpc_clnt_add_xprt+0x254/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]\n[   57.202646]  rpc_clnt_add_xprt+0x27a/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]\n[   57.202671]  ? __pfx_rpc_clnt_setup_test_and_add_xprt+0x10/0x10 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]\n[   57.202696]  nfs4_pnfs_ds_connect+0x345/0x760 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]\n[   57.202728]  ? __pfx_nfs4_test_session_trunk+0x10/0x10 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]\n[   57.202754]  nfs4_fl_prepare_ds+0x75/0xc0 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a]\n[   57.202760]  filelayout_write_pagelist+0x4a/0x200 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a]\n[   57.202765]  pnfs_generic_pg_writepages+0xbe/0x230 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]\n[   57.202788]  __nfs_pageio_add_request+0x3fd/0x520 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202813]  nfs_pageio_add_request+0x18b/0x390 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202831]  nfs_do_writepage+0x116/0x1e0 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202849]  nfs_writepages_callback+0x13/0x30 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202866]  write_cache_pages+0x265/0x450\n[   57.202870]  ? __pfx_nfs_writepages_callback+0x10/0x10 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202891]  nfs_writepages+0x141/0x230 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202913]  do_writepages+0xd2/0x230\n[   57.202917]  ? filemap_fdatawrite_wbc+0x5c/0x80\n[   57.202921]  filemap_fdatawrite_wbc+0x67/0x80\n[   57.202924]  filemap_write_and_wait_range+0xd9/0x170\n[   57.202930]  nfs_wb_all+0x49/0x180 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202947]  nfs4_file_flush+0x72/0xb0 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]\n[   57.202969]  __se_sys_close+0x46/0xd0\n[   57.202972]  do_syscall_64+0x68/0x100\n[   57.202975]  ? do_syscall_64+0x77/0x100\n[   57.202976]  ? do_syscall_64+0x77/0x100\n[   57.202979]  entry_SYSCALL_64_after_hwframe+0x6e/0x76\n[   57.202982] RIP: 0033:0x7fe2b12e4a94\n[   57.202985] Code: 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d d5 18 0e 00 00 74 13 b8 03 00 00 00 0f 05 \u0026lt;48\u0026gt; 3d 00 f0 ff ff 77 44 c3 0f 1f 00 48 83 ec 18 89 7c 24 0c e8 c3\n[   57.202987] RSP: 002b:00007ffe857ddb38 EFLAGS: 00000202 ORIG_RAX: 0000000000000003\n[   57.202989] RAX: ffffffffffffffda RBX: 00007ffe857dfd68 RCX: 00007fe2b12e4a94\n[   57.202991] RDX: 0000000000002000 RSI: 00007ffe857ddc40 RDI: 0000000000000003\n[   57.202992] RBP: 00007ffe857dfc50 R08: 7fffffffffffffff R09: 0000000065650f49\n[   57.202993] R10: 00007f\n---truncated---(CVE-2023-52623)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nftables: exthdr: fix 4-byte stack OOB write\r\n\r\nIf priv-\u0026gt;len is a multiple of 4, then dst[len / 4] can write past\nthe destination array which leads to stack corruption.\r\n\r\nThis construct is necessary to clean the remainder of the register\nin case -\u0026gt;len is NOT a multiple of the register size, so make it\nconditional just like nft_payload.c does.\r\n\r\nThe bug was added in 4.1 cycle and then copied/inherited when\ntcp/sctp and ip option support was added.\r\n\r\nBug reported by Zero Day Initiative project (ZDI-CAN-21950,\nZDI-CAN-21951, ZDI-CAN-21961).(CVE-2023-52628)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nsh: push-switch: Reorder cleanup operations to avoid use-after-free bug\r\n\r\nThe original code puts flush_work() before timer_shutdown_sync()\nin switch_drv_remove(). Although we use flush_work() to stop\nthe worker, it could be rescheduled in switch_timer(). As a result,\na use-after-free bug can occur. The details are shown below:\r\n\r\n      (cpu 0)                    |      (cpu 1)\nswitch_drv_remove()              |\n flush_work()                    |\n  ...                            |  switch_timer // timer\n                                 |   schedule_work(\u0026amp;psw-\u0026gt;work)\n timer_shutdown_sync()           |\n ...                             |  switch_work_handler // worker\n kfree(psw) // free              |\n                                 |   psw-\u0026gt;state = 0 // use\r\n\r\nThis patch puts timer_shutdown_sync() before flush_work() to\nmitigate the bugs. As a result, the worker and timer will be\nstopped safely before the deallocate operations.(CVE-2023-52629)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nPM / devfreq: Synchronize devfreq_monitor_[start/stop]\r\n\r\nThere is a chance if a frequent switch of the governor\ndone in a loop result in timer list corruption where\ntimer cancel being done from two place one from\ncancel_delayed_work_sync() and followed by expire_timers()\ncan be seen from the traces[1].\r\n\r\nwhile true\ndo\n        echo \u0026quot;simple_ondemand\u0026quot; \u0026gt; /sys/class/devfreq/1d84000.ufshc/governor\n        echo \u0026quot;performance\u0026quot; \u0026gt; /sys/class/devfreq/1d84000.ufshc/governor\ndone\r\n\r\nIt looks to be issue with devfreq driver where\ndevice_monitor_[start/stop] need to synchronized so that\ndelayed work should get corrupted while it is either\nbeing queued or running or being cancelled.\r\n\r\nLet\u0026apos;s use polling flag and devfreq lock to synchronize the\nqueueing the timer instance twice and work data being\ncorrupted.\r\n\r\n[1]\n...\n..\n\u0026lt;idle\u0026gt;-0    [003]   9436.209662:  timer_cancel   timer=0xffffff80444f0428\n\u0026lt;idle\u0026gt;-0    [003]   9436.209664:  timer_expire_entry   timer=0xffffff80444f0428  now=0x10022da1c  function=__typeid__ZTSFvP10timer_listE_global_addr  baseclk=0x10022da1c\n\u0026lt;idle\u0026gt;-0    [003]   9436.209718:  timer_expire_exit   timer=0xffffff80444f0428\nkworker/u16:6-14217    [003]   9436.209863:  timer_start   timer=0xffffff80444f0428  function=__typeid__ZTSFvP10timer_listE_global_addr  expires=0x10022da2b  now=0x10022da1c  flags=182452227\nvendor.xxxyyy.ha-1593    [004]   9436.209888:  timer_cancel   timer=0xffffff80444f0428\nvendor.xxxyyy.ha-1593    [004]   9436.216390:  timer_init   timer=0xffffff80444f0428\nvendor.xxxyyy.ha-1593    [004]   9436.216392:  timer_start   timer=0xffffff80444f0428  function=__typeid__ZTSFvP10timer_listE_global_addr  expires=0x10022da2c  now=0x10022da1d  flags=186646532\nvendor.xxxyyy.ha-1593    [005]   9436.220992:  timer_cancel   timer=0xffffff80444f0428\nxxxyyyTraceManag-7795    [004]   9436.261641:  timer_cancel   timer=0xffffff80444f0428\r\n\r\n[2]\r\n\r\n 9436.261653][    C4] Unable to handle kernel paging request at virtual address dead00000000012a\n[ 9436.261664][    C4] Mem abort info:\n[ 9436.261666][    C4]   ESR = 0x96000044\n[ 9436.261669][    C4]   EC = 0x25: DABT (current EL), IL = 32 bits\n[ 9436.261671][    C4]   SET = 0, FnV = 0\n[ 9436.261673][    C4]   EA = 0, S1PTW = 0\n[ 9436.261675][    C4] Data abort info:\n[ 9436.261677][    C4]   ISV = 0, ISS = 0x00000044\n[ 9436.261680][    C4]   CM = 0, WnR = 1\n[ 9436.261682][    C4] [dead00000000012a] address between user and kernel address ranges\n[ 9436.261685][    C4] Internal error: Oops: 96000044 [#1] PREEMPT SMP\n[ 9436.261701][    C4] Skip md ftrace buffer dump for: 0x3a982d0\n...\r\n\r\n[ 9436.262138][    C4] CPU: 4 PID: 7795 Comm: TraceManag Tainted: G S      W  O      5.10.149-android12-9-o-g17f915d29d0c #1\n[ 9436.262141][    C4] Hardware name: Qualcomm Technologies, Inc.  (DT)\n[ 9436.262144][    C4] pstate: 22400085 (nzCv daIf +PAN -UAO +TCO BTYPE=--)\n[ 9436.262161][    C4] pc : expire_timers+0x9c/0x438\n[ 9436.262164][    C4] lr : expire_timers+0x2a4/0x438\n[ 9436.262168][    C4] sp : ffffffc010023dd0\n[ 9436.262171][    C4] x29: ffffffc010023df0 x28: ffffffd0636fdc18\n[ 9436.262178][    C4] x27: ffffffd063569dd0 x26: ffffffd063536008\n[ 9436.262182][    C4] x25: 0000000000000001 x24: ffffff88f7c69280\n[ 9436.262185][    C4] x23: 00000000000000e0 x22: dead000000000122\n[ 9436.262188][    C4] x21: 000000010022da29 x20: ffffff8af72b4e80\n[ 9436.262191][    C4] x19: ffffffc010023e50 x18: ffffffc010025038\n[ 9436.262195][    C4] x17: 0000000000000240 x16: 0000000000000201\n[ 9436.262199][    C4] x15: ffffffffffffffff x14: ffffff889f3c3100\n[ 9436.262203][    C4] x13: ffffff889f3c3100 x12: 00000000049f56b8\n[ 9436.262207][    C4] x11: 00000000049f56b8 x10: 00000000ffffffff\n[ 9436.262212][    C4] x9 : ffffffc010023e50 x8 : dead000000000122\n[ 9436.262216][    C4] x7 : ffffffffffffffff x6 : ffffffc0100239d8\n[ 9436.262220][    C4] x5 : 0000000000000000 x4 : 0000000000000101\n[ 9436.262223][    C4] x3 : 0000000000000080 x2 : ffffff8\n---truncated---(CVE-2023-52635)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ncan: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)\r\n\r\nLock jsk-\u0026gt;sk to prevent UAF when setsockopt(..., SO_J1939_FILTER, ...)\nmodifies jsk-\u0026gt;filters while receiving packets.\r\n\r\nFollowing trace was seen on affected system:\n ==================================================================\n BUG: KASAN: slab-use-after-free in j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939]\n Read of size 4 at addr ffff888012144014 by task j1939/350\r\n\r\n CPU: 0 PID: 350 Comm: j1939 Tainted: G        W  OE      6.5.0-rc5 #1\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014\n Call Trace:\n  print_report+0xd3/0x620\n  ? kasan_complete_mode_report_info+0x7d/0x200\n  ? j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939]\n  kasan_report+0xc2/0x100\n  ? j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939]\n  __asan_load4+0x84/0xb0\n  j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939]\n  j1939_sk_recv+0x20b/0x320 [can_j1939]\n  ? __kasan_check_write+0x18/0x20\n  ? __pfx_j1939_sk_recv+0x10/0x10 [can_j1939]\n  ? j1939_simple_recv+0x69/0x280 [can_j1939]\n  ? j1939_ac_recv+0x5e/0x310 [can_j1939]\n  j1939_can_recv+0x43f/0x580 [can_j1939]\n  ? __pfx_j1939_can_recv+0x10/0x10 [can_j1939]\n  ? raw_rcv+0x42/0x3c0 [can_raw]\n  ? __pfx_j1939_can_recv+0x10/0x10 [can_j1939]\n  can_rcv_filter+0x11f/0x350 [can]\n  can_receive+0x12f/0x190 [can]\n  ? __pfx_can_rcv+0x10/0x10 [can]\n  can_rcv+0xdd/0x130 [can]\n  ? __pfx_can_rcv+0x10/0x10 [can]\n  __netif_receive_skb_one_core+0x13d/0x150\n  ? __pfx___netif_receive_skb_one_core+0x10/0x10\n  ? __kasan_check_write+0x18/0x20\n  ? _raw_spin_lock_irq+0x8c/0xe0\n  __netif_receive_skb+0x23/0xb0\n  process_backlog+0x107/0x260\n  __napi_poll+0x69/0x310\n  net_rx_action+0x2a1/0x580\n  ? __pfx_net_rx_action+0x10/0x10\n  ? __pfx__raw_spin_lock+0x10/0x10\n  ? handle_irq_event+0x7d/0xa0\n  __do_softirq+0xf3/0x3f8\n  do_softirq+0x53/0x80\n  \u0026lt;/IRQ\u0026gt;\n  \u0026lt;TASK\u0026gt;\n  __local_bh_enable_ip+0x6e/0x70\n  netif_rx+0x16b/0x180\n  can_send+0x32b/0x520 [can]\n  ? __pfx_can_send+0x10/0x10 [can]\n  ? __check_object_size+0x299/0x410\n  raw_sendmsg+0x572/0x6d0 [can_raw]\n  ? __pfx_raw_sendmsg+0x10/0x10 [can_raw]\n  ? apparmor_socket_sendmsg+0x2f/0x40\n  ? __pfx_raw_sendmsg+0x10/0x10 [can_raw]\n  sock_sendmsg+0xef/0x100\n  sock_write_iter+0x162/0x220\n  ? __pfx_sock_write_iter+0x10/0x10\n  ? __rtnl_unlock+0x47/0x80\n  ? security_file_permission+0x54/0x320\n  vfs_write+0x6ba/0x750\n  ? __pfx_vfs_write+0x10/0x10\n  ? __fget_light+0x1ca/0x1f0\n  ? __rcu_read_unlock+0x5b/0x280\n  ksys_write+0x143/0x170\n  ? __pfx_ksys_write+0x10/0x10\n  ? __kasan_check_read+0x15/0x20\n  ? fpregs_assert_state_consistent+0x62/0x70\n  __x64_sys_write+0x47/0x60\n  do_syscall_64+0x60/0x90\n  ? do_syscall_64+0x6d/0x90\n  ? irqentry_exit+0x3f/0x50\n  ? exc_page_fault+0x79/0xf0\n  entry_SYSCALL_64_after_hwframe+0x6e/0xd8\r\n\r\n Allocated by task 348:\n  kasan_save_stack+0x2a/0x50\n  kasan_set_track+0x29/0x40\n  kasan_save_alloc_info+0x1f/0x30\n  __kasan_kmalloc+0xb5/0xc0\n  __kmalloc_node_track_caller+0x67/0x160\n  j1939_sk_setsockopt+0x284/0x450 [can_j1939]\n  __sys_setsockopt+0x15c/0x2f0\n  __x64_sys_setsockopt+0x6b/0x80\n  do_syscall_64+0x60/0x90\n  entry_SYSCALL_64_after_hwframe+0x6e/0xd8\r\n\r\n Freed by task 349:\n  kasan_save_stack+0x2a/0x50\n  kasan_set_track+0x29/0x40\n  kasan_save_free_info+0x2f/0x50\n  __kasan_slab_free+0x12e/0x1c0\n  __kmem_cache_free+0x1b9/0x380\n  kfree+0x7a/0x120\n  j1939_sk_setsockopt+0x3b2/0x450 [can_j1939]\n  __sys_setsockopt+0x15c/0x2f0\n  __x64_sys_setsockopt+0x6b/0x80\n  do_syscall_64+0x60/0x90\n  entry_SYSCALL_64_after_hwframe+0x6e/0xd8(CVE-2023-52637)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ncan: j1939: prevent deadlock by changing j1939_socks_lock to rwlock\r\n\r\nThe following 3 locks would race against each other, causing the\ndeadlock situation in the Syzbot bug report:\r\n\r\n- j1939_socks_lock\n- active_session_list_lock\n- sk_session_queue_lock\r\n\r\nA reasonable fix is to change j1939_socks_lock to an rwlock, since in\nthe rare situations where a write lock is required for the linked list\nthat j1939_socks_lock is protecting, the code does not attempt to\nacquire any more locks. This would break the circular lock dependency,\nwhere, for example, the current thread already locks j1939_socks_lock\nand attempts to acquire sk_session_queue_lock, and at the same time,\nanother thread attempts to acquire j1939_socks_lock while holding\nsk_session_queue_lock.\r\n\r\nNOTE: This patch along does not fix the unregister_netdevice bug\nreported by Syzbot; instead, it solves a deadlock situation to prepare\nfor one or more further patches to actually fix the Syzbot bug, which\nappears to be a reference counting problem within the j1939 codebase.\r\n\r\n[mkl: remove unrelated newline change](CVE-2023-52638)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nKVM: s390: vsie: fix race during shadow creation\r\n\r\nRight now it is possible to see gmap-\u0026gt;private being zero in\nkvm_s390_vsie_gmap_notifier resulting in a crash.  This is due to the\nfact that we add gmap-\u0026gt;private == kvm after creation:\r\n\r\nstatic int acquire_gmap_shadow(struct kvm_vcpu *vcpu,\n                               struct vsie_page *vsie_page)\n{\n[...]\n        gmap = gmap_shadow(vcpu-\u0026gt;arch.gmap, asce, edat);\n        if (IS_ERR(gmap))\n                return PTR_ERR(gmap);\n        gmap-\u0026gt;private = vcpu-\u0026gt;kvm;\r\n\r\nLet children inherit the private field of the parent.(CVE-2023-52639)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmedia: rc: bpf attach/detach requires write permission\r\n\r\nNote that bpf attach/detach also requires CAP_NET_ADMIN.(CVE-2023-52642)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled\r\n\r\nWhen QoS is disabled, the queue priority value will not map to the correct\nieee80211 queue since there is only one queue. Stop/wake queue 0 when QoS\nis disabled to prevent trying to stop/wake a non-existent queue and failing\nto stop/wake the actual queue instantiated.\r\n\r\nLog of issue before change (with kernel parameter qos=0):\n    [  +5.112651] ------------[ cut here ]------------\n    [  +0.000005] WARNING: CPU: 7 PID: 25513 at net/mac80211/util.c:449 __ieee80211_wake_queue+0xd5/0x180 [mac80211]\n    [  +0.000067] Modules linked in: b43(O) snd_seq_dummy snd_hrtimer snd_seq snd_seq_device nft_chain_nat xt_MASQUERADE nf_nat xfrm_user xfrm_algo xt_addrtype overlay ccm af_packet amdgpu snd_hda_codec_cirrus snd_hda_codec_generic ledtrig_audio drm_exec amdxcp gpu_sched xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip6t_rpfilter ipt_rpfilter xt_pkttype xt_LOG nf_log_syslog xt_tcpudp nft_compat nf_tables nfnetlink sch_fq_codel btusb uinput iTCO_wdt ctr btrtl intel_pmc_bxt i915 intel_rapl_msr mei_hdcp mei_pxp joydev at24 watchdog btintel atkbd libps2 serio radeon btbcm vivaldi_fmap btmtk intel_rapl_common snd_hda_codec_hdmi bluetooth uvcvideo nls_iso8859_1 applesmc nls_cp437 x86_pkg_temp_thermal snd_hda_intel intel_powerclamp vfat videobuf2_vmalloc coretemp fat snd_intel_dspcfg crc32_pclmul uvc polyval_clmulni snd_intel_sdw_acpi loop videobuf2_memops snd_hda_codec tun drm_suballoc_helper polyval_generic drm_ttm_helper drm_buddy tap ecdh_generic videobuf2_v4l2 gf128mul macvlan ttm ghash_clmulni_intel ecc tg3\n    [  +0.000044]  videodev bridge snd_hda_core rapl crc16 drm_display_helper cec mousedev snd_hwdep evdev intel_cstate bcm5974 hid_appleir videobuf2_common stp mac_hid libphy snd_pcm drm_kms_helper acpi_als mei_me intel_uncore llc mc snd_timer intel_gtt industrialio_triggered_buffer apple_mfi_fastcharge i2c_i801 mei snd lpc_ich agpgart ptp i2c_smbus thunderbolt apple_gmux i2c_algo_bit kfifo_buf video industrialio soundcore pps_core wmi tiny_power_button sbs sbshc button ac cordic bcma mac80211 cfg80211 ssb rfkill libarc4 kvm_intel kvm drm irqbypass fuse backlight firmware_class efi_pstore configfs efivarfs dmi_sysfs ip_tables x_tables autofs4 dm_crypt cbc encrypted_keys trusted asn1_encoder tee tpm rng_core input_leds hid_apple led_class hid_generic usbhid hid sd_mod t10_pi crc64_rocksoft crc64 crc_t10dif crct10dif_generic ahci libahci libata uhci_hcd ehci_pci ehci_hcd crct10dif_pclmul crct10dif_common sha512_ssse3 sha512_generic sha256_ssse3 sha1_ssse3 aesni_intel usbcore scsi_mod libaes crypto_simd cryptd scsi_common\n    [  +0.000055]  usb_common rtc_cmos btrfs blake2b_generic libcrc32c crc32c_generic crc32c_intel xor raid6_pq dm_snapshot dm_bufio dm_mod dax [last unloaded: b43(O)]\n    [  +0.000009] CPU: 7 PID: 25513 Comm: irq/17-b43 Tainted: G        W  O       6.6.7 #1-NixOS\n    [  +0.000003] Hardware name: Apple Inc. MacBookPro8,3/Mac-942459F5819B171B, BIOS 87.0.0.0.0 06/13/2019\n    [  +0.000001] RIP: 0010:__ieee80211_wake_queue+0xd5/0x180 [mac80211]\n    [  +0.000046] Code: 00 45 85 e4 0f 85 9b 00 00 00 48 8d bd 40 09 00 00 f0 48 0f ba ad 48 09 00 00 00 72 0f 5b 5d 41 5c 41 5d 41 5e e9 cb 6d 3c d0 \u0026lt;0f\u0026gt; 0b 5b 5d 41 5c 41 5d 41 5e c3 cc cc cc cc 48 8d b4 16 94 00 00\n    [  +0.000002] RSP: 0018:ffffc90003c77d60 EFLAGS: 00010097\n    [  +0.000001] RAX: 0000000000000001 RBX: 0000000000000002 RCX: 0000000000000000\n    [  +0.000001] RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffff88820b924900\n    [  +0.000002] RBP: ffff88820b924900 R08: ffffc90003c77d90 R09: 000000000003bfd0\n    [  +0.000001] R10: ffff88820b924900 R11: ffffc90003c77c68 R12: 0000000000000000\n    [  +0.000001] R13: 0000000000000000 R14: ffffc90003c77d90 R15: ffffffffc0fa6f40\n    [  +0.000001] FS:  0000000000000000(0000) GS:ffff88846fb80000(0000) knlGS:0000000000000000\n    [  +0.000001] CS:  0010 DS: 0\n---truncated---(CVE-2023-52644)\r\n\r\nA flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on `struct net_device`, and a use-after-free can be triggered by racing between the free on the struct and the access through the `skbtxq` global queue. This could lead to a denial of service condition or potential code execution.(CVE-2023-6270)\r\n\r\nA race condition was found in the Linux kernel\u0026apos;s net/bluetooth in {conn,adv}_{min,max}_interval_set() function. This can result in I2cap connection or broadcast abnormality issue, possibly leading to denial of service.\r\n\r\n\r\n\r\n\n(CVE-2024-24858)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntcp: make sure init the accept_queue\u0026apos;s spinlocks once\r\n\r\nWhen I run syz\u0026apos;s reproduction C program locally, it causes the following\nissue:\npvqspinlock: lock 0xffff9d181cd5c660 has corrupted value 0x0!\nWARNING: CPU: 19 PID: 21160 at __pv_queued_spin_unlock_slowpath (kernel/locking/qspinlock_paravirt.h:508)\nHardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011\nRIP: 0010:__pv_queued_spin_unlock_slowpath (kernel/locking/qspinlock_paravirt.h:508)\nCode: 73 56 3a ff 90 c3 cc cc cc cc 8b 05 bb 1f 48 01 85 c0 74 05 c3 cc cc cc cc 8b 17 48 89 fe 48 c7 c7\n30 20 ce 8f e8 ad 56 42 ff \u0026lt;0f\u0026gt; 0b c3 cc cc cc cc 0f 0b 0f 1f 40 00 90 90 90 90 90 90 90 90 90\nRSP: 0018:ffffa8d200604cb8 EFLAGS: 00010282\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff9d1ef60e0908\nRDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff9d1ef60e0900\nRBP: ffff9d181cd5c280 R08: 0000000000000000 R09: 00000000ffff7fff\nR10: ffffa8d200604b68 R11: ffffffff907dcdc8 R12: 0000000000000000\nR13: ffff9d181cd5c660 R14: ffff9d1813a3f330 R15: 0000000000001000\nFS:  00007fa110184640(0000) GS:ffff9d1ef60c0000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000020000000 CR3: 000000011f65e000 CR4: 00000000000006f0\nCall Trace:\n\u0026lt;IRQ\u0026gt;\n  _raw_spin_unlock (kernel/locking/spinlock.c:186)\n  inet_csk_reqsk_queue_add (net/ipv4/inet_connection_sock.c:1321)\n  inet_csk_complete_hashdance (net/ipv4/inet_connection_sock.c:1358)\n  tcp_check_req (net/ipv4/tcp_minisocks.c:868)\n  tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2260)\n  ip_protocol_deliver_rcu (net/ipv4/ip_input.c:205)\n  ip_local_deliver_finish (net/ipv4/ip_input.c:234)\n  __netif_receive_skb_one_core (net/core/dev.c:5529)\n  process_backlog (./include/linux/rcupdate.h:779)\n  __napi_poll (net/core/dev.c:6533)\n  net_rx_action (net/core/dev.c:6604)\n  __do_softirq (./arch/x86/include/asm/jump_label.h:27)\n  do_softirq (kernel/softirq.c:454 kernel/softirq.c:441)\n\u0026lt;/IRQ\u0026gt;\n\u0026lt;TASK\u0026gt;\n  __local_bh_enable_ip (kernel/softirq.c:381)\n  __dev_queue_xmit (net/core/dev.c:4374)\n  ip_finish_output2 (./include/net/neighbour.h:540 net/ipv4/ip_output.c:235)\n  __ip_queue_xmit (net/ipv4/ip_output.c:535)\n  __tcp_transmit_skb (net/ipv4/tcp_output.c:1462)\n  tcp_rcv_synsent_state_process (net/ipv4/tcp_input.c:6469)\n  tcp_rcv_state_process (net/ipv4/tcp_input.c:6657)\n  tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1929)\n  __release_sock (./include/net/sock.h:1121 net/core/sock.c:2968)\n  release_sock (net/core/sock.c:3536)\n  inet_wait_for_connect (net/ipv4/af_inet.c:609)\n  __inet_stream_connect (net/ipv4/af_inet.c:702)\n  inet_stream_connect (net/ipv4/af_inet.c:748)\n  __sys_connect (./include/linux/file.h:45 net/socket.c:2064)\n  __x64_sys_connect (net/socket.c:2073 net/socket.c:2070 net/socket.c:2070)\n  do_syscall_64 (arch/x86/entry/common.c:51 arch/x86/entry/common.c:82)\n  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:129)\n  RIP: 0033:0x7fa10ff05a3d\n  Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89\n  c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 8b 0d ab a3 0e 00 f7 d8 64 89 01 48\n  RSP: 002b:00007fa110183de8 EFLAGS: 00000202 ORIG_RAX: 000000000000002a\n  RAX: ffffffffffffffda RBX: 0000000020000054 RCX: 00007fa10ff05a3d\n  RDX: 000000000000001c RSI: 0000000020000040 RDI: 0000000000000003\n  RBP: 00007fa110183e20 R08: 0000000000000000 R09: 0000000000000000\n  R10: 0000000000000000 R11: 0000000000000202 R12: 00007fa110184640\n  R13: 0000000000000000 R14: 00007fa10fe8b060 R15: 00007fff73e23b20\n\u0026lt;/TASK\u0026gt;\r\n\r\nThe issue triggering process is analyzed as follows:\nThread A                                       Thread B\ntcp_v4_rcv\t//receive ack TCP packet       inet_shutdown\n  tcp_check_req                                  tcp_disconnect //disconnect sock\n  ...                                              tcp_set_state(sk, TCP_CLOSE)\n    inet_csk_complete_hashdance                ...\n      inet_csk_reqsk_queue_add         \n---truncated---(CVE-2024-26614)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nf_tables: disallow anonymous set with timeout flag\r\n\r\nAnonymous sets are never used with timeout from userspace, reject this.\nException to this rule is NFT_SET_EVAL to ensure legacy meters still work.(CVE-2024-26642)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntracing: Ensure visibility when inserting an element into tracing_map\r\n\r\nRunning the following two commands in parallel on a multi-processor\nAArch64 machine can sporadically produce an unexpected warning about\nduplicate histogram entries:\r\n\r\n $ while true; do\n     echo hist:key=id.syscall:val=hitcount \u0026gt; \\\n       /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/trigger\n     cat /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/hist\n     sleep 0.001\n   done\n $ stress-ng --sysbadaddr $(nproc)\r\n\r\nThe warning looks as follows:\r\n\r\n[ 2911.172474] ------------[ cut here ]------------\n[ 2911.173111] Duplicates detected: 1\n[ 2911.173574] WARNING: CPU: 2 PID: 12247 at kernel/trace/tracing_map.c:983 tracing_map_sort_entries+0x3e0/0x408\n[ 2911.174702] Modules linked in: iscsi_ibft(E) iscsi_boot_sysfs(E) rfkill(E) af_packet(E) nls_iso8859_1(E) nls_cp437(E) vfat(E) fat(E) ena(E) tiny_power_button(E) qemu_fw_cfg(E) button(E) fuse(E) efi_pstore(E) ip_tables(E) x_tables(E) xfs(E) libcrc32c(E) aes_ce_blk(E) aes_ce_cipher(E) crct10dif_ce(E) polyval_ce(E) polyval_generic(E) ghash_ce(E) gf128mul(E) sm4_ce_gcm(E) sm4_ce_ccm(E) sm4_ce(E) sm4_ce_cipher(E) sm4(E) sm3_ce(E) sm3(E) sha3_ce(E) sha512_ce(E) sha512_arm64(E) sha2_ce(E) sha256_arm64(E) nvme(E) sha1_ce(E) nvme_core(E) nvme_auth(E) t10_pi(E) sg(E) scsi_mod(E) scsi_common(E) efivarfs(E)\n[ 2911.174738] Unloaded tainted modules: cppc_cpufreq(E):1\n[ 2911.180985] CPU: 2 PID: 12247 Comm: cat Kdump: loaded Tainted: G            E      6.7.0-default #2 1b58bbb22c97e4399dc09f92d309344f69c44a01\n[ 2911.182398] Hardware name: Amazon EC2 c7g.8xlarge/, BIOS 1.0 11/1/2018\n[ 2911.183208] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n[ 2911.184038] pc : tracing_map_sort_entries+0x3e0/0x408\n[ 2911.184667] lr : tracing_map_sort_entries+0x3e0/0x408\n[ 2911.185310] sp : ffff8000a1513900\n[ 2911.185750] x29: ffff8000a1513900 x28: ffff0003f272fe80 x27: 0000000000000001\n[ 2911.186600] x26: ffff0003f272fe80 x25: 0000000000000030 x24: 0000000000000008\n[ 2911.187458] x23: ffff0003c5788000 x22: ffff0003c16710c8 x21: ffff80008017f180\n[ 2911.188310] x20: ffff80008017f000 x19: ffff80008017f180 x18: ffffffffffffffff\n[ 2911.189160] x17: 0000000000000000 x16: 0000000000000000 x15: ffff8000a15134b8\n[ 2911.190015] x14: 0000000000000000 x13: 205d373432323154 x12: 5b5d313131333731\n[ 2911.190844] x11: 00000000fffeffff x10: 00000000fffeffff x9 : ffffd1b78274a13c\n[ 2911.191716] x8 : 000000000017ffe8 x7 : c0000000fffeffff x6 : 000000000057ffa8\n[ 2911.192554] x5 : ffff0012f6c24ec0 x4 : 0000000000000000 x3 : ffff2e5b72b5d000\n[ 2911.193404] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0003ff254480\n[ 2911.194259] Call trace:\n[ 2911.194626]  tracing_map_sort_entries+0x3e0/0x408\n[ 2911.195220]  hist_show+0x124/0x800\n[ 2911.195692]  seq_read_iter+0x1d4/0x4e8\n[ 2911.196193]  seq_read+0xe8/0x138\n[ 2911.196638]  vfs_read+0xc8/0x300\n[ 2911.197078]  ksys_read+0x70/0x108\n[ 2911.197534]  __arm64_sys_read+0x24/0x38\n[ 2911.198046]  invoke_syscall+0x78/0x108\n[ 2911.198553]  el0_svc_common.constprop.0+0xd0/0xf8\n[ 2911.199157]  do_el0_svc+0x28/0x40\n[ 2911.199613]  el0_svc+0x40/0x178\n[ 2911.200048]  el0t_64_sync_handler+0x13c/0x158\n[ 2911.200621]  el0t_64_sync+0x1a8/0x1b0\n[ 2911.201115] ---[ end trace 0000000000000000 ]---\r\n\r\nThe problem appears to be caused by CPU reordering of writes issued from\n__tracing_map_insert().\r\n\r\nThe check for the presence of an element with a given key in this\nfunction is:\r\n\r\n val = READ_ONCE(entry-\u0026gt;val);\n if (val \u0026amp;\u0026amp; keys_match(key, val-\u0026gt;key, map-\u0026gt;key_size)) ...\r\n\r\nThe write of a new entry is:\r\n\r\n elt = get_free_elt(map);\n memcpy(elt-\u0026gt;key, key, map-\u0026gt;key_size);\n entry-\u0026gt;val = elt;\r\n\r\nThe \u0026quot;memcpy(elt-\u0026gt;key, key, map-\u0026gt;key_size);\u0026quot; and \u0026quot;entry-\u0026gt;val = elt;\u0026quot;\nstores may become visible in the reversed order on another CPU. This\nsecond CPU might then incorrectly determine that a new key doesn\u0026apos;t match\nan already present val-\u0026gt;key and subse\n---truncated---(CVE-2024-26645)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nft_limit: reject configurations that cause integer overflow\r\n\r\nReject bogus configs where internal token counter wraps around.\nThis only occurs with very very large requests, such as 17gbyte/s.\r\n\r\nIts better to reject this rather than having incorrect ratelimit.(CVE-2024-26668)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nblk-mq: fix IO hang from sbitmap wakeup race\r\n\r\nIn blk_mq_mark_tag_wait(), __add_wait_queue() may be re-ordered\nwith the following blk_mq_get_driver_tag() in case of getting driver\ntag failure.\r\n\r\nThen in __sbitmap_queue_wake_up(), waitqueue_active() may not observe\nthe added waiter in blk_mq_mark_tag_wait() and wake up nothing, meantime\nblk_mq_mark_tag_wait() can\u0026apos;t get driver tag successfully.\r\n\r\nThis issue can be reproduced by running the following test in loop, and\nfio hang can be observed in \u0026lt; 30min when running it on my test VM\nin laptop.\r\n\r\n\tmodprobe -r scsi_debug\n\tmodprobe scsi_debug delay=0 dev_size_mb=4096 max_queue=1 host_max_queue=1 submit_queues=4\n\tdev=`ls -d /sys/bus/pseudo/drivers/scsi_debug/adapter*/host*/target*/*/block/* | head -1 | xargs basename`\n\tfio --filename=/dev/\u0026quot;$dev\u0026quot; --direct=1 --rw=randrw --bs=4k --iodepth=1 \\\n       \t\t--runtime=100 --numjobs=40 --time_based --name=test \\\n        \t--ioengine=libaio\r\n\r\nFix the issue by adding one explicit barrier in blk_mq_mark_tag_wait(), which\nis just fine in case of running out of tag.(CVE-2024-26671)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nppp_async: limit MRU to 64K\r\n\r\nsyzbot triggered a warning [1] in __alloc_pages():\r\n\r\nWARN_ON_ONCE_GFP(order \u0026gt; MAX_PAGE_ORDER, gfp)\r\n\r\nWillem fixed a similar issue in commit c0a2a1b0d631 (\u0026quot;ppp: limit MRU to 64K\u0026quot;)\r\n\r\nAdopt the same sanity check for ppp_async_ioctl(PPPIOCSMRU)\r\n\r\n[1]:\r\n\r\n WARNING: CPU: 1 PID: 11 at mm/page_alloc.c:4543 __alloc_pages+0x308/0x698 mm/page_alloc.c:4543\nModules linked in:\nCPU: 1 PID: 11 Comm: kworker/u4:0 Not tainted 6.8.0-rc2-syzkaller-g41bccc98fb79 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023\nWorkqueue: events_unbound flush_to_ldisc\npstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : __alloc_pages+0x308/0x698 mm/page_alloc.c:4543\n lr : __alloc_pages+0xc8/0x698 mm/page_alloc.c:4537\nsp : ffff800093967580\nx29: ffff800093967660 x28: ffff8000939675a0 x27: dfff800000000000\nx26: ffff70001272ceb4 x25: 0000000000000000 x24: ffff8000939675c0\nx23: 0000000000000000 x22: 0000000000060820 x21: 1ffff0001272ceb8\nx20: ffff8000939675e0 x19: 0000000000000010 x18: ffff800093967120\nx17: ffff800083bded5c x16: ffff80008ac97500 x15: 0000000000000005\nx14: 1ffff0001272cebc x13: 0000000000000000 x12: 0000000000000000\nx11: ffff70001272cec1 x10: 1ffff0001272cec0 x9 : 0000000000000001\nx8 : ffff800091c91000 x7 : 0000000000000000 x6 : 000000000000003f\nx5 : 00000000ffffffff x4 : 0000000000000000 x3 : 0000000000000020\nx2 : 0000000000000008 x1 : 0000000000000000 x0 : ffff8000939675e0\nCall trace:\n  __alloc_pages+0x308/0x698 mm/page_alloc.c:4543\n  __alloc_pages_node include/linux/gfp.h:238 [inline]\n  alloc_pages_node include/linux/gfp.h:261 [inline]\n  __kmalloc_large_node+0xbc/0x1fc mm/slub.c:3926\n  __do_kmalloc_node mm/slub.c:3969 [inline]\n  __kmalloc_node_track_caller+0x418/0x620 mm/slub.c:4001\n  kmalloc_reserve+0x17c/0x23c net/core/skbuff.c:590\n  __alloc_skb+0x1c8/0x3d8 net/core/skbuff.c:651\n  __netdev_alloc_skb+0xb8/0x3e8 net/core/skbuff.c:715\n  netdev_alloc_skb include/linux/skbuff.h:3235 [inline]\n  dev_alloc_skb include/linux/skbuff.h:3248 [inline]\n  ppp_async_input drivers/net/ppp/ppp_async.c:863 [inline]\n  ppp_asynctty_receive+0x588/0x186c drivers/net/ppp/ppp_async.c:341\n  tty_ldisc_receive_buf+0x12c/0x15c drivers/tty/tty_buffer.c:390\n  tty_port_default_receive_buf+0x74/0xac drivers/tty/tty_port.c:37\n  receive_buf drivers/tty/tty_buffer.c:444 [inline]\n  flush_to_ldisc+0x284/0x6e4 drivers/tty/tty_buffer.c:494\n  process_one_work+0x694/0x1204 kernel/workqueue.c:2633\n  process_scheduled_works kernel/workqueue.c:2706 [inline]\n  worker_thread+0x938/0xef4 kernel/workqueue.c:2787\n  kthread+0x288/0x310 kernel/kthread.c:388\n  ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860(CVE-2024-26675)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ninet: read sk-\u0026gt;sk_family once in inet_recv_error()\r\n\r\ninet_recv_error() is called without holding the socket lock.\r\n\r\nIPv6 socket could mutate to IPv4 with IPV6_ADDRFORM\nsocket option and trigger a KCSAN warning.(CVE-2024-26679)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnilfs2: fix potential bug in end_buffer_async_write\r\n\r\nAccording to a syzbot report, end_buffer_async_write(), which handles the\ncompletion of block device writes, may detect abnormal condition of the\nbuffer async_write flag and cause a BUG_ON failure when using nilfs2.\r\n\r\nNilfs2 itself does not use end_buffer_async_write().  But, the async_write\nflag is now used as a marker by commit 7f42ec394156 (\u0026quot;nilfs2: fix issue\nwith race condition of competition between segments for dirty blocks\u0026quot;) as\na means of resolving double list insertion of dirty blocks in\nnilfs_lookup_dirty_data_buffers() and nilfs_lookup_node_buffers() and the\nresulting crash.\r\n\r\nThis modification is safe as long as it is used for file data and b-tree\nnode blocks where the page caches are independent.  However, it was\nirrelevant and redundant to also introduce async_write for segment summary\nand super root blocks that share buffers with the backing device.  This\nled to the possibility that the BUG_ON check in end_buffer_async_write\nwould fail as described above, if independent writebacks of the backing\ndevice occurred in parallel.\r\n\r\nThe use of async_write for segment summary buffers has already been\nremoved in a previous change.\r\n\r\nFix this issue by removing the manipulation of the async_write flag for\nthe remaining super root block buffer.(CVE-2024-26685)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nfs/proc: do_task_stat: use sig-\u0026gt;stats_lock to gather the threads/children stats\r\n\r\nlock_task_sighand() can trigger a hard lockup.  If NR_CPUS threads call\ndo_task_stat() at the same time and the process has NR_THREADS, it will\nspin with irqs disabled O(NR_CPUS * NR_THREADS) time.\r\n\r\nChange do_task_stat() to use sig-\u0026gt;stats_lock to gather the statistics\noutside of -\u0026gt;siglock protected section, in the likely case this code will\nrun lockless.(CVE-2024-26686)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnilfs2: fix data corruption in dsync block recovery for small block sizes\r\n\r\nThe helper function nilfs_recovery_copy_block() of\nnilfs_recovery_dsync_blocks(), which recovers data from logs created by\ndata sync writes during a mount after an unclean shutdown, incorrectly\ncalculates the on-page offset when copying repair data to the file\u0026apos;s page\ncache.  In environments where the block size is smaller than the page\nsize, this flaw can cause data corruption and leak uninitialized memory\nbytes during the recovery process.\r\n\r\nFix these issues by correcting this byte offset calculation on the page.(CVE-2024-26697)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again\r\n\r\n(struct dirty_throttle_control *)-\u0026gt;thresh is an unsigned long, but is\npassed as the u32 divisor argument to div_u64().  On architectures where\nunsigned long is 64 bytes, the argument will be implicitly truncated.\r\n\r\nUse div64_u64() instead of div_u64() so that the value used in the \u0026quot;is\nthis a safe division\u0026quot; check is the same as the divisor.\r\n\r\nAlso, remove redundant cast of the numerator to u64, as that should happen\nimplicitly.\r\n\r\nThis would be difficult to exploit in memcg domain, given the ratio-based\narithmetic domain_drity_limits() uses, but is much easier in global\nwriteback domain with a BDI_CAP_STRICTLIMIT-backing device, using e.g. \nvm.dirty_bytes=(1\u0026lt;\u0026lt;32)*PAGE_SIZE so that dtc-\u0026gt;thresh == (1\u0026lt;\u0026lt;32)(CVE-2024-26720)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbtrfs: don\u0026apos;t drop extent_map for free space inode on write error\r\n\r\nWhile running the CI for an unrelated change I hit the following panic\nwith generic/648 on btrfs_holes_spacecache.\r\n\r\nassertion failed: block_start != EXTENT_MAP_HOLE, in fs/btrfs/extent_io.c:1385\n------------[ cut here ]------------\nkernel BUG at fs/btrfs/extent_io.c:1385!\ninvalid opcode: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 1 PID: 2695096 Comm: fsstress Kdump: loaded Tainted: G        W          6.8.0-rc2+ #1\nRIP: 0010:__extent_writepage_io.constprop.0+0x4c1/0x5c0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n extent_write_cache_pages+0x2ac/0x8f0\n extent_writepages+0x87/0x110\n do_writepages+0xd5/0x1f0\n filemap_fdatawrite_wbc+0x63/0x90\n __filemap_fdatawrite_range+0x5c/0x80\n btrfs_fdatawrite_range+0x1f/0x50\n btrfs_write_out_cache+0x507/0x560\n btrfs_write_dirty_block_groups+0x32a/0x420\n commit_cowonly_roots+0x21b/0x290\n btrfs_commit_transaction+0x813/0x1360\n btrfs_sync_file+0x51a/0x640\n __x64_sys_fdatasync+0x52/0x90\n do_syscall_64+0x9c/0x190\n entry_SYSCALL_64_after_hwframe+0x6e/0x76\r\n\r\nThis happens because we fail to write out the free space cache in one\ninstance, come back around and attempt to write it again.  However on\nthe second pass through we go to call btrfs_get_extent() on the inode to\nget the extent mapping.  Because this is a new block group, and with the\nfree space inode we always search the commit root to avoid deadlocking\nwith the tree, we find nothing and return a EXTENT_MAP_HOLE for the\nrequested range.\r\n\r\nThis happens because the first time we try to write the space cache out\nwe hit an error, and on an error we drop the extent mapping.  This is\nnormal for normal files, but the free space cache inode is special.  We\nalways expect the extent map to be correct.  Thus the second time\nthrough we end up with a bogus extent map.\r\n\r\nSince we\u0026apos;re deprecating this feature, the most straightforward way to\nfix this is to simply skip dropping the extent map range for this failed\nrange.\r\n\r\nI shortened the test by using error injection to stress the area to make\nit easier to reproduce.  With this patch in place we no longer panic\nwith my error injection test.(CVE-2024-26726)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\narp: Prevent overflow in arp_req_get().\r\n\r\nsyzkaller reported an overflown write in arp_req_get(). [0]\r\n\r\nWhen ioctl(SIOCGARP) is issued, arp_req_get() looks up an neighbour\nentry and copies neigh-\u0026gt;ha to struct arpreq.arp_ha.sa_data.\r\n\r\nThe arp_ha here is struct sockaddr, not struct sockaddr_storage, so\nthe sa_data buffer is just 14 bytes.\r\n\r\nIn the splat below, 2 bytes are overflown to the next int field,\narp_flags.  We initialise the field just after the memcpy(), so it\u0026apos;s\nnot a problem.\r\n\r\nHowever, when dev-\u0026gt;addr_len is greater than 22 (e.g. MAX_ADDR_LEN),\narp_netmask is overwritten, which could be set as htonl(0xFFFFFFFFUL)\nin arp_ioctl() before calling arp_req_get().\r\n\r\nTo avoid the overflow, let\u0026apos;s limit the max length of memcpy().\r\n\r\nNote that commit b5f0de6df6dc (\u0026quot;net: dev: Convert sa_data to flexible\narray in struct sockaddr\u0026quot;) just silenced syzkaller.\r\n\r\n[0]:\nmemcpy: detected field-spanning write (size 16) of single field \u0026quot;r-\u0026gt;arp_ha.sa_data\u0026quot; at net/ipv4/arp.c:1128 (size 14)\nWARNING: CPU: 0 PID: 144638 at net/ipv4/arp.c:1128 arp_req_get+0x411/0x4a0 net/ipv4/arp.c:1128\nModules linked in:\nCPU: 0 PID: 144638 Comm: syz-executor.4 Not tainted 6.1.74 #31\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-5 04/01/2014\nRIP: 0010:arp_req_get+0x411/0x4a0 net/ipv4/arp.c:1128\nCode: fd ff ff e8 41 42 de fb b9 0e 00 00 00 4c 89 fe 48 c7 c2 20 6d ab 87 48 c7 c7 80 6d ab 87 c6 05 25 af 72 04 01 e8 5f 8d ad fb \u0026lt;0f\u0026gt; 0b e9 6c fd ff ff e8 13 42 de fb be 03 00 00 00 4c 89 e7 e8 a6\nRSP: 0018:ffffc900050b7998 EFLAGS: 00010286\nRAX: 0000000000000000 RBX: ffff88803a815000 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: ffffffff8641a44a RDI: 0000000000000001\nRBP: ffffc900050b7a98 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000000 R11: 203a7970636d656d R12: ffff888039c54000\nR13: 1ffff92000a16f37 R14: ffff88803a815084 R15: 0000000000000010\nFS:  00007f172bf306c0(0000) GS:ffff88805aa00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f172b3569f0 CR3: 0000000057f12005 CR4: 0000000000770ef0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n \u0026lt;TASK\u0026gt;\n arp_ioctl+0x33f/0x4b0 net/ipv4/arp.c:1261\n inet_ioctl+0x314/0x3a0 net/ipv4/af_inet.c:981\n sock_do_ioctl+0xdf/0x260 net/socket.c:1204\n sock_ioctl+0x3ef/0x650 net/socket.c:1321\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:870 [inline]\n __se_sys_ioctl fs/ioctl.c:856 [inline]\n __x64_sys_ioctl+0x18e/0x220 fs/ioctl.c:856\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x37/0x90 arch/x86/entry/common.c:81\n entry_SYSCALL_64_after_hwframe+0x64/0xce\nRIP: 0033:0x7f172b262b8d\nCode: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f172bf300b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 00007f172b3abf80 RCX: 00007f172b262b8d\nRDX: 0000000020000000 RSI: 0000000000008954 RDI: 0000000000000003\nRBP: 00007f172b2d3493 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 000000000000000b R14: 00007f172b3abf80 R15: 00007f172bf10000\n \u0026lt;/TASK\u0026gt;(CVE-2024-26733)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nipv6: sr: fix possible use-after-free and null-ptr-deref\r\n\r\nThe pernet operations structure for the subsystem must be registered\nbefore registering the generic netlink family.(CVE-2024-26735)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/sched: act_mirred: don\u0026apos;t override retval if we already lost the skb\r\n\r\nIf we\u0026apos;re redirecting the skb, and haven\u0026apos;t called tcf_mirred_forward(),\nyet, we need to tell the core to drop the skb by setting the retcode\nto SHOT. If we have called tcf_mirred_forward(), however, the skb\nis out of our hands and returning SHOT will lead to UaF.\r\n\r\nMove the retval override to the error path which actually need it.(CVE-2024-26739)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/sched: act_mirred: use the backlog for mirred ingress\r\n\r\nThe test Davide added in commit ca22da2fbd69 (\u0026quot;act_mirred: use the backlog\nfor nested calls to mirred ingress\u0026quot;) hangs our testing VMs every 10 or so\nruns, with the familiar tcp_v4_rcv -\u0026gt; tcp_v4_rcv deadlock reported by\nlockdep.\r\n\r\nThe problem as previously described by Davide (see Link) is that\nif we reverse flow of traffic with the redirect (egress -\u0026gt; ingress)\nwe may reach the same socket which generated the packet. And we may\nstill be holding its socket lock. The common solution to such deadlocks\nis to put the packet in the Rx backlog, rather than run the Rx path\ninline. Do that for all egress -\u0026gt; ingress reversals, not just once\nwe started to nest mirred calls.\r\n\r\nIn the past there was a concern that the backlog indirection will\nlead to loss of error reporting / less accurate stats. But the current\nworkaround does not seem to address the issue.(CVE-2024-26740)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nRDMA/qedr: Fix qedr_create_user_qp error flow\r\n\r\nAvoid the following warning by making sure to free the allocated\nresources in case that qedr_init_user_queue() fail.\r\n\r\n-----------[ cut here ]-----------\nWARNING: CPU: 0 PID: 143192 at drivers/infiniband/core/rdma_core.c:874 uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]\nModules linked in: tls target_core_user uio target_core_pscsi target_core_file target_core_iblock ib_srpt ib_srp scsi_transport_srp nfsd nfs_acl rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs 8021q garp mrp stp llc ext4 mbcache jbd2 opa_vnic ib_umad ib_ipoib sunrpc rdma_ucm ib_isert iscsi_target_mod target_core_mod ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm hfi1 intel_rapl_msr intel_rapl_common mgag200 qedr sb_edac drm_shmem_helper rdmavt x86_pkg_temp_thermal drm_kms_helper intel_powerclamp ib_uverbs coretemp i2c_algo_bit kvm_intel dell_wmi_descriptor ipmi_ssif sparse_keymap kvm ib_core rfkill syscopyarea sysfillrect video sysimgblt irqbypass ipmi_si ipmi_devintf fb_sys_fops rapl iTCO_wdt mxm_wmi iTCO_vendor_support intel_cstate pcspkr dcdbas intel_uncore ipmi_msghandler lpc_ich acpi_power_meter mei_me mei fuse drm xfs libcrc32c qede sd_mod ahci libahci t10_pi sg crct10dif_pclmul crc32_pclmul crc32c_intel qed libata tg3\nghash_clmulni_intel megaraid_sas crc8 wmi [last unloaded: ib_srpt]\nCPU: 0 PID: 143192 Comm: fi_rdm_tagged_p Kdump: loaded Not tainted 5.14.0-408.el9.x86_64 #1\nHardware name: Dell Inc. PowerEdge R430/03XKDV, BIOS 2.14.0 01/25/2022\nRIP: 0010:uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]\nCode: 5d 41 5c 41 5d 41 5e e9 0f 26 1b dd 48 89 df e8 67 6a ff ff 49 8b 86 10 01 00 00 48 85 c0 74 9c 4c 89 e7 e8 83 c0 cb dd eb 92 \u0026lt;0f\u0026gt; 0b eb be 0f 0b be 04 00 00 00 48 89 df e8 8e f5 ff ff e9 6d ff\nRSP: 0018:ffffb7c6cadfbc60 EFLAGS: 00010286\nRAX: ffff8f0889ee3f60 RBX: ffff8f088c1a5200 RCX: 00000000802a0016\nRDX: 00000000802a0017 RSI: 0000000000000001 RDI: ffff8f0880042600\nRBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000\nR10: ffff8f11fffd5000 R11: 0000000000039000 R12: ffff8f0d5b36cd80\nR13: ffff8f088c1a5250 R14: ffff8f1206d91000 R15: 0000000000000000\nFS: 0000000000000000(0000) GS:ffff8f11d7c00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000147069200e20 CR3: 00000001c7210002 CR4: 00000000001706f0\nCall Trace:\n\u0026lt;TASK\u0026gt;\n? show_trace_log_lvl+0x1c4/0x2df\n? show_trace_log_lvl+0x1c4/0x2df\n? ib_uverbs_close+0x1f/0xb0 [ib_uverbs]\n? uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]\n? __warn+0x81/0x110\n? uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]\n? report_bug+0x10a/0x140\n? handle_bug+0x3c/0x70\n? exc_invalid_op+0x14/0x70\n? asm_exc_invalid_op+0x16/0x20\n? uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]\nib_uverbs_close+0x1f/0xb0 [ib_uverbs]\n__fput+0x94/0x250\ntask_work_run+0x5c/0x90\ndo_exit+0x270/0x4a0\ndo_group_exit+0x2d/0x90\nget_signal+0x87c/0x8c0\narch_do_signal_or_restart+0x25/0x100\n? ib_uverbs_ioctl+0xc2/0x110 [ib_uverbs]\nexit_to_user_mode_loop+0x9c/0x130\nexit_to_user_mode_prepare+0xb6/0x100\nsyscall_exit_to_user_mode+0x12/0x40\ndo_syscall_64+0x69/0x90\n? syscall_exit_work+0x103/0x130\n? syscall_exit_to_user_mode+0x22/0x40\n? do_syscall_64+0x69/0x90\n? syscall_exit_work+0x103/0x130\n? syscall_exit_to_user_mode+0x22/0x40\n? do_syscall_64+0x69/0x90\n? do_syscall_64+0x69/0x90\n? common_interrupt+0x43/0xa0\nentry_SYSCALL_64_after_hwframe+0x72/0xdc\nRIP: 0033:0x1470abe3ec6b\nCode: Unable to access opcode bytes at RIP 0x1470abe3ec41.\nRSP: 002b:00007fff13ce9108 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: fffffffffffffffc RBX: 00007fff13ce9218 RCX: 00001470abe3ec6b\nRDX: 00007fff13ce9200 RSI: 00000000c0181b01 RDI: 0000000000000004\nRBP: 00007fff13ce91e0 R08: 0000558d9655da10 R09: 0000558d9655dd00\nR10: 00007fff13ce95c0 R11: 0000000000000246 R12: 00007fff13ce9358\nR13: 0000000000000013 R14: 0000558d9655db50 R15: 00007fff13ce9470\n\u0026lt;/TASK\u0026gt;\n--[ end trace 888a9b92e04c5c97 ]--(CVE-2024-26743)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nRDMA/srpt: Support specifying the srpt_service_guid parameter\r\n\r\nMake loading ib_srpt with this parameter set work. The current behavior is\nthat setting that parameter while loading the ib_srpt kernel module\ntriggers the following kernel crash:\r\n\r\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nCall Trace:\n \u0026lt;TASK\u0026gt;\n parse_one+0x18c/0x1d0\n parse_args+0xe1/0x230\n load_module+0x8de/0xa60\n init_module_from_file+0x8b/0xd0\n idempotent_init_module+0x181/0x240\n __x64_sys_finit_module+0x5a/0xb0\n do_syscall_64+0x5f/0xe0\n entry_SYSCALL_64_after_hwframe+0x6e/0x76(CVE-2024-26744)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ngtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()\r\n\r\nThe gtp_net_ops pernet operations structure for the subsystem must be\nregistered before registering the generic netlink family.\r\n\r\nSyzkaller hit \u0026apos;general protection fault in gtp_genl_dump_pdp\u0026apos; bug:\r\n\r\ngeneral protection fault, probably for non-canonical address\n0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN NOPTI\nKASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\nCPU: 1 PID: 5826 Comm: gtp Not tainted 6.8.0-rc3-std-def-alt1 #1\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-alt1 04/01/2014\nRIP: 0010:gtp_genl_dump_pdp+0x1be/0x800 [gtp]\nCode: c6 89 c6 e8 64 e9 86 df 58 45 85 f6 0f 85 4e 04 00 00 e8 c5 ee 86\n      df 48 8b 54 24 18 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 \u0026lt;80\u0026gt;\n      3c 02 00 0f 85 de 05 00 00 48 8b 44 24 18 4c 8b 30 4c 39 f0 74\nRSP: 0018:ffff888014107220 EFLAGS: 00010202\nRAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000\nRDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000\nRBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000\nR13: ffff88800fcda588 R14: 0000000000000001 R15: 0000000000000000\nFS:  00007f1be4eb05c0(0000) GS:ffff88806ce80000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f1be4e766cf CR3: 000000000c33e000 CR4: 0000000000750ef0\nPKRU: 55555554\nCall Trace:\n \u0026lt;TASK\u0026gt;\n ? show_regs+0x90/0xa0\n ? die_addr+0x50/0xd0\n ? exc_general_protection+0x148/0x220\n ? asm_exc_general_protection+0x22/0x30\n ? gtp_genl_dump_pdp+0x1be/0x800 [gtp]\n ? __alloc_skb+0x1dd/0x350\n ? __pfx___alloc_skb+0x10/0x10\n genl_dumpit+0x11d/0x230\n netlink_dump+0x5b9/0xce0\n ? lockdep_hardirqs_on_prepare+0x253/0x430\n ? __pfx_netlink_dump+0x10/0x10\n ? kasan_save_track+0x10/0x40\n ? __kasan_kmalloc+0x9b/0xa0\n ? genl_start+0x675/0x970\n __netlink_dump_start+0x6fc/0x9f0\n genl_family_rcv_msg_dumpit+0x1bb/0x2d0\n ? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10\n ? genl_op_from_small+0x2a/0x440\n ? cap_capable+0x1d0/0x240\n ? __pfx_genl_start+0x10/0x10\n ? __pfx_genl_dumpit+0x10/0x10\n ? __pfx_genl_done+0x10/0x10\n ? security_capable+0x9d/0xe0(CVE-2024-26754)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndm-crypt: don\u0026apos;t modify the data when using authenticated encryption\r\n\r\nIt was said that authenticated encryption could produce invalid tag when\nthe data that is being encrypted is modified [1]. So, fix this problem by\ncopying the data into the clone bio first and then encrypt them inside the\nclone bio.\r\n\r\nThis may reduce performance, but it is needed to prevent the user from\ncorrupting the device by writing data with O_DIRECT and modifying them at\nthe same time.\r\n\r\n[1] https://lore.kernel.org/all/20240207004723.GA35324@sol.localdomain/T/(CVE-2024-26763)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbtrfs: dev-replace: properly validate device names\r\n\r\nThere\u0026apos;s a syzbot report that device name buffers passed to device\nreplace are not properly checked for string termination which could lead\nto a read out of bounds in getname_kernel().\r\n\r\nAdd a helper that validates both source and target device name buffers.\nFor devid as the source initialize the buffer to empty string in case\nsomething tries to read it later.\r\n\r\nThis was originally analyzed and fixed in a different way by Edward Adam\nDavis (see links).(CVE-2024-26791)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ngtp: fix use-after-free and null-ptr-deref in gtp_newlink()\r\n\r\nThe gtp_link_ops operations structure for the subsystem must be\nregistered after registering the gtp_net_ops pernet operations structure.\r\n\r\nSyzkaller hit \u0026apos;general protection fault in gtp_genl_dump_pdp\u0026apos; bug:\r\n\r\n[ 1010.702740] gtp: GTP module unloaded\n[ 1010.715877] general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI\n[ 1010.715888] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\n[ 1010.715895] CPU: 1 PID: 128616 Comm: a.out Not tainted 6.8.0-rc6-std-def-alt1 #1\n[ 1010.715899] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-alt1 04/01/2014\n[ 1010.715908] RIP: 0010:gtp_newlink+0x4d7/0x9c0 [gtp]\n[ 1010.715915] Code: 80 3c 02 00 0f 85 41 04 00 00 48 8b bb d8 05 00 00 e8 ed f6 ff ff 48 89 c2 48 89 c5 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 \u0026lt;80\u0026gt; 3c 02 00 0f 85 4f 04 00 00 4c 89 e2 4c 8b 6d 00 48 b8 00 00 00\n[ 1010.715920] RSP: 0018:ffff888020fbf180 EFLAGS: 00010203\n[ 1010.715929] RAX: dffffc0000000000 RBX: ffff88800399c000 RCX: 0000000000000000\n[ 1010.715933] RDX: 0000000000000001 RSI: ffffffff84805280 RDI: 0000000000000282\n[ 1010.715938] RBP: 000000000000000d R08: 0000000000000001 R09: 0000000000000000\n[ 1010.715942] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88800399cc80\n[ 1010.715947] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000400\n[ 1010.715953] FS:  00007fd1509ab5c0(0000) GS:ffff88805b300000(0000) knlGS:0000000000000000\n[ 1010.715958] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 1010.715962] CR2: 0000000000000000 CR3: 000000001c07a000 CR4: 0000000000750ee0\n[ 1010.715968] PKRU: 55555554\n[ 1010.715972] Call Trace:\n[ 1010.715985]  ? __die_body.cold+0x1a/0x1f\n[ 1010.715995]  ? die_addr+0x43/0x70\n[ 1010.716002]  ? exc_general_protection+0x199/0x2f0\n[ 1010.716016]  ? asm_exc_general_protection+0x1e/0x30\n[ 1010.716026]  ? gtp_newlink+0x4d7/0x9c0 [gtp]\n[ 1010.716034]  ? gtp_net_exit+0x150/0x150 [gtp]\n[ 1010.716042]  __rtnl_newlink+0x1063/0x1700\n[ 1010.716051]  ? rtnl_setlink+0x3c0/0x3c0\n[ 1010.716063]  ? is_bpf_text_address+0xc0/0x1f0\n[ 1010.716070]  ? kernel_text_address.part.0+0xbb/0xd0\n[ 1010.716076]  ? __kernel_text_address+0x56/0xa0\n[ 1010.716084]  ? unwind_get_return_address+0x5a/0xa0\n[ 1010.716091]  ? create_prof_cpu_mask+0x30/0x30\n[ 1010.716098]  ? arch_stack_walk+0x9e/0xf0\n[ 1010.716106]  ? stack_trace_save+0x91/0xd0\n[ 1010.716113]  ? stack_trace_consume_entry+0x170/0x170\n[ 1010.716121]  ? __lock_acquire+0x15c5/0x5380\n[ 1010.716139]  ? mark_held_locks+0x9e/0xe0\n[ 1010.716148]  ? kmem_cache_alloc_trace+0x35f/0x3c0\n[ 1010.716155]  ? __rtnl_newlink+0x1700/0x1700\n[ 1010.716160]  rtnl_newlink+0x69/0xa0\n[ 1010.716166]  rtnetlink_rcv_msg+0x43b/0xc50\n[ 1010.716172]  ? rtnl_fdb_dump+0x9f0/0x9f0\n[ 1010.716179]  ? lock_acquire+0x1fe/0x560\n[ 1010.716188]  ? netlink_deliver_tap+0x12f/0xd50\n[ 1010.716196]  netlink_rcv_skb+0x14d/0x440\n[ 1010.716202]  ? rtnl_fdb_dump+0x9f0/0x9f0\n[ 1010.716208]  ? netlink_ack+0xab0/0xab0\n[ 1010.716213]  ? netlink_deliver_tap+0x202/0xd50\n[ 1010.716220]  ? netlink_deliver_tap+0x218/0xd50\n[ 1010.716226]  ? __virt_addr_valid+0x30b/0x590\n[ 1010.716233]  netlink_unicast+0x54b/0x800\n[ 1010.716240]  ? netlink_attachskb+0x870/0x870\n[ 1010.716248]  ? __check_object_size+0x2de/0x3b0\n[ 1010.716254]  netlink_sendmsg+0x938/0xe40\n[ 1010.716261]  ? netlink_unicast+0x800/0x800\n[ 1010.716269]  ? __import_iovec+0x292/0x510\n[ 1010.716276]  ? netlink_unicast+0x800/0x800\n[ 1010.716284]  __sock_sendmsg+0x159/0x190\n[ 1010.716290]  ____sys_sendmsg+0x712/0x880\n[ 1010.716297]  ? sock_write_iter+0x3d0/0x3d0\n[ 1010.716304]  ? __ia32_sys_recvmmsg+0x270/0x270\n[ 1010.716309]  ? lock_acquire+0x1fe/0x560\n[ 1010.716315]  ? drain_array_locked+0x90/0x90\n[ 1010.716324]  ___sys_sendmsg+0xf8/0x170\n[ 1010.716331]  ? sendmsg_copy_msghdr+0x170/0x170\n[ 1010.716337]  ? lockdep_init_map\n---truncated---(CVE-2024-26793)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nBluetooth: Avoid potential use-after-free in hci_error_reset\r\n\r\nWhile handling the HCI_EV_HARDWARE_ERROR event, if the underlying\nBT controller is not responding, the GPIO reset mechanism would\nfree the hci_dev and lead to a use-after-free in hci_error_reset.\r\n\r\nHere\u0026apos;s the call trace observed on a ChromeOS device with Intel AX201:\n   queue_work_on+0x3e/0x6c\n   __hci_cmd_sync_sk+0x2ee/0x4c0 [bluetooth \u0026lt;HASH:3b4a6\u0026gt;]\n   ? init_wait_entry+0x31/0x31\n   __hci_cmd_sync+0x16/0x20 [bluetooth \u0026lt;HASH:3b4a 6\u0026gt;]\n   hci_error_reset+0x4f/0xa4 [bluetooth \u0026lt;HASH:3b4a 6\u0026gt;]\n   process_one_work+0x1d8/0x33f\n   worker_thread+0x21b/0x373\n   kthread+0x13a/0x152\n   ? pr_cont_work+0x54/0x54\n   ? kthread_blkcg+0x31/0x31\n    ret_from_fork+0x1f/0x30\r\n\r\nThis patch holds the reference count on the hci_dev while processing\na HCI_EV_HARDWARE_ERROR event to avoid potential crash.(CVE-2024-26801)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: ip_tunnel: prevent perpetual headroom growth\r\n\r\nsyzkaller triggered following kasan splat:\nBUG: KASAN: use-after-free in __skb_flow_dissect+0x19d1/0x7a50 net/core/flow_dissector.c:1170\nRead of size 1 at addr ffff88812fb4000e by task syz-executor183/5191\n[..]\n kasan_report+0xda/0x110 mm/kasan/report.c:588\n __skb_flow_dissect+0x19d1/0x7a50 net/core/flow_dissector.c:1170\n skb_flow_dissect_flow_keys include/linux/skbuff.h:1514 [inline]\n ___skb_get_hash net/core/flow_dissector.c:1791 [inline]\n __skb_get_hash+0xc7/0x540 net/core/flow_dissector.c:1856\n skb_get_hash include/linux/skbuff.h:1556 [inline]\n ip_tunnel_xmit+0x1855/0x33c0 net/ipv4/ip_tunnel.c:748\n ipip_tunnel_xmit+0x3cc/0x4e0 net/ipv4/ipip.c:308\n __netdev_start_xmit include/linux/netdevice.h:4940 [inline]\n netdev_start_xmit include/linux/netdevice.h:4954 [inline]\n xmit_one net/core/dev.c:3548 [inline]\n dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3564\n __dev_queue_xmit+0x7c1/0x3d60 net/core/dev.c:4349\n dev_queue_xmit include/linux/netdevice.h:3134 [inline]\n neigh_connected_output+0x42c/0x5d0 net/core/neighbour.c:1592\n ...\n ip_finish_output2+0x833/0x2550 net/ipv4/ip_output.c:235\n ip_finish_output+0x31/0x310 net/ipv4/ip_output.c:323\n ..\n iptunnel_xmit+0x5b4/0x9b0 net/ipv4/ip_tunnel_core.c:82\n ip_tunnel_xmit+0x1dbc/0x33c0 net/ipv4/ip_tunnel.c:831\n ipgre_xmit+0x4a1/0x980 net/ipv4/ip_gre.c:665\n __netdev_start_xmit include/linux/netdevice.h:4940 [inline]\n netdev_start_xmit include/linux/netdevice.h:4954 [inline]\n xmit_one net/core/dev.c:3548 [inline]\n dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3564\n ...\r\n\r\nThe splat occurs because skb-\u0026gt;data points past skb-\u0026gt;head allocated area.\nThis is because neigh layer does:\n  __skb_pull(skb, skb_network_offset(skb));\r\n\r\n... but skb_network_offset() returns a negative offset and __skb_pull()\narg is unsigned.  IOW, we skb-\u0026gt;data gets \u0026quot;adjusted\u0026quot; by a huge value.\r\n\r\nThe negative value is returned because skb-\u0026gt;head and skb-\u0026gt;data distance is\nmore than 64k and skb-\u0026gt;network_header (u16) has wrapped around.\r\n\r\nThe bug is in the ip_tunnel infrastructure, which can cause\ndev-\u0026gt;needed_headroom to increment ad infinitum.\r\n\r\nThe syzkaller reproducer consists of packets getting routed via a gre\ntunnel, and route of gre encapsulated packets pointing at another (ipip)\ntunnel.  The ipip encapsulation finds gre0 as next output device.\r\n\r\nThis results in the following pattern:\r\n\r\n1). First packet is to be sent out via gre0.\nRoute lookup found an output device, ipip0.\r\n\r\n2).\nip_tunnel_xmit for gre0 bumps gre0-\u0026gt;needed_headroom based on the future\noutput device, rt.dev-\u0026gt;needed_headroom (ipip0).\r\n\r\n3).\nip output / start_xmit moves skb on to ipip0. which runs the same\ncode path again (xmit recursion).\r\n\r\n4).\nRouting step for the post-gre0-encap packet finds gre0 as output device\nto use for ipip0 encapsulated packet.\r\n\r\ntunl0-\u0026gt;needed_headroom is then incremented based on the (already bumped)\ngre0 device headroom.\r\n\r\nThis repeats for every future packet:\r\n\r\ngre0-\u0026gt;needed_headroom gets inflated because previous packets\u0026apos; ipip0 step\nincremented rt-\u0026gt;dev (gre0) headroom, and ipip0 incremented because gre0\nneeded_headroom was increased.\r\n\r\nFor each subsequent packet, gre/ipip0-\u0026gt;needed_headroom grows until\npost-expand-head reallocations result in a skb-\u0026gt;head/data distance of\nmore than 64k.\r\n\r\nOnce that happens, skb-\u0026gt;network_header (u16) wraps around when\npskb_expand_head tries to make sure that skb_network_offset() is unchanged\nafter the headroom expansion/reallocation.\r\n\r\nAfter this skb_network_offset(skb) returns a different (and negative)\nresult post headroom expansion.\r\n\r\nThe next trip to neigh layer (or anything else that would __skb_pull the\nnetwork header) makes skb-\u0026gt;data point to a memory location outside\nskb-\u0026gt;head area.\r\n\r\nv2: Cap the needed_headroom update to an arbitarily chosen upperlimit to\nprevent perpetual increase instead of dropping the headroom increment\ncompletely.(CVE-2024-26804)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetlink: Fix kernel-infoleak-after-free in __skb_datagram_iter\r\n\r\nsyzbot reported the following uninit-value access issue [1]:\r\n\r\nnetlink_to_full_skb() creates a new `skb` and puts the `skb-\u0026gt;data`\npassed as a 1st arg of netlink_to_full_skb() onto new `skb`. The data\nsize is specified as `len` and passed to skb_put_data(). This `len`\nis based on `skb-\u0026gt;end` that is not data offset but buffer offset. The\n`skb-\u0026gt;end` contains data and tailroom. Since the tailroom is not\ninitialized when the new `skb` created, KMSAN detects uninitialized\nmemory area when copying the data.\r\n\r\nThis patch resolved this issue by correct the len from `skb-\u0026gt;end` to\n`skb-\u0026gt;len`, which is the actual data offset.\r\n\r\nBUG: KMSAN: kernel-infoleak-after-free in instrument_copy_to_user include/linux/instrumented.h:114 [inline]\nBUG: KMSAN: kernel-infoleak-after-free in copy_to_user_iter lib/iov_iter.c:24 [inline]\nBUG: KMSAN: kernel-infoleak-after-free in iterate_ubuf include/linux/iov_iter.h:29 [inline]\nBUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance2 include/linux/iov_iter.h:245 [inline]\nBUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance include/linux/iov_iter.h:271 [inline]\nBUG: KMSAN: kernel-infoleak-after-free in _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186\n instrument_copy_to_user include/linux/instrumented.h:114 [inline]\n copy_to_user_iter lib/iov_iter.c:24 [inline]\n iterate_ubuf include/linux/iov_iter.h:29 [inline]\n iterate_and_advance2 include/linux/iov_iter.h:245 [inline]\n iterate_and_advance include/linux/iov_iter.h:271 [inline]\n _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186\n copy_to_iter include/linux/uio.h:197 [inline]\n simple_copy_to_iter+0x68/0xa0 net/core/datagram.c:532\n __skb_datagram_iter+0x123/0xdc0 net/core/datagram.c:420\n skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:546\n skb_copy_datagram_msg include/linux/skbuff.h:3960 [inline]\n packet_recvmsg+0xd9c/0x2000 net/packet/af_packet.c:3482\n sock_recvmsg_nosec net/socket.c:1044 [inline]\n sock_recvmsg net/socket.c:1066 [inline]\n sock_read_iter+0x467/0x580 net/socket.c:1136\n call_read_iter include/linux/fs.h:2014 [inline]\n new_sync_read fs/read_write.c:389 [inline]\n vfs_read+0x8f6/0xe00 fs/read_write.c:470\n ksys_read+0x20f/0x4c0 fs/read_write.c:613\n __do_sys_read fs/read_write.c:623 [inline]\n __se_sys_read fs/read_write.c:621 [inline]\n __x64_sys_read+0x93/0xd0 fs/read_write.c:621\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nUninit was stored to memory at:\n skb_put_data include/linux/skbuff.h:2622 [inline]\n netlink_to_full_skb net/netlink/af_netlink.c:181 [inline]\n __netlink_deliver_tap_skb net/netlink/af_netlink.c:298 [inline]\n __netlink_deliver_tap+0x5be/0xc90 net/netlink/af_netlink.c:325\n netlink_deliver_tap net/netlink/af_netlink.c:338 [inline]\n netlink_deliver_tap_kernel net/netlink/af_netlink.c:347 [inline]\n netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]\n netlink_unicast+0x10f1/0x1250 net/netlink/af_netlink.c:1368\n netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg net/socket.c:745 [inline]\n ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584\n ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638\n __sys_sendmsg net/socket.c:2667 [inline]\n __do_sys_sendmsg net/socket.c:2676 [inline]\n __se_sys_sendmsg net/socket.c:2674 [inline]\n __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nUninit was created at:\n free_pages_prepare mm/page_alloc.c:1087 [inline]\n free_unref_page_prepare+0xb0/0xa40 mm/page_alloc.c:2347\n free_unref_page_list+0xeb/0x1100 mm/page_alloc.c:2533\n release_pages+0x23d3/0x2410 mm/swap.c:1042\n free_pages_and_swap_cache+0xd9/0xf0 mm/swap_state.c:316\n tlb_batch_pages\n---truncated---(CVE-2024-26805)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nvfio/pci: Create persistent INTx handler\r\n\r\nA vulnerability exists where the eventfd for INTx signaling can be\ndeconfigured, which unregisters the IRQ handler but still allows\neventfds to be signaled with a NULL context through the SET_IRQS ioctl\nor through unmask irqfd if the device interrupt is pending.\r\n\r\nIdeally this could be solved with some additional locking; the igate\nmutex serializes the ioctl and config space accesses, and the interrupt\nhandler is unregistered relative to the trigger, but the irqfd path\nruns asynchronous to those.  The igate mutex cannot be acquired from the\natomic context of the eventfd wake function.  Disabling the irqfd\nrelative to the eventfd registration is potentially incompatible with\nexisting userspace.\r\n\r\nAs a result, the solution implemented here moves configuration of the\nINTx interrupt handler to track the lifetime of the INTx context object\nand irq_type configuration, rather than registration of a particular\ntrigger eventfd.  Synchronization is added between the ioctl path and\neventfd_signal() wrapper such that the eventfd trigger can be\ndynamically updated relative to in-flight interrupts or irqfd callbacks.(CVE-2024-26812)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nvfio/platform: Create persistent IRQ handlers\r\n\r\nThe vfio-platform SET_IRQS ioctl currently allows loopback triggering of\nan interrupt before a signaling eventfd has been configured by the user,\nwhich thereby allows a NULL pointer dereference.\r\n\r\nRather than register the IRQ relative to a valid trigger, register all\nIRQs in a disabled state in the device open path.  This allows mask\noperations on the IRQ to nest within the overall enable state governed\nby a valid eventfd signal.  This decouples @masked, protected by the\n@locked spinlock from @trigger, protected via the @igate mutex.\r\n\r\nIn doing so, it\u0026apos;s guaranteed that changes to @trigger cannot race the\nIRQ handlers because the IRQ handler is synchronously disabled before\nmodifying the trigger, and loopback triggering of the IRQ via ioctl is\nsafe due to serialization with trigger changes via igate.\r\n\r\nFor compatibility, request_irq() failures are maintained to be local to\nthe SET_IRQS ioctl rather than a fatal error in the open device path.\nThis allows, for example, a userspace driver with polling mode support\nto continue to work regardless of moving the request_irq() call site.\nThis necessarily blocks all SET_IRQS access to the failed index.(CVE-2024-26813)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\namdkfd: use calloc instead of kzalloc to avoid integer overflow\r\n\r\nThis uses calloc instead of doing the multiplication which might\noverflow.(CVE-2024-26817)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ncifs: fix underflow in parse_server_interfaces()\r\n\r\nIn this loop, we step through the buffer and after each item we check\nif the size_left is greater than the minimum size we need.  However,\nthe problem is that \u0026quot;bytes_left\u0026quot; is type ssize_t while sizeof() is type\nsize_t.  That means that because of type promotion, the comparison is\ndone as an unsigned and if we have negative bytes left the loop\ncontinues instead of ending.(CVE-2024-26828)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nIB/hfi1: Fix a memleak in init_credit_return\r\n\r\nWhen dma_alloc_coherent fails to allocate dd-\u0026gt;cr_base[i].va,\ninit_credit_return should deallocate dd-\u0026gt;cr_base and\ndd-\u0026gt;cr_base[i] that allocated before. Or those resources\nwould be never freed and a memleak is triggered.(CVE-2024-26839)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ncachefiles: fix memory leak in cachefiles_add_cache()\r\n\r\nThe following memory leak was reported after unbinding /dev/cachefiles:\r\n\r\n==================================================================\nunreferenced object 0xffff9b674176e3c0 (size 192):\n  comm \u0026quot;cachefilesd2\u0026quot;, pid 680, jiffies 4294881224\n  hex dump (first 32 bytes):\n    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace (crc ea38a44b):\n    [\u0026lt;ffffffff8eb8a1a5\u0026gt;] kmem_cache_alloc+0x2d5/0x370\n    [\u0026lt;ffffffff8e917f86\u0026gt;] prepare_creds+0x26/0x2e0\n    [\u0026lt;ffffffffc002eeef\u0026gt;] cachefiles_determine_cache_security+0x1f/0x120\n    [\u0026lt;ffffffffc00243ec\u0026gt;] cachefiles_add_cache+0x13c/0x3a0\n    [\u0026lt;ffffffffc0025216\u0026gt;] cachefiles_daemon_write+0x146/0x1c0\n    [\u0026lt;ffffffff8ebc4a3b\u0026gt;] vfs_write+0xcb/0x520\n    [\u0026lt;ffffffff8ebc5069\u0026gt;] ksys_write+0x69/0xf0\n    [\u0026lt;ffffffff8f6d4662\u0026gt;] do_syscall_64+0x72/0x140\n    [\u0026lt;ffffffff8f8000aa\u0026gt;] entry_SYSCALL_64_after_hwframe+0x6e/0x76\n==================================================================\r\n\r\nPut the reference count of cache_cred in cachefiles_daemon_unbind() to\nfix the problem. And also put cache_cred in cachefiles_add_cache() error\nbranch to avoid memory leaks.(CVE-2024-26840)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnvme-fc: do not wait in vain when unloading module\r\n\r\nThe module exit path has race between deleting all controllers and\nfreeing \u0026apos;left over IDs\u0026apos;. To prevent double free a synchronization\nbetween nvme_delete_ctrl and ida_destroy has been added by the initial\ncommit.\r\n\r\nThere is some logic around trying to prevent from hanging forever in\nwait_for_completion, though it does not handling all cases. E.g.\nblktests is able to reproduce the situation where the module unload\nhangs forever.\r\n\r\nIf we completely rely on the cleanup code executed from the\nnvme_delete_ctrl path, all IDs will be freed eventually. This makes\ncalling ida_destroy unnecessary. We only have to ensure that all\nnvme_delete_ctrl code has been executed before we leave\nnvme_fc_exit_module. This is done by flushing the nvme_delete_wq\nworkqueue.\r\n\r\nWhile at it, remove the unused nvme_fc_wq workqueue too.(CVE-2024-26846)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/ipv6: avoid possible UAF in ip6_route_mpath_notify()\r\n\r\nsyzbot found another use-after-free in ip6_route_mpath_notify() [1]\r\n\r\nCommit f7225172f25a (\u0026quot;net/ipv6: prevent use after free in\nip6_route_mpath_notify\u0026quot;) was not able to fix the root cause.\r\n\r\nWe need to defer the fib6_info_release() calls after\nip6_route_mpath_notify(), in the cleanup phase.\r\n\r\n[1]\nBUG: KASAN: slab-use-after-free in rt6_fill_node+0x1460/0x1ac0\nRead of size 4 at addr ffff88809a07fc64 by task syz-executor.2/23037\r\n\r\nCPU: 0 PID: 23037 Comm: syz-executor.2 Not tainted 6.8.0-rc4-syzkaller-01035-gea7f3cfaa588 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024\nCall Trace:\n \u0026lt;TASK\u0026gt;\n  __dump_stack lib/dump_stack.c:88 [inline]\n  dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106\n  print_address_description mm/kasan/report.c:377 [inline]\n  print_report+0x167/0x540 mm/kasan/report.c:488\n  kasan_report+0x142/0x180 mm/kasan/report.c:601\n rt6_fill_node+0x1460/0x1ac0\n  inet6_rt_notify+0x13b/0x290 net/ipv6/route.c:6184\n  ip6_route_mpath_notify net/ipv6/route.c:5198 [inline]\n  ip6_route_multipath_add net/ipv6/route.c:5404 [inline]\n  inet6_rtm_newroute+0x1d0f/0x2300 net/ipv6/route.c:5517\n  rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6597\n  netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543\n  netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]\n  netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367\n  netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg+0x221/0x270 net/socket.c:745\n  ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584\n  ___sys_sendmsg net/socket.c:2638 [inline]\n  __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667\n do_syscall_64+0xf9/0x240\n entry_SYSCALL_64_after_hwframe+0x6f/0x77\nRIP: 0033:0x7f73dd87dda9\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f73de6550c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 00007f73dd9ac050 RCX: 00007f73dd87dda9\nRDX: 0000000000000000 RSI: 0000000020000140 RDI: 0000000000000005\nRBP: 00007f73dd8ca47a R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 000000000000006e R14: 00007f73dd9ac050 R15: 00007ffdbdeb7858\n \u0026lt;/TASK\u0026gt;\r\n\r\nAllocated by task 23037:\n  kasan_save_stack mm/kasan/common.c:47 [inline]\n  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n  poison_kmalloc_redzone mm/kasan/common.c:372 [inline]\n  __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:389\n  kasan_kmalloc include/linux/kasan.h:211 [inline]\n  __do_kmalloc_node mm/slub.c:3981 [inline]\n  __kmalloc+0x22e/0x490 mm/slub.c:3994\n  kmalloc include/linux/slab.h:594 [inline]\n  kzalloc include/linux/slab.h:711 [inline]\n  fib6_info_alloc+0x2e/0xf0 net/ipv6/ip6_fib.c:155\n  ip6_route_info_create+0x445/0x12b0 net/ipv6/route.c:3758\n  ip6_route_multipath_add net/ipv6/route.c:5298 [inline]\n  inet6_rtm_newroute+0x744/0x2300 net/ipv6/route.c:5517\n  rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6597\n  netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543\n  netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]\n  netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367\n  netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg+0x221/0x270 net/socket.c:745\n  ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584\n  ___sys_sendmsg net/socket.c:2638 [inline]\n  __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667\n do_syscall_64+0xf9/0x240\n entry_SYSCALL_64_after_hwframe+0x6f/0x77\r\n\r\nFreed by task 16:\n  kasan_save_stack mm/kasan/common.c:47 [inline]\n  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n  kasan_save_free_info+0x4e/0x60 mm/kasan/generic.c:640\n  poison_slab_object+0xa6/0xe0 m\n---truncated---(CVE-2024-26852)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ngeneve: make sure to pull inner header in geneve_rx()\r\n\r\nsyzbot triggered a bug in geneve_rx() [1]\r\n\r\nIssue is similar to the one I fixed in commit 8d975c15c0cd\n(\u0026quot;ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()\u0026quot;)\r\n\r\nWe have to save skb-\u0026gt;network_header in a temporary variable\nin order to be able to recompute the network_header pointer\nafter a pskb_inet_may_pull() call.\r\n\r\npskb_inet_may_pull() makes sure the needed headers are in skb-\u0026gt;head.\r\n\r\n[1]\nBUG: KMSAN: uninit-value in IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline]\n BUG: KMSAN: uninit-value in geneve_rx drivers/net/geneve.c:279 [inline]\n BUG: KMSAN: uninit-value in geneve_udp_encap_recv+0x36f9/0x3c10 drivers/net/geneve.c:391\n  IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline]\n  geneve_rx drivers/net/geneve.c:279 [inline]\n  geneve_udp_encap_recv+0x36f9/0x3c10 drivers/net/geneve.c:391\n  udp_queue_rcv_one_skb+0x1d39/0x1f20 net/ipv4/udp.c:2108\n  udp_queue_rcv_skb+0x6ae/0x6e0 net/ipv4/udp.c:2186\n  udp_unicast_rcv_skb+0x184/0x4b0 net/ipv4/udp.c:2346\n  __udp4_lib_rcv+0x1c6b/0x3010 net/ipv4/udp.c:2422\n  udp_rcv+0x7d/0xa0 net/ipv4/udp.c:2604\n  ip_protocol_deliver_rcu+0x264/0x1300 net/ipv4/ip_input.c:205\n  ip_local_deliver_finish+0x2b8/0x440 net/ipv4/ip_input.c:233\n  NF_HOOK include/linux/netfilter.h:314 [inline]\n  ip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254\n  dst_input include/net/dst.h:461 [inline]\n  ip_rcv_finish net/ipv4/ip_input.c:449 [inline]\n  NF_HOOK include/linux/netfilter.h:314 [inline]\n  ip_rcv+0x46f/0x760 net/ipv4/ip_input.c:569\n  __netif_receive_skb_one_core net/core/dev.c:5534 [inline]\n  __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5648\n  process_backlog+0x480/0x8b0 net/core/dev.c:5976\n  __napi_poll+0xe3/0x980 net/core/dev.c:6576\n  napi_poll net/core/dev.c:6645 [inline]\n  net_rx_action+0x8b8/0x1870 net/core/dev.c:6778\n  __do_softirq+0x1b7/0x7c5 kernel/softirq.c:553\n  do_softirq+0x9a/0xf0 kernel/softirq.c:454\n  __local_bh_enable_ip+0x9b/0xa0 kernel/softirq.c:381\n  local_bh_enable include/linux/bottom_half.h:33 [inline]\n  rcu_read_unlock_bh include/linux/rcupdate.h:820 [inline]\n  __dev_queue_xmit+0x2768/0x51c0 net/core/dev.c:4378\n  dev_queue_xmit include/linux/netdevice.h:3171 [inline]\n  packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276\n  packet_snd net/packet/af_packet.c:3081 [inline]\n  packet_sendmsg+0x8aef/0x9f10 net/packet/af_packet.c:3113\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg net/socket.c:745 [inline]\n  __sys_sendto+0x735/0xa10 net/socket.c:2191\n  __do_sys_sendto net/socket.c:2203 [inline]\n  __se_sys_sendto net/socket.c:2199 [inline]\n  __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nUninit was created at:\n  slab_post_alloc_hook mm/slub.c:3819 [inline]\n  slab_alloc_node mm/slub.c:3860 [inline]\n  kmem_cache_alloc_node+0x5cb/0xbc0 mm/slub.c:3903\n  kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560\n  __alloc_skb+0x352/0x790 net/core/skbuff.c:651\n  alloc_skb include/linux/skbuff.h:1296 [inline]\n  alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6394\n  sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2783\n  packet_alloc_skb net/packet/af_packet.c:2930 [inline]\n  packet_snd net/packet/af_packet.c:3024 [inline]\n  packet_sendmsg+0x70c2/0x9f10 net/packet/af_packet.c:3113\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg net/socket.c:745 [inline]\n  __sys_sendto+0x735/0xa10 net/socket.c:2191\n  __do_sys_sendto net/socket.c:2203 [inline]\n  __se_sys_sendto net/socket.c:2199 [inline]\n  __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b(CVE-2024-26857)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/bnx2x: Prevent access to a freed page in page_pool\r\n\r\nFix race condition leading to system crash during EEH error handling\r\n\r\nDuring EEH error recovery, the bnx2x driver\u0026apos;s transmit timeout logic\ncould cause a race condition when handling reset tasks. The\nbnx2x_tx_timeout() schedules reset tasks via bnx2x_sp_rtnl_task(),\nwhich ultimately leads to bnx2x_nic_unload(). In bnx2x_nic_unload()\nSGEs are freed using bnx2x_free_rx_sge_range(). However, this could\noverlap with the EEH driver\u0026apos;s attempt to reset the device using\nbnx2x_io_slot_reset(), which also tries to free SGEs. This race\ncondition can result in system crashes due to accessing freed memory\nlocations in bnx2x_free_rx_sge()\r\n\r\n799  static inline void bnx2x_free_rx_sge(struct bnx2x *bp,\n800\t\t\t\tstruct bnx2x_fastpath *fp, u16 index)\n801  {\n802\tstruct sw_rx_page *sw_buf = \u0026amp;fp-\u0026gt;rx_page_ring[index];\n803     struct page *page = sw_buf-\u0026gt;page;\n....\nwhere sw_buf was set to NULL after the call to dma_unmap_page()\nby the preceding thread.\r\n\r\n    EEH: Beginning: \u0026apos;slot_reset\u0026apos;\n    PCI 0011:01:00.0#10000: EEH: Invoking bnx2x-\u0026gt;slot_reset()\n    bnx2x: [bnx2x_io_slot_reset:14228(eth1)]IO slot reset initializing...\n    bnx2x 0011:01:00.0: enabling device (0140 -\u0026gt; 0142)\n    bnx2x: [bnx2x_io_slot_reset:14244(eth1)]IO slot reset --\u0026gt; driver unload\n    Kernel attempted to read user page (0) - exploit attempt? (uid: 0)\n    BUG: Kernel NULL pointer dereference on read at 0x00000000\n    Faulting instruction address: 0xc0080000025065fc\n    Oops: Kernel access of bad area, sig: 11 [#1]\n    .....\n    Call Trace:\n    [c000000003c67a20] [c00800000250658c] bnx2x_io_slot_reset+0x204/0x610 [bnx2x] (unreliable)\n    [c000000003c67af0] [c0000000000518a8] eeh_report_reset+0xb8/0xf0\n    [c000000003c67b60] [c000000000052130] eeh_pe_report+0x180/0x550\n    [c000000003c67c70] [c00000000005318c] eeh_handle_normal_event+0x84c/0xa60\n    [c000000003c67d50] [c000000000053a84] eeh_event_handler+0xf4/0x170\n    [c000000003c67da0] [c000000000194c58] kthread+0x1c8/0x1d0\n    [c000000003c67e10] [c00000000000cf64] ret_from_kernel_thread+0x5c/0x64\r\n\r\nTo solve this issue, we need to verify page pool allocations before\nfreeing.(CVE-2024-26859)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nhsr: Fix uninit-value access in hsr_get_node()\r\n\r\nKMSAN reported the following uninit-value access issue [1]:\r\n\r\n=====================================================\nBUG: KMSAN: uninit-value in hsr_get_node+0xa2e/0xa40 net/hsr/hsr_framereg.c:246\n hsr_get_node+0xa2e/0xa40 net/hsr/hsr_framereg.c:246\n fill_frame_info net/hsr/hsr_forward.c:577 [inline]\n hsr_forward_skb+0xe12/0x30e0 net/hsr/hsr_forward.c:615\n hsr_dev_xmit+0x1a1/0x270 net/hsr/hsr_device.c:223\n __netdev_start_xmit include/linux/netdevice.h:4940 [inline]\n netdev_start_xmit include/linux/netdevice.h:4954 [inline]\n xmit_one net/core/dev.c:3548 [inline]\n dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564\n __dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349\n dev_queue_xmit include/linux/netdevice.h:3134 [inline]\n packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276\n packet_snd net/packet/af_packet.c:3087 [inline]\n packet_sendmsg+0x8b1d/0x9f30 net/packet/af_packet.c:3119\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg net/socket.c:745 [inline]\n __sys_sendto+0x735/0xa10 net/socket.c:2191\n __do_sys_sendto net/socket.c:2203 [inline]\n __se_sys_sendto net/socket.c:2199 [inline]\n __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x6d/0x140 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nUninit was created at:\n slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768\n slab_alloc_node mm/slub.c:3478 [inline]\n kmem_cache_alloc_node+0x5e9/0xb10 mm/slub.c:3523\n kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560\n __alloc_skb+0x318/0x740 net/core/skbuff.c:651\n alloc_skb include/linux/skbuff.h:1286 [inline]\n alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6334\n sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2787\n packet_alloc_skb net/packet/af_packet.c:2936 [inline]\n packet_snd net/packet/af_packet.c:3030 [inline]\n packet_sendmsg+0x70e8/0x9f30 net/packet/af_packet.c:3119\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg net/socket.c:745 [inline]\n __sys_sendto+0x735/0xa10 net/socket.c:2191\n __do_sys_sendto net/socket.c:2203 [inline]\n __se_sys_sendto net/socket.c:2199 [inline]\n __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x6d/0x140 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nCPU: 1 PID: 5033 Comm: syz-executor334 Not tainted 6.7.0-syzkaller-00562-g9f8413c4a66f #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023\n=====================================================\r\n\r\nIf the packet type ID field in the Ethernet header is either ETH_P_PRP or\nETH_P_HSR, but it is not followed by an HSR tag, hsr_get_skb_sequence_nr()\nreads an invalid value as a sequence number. This causes the above issue.\r\n\r\nThis patch fixes the issue by returning NULL if the Ethernet header is not\nfollowed by an HSR tag.(CVE-2024-26863)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nRDMA/srpt: Do not register event handler until srpt device is fully setup\r\n\r\nUpon rare occasions, KASAN reports a use-after-free Write\nin srpt_refresh_port().\r\n\r\nThis seems to be because an event handler is registered before the\nsrpt device is fully setup and a race condition upon error may leave a\npartially setup event handler in place.\r\n\r\nInstead, only register the event handler after srpt device initialization\nis complete.(CVE-2024-26872)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmedia: pvrusb2: fix uaf in pvr2_context_set_notify\r\n\r\n[Syzbot reported]\nBUG: KASAN: slab-use-after-free in pvr2_context_set_notify+0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:35\nRead of size 4 at addr ffff888113aeb0d8 by task kworker/1:1/26\r\n\r\nCPU: 1 PID: 26 Comm: kworker/1:1 Not tainted 6.8.0-rc1-syzkaller-00046-gf1a27f081c1f #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024\nWorkqueue: usb_hub_wq hub_event\nCall Trace:\n \u0026lt;TASK\u0026gt;\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0xc4/0x620 mm/kasan/report.c:488\n kasan_report+0xda/0x110 mm/kasan/report.c:601\n pvr2_context_set_notify+0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:35\n pvr2_context_notify drivers/media/usb/pvrusb2/pvrusb2-context.c:95 [inline]\n pvr2_context_disconnect+0x94/0xb0 drivers/media/usb/pvrusb2/pvrusb2-context.c:272\r\n\r\nFreed by task 906:\nkasan_save_stack+0x33/0x50 mm/kasan/common.c:47\nkasan_save_track+0x14/0x30 mm/kasan/common.c:68\nkasan_save_free_info+0x3f/0x60 mm/kasan/generic.c:640\npoison_slab_object mm/kasan/common.c:241 [inline]\n__kasan_slab_free+0x106/0x1b0 mm/kasan/common.c:257\nkasan_slab_free include/linux/kasan.h:184 [inline]\nslab_free_hook mm/slub.c:2121 [inline]\nslab_free mm/slub.c:4299 [inline]\nkfree+0x105/0x340 mm/slub.c:4409\npvr2_context_check drivers/media/usb/pvrusb2/pvrusb2-context.c:137 [inline]\npvr2_context_thread_func+0x69d/0x960 drivers/media/usb/pvrusb2/pvrusb2-context.c:158\r\n\r\n[Analyze]\nTask A set disconnect_flag = !0, which resulted in Task B\u0026apos;s condition being met\nand releasing mp, leading to this issue.\r\n\r\n[Fix]\nPlace the disconnect_flag assignment operation after all code in pvr2_context_disconnect()\nto avoid this issue.(CVE-2024-26875)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/bridge: adv7511: fix crash on irq during probe\r\n\r\nMoved IRQ registration down to end of adv7511_probe().\r\n\r\nIf an IRQ already is pending during adv7511_probe\n(before adv7511_cec_init) then cec_received_msg_ts\ncould crash using uninitialized data:\r\n\r\n    Unable to handle kernel read from unreadable memory at virtual address 00000000000003d5\n    Internal error: Oops: 96000004 [#1] PREEMPT_RT SMP\n    Call trace:\n     cec_received_msg_ts+0x48/0x990 [cec]\n     adv7511_cec_irq_process+0x1cc/0x308 [adv7511]\n     adv7511_irq_process+0xd8/0x120 [adv7511]\n     adv7511_irq_handler+0x1c/0x30 [adv7511]\n     irq_thread_fn+0x30/0xa0\n     irq_thread+0x14c/0x238\n     kthread+0x190/0x1a8(CVE-2024-26876)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nquota: Fix potential NULL pointer dereference\r\n\r\nBelow race may cause NULL pointer dereference\r\n\r\nP1\t\t\t\t\tP2\ndquot_free_inode\t\t\tquota_off\n\t\t\t\t\t  drop_dquot_ref\n\t\t\t\t\t   remove_dquot_ref\n\t\t\t\t\t   dquots = i_dquot(inode)\n  dquots = i_dquot(inode)\n  srcu_read_lock\n  dquots[cnt]) != NULL (1)\n\t\t\t\t\t     dquots[type] = NULL (2)\n  spin_lock(\u0026amp;dquots[cnt]-\u0026gt;dq_dqb_lock) (3)\n   ....\r\n\r\nIf dquot_free_inode(or other routines) checks inode\u0026apos;s quota pointers (1)\nbefore quota_off sets it to NULL(2) and use it (3) after that, NULL pointer\ndereference will be triggered.\r\n\r\nSo let\u0026apos;s fix it by using a temporary pointer to avoid this issue.(CVE-2024-26878)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndm: call the resume method on internal suspend\r\n\r\nThere is this reported crash when experimenting with the lvm2 testsuite.\nThe list corruption is caused by the fact that the postsuspend and resume\nmethods were not paired correctly; there were two consecutive calls to the\norigin_postsuspend function. The second call attempts to remove the\n\u0026quot;hash_list\u0026quot; entry from a list, while it was already removed by the first\ncall.\r\n\r\nFix __dm_internal_resume so that it calls the preresume and resume\nmethods of the table\u0026apos;s targets.\r\n\r\nIf a preresume method of some target fails, we are in a tricky situation.\nWe can\u0026apos;t return an error because dm_internal_resume isn\u0026apos;t supposed to\nreturn errors. We can\u0026apos;t return success, because then the \u0026quot;resume\u0026quot; and\n\u0026quot;postsuspend\u0026quot; methods would not be paired correctly. So, we set the\nDMF_SUSPENDED flag and we fake normal suspend - it may confuse userspace\ntools, but it won\u0026apos;t cause a kernel crash.\r\n\r\n------------[ cut here ]------------\nkernel BUG at lib/list_debug.c:56!\ninvalid opcode: 0000 [#1] PREEMPT SMP\nCPU: 1 PID: 8343 Comm: dmsetup Not tainted 6.8.0-rc6 #4\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014\nRIP: 0010:__list_del_entry_valid_or_report+0x77/0xc0\n\u0026lt;snip\u0026gt;\nRSP: 0018:ffff8881b831bcc0 EFLAGS: 00010282\nRAX: 000000000000004e RBX: ffff888143b6eb80 RCX: 0000000000000000\nRDX: 0000000000000001 RSI: ffffffff819053d0 RDI: 00000000ffffffff\nRBP: ffff8881b83a3400 R08: 00000000fffeffff R09: 0000000000000058\nR10: 0000000000000000 R11: ffffffff81a24080 R12: 0000000000000001\nR13: ffff88814538e000 R14: ffff888143bc6dc0 R15: ffffffffa02e4bb0\nFS:  00000000f7c0f780(0000) GS:ffff8893f0a40000(0000) knlGS:0000000000000000\nCS:  0010 DS: 002b ES: 002b CR0: 0000000080050033\nCR2: 0000000057fb5000 CR3: 0000000143474000 CR4: 00000000000006b0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n ? die+0x2d/0x80\n ? do_trap+0xeb/0xf0\n ? __list_del_entry_valid_or_report+0x77/0xc0\n ? do_error_trap+0x60/0x80\n ? __list_del_entry_valid_or_report+0x77/0xc0\n ? exc_invalid_op+0x49/0x60\n ? __list_del_entry_valid_or_report+0x77/0xc0\n ? asm_exc_invalid_op+0x16/0x20\n ? table_deps+0x1b0/0x1b0 [dm_mod]\n ? __list_del_entry_valid_or_report+0x77/0xc0\n origin_postsuspend+0x1a/0x50 [dm_snapshot]\n dm_table_postsuspend_targets+0x34/0x50 [dm_mod]\n dm_suspend+0xd8/0xf0 [dm_mod]\n dev_suspend+0x1f2/0x2f0 [dm_mod]\n ? table_deps+0x1b0/0x1b0 [dm_mod]\n ctl_ioctl+0x300/0x5f0 [dm_mod]\n dm_compat_ctl_ioctl+0x7/0x10 [dm_mod]\n __x64_compat_sys_ioctl+0x104/0x170\n do_syscall_64+0x184/0x1b0\n entry_SYSCALL_64_after_hwframe+0x46/0x4e\nRIP: 0033:0xf7e6aead\n\u0026lt;snip\u0026gt;\n---[ end trace 0000000000000000 ]---(CVE-2024-26880)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete\r\n\r\nThe ath9k_wmi_event_tasklet() used in ath9k_htc assumes that all the data\nstructures have been fully initialised by the time it runs. However, because of\nthe order in which things are initialised, this is not guaranteed to be the\ncase, because the device is exposed to the USB subsystem before the ath9k driver\ninitialisation is completed.\r\n\r\nWe already committed a partial fix for this in commit:\n8b3046abc99e (\u0026quot;ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet()\u0026quot;)\r\n\r\nHowever, that commit only aborted the WMI_TXSTATUS_EVENTID command in the event\ntasklet, pairing it with an \u0026quot;initialisation complete\u0026quot; bit in the TX struct. It\nseems syzbot managed to trigger the race for one of the other commands as well,\nso let\u0026apos;s just move the existing synchronisation bit to cover the whole\ntasklet (setting it at the end of ath9k_htc_probe_device() instead of inside\nath9k_tx_init()).(CVE-2024-26897)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/amdgpu: Reset IH OVERFLOW_CLEAR bit\r\n\r\nAllows us to detect subsequent IH ring buffer overflows as well.(CVE-2024-26915)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/amdgpu: validate the parameters of bo mapping operations more clearly\r\n\r\nVerify the parameters of\namdgpu_vm_bo_(map/replace_map/clearing_mappings) in one common place.(CVE-2024-26922)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmedia: go7007: fix a memleak in go7007_load_encoder\r\n\r\nIn go7007_load_encoder, bounce(i.e. go-\u0026gt;boot_fw), is allocated without\na deallocation thereafter. After the following call chain:\r\n\r\nsaa7134_go7007_init\n  |-\u0026gt; go7007_boot_encoder\n        |-\u0026gt; go7007_load_encoder\n  |-\u0026gt; kfree(go)\r\n\r\ngo is freed and thus bounce is leaked.(CVE-2024-27074)","status":"published","published":"2024-05-17T11:07:04Z","modified":"2026-08-18T01:18:27.183042613Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1618","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntun: avoid double free in tun_free_netdev\r\n\r\nAvoid double free in tun_free_netdev() by moving the\ndev-\u0026gt;tstats and tun-\u0026gt;security allocs to a new ndo_init routine\n(tun_net_init()) that will be called by register_netdevice().\nndo_init is paired with the desctructor (tun_free_netdev()),\nso if there\u0026apos;s an error in register_netdevice() the destructor\nwill handle the frees.\r\n\r\nBUG: KASAN: double-free or invalid-free in selinux_tun_dev_free_security+0x1a/0x20 security/selinux/hooks.c:5605\r\n\r\nCPU: 0 PID: 25750 Comm: syz-executor416 Not tainted 5.16.0-rc2-syzk #1\nHardware name: Red Hat KVM, BIOS\nCall Trace:\n\u0026lt;TASK\u0026gt;\n__dump_stack lib/dump_stack.c:88 [inline]\ndump_stack_lvl+0x89/0xb5 lib/dump_stack.c:106\nprint_address_description.constprop.9+0x28/0x160 mm/kasan/report.c:247\nkasan_report_invalid_free+0x55/0x80 mm/kasan/report.c:372\n____kasan_slab_free mm/kasan/common.c:346 [inline]\n__kasan_slab_free+0x107/0x120 mm/kasan/common.c:374\nkasan_slab_free include/linux/kasan.h:235 [inline]\nslab_free_hook mm/slub.c:1723 [inline]\nslab_free_freelist_hook mm/slub.c:1749 [inline]\nslab_free mm/slub.c:3513 [inline]\nkfree+0xac/0x2d0 mm/slub.c:4561\nselinux_tun_dev_free_security+0x1a/0x20 security/selinux/hooks.c:5605\nsecurity_tun_dev_free_security+0x4f/0x90 security/security.c:2342\ntun_free_netdev+0xe6/0x150 drivers/net/tun.c:2215\nnetdev_run_todo+0x4df/0x840 net/core/dev.c:10627\nrtnl_unlock+0x13/0x20 net/core/rtnetlink.c:112\n__tun_chr_ioctl+0x80c/0x2870 drivers/net/tun.c:3302\ntun_chr_ioctl+0x2f/0x40 drivers/net/tun.c:3311\nvfs_ioctl fs/ioctl.c:51 [inline]\n__do_sys_ioctl fs/ioctl.c:874 [inline]\n__se_sys_ioctl fs/ioctl.c:860 [inline]\n__x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:860\ndo_syscall_x64 arch/x86/entry/common.c:50 [inline]\ndo_syscall_64+0x3a/0x80 arch/x86/entry/common.c:80\nentry_SYSCALL_64_after_hwframe+0x44/0xae(CVE-2021-47082)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nx86/kvm: Disable kvmclock on all CPUs on shutdown\r\n\r\nCurrenly, we disable kvmclock from machine_shutdown() hook and this\nonly happens for boot CPU. We need to disable it for all CPUs to\nguard against memory corruption e.g. on restore from hibernate.\r\n\r\nNote, writing \u0026apos;0\u0026apos; to kvmclock MSR doesn\u0026apos;t clear memory location, it\njust prevents hypervisor from updating the location so for the short\nwhile after write and while CPU is still alive, the clock remains usable\nand correct so we don\u0026apos;t need to switch to some other clocksource.(CVE-2021-47110)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ni40e: Fix NULL ptr dereference on VSI filter sync\r\n\r\nRemove the reason of null pointer dereference in sync VSI filters.\nAdded new I40E_VSI_RELEASING flag to signalize deleting and releasing\nof VSI resources to sync this thread with sync filters subtask.\nWithout this patch it is possible to start update the VSI filter list\nafter VSI is removed, that\u0026apos;s causing a kernel oops.(CVE-2021-47184)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nerofs: fix pcluster use-after-free on UP platforms\r\n\r\nDuring stress testing with CONFIG_SMP disabled, KASAN reports as below:\r\n\r\n==================================================================\nBUG: KASAN: use-after-free in __mutex_lock+0xe5/0xc30\nRead of size 8 at addr ffff8881094223f8 by task stress/7789\r\n\r\nCPU: 0 PID: 7789 Comm: stress Not tainted 6.0.0-rc1-00002-g0d53d2e882f9 #3\nHardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011\nCall Trace:\n \u0026lt;TASK\u0026gt;\n..\n __mutex_lock+0xe5/0xc30\n..\n z_erofs_do_read_page+0x8ce/0x1560\n..\n z_erofs_readahead+0x31c/0x580\n..\nFreed by task 7787\n kasan_save_stack+0x1e/0x40\n kasan_set_track+0x20/0x30\n kasan_set_free_info+0x20/0x40\n __kasan_slab_free+0x10c/0x190\n kmem_cache_free+0xed/0x380\n rcu_core+0x3d5/0xc90\n __do_softirq+0x12d/0x389\r\n\r\nLast potentially related work creation:\n kasan_save_stack+0x1e/0x40\n __kasan_record_aux_stack+0x97/0xb0\n call_rcu+0x3d/0x3f0\n erofs_shrink_workstation+0x11f/0x210\n erofs_shrink_scan+0xdc/0x170\n shrink_slab.constprop.0+0x296/0x530\n drop_slab+0x1c/0x70\n drop_caches_sysctl_handler+0x70/0x80\n proc_sys_call_handler+0x20a/0x2f0\n vfs_write+0x555/0x6c0\n ksys_write+0xbe/0x160\n do_syscall_64+0x3b/0x90\r\n\r\nThe root cause is that erofs_workgroup_unfreeze() doesn\u0026apos;t reset to\norig_val thus it causes a race that the pcluster reuses unexpectedly\nbefore freeing.\r\n\r\nSince UP platforms are quite rare now, such path becomes unnecessary.\nLet\u0026apos;s drop such specific-designed path directly instead.(CVE-2022-48674)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nhwrng: core - Fix page fault dead lock on mmap-ed hwrng\r\n\r\nThere is a dead-lock in the hwrng device read path.  This triggers\nwhen the user reads from /dev/hwrng into memory also mmap-ed from\n/dev/hwrng.  The resulting page fault triggers a recursive read\nwhich then dead-locks.\r\n\r\nFix this by using a stack buffer when calling copy_to_user.(CVE-2023-52615)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nf_tables: disallow timeout for anonymous sets\r\n\r\nNever used from userspace, disallow these parameters.(CVE-2023-52620)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nSUNRPC: Fix a suspicious RCU usage warning\r\n\r\nI received the following warning while running cthon against an ontap\nserver running pNFS:\r\n\r\n[   57.202521] =============================\n[   57.202522] WARNING: suspicious RCU usage\n[   57.202523] 6.7.0-rc3-g2cc14f52aeb7 #41492 Not tainted\n[   57.202525] -----------------------------\n[   57.202525] net/sunrpc/xprtmultipath.c:349 RCU-list traversed in non-reader section!!\n[   57.202527]\n               other info that might help us debug this:\r\n\r\n[   57.202528]\n               rcu_scheduler_active = 2, debug_locks = 1\n[   57.202529] no locks held by test5/3567.\n[   57.202530]\n               stack backtrace:\n[   57.202532] CPU: 0 PID: 3567 Comm: test5 Not tainted 6.7.0-rc3-g2cc14f52aeb7 #41492 5b09971b4965c0aceba19f3eea324a4a806e227e\n[   57.202534] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 2/2/2022\n[   57.202536] Call Trace:\n[   57.202537]  \u0026lt;TASK\u0026gt;\n[   57.202540]  dump_stack_lvl+0x77/0xb0\n[   57.202551]  lockdep_rcu_suspicious+0x154/0x1a0\n[   57.202556]  rpc_xprt_switch_has_addr+0x17c/0x190 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]\n[   57.202596]  rpc_clnt_setup_test_and_add_xprt+0x50/0x180 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]\n[   57.202621]  ? rpc_clnt_add_xprt+0x254/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]\n[   57.202646]  rpc_clnt_add_xprt+0x27a/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]\n[   57.202671]  ? __pfx_rpc_clnt_setup_test_and_add_xprt+0x10/0x10 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]\n[   57.202696]  nfs4_pnfs_ds_connect+0x345/0x760 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]\n[   57.202728]  ? __pfx_nfs4_test_session_trunk+0x10/0x10 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]\n[   57.202754]  nfs4_fl_prepare_ds+0x75/0xc0 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a]\n[   57.202760]  filelayout_write_pagelist+0x4a/0x200 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a]\n[   57.202765]  pnfs_generic_pg_writepages+0xbe/0x230 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]\n[   57.202788]  __nfs_pageio_add_request+0x3fd/0x520 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202813]  nfs_pageio_add_request+0x18b/0x390 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202831]  nfs_do_writepage+0x116/0x1e0 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202849]  nfs_writepages_callback+0x13/0x30 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202866]  write_cache_pages+0x265/0x450\n[   57.202870]  ? __pfx_nfs_writepages_callback+0x10/0x10 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202891]  nfs_writepages+0x141/0x230 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202913]  do_writepages+0xd2/0x230\n[   57.202917]  ? filemap_fdatawrite_wbc+0x5c/0x80\n[   57.202921]  filemap_fdatawrite_wbc+0x67/0x80\n[   57.202924]  filemap_write_and_wait_range+0xd9/0x170\n[   57.202930]  nfs_wb_all+0x49/0x180 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202947]  nfs4_file_flush+0x72/0xb0 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]\n[   57.202969]  __se_sys_close+0x46/0xd0\n[   57.202972]  do_syscall_64+0x68/0x100\n[   57.202975]  ? do_syscall_64+0x77/0x100\n[   57.202976]  ? do_syscall_64+0x77/0x100\n[   57.202979]  entry_SYSCALL_64_after_hwframe+0x6e/0x76\n[   57.202982] RIP: 0033:0x7fe2b12e4a94\n[   57.202985] Code: 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d d5 18 0e 00 00 74 13 b8 03 00 00 00 0f 05 \u0026lt;48\u0026gt; 3d 00 f0 ff ff 77 44 c3 0f 1f 00 48 83 ec 18 89 7c 24 0c e8 c3\n[   57.202987] RSP: 002b:00007ffe857ddb38 EFLAGS: 00000202 ORIG_RAX: 0000000000000003\n[   57.202989] RAX: ffffffffffffffda RBX: 00007ffe857dfd68 RCX: 00007fe2b12e4a94\n[   57.202991] RDX: 0000000000002000 RSI: 00007ffe857ddc40 RDI: 0000000000000003\n[   57.202992] RBP: 00007ffe857dfc50 R08: 7fffffffffffffff R09: 0000000065650f49\n[   57.202993] R10: 00007f\n---truncated---(CVE-2023-52623)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nsh: push-switch: Reorder cleanup operations to avoid use-after-free bug\r\n\r\nThe original code puts flush_work() before timer_shutdown_sync()\nin switch_drv_remove(). Although we use flush_work() to stop\nthe worker, it could be rescheduled in switch_timer(). As a result,\na use-after-free bug can occur. The details are shown below:\r\n\r\n      (cpu 0)                    |      (cpu 1)\nswitch_drv_remove()              |\n flush_work()                    |\n  ...                            |  switch_timer // timer\n                                 |   schedule_work(\u0026amp;psw-\u0026gt;work)\n timer_shutdown_sync()           |\n ...                             |  switch_work_handler // worker\n kfree(psw) // free              |\n                                 |   psw-\u0026gt;state = 0 // use\r\n\r\nThis patch puts timer_shutdown_sync() before flush_work() to\nmitigate the bugs. As a result, the worker and timer will be\nstopped safely before the deallocate operations.(CVE-2023-52629)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nPM / devfreq: Synchronize devfreq_monitor_[start/stop]\r\n\r\nThere is a chance if a frequent switch of the governor\ndone in a loop result in timer list corruption where\ntimer cancel being done from two place one from\ncancel_delayed_work_sync() and followed by expire_timers()\ncan be seen from the traces[1].\r\n\r\nwhile true\ndo\n        echo \u0026quot;simple_ondemand\u0026quot; \u0026gt; /sys/class/devfreq/1d84000.ufshc/governor\n        echo \u0026quot;performance\u0026quot; \u0026gt; /sys/class/devfreq/1d84000.ufshc/governor\ndone\r\n\r\nIt looks to be issue with devfreq driver where\ndevice_monitor_[start/stop] need to synchronized so that\ndelayed work should get corrupted while it is either\nbeing queued or running or being cancelled.\r\n\r\nLet\u0026apos;s use polling flag and devfreq lock to synchronize the\nqueueing the timer instance twice and work data being\ncorrupted.\r\n\r\n[1]\n...\n..\n\u0026lt;idle\u0026gt;-0    [003]   9436.209662:  timer_cancel   timer=0xffffff80444f0428\n\u0026lt;idle\u0026gt;-0    [003]   9436.209664:  timer_expire_entry   timer=0xffffff80444f0428  now=0x10022da1c  function=__typeid__ZTSFvP10timer_listE_global_addr  baseclk=0x10022da1c\n\u0026lt;idle\u0026gt;-0    [003]   9436.209718:  timer_expire_exit   timer=0xffffff80444f0428\nkworker/u16:6-14217    [003]   9436.209863:  timer_start   timer=0xffffff80444f0428  function=__typeid__ZTSFvP10timer_listE_global_addr  expires=0x10022da2b  now=0x10022da1c  flags=182452227\nvendor.xxxyyy.ha-1593    [004]   9436.209888:  timer_cancel   timer=0xffffff80444f0428\nvendor.xxxyyy.ha-1593    [004]   9436.216390:  timer_init   timer=0xffffff80444f0428\nvendor.xxxyyy.ha-1593    [004]   9436.216392:  timer_start   timer=0xffffff80444f0428  function=__typeid__ZTSFvP10timer_listE_global_addr  expires=0x10022da2c  now=0x10022da1d  flags=186646532\nvendor.xxxyyy.ha-1593    [005]   9436.220992:  timer_cancel   timer=0xffffff80444f0428\nxxxyyyTraceManag-7795    [004]   9436.261641:  timer_cancel   timer=0xffffff80444f0428\r\n\r\n[2]\r\n\r\n 9436.261653][    C4] Unable to handle kernel paging request at virtual address dead00000000012a\n[ 9436.261664][    C4] Mem abort info:\n[ 9436.261666][    C4]   ESR = 0x96000044\n[ 9436.261669][    C4]   EC = 0x25: DABT (current EL), IL = 32 bits\n[ 9436.261671][    C4]   SET = 0, FnV = 0\n[ 9436.261673][    C4]   EA = 0, S1PTW = 0\n[ 9436.261675][    C4] Data abort info:\n[ 9436.261677][    C4]   ISV = 0, ISS = 0x00000044\n[ 9436.261680][    C4]   CM = 0, WnR = 1\n[ 9436.261682][    C4] [dead00000000012a] address between user and kernel address ranges\n[ 9436.261685][    C4] Internal error: Oops: 96000044 [#1] PREEMPT SMP\n[ 9436.261701][    C4] Skip md ftrace buffer dump for: 0x3a982d0\n...\r\n\r\n[ 9436.262138][    C4] CPU: 4 PID: 7795 Comm: TraceManag Tainted: G S      W  O      5.10.149-android12-9-o-g17f915d29d0c #1\n[ 9436.262141][    C4] Hardware name: Qualcomm Technologies, Inc.  (DT)\n[ 9436.262144][    C4] pstate: 22400085 (nzCv daIf +PAN -UAO +TCO BTYPE=--)\n[ 9436.262161][    C4] pc : expire_timers+0x9c/0x438\n[ 9436.262164][    C4] lr : expire_timers+0x2a4/0x438\n[ 9436.262168][    C4] sp : ffffffc010023dd0\n[ 9436.262171][    C4] x29: ffffffc010023df0 x28: ffffffd0636fdc18\n[ 9436.262178][    C4] x27: ffffffd063569dd0 x26: ffffffd063536008\n[ 9436.262182][    C4] x25: 0000000000000001 x24: ffffff88f7c69280\n[ 9436.262185][    C4] x23: 00000000000000e0 x22: dead000000000122\n[ 9436.262188][    C4] x21: 000000010022da29 x20: ffffff8af72b4e80\n[ 9436.262191][    C4] x19: ffffffc010023e50 x18: ffffffc010025038\n[ 9436.262195][    C4] x17: 0000000000000240 x16: 0000000000000201\n[ 9436.262199][    C4] x15: ffffffffffffffff x14: ffffff889f3c3100\n[ 9436.262203][    C4] x13: ffffff889f3c3100 x12: 00000000049f56b8\n[ 9436.262207][    C4] x11: 00000000049f56b8 x10: 00000000ffffffff\n[ 9436.262212][    C4] x9 : ffffffc010023e50 x8 : dead000000000122\n[ 9436.262216][    C4] x7 : ffffffffffffffff x6 : ffffffc0100239d8\n[ 9436.262220][    C4] x5 : 0000000000000000 x4 : 0000000000000101\n[ 9436.262223][    C4] x3 : 0000000000000080 x2 : ffffff8\n---truncated---(CVE-2023-52635)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ncan: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)\r\n\r\nLock jsk-\u0026gt;sk to prevent UAF when setsockopt(..., SO_J1939_FILTER, ...)\nmodifies jsk-\u0026gt;filters while receiving packets.\r\n\r\nFollowing trace was seen on affected system:\n ==================================================================\n BUG: KASAN: slab-use-after-free in j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939]\n Read of size 4 at addr ffff888012144014 by task j1939/350\r\n\r\n CPU: 0 PID: 350 Comm: j1939 Tainted: G        W  OE      6.5.0-rc5 #1\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014\n Call Trace:\n  print_report+0xd3/0x620\n  ? kasan_complete_mode_report_info+0x7d/0x200\n  ? j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939]\n  kasan_report+0xc2/0x100\n  ? j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939]\n  __asan_load4+0x84/0xb0\n  j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939]\n  j1939_sk_recv+0x20b/0x320 [can_j1939]\n  ? __kasan_check_write+0x18/0x20\n  ? __pfx_j1939_sk_recv+0x10/0x10 [can_j1939]\n  ? j1939_simple_recv+0x69/0x280 [can_j1939]\n  ? j1939_ac_recv+0x5e/0x310 [can_j1939]\n  j1939_can_recv+0x43f/0x580 [can_j1939]\n  ? __pfx_j1939_can_recv+0x10/0x10 [can_j1939]\n  ? raw_rcv+0x42/0x3c0 [can_raw]\n  ? __pfx_j1939_can_recv+0x10/0x10 [can_j1939]\n  can_rcv_filter+0x11f/0x350 [can]\n  can_receive+0x12f/0x190 [can]\n  ? __pfx_can_rcv+0x10/0x10 [can]\n  can_rcv+0xdd/0x130 [can]\n  ? __pfx_can_rcv+0x10/0x10 [can]\n  __netif_receive_skb_one_core+0x13d/0x150\n  ? __pfx___netif_receive_skb_one_core+0x10/0x10\n  ? __kasan_check_write+0x18/0x20\n  ? _raw_spin_lock_irq+0x8c/0xe0\n  __netif_receive_skb+0x23/0xb0\n  process_backlog+0x107/0x260\n  __napi_poll+0x69/0x310\n  net_rx_action+0x2a1/0x580\n  ? __pfx_net_rx_action+0x10/0x10\n  ? __pfx__raw_spin_lock+0x10/0x10\n  ? handle_irq_event+0x7d/0xa0\n  __do_softirq+0xf3/0x3f8\n  do_softirq+0x53/0x80\n  \u0026lt;/IRQ\u0026gt;\n  \u0026lt;TASK\u0026gt;\n  __local_bh_enable_ip+0x6e/0x70\n  netif_rx+0x16b/0x180\n  can_send+0x32b/0x520 [can]\n  ? __pfx_can_send+0x10/0x10 [can]\n  ? __check_object_size+0x299/0x410\n  raw_sendmsg+0x572/0x6d0 [can_raw]\n  ? __pfx_raw_sendmsg+0x10/0x10 [can_raw]\n  ? apparmor_socket_sendmsg+0x2f/0x40\n  ? __pfx_raw_sendmsg+0x10/0x10 [can_raw]\n  sock_sendmsg+0xef/0x100\n  sock_write_iter+0x162/0x220\n  ? __pfx_sock_write_iter+0x10/0x10\n  ? __rtnl_unlock+0x47/0x80\n  ? security_file_permission+0x54/0x320\n  vfs_write+0x6ba/0x750\n  ? __pfx_vfs_write+0x10/0x10\n  ? __fget_light+0x1ca/0x1f0\n  ? __rcu_read_unlock+0x5b/0x280\n  ksys_write+0x143/0x170\n  ? __pfx_ksys_write+0x10/0x10\n  ? __kasan_check_read+0x15/0x20\n  ? fpregs_assert_state_consistent+0x62/0x70\n  __x64_sys_write+0x47/0x60\n  do_syscall_64+0x60/0x90\n  ? do_syscall_64+0x6d/0x90\n  ? irqentry_exit+0x3f/0x50\n  ? exc_page_fault+0x79/0xf0\n  entry_SYSCALL_64_after_hwframe+0x6e/0xd8\r\n\r\n Allocated by task 348:\n  kasan_save_stack+0x2a/0x50\n  kasan_set_track+0x29/0x40\n  kasan_save_alloc_info+0x1f/0x30\n  __kasan_kmalloc+0xb5/0xc0\n  __kmalloc_node_track_caller+0x67/0x160\n  j1939_sk_setsockopt+0x284/0x450 [can_j1939]\n  __sys_setsockopt+0x15c/0x2f0\n  __x64_sys_setsockopt+0x6b/0x80\n  do_syscall_64+0x60/0x90\n  entry_SYSCALL_64_after_hwframe+0x6e/0xd8\r\n\r\n Freed by task 349:\n  kasan_save_stack+0x2a/0x50\n  kasan_set_track+0x29/0x40\n  kasan_save_free_info+0x2f/0x50\n  __kasan_slab_free+0x12e/0x1c0\n  __kmem_cache_free+0x1b9/0x380\n  kfree+0x7a/0x120\n  j1939_sk_setsockopt+0x3b2/0x450 [can_j1939]\n  __sys_setsockopt+0x15c/0x2f0\n  __x64_sys_setsockopt+0x6b/0x80\n  do_syscall_64+0x60/0x90\n  entry_SYSCALL_64_after_hwframe+0x6e/0xd8(CVE-2023-52637)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ncan: j1939: prevent deadlock by changing j1939_socks_lock to rwlock\r\n\r\nThe following 3 locks would race against each other, causing the\ndeadlock situation in the Syzbot bug report:\r\n\r\n- j1939_socks_lock\n- active_session_list_lock\n- sk_session_queue_lock\r\n\r\nA reasonable fix is to change j1939_socks_lock to an rwlock, since in\nthe rare situations where a write lock is required for the linked list\nthat j1939_socks_lock is protecting, the code does not attempt to\nacquire any more locks. This would break the circular lock dependency,\nwhere, for example, the current thread already locks j1939_socks_lock\nand attempts to acquire sk_session_queue_lock, and at the same time,\nanother thread attempts to acquire j1939_socks_lock while holding\nsk_session_queue_lock.\r\n\r\nNOTE: This patch along does not fix the unregister_netdevice bug\nreported by Syzbot; instead, it solves a deadlock situation to prepare\nfor one or more further patches to actually fix the Syzbot bug, which\nappears to be a reference counting problem within the j1939 codebase.\r\n\r\n[mkl: remove unrelated newline change](CVE-2023-52638)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nKVM: s390: vsie: fix race during shadow creation\r\n\r\nRight now it is possible to see gmap-\u0026gt;private being zero in\nkvm_s390_vsie_gmap_notifier resulting in a crash.  This is due to the\nfact that we add gmap-\u0026gt;private == kvm after creation:\r\n\r\nstatic int acquire_gmap_shadow(struct kvm_vcpu *vcpu,\n                               struct vsie_page *vsie_page)\n{\n[...]\n        gmap = gmap_shadow(vcpu-\u0026gt;arch.gmap, asce, edat);\n        if (IS_ERR(gmap))\n                return PTR_ERR(gmap);\n        gmap-\u0026gt;private = vcpu-\u0026gt;kvm;\r\n\r\nLet children inherit the private field of the parent.(CVE-2023-52639)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmedia: rc: bpf attach/detach requires write permission\r\n\r\nNote that bpf attach/detach also requires CAP_NET_ADMIN.(CVE-2023-52642)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled\r\n\r\nWhen QoS is disabled, the queue priority value will not map to the correct\nieee80211 queue since there is only one queue. Stop/wake queue 0 when QoS\nis disabled to prevent trying to stop/wake a non-existent queue and failing\nto stop/wake the actual queue instantiated.\r\n\r\nLog of issue before change (with kernel parameter qos=0):\n    [  +5.112651] ------------[ cut here ]------------\n    [  +0.000005] WARNING: CPU: 7 PID: 25513 at net/mac80211/util.c:449 __ieee80211_wake_queue+0xd5/0x180 [mac80211]\n    [  +0.000067] Modules linked in: b43(O) snd_seq_dummy snd_hrtimer snd_seq snd_seq_device nft_chain_nat xt_MASQUERADE nf_nat xfrm_user xfrm_algo xt_addrtype overlay ccm af_packet amdgpu snd_hda_codec_cirrus snd_hda_codec_generic ledtrig_audio drm_exec amdxcp gpu_sched xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip6t_rpfilter ipt_rpfilter xt_pkttype xt_LOG nf_log_syslog xt_tcpudp nft_compat nf_tables nfnetlink sch_fq_codel btusb uinput iTCO_wdt ctr btrtl intel_pmc_bxt i915 intel_rapl_msr mei_hdcp mei_pxp joydev at24 watchdog btintel atkbd libps2 serio radeon btbcm vivaldi_fmap btmtk intel_rapl_common snd_hda_codec_hdmi bluetooth uvcvideo nls_iso8859_1 applesmc nls_cp437 x86_pkg_temp_thermal snd_hda_intel intel_powerclamp vfat videobuf2_vmalloc coretemp fat snd_intel_dspcfg crc32_pclmul uvc polyval_clmulni snd_intel_sdw_acpi loop videobuf2_memops snd_hda_codec tun drm_suballoc_helper polyval_generic drm_ttm_helper drm_buddy tap ecdh_generic videobuf2_v4l2 gf128mul macvlan ttm ghash_clmulni_intel ecc tg3\n    [  +0.000044]  videodev bridge snd_hda_core rapl crc16 drm_display_helper cec mousedev snd_hwdep evdev intel_cstate bcm5974 hid_appleir videobuf2_common stp mac_hid libphy snd_pcm drm_kms_helper acpi_als mei_me intel_uncore llc mc snd_timer intel_gtt industrialio_triggered_buffer apple_mfi_fastcharge i2c_i801 mei snd lpc_ich agpgart ptp i2c_smbus thunderbolt apple_gmux i2c_algo_bit kfifo_buf video industrialio soundcore pps_core wmi tiny_power_button sbs sbshc button ac cordic bcma mac80211 cfg80211 ssb rfkill libarc4 kvm_intel kvm drm irqbypass fuse backlight firmware_class efi_pstore configfs efivarfs dmi_sysfs ip_tables x_tables autofs4 dm_crypt cbc encrypted_keys trusted asn1_encoder tee tpm rng_core input_leds hid_apple led_class hid_generic usbhid hid sd_mod t10_pi crc64_rocksoft crc64 crc_t10dif crct10dif_generic ahci libahci libata uhci_hcd ehci_pci ehci_hcd crct10dif_pclmul crct10dif_common sha512_ssse3 sha512_generic sha256_ssse3 sha1_ssse3 aesni_intel usbcore scsi_mod libaes crypto_simd cryptd scsi_common\n    [  +0.000055]  usb_common rtc_cmos btrfs blake2b_generic libcrc32c crc32c_generic crc32c_intel xor raid6_pq dm_snapshot dm_bufio dm_mod dax [last unloaded: b43(O)]\n    [  +0.000009] CPU: 7 PID: 25513 Comm: irq/17-b43 Tainted: G        W  O       6.6.7 #1-NixOS\n    [  +0.000003] Hardware name: Apple Inc. MacBookPro8,3/Mac-942459F5819B171B, BIOS 87.0.0.0.0 06/13/2019\n    [  +0.000001] RIP: 0010:__ieee80211_wake_queue+0xd5/0x180 [mac80211]\n    [  +0.000046] Code: 00 45 85 e4 0f 85 9b 00 00 00 48 8d bd 40 09 00 00 f0 48 0f ba ad 48 09 00 00 00 72 0f 5b 5d 41 5c 41 5d 41 5e e9 cb 6d 3c d0 \u0026lt;0f\u0026gt; 0b 5b 5d 41 5c 41 5d 41 5e c3 cc cc cc cc 48 8d b4 16 94 00 00\n    [  +0.000002] RSP: 0018:ffffc90003c77d60 EFLAGS: 00010097\n    [  +0.000001] RAX: 0000000000000001 RBX: 0000000000000002 RCX: 0000000000000000\n    [  +0.000001] RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffff88820b924900\n    [  +0.000002] RBP: ffff88820b924900 R08: ffffc90003c77d90 R09: 000000000003bfd0\n    [  +0.000001] R10: ffff88820b924900 R11: ffffc90003c77c68 R12: 0000000000000000\n    [  +0.000001] R13: 0000000000000000 R14: ffffc90003c77d90 R15: ffffffffc0fa6f40\n    [  +0.000001] FS:  0000000000000000(0000) GS:ffff88846fb80000(0000) knlGS:0000000000000000\n    [  +0.000001] CS:  0010 DS: 0\n---truncated---(CVE-2023-52644)\r\n\r\nA flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on `struct net_device`, and a use-after-free can be triggered by racing between the free on the struct and the access through the `skbtxq` global queue. This could lead to a denial of service condition or potential code execution.(CVE-2023-6270)\r\n\r\nA race condition was found in the Linux kernel\u0026apos;s net/bluetooth in {conn,adv}_{min,max}_interval_set() function. This can result in I2cap connection or broadcast abnormality issue, possibly leading to denial of service.\r\n\r\n\r\n\r\n\n(CVE-2024-24858)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntcp: make sure init the accept_queue\u0026apos;s spinlocks once\r\n\r\nWhen I run syz\u0026apos;s reproduction C program locally, it causes the following\nissue:\npvqspinlock: lock 0xffff9d181cd5c660 has corrupted value 0x0!\nWARNING: CPU: 19 PID: 21160 at __pv_queued_spin_unlock_slowpath (kernel/locking/qspinlock_paravirt.h:508)\nHardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011\nRIP: 0010:__pv_queued_spin_unlock_slowpath (kernel/locking/qspinlock_paravirt.h:508)\nCode: 73 56 3a ff 90 c3 cc cc cc cc 8b 05 bb 1f 48 01 85 c0 74 05 c3 cc cc cc cc 8b 17 48 89 fe 48 c7 c7\n30 20 ce 8f e8 ad 56 42 ff \u0026lt;0f\u0026gt; 0b c3 cc cc cc cc 0f 0b 0f 1f 40 00 90 90 90 90 90 90 90 90 90\nRSP: 0018:ffffa8d200604cb8 EFLAGS: 00010282\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff9d1ef60e0908\nRDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff9d1ef60e0900\nRBP: ffff9d181cd5c280 R08: 0000000000000000 R09: 00000000ffff7fff\nR10: ffffa8d200604b68 R11: ffffffff907dcdc8 R12: 0000000000000000\nR13: ffff9d181cd5c660 R14: ffff9d1813a3f330 R15: 0000000000001000\nFS:  00007fa110184640(0000) GS:ffff9d1ef60c0000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000020000000 CR3: 000000011f65e000 CR4: 00000000000006f0\nCall Trace:\n\u0026lt;IRQ\u0026gt;\n  _raw_spin_unlock (kernel/locking/spinlock.c:186)\n  inet_csk_reqsk_queue_add (net/ipv4/inet_connection_sock.c:1321)\n  inet_csk_complete_hashdance (net/ipv4/inet_connection_sock.c:1358)\n  tcp_check_req (net/ipv4/tcp_minisocks.c:868)\n  tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2260)\n  ip_protocol_deliver_rcu (net/ipv4/ip_input.c:205)\n  ip_local_deliver_finish (net/ipv4/ip_input.c:234)\n  __netif_receive_skb_one_core (net/core/dev.c:5529)\n  process_backlog (./include/linux/rcupdate.h:779)\n  __napi_poll (net/core/dev.c:6533)\n  net_rx_action (net/core/dev.c:6604)\n  __do_softirq (./arch/x86/include/asm/jump_label.h:27)\n  do_softirq (kernel/softirq.c:454 kernel/softirq.c:441)\n\u0026lt;/IRQ\u0026gt;\n\u0026lt;TASK\u0026gt;\n  __local_bh_enable_ip (kernel/softirq.c:381)\n  __dev_queue_xmit (net/core/dev.c:4374)\n  ip_finish_output2 (./include/net/neighbour.h:540 net/ipv4/ip_output.c:235)\n  __ip_queue_xmit (net/ipv4/ip_output.c:535)\n  __tcp_transmit_skb (net/ipv4/tcp_output.c:1462)\n  tcp_rcv_synsent_state_process (net/ipv4/tcp_input.c:6469)\n  tcp_rcv_state_process (net/ipv4/tcp_input.c:6657)\n  tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1929)\n  __release_sock (./include/net/sock.h:1121 net/core/sock.c:2968)\n  release_sock (net/core/sock.c:3536)\n  inet_wait_for_connect (net/ipv4/af_inet.c:609)\n  __inet_stream_connect (net/ipv4/af_inet.c:702)\n  inet_stream_connect (net/ipv4/af_inet.c:748)\n  __sys_connect (./include/linux/file.h:45 net/socket.c:2064)\n  __x64_sys_connect (net/socket.c:2073 net/socket.c:2070 net/socket.c:2070)\n  do_syscall_64 (arch/x86/entry/common.c:51 arch/x86/entry/common.c:82)\n  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:129)\n  RIP: 0033:0x7fa10ff05a3d\n  Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89\n  c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 8b 0d ab a3 0e 00 f7 d8 64 89 01 48\n  RSP: 002b:00007fa110183de8 EFLAGS: 00000202 ORIG_RAX: 000000000000002a\n  RAX: ffffffffffffffda RBX: 0000000020000054 RCX: 00007fa10ff05a3d\n  RDX: 000000000000001c RSI: 0000000020000040 RDI: 0000000000000003\n  RBP: 00007fa110183e20 R08: 0000000000000000 R09: 0000000000000000\n  R10: 0000000000000000 R11: 0000000000000202 R12: 00007fa110184640\n  R13: 0000000000000000 R14: 00007fa10fe8b060 R15: 00007fff73e23b20\n\u0026lt;/TASK\u0026gt;\r\n\r\nThe issue triggering process is analyzed as follows:\nThread A                                       Thread B\ntcp_v4_rcv\t//receive ack TCP packet       inet_shutdown\n  tcp_check_req                                  tcp_disconnect //disconnect sock\n  ...                                              tcp_set_state(sk, TCP_CLOSE)\n    inet_csk_complete_hashdance                ...\n      inet_csk_reqsk_queue_add         \n---truncated---(CVE-2024-26614)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nf_tables: disallow anonymous set with timeout flag\r\n\r\nAnonymous sets are never used with timeout from userspace, reject this.\nException to this rule is NFT_SET_EVAL to ensure legacy meters still work.(CVE-2024-26642)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntracing: Ensure visibility when inserting an element into tracing_map\r\n\r\nRunning the following two commands in parallel on a multi-processor\nAArch64 machine can sporadically produce an unexpected warning about\nduplicate histogram entries:\r\n\r\n $ while true; do\n     echo hist:key=id.syscall:val=hitcount \u0026gt; \\\n       /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/trigger\n     cat /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/hist\n     sleep 0.001\n   done\n $ stress-ng --sysbadaddr $(nproc)\r\n\r\nThe warning looks as follows:\r\n\r\n[ 2911.172474] ------------[ cut here ]------------\n[ 2911.173111] Duplicates detected: 1\n[ 2911.173574] WARNING: CPU: 2 PID: 12247 at kernel/trace/tracing_map.c:983 tracing_map_sort_entries+0x3e0/0x408\n[ 2911.174702] Modules linked in: iscsi_ibft(E) iscsi_boot_sysfs(E) rfkill(E) af_packet(E) nls_iso8859_1(E) nls_cp437(E) vfat(E) fat(E) ena(E) tiny_power_button(E) qemu_fw_cfg(E) button(E) fuse(E) efi_pstore(E) ip_tables(E) x_tables(E) xfs(E) libcrc32c(E) aes_ce_blk(E) aes_ce_cipher(E) crct10dif_ce(E) polyval_ce(E) polyval_generic(E) ghash_ce(E) gf128mul(E) sm4_ce_gcm(E) sm4_ce_ccm(E) sm4_ce(E) sm4_ce_cipher(E) sm4(E) sm3_ce(E) sm3(E) sha3_ce(E) sha512_ce(E) sha512_arm64(E) sha2_ce(E) sha256_arm64(E) nvme(E) sha1_ce(E) nvme_core(E) nvme_auth(E) t10_pi(E) sg(E) scsi_mod(E) scsi_common(E) efivarfs(E)\n[ 2911.174738] Unloaded tainted modules: cppc_cpufreq(E):1\n[ 2911.180985] CPU: 2 PID: 12247 Comm: cat Kdump: loaded Tainted: G            E      6.7.0-default #2 1b58bbb22c97e4399dc09f92d309344f69c44a01\n[ 2911.182398] Hardware name: Amazon EC2 c7g.8xlarge/, BIOS 1.0 11/1/2018\n[ 2911.183208] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n[ 2911.184038] pc : tracing_map_sort_entries+0x3e0/0x408\n[ 2911.184667] lr : tracing_map_sort_entries+0x3e0/0x408\n[ 2911.185310] sp : ffff8000a1513900\n[ 2911.185750] x29: ffff8000a1513900 x28: ffff0003f272fe80 x27: 0000000000000001\n[ 2911.186600] x26: ffff0003f272fe80 x25: 0000000000000030 x24: 0000000000000008\n[ 2911.187458] x23: ffff0003c5788000 x22: ffff0003c16710c8 x21: ffff80008017f180\n[ 2911.188310] x20: ffff80008017f000 x19: ffff80008017f180 x18: ffffffffffffffff\n[ 2911.189160] x17: 0000000000000000 x16: 0000000000000000 x15: ffff8000a15134b8\n[ 2911.190015] x14: 0000000000000000 x13: 205d373432323154 x12: 5b5d313131333731\n[ 2911.190844] x11: 00000000fffeffff x10: 00000000fffeffff x9 : ffffd1b78274a13c\n[ 2911.191716] x8 : 000000000017ffe8 x7 : c0000000fffeffff x6 : 000000000057ffa8\n[ 2911.192554] x5 : ffff0012f6c24ec0 x4 : 0000000000000000 x3 : ffff2e5b72b5d000\n[ 2911.193404] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0003ff254480\n[ 2911.194259] Call trace:\n[ 2911.194626]  tracing_map_sort_entries+0x3e0/0x408\n[ 2911.195220]  hist_show+0x124/0x800\n[ 2911.195692]  seq_read_iter+0x1d4/0x4e8\n[ 2911.196193]  seq_read+0xe8/0x138\n[ 2911.196638]  vfs_read+0xc8/0x300\n[ 2911.197078]  ksys_read+0x70/0x108\n[ 2911.197534]  __arm64_sys_read+0x24/0x38\n[ 2911.198046]  invoke_syscall+0x78/0x108\n[ 2911.198553]  el0_svc_common.constprop.0+0xd0/0xf8\n[ 2911.199157]  do_el0_svc+0x28/0x40\n[ 2911.199613]  el0_svc+0x40/0x178\n[ 2911.200048]  el0t_64_sync_handler+0x13c/0x158\n[ 2911.200621]  el0t_64_sync+0x1a8/0x1b0\n[ 2911.201115] ---[ end trace 0000000000000000 ]---\r\n\r\nThe problem appears to be caused by CPU reordering of writes issued from\n__tracing_map_insert().\r\n\r\nThe check for the presence of an element with a given key in this\nfunction is:\r\n\r\n val = READ_ONCE(entry-\u0026gt;val);\n if (val \u0026amp;\u0026amp; keys_match(key, val-\u0026gt;key, map-\u0026gt;key_size)) ...\r\n\r\nThe write of a new entry is:\r\n\r\n elt = get_free_elt(map);\n memcpy(elt-\u0026gt;key, key, map-\u0026gt;key_size);\n entry-\u0026gt;val = elt;\r\n\r\nThe \u0026quot;memcpy(elt-\u0026gt;key, key, map-\u0026gt;key_size);\u0026quot; and \u0026quot;entry-\u0026gt;val = elt;\u0026quot;\nstores may become visible in the reversed order on another CPU. This\nsecond CPU might then incorrectly determine that a new key doesn\u0026apos;t match\nan already present val-\u0026gt;key and subse\n---truncated---(CVE-2024-26645)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nft_limit: reject configurations that cause integer overflow\r\n\r\nReject bogus configs where internal token counter wraps around.\nThis only occurs with very very large requests, such as 17gbyte/s.\r\n\r\nIts better to reject this rather than having incorrect ratelimit.(CVE-2024-26668)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nblk-mq: fix IO hang from sbitmap wakeup race\r\n\r\nIn blk_mq_mark_tag_wait(), __add_wait_queue() may be re-ordered\nwith the following blk_mq_get_driver_tag() in case of getting driver\ntag failure.\r\n\r\nThen in __sbitmap_queue_wake_up(), waitqueue_active() may not observe\nthe added waiter in blk_mq_mark_tag_wait() and wake up nothing, meantime\nblk_mq_mark_tag_wait() can\u0026apos;t get driver tag successfully.\r\n\r\nThis issue can be reproduced by running the following test in loop, and\nfio hang can be observed in \u0026lt; 30min when running it on my test VM\nin laptop.\r\n\r\n\tmodprobe -r scsi_debug\n\tmodprobe scsi_debug delay=0 dev_size_mb=4096 max_queue=1 host_max_queue=1 submit_queues=4\n\tdev=`ls -d /sys/bus/pseudo/drivers/scsi_debug/adapter*/host*/target*/*/block/* | head -1 | xargs basename`\n\tfio --filename=/dev/\u0026quot;$dev\u0026quot; --direct=1 --rw=randrw --bs=4k --iodepth=1 \\\n       \t\t--runtime=100 --numjobs=40 --time_based --name=test \\\n        \t--ioengine=libaio\r\n\r\nFix the issue by adding one explicit barrier in blk_mq_mark_tag_wait(), which\nis just fine in case of running out of tag.(CVE-2024-26671)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nppp_async: limit MRU to 64K\r\n\r\nsyzbot triggered a warning [1] in __alloc_pages():\r\n\r\nWARN_ON_ONCE_GFP(order \u0026gt; MAX_PAGE_ORDER, gfp)\r\n\r\nWillem fixed a similar issue in commit c0a2a1b0d631 (\u0026quot;ppp: limit MRU to 64K\u0026quot;)\r\n\r\nAdopt the same sanity check for ppp_async_ioctl(PPPIOCSMRU)\r\n\r\n[1]:\r\n\r\n WARNING: CPU: 1 PID: 11 at mm/page_alloc.c:4543 __alloc_pages+0x308/0x698 mm/page_alloc.c:4543\nModules linked in:\nCPU: 1 PID: 11 Comm: kworker/u4:0 Not tainted 6.8.0-rc2-syzkaller-g41bccc98fb79 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023\nWorkqueue: events_unbound flush_to_ldisc\npstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : __alloc_pages+0x308/0x698 mm/page_alloc.c:4543\n lr : __alloc_pages+0xc8/0x698 mm/page_alloc.c:4537\nsp : ffff800093967580\nx29: ffff800093967660 x28: ffff8000939675a0 x27: dfff800000000000\nx26: ffff70001272ceb4 x25: 0000000000000000 x24: ffff8000939675c0\nx23: 0000000000000000 x22: 0000000000060820 x21: 1ffff0001272ceb8\nx20: ffff8000939675e0 x19: 0000000000000010 x18: ffff800093967120\nx17: ffff800083bded5c x16: ffff80008ac97500 x15: 0000000000000005\nx14: 1ffff0001272cebc x13: 0000000000000000 x12: 0000000000000000\nx11: ffff70001272cec1 x10: 1ffff0001272cec0 x9 : 0000000000000001\nx8 : ffff800091c91000 x7 : 0000000000000000 x6 : 000000000000003f\nx5 : 00000000ffffffff x4 : 0000000000000000 x3 : 0000000000000020\nx2 : 0000000000000008 x1 : 0000000000000000 x0 : ffff8000939675e0\nCall trace:\n  __alloc_pages+0x308/0x698 mm/page_alloc.c:4543\n  __alloc_pages_node include/linux/gfp.h:238 [inline]\n  alloc_pages_node include/linux/gfp.h:261 [inline]\n  __kmalloc_large_node+0xbc/0x1fc mm/slub.c:3926\n  __do_kmalloc_node mm/slub.c:3969 [inline]\n  __kmalloc_node_track_caller+0x418/0x620 mm/slub.c:4001\n  kmalloc_reserve+0x17c/0x23c net/core/skbuff.c:590\n  __alloc_skb+0x1c8/0x3d8 net/core/skbuff.c:651\n  __netdev_alloc_skb+0xb8/0x3e8 net/core/skbuff.c:715\n  netdev_alloc_skb include/linux/skbuff.h:3235 [inline]\n  dev_alloc_skb include/linux/skbuff.h:3248 [inline]\n  ppp_async_input drivers/net/ppp/ppp_async.c:863 [inline]\n  ppp_asynctty_receive+0x588/0x186c drivers/net/ppp/ppp_async.c:341\n  tty_ldisc_receive_buf+0x12c/0x15c drivers/tty/tty_buffer.c:390\n  tty_port_default_receive_buf+0x74/0xac drivers/tty/tty_port.c:37\n  receive_buf drivers/tty/tty_buffer.c:444 [inline]\n  flush_to_ldisc+0x284/0x6e4 drivers/tty/tty_buffer.c:494\n  process_one_work+0x694/0x1204 kernel/workqueue.c:2633\n  process_scheduled_works kernel/workqueue.c:2706 [inline]\n  worker_thread+0x938/0xef4 kernel/workqueue.c:2787\n  kthread+0x288/0x310 kernel/kthread.c:388\n  ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860(CVE-2024-26675)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ninet: read sk-\u0026gt;sk_family once in inet_recv_error()\r\n\r\ninet_recv_error() is called without holding the socket lock.\r\n\r\nIPv6 socket could mutate to IPv4 with IPV6_ADDRFORM\nsocket option and trigger a KCSAN warning.(CVE-2024-26679)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnilfs2: fix potential bug in end_buffer_async_write\r\n\r\nAccording to a syzbot report, end_buffer_async_write(), which handles the\ncompletion of block device writes, may detect abnormal condition of the\nbuffer async_write flag and cause a BUG_ON failure when using nilfs2.\r\n\r\nNilfs2 itself does not use end_buffer_async_write().  But, the async_write\nflag is now used as a marker by commit 7f42ec394156 (\u0026quot;nilfs2: fix issue\nwith race condition of competition between segments for dirty blocks\u0026quot;) as\na means of resolving double list insertion of dirty blocks in\nnilfs_lookup_dirty_data_buffers() and nilfs_lookup_node_buffers() and the\nresulting crash.\r\n\r\nThis modification is safe as long as it is used for file data and b-tree\nnode blocks where the page caches are independent.  However, it was\nirrelevant and redundant to also introduce async_write for segment summary\nand super root blocks that share buffers with the backing device.  This\nled to the possibility that the BUG_ON check in end_buffer_async_write\nwould fail as described above, if independent writebacks of the backing\ndevice occurred in parallel.\r\n\r\nThe use of async_write for segment summary buffers has already been\nremoved in a previous change.\r\n\r\nFix this issue by removing the manipulation of the async_write flag for\nthe remaining super root block buffer.(CVE-2024-26685)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nfs/proc: do_task_stat: use sig-\u0026gt;stats_lock to gather the threads/children stats\r\n\r\nlock_task_sighand() can trigger a hard lockup.  If NR_CPUS threads call\ndo_task_stat() at the same time and the process has NR_THREADS, it will\nspin with irqs disabled O(NR_CPUS * NR_THREADS) time.\r\n\r\nChange do_task_stat() to use sig-\u0026gt;stats_lock to gather the statistics\noutside of -\u0026gt;siglock protected section, in the likely case this code will\nrun lockless.(CVE-2024-26686)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnilfs2: fix data corruption in dsync block recovery for small block sizes\r\n\r\nThe helper function nilfs_recovery_copy_block() of\nnilfs_recovery_dsync_blocks(), which recovers data from logs created by\ndata sync writes during a mount after an unclean shutdown, incorrectly\ncalculates the on-page offset when copying repair data to the file\u0026apos;s page\ncache.  In environments where the block size is smaller than the page\nsize, this flaw can cause data corruption and leak uninitialized memory\nbytes during the recovery process.\r\n\r\nFix these issues by correcting this byte offset calculation on the page.(CVE-2024-26697)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again\r\n\r\n(struct dirty_throttle_control *)-\u0026gt;thresh is an unsigned long, but is\npassed as the u32 divisor argument to div_u64().  On architectures where\nunsigned long is 64 bytes, the argument will be implicitly truncated.\r\n\r\nUse div64_u64() instead of div_u64() so that the value used in the \u0026quot;is\nthis a safe division\u0026quot; check is the same as the divisor.\r\n\r\nAlso, remove redundant cast of the numerator to u64, as that should happen\nimplicitly.\r\n\r\nThis would be difficult to exploit in memcg domain, given the ratio-based\narithmetic domain_drity_limits() uses, but is much easier in global\nwriteback domain with a BDI_CAP_STRICTLIMIT-backing device, using e.g. \nvm.dirty_bytes=(1\u0026lt;\u0026lt;32)*PAGE_SIZE so that dtc-\u0026gt;thresh == (1\u0026lt;\u0026lt;32)(CVE-2024-26720)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbtrfs: don\u0026apos;t drop extent_map for free space inode on write error\r\n\r\nWhile running the CI for an unrelated change I hit the following panic\nwith generic/648 on btrfs_holes_spacecache.\r\n\r\nassertion failed: block_start != EXTENT_MAP_HOLE, in fs/btrfs/extent_io.c:1385\n------------[ cut here ]------------\nkernel BUG at fs/btrfs/extent_io.c:1385!\ninvalid opcode: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 1 PID: 2695096 Comm: fsstress Kdump: loaded Tainted: G        W          6.8.0-rc2+ #1\nRIP: 0010:__extent_writepage_io.constprop.0+0x4c1/0x5c0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n extent_write_cache_pages+0x2ac/0x8f0\n extent_writepages+0x87/0x110\n do_writepages+0xd5/0x1f0\n filemap_fdatawrite_wbc+0x63/0x90\n __filemap_fdatawrite_range+0x5c/0x80\n btrfs_fdatawrite_range+0x1f/0x50\n btrfs_write_out_cache+0x507/0x560\n btrfs_write_dirty_block_groups+0x32a/0x420\n commit_cowonly_roots+0x21b/0x290\n btrfs_commit_transaction+0x813/0x1360\n btrfs_sync_file+0x51a/0x640\n __x64_sys_fdatasync+0x52/0x90\n do_syscall_64+0x9c/0x190\n entry_SYSCALL_64_after_hwframe+0x6e/0x76\r\n\r\nThis happens because we fail to write out the free space cache in one\ninstance, come back around and attempt to write it again.  However on\nthe second pass through we go to call btrfs_get_extent() on the inode to\nget the extent mapping.  Because this is a new block group, and with the\nfree space inode we always search the commit root to avoid deadlocking\nwith the tree, we find nothing and return a EXTENT_MAP_HOLE for the\nrequested range.\r\n\r\nThis happens because the first time we try to write the space cache out\nwe hit an error, and on an error we drop the extent mapping.  This is\nnormal for normal files, but the free space cache inode is special.  We\nalways expect the extent map to be correct.  Thus the second time\nthrough we end up with a bogus extent map.\r\n\r\nSince we\u0026apos;re deprecating this feature, the most straightforward way to\nfix this is to simply skip dropping the extent map range for this failed\nrange.\r\n\r\nI shortened the test by using error injection to stress the area to make\nit easier to reproduce.  With this patch in place we no longer panic\nwith my error injection test.(CVE-2024-26726)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\narp: Prevent overflow in arp_req_get().\r\n\r\nsyzkaller reported an overflown write in arp_req_get(). [0]\r\n\r\nWhen ioctl(SIOCGARP) is issued, arp_req_get() looks up an neighbour\nentry and copies neigh-\u0026gt;ha to struct arpreq.arp_ha.sa_data.\r\n\r\nThe arp_ha here is struct sockaddr, not struct sockaddr_storage, so\nthe sa_data buffer is just 14 bytes.\r\n\r\nIn the splat below, 2 bytes are overflown to the next int field,\narp_flags.  We initialise the field just after the memcpy(), so it\u0026apos;s\nnot a problem.\r\n\r\nHowever, when dev-\u0026gt;addr_len is greater than 22 (e.g. MAX_ADDR_LEN),\narp_netmask is overwritten, which could be set as htonl(0xFFFFFFFFUL)\nin arp_ioctl() before calling arp_req_get().\r\n\r\nTo avoid the overflow, let\u0026apos;s limit the max length of memcpy().\r\n\r\nNote that commit b5f0de6df6dc (\u0026quot;net: dev: Convert sa_data to flexible\narray in struct sockaddr\u0026quot;) just silenced syzkaller.\r\n\r\n[0]:\nmemcpy: detected field-spanning write (size 16) of single field \u0026quot;r-\u0026gt;arp_ha.sa_data\u0026quot; at net/ipv4/arp.c:1128 (size 14)\nWARNING: CPU: 0 PID: 144638 at net/ipv4/arp.c:1128 arp_req_get+0x411/0x4a0 net/ipv4/arp.c:1128\nModules linked in:\nCPU: 0 PID: 144638 Comm: syz-executor.4 Not tainted 6.1.74 #31\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-5 04/01/2014\nRIP: 0010:arp_req_get+0x411/0x4a0 net/ipv4/arp.c:1128\nCode: fd ff ff e8 41 42 de fb b9 0e 00 00 00 4c 89 fe 48 c7 c2 20 6d ab 87 48 c7 c7 80 6d ab 87 c6 05 25 af 72 04 01 e8 5f 8d ad fb \u0026lt;0f\u0026gt; 0b e9 6c fd ff ff e8 13 42 de fb be 03 00 00 00 4c 89 e7 e8 a6\nRSP: 0018:ffffc900050b7998 EFLAGS: 00010286\nRAX: 0000000000000000 RBX: ffff88803a815000 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: ffffffff8641a44a RDI: 0000000000000001\nRBP: ffffc900050b7a98 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000000 R11: 203a7970636d656d R12: ffff888039c54000\nR13: 1ffff92000a16f37 R14: ffff88803a815084 R15: 0000000000000010\nFS:  00007f172bf306c0(0000) GS:ffff88805aa00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f172b3569f0 CR3: 0000000057f12005 CR4: 0000000000770ef0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n \u0026lt;TASK\u0026gt;\n arp_ioctl+0x33f/0x4b0 net/ipv4/arp.c:1261\n inet_ioctl+0x314/0x3a0 net/ipv4/af_inet.c:981\n sock_do_ioctl+0xdf/0x260 net/socket.c:1204\n sock_ioctl+0x3ef/0x650 net/socket.c:1321\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:870 [inline]\n __se_sys_ioctl fs/ioctl.c:856 [inline]\n __x64_sys_ioctl+0x18e/0x220 fs/ioctl.c:856\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x37/0x90 arch/x86/entry/common.c:81\n entry_SYSCALL_64_after_hwframe+0x64/0xce\nRIP: 0033:0x7f172b262b8d\nCode: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f172bf300b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 00007f172b3abf80 RCX: 00007f172b262b8d\nRDX: 0000000020000000 RSI: 0000000000008954 RDI: 0000000000000003\nRBP: 00007f172b2d3493 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 000000000000000b R14: 00007f172b3abf80 R15: 00007f172bf10000\n \u0026lt;/TASK\u0026gt;(CVE-2024-26733)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nipv6: sr: fix possible use-after-free and null-ptr-deref\r\n\r\nThe pernet operations structure for the subsystem must be registered\nbefore registering the generic netlink family.(CVE-2024-26735)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/sched: act_mirred: don\u0026apos;t override retval if we already lost the skb\r\n\r\nIf we\u0026apos;re redirecting the skb, and haven\u0026apos;t called tcf_mirred_forward(),\nyet, we need to tell the core to drop the skb by setting the retcode\nto SHOT. If we have called tcf_mirred_forward(), however, the skb\nis out of our hands and returning SHOT will lead to UaF.\r\n\r\nMove the retval override to the error path which actually need it.(CVE-2024-26739)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/sched: act_mirred: use the backlog for mirred ingress\r\n\r\nThe test Davide added in commit ca22da2fbd69 (\u0026quot;act_mirred: use the backlog\nfor nested calls to mirred ingress\u0026quot;) hangs our testing VMs every 10 or so\nruns, with the familiar tcp_v4_rcv -\u0026gt; tcp_v4_rcv deadlock reported by\nlockdep.\r\n\r\nThe problem as previously described by Davide (see Link) is that\nif we reverse flow of traffic with the redirect (egress -\u0026gt; ingress)\nwe may reach the same socket which generated the packet. And we may\nstill be holding its socket lock. The common solution to such deadlocks\nis to put the packet in the Rx backlog, rather than run the Rx path\ninline. Do that for all egress -\u0026gt; ingress reversals, not just once\nwe started to nest mirred calls.\r\n\r\nIn the past there was a concern that the backlog indirection will\nlead to loss of error reporting / less accurate stats. But the current\nworkaround does not seem to address the issue.(CVE-2024-26740)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nRDMA/qedr: Fix qedr_create_user_qp error flow\r\n\r\nAvoid the following warning by making sure to free the allocated\nresources in case that qedr_init_user_queue() fail.\r\n\r\n-----------[ cut here ]-----------\nWARNING: CPU: 0 PID: 143192 at drivers/infiniband/core/rdma_core.c:874 uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]\nModules linked in: tls target_core_user uio target_core_pscsi target_core_file target_core_iblock ib_srpt ib_srp scsi_transport_srp nfsd nfs_acl rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs 8021q garp mrp stp llc ext4 mbcache jbd2 opa_vnic ib_umad ib_ipoib sunrpc rdma_ucm ib_isert iscsi_target_mod target_core_mod ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm hfi1 intel_rapl_msr intel_rapl_common mgag200 qedr sb_edac drm_shmem_helper rdmavt x86_pkg_temp_thermal drm_kms_helper intel_powerclamp ib_uverbs coretemp i2c_algo_bit kvm_intel dell_wmi_descriptor ipmi_ssif sparse_keymap kvm ib_core rfkill syscopyarea sysfillrect video sysimgblt irqbypass ipmi_si ipmi_devintf fb_sys_fops rapl iTCO_wdt mxm_wmi iTCO_vendor_support intel_cstate pcspkr dcdbas intel_uncore ipmi_msghandler lpc_ich acpi_power_meter mei_me mei fuse drm xfs libcrc32c qede sd_mod ahci libahci t10_pi sg crct10dif_pclmul crc32_pclmul crc32c_intel qed libata tg3\nghash_clmulni_intel megaraid_sas crc8 wmi [last unloaded: ib_srpt]\nCPU: 0 PID: 143192 Comm: fi_rdm_tagged_p Kdump: loaded Not tainted 5.14.0-408.el9.x86_64 #1\nHardware name: Dell Inc. PowerEdge R430/03XKDV, BIOS 2.14.0 01/25/2022\nRIP: 0010:uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]\nCode: 5d 41 5c 41 5d 41 5e e9 0f 26 1b dd 48 89 df e8 67 6a ff ff 49 8b 86 10 01 00 00 48 85 c0 74 9c 4c 89 e7 e8 83 c0 cb dd eb 92 \u0026lt;0f\u0026gt; 0b eb be 0f 0b be 04 00 00 00 48 89 df e8 8e f5 ff ff e9 6d ff\nRSP: 0018:ffffb7c6cadfbc60 EFLAGS: 00010286\nRAX: ffff8f0889ee3f60 RBX: ffff8f088c1a5200 RCX: 00000000802a0016\nRDX: 00000000802a0017 RSI: 0000000000000001 RDI: ffff8f0880042600\nRBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000\nR10: ffff8f11fffd5000 R11: 0000000000039000 R12: ffff8f0d5b36cd80\nR13: ffff8f088c1a5250 R14: ffff8f1206d91000 R15: 0000000000000000\nFS: 0000000000000000(0000) GS:ffff8f11d7c00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000147069200e20 CR3: 00000001c7210002 CR4: 00000000001706f0\nCall Trace:\n\u0026lt;TASK\u0026gt;\n? show_trace_log_lvl+0x1c4/0x2df\n? show_trace_log_lvl+0x1c4/0x2df\n? ib_uverbs_close+0x1f/0xb0 [ib_uverbs]\n? uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]\n? __warn+0x81/0x110\n? uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]\n? report_bug+0x10a/0x140\n? handle_bug+0x3c/0x70\n? exc_invalid_op+0x14/0x70\n? asm_exc_invalid_op+0x16/0x20\n? uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]\nib_uverbs_close+0x1f/0xb0 [ib_uverbs]\n__fput+0x94/0x250\ntask_work_run+0x5c/0x90\ndo_exit+0x270/0x4a0\ndo_group_exit+0x2d/0x90\nget_signal+0x87c/0x8c0\narch_do_signal_or_restart+0x25/0x100\n? ib_uverbs_ioctl+0xc2/0x110 [ib_uverbs]\nexit_to_user_mode_loop+0x9c/0x130\nexit_to_user_mode_prepare+0xb6/0x100\nsyscall_exit_to_user_mode+0x12/0x40\ndo_syscall_64+0x69/0x90\n? syscall_exit_work+0x103/0x130\n? syscall_exit_to_user_mode+0x22/0x40\n? do_syscall_64+0x69/0x90\n? syscall_exit_work+0x103/0x130\n? syscall_exit_to_user_mode+0x22/0x40\n? do_syscall_64+0x69/0x90\n? do_syscall_64+0x69/0x90\n? common_interrupt+0x43/0xa0\nentry_SYSCALL_64_after_hwframe+0x72/0xdc\nRIP: 0033:0x1470abe3ec6b\nCode: Unable to access opcode bytes at RIP 0x1470abe3ec41.\nRSP: 002b:00007fff13ce9108 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: fffffffffffffffc RBX: 00007fff13ce9218 RCX: 00001470abe3ec6b\nRDX: 00007fff13ce9200 RSI: 00000000c0181b01 RDI: 0000000000000004\nRBP: 00007fff13ce91e0 R08: 0000558d9655da10 R09: 0000558d9655dd00\nR10: 00007fff13ce95c0 R11: 0000000000000246 R12: 00007fff13ce9358\nR13: 0000000000000013 R14: 0000558d9655db50 R15: 00007fff13ce9470\n\u0026lt;/TASK\u0026gt;\n--[ end trace 888a9b92e04c5c97 ]--(CVE-2024-26743)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nRDMA/srpt: Support specifying the srpt_service_guid parameter\r\n\r\nMake loading ib_srpt with this parameter set work. The current behavior is\nthat setting that parameter while loading the ib_srpt kernel module\ntriggers the following kernel crash:\r\n\r\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nCall Trace:\n \u0026lt;TASK\u0026gt;\n parse_one+0x18c/0x1d0\n parse_args+0xe1/0x230\n load_module+0x8de/0xa60\n init_module_from_file+0x8b/0xd0\n idempotent_init_module+0x181/0x240\n __x64_sys_finit_module+0x5a/0xb0\n do_syscall_64+0x5f/0xe0\n entry_SYSCALL_64_after_hwframe+0x6e/0x76(CVE-2024-26744)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nl2tp: pass correct message length to ip6_append_data\r\n\r\nl2tp_ip6_sendmsg needs to avoid accounting for the transport header\ntwice when splicing more data into an already partially-occupied skbuff.\r\n\r\nTo manage this, we check whether the skbuff contains data using\nskb_queue_empty when deciding how much data to append using\nip6_append_data.\r\n\r\nHowever, the code which performed the calculation was incorrect:\r\n\r\n     ulen = len + skb_queue_empty(\u0026amp;sk-\u0026gt;sk_write_queue) ? transhdrlen : 0;\r\n\r\n...due to C operator precedence, this ends up setting ulen to\ntranshdrlen for messages with a non-zero length, which results in\ncorrupted packets on the wire.\r\n\r\nAdd parentheses to correct the calculation in line with the original\nintent.(CVE-2024-26752)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ngtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()\r\n\r\nThe gtp_net_ops pernet operations structure for the subsystem must be\nregistered before registering the generic netlink family.\r\n\r\nSyzkaller hit \u0026apos;general protection fault in gtp_genl_dump_pdp\u0026apos; bug:\r\n\r\ngeneral protection fault, probably for non-canonical address\n0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN NOPTI\nKASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\nCPU: 1 PID: 5826 Comm: gtp Not tainted 6.8.0-rc3-std-def-alt1 #1\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-alt1 04/01/2014\nRIP: 0010:gtp_genl_dump_pdp+0x1be/0x800 [gtp]\nCode: c6 89 c6 e8 64 e9 86 df 58 45 85 f6 0f 85 4e 04 00 00 e8 c5 ee 86\n      df 48 8b 54 24 18 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 \u0026lt;80\u0026gt;\n      3c 02 00 0f 85 de 05 00 00 48 8b 44 24 18 4c 8b 30 4c 39 f0 74\nRSP: 0018:ffff888014107220 EFLAGS: 00010202\nRAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000\nRDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000\nRBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000\nR13: ffff88800fcda588 R14: 0000000000000001 R15: 0000000000000000\nFS:  00007f1be4eb05c0(0000) GS:ffff88806ce80000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f1be4e766cf CR3: 000000000c33e000 CR4: 0000000000750ef0\nPKRU: 55555554\nCall Trace:\n \u0026lt;TASK\u0026gt;\n ? show_regs+0x90/0xa0\n ? die_addr+0x50/0xd0\n ? exc_general_protection+0x148/0x220\n ? asm_exc_general_protection+0x22/0x30\n ? gtp_genl_dump_pdp+0x1be/0x800 [gtp]\n ? __alloc_skb+0x1dd/0x350\n ? __pfx___alloc_skb+0x10/0x10\n genl_dumpit+0x11d/0x230\n netlink_dump+0x5b9/0xce0\n ? lockdep_hardirqs_on_prepare+0x253/0x430\n ? __pfx_netlink_dump+0x10/0x10\n ? kasan_save_track+0x10/0x40\n ? __kasan_kmalloc+0x9b/0xa0\n ? genl_start+0x675/0x970\n __netlink_dump_start+0x6fc/0x9f0\n genl_family_rcv_msg_dumpit+0x1bb/0x2d0\n ? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10\n ? genl_op_from_small+0x2a/0x440\n ? cap_capable+0x1d0/0x240\n ? __pfx_genl_start+0x10/0x10\n ? __pfx_genl_dumpit+0x10/0x10\n ? __pfx_genl_done+0x10/0x10\n ? security_capable+0x9d/0xe0(CVE-2024-26754)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndm-crypt: don\u0026apos;t modify the data when using authenticated encryption\r\n\r\nIt was said that authenticated encryption could produce invalid tag when\nthe data that is being encrypted is modified [1]. So, fix this problem by\ncopying the data into the clone bio first and then encrypt them inside the\nclone bio.\r\n\r\nThis may reduce performance, but it is needed to prevent the user from\ncorrupting the device by writing data with O_DIRECT and modifying them at\nthe same time.\r\n\r\n[1] https://lore.kernel.org/all/20240207004723.GA35324@sol.localdomain/T/(CVE-2024-26763)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbtrfs: dev-replace: properly validate device names\r\n\r\nThere\u0026apos;s a syzbot report that device name buffers passed to device\nreplace are not properly checked for string termination which could lead\nto a read out of bounds in getname_kernel().\r\n\r\nAdd a helper that validates both source and target device name buffers.\nFor devid as the source initialize the buffer to empty string in case\nsomething tries to read it later.\r\n\r\nThis was originally analyzed and fixed in a different way by Edward Adam\nDavis (see links).(CVE-2024-26791)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ngtp: fix use-after-free and null-ptr-deref in gtp_newlink()\r\n\r\nThe gtp_link_ops operations structure for the subsystem must be\nregistered after registering the gtp_net_ops pernet operations structure.\r\n\r\nSyzkaller hit \u0026apos;general protection fault in gtp_genl_dump_pdp\u0026apos; bug:\r\n\r\n[ 1010.702740] gtp: GTP module unloaded\n[ 1010.715877] general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI\n[ 1010.715888] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\n[ 1010.715895] CPU: 1 PID: 128616 Comm: a.out Not tainted 6.8.0-rc6-std-def-alt1 #1\n[ 1010.715899] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-alt1 04/01/2014\n[ 1010.715908] RIP: 0010:gtp_newlink+0x4d7/0x9c0 [gtp]\n[ 1010.715915] Code: 80 3c 02 00 0f 85 41 04 00 00 48 8b bb d8 05 00 00 e8 ed f6 ff ff 48 89 c2 48 89 c5 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 \u0026lt;80\u0026gt; 3c 02 00 0f 85 4f 04 00 00 4c 89 e2 4c 8b 6d 00 48 b8 00 00 00\n[ 1010.715920] RSP: 0018:ffff888020fbf180 EFLAGS: 00010203\n[ 1010.715929] RAX: dffffc0000000000 RBX: ffff88800399c000 RCX: 0000000000000000\n[ 1010.715933] RDX: 0000000000000001 RSI: ffffffff84805280 RDI: 0000000000000282\n[ 1010.715938] RBP: 000000000000000d R08: 0000000000000001 R09: 0000000000000000\n[ 1010.715942] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88800399cc80\n[ 1010.715947] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000400\n[ 1010.715953] FS:  00007fd1509ab5c0(0000) GS:ffff88805b300000(0000) knlGS:0000000000000000\n[ 1010.715958] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 1010.715962] CR2: 0000000000000000 CR3: 000000001c07a000 CR4: 0000000000750ee0\n[ 1010.715968] PKRU: 55555554\n[ 1010.715972] Call Trace:\n[ 1010.715985]  ? __die_body.cold+0x1a/0x1f\n[ 1010.715995]  ? die_addr+0x43/0x70\n[ 1010.716002]  ? exc_general_protection+0x199/0x2f0\n[ 1010.716016]  ? asm_exc_general_protection+0x1e/0x30\n[ 1010.716026]  ? gtp_newlink+0x4d7/0x9c0 [gtp]\n[ 1010.716034]  ? gtp_net_exit+0x150/0x150 [gtp]\n[ 1010.716042]  __rtnl_newlink+0x1063/0x1700\n[ 1010.716051]  ? rtnl_setlink+0x3c0/0x3c0\n[ 1010.716063]  ? is_bpf_text_address+0xc0/0x1f0\n[ 1010.716070]  ? kernel_text_address.part.0+0xbb/0xd0\n[ 1010.716076]  ? __kernel_text_address+0x56/0xa0\n[ 1010.716084]  ? unwind_get_return_address+0x5a/0xa0\n[ 1010.716091]  ? create_prof_cpu_mask+0x30/0x30\n[ 1010.716098]  ? arch_stack_walk+0x9e/0xf0\n[ 1010.716106]  ? stack_trace_save+0x91/0xd0\n[ 1010.716113]  ? stack_trace_consume_entry+0x170/0x170\n[ 1010.716121]  ? __lock_acquire+0x15c5/0x5380\n[ 1010.716139]  ? mark_held_locks+0x9e/0xe0\n[ 1010.716148]  ? kmem_cache_alloc_trace+0x35f/0x3c0\n[ 1010.716155]  ? __rtnl_newlink+0x1700/0x1700\n[ 1010.716160]  rtnl_newlink+0x69/0xa0\n[ 1010.716166]  rtnetlink_rcv_msg+0x43b/0xc50\n[ 1010.716172]  ? rtnl_fdb_dump+0x9f0/0x9f0\n[ 1010.716179]  ? lock_acquire+0x1fe/0x560\n[ 1010.716188]  ? netlink_deliver_tap+0x12f/0xd50\n[ 1010.716196]  netlink_rcv_skb+0x14d/0x440\n[ 1010.716202]  ? rtnl_fdb_dump+0x9f0/0x9f0\n[ 1010.716208]  ? netlink_ack+0xab0/0xab0\n[ 1010.716213]  ? netlink_deliver_tap+0x202/0xd50\n[ 1010.716220]  ? netlink_deliver_tap+0x218/0xd50\n[ 1010.716226]  ? __virt_addr_valid+0x30b/0x590\n[ 1010.716233]  netlink_unicast+0x54b/0x800\n[ 1010.716240]  ? netlink_attachskb+0x870/0x870\n[ 1010.716248]  ? __check_object_size+0x2de/0x3b0\n[ 1010.716254]  netlink_sendmsg+0x938/0xe40\n[ 1010.716261]  ? netlink_unicast+0x800/0x800\n[ 1010.716269]  ? __import_iovec+0x292/0x510\n[ 1010.716276]  ? netlink_unicast+0x800/0x800\n[ 1010.716284]  __sock_sendmsg+0x159/0x190\n[ 1010.716290]  ____sys_sendmsg+0x712/0x880\n[ 1010.716297]  ? sock_write_iter+0x3d0/0x3d0\n[ 1010.716304]  ? __ia32_sys_recvmmsg+0x270/0x270\n[ 1010.716309]  ? lock_acquire+0x1fe/0x560\n[ 1010.716315]  ? drain_array_locked+0x90/0x90\n[ 1010.716324]  ___sys_sendmsg+0xf8/0x170\n[ 1010.716331]  ? sendmsg_copy_msghdr+0x170/0x170\n[ 1010.716337]  ? lockdep_init_map\n---truncated---(CVE-2024-26793)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nBluetooth: Avoid potential use-after-free in hci_error_reset\r\n\r\nWhile handling the HCI_EV_HARDWARE_ERROR event, if the underlying\nBT controller is not responding, the GPIO reset mechanism would\nfree the hci_dev and lead to a use-after-free in hci_error_reset.\r\n\r\nHere\u0026apos;s the call trace observed on a ChromeOS device with Intel AX201:\n   queue_work_on+0x3e/0x6c\n   __hci_cmd_sync_sk+0x2ee/0x4c0 [bluetooth \u0026lt;HASH:3b4a6\u0026gt;]\n   ? init_wait_entry+0x31/0x31\n   __hci_cmd_sync+0x16/0x20 [bluetooth \u0026lt;HASH:3b4a 6\u0026gt;]\n   hci_error_reset+0x4f/0xa4 [bluetooth \u0026lt;HASH:3b4a 6\u0026gt;]\n   process_one_work+0x1d8/0x33f\n   worker_thread+0x21b/0x373\n   kthread+0x13a/0x152\n   ? pr_cont_work+0x54/0x54\n   ? kthread_blkcg+0x31/0x31\n    ret_from_fork+0x1f/0x30\r\n\r\nThis patch holds the reference count on the hci_dev while processing\na HCI_EV_HARDWARE_ERROR event to avoid potential crash.(CVE-2024-26801)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: ip_tunnel: prevent perpetual headroom growth\r\n\r\nsyzkaller triggered following kasan splat:\nBUG: KASAN: use-after-free in __skb_flow_dissect+0x19d1/0x7a50 net/core/flow_dissector.c:1170\nRead of size 1 at addr ffff88812fb4000e by task syz-executor183/5191\n[..]\n kasan_report+0xda/0x110 mm/kasan/report.c:588\n __skb_flow_dissect+0x19d1/0x7a50 net/core/flow_dissector.c:1170\n skb_flow_dissect_flow_keys include/linux/skbuff.h:1514 [inline]\n ___skb_get_hash net/core/flow_dissector.c:1791 [inline]\n __skb_get_hash+0xc7/0x540 net/core/flow_dissector.c:1856\n skb_get_hash include/linux/skbuff.h:1556 [inline]\n ip_tunnel_xmit+0x1855/0x33c0 net/ipv4/ip_tunnel.c:748\n ipip_tunnel_xmit+0x3cc/0x4e0 net/ipv4/ipip.c:308\n __netdev_start_xmit include/linux/netdevice.h:4940 [inline]\n netdev_start_xmit include/linux/netdevice.h:4954 [inline]\n xmit_one net/core/dev.c:3548 [inline]\n dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3564\n __dev_queue_xmit+0x7c1/0x3d60 net/core/dev.c:4349\n dev_queue_xmit include/linux/netdevice.h:3134 [inline]\n neigh_connected_output+0x42c/0x5d0 net/core/neighbour.c:1592\n ...\n ip_finish_output2+0x833/0x2550 net/ipv4/ip_output.c:235\n ip_finish_output+0x31/0x310 net/ipv4/ip_output.c:323\n ..\n iptunnel_xmit+0x5b4/0x9b0 net/ipv4/ip_tunnel_core.c:82\n ip_tunnel_xmit+0x1dbc/0x33c0 net/ipv4/ip_tunnel.c:831\n ipgre_xmit+0x4a1/0x980 net/ipv4/ip_gre.c:665\n __netdev_start_xmit include/linux/netdevice.h:4940 [inline]\n netdev_start_xmit include/linux/netdevice.h:4954 [inline]\n xmit_one net/core/dev.c:3548 [inline]\n dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3564\n ...\r\n\r\nThe splat occurs because skb-\u0026gt;data points past skb-\u0026gt;head allocated area.\nThis is because neigh layer does:\n  __skb_pull(skb, skb_network_offset(skb));\r\n\r\n... but skb_network_offset() returns a negative offset and __skb_pull()\narg is unsigned.  IOW, we skb-\u0026gt;data gets \u0026quot;adjusted\u0026quot; by a huge value.\r\n\r\nThe negative value is returned because skb-\u0026gt;head and skb-\u0026gt;data distance is\nmore than 64k and skb-\u0026gt;network_header (u16) has wrapped around.\r\n\r\nThe bug is in the ip_tunnel infrastructure, which can cause\ndev-\u0026gt;needed_headroom to increment ad infinitum.\r\n\r\nThe syzkaller reproducer consists of packets getting routed via a gre\ntunnel, and route of gre encapsulated packets pointing at another (ipip)\ntunnel.  The ipip encapsulation finds gre0 as next output device.\r\n\r\nThis results in the following pattern:\r\n\r\n1). First packet is to be sent out via gre0.\nRoute lookup found an output device, ipip0.\r\n\r\n2).\nip_tunnel_xmit for gre0 bumps gre0-\u0026gt;needed_headroom based on the future\noutput device, rt.dev-\u0026gt;needed_headroom (ipip0).\r\n\r\n3).\nip output / start_xmit moves skb on to ipip0. which runs the same\ncode path again (xmit recursion).\r\n\r\n4).\nRouting step for the post-gre0-encap packet finds gre0 as output device\nto use for ipip0 encapsulated packet.\r\n\r\ntunl0-\u0026gt;needed_headroom is then incremented based on the (already bumped)\ngre0 device headroom.\r\n\r\nThis repeats for every future packet:\r\n\r\ngre0-\u0026gt;needed_headroom gets inflated because previous packets\u0026apos; ipip0 step\nincremented rt-\u0026gt;dev (gre0) headroom, and ipip0 incremented because gre0\nneeded_headroom was increased.\r\n\r\nFor each subsequent packet, gre/ipip0-\u0026gt;needed_headroom grows until\npost-expand-head reallocations result in a skb-\u0026gt;head/data distance of\nmore than 64k.\r\n\r\nOnce that happens, skb-\u0026gt;network_header (u16) wraps around when\npskb_expand_head tries to make sure that skb_network_offset() is unchanged\nafter the headroom expansion/reallocation.\r\n\r\nAfter this skb_network_offset(skb) returns a different (and negative)\nresult post headroom expansion.\r\n\r\nThe next trip to neigh layer (or anything else that would __skb_pull the\nnetwork header) makes skb-\u0026gt;data point to a memory location outside\nskb-\u0026gt;head area.\r\n\r\nv2: Cap the needed_headroom update to an arbitarily chosen upperlimit to\nprevent perpetual increase instead of dropping the headroom increment\ncompletely.(CVE-2024-26804)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetlink: Fix kernel-infoleak-after-free in __skb_datagram_iter\r\n\r\nsyzbot reported the following uninit-value access issue [1]:\r\n\r\nnetlink_to_full_skb() creates a new `skb` and puts the `skb-\u0026gt;data`\npassed as a 1st arg of netlink_to_full_skb() onto new `skb`. The data\nsize is specified as `len` and passed to skb_put_data(). This `len`\nis based on `skb-\u0026gt;end` that is not data offset but buffer offset. The\n`skb-\u0026gt;end` contains data and tailroom. Since the tailroom is not\ninitialized when the new `skb` created, KMSAN detects uninitialized\nmemory area when copying the data.\r\n\r\nThis patch resolved this issue by correct the len from `skb-\u0026gt;end` to\n`skb-\u0026gt;len`, which is the actual data offset.\r\n\r\nBUG: KMSAN: kernel-infoleak-after-free in instrument_copy_to_user include/linux/instrumented.h:114 [inline]\nBUG: KMSAN: kernel-infoleak-after-free in copy_to_user_iter lib/iov_iter.c:24 [inline]\nBUG: KMSAN: kernel-infoleak-after-free in iterate_ubuf include/linux/iov_iter.h:29 [inline]\nBUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance2 include/linux/iov_iter.h:245 [inline]\nBUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance include/linux/iov_iter.h:271 [inline]\nBUG: KMSAN: kernel-infoleak-after-free in _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186\n instrument_copy_to_user include/linux/instrumented.h:114 [inline]\n copy_to_user_iter lib/iov_iter.c:24 [inline]\n iterate_ubuf include/linux/iov_iter.h:29 [inline]\n iterate_and_advance2 include/linux/iov_iter.h:245 [inline]\n iterate_and_advance include/linux/iov_iter.h:271 [inline]\n _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186\n copy_to_iter include/linux/uio.h:197 [inline]\n simple_copy_to_iter+0x68/0xa0 net/core/datagram.c:532\n __skb_datagram_iter+0x123/0xdc0 net/core/datagram.c:420\n skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:546\n skb_copy_datagram_msg include/linux/skbuff.h:3960 [inline]\n packet_recvmsg+0xd9c/0x2000 net/packet/af_packet.c:3482\n sock_recvmsg_nosec net/socket.c:1044 [inline]\n sock_recvmsg net/socket.c:1066 [inline]\n sock_read_iter+0x467/0x580 net/socket.c:1136\n call_read_iter include/linux/fs.h:2014 [inline]\n new_sync_read fs/read_write.c:389 [inline]\n vfs_read+0x8f6/0xe00 fs/read_write.c:470\n ksys_read+0x20f/0x4c0 fs/read_write.c:613\n __do_sys_read fs/read_write.c:623 [inline]\n __se_sys_read fs/read_write.c:621 [inline]\n __x64_sys_read+0x93/0xd0 fs/read_write.c:621\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nUninit was stored to memory at:\n skb_put_data include/linux/skbuff.h:2622 [inline]\n netlink_to_full_skb net/netlink/af_netlink.c:181 [inline]\n __netlink_deliver_tap_skb net/netlink/af_netlink.c:298 [inline]\n __netlink_deliver_tap+0x5be/0xc90 net/netlink/af_netlink.c:325\n netlink_deliver_tap net/netlink/af_netlink.c:338 [inline]\n netlink_deliver_tap_kernel net/netlink/af_netlink.c:347 [inline]\n netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]\n netlink_unicast+0x10f1/0x1250 net/netlink/af_netlink.c:1368\n netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg net/socket.c:745 [inline]\n ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584\n ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638\n __sys_sendmsg net/socket.c:2667 [inline]\n __do_sys_sendmsg net/socket.c:2676 [inline]\n __se_sys_sendmsg net/socket.c:2674 [inline]\n __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nUninit was created at:\n free_pages_prepare mm/page_alloc.c:1087 [inline]\n free_unref_page_prepare+0xb0/0xa40 mm/page_alloc.c:2347\n free_unref_page_list+0xeb/0x1100 mm/page_alloc.c:2533\n release_pages+0x23d3/0x2410 mm/swap.c:1042\n free_pages_and_swap_cache+0xd9/0xf0 mm/swap_state.c:316\n tlb_batch_pages\n---truncated---(CVE-2024-26805)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nvfio/pci: Create persistent INTx handler\r\n\r\nA vulnerability exists where the eventfd for INTx signaling can be\ndeconfigured, which unregisters the IRQ handler but still allows\neventfds to be signaled with a NULL context through the SET_IRQS ioctl\nor through unmask irqfd if the device interrupt is pending.\r\n\r\nIdeally this could be solved with some additional locking; the igate\nmutex serializes the ioctl and config space accesses, and the interrupt\nhandler is unregistered relative to the trigger, but the irqfd path\nruns asynchronous to those.  The igate mutex cannot be acquired from the\natomic context of the eventfd wake function.  Disabling the irqfd\nrelative to the eventfd registration is potentially incompatible with\nexisting userspace.\r\n\r\nAs a result, the solution implemented here moves configuration of the\nINTx interrupt handler to track the lifetime of the INTx context object\nand irq_type configuration, rather than registration of a particular\ntrigger eventfd.  Synchronization is added between the ioctl path and\neventfd_signal() wrapper such that the eventfd trigger can be\ndynamically updated relative to in-flight interrupts or irqfd callbacks.(CVE-2024-26812)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nvfio/platform: Create persistent IRQ handlers\r\n\r\nThe vfio-platform SET_IRQS ioctl currently allows loopback triggering of\nan interrupt before a signaling eventfd has been configured by the user,\nwhich thereby allows a NULL pointer dereference.\r\n\r\nRather than register the IRQ relative to a valid trigger, register all\nIRQs in a disabled state in the device open path.  This allows mask\noperations on the IRQ to nest within the overall enable state governed\nby a valid eventfd signal.  This decouples @masked, protected by the\n@locked spinlock from @trigger, protected via the @igate mutex.\r\n\r\nIn doing so, it\u0026apos;s guaranteed that changes to @trigger cannot race the\nIRQ handlers because the IRQ handler is synchronously disabled before\nmodifying the trigger, and loopback triggering of the IRQ via ioctl is\nsafe due to serialization with trigger changes via igate.\r\n\r\nFor compatibility, request_irq() failures are maintained to be local to\nthe SET_IRQS ioctl rather than a fatal error in the open device path.\nThis allows, for example, a userspace driver with polling mode support\nto continue to work regardless of moving the request_irq() call site.\nThis necessarily blocks all SET_IRQS access to the failed index.(CVE-2024-26813)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\namdkfd: use calloc instead of kzalloc to avoid integer overflow\r\n\r\nThis uses calloc instead of doing the multiplication which might\noverflow.(CVE-2024-26817)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ncifs: fix underflow in parse_server_interfaces()\r\n\r\nIn this loop, we step through the buffer and after each item we check\nif the size_left is greater than the minimum size we need.  However,\nthe problem is that \u0026quot;bytes_left\u0026quot; is type ssize_t while sizeof() is type\nsize_t.  That means that because of type promotion, the comparison is\ndone as an unsigned and if we have negative bytes left the loop\ncontinues instead of ending.(CVE-2024-26828)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nIB/hfi1: Fix a memleak in init_credit_return\r\n\r\nWhen dma_alloc_coherent fails to allocate dd-\u0026gt;cr_base[i].va,\ninit_credit_return should deallocate dd-\u0026gt;cr_base and\ndd-\u0026gt;cr_base[i] that allocated before. Or those resources\nwould be never freed and a memleak is triggered.(CVE-2024-26839)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ncachefiles: fix memory leak in cachefiles_add_cache()\r\n\r\nThe following memory leak was reported after unbinding /dev/cachefiles:\r\n\r\n==================================================================\nunreferenced object 0xffff9b674176e3c0 (size 192):\n  comm \u0026quot;cachefilesd2\u0026quot;, pid 680, jiffies 4294881224\n  hex dump (first 32 bytes):\n    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace (crc ea38a44b):\n    [\u0026lt;ffffffff8eb8a1a5\u0026gt;] kmem_cache_alloc+0x2d5/0x370\n    [\u0026lt;ffffffff8e917f86\u0026gt;] prepare_creds+0x26/0x2e0\n    [\u0026lt;ffffffffc002eeef\u0026gt;] cachefiles_determine_cache_security+0x1f/0x120\n    [\u0026lt;ffffffffc00243ec\u0026gt;] cachefiles_add_cache+0x13c/0x3a0\n    [\u0026lt;ffffffffc0025216\u0026gt;] cachefiles_daemon_write+0x146/0x1c0\n    [\u0026lt;ffffffff8ebc4a3b\u0026gt;] vfs_write+0xcb/0x520\n    [\u0026lt;ffffffff8ebc5069\u0026gt;] ksys_write+0x69/0xf0\n    [\u0026lt;ffffffff8f6d4662\u0026gt;] do_syscall_64+0x72/0x140\n    [\u0026lt;ffffffff8f8000aa\u0026gt;] entry_SYSCALL_64_after_hwframe+0x6e/0x76\n==================================================================\r\n\r\nPut the reference count of cache_cred in cachefiles_daemon_unbind() to\nfix the problem. And also put cache_cred in cachefiles_add_cache() error\nbranch to avoid memory leaks.(CVE-2024-26840)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnvme-fc: do not wait in vain when unloading module\r\n\r\nThe module exit path has race between deleting all controllers and\nfreeing \u0026apos;left over IDs\u0026apos;. To prevent double free a synchronization\nbetween nvme_delete_ctrl and ida_destroy has been added by the initial\ncommit.\r\n\r\nThere is some logic around trying to prevent from hanging forever in\nwait_for_completion, though it does not handling all cases. E.g.\nblktests is able to reproduce the situation where the module unload\nhangs forever.\r\n\r\nIf we completely rely on the cleanup code executed from the\nnvme_delete_ctrl path, all IDs will be freed eventually. This makes\ncalling ida_destroy unnecessary. We only have to ensure that all\nnvme_delete_ctrl code has been executed before we leave\nnvme_fc_exit_module. This is done by flushing the nvme_delete_wq\nworkqueue.\r\n\r\nWhile at it, remove the unused nvme_fc_wq workqueue too.(CVE-2024-26846)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/ipv6: avoid possible UAF in ip6_route_mpath_notify()\r\n\r\nsyzbot found another use-after-free in ip6_route_mpath_notify() [1]\r\n\r\nCommit f7225172f25a (\u0026quot;net/ipv6: prevent use after free in\nip6_route_mpath_notify\u0026quot;) was not able to fix the root cause.\r\n\r\nWe need to defer the fib6_info_release() calls after\nip6_route_mpath_notify(), in the cleanup phase.\r\n\r\n[1]\nBUG: KASAN: slab-use-after-free in rt6_fill_node+0x1460/0x1ac0\nRead of size 4 at addr ffff88809a07fc64 by task syz-executor.2/23037\r\n\r\nCPU: 0 PID: 23037 Comm: syz-executor.2 Not tainted 6.8.0-rc4-syzkaller-01035-gea7f3cfaa588 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024\nCall Trace:\n \u0026lt;TASK\u0026gt;\n  __dump_stack lib/dump_stack.c:88 [inline]\n  dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106\n  print_address_description mm/kasan/report.c:377 [inline]\n  print_report+0x167/0x540 mm/kasan/report.c:488\n  kasan_report+0x142/0x180 mm/kasan/report.c:601\n rt6_fill_node+0x1460/0x1ac0\n  inet6_rt_notify+0x13b/0x290 net/ipv6/route.c:6184\n  ip6_route_mpath_notify net/ipv6/route.c:5198 [inline]\n  ip6_route_multipath_add net/ipv6/route.c:5404 [inline]\n  inet6_rtm_newroute+0x1d0f/0x2300 net/ipv6/route.c:5517\n  rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6597\n  netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543\n  netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]\n  netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367\n  netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg+0x221/0x270 net/socket.c:745\n  ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584\n  ___sys_sendmsg net/socket.c:2638 [inline]\n  __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667\n do_syscall_64+0xf9/0x240\n entry_SYSCALL_64_after_hwframe+0x6f/0x77\nRIP: 0033:0x7f73dd87dda9\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f73de6550c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 00007f73dd9ac050 RCX: 00007f73dd87dda9\nRDX: 0000000000000000 RSI: 0000000020000140 RDI: 0000000000000005\nRBP: 00007f73dd8ca47a R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 000000000000006e R14: 00007f73dd9ac050 R15: 00007ffdbdeb7858\n \u0026lt;/TASK\u0026gt;\r\n\r\nAllocated by task 23037:\n  kasan_save_stack mm/kasan/common.c:47 [inline]\n  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n  poison_kmalloc_redzone mm/kasan/common.c:372 [inline]\n  __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:389\n  kasan_kmalloc include/linux/kasan.h:211 [inline]\n  __do_kmalloc_node mm/slub.c:3981 [inline]\n  __kmalloc+0x22e/0x490 mm/slub.c:3994\n  kmalloc include/linux/slab.h:594 [inline]\n  kzalloc include/linux/slab.h:711 [inline]\n  fib6_info_alloc+0x2e/0xf0 net/ipv6/ip6_fib.c:155\n  ip6_route_info_create+0x445/0x12b0 net/ipv6/route.c:3758\n  ip6_route_multipath_add net/ipv6/route.c:5298 [inline]\n  inet6_rtm_newroute+0x744/0x2300 net/ipv6/route.c:5517\n  rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6597\n  netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543\n  netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]\n  netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367\n  netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg+0x221/0x270 net/socket.c:745\n  ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584\n  ___sys_sendmsg net/socket.c:2638 [inline]\n  __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667\n do_syscall_64+0xf9/0x240\n entry_SYSCALL_64_after_hwframe+0x6f/0x77\r\n\r\nFreed by task 16:\n  kasan_save_stack mm/kasan/common.c:47 [inline]\n  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n  kasan_save_free_info+0x4e/0x60 mm/kasan/generic.c:640\n  poison_slab_object+0xa6/0xe0 m\n---truncated---(CVE-2024-26852)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ngeneve: make sure to pull inner header in geneve_rx()\r\n\r\nsyzbot triggered a bug in geneve_rx() [1]\r\n\r\nIssue is similar to the one I fixed in commit 8d975c15c0cd\n(\u0026quot;ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()\u0026quot;)\r\n\r\nWe have to save skb-\u0026gt;network_header in a temporary variable\nin order to be able to recompute the network_header pointer\nafter a pskb_inet_may_pull() call.\r\n\r\npskb_inet_may_pull() makes sure the needed headers are in skb-\u0026gt;head.\r\n\r\n[1]\nBUG: KMSAN: uninit-value in IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline]\n BUG: KMSAN: uninit-value in geneve_rx drivers/net/geneve.c:279 [inline]\n BUG: KMSAN: uninit-value in geneve_udp_encap_recv+0x36f9/0x3c10 drivers/net/geneve.c:391\n  IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline]\n  geneve_rx drivers/net/geneve.c:279 [inline]\n  geneve_udp_encap_recv+0x36f9/0x3c10 drivers/net/geneve.c:391\n  udp_queue_rcv_one_skb+0x1d39/0x1f20 net/ipv4/udp.c:2108\n  udp_queue_rcv_skb+0x6ae/0x6e0 net/ipv4/udp.c:2186\n  udp_unicast_rcv_skb+0x184/0x4b0 net/ipv4/udp.c:2346\n  __udp4_lib_rcv+0x1c6b/0x3010 net/ipv4/udp.c:2422\n  udp_rcv+0x7d/0xa0 net/ipv4/udp.c:2604\n  ip_protocol_deliver_rcu+0x264/0x1300 net/ipv4/ip_input.c:205\n  ip_local_deliver_finish+0x2b8/0x440 net/ipv4/ip_input.c:233\n  NF_HOOK include/linux/netfilter.h:314 [inline]\n  ip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254\n  dst_input include/net/dst.h:461 [inline]\n  ip_rcv_finish net/ipv4/ip_input.c:449 [inline]\n  NF_HOOK include/linux/netfilter.h:314 [inline]\n  ip_rcv+0x46f/0x760 net/ipv4/ip_input.c:569\n  __netif_receive_skb_one_core net/core/dev.c:5534 [inline]\n  __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5648\n  process_backlog+0x480/0x8b0 net/core/dev.c:5976\n  __napi_poll+0xe3/0x980 net/core/dev.c:6576\n  napi_poll net/core/dev.c:6645 [inline]\n  net_rx_action+0x8b8/0x1870 net/core/dev.c:6778\n  __do_softirq+0x1b7/0x7c5 kernel/softirq.c:553\n  do_softirq+0x9a/0xf0 kernel/softirq.c:454\n  __local_bh_enable_ip+0x9b/0xa0 kernel/softirq.c:381\n  local_bh_enable include/linux/bottom_half.h:33 [inline]\n  rcu_read_unlock_bh include/linux/rcupdate.h:820 [inline]\n  __dev_queue_xmit+0x2768/0x51c0 net/core/dev.c:4378\n  dev_queue_xmit include/linux/netdevice.h:3171 [inline]\n  packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276\n  packet_snd net/packet/af_packet.c:3081 [inline]\n  packet_sendmsg+0x8aef/0x9f10 net/packet/af_packet.c:3113\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg net/socket.c:745 [inline]\n  __sys_sendto+0x735/0xa10 net/socket.c:2191\n  __do_sys_sendto net/socket.c:2203 [inline]\n  __se_sys_sendto net/socket.c:2199 [inline]\n  __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nUninit was created at:\n  slab_post_alloc_hook mm/slub.c:3819 [inline]\n  slab_alloc_node mm/slub.c:3860 [inline]\n  kmem_cache_alloc_node+0x5cb/0xbc0 mm/slub.c:3903\n  kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560\n  __alloc_skb+0x352/0x790 net/core/skbuff.c:651\n  alloc_skb include/linux/skbuff.h:1296 [inline]\n  alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6394\n  sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2783\n  packet_alloc_skb net/packet/af_packet.c:2930 [inline]\n  packet_snd net/packet/af_packet.c:3024 [inline]\n  packet_sendmsg+0x70c2/0x9f10 net/packet/af_packet.c:3113\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg net/socket.c:745 [inline]\n  __sys_sendto+0x735/0xa10 net/socket.c:2191\n  __do_sys_sendto net/socket.c:2203 [inline]\n  __se_sys_sendto net/socket.c:2199 [inline]\n  __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b(CVE-2024-26857)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/bnx2x: Prevent access to a freed page in page_pool\r\n\r\nFix race condition leading to system crash during EEH error handling\r\n\r\nDuring EEH error recovery, the bnx2x driver\u0026apos;s transmit timeout logic\ncould cause a race condition when handling reset tasks. The\nbnx2x_tx_timeout() schedules reset tasks via bnx2x_sp_rtnl_task(),\nwhich ultimately leads to bnx2x_nic_unload(). In bnx2x_nic_unload()\nSGEs are freed using bnx2x_free_rx_sge_range(). However, this could\noverlap with the EEH driver\u0026apos;s attempt to reset the device using\nbnx2x_io_slot_reset(), which also tries to free SGEs. This race\ncondition can result in system crashes due to accessing freed memory\nlocations in bnx2x_free_rx_sge()\r\n\r\n799  static inline void bnx2x_free_rx_sge(struct bnx2x *bp,\n800\t\t\t\tstruct bnx2x_fastpath *fp, u16 index)\n801  {\n802\tstruct sw_rx_page *sw_buf = \u0026amp;fp-\u0026gt;rx_page_ring[index];\n803     struct page *page = sw_buf-\u0026gt;page;\n....\nwhere sw_buf was set to NULL after the call to dma_unmap_page()\nby the preceding thread.\r\n\r\n    EEH: Beginning: \u0026apos;slot_reset\u0026apos;\n    PCI 0011:01:00.0#10000: EEH: Invoking bnx2x-\u0026gt;slot_reset()\n    bnx2x: [bnx2x_io_slot_reset:14228(eth1)]IO slot reset initializing...\n    bnx2x 0011:01:00.0: enabling device (0140 -\u0026gt; 0142)\n    bnx2x: [bnx2x_io_slot_reset:14244(eth1)]IO slot reset --\u0026gt; driver unload\n    Kernel attempted to read user page (0) - exploit attempt? (uid: 0)\n    BUG: Kernel NULL pointer dereference on read at 0x00000000\n    Faulting instruction address: 0xc0080000025065fc\n    Oops: Kernel access of bad area, sig: 11 [#1]\n    .....\n    Call Trace:\n    [c000000003c67a20] [c00800000250658c] bnx2x_io_slot_reset+0x204/0x610 [bnx2x] (unreliable)\n    [c000000003c67af0] [c0000000000518a8] eeh_report_reset+0xb8/0xf0\n    [c000000003c67b60] [c000000000052130] eeh_pe_report+0x180/0x550\n    [c000000003c67c70] [c00000000005318c] eeh_handle_normal_event+0x84c/0xa60\n    [c000000003c67d50] [c000000000053a84] eeh_event_handler+0xf4/0x170\n    [c000000003c67da0] [c000000000194c58] kthread+0x1c8/0x1d0\n    [c000000003c67e10] [c00000000000cf64] ret_from_kernel_thread+0x5c/0x64\r\n\r\nTo solve this issue, we need to verify page pool allocations before\nfreeing.(CVE-2024-26859)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nhsr: Fix uninit-value access in hsr_get_node()\r\n\r\nKMSAN reported the following uninit-value access issue [1]:\r\n\r\n=====================================================\nBUG: KMSAN: uninit-value in hsr_get_node+0xa2e/0xa40 net/hsr/hsr_framereg.c:246\n hsr_get_node+0xa2e/0xa40 net/hsr/hsr_framereg.c:246\n fill_frame_info net/hsr/hsr_forward.c:577 [inline]\n hsr_forward_skb+0xe12/0x30e0 net/hsr/hsr_forward.c:615\n hsr_dev_xmit+0x1a1/0x270 net/hsr/hsr_device.c:223\n __netdev_start_xmit include/linux/netdevice.h:4940 [inline]\n netdev_start_xmit include/linux/netdevice.h:4954 [inline]\n xmit_one net/core/dev.c:3548 [inline]\n dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564\n __dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349\n dev_queue_xmit include/linux/netdevice.h:3134 [inline]\n packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276\n packet_snd net/packet/af_packet.c:3087 [inline]\n packet_sendmsg+0x8b1d/0x9f30 net/packet/af_packet.c:3119\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg net/socket.c:745 [inline]\n __sys_sendto+0x735/0xa10 net/socket.c:2191\n __do_sys_sendto net/socket.c:2203 [inline]\n __se_sys_sendto net/socket.c:2199 [inline]\n __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x6d/0x140 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nUninit was created at:\n slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768\n slab_alloc_node mm/slub.c:3478 [inline]\n kmem_cache_alloc_node+0x5e9/0xb10 mm/slub.c:3523\n kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560\n __alloc_skb+0x318/0x740 net/core/skbuff.c:651\n alloc_skb include/linux/skbuff.h:1286 [inline]\n alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6334\n sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2787\n packet_alloc_skb net/packet/af_packet.c:2936 [inline]\n packet_snd net/packet/af_packet.c:3030 [inline]\n packet_sendmsg+0x70e8/0x9f30 net/packet/af_packet.c:3119\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg net/socket.c:745 [inline]\n __sys_sendto+0x735/0xa10 net/socket.c:2191\n __do_sys_sendto net/socket.c:2203 [inline]\n __se_sys_sendto net/socket.c:2199 [inline]\n __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x6d/0x140 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nCPU: 1 PID: 5033 Comm: syz-executor334 Not tainted 6.7.0-syzkaller-00562-g9f8413c4a66f #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023\n=====================================================\r\n\r\nIf the packet type ID field in the Ethernet header is either ETH_P_PRP or\nETH_P_HSR, but it is not followed by an HSR tag, hsr_get_skb_sequence_nr()\nreads an invalid value as a sequence number. This causes the above issue.\r\n\r\nThis patch fixes the issue by returning NULL if the Ethernet header is not\nfollowed by an HSR tag.(CVE-2024-26863)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nRDMA/srpt: Do not register event handler until srpt device is fully setup\r\n\r\nUpon rare occasions, KASAN reports a use-after-free Write\nin srpt_refresh_port().\r\n\r\nThis seems to be because an event handler is registered before the\nsrpt device is fully setup and a race condition upon error may leave a\npartially setup event handler in place.\r\n\r\nInstead, only register the event handler after srpt device initialization\nis complete.(CVE-2024-26872)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmedia: pvrusb2: fix uaf in pvr2_context_set_notify\r\n\r\n[Syzbot reported]\nBUG: KASAN: slab-use-after-free in pvr2_context_set_notify+0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:35\nRead of size 4 at addr ffff888113aeb0d8 by task kworker/1:1/26\r\n\r\nCPU: 1 PID: 26 Comm: kworker/1:1 Not tainted 6.8.0-rc1-syzkaller-00046-gf1a27f081c1f #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024\nWorkqueue: usb_hub_wq hub_event\nCall Trace:\n \u0026lt;TASK\u0026gt;\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0xc4/0x620 mm/kasan/report.c:488\n kasan_report+0xda/0x110 mm/kasan/report.c:601\n pvr2_context_set_notify+0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:35\n pvr2_context_notify drivers/media/usb/pvrusb2/pvrusb2-context.c:95 [inline]\n pvr2_context_disconnect+0x94/0xb0 drivers/media/usb/pvrusb2/pvrusb2-context.c:272\r\n\r\nFreed by task 906:\nkasan_save_stack+0x33/0x50 mm/kasan/common.c:47\nkasan_save_track+0x14/0x30 mm/kasan/common.c:68\nkasan_save_free_info+0x3f/0x60 mm/kasan/generic.c:640\npoison_slab_object mm/kasan/common.c:241 [inline]\n__kasan_slab_free+0x106/0x1b0 mm/kasan/common.c:257\nkasan_slab_free include/linux/kasan.h:184 [inline]\nslab_free_hook mm/slub.c:2121 [inline]\nslab_free mm/slub.c:4299 [inline]\nkfree+0x105/0x340 mm/slub.c:4409\npvr2_context_check drivers/media/usb/pvrusb2/pvrusb2-context.c:137 [inline]\npvr2_context_thread_func+0x69d/0x960 drivers/media/usb/pvrusb2/pvrusb2-context.c:158\r\n\r\n[Analyze]\nTask A set disconnect_flag = !0, which resulted in Task B\u0026apos;s condition being met\nand releasing mp, leading to this issue.\r\n\r\n[Fix]\nPlace the disconnect_flag assignment operation after all code in pvr2_context_disconnect()\nto avoid this issue.(CVE-2024-26875)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/bridge: adv7511: fix crash on irq during probe\r\n\r\nMoved IRQ registration down to end of adv7511_probe().\r\n\r\nIf an IRQ already is pending during adv7511_probe\n(before adv7511_cec_init) then cec_received_msg_ts\ncould crash using uninitialized data:\r\n\r\n    Unable to handle kernel read from unreadable memory at virtual address 00000000000003d5\n    Internal error: Oops: 96000004 [#1] PREEMPT_RT SMP\n    Call trace:\n     cec_received_msg_ts+0x48/0x990 [cec]\n     adv7511_cec_irq_process+0x1cc/0x308 [adv7511]\n     adv7511_irq_process+0xd8/0x120 [adv7511]\n     adv7511_irq_handler+0x1c/0x30 [adv7511]\n     irq_thread_fn+0x30/0xa0\n     irq_thread+0x14c/0x238\n     kthread+0x190/0x1a8(CVE-2024-26876)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nquota: Fix potential NULL pointer dereference\r\n\r\nBelow race may cause NULL pointer dereference\r\n\r\nP1\t\t\t\t\tP2\ndquot_free_inode\t\t\tquota_off\n\t\t\t\t\t  drop_dquot_ref\n\t\t\t\t\t   remove_dquot_ref\n\t\t\t\t\t   dquots = i_dquot(inode)\n  dquots = i_dquot(inode)\n  srcu_read_lock\n  dquots[cnt]) != NULL (1)\n\t\t\t\t\t     dquots[type] = NULL (2)\n  spin_lock(\u0026amp;dquots[cnt]-\u0026gt;dq_dqb_lock) (3)\n   ....\r\n\r\nIf dquot_free_inode(or other routines) checks inode\u0026apos;s quota pointers (1)\nbefore quota_off sets it to NULL(2) and use it (3) after that, NULL pointer\ndereference will be triggered.\r\n\r\nSo let\u0026apos;s fix it by using a temporary pointer to avoid this issue.(CVE-2024-26878)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndm: call the resume method on internal suspend\r\n\r\nThere is this reported crash when experimenting with the lvm2 testsuite.\nThe list corruption is caused by the fact that the postsuspend and resume\nmethods were not paired correctly; there were two consecutive calls to the\norigin_postsuspend function. The second call attempts to remove the\n\u0026quot;hash_list\u0026quot; entry from a list, while it was already removed by the first\ncall.\r\n\r\nFix __dm_internal_resume so that it calls the preresume and resume\nmethods of the table\u0026apos;s targets.\r\n\r\nIf a preresume method of some target fails, we are in a tricky situation.\nWe can\u0026apos;t return an error because dm_internal_resume isn\u0026apos;t supposed to\nreturn errors. We can\u0026apos;t return success, because then the \u0026quot;resume\u0026quot; and\n\u0026quot;postsuspend\u0026quot; methods would not be paired correctly. So, we set the\nDMF_SUSPENDED flag and we fake normal suspend - it may confuse userspace\ntools, but it won\u0026apos;t cause a kernel crash.\r\n\r\n------------[ cut here ]------------\nkernel BUG at lib/list_debug.c:56!\ninvalid opcode: 0000 [#1] PREEMPT SMP\nCPU: 1 PID: 8343 Comm: dmsetup Not tainted 6.8.0-rc6 #4\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014\nRIP: 0010:__list_del_entry_valid_or_report+0x77/0xc0\n\u0026lt;snip\u0026gt;\nRSP: 0018:ffff8881b831bcc0 EFLAGS: 00010282\nRAX: 000000000000004e RBX: ffff888143b6eb80 RCX: 0000000000000000\nRDX: 0000000000000001 RSI: ffffffff819053d0 RDI: 00000000ffffffff\nRBP: ffff8881b83a3400 R08: 00000000fffeffff R09: 0000000000000058\nR10: 0000000000000000 R11: ffffffff81a24080 R12: 0000000000000001\nR13: ffff88814538e000 R14: ffff888143bc6dc0 R15: ffffffffa02e4bb0\nFS:  00000000f7c0f780(0000) GS:ffff8893f0a40000(0000) knlGS:0000000000000000\nCS:  0010 DS: 002b ES: 002b CR0: 0000000080050033\nCR2: 0000000057fb5000 CR3: 0000000143474000 CR4: 00000000000006b0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n ? die+0x2d/0x80\n ? do_trap+0xeb/0xf0\n ? __list_del_entry_valid_or_report+0x77/0xc0\n ? do_error_trap+0x60/0x80\n ? __list_del_entry_valid_or_report+0x77/0xc0\n ? exc_invalid_op+0x49/0x60\n ? __list_del_entry_valid_or_report+0x77/0xc0\n ? asm_exc_invalid_op+0x16/0x20\n ? table_deps+0x1b0/0x1b0 [dm_mod]\n ? __list_del_entry_valid_or_report+0x77/0xc0\n origin_postsuspend+0x1a/0x50 [dm_snapshot]\n dm_table_postsuspend_targets+0x34/0x50 [dm_mod]\n dm_suspend+0xd8/0xf0 [dm_mod]\n dev_suspend+0x1f2/0x2f0 [dm_mod]\n ? table_deps+0x1b0/0x1b0 [dm_mod]\n ctl_ioctl+0x300/0x5f0 [dm_mod]\n dm_compat_ctl_ioctl+0x7/0x10 [dm_mod]\n __x64_compat_sys_ioctl+0x104/0x170\n do_syscall_64+0x184/0x1b0\n entry_SYSCALL_64_after_hwframe+0x46/0x4e\nRIP: 0033:0xf7e6aead\n\u0026lt;snip\u0026gt;\n---[ end trace 0000000000000000 ]---(CVE-2024-26880)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete\r\n\r\nThe ath9k_wmi_event_tasklet() used in ath9k_htc assumes that all the data\nstructures have been fully initialised by the time it runs. However, because of\nthe order in which things are initialised, this is not guaranteed to be the\ncase, because the device is exposed to the USB subsystem before the ath9k driver\ninitialisation is completed.\r\n\r\nWe already committed a partial fix for this in commit:\n8b3046abc99e (\u0026quot;ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet()\u0026quot;)\r\n\r\nHowever, that commit only aborted the WMI_TXSTATUS_EVENTID command in the event\ntasklet, pairing it with an \u0026quot;initialisation complete\u0026quot; bit in the TX struct. It\nseems syzbot managed to trigger the race for one of the other commands as well,\nso let\u0026apos;s just move the existing synchronisation bit to cover the whole\ntasklet (setting it at the end of ath9k_htc_probe_device() instead of inside\nath9k_tx_init()).(CVE-2024-26897)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\naoe: fix the potential use-after-free problem in aoecmd_cfg_pkts\r\n\r\nThis patch is against CVE-2023-6270. The description of cve is:\r\n\r\n  A flaw was found in the ATA over Ethernet (AoE) driver in the Linux\n  kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on\n  `struct net_device`, and a use-after-free can be triggered by racing\n  between the free on the struct and the access through the `skbtxq`\n  global queue. This could lead to a denial of service condition or\n  potential code execution.\r\n\r\nIn aoecmd_cfg_pkts(), it always calls dev_put(ifp) when skb initial\ncode is finished. But the net_device ifp will still be used in\nlater tx()-\u0026gt;dev_queue_xmit() in kthread. Which means that the\ndev_put(ifp) should NOT be called in the success path of skb\ninitial code in aoecmd_cfg_pkts(). Otherwise tx() may run into\nuse-after-free because the net_device is freed.\r\n\r\nThis patch removed the dev_put(ifp) in the success path in\naoecmd_cfg_pkts(), and added dev_put() after skb xmit in tx().(CVE-2024-26898)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/amdgpu: Reset IH OVERFLOW_CLEAR bit\r\n\r\nAllows us to detect subsequent IH ring buffer overflows as well.(CVE-2024-26915)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/amdgpu: validate the parameters of bo mapping operations more clearly\r\n\r\nVerify the parameters of\namdgpu_vm_bo_(map/replace_map/clearing_mappings) in one common place.(CVE-2024-26922)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmedia: go7007: fix a memleak in go7007_load_encoder\r\n\r\nIn go7007_load_encoder, bounce(i.e. go-\u0026gt;boot_fw), is allocated without\na deallocation thereafter. After the following call chain:\r\n\r\nsaa7134_go7007_init\n  |-\u0026gt; go7007_boot_encoder\n        |-\u0026gt; go7007_load_encoder\n  |-\u0026gt; kfree(go)\r\n\r\ngo is freed and thus bounce is leaked.(CVE-2024-27074)","status":"published","published":"2024-05-17T11:07:04Z","modified":"2026-08-18T01:18:27.05890931Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1622","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nfirmware: arm_scmi: Harden accesses to the reset domains\r\n\r\nAccessing reset domains descriptors by the index upon the SCMI drivers\nrequests through the SCMI reset operations interface can potentially\nlead to out-of-bound violations if the SCMI driver misbehave.\r\n\r\nAdd an internal consistency check before any such domains descriptors\naccesses.(CVE-2022-48655)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nerofs: fix pcluster use-after-free on UP platforms\r\n\r\nDuring stress testing with CONFIG_SMP disabled, KASAN reports as below:\r\n\r\n==================================================================\nBUG: KASAN: use-after-free in __mutex_lock+0xe5/0xc30\nRead of size 8 at addr ffff8881094223f8 by task stress/7789\r\n\r\nCPU: 0 PID: 7789 Comm: stress Not tainted 6.0.0-rc1-00002-g0d53d2e882f9 #3\nHardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011\nCall Trace:\n \u0026lt;TASK\u0026gt;\n..\n __mutex_lock+0xe5/0xc30\n..\n z_erofs_do_read_page+0x8ce/0x1560\n..\n z_erofs_readahead+0x31c/0x580\n..\nFreed by task 7787\n kasan_save_stack+0x1e/0x40\n kasan_set_track+0x20/0x30\n kasan_set_free_info+0x20/0x40\n __kasan_slab_free+0x10c/0x190\n kmem_cache_free+0xed/0x380\n rcu_core+0x3d5/0xc90\n __do_softirq+0x12d/0x389\r\n\r\nLast potentially related work creation:\n kasan_save_stack+0x1e/0x40\n __kasan_record_aux_stack+0x97/0xb0\n call_rcu+0x3d/0x3f0\n erofs_shrink_workstation+0x11f/0x210\n erofs_shrink_scan+0xdc/0x170\n shrink_slab.constprop.0+0x296/0x530\n drop_slab+0x1c/0x70\n drop_caches_sysctl_handler+0x70/0x80\n proc_sys_call_handler+0x20a/0x2f0\n vfs_write+0x555/0x6c0\n ksys_write+0xbe/0x160\n do_syscall_64+0x3b/0x90\r\n\r\nThe root cause is that erofs_workgroup_unfreeze() doesn\u0026apos;t reset to\norig_val thus it causes a race that the pcluster reuses unexpectedly\nbefore freeing.\r\n\r\nSince UP platforms are quite rare now, such path becomes unnecessary.\nLet\u0026apos;s drop such specific-designed path directly instead.(CVE-2022-48674)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nusb: hub: Guard against accesses to uninitialized BOS descriptors\r\n\r\nMany functions in drivers/usb/core/hub.c and drivers/usb/core/hub.h\naccess fields inside udev-\u0026gt;bos without checking if it was allocated and\ninitialized. If usb_get_bos_descriptor() fails for whatever\nreason, udev-\u0026gt;bos will be NULL and those accesses will result in a\ncrash:\r\n\r\nBUG: kernel NULL pointer dereference, address: 0000000000000018\nPGD 0 P4D 0\nOops: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 5 PID: 17818 Comm: kworker/5:1 Tainted: G W 5.15.108-18910-gab0e1cb584e1 #1 \u0026lt;HASH:1f9e 1\u0026gt;\nHardware name: Google Kindred/Kindred, BIOS Google_Kindred.12672.413.0 02/03/2021\nWorkqueue: usb_hub_wq hub_event\nRIP: 0010:hub_port_reset+0x193/0x788\nCode: 89 f7 e8 20 f7 15 00 48 8b 43 08 80 b8 96 03 00 00 03 75 36 0f b7 88 92 03 00 00 81 f9 10 03 00 00 72 27 48 8b 80 a8 03 00 00 \u0026lt;48\u0026gt; 83 78 18 00 74 19 48 89 df 48 8b 75 b0 ba 02 00 00 00 4c 89 e9\nRSP: 0018:ffffab740c53fcf8 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: ffffa1bc5f678000 RCX: 0000000000000310\nRDX: fffffffffffffdff RSI: 0000000000000286 RDI: ffffa1be9655b840\nRBP: ffffab740c53fd70 R08: 00001b7d5edaa20c R09: ffffffffb005e060\nR10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000\nR13: ffffab740c53fd3e R14: 0000000000000032 R15: 0000000000000000\nFS: 0000000000000000(0000) GS:ffffa1be96540000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000018 CR3: 000000022e80c005 CR4: 00000000003706e0\nCall Trace:\nhub_event+0x73f/0x156e\n? hub_activate+0x5b7/0x68f\nprocess_one_work+0x1a2/0x487\nworker_thread+0x11a/0x288\nkthread+0x13a/0x152\n? process_one_work+0x487/0x487\n? kthread_associate_blkcg+0x70/0x70\nret_from_fork+0x1f/0x30\r\n\r\nFall back to a default behavior if the BOS descriptor isn\u0026apos;t accessible\nand skip all the functionalities that depend on it: LPM support checks,\nSuper Speed capabilitiy checks, U1/U2 states setup.(CVE-2023-52477)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nf_tables: disallow timeout for anonymous sets\r\n\r\nNever used from userspace, disallow these parameters.(CVE-2023-52620)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nftables: exthdr: fix 4-byte stack OOB write\r\n\r\nIf priv-\u0026gt;len is a multiple of 4, then dst[len / 4] can write past\nthe destination array which leads to stack corruption.\r\n\r\nThis construct is necessary to clean the remainder of the register\nin case -\u0026gt;len is NOT a multiple of the register size, so make it\nconditional just like nft_payload.c does.\r\n\r\nThe bug was added in 4.1 cycle and then copied/inherited when\ntcp/sctp and ip option support was added.\r\n\r\nBug reported by Zero Day Initiative project (ZDI-CAN-21950,\nZDI-CAN-21951, ZDI-CAN-21961).(CVE-2023-52628)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nfs/ntfs3: Fix an NULL dereference bug\r\n\r\nThe issue here is when this is called from ntfs_load_attr_list().  The\n\u0026quot;size\u0026quot; comes from le32_to_cpu(attr-\u0026gt;res.data_size) so it can\u0026apos;t overflow\non a 64bit systems but on 32bit systems the \u0026quot;+ 1023\u0026quot; can overflow and\nthe result is zero.  This means that the kmalloc will succeed by\nreturning the ZERO_SIZE_PTR and then the memcpy() will crash with an\nOops on the next line.(CVE-2023-52631)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\num: time-travel: fix time corruption\r\n\r\nIn \u0026apos;basic\u0026apos; time-travel mode (without =inf-cpu or =ext), we\nstill get timer interrupts. These can happen at arbitrary\npoints in time, i.e. while in timer_read(), which pushes\ntime forward just a little bit. Then, if we happen to get\nthe interrupt after calculating the new time to push to,\nbut before actually finishing that, the interrupt will set\nthe time to a value that\u0026apos;s incompatible with the forward,\nand we\u0026apos;ll crash because time goes backwards when we do the\nforwarding.\r\n\r\nFix this by reading the time_travel_time, calculating the\nadjustment, and doing the adjustment all with interrupts\ndisabled.(CVE-2023-52633)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ncan: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)\r\n\r\nLock jsk-\u0026gt;sk to prevent UAF when setsockopt(..., SO_J1939_FILTER, ...)\nmodifies jsk-\u0026gt;filters while receiving packets.\r\n\r\nFollowing trace was seen on affected system:\n ==================================================================\n BUG: KASAN: slab-use-after-free in j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939]\n Read of size 4 at addr ffff888012144014 by task j1939/350\r\n\r\n CPU: 0 PID: 350 Comm: j1939 Tainted: G        W  OE      6.5.0-rc5 #1\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014\n Call Trace:\n  print_report+0xd3/0x620\n  ? kasan_complete_mode_report_info+0x7d/0x200\n  ? j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939]\n  kasan_report+0xc2/0x100\n  ? j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939]\n  __asan_load4+0x84/0xb0\n  j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939]\n  j1939_sk_recv+0x20b/0x320 [can_j1939]\n  ? __kasan_check_write+0x18/0x20\n  ? __pfx_j1939_sk_recv+0x10/0x10 [can_j1939]\n  ? j1939_simple_recv+0x69/0x280 [can_j1939]\n  ? j1939_ac_recv+0x5e/0x310 [can_j1939]\n  j1939_can_recv+0x43f/0x580 [can_j1939]\n  ? __pfx_j1939_can_recv+0x10/0x10 [can_j1939]\n  ? raw_rcv+0x42/0x3c0 [can_raw]\n  ? __pfx_j1939_can_recv+0x10/0x10 [can_j1939]\n  can_rcv_filter+0x11f/0x350 [can]\n  can_receive+0x12f/0x190 [can]\n  ? __pfx_can_rcv+0x10/0x10 [can]\n  can_rcv+0xdd/0x130 [can]\n  ? __pfx_can_rcv+0x10/0x10 [can]\n  __netif_receive_skb_one_core+0x13d/0x150\n  ? __pfx___netif_receive_skb_one_core+0x10/0x10\n  ? __kasan_check_write+0x18/0x20\n  ? _raw_spin_lock_irq+0x8c/0xe0\n  __netif_receive_skb+0x23/0xb0\n  process_backlog+0x107/0x260\n  __napi_poll+0x69/0x310\n  net_rx_action+0x2a1/0x580\n  ? __pfx_net_rx_action+0x10/0x10\n  ? __pfx__raw_spin_lock+0x10/0x10\n  ? handle_irq_event+0x7d/0xa0\n  __do_softirq+0xf3/0x3f8\n  do_softirq+0x53/0x80\n  \u0026lt;/IRQ\u0026gt;\n  \u0026lt;TASK\u0026gt;\n  __local_bh_enable_ip+0x6e/0x70\n  netif_rx+0x16b/0x180\n  can_send+0x32b/0x520 [can]\n  ? __pfx_can_send+0x10/0x10 [can]\n  ? __check_object_size+0x299/0x410\n  raw_sendmsg+0x572/0x6d0 [can_raw]\n  ? __pfx_raw_sendmsg+0x10/0x10 [can_raw]\n  ? apparmor_socket_sendmsg+0x2f/0x40\n  ? __pfx_raw_sendmsg+0x10/0x10 [can_raw]\n  sock_sendmsg+0xef/0x100\n  sock_write_iter+0x162/0x220\n  ? __pfx_sock_write_iter+0x10/0x10\n  ? __rtnl_unlock+0x47/0x80\n  ? security_file_permission+0x54/0x320\n  vfs_write+0x6ba/0x750\n  ? __pfx_vfs_write+0x10/0x10\n  ? __fget_light+0x1ca/0x1f0\n  ? __rcu_read_unlock+0x5b/0x280\n  ksys_write+0x143/0x170\n  ? __pfx_ksys_write+0x10/0x10\n  ? __kasan_check_read+0x15/0x20\n  ? fpregs_assert_state_consistent+0x62/0x70\n  __x64_sys_write+0x47/0x60\n  do_syscall_64+0x60/0x90\n  ? do_syscall_64+0x6d/0x90\n  ? irqentry_exit+0x3f/0x50\n  ? exc_page_fault+0x79/0xf0\n  entry_SYSCALL_64_after_hwframe+0x6e/0xd8\r\n\r\n Allocated by task 348:\n  kasan_save_stack+0x2a/0x50\n  kasan_set_track+0x29/0x40\n  kasan_save_alloc_info+0x1f/0x30\n  __kasan_kmalloc+0xb5/0xc0\n  __kmalloc_node_track_caller+0x67/0x160\n  j1939_sk_setsockopt+0x284/0x450 [can_j1939]\n  __sys_setsockopt+0x15c/0x2f0\n  __x64_sys_setsockopt+0x6b/0x80\n  do_syscall_64+0x60/0x90\n  entry_SYSCALL_64_after_hwframe+0x6e/0xd8\r\n\r\n Freed by task 349:\n  kasan_save_stack+0x2a/0x50\n  kasan_set_track+0x29/0x40\n  kasan_save_free_info+0x2f/0x50\n  __kasan_slab_free+0x12e/0x1c0\n  __kmem_cache_free+0x1b9/0x380\n  kfree+0x7a/0x120\n  j1939_sk_setsockopt+0x3b2/0x450 [can_j1939]\n  __sys_setsockopt+0x15c/0x2f0\n  __x64_sys_setsockopt+0x6b/0x80\n  do_syscall_64+0x60/0x90\n  entry_SYSCALL_64_after_hwframe+0x6e/0xd8(CVE-2023-52637)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nKVM: s390: vsie: fix race during shadow creation\r\n\r\nRight now it is possible to see gmap-\u0026gt;private being zero in\nkvm_s390_vsie_gmap_notifier resulting in a crash.  This is due to the\nfact that we add gmap-\u0026gt;private == kvm after creation:\r\n\r\nstatic int acquire_gmap_shadow(struct kvm_vcpu *vcpu,\n                               struct vsie_page *vsie_page)\n{\n[...]\n        gmap = gmap_shadow(vcpu-\u0026gt;arch.gmap, asce, edat);\n        if (IS_ERR(gmap))\n                return PTR_ERR(gmap);\n        gmap-\u0026gt;private = vcpu-\u0026gt;kvm;\r\n\r\nLet children inherit the private field of the parent.(CVE-2023-52639)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmedia: rc: bpf attach/detach requires write permission\r\n\r\nNote that bpf attach/detach also requires CAP_NET_ADMIN.(CVE-2023-52642)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled\r\n\r\nWhen QoS is disabled, the queue priority value will not map to the correct\nieee80211 queue since there is only one queue. Stop/wake queue 0 when QoS\nis disabled to prevent trying to stop/wake a non-existent queue and failing\nto stop/wake the actual queue instantiated.\r\n\r\nLog of issue before change (with kernel parameter qos=0):\n    [  +5.112651] ------------[ cut here ]------------\n    [  +0.000005] WARNING: CPU: 7 PID: 25513 at net/mac80211/util.c:449 __ieee80211_wake_queue+0xd5/0x180 [mac80211]\n    [  +0.000067] Modules linked in: b43(O) snd_seq_dummy snd_hrtimer snd_seq snd_seq_device nft_chain_nat xt_MASQUERADE nf_nat xfrm_user xfrm_algo xt_addrtype overlay ccm af_packet amdgpu snd_hda_codec_cirrus snd_hda_codec_generic ledtrig_audio drm_exec amdxcp gpu_sched xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip6t_rpfilter ipt_rpfilter xt_pkttype xt_LOG nf_log_syslog xt_tcpudp nft_compat nf_tables nfnetlink sch_fq_codel btusb uinput iTCO_wdt ctr btrtl intel_pmc_bxt i915 intel_rapl_msr mei_hdcp mei_pxp joydev at24 watchdog btintel atkbd libps2 serio radeon btbcm vivaldi_fmap btmtk intel_rapl_common snd_hda_codec_hdmi bluetooth uvcvideo nls_iso8859_1 applesmc nls_cp437 x86_pkg_temp_thermal snd_hda_intel intel_powerclamp vfat videobuf2_vmalloc coretemp fat snd_intel_dspcfg crc32_pclmul uvc polyval_clmulni snd_intel_sdw_acpi loop videobuf2_memops snd_hda_codec tun drm_suballoc_helper polyval_generic drm_ttm_helper drm_buddy tap ecdh_generic videobuf2_v4l2 gf128mul macvlan ttm ghash_clmulni_intel ecc tg3\n    [  +0.000044]  videodev bridge snd_hda_core rapl crc16 drm_display_helper cec mousedev snd_hwdep evdev intel_cstate bcm5974 hid_appleir videobuf2_common stp mac_hid libphy snd_pcm drm_kms_helper acpi_als mei_me intel_uncore llc mc snd_timer intel_gtt industrialio_triggered_buffer apple_mfi_fastcharge i2c_i801 mei snd lpc_ich agpgart ptp i2c_smbus thunderbolt apple_gmux i2c_algo_bit kfifo_buf video industrialio soundcore pps_core wmi tiny_power_button sbs sbshc button ac cordic bcma mac80211 cfg80211 ssb rfkill libarc4 kvm_intel kvm drm irqbypass fuse backlight firmware_class efi_pstore configfs efivarfs dmi_sysfs ip_tables x_tables autofs4 dm_crypt cbc encrypted_keys trusted asn1_encoder tee tpm rng_core input_leds hid_apple led_class hid_generic usbhid hid sd_mod t10_pi crc64_rocksoft crc64 crc_t10dif crct10dif_generic ahci libahci libata uhci_hcd ehci_pci ehci_hcd crct10dif_pclmul crct10dif_common sha512_ssse3 sha512_generic sha256_ssse3 sha1_ssse3 aesni_intel usbcore scsi_mod libaes crypto_simd cryptd scsi_common\n    [  +0.000055]  usb_common rtc_cmos btrfs blake2b_generic libcrc32c crc32c_generic crc32c_intel xor raid6_pq dm_snapshot dm_bufio dm_mod dax [last unloaded: b43(O)]\n    [  +0.000009] CPU: 7 PID: 25513 Comm: irq/17-b43 Tainted: G        W  O       6.6.7 #1-NixOS\n    [  +0.000003] Hardware name: Apple Inc. MacBookPro8,3/Mac-942459F5819B171B, BIOS 87.0.0.0.0 06/13/2019\n    [  +0.000001] RIP: 0010:__ieee80211_wake_queue+0xd5/0x180 [mac80211]\n    [  +0.000046] Code: 00 45 85 e4 0f 85 9b 00 00 00 48 8d bd 40 09 00 00 f0 48 0f ba ad 48 09 00 00 00 72 0f 5b 5d 41 5c 41 5d 41 5e e9 cb 6d 3c d0 \u0026lt;0f\u0026gt; 0b 5b 5d 41 5c 41 5d 41 5e c3 cc cc cc cc 48 8d b4 16 94 00 00\n    [  +0.000002] RSP: 0018:ffffc90003c77d60 EFLAGS: 00010097\n    [  +0.000001] RAX: 0000000000000001 RBX: 0000000000000002 RCX: 0000000000000000\n    [  +0.000001] RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffff88820b924900\n    [  +0.000002] RBP: ffff88820b924900 R08: ffffc90003c77d90 R09: 000000000003bfd0\n    [  +0.000001] R10: ffff88820b924900 R11: ffffc90003c77c68 R12: 0000000000000000\n    [  +0.000001] R13: 0000000000000000 R14: ffffc90003c77d90 R15: ffffffffc0fa6f40\n    [  +0.000001] FS:  0000000000000000(0000) GS:ffff88846fb80000(0000) knlGS:0000000000000000\n    [  +0.000001] CS:  0010 DS: 0\n---truncated---(CVE-2023-52644)\r\n\r\nA flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on `struct net_device`, and a use-after-free can be triggered by racing between the free on the struct and the access through the `skbtxq` global queue. This could lead to a denial of service condition or potential code execution.(CVE-2023-6270)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nf_tables: disallow anonymous set with timeout flag\r\n\r\nAnonymous sets are never used with timeout from userspace, reject this.\nException to this rule is NFT_SET_EVAL to ensure legacy meters still work.(CVE-2024-26642)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntracing: Ensure visibility when inserting an element into tracing_map\r\n\r\nRunning the following two commands in parallel on a multi-processor\nAArch64 machine can sporadically produce an unexpected warning about\nduplicate histogram entries:\r\n\r\n $ while true; do\n     echo hist:key=id.syscall:val=hitcount \u0026gt; \\\n       /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/trigger\n     cat /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/hist\n     sleep 0.001\n   done\n $ stress-ng --sysbadaddr $(nproc)\r\n\r\nThe warning looks as follows:\r\n\r\n[ 2911.172474] ------------[ cut here ]------------\n[ 2911.173111] Duplicates detected: 1\n[ 2911.173574] WARNING: CPU: 2 PID: 12247 at kernel/trace/tracing_map.c:983 tracing_map_sort_entries+0x3e0/0x408\n[ 2911.174702] Modules linked in: iscsi_ibft(E) iscsi_boot_sysfs(E) rfkill(E) af_packet(E) nls_iso8859_1(E) nls_cp437(E) vfat(E) fat(E) ena(E) tiny_power_button(E) qemu_fw_cfg(E) button(E) fuse(E) efi_pstore(E) ip_tables(E) x_tables(E) xfs(E) libcrc32c(E) aes_ce_blk(E) aes_ce_cipher(E) crct10dif_ce(E) polyval_ce(E) polyval_generic(E) ghash_ce(E) gf128mul(E) sm4_ce_gcm(E) sm4_ce_ccm(E) sm4_ce(E) sm4_ce_cipher(E) sm4(E) sm3_ce(E) sm3(E) sha3_ce(E) sha512_ce(E) sha512_arm64(E) sha2_ce(E) sha256_arm64(E) nvme(E) sha1_ce(E) nvme_core(E) nvme_auth(E) t10_pi(E) sg(E) scsi_mod(E) scsi_common(E) efivarfs(E)\n[ 2911.174738] Unloaded tainted modules: cppc_cpufreq(E):1\n[ 2911.180985] CPU: 2 PID: 12247 Comm: cat Kdump: loaded Tainted: G            E      6.7.0-default #2 1b58bbb22c97e4399dc09f92d309344f69c44a01\n[ 2911.182398] Hardware name: Amazon EC2 c7g.8xlarge/, BIOS 1.0 11/1/2018\n[ 2911.183208] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n[ 2911.184038] pc : tracing_map_sort_entries+0x3e0/0x408\n[ 2911.184667] lr : tracing_map_sort_entries+0x3e0/0x408\n[ 2911.185310] sp : ffff8000a1513900\n[ 2911.185750] x29: ffff8000a1513900 x28: ffff0003f272fe80 x27: 0000000000000001\n[ 2911.186600] x26: ffff0003f272fe80 x25: 0000000000000030 x24: 0000000000000008\n[ 2911.187458] x23: ffff0003c5788000 x22: ffff0003c16710c8 x21: ffff80008017f180\n[ 2911.188310] x20: ffff80008017f000 x19: ffff80008017f180 x18: ffffffffffffffff\n[ 2911.189160] x17: 0000000000000000 x16: 0000000000000000 x15: ffff8000a15134b8\n[ 2911.190015] x14: 0000000000000000 x13: 205d373432323154 x12: 5b5d313131333731\n[ 2911.190844] x11: 00000000fffeffff x10: 00000000fffeffff x9 : ffffd1b78274a13c\n[ 2911.191716] x8 : 000000000017ffe8 x7 : c0000000fffeffff x6 : 000000000057ffa8\n[ 2911.192554] x5 : ffff0012f6c24ec0 x4 : 0000000000000000 x3 : ffff2e5b72b5d000\n[ 2911.193404] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0003ff254480\n[ 2911.194259] Call trace:\n[ 2911.194626]  tracing_map_sort_entries+0x3e0/0x408\n[ 2911.195220]  hist_show+0x124/0x800\n[ 2911.195692]  seq_read_iter+0x1d4/0x4e8\n[ 2911.196193]  seq_read+0xe8/0x138\n[ 2911.196638]  vfs_read+0xc8/0x300\n[ 2911.197078]  ksys_read+0x70/0x108\n[ 2911.197534]  __arm64_sys_read+0x24/0x38\n[ 2911.198046]  invoke_syscall+0x78/0x108\n[ 2911.198553]  el0_svc_common.constprop.0+0xd0/0xf8\n[ 2911.199157]  do_el0_svc+0x28/0x40\n[ 2911.199613]  el0_svc+0x40/0x178\n[ 2911.200048]  el0t_64_sync_handler+0x13c/0x158\n[ 2911.200621]  el0t_64_sync+0x1a8/0x1b0\n[ 2911.201115] ---[ end trace 0000000000000000 ]---\r\n\r\nThe problem appears to be caused by CPU reordering of writes issued from\n__tracing_map_insert().\r\n\r\nThe check for the presence of an element with a given key in this\nfunction is:\r\n\r\n val = READ_ONCE(entry-\u0026gt;val);\n if (val \u0026amp;\u0026amp; keys_match(key, val-\u0026gt;key, map-\u0026gt;key_size)) ...\r\n\r\nThe write of a new entry is:\r\n\r\n elt = get_free_elt(map);\n memcpy(elt-\u0026gt;key, key, map-\u0026gt;key_size);\n entry-\u0026gt;val = elt;\r\n\r\nThe \u0026quot;memcpy(elt-\u0026gt;key, key, map-\u0026gt;key_size);\u0026quot; and \u0026quot;entry-\u0026gt;val = elt;\u0026quot;\nstores may become visible in the reversed order on another CPU. This\nsecond CPU might then incorrectly determine that a new key doesn\u0026apos;t match\nan already present val-\u0026gt;key and subse\n---truncated---(CVE-2024-26645)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntunnels: fix out of bounds access when building IPv6 PMTU error\r\n\r\nIf the ICMPv6 error is built from a non-linear skb we get the following\nsplat,\r\n\r\n  BUG: KASAN: slab-out-of-bounds in do_csum+0x220/0x240\n  Read of size 4 at addr ffff88811d402c80 by task netperf/820\n  CPU: 0 PID: 820 Comm: netperf Not tainted 6.8.0-rc1+ #543\n  ...\n   kasan_report+0xd8/0x110\n   do_csum+0x220/0x240\n   csum_partial+0xc/0x20\n   skb_tunnel_check_pmtu+0xeb9/0x3280\n   vxlan_xmit_one+0x14c2/0x4080\n   vxlan_xmit+0xf61/0x5c00\n   dev_hard_start_xmit+0xfb/0x510\n   __dev_queue_xmit+0x7cd/0x32a0\n   br_dev_queue_push_xmit+0x39d/0x6a0\r\n\r\nUse skb_checksum instead of csum_partial who cannot deal with non-linear\nSKBs.(CVE-2024-26665)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nft_limit: reject configurations that cause integer overflow\r\n\r\nReject bogus configs where internal token counter wraps around.\nThis only occurs with very very large requests, such as 17gbyte/s.\r\n\r\nIts better to reject this rather than having incorrect ratelimit.(CVE-2024-26668)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/sched: flower: Fix chain template offload\r\n\r\nWhen a qdisc is deleted from a net device the stack instructs the\nunderlying driver to remove its flow offload callback from the\nassociated filter block using the \u0026apos;FLOW_BLOCK_UNBIND\u0026apos; command. The stack\nthen continues to replay the removal of the filters in the block for\nthis driver by iterating over the chains in the block and invoking the\n\u0026apos;reoffload\u0026apos; operation of the classifier being used. In turn, the\nclassifier in its \u0026apos;reoffload\u0026apos; operation prepares and emits a\n\u0026apos;FLOW_CLS_DESTROY\u0026apos; command for each filter.\r\n\r\nHowever, the stack does not do the same for chain templates and the\nunderlying driver never receives a \u0026apos;FLOW_CLS_TMPLT_DESTROY\u0026apos; command when\na qdisc is deleted. This results in a memory leak [1] which can be\nreproduced using [2].\r\n\r\nFix by introducing a \u0026apos;tmplt_reoffload\u0026apos; operation and have the stack\ninvoke it with the appropriate arguments as part of the replay.\nImplement the operation in the sole classifier that supports chain\ntemplates (flower) by emitting the \u0026apos;FLOW_CLS_TMPLT_{CREATE,DESTROY}\u0026apos;\ncommand based on whether a flow offload callback is being bound to a\nfilter block or being unbound from one.\r\n\r\nAs far as I can tell, the issue happens since cited commit which\nreordered tcf_block_offload_unbind() before tcf_block_flush_all_chains()\nin __tcf_block_put(). The order cannot be reversed as the filter block\nis expected to be freed after flushing all the chains.\r\n\r\n[1]\nunreferenced object 0xffff888107e28800 (size 2048):\n  comm \u0026quot;tc\u0026quot;, pid 1079, jiffies 4294958525 (age 3074.287s)\n  hex dump (first 32 bytes):\n    b1 a6 7c 11 81 88 ff ff e0 5b b3 10 81 88 ff ff  ..|......[......\n    01 00 00 00 00 00 00 00 e0 aa b0 84 ff ff ff ff  ................\n  backtrace:\n    [\u0026lt;ffffffff81c06a68\u0026gt;] __kmem_cache_alloc_node+0x1e8/0x320\n    [\u0026lt;ffffffff81ab374e\u0026gt;] __kmalloc+0x4e/0x90\n    [\u0026lt;ffffffff832aec6d\u0026gt;] mlxsw_sp_acl_ruleset_get+0x34d/0x7a0\n    [\u0026lt;ffffffff832bc195\u0026gt;] mlxsw_sp_flower_tmplt_create+0x145/0x180\n    [\u0026lt;ffffffff832b2e1a\u0026gt;] mlxsw_sp_flow_block_cb+0x1ea/0x280\n    [\u0026lt;ffffffff83a10613\u0026gt;] tc_setup_cb_call+0x183/0x340\n    [\u0026lt;ffffffff83a9f85a\u0026gt;] fl_tmplt_create+0x3da/0x4c0\n    [\u0026lt;ffffffff83a22435\u0026gt;] tc_ctl_chain+0xa15/0x1170\n    [\u0026lt;ffffffff838a863c\u0026gt;] rtnetlink_rcv_msg+0x3cc/0xed0\n    [\u0026lt;ffffffff83ac87f0\u0026gt;] netlink_rcv_skb+0x170/0x440\n    [\u0026lt;ffffffff83ac6270\u0026gt;] netlink_unicast+0x540/0x820\n    [\u0026lt;ffffffff83ac6e28\u0026gt;] netlink_sendmsg+0x8d8/0xda0\n    [\u0026lt;ffffffff83793def\u0026gt;] ____sys_sendmsg+0x30f/0xa80\n    [\u0026lt;ffffffff8379d29a\u0026gt;] ___sys_sendmsg+0x13a/0x1e0\n    [\u0026lt;ffffffff8379d50c\u0026gt;] __sys_sendmsg+0x11c/0x1f0\n    [\u0026lt;ffffffff843b9ce0\u0026gt;] do_syscall_64+0x40/0xe0\nunreferenced object 0xffff88816d2c0400 (size 1024):\n  comm \u0026quot;tc\u0026quot;, pid 1079, jiffies 4294958525 (age 3074.287s)\n  hex dump (first 32 bytes):\n    40 00 00 00 00 00 00 00 57 f6 38 be 00 00 00 00  @.......W.8.....\n    10 04 2c 6d 81 88 ff ff 10 04 2c 6d 81 88 ff ff  ..,m......,m....\n  backtrace:\n    [\u0026lt;ffffffff81c06a68\u0026gt;] __kmem_cache_alloc_node+0x1e8/0x320\n    [\u0026lt;ffffffff81ab36c1\u0026gt;] __kmalloc_node+0x51/0x90\n    [\u0026lt;ffffffff81a8ed96\u0026gt;] kvmalloc_node+0xa6/0x1f0\n    [\u0026lt;ffffffff82827d03\u0026gt;] bucket_table_alloc.isra.0+0x83/0x460\n    [\u0026lt;ffffffff82828d2b\u0026gt;] rhashtable_init+0x43b/0x7c0\n    [\u0026lt;ffffffff832aed48\u0026gt;] mlxsw_sp_acl_ruleset_get+0x428/0x7a0\n    [\u0026lt;ffffffff832bc195\u0026gt;] mlxsw_sp_flower_tmplt_create+0x145/0x180\n    [\u0026lt;ffffffff832b2e1a\u0026gt;] mlxsw_sp_flow_block_cb+0x1ea/0x280\n    [\u0026lt;ffffffff83a10613\u0026gt;] tc_setup_cb_call+0x183/0x340\n    [\u0026lt;ffffffff83a9f85a\u0026gt;] fl_tmplt_create+0x3da/0x4c0\n    [\u0026lt;ffffffff83a22435\u0026gt;] tc_ctl_chain+0xa15/0x1170\n    [\u0026lt;ffffffff838a863c\u0026gt;] rtnetlink_rcv_msg+0x3cc/0xed0\n    [\u0026lt;ffffffff83ac87f0\u0026gt;] netlink_rcv_skb+0x170/0x440\n    [\u0026lt;ffffffff83ac6270\u0026gt;] netlink_unicast+0x540/0x820\n    [\u0026lt;ffffffff83ac6e28\u0026gt;] netlink_sendmsg+0x8d8/0xda0\n    [\u0026lt;ffffffff83793def\u0026gt;] ____sys_sendmsg+0x30f/0xa80\r\n\r\n[2]\n # tc qdisc add dev swp1 clsact\n # tc chain add dev swp1 ingress proto ip chain 1 flower dst_ip 0.0.0.0/32\n # tc qdisc del dev\n---truncated---(CVE-2024-26669)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nblk-mq: fix IO hang from sbitmap wakeup race\r\n\r\nIn blk_mq_mark_tag_wait(), __add_wait_queue() may be re-ordered\nwith the following blk_mq_get_driver_tag() in case of getting driver\ntag failure.\r\n\r\nThen in __sbitmap_queue_wake_up(), waitqueue_active() may not observe\nthe added waiter in blk_mq_mark_tag_wait() and wake up nothing, meantime\nblk_mq_mark_tag_wait() can\u0026apos;t get driver tag successfully.\r\n\r\nThis issue can be reproduced by running the following test in loop, and\nfio hang can be observed in \u0026lt; 30min when running it on my test VM\nin laptop.\r\n\r\n\tmodprobe -r scsi_debug\n\tmodprobe scsi_debug delay=0 dev_size_mb=4096 max_queue=1 host_max_queue=1 submit_queues=4\n\tdev=`ls -d /sys/bus/pseudo/drivers/scsi_debug/adapter*/host*/target*/*/block/* | head -1 | xargs basename`\n\tfio --filename=/dev/\u0026quot;$dev\u0026quot; --direct=1 --rw=randrw --bs=4k --iodepth=1 \\\n       \t\t--runtime=100 --numjobs=40 --time_based --name=test \\\n        \t--ioengine=libaio\r\n\r\nFix the issue by adding one explicit barrier in blk_mq_mark_tag_wait(), which\nis just fine in case of running out of tag.(CVE-2024-26671)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ninet: read sk-\u0026gt;sk_family once in inet_recv_error()\r\n\r\ninet_recv_error() is called without holding the socket lock.\r\n\r\nIPv6 socket could mutate to IPv4 with IPV6_ADDRFORM\nsocket option and trigger a KCSAN warning.(CVE-2024-26679)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: atlantic: Fix DMA mapping for PTP hwts ring\r\n\r\nFunction aq_ring_hwts_rx_alloc() maps extra AQ_CFG_RXDS_DEF bytes\nfor PTP HWTS ring but then generic aq_ring_free() does not take this\ninto account.\nCreate and use a specific function to free HWTS ring to fix this\nissue.\r\n\r\nTrace:\n[  215.351607] ------------[ cut here ]------------\n[  215.351612] DMA-API: atlantic 0000:4b:00.0: device driver frees DMA memory with different size [device address=0x00000000fbdd0000] [map size=34816 bytes] [unmap size=32768 bytes]\n[  215.351635] WARNING: CPU: 33 PID: 10759 at kernel/dma/debug.c:988 check_unmap+0xa6f/0x2360\n...\n[  215.581176] Call Trace:\n[  215.583632]  \u0026lt;TASK\u0026gt;\n[  215.585745]  ? show_trace_log_lvl+0x1c4/0x2df\n[  215.590114]  ? show_trace_log_lvl+0x1c4/0x2df\n[  215.594497]  ? debug_dma_free_coherent+0x196/0x210\n[  215.599305]  ? check_unmap+0xa6f/0x2360\n[  215.603147]  ? __warn+0xca/0x1d0\n[  215.606391]  ? check_unmap+0xa6f/0x2360\n[  215.610237]  ? report_bug+0x1ef/0x370\n[  215.613921]  ? handle_bug+0x3c/0x70\n[  215.617423]  ? exc_invalid_op+0x14/0x50\n[  215.621269]  ? asm_exc_invalid_op+0x16/0x20\n[  215.625480]  ? check_unmap+0xa6f/0x2360\n[  215.629331]  ? mark_lock.part.0+0xca/0xa40\n[  215.633445]  debug_dma_free_coherent+0x196/0x210\n[  215.638079]  ? __pfx_debug_dma_free_coherent+0x10/0x10\n[  215.643242]  ? slab_free_freelist_hook+0x11d/0x1d0\n[  215.648060]  dma_free_attrs+0x6d/0x130\n[  215.651834]  aq_ring_free+0x193/0x290 [atlantic]\n[  215.656487]  aq_ptp_ring_free+0x67/0x110 [atlantic]\n...\n[  216.127540] ---[ end trace 6467e5964dd2640b ]---\n[  216.132160] DMA-API: Mapped at:\n[  216.132162]  debug_dma_alloc_coherent+0x66/0x2f0\n[  216.132165]  dma_alloc_attrs+0xf5/0x1b0\n[  216.132168]  aq_ring_hwts_rx_alloc+0x150/0x1f0 [atlantic]\n[  216.132193]  aq_ptp_ring_alloc+0x1bb/0x540 [atlantic]\n[  216.132213]  aq_nic_init+0x4a1/0x760 [atlantic](CVE-2024-26680)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: stmmac: xgmac: fix handling of DPP safety error for DMA channels\r\n\r\nCommit 56e58d6c8a56 (\u0026quot;net: stmmac: Implement Safety Features in\nXGMAC core\u0026quot;) checks and reports safety errors, but leaves the\nData Path Parity Errors for each channel in DMA unhandled at all, lead to\na storm of interrupt.\nFix it by checking and clearing the DMA_DPP_Interrupt_Status register.(CVE-2024-26684)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnilfs2: fix potential bug in end_buffer_async_write\r\n\r\nAccording to a syzbot report, end_buffer_async_write(), which handles the\ncompletion of block device writes, may detect abnormal condition of the\nbuffer async_write flag and cause a BUG_ON failure when using nilfs2.\r\n\r\nNilfs2 itself does not use end_buffer_async_write().  But, the async_write\nflag is now used as a marker by commit 7f42ec394156 (\u0026quot;nilfs2: fix issue\nwith race condition of competition between segments for dirty blocks\u0026quot;) as\na means of resolving double list insertion of dirty blocks in\nnilfs_lookup_dirty_data_buffers() and nilfs_lookup_node_buffers() and the\nresulting crash.\r\n\r\nThis modification is safe as long as it is used for file data and b-tree\nnode blocks where the page caches are independent.  However, it was\nirrelevant and redundant to also introduce async_write for segment summary\nand super root blocks that share buffers with the backing device.  This\nled to the possibility that the BUG_ON check in end_buffer_async_write\nwould fail as described above, if independent writebacks of the backing\ndevice occurred in parallel.\r\n\r\nThe use of async_write for segment summary buffers has already been\nremoved in a previous change.\r\n\r\nFix this issue by removing the manipulation of the async_write flag for\nthe remaining super root block buffer.(CVE-2024-26685)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nfs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super\r\n\r\nWhen configuring a hugetlb filesystem via the fsconfig() syscall, there is\na possible NULL dereference in hugetlbfs_fill_super() caused by assigning\nNULL to ctx-\u0026gt;hstate in hugetlbfs_parse_param() when the requested pagesize\nis non valid.\r\n\r\nE.g: Taking the following steps:\r\n\r\n     fd = fsopen(\u0026quot;hugetlbfs\u0026quot;, FSOPEN_CLOEXEC);\n     fsconfig(fd, FSCONFIG_SET_STRING, \u0026quot;pagesize\u0026quot;, \u0026quot;1024\u0026quot;, 0);\n     fsconfig(fd, FSCONFIG_CMD_CREATE, NULL, NULL, 0);\r\n\r\nGiven that the requested \u0026quot;pagesize\u0026quot; is invalid, ctxt-\u0026gt;hstate will be replaced\nwith NULL, losing its previous value, and we will print an error:\r\n\r\n ...\n ...\n case Opt_pagesize:\n ps = memparse(param-\u0026gt;string, \u0026amp;rest);\n ctx-\u0026gt;hstate = h;\n if (!ctx-\u0026gt;hstate) {\n         pr_err(\u0026quot;Unsupported page size %lu MB\\n\u0026quot;, ps / SZ_1M);\n         return -EINVAL;\n }\n return 0;\n ...\n ...\r\n\r\nThis is a problem because later on, we will dereference ctxt-\u0026gt;hstate in\nhugetlbfs_fill_super()\r\n\r\n ...\n ...\n sb-\u0026gt;s_blocksize = huge_page_size(ctx-\u0026gt;hstate);\n ...\n ...\r\n\r\nCausing below Oops.\r\n\r\nFix this by replacing cxt-\u0026gt;hstate value only when then pagesize is known\nto be valid.\r\n\r\n kernel: hugetlbfs: Unsupported page size 0 MB\n kernel: BUG: kernel NULL pointer dereference, address: 0000000000000028\n kernel: #PF: supervisor read access in kernel mode\n kernel: #PF: error_code(0x0000) - not-present page\n kernel: PGD 800000010f66c067 P4D 800000010f66c067 PUD 1b22f8067 PMD 0\n kernel: Oops: 0000 [#1] PREEMPT SMP PTI\n kernel: CPU: 4 PID: 5659 Comm: syscall Tainted: G            E      6.8.0-rc2-default+ #22 5a47c3fef76212addcc6eb71344aabc35190ae8f\n kernel: Hardware name: Intel Corp. GROVEPORT/GROVEPORT, BIOS GVPRCRB1.86B.0016.D04.1705030402 05/03/2017\n kernel: RIP: 0010:hugetlbfs_fill_super+0xb4/0x1a0\n kernel: Code: 48 8b 3b e8 3e c6 ed ff 48 85 c0 48 89 45 20 0f 84 d6 00 00 00 48 b8 ff ff ff ff ff ff ff 7f 4c 89 e7 49 89 44 24 20 48 8b 03 \u0026lt;8b\u0026gt; 48 28 b8 00 10 00 00 48 d3 e0 49 89 44 24 18 48 8b 03 8b 40 28\n kernel: RSP: 0018:ffffbe9960fcbd48 EFLAGS: 00010246\n kernel: RAX: 0000000000000000 RBX: ffff9af5272ae780 RCX: 0000000000372004\n kernel: RDX: ffffffffffffffff RSI: ffffffffffffffff RDI: ffff9af555e9b000\n kernel: RBP: ffff9af52ee66b00 R08: 0000000000000040 R09: 0000000000370004\n kernel: R10: ffffbe9960fcbd48 R11: 0000000000000040 R12: ffff9af555e9b000\n kernel: R13: ffffffffa66b86c0 R14: ffff9af507d2f400 R15: ffff9af507d2f400\n kernel: FS:  00007ffbc0ba4740(0000) GS:ffff9b0bd7000000(0000) knlGS:0000000000000000\n kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n kernel: CR2: 0000000000000028 CR3: 00000001b1ee0000 CR4: 00000000001506f0\n kernel: Call Trace:\n kernel:  \u0026lt;TASK\u0026gt;\n kernel:  ? __die_body+0x1a/0x60\n kernel:  ? page_fault_oops+0x16f/0x4a0\n kernel:  ? search_bpf_extables+0x65/0x70\n kernel:  ? fixup_exception+0x22/0x310\n kernel:  ? exc_page_fault+0x69/0x150\n kernel:  ? asm_exc_page_fault+0x22/0x30\n kernel:  ? __pfx_hugetlbfs_fill_super+0x10/0x10\n kernel:  ? hugetlbfs_fill_super+0xb4/0x1a0\n kernel:  ? hugetlbfs_fill_super+0x28/0x1a0\n kernel:  ? __pfx_hugetlbfs_fill_super+0x10/0x10\n kernel:  vfs_get_super+0x40/0xa0\n kernel:  ? __pfx_bpf_lsm_capable+0x10/0x10\n kernel:  vfs_get_tree+0x25/0xd0\n kernel:  vfs_cmd_create+0x64/0xe0\n kernel:  __x64_sys_fsconfig+0x395/0x410\n kernel:  do_syscall_64+0x80/0x160\n kernel:  ? syscall_exit_to_user_mode+0x82/0x240\n kernel:  ? do_syscall_64+0x8d/0x160\n kernel:  ? syscall_exit_to_user_mode+0x82/0x240\n kernel:  ? do_syscall_64+0x8d/0x160\n kernel:  ? exc_page_fault+0x69/0x150\n kernel:  entry_SYSCALL_64_after_hwframe+0x6e/0x76\n kernel: RIP: 0033:0x7ffbc0cb87c9\n kernel: Code: 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 8b 0d 97 96 0d 00 f7 d8 64 89 01 48\n kernel: RSP: 002b:00007ffc29d2f388 EFLAGS: 00000206 ORIG_RAX: 00000000000001af\n kernel: RAX: fffffffffff\n---truncated---(CVE-2024-26688)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nceph: prevent use-after-free in encode_cap_msg()\r\n\r\nIn fs/ceph/caps.c, in encode_cap_msg(), \u0026quot;use after free\u0026quot; error was\ncaught by KASAN at this line - \u0026apos;ceph_buffer_get(arg-\u0026gt;xattr_buf);\u0026apos;. This\nimplies before the refcount could be increment here, it was freed.\r\n\r\nIn same file, in \u0026quot;handle_cap_grant()\u0026quot; refcount is decremented by this\nline - \u0026apos;ceph_buffer_put(ci-\u0026gt;i_xattrs.blob);\u0026apos;. It appears that a race\noccurred and resource was freed by the latter line before the former\nline could increment it.\r\n\r\nencode_cap_msg() is called by __send_cap() and __send_cap() is called by\nceph_check_caps() after calling __prep_cap(). __prep_cap() is where\narg-\u0026gt;xattr_buf is assigned to ci-\u0026gt;i_xattrs.blob. This is the spot where\nthe refcount must be increased to prevent \u0026quot;use after free\u0026quot; error.(CVE-2024-26689)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnilfs2: fix data corruption in dsync block recovery for small block sizes\r\n\r\nThe helper function nilfs_recovery_copy_block() of\nnilfs_recovery_dsync_blocks(), which recovers data from logs created by\ndata sync writes during a mount after an unclean shutdown, incorrectly\ncalculates the on-page offset when copying repair data to the file\u0026apos;s page\ncache.  In environments where the block size is smaller than the page\nsize, this flaw can cause data corruption and leak uninitialized memory\nbytes during the recovery process.\r\n\r\nFix these issues by correcting this byte offset calculation on the page.(CVE-2024-26697)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nparisc: Fix random data corruption from exception handler\r\n\r\nThe current exception handler implementation, which assists when accessing\nuser space memory, may exhibit random data corruption if the compiler decides\nto use a different register than the specified register %r29 (defined in\nASM_EXCEPTIONTABLE_REG) for the error code. If the compiler choose another\nregister, the fault handler will nevertheless store -EFAULT into %r29 and thus\ntrash whatever this register is used for.\nLooking at the assembly I found that this happens sometimes in emulate_ldd().\r\n\r\nTo solve the issue, the easiest solution would be if it somehow is\npossible to tell the fault handler which register is used to hold the error\ncode. Using %0 or %1 in the inline assembly is not posssible as it will show\nup as e.g. %r29 (with the \u0026quot;%r\u0026quot; prefix), which the GNU assembler can not\nconvert to an integer.\r\n\r\nThis patch takes another, better and more flexible approach:\nWe extend the __ex_table (which is out of the execution path) by one 32-word.\nIn this word we tell the compiler to insert the assembler instruction\n\u0026quot;or %r0,%r0,%reg\u0026quot;, where %reg references the register which the compiler\nchoosed for the error return code.\nIn case of an access failure, the fault handler finds the __ex_table entry and\ncan examine the opcode. The used register is encoded in the lowest 5 bits, and\nthe fault handler can then store -EFAULT into this register.\r\n\r\nSince we extend the __ex_table to 3 words we can\u0026apos;t use the BUILDTIME_TABLE_SORT\nconfig option any longer.(CVE-2024-26706)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: hsr: remove WARN_ONCE() in send_hsr_supervision_frame()\r\n\r\nSyzkaller reported [1] hitting a warning after failing to allocate\nresources for skb in hsr_init_skb(). Since a WARN_ONCE() call will\nnot help much in this case, it might be prudent to switch to\nnetdev_warn_once(). At the very least it will suppress syzkaller\nreports such as [1].\r\n\r\nJust in case, use netdev_warn_once() in send_prp_supervision_frame()\nfor similar reasons.\r\n\r\n[1]\nHSR: Could not send supervision frame\nWARNING: CPU: 1 PID: 85 at net/hsr/hsr_device.c:294 send_hsr_supervision_frame+0x60a/0x810 net/hsr/hsr_device.c:294\nRIP: 0010:send_hsr_supervision_frame+0x60a/0x810 net/hsr/hsr_device.c:294\n...\nCall Trace:\n \u0026lt;IRQ\u0026gt;\n hsr_announce+0x114/0x370 net/hsr/hsr_device.c:382\n call_timer_fn+0x193/0x590 kernel/time/timer.c:1700\n expire_timers kernel/time/timer.c:1751 [inline]\n __run_timers+0x764/0xb20 kernel/time/timer.c:2022\n run_timer_softirq+0x58/0xd0 kernel/time/timer.c:2035\n __do_softirq+0x21a/0x8de kernel/softirq.c:553\n invoke_softirq kernel/softirq.c:427 [inline]\n __irq_exit_rcu kernel/softirq.c:632 [inline]\n irq_exit_rcu+0xb7/0x120 kernel/softirq.c:644\n sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1076\n \u0026lt;/IRQ\u0026gt;\n \u0026lt;TASK\u0026gt;\n asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649\n...\r\n\r\nThis issue is also found in older kernels (at least up to 5.10).(CVE-2024-26707)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again\r\n\r\n(struct dirty_throttle_control *)-\u0026gt;thresh is an unsigned long, but is\npassed as the u32 divisor argument to div_u64().  On architectures where\nunsigned long is 64 bytes, the argument will be implicitly truncated.\r\n\r\nUse div64_u64() instead of div_u64() so that the value used in the \u0026quot;is\nthis a safe division\u0026quot; check is the same as the divisor.\r\n\r\nAlso, remove redundant cast of the numerator to u64, as that should happen\nimplicitly.\r\n\r\nThis would be difficult to exploit in memcg domain, given the ratio-based\narithmetic domain_drity_limits() uses, but is much easier in global\nwriteback domain with a BDI_CAP_STRICTLIMIT-backing device, using e.g. \nvm.dirty_bytes=(1\u0026lt;\u0026lt;32)*PAGE_SIZE so that dtc-\u0026gt;thresh == (1\u0026lt;\u0026lt;32)(CVE-2024-26720)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbtrfs: don\u0026apos;t drop extent_map for free space inode on write error\r\n\r\nWhile running the CI for an unrelated change I hit the following panic\nwith generic/648 on btrfs_holes_spacecache.\r\n\r\nassertion failed: block_start != EXTENT_MAP_HOLE, in fs/btrfs/extent_io.c:1385\n------------[ cut here ]------------\nkernel BUG at fs/btrfs/extent_io.c:1385!\ninvalid opcode: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 1 PID: 2695096 Comm: fsstress Kdump: loaded Tainted: G        W          6.8.0-rc2+ #1\nRIP: 0010:__extent_writepage_io.constprop.0+0x4c1/0x5c0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n extent_write_cache_pages+0x2ac/0x8f0\n extent_writepages+0x87/0x110\n do_writepages+0xd5/0x1f0\n filemap_fdatawrite_wbc+0x63/0x90\n __filemap_fdatawrite_range+0x5c/0x80\n btrfs_fdatawrite_range+0x1f/0x50\n btrfs_write_out_cache+0x507/0x560\n btrfs_write_dirty_block_groups+0x32a/0x420\n commit_cowonly_roots+0x21b/0x290\n btrfs_commit_transaction+0x813/0x1360\n btrfs_sync_file+0x51a/0x640\n __x64_sys_fdatasync+0x52/0x90\n do_syscall_64+0x9c/0x190\n entry_SYSCALL_64_after_hwframe+0x6e/0x76\r\n\r\nThis happens because we fail to write out the free space cache in one\ninstance, come back around and attempt to write it again.  However on\nthe second pass through we go to call btrfs_get_extent() on the inode to\nget the extent mapping.  Because this is a new block group, and with the\nfree space inode we always search the commit root to avoid deadlocking\nwith the tree, we find nothing and return a EXTENT_MAP_HOLE for the\nrequested range.\r\n\r\nThis happens because the first time we try to write the space cache out\nwe hit an error, and on an error we drop the extent mapping.  This is\nnormal for normal files, but the free space cache inode is special.  We\nalways expect the extent map to be correct.  Thus the second time\nthrough we end up with a bogus extent map.\r\n\r\nSince we\u0026apos;re deprecating this feature, the most straightforward way to\nfix this is to simply skip dropping the extent map range for this failed\nrange.\r\n\r\nI shortened the test by using error injection to stress the area to make\nit easier to reproduce.  With this patch in place we no longer panic\nwith my error injection test.(CVE-2024-26726)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\narp: Prevent overflow in arp_req_get().\r\n\r\nsyzkaller reported an overflown write in arp_req_get(). [0]\r\n\r\nWhen ioctl(SIOCGARP) is issued, arp_req_get() looks up an neighbour\nentry and copies neigh-\u0026gt;ha to struct arpreq.arp_ha.sa_data.\r\n\r\nThe arp_ha here is struct sockaddr, not struct sockaddr_storage, so\nthe sa_data buffer is just 14 bytes.\r\n\r\nIn the splat below, 2 bytes are overflown to the next int field,\narp_flags.  We initialise the field just after the memcpy(), so it\u0026apos;s\nnot a problem.\r\n\r\nHowever, when dev-\u0026gt;addr_len is greater than 22 (e.g. MAX_ADDR_LEN),\narp_netmask is overwritten, which could be set as htonl(0xFFFFFFFFUL)\nin arp_ioctl() before calling arp_req_get().\r\n\r\nTo avoid the overflow, let\u0026apos;s limit the max length of memcpy().\r\n\r\nNote that commit b5f0de6df6dc (\u0026quot;net: dev: Convert sa_data to flexible\narray in struct sockaddr\u0026quot;) just silenced syzkaller.\r\n\r\n[0]:\nmemcpy: detected field-spanning write (size 16) of single field \u0026quot;r-\u0026gt;arp_ha.sa_data\u0026quot; at net/ipv4/arp.c:1128 (size 14)\nWARNING: CPU: 0 PID: 144638 at net/ipv4/arp.c:1128 arp_req_get+0x411/0x4a0 net/ipv4/arp.c:1128\nModules linked in:\nCPU: 0 PID: 144638 Comm: syz-executor.4 Not tainted 6.1.74 #31\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-5 04/01/2014\nRIP: 0010:arp_req_get+0x411/0x4a0 net/ipv4/arp.c:1128\nCode: fd ff ff e8 41 42 de fb b9 0e 00 00 00 4c 89 fe 48 c7 c2 20 6d ab 87 48 c7 c7 80 6d ab 87 c6 05 25 af 72 04 01 e8 5f 8d ad fb \u0026lt;0f\u0026gt; 0b e9 6c fd ff ff e8 13 42 de fb be 03 00 00 00 4c 89 e7 e8 a6\nRSP: 0018:ffffc900050b7998 EFLAGS: 00010286\nRAX: 0000000000000000 RBX: ffff88803a815000 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: ffffffff8641a44a RDI: 0000000000000001\nRBP: ffffc900050b7a98 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000000 R11: 203a7970636d656d R12: ffff888039c54000\nR13: 1ffff92000a16f37 R14: ffff88803a815084 R15: 0000000000000010\nFS:  00007f172bf306c0(0000) GS:ffff88805aa00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f172b3569f0 CR3: 0000000057f12005 CR4: 0000000000770ef0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n \u0026lt;TASK\u0026gt;\n arp_ioctl+0x33f/0x4b0 net/ipv4/arp.c:1261\n inet_ioctl+0x314/0x3a0 net/ipv4/af_inet.c:981\n sock_do_ioctl+0xdf/0x260 net/socket.c:1204\n sock_ioctl+0x3ef/0x650 net/socket.c:1321\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:870 [inline]\n __se_sys_ioctl fs/ioctl.c:856 [inline]\n __x64_sys_ioctl+0x18e/0x220 fs/ioctl.c:856\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x37/0x90 arch/x86/entry/common.c:81\n entry_SYSCALL_64_after_hwframe+0x64/0xce\nRIP: 0033:0x7f172b262b8d\nCode: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f172bf300b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 00007f172b3abf80 RCX: 00007f172b262b8d\nRDX: 0000000020000000 RSI: 0000000000008954 RDI: 0000000000000003\nRBP: 00007f172b2d3493 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 000000000000000b R14: 00007f172b3abf80 R15: 00007f172bf10000\n \u0026lt;/TASK\u0026gt;(CVE-2024-26733)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndevlink: fix possible use-after-free and memory leaks in devlink_init()\r\n\r\nThe pernet operations structure for the subsystem must be registered\nbefore registering the generic netlink family.\r\n\r\nMake an unregister in case of unsuccessful registration.(CVE-2024-26734)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nipv6: sr: fix possible use-after-free and null-ptr-deref\r\n\r\nThe pernet operations structure for the subsystem must be registered\nbefore registering the generic netlink family.(CVE-2024-26735)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/sched: act_mirred: don\u0026apos;t override retval if we already lost the skb\r\n\r\nIf we\u0026apos;re redirecting the skb, and haven\u0026apos;t called tcf_mirred_forward(),\nyet, we need to tell the core to drop the skb by setting the retcode\nto SHOT. If we have called tcf_mirred_forward(), however, the skb\nis out of our hands and returning SHOT will lead to UaF.\r\n\r\nMove the retval override to the error path which actually need it.(CVE-2024-26739)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/sched: act_mirred: use the backlog for mirred ingress\r\n\r\nThe test Davide added in commit ca22da2fbd69 (\u0026quot;act_mirred: use the backlog\nfor nested calls to mirred ingress\u0026quot;) hangs our testing VMs every 10 or so\nruns, with the familiar tcp_v4_rcv -\u0026gt; tcp_v4_rcv deadlock reported by\nlockdep.\r\n\r\nThe problem as previously described by Davide (see Link) is that\nif we reverse flow of traffic with the redirect (egress -\u0026gt; ingress)\nwe may reach the same socket which generated the packet. And we may\nstill be holding its socket lock. The common solution to such deadlocks\nis to put the packet in the Rx backlog, rather than run the Rx path\ninline. Do that for all egress -\u0026gt; ingress reversals, not just once\nwe started to nest mirred calls.\r\n\r\nIn the past there was a concern that the backlog indirection will\nlead to loss of error reporting / less accurate stats. But the current\nworkaround does not seem to address the issue.(CVE-2024-26740)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nRDMA/qedr: Fix qedr_create_user_qp error flow\r\n\r\nAvoid the following warning by making sure to free the allocated\nresources in case that qedr_init_user_queue() fail.\r\n\r\n-----------[ cut here ]-----------\nWARNING: CPU: 0 PID: 143192 at drivers/infiniband/core/rdma_core.c:874 uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]\nModules linked in: tls target_core_user uio target_core_pscsi target_core_file target_core_iblock ib_srpt ib_srp scsi_transport_srp nfsd nfs_acl rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs 8021q garp mrp stp llc ext4 mbcache jbd2 opa_vnic ib_umad ib_ipoib sunrpc rdma_ucm ib_isert iscsi_target_mod target_core_mod ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm hfi1 intel_rapl_msr intel_rapl_common mgag200 qedr sb_edac drm_shmem_helper rdmavt x86_pkg_temp_thermal drm_kms_helper intel_powerclamp ib_uverbs coretemp i2c_algo_bit kvm_intel dell_wmi_descriptor ipmi_ssif sparse_keymap kvm ib_core rfkill syscopyarea sysfillrect video sysimgblt irqbypass ipmi_si ipmi_devintf fb_sys_fops rapl iTCO_wdt mxm_wmi iTCO_vendor_support intel_cstate pcspkr dcdbas intel_uncore ipmi_msghandler lpc_ich acpi_power_meter mei_me mei fuse drm xfs libcrc32c qede sd_mod ahci libahci t10_pi sg crct10dif_pclmul crc32_pclmul crc32c_intel qed libata tg3\nghash_clmulni_intel megaraid_sas crc8 wmi [last unloaded: ib_srpt]\nCPU: 0 PID: 143192 Comm: fi_rdm_tagged_p Kdump: loaded Not tainted 5.14.0-408.el9.x86_64 #1\nHardware name: Dell Inc. PowerEdge R430/03XKDV, BIOS 2.14.0 01/25/2022\nRIP: 0010:uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]\nCode: 5d 41 5c 41 5d 41 5e e9 0f 26 1b dd 48 89 df e8 67 6a ff ff 49 8b 86 10 01 00 00 48 85 c0 74 9c 4c 89 e7 e8 83 c0 cb dd eb 92 \u0026lt;0f\u0026gt; 0b eb be 0f 0b be 04 00 00 00 48 89 df e8 8e f5 ff ff e9 6d ff\nRSP: 0018:ffffb7c6cadfbc60 EFLAGS: 00010286\nRAX: ffff8f0889ee3f60 RBX: ffff8f088c1a5200 RCX: 00000000802a0016\nRDX: 00000000802a0017 RSI: 0000000000000001 RDI: ffff8f0880042600\nRBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000\nR10: ffff8f11fffd5000 R11: 0000000000039000 R12: ffff8f0d5b36cd80\nR13: ffff8f088c1a5250 R14: ffff8f1206d91000 R15: 0000000000000000\nFS: 0000000000000000(0000) GS:ffff8f11d7c00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000147069200e20 CR3: 00000001c7210002 CR4: 00000000001706f0\nCall Trace:\n\u0026lt;TASK\u0026gt;\n? show_trace_log_lvl+0x1c4/0x2df\n? show_trace_log_lvl+0x1c4/0x2df\n? ib_uverbs_close+0x1f/0xb0 [ib_uverbs]\n? uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]\n? __warn+0x81/0x110\n? uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]\n? report_bug+0x10a/0x140\n? handle_bug+0x3c/0x70\n? exc_invalid_op+0x14/0x70\n? asm_exc_invalid_op+0x16/0x20\n? uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]\nib_uverbs_close+0x1f/0xb0 [ib_uverbs]\n__fput+0x94/0x250\ntask_work_run+0x5c/0x90\ndo_exit+0x270/0x4a0\ndo_group_exit+0x2d/0x90\nget_signal+0x87c/0x8c0\narch_do_signal_or_restart+0x25/0x100\n? ib_uverbs_ioctl+0xc2/0x110 [ib_uverbs]\nexit_to_user_mode_loop+0x9c/0x130\nexit_to_user_mode_prepare+0xb6/0x100\nsyscall_exit_to_user_mode+0x12/0x40\ndo_syscall_64+0x69/0x90\n? syscall_exit_work+0x103/0x130\n? syscall_exit_to_user_mode+0x22/0x40\n? do_syscall_64+0x69/0x90\n? syscall_exit_work+0x103/0x130\n? syscall_exit_to_user_mode+0x22/0x40\n? do_syscall_64+0x69/0x90\n? do_syscall_64+0x69/0x90\n? common_interrupt+0x43/0xa0\nentry_SYSCALL_64_after_hwframe+0x72/0xdc\nRIP: 0033:0x1470abe3ec6b\nCode: Unable to access opcode bytes at RIP 0x1470abe3ec41.\nRSP: 002b:00007fff13ce9108 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: fffffffffffffffc RBX: 00007fff13ce9218 RCX: 00001470abe3ec6b\nRDX: 00007fff13ce9200 RSI: 00000000c0181b01 RDI: 0000000000000004\nRBP: 00007fff13ce91e0 R08: 0000558d9655da10 R09: 0000558d9655dd00\nR10: 00007fff13ce95c0 R11: 0000000000000246 R12: 00007fff13ce9358\nR13: 0000000000000013 R14: 0000558d9655db50 R15: 00007fff13ce9470\n\u0026lt;/TASK\u0026gt;\n--[ end trace 888a9b92e04c5c97 ]--(CVE-2024-26743)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nRDMA/srpt: Support specifying the srpt_service_guid parameter\r\n\r\nMake loading ib_srpt with this parameter set work. The current behavior is\nthat setting that parameter while loading the ib_srpt kernel module\ntriggers the following kernel crash:\r\n\r\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nCall Trace:\n \u0026lt;TASK\u0026gt;\n parse_one+0x18c/0x1d0\n parse_args+0xe1/0x230\n load_module+0x8de/0xa60\n init_module_from_file+0x8b/0xd0\n idempotent_init_module+0x181/0x240\n __x64_sys_finit_module+0x5a/0xb0\n do_syscall_64+0x5f/0xe0\n entry_SYSCALL_64_after_hwframe+0x6e/0x76(CVE-2024-26744)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ngtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()\r\n\r\nThe gtp_net_ops pernet operations structure for the subsystem must be\nregistered before registering the generic netlink family.\r\n\r\nSyzkaller hit \u0026apos;general protection fault in gtp_genl_dump_pdp\u0026apos; bug:\r\n\r\ngeneral protection fault, probably for non-canonical address\n0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN NOPTI\nKASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\nCPU: 1 PID: 5826 Comm: gtp Not tainted 6.8.0-rc3-std-def-alt1 #1\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-alt1 04/01/2014\nRIP: 0010:gtp_genl_dump_pdp+0x1be/0x800 [gtp]\nCode: c6 89 c6 e8 64 e9 86 df 58 45 85 f6 0f 85 4e 04 00 00 e8 c5 ee 86\n      df 48 8b 54 24 18 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 \u0026lt;80\u0026gt;\n      3c 02 00 0f 85 de 05 00 00 48 8b 44 24 18 4c 8b 30 4c 39 f0 74\nRSP: 0018:ffff888014107220 EFLAGS: 00010202\nRAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000\nRDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000\nRBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000\nR13: ffff88800fcda588 R14: 0000000000000001 R15: 0000000000000000\nFS:  00007f1be4eb05c0(0000) GS:ffff88806ce80000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f1be4e766cf CR3: 000000000c33e000 CR4: 0000000000750ef0\nPKRU: 55555554\nCall Trace:\n \u0026lt;TASK\u0026gt;\n ? show_regs+0x90/0xa0\n ? die_addr+0x50/0xd0\n ? exc_general_protection+0x148/0x220\n ? asm_exc_general_protection+0x22/0x30\n ? gtp_genl_dump_pdp+0x1be/0x800 [gtp]\n ? __alloc_skb+0x1dd/0x350\n ? __pfx___alloc_skb+0x10/0x10\n genl_dumpit+0x11d/0x230\n netlink_dump+0x5b9/0xce0\n ? lockdep_hardirqs_on_prepare+0x253/0x430\n ? __pfx_netlink_dump+0x10/0x10\n ? kasan_save_track+0x10/0x40\n ? __kasan_kmalloc+0x9b/0xa0\n ? genl_start+0x675/0x970\n __netlink_dump_start+0x6fc/0x9f0\n genl_family_rcv_msg_dumpit+0x1bb/0x2d0\n ? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10\n ? genl_op_from_small+0x2a/0x440\n ? cap_capable+0x1d0/0x240\n ? __pfx_genl_start+0x10/0x10\n ? __pfx_genl_dumpit+0x10/0x10\n ? __pfx_genl_done+0x10/0x10\n ? security_capable+0x9d/0xe0(CVE-2024-26754)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndm-crypt: don\u0026apos;t modify the data when using authenticated encryption\r\n\r\nIt was said that authenticated encryption could produce invalid tag when\nthe data that is being encrypted is modified [1]. So, fix this problem by\ncopying the data into the clone bio first and then encrypt them inside the\nclone bio.\r\n\r\nThis may reduce performance, but it is needed to prevent the user from\ncorrupting the device by writing data with O_DIRECT and modifying them at\nthe same time.\r\n\r\n[1] https://lore.kernel.org/all/20240207004723.GA35324@sol.localdomain/T/(CVE-2024-26763)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nspi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected\r\n\r\nReturn IRQ_NONE from the interrupt handler when no interrupt was\ndetected. Because an empty interrupt will cause a null pointer error:\r\n\r\n    Unable to handle kernel NULL pointer dereference at virtual\n  address 0000000000000008\n    Call trace:\n        complete+0x54/0x100\n        hisi_sfc_v3xx_isr+0x2c/0x40 [spi_hisi_sfc_v3xx]\n        __handle_irq_event_percpu+0x64/0x1e0\n        handle_irq_event+0x7c/0x1cc(CVE-2024-26776)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmptcp: fix double-free on socket dismantle\r\n\r\nwhen MPTCP server accepts an incoming connection, it clones its listener\nsocket. However, the pointer to \u0026apos;inet_opt\u0026apos; for the new socket has the same\nvalue as the original one: as a consequence, on program exit it\u0026apos;s possible\nto observe the following splat:\r\n\r\n  BUG: KASAN: double-free in inet_sock_destruct+0x54f/0x8b0\n  Free of addr ffff888485950880 by task swapper/25/0\r\n\r\n  CPU: 25 PID: 0 Comm: swapper/25 Kdump: loaded Not tainted 6.8.0-rc1+ #609\n  Hardware name: Supermicro SYS-6027R-72RF/X9DRH-7TF/7F/iTF/iF, BIOS 3.0  07/26/2013\n  Call Trace:\n   \u0026lt;IRQ\u0026gt;\n   dump_stack_lvl+0x32/0x50\n   print_report+0xca/0x620\n   kasan_report_invalid_free+0x64/0x90\n   __kasan_slab_free+0x1aa/0x1f0\n   kfree+0xed/0x2e0\n   inet_sock_destruct+0x54f/0x8b0\n   __sk_destruct+0x48/0x5b0\n   rcu_do_batch+0x34e/0xd90\n   rcu_core+0x559/0xac0\n   __do_softirq+0x183/0x5a4\n   irq_exit_rcu+0x12d/0x170\n   sysvec_apic_timer_interrupt+0x6b/0x80\n   \u0026lt;/IRQ\u0026gt;\n   \u0026lt;TASK\u0026gt;\n   asm_sysvec_apic_timer_interrupt+0x16/0x20\n  RIP: 0010:cpuidle_enter_state+0x175/0x300\n  Code: 30 00 0f 84 1f 01 00 00 83 e8 01 83 f8 ff 75 e5 48 83 c4 18 44 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc fb 45 85 ed \u0026lt;0f\u0026gt; 89 60 ff ff ff 48 c1 e5 06 48 c7 43 18 00 00 00 00 48 83 44 2b\n  RSP: 0018:ffff888481cf7d90 EFLAGS: 00000202\n  RAX: 0000000000000000 RBX: ffff88887facddc8 RCX: 0000000000000000\n  RDX: 1ffff1110ff588b1 RSI: 0000000000000019 RDI: ffff88887fac4588\n  RBP: 0000000000000004 R08: 0000000000000002 R09: 0000000000043080\n  R10: 0009b02ea273363f R11: ffff88887fabf42b R12: ffffffff932592e0\n  R13: 0000000000000004 R14: 0000000000000000 R15: 00000022c880ec80\n   cpuidle_enter+0x4a/0xa0\n   do_idle+0x310/0x410\n   cpu_startup_entry+0x51/0x60\n   start_secondary+0x211/0x270\n   secondary_startup_64_no_verify+0x184/0x18b\n   \u0026lt;/TASK\u0026gt;\r\n\r\n  Allocated by task 6853:\n   kasan_save_stack+0x1c/0x40\n   kasan_save_track+0x10/0x30\n   __kasan_kmalloc+0xa6/0xb0\n   __kmalloc+0x1eb/0x450\n   cipso_v4_sock_setattr+0x96/0x360\n   netlbl_sock_setattr+0x132/0x1f0\n   selinux_netlbl_socket_post_create+0x6c/0x110\n   selinux_socket_post_create+0x37b/0x7f0\n   security_socket_post_create+0x63/0xb0\n   __sock_create+0x305/0x450\n   __sys_socket_create.part.23+0xbd/0x130\n   __sys_socket+0x37/0xb0\n   __x64_sys_socket+0x6f/0xb0\n   do_syscall_64+0x83/0x160\n   entry_SYSCALL_64_after_hwframe+0x6e/0x76\r\n\r\n  Freed by task 6858:\n   kasan_save_stack+0x1c/0x40\n   kasan_save_track+0x10/0x30\n   kasan_save_free_info+0x3b/0x60\n   __kasan_slab_free+0x12c/0x1f0\n   kfree+0xed/0x2e0\n   inet_sock_destruct+0x54f/0x8b0\n   __sk_destruct+0x48/0x5b0\n   subflow_ulp_release+0x1f0/0x250\n   tcp_cleanup_ulp+0x6e/0x110\n   tcp_v4_destroy_sock+0x5a/0x3a0\n   inet_csk_destroy_sock+0x135/0x390\n   tcp_fin+0x416/0x5c0\n   tcp_data_queue+0x1bc8/0x4310\n   tcp_rcv_state_process+0x15a3/0x47b0\n   tcp_v4_do_rcv+0x2c1/0x990\n   tcp_v4_rcv+0x41fb/0x5ed0\n   ip_protocol_deliver_rcu+0x6d/0x9f0\n   ip_local_deliver_finish+0x278/0x360\n   ip_local_deliver+0x182/0x2c0\n   ip_rcv+0xb5/0x1c0\n   __netif_receive_skb_one_core+0x16e/0x1b0\n   process_backlog+0x1e3/0x650\n   __napi_poll+0xa6/0x500\n   net_rx_action+0x740/0xbb0\n   __do_softirq+0x183/0x5a4\r\n\r\n  The buggy address belongs to the object at ffff888485950880\n   which belongs to the cache kmalloc-64 of size 64\n  The buggy address is located 0 bytes inside of\n   64-byte region [ffff888485950880, ffff8884859508c0)\r\n\r\n  The buggy address belongs to the physical page:\n  page:0000000056d1e95e refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888485950700 pfn:0x485950\n  flags: 0x57ffffc0000800(slab|node=1|zone=2|lastcpupid=0x1fffff)\n  page_type: 0xffffffff()\n  raw: 0057ffffc0000800 ffff88810004c640 ffffea00121b8ac0 dead000000000006\n  raw: ffff888485950700 0000000000200019 00000001ffffffff 0000000000000000\n  page dumped because: kasan: bad access detected\r\n\r\n  Memory state around the buggy address:\n   ffff888485950780: fa fb fb\n---truncated---(CVE-2024-26782)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmmc: mmci: stm32: fix DMA API overlapping mappings warning\r\n\r\nTurning on CONFIG_DMA_API_DEBUG_SG results in the following warning:\r\n\r\nDMA-API: mmci-pl18x 48220000.mmc: cacheline tracking EEXIST,\noverlapping mappings aren\u0026apos;t supported\nWARNING: CPU: 1 PID: 51 at kernel/dma/debug.c:568\nadd_dma_entry+0x234/0x2f4\nModules linked in:\nCPU: 1 PID: 51 Comm: kworker/1:2 Not tainted 6.1.28 #1\nHardware name: STMicroelectronics STM32MP257F-EV1 Evaluation Board (DT)\nWorkqueue: events_freezable mmc_rescan\nCall trace:\nadd_dma_entry+0x234/0x2f4\ndebug_dma_map_sg+0x198/0x350\n__dma_map_sg_attrs+0xa0/0x110\ndma_map_sg_attrs+0x10/0x2c\nsdmmc_idma_prep_data+0x80/0xc0\nmmci_prep_data+0x38/0x84\nmmci_start_data+0x108/0x2dc\nmmci_request+0xe4/0x190\n__mmc_start_request+0x68/0x140\nmmc_start_request+0x94/0xc0\nmmc_wait_for_req+0x70/0x100\nmmc_send_tuning+0x108/0x1ac\nsdmmc_execute_tuning+0x14c/0x210\nmmc_execute_tuning+0x48/0xec\nmmc_sd_init_uhs_card.part.0+0x208/0x464\nmmc_sd_init_card+0x318/0x89c\nmmc_attach_sd+0xe4/0x180\nmmc_rescan+0x244/0x320\r\n\r\nDMA API debug brings to light leaking dma-mappings as dma_map_sg and\ndma_unmap_sg are not correctly balanced.\r\n\r\nIf an error occurs in mmci_cmd_irq function, only mmci_dma_error\nfunction is called and as this API is not managed on stm32 variant,\ndma_unmap_sg is never called in this error path.(CVE-2024-26787)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbtrfs: dev-replace: properly validate device names\r\n\r\nThere\u0026apos;s a syzbot report that device name buffers passed to device\nreplace are not properly checked for string termination which could lead\nto a read out of bounds in getname_kernel().\r\n\r\nAdd a helper that validates both source and target device name buffers.\nFor devid as the source initialize the buffer to empty string in case\nsomething tries to read it later.\r\n\r\nThis was originally analyzed and fixed in a different way by Edward Adam\nDavis (see links).(CVE-2024-26791)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbtrfs: fix double free of anonymous device after snapshot creation failure\r\n\r\nWhen creating a snapshot we may do a double free of an anonymous device\nin case there\u0026apos;s an error committing the transaction. The second free may\nresult in freeing an anonymous device number that was allocated by some\nother subsystem in the kernel or another btrfs filesystem.\r\n\r\nThe steps that lead to this:\r\n\r\n1) At ioctl.c:create_snapshot() we allocate an anonymous device number\n   and assign it to pending_snapshot-\u0026gt;anon_dev;\r\n\r\n2) Then we call btrfs_commit_transaction() and end up at\n   transaction.c:create_pending_snapshot();\r\n\r\n3) There we call btrfs_get_new_fs_root() and pass it the anonymous device\n   number stored in pending_snapshot-\u0026gt;anon_dev;\r\n\r\n4) btrfs_get_new_fs_root() frees that anonymous device number because\n   btrfs_lookup_fs_root() returned a root - someone else did a lookup\n   of the new root already, which could some task doing backref walking;\r\n\r\n5) After that some error happens in the transaction commit path, and at\n   ioctl.c:create_snapshot() we jump to the \u0026apos;fail\u0026apos; label, and after\n   that we free again the same anonymous device number, which in the\n   meanwhile may have been reallocated somewhere else, because\n   pending_snapshot-\u0026gt;anon_dev still has the same value as in step 1.\r\n\r\nRecently syzbot ran into this and reported the following trace:\r\n\r\n  ------------[ cut here ]------------\n  ida_free called for id=51 which is not allocated.\n  WARNING: CPU: 1 PID: 31038 at lib/idr.c:525 ida_free+0x370/0x420 lib/idr.c:525\n  Modules linked in:\n  CPU: 1 PID: 31038 Comm: syz-executor.2 Not tainted 6.8.0-rc4-syzkaller-00410-gc02197fc9076 #0\n  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024\n  RIP: 0010:ida_free+0x370/0x420 lib/idr.c:525\n  Code: 10 42 80 3c 28 (...)\n  RSP: 0018:ffffc90015a67300 EFLAGS: 00010246\n  RAX: be5130472f5dd000 RBX: 0000000000000033 RCX: 0000000000040000\n  RDX: ffffc90009a7a000 RSI: 000000000003ffff RDI: 0000000000040000\n  RBP: ffffc90015a673f0 R08: ffffffff81577992 R09: 1ffff92002b4cdb4\n  R10: dffffc0000000000 R11: fffff52002b4cdb5 R12: 0000000000000246\n  R13: dffffc0000000000 R14: ffffffff8e256b80 R15: 0000000000000246\n  FS:  00007fca3f4b46c0(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007f167a17b978 CR3: 000000001ed26000 CR4: 0000000000350ef0\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   btrfs_get_root_ref+0xa48/0xaf0 fs/btrfs/disk-io.c:1346\n   create_pending_snapshot+0xff2/0x2bc0 fs/btrfs/transaction.c:1837\n   create_pending_snapshots+0x195/0x1d0 fs/btrfs/transaction.c:1931\n   btrfs_commit_transaction+0xf1c/0x3740 fs/btrfs/transaction.c:2404\n   create_snapshot+0x507/0x880 fs/btrfs/ioctl.c:848\n   btrfs_mksubvol+0x5d0/0x750 fs/btrfs/ioctl.c:998\n   btrfs_mksnapshot+0xb5/0xf0 fs/btrfs/ioctl.c:1044\n   __btrfs_ioctl_snap_create+0x387/0x4b0 fs/btrfs/ioctl.c:1306\n   btrfs_ioctl_snap_create_v2+0x1ca/0x400 fs/btrfs/ioctl.c:1393\n   btrfs_ioctl+0xa74/0xd40\n   vfs_ioctl fs/ioctl.c:51 [inline]\n   __do_sys_ioctl fs/ioctl.c:871 [inline]\n   __se_sys_ioctl+0xfe/0x170 fs/ioctl.c:857\n   do_syscall_64+0xfb/0x240\n   entry_SYSCALL_64_after_hwframe+0x6f/0x77\n  RIP: 0033:0x7fca3e67dda9\n  Code: 28 00 00 00 (...)\n  RSP: 002b:00007fca3f4b40c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\n  RAX: ffffffffffffffda RBX: 00007fca3e7abf80 RCX: 00007fca3e67dda9\n  RDX: 00000000200005c0 RSI: 0000000050009417 RDI: 0000000000000003\n  RBP: 00007fca3e6ca47a R08: 0000000000000000 R09: 0000000000000000\n  R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\n  R13: 000000000000000b R14: 00007fca3e7abf80 R15: 00007fff6bf95658\n   \u0026lt;/TASK\u0026gt;\r\n\r\nWhere we get an explicit message where we attempt to free an anonymous\ndevice number that is not currently allocated. It happens in a different\ncode path from the example below, at btrfs_get_root_ref(), so this change\nmay not fix the case triggered by sy\n---truncated---(CVE-2024-26792)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nBluetooth: Avoid potential use-after-free in hci_error_reset\r\n\r\nWhile handling the HCI_EV_HARDWARE_ERROR event, if the underlying\nBT controller is not responding, the GPIO reset mechanism would\nfree the hci_dev and lead to a use-after-free in hci_error_reset.\r\n\r\nHere\u0026apos;s the call trace observed on a ChromeOS device with Intel AX201:\n   queue_work_on+0x3e/0x6c\n   __hci_cmd_sync_sk+0x2ee/0x4c0 [bluetooth \u0026lt;HASH:3b4a6\u0026gt;]\n   ? init_wait_entry+0x31/0x31\n   __hci_cmd_sync+0x16/0x20 [bluetooth \u0026lt;HASH:3b4a 6\u0026gt;]\n   hci_error_reset+0x4f/0xa4 [bluetooth \u0026lt;HASH:3b4a 6\u0026gt;]\n   process_one_work+0x1d8/0x33f\n   worker_thread+0x21b/0x373\n   kthread+0x13a/0x152\n   ? pr_cont_work+0x54/0x54\n   ? kthread_blkcg+0x31/0x31\n    ret_from_fork+0x1f/0x30\r\n\r\nThis patch holds the reference count on the hci_dev while processing\na HCI_EV_HARDWARE_ERROR event to avoid potential crash.(CVE-2024-26801)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: ip_tunnel: prevent perpetual headroom growth\r\n\r\nsyzkaller triggered following kasan splat:\nBUG: KASAN: use-after-free in __skb_flow_dissect+0x19d1/0x7a50 net/core/flow_dissector.c:1170\nRead of size 1 at addr ffff88812fb4000e by task syz-executor183/5191\n[..]\n kasan_report+0xda/0x110 mm/kasan/report.c:588\n __skb_flow_dissect+0x19d1/0x7a50 net/core/flow_dissector.c:1170\n skb_flow_dissect_flow_keys include/linux/skbuff.h:1514 [inline]\n ___skb_get_hash net/core/flow_dissector.c:1791 [inline]\n __skb_get_hash+0xc7/0x540 net/core/flow_dissector.c:1856\n skb_get_hash include/linux/skbuff.h:1556 [inline]\n ip_tunnel_xmit+0x1855/0x33c0 net/ipv4/ip_tunnel.c:748\n ipip_tunnel_xmit+0x3cc/0x4e0 net/ipv4/ipip.c:308\n __netdev_start_xmit include/linux/netdevice.h:4940 [inline]\n netdev_start_xmit include/linux/netdevice.h:4954 [inline]\n xmit_one net/core/dev.c:3548 [inline]\n dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3564\n __dev_queue_xmit+0x7c1/0x3d60 net/core/dev.c:4349\n dev_queue_xmit include/linux/netdevice.h:3134 [inline]\n neigh_connected_output+0x42c/0x5d0 net/core/neighbour.c:1592\n ...\n ip_finish_output2+0x833/0x2550 net/ipv4/ip_output.c:235\n ip_finish_output+0x31/0x310 net/ipv4/ip_output.c:323\n ..\n iptunnel_xmit+0x5b4/0x9b0 net/ipv4/ip_tunnel_core.c:82\n ip_tunnel_xmit+0x1dbc/0x33c0 net/ipv4/ip_tunnel.c:831\n ipgre_xmit+0x4a1/0x980 net/ipv4/ip_gre.c:665\n __netdev_start_xmit include/linux/netdevice.h:4940 [inline]\n netdev_start_xmit include/linux/netdevice.h:4954 [inline]\n xmit_one net/core/dev.c:3548 [inline]\n dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3564\n ...\r\n\r\nThe splat occurs because skb-\u0026gt;data points past skb-\u0026gt;head allocated area.\nThis is because neigh layer does:\n  __skb_pull(skb, skb_network_offset(skb));\r\n\r\n... but skb_network_offset() returns a negative offset and __skb_pull()\narg is unsigned.  IOW, we skb-\u0026gt;data gets \u0026quot;adjusted\u0026quot; by a huge value.\r\n\r\nThe negative value is returned because skb-\u0026gt;head and skb-\u0026gt;data distance is\nmore than 64k and skb-\u0026gt;network_header (u16) has wrapped around.\r\n\r\nThe bug is in the ip_tunnel infrastructure, which can cause\ndev-\u0026gt;needed_headroom to increment ad infinitum.\r\n\r\nThe syzkaller reproducer consists of packets getting routed via a gre\ntunnel, and route of gre encapsulated packets pointing at another (ipip)\ntunnel.  The ipip encapsulation finds gre0 as next output device.\r\n\r\nThis results in the following pattern:\r\n\r\n1). First packet is to be sent out via gre0.\nRoute lookup found an output device, ipip0.\r\n\r\n2).\nip_tunnel_xmit for gre0 bumps gre0-\u0026gt;needed_headroom based on the future\noutput device, rt.dev-\u0026gt;needed_headroom (ipip0).\r\n\r\n3).\nip output / start_xmit moves skb on to ipip0. which runs the same\ncode path again (xmit recursion).\r\n\r\n4).\nRouting step for the post-gre0-encap packet finds gre0 as output device\nto use for ipip0 encapsulated packet.\r\n\r\ntunl0-\u0026gt;needed_headroom is then incremented based on the (already bumped)\ngre0 device headroom.\r\n\r\nThis repeats for every future packet:\r\n\r\ngre0-\u0026gt;needed_headroom gets inflated because previous packets\u0026apos; ipip0 step\nincremented rt-\u0026gt;dev (gre0) headroom, and ipip0 incremented because gre0\nneeded_headroom was increased.\r\n\r\nFor each subsequent packet, gre/ipip0-\u0026gt;needed_headroom grows until\npost-expand-head reallocations result in a skb-\u0026gt;head/data distance of\nmore than 64k.\r\n\r\nOnce that happens, skb-\u0026gt;network_header (u16) wraps around when\npskb_expand_head tries to make sure that skb_network_offset() is unchanged\nafter the headroom expansion/reallocation.\r\n\r\nAfter this skb_network_offset(skb) returns a different (and negative)\nresult post headroom expansion.\r\n\r\nThe next trip to neigh layer (or anything else that would __skb_pull the\nnetwork header) makes skb-\u0026gt;data point to a memory location outside\nskb-\u0026gt;head area.\r\n\r\nv2: Cap the needed_headroom update to an arbitarily chosen upperlimit to\nprevent perpetual increase instead of dropping the headroom increment\ncompletely.(CVE-2024-26804)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetlink: Fix kernel-infoleak-after-free in __skb_datagram_iter\r\n\r\nsyzbot reported the following uninit-value access issue [1]:\r\n\r\nnetlink_to_full_skb() creates a new `skb` and puts the `skb-\u0026gt;data`\npassed as a 1st arg of netlink_to_full_skb() onto new `skb`. The data\nsize is specified as `len` and passed to skb_put_data(). This `len`\nis based on `skb-\u0026gt;end` that is not data offset but buffer offset. The\n`skb-\u0026gt;end` contains data and tailroom. Since the tailroom is not\ninitialized when the new `skb` created, KMSAN detects uninitialized\nmemory area when copying the data.\r\n\r\nThis patch resolved this issue by correct the len from `skb-\u0026gt;end` to\n`skb-\u0026gt;len`, which is the actual data offset.\r\n\r\nBUG: KMSAN: kernel-infoleak-after-free in instrument_copy_to_user include/linux/instrumented.h:114 [inline]\nBUG: KMSAN: kernel-infoleak-after-free in copy_to_user_iter lib/iov_iter.c:24 [inline]\nBUG: KMSAN: kernel-infoleak-after-free in iterate_ubuf include/linux/iov_iter.h:29 [inline]\nBUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance2 include/linux/iov_iter.h:245 [inline]\nBUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance include/linux/iov_iter.h:271 [inline]\nBUG: KMSAN: kernel-infoleak-after-free in _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186\n instrument_copy_to_user include/linux/instrumented.h:114 [inline]\n copy_to_user_iter lib/iov_iter.c:24 [inline]\n iterate_ubuf include/linux/iov_iter.h:29 [inline]\n iterate_and_advance2 include/linux/iov_iter.h:245 [inline]\n iterate_and_advance include/linux/iov_iter.h:271 [inline]\n _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186\n copy_to_iter include/linux/uio.h:197 [inline]\n simple_copy_to_iter+0x68/0xa0 net/core/datagram.c:532\n __skb_datagram_iter+0x123/0xdc0 net/core/datagram.c:420\n skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:546\n skb_copy_datagram_msg include/linux/skbuff.h:3960 [inline]\n packet_recvmsg+0xd9c/0x2000 net/packet/af_packet.c:3482\n sock_recvmsg_nosec net/socket.c:1044 [inline]\n sock_recvmsg net/socket.c:1066 [inline]\n sock_read_iter+0x467/0x580 net/socket.c:1136\n call_read_iter include/linux/fs.h:2014 [inline]\n new_sync_read fs/read_write.c:389 [inline]\n vfs_read+0x8f6/0xe00 fs/read_write.c:470\n ksys_read+0x20f/0x4c0 fs/read_write.c:613\n __do_sys_read fs/read_write.c:623 [inline]\n __se_sys_read fs/read_write.c:621 [inline]\n __x64_sys_read+0x93/0xd0 fs/read_write.c:621\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nUninit was stored to memory at:\n skb_put_data include/linux/skbuff.h:2622 [inline]\n netlink_to_full_skb net/netlink/af_netlink.c:181 [inline]\n __netlink_deliver_tap_skb net/netlink/af_netlink.c:298 [inline]\n __netlink_deliver_tap+0x5be/0xc90 net/netlink/af_netlink.c:325\n netlink_deliver_tap net/netlink/af_netlink.c:338 [inline]\n netlink_deliver_tap_kernel net/netlink/af_netlink.c:347 [inline]\n netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]\n netlink_unicast+0x10f1/0x1250 net/netlink/af_netlink.c:1368\n netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg net/socket.c:745 [inline]\n ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584\n ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638\n __sys_sendmsg net/socket.c:2667 [inline]\n __do_sys_sendmsg net/socket.c:2676 [inline]\n __se_sys_sendmsg net/socket.c:2674 [inline]\n __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nUninit was created at:\n free_pages_prepare mm/page_alloc.c:1087 [inline]\n free_unref_page_prepare+0xb0/0xa40 mm/page_alloc.c:2347\n free_unref_page_list+0xeb/0x1100 mm/page_alloc.c:2533\n release_pages+0x23d3/0x2410 mm/swap.c:1042\n free_pages_and_swap_cache+0xd9/0xf0 mm/swap_state.c:316\n tlb_batch_pages\n---truncated---(CVE-2024-26805)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain\r\n\r\nRemove netdevice from inet/ingress basechain in case NETDEV_UNREGISTER\nevent is reported, otherwise a stale reference to netdevice remains in\nthe hook list.(CVE-2024-26808)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nft_set_pipapo: release elements in clone only from destroy path\r\n\r\nClone already always provides a current view of the lookup table, use it\nto destroy the set, otherwise it is possible to destroy elements twice.\r\n\r\nThis fix requires:\r\n\r\n 212ed75dc5fb (\u0026quot;netfilter: nf_tables: integrate pipapo into commit protocol\u0026quot;)\r\n\r\nwhich came after:\r\n\r\n 9827a0e6e23b (\u0026quot;netfilter: nft_set_pipapo: release elements in clone from abort path\u0026quot;).(CVE-2024-26809)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nksmbd: validate payload size in ipc response\r\n\r\nIf installing malicious ksmbd-tools, ksmbd.mountd can return invalid ipc\nresponse to ksmbd kernel server. ksmbd should validate payload size of\nipc response from ksmbd.mountd to avoid memory overrun or\nslab-out-of-bounds. This patch validate 3 ipc response that has payload.(CVE-2024-26811)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nvfio/pci: Create persistent INTx handler\r\n\r\nA vulnerability exists where the eventfd for INTx signaling can be\ndeconfigured, which unregisters the IRQ handler but still allows\neventfds to be signaled with a NULL context through the SET_IRQS ioctl\nor through unmask irqfd if the device interrupt is pending.\r\n\r\nIdeally this could be solved with some additional locking; the igate\nmutex serializes the ioctl and config space accesses, and the interrupt\nhandler is unregistered relative to the trigger, but the irqfd path\nruns asynchronous to those.  The igate mutex cannot be acquired from the\natomic context of the eventfd wake function.  Disabling the irqfd\nrelative to the eventfd registration is potentially incompatible with\nexisting userspace.\r\n\r\nAs a result, the solution implemented here moves configuration of the\nINTx interrupt handler to track the lifetime of the INTx context object\nand irq_type configuration, rather than registration of a particular\ntrigger eventfd.  Synchronization is added between the ioctl path and\neventfd_signal() wrapper such that the eventfd trigger can be\ndynamically updated relative to in-flight interrupts or irqfd callbacks.(CVE-2024-26812)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nvfio/fsl-mc: Block calling interrupt handler without trigger\r\n\r\nThe eventfd_ctx trigger pointer of the vfio_fsl_mc_irq object is\ninitially NULL and may become NULL if the user sets the trigger\neventfd to -1.  The interrupt handler itself is guaranteed that\ntrigger is always valid between request_irq() and free_irq(), but\nthe loopback testing mechanisms to invoke the handler function\nneed to test the trigger.  The triggering and setting ioctl paths\nboth make use of igate and are therefore mutually exclusive.\r\n\r\nThe vfio-fsl-mc driver does not make use of irqfds, nor does it\nsupport any sort of masking operations, therefore unlike vfio-pci\nand vfio-platform, the flow can remain essentially unchanged.(CVE-2024-26814)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\namdkfd: use calloc instead of kzalloc to avoid integer overflow\r\n\r\nThis uses calloc instead of doing the multiplication which might\noverflow.(CVE-2024-26817)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ncifs: fix underflow in parse_server_interfaces()\r\n\r\nIn this loop, we step through the buffer and after each item we check\nif the size_left is greater than the minimum size we need.  However,\nthe problem is that \u0026quot;bytes_left\u0026quot; is type ssize_t while sizeof() is type\nsize_t.  That means that because of type promotion, the comparison is\ndone as an unsigned and if we have negative bytes left the loop\ncontinues instead of ending.(CVE-2024-26828)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmedia: ir_toy: fix a memleak in irtoy_tx\r\n\r\nWhen irtoy_command fails, buf should be freed since it is allocated by\nirtoy_tx, or there is a memleak.(CVE-2024-26829)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nIB/hfi1: Fix a memleak in init_credit_return\r\n\r\nWhen dma_alloc_coherent fails to allocate dd-\u0026gt;cr_base[i].va,\ninit_credit_return should deallocate dd-\u0026gt;cr_base and\ndd-\u0026gt;cr_base[i] that allocated before. Or those resources\nwould be never freed and a memleak is triggered.(CVE-2024-26839)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ncachefiles: fix memory leak in cachefiles_add_cache()\r\n\r\nThe following memory leak was reported after unbinding /dev/cachefiles:\r\n\r\n==================================================================\nunreferenced object 0xffff9b674176e3c0 (size 192):\n  comm \u0026quot;cachefilesd2\u0026quot;, pid 680, jiffies 4294881224\n  hex dump (first 32 bytes):\n    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace (crc ea38a44b):\n    [\u0026lt;ffffffff8eb8a1a5\u0026gt;] kmem_cache_alloc+0x2d5/0x370\n    [\u0026lt;ffffffff8e917f86\u0026gt;] prepare_creds+0x26/0x2e0\n    [\u0026lt;ffffffffc002eeef\u0026gt;] cachefiles_determine_cache_security+0x1f/0x120\n    [\u0026lt;ffffffffc00243ec\u0026gt;] cachefiles_add_cache+0x13c/0x3a0\n    [\u0026lt;ffffffffc0025216\u0026gt;] cachefiles_daemon_write+0x146/0x1c0\n    [\u0026lt;ffffffff8ebc4a3b\u0026gt;] vfs_write+0xcb/0x520\n    [\u0026lt;ffffffff8ebc5069\u0026gt;] ksys_write+0x69/0xf0\n    [\u0026lt;ffffffff8f6d4662\u0026gt;] do_syscall_64+0x72/0x140\n    [\u0026lt;ffffffff8f8000aa\u0026gt;] entry_SYSCALL_64_after_hwframe+0x6e/0x76\n==================================================================\r\n\r\nPut the reference count of cache_cred in cachefiles_daemon_unbind() to\nfix the problem. And also put cache_cred in cachefiles_add_cache() error\nbranch to avoid memory leaks.(CVE-2024-26840)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nefi: runtime: Fix potential overflow of soft-reserved region size\r\n\r\nmd_size will have been narrowed if we have \u0026gt;= 4GB worth of pages in a\nsoft-reserved region.(CVE-2024-26843)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnvme-fc: do not wait in vain when unloading module\r\n\r\nThe module exit path has race between deleting all controllers and\nfreeing \u0026apos;left over IDs\u0026apos;. To prevent double free a synchronization\nbetween nvme_delete_ctrl and ida_destroy has been added by the initial\ncommit.\r\n\r\nThere is some logic around trying to prevent from hanging forever in\nwait_for_completion, though it does not handling all cases. E.g.\nblktests is able to reproduce the situation where the module unload\nhangs forever.\r\n\r\nIf we completely rely on the cleanup code executed from the\nnvme_delete_ctrl path, all IDs will be freed eventually. This makes\ncalling ida_destroy unnecessary. We only have to ensure that all\nnvme_delete_ctrl code has been executed before we leave\nnvme_fc_exit_module. This is done by flushing the nvme_delete_wq\nworkqueue.\r\n\r\nWhile at it, remove the unused nvme_fc_wq workqueue too.(CVE-2024-26846)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/ipv6: avoid possible UAF in ip6_route_mpath_notify()\r\n\r\nsyzbot found another use-after-free in ip6_route_mpath_notify() [1]\r\n\r\nCommit f7225172f25a (\u0026quot;net/ipv6: prevent use after free in\nip6_route_mpath_notify\u0026quot;) was not able to fix the root cause.\r\n\r\nWe need to defer the fib6_info_release() calls after\nip6_route_mpath_notify(), in the cleanup phase.\r\n\r\n[1]\nBUG: KASAN: slab-use-after-free in rt6_fill_node+0x1460/0x1ac0\nRead of size 4 at addr ffff88809a07fc64 by task syz-executor.2/23037\r\n\r\nCPU: 0 PID: 23037 Comm: syz-executor.2 Not tainted 6.8.0-rc4-syzkaller-01035-gea7f3cfaa588 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024\nCall Trace:\n \u0026lt;TASK\u0026gt;\n  __dump_stack lib/dump_stack.c:88 [inline]\n  dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106\n  print_address_description mm/kasan/report.c:377 [inline]\n  print_report+0x167/0x540 mm/kasan/report.c:488\n  kasan_report+0x142/0x180 mm/kasan/report.c:601\n rt6_fill_node+0x1460/0x1ac0\n  inet6_rt_notify+0x13b/0x290 net/ipv6/route.c:6184\n  ip6_route_mpath_notify net/ipv6/route.c:5198 [inline]\n  ip6_route_multipath_add net/ipv6/route.c:5404 [inline]\n  inet6_rtm_newroute+0x1d0f/0x2300 net/ipv6/route.c:5517\n  rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6597\n  netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543\n  netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]\n  netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367\n  netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg+0x221/0x270 net/socket.c:745\n  ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584\n  ___sys_sendmsg net/socket.c:2638 [inline]\n  __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667\n do_syscall_64+0xf9/0x240\n entry_SYSCALL_64_after_hwframe+0x6f/0x77\nRIP: 0033:0x7f73dd87dda9\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f73de6550c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 00007f73dd9ac050 RCX: 00007f73dd87dda9\nRDX: 0000000000000000 RSI: 0000000020000140 RDI: 0000000000000005\nRBP: 00007f73dd8ca47a R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 000000000000006e R14: 00007f73dd9ac050 R15: 00007ffdbdeb7858\n \u0026lt;/TASK\u0026gt;\r\n\r\nAllocated by task 23037:\n  kasan_save_stack mm/kasan/common.c:47 [inline]\n  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n  poison_kmalloc_redzone mm/kasan/common.c:372 [inline]\n  __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:389\n  kasan_kmalloc include/linux/kasan.h:211 [inline]\n  __do_kmalloc_node mm/slub.c:3981 [inline]\n  __kmalloc+0x22e/0x490 mm/slub.c:3994\n  kmalloc include/linux/slab.h:594 [inline]\n  kzalloc include/linux/slab.h:711 [inline]\n  fib6_info_alloc+0x2e/0xf0 net/ipv6/ip6_fib.c:155\n  ip6_route_info_create+0x445/0x12b0 net/ipv6/route.c:3758\n  ip6_route_multipath_add net/ipv6/route.c:5298 [inline]\n  inet6_rtm_newroute+0x744/0x2300 net/ipv6/route.c:5517\n  rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6597\n  netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543\n  netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]\n  netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367\n  netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg+0x221/0x270 net/socket.c:745\n  ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584\n  ___sys_sendmsg net/socket.c:2638 [inline]\n  __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667\n do_syscall_64+0xf9/0x240\n entry_SYSCALL_64_after_hwframe+0x6f/0x77\r\n\r\nFreed by task 16:\n  kasan_save_stack mm/kasan/common.c:47 [inline]\n  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n  kasan_save_free_info+0x4e/0x60 mm/kasan/generic.c:640\n  poison_slab_object+0xa6/0xe0 m\n---truncated---(CVE-2024-26852)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()\r\n\r\nThe function ice_bridge_setlink() may encounter a NULL pointer dereference\nif nlmsg_find_attr() returns NULL and br_spec is dereferenced subsequently\nin nla_for_each_nested(). To address this issue, add a check to ensure that\nbr_spec is not NULL before proceeding with the nested attribute iteration.(CVE-2024-26855)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/bnx2x: Prevent access to a freed page in page_pool\r\n\r\nFix race condition leading to system crash during EEH error handling\r\n\r\nDuring EEH error recovery, the bnx2x driver\u0026apos;s transmit timeout logic\ncould cause a race condition when handling reset tasks. The\nbnx2x_tx_timeout() schedules reset tasks via bnx2x_sp_rtnl_task(),\nwhich ultimately leads to bnx2x_nic_unload(). In bnx2x_nic_unload()\nSGEs are freed using bnx2x_free_rx_sge_range(). However, this could\noverlap with the EEH driver\u0026apos;s attempt to reset the device using\nbnx2x_io_slot_reset(), which also tries to free SGEs. This race\ncondition can result in system crashes due to accessing freed memory\nlocations in bnx2x_free_rx_sge()\r\n\r\n799  static inline void bnx2x_free_rx_sge(struct bnx2x *bp,\n800\t\t\t\tstruct bnx2x_fastpath *fp, u16 index)\n801  {\n802\tstruct sw_rx_page *sw_buf = \u0026amp;fp-\u0026gt;rx_page_ring[index];\n803     struct page *page = sw_buf-\u0026gt;page;\n....\nwhere sw_buf was set to NULL after the call to dma_unmap_page()\nby the preceding thread.\r\n\r\n    EEH: Beginning: \u0026apos;slot_reset\u0026apos;\n    PCI 0011:01:00.0#10000: EEH: Invoking bnx2x-\u0026gt;slot_reset()\n    bnx2x: [bnx2x_io_slot_reset:14228(eth1)]IO slot reset initializing...\n    bnx2x 0011:01:00.0: enabling device (0140 -\u0026gt; 0142)\n    bnx2x: [bnx2x_io_slot_reset:14244(eth1)]IO slot reset --\u0026gt; driver unload\n    Kernel attempted to read user page (0) - exploit attempt? (uid: 0)\n    BUG: Kernel NULL pointer dereference on read at 0x00000000\n    Faulting instruction address: 0xc0080000025065fc\n    Oops: Kernel access of bad area, sig: 11 [#1]\n    .....\n    Call Trace:\n    [c000000003c67a20] [c00800000250658c] bnx2x_io_slot_reset+0x204/0x610 [bnx2x] (unreliable)\n    [c000000003c67af0] [c0000000000518a8] eeh_report_reset+0xb8/0xf0\n    [c000000003c67b60] [c000000000052130] eeh_pe_report+0x180/0x550\n    [c000000003c67c70] [c00000000005318c] eeh_handle_normal_event+0x84c/0xa60\n    [c000000003c67d50] [c000000000053a84] eeh_event_handler+0xf4/0x170\n    [c000000003c67da0] [c000000000194c58] kthread+0x1c8/0x1d0\n    [c000000003c67e10] [c00000000000cf64] ret_from_kernel_thread+0x5c/0x64\r\n\r\nTo solve this issue, we need to verify page pool allocations before\nfreeing.(CVE-2024-26859)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\npacket: annotate data-races around ignore_outgoing\r\n\r\nignore_outgoing is read locklessly from dev_queue_xmit_nit()\nand packet_getsockopt()\r\n\r\nAdd appropriate READ_ONCE()/WRITE_ONCE() annotations.\r\n\r\nsyzbot reported:\r\n\r\nBUG: KCSAN: data-race in dev_queue_xmit_nit / packet_setsockopt\r\n\r\nwrite to 0xffff888107804542 of 1 bytes by task 22618 on cpu 0:\n packet_setsockopt+0xd83/0xfd0 net/packet/af_packet.c:4003\n do_sock_setsockopt net/socket.c:2311 [inline]\n __sys_setsockopt+0x1d8/0x250 net/socket.c:2334\n __do_sys_setsockopt net/socket.c:2343 [inline]\n __se_sys_setsockopt net/socket.c:2340 [inline]\n __x64_sys_setsockopt+0x66/0x80 net/socket.c:2340\n do_syscall_64+0xd3/0x1d0\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\r\n\r\nread to 0xffff888107804542 of 1 bytes by task 27 on cpu 1:\n dev_queue_xmit_nit+0x82/0x620 net/core/dev.c:2248\n xmit_one net/core/dev.c:3527 [inline]\n dev_hard_start_xmit+0xcc/0x3f0 net/core/dev.c:3547\n __dev_queue_xmit+0xf24/0x1dd0 net/core/dev.c:4335\n dev_queue_xmit include/linux/netdevice.h:3091 [inline]\n batadv_send_skb_packet+0x264/0x300 net/batman-adv/send.c:108\n batadv_send_broadcast_skb+0x24/0x30 net/batman-adv/send.c:127\n batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:392 [inline]\n batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:420 [inline]\n batadv_iv_send_outstanding_bat_ogm_packet+0x3f0/0x4b0 net/batman-adv/bat_iv_ogm.c:1700\n process_one_work kernel/workqueue.c:3254 [inline]\n process_scheduled_works+0x465/0x990 kernel/workqueue.c:3335\n worker_thread+0x526/0x730 kernel/workqueue.c:3416\n kthread+0x1d1/0x210 kernel/kthread.c:388\n ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243\r\n\r\nvalue changed: 0x00 -\u0026gt; 0x01\r\n\r\nReported by Kernel Concurrency Sanitizer on:\nCPU: 1 PID: 27 Comm: kworker/u8:1 Tainted: G        W          6.8.0-syzkaller-08073-g480e035fc4c7 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024\nWorkqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet(CVE-2024-26862)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nhsr: Fix uninit-value access in hsr_get_node()\r\n\r\nKMSAN reported the following uninit-value access issue [1]:\r\n\r\n=====================================================\nBUG: KMSAN: uninit-value in hsr_get_node+0xa2e/0xa40 net/hsr/hsr_framereg.c:246\n hsr_get_node+0xa2e/0xa40 net/hsr/hsr_framereg.c:246\n fill_frame_info net/hsr/hsr_forward.c:577 [inline]\n hsr_forward_skb+0xe12/0x30e0 net/hsr/hsr_forward.c:615\n hsr_dev_xmit+0x1a1/0x270 net/hsr/hsr_device.c:223\n __netdev_start_xmit include/linux/netdevice.h:4940 [inline]\n netdev_start_xmit include/linux/netdevice.h:4954 [inline]\n xmit_one net/core/dev.c:3548 [inline]\n dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564\n __dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349\n dev_queue_xmit include/linux/netdevice.h:3134 [inline]\n packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276\n packet_snd net/packet/af_packet.c:3087 [inline]\n packet_sendmsg+0x8b1d/0x9f30 net/packet/af_packet.c:3119\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg net/socket.c:745 [inline]\n __sys_sendto+0x735/0xa10 net/socket.c:2191\n __do_sys_sendto net/socket.c:2203 [inline]\n __se_sys_sendto net/socket.c:2199 [inline]\n __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x6d/0x140 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nUninit was created at:\n slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768\n slab_alloc_node mm/slub.c:3478 [inline]\n kmem_cache_alloc_node+0x5e9/0xb10 mm/slub.c:3523\n kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560\n __alloc_skb+0x318/0x740 net/core/skbuff.c:651\n alloc_skb include/linux/skbuff.h:1286 [inline]\n alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6334\n sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2787\n packet_alloc_skb net/packet/af_packet.c:2936 [inline]\n packet_snd net/packet/af_packet.c:3030 [inline]\n packet_sendmsg+0x70e8/0x9f30 net/packet/af_packet.c:3119\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg net/socket.c:745 [inline]\n __sys_sendto+0x735/0xa10 net/socket.c:2191\n __do_sys_sendto net/socket.c:2203 [inline]\n __se_sys_sendto net/socket.c:2199 [inline]\n __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x6d/0x140 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nCPU: 1 PID: 5033 Comm: syz-executor334 Not tainted 6.7.0-syzkaller-00562-g9f8413c4a66f #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023\n=====================================================\r\n\r\nIf the packet type ID field in the Ethernet header is either ETH_P_PRP or\nETH_P_HSR, but it is not followed by an HSR tag, hsr_get_skb_sequence_nr()\nreads an invalid value as a sequence number. This causes the above issue.\r\n\r\nThis patch fixes the issue by returning NULL if the Ethernet header is not\nfollowed by an HSR tag.(CVE-2024-26863)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nrds: tcp: Fix use-after-free of net in reqsk_timer_handler().\r\n\r\nsyzkaller reported a warning of netns tracker [0] followed by KASAN\nsplat [1] and another ref tracker warning [1].\r\n\r\nsyzkaller could not find a repro, but in the log, the only suspicious\nsequence was as follows:\r\n\r\n  18:26:22 executing program 1:\n  r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)\n  ...\n  connect$inet6(r0, \u0026amp;(0x7f0000000080)={0xa, 0x4001, 0x0, @loopback}, 0x1c) (async)\r\n\r\nThe notable thing here is 0x4001 in connect(), which is RDS_TCP_PORT.\r\n\r\nSo, the scenario would be:\r\n\r\n  1. unshare(CLONE_NEWNET) creates a per netns tcp listener in\n      rds_tcp_listen_init().\n  2. syz-executor connect()s to it and creates a reqsk.\n  3. syz-executor exit()s immediately.\n  4. netns is dismantled.  [0]\n  5. reqsk timer is fired, and UAF happens while freeing reqsk.  [1]\n  6. listener is freed after RCU grace period.  [2]\r\n\r\nBasically, reqsk assumes that the listener guarantees netns safety\nuntil all reqsk timers are expired by holding the listener\u0026apos;s refcount.\nHowever, this was not the case for kernel sockets.\r\n\r\nCommit 740ea3c4a0b2 (\u0026quot;tcp: Clean up kernel listener\u0026apos;s reqsk in\ninet_twsk_purge()\u0026quot;) fixed this issue only for per-netns ehash.\r\n\r\nLet\u0026apos;s apply the same fix for the global ehash.\r\n\r\n[0]:\nref_tracker: net notrefcnt@0000000065449cc3 has 1/1 users at\n     sk_alloc (./include/net/net_namespace.h:337 net/core/sock.c:2146)\n     inet6_create (net/ipv6/af_inet6.c:192 net/ipv6/af_inet6.c:119)\n     __sock_create (net/socket.c:1572)\n     rds_tcp_listen_init (net/rds/tcp_listen.c:279)\n     rds_tcp_init_net (net/rds/tcp.c:577)\n     ops_init (net/core/net_namespace.c:137)\n     setup_net (net/core/net_namespace.c:340)\n     copy_net_ns (net/core/net_namespace.c:497)\n     create_new_namespaces (kernel/nsproxy.c:110)\n     unshare_nsproxy_namespaces (kernel/nsproxy.c:228 (discriminator 4))\n     ksys_unshare (kernel/fork.c:3429)\n     __x64_sys_unshare (kernel/fork.c:3496)\n     do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)\n     entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:129)\n...\nWARNING: CPU: 0 PID: 27 at lib/ref_tracker.c:179 ref_tracker_dir_exit (lib/ref_tracker.c:179)\r\n\r\n[1]:\nBUG: KASAN: slab-use-after-free in inet_csk_reqsk_queue_drop (./include/net/inet_hashtables.h:180 net/ipv4/inet_connection_sock.c:952 net/ipv4/inet_connection_sock.c:966)\nRead of size 8 at addr ffff88801b370400 by task swapper/0/0\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\nCall Trace:\n \u0026lt;IRQ\u0026gt;\n dump_stack_lvl (lib/dump_stack.c:107 (discriminator 1))\n print_report (mm/kasan/report.c:378 mm/kasan/report.c:488)\n kasan_report (mm/kasan/report.c:603)\n inet_csk_reqsk_queue_drop (./include/net/inet_hashtables.h:180 net/ipv4/inet_connection_sock.c:952 net/ipv4/inet_connection_sock.c:966)\n reqsk_timer_handler (net/ipv4/inet_connection_sock.c:979 net/ipv4/inet_connection_sock.c:1092)\n call_timer_fn (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/timer.h:127 kernel/time/timer.c:1701)\n __run_timers.part.0 (kernel/time/timer.c:1752 kernel/time/timer.c:2038)\n run_timer_softirq (kernel/time/timer.c:2053)\n __do_softirq (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/irq.h:142 kernel/softirq.c:554)\n irq_exit_rcu (kernel/softirq.c:427 kernel/softirq.c:632 kernel/softirq.c:644)\n sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1076 (discriminator 14))\n \u0026lt;/IRQ\u0026gt;\r\n\r\nAllocated by task 258 on cpu 0 at 83.612050s:\n kasan_save_stack (mm/kasan/common.c:48)\n kasan_save_track (mm/kasan/common.c:68)\n __kasan_slab_alloc (mm/kasan/common.c:343)\n kmem_cache_alloc (mm/slub.c:3813 mm/slub.c:3860 mm/slub.c:3867)\n copy_net_ns (./include/linux/slab.h:701 net/core/net_namespace.c:421 net/core/net_namespace.c:480)\n create_new_namespaces (kernel/nsproxy.c:110)\n unshare_nsproxy_name\n---truncated---(CVE-2024-26865)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nf2fs: fix to truncate meta inode pages forcely\r\n\r\nBelow race case can cause data corruption:\r\n\r\nThread A\t\t\t\tGC thread\n\t\t\t\t\t- gc_data_segment\n\t\t\t\t\t - ra_data_block\n\t\t\t\t\t  - locked meta_inode page\n- f2fs_inplace_write_data\n - invalidate_mapping_pages\n : fail to invalidate meta_inode page\n   due to lock failure or dirty|writeback\n   status\n - f2fs_submit_page_bio\n : write last dirty data to old blkaddr\n\t\t\t\t\t - move_data_block\n\t\t\t\t\t  - load old data from meta_inode page\n\t\t\t\t\t  - f2fs_submit_page_write\n\t\t\t\t\t  : write old data to new blkaddr\r\n\r\nBecause invalidate_mapping_pages() will skip invalidating page which\nhas unclear status including locked, dirty, writeback and so on, so\nwe need to use truncate_inode_pages_range() instead of\ninvalidate_mapping_pages() to make sure meta_inode page will be dropped.(CVE-2024-26869)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nNFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102\r\n\r\nA call to listxattr() with a buffer size = 0 returns the actual\nsize of the buffer needed for a subsequent call. When size \u0026gt; 0,\nnfs4_listxattr() does not return an error because either\ngeneric_listxattr() or nfs4_listxattr_nfs4_label() consumes\nexactly all the bytes then size is 0 when calling\nnfs4_listxattr_nfs4_user() which then triggers the following\nkernel BUG:\r\n\r\n  [   99.403778] kernel BUG at mm/usercopy.c:102!\n  [   99.404063] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP\n  [   99.408463] CPU: 0 PID: 3310 Comm: python3 Not tainted 6.6.0-61.fc40.aarch64 #1\n  [   99.415827] Call trace:\n  [   99.415985]  usercopy_abort+0x70/0xa0\n  [   99.416227]  __check_heap_object+0x134/0x158\n  [   99.416505]  check_heap_object+0x150/0x188\n  [   99.416696]  __check_object_size.part.0+0x78/0x168\n  [   99.416886]  __check_object_size+0x28/0x40\n  [   99.417078]  listxattr+0x8c/0x120\n  [   99.417252]  path_listxattr+0x78/0xe0\n  [   99.417476]  __arm64_sys_listxattr+0x28/0x40\n  [   99.417723]  invoke_syscall+0x78/0x100\n  [   99.417929]  el0_svc_common.constprop.0+0x48/0xf0\n  [   99.418186]  do_el0_svc+0x24/0x38\n  [   99.418376]  el0_svc+0x3c/0x110\n  [   99.418554]  el0t_64_sync_handler+0x120/0x130\n  [   99.418788]  el0t_64_sync+0x194/0x198\n  [   99.418994] Code: aa0003e3 d000a3e0 91310000 97f49bdb (d4210000)\r\n\r\nIssue is reproduced when generic_listxattr() returns \u0026apos;system.nfs4_acl\u0026apos;,\nthus calling lisxattr() with size = 16 will trigger the bug.\r\n\r\nAdd check on nfs4_listxattr() to return ERANGE error when it is\ncalled with size \u0026gt; 0 and the return value is greater than size.(CVE-2024-26870)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nRDMA/srpt: Do not register event handler until srpt device is fully setup\r\n\r\nUpon rare occasions, KASAN reports a use-after-free Write\nin srpt_refresh_port().\r\n\r\nThis seems to be because an event handler is registered before the\nsrpt device is fully setup and a race condition upon error may leave a\npartially setup event handler in place.\r\n\r\nInstead, only register the event handler after srpt device initialization\nis complete.(CVE-2024-26872)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmedia: pvrusb2: fix uaf in pvr2_context_set_notify\r\n\r\n[Syzbot reported]\nBUG: KASAN: slab-use-after-free in pvr2_context_set_notify+0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:35\nRead of size 4 at addr ffff888113aeb0d8 by task kworker/1:1/26\r\n\r\nCPU: 1 PID: 26 Comm: kworker/1:1 Not tainted 6.8.0-rc1-syzkaller-00046-gf1a27f081c1f #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024\nWorkqueue: usb_hub_wq hub_event\nCall Trace:\n \u0026lt;TASK\u0026gt;\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0xc4/0x620 mm/kasan/report.c:488\n kasan_report+0xda/0x110 mm/kasan/report.c:601\n pvr2_context_set_notify+0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:35\n pvr2_context_notify drivers/media/usb/pvrusb2/pvrusb2-context.c:95 [inline]\n pvr2_context_disconnect+0x94/0xb0 drivers/media/usb/pvrusb2/pvrusb2-context.c:272\r\n\r\nFreed by task 906:\nkasan_save_stack+0x33/0x50 mm/kasan/common.c:47\nkasan_save_track+0x14/0x30 mm/kasan/common.c:68\nkasan_save_free_info+0x3f/0x60 mm/kasan/generic.c:640\npoison_slab_object mm/kasan/common.c:241 [inline]\n__kasan_slab_free+0x106/0x1b0 mm/kasan/common.c:257\nkasan_slab_free include/linux/kasan.h:184 [inline]\nslab_free_hook mm/slub.c:2121 [inline]\nslab_free mm/slub.c:4299 [inline]\nkfree+0x105/0x340 mm/slub.c:4409\npvr2_context_check drivers/media/usb/pvrusb2/pvrusb2-context.c:137 [inline]\npvr2_context_thread_func+0x69d/0x960 drivers/media/usb/pvrusb2/pvrusb2-context.c:158\r\n\r\n[Analyze]\nTask A set disconnect_flag = !0, which resulted in Task B\u0026apos;s condition being met\nand releasing mp, leading to this issue.\r\n\r\n[Fix]\nPlace the disconnect_flag assignment operation after all code in pvr2_context_disconnect()\nto avoid this issue.(CVE-2024-26875)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nquota: Fix potential NULL pointer dereference\r\n\r\nBelow race may cause NULL pointer dereference\r\n\r\nP1\t\t\t\t\tP2\ndquot_free_inode\t\t\tquota_off\n\t\t\t\t\t  drop_dquot_ref\n\t\t\t\t\t   remove_dquot_ref\n\t\t\t\t\t   dquots = i_dquot(inode)\n  dquots = i_dquot(inode)\n  srcu_read_lock\n  dquots[cnt]) != NULL (1)\n\t\t\t\t\t     dquots[type] = NULL (2)\n  spin_lock(\u0026amp;dquots[cnt]-\u0026gt;dq_dqb_lock) (3)\n   ....\r\n\r\nIf dquot_free_inode(or other routines) checks inode\u0026apos;s quota pointers (1)\nbefore quota_off sets it to NULL(2) and use it (3) after that, NULL pointer\ndereference will be triggered.\r\n\r\nSo let\u0026apos;s fix it by using a temporary pointer to avoid this issue.(CVE-2024-26878)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndm: call the resume method on internal suspend\r\n\r\nThere is this reported crash when experimenting with the lvm2 testsuite.\nThe list corruption is caused by the fact that the postsuspend and resume\nmethods were not paired correctly; there were two consecutive calls to the\norigin_postsuspend function. The second call attempts to remove the\n\u0026quot;hash_list\u0026quot; entry from a list, while it was already removed by the first\ncall.\r\n\r\nFix __dm_internal_resume so that it calls the preresume and resume\nmethods of the table\u0026apos;s targets.\r\n\r\nIf a preresume method of some target fails, we are in a tricky situation.\nWe can\u0026apos;t return an error because dm_internal_resume isn\u0026apos;t supposed to\nreturn errors. We can\u0026apos;t return success, because then the \u0026quot;resume\u0026quot; and\n\u0026quot;postsuspend\u0026quot; methods would not be paired correctly. So, we set the\nDMF_SUSPENDED flag and we fake normal suspend - it may confuse userspace\ntools, but it won\u0026apos;t cause a kernel crash.\r\n\r\n------------[ cut here ]------------\nkernel BUG at lib/list_debug.c:56!\ninvalid opcode: 0000 [#1] PREEMPT SMP\nCPU: 1 PID: 8343 Comm: dmsetup Not tainted 6.8.0-rc6 #4\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014\nRIP: 0010:__list_del_entry_valid_or_report+0x77/0xc0\n\u0026lt;snip\u0026gt;\nRSP: 0018:ffff8881b831bcc0 EFLAGS: 00010282\nRAX: 000000000000004e RBX: ffff888143b6eb80 RCX: 0000000000000000\nRDX: 0000000000000001 RSI: ffffffff819053d0 RDI: 00000000ffffffff\nRBP: ffff8881b83a3400 R08: 00000000fffeffff R09: 0000000000000058\nR10: 0000000000000000 R11: ffffffff81a24080 R12: 0000000000000001\nR13: ffff88814538e000 R14: ffff888143bc6dc0 R15: ffffffffa02e4bb0\nFS:  00000000f7c0f780(0000) GS:ffff8893f0a40000(0000) knlGS:0000000000000000\nCS:  0010 DS: 002b ES: 002b CR0: 0000000080050033\nCR2: 0000000057fb5000 CR3: 0000000143474000 CR4: 00000000000006b0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n ? die+0x2d/0x80\n ? do_trap+0xeb/0xf0\n ? __list_del_entry_valid_or_report+0x77/0xc0\n ? do_error_trap+0x60/0x80\n ? __list_del_entry_valid_or_report+0x77/0xc0\n ? exc_invalid_op+0x49/0x60\n ? __list_del_entry_valid_or_report+0x77/0xc0\n ? asm_exc_invalid_op+0x16/0x20\n ? table_deps+0x1b0/0x1b0 [dm_mod]\n ? __list_del_entry_valid_or_report+0x77/0xc0\n origin_postsuspend+0x1a/0x50 [dm_snapshot]\n dm_table_postsuspend_targets+0x34/0x50 [dm_mod]\n dm_suspend+0xd8/0xf0 [dm_mod]\n dev_suspend+0x1f2/0x2f0 [dm_mod]\n ? table_deps+0x1b0/0x1b0 [dm_mod]\n ctl_ioctl+0x300/0x5f0 [dm_mod]\n dm_compat_ctl_ioctl+0x7/0x10 [dm_mod]\n __x64_compat_sys_ioctl+0x104/0x170\n do_syscall_64+0x184/0x1b0\n entry_SYSCALL_64_after_hwframe+0x46/0x4e\nRIP: 0033:0xf7e6aead\n\u0026lt;snip\u0026gt;\n---[ end trace 0000000000000000 ]---(CVE-2024-26880)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nfirmware: arm_scmi: Fix double free in SMC transport cleanup path\r\n\r\nWhen the generic SCMI code tears down a channel, it calls the chan_free\ncallback function, defined by each transport. Since multiple protocols\nmight share the same transport_info member, chan_free() might want to\nclean up the same member multiple times within the given SCMI transport\nimplementation. In this case, it is SMC transport. This will lead to a NULL\npointer dereference at the second time:\r\n\r\n    | scmi_protocol scmi_dev.1: Enabled polling mode TX channel - prot_id:16\n    | arm-scmi firmware:scmi: SCMI Notifications - Core Enabled.\n    | arm-scmi firmware:scmi: unable to communicate with SCMI\n    | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\n    | Mem abort info:\n    |   ESR = 0x0000000096000004\n    |   EC = 0x25: DABT (current EL), IL = 32 bits\n    |   SET = 0, FnV = 0\n    |   EA = 0, S1PTW = 0\n    |   FSC = 0x04: level 0 translation fault\n    | Data abort info:\n    |   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n    |   CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n    |   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n    | user pgtable: 4k pages, 48-bit VAs, pgdp=0000000881ef8000\n    | [0000000000000000] pgd=0000000000000000, p4d=0000000000000000\n    | Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP\n    | Modules linked in:\n    | CPU: 4 PID: 1 Comm: swapper/0 Not tainted 6.7.0-rc2-00124-g455ef3d016c9-dirty #793\n    | Hardware name: FVP Base RevC (DT)\n    | pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n    | pc : smc_chan_free+0x3c/0x6c\n    | lr : smc_chan_free+0x3c/0x6c\n    | Call trace:\n    |  smc_chan_free+0x3c/0x6c\n    |  idr_for_each+0x68/0xf8\n    |  scmi_cleanup_channels.isra.0+0x2c/0x58\n    |  scmi_probe+0x434/0x734\n    |  platform_probe+0x68/0xd8\n    |  really_probe+0x110/0x27c\n    |  __driver_probe_device+0x78/0x12c\n    |  driver_probe_device+0x3c/0x118\n    |  __driver_attach+0x74/0x128\n    |  bus_for_each_dev+0x78/0xe0\n    |  driver_attach+0x24/0x30\n    |  bus_add_driver+0xe4/0x1e8\n    |  driver_register+0x60/0x128\n    |  __platform_driver_register+0x28/0x34\n    |  scmi_driver_init+0x84/0xc0\n    |  do_one_initcall+0x78/0x33c\n    |  kernel_init_freeable+0x2b8/0x51c\n    |  kernel_init+0x24/0x130\n    |  ret_from_fork+0x10/0x20\n    | Code: f0004701 910a0021 aa1403e5 97b91c70 (b9400280)\n    | ---[ end trace 0000000000000000 ]---\r\n\r\nSimply check for the struct pointer being NULL before trying to access\nits members, to avoid this situation.\r\n\r\nThis was found when a transport doesn\u0026apos;t really work (for instance no SMC\nservice), the probe routines then tries to clean up, and triggers a crash.(CVE-2024-26893)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: wilc1000: prevent use-after-free on vif when cleaning up all interfaces\r\n\r\nwilc_netdev_cleanup currently triggers a KASAN warning, which can be\nobserved on interface registration error path, or simply by\nremoving the module/unbinding device from driver:\r\n\r\necho spi0.1 \u0026gt; /sys/bus/spi/drivers/wilc1000_spi/unbind\r\n\r\n==================================================================\nBUG: KASAN: slab-use-after-free in wilc_netdev_cleanup+0x508/0x5cc\nRead of size 4 at addr c54d1ce8 by task sh/86\r\n\r\nCPU: 0 PID: 86 Comm: sh Not tainted 6.8.0-rc1+ #117\nHardware name: Atmel SAMA5\n unwind_backtrace from show_stack+0x18/0x1c\n show_stack from dump_stack_lvl+0x34/0x58\n dump_stack_lvl from print_report+0x154/0x500\n print_report from kasan_report+0xac/0xd8\n kasan_report from wilc_netdev_cleanup+0x508/0x5cc\n wilc_netdev_cleanup from wilc_bus_remove+0xc8/0xec\n wilc_bus_remove from spi_remove+0x8c/0xac\n spi_remove from device_release_driver_internal+0x434/0x5f8\n device_release_driver_internal from unbind_store+0xbc/0x108\n unbind_store from kernfs_fop_write_iter+0x398/0x584\n kernfs_fop_write_iter from vfs_write+0x728/0xf88\n vfs_write from ksys_write+0x110/0x1e4\n ksys_write from ret_fast_syscall+0x0/0x1c\r\n\r\n[...]\r\n\r\nAllocated by task 1:\n kasan_save_track+0x30/0x5c\n __kasan_kmalloc+0x8c/0x94\n __kmalloc_node+0x1cc/0x3e4\n kvmalloc_node+0x48/0x180\n alloc_netdev_mqs+0x68/0x11dc\n alloc_etherdev_mqs+0x28/0x34\n wilc_netdev_ifc_init+0x34/0x8ec\n wilc_cfg80211_init+0x690/0x910\n wilc_bus_probe+0xe0/0x4a0\n spi_probe+0x158/0x1b0\n really_probe+0x270/0xdf4\n __driver_probe_device+0x1dc/0x580\n driver_probe_device+0x60/0x140\n __driver_attach+0x228/0x5d4\n bus_for_each_dev+0x13c/0x1a8\n bus_add_driver+0x2a0/0x608\n driver_register+0x24c/0x578\n do_one_initcall+0x180/0x310\n kernel_init_freeable+0x424/0x484\n kernel_init+0x20/0x148\n ret_from_fork+0x14/0x28\r\n\r\nFreed by task 86:\n kasan_save_track+0x30/0x5c\n kasan_save_free_info+0x38/0x58\n __kasan_slab_free+0xe4/0x140\n kfree+0xb0/0x238\n device_release+0xc0/0x2a8\n kobject_put+0x1d4/0x46c\n netdev_run_todo+0x8fc/0x11d0\n wilc_netdev_cleanup+0x1e4/0x5cc\n wilc_bus_remove+0xc8/0xec\n spi_remove+0x8c/0xac\n device_release_driver_internal+0x434/0x5f8\n unbind_store+0xbc/0x108\n kernfs_fop_write_iter+0x398/0x584\n vfs_write+0x728/0xf88\n ksys_write+0x110/0x1e4\n ret_fast_syscall+0x0/0x1c\n [...]\r\n\r\nDavid Mosberger-Tan initial investigation [1] showed that this\nuse-after-free is due to netdevice unregistration during vif list\ntraversal. When unregistering a net device, since the needs_free_netdev has\nbeen set to true during registration, the netdevice object is also freed,\nand as a consequence, the corresponding vif object too, since it is\nattached to it as private netdevice data. The next occurrence of the loop\nthen tries to access freed vif pointer to the list to move forward in the\nlist.\r\n\r\nFix this use-after-free thanks to two mechanisms:\n- navigate in the list with list_for_each_entry_safe, which allows to\n  safely modify the list as we go through each element. For each element,\n  remove it from the list with list_del_rcu\n- make sure to wait for RCU grace period end after each vif removal to make\n  sure it is safe to free the corresponding vif too (through\n  unregister_netdev)\r\n\r\nSince we are in a RCU \u0026quot;modifier\u0026quot; path (not a \u0026quot;reader\u0026quot; path), and because\nsuch path is expected not to be concurrent to any other modifier (we are\nusing the vif_mutex lock), we do not need to use RCU list API, that\u0026apos;s why\nwe can benefit from list_for_each_entry_safe.\r\n\r\n[1] https://lore.kernel.org/linux-wireless/ab077dbe58b1ea5de0a3b2ca21f275a07af967d2.camel@egauge.net/(CVE-2024-26895)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: wfx: fix memory leak when starting AP\r\n\r\nKmemleak reported this error:\r\n\r\n    unreferenced object 0xd73d1180 (size 184):\n      comm \u0026quot;wpa_supplicant\u0026quot;, pid 1559, jiffies 13006305 (age 964.245s)\n      hex dump (first 32 bytes):\n        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n        00 00 00 00 00 00 00 00 1e 00 01 00 00 00 00 00  ................\n      backtrace:\n        [\u0026lt;5ca11420\u0026gt;] kmem_cache_alloc+0x20c/0x5ac\n        [\u0026lt;127bdd74\u0026gt;] __alloc_skb+0x144/0x170\n        [\u0026lt;fb8a5e38\u0026gt;] __netdev_alloc_skb+0x50/0x180\n        [\u0026lt;0f9fa1d5\u0026gt;] __ieee80211_beacon_get+0x290/0x4d4 [mac80211]\n        [\u0026lt;7accd02d\u0026gt;] ieee80211_beacon_get_tim+0x54/0x18c [mac80211]\n        [\u0026lt;41e25cc3\u0026gt;] wfx_start_ap+0xc8/0x234 [wfx]\n        [\u0026lt;93a70356\u0026gt;] ieee80211_start_ap+0x404/0x6b4 [mac80211]\n        [\u0026lt;a4a661cd\u0026gt;] nl80211_start_ap+0x76c/0x9e0 [cfg80211]\n        [\u0026lt;47bd8b68\u0026gt;] genl_rcv_msg+0x198/0x378\n        [\u0026lt;453ef796\u0026gt;] netlink_rcv_skb+0xd0/0x130\n        [\u0026lt;6b7c977a\u0026gt;] genl_rcv+0x34/0x44\n        [\u0026lt;66b2d04d\u0026gt;] netlink_unicast+0x1b4/0x258\n        [\u0026lt;f965b9b6\u0026gt;] netlink_sendmsg+0x1e8/0x428\n        [\u0026lt;aadb8231\u0026gt;] ____sys_sendmsg+0x1e0/0x274\n        [\u0026lt;d2b5212d\u0026gt;] ___sys_sendmsg+0x80/0xb4\n        [\u0026lt;69954f45\u0026gt;] __sys_sendmsg+0x64/0xa8\n    unreferenced object 0xce087000 (size 1024):\n      comm \u0026quot;wpa_supplicant\u0026quot;, pid 1559, jiffies 13006305 (age 964.246s)\n      hex dump (first 32 bytes):\n        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n        10 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00  ...@............\n      backtrace:\n        [\u0026lt;9a993714\u0026gt;] __kmalloc_track_caller+0x230/0x600\n        [\u0026lt;f83ea192\u0026gt;] kmalloc_reserve.constprop.0+0x30/0x74\n        [\u0026lt;a2c61343\u0026gt;] __alloc_skb+0xa0/0x170\n        [\u0026lt;fb8a5e38\u0026gt;] __netdev_alloc_skb+0x50/0x180\n        [\u0026lt;0f9fa1d5\u0026gt;] __ieee80211_beacon_get+0x290/0x4d4 [mac80211]\n        [\u0026lt;7accd02d\u0026gt;] ieee80211_beacon_get_tim+0x54/0x18c [mac80211]\n        [\u0026lt;41e25cc3\u0026gt;] wfx_start_ap+0xc8/0x234 [wfx]\n        [\u0026lt;93a70356\u0026gt;] ieee80211_start_ap+0x404/0x6b4 [mac80211]\n        [\u0026lt;a4a661cd\u0026gt;] nl80211_start_ap+0x76c/0x9e0 [cfg80211]\n        [\u0026lt;47bd8b68\u0026gt;] genl_rcv_msg+0x198/0x378\n        [\u0026lt;453ef796\u0026gt;] netlink_rcv_skb+0xd0/0x130\n        [\u0026lt;6b7c977a\u0026gt;] genl_rcv+0x34/0x44\n        [\u0026lt;66b2d04d\u0026gt;] netlink_unicast+0x1b4/0x258\n        [\u0026lt;f965b9b6\u0026gt;] netlink_sendmsg+0x1e8/0x428\n        [\u0026lt;aadb8231\u0026gt;] ____sys_sendmsg+0x1e0/0x274\n        [\u0026lt;d2b5212d\u0026gt;] ___sys_sendmsg+0x80/0xb4\r\n\r\nHowever, since the kernel is build optimized, it seems the stack is not\naccurate. It appears the issue is related to wfx_set_mfp_ap(). The issue\nis obvious in this function: memory allocated by ieee80211_beacon_get()\nis never released. Fixing this leak makes kmemleak happy.(CVE-2024-26896)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete\r\n\r\nThe ath9k_wmi_event_tasklet() used in ath9k_htc assumes that all the data\nstructures have been fully initialised by the time it runs. However, because of\nthe order in which things are initialised, this is not guaranteed to be the\ncase, because the device is exposed to the USB subsystem before the ath9k driver\ninitialisation is completed.\r\n\r\nWe already committed a partial fix for this in commit:\n8b3046abc99e (\u0026quot;ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet()\u0026quot;)\r\n\r\nHowever, that commit only aborted the WMI_TXSTATUS_EVENTID command in the event\ntasklet, pairing it with an \u0026quot;initialisation complete\u0026quot; bit in the TX struct. It\nseems syzbot managed to trigger the race for one of the other commands as well,\nso let\u0026apos;s just move the existing synchronisation bit to cover the whole\ntasklet (setting it at the end of ath9k_htc_probe_device() instead of inside\nath9k_tx_init()).(CVE-2024-26897)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nscsi: Revert \u0026quot;scsi: fcoe: Fix potential deadlock on \u0026amp;fip-\u0026gt;ctlr_lock\u0026quot;\r\n\r\nThis reverts commit 1a1975551943f681772720f639ff42fbaa746212.\r\n\r\nThis commit causes interrupts to be lost for FCoE devices, since it changed\nsping locks from \u0026quot;bh\u0026quot; to \u0026quot;irqsave\u0026quot;.\r\n\r\nInstead, a work queue should be used, and will be addressed in a separate\ncommit.(CVE-2024-26917)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ninet: inet_defrag: prevent sk release while still in use\r\n\r\nip_local_out() and other functions can pass skb-\u0026gt;sk as function argument.\r\n\r\nIf the skb is a fragment and reassembly happens before such function call\nreturns, the sk must not be released.\r\n\r\nThis affects skb fragments reassembled via netfilter or similar\nmodules, e.g. openvswitch or ct_act.c, when run as part of tx pipeline.\r\n\r\nEric Dumazet made an initial analysis of this bug.  Quoting Eric:\n  Calling ip_defrag() in output path is also implying skb_orphan(),\n  which is buggy because output path relies on sk not disappearing.\r\n\r\n  A relevant old patch about the issue was :\n  8282f27449bf (\u0026quot;inet: frag: Always orphan skbs inside ip_defrag()\u0026quot;)\r\n\r\n  [..]\r\n\r\n  net/ipv4/ip_output.c depends on skb-\u0026gt;sk being set, and probably to an\n  inet socket, not an arbitrary one.\r\n\r\n  If we orphan the packet in ipvlan, then downstream things like FQ\n  packet scheduler will not work properly.\r\n\r\n  We need to change ip_defrag() to only use skb_orphan() when really\n  needed, ie whenever frag_list is going to be used.\r\n\r\nEric suggested to stash sk in fragment queue and made an initial patch.\nHowever there is a problem with this:\r\n\r\nIf skb is refragmented again right after, ip_do_fragment() will copy\nhead-\u0026gt;sk to the new fragments, and sets up destructor to sock_wfree.\nIOW, we have no choice but to fix up sk_wmem accouting to reflect the\nfully reassembled skb, else wmem will underflow.\r\n\r\nThis change moves the orphan down into the core, to last possible moment.\nAs ip_defrag_offset is aliased with sk_buff-\u0026gt;sk member, we must move the\noffset into the FRAG_CB, else skb-\u0026gt;sk gets clobbered.\r\n\r\nThis allows to delay the orphaning long enough to learn if the skb has\nto be queued or if the skb is completing the reasm queue.\r\n\r\nIn the former case, things work as before, skb is orphaned.  This is\nsafe because skb gets queued/stolen and won\u0026apos;t continue past reasm engine.\r\n\r\nIn the latter case, we will steal the skb-\u0026gt;sk reference, reattach it to\nthe head skb, and fix up wmem accouting when inet_frag inflates truesize.(CVE-2024-26921)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/amdgpu: validate the parameters of bo mapping operations more clearly\r\n\r\nVerify the parameters of\namdgpu_vm_bo_(map/replace_map/clearing_mappings) in one common place.(CVE-2024-26922)","status":"published","published":"2024-05-17T11:07:04Z","modified":"2026-08-18T01:18:27.324466905Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1647","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ni2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction()\r\n\r\nmemcpy() is called in a loop while \u0026apos;operation-\u0026gt;length\u0026apos; upper bound\nis not checked and \u0026apos;data_idx\u0026apos; also increments.(CVE-2022-48632)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmm/slub: fix to return errno if kmalloc() fails\r\n\r\nIn create_unique_id(), kmalloc(, GFP_KERNEL) can fail due to\nout-of-memory, if it fails, return errno correctly rather than\ntriggering panic via BUG_ON();\r\n\r\nkernel BUG at mm/slub.c:5893!\nInternal error: Oops - BUG: 0 [#1] PREEMPT SMP\r\n\r\nCall trace:\n sysfs_slab_add+0x258/0x260 mm/slub.c:5973\n __kmem_cache_create+0x60/0x118 mm/slub.c:4899\n create_cache mm/slab_common.c:229 [inline]\n kmem_cache_create_usercopy+0x19c/0x31c mm/slab_common.c:335\n kmem_cache_create+0x1c/0x28 mm/slab_common.c:390\n f2fs_kmem_cache_create fs/f2fs/f2fs.h:2766 [inline]\n f2fs_init_xattr_caches+0x78/0xb4 fs/f2fs/xattr.c:808\n f2fs_fill_super+0x1050/0x1e0c fs/f2fs/super.c:4149\n mount_bdev+0x1b8/0x210 fs/super.c:1400\n f2fs_mount+0x44/0x58 fs/f2fs/super.c:4512\n legacy_get_tree+0x30/0x74 fs/fs_context.c:610\n vfs_get_tree+0x40/0x140 fs/super.c:1530\n do_new_mount+0x1dc/0x4e4 fs/namespace.c:3040\n path_mount+0x358/0x914 fs/namespace.c:3370\n do_mount fs/namespace.c:3383 [inline]\n __do_sys_mount fs/namespace.c:3591 [inline]\n __se_sys_mount fs/namespace.c:3568 [inline]\n __arm64_sys_mount+0x2f8/0x408 fs/namespace.c:3568(CVE-2022-48659)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ngpiolib: cdev: Set lineevent_state::irq after IRQ register successfully\r\n\r\nWhen running gpio test on nxp-ls1028 platform with below command\ngpiomon --num-events=3 --rising-edge gpiochip1 25\nThere will be a warning trace as below:\nCall trace:\nfree_irq+0x204/0x360\nlineevent_free+0x64/0x70\ngpio_ioctl+0x598/0x6a0\n__arm64_sys_ioctl+0xb4/0x100\ninvoke_syscall+0x5c/0x130\n......\nel0t_64_sync+0x1a0/0x1a4\nThe reason of this issue is that calling request_threaded_irq()\nfunction failed, and then lineevent_free() is invoked to release\nthe resource. Since the lineevent_state::irq was already set, so\nthe subsequent invocation of free_irq() would trigger the above\nwarning call trace. To fix this issue, set the lineevent_state::irq\nafter the IRQ register successfully.(CVE-2022-48660)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbinder: fix race between mmput() and do_exit()\r\n\r\nTask A calls binder_update_page_range() to allocate and insert pages on\na remote address space from Task B. For this, Task A pins the remote mm\nvia mmget_not_zero() first. This can race with Task B do_exit() and the\nfinal mmput() refcount decrement will come from Task A.\r\n\r\n  Task A            | Task B\n  ------------------+------------------\n  mmget_not_zero()  |\n                    |  do_exit()\n                    |    exit_mm()\n                    |      mmput()\n  mmput()           |\n    exit_mmap()     |\n      remove_vma()  |\n        fput()      |\r\n\r\nIn this case, the work of ____fput() from Task B is queued up in Task A\nas TWA_RESUME. So in theory, Task A returns to userspace and the cleanup\nwork gets executed. However, Task A instead sleep, waiting for a reply\nfrom Task B that never comes (it\u0026apos;s dead).\r\n\r\nThis means the binder_deferred_release() is blocked until an unrelated\nbinder event forces Task A to go back to userspace. All the associated\ndeath notifications will also be delayed until then.\r\n\r\nIn order to fix this use mmput_async() that will schedule the work in\nthe corresponding mm-\u0026gt;async_put_work WQ instead of Task A.(CVE-2023-52609)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nhwrng: core - Fix page fault dead lock on mmap-ed hwrng\r\n\r\nThere is a dead-lock in the hwrng device read path.  This triggers\nwhen the user reads from /dev/hwrng into memory also mmap-ed from\n/dev/hwrng.  The resulting page fault triggers a recursive read\nwhich then dead-locks.\r\n\r\nFix this by using a stack buffer when calling copy_to_user.(CVE-2023-52615)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ncrypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init\r\n\r\nWhen the mpi_ec_ctx structure is initialized, some fields are not\ncleared, causing a crash when referencing the field when the\nstructure was released. Initially, this issue was ignored because\nmemory for mpi_ec_ctx is allocated with the __GFP_ZERO flag.\nFor example, this error will be triggered when calculating the\nZa value for SM2 separately.(CVE-2023-52616)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nblock/rnbd-srv: Check for unlikely string overflow\r\n\r\nSince \u0026quot;dev_search_path\u0026quot; can technically be as large as PATH_MAX,\nthere was a risk of truncation when copying it and a second string\ninto \u0026quot;full_path\u0026quot; since it was also PATH_MAX sized. The W=1 builds were\nreporting this warning:\r\n\r\ndrivers/block/rnbd/rnbd-srv.c: In function \u0026apos;process_msg_open.isra\u0026apos;:\ndrivers/block/rnbd/rnbd-srv.c:616:51: warning: \u0026apos;%s\u0026apos; directive output may be truncated writing up to 254 bytes into a region of size between 0 and 4095 [-Wformat-truncation=]\n  616 |                 snprintf(full_path, PATH_MAX, \u0026quot;%s/%s\u0026quot;,\n      |                                                   ^~\nIn function \u0026apos;rnbd_srv_get_full_path\u0026apos;,\n    inlined from \u0026apos;process_msg_open.isra\u0026apos; at drivers/block/rnbd/rnbd-srv.c:721:14: drivers/block/rnbd/rnbd-srv.c:616:17: note: \u0026apos;snprintf\u0026apos; output between 2 and 4351 bytes into a destination of size 4096\n  616 |                 snprintf(full_path, PATH_MAX, \u0026quot;%s/%s\u0026quot;,\n      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n  617 |                          dev_search_path, dev_name);\n      |                          ~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nTo fix this, unconditionally check for truncation (as was already done\nfor the case where \u0026quot;%SESSNAME%\u0026quot; was present).(CVE-2023-52618)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nf_tables: disallow timeout for anonymous sets\r\n\r\nNever used from userspace, disallow these parameters.(CVE-2023-52620)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbpf: Check rcu_read_lock_trace_held() before calling bpf map helpers\r\n\r\nThese three bpf_map_{lookup,update,delete}_elem() helpers are also\navailable for sleepable bpf program, so add the corresponding lock\nassertion for sleepable bpf program, otherwise the following warning\nwill be reported when a sleepable bpf program manipulates bpf map under\ninterpreter mode (aka bpf_jit_enable=0):\r\n\r\n  WARNING: CPU: 3 PID: 4985 at kernel/bpf/helpers.c:40 ......\n  CPU: 3 PID: 4985 Comm: test_progs Not tainted 6.6.0+ #2\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ......\n  RIP: 0010:bpf_map_lookup_elem+0x54/0x60\n  ......\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   ? __warn+0xa5/0x240\n   ? bpf_map_lookup_elem+0x54/0x60\n   ? report_bug+0x1ba/0x1f0\n   ? handle_bug+0x40/0x80\n   ? exc_invalid_op+0x18/0x50\n   ? asm_exc_invalid_op+0x1b/0x20\n   ? __pfx_bpf_map_lookup_elem+0x10/0x10\n   ? rcu_lockdep_current_cpu_online+0x65/0xb0\n   ? rcu_is_watching+0x23/0x50\n   ? bpf_map_lookup_elem+0x54/0x60\n   ? __pfx_bpf_map_lookup_elem+0x10/0x10\n   ___bpf_prog_run+0x513/0x3b70\n   __bpf_prog_run32+0x9d/0xd0\n   ? __bpf_prog_enter_sleepable_recur+0xad/0x120\n   ? __bpf_prog_enter_sleepable_recur+0x3e/0x120\n   bpf_trampoline_6442580665+0x4d/0x1000\n   __x64_sys_getpgid+0x5/0x30\n   ? do_syscall_64+0x36/0xb0\n   entry_SYSCALL_64_after_hwframe+0x6e/0x76\n   \u0026lt;/TASK\u0026gt;(CVE-2023-52621)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nSUNRPC: Fix a suspicious RCU usage warning\r\n\r\nI received the following warning while running cthon against an ontap\nserver running pNFS:\r\n\r\n[   57.202521] =============================\n[   57.202522] WARNING: suspicious RCU usage\n[   57.202523] 6.7.0-rc3-g2cc14f52aeb7 #41492 Not tainted\n[   57.202525] -----------------------------\n[   57.202525] net/sunrpc/xprtmultipath.c:349 RCU-list traversed in non-reader section!!\n[   57.202527]\n               other info that might help us debug this:\r\n\r\n[   57.202528]\n               rcu_scheduler_active = 2, debug_locks = 1\n[   57.202529] no locks held by test5/3567.\n[   57.202530]\n               stack backtrace:\n[   57.202532] CPU: 0 PID: 3567 Comm: test5 Not tainted 6.7.0-rc3-g2cc14f52aeb7 #41492 5b09971b4965c0aceba19f3eea324a4a806e227e\n[   57.202534] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 2/2/2022\n[   57.202536] Call Trace:\n[   57.202537]  \u0026lt;TASK\u0026gt;\n[   57.202540]  dump_stack_lvl+0x77/0xb0\n[   57.202551]  lockdep_rcu_suspicious+0x154/0x1a0\n[   57.202556]  rpc_xprt_switch_has_addr+0x17c/0x190 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]\n[   57.202596]  rpc_clnt_setup_test_and_add_xprt+0x50/0x180 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]\n[   57.202621]  ? rpc_clnt_add_xprt+0x254/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]\n[   57.202646]  rpc_clnt_add_xprt+0x27a/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]\n[   57.202671]  ? __pfx_rpc_clnt_setup_test_and_add_xprt+0x10/0x10 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]\n[   57.202696]  nfs4_pnfs_ds_connect+0x345/0x760 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]\n[   57.202728]  ? __pfx_nfs4_test_session_trunk+0x10/0x10 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]\n[   57.202754]  nfs4_fl_prepare_ds+0x75/0xc0 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a]\n[   57.202760]  filelayout_write_pagelist+0x4a/0x200 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a]\n[   57.202765]  pnfs_generic_pg_writepages+0xbe/0x230 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]\n[   57.202788]  __nfs_pageio_add_request+0x3fd/0x520 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202813]  nfs_pageio_add_request+0x18b/0x390 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202831]  nfs_do_writepage+0x116/0x1e0 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202849]  nfs_writepages_callback+0x13/0x30 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202866]  write_cache_pages+0x265/0x450\n[   57.202870]  ? __pfx_nfs_writepages_callback+0x10/0x10 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202891]  nfs_writepages+0x141/0x230 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202913]  do_writepages+0xd2/0x230\n[   57.202917]  ? filemap_fdatawrite_wbc+0x5c/0x80\n[   57.202921]  filemap_fdatawrite_wbc+0x67/0x80\n[   57.202924]  filemap_write_and_wait_range+0xd9/0x170\n[   57.202930]  nfs_wb_all+0x49/0x180 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202947]  nfs4_file_flush+0x72/0xb0 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]\n[   57.202969]  __se_sys_close+0x46/0xd0\n[   57.202972]  do_syscall_64+0x68/0x100\n[   57.202975]  ? do_syscall_64+0x77/0x100\n[   57.202976]  ? do_syscall_64+0x77/0x100\n[   57.202979]  entry_SYSCALL_64_after_hwframe+0x6e/0x76\n[   57.202982] RIP: 0033:0x7fe2b12e4a94\n[   57.202985] Code: 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d d5 18 0e 00 00 74 13 b8 03 00 00 00 0f 05 \u0026lt;48\u0026gt; 3d 00 f0 ff ff 77 44 c3 0f 1f 00 48 83 ec 18 89 7c 24 0c e8 c3\n[   57.202987] RSP: 002b:00007ffe857ddb38 EFLAGS: 00000202 ORIG_RAX: 0000000000000003\n[   57.202989] RAX: ffffffffffffffda RBX: 00007ffe857dfd68 RCX: 00007fe2b12e4a94\n[   57.202991] RDX: 0000000000002000 RSI: 00007ffe857ddc40 RDI: 0000000000000003\n[   57.202992] RBP: 00007ffe857dfc50 R08: 7fffffffffffffff R09: 0000000065650f49\n[   57.202993] R10: 00007f\n---truncated---(CVE-2023-52623)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nsh: push-switch: Reorder cleanup operations to avoid use-after-free bug\r\n\r\nThe original code puts flush_work() before timer_shutdown_sync()\nin switch_drv_remove(). Although we use flush_work() to stop\nthe worker, it could be rescheduled in switch_timer(). As a result,\na use-after-free bug can occur. The details are shown below:\r\n\r\n      (cpu 0)                    |      (cpu 1)\nswitch_drv_remove()              |\n flush_work()                    |\n  ...                            |  switch_timer // timer\n                                 |   schedule_work(\u0026amp;psw-\u0026gt;work)\n timer_shutdown_sync()           |\n ...                             |  switch_work_handler // worker\n kfree(psw) // free              |\n                                 |   psw-\u0026gt;state = 0 // use\r\n\r\nThis patch puts timer_shutdown_sync() before flush_work() to\nmitigate the bugs. As a result, the worker and timer will be\nstopped safely before the deallocate operations.(CVE-2023-52629)\r\n\r\nRejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.(CVE-2023-52630)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\num: time-travel: fix time corruption\r\n\r\nIn \u0026apos;basic\u0026apos; time-travel mode (without =inf-cpu or =ext), we\nstill get timer interrupts. These can happen at arbitrary\npoints in time, i.e. while in timer_read(), which pushes\ntime forward just a little bit. Then, if we happen to get\nthe interrupt after calculating the new time to push to,\nbut before actually finishing that, the interrupt will set\nthe time to a value that\u0026apos;s incompatible with the forward,\nand we\u0026apos;ll crash because time goes backwards when we do the\nforwarding.\r\n\r\nFix this by reading the time_travel_time, calculating the\nadjustment, and doing the adjustment all with interrupts\ndisabled.(CVE-2023-52633)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nPM / devfreq: Synchronize devfreq_monitor_[start/stop]\r\n\r\nThere is a chance if a frequent switch of the governor\ndone in a loop result in timer list corruption where\ntimer cancel being done from two place one from\ncancel_delayed_work_sync() and followed by expire_timers()\ncan be seen from the traces[1].\r\n\r\nwhile true\ndo\n        echo \u0026quot;simple_ondemand\u0026quot; \u0026gt; /sys/class/devfreq/1d84000.ufshc/governor\n        echo \u0026quot;performance\u0026quot; \u0026gt; /sys/class/devfreq/1d84000.ufshc/governor\ndone\r\n\r\nIt looks to be issue with devfreq driver where\ndevice_monitor_[start/stop] need to synchronized so that\ndelayed work should get corrupted while it is either\nbeing queued or running or being cancelled.\r\n\r\nLet\u0026apos;s use polling flag and devfreq lock to synchronize the\nqueueing the timer instance twice and work data being\ncorrupted.\r\n\r\n[1]\n...\n..\n\u0026lt;idle\u0026gt;-0    [003]   9436.209662:  timer_cancel   timer=0xffffff80444f0428\n\u0026lt;idle\u0026gt;-0    [003]   9436.209664:  timer_expire_entry   timer=0xffffff80444f0428  now=0x10022da1c  function=__typeid__ZTSFvP10timer_listE_global_addr  baseclk=0x10022da1c\n\u0026lt;idle\u0026gt;-0    [003]   9436.209718:  timer_expire_exit   timer=0xffffff80444f0428\nkworker/u16:6-14217    [003]   9436.209863:  timer_start   timer=0xffffff80444f0428  function=__typeid__ZTSFvP10timer_listE_global_addr  expires=0x10022da2b  now=0x10022da1c  flags=182452227\nvendor.xxxyyy.ha-1593    [004]   9436.209888:  timer_cancel   timer=0xffffff80444f0428\nvendor.xxxyyy.ha-1593    [004]   9436.216390:  timer_init   timer=0xffffff80444f0428\nvendor.xxxyyy.ha-1593    [004]   9436.216392:  timer_start   timer=0xffffff80444f0428  function=__typeid__ZTSFvP10timer_listE_global_addr  expires=0x10022da2c  now=0x10022da1d  flags=186646532\nvendor.xxxyyy.ha-1593    [005]   9436.220992:  timer_cancel   timer=0xffffff80444f0428\nxxxyyyTraceManag-7795    [004]   9436.261641:  timer_cancel   timer=0xffffff80444f0428\r\n\r\n[2]\r\n\r\n 9436.261653][    C4] Unable to handle kernel paging request at virtual address dead00000000012a\n[ 9436.261664][    C4] Mem abort info:\n[ 9436.261666][    C4]   ESR = 0x96000044\n[ 9436.261669][    C4]   EC = 0x25: DABT (current EL), IL = 32 bits\n[ 9436.261671][    C4]   SET = 0, FnV = 0\n[ 9436.261673][    C4]   EA = 0, S1PTW = 0\n[ 9436.261675][    C4] Data abort info:\n[ 9436.261677][    C4]   ISV = 0, ISS = 0x00000044\n[ 9436.261680][    C4]   CM = 0, WnR = 1\n[ 9436.261682][    C4] [dead00000000012a] address between user and kernel address ranges\n[ 9436.261685][    C4] Internal error: Oops: 96000044 [#1] PREEMPT SMP\n[ 9436.261701][    C4] Skip md ftrace buffer dump for: 0x3a982d0\n...\r\n\r\n[ 9436.262138][    C4] CPU: 4 PID: 7795 Comm: TraceManag Tainted: G S      W  O      5.10.149-android12-9-o-g17f915d29d0c #1\n[ 9436.262141][    C4] Hardware name: Qualcomm Technologies, Inc.  (DT)\n[ 9436.262144][    C4] pstate: 22400085 (nzCv daIf +PAN -UAO +TCO BTYPE=--)\n[ 9436.262161][    C4] pc : expire_timers+0x9c/0x438\n[ 9436.262164][    C4] lr : expire_timers+0x2a4/0x438\n[ 9436.262168][    C4] sp : ffffffc010023dd0\n[ 9436.262171][    C4] x29: ffffffc010023df0 x28: ffffffd0636fdc18\n[ 9436.262178][    C4] x27: ffffffd063569dd0 x26: ffffffd063536008\n[ 9436.262182][    C4] x25: 0000000000000001 x24: ffffff88f7c69280\n[ 9436.262185][    C4] x23: 00000000000000e0 x22: dead000000000122\n[ 9436.262188][    C4] x21: 000000010022da29 x20: ffffff8af72b4e80\n[ 9436.262191][    C4] x19: ffffffc010023e50 x18: ffffffc010025038\n[ 9436.262195][    C4] x17: 0000000000000240 x16: 0000000000000201\n[ 9436.262199][    C4] x15: ffffffffffffffff x14: ffffff889f3c3100\n[ 9436.262203][    C4] x13: ffffff889f3c3100 x12: 00000000049f56b8\n[ 9436.262207][    C4] x11: 00000000049f56b8 x10: 00000000ffffffff\n[ 9436.262212][    C4] x9 : ffffffc010023e50 x8 : dead000000000122\n[ 9436.262216][    C4] x7 : ffffffffffffffff x6 : ffffffc0100239d8\n[ 9436.262220][    C4] x5 : 0000000000000000 x4 : 0000000000000101\n[ 9436.262223][    C4] x3 : 0000000000000080 x2 : ffffff8\n---truncated---(CVE-2023-52635)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ncan: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)\r\n\r\nLock jsk-\u0026gt;sk to prevent UAF when setsockopt(..., SO_J1939_FILTER, ...)\nmodifies jsk-\u0026gt;filters while receiving packets.\r\n\r\nFollowing trace was seen on affected system:\n ==================================================================\n BUG: KASAN: slab-use-after-free in j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939]\n Read of size 4 at addr ffff888012144014 by task j1939/350\r\n\r\n CPU: 0 PID: 350 Comm: j1939 Tainted: G        W  OE      6.5.0-rc5 #1\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014\n Call Trace:\n  print_report+0xd3/0x620\n  ? kasan_complete_mode_report_info+0x7d/0x200\n  ? j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939]\n  kasan_report+0xc2/0x100\n  ? j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939]\n  __asan_load4+0x84/0xb0\n  j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939]\n  j1939_sk_recv+0x20b/0x320 [can_j1939]\n  ? __kasan_check_write+0x18/0x20\n  ? __pfx_j1939_sk_recv+0x10/0x10 [can_j1939]\n  ? j1939_simple_recv+0x69/0x280 [can_j1939]\n  ? j1939_ac_recv+0x5e/0x310 [can_j1939]\n  j1939_can_recv+0x43f/0x580 [can_j1939]\n  ? __pfx_j1939_can_recv+0x10/0x10 [can_j1939]\n  ? raw_rcv+0x42/0x3c0 [can_raw]\n  ? __pfx_j1939_can_recv+0x10/0x10 [can_j1939]\n  can_rcv_filter+0x11f/0x350 [can]\n  can_receive+0x12f/0x190 [can]\n  ? __pfx_can_rcv+0x10/0x10 [can]\n  can_rcv+0xdd/0x130 [can]\n  ? __pfx_can_rcv+0x10/0x10 [can]\n  __netif_receive_skb_one_core+0x13d/0x150\n  ? __pfx___netif_receive_skb_one_core+0x10/0x10\n  ? __kasan_check_write+0x18/0x20\n  ? _raw_spin_lock_irq+0x8c/0xe0\n  __netif_receive_skb+0x23/0xb0\n  process_backlog+0x107/0x260\n  __napi_poll+0x69/0x310\n  net_rx_action+0x2a1/0x580\n  ? __pfx_net_rx_action+0x10/0x10\n  ? __pfx__raw_spin_lock+0x10/0x10\n  ? handle_irq_event+0x7d/0xa0\n  __do_softirq+0xf3/0x3f8\n  do_softirq+0x53/0x80\n  \u0026lt;/IRQ\u0026gt;\n  \u0026lt;TASK\u0026gt;\n  __local_bh_enable_ip+0x6e/0x70\n  netif_rx+0x16b/0x180\n  can_send+0x32b/0x520 [can]\n  ? __pfx_can_send+0x10/0x10 [can]\n  ? __check_object_size+0x299/0x410\n  raw_sendmsg+0x572/0x6d0 [can_raw]\n  ? __pfx_raw_sendmsg+0x10/0x10 [can_raw]\n  ? apparmor_socket_sendmsg+0x2f/0x40\n  ? __pfx_raw_sendmsg+0x10/0x10 [can_raw]\n  sock_sendmsg+0xef/0x100\n  sock_write_iter+0x162/0x220\n  ? __pfx_sock_write_iter+0x10/0x10\n  ? __rtnl_unlock+0x47/0x80\n  ? security_file_permission+0x54/0x320\n  vfs_write+0x6ba/0x750\n  ? __pfx_vfs_write+0x10/0x10\n  ? __fget_light+0x1ca/0x1f0\n  ? __rcu_read_unlock+0x5b/0x280\n  ksys_write+0x143/0x170\n  ? __pfx_ksys_write+0x10/0x10\n  ? __kasan_check_read+0x15/0x20\n  ? fpregs_assert_state_consistent+0x62/0x70\n  __x64_sys_write+0x47/0x60\n  do_syscall_64+0x60/0x90\n  ? do_syscall_64+0x6d/0x90\n  ? irqentry_exit+0x3f/0x50\n  ? exc_page_fault+0x79/0xf0\n  entry_SYSCALL_64_after_hwframe+0x6e/0xd8\r\n\r\n Allocated by task 348:\n  kasan_save_stack+0x2a/0x50\n  kasan_set_track+0x29/0x40\n  kasan_save_alloc_info+0x1f/0x30\n  __kasan_kmalloc+0xb5/0xc0\n  __kmalloc_node_track_caller+0x67/0x160\n  j1939_sk_setsockopt+0x284/0x450 [can_j1939]\n  __sys_setsockopt+0x15c/0x2f0\n  __x64_sys_setsockopt+0x6b/0x80\n  do_syscall_64+0x60/0x90\n  entry_SYSCALL_64_after_hwframe+0x6e/0xd8\r\n\r\n Freed by task 349:\n  kasan_save_stack+0x2a/0x50\n  kasan_set_track+0x29/0x40\n  kasan_save_free_info+0x2f/0x50\n  __kasan_slab_free+0x12e/0x1c0\n  __kmem_cache_free+0x1b9/0x380\n  kfree+0x7a/0x120\n  j1939_sk_setsockopt+0x3b2/0x450 [can_j1939]\n  __sys_setsockopt+0x15c/0x2f0\n  __x64_sys_setsockopt+0x6b/0x80\n  do_syscall_64+0x60/0x90\n  entry_SYSCALL_64_after_hwframe+0x6e/0xd8(CVE-2023-52637)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nKVM: s390: vsie: fix race during shadow creation\r\n\r\nRight now it is possible to see gmap-\u0026gt;private being zero in\nkvm_s390_vsie_gmap_notifier resulting in a crash.  This is due to the\nfact that we add gmap-\u0026gt;private == kvm after creation:\r\n\r\nstatic int acquire_gmap_shadow(struct kvm_vcpu *vcpu,\n                               struct vsie_page *vsie_page)\n{\n[...]\n        gmap = gmap_shadow(vcpu-\u0026gt;arch.gmap, asce, edat);\n        if (IS_ERR(gmap))\n                return PTR_ERR(gmap);\n        gmap-\u0026gt;private = vcpu-\u0026gt;kvm;\r\n\r\nLet children inherit the private field of the parent.(CVE-2023-52639)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled\r\n\r\nWhen QoS is disabled, the queue priority value will not map to the correct\nieee80211 queue since there is only one queue. Stop/wake queue 0 when QoS\nis disabled to prevent trying to stop/wake a non-existent queue and failing\nto stop/wake the actual queue instantiated.\r\n\r\nLog of issue before change (with kernel parameter qos=0):\n    [  +5.112651] ------------[ cut here ]------------\n    [  +0.000005] WARNING: CPU: 7 PID: 25513 at net/mac80211/util.c:449 __ieee80211_wake_queue+0xd5/0x180 [mac80211]\n    [  +0.000067] Modules linked in: b43(O) snd_seq_dummy snd_hrtimer snd_seq snd_seq_device nft_chain_nat xt_MASQUERADE nf_nat xfrm_user xfrm_algo xt_addrtype overlay ccm af_packet amdgpu snd_hda_codec_cirrus snd_hda_codec_generic ledtrig_audio drm_exec amdxcp gpu_sched xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip6t_rpfilter ipt_rpfilter xt_pkttype xt_LOG nf_log_syslog xt_tcpudp nft_compat nf_tables nfnetlink sch_fq_codel btusb uinput iTCO_wdt ctr btrtl intel_pmc_bxt i915 intel_rapl_msr mei_hdcp mei_pxp joydev at24 watchdog btintel atkbd libps2 serio radeon btbcm vivaldi_fmap btmtk intel_rapl_common snd_hda_codec_hdmi bluetooth uvcvideo nls_iso8859_1 applesmc nls_cp437 x86_pkg_temp_thermal snd_hda_intel intel_powerclamp vfat videobuf2_vmalloc coretemp fat snd_intel_dspcfg crc32_pclmul uvc polyval_clmulni snd_intel_sdw_acpi loop videobuf2_memops snd_hda_codec tun drm_suballoc_helper polyval_generic drm_ttm_helper drm_buddy tap ecdh_generic videobuf2_v4l2 gf128mul macvlan ttm ghash_clmulni_intel ecc tg3\n    [  +0.000044]  videodev bridge snd_hda_core rapl crc16 drm_display_helper cec mousedev snd_hwdep evdev intel_cstate bcm5974 hid_appleir videobuf2_common stp mac_hid libphy snd_pcm drm_kms_helper acpi_als mei_me intel_uncore llc mc snd_timer intel_gtt industrialio_triggered_buffer apple_mfi_fastcharge i2c_i801 mei snd lpc_ich agpgart ptp i2c_smbus thunderbolt apple_gmux i2c_algo_bit kfifo_buf video industrialio soundcore pps_core wmi tiny_power_button sbs sbshc button ac cordic bcma mac80211 cfg80211 ssb rfkill libarc4 kvm_intel kvm drm irqbypass fuse backlight firmware_class efi_pstore configfs efivarfs dmi_sysfs ip_tables x_tables autofs4 dm_crypt cbc encrypted_keys trusted asn1_encoder tee tpm rng_core input_leds hid_apple led_class hid_generic usbhid hid sd_mod t10_pi crc64_rocksoft crc64 crc_t10dif crct10dif_generic ahci libahci libata uhci_hcd ehci_pci ehci_hcd crct10dif_pclmul crct10dif_common sha512_ssse3 sha512_generic sha256_ssse3 sha1_ssse3 aesni_intel usbcore scsi_mod libaes crypto_simd cryptd scsi_common\n    [  +0.000055]  usb_common rtc_cmos btrfs blake2b_generic libcrc32c crc32c_generic crc32c_intel xor raid6_pq dm_snapshot dm_bufio dm_mod dax [last unloaded: b43(O)]\n    [  +0.000009] CPU: 7 PID: 25513 Comm: irq/17-b43 Tainted: G        W  O       6.6.7 #1-NixOS\n    [  +0.000003] Hardware name: Apple Inc. MacBookPro8,3/Mac-942459F5819B171B, BIOS 87.0.0.0.0 06/13/2019\n    [  +0.000001] RIP: 0010:__ieee80211_wake_queue+0xd5/0x180 [mac80211]\n    [  +0.000046] Code: 00 45 85 e4 0f 85 9b 00 00 00 48 8d bd 40 09 00 00 f0 48 0f ba ad 48 09 00 00 00 72 0f 5b 5d 41 5c 41 5d 41 5e e9 cb 6d 3c d0 \u0026lt;0f\u0026gt; 0b 5b 5d 41 5c 41 5d 41 5e c3 cc cc cc cc 48 8d b4 16 94 00 00\n    [  +0.000002] RSP: 0018:ffffc90003c77d60 EFLAGS: 00010097\n    [  +0.000001] RAX: 0000000000000001 RBX: 0000000000000002 RCX: 0000000000000000\n    [  +0.000001] RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffff88820b924900\n    [  +0.000002] RBP: ffff88820b924900 R08: ffffc90003c77d90 R09: 000000000003bfd0\n    [  +0.000001] R10: ffff88820b924900 R11: ffffc90003c77c68 R12: 0000000000000000\n    [  +0.000001] R13: 0000000000000000 R14: ffffc90003c77d90 R15: ffffffffc0fa6f40\n    [  +0.000001] FS:  0000000000000000(0000) GS:ffff88846fb80000(0000) knlGS:0000000000000000\n    [  +0.000001] CS:  0010 DS: 0\n---truncated---(CVE-2023-52644)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nusb: aqc111: check packet for fixup for true limit\r\n\r\nIf a device sends a packet that is inbetween 0\nand sizeof(u64) the value passed to skb_trim()\nas length will wrap around ending up as some very\nlarge value.\r\n\r\nThe driver will then proceed to parse the header\nlocated at that position, which will either oops or\nprocess some random value.\r\n\r\nThe fix is to check against sizeof(u64) rather than\n0, which the driver currently does. The issue exists\nsince the introduction of the driver.(CVE-2023-52655)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\npowerpc/imc-pmu: Add a null pointer check in update_events_in_group()\r\n\r\nkasprintf() returns a pointer to dynamically allocated memory\nwhich can be NULL upon failure.(CVE-2023-52675)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbpf: Guard stack limits against 32bit overflow\r\n\r\nThis patch promotes the arithmetic around checking stack bounds to be\ndone in the 64-bit domain, instead of the current 32bit. The arithmetic\nimplies adding together a 64-bit register with a int offset. The\nregister was checked to be below 1\u0026lt;\u0026lt;29 when it was variable, but not\nwhen it was fixed. The offset either comes from an instruction (in which\ncase it is 16 bit), from another register (in which case the caller\nchecked it to be below 1\u0026lt;\u0026lt;29 [1]), or from the size of an argument to a\nkfunc (in which case it can be a u32 [2]). Between the register being\ninconsistently checked to be below 1\u0026lt;\u0026lt;29, and the offset being up to an\nu32, it appears that we were open to overflowing the `int`s which were\ncurrently used for arithmetic.\r\n\r\n[1] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L7494-L7498\n[2] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L11904(CVE-2023-52676)\r\n\r\n\r\nA race condition was found in the Linux kernel\u0026apos;s bluetooth device driver in {min,max}_key_size_set() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.\r\n\r\n\r\n\r\n\n(CVE-2024-24860)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: iwlwifi: fix a memory corruption\r\n\r\niwl_fw_ini_trigger_tlv::data is a pointer to a __le32, which means that\nif we copy to iwl_fw_ini_trigger_tlv::data + offset while offset is in\nbytes, we\u0026apos;ll write past the buffer.(CVE-2024-26610)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()\r\n\r\nsyzbot pointed out [1] that NEXTHDR_FRAGMENT handling is broken.\r\n\r\nReading frag_off can only be done if we pulled enough bytes\nto skb-\u0026gt;head. Currently we might access garbage.\r\n\r\n[1]\nBUG: KMSAN: uninit-value in ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0\nip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0\nipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline]\nip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432\n__netdev_start_xmit include/linux/netdevice.h:4940 [inline]\nnetdev_start_xmit include/linux/netdevice.h:4954 [inline]\nxmit_one net/core/dev.c:3548 [inline]\ndev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564\n__dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349\ndev_queue_xmit include/linux/netdevice.h:3134 [inline]\nneigh_connected_output+0x569/0x660 net/core/neighbour.c:1592\nneigh_output include/net/neighbour.h:542 [inline]\nip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137\nip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222\nNF_HOOK_COND include/linux/netfilter.h:303 [inline]\nip6_output+0x323/0x610 net/ipv6/ip6_output.c:243\ndst_output include/net/dst.h:451 [inline]\nip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155\nip6_send_skb net/ipv6/ip6_output.c:1952 [inline]\nip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972\nrawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582\nrawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920\ninet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847\nsock_sendmsg_nosec net/socket.c:730 [inline]\n__sock_sendmsg net/socket.c:745 [inline]\n____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584\n___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638\n__sys_sendmsg net/socket.c:2667 [inline]\n__do_sys_sendmsg net/socket.c:2676 [inline]\n__se_sys_sendmsg net/socket.c:2674 [inline]\n__x64_sys_sendmsg+0x307/0x490 net/socket.c:2674\ndo_syscall_x64 arch/x86/entry/common.c:52 [inline]\ndo_syscall_64+0x44/0x110 arch/x86/entry/common.c:83\nentry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nUninit was created at:\nslab_post_alloc_hook+0x129/0xa70 mm/slab.h:768\nslab_alloc_node mm/slub.c:3478 [inline]\n__kmem_cache_alloc_node+0x5c9/0x970 mm/slub.c:3517\n__do_kmalloc_node mm/slab_common.c:1006 [inline]\n__kmalloc_node_track_caller+0x118/0x3c0 mm/slab_common.c:1027\nkmalloc_reserve+0x249/0x4a0 net/core/skbuff.c:582\npskb_expand_head+0x226/0x1a00 net/core/skbuff.c:2098\n__pskb_pull_tail+0x13b/0x2310 net/core/skbuff.c:2655\npskb_may_pull_reason include/linux/skbuff.h:2673 [inline]\npskb_may_pull include/linux/skbuff.h:2681 [inline]\nip6_tnl_parse_tlv_enc_lim+0x901/0xbb0 net/ipv6/ip6_tunnel.c:408\nipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline]\nip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432\n__netdev_start_xmit include/linux/netdevice.h:4940 [inline]\nnetdev_start_xmit include/linux/netdevice.h:4954 [inline]\nxmit_one net/core/dev.c:3548 [inline]\ndev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564\n__dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349\ndev_queue_xmit include/linux/netdevice.h:3134 [inline]\nneigh_connected_output+0x569/0x660 net/core/neighbour.c:1592\nneigh_output include/net/neighbour.h:542 [inline]\nip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137\nip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222\nNF_HOOK_COND include/linux/netfilter.h:303 [inline]\nip6_output+0x323/0x610 net/ipv6/ip6_output.c:243\ndst_output include/net/dst.h:451 [inline]\nip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155\nip6_send_skb net/ipv6/ip6_output.c:1952 [inline]\nip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972\nrawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582\nrawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920\ninet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847\nsock_sendmsg_nosec net/socket.c:730 [inline]\n__sock_sendmsg net/socket.c:745 [inline]\n____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584\n___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638\n__sys_sendmsg net/socket.c:2667 [inline]\n__do_sys_sendms\n---truncated---(CVE-2024-26633)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nllc: Drop support for ETH_P_TR_802_2.\r\n\r\nsyzbot reported an uninit-value bug below. [0]\r\n\r\nllc supports ETH_P_802_2 (0x0004) and used to support ETH_P_TR_802_2\n(0x0011), and syzbot abused the latter to trigger the bug.\r\n\r\n  write$tun(r0, \u0026amp;(0x7f0000000040)={@val={0x0, 0x11}, @val, @mpls={[], @llc={@snap={0xaa, 0x1, \u0026apos;)\u0026apos;, \u0026quot;90e5dd\u0026quot;}}}}, 0x16)\r\n\r\nllc_conn_handler() initialises local variables {saddr,daddr}.mac\nbased on skb in llc_pdu_decode_sa()/llc_pdu_decode_da() and passes\nthem to __llc_lookup().\r\n\r\nHowever, the initialisation is done only when skb-\u0026gt;protocol is\nhtons(ETH_P_802_2), otherwise, __llc_lookup_established() and\n__llc_lookup_listener() will read garbage.\r\n\r\nThe missing initialisation existed prior to commit 211ed865108e\n(\u0026quot;net: delete all instances of special processing for token ring\u0026quot;).\r\n\r\nIt removed the part to kick out the token ring stuff but forgot to\nclose the door allowing ETH_P_TR_802_2 packets to sneak into llc_rcv().\r\n\r\nLet\u0026apos;s remove llc_tr_packet_type and complete the deprecation.\r\n\r\n[0]:\nBUG: KMSAN: uninit-value in __llc_lookup_established+0xe9d/0xf90\n __llc_lookup_established+0xe9d/0xf90\n __llc_lookup net/llc/llc_conn.c:611 [inline]\n llc_conn_handler+0x4bd/0x1360 net/llc/llc_conn.c:791\n llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206\n __netif_receive_skb_one_core net/core/dev.c:5527 [inline]\n __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5641\n netif_receive_skb_internal net/core/dev.c:5727 [inline]\n netif_receive_skb+0x58/0x660 net/core/dev.c:5786\n tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555\n tun_get_user+0x53af/0x66d0 drivers/net/tun.c:2002\n tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048\n call_write_iter include/linux/fs.h:2020 [inline]\n new_sync_write fs/read_write.c:491 [inline]\n vfs_write+0x8ef/0x1490 fs/read_write.c:584\n ksys_write+0x20f/0x4c0 fs/read_write.c:637\n __do_sys_write fs/read_write.c:649 [inline]\n __se_sys_write fs/read_write.c:646 [inline]\n __x64_sys_write+0x93/0xd0 fs/read_write.c:646\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nLocal variable daddr created at:\n llc_conn_handler+0x53/0x1360 net/llc/llc_conn.c:783\n llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206\r\n\r\nCPU: 1 PID: 5004 Comm: syz-executor994 Not tainted 6.6.0-syzkaller-14500-g1c41041124bd #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023(CVE-2024-26635)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nllc: make llc_ui_sendmsg() more robust against bonding changes\r\n\r\nsyzbot was able to trick llc_ui_sendmsg(), allocating an skb with no\nheadroom, but subsequently trying to push 14 bytes of Ethernet header [1]\r\n\r\nLike some others, llc_ui_sendmsg() releases the socket lock before\ncalling sock_alloc_send_skb().\nThen it acquires it again, but does not redo all the sanity checks\nthat were performed.\r\n\r\nThis fix:\r\n\r\n- Uses LL_RESERVED_SPACE() to reserve space.\n- Check all conditions again after socket lock is held again.\n- Do not account Ethernet header for mtu limitation.\r\n\r\n[1]\r\n\r\nskbuff: skb_under_panic: text:ffff800088baa334 len:1514 put:14 head:ffff0000c9c37000 data:ffff0000c9c36ff2 tail:0x5dc end:0x6c0 dev:bond0\r\n\r\n kernel BUG at net/core/skbuff.c:193 !\nInternal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP\nModules linked in:\nCPU: 0 PID: 6875 Comm: syz-executor.0 Not tainted 6.7.0-rc8-syzkaller-00101-g0802e17d9aca-dirty #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023\npstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : skb_panic net/core/skbuff.c:189 [inline]\n pc : skb_under_panic+0x13c/0x140 net/core/skbuff.c:203\n lr : skb_panic net/core/skbuff.c:189 [inline]\n lr : skb_under_panic+0x13c/0x140 net/core/skbuff.c:203\nsp : ffff800096f97000\nx29: ffff800096f97010 x28: ffff80008cc8d668 x27: dfff800000000000\nx26: ffff0000cb970c90 x25: 00000000000005dc x24: ffff0000c9c36ff2\nx23: ffff0000c9c37000 x22: 00000000000005ea x21: 00000000000006c0\nx20: 000000000000000e x19: ffff800088baa334 x18: 1fffe000368261ce\nx17: ffff80008e4ed000 x16: ffff80008a8310f8 x15: 0000000000000001\nx14: 1ffff00012df2d58 x13: 0000000000000000 x12: 0000000000000000\nx11: 0000000000000001 x10: 0000000000ff0100 x9 : e28a51f1087e8400\nx8 : e28a51f1087e8400 x7 : ffff80008028f8d0 x6 : 0000000000000000\nx5 : 0000000000000001 x4 : 0000000000000001 x3 : ffff800082b78714\nx2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000089\nCall trace:\n  skb_panic net/core/skbuff.c:189 [inline]\n  skb_under_panic+0x13c/0x140 net/core/skbuff.c:203\n  skb_push+0xf0/0x108 net/core/skbuff.c:2451\n  eth_header+0x44/0x1f8 net/ethernet/eth.c:83\n  dev_hard_header include/linux/netdevice.h:3188 [inline]\n  llc_mac_hdr_init+0x110/0x17c net/llc/llc_output.c:33\n  llc_sap_action_send_xid_c+0x170/0x344 net/llc/llc_s_ac.c:85\n  llc_exec_sap_trans_actions net/llc/llc_sap.c:153 [inline]\n  llc_sap_next_state net/llc/llc_sap.c:182 [inline]\n  llc_sap_state_process+0x1ec/0x774 net/llc/llc_sap.c:209\n  llc_build_and_send_xid_pkt+0x12c/0x1c0 net/llc/llc_sap.c:270\n  llc_ui_sendmsg+0x7bc/0xb1c net/llc/af_llc.c:997\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg net/socket.c:745 [inline]\n  sock_sendmsg+0x194/0x274 net/socket.c:767\n  splice_to_socket+0x7cc/0xd58 fs/splice.c:881\n  do_splice_from fs/splice.c:933 [inline]\n  direct_splice_actor+0xe4/0x1c0 fs/splice.c:1142\n  splice_direct_to_actor+0x2a0/0x7e4 fs/splice.c:1088\n  do_splice_direct+0x20c/0x348 fs/splice.c:1194\n  do_sendfile+0x4bc/0xc70 fs/read_write.c:1254\n  __do_sys_sendfile64 fs/read_write.c:1322 [inline]\n  __se_sys_sendfile64 fs/read_write.c:1308 [inline]\n  __arm64_sys_sendfile64+0x160/0x3b4 fs/read_write.c:1308\n  __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]\n  invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51\n  el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136\n  do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155\n  el0_svc+0x54/0x158 arch/arm64/kernel/entry-common.c:678\n  el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696\n  el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:595\nCode: aa1803e6 aa1903e7 a90023f5 94792f6a (d4210000)(CVE-2024-26636)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntcp: add sanity checks to rx zerocopy\r\n\r\nTCP rx zerocopy intent is to map pages initially allocated\nfrom NIC drivers, not pages owned by a fs.\r\n\r\nThis patch adds to can_map_frag() these additional checks:\r\n\r\n- Page must not be a compound one.\n- page-\u0026gt;mapping must be NULL.\r\n\r\nThis fixes the panic reported by ZhangPeng.\r\n\r\nsyzbot was able to loopback packets built with sendfile(),\nmapping pages owned by an ext4 file to TCP rx zerocopy.\r\n\r\nr3 = socket$inet_tcp(0x2, 0x1, 0x0)\nmmap(\u0026amp;(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x12, r3, 0x0)\nr4 = socket$inet_tcp(0x2, 0x1, 0x0)\nbind$inet(r4, \u0026amp;(0x7f0000000000)={0x2, 0x4e24, @multicast1}, 0x10)\nconnect$inet(r4, \u0026amp;(0x7f00000006c0)={0x2, 0x4e24, @empty}, 0x10)\nr5 = openat$dir(0xffffffffffffff9c, \u0026amp;(0x7f00000000c0)=\u0026apos;./file0\\x00\u0026apos;,\n    0x181e42, 0x0)\nfallocate(r5, 0x0, 0x0, 0x85b8)\nsendfile(r4, r5, 0x0, 0x8ba0)\ngetsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r4, 0x6, 0x23,\n    \u0026amp;(0x7f00000001c0)={\u0026amp;(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0,\n    0x0, 0x0, 0x0, 0x0}, \u0026amp;(0x7f0000000440)=0x40)\nr6 = openat$dir(0xffffffffffffff9c, \u0026amp;(0x7f00000000c0)=\u0026apos;./file0\\x00\u0026apos;,\n    0x181e42, 0x0)(CVE-2024-26640)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()\r\n\r\nsyzbot found __ip6_tnl_rcv() could access unitiliazed data [1].\r\n\r\nCall pskb_inet_may_pull() to fix this, and initialize ipv6h\nvariable after this call as it can change skb-\u0026gt;head.\r\n\r\n[1]\n BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]\n BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]\n BUG: KMSAN: uninit-value in IP6_ECN_decapsulate+0x7df/0x1e50 include/net/inet_ecn.h:321\n  __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]\n  INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]\n  IP6_ECN_decapsulate+0x7df/0x1e50 include/net/inet_ecn.h:321\n  ip6ip6_dscp_ecn_decapsulate+0x178/0x1b0 net/ipv6/ip6_tunnel.c:727\n  __ip6_tnl_rcv+0xd4e/0x1590 net/ipv6/ip6_tunnel.c:845\n  ip6_tnl_rcv+0xce/0x100 net/ipv6/ip6_tunnel.c:888\n gre_rcv+0x143f/0x1870\n  ip6_protocol_deliver_rcu+0xda6/0x2a60 net/ipv6/ip6_input.c:438\n  ip6_input_finish net/ipv6/ip6_input.c:483 [inline]\n  NF_HOOK include/linux/netfilter.h:314 [inline]\n  ip6_input+0x15d/0x430 net/ipv6/ip6_input.c:492\n  ip6_mc_input+0xa7e/0xc80 net/ipv6/ip6_input.c:586\n  dst_input include/net/dst.h:461 [inline]\n  ip6_rcv_finish+0x5db/0x870 net/ipv6/ip6_input.c:79\n  NF_HOOK include/linux/netfilter.h:314 [inline]\n  ipv6_rcv+0xda/0x390 net/ipv6/ip6_input.c:310\n  __netif_receive_skb_one_core net/core/dev.c:5532 [inline]\n  __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5646\n  netif_receive_skb_internal net/core/dev.c:5732 [inline]\n  netif_receive_skb+0x58/0x660 net/core/dev.c:5791\n  tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555\n  tun_get_user+0x53af/0x66d0 drivers/net/tun.c:2002\n  tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048\n  call_write_iter include/linux/fs.h:2084 [inline]\n  new_sync_write fs/read_write.c:497 [inline]\n  vfs_write+0x786/0x1200 fs/read_write.c:590\n  ksys_write+0x20f/0x4c0 fs/read_write.c:643\n  __do_sys_write fs/read_write.c:655 [inline]\n  __se_sys_write fs/read_write.c:652 [inline]\n  __x64_sys_write+0x93/0xd0 fs/read_write.c:652\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0x6d/0x140 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nUninit was created at:\n  slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768\n  slab_alloc_node mm/slub.c:3478 [inline]\n  kmem_cache_alloc_node+0x5e9/0xb10 mm/slub.c:3523\n  kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560\n  __alloc_skb+0x318/0x740 net/core/skbuff.c:651\n  alloc_skb include/linux/skbuff.h:1286 [inline]\n  alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6334\n  sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2787\n  tun_alloc_skb drivers/net/tun.c:1531 [inline]\n  tun_get_user+0x1e8a/0x66d0 drivers/net/tun.c:1846\n  tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048\n  call_write_iter include/linux/fs.h:2084 [inline]\n  new_sync_write fs/read_write.c:497 [inline]\n  vfs_write+0x786/0x1200 fs/read_write.c:590\n  ksys_write+0x20f/0x4c0 fs/read_write.c:643\n  __do_sys_write fs/read_write.c:655 [inline]\n  __se_sys_write fs/read_write.c:652 [inline]\n  __x64_sys_write+0x93/0xd0 fs/read_write.c:652\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0x6d/0x140 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nCPU: 0 PID: 5034 Comm: syz-executor331 Not tainted 6.7.0-syzkaller-00562-g9f8413c4a66f #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023(CVE-2024-26641)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nf_tables: disallow anonymous set with timeout flag\r\n\r\nAnonymous sets are never used with timeout from userspace, reject this.\nException to this rule is NFT_SET_EVAL to ensure legacy meters still work.(CVE-2024-26642)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntracing: Ensure visibility when inserting an element into tracing_map\r\n\r\nRunning the following two commands in parallel on a multi-processor\nAArch64 machine can sporadically produce an unexpected warning about\nduplicate histogram entries:\r\n\r\n $ while true; do\n     echo hist:key=id.syscall:val=hitcount \u0026gt; \\\n       /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/trigger\n     cat /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/hist\n     sleep 0.001\n   done\n $ stress-ng --sysbadaddr $(nproc)\r\n\r\nThe warning looks as follows:\r\n\r\n[ 2911.172474] ------------[ cut here ]------------\n[ 2911.173111] Duplicates detected: 1\n[ 2911.173574] WARNING: CPU: 2 PID: 12247 at kernel/trace/tracing_map.c:983 tracing_map_sort_entries+0x3e0/0x408\n[ 2911.174702] Modules linked in: iscsi_ibft(E) iscsi_boot_sysfs(E) rfkill(E) af_packet(E) nls_iso8859_1(E) nls_cp437(E) vfat(E) fat(E) ena(E) tiny_power_button(E) qemu_fw_cfg(E) button(E) fuse(E) efi_pstore(E) ip_tables(E) x_tables(E) xfs(E) libcrc32c(E) aes_ce_blk(E) aes_ce_cipher(E) crct10dif_ce(E) polyval_ce(E) polyval_generic(E) ghash_ce(E) gf128mul(E) sm4_ce_gcm(E) sm4_ce_ccm(E) sm4_ce(E) sm4_ce_cipher(E) sm4(E) sm3_ce(E) sm3(E) sha3_ce(E) sha512_ce(E) sha512_arm64(E) sha2_ce(E) sha256_arm64(E) nvme(E) sha1_ce(E) nvme_core(E) nvme_auth(E) t10_pi(E) sg(E) scsi_mod(E) scsi_common(E) efivarfs(E)\n[ 2911.174738] Unloaded tainted modules: cppc_cpufreq(E):1\n[ 2911.180985] CPU: 2 PID: 12247 Comm: cat Kdump: loaded Tainted: G            E      6.7.0-default #2 1b58bbb22c97e4399dc09f92d309344f69c44a01\n[ 2911.182398] Hardware name: Amazon EC2 c7g.8xlarge/, BIOS 1.0 11/1/2018\n[ 2911.183208] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n[ 2911.184038] pc : tracing_map_sort_entries+0x3e0/0x408\n[ 2911.184667] lr : tracing_map_sort_entries+0x3e0/0x408\n[ 2911.185310] sp : ffff8000a1513900\n[ 2911.185750] x29: ffff8000a1513900 x28: ffff0003f272fe80 x27: 0000000000000001\n[ 2911.186600] x26: ffff0003f272fe80 x25: 0000000000000030 x24: 0000000000000008\n[ 2911.187458] x23: ffff0003c5788000 x22: ffff0003c16710c8 x21: ffff80008017f180\n[ 2911.188310] x20: ffff80008017f000 x19: ffff80008017f180 x18: ffffffffffffffff\n[ 2911.189160] x17: 0000000000000000 x16: 0000000000000000 x15: ffff8000a15134b8\n[ 2911.190015] x14: 0000000000000000 x13: 205d373432323154 x12: 5b5d313131333731\n[ 2911.190844] x11: 00000000fffeffff x10: 00000000fffeffff x9 : ffffd1b78274a13c\n[ 2911.191716] x8 : 000000000017ffe8 x7 : c0000000fffeffff x6 : 000000000057ffa8\n[ 2911.192554] x5 : ffff0012f6c24ec0 x4 : 0000000000000000 x3 : ffff2e5b72b5d000\n[ 2911.193404] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0003ff254480\n[ 2911.194259] Call trace:\n[ 2911.194626]  tracing_map_sort_entries+0x3e0/0x408\n[ 2911.195220]  hist_show+0x124/0x800\n[ 2911.195692]  seq_read_iter+0x1d4/0x4e8\n[ 2911.196193]  seq_read+0xe8/0x138\n[ 2911.196638]  vfs_read+0xc8/0x300\n[ 2911.197078]  ksys_read+0x70/0x108\n[ 2911.197534]  __arm64_sys_read+0x24/0x38\n[ 2911.198046]  invoke_syscall+0x78/0x108\n[ 2911.198553]  el0_svc_common.constprop.0+0xd0/0xf8\n[ 2911.199157]  do_el0_svc+0x28/0x40\n[ 2911.199613]  el0_svc+0x40/0x178\n[ 2911.200048]  el0t_64_sync_handler+0x13c/0x158\n[ 2911.200621]  el0t_64_sync+0x1a8/0x1b0\n[ 2911.201115] ---[ end trace 0000000000000000 ]---\r\n\r\nThe problem appears to be caused by CPU reordering of writes issued from\n__tracing_map_insert().\r\n\r\nThe check for the presence of an element with a given key in this\nfunction is:\r\n\r\n val = READ_ONCE(entry-\u0026gt;val);\n if (val \u0026amp;\u0026amp; keys_match(key, val-\u0026gt;key, map-\u0026gt;key_size)) ...\r\n\r\nThe write of a new entry is:\r\n\r\n elt = get_free_elt(map);\n memcpy(elt-\u0026gt;key, key, map-\u0026gt;key_size);\n entry-\u0026gt;val = elt;\r\n\r\nThe \u0026quot;memcpy(elt-\u0026gt;key, key, map-\u0026gt;key_size);\u0026quot; and \u0026quot;entry-\u0026gt;val = elt;\u0026quot;\nstores may become visible in the reversed order on another CPU. This\nsecond CPU might then incorrectly determine that a new key doesn\u0026apos;t match\nan already present val-\u0026gt;key and subse\n---truncated---(CVE-2024-26645)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/amd/display: Add NULL test for \u0026apos;timing generator\u0026apos; in \u0026apos;dcn21_set_pipe()\u0026apos;\r\n\r\nIn \u0026quot;u32 otg_inst = pipe_ctx-\u0026gt;stream_res.tg-\u0026gt;inst;\u0026quot;\npipe_ctx-\u0026gt;stream_res.tg could be NULL, it is relying on the caller to\nensure the tg is not NULL.(CVE-2024-26661)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntunnels: fix out of bounds access when building IPv6 PMTU error\r\n\r\nIf the ICMPv6 error is built from a non-linear skb we get the following\nsplat,\r\n\r\n  BUG: KASAN: slab-out-of-bounds in do_csum+0x220/0x240\n  Read of size 4 at addr ffff88811d402c80 by task netperf/820\n  CPU: 0 PID: 820 Comm: netperf Not tainted 6.8.0-rc1+ #543\n  ...\n   kasan_report+0xd8/0x110\n   do_csum+0x220/0x240\n   csum_partial+0xc/0x20\n   skb_tunnel_check_pmtu+0xeb9/0x3280\n   vxlan_xmit_one+0x14c2/0x4080\n   vxlan_xmit+0xf61/0x5c00\n   dev_hard_start_xmit+0xfb/0x510\n   __dev_queue_xmit+0x7cd/0x32a0\n   br_dev_queue_push_xmit+0x39d/0x6a0\r\n\r\nUse skb_checksum instead of csum_partial who cannot deal with non-linear\nSKBs.(CVE-2024-26665)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nft_limit: reject configurations that cause integer overflow\r\n\r\nReject bogus configs where internal token counter wraps around.\nThis only occurs with very very large requests, such as 17gbyte/s.\r\n\r\nIts better to reject this rather than having incorrect ratelimit.(CVE-2024-26668)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/sched: flower: Fix chain template offload\r\n\r\nWhen a qdisc is deleted from a net device the stack instructs the\nunderlying driver to remove its flow offload callback from the\nassociated filter block using the \u0026apos;FLOW_BLOCK_UNBIND\u0026apos; command. The stack\nthen continues to replay the removal of the filters in the block for\nthis driver by iterating over the chains in the block and invoking the\n\u0026apos;reoffload\u0026apos; operation of the classifier being used. In turn, the\nclassifier in its \u0026apos;reoffload\u0026apos; operation prepares and emits a\n\u0026apos;FLOW_CLS_DESTROY\u0026apos; command for each filter.\r\n\r\nHowever, the stack does not do the same for chain templates and the\nunderlying driver never receives a \u0026apos;FLOW_CLS_TMPLT_DESTROY\u0026apos; command when\na qdisc is deleted. This results in a memory leak [1] which can be\nreproduced using [2].\r\n\r\nFix by introducing a \u0026apos;tmplt_reoffload\u0026apos; operation and have the stack\ninvoke it with the appropriate arguments as part of the replay.\nImplement the operation in the sole classifier that supports chain\ntemplates (flower) by emitting the \u0026apos;FLOW_CLS_TMPLT_{CREATE,DESTROY}\u0026apos;\ncommand based on whether a flow offload callback is being bound to a\nfilter block or being unbound from one.\r\n\r\nAs far as I can tell, the issue happens since cited commit which\nreordered tcf_block_offload_unbind() before tcf_block_flush_all_chains()\nin __tcf_block_put(). The order cannot be reversed as the filter block\nis expected to be freed after flushing all the chains.\r\n\r\n[1]\nunreferenced object 0xffff888107e28800 (size 2048):\n  comm \u0026quot;tc\u0026quot;, pid 1079, jiffies 4294958525 (age 3074.287s)\n  hex dump (first 32 bytes):\n    b1 a6 7c 11 81 88 ff ff e0 5b b3 10 81 88 ff ff  ..|......[......\n    01 00 00 00 00 00 00 00 e0 aa b0 84 ff ff ff ff  ................\n  backtrace:\n    [\u0026lt;ffffffff81c06a68\u0026gt;] __kmem_cache_alloc_node+0x1e8/0x320\n    [\u0026lt;ffffffff81ab374e\u0026gt;] __kmalloc+0x4e/0x90\n    [\u0026lt;ffffffff832aec6d\u0026gt;] mlxsw_sp_acl_ruleset_get+0x34d/0x7a0\n    [\u0026lt;ffffffff832bc195\u0026gt;] mlxsw_sp_flower_tmplt_create+0x145/0x180\n    [\u0026lt;ffffffff832b2e1a\u0026gt;] mlxsw_sp_flow_block_cb+0x1ea/0x280\n    [\u0026lt;ffffffff83a10613\u0026gt;] tc_setup_cb_call+0x183/0x340\n    [\u0026lt;ffffffff83a9f85a\u0026gt;] fl_tmplt_create+0x3da/0x4c0\n    [\u0026lt;ffffffff83a22435\u0026gt;] tc_ctl_chain+0xa15/0x1170\n    [\u0026lt;ffffffff838a863c\u0026gt;] rtnetlink_rcv_msg+0x3cc/0xed0\n    [\u0026lt;ffffffff83ac87f0\u0026gt;] netlink_rcv_skb+0x170/0x440\n    [\u0026lt;ffffffff83ac6270\u0026gt;] netlink_unicast+0x540/0x820\n    [\u0026lt;ffffffff83ac6e28\u0026gt;] netlink_sendmsg+0x8d8/0xda0\n    [\u0026lt;ffffffff83793def\u0026gt;] ____sys_sendmsg+0x30f/0xa80\n    [\u0026lt;ffffffff8379d29a\u0026gt;] ___sys_sendmsg+0x13a/0x1e0\n    [\u0026lt;ffffffff8379d50c\u0026gt;] __sys_sendmsg+0x11c/0x1f0\n    [\u0026lt;ffffffff843b9ce0\u0026gt;] do_syscall_64+0x40/0xe0\nunreferenced object 0xffff88816d2c0400 (size 1024):\n  comm \u0026quot;tc\u0026quot;, pid 1079, jiffies 4294958525 (age 3074.287s)\n  hex dump (first 32 bytes):\n    40 00 00 00 00 00 00 00 57 f6 38 be 00 00 00 00  @.......W.8.....\n    10 04 2c 6d 81 88 ff ff 10 04 2c 6d 81 88 ff ff  ..,m......,m....\n  backtrace:\n    [\u0026lt;ffffffff81c06a68\u0026gt;] __kmem_cache_alloc_node+0x1e8/0x320\n    [\u0026lt;ffffffff81ab36c1\u0026gt;] __kmalloc_node+0x51/0x90\n    [\u0026lt;ffffffff81a8ed96\u0026gt;] kvmalloc_node+0xa6/0x1f0\n    [\u0026lt;ffffffff82827d03\u0026gt;] bucket_table_alloc.isra.0+0x83/0x460\n    [\u0026lt;ffffffff82828d2b\u0026gt;] rhashtable_init+0x43b/0x7c0\n    [\u0026lt;ffffffff832aed48\u0026gt;] mlxsw_sp_acl_ruleset_get+0x428/0x7a0\n    [\u0026lt;ffffffff832bc195\u0026gt;] mlxsw_sp_flower_tmplt_create+0x145/0x180\n    [\u0026lt;ffffffff832b2e1a\u0026gt;] mlxsw_sp_flow_block_cb+0x1ea/0x280\n    [\u0026lt;ffffffff83a10613\u0026gt;] tc_setup_cb_call+0x183/0x340\n    [\u0026lt;ffffffff83a9f85a\u0026gt;] fl_tmplt_create+0x3da/0x4c0\n    [\u0026lt;ffffffff83a22435\u0026gt;] tc_ctl_chain+0xa15/0x1170\n    [\u0026lt;ffffffff838a863c\u0026gt;] rtnetlink_rcv_msg+0x3cc/0xed0\n    [\u0026lt;ffffffff83ac87f0\u0026gt;] netlink_rcv_skb+0x170/0x440\n    [\u0026lt;ffffffff83ac6270\u0026gt;] netlink_unicast+0x540/0x820\n    [\u0026lt;ffffffff83ac6e28\u0026gt;] netlink_sendmsg+0x8d8/0xda0\n    [\u0026lt;ffffffff83793def\u0026gt;] ____sys_sendmsg+0x30f/0xa80\r\n\r\n[2]\n # tc qdisc add dev swp1 clsact\n # tc chain add dev swp1 ingress proto ip chain 1 flower dst_ip 0.0.0.0/32\n # tc qdisc del dev\n---truncated---(CVE-2024-26669)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nppp_async: limit MRU to 64K\r\n\r\nsyzbot triggered a warning [1] in __alloc_pages():\r\n\r\nWARN_ON_ONCE_GFP(order \u0026gt; MAX_PAGE_ORDER, gfp)\r\n\r\nWillem fixed a similar issue in commit c0a2a1b0d631 (\u0026quot;ppp: limit MRU to 64K\u0026quot;)\r\n\r\nAdopt the same sanity check for ppp_async_ioctl(PPPIOCSMRU)\r\n\r\n[1]:\r\n\r\n WARNING: CPU: 1 PID: 11 at mm/page_alloc.c:4543 __alloc_pages+0x308/0x698 mm/page_alloc.c:4543\nModules linked in:\nCPU: 1 PID: 11 Comm: kworker/u4:0 Not tainted 6.8.0-rc2-syzkaller-g41bccc98fb79 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023\nWorkqueue: events_unbound flush_to_ldisc\npstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : __alloc_pages+0x308/0x698 mm/page_alloc.c:4543\n lr : __alloc_pages+0xc8/0x698 mm/page_alloc.c:4537\nsp : ffff800093967580\nx29: ffff800093967660 x28: ffff8000939675a0 x27: dfff800000000000\nx26: ffff70001272ceb4 x25: 0000000000000000 x24: ffff8000939675c0\nx23: 0000000000000000 x22: 0000000000060820 x21: 1ffff0001272ceb8\nx20: ffff8000939675e0 x19: 0000000000000010 x18: ffff800093967120\nx17: ffff800083bded5c x16: ffff80008ac97500 x15: 0000000000000005\nx14: 1ffff0001272cebc x13: 0000000000000000 x12: 0000000000000000\nx11: ffff70001272cec1 x10: 1ffff0001272cec0 x9 : 0000000000000001\nx8 : ffff800091c91000 x7 : 0000000000000000 x6 : 000000000000003f\nx5 : 00000000ffffffff x4 : 0000000000000000 x3 : 0000000000000020\nx2 : 0000000000000008 x1 : 0000000000000000 x0 : ffff8000939675e0\nCall trace:\n  __alloc_pages+0x308/0x698 mm/page_alloc.c:4543\n  __alloc_pages_node include/linux/gfp.h:238 [inline]\n  alloc_pages_node include/linux/gfp.h:261 [inline]\n  __kmalloc_large_node+0xbc/0x1fc mm/slub.c:3926\n  __do_kmalloc_node mm/slub.c:3969 [inline]\n  __kmalloc_node_track_caller+0x418/0x620 mm/slub.c:4001\n  kmalloc_reserve+0x17c/0x23c net/core/skbuff.c:590\n  __alloc_skb+0x1c8/0x3d8 net/core/skbuff.c:651\n  __netdev_alloc_skb+0xb8/0x3e8 net/core/skbuff.c:715\n  netdev_alloc_skb include/linux/skbuff.h:3235 [inline]\n  dev_alloc_skb include/linux/skbuff.h:3248 [inline]\n  ppp_async_input drivers/net/ppp/ppp_async.c:863 [inline]\n  ppp_asynctty_receive+0x588/0x186c drivers/net/ppp/ppp_async.c:341\n  tty_ldisc_receive_buf+0x12c/0x15c drivers/tty/tty_buffer.c:390\n  tty_port_default_receive_buf+0x74/0xac drivers/tty/tty_port.c:37\n  receive_buf drivers/tty/tty_buffer.c:444 [inline]\n  flush_to_ldisc+0x284/0x6e4 drivers/tty/tty_buffer.c:494\n  process_one_work+0x694/0x1204 kernel/workqueue.c:2633\n  process_scheduled_works kernel/workqueue.c:2706 [inline]\n  worker_thread+0x938/0xef4 kernel/workqueue.c:2787\n  kthread+0x288/0x310 kernel/kthread.c:388\n  ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860(CVE-2024-26675)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ninet: read sk-\u0026gt;sk_family once in inet_recv_error()\r\n\r\ninet_recv_error() is called without holding the socket lock.\r\n\r\nIPv6 socket could mutate to IPv4 with IPV6_ADDRFORM\nsocket option and trigger a KCSAN warning.(CVE-2024-26679)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: atlantic: Fix DMA mapping for PTP hwts ring\r\n\r\nFunction aq_ring_hwts_rx_alloc() maps extra AQ_CFG_RXDS_DEF bytes\nfor PTP HWTS ring but then generic aq_ring_free() does not take this\ninto account.\nCreate and use a specific function to free HWTS ring to fix this\nissue.\r\n\r\nTrace:\n[  215.351607] ------------[ cut here ]------------\n[  215.351612] DMA-API: atlantic 0000:4b:00.0: device driver frees DMA memory with different size [device address=0x00000000fbdd0000] [map size=34816 bytes] [unmap size=32768 bytes]\n[  215.351635] WARNING: CPU: 33 PID: 10759 at kernel/dma/debug.c:988 check_unmap+0xa6f/0x2360\n...\n[  215.581176] Call Trace:\n[  215.583632]  \u0026lt;TASK\u0026gt;\n[  215.585745]  ? show_trace_log_lvl+0x1c4/0x2df\n[  215.590114]  ? show_trace_log_lvl+0x1c4/0x2df\n[  215.594497]  ? debug_dma_free_coherent+0x196/0x210\n[  215.599305]  ? check_unmap+0xa6f/0x2360\n[  215.603147]  ? __warn+0xca/0x1d0\n[  215.606391]  ? check_unmap+0xa6f/0x2360\n[  215.610237]  ? report_bug+0x1ef/0x370\n[  215.613921]  ? handle_bug+0x3c/0x70\n[  215.617423]  ? exc_invalid_op+0x14/0x50\n[  215.621269]  ? asm_exc_invalid_op+0x16/0x20\n[  215.625480]  ? check_unmap+0xa6f/0x2360\n[  215.629331]  ? mark_lock.part.0+0xca/0xa40\n[  215.633445]  debug_dma_free_coherent+0x196/0x210\n[  215.638079]  ? __pfx_debug_dma_free_coherent+0x10/0x10\n[  215.643242]  ? slab_free_freelist_hook+0x11d/0x1d0\n[  215.648060]  dma_free_attrs+0x6d/0x130\n[  215.651834]  aq_ring_free+0x193/0x290 [atlantic]\n[  215.656487]  aq_ptp_ring_free+0x67/0x110 [atlantic]\n...\n[  216.127540] ---[ end trace 6467e5964dd2640b ]---\n[  216.132160] DMA-API: Mapped at:\n[  216.132162]  debug_dma_alloc_coherent+0x66/0x2f0\n[  216.132165]  dma_alloc_attrs+0xf5/0x1b0\n[  216.132168]  aq_ring_hwts_rx_alloc+0x150/0x1f0 [atlantic]\n[  216.132193]  aq_ptp_ring_alloc+0x1bb/0x540 [atlantic]\n[  216.132213]  aq_nic_init+0x4a1/0x760 [atlantic](CVE-2024-26680)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: stmmac: xgmac: fix handling of DPP safety error for DMA channels\r\n\r\nCommit 56e58d6c8a56 (\u0026quot;net: stmmac: Implement Safety Features in\nXGMAC core\u0026quot;) checks and reports safety errors, but leaves the\nData Path Parity Errors for each channel in DMA unhandled at all, lead to\na storm of interrupt.\nFix it by checking and clearing the DMA_DPP_Interrupt_Status register.(CVE-2024-26684)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnilfs2: fix potential bug in end_buffer_async_write\r\n\r\nAccording to a syzbot report, end_buffer_async_write(), which handles the\ncompletion of block device writes, may detect abnormal condition of the\nbuffer async_write flag and cause a BUG_ON failure when using nilfs2.\r\n\r\nNilfs2 itself does not use end_buffer_async_write().  But, the async_write\nflag is now used as a marker by commit 7f42ec394156 (\u0026quot;nilfs2: fix issue\nwith race condition of competition between segments for dirty blocks\u0026quot;) as\na means of resolving double list insertion of dirty blocks in\nnilfs_lookup_dirty_data_buffers() and nilfs_lookup_node_buffers() and the\nresulting crash.\r\n\r\nThis modification is safe as long as it is used for file data and b-tree\nnode blocks where the page caches are independent.  However, it was\nirrelevant and redundant to also introduce async_write for segment summary\nand super root blocks that share buffers with the backing device.  This\nled to the possibility that the BUG_ON check in end_buffer_async_write\nwould fail as described above, if independent writebacks of the backing\ndevice occurred in parallel.\r\n\r\nThe use of async_write for segment summary buffers has already been\nremoved in a previous change.\r\n\r\nFix this issue by removing the manipulation of the async_write flag for\nthe remaining super root block buffer.(CVE-2024-26685)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nfs/proc: do_task_stat: use sig-\u0026gt;stats_lock to gather the threads/children stats\r\n\r\nlock_task_sighand() can trigger a hard lockup.  If NR_CPUS threads call\ndo_task_stat() at the same time and the process has NR_THREADS, it will\nspin with irqs disabled O(NR_CPUS * NR_THREADS) time.\r\n\r\nChange do_task_stat() to use sig-\u0026gt;stats_lock to gather the statistics\noutside of -\u0026gt;siglock protected section, in the likely case this code will\nrun lockless.(CVE-2024-26686)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nceph: prevent use-after-free in encode_cap_msg()\r\n\r\nIn fs/ceph/caps.c, in encode_cap_msg(), \u0026quot;use after free\u0026quot; error was\ncaught by KASAN at this line - \u0026apos;ceph_buffer_get(arg-\u0026gt;xattr_buf);\u0026apos;. This\nimplies before the refcount could be increment here, it was freed.\r\n\r\nIn same file, in \u0026quot;handle_cap_grant()\u0026quot; refcount is decremented by this\nline - \u0026apos;ceph_buffer_put(ci-\u0026gt;i_xattrs.blob);\u0026apos;. It appears that a race\noccurred and resource was freed by the latter line before the former\nline could increment it.\r\n\r\nencode_cap_msg() is called by __send_cap() and __send_cap() is called by\nceph_check_caps() after calling __prep_cap(). __prep_cap() is where\narg-\u0026gt;xattr_buf is assigned to ci-\u0026gt;i_xattrs.blob. This is the spot where\nthe refcount must be increased to prevent \u0026quot;use after free\u0026quot; error.(CVE-2024-26689)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnilfs2: fix data corruption in dsync block recovery for small block sizes\r\n\r\nThe helper function nilfs_recovery_copy_block() of\nnilfs_recovery_dsync_blocks(), which recovers data from logs created by\ndata sync writes during a mount after an unclean shutdown, incorrectly\ncalculates the on-page offset when copying repair data to the file\u0026apos;s page\ncache.  In environments where the block size is smaller than the page\nsize, this flaw can cause data corruption and leak uninitialized memory\nbytes during the recovery process.\r\n\r\nFix these issues by correcting this byte offset calculation on the page.(CVE-2024-26697)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\niio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC\r\n\r\nRecently, we encounter kernel crash in function rm3100_common_probe\ncaused by out of bound access of array rm3100_samp_rates (because of\nunderlying hardware failures). Add boundary check to prevent out of\nbound access.(CVE-2024-26702)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nparisc: Fix random data corruption from exception handler\r\n\r\nThe current exception handler implementation, which assists when accessing\nuser space memory, may exhibit random data corruption if the compiler decides\nto use a different register than the specified register %r29 (defined in\nASM_EXCEPTIONTABLE_REG) for the error code. If the compiler choose another\nregister, the fault handler will nevertheless store -EFAULT into %r29 and thus\ntrash whatever this register is used for.\nLooking at the assembly I found that this happens sometimes in emulate_ldd().\r\n\r\nTo solve the issue, the easiest solution would be if it somehow is\npossible to tell the fault handler which register is used to hold the error\ncode. Using %0 or %1 in the inline assembly is not posssible as it will show\nup as e.g. %r29 (with the \u0026quot;%r\u0026quot; prefix), which the GNU assembler can not\nconvert to an integer.\r\n\r\nThis patch takes another, better and more flexible approach:\nWe extend the __ex_table (which is out of the execution path) by one 32-word.\nIn this word we tell the compiler to insert the assembler instruction\n\u0026quot;or %r0,%r0,%reg\u0026quot;, where %reg references the register which the compiler\nchoosed for the error return code.\nIn case of an access failure, the fault handler finds the __ex_table entry and\ncan examine the opcode. The used register is encoded in the lowest 5 bits, and\nthe fault handler can then store -EFAULT into this register.\r\n\r\nSince we extend the __ex_table to 3 words we can\u0026apos;t use the BUILDTIME_TABLE_SORT\nconfig option any longer.(CVE-2024-26706)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: hsr: remove WARN_ONCE() in send_hsr_supervision_frame()\r\n\r\nSyzkaller reported [1] hitting a warning after failing to allocate\nresources for skb in hsr_init_skb(). Since a WARN_ONCE() call will\nnot help much in this case, it might be prudent to switch to\nnetdev_warn_once(). At the very least it will suppress syzkaller\nreports such as [1].\r\n\r\nJust in case, use netdev_warn_once() in send_prp_supervision_frame()\nfor similar reasons.\r\n\r\n[1]\nHSR: Could not send supervision frame\nWARNING: CPU: 1 PID: 85 at net/hsr/hsr_device.c:294 send_hsr_supervision_frame+0x60a/0x810 net/hsr/hsr_device.c:294\nRIP: 0010:send_hsr_supervision_frame+0x60a/0x810 net/hsr/hsr_device.c:294\n...\nCall Trace:\n \u0026lt;IRQ\u0026gt;\n hsr_announce+0x114/0x370 net/hsr/hsr_device.c:382\n call_timer_fn+0x193/0x590 kernel/time/timer.c:1700\n expire_timers kernel/time/timer.c:1751 [inline]\n __run_timers+0x764/0xb20 kernel/time/timer.c:2022\n run_timer_softirq+0x58/0xd0 kernel/time/timer.c:2035\n __do_softirq+0x21a/0x8de kernel/softirq.c:553\n invoke_softirq kernel/softirq.c:427 [inline]\n __irq_exit_rcu kernel/softirq.c:632 [inline]\n irq_exit_rcu+0xb7/0x120 kernel/softirq.c:644\n sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1076\n \u0026lt;/IRQ\u0026gt;\n \u0026lt;TASK\u0026gt;\n asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649\n...\r\n\r\nThis issue is also found in older kernels (at least up to 5.10).(CVE-2024-26707)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\npowerpc/kasan: Fix addr error caused by page alignment\r\n\r\nIn kasan_init_region, when k_start is not page aligned, at the begin of\nfor loop, k_cur = k_start \u0026amp; PAGE_MASK is less than k_start, and then\n`va = block + k_cur - k_start` is less than block, the addr va is invalid,\nbecause the memory address space from va to block is not alloced by\nmemblock_alloc, which will not be reserved by memblock_reserve later, it\nwill be used by other places.\r\n\r\nAs a result, memory overwriting occurs.\r\n\r\nfor example:\nint __init __weak kasan_init_region(void *start, size_t size)\n{\n[...]\n\t/* if say block(dcd97000) k_start(feef7400) k_end(feeff3fe) */\n\tblock = memblock_alloc(k_end - k_start, PAGE_SIZE);\n\t[...]\n\tfor (k_cur = k_start \u0026amp; PAGE_MASK; k_cur \u0026lt; k_end; k_cur += PAGE_SIZE) {\n\t\t/* at the begin of for loop\n\t\t * block(dcd97000) va(dcd96c00) k_cur(feef7000) k_start(feef7400)\n\t\t * va(dcd96c00) is less than block(dcd97000), va is invalid\n\t\t */\n\t\tvoid *va = block + k_cur - k_start;\n\t\t[...]\n\t}\n[...]\n}\r\n\r\nTherefore, page alignment is performed on k_start before\nmemblock_alloc() to ensure the validity of the VA address.(CVE-2024-26712)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again\r\n\r\n(struct dirty_throttle_control *)-\u0026gt;thresh is an unsigned long, but is\npassed as the u32 divisor argument to div_u64().  On architectures where\nunsigned long is 64 bytes, the argument will be implicitly truncated.\r\n\r\nUse div64_u64() instead of div_u64() so that the value used in the \u0026quot;is\nthis a safe division\u0026quot; check is the same as the divisor.\r\n\r\nAlso, remove redundant cast of the numerator to u64, as that should happen\nimplicitly.\r\n\r\nThis would be difficult to exploit in memcg domain, given the ratio-based\narithmetic domain_drity_limits() uses, but is much easier in global\nwriteback domain with a BDI_CAP_STRICTLIMIT-backing device, using e.g. \nvm.dirty_bytes=(1\u0026lt;\u0026lt;32)*PAGE_SIZE so that dtc-\u0026gt;thresh == (1\u0026lt;\u0026lt;32)(CVE-2024-26720)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbtrfs: don\u0026apos;t drop extent_map for free space inode on write error\r\n\r\nWhile running the CI for an unrelated change I hit the following panic\nwith generic/648 on btrfs_holes_spacecache.\r\n\r\nassertion failed: block_start != EXTENT_MAP_HOLE, in fs/btrfs/extent_io.c:1385\n------------[ cut here ]------------\nkernel BUG at fs/btrfs/extent_io.c:1385!\ninvalid opcode: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 1 PID: 2695096 Comm: fsstress Kdump: loaded Tainted: G        W          6.8.0-rc2+ #1\nRIP: 0010:__extent_writepage_io.constprop.0+0x4c1/0x5c0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n extent_write_cache_pages+0x2ac/0x8f0\n extent_writepages+0x87/0x110\n do_writepages+0xd5/0x1f0\n filemap_fdatawrite_wbc+0x63/0x90\n __filemap_fdatawrite_range+0x5c/0x80\n btrfs_fdatawrite_range+0x1f/0x50\n btrfs_write_out_cache+0x507/0x560\n btrfs_write_dirty_block_groups+0x32a/0x420\n commit_cowonly_roots+0x21b/0x290\n btrfs_commit_transaction+0x813/0x1360\n btrfs_sync_file+0x51a/0x640\n __x64_sys_fdatasync+0x52/0x90\n do_syscall_64+0x9c/0x190\n entry_SYSCALL_64_after_hwframe+0x6e/0x76\r\n\r\nThis happens because we fail to write out the free space cache in one\ninstance, come back around and attempt to write it again.  However on\nthe second pass through we go to call btrfs_get_extent() on the inode to\nget the extent mapping.  Because this is a new block group, and with the\nfree space inode we always search the commit root to avoid deadlocking\nwith the tree, we find nothing and return a EXTENT_MAP_HOLE for the\nrequested range.\r\n\r\nThis happens because the first time we try to write the space cache out\nwe hit an error, and on an error we drop the extent mapping.  This is\nnormal for normal files, but the free space cache inode is special.  We\nalways expect the extent map to be correct.  Thus the second time\nthrough we end up with a bogus extent map.\r\n\r\nSince we\u0026apos;re deprecating this feature, the most straightforward way to\nfix this is to simply skip dropping the extent map range for this failed\nrange.\r\n\r\nI shortened the test by using error injection to stress the area to make\nit easier to reproduce.  With this patch in place we no longer panic\nwith my error injection test.(CVE-2024-26726)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\narp: Prevent overflow in arp_req_get().\r\n\r\nsyzkaller reported an overflown write in arp_req_get(). [0]\r\n\r\nWhen ioctl(SIOCGARP) is issued, arp_req_get() looks up an neighbour\nentry and copies neigh-\u0026gt;ha to struct arpreq.arp_ha.sa_data.\r\n\r\nThe arp_ha here is struct sockaddr, not struct sockaddr_storage, so\nthe sa_data buffer is just 14 bytes.\r\n\r\nIn the splat below, 2 bytes are overflown to the next int field,\narp_flags.  We initialise the field just after the memcpy(), so it\u0026apos;s\nnot a problem.\r\n\r\nHowever, when dev-\u0026gt;addr_len is greater than 22 (e.g. MAX_ADDR_LEN),\narp_netmask is overwritten, which could be set as htonl(0xFFFFFFFFUL)\nin arp_ioctl() before calling arp_req_get().\r\n\r\nTo avoid the overflow, let\u0026apos;s limit the max length of memcpy().\r\n\r\nNote that commit b5f0de6df6dc (\u0026quot;net: dev: Convert sa_data to flexible\narray in struct sockaddr\u0026quot;) just silenced syzkaller.\r\n\r\n[0]:\nmemcpy: detected field-spanning write (size 16) of single field \u0026quot;r-\u0026gt;arp_ha.sa_data\u0026quot; at net/ipv4/arp.c:1128 (size 14)\nWARNING: CPU: 0 PID: 144638 at net/ipv4/arp.c:1128 arp_req_get+0x411/0x4a0 net/ipv4/arp.c:1128\nModules linked in:\nCPU: 0 PID: 144638 Comm: syz-executor.4 Not tainted 6.1.74 #31\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-5 04/01/2014\nRIP: 0010:arp_req_get+0x411/0x4a0 net/ipv4/arp.c:1128\nCode: fd ff ff e8 41 42 de fb b9 0e 00 00 00 4c 89 fe 48 c7 c2 20 6d ab 87 48 c7 c7 80 6d ab 87 c6 05 25 af 72 04 01 e8 5f 8d ad fb \u0026lt;0f\u0026gt; 0b e9 6c fd ff ff e8 13 42 de fb be 03 00 00 00 4c 89 e7 e8 a6\nRSP: 0018:ffffc900050b7998 EFLAGS: 00010286\nRAX: 0000000000000000 RBX: ffff88803a815000 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: ffffffff8641a44a RDI: 0000000000000001\nRBP: ffffc900050b7a98 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000000 R11: 203a7970636d656d R12: ffff888039c54000\nR13: 1ffff92000a16f37 R14: ffff88803a815084 R15: 0000000000000010\nFS:  00007f172bf306c0(0000) GS:ffff88805aa00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f172b3569f0 CR3: 0000000057f12005 CR4: 0000000000770ef0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n \u0026lt;TASK\u0026gt;\n arp_ioctl+0x33f/0x4b0 net/ipv4/arp.c:1261\n inet_ioctl+0x314/0x3a0 net/ipv4/af_inet.c:981\n sock_do_ioctl+0xdf/0x260 net/socket.c:1204\n sock_ioctl+0x3ef/0x650 net/socket.c:1321\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:870 [inline]\n __se_sys_ioctl fs/ioctl.c:856 [inline]\n __x64_sys_ioctl+0x18e/0x220 fs/ioctl.c:856\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x37/0x90 arch/x86/entry/common.c:81\n entry_SYSCALL_64_after_hwframe+0x64/0xce\nRIP: 0033:0x7f172b262b8d\nCode: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f172bf300b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 00007f172b3abf80 RCX: 00007f172b262b8d\nRDX: 0000000020000000 RSI: 0000000000008954 RDI: 0000000000000003\nRBP: 00007f172b2d3493 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 000000000000000b R14: 00007f172b3abf80 R15: 00007f172bf10000\n \u0026lt;/TASK\u0026gt;(CVE-2024-26733)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndevlink: fix possible use-after-free and memory leaks in devlink_init()\r\n\r\nThe pernet operations structure for the subsystem must be registered\nbefore registering the generic netlink family.\r\n\r\nMake an unregister in case of unsuccessful registration.(CVE-2024-26734)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nipv6: sr: fix possible use-after-free and null-ptr-deref\r\n\r\nThe pernet operations structure for the subsystem must be registered\nbefore registering the generic netlink family.(CVE-2024-26735)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/sched: act_mirred: use the backlog for mirred ingress\r\n\r\nThe test Davide added in commit ca22da2fbd69 (\u0026quot;act_mirred: use the backlog\nfor nested calls to mirred ingress\u0026quot;) hangs our testing VMs every 10 or so\nruns, with the familiar tcp_v4_rcv -\u0026gt; tcp_v4_rcv deadlock reported by\nlockdep.\r\n\r\nThe problem as previously described by Davide (see Link) is that\nif we reverse flow of traffic with the redirect (egress -\u0026gt; ingress)\nwe may reach the same socket which generated the packet. And we may\nstill be holding its socket lock. The common solution to such deadlocks\nis to put the packet in the Rx backlog, rather than run the Rx path\ninline. Do that for all egress -\u0026gt; ingress reversals, not just once\nwe started to nest mirred calls.\r\n\r\nIn the past there was a concern that the backlog indirection will\nlead to loss of error reporting / less accurate stats. But the current\nworkaround does not seem to address the issue.(CVE-2024-26740)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nRDMA/qedr: Fix qedr_create_user_qp error flow\r\n\r\nAvoid the following warning by making sure to free the allocated\nresources in case that qedr_init_user_queue() fail.\r\n\r\n-----------[ cut here ]-----------\nWARNING: CPU: 0 PID: 143192 at drivers/infiniband/core/rdma_core.c:874 uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]\nModules linked in: tls target_core_user uio target_core_pscsi target_core_file target_core_iblock ib_srpt ib_srp scsi_transport_srp nfsd nfs_acl rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs 8021q garp mrp stp llc ext4 mbcache jbd2 opa_vnic ib_umad ib_ipoib sunrpc rdma_ucm ib_isert iscsi_target_mod target_core_mod ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm hfi1 intel_rapl_msr intel_rapl_common mgag200 qedr sb_edac drm_shmem_helper rdmavt x86_pkg_temp_thermal drm_kms_helper intel_powerclamp ib_uverbs coretemp i2c_algo_bit kvm_intel dell_wmi_descriptor ipmi_ssif sparse_keymap kvm ib_core rfkill syscopyarea sysfillrect video sysimgblt irqbypass ipmi_si ipmi_devintf fb_sys_fops rapl iTCO_wdt mxm_wmi iTCO_vendor_support intel_cstate pcspkr dcdbas intel_uncore ipmi_msghandler lpc_ich acpi_power_meter mei_me mei fuse drm xfs libcrc32c qede sd_mod ahci libahci t10_pi sg crct10dif_pclmul crc32_pclmul crc32c_intel qed libata tg3\nghash_clmulni_intel megaraid_sas crc8 wmi [last unloaded: ib_srpt]\nCPU: 0 PID: 143192 Comm: fi_rdm_tagged_p Kdump: loaded Not tainted 5.14.0-408.el9.x86_64 #1\nHardware name: Dell Inc. PowerEdge R430/03XKDV, BIOS 2.14.0 01/25/2022\nRIP: 0010:uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]\nCode: 5d 41 5c 41 5d 41 5e e9 0f 26 1b dd 48 89 df e8 67 6a ff ff 49 8b 86 10 01 00 00 48 85 c0 74 9c 4c 89 e7 e8 83 c0 cb dd eb 92 \u0026lt;0f\u0026gt; 0b eb be 0f 0b be 04 00 00 00 48 89 df e8 8e f5 ff ff e9 6d ff\nRSP: 0018:ffffb7c6cadfbc60 EFLAGS: 00010286\nRAX: ffff8f0889ee3f60 RBX: ffff8f088c1a5200 RCX: 00000000802a0016\nRDX: 00000000802a0017 RSI: 0000000000000001 RDI: ffff8f0880042600\nRBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000\nR10: ffff8f11fffd5000 R11: 0000000000039000 R12: ffff8f0d5b36cd80\nR13: ffff8f088c1a5250 R14: ffff8f1206d91000 R15: 0000000000000000\nFS: 0000000000000000(0000) GS:ffff8f11d7c00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000147069200e20 CR3: 00000001c7210002 CR4: 00000000001706f0\nCall Trace:\n\u0026lt;TASK\u0026gt;\n? show_trace_log_lvl+0x1c4/0x2df\n? show_trace_log_lvl+0x1c4/0x2df\n? ib_uverbs_close+0x1f/0xb0 [ib_uverbs]\n? uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]\n? __warn+0x81/0x110\n? uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]\n? report_bug+0x10a/0x140\n? handle_bug+0x3c/0x70\n? exc_invalid_op+0x14/0x70\n? asm_exc_invalid_op+0x16/0x20\n? uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]\nib_uverbs_close+0x1f/0xb0 [ib_uverbs]\n__fput+0x94/0x250\ntask_work_run+0x5c/0x90\ndo_exit+0x270/0x4a0\ndo_group_exit+0x2d/0x90\nget_signal+0x87c/0x8c0\narch_do_signal_or_restart+0x25/0x100\n? ib_uverbs_ioctl+0xc2/0x110 [ib_uverbs]\nexit_to_user_mode_loop+0x9c/0x130\nexit_to_user_mode_prepare+0xb6/0x100\nsyscall_exit_to_user_mode+0x12/0x40\ndo_syscall_64+0x69/0x90\n? syscall_exit_work+0x103/0x130\n? syscall_exit_to_user_mode+0x22/0x40\n? do_syscall_64+0x69/0x90\n? syscall_exit_work+0x103/0x130\n? syscall_exit_to_user_mode+0x22/0x40\n? do_syscall_64+0x69/0x90\n? do_syscall_64+0x69/0x90\n? common_interrupt+0x43/0xa0\nentry_SYSCALL_64_after_hwframe+0x72/0xdc\nRIP: 0033:0x1470abe3ec6b\nCode: Unable to access opcode bytes at RIP 0x1470abe3ec41.\nRSP: 002b:00007fff13ce9108 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: fffffffffffffffc RBX: 00007fff13ce9218 RCX: 00001470abe3ec6b\nRDX: 00007fff13ce9200 RSI: 00000000c0181b01 RDI: 0000000000000004\nRBP: 00007fff13ce91e0 R08: 0000558d9655da10 R09: 0000558d9655dd00\nR10: 00007fff13ce95c0 R11: 0000000000000246 R12: 00007fff13ce9358\nR13: 0000000000000013 R14: 0000558d9655db50 R15: 00007fff13ce9470\n\u0026lt;/TASK\u0026gt;\n--[ end trace 888a9b92e04c5c97 ]--(CVE-2024-26743)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nRDMA/srpt: Support specifying the srpt_service_guid parameter\r\n\r\nMake loading ib_srpt with this parameter set work. The current behavior is\nthat setting that parameter while loading the ib_srpt kernel module\ntriggers the following kernel crash:\r\n\r\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nCall Trace:\n \u0026lt;TASK\u0026gt;\n parse_one+0x18c/0x1d0\n parse_args+0xe1/0x230\n load_module+0x8de/0xa60\n init_module_from_file+0x8b/0xd0\n idempotent_init_module+0x181/0x240\n __x64_sys_finit_module+0x5a/0xb0\n do_syscall_64+0x5f/0xe0\n entry_SYSCALL_64_after_hwframe+0x6e/0x76(CVE-2024-26744)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ngtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()\r\n\r\nThe gtp_net_ops pernet operations structure for the subsystem must be\nregistered before registering the generic netlink family.\r\n\r\nSyzkaller hit \u0026apos;general protection fault in gtp_genl_dump_pdp\u0026apos; bug:\r\n\r\ngeneral protection fault, probably for non-canonical address\n0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN NOPTI\nKASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\nCPU: 1 PID: 5826 Comm: gtp Not tainted 6.8.0-rc3-std-def-alt1 #1\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-alt1 04/01/2014\nRIP: 0010:gtp_genl_dump_pdp+0x1be/0x800 [gtp]\nCode: c6 89 c6 e8 64 e9 86 df 58 45 85 f6 0f 85 4e 04 00 00 e8 c5 ee 86\n      df 48 8b 54 24 18 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 \u0026lt;80\u0026gt;\n      3c 02 00 0f 85 de 05 00 00 48 8b 44 24 18 4c 8b 30 4c 39 f0 74\nRSP: 0018:ffff888014107220 EFLAGS: 00010202\nRAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000\nRDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000\nRBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000\nR13: ffff88800fcda588 R14: 0000000000000001 R15: 0000000000000000\nFS:  00007f1be4eb05c0(0000) GS:ffff88806ce80000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f1be4e766cf CR3: 000000000c33e000 CR4: 0000000000750ef0\nPKRU: 55555554\nCall Trace:\n \u0026lt;TASK\u0026gt;\n ? show_regs+0x90/0xa0\n ? die_addr+0x50/0xd0\n ? exc_general_protection+0x148/0x220\n ? asm_exc_general_protection+0x22/0x30\n ? gtp_genl_dump_pdp+0x1be/0x800 [gtp]\n ? __alloc_skb+0x1dd/0x350\n ? __pfx___alloc_skb+0x10/0x10\n genl_dumpit+0x11d/0x230\n netlink_dump+0x5b9/0xce0\n ? lockdep_hardirqs_on_prepare+0x253/0x430\n ? __pfx_netlink_dump+0x10/0x10\n ? kasan_save_track+0x10/0x40\n ? __kasan_kmalloc+0x9b/0xa0\n ? genl_start+0x675/0x970\n __netlink_dump_start+0x6fc/0x9f0\n genl_family_rcv_msg_dumpit+0x1bb/0x2d0\n ? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10\n ? genl_op_from_small+0x2a/0x440\n ? cap_capable+0x1d0/0x240\n ? __pfx_genl_start+0x10/0x10\n ? __pfx_genl_dumpit+0x10/0x10\n ? __pfx_genl_done+0x10/0x10\n ? security_capable+0x9d/0xe0(CVE-2024-26754)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndm-crypt: don\u0026apos;t modify the data when using authenticated encryption\r\n\r\nIt was said that authenticated encryption could produce invalid tag when\nthe data that is being encrypted is modified [1]. So, fix this problem by\ncopying the data into the clone bio first and then encrypt them inside the\nclone bio.\r\n\r\nThis may reduce performance, but it is needed to prevent the user from\ncorrupting the device by writing data with O_DIRECT and modifying them at\nthe same time.\r\n\r\n[1] https://lore.kernel.org/all/20240207004723.GA35324@sol.localdomain/T/(CVE-2024-26763)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nspi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected\r\n\r\nReturn IRQ_NONE from the interrupt handler when no interrupt was\ndetected. Because an empty interrupt will cause a null pointer error:\r\n\r\n    Unable to handle kernel NULL pointer dereference at virtual\n  address 0000000000000008\n    Call trace:\n        complete+0x54/0x100\n        hisi_sfc_v3xx_isr+0x2c/0x40 [spi_hisi_sfc_v3xx]\n        __handle_irq_event_percpu+0x64/0x1e0\n        handle_irq_event+0x7c/0x1cc(CVE-2024-26776)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmptcp: fix double-free on socket dismantle\r\n\r\nwhen MPTCP server accepts an incoming connection, it clones its listener\nsocket. However, the pointer to \u0026apos;inet_opt\u0026apos; for the new socket has the same\nvalue as the original one: as a consequence, on program exit it\u0026apos;s possible\nto observe the following splat:\r\n\r\n  BUG: KASAN: double-free in inet_sock_destruct+0x54f/0x8b0\n  Free of addr ffff888485950880 by task swapper/25/0\r\n\r\n  CPU: 25 PID: 0 Comm: swapper/25 Kdump: loaded Not tainted 6.8.0-rc1+ #609\n  Hardware name: Supermicro SYS-6027R-72RF/X9DRH-7TF/7F/iTF/iF, BIOS 3.0  07/26/2013\n  Call Trace:\n   \u0026lt;IRQ\u0026gt;\n   dump_stack_lvl+0x32/0x50\n   print_report+0xca/0x620\n   kasan_report_invalid_free+0x64/0x90\n   __kasan_slab_free+0x1aa/0x1f0\n   kfree+0xed/0x2e0\n   inet_sock_destruct+0x54f/0x8b0\n   __sk_destruct+0x48/0x5b0\n   rcu_do_batch+0x34e/0xd90\n   rcu_core+0x559/0xac0\n   __do_softirq+0x183/0x5a4\n   irq_exit_rcu+0x12d/0x170\n   sysvec_apic_timer_interrupt+0x6b/0x80\n   \u0026lt;/IRQ\u0026gt;\n   \u0026lt;TASK\u0026gt;\n   asm_sysvec_apic_timer_interrupt+0x16/0x20\n  RIP: 0010:cpuidle_enter_state+0x175/0x300\n  Code: 30 00 0f 84 1f 01 00 00 83 e8 01 83 f8 ff 75 e5 48 83 c4 18 44 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc fb 45 85 ed \u0026lt;0f\u0026gt; 89 60 ff ff ff 48 c1 e5 06 48 c7 43 18 00 00 00 00 48 83 44 2b\n  RSP: 0018:ffff888481cf7d90 EFLAGS: 00000202\n  RAX: 0000000000000000 RBX: ffff88887facddc8 RCX: 0000000000000000\n  RDX: 1ffff1110ff588b1 RSI: 0000000000000019 RDI: ffff88887fac4588\n  RBP: 0000000000000004 R08: 0000000000000002 R09: 0000000000043080\n  R10: 0009b02ea273363f R11: ffff88887fabf42b R12: ffffffff932592e0\n  R13: 0000000000000004 R14: 0000000000000000 R15: 00000022c880ec80\n   cpuidle_enter+0x4a/0xa0\n   do_idle+0x310/0x410\n   cpu_startup_entry+0x51/0x60\n   start_secondary+0x211/0x270\n   secondary_startup_64_no_verify+0x184/0x18b\n   \u0026lt;/TASK\u0026gt;\r\n\r\n  Allocated by task 6853:\n   kasan_save_stack+0x1c/0x40\n   kasan_save_track+0x10/0x30\n   __kasan_kmalloc+0xa6/0xb0\n   __kmalloc+0x1eb/0x450\n   cipso_v4_sock_setattr+0x96/0x360\n   netlbl_sock_setattr+0x132/0x1f0\n   selinux_netlbl_socket_post_create+0x6c/0x110\n   selinux_socket_post_create+0x37b/0x7f0\n   security_socket_post_create+0x63/0xb0\n   __sock_create+0x305/0x450\n   __sys_socket_create.part.23+0xbd/0x130\n   __sys_socket+0x37/0xb0\n   __x64_sys_socket+0x6f/0xb0\n   do_syscall_64+0x83/0x160\n   entry_SYSCALL_64_after_hwframe+0x6e/0x76\r\n\r\n  Freed by task 6858:\n   kasan_save_stack+0x1c/0x40\n   kasan_save_track+0x10/0x30\n   kasan_save_free_info+0x3b/0x60\n   __kasan_slab_free+0x12c/0x1f0\n   kfree+0xed/0x2e0\n   inet_sock_destruct+0x54f/0x8b0\n   __sk_destruct+0x48/0x5b0\n   subflow_ulp_release+0x1f0/0x250\n   tcp_cleanup_ulp+0x6e/0x110\n   tcp_v4_destroy_sock+0x5a/0x3a0\n   inet_csk_destroy_sock+0x135/0x390\n   tcp_fin+0x416/0x5c0\n   tcp_data_queue+0x1bc8/0x4310\n   tcp_rcv_state_process+0x15a3/0x47b0\n   tcp_v4_do_rcv+0x2c1/0x990\n   tcp_v4_rcv+0x41fb/0x5ed0\n   ip_protocol_deliver_rcu+0x6d/0x9f0\n   ip_local_deliver_finish+0x278/0x360\n   ip_local_deliver+0x182/0x2c0\n   ip_rcv+0xb5/0x1c0\n   __netif_receive_skb_one_core+0x16e/0x1b0\n   process_backlog+0x1e3/0x650\n   __napi_poll+0xa6/0x500\n   net_rx_action+0x740/0xbb0\n   __do_softirq+0x183/0x5a4\r\n\r\n  The buggy address belongs to the object at ffff888485950880\n   which belongs to the cache kmalloc-64 of size 64\n  The buggy address is located 0 bytes inside of\n   64-byte region [ffff888485950880, ffff8884859508c0)\r\n\r\n  The buggy address belongs to the physical page:\n  page:0000000056d1e95e refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888485950700 pfn:0x485950\n  flags: 0x57ffffc0000800(slab|node=1|zone=2|lastcpupid=0x1fffff)\n  page_type: 0xffffffff()\n  raw: 0057ffffc0000800 ffff88810004c640 ffffea00121b8ac0 dead000000000006\n  raw: ffff888485950700 0000000000200019 00000001ffffffff 0000000000000000\n  page dumped because: kasan: bad access detected\r\n\r\n  Memory state around the buggy address:\n   ffff888485950780: fa fb fb\n---truncated---(CVE-2024-26782)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmmc: mmci: stm32: fix DMA API overlapping mappings warning\r\n\r\nTurning on CONFIG_DMA_API_DEBUG_SG results in the following warning:\r\n\r\nDMA-API: mmci-pl18x 48220000.mmc: cacheline tracking EEXIST,\noverlapping mappings aren\u0026apos;t supported\nWARNING: CPU: 1 PID: 51 at kernel/dma/debug.c:568\nadd_dma_entry+0x234/0x2f4\nModules linked in:\nCPU: 1 PID: 51 Comm: kworker/1:2 Not tainted 6.1.28 #1\nHardware name: STMicroelectronics STM32MP257F-EV1 Evaluation Board (DT)\nWorkqueue: events_freezable mmc_rescan\nCall trace:\nadd_dma_entry+0x234/0x2f4\ndebug_dma_map_sg+0x198/0x350\n__dma_map_sg_attrs+0xa0/0x110\ndma_map_sg_attrs+0x10/0x2c\nsdmmc_idma_prep_data+0x80/0xc0\nmmci_prep_data+0x38/0x84\nmmci_start_data+0x108/0x2dc\nmmci_request+0xe4/0x190\n__mmc_start_request+0x68/0x140\nmmc_start_request+0x94/0xc0\nmmc_wait_for_req+0x70/0x100\nmmc_send_tuning+0x108/0x1ac\nsdmmc_execute_tuning+0x14c/0x210\nmmc_execute_tuning+0x48/0xec\nmmc_sd_init_uhs_card.part.0+0x208/0x464\nmmc_sd_init_card+0x318/0x89c\nmmc_attach_sd+0xe4/0x180\nmmc_rescan+0x244/0x320\r\n\r\nDMA API debug brings to light leaking dma-mappings as dma_map_sg and\ndma_unmap_sg are not correctly balanced.\r\n\r\nIf an error occurs in mmci_cmd_irq function, only mmci_dma_error\nfunction is called and as this API is not managed on stm32 variant,\ndma_unmap_sg is never called in this error path.(CVE-2024-26787)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbtrfs: dev-replace: properly validate device names\r\n\r\nThere\u0026apos;s a syzbot report that device name buffers passed to device\nreplace are not properly checked for string termination which could lead\nto a read out of bounds in getname_kernel().\r\n\r\nAdd a helper that validates both source and target device name buffers.\nFor devid as the source initialize the buffer to empty string in case\nsomething tries to read it later.\r\n\r\nThis was originally analyzed and fixed in a different way by Edward Adam\nDavis (see links).(CVE-2024-26791)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nBluetooth: Avoid potential use-after-free in hci_error_reset\r\n\r\nWhile handling the HCI_EV_HARDWARE_ERROR event, if the underlying\nBT controller is not responding, the GPIO reset mechanism would\nfree the hci_dev and lead to a use-after-free in hci_error_reset.\r\n\r\nHere\u0026apos;s the call trace observed on a ChromeOS device with Intel AX201:\n   queue_work_on+0x3e/0x6c\n   __hci_cmd_sync_sk+0x2ee/0x4c0 [bluetooth \u0026lt;HASH:3b4a6\u0026gt;]\n   ? init_wait_entry+0x31/0x31\n   __hci_cmd_sync+0x16/0x20 [bluetooth \u0026lt;HASH:3b4a 6\u0026gt;]\n   hci_error_reset+0x4f/0xa4 [bluetooth \u0026lt;HASH:3b4a 6\u0026gt;]\n   process_one_work+0x1d8/0x33f\n   worker_thread+0x21b/0x373\n   kthread+0x13a/0x152\n   ? pr_cont_work+0x54/0x54\n   ? kthread_blkcg+0x31/0x31\n    ret_from_fork+0x1f/0x30\r\n\r\nThis patch holds the reference count on the hci_dev while processing\na HCI_EV_HARDWARE_ERROR event to avoid potential crash.(CVE-2024-26801)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetlink: Fix kernel-infoleak-after-free in __skb_datagram_iter\r\n\r\nsyzbot reported the following uninit-value access issue [1]:\r\n\r\nnetlink_to_full_skb() creates a new `skb` and puts the `skb-\u0026gt;data`\npassed as a 1st arg of netlink_to_full_skb() onto new `skb`. The data\nsize is specified as `len` and passed to skb_put_data(). This `len`\nis based on `skb-\u0026gt;end` that is not data offset but buffer offset. The\n`skb-\u0026gt;end` contains data and tailroom. Since the tailroom is not\ninitialized when the new `skb` created, KMSAN detects uninitialized\nmemory area when copying the data.\r\n\r\nThis patch resolved this issue by correct the len from `skb-\u0026gt;end` to\n`skb-\u0026gt;len`, which is the actual data offset.\r\n\r\nBUG: KMSAN: kernel-infoleak-after-free in instrument_copy_to_user include/linux/instrumented.h:114 [inline]\nBUG: KMSAN: kernel-infoleak-after-free in copy_to_user_iter lib/iov_iter.c:24 [inline]\nBUG: KMSAN: kernel-infoleak-after-free in iterate_ubuf include/linux/iov_iter.h:29 [inline]\nBUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance2 include/linux/iov_iter.h:245 [inline]\nBUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance include/linux/iov_iter.h:271 [inline]\nBUG: KMSAN: kernel-infoleak-after-free in _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186\n instrument_copy_to_user include/linux/instrumented.h:114 [inline]\n copy_to_user_iter lib/iov_iter.c:24 [inline]\n iterate_ubuf include/linux/iov_iter.h:29 [inline]\n iterate_and_advance2 include/linux/iov_iter.h:245 [inline]\n iterate_and_advance include/linux/iov_iter.h:271 [inline]\n _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186\n copy_to_iter include/linux/uio.h:197 [inline]\n simple_copy_to_iter+0x68/0xa0 net/core/datagram.c:532\n __skb_datagram_iter+0x123/0xdc0 net/core/datagram.c:420\n skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:546\n skb_copy_datagram_msg include/linux/skbuff.h:3960 [inline]\n packet_recvmsg+0xd9c/0x2000 net/packet/af_packet.c:3482\n sock_recvmsg_nosec net/socket.c:1044 [inline]\n sock_recvmsg net/socket.c:1066 [inline]\n sock_read_iter+0x467/0x580 net/socket.c:1136\n call_read_iter include/linux/fs.h:2014 [inline]\n new_sync_read fs/read_write.c:389 [inline]\n vfs_read+0x8f6/0xe00 fs/read_write.c:470\n ksys_read+0x20f/0x4c0 fs/read_write.c:613\n __do_sys_read fs/read_write.c:623 [inline]\n __se_sys_read fs/read_write.c:621 [inline]\n __x64_sys_read+0x93/0xd0 fs/read_write.c:621\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nUninit was stored to memory at:\n skb_put_data include/linux/skbuff.h:2622 [inline]\n netlink_to_full_skb net/netlink/af_netlink.c:181 [inline]\n __netlink_deliver_tap_skb net/netlink/af_netlink.c:298 [inline]\n __netlink_deliver_tap+0x5be/0xc90 net/netlink/af_netlink.c:325\n netlink_deliver_tap net/netlink/af_netlink.c:338 [inline]\n netlink_deliver_tap_kernel net/netlink/af_netlink.c:347 [inline]\n netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]\n netlink_unicast+0x10f1/0x1250 net/netlink/af_netlink.c:1368\n netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg net/socket.c:745 [inline]\n ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584\n ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638\n __sys_sendmsg net/socket.c:2667 [inline]\n __do_sys_sendmsg net/socket.c:2676 [inline]\n __se_sys_sendmsg net/socket.c:2674 [inline]\n __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nUninit was created at:\n free_pages_prepare mm/page_alloc.c:1087 [inline]\n free_unref_page_prepare+0xb0/0xa40 mm/page_alloc.c:2347\n free_unref_page_list+0xeb/0x1100 mm/page_alloc.c:2533\n release_pages+0x23d3/0x2410 mm/swap.c:1042\n free_pages_and_swap_cache+0xd9/0xf0 mm/swap_state.c:316\n tlb_batch_pages\n---truncated---(CVE-2024-26805)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain\r\n\r\nRemove netdevice from inet/ingress basechain in case NETDEV_UNREGISTER\nevent is reported, otherwise a stale reference to netdevice remains in\nthe hook list.(CVE-2024-26808)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nft_set_pipapo: release elements in clone only from destroy path\r\n\r\nClone already always provides a current view of the lookup table, use it\nto destroy the set, otherwise it is possible to destroy elements twice.\r\n\r\nThis fix requires:\r\n\r\n 212ed75dc5fb (\u0026quot;netfilter: nf_tables: integrate pipapo into commit protocol\u0026quot;)\r\n\r\nwhich came after:\r\n\r\n 9827a0e6e23b (\u0026quot;netfilter: nft_set_pipapo: release elements in clone from abort path\u0026quot;).(CVE-2024-26809)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nksmbd: validate payload size in ipc response\r\n\r\nIf installing malicious ksmbd-tools, ksmbd.mountd can return invalid ipc\nresponse to ksmbd kernel server. ksmbd should validate payload size of\nipc response from ksmbd.mountd to avoid memory overrun or\nslab-out-of-bounds. This patch validate 3 ipc response that has payload.(CVE-2024-26811)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nvfio/pci: Create persistent INTx handler\r\n\r\nA vulnerability exists where the eventfd for INTx signaling can be\ndeconfigured, which unregisters the IRQ handler but still allows\neventfds to be signaled with a NULL context through the SET_IRQS ioctl\nor through unmask irqfd if the device interrupt is pending.\r\n\r\nIdeally this could be solved with some additional locking; the igate\nmutex serializes the ioctl and config space accesses, and the interrupt\nhandler is unregistered relative to the trigger, but the irqfd path\nruns asynchronous to those.  The igate mutex cannot be acquired from the\natomic context of the eventfd wake function.  Disabling the irqfd\nrelative to the eventfd registration is potentially incompatible with\nexisting userspace.\r\n\r\nAs a result, the solution implemented here moves configuration of the\nINTx interrupt handler to track the lifetime of the INTx context object\nand irq_type configuration, rather than registration of a particular\ntrigger eventfd.  Synchronization is added between the ioctl path and\neventfd_signal() wrapper such that the eventfd trigger can be\ndynamically updated relative to in-flight interrupts or irqfd callbacks.(CVE-2024-26812)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ncifs: fix underflow in parse_server_interfaces()\r\n\r\nIn this loop, we step through the buffer and after each item we check\nif the size_left is greater than the minimum size we need.  However,\nthe problem is that \u0026quot;bytes_left\u0026quot; is type ssize_t while sizeof() is type\nsize_t.  That means that because of type promotion, the comparison is\ndone as an unsigned and if we have negative bytes left the loop\ncontinues instead of ending.(CVE-2024-26828)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nf_conntrack_h323: Add protection for bmp length out of range\r\n\r\nUBSAN load reports an exception of BRK#5515 SHIFT_ISSUE:Bitwise shifts\nthat are out of bounds for their data type.\r\n\r\nvmlinux   get_bitmap(b=75) + 712\n\u0026lt;net/netfilter/nf_conntrack_h323_asn1.c:0\u0026gt;\nvmlinux   decode_seq(bs=0xFFFFFFD008037000, f=0xFFFFFFD008037018, level=134443100) + 1956\n\u0026lt;net/netfilter/nf_conntrack_h323_asn1.c:592\u0026gt;\nvmlinux   decode_choice(base=0xFFFFFFD0080370F0, level=23843636) + 1216\n\u0026lt;net/netfilter/nf_conntrack_h323_asn1.c:814\u0026gt;\nvmlinux   decode_seq(f=0xFFFFFFD0080371A8, level=134443500) + 812\n\u0026lt;net/netfilter/nf_conntrack_h323_asn1.c:576\u0026gt;\nvmlinux   decode_choice(base=0xFFFFFFD008037280, level=0) + 1216\n\u0026lt;net/netfilter/nf_conntrack_h323_asn1.c:814\u0026gt;\nvmlinux   DecodeRasMessage() + 304\n\u0026lt;net/netfilter/nf_conntrack_h323_asn1.c:833\u0026gt;\nvmlinux   ras_help() + 684\n\u0026lt;net/netfilter/nf_conntrack_h323_main.c:1728\u0026gt;\nvmlinux   nf_confirm() + 188\n\u0026lt;net/netfilter/nf_conntrack_proto.c:137\u0026gt;\r\n\r\nDue to abnormal data in skb-\u0026gt;data, the extension bitmap length\nexceeds 32 when decoding ras message then uses the length to make\na shift operation. It will change into negative after several loop.\nUBSAN load could detect a negative shift as an undefined behaviour\nand reports exception.\nSo we add the protection to avoid the length exceeding 32. Or else\nit will return out of range error and stop decoding.(CVE-2024-26851)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: hns3: fix kernel crash when 1588 is received on HIP08 devices\r\n\r\nThe HIP08 devices does not register the ptp devices, so the\nhdev-\u0026gt;ptp is NULL, but the hardware can receive 1588 messages,\nand set the HNS3_RXD_TS_VLD_B bit, so, if match this case, the\naccess of hdev-\u0026gt;ptp-\u0026gt;flags will cause a kernel crash:\r\n\r\n[ 5888.946472] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018\n[ 5888.946475] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018\n...\n[ 5889.266118] pc : hclge_ptp_get_rx_hwts+0x40/0x170 [hclge]\n[ 5889.272612] lr : hclge_ptp_get_rx_hwts+0x34/0x170 [hclge]\n[ 5889.279101] sp : ffff800012c3bc50\n[ 5889.283516] x29: ffff800012c3bc50 x28: ffff2040002be040\n[ 5889.289927] x27: ffff800009116484 x26: 0000000080007500\n[ 5889.296333] x25: 0000000000000000 x24: ffff204001c6f000\n[ 5889.302738] x23: ffff204144f53c00 x22: 0000000000000000\n[ 5889.309134] x21: 0000000000000000 x20: ffff204004220080\n[ 5889.315520] x19: ffff204144f53c00 x18: 0000000000000000\n[ 5889.321897] x17: 0000000000000000 x16: 0000000000000000\n[ 5889.328263] x15: 0000004000140ec8 x14: 0000000000000000\n[ 5889.334617] x13: 0000000000000000 x12: 00000000010011df\n[ 5889.340965] x11: bbfeff4d22000000 x10: 0000000000000000\n[ 5889.347303] x9 : ffff800009402124 x8 : 0200f78811dfbb4d\n[ 5889.353637] x7 : 2200000000191b01 x6 : ffff208002a7d480\n[ 5889.359959] x5 : 0000000000000000 x4 : 0000000000000000\n[ 5889.366271] x3 : 0000000000000000 x2 : 0000000000000000\n[ 5889.372567] x1 : 0000000000000000 x0 : ffff20400095c080\n[ 5889.378857] Call trace:\n[ 5889.382285] hclge_ptp_get_rx_hwts+0x40/0x170 [hclge]\n[ 5889.388304] hns3_handle_bdinfo+0x324/0x410 [hns3]\n[ 5889.394055] hns3_handle_rx_bd+0x60/0x150 [hns3]\n[ 5889.399624] hns3_clean_rx_ring+0x84/0x170 [hns3]\n[ 5889.405270] hns3_nic_common_poll+0xa8/0x220 [hns3]\n[ 5889.411084] napi_poll+0xcc/0x264\n[ 5889.415329] net_rx_action+0xd4/0x21c\n[ 5889.419911] __do_softirq+0x130/0x358\n[ 5889.424484] irq_exit+0x134/0x154\n[ 5889.428700] __handle_domain_irq+0x88/0xf0\n[ 5889.433684] gic_handle_irq+0x78/0x2c0\n[ 5889.438319] el1_irq+0xb8/0x140\n[ 5889.442354] arch_cpu_idle+0x18/0x40\n[ 5889.446816] default_idle_call+0x5c/0x1c0\n[ 5889.451714] cpuidle_idle_call+0x174/0x1b0\n[ 5889.456692] do_idle+0xc8/0x160\n[ 5889.460717] cpu_startup_entry+0x30/0xfc\n[ 5889.465523] secondary_start_kernel+0x158/0x1ec\n[ 5889.470936] Code: 97ffab78 f9411c14 91408294 f9457284 (f9400c80)\n[ 5889.477950] SMP: stopping secondary CPUs\n[ 5890.514626] SMP: failed to stop secondary CPUs 0-69,71-95\n[ 5890.522951] Starting crashdump kernel...(CVE-2024-26881)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmd: fix kmemleak of rdev-\u0026gt;serial\r\n\r\nIf kobject_add() is fail in bind_rdev_to_array(), \u0026apos;rdev-\u0026gt;serial\u0026apos; will be\nalloc not be freed, and kmemleak occurs.\r\n\r\nunreferenced object 0xffff88815a350000 (size 49152):\n  comm \u0026quot;mdadm\u0026quot;, pid 789, jiffies 4294716910\n  hex dump (first 32 bytes):\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace (crc f773277a):\n    [\u0026lt;0000000058b0a453\u0026gt;] kmemleak_alloc+0x61/0xe0\n    [\u0026lt;00000000366adf14\u0026gt;] __kmalloc_large_node+0x15e/0x270\n    [\u0026lt;000000002e82961b\u0026gt;] __kmalloc_node.cold+0x11/0x7f\n    [\u0026lt;00000000f206d60a\u0026gt;] kvmalloc_node+0x74/0x150\n    [\u0026lt;0000000034bf3363\u0026gt;] rdev_init_serial+0x67/0x170\n    [\u0026lt;0000000010e08fe9\u0026gt;] mddev_create_serial_pool+0x62/0x220\n    [\u0026lt;00000000c3837bf0\u0026gt;] bind_rdev_to_array+0x2af/0x630\n    [\u0026lt;0000000073c28560\u0026gt;] md_add_new_disk+0x400/0x9f0\n    [\u0026lt;00000000770e30ff\u0026gt;] md_ioctl+0x15bf/0x1c10\n    [\u0026lt;000000006cfab718\u0026gt;] blkdev_ioctl+0x191/0x3f0\n    [\u0026lt;0000000085086a11\u0026gt;] vfs_ioctl+0x22/0x60\n    [\u0026lt;0000000018b656fe\u0026gt;] __x64_sys_ioctl+0xba/0xe0\n    [\u0026lt;00000000e54e675e\u0026gt;] do_syscall_64+0x71/0x150\n    [\u0026lt;000000008b0ad622\u0026gt;] entry_SYSCALL_64_after_hwframe+0x6c/0x74(CVE-2024-26900)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndo_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak\r\n\r\nsyzbot identified a kernel information leak vulnerability in\ndo_sys_name_to_handle() and issued the following report [1].\r\n\r\n[1]\n\u0026quot;BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]\nBUG: KMSAN: kernel-infoleak in _copy_to_user+0xbc/0x100 lib/usercopy.c:40\n instrument_copy_to_user include/linux/instrumented.h:114 [inline]\n _copy_to_user+0xbc/0x100 lib/usercopy.c:40\n copy_to_user include/linux/uaccess.h:191 [inline]\n do_sys_name_to_handle fs/fhandle.c:73 [inline]\n __do_sys_name_to_handle_at fs/fhandle.c:112 [inline]\n __se_sys_name_to_handle_at+0x949/0xb10 fs/fhandle.c:94\n __x64_sys_name_to_handle_at+0xe4/0x140 fs/fhandle.c:94\n ...\r\n\r\nUninit was created at:\n slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768\n slab_alloc_node mm/slub.c:3478 [inline]\n __kmem_cache_alloc_node+0x5c9/0x970 mm/slub.c:3517\n __do_kmalloc_node mm/slab_common.c:1006 [inline]\n __kmalloc+0x121/0x3c0 mm/slab_common.c:1020\n kmalloc include/linux/slab.h:604 [inline]\n do_sys_name_to_handle fs/fhandle.c:39 [inline]\n __do_sys_name_to_handle_at fs/fhandle.c:112 [inline]\n __se_sys_name_to_handle_at+0x441/0xb10 fs/fhandle.c:94\n __x64_sys_name_to_handle_at+0xe4/0x140 fs/fhandle.c:94\n ...\r\n\r\nBytes 18-19 of 20 are uninitialized\nMemory access of size 20 starts at ffff888128a46380\nData copied to user address 0000000020000240\u0026quot;\r\n\r\nPer Chuck Lever\u0026apos;s suggestion, use kzalloc() instead of kmalloc() to\nsolve the problem.(CVE-2024-26901)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nBluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security\r\n\r\nDuring our fuzz testing of the connection and disconnection process at the\nRFCOMM layer, we discovered this bug. By comparing the packets from a\nnormal connection and disconnection process with the testcase that\ntriggered a KASAN report. We analyzed the cause of this bug as follows:\r\n\r\n1. In the packets captured during a normal connection, the host sends a\n`Read Encryption Key Size` type of `HCI_CMD` packet\n(Command Opcode: 0x1408) to the controller to inquire the length of\nencryption key.After receiving this packet, the controller immediately\nreplies with a Command Completepacket (Event Code: 0x0e) to return the\nEncryption Key Size.\r\n\r\n2. In our fuzz test case, the timing of the controller\u0026apos;s response to this\npacket was delayed to an unexpected point: after the RFCOMM and L2CAP\nlayers had disconnected but before the HCI layer had disconnected.\r\n\r\n3. After receiving the Encryption Key Size Response at the time described\nin point 2, the host still called the rfcomm_check_security function.\nHowever, by this time `struct l2cap_conn *conn = l2cap_pi(sk)-\u0026gt;chan-\u0026gt;conn;`\nhad already been released, and when the function executed\n`return hci_conn_security(conn-\u0026gt;hcon, d-\u0026gt;sec_level, auth_type, d-\u0026gt;out);`,\nspecifically when accessing `conn-\u0026gt;hcon`, a null-ptr-deref error occurred.\r\n\r\nTo fix this bug, check if `sk-\u0026gt;sk_state` is BT_CLOSED before calling\nrfcomm_recv_frame in rfcomm_process_rx.(CVE-2024-26903)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nRDMA/mlx5: Fix fortify source warning while accessing Eth segment\r\n\r\n ------------[ cut here ]------------\n memcpy: detected field-spanning write (size 56) of single field \u0026quot;eseg-\u0026gt;inline_hdr.start\u0026quot; at /var/lib/dkms/mlnx-ofed-kernel/5.8/build/drivers/infiniband/hw/mlx5/wr.c:131 (size 2)\n WARNING: CPU: 0 PID: 293779 at /var/lib/dkms/mlnx-ofed-kernel/5.8/build/drivers/infiniband/hw/mlx5/wr.c:131 mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib]\n Modules linked in: 8021q garp mrp stp llc rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) ib_uverbs(OE) ib_core(OE) mlx5_core(OE) pci_hyperv_intf mlxdevm(OE) mlx_compat(OE) tls mlxfw(OE) psample nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink mst_pciconf(OE) knem(OE) vfio_pci vfio_pci_core vfio_iommu_type1 vfio iommufd irqbypass cuse nfsv3 nfs fscache netfs xfrm_user xfrm_algo ipmi_devintf ipmi_msghandler binfmt_misc crct10dif_pclmul crc32_pclmul polyval_clmulni polyval_generic ghash_clmulni_intel sha512_ssse3 snd_pcsp aesni_intel crypto_simd cryptd snd_pcm snd_timer joydev snd soundcore input_leds serio_raw evbug nfsd auth_rpcgss nfs_acl lockd grace sch_fq_codel sunrpc drm efi_pstore ip_tables x_tables autofs4 psmouse virtio_net net_failover failover floppy\n  [last unloaded: mlx_compat(OE)]\n CPU: 0 PID: 293779 Comm: ssh Tainted: G           OE      6.2.0-32-generic #32~22.04.1-Ubuntu\n Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011\n RIP: 0010:mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib]\n Code: 0c 01 00 a8 01 75 25 48 8b 75 a0 b9 02 00 00 00 48 c7 c2 10 5b fd c0 48 c7 c7 80 5b fd c0 c6 05 57 0c 03 00 01 e8 95 4d 93 da \u0026lt;0f\u0026gt; 0b 44 8b 4d b0 4c 8b 45 c8 48 8b 4d c0 e9 49 fb ff ff 41 0f b7\n RSP: 0018:ffffb5b48478b570 EFLAGS: 00010046\n RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000\n RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n RBP: ffffb5b48478b628 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000000 R12: ffffb5b48478b5e8\n R13: ffff963a3c609b5e R14: ffff9639c3fbd800 R15: ffffb5b480475a80\n FS:  00007fc03b444c80(0000) GS:ffff963a3dc00000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000556f46bdf000 CR3: 0000000006ac6003 CR4: 00000000003706f0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  ? show_regs+0x72/0x90\n  ? mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib]\n  ? __warn+0x8d/0x160\n  ? mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib]\n  ? report_bug+0x1bb/0x1d0\n  ? handle_bug+0x46/0x90\n  ? exc_invalid_op+0x19/0x80\n  ? asm_exc_invalid_op+0x1b/0x20\n  ? mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib]\n  mlx5_ib_post_send_nodrain+0xb/0x20 [mlx5_ib]\n  ipoib_send+0x2ec/0x770 [ib_ipoib]\n  ipoib_start_xmit+0x5a0/0x770 [ib_ipoib]\n  dev_hard_start_xmit+0x8e/0x1e0\n  ? validate_xmit_skb_list+0x4d/0x80\n  sch_direct_xmit+0x116/0x3a0\n  __dev_xmit_skb+0x1fd/0x580\n  __dev_queue_xmit+0x284/0x6b0\n  ? _raw_spin_unlock_irq+0xe/0x50\n  ? __flush_work.isra.0+0x20d/0x370\n  ? push_pseudo_header+0x17/0x40 [ib_ipoib]\n  neigh_connected_output+0xcd/0x110\n  ip_finish_output2+0x179/0x480\n  ? __smp_call_single_queue+0x61/0xa0\n  __ip_finish_output+0xc3/0x190\n  ip_finish_output+0x2e/0xf0\n  ip_output+0x78/0x110\n  ? __pfx_ip_finish_output+0x10/0x10\n  ip_local_out+0x64/0x70\n  __ip_queue_xmit+0x18a/0x460\n  ip_queue_xmit+0x15/0x30\n  __tcp_transmit_skb+0x914/0x9c0\n  tcp_write_xmit+0x334/0x8d0\n  tcp_push_one+0x3c/0x60\n  tcp_sendmsg_locked+0x2e1/0xac0\n  tcp_sendmsg+0x2d/0x50\n  inet_sendmsg+0x43/0x90\n  sock_sendmsg+0x68/0x80\n  sock_write_iter+0x93/0x100\n  vfs_write+0x326/0x3c0\n  ksys_write+0xbd/0xf0\n  ? do_syscall_64+0x69/0x90\n  __x64_sys_write+0x19/0x30\n  do_syscall_\n---truncated---(CVE-2024-26907)\r\n\r\nRejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.(CVE-2024-26908)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: openvswitch: Fix Use-After-Free in ovs_ct_exit\r\n\r\nSince kfree_rcu, which is called in the hlist_for_each_entry_rcu traversal\nof ovs_ct_limit_exit, is not part of the RCU read critical section, it\nis possible that the RCU grace period will pass during the traversal and\nthe key will be free.\r\n\r\nTo prevent this, it should be changed to hlist_for_each_entry_safe.(CVE-2024-27395)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: gtp: Fix Use-After-Free in gtp_dellink\r\n\r\nSince call_rcu, which is called in the hlist_for_each_entry_rcu traversal\nof gtp_dellink, is not part of the RCU read critical section, it\nis possible that the RCU grace period will pass during the traversal and\nthe key will be free.\r\n\r\nTo prevent this, it should be changed to hlist_for_each_entry_safe.(CVE-2024-27396)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ncpumap: Zero-initialise xdp_rxq_info struct before running XDP program\r\n\r\nWhen running an XDP program that is attached to a cpumap entry, we don\u0026apos;t\ninitialise the xdp_rxq_info data structure being used in the xdp_buff\nthat backs the XDP program invocation. Tobias noticed that this leads to\nrandom values being returned as the xdp_md-\u0026gt;rx_queue_index value for XDP\nprograms running in a cpumap.\r\n\r\nThis means we\u0026apos;re basically returning the contents of the uninitialised\nmemory, which is bad. Fix this by zero-initialising the rxq data\nstructure before running the XDP program.(CVE-2024-27431)","status":"published","published":"2024-05-24T11:07:06Z","modified":"2026-08-18T01:18:29.561506137Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1648","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmm/slub: fix to return errno if kmalloc() fails\r\n\r\nIn create_unique_id(), kmalloc(, GFP_KERNEL) can fail due to\nout-of-memory, if it fails, return errno correctly rather than\ntriggering panic via BUG_ON();\r\n\r\nkernel BUG at mm/slub.c:5893!\nInternal error: Oops - BUG: 0 [#1] PREEMPT SMP\r\n\r\nCall trace:\n sysfs_slab_add+0x258/0x260 mm/slub.c:5973\n __kmem_cache_create+0x60/0x118 mm/slub.c:4899\n create_cache mm/slab_common.c:229 [inline]\n kmem_cache_create_usercopy+0x19c/0x31c mm/slab_common.c:335\n kmem_cache_create+0x1c/0x28 mm/slab_common.c:390\n f2fs_kmem_cache_create fs/f2fs/f2fs.h:2766 [inline]\n f2fs_init_xattr_caches+0x78/0xb4 fs/f2fs/xattr.c:808\n f2fs_fill_super+0x1050/0x1e0c fs/f2fs/super.c:4149\n mount_bdev+0x1b8/0x210 fs/super.c:1400\n f2fs_mount+0x44/0x58 fs/f2fs/super.c:4512\n legacy_get_tree+0x30/0x74 fs/fs_context.c:610\n vfs_get_tree+0x40/0x140 fs/super.c:1530\n do_new_mount+0x1dc/0x4e4 fs/namespace.c:3040\n path_mount+0x358/0x914 fs/namespace.c:3370\n do_mount fs/namespace.c:3383 [inline]\n __do_sys_mount fs/namespace.c:3591 [inline]\n __se_sys_mount fs/namespace.c:3568 [inline]\n __arm64_sys_mount+0x2f8/0x408 fs/namespace.c:3568(CVE-2022-48659)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ngpiolib: cdev: Set lineevent_state::irq after IRQ register successfully\r\n\r\nWhen running gpio test on nxp-ls1028 platform with below command\ngpiomon --num-events=3 --rising-edge gpiochip1 25\nThere will be a warning trace as below:\nCall trace:\nfree_irq+0x204/0x360\nlineevent_free+0x64/0x70\ngpio_ioctl+0x598/0x6a0\n__arm64_sys_ioctl+0xb4/0x100\ninvoke_syscall+0x5c/0x130\n......\nel0t_64_sync+0x1a0/0x1a4\nThe reason of this issue is that calling request_threaded_irq()\nfunction failed, and then lineevent_free() is invoked to release\nthe resource. Since the lineevent_state::irq was already set, so\nthe subsequent invocation of free_irq() would trigger the above\nwarning call trace. To fix this issue, set the lineevent_state::irq\nafter the IRQ register successfully.(CVE-2022-48660)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbinder: fix race between mmput() and do_exit()\r\n\r\nTask A calls binder_update_page_range() to allocate and insert pages on\na remote address space from Task B. For this, Task A pins the remote mm\nvia mmget_not_zero() first. This can race with Task B do_exit() and the\nfinal mmput() refcount decrement will come from Task A.\r\n\r\n  Task A            | Task B\n  ------------------+------------------\n  mmget_not_zero()  |\n                    |  do_exit()\n                    |    exit_mm()\n                    |      mmput()\n  mmput()           |\n    exit_mmap()     |\n      remove_vma()  |\n        fput()      |\r\n\r\nIn this case, the work of ____fput() from Task B is queued up in Task A\nas TWA_RESUME. So in theory, Task A returns to userspace and the cleanup\nwork gets executed. However, Task A instead sleep, waiting for a reply\nfrom Task B that never comes (it\u0026apos;s dead).\r\n\r\nThis means the binder_deferred_release() is blocked until an unrelated\nbinder event forces Task A to go back to userspace. All the associated\ndeath notifications will also be delayed until then.\r\n\r\nIn order to fix this use mmput_async() that will schedule the work in\nthe corresponding mm-\u0026gt;async_put_work WQ instead of Task A.(CVE-2023-52609)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nhwrng: core - Fix page fault dead lock on mmap-ed hwrng\r\n\r\nThere is a dead-lock in the hwrng device read path.  This triggers\nwhen the user reads from /dev/hwrng into memory also mmap-ed from\n/dev/hwrng.  The resulting page fault triggers a recursive read\nwhich then dead-locks.\r\n\r\nFix this by using a stack buffer when calling copy_to_user.(CVE-2023-52615)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ncrypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init\r\n\r\nWhen the mpi_ec_ctx structure is initialized, some fields are not\ncleared, causing a crash when referencing the field when the\nstructure was released. Initially, this issue was ignored because\nmemory for mpi_ec_ctx is allocated with the __GFP_ZERO flag.\nFor example, this error will be triggered when calculating the\nZa value for SM2 separately.(CVE-2023-52616)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbpf: Check rcu_read_lock_trace_held() before calling bpf map helpers\r\n\r\nThese three bpf_map_{lookup,update,delete}_elem() helpers are also\navailable for sleepable bpf program, so add the corresponding lock\nassertion for sleepable bpf program, otherwise the following warning\nwill be reported when a sleepable bpf program manipulates bpf map under\ninterpreter mode (aka bpf_jit_enable=0):\r\n\r\n  WARNING: CPU: 3 PID: 4985 at kernel/bpf/helpers.c:40 ......\n  CPU: 3 PID: 4985 Comm: test_progs Not tainted 6.6.0+ #2\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ......\n  RIP: 0010:bpf_map_lookup_elem+0x54/0x60\n  ......\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   ? __warn+0xa5/0x240\n   ? bpf_map_lookup_elem+0x54/0x60\n   ? report_bug+0x1ba/0x1f0\n   ? handle_bug+0x40/0x80\n   ? exc_invalid_op+0x18/0x50\n   ? asm_exc_invalid_op+0x1b/0x20\n   ? __pfx_bpf_map_lookup_elem+0x10/0x10\n   ? rcu_lockdep_current_cpu_online+0x65/0xb0\n   ? rcu_is_watching+0x23/0x50\n   ? bpf_map_lookup_elem+0x54/0x60\n   ? __pfx_bpf_map_lookup_elem+0x10/0x10\n   ___bpf_prog_run+0x513/0x3b70\n   __bpf_prog_run32+0x9d/0xd0\n   ? __bpf_prog_enter_sleepable_recur+0xad/0x120\n   ? __bpf_prog_enter_sleepable_recur+0x3e/0x120\n   bpf_trampoline_6442580665+0x4d/0x1000\n   __x64_sys_getpgid+0x5/0x30\n   ? do_syscall_64+0x36/0xb0\n   entry_SYSCALL_64_after_hwframe+0x6e/0x76\n   \u0026lt;/TASK\u0026gt;(CVE-2023-52621)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nSUNRPC: Fix a suspicious RCU usage warning\r\n\r\nI received the following warning while running cthon against an ontap\nserver running pNFS:\r\n\r\n[   57.202521] =============================\n[   57.202522] WARNING: suspicious RCU usage\n[   57.202523] 6.7.0-rc3-g2cc14f52aeb7 #41492 Not tainted\n[   57.202525] -----------------------------\n[   57.202525] net/sunrpc/xprtmultipath.c:349 RCU-list traversed in non-reader section!!\n[   57.202527]\n               other info that might help us debug this:\r\n\r\n[   57.202528]\n               rcu_scheduler_active = 2, debug_locks = 1\n[   57.202529] no locks held by test5/3567.\n[   57.202530]\n               stack backtrace:\n[   57.202532] CPU: 0 PID: 3567 Comm: test5 Not tainted 6.7.0-rc3-g2cc14f52aeb7 #41492 5b09971b4965c0aceba19f3eea324a4a806e227e\n[   57.202534] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 2/2/2022\n[   57.202536] Call Trace:\n[   57.202537]  \u0026lt;TASK\u0026gt;\n[   57.202540]  dump_stack_lvl+0x77/0xb0\n[   57.202551]  lockdep_rcu_suspicious+0x154/0x1a0\n[   57.202556]  rpc_xprt_switch_has_addr+0x17c/0x190 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]\n[   57.202596]  rpc_clnt_setup_test_and_add_xprt+0x50/0x180 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]\n[   57.202621]  ? rpc_clnt_add_xprt+0x254/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]\n[   57.202646]  rpc_clnt_add_xprt+0x27a/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]\n[   57.202671]  ? __pfx_rpc_clnt_setup_test_and_add_xprt+0x10/0x10 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]\n[   57.202696]  nfs4_pnfs_ds_connect+0x345/0x760 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]\n[   57.202728]  ? __pfx_nfs4_test_session_trunk+0x10/0x10 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]\n[   57.202754]  nfs4_fl_prepare_ds+0x75/0xc0 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a]\n[   57.202760]  filelayout_write_pagelist+0x4a/0x200 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a]\n[   57.202765]  pnfs_generic_pg_writepages+0xbe/0x230 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]\n[   57.202788]  __nfs_pageio_add_request+0x3fd/0x520 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202813]  nfs_pageio_add_request+0x18b/0x390 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202831]  nfs_do_writepage+0x116/0x1e0 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202849]  nfs_writepages_callback+0x13/0x30 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202866]  write_cache_pages+0x265/0x450\n[   57.202870]  ? __pfx_nfs_writepages_callback+0x10/0x10 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202891]  nfs_writepages+0x141/0x230 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202913]  do_writepages+0xd2/0x230\n[   57.202917]  ? filemap_fdatawrite_wbc+0x5c/0x80\n[   57.202921]  filemap_fdatawrite_wbc+0x67/0x80\n[   57.202924]  filemap_write_and_wait_range+0xd9/0x170\n[   57.202930]  nfs_wb_all+0x49/0x180 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202947]  nfs4_file_flush+0x72/0xb0 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]\n[   57.202969]  __se_sys_close+0x46/0xd0\n[   57.202972]  do_syscall_64+0x68/0x100\n[   57.202975]  ? do_syscall_64+0x77/0x100\n[   57.202976]  ? do_syscall_64+0x77/0x100\n[   57.202979]  entry_SYSCALL_64_after_hwframe+0x6e/0x76\n[   57.202982] RIP: 0033:0x7fe2b12e4a94\n[   57.202985] Code: 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d d5 18 0e 00 00 74 13 b8 03 00 00 00 0f 05 \u0026lt;48\u0026gt; 3d 00 f0 ff ff 77 44 c3 0f 1f 00 48 83 ec 18 89 7c 24 0c e8 c3\n[   57.202987] RSP: 002b:00007ffe857ddb38 EFLAGS: 00000202 ORIG_RAX: 0000000000000003\n[   57.202989] RAX: ffffffffffffffda RBX: 00007ffe857dfd68 RCX: 00007fe2b12e4a94\n[   57.202991] RDX: 0000000000002000 RSI: 00007ffe857ddc40 RDI: 0000000000000003\n[   57.202992] RBP: 00007ffe857dfc50 R08: 7fffffffffffffff R09: 0000000065650f49\n[   57.202993] R10: 00007f\n---truncated---(CVE-2023-52623)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nsh: push-switch: Reorder cleanup operations to avoid use-after-free bug\r\n\r\nThe original code puts flush_work() before timer_shutdown_sync()\nin switch_drv_remove(). Although we use flush_work() to stop\nthe worker, it could be rescheduled in switch_timer(). As a result,\na use-after-free bug can occur. The details are shown below:\r\n\r\n      (cpu 0)                    |      (cpu 1)\nswitch_drv_remove()              |\n flush_work()                    |\n  ...                            |  switch_timer // timer\n                                 |   schedule_work(\u0026amp;psw-\u0026gt;work)\n timer_shutdown_sync()           |\n ...                             |  switch_work_handler // worker\n kfree(psw) // free              |\n                                 |   psw-\u0026gt;state = 0 // use\r\n\r\nThis patch puts timer_shutdown_sync() before flush_work() to\nmitigate the bugs. As a result, the worker and timer will be\nstopped safely before the deallocate operations.(CVE-2023-52629)\r\n\r\nRejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.(CVE-2023-52630)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\num: time-travel: fix time corruption\r\n\r\nIn \u0026apos;basic\u0026apos; time-travel mode (without =inf-cpu or =ext), we\nstill get timer interrupts. These can happen at arbitrary\npoints in time, i.e. while in timer_read(), which pushes\ntime forward just a little bit. Then, if we happen to get\nthe interrupt after calculating the new time to push to,\nbut before actually finishing that, the interrupt will set\nthe time to a value that\u0026apos;s incompatible with the forward,\nand we\u0026apos;ll crash because time goes backwards when we do the\nforwarding.\r\n\r\nFix this by reading the time_travel_time, calculating the\nadjustment, and doing the adjustment all with interrupts\ndisabled.(CVE-2023-52633)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nPM / devfreq: Synchronize devfreq_monitor_[start/stop]\r\n\r\nThere is a chance if a frequent switch of the governor\ndone in a loop result in timer list corruption where\ntimer cancel being done from two place one from\ncancel_delayed_work_sync() and followed by expire_timers()\ncan be seen from the traces[1].\r\n\r\nwhile true\ndo\n        echo \u0026quot;simple_ondemand\u0026quot; \u0026gt; /sys/class/devfreq/1d84000.ufshc/governor\n        echo \u0026quot;performance\u0026quot; \u0026gt; /sys/class/devfreq/1d84000.ufshc/governor\ndone\r\n\r\nIt looks to be issue with devfreq driver where\ndevice_monitor_[start/stop] need to synchronized so that\ndelayed work should get corrupted while it is either\nbeing queued or running or being cancelled.\r\n\r\nLet\u0026apos;s use polling flag and devfreq lock to synchronize the\nqueueing the timer instance twice and work data being\ncorrupted.\r\n\r\n[1]\n...\n..\n\u0026lt;idle\u0026gt;-0    [003]   9436.209662:  timer_cancel   timer=0xffffff80444f0428\n\u0026lt;idle\u0026gt;-0    [003]   9436.209664:  timer_expire_entry   timer=0xffffff80444f0428  now=0x10022da1c  function=__typeid__ZTSFvP10timer_listE_global_addr  baseclk=0x10022da1c\n\u0026lt;idle\u0026gt;-0    [003]   9436.209718:  timer_expire_exit   timer=0xffffff80444f0428\nkworker/u16:6-14217    [003]   9436.209863:  timer_start   timer=0xffffff80444f0428  function=__typeid__ZTSFvP10timer_listE_global_addr  expires=0x10022da2b  now=0x10022da1c  flags=182452227\nvendor.xxxyyy.ha-1593    [004]   9436.209888:  timer_cancel   timer=0xffffff80444f0428\nvendor.xxxyyy.ha-1593    [004]   9436.216390:  timer_init   timer=0xffffff80444f0428\nvendor.xxxyyy.ha-1593    [004]   9436.216392:  timer_start   timer=0xffffff80444f0428  function=__typeid__ZTSFvP10timer_listE_global_addr  expires=0x10022da2c  now=0x10022da1d  flags=186646532\nvendor.xxxyyy.ha-1593    [005]   9436.220992:  timer_cancel   timer=0xffffff80444f0428\nxxxyyyTraceManag-7795    [004]   9436.261641:  timer_cancel   timer=0xffffff80444f0428\r\n\r\n[2]\r\n\r\n 9436.261653][    C4] Unable to handle kernel paging request at virtual address dead00000000012a\n[ 9436.261664][    C4] Mem abort info:\n[ 9436.261666][    C4]   ESR = 0x96000044\n[ 9436.261669][    C4]   EC = 0x25: DABT (current EL), IL = 32 bits\n[ 9436.261671][    C4]   SET = 0, FnV = 0\n[ 9436.261673][    C4]   EA = 0, S1PTW = 0\n[ 9436.261675][    C4] Data abort info:\n[ 9436.261677][    C4]   ISV = 0, ISS = 0x00000044\n[ 9436.261680][    C4]   CM = 0, WnR = 1\n[ 9436.261682][    C4] [dead00000000012a] address between user and kernel address ranges\n[ 9436.261685][    C4] Internal error: Oops: 96000044 [#1] PREEMPT SMP\n[ 9436.261701][    C4] Skip md ftrace buffer dump for: 0x3a982d0\n...\r\n\r\n[ 9436.262138][    C4] CPU: 4 PID: 7795 Comm: TraceManag Tainted: G S      W  O      5.10.149-android12-9-o-g17f915d29d0c #1\n[ 9436.262141][    C4] Hardware name: Qualcomm Technologies, Inc.  (DT)\n[ 9436.262144][    C4] pstate: 22400085 (nzCv daIf +PAN -UAO +TCO BTYPE=--)\n[ 9436.262161][    C4] pc : expire_timers+0x9c/0x438\n[ 9436.262164][    C4] lr : expire_timers+0x2a4/0x438\n[ 9436.262168][    C4] sp : ffffffc010023dd0\n[ 9436.262171][    C4] x29: ffffffc010023df0 x28: ffffffd0636fdc18\n[ 9436.262178][    C4] x27: ffffffd063569dd0 x26: ffffffd063536008\n[ 9436.262182][    C4] x25: 0000000000000001 x24: ffffff88f7c69280\n[ 9436.262185][    C4] x23: 00000000000000e0 x22: dead000000000122\n[ 9436.262188][    C4] x21: 000000010022da29 x20: ffffff8af72b4e80\n[ 9436.262191][    C4] x19: ffffffc010023e50 x18: ffffffc010025038\n[ 9436.262195][    C4] x17: 0000000000000240 x16: 0000000000000201\n[ 9436.262199][    C4] x15: ffffffffffffffff x14: ffffff889f3c3100\n[ 9436.262203][    C4] x13: ffffff889f3c3100 x12: 00000000049f56b8\n[ 9436.262207][    C4] x11: 00000000049f56b8 x10: 00000000ffffffff\n[ 9436.262212][    C4] x9 : ffffffc010023e50 x8 : dead000000000122\n[ 9436.262216][    C4] x7 : ffffffffffffffff x6 : ffffffc0100239d8\n[ 9436.262220][    C4] x5 : 0000000000000000 x4 : 0000000000000101\n[ 9436.262223][    C4] x3 : 0000000000000080 x2 : ffffff8\n---truncated---(CVE-2023-52635)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ncan: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)\r\n\r\nLock jsk-\u0026gt;sk to prevent UAF when setsockopt(..., SO_J1939_FILTER, ...)\nmodifies jsk-\u0026gt;filters while receiving packets.\r\n\r\nFollowing trace was seen on affected system:\n ==================================================================\n BUG: KASAN: slab-use-after-free in j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939]\n Read of size 4 at addr ffff888012144014 by task j1939/350\r\n\r\n CPU: 0 PID: 350 Comm: j1939 Tainted: G        W  OE      6.5.0-rc5 #1\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014\n Call Trace:\n  print_report+0xd3/0x620\n  ? kasan_complete_mode_report_info+0x7d/0x200\n  ? j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939]\n  kasan_report+0xc2/0x100\n  ? j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939]\n  __asan_load4+0x84/0xb0\n  j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939]\n  j1939_sk_recv+0x20b/0x320 [can_j1939]\n  ? __kasan_check_write+0x18/0x20\n  ? __pfx_j1939_sk_recv+0x10/0x10 [can_j1939]\n  ? j1939_simple_recv+0x69/0x280 [can_j1939]\n  ? j1939_ac_recv+0x5e/0x310 [can_j1939]\n  j1939_can_recv+0x43f/0x580 [can_j1939]\n  ? __pfx_j1939_can_recv+0x10/0x10 [can_j1939]\n  ? raw_rcv+0x42/0x3c0 [can_raw]\n  ? __pfx_j1939_can_recv+0x10/0x10 [can_j1939]\n  can_rcv_filter+0x11f/0x350 [can]\n  can_receive+0x12f/0x190 [can]\n  ? __pfx_can_rcv+0x10/0x10 [can]\n  can_rcv+0xdd/0x130 [can]\n  ? __pfx_can_rcv+0x10/0x10 [can]\n  __netif_receive_skb_one_core+0x13d/0x150\n  ? __pfx___netif_receive_skb_one_core+0x10/0x10\n  ? __kasan_check_write+0x18/0x20\n  ? _raw_spin_lock_irq+0x8c/0xe0\n  __netif_receive_skb+0x23/0xb0\n  process_backlog+0x107/0x260\n  __napi_poll+0x69/0x310\n  net_rx_action+0x2a1/0x580\n  ? __pfx_net_rx_action+0x10/0x10\n  ? __pfx__raw_spin_lock+0x10/0x10\n  ? handle_irq_event+0x7d/0xa0\n  __do_softirq+0xf3/0x3f8\n  do_softirq+0x53/0x80\n  \u0026lt;/IRQ\u0026gt;\n  \u0026lt;TASK\u0026gt;\n  __local_bh_enable_ip+0x6e/0x70\n  netif_rx+0x16b/0x180\n  can_send+0x32b/0x520 [can]\n  ? __pfx_can_send+0x10/0x10 [can]\n  ? __check_object_size+0x299/0x410\n  raw_sendmsg+0x572/0x6d0 [can_raw]\n  ? __pfx_raw_sendmsg+0x10/0x10 [can_raw]\n  ? apparmor_socket_sendmsg+0x2f/0x40\n  ? __pfx_raw_sendmsg+0x10/0x10 [can_raw]\n  sock_sendmsg+0xef/0x100\n  sock_write_iter+0x162/0x220\n  ? __pfx_sock_write_iter+0x10/0x10\n  ? __rtnl_unlock+0x47/0x80\n  ? security_file_permission+0x54/0x320\n  vfs_write+0x6ba/0x750\n  ? __pfx_vfs_write+0x10/0x10\n  ? __fget_light+0x1ca/0x1f0\n  ? __rcu_read_unlock+0x5b/0x280\n  ksys_write+0x143/0x170\n  ? __pfx_ksys_write+0x10/0x10\n  ? __kasan_check_read+0x15/0x20\n  ? fpregs_assert_state_consistent+0x62/0x70\n  __x64_sys_write+0x47/0x60\n  do_syscall_64+0x60/0x90\n  ? do_syscall_64+0x6d/0x90\n  ? irqentry_exit+0x3f/0x50\n  ? exc_page_fault+0x79/0xf0\n  entry_SYSCALL_64_after_hwframe+0x6e/0xd8\r\n\r\n Allocated by task 348:\n  kasan_save_stack+0x2a/0x50\n  kasan_set_track+0x29/0x40\n  kasan_save_alloc_info+0x1f/0x30\n  __kasan_kmalloc+0xb5/0xc0\n  __kmalloc_node_track_caller+0x67/0x160\n  j1939_sk_setsockopt+0x284/0x450 [can_j1939]\n  __sys_setsockopt+0x15c/0x2f0\n  __x64_sys_setsockopt+0x6b/0x80\n  do_syscall_64+0x60/0x90\n  entry_SYSCALL_64_after_hwframe+0x6e/0xd8\r\n\r\n Freed by task 349:\n  kasan_save_stack+0x2a/0x50\n  kasan_set_track+0x29/0x40\n  kasan_save_free_info+0x2f/0x50\n  __kasan_slab_free+0x12e/0x1c0\n  __kmem_cache_free+0x1b9/0x380\n  kfree+0x7a/0x120\n  j1939_sk_setsockopt+0x3b2/0x450 [can_j1939]\n  __sys_setsockopt+0x15c/0x2f0\n  __x64_sys_setsockopt+0x6b/0x80\n  do_syscall_64+0x60/0x90\n  entry_SYSCALL_64_after_hwframe+0x6e/0xd8(CVE-2023-52637)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nKVM: s390: vsie: fix race during shadow creation\r\n\r\nRight now it is possible to see gmap-\u0026gt;private being zero in\nkvm_s390_vsie_gmap_notifier resulting in a crash.  This is due to the\nfact that we add gmap-\u0026gt;private == kvm after creation:\r\n\r\nstatic int acquire_gmap_shadow(struct kvm_vcpu *vcpu,\n                               struct vsie_page *vsie_page)\n{\n[...]\n        gmap = gmap_shadow(vcpu-\u0026gt;arch.gmap, asce, edat);\n        if (IS_ERR(gmap))\n                return PTR_ERR(gmap);\n        gmap-\u0026gt;private = vcpu-\u0026gt;kvm;\r\n\r\nLet children inherit the private field of the parent.(CVE-2023-52639)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled\r\n\r\nWhen QoS is disabled, the queue priority value will not map to the correct\nieee80211 queue since there is only one queue. Stop/wake queue 0 when QoS\nis disabled to prevent trying to stop/wake a non-existent queue and failing\nto stop/wake the actual queue instantiated.\r\n\r\nLog of issue before change (with kernel parameter qos=0):\n    [  +5.112651] ------------[ cut here ]------------\n    [  +0.000005] WARNING: CPU: 7 PID: 25513 at net/mac80211/util.c:449 __ieee80211_wake_queue+0xd5/0x180 [mac80211]\n    [  +0.000067] Modules linked in: b43(O) snd_seq_dummy snd_hrtimer snd_seq snd_seq_device nft_chain_nat xt_MASQUERADE nf_nat xfrm_user xfrm_algo xt_addrtype overlay ccm af_packet amdgpu snd_hda_codec_cirrus snd_hda_codec_generic ledtrig_audio drm_exec amdxcp gpu_sched xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip6t_rpfilter ipt_rpfilter xt_pkttype xt_LOG nf_log_syslog xt_tcpudp nft_compat nf_tables nfnetlink sch_fq_codel btusb uinput iTCO_wdt ctr btrtl intel_pmc_bxt i915 intel_rapl_msr mei_hdcp mei_pxp joydev at24 watchdog btintel atkbd libps2 serio radeon btbcm vivaldi_fmap btmtk intel_rapl_common snd_hda_codec_hdmi bluetooth uvcvideo nls_iso8859_1 applesmc nls_cp437 x86_pkg_temp_thermal snd_hda_intel intel_powerclamp vfat videobuf2_vmalloc coretemp fat snd_intel_dspcfg crc32_pclmul uvc polyval_clmulni snd_intel_sdw_acpi loop videobuf2_memops snd_hda_codec tun drm_suballoc_helper polyval_generic drm_ttm_helper drm_buddy tap ecdh_generic videobuf2_v4l2 gf128mul macvlan ttm ghash_clmulni_intel ecc tg3\n    [  +0.000044]  videodev bridge snd_hda_core rapl crc16 drm_display_helper cec mousedev snd_hwdep evdev intel_cstate bcm5974 hid_appleir videobuf2_common stp mac_hid libphy snd_pcm drm_kms_helper acpi_als mei_me intel_uncore llc mc snd_timer intel_gtt industrialio_triggered_buffer apple_mfi_fastcharge i2c_i801 mei snd lpc_ich agpgart ptp i2c_smbus thunderbolt apple_gmux i2c_algo_bit kfifo_buf video industrialio soundcore pps_core wmi tiny_power_button sbs sbshc button ac cordic bcma mac80211 cfg80211 ssb rfkill libarc4 kvm_intel kvm drm irqbypass fuse backlight firmware_class efi_pstore configfs efivarfs dmi_sysfs ip_tables x_tables autofs4 dm_crypt cbc encrypted_keys trusted asn1_encoder tee tpm rng_core input_leds hid_apple led_class hid_generic usbhid hid sd_mod t10_pi crc64_rocksoft crc64 crc_t10dif crct10dif_generic ahci libahci libata uhci_hcd ehci_pci ehci_hcd crct10dif_pclmul crct10dif_common sha512_ssse3 sha512_generic sha256_ssse3 sha1_ssse3 aesni_intel usbcore scsi_mod libaes crypto_simd cryptd scsi_common\n    [  +0.000055]  usb_common rtc_cmos btrfs blake2b_generic libcrc32c crc32c_generic crc32c_intel xor raid6_pq dm_snapshot dm_bufio dm_mod dax [last unloaded: b43(O)]\n    [  +0.000009] CPU: 7 PID: 25513 Comm: irq/17-b43 Tainted: G        W  O       6.6.7 #1-NixOS\n    [  +0.000003] Hardware name: Apple Inc. MacBookPro8,3/Mac-942459F5819B171B, BIOS 87.0.0.0.0 06/13/2019\n    [  +0.000001] RIP: 0010:__ieee80211_wake_queue+0xd5/0x180 [mac80211]\n    [  +0.000046] Code: 00 45 85 e4 0f 85 9b 00 00 00 48 8d bd 40 09 00 00 f0 48 0f ba ad 48 09 00 00 00 72 0f 5b 5d 41 5c 41 5d 41 5e e9 cb 6d 3c d0 \u0026lt;0f\u0026gt; 0b 5b 5d 41 5c 41 5d 41 5e c3 cc cc cc cc 48 8d b4 16 94 00 00\n    [  +0.000002] RSP: 0018:ffffc90003c77d60 EFLAGS: 00010097\n    [  +0.000001] RAX: 0000000000000001 RBX: 0000000000000002 RCX: 0000000000000000\n    [  +0.000001] RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffff88820b924900\n    [  +0.000002] RBP: ffff88820b924900 R08: ffffc90003c77d90 R09: 000000000003bfd0\n    [  +0.000001] R10: ffff88820b924900 R11: ffffc90003c77c68 R12: 0000000000000000\n    [  +0.000001] R13: 0000000000000000 R14: ffffc90003c77d90 R15: ffffffffc0fa6f40\n    [  +0.000001] FS:  0000000000000000(0000) GS:ffff88846fb80000(0000) knlGS:0000000000000000\n    [  +0.000001] CS:  0010 DS: 0\n---truncated---(CVE-2023-52644)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\npowerpc/imc-pmu: Add a null pointer check in update_events_in_group()\r\n\r\nkasprintf() returns a pointer to dynamically allocated memory\nwhich can be NULL upon failure.(CVE-2023-52675)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbpf: Guard stack limits against 32bit overflow\r\n\r\nThis patch promotes the arithmetic around checking stack bounds to be\ndone in the 64-bit domain, instead of the current 32bit. The arithmetic\nimplies adding together a 64-bit register with a int offset. The\nregister was checked to be below 1\u0026lt;\u0026lt;29 when it was variable, but not\nwhen it was fixed. The offset either comes from an instruction (in which\ncase it is 16 bit), from another register (in which case the caller\nchecked it to be below 1\u0026lt;\u0026lt;29 [1]), or from the size of an argument to a\nkfunc (in which case it can be a u32 [2]). Between the register being\ninconsistently checked to be below 1\u0026lt;\u0026lt;29, and the offset being up to an\nu32, it appears that we were open to overflowing the `int`s which were\ncurrently used for arithmetic.\r\n\r\n[1] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L7494-L7498\n[2] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L11904(CVE-2023-52676)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\npstore: ram_core: fix possible overflow in persistent_ram_init_ecc()\r\n\r\nIn persistent_ram_init_ecc(), on 64-bit arches DIV_ROUND_UP() will return\n64-bit value since persistent_ram_zone::buffer_size has type size_t which\nis derived from the 64-bit *unsigned long*, while the ecc_blocks variable\nthis value gets assigned to has (always 32-bit) *int* type.  Even if that\nvalue fits into *int* type, an overflow is still possible when calculating\nthe size_t typed ecc_total variable further below since there\u0026apos;s no cast to\nany 64-bit type before multiplication.  Declaring the ecc_blocks variable\nas *size_t* should fix this mess...\r\n\r\nFound by Linux Verification Center (linuxtesting.org) with the SVACE static\nanalysis tool.(CVE-2023-52685)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\npowerpc/powernv: Add a null pointer check to scom_debug_init_one()\r\n\r\nkasprintf() returns a pointer to dynamically allocated memory\nwhich can be NULL upon failure.\nAdd a null pointer check, and release \u0026apos;ent\u0026apos; to avoid memory leaks.(CVE-2023-52690)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/bridge: tpd12s015: Drop buggy __exit annotation for remove function\r\n\r\nWith tpd12s015_remove() marked with __exit this function is discarded\nwhen the driver is compiled as a built-in. The result is that when the\ndriver unbinds there is no cleanup done which results in resource\nleakage or worse.(CVE-2023-52694)\r\n\r\nA race condition was found in the Linux kernel\u0026apos;s bluetooth device driver in {min,max}_key_size_set() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.\r\n\r\n\r\n\r\n\n(CVE-2024-24860)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: iwlwifi: fix a memory corruption\r\n\r\niwl_fw_ini_trigger_tlv::data is a pointer to a __le32, which means that\nif we copy to iwl_fw_ini_trigger_tlv::data + offset while offset is in\nbytes, we\u0026apos;ll write past the buffer.(CVE-2024-26610)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()\r\n\r\nsyzbot pointed out [1] that NEXTHDR_FRAGMENT handling is broken.\r\n\r\nReading frag_off can only be done if we pulled enough bytes\nto skb-\u0026gt;head. Currently we might access garbage.\r\n\r\n[1]\nBUG: KMSAN: uninit-value in ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0\nip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0\nipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline]\nip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432\n__netdev_start_xmit include/linux/netdevice.h:4940 [inline]\nnetdev_start_xmit include/linux/netdevice.h:4954 [inline]\nxmit_one net/core/dev.c:3548 [inline]\ndev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564\n__dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349\ndev_queue_xmit include/linux/netdevice.h:3134 [inline]\nneigh_connected_output+0x569/0x660 net/core/neighbour.c:1592\nneigh_output include/net/neighbour.h:542 [inline]\nip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137\nip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222\nNF_HOOK_COND include/linux/netfilter.h:303 [inline]\nip6_output+0x323/0x610 net/ipv6/ip6_output.c:243\ndst_output include/net/dst.h:451 [inline]\nip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155\nip6_send_skb net/ipv6/ip6_output.c:1952 [inline]\nip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972\nrawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582\nrawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920\ninet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847\nsock_sendmsg_nosec net/socket.c:730 [inline]\n__sock_sendmsg net/socket.c:745 [inline]\n____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584\n___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638\n__sys_sendmsg net/socket.c:2667 [inline]\n__do_sys_sendmsg net/socket.c:2676 [inline]\n__se_sys_sendmsg net/socket.c:2674 [inline]\n__x64_sys_sendmsg+0x307/0x490 net/socket.c:2674\ndo_syscall_x64 arch/x86/entry/common.c:52 [inline]\ndo_syscall_64+0x44/0x110 arch/x86/entry/common.c:83\nentry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nUninit was created at:\nslab_post_alloc_hook+0x129/0xa70 mm/slab.h:768\nslab_alloc_node mm/slub.c:3478 [inline]\n__kmem_cache_alloc_node+0x5c9/0x970 mm/slub.c:3517\n__do_kmalloc_node mm/slab_common.c:1006 [inline]\n__kmalloc_node_track_caller+0x118/0x3c0 mm/slab_common.c:1027\nkmalloc_reserve+0x249/0x4a0 net/core/skbuff.c:582\npskb_expand_head+0x226/0x1a00 net/core/skbuff.c:2098\n__pskb_pull_tail+0x13b/0x2310 net/core/skbuff.c:2655\npskb_may_pull_reason include/linux/skbuff.h:2673 [inline]\npskb_may_pull include/linux/skbuff.h:2681 [inline]\nip6_tnl_parse_tlv_enc_lim+0x901/0xbb0 net/ipv6/ip6_tunnel.c:408\nipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline]\nip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432\n__netdev_start_xmit include/linux/netdevice.h:4940 [inline]\nnetdev_start_xmit include/linux/netdevice.h:4954 [inline]\nxmit_one net/core/dev.c:3548 [inline]\ndev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564\n__dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349\ndev_queue_xmit include/linux/netdevice.h:3134 [inline]\nneigh_connected_output+0x569/0x660 net/core/neighbour.c:1592\nneigh_output include/net/neighbour.h:542 [inline]\nip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137\nip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222\nNF_HOOK_COND include/linux/netfilter.h:303 [inline]\nip6_output+0x323/0x610 net/ipv6/ip6_output.c:243\ndst_output include/net/dst.h:451 [inline]\nip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155\nip6_send_skb net/ipv6/ip6_output.c:1952 [inline]\nip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972\nrawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582\nrawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920\ninet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847\nsock_sendmsg_nosec net/socket.c:730 [inline]\n__sock_sendmsg net/socket.c:745 [inline]\n____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584\n___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638\n__sys_sendmsg net/socket.c:2667 [inline]\n__do_sys_sendms\n---truncated---(CVE-2024-26633)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nllc: Drop support for ETH_P_TR_802_2.\r\n\r\nsyzbot reported an uninit-value bug below. [0]\r\n\r\nllc supports ETH_P_802_2 (0x0004) and used to support ETH_P_TR_802_2\n(0x0011), and syzbot abused the latter to trigger the bug.\r\n\r\n  write$tun(r0, \u0026amp;(0x7f0000000040)={@val={0x0, 0x11}, @val, @mpls={[], @llc={@snap={0xaa, 0x1, \u0026apos;)\u0026apos;, \u0026quot;90e5dd\u0026quot;}}}}, 0x16)\r\n\r\nllc_conn_handler() initialises local variables {saddr,daddr}.mac\nbased on skb in llc_pdu_decode_sa()/llc_pdu_decode_da() and passes\nthem to __llc_lookup().\r\n\r\nHowever, the initialisation is done only when skb-\u0026gt;protocol is\nhtons(ETH_P_802_2), otherwise, __llc_lookup_established() and\n__llc_lookup_listener() will read garbage.\r\n\r\nThe missing initialisation existed prior to commit 211ed865108e\n(\u0026quot;net: delete all instances of special processing for token ring\u0026quot;).\r\n\r\nIt removed the part to kick out the token ring stuff but forgot to\nclose the door allowing ETH_P_TR_802_2 packets to sneak into llc_rcv().\r\n\r\nLet\u0026apos;s remove llc_tr_packet_type and complete the deprecation.\r\n\r\n[0]:\nBUG: KMSAN: uninit-value in __llc_lookup_established+0xe9d/0xf90\n __llc_lookup_established+0xe9d/0xf90\n __llc_lookup net/llc/llc_conn.c:611 [inline]\n llc_conn_handler+0x4bd/0x1360 net/llc/llc_conn.c:791\n llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206\n __netif_receive_skb_one_core net/core/dev.c:5527 [inline]\n __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5641\n netif_receive_skb_internal net/core/dev.c:5727 [inline]\n netif_receive_skb+0x58/0x660 net/core/dev.c:5786\n tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555\n tun_get_user+0x53af/0x66d0 drivers/net/tun.c:2002\n tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048\n call_write_iter include/linux/fs.h:2020 [inline]\n new_sync_write fs/read_write.c:491 [inline]\n vfs_write+0x8ef/0x1490 fs/read_write.c:584\n ksys_write+0x20f/0x4c0 fs/read_write.c:637\n __do_sys_write fs/read_write.c:649 [inline]\n __se_sys_write fs/read_write.c:646 [inline]\n __x64_sys_write+0x93/0xd0 fs/read_write.c:646\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nLocal variable daddr created at:\n llc_conn_handler+0x53/0x1360 net/llc/llc_conn.c:783\n llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206\r\n\r\nCPU: 1 PID: 5004 Comm: syz-executor994 Not tainted 6.6.0-syzkaller-14500-g1c41041124bd #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023(CVE-2024-26635)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nllc: make llc_ui_sendmsg() more robust against bonding changes\r\n\r\nsyzbot was able to trick llc_ui_sendmsg(), allocating an skb with no\nheadroom, but subsequently trying to push 14 bytes of Ethernet header [1]\r\n\r\nLike some others, llc_ui_sendmsg() releases the socket lock before\ncalling sock_alloc_send_skb().\nThen it acquires it again, but does not redo all the sanity checks\nthat were performed.\r\n\r\nThis fix:\r\n\r\n- Uses LL_RESERVED_SPACE() to reserve space.\n- Check all conditions again after socket lock is held again.\n- Do not account Ethernet header for mtu limitation.\r\n\r\n[1]\r\n\r\nskbuff: skb_under_panic: text:ffff800088baa334 len:1514 put:14 head:ffff0000c9c37000 data:ffff0000c9c36ff2 tail:0x5dc end:0x6c0 dev:bond0\r\n\r\n kernel BUG at net/core/skbuff.c:193 !\nInternal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP\nModules linked in:\nCPU: 0 PID: 6875 Comm: syz-executor.0 Not tainted 6.7.0-rc8-syzkaller-00101-g0802e17d9aca-dirty #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023\npstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : skb_panic net/core/skbuff.c:189 [inline]\n pc : skb_under_panic+0x13c/0x140 net/core/skbuff.c:203\n lr : skb_panic net/core/skbuff.c:189 [inline]\n lr : skb_under_panic+0x13c/0x140 net/core/skbuff.c:203\nsp : ffff800096f97000\nx29: ffff800096f97010 x28: ffff80008cc8d668 x27: dfff800000000000\nx26: ffff0000cb970c90 x25: 00000000000005dc x24: ffff0000c9c36ff2\nx23: ffff0000c9c37000 x22: 00000000000005ea x21: 00000000000006c0\nx20: 000000000000000e x19: ffff800088baa334 x18: 1fffe000368261ce\nx17: ffff80008e4ed000 x16: ffff80008a8310f8 x15: 0000000000000001\nx14: 1ffff00012df2d58 x13: 0000000000000000 x12: 0000000000000000\nx11: 0000000000000001 x10: 0000000000ff0100 x9 : e28a51f1087e8400\nx8 : e28a51f1087e8400 x7 : ffff80008028f8d0 x6 : 0000000000000000\nx5 : 0000000000000001 x4 : 0000000000000001 x3 : ffff800082b78714\nx2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000089\nCall trace:\n  skb_panic net/core/skbuff.c:189 [inline]\n  skb_under_panic+0x13c/0x140 net/core/skbuff.c:203\n  skb_push+0xf0/0x108 net/core/skbuff.c:2451\n  eth_header+0x44/0x1f8 net/ethernet/eth.c:83\n  dev_hard_header include/linux/netdevice.h:3188 [inline]\n  llc_mac_hdr_init+0x110/0x17c net/llc/llc_output.c:33\n  llc_sap_action_send_xid_c+0x170/0x344 net/llc/llc_s_ac.c:85\n  llc_exec_sap_trans_actions net/llc/llc_sap.c:153 [inline]\n  llc_sap_next_state net/llc/llc_sap.c:182 [inline]\n  llc_sap_state_process+0x1ec/0x774 net/llc/llc_sap.c:209\n  llc_build_and_send_xid_pkt+0x12c/0x1c0 net/llc/llc_sap.c:270\n  llc_ui_sendmsg+0x7bc/0xb1c net/llc/af_llc.c:997\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg net/socket.c:745 [inline]\n  sock_sendmsg+0x194/0x274 net/socket.c:767\n  splice_to_socket+0x7cc/0xd58 fs/splice.c:881\n  do_splice_from fs/splice.c:933 [inline]\n  direct_splice_actor+0xe4/0x1c0 fs/splice.c:1142\n  splice_direct_to_actor+0x2a0/0x7e4 fs/splice.c:1088\n  do_splice_direct+0x20c/0x348 fs/splice.c:1194\n  do_sendfile+0x4bc/0xc70 fs/read_write.c:1254\n  __do_sys_sendfile64 fs/read_write.c:1322 [inline]\n  __se_sys_sendfile64 fs/read_write.c:1308 [inline]\n  __arm64_sys_sendfile64+0x160/0x3b4 fs/read_write.c:1308\n  __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]\n  invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51\n  el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136\n  do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155\n  el0_svc+0x54/0x158 arch/arm64/kernel/entry-common.c:678\n  el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696\n  el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:595\nCode: aa1803e6 aa1903e7 a90023f5 94792f6a (d4210000)(CVE-2024-26636)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntcp: add sanity checks to rx zerocopy\r\n\r\nTCP rx zerocopy intent is to map pages initially allocated\nfrom NIC drivers, not pages owned by a fs.\r\n\r\nThis patch adds to can_map_frag() these additional checks:\r\n\r\n- Page must not be a compound one.\n- page-\u0026gt;mapping must be NULL.\r\n\r\nThis fixes the panic reported by ZhangPeng.\r\n\r\nsyzbot was able to loopback packets built with sendfile(),\nmapping pages owned by an ext4 file to TCP rx zerocopy.\r\n\r\nr3 = socket$inet_tcp(0x2, 0x1, 0x0)\nmmap(\u0026amp;(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x12, r3, 0x0)\nr4 = socket$inet_tcp(0x2, 0x1, 0x0)\nbind$inet(r4, \u0026amp;(0x7f0000000000)={0x2, 0x4e24, @multicast1}, 0x10)\nconnect$inet(r4, \u0026amp;(0x7f00000006c0)={0x2, 0x4e24, @empty}, 0x10)\nr5 = openat$dir(0xffffffffffffff9c, \u0026amp;(0x7f00000000c0)=\u0026apos;./file0\\x00\u0026apos;,\n    0x181e42, 0x0)\nfallocate(r5, 0x0, 0x0, 0x85b8)\nsendfile(r4, r5, 0x0, 0x8ba0)\ngetsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r4, 0x6, 0x23,\n    \u0026amp;(0x7f00000001c0)={\u0026amp;(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0,\n    0x0, 0x0, 0x0, 0x0}, \u0026amp;(0x7f0000000440)=0x40)\nr6 = openat$dir(0xffffffffffffff9c, \u0026amp;(0x7f00000000c0)=\u0026apos;./file0\\x00\u0026apos;,\n    0x181e42, 0x0)(CVE-2024-26640)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()\r\n\r\nsyzbot found __ip6_tnl_rcv() could access unitiliazed data [1].\r\n\r\nCall pskb_inet_may_pull() to fix this, and initialize ipv6h\nvariable after this call as it can change skb-\u0026gt;head.\r\n\r\n[1]\n BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]\n BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]\n BUG: KMSAN: uninit-value in IP6_ECN_decapsulate+0x7df/0x1e50 include/net/inet_ecn.h:321\n  __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]\n  INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]\n  IP6_ECN_decapsulate+0x7df/0x1e50 include/net/inet_ecn.h:321\n  ip6ip6_dscp_ecn_decapsulate+0x178/0x1b0 net/ipv6/ip6_tunnel.c:727\n  __ip6_tnl_rcv+0xd4e/0x1590 net/ipv6/ip6_tunnel.c:845\n  ip6_tnl_rcv+0xce/0x100 net/ipv6/ip6_tunnel.c:888\n gre_rcv+0x143f/0x1870\n  ip6_protocol_deliver_rcu+0xda6/0x2a60 net/ipv6/ip6_input.c:438\n  ip6_input_finish net/ipv6/ip6_input.c:483 [inline]\n  NF_HOOK include/linux/netfilter.h:314 [inline]\n  ip6_input+0x15d/0x430 net/ipv6/ip6_input.c:492\n  ip6_mc_input+0xa7e/0xc80 net/ipv6/ip6_input.c:586\n  dst_input include/net/dst.h:461 [inline]\n  ip6_rcv_finish+0x5db/0x870 net/ipv6/ip6_input.c:79\n  NF_HOOK include/linux/netfilter.h:314 [inline]\n  ipv6_rcv+0xda/0x390 net/ipv6/ip6_input.c:310\n  __netif_receive_skb_one_core net/core/dev.c:5532 [inline]\n  __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5646\n  netif_receive_skb_internal net/core/dev.c:5732 [inline]\n  netif_receive_skb+0x58/0x660 net/core/dev.c:5791\n  tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555\n  tun_get_user+0x53af/0x66d0 drivers/net/tun.c:2002\n  tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048\n  call_write_iter include/linux/fs.h:2084 [inline]\n  new_sync_write fs/read_write.c:497 [inline]\n  vfs_write+0x786/0x1200 fs/read_write.c:590\n  ksys_write+0x20f/0x4c0 fs/read_write.c:643\n  __do_sys_write fs/read_write.c:655 [inline]\n  __se_sys_write fs/read_write.c:652 [inline]\n  __x64_sys_write+0x93/0xd0 fs/read_write.c:652\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0x6d/0x140 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nUninit was created at:\n  slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768\n  slab_alloc_node mm/slub.c:3478 [inline]\n  kmem_cache_alloc_node+0x5e9/0xb10 mm/slub.c:3523\n  kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560\n  __alloc_skb+0x318/0x740 net/core/skbuff.c:651\n  alloc_skb include/linux/skbuff.h:1286 [inline]\n  alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6334\n  sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2787\n  tun_alloc_skb drivers/net/tun.c:1531 [inline]\n  tun_get_user+0x1e8a/0x66d0 drivers/net/tun.c:1846\n  tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048\n  call_write_iter include/linux/fs.h:2084 [inline]\n  new_sync_write fs/read_write.c:497 [inline]\n  vfs_write+0x786/0x1200 fs/read_write.c:590\n  ksys_write+0x20f/0x4c0 fs/read_write.c:643\n  __do_sys_write fs/read_write.c:655 [inline]\n  __se_sys_write fs/read_write.c:652 [inline]\n  __x64_sys_write+0x93/0xd0 fs/read_write.c:652\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0x6d/0x140 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nCPU: 0 PID: 5034 Comm: syz-executor331 Not tainted 6.7.0-syzkaller-00562-g9f8413c4a66f #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023(CVE-2024-26641)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nf_tables: disallow anonymous set with timeout flag\r\n\r\nAnonymous sets are never used with timeout from userspace, reject this.\nException to this rule is NFT_SET_EVAL to ensure legacy meters still work.(CVE-2024-26642)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntracing: Ensure visibility when inserting an element into tracing_map\r\n\r\nRunning the following two commands in parallel on a multi-processor\nAArch64 machine can sporadically produce an unexpected warning about\nduplicate histogram entries:\r\n\r\n $ while true; do\n     echo hist:key=id.syscall:val=hitcount \u0026gt; \\\n       /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/trigger\n     cat /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/hist\n     sleep 0.001\n   done\n $ stress-ng --sysbadaddr $(nproc)\r\n\r\nThe warning looks as follows:\r\n\r\n[ 2911.172474] ------------[ cut here ]------------\n[ 2911.173111] Duplicates detected: 1\n[ 2911.173574] WARNING: CPU: 2 PID: 12247 at kernel/trace/tracing_map.c:983 tracing_map_sort_entries+0x3e0/0x408\n[ 2911.174702] Modules linked in: iscsi_ibft(E) iscsi_boot_sysfs(E) rfkill(E) af_packet(E) nls_iso8859_1(E) nls_cp437(E) vfat(E) fat(E) ena(E) tiny_power_button(E) qemu_fw_cfg(E) button(E) fuse(E) efi_pstore(E) ip_tables(E) x_tables(E) xfs(E) libcrc32c(E) aes_ce_blk(E) aes_ce_cipher(E) crct10dif_ce(E) polyval_ce(E) polyval_generic(E) ghash_ce(E) gf128mul(E) sm4_ce_gcm(E) sm4_ce_ccm(E) sm4_ce(E) sm4_ce_cipher(E) sm4(E) sm3_ce(E) sm3(E) sha3_ce(E) sha512_ce(E) sha512_arm64(E) sha2_ce(E) sha256_arm64(E) nvme(E) sha1_ce(E) nvme_core(E) nvme_auth(E) t10_pi(E) sg(E) scsi_mod(E) scsi_common(E) efivarfs(E)\n[ 2911.174738] Unloaded tainted modules: cppc_cpufreq(E):1\n[ 2911.180985] CPU: 2 PID: 12247 Comm: cat Kdump: loaded Tainted: G            E      6.7.0-default #2 1b58bbb22c97e4399dc09f92d309344f69c44a01\n[ 2911.182398] Hardware name: Amazon EC2 c7g.8xlarge/, BIOS 1.0 11/1/2018\n[ 2911.183208] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n[ 2911.184038] pc : tracing_map_sort_entries+0x3e0/0x408\n[ 2911.184667] lr : tracing_map_sort_entries+0x3e0/0x408\n[ 2911.185310] sp : ffff8000a1513900\n[ 2911.185750] x29: ffff8000a1513900 x28: ffff0003f272fe80 x27: 0000000000000001\n[ 2911.186600] x26: ffff0003f272fe80 x25: 0000000000000030 x24: 0000000000000008\n[ 2911.187458] x23: ffff0003c5788000 x22: ffff0003c16710c8 x21: ffff80008017f180\n[ 2911.188310] x20: ffff80008017f000 x19: ffff80008017f180 x18: ffffffffffffffff\n[ 2911.189160] x17: 0000000000000000 x16: 0000000000000000 x15: ffff8000a15134b8\n[ 2911.190015] x14: 0000000000000000 x13: 205d373432323154 x12: 5b5d313131333731\n[ 2911.190844] x11: 00000000fffeffff x10: 00000000fffeffff x9 : ffffd1b78274a13c\n[ 2911.191716] x8 : 000000000017ffe8 x7 : c0000000fffeffff x6 : 000000000057ffa8\n[ 2911.192554] x5 : ffff0012f6c24ec0 x4 : 0000000000000000 x3 : ffff2e5b72b5d000\n[ 2911.193404] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0003ff254480\n[ 2911.194259] Call trace:\n[ 2911.194626]  tracing_map_sort_entries+0x3e0/0x408\n[ 2911.195220]  hist_show+0x124/0x800\n[ 2911.195692]  seq_read_iter+0x1d4/0x4e8\n[ 2911.196193]  seq_read+0xe8/0x138\n[ 2911.196638]  vfs_read+0xc8/0x300\n[ 2911.197078]  ksys_read+0x70/0x108\n[ 2911.197534]  __arm64_sys_read+0x24/0x38\n[ 2911.198046]  invoke_syscall+0x78/0x108\n[ 2911.198553]  el0_svc_common.constprop.0+0xd0/0xf8\n[ 2911.199157]  do_el0_svc+0x28/0x40\n[ 2911.199613]  el0_svc+0x40/0x178\n[ 2911.200048]  el0t_64_sync_handler+0x13c/0x158\n[ 2911.200621]  el0t_64_sync+0x1a8/0x1b0\n[ 2911.201115] ---[ end trace 0000000000000000 ]---\r\n\r\nThe problem appears to be caused by CPU reordering of writes issued from\n__tracing_map_insert().\r\n\r\nThe check for the presence of an element with a given key in this\nfunction is:\r\n\r\n val = READ_ONCE(entry-\u0026gt;val);\n if (val \u0026amp;\u0026amp; keys_match(key, val-\u0026gt;key, map-\u0026gt;key_size)) ...\r\n\r\nThe write of a new entry is:\r\n\r\n elt = get_free_elt(map);\n memcpy(elt-\u0026gt;key, key, map-\u0026gt;key_size);\n entry-\u0026gt;val = elt;\r\n\r\nThe \u0026quot;memcpy(elt-\u0026gt;key, key, map-\u0026gt;key_size);\u0026quot; and \u0026quot;entry-\u0026gt;val = elt;\u0026quot;\nstores may become visible in the reversed order on another CPU. This\nsecond CPU might then incorrectly determine that a new key doesn\u0026apos;t match\nan already present val-\u0026gt;key and subse\n---truncated---(CVE-2024-26645)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/amd/display: Add NULL test for \u0026apos;timing generator\u0026apos; in \u0026apos;dcn21_set_pipe()\u0026apos;\r\n\r\nIn \u0026quot;u32 otg_inst = pipe_ctx-\u0026gt;stream_res.tg-\u0026gt;inst;\u0026quot;\npipe_ctx-\u0026gt;stream_res.tg could be NULL, it is relying on the caller to\nensure the tg is not NULL.(CVE-2024-26661)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntunnels: fix out of bounds access when building IPv6 PMTU error\r\n\r\nIf the ICMPv6 error is built from a non-linear skb we get the following\nsplat,\r\n\r\n  BUG: KASAN: slab-out-of-bounds in do_csum+0x220/0x240\n  Read of size 4 at addr ffff88811d402c80 by task netperf/820\n  CPU: 0 PID: 820 Comm: netperf Not tainted 6.8.0-rc1+ #543\n  ...\n   kasan_report+0xd8/0x110\n   do_csum+0x220/0x240\n   csum_partial+0xc/0x20\n   skb_tunnel_check_pmtu+0xeb9/0x3280\n   vxlan_xmit_one+0x14c2/0x4080\n   vxlan_xmit+0xf61/0x5c00\n   dev_hard_start_xmit+0xfb/0x510\n   __dev_queue_xmit+0x7cd/0x32a0\n   br_dev_queue_push_xmit+0x39d/0x6a0\r\n\r\nUse skb_checksum instead of csum_partial who cannot deal with non-linear\nSKBs.(CVE-2024-26665)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nppp_async: limit MRU to 64K\r\n\r\nsyzbot triggered a warning [1] in __alloc_pages():\r\n\r\nWARN_ON_ONCE_GFP(order \u0026gt; MAX_PAGE_ORDER, gfp)\r\n\r\nWillem fixed a similar issue in commit c0a2a1b0d631 (\u0026quot;ppp: limit MRU to 64K\u0026quot;)\r\n\r\nAdopt the same sanity check for ppp_async_ioctl(PPPIOCSMRU)\r\n\r\n[1]:\r\n\r\n WARNING: CPU: 1 PID: 11 at mm/page_alloc.c:4543 __alloc_pages+0x308/0x698 mm/page_alloc.c:4543\nModules linked in:\nCPU: 1 PID: 11 Comm: kworker/u4:0 Not tainted 6.8.0-rc2-syzkaller-g41bccc98fb79 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023\nWorkqueue: events_unbound flush_to_ldisc\npstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : __alloc_pages+0x308/0x698 mm/page_alloc.c:4543\n lr : __alloc_pages+0xc8/0x698 mm/page_alloc.c:4537\nsp : ffff800093967580\nx29: ffff800093967660 x28: ffff8000939675a0 x27: dfff800000000000\nx26: ffff70001272ceb4 x25: 0000000000000000 x24: ffff8000939675c0\nx23: 0000000000000000 x22: 0000000000060820 x21: 1ffff0001272ceb8\nx20: ffff8000939675e0 x19: 0000000000000010 x18: ffff800093967120\nx17: ffff800083bded5c x16: ffff80008ac97500 x15: 0000000000000005\nx14: 1ffff0001272cebc x13: 0000000000000000 x12: 0000000000000000\nx11: ffff70001272cec1 x10: 1ffff0001272cec0 x9 : 0000000000000001\nx8 : ffff800091c91000 x7 : 0000000000000000 x6 : 000000000000003f\nx5 : 00000000ffffffff x4 : 0000000000000000 x3 : 0000000000000020\nx2 : 0000000000000008 x1 : 0000000000000000 x0 : ffff8000939675e0\nCall trace:\n  __alloc_pages+0x308/0x698 mm/page_alloc.c:4543\n  __alloc_pages_node include/linux/gfp.h:238 [inline]\n  alloc_pages_node include/linux/gfp.h:261 [inline]\n  __kmalloc_large_node+0xbc/0x1fc mm/slub.c:3926\n  __do_kmalloc_node mm/slub.c:3969 [inline]\n  __kmalloc_node_track_caller+0x418/0x620 mm/slub.c:4001\n  kmalloc_reserve+0x17c/0x23c net/core/skbuff.c:590\n  __alloc_skb+0x1c8/0x3d8 net/core/skbuff.c:651\n  __netdev_alloc_skb+0xb8/0x3e8 net/core/skbuff.c:715\n  netdev_alloc_skb include/linux/skbuff.h:3235 [inline]\n  dev_alloc_skb include/linux/skbuff.h:3248 [inline]\n  ppp_async_input drivers/net/ppp/ppp_async.c:863 [inline]\n  ppp_asynctty_receive+0x588/0x186c drivers/net/ppp/ppp_async.c:341\n  tty_ldisc_receive_buf+0x12c/0x15c drivers/tty/tty_buffer.c:390\n  tty_port_default_receive_buf+0x74/0xac drivers/tty/tty_port.c:37\n  receive_buf drivers/tty/tty_buffer.c:444 [inline]\n  flush_to_ldisc+0x284/0x6e4 drivers/tty/tty_buffer.c:494\n  process_one_work+0x694/0x1204 kernel/workqueue.c:2633\n  process_scheduled_works kernel/workqueue.c:2706 [inline]\n  worker_thread+0x938/0xef4 kernel/workqueue.c:2787\n  kthread+0x288/0x310 kernel/kthread.c:388\n  ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860(CVE-2024-26675)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ninet: read sk-\u0026gt;sk_family once in inet_recv_error()\r\n\r\ninet_recv_error() is called without holding the socket lock.\r\n\r\nIPv6 socket could mutate to IPv4 with IPV6_ADDRFORM\nsocket option and trigger a KCSAN warning.(CVE-2024-26679)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: stmmac: xgmac: fix handling of DPP safety error for DMA channels\r\n\r\nCommit 56e58d6c8a56 (\u0026quot;net: stmmac: Implement Safety Features in\nXGMAC core\u0026quot;) checks and reports safety errors, but leaves the\nData Path Parity Errors for each channel in DMA unhandled at all, lead to\na storm of interrupt.\nFix it by checking and clearing the DMA_DPP_Interrupt_Status register.(CVE-2024-26684)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnilfs2: fix potential bug in end_buffer_async_write\r\n\r\nAccording to a syzbot report, end_buffer_async_write(), which handles the\ncompletion of block device writes, may detect abnormal condition of the\nbuffer async_write flag and cause a BUG_ON failure when using nilfs2.\r\n\r\nNilfs2 itself does not use end_buffer_async_write().  But, the async_write\nflag is now used as a marker by commit 7f42ec394156 (\u0026quot;nilfs2: fix issue\nwith race condition of competition between segments for dirty blocks\u0026quot;) as\na means of resolving double list insertion of dirty blocks in\nnilfs_lookup_dirty_data_buffers() and nilfs_lookup_node_buffers() and the\nresulting crash.\r\n\r\nThis modification is safe as long as it is used for file data and b-tree\nnode blocks where the page caches are independent.  However, it was\nirrelevant and redundant to also introduce async_write for segment summary\nand super root blocks that share buffers with the backing device.  This\nled to the possibility that the BUG_ON check in end_buffer_async_write\nwould fail as described above, if independent writebacks of the backing\ndevice occurred in parallel.\r\n\r\nThe use of async_write for segment summary buffers has already been\nremoved in a previous change.\r\n\r\nFix this issue by removing the manipulation of the async_write flag for\nthe remaining super root block buffer.(CVE-2024-26685)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nfs/proc: do_task_stat: use sig-\u0026gt;stats_lock to gather the threads/children stats\r\n\r\nlock_task_sighand() can trigger a hard lockup.  If NR_CPUS threads call\ndo_task_stat() at the same time and the process has NR_THREADS, it will\nspin with irqs disabled O(NR_CPUS * NR_THREADS) time.\r\n\r\nChange do_task_stat() to use sig-\u0026gt;stats_lock to gather the statistics\noutside of -\u0026gt;siglock protected section, in the likely case this code will\nrun lockless.(CVE-2024-26686)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnilfs2: fix data corruption in dsync block recovery for small block sizes\r\n\r\nThe helper function nilfs_recovery_copy_block() of\nnilfs_recovery_dsync_blocks(), which recovers data from logs created by\ndata sync writes during a mount after an unclean shutdown, incorrectly\ncalculates the on-page offset when copying repair data to the file\u0026apos;s page\ncache.  In environments where the block size is smaller than the page\nsize, this flaw can cause data corruption and leak uninitialized memory\nbytes during the recovery process.\r\n\r\nFix these issues by correcting this byte offset calculation on the page.(CVE-2024-26697)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\niio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC\r\n\r\nRecently, we encounter kernel crash in function rm3100_common_probe\ncaused by out of bound access of array rm3100_samp_rates (because of\nunderlying hardware failures). Add boundary check to prevent out of\nbound access.(CVE-2024-26702)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nparisc: Fix random data corruption from exception handler\r\n\r\nThe current exception handler implementation, which assists when accessing\nuser space memory, may exhibit random data corruption if the compiler decides\nto use a different register than the specified register %r29 (defined in\nASM_EXCEPTIONTABLE_REG) for the error code. If the compiler choose another\nregister, the fault handler will nevertheless store -EFAULT into %r29 and thus\ntrash whatever this register is used for.\nLooking at the assembly I found that this happens sometimes in emulate_ldd().\r\n\r\nTo solve the issue, the easiest solution would be if it somehow is\npossible to tell the fault handler which register is used to hold the error\ncode. Using %0 or %1 in the inline assembly is not posssible as it will show\nup as e.g. %r29 (with the \u0026quot;%r\u0026quot; prefix), which the GNU assembler can not\nconvert to an integer.\r\n\r\nThis patch takes another, better and more flexible approach:\nWe extend the __ex_table (which is out of the execution path) by one 32-word.\nIn this word we tell the compiler to insert the assembler instruction\n\u0026quot;or %r0,%r0,%reg\u0026quot;, where %reg references the register which the compiler\nchoosed for the error return code.\nIn case of an access failure, the fault handler finds the __ex_table entry and\ncan examine the opcode. The used register is encoded in the lowest 5 bits, and\nthe fault handler can then store -EFAULT into this register.\r\n\r\nSince we extend the __ex_table to 3 words we can\u0026apos;t use the BUILDTIME_TABLE_SORT\nconfig option any longer.(CVE-2024-26706)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: hsr: remove WARN_ONCE() in send_hsr_supervision_frame()\r\n\r\nSyzkaller reported [1] hitting a warning after failing to allocate\nresources for skb in hsr_init_skb(). Since a WARN_ONCE() call will\nnot help much in this case, it might be prudent to switch to\nnetdev_warn_once(). At the very least it will suppress syzkaller\nreports such as [1].\r\n\r\nJust in case, use netdev_warn_once() in send_prp_supervision_frame()\nfor similar reasons.\r\n\r\n[1]\nHSR: Could not send supervision frame\nWARNING: CPU: 1 PID: 85 at net/hsr/hsr_device.c:294 send_hsr_supervision_frame+0x60a/0x810 net/hsr/hsr_device.c:294\nRIP: 0010:send_hsr_supervision_frame+0x60a/0x810 net/hsr/hsr_device.c:294\n...\nCall Trace:\n \u0026lt;IRQ\u0026gt;\n hsr_announce+0x114/0x370 net/hsr/hsr_device.c:382\n call_timer_fn+0x193/0x590 kernel/time/timer.c:1700\n expire_timers kernel/time/timer.c:1751 [inline]\n __run_timers+0x764/0xb20 kernel/time/timer.c:2022\n run_timer_softirq+0x58/0xd0 kernel/time/timer.c:2035\n __do_softirq+0x21a/0x8de kernel/softirq.c:553\n invoke_softirq kernel/softirq.c:427 [inline]\n __irq_exit_rcu kernel/softirq.c:632 [inline]\n irq_exit_rcu+0xb7/0x120 kernel/softirq.c:644\n sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1076\n \u0026lt;/IRQ\u0026gt;\n \u0026lt;TASK\u0026gt;\n asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649\n...\r\n\r\nThis issue is also found in older kernels (at least up to 5.10).(CVE-2024-26707)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\npowerpc/kasan: Fix addr error caused by page alignment\r\n\r\nIn kasan_init_region, when k_start is not page aligned, at the begin of\nfor loop, k_cur = k_start \u0026amp; PAGE_MASK is less than k_start, and then\n`va = block + k_cur - k_start` is less than block, the addr va is invalid,\nbecause the memory address space from va to block is not alloced by\nmemblock_alloc, which will not be reserved by memblock_reserve later, it\nwill be used by other places.\r\n\r\nAs a result, memory overwriting occurs.\r\n\r\nfor example:\nint __init __weak kasan_init_region(void *start, size_t size)\n{\n[...]\n\t/* if say block(dcd97000) k_start(feef7400) k_end(feeff3fe) */\n\tblock = memblock_alloc(k_end - k_start, PAGE_SIZE);\n\t[...]\n\tfor (k_cur = k_start \u0026amp; PAGE_MASK; k_cur \u0026lt; k_end; k_cur += PAGE_SIZE) {\n\t\t/* at the begin of for loop\n\t\t * block(dcd97000) va(dcd96c00) k_cur(feef7000) k_start(feef7400)\n\t\t * va(dcd96c00) is less than block(dcd97000), va is invalid\n\t\t */\n\t\tvoid *va = block + k_cur - k_start;\n\t\t[...]\n\t}\n[...]\n}\r\n\r\nTherefore, page alignment is performed on k_start before\nmemblock_alloc() to ensure the validity of the VA address.(CVE-2024-26712)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again\r\n\r\n(struct dirty_throttle_control *)-\u0026gt;thresh is an unsigned long, but is\npassed as the u32 divisor argument to div_u64().  On architectures where\nunsigned long is 64 bytes, the argument will be implicitly truncated.\r\n\r\nUse div64_u64() instead of div_u64() so that the value used in the \u0026quot;is\nthis a safe division\u0026quot; check is the same as the divisor.\r\n\r\nAlso, remove redundant cast of the numerator to u64, as that should happen\nimplicitly.\r\n\r\nThis would be difficult to exploit in memcg domain, given the ratio-based\narithmetic domain_drity_limits() uses, but is much easier in global\nwriteback domain with a BDI_CAP_STRICTLIMIT-backing device, using e.g. \nvm.dirty_bytes=(1\u0026lt;\u0026lt;32)*PAGE_SIZE so that dtc-\u0026gt;thresh == (1\u0026lt;\u0026lt;32)(CVE-2024-26720)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbtrfs: don\u0026apos;t drop extent_map for free space inode on write error\r\n\r\nWhile running the CI for an unrelated change I hit the following panic\nwith generic/648 on btrfs_holes_spacecache.\r\n\r\nassertion failed: block_start != EXTENT_MAP_HOLE, in fs/btrfs/extent_io.c:1385\n------------[ cut here ]------------\nkernel BUG at fs/btrfs/extent_io.c:1385!\ninvalid opcode: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 1 PID: 2695096 Comm: fsstress Kdump: loaded Tainted: G        W          6.8.0-rc2+ #1\nRIP: 0010:__extent_writepage_io.constprop.0+0x4c1/0x5c0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n extent_write_cache_pages+0x2ac/0x8f0\n extent_writepages+0x87/0x110\n do_writepages+0xd5/0x1f0\n filemap_fdatawrite_wbc+0x63/0x90\n __filemap_fdatawrite_range+0x5c/0x80\n btrfs_fdatawrite_range+0x1f/0x50\n btrfs_write_out_cache+0x507/0x560\n btrfs_write_dirty_block_groups+0x32a/0x420\n commit_cowonly_roots+0x21b/0x290\n btrfs_commit_transaction+0x813/0x1360\n btrfs_sync_file+0x51a/0x640\n __x64_sys_fdatasync+0x52/0x90\n do_syscall_64+0x9c/0x190\n entry_SYSCALL_64_after_hwframe+0x6e/0x76\r\n\r\nThis happens because we fail to write out the free space cache in one\ninstance, come back around and attempt to write it again.  However on\nthe second pass through we go to call btrfs_get_extent() on the inode to\nget the extent mapping.  Because this is a new block group, and with the\nfree space inode we always search the commit root to avoid deadlocking\nwith the tree, we find nothing and return a EXTENT_MAP_HOLE for the\nrequested range.\r\n\r\nThis happens because the first time we try to write the space cache out\nwe hit an error, and on an error we drop the extent mapping.  This is\nnormal for normal files, but the free space cache inode is special.  We\nalways expect the extent map to be correct.  Thus the second time\nthrough we end up with a bogus extent map.\r\n\r\nSince we\u0026apos;re deprecating this feature, the most straightforward way to\nfix this is to simply skip dropping the extent map range for this failed\nrange.\r\n\r\nI shortened the test by using error injection to stress the area to make\nit easier to reproduce.  With this patch in place we no longer panic\nwith my error injection test.(CVE-2024-26726)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\narp: Prevent overflow in arp_req_get().\r\n\r\nsyzkaller reported an overflown write in arp_req_get(). [0]\r\n\r\nWhen ioctl(SIOCGARP) is issued, arp_req_get() looks up an neighbour\nentry and copies neigh-\u0026gt;ha to struct arpreq.arp_ha.sa_data.\r\n\r\nThe arp_ha here is struct sockaddr, not struct sockaddr_storage, so\nthe sa_data buffer is just 14 bytes.\r\n\r\nIn the splat below, 2 bytes are overflown to the next int field,\narp_flags.  We initialise the field just after the memcpy(), so it\u0026apos;s\nnot a problem.\r\n\r\nHowever, when dev-\u0026gt;addr_len is greater than 22 (e.g. MAX_ADDR_LEN),\narp_netmask is overwritten, which could be set as htonl(0xFFFFFFFFUL)\nin arp_ioctl() before calling arp_req_get().\r\n\r\nTo avoid the overflow, let\u0026apos;s limit the max length of memcpy().\r\n\r\nNote that commit b5f0de6df6dc (\u0026quot;net: dev: Convert sa_data to flexible\narray in struct sockaddr\u0026quot;) just silenced syzkaller.\r\n\r\n[0]:\nmemcpy: detected field-spanning write (size 16) of single field \u0026quot;r-\u0026gt;arp_ha.sa_data\u0026quot; at net/ipv4/arp.c:1128 (size 14)\nWARNING: CPU: 0 PID: 144638 at net/ipv4/arp.c:1128 arp_req_get+0x411/0x4a0 net/ipv4/arp.c:1128\nModules linked in:\nCPU: 0 PID: 144638 Comm: syz-executor.4 Not tainted 6.1.74 #31\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-5 04/01/2014\nRIP: 0010:arp_req_get+0x411/0x4a0 net/ipv4/arp.c:1128\nCode: fd ff ff e8 41 42 de fb b9 0e 00 00 00 4c 89 fe 48 c7 c2 20 6d ab 87 48 c7 c7 80 6d ab 87 c6 05 25 af 72 04 01 e8 5f 8d ad fb \u0026lt;0f\u0026gt; 0b e9 6c fd ff ff e8 13 42 de fb be 03 00 00 00 4c 89 e7 e8 a6\nRSP: 0018:ffffc900050b7998 EFLAGS: 00010286\nRAX: 0000000000000000 RBX: ffff88803a815000 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: ffffffff8641a44a RDI: 0000000000000001\nRBP: ffffc900050b7a98 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000000 R11: 203a7970636d656d R12: ffff888039c54000\nR13: 1ffff92000a16f37 R14: ffff88803a815084 R15: 0000000000000010\nFS:  00007f172bf306c0(0000) GS:ffff88805aa00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f172b3569f0 CR3: 0000000057f12005 CR4: 0000000000770ef0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n \u0026lt;TASK\u0026gt;\n arp_ioctl+0x33f/0x4b0 net/ipv4/arp.c:1261\n inet_ioctl+0x314/0x3a0 net/ipv4/af_inet.c:981\n sock_do_ioctl+0xdf/0x260 net/socket.c:1204\n sock_ioctl+0x3ef/0x650 net/socket.c:1321\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:870 [inline]\n __se_sys_ioctl fs/ioctl.c:856 [inline]\n __x64_sys_ioctl+0x18e/0x220 fs/ioctl.c:856\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x37/0x90 arch/x86/entry/common.c:81\n entry_SYSCALL_64_after_hwframe+0x64/0xce\nRIP: 0033:0x7f172b262b8d\nCode: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f172bf300b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 00007f172b3abf80 RCX: 00007f172b262b8d\nRDX: 0000000020000000 RSI: 0000000000008954 RDI: 0000000000000003\nRBP: 00007f172b2d3493 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 000000000000000b R14: 00007f172b3abf80 R15: 00007f172bf10000\n \u0026lt;/TASK\u0026gt;(CVE-2024-26733)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndevlink: fix possible use-after-free and memory leaks in devlink_init()\r\n\r\nThe pernet operations structure for the subsystem must be registered\nbefore registering the generic netlink family.\r\n\r\nMake an unregister in case of unsuccessful registration.(CVE-2024-26734)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nipv6: sr: fix possible use-after-free and null-ptr-deref\r\n\r\nThe pernet operations structure for the subsystem must be registered\nbefore registering the generic netlink family.(CVE-2024-26735)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/sched: act_mirred: use the backlog for mirred ingress\r\n\r\nThe test Davide added in commit ca22da2fbd69 (\u0026quot;act_mirred: use the backlog\nfor nested calls to mirred ingress\u0026quot;) hangs our testing VMs every 10 or so\nruns, with the familiar tcp_v4_rcv -\u0026gt; tcp_v4_rcv deadlock reported by\nlockdep.\r\n\r\nThe problem as previously described by Davide (see Link) is that\nif we reverse flow of traffic with the redirect (egress -\u0026gt; ingress)\nwe may reach the same socket which generated the packet. And we may\nstill be holding its socket lock. The common solution to such deadlocks\nis to put the packet in the Rx backlog, rather than run the Rx path\ninline. Do that for all egress -\u0026gt; ingress reversals, not just once\nwe started to nest mirred calls.\r\n\r\nIn the past there was a concern that the backlog indirection will\nlead to loss of error reporting / less accurate stats. But the current\nworkaround does not seem to address the issue.(CVE-2024-26740)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nRDMA/qedr: Fix qedr_create_user_qp error flow\r\n\r\nAvoid the following warning by making sure to free the allocated\nresources in case that qedr_init_user_queue() fail.\r\n\r\n-----------[ cut here ]-----------\nWARNING: CPU: 0 PID: 143192 at drivers/infiniband/core/rdma_core.c:874 uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]\nModules linked in: tls target_core_user uio target_core_pscsi target_core_file target_core_iblock ib_srpt ib_srp scsi_transport_srp nfsd nfs_acl rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs 8021q garp mrp stp llc ext4 mbcache jbd2 opa_vnic ib_umad ib_ipoib sunrpc rdma_ucm ib_isert iscsi_target_mod target_core_mod ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm hfi1 intel_rapl_msr intel_rapl_common mgag200 qedr sb_edac drm_shmem_helper rdmavt x86_pkg_temp_thermal drm_kms_helper intel_powerclamp ib_uverbs coretemp i2c_algo_bit kvm_intel dell_wmi_descriptor ipmi_ssif sparse_keymap kvm ib_core rfkill syscopyarea sysfillrect video sysimgblt irqbypass ipmi_si ipmi_devintf fb_sys_fops rapl iTCO_wdt mxm_wmi iTCO_vendor_support intel_cstate pcspkr dcdbas intel_uncore ipmi_msghandler lpc_ich acpi_power_meter mei_me mei fuse drm xfs libcrc32c qede sd_mod ahci libahci t10_pi sg crct10dif_pclmul crc32_pclmul crc32c_intel qed libata tg3\nghash_clmulni_intel megaraid_sas crc8 wmi [last unloaded: ib_srpt]\nCPU: 0 PID: 143192 Comm: fi_rdm_tagged_p Kdump: loaded Not tainted 5.14.0-408.el9.x86_64 #1\nHardware name: Dell Inc. PowerEdge R430/03XKDV, BIOS 2.14.0 01/25/2022\nRIP: 0010:uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]\nCode: 5d 41 5c 41 5d 41 5e e9 0f 26 1b dd 48 89 df e8 67 6a ff ff 49 8b 86 10 01 00 00 48 85 c0 74 9c 4c 89 e7 e8 83 c0 cb dd eb 92 \u0026lt;0f\u0026gt; 0b eb be 0f 0b be 04 00 00 00 48 89 df e8 8e f5 ff ff e9 6d ff\nRSP: 0018:ffffb7c6cadfbc60 EFLAGS: 00010286\nRAX: ffff8f0889ee3f60 RBX: ffff8f088c1a5200 RCX: 00000000802a0016\nRDX: 00000000802a0017 RSI: 0000000000000001 RDI: ffff8f0880042600\nRBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000\nR10: ffff8f11fffd5000 R11: 0000000000039000 R12: ffff8f0d5b36cd80\nR13: ffff8f088c1a5250 R14: ffff8f1206d91000 R15: 0000000000000000\nFS: 0000000000000000(0000) GS:ffff8f11d7c00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000147069200e20 CR3: 00000001c7210002 CR4: 00000000001706f0\nCall Trace:\n\u0026lt;TASK\u0026gt;\n? show_trace_log_lvl+0x1c4/0x2df\n? show_trace_log_lvl+0x1c4/0x2df\n? ib_uverbs_close+0x1f/0xb0 [ib_uverbs]\n? uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]\n? __warn+0x81/0x110\n? uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]\n? report_bug+0x10a/0x140\n? handle_bug+0x3c/0x70\n? exc_invalid_op+0x14/0x70\n? asm_exc_invalid_op+0x16/0x20\n? uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]\nib_uverbs_close+0x1f/0xb0 [ib_uverbs]\n__fput+0x94/0x250\ntask_work_run+0x5c/0x90\ndo_exit+0x270/0x4a0\ndo_group_exit+0x2d/0x90\nget_signal+0x87c/0x8c0\narch_do_signal_or_restart+0x25/0x100\n? ib_uverbs_ioctl+0xc2/0x110 [ib_uverbs]\nexit_to_user_mode_loop+0x9c/0x130\nexit_to_user_mode_prepare+0xb6/0x100\nsyscall_exit_to_user_mode+0x12/0x40\ndo_syscall_64+0x69/0x90\n? syscall_exit_work+0x103/0x130\n? syscall_exit_to_user_mode+0x22/0x40\n? do_syscall_64+0x69/0x90\n? syscall_exit_work+0x103/0x130\n? syscall_exit_to_user_mode+0x22/0x40\n? do_syscall_64+0x69/0x90\n? do_syscall_64+0x69/0x90\n? common_interrupt+0x43/0xa0\nentry_SYSCALL_64_after_hwframe+0x72/0xdc\nRIP: 0033:0x1470abe3ec6b\nCode: Unable to access opcode bytes at RIP 0x1470abe3ec41.\nRSP: 002b:00007fff13ce9108 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: fffffffffffffffc RBX: 00007fff13ce9218 RCX: 00001470abe3ec6b\nRDX: 00007fff13ce9200 RSI: 00000000c0181b01 RDI: 0000000000000004\nRBP: 00007fff13ce91e0 R08: 0000558d9655da10 R09: 0000558d9655dd00\nR10: 00007fff13ce95c0 R11: 0000000000000246 R12: 00007fff13ce9358\nR13: 0000000000000013 R14: 0000558d9655db50 R15: 00007fff13ce9470\n\u0026lt;/TASK\u0026gt;\n--[ end trace 888a9b92e04c5c97 ]--(CVE-2024-26743)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nRDMA/srpt: Support specifying the srpt_service_guid parameter\r\n\r\nMake loading ib_srpt with this parameter set work. The current behavior is\nthat setting that parameter while loading the ib_srpt kernel module\ntriggers the following kernel crash:\r\n\r\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nCall Trace:\n \u0026lt;TASK\u0026gt;\n parse_one+0x18c/0x1d0\n parse_args+0xe1/0x230\n load_module+0x8de/0xa60\n init_module_from_file+0x8b/0xd0\n idempotent_init_module+0x181/0x240\n __x64_sys_finit_module+0x5a/0xb0\n do_syscall_64+0x5f/0xe0\n entry_SYSCALL_64_after_hwframe+0x6e/0x76(CVE-2024-26744)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ngtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()\r\n\r\nThe gtp_net_ops pernet operations structure for the subsystem must be\nregistered before registering the generic netlink family.\r\n\r\nSyzkaller hit \u0026apos;general protection fault in gtp_genl_dump_pdp\u0026apos; bug:\r\n\r\ngeneral protection fault, probably for non-canonical address\n0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN NOPTI\nKASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\nCPU: 1 PID: 5826 Comm: gtp Not tainted 6.8.0-rc3-std-def-alt1 #1\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-alt1 04/01/2014\nRIP: 0010:gtp_genl_dump_pdp+0x1be/0x800 [gtp]\nCode: c6 89 c6 e8 64 e9 86 df 58 45 85 f6 0f 85 4e 04 00 00 e8 c5 ee 86\n      df 48 8b 54 24 18 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 \u0026lt;80\u0026gt;\n      3c 02 00 0f 85 de 05 00 00 48 8b 44 24 18 4c 8b 30 4c 39 f0 74\nRSP: 0018:ffff888014107220 EFLAGS: 00010202\nRAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000\nRDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000\nRBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000\nR13: ffff88800fcda588 R14: 0000000000000001 R15: 0000000000000000\nFS:  00007f1be4eb05c0(0000) GS:ffff88806ce80000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f1be4e766cf CR3: 000000000c33e000 CR4: 0000000000750ef0\nPKRU: 55555554\nCall Trace:\n \u0026lt;TASK\u0026gt;\n ? show_regs+0x90/0xa0\n ? die_addr+0x50/0xd0\n ? exc_general_protection+0x148/0x220\n ? asm_exc_general_protection+0x22/0x30\n ? gtp_genl_dump_pdp+0x1be/0x800 [gtp]\n ? __alloc_skb+0x1dd/0x350\n ? __pfx___alloc_skb+0x10/0x10\n genl_dumpit+0x11d/0x230\n netlink_dump+0x5b9/0xce0\n ? lockdep_hardirqs_on_prepare+0x253/0x430\n ? __pfx_netlink_dump+0x10/0x10\n ? kasan_save_track+0x10/0x40\n ? __kasan_kmalloc+0x9b/0xa0\n ? genl_start+0x675/0x970\n __netlink_dump_start+0x6fc/0x9f0\n genl_family_rcv_msg_dumpit+0x1bb/0x2d0\n ? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10\n ? genl_op_from_small+0x2a/0x440\n ? cap_capable+0x1d0/0x240\n ? __pfx_genl_start+0x10/0x10\n ? __pfx_genl_dumpit+0x10/0x10\n ? __pfx_genl_done+0x10/0x10\n ? security_capable+0x9d/0xe0(CVE-2024-26754)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndm-crypt: don\u0026apos;t modify the data when using authenticated encryption\r\n\r\nIt was said that authenticated encryption could produce invalid tag when\nthe data that is being encrypted is modified [1]. So, fix this problem by\ncopying the data into the clone bio first and then encrypt them inside the\nclone bio.\r\n\r\nThis may reduce performance, but it is needed to prevent the user from\ncorrupting the device by writing data with O_DIRECT and modifying them at\nthe same time.\r\n\r\n[1] https://lore.kernel.org/all/20240207004723.GA35324@sol.localdomain/T/(CVE-2024-26763)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nspi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected\r\n\r\nReturn IRQ_NONE from the interrupt handler when no interrupt was\ndetected. Because an empty interrupt will cause a null pointer error:\r\n\r\n    Unable to handle kernel NULL pointer dereference at virtual\n  address 0000000000000008\n    Call trace:\n        complete+0x54/0x100\n        hisi_sfc_v3xx_isr+0x2c/0x40 [spi_hisi_sfc_v3xx]\n        __handle_irq_event_percpu+0x64/0x1e0\n        handle_irq_event+0x7c/0x1cc(CVE-2024-26776)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmptcp: fix double-free on socket dismantle\r\n\r\nwhen MPTCP server accepts an incoming connection, it clones its listener\nsocket. However, the pointer to \u0026apos;inet_opt\u0026apos; for the new socket has the same\nvalue as the original one: as a consequence, on program exit it\u0026apos;s possible\nto observe the following splat:\r\n\r\n  BUG: KASAN: double-free in inet_sock_destruct+0x54f/0x8b0\n  Free of addr ffff888485950880 by task swapper/25/0\r\n\r\n  CPU: 25 PID: 0 Comm: swapper/25 Kdump: loaded Not tainted 6.8.0-rc1+ #609\n  Hardware name: Supermicro SYS-6027R-72RF/X9DRH-7TF/7F/iTF/iF, BIOS 3.0  07/26/2013\n  Call Trace:\n   \u0026lt;IRQ\u0026gt;\n   dump_stack_lvl+0x32/0x50\n   print_report+0xca/0x620\n   kasan_report_invalid_free+0x64/0x90\n   __kasan_slab_free+0x1aa/0x1f0\n   kfree+0xed/0x2e0\n   inet_sock_destruct+0x54f/0x8b0\n   __sk_destruct+0x48/0x5b0\n   rcu_do_batch+0x34e/0xd90\n   rcu_core+0x559/0xac0\n   __do_softirq+0x183/0x5a4\n   irq_exit_rcu+0x12d/0x170\n   sysvec_apic_timer_interrupt+0x6b/0x80\n   \u0026lt;/IRQ\u0026gt;\n   \u0026lt;TASK\u0026gt;\n   asm_sysvec_apic_timer_interrupt+0x16/0x20\n  RIP: 0010:cpuidle_enter_state+0x175/0x300\n  Code: 30 00 0f 84 1f 01 00 00 83 e8 01 83 f8 ff 75 e5 48 83 c4 18 44 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc fb 45 85 ed \u0026lt;0f\u0026gt; 89 60 ff ff ff 48 c1 e5 06 48 c7 43 18 00 00 00 00 48 83 44 2b\n  RSP: 0018:ffff888481cf7d90 EFLAGS: 00000202\n  RAX: 0000000000000000 RBX: ffff88887facddc8 RCX: 0000000000000000\n  RDX: 1ffff1110ff588b1 RSI: 0000000000000019 RDI: ffff88887fac4588\n  RBP: 0000000000000004 R08: 0000000000000002 R09: 0000000000043080\n  R10: 0009b02ea273363f R11: ffff88887fabf42b R12: ffffffff932592e0\n  R13: 0000000000000004 R14: 0000000000000000 R15: 00000022c880ec80\n   cpuidle_enter+0x4a/0xa0\n   do_idle+0x310/0x410\n   cpu_startup_entry+0x51/0x60\n   start_secondary+0x211/0x270\n   secondary_startup_64_no_verify+0x184/0x18b\n   \u0026lt;/TASK\u0026gt;\r\n\r\n  Allocated by task 6853:\n   kasan_save_stack+0x1c/0x40\n   kasan_save_track+0x10/0x30\n   __kasan_kmalloc+0xa6/0xb0\n   __kmalloc+0x1eb/0x450\n   cipso_v4_sock_setattr+0x96/0x360\n   netlbl_sock_setattr+0x132/0x1f0\n   selinux_netlbl_socket_post_create+0x6c/0x110\n   selinux_socket_post_create+0x37b/0x7f0\n   security_socket_post_create+0x63/0xb0\n   __sock_create+0x305/0x450\n   __sys_socket_create.part.23+0xbd/0x130\n   __sys_socket+0x37/0xb0\n   __x64_sys_socket+0x6f/0xb0\n   do_syscall_64+0x83/0x160\n   entry_SYSCALL_64_after_hwframe+0x6e/0x76\r\n\r\n  Freed by task 6858:\n   kasan_save_stack+0x1c/0x40\n   kasan_save_track+0x10/0x30\n   kasan_save_free_info+0x3b/0x60\n   __kasan_slab_free+0x12c/0x1f0\n   kfree+0xed/0x2e0\n   inet_sock_destruct+0x54f/0x8b0\n   __sk_destruct+0x48/0x5b0\n   subflow_ulp_release+0x1f0/0x250\n   tcp_cleanup_ulp+0x6e/0x110\n   tcp_v4_destroy_sock+0x5a/0x3a0\n   inet_csk_destroy_sock+0x135/0x390\n   tcp_fin+0x416/0x5c0\n   tcp_data_queue+0x1bc8/0x4310\n   tcp_rcv_state_process+0x15a3/0x47b0\n   tcp_v4_do_rcv+0x2c1/0x990\n   tcp_v4_rcv+0x41fb/0x5ed0\n   ip_protocol_deliver_rcu+0x6d/0x9f0\n   ip_local_deliver_finish+0x278/0x360\n   ip_local_deliver+0x182/0x2c0\n   ip_rcv+0xb5/0x1c0\n   __netif_receive_skb_one_core+0x16e/0x1b0\n   process_backlog+0x1e3/0x650\n   __napi_poll+0xa6/0x500\n   net_rx_action+0x740/0xbb0\n   __do_softirq+0x183/0x5a4\r\n\r\n  The buggy address belongs to the object at ffff888485950880\n   which belongs to the cache kmalloc-64 of size 64\n  The buggy address is located 0 bytes inside of\n   64-byte region [ffff888485950880, ffff8884859508c0)\r\n\r\n  The buggy address belongs to the physical page:\n  page:0000000056d1e95e refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888485950700 pfn:0x485950\n  flags: 0x57ffffc0000800(slab|node=1|zone=2|lastcpupid=0x1fffff)\n  page_type: 0xffffffff()\n  raw: 0057ffffc0000800 ffff88810004c640 ffffea00121b8ac0 dead000000000006\n  raw: ffff888485950700 0000000000200019 00000001ffffffff 0000000000000000\n  page dumped because: kasan: bad access detected\r\n\r\n  Memory state around the buggy address:\n   ffff888485950780: fa fb fb\n---truncated---(CVE-2024-26782)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmmc: mmci: stm32: fix DMA API overlapping mappings warning\r\n\r\nTurning on CONFIG_DMA_API_DEBUG_SG results in the following warning:\r\n\r\nDMA-API: mmci-pl18x 48220000.mmc: cacheline tracking EEXIST,\noverlapping mappings aren\u0026apos;t supported\nWARNING: CPU: 1 PID: 51 at kernel/dma/debug.c:568\nadd_dma_entry+0x234/0x2f4\nModules linked in:\nCPU: 1 PID: 51 Comm: kworker/1:2 Not tainted 6.1.28 #1\nHardware name: STMicroelectronics STM32MP257F-EV1 Evaluation Board (DT)\nWorkqueue: events_freezable mmc_rescan\nCall trace:\nadd_dma_entry+0x234/0x2f4\ndebug_dma_map_sg+0x198/0x350\n__dma_map_sg_attrs+0xa0/0x110\ndma_map_sg_attrs+0x10/0x2c\nsdmmc_idma_prep_data+0x80/0xc0\nmmci_prep_data+0x38/0x84\nmmci_start_data+0x108/0x2dc\nmmci_request+0xe4/0x190\n__mmc_start_request+0x68/0x140\nmmc_start_request+0x94/0xc0\nmmc_wait_for_req+0x70/0x100\nmmc_send_tuning+0x108/0x1ac\nsdmmc_execute_tuning+0x14c/0x210\nmmc_execute_tuning+0x48/0xec\nmmc_sd_init_uhs_card.part.0+0x208/0x464\nmmc_sd_init_card+0x318/0x89c\nmmc_attach_sd+0xe4/0x180\nmmc_rescan+0x244/0x320\r\n\r\nDMA API debug brings to light leaking dma-mappings as dma_map_sg and\ndma_unmap_sg are not correctly balanced.\r\n\r\nIf an error occurs in mmci_cmd_irq function, only mmci_dma_error\nfunction is called and as this API is not managed on stm32 variant,\ndma_unmap_sg is never called in this error path.(CVE-2024-26787)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nBluetooth: Avoid potential use-after-free in hci_error_reset\r\n\r\nWhile handling the HCI_EV_HARDWARE_ERROR event, if the underlying\nBT controller is not responding, the GPIO reset mechanism would\nfree the hci_dev and lead to a use-after-free in hci_error_reset.\r\n\r\nHere\u0026apos;s the call trace observed on a ChromeOS device with Intel AX201:\n   queue_work_on+0x3e/0x6c\n   __hci_cmd_sync_sk+0x2ee/0x4c0 [bluetooth \u0026lt;HASH:3b4a6\u0026gt;]\n   ? init_wait_entry+0x31/0x31\n   __hci_cmd_sync+0x16/0x20 [bluetooth \u0026lt;HASH:3b4a 6\u0026gt;]\n   hci_error_reset+0x4f/0xa4 [bluetooth \u0026lt;HASH:3b4a 6\u0026gt;]\n   process_one_work+0x1d8/0x33f\n   worker_thread+0x21b/0x373\n   kthread+0x13a/0x152\n   ? pr_cont_work+0x54/0x54\n   ? kthread_blkcg+0x31/0x31\n    ret_from_fork+0x1f/0x30\r\n\r\nThis patch holds the reference count on the hci_dev while processing\na HCI_EV_HARDWARE_ERROR event to avoid potential crash.(CVE-2024-26801)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetlink: Fix kernel-infoleak-after-free in __skb_datagram_iter\r\n\r\nsyzbot reported the following uninit-value access issue [1]:\r\n\r\nnetlink_to_full_skb() creates a new `skb` and puts the `skb-\u0026gt;data`\npassed as a 1st arg of netlink_to_full_skb() onto new `skb`. The data\nsize is specified as `len` and passed to skb_put_data(). This `len`\nis based on `skb-\u0026gt;end` that is not data offset but buffer offset. The\n`skb-\u0026gt;end` contains data and tailroom. Since the tailroom is not\ninitialized when the new `skb` created, KMSAN detects uninitialized\nmemory area when copying the data.\r\n\r\nThis patch resolved this issue by correct the len from `skb-\u0026gt;end` to\n`skb-\u0026gt;len`, which is the actual data offset.\r\n\r\nBUG: KMSAN: kernel-infoleak-after-free in instrument_copy_to_user include/linux/instrumented.h:114 [inline]\nBUG: KMSAN: kernel-infoleak-after-free in copy_to_user_iter lib/iov_iter.c:24 [inline]\nBUG: KMSAN: kernel-infoleak-after-free in iterate_ubuf include/linux/iov_iter.h:29 [inline]\nBUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance2 include/linux/iov_iter.h:245 [inline]\nBUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance include/linux/iov_iter.h:271 [inline]\nBUG: KMSAN: kernel-infoleak-after-free in _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186\n instrument_copy_to_user include/linux/instrumented.h:114 [inline]\n copy_to_user_iter lib/iov_iter.c:24 [inline]\n iterate_ubuf include/linux/iov_iter.h:29 [inline]\n iterate_and_advance2 include/linux/iov_iter.h:245 [inline]\n iterate_and_advance include/linux/iov_iter.h:271 [inline]\n _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186\n copy_to_iter include/linux/uio.h:197 [inline]\n simple_copy_to_iter+0x68/0xa0 net/core/datagram.c:532\n __skb_datagram_iter+0x123/0xdc0 net/core/datagram.c:420\n skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:546\n skb_copy_datagram_msg include/linux/skbuff.h:3960 [inline]\n packet_recvmsg+0xd9c/0x2000 net/packet/af_packet.c:3482\n sock_recvmsg_nosec net/socket.c:1044 [inline]\n sock_recvmsg net/socket.c:1066 [inline]\n sock_read_iter+0x467/0x580 net/socket.c:1136\n call_read_iter include/linux/fs.h:2014 [inline]\n new_sync_read fs/read_write.c:389 [inline]\n vfs_read+0x8f6/0xe00 fs/read_write.c:470\n ksys_read+0x20f/0x4c0 fs/read_write.c:613\n __do_sys_read fs/read_write.c:623 [inline]\n __se_sys_read fs/read_write.c:621 [inline]\n __x64_sys_read+0x93/0xd0 fs/read_write.c:621\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nUninit was stored to memory at:\n skb_put_data include/linux/skbuff.h:2622 [inline]\n netlink_to_full_skb net/netlink/af_netlink.c:181 [inline]\n __netlink_deliver_tap_skb net/netlink/af_netlink.c:298 [inline]\n __netlink_deliver_tap+0x5be/0xc90 net/netlink/af_netlink.c:325\n netlink_deliver_tap net/netlink/af_netlink.c:338 [inline]\n netlink_deliver_tap_kernel net/netlink/af_netlink.c:347 [inline]\n netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]\n netlink_unicast+0x10f1/0x1250 net/netlink/af_netlink.c:1368\n netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg net/socket.c:745 [inline]\n ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584\n ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638\n __sys_sendmsg net/socket.c:2667 [inline]\n __do_sys_sendmsg net/socket.c:2676 [inline]\n __se_sys_sendmsg net/socket.c:2674 [inline]\n __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nUninit was created at:\n free_pages_prepare mm/page_alloc.c:1087 [inline]\n free_unref_page_prepare+0xb0/0xa40 mm/page_alloc.c:2347\n free_unref_page_list+0xeb/0x1100 mm/page_alloc.c:2533\n release_pages+0x23d3/0x2410 mm/swap.c:1042\n free_pages_and_swap_cache+0xd9/0xf0 mm/swap_state.c:316\n tlb_batch_pages\n---truncated---(CVE-2024-26805)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain\r\n\r\nRemove netdevice from inet/ingress basechain in case NETDEV_UNREGISTER\nevent is reported, otherwise a stale reference to netdevice remains in\nthe hook list.(CVE-2024-26808)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nft_set_pipapo: release elements in clone only from destroy path\r\n\r\nClone already always provides a current view of the lookup table, use it\nto destroy the set, otherwise it is possible to destroy elements twice.\r\n\r\nThis fix requires:\r\n\r\n 212ed75dc5fb (\u0026quot;netfilter: nf_tables: integrate pipapo into commit protocol\u0026quot;)\r\n\r\nwhich came after:\r\n\r\n 9827a0e6e23b (\u0026quot;netfilter: nft_set_pipapo: release elements in clone from abort path\u0026quot;).(CVE-2024-26809)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nf_conntrack_h323: Add protection for bmp length out of range\r\n\r\nUBSAN load reports an exception of BRK#5515 SHIFT_ISSUE:Bitwise shifts\nthat are out of bounds for their data type.\r\n\r\nvmlinux   get_bitmap(b=75) + 712\n\u0026lt;net/netfilter/nf_conntrack_h323_asn1.c:0\u0026gt;\nvmlinux   decode_seq(bs=0xFFFFFFD008037000, f=0xFFFFFFD008037018, level=134443100) + 1956\n\u0026lt;net/netfilter/nf_conntrack_h323_asn1.c:592\u0026gt;\nvmlinux   decode_choice(base=0xFFFFFFD0080370F0, level=23843636) + 1216\n\u0026lt;net/netfilter/nf_conntrack_h323_asn1.c:814\u0026gt;\nvmlinux   decode_seq(f=0xFFFFFFD0080371A8, level=134443500) + 812\n\u0026lt;net/netfilter/nf_conntrack_h323_asn1.c:576\u0026gt;\nvmlinux   decode_choice(base=0xFFFFFFD008037280, level=0) + 1216\n\u0026lt;net/netfilter/nf_conntrack_h323_asn1.c:814\u0026gt;\nvmlinux   DecodeRasMessage() + 304\n\u0026lt;net/netfilter/nf_conntrack_h323_asn1.c:833\u0026gt;\nvmlinux   ras_help() + 684\n\u0026lt;net/netfilter/nf_conntrack_h323_main.c:1728\u0026gt;\nvmlinux   nf_confirm() + 188\n\u0026lt;net/netfilter/nf_conntrack_proto.c:137\u0026gt;\r\n\r\nDue to abnormal data in skb-\u0026gt;data, the extension bitmap length\nexceeds 32 when decoding ras message then uses the length to make\na shift operation. It will change into negative after several loop.\nUBSAN load could detect a negative shift as an undefined behaviour\nand reports exception.\nSo we add the protection to avoid the length exceeding 32. Or else\nit will return out of range error and stop decoding.(CVE-2024-26851)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: hns3: fix kernel crash when 1588 is received on HIP08 devices\r\n\r\nThe HIP08 devices does not register the ptp devices, so the\nhdev-\u0026gt;ptp is NULL, but the hardware can receive 1588 messages,\nand set the HNS3_RXD_TS_VLD_B bit, so, if match this case, the\naccess of hdev-\u0026gt;ptp-\u0026gt;flags will cause a kernel crash:\r\n\r\n[ 5888.946472] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018\n[ 5888.946475] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018\n...\n[ 5889.266118] pc : hclge_ptp_get_rx_hwts+0x40/0x170 [hclge]\n[ 5889.272612] lr : hclge_ptp_get_rx_hwts+0x34/0x170 [hclge]\n[ 5889.279101] sp : ffff800012c3bc50\n[ 5889.283516] x29: ffff800012c3bc50 x28: ffff2040002be040\n[ 5889.289927] x27: ffff800009116484 x26: 0000000080007500\n[ 5889.296333] x25: 0000000000000000 x24: ffff204001c6f000\n[ 5889.302738] x23: ffff204144f53c00 x22: 0000000000000000\n[ 5889.309134] x21: 0000000000000000 x20: ffff204004220080\n[ 5889.315520] x19: ffff204144f53c00 x18: 0000000000000000\n[ 5889.321897] x17: 0000000000000000 x16: 0000000000000000\n[ 5889.328263] x15: 0000004000140ec8 x14: 0000000000000000\n[ 5889.334617] x13: 0000000000000000 x12: 00000000010011df\n[ 5889.340965] x11: bbfeff4d22000000 x10: 0000000000000000\n[ 5889.347303] x9 : ffff800009402124 x8 : 0200f78811dfbb4d\n[ 5889.353637] x7 : 2200000000191b01 x6 : ffff208002a7d480\n[ 5889.359959] x5 : 0000000000000000 x4 : 0000000000000000\n[ 5889.366271] x3 : 0000000000000000 x2 : 0000000000000000\n[ 5889.372567] x1 : 0000000000000000 x0 : ffff20400095c080\n[ 5889.378857] Call trace:\n[ 5889.382285] hclge_ptp_get_rx_hwts+0x40/0x170 [hclge]\n[ 5889.388304] hns3_handle_bdinfo+0x324/0x410 [hns3]\n[ 5889.394055] hns3_handle_rx_bd+0x60/0x150 [hns3]\n[ 5889.399624] hns3_clean_rx_ring+0x84/0x170 [hns3]\n[ 5889.405270] hns3_nic_common_poll+0xa8/0x220 [hns3]\n[ 5889.411084] napi_poll+0xcc/0x264\n[ 5889.415329] net_rx_action+0xd4/0x21c\n[ 5889.419911] __do_softirq+0x130/0x358\n[ 5889.424484] irq_exit+0x134/0x154\n[ 5889.428700] __handle_domain_irq+0x88/0xf0\n[ 5889.433684] gic_handle_irq+0x78/0x2c0\n[ 5889.438319] el1_irq+0xb8/0x140\n[ 5889.442354] arch_cpu_idle+0x18/0x40\n[ 5889.446816] default_idle_call+0x5c/0x1c0\n[ 5889.451714] cpuidle_idle_call+0x174/0x1b0\n[ 5889.456692] do_idle+0xc8/0x160\n[ 5889.460717] cpu_startup_entry+0x30/0xfc\n[ 5889.465523] secondary_start_kernel+0x158/0x1ec\n[ 5889.470936] Code: 97ffab78 f9411c14 91408294 f9457284 (f9400c80)\n[ 5889.477950] SMP: stopping secondary CPUs\n[ 5890.514626] SMP: failed to stop secondary CPUs 0-69,71-95\n[ 5890.522951] Starting crashdump kernel...(CVE-2024-26881)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmd: fix kmemleak of rdev-\u0026gt;serial\r\n\r\nIf kobject_add() is fail in bind_rdev_to_array(), \u0026apos;rdev-\u0026gt;serial\u0026apos; will be\nalloc not be freed, and kmemleak occurs.\r\n\r\nunreferenced object 0xffff88815a350000 (size 49152):\n  comm \u0026quot;mdadm\u0026quot;, pid 789, jiffies 4294716910\n  hex dump (first 32 bytes):\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace (crc f773277a):\n    [\u0026lt;0000000058b0a453\u0026gt;] kmemleak_alloc+0x61/0xe0\n    [\u0026lt;00000000366adf14\u0026gt;] __kmalloc_large_node+0x15e/0x270\n    [\u0026lt;000000002e82961b\u0026gt;] __kmalloc_node.cold+0x11/0x7f\n    [\u0026lt;00000000f206d60a\u0026gt;] kvmalloc_node+0x74/0x150\n    [\u0026lt;0000000034bf3363\u0026gt;] rdev_init_serial+0x67/0x170\n    [\u0026lt;0000000010e08fe9\u0026gt;] mddev_create_serial_pool+0x62/0x220\n    [\u0026lt;00000000c3837bf0\u0026gt;] bind_rdev_to_array+0x2af/0x630\n    [\u0026lt;0000000073c28560\u0026gt;] md_add_new_disk+0x400/0x9f0\n    [\u0026lt;00000000770e30ff\u0026gt;] md_ioctl+0x15bf/0x1c10\n    [\u0026lt;000000006cfab718\u0026gt;] blkdev_ioctl+0x191/0x3f0\n    [\u0026lt;0000000085086a11\u0026gt;] vfs_ioctl+0x22/0x60\n    [\u0026lt;0000000018b656fe\u0026gt;] __x64_sys_ioctl+0xba/0xe0\n    [\u0026lt;00000000e54e675e\u0026gt;] do_syscall_64+0x71/0x150\n    [\u0026lt;000000008b0ad622\u0026gt;] entry_SYSCALL_64_after_hwframe+0x6c/0x74(CVE-2024-26900)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndo_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak\r\n\r\nsyzbot identified a kernel information leak vulnerability in\ndo_sys_name_to_handle() and issued the following report [1].\r\n\r\n[1]\n\u0026quot;BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]\nBUG: KMSAN: kernel-infoleak in _copy_to_user+0xbc/0x100 lib/usercopy.c:40\n instrument_copy_to_user include/linux/instrumented.h:114 [inline]\n _copy_to_user+0xbc/0x100 lib/usercopy.c:40\n copy_to_user include/linux/uaccess.h:191 [inline]\n do_sys_name_to_handle fs/fhandle.c:73 [inline]\n __do_sys_name_to_handle_at fs/fhandle.c:112 [inline]\n __se_sys_name_to_handle_at+0x949/0xb10 fs/fhandle.c:94\n __x64_sys_name_to_handle_at+0xe4/0x140 fs/fhandle.c:94\n ...\r\n\r\nUninit was created at:\n slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768\n slab_alloc_node mm/slub.c:3478 [inline]\n __kmem_cache_alloc_node+0x5c9/0x970 mm/slub.c:3517\n __do_kmalloc_node mm/slab_common.c:1006 [inline]\n __kmalloc+0x121/0x3c0 mm/slab_common.c:1020\n kmalloc include/linux/slab.h:604 [inline]\n do_sys_name_to_handle fs/fhandle.c:39 [inline]\n __do_sys_name_to_handle_at fs/fhandle.c:112 [inline]\n __se_sys_name_to_handle_at+0x441/0xb10 fs/fhandle.c:94\n __x64_sys_name_to_handle_at+0xe4/0x140 fs/fhandle.c:94\n ...\r\n\r\nBytes 18-19 of 20 are uninitialized\nMemory access of size 20 starts at ffff888128a46380\nData copied to user address 0000000020000240\u0026quot;\r\n\r\nPer Chuck Lever\u0026apos;s suggestion, use kzalloc() instead of kmalloc() to\nsolve the problem.(CVE-2024-26901)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nBluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security\r\n\r\nDuring our fuzz testing of the connection and disconnection process at the\nRFCOMM layer, we discovered this bug. By comparing the packets from a\nnormal connection and disconnection process with the testcase that\ntriggered a KASAN report. We analyzed the cause of this bug as follows:\r\n\r\n1. In the packets captured during a normal connection, the host sends a\n`Read Encryption Key Size` type of `HCI_CMD` packet\n(Command Opcode: 0x1408) to the controller to inquire the length of\nencryption key.After receiving this packet, the controller immediately\nreplies with a Command Completepacket (Event Code: 0x0e) to return the\nEncryption Key Size.\r\n\r\n2. In our fuzz test case, the timing of the controller\u0026apos;s response to this\npacket was delayed to an unexpected point: after the RFCOMM and L2CAP\nlayers had disconnected but before the HCI layer had disconnected.\r\n\r\n3. After receiving the Encryption Key Size Response at the time described\nin point 2, the host still called the rfcomm_check_security function.\nHowever, by this time `struct l2cap_conn *conn = l2cap_pi(sk)-\u0026gt;chan-\u0026gt;conn;`\nhad already been released, and when the function executed\n`return hci_conn_security(conn-\u0026gt;hcon, d-\u0026gt;sec_level, auth_type, d-\u0026gt;out);`,\nspecifically when accessing `conn-\u0026gt;hcon`, a null-ptr-deref error occurred.\r\n\r\nTo fix this bug, check if `sk-\u0026gt;sk_state` is BT_CLOSED before calling\nrfcomm_recv_frame in rfcomm_process_rx.(CVE-2024-26903)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nRDMA/mlx5: Fix fortify source warning while accessing Eth segment\r\n\r\n ------------[ cut here ]------------\n memcpy: detected field-spanning write (size 56) of single field \u0026quot;eseg-\u0026gt;inline_hdr.start\u0026quot; at /var/lib/dkms/mlnx-ofed-kernel/5.8/build/drivers/infiniband/hw/mlx5/wr.c:131 (size 2)\n WARNING: CPU: 0 PID: 293779 at /var/lib/dkms/mlnx-ofed-kernel/5.8/build/drivers/infiniband/hw/mlx5/wr.c:131 mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib]\n Modules linked in: 8021q garp mrp stp llc rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) ib_uverbs(OE) ib_core(OE) mlx5_core(OE) pci_hyperv_intf mlxdevm(OE) mlx_compat(OE) tls mlxfw(OE) psample nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink mst_pciconf(OE) knem(OE) vfio_pci vfio_pci_core vfio_iommu_type1 vfio iommufd irqbypass cuse nfsv3 nfs fscache netfs xfrm_user xfrm_algo ipmi_devintf ipmi_msghandler binfmt_misc crct10dif_pclmul crc32_pclmul polyval_clmulni polyval_generic ghash_clmulni_intel sha512_ssse3 snd_pcsp aesni_intel crypto_simd cryptd snd_pcm snd_timer joydev snd soundcore input_leds serio_raw evbug nfsd auth_rpcgss nfs_acl lockd grace sch_fq_codel sunrpc drm efi_pstore ip_tables x_tables autofs4 psmouse virtio_net net_failover failover floppy\n  [last unloaded: mlx_compat(OE)]\n CPU: 0 PID: 293779 Comm: ssh Tainted: G           OE      6.2.0-32-generic #32~22.04.1-Ubuntu\n Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011\n RIP: 0010:mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib]\n Code: 0c 01 00 a8 01 75 25 48 8b 75 a0 b9 02 00 00 00 48 c7 c2 10 5b fd c0 48 c7 c7 80 5b fd c0 c6 05 57 0c 03 00 01 e8 95 4d 93 da \u0026lt;0f\u0026gt; 0b 44 8b 4d b0 4c 8b 45 c8 48 8b 4d c0 e9 49 fb ff ff 41 0f b7\n RSP: 0018:ffffb5b48478b570 EFLAGS: 00010046\n RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000\n RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n RBP: ffffb5b48478b628 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000000 R12: ffffb5b48478b5e8\n R13: ffff963a3c609b5e R14: ffff9639c3fbd800 R15: ffffb5b480475a80\n FS:  00007fc03b444c80(0000) GS:ffff963a3dc00000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000556f46bdf000 CR3: 0000000006ac6003 CR4: 00000000003706f0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  ? show_regs+0x72/0x90\n  ? mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib]\n  ? __warn+0x8d/0x160\n  ? mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib]\n  ? report_bug+0x1bb/0x1d0\n  ? handle_bug+0x46/0x90\n  ? exc_invalid_op+0x19/0x80\n  ? asm_exc_invalid_op+0x1b/0x20\n  ? mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib]\n  mlx5_ib_post_send_nodrain+0xb/0x20 [mlx5_ib]\n  ipoib_send+0x2ec/0x770 [ib_ipoib]\n  ipoib_start_xmit+0x5a0/0x770 [ib_ipoib]\n  dev_hard_start_xmit+0x8e/0x1e0\n  ? validate_xmit_skb_list+0x4d/0x80\n  sch_direct_xmit+0x116/0x3a0\n  __dev_xmit_skb+0x1fd/0x580\n  __dev_queue_xmit+0x284/0x6b0\n  ? _raw_spin_unlock_irq+0xe/0x50\n  ? __flush_work.isra.0+0x20d/0x370\n  ? push_pseudo_header+0x17/0x40 [ib_ipoib]\n  neigh_connected_output+0xcd/0x110\n  ip_finish_output2+0x179/0x480\n  ? __smp_call_single_queue+0x61/0xa0\n  __ip_finish_output+0xc3/0x190\n  ip_finish_output+0x2e/0xf0\n  ip_output+0x78/0x110\n  ? __pfx_ip_finish_output+0x10/0x10\n  ip_local_out+0x64/0x70\n  __ip_queue_xmit+0x18a/0x460\n  ip_queue_xmit+0x15/0x30\n  __tcp_transmit_skb+0x914/0x9c0\n  tcp_write_xmit+0x334/0x8d0\n  tcp_push_one+0x3c/0x60\n  tcp_sendmsg_locked+0x2e1/0xac0\n  tcp_sendmsg+0x2d/0x50\n  inet_sendmsg+0x43/0x90\n  sock_sendmsg+0x68/0x80\n  sock_write_iter+0x93/0x100\n  vfs_write+0x326/0x3c0\n  ksys_write+0xbd/0xf0\n  ? do_syscall_64+0x69/0x90\n  __x64_sys_write+0x19/0x30\n  do_syscall_\n---truncated---(CVE-2024-26907)\r\n\r\nRejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.(CVE-2024-26908)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/i915/gt: Reset queue_priority_hint on parking\r\n\r\nOriginally, with strict in order execution, we could complete execution\nonly when the queue was empty. Preempt-to-busy allows replacement of an\nactive request that may complete before the preemption is processed by\nHW. If that happens, the request is retired from the queue, but the\nqueue_priority_hint remains set, preventing direct submission until\nafter the next CS interrupt is processed.\r\n\r\nThis preempt-to-busy race can be triggered by the heartbeat, which will\nalso act as the power-management barrier and upon completion allow us to\nidle the HW. We may process the completion of the heartbeat, and begin\nparking the engine before the CS event that restores the\nqueue_priority_hint, causing us to fail the assertion that it is MIN.\r\n\r\n\u0026lt;3\u0026gt;[  166.210729] __engine_park:283 GEM_BUG_ON(engine-\u0026gt;sched_engine-\u0026gt;queue_priority_hint != (-((int)(~0U \u0026gt;\u0026gt; 1)) - 1))\n\u0026lt;0\u0026gt;[  166.210781] Dumping ftrace buffer:\n\u0026lt;0\u0026gt;[  166.210795] ---------------------------------\n...\n\u0026lt;0\u0026gt;[  167.302811] drm_fdin-1097      2..s1. 165741070us : trace_ports: 0000:00:02.0 rcs0: promote { ccid:20 1217:2 prio 0 }\n\u0026lt;0\u0026gt;[  167.302861] drm_fdin-1097      2d.s2. 165741072us : execlists_submission_tasklet: 0000:00:02.0 rcs0: preempting last=1217:2, prio=0, hint=2147483646\n\u0026lt;0\u0026gt;[  167.302928] drm_fdin-1097      2d.s2. 165741072us : __i915_request_unsubmit: 0000:00:02.0 rcs0: fence 1217:2, current 0\n\u0026lt;0\u0026gt;[  167.302992] drm_fdin-1097      2d.s2. 165741073us : __i915_request_submit: 0000:00:02.0 rcs0: fence 3:4660, current 4659\n\u0026lt;0\u0026gt;[  167.303044] drm_fdin-1097      2d.s1. 165741076us : execlists_submission_tasklet: 0000:00:02.0 rcs0: context:3 schedule-in, ccid:40\n\u0026lt;0\u0026gt;[  167.303095] drm_fdin-1097      2d.s1. 165741077us : trace_ports: 0000:00:02.0 rcs0: submit { ccid:40 3:4660* prio 2147483646 }\n\u0026lt;0\u0026gt;[  167.303159] kworker/-89       11..... 165741139us : i915_request_retire.part.0: 0000:00:02.0 rcs0: fence c90:2, current 2\n\u0026lt;0\u0026gt;[  167.303208] kworker/-89       11..... 165741148us : __intel_context_do_unpin: 0000:00:02.0 rcs0: context:c90 unpin\n\u0026lt;0\u0026gt;[  167.303272] kworker/-89       11..... 165741159us : i915_request_retire.part.0: 0000:00:02.0 rcs0: fence 1217:2, current 2\n\u0026lt;0\u0026gt;[  167.303321] kworker/-89       11..... 165741166us : __intel_context_do_unpin: 0000:00:02.0 rcs0: context:1217 unpin\n\u0026lt;0\u0026gt;[  167.303384] kworker/-89       11..... 165741170us : i915_request_retire.part.0: 0000:00:02.0 rcs0: fence 3:4660, current 4660\n\u0026lt;0\u0026gt;[  167.303434] kworker/-89       11d..1. 165741172us : __intel_context_retire: 0000:00:02.0 rcs0: context:1216 retire runtime: { total:56028ns, avg:56028ns }\n\u0026lt;0\u0026gt;[  167.303484] kworker/-89       11..... 165741198us : __engine_park: 0000:00:02.0 rcs0: parked\n\u0026lt;0\u0026gt;[  167.303534]   \u0026lt;idle\u0026gt;-0         5d.H3. 165741207us : execlists_irq_handler: 0000:00:02.0 rcs0: semaphore yield: 00000040\n\u0026lt;0\u0026gt;[  167.303583] kworker/-89       11..... 165741397us : __intel_context_retire: 0000:00:02.0 rcs0: context:1217 retire runtime: { total:325575ns, avg:0ns }\n\u0026lt;0\u0026gt;[  167.303756] kworker/-89       11..... 165741777us : __intel_context_retire: 0000:00:02.0 rcs0: context:c90 retire runtime: { total:0ns, avg:0ns }\n\u0026lt;0\u0026gt;[  167.303806] kworker/-89       11..... 165742017us : __engine_park: __engine_park:283 GEM_BUG_ON(engine-\u0026gt;sched_engine-\u0026gt;queue_priority_hint != (-((int)(~0U \u0026gt;\u0026gt; 1)) - 1))\n\u0026lt;0\u0026gt;[  167.303811] ---------------------------------\n\u0026lt;4\u0026gt;[  167.304722] ------------[ cut here ]------------\n\u0026lt;2\u0026gt;[  167.304725] kernel BUG at drivers/gpu/drm/i915/gt/intel_engine_pm.c:283!\n\u0026lt;4\u0026gt;[  167.304731] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI\n\u0026lt;4\u0026gt;[  167.304734] CPU: 11 PID: 89 Comm: kworker/11:1 Tainted: G        W          6.8.0-rc2-CI_DRM_14193-gc655e0fd2804+ #1\n\u0026lt;4\u0026gt;[  167.304736] Hardware name: Intel Corporation Rocket Lake Client Platform/RocketLake S UDIMM 6L RVP, BIOS RKLSFWI1.R00.3173.A03.2204210138 04/21/2022\n\u0026lt;4\u0026gt;[  167.304738] Workqueue: i915-unordered retire_work_handler [i915]\n\u0026lt;4\u0026gt;[  16\n---truncated---(CVE-2024-26937)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: openvswitch: Fix Use-After-Free in ovs_ct_exit\r\n\r\nSince kfree_rcu, which is called in the hlist_for_each_entry_rcu traversal\nof ovs_ct_limit_exit, is not part of the RCU read critical section, it\nis possible that the RCU grace period will pass during the traversal and\nthe key will be free.\r\n\r\nTo prevent this, it should be changed to hlist_for_each_entry_safe.(CVE-2024-27395)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: gtp: Fix Use-After-Free in gtp_dellink\r\n\r\nSince call_rcu, which is called in the hlist_for_each_entry_rcu traversal\nof gtp_dellink, is not part of the RCU read critical section, it\nis possible that the RCU grace period will pass during the traversal and\nthe key will be free.\r\n\r\nTo prevent this, it should be changed to hlist_for_each_entry_safe.(CVE-2024-27396)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nBluetooth: Fix use-after-free bugs caused by sco_sock_timeout\r\n\r\nWhen the sco connection is established and then, the sco socket\nis releasing, timeout_work will be scheduled to judge whether\nthe sco disconnection is timeout. The sock will be deallocated\nlater, but it is dereferenced again in sco_sock_timeout. As a\nresult, the use-after-free bugs will happen. The root cause is\nshown below:\r\n\r\n    Cleanup Thread               |      Worker Thread\nsco_sock_release                 |\n  sco_sock_close                 |\n    __sco_sock_close             |\n      sco_sock_set_timer         |\n        schedule_delayed_work    |\n  sco_sock_kill                  |    (wait a time)\n    sock_put(sk) //FREE          |  sco_sock_timeout\n                                 |    sock_hold(sk) //USE\r\n\r\nThe KASAN report triggered by POC is shown below:\r\n\r\n[   95.890016] ==================================================================\n[   95.890496] BUG: KASAN: slab-use-after-free in sco_sock_timeout+0x5e/0x1c0\n[   95.890755] Write of size 4 at addr ffff88800c388080 by task kworker/0:0/7\n...\n[   95.890755] Workqueue: events sco_sock_timeout\n[   95.890755] Call Trace:\n[   95.890755]  \u0026lt;TASK\u0026gt;\n[   95.890755]  dump_stack_lvl+0x45/0x110\n[   95.890755]  print_address_description+0x78/0x390\n[   95.890755]  print_report+0x11b/0x250\n[   95.890755]  ? __virt_addr_valid+0xbe/0xf0\n[   95.890755]  ? sco_sock_timeout+0x5e/0x1c0\n[   95.890755]  kasan_report+0x139/0x170\n[   95.890755]  ? update_load_avg+0xe5/0x9f0\n[   95.890755]  ? sco_sock_timeout+0x5e/0x1c0\n[   95.890755]  kasan_check_range+0x2c3/0x2e0\n[   95.890755]  sco_sock_timeout+0x5e/0x1c0\n[   95.890755]  process_one_work+0x561/0xc50\n[   95.890755]  worker_thread+0xab2/0x13c0\n[   95.890755]  ? pr_cont_work+0x490/0x490\n[   95.890755]  kthread+0x279/0x300\n[   95.890755]  ? pr_cont_work+0x490/0x490\n[   95.890755]  ? kthread_blkcg+0xa0/0xa0\n[   95.890755]  ret_from_fork+0x34/0x60\n[   95.890755]  ? kthread_blkcg+0xa0/0xa0\n[   95.890755]  ret_from_fork_asm+0x11/0x20\n[   95.890755]  \u0026lt;/TASK\u0026gt;\n[   95.890755]\n[   95.890755] Allocated by task 506:\n[   95.890755]  kasan_save_track+0x3f/0x70\n[   95.890755]  __kasan_kmalloc+0x86/0x90\n[   95.890755]  __kmalloc+0x17f/0x360\n[   95.890755]  sk_prot_alloc+0xe1/0x1a0\n[   95.890755]  sk_alloc+0x31/0x4e0\n[   95.890755]  bt_sock_alloc+0x2b/0x2a0\n[   95.890755]  sco_sock_create+0xad/0x320\n[   95.890755]  bt_sock_create+0x145/0x320\n[   95.890755]  __sock_create+0x2e1/0x650\n[   95.890755]  __sys_socket+0xd0/0x280\n[   95.890755]  __x64_sys_socket+0x75/0x80\n[   95.890755]  do_syscall_64+0xc4/0x1b0\n[   95.890755]  entry_SYSCALL_64_after_hwframe+0x67/0x6f\n[   95.890755]\n[   95.890755] Freed by task 506:\n[   95.890755]  kasan_save_track+0x3f/0x70\n[   95.890755]  kasan_save_free_info+0x40/0x50\n[   95.890755]  poison_slab_object+0x118/0x180\n[   95.890755]  __kasan_slab_free+0x12/0x30\n[   95.890755]  kfree+0xb2/0x240\n[   95.890755]  __sk_destruct+0x317/0x410\n[   95.890755]  sco_sock_release+0x232/0x280\n[   95.890755]  sock_close+0xb2/0x210\n[   95.890755]  __fput+0x37f/0x770\n[   95.890755]  task_work_run+0x1ae/0x210\n[   95.890755]  get_signal+0xe17/0xf70\n[   95.890755]  arch_do_signal_or_restart+0x3f/0x520\n[   95.890755]  syscall_exit_to_user_mode+0x55/0x120\n[   95.890755]  do_syscall_64+0xd1/0x1b0\n[   95.890755]  entry_SYSCALL_64_after_hwframe+0x67/0x6f\n[   95.890755]\n[   95.890755] The buggy address belongs to the object at ffff88800c388000\n[   95.890755]  which belongs to the cache kmalloc-1k of size 1024\n[   95.890755] The buggy address is located 128 bytes inside of\n[   95.890755]  freed 1024-byte region [ffff88800c388000, ffff88800c388400)\n[   95.890755]\n[   95.890755] The buggy address belongs to the physical page:\n[   95.890755] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800c38a800 pfn:0xc388\n[   95.890755] head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0\n[   95.890755] ano\n---truncated---(CVE-2024-27398)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ncpumap: Zero-initialise xdp_rxq_info struct before running XDP program\r\n\r\nWhen running an XDP program that is attached to a cpumap entry, we don\u0026apos;t\ninitialise the xdp_rxq_info data structure being used in the xdp_buff\nthat backs the XDP program invocation. Tobias noticed that this leads to\nrandom values being returned as the xdp_md-\u0026gt;rx_queue_index value for XDP\nprograms running in a cpumap.\r\n\r\nThis means we\u0026apos;re basically returning the contents of the uninitialised\nmemory, which is bad. Fix this by zero-initialising the rxq data\nstructure before running the XDP program.(CVE-2024-27431)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbtrfs: fix information leak in btrfs_ioctl_logical_to_ino()\r\n\r\nSyzbot reported the following information leak for in\nbtrfs_ioctl_logical_to_ino():\r\n\r\n  BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]\n  BUG: KMSAN: kernel-infoleak in _copy_to_user+0xbc/0x110 lib/usercopy.c:40\n   instrument_copy_to_user include/linux/instrumented.h:114 [inline]\n   _copy_to_user+0xbc/0x110 lib/usercopy.c:40\n   copy_to_user include/linux/uaccess.h:191 [inline]\n   btrfs_ioctl_logical_to_ino+0x440/0x750 fs/btrfs/ioctl.c:3499\n   btrfs_ioctl+0x714/0x1260\n   vfs_ioctl fs/ioctl.c:51 [inline]\n   __do_sys_ioctl fs/ioctl.c:904 [inline]\n   __se_sys_ioctl+0x261/0x450 fs/ioctl.c:890\n   __x64_sys_ioctl+0x96/0xe0 fs/ioctl.c:890\n   x64_sys_call+0x1883/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:17\n   do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n   do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\r\n\r\n  Uninit was created at:\n   __kmalloc_large_node+0x231/0x370 mm/slub.c:3921\n   __do_kmalloc_node mm/slub.c:3954 [inline]\n   __kmalloc_node+0xb07/0x1060 mm/slub.c:3973\n   kmalloc_node include/linux/slab.h:648 [inline]\n   kvmalloc_node+0xc0/0x2d0 mm/util.c:634\n   kvmalloc include/linux/slab.h:766 [inline]\n   init_data_container+0x49/0x1e0 fs/btrfs/backref.c:2779\n   btrfs_ioctl_logical_to_ino+0x17c/0x750 fs/btrfs/ioctl.c:3480\n   btrfs_ioctl+0x714/0x1260\n   vfs_ioctl fs/ioctl.c:51 [inline]\n   __do_sys_ioctl fs/ioctl.c:904 [inline]\n   __se_sys_ioctl+0x261/0x450 fs/ioctl.c:890\n   __x64_sys_ioctl+0x96/0xe0 fs/ioctl.c:890\n   x64_sys_call+0x1883/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:17\n   do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n   do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\r\n\r\n  Bytes 40-65535 of 65536 are uninitialized\n  Memory access of size 65536 starts at ffff888045a40000\r\n\r\nThis happens, because we\u0026apos;re copying a \u0026apos;struct btrfs_data_container\u0026apos; back\nto user-space. This btrfs_data_container is allocated in\n\u0026apos;init_data_container()\u0026apos; via kvmalloc(), which does not zero-fill the\nmemory.\r\n\r\nFix this by using kvzalloc() which zeroes out the memory on allocation.(CVE-2024-35849)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\npmdomain: ti: Add a null pointer check to the omap_prm_domain_init\r\n\r\ndevm_kasprintf() returns a pointer to dynamically allocated memory\nwhich can be NULL upon failure. Ensure the allocation was successful\nby checking the pointer validity.(CVE-2024-35943)","status":"published","published":"2024-05-24T11:07:06Z","modified":"2026-08-18T01:18:29.950596685Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1649","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbinder: fix race between mmput() and do_exit()\r\n\r\nTask A calls binder_update_page_range() to allocate and insert pages on\na remote address space from Task B. For this, Task A pins the remote mm\nvia mmget_not_zero() first. This can race with Task B do_exit() and the\nfinal mmput() refcount decrement will come from Task A.\r\n\r\n  Task A            | Task B\n  ------------------+------------------\n  mmget_not_zero()  |\n                    |  do_exit()\n                    |    exit_mm()\n                    |      mmput()\n  mmput()           |\n    exit_mmap()     |\n      remove_vma()  |\n        fput()      |\r\n\r\nIn this case, the work of ____fput() from Task B is queued up in Task A\nas TWA_RESUME. So in theory, Task A returns to userspace and the cleanup\nwork gets executed. However, Task A instead sleep, waiting for a reply\nfrom Task B that never comes (it\u0026apos;s dead).\r\n\r\nThis means the binder_deferred_release() is blocked until an unrelated\nbinder event forces Task A to go back to userspace. All the associated\ndeath notifications will also be delayed until then.\r\n\r\nIn order to fix this use mmput_async() that will schedule the work in\nthe corresponding mm-\u0026gt;async_put_work WQ instead of Task A.(CVE-2023-52609)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nhwrng: core - Fix page fault dead lock on mmap-ed hwrng\r\n\r\nThere is a dead-lock in the hwrng device read path.  This triggers\nwhen the user reads from /dev/hwrng into memory also mmap-ed from\n/dev/hwrng.  The resulting page fault triggers a recursive read\nwhich then dead-locks.\r\n\r\nFix this by using a stack buffer when calling copy_to_user.(CVE-2023-52615)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ncrypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init\r\n\r\nWhen the mpi_ec_ctx structure is initialized, some fields are not\ncleared, causing a crash when referencing the field when the\nstructure was released. Initially, this issue was ignored because\nmemory for mpi_ec_ctx is allocated with the __GFP_ZERO flag.\nFor example, this error will be triggered when calculating the\nZa value for SM2 separately.(CVE-2023-52616)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbpf: Check rcu_read_lock_trace_held() before calling bpf map helpers\r\n\r\nThese three bpf_map_{lookup,update,delete}_elem() helpers are also\navailable for sleepable bpf program, so add the corresponding lock\nassertion for sleepable bpf program, otherwise the following warning\nwill be reported when a sleepable bpf program manipulates bpf map under\ninterpreter mode (aka bpf_jit_enable=0):\r\n\r\n  WARNING: CPU: 3 PID: 4985 at kernel/bpf/helpers.c:40 ......\n  CPU: 3 PID: 4985 Comm: test_progs Not tainted 6.6.0+ #2\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ......\n  RIP: 0010:bpf_map_lookup_elem+0x54/0x60\n  ......\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   ? __warn+0xa5/0x240\n   ? bpf_map_lookup_elem+0x54/0x60\n   ? report_bug+0x1ba/0x1f0\n   ? handle_bug+0x40/0x80\n   ? exc_invalid_op+0x18/0x50\n   ? asm_exc_invalid_op+0x1b/0x20\n   ? __pfx_bpf_map_lookup_elem+0x10/0x10\n   ? rcu_lockdep_current_cpu_online+0x65/0xb0\n   ? rcu_is_watching+0x23/0x50\n   ? bpf_map_lookup_elem+0x54/0x60\n   ? __pfx_bpf_map_lookup_elem+0x10/0x10\n   ___bpf_prog_run+0x513/0x3b70\n   __bpf_prog_run32+0x9d/0xd0\n   ? __bpf_prog_enter_sleepable_recur+0xad/0x120\n   ? __bpf_prog_enter_sleepable_recur+0x3e/0x120\n   bpf_trampoline_6442580665+0x4d/0x1000\n   __x64_sys_getpgid+0x5/0x30\n   ? do_syscall_64+0x36/0xb0\n   entry_SYSCALL_64_after_hwframe+0x6e/0x76\n   \u0026lt;/TASK\u0026gt;(CVE-2023-52621)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nSUNRPC: Fix a suspicious RCU usage warning\r\n\r\nI received the following warning while running cthon against an ontap\nserver running pNFS:\r\n\r\n[   57.202521] =============================\n[   57.202522] WARNING: suspicious RCU usage\n[   57.202523] 6.7.0-rc3-g2cc14f52aeb7 #41492 Not tainted\n[   57.202525] -----------------------------\n[   57.202525] net/sunrpc/xprtmultipath.c:349 RCU-list traversed in non-reader section!!\n[   57.202527]\n               other info that might help us debug this:\r\n\r\n[   57.202528]\n               rcu_scheduler_active = 2, debug_locks = 1\n[   57.202529] no locks held by test5/3567.\n[   57.202530]\n               stack backtrace:\n[   57.202532] CPU: 0 PID: 3567 Comm: test5 Not tainted 6.7.0-rc3-g2cc14f52aeb7 #41492 5b09971b4965c0aceba19f3eea324a4a806e227e\n[   57.202534] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 2/2/2022\n[   57.202536] Call Trace:\n[   57.202537]  \u0026lt;TASK\u0026gt;\n[   57.202540]  dump_stack_lvl+0x77/0xb0\n[   57.202551]  lockdep_rcu_suspicious+0x154/0x1a0\n[   57.202556]  rpc_xprt_switch_has_addr+0x17c/0x190 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]\n[   57.202596]  rpc_clnt_setup_test_and_add_xprt+0x50/0x180 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]\n[   57.202621]  ? rpc_clnt_add_xprt+0x254/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]\n[   57.202646]  rpc_clnt_add_xprt+0x27a/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]\n[   57.202671]  ? __pfx_rpc_clnt_setup_test_and_add_xprt+0x10/0x10 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]\n[   57.202696]  nfs4_pnfs_ds_connect+0x345/0x760 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]\n[   57.202728]  ? __pfx_nfs4_test_session_trunk+0x10/0x10 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]\n[   57.202754]  nfs4_fl_prepare_ds+0x75/0xc0 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a]\n[   57.202760]  filelayout_write_pagelist+0x4a/0x200 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a]\n[   57.202765]  pnfs_generic_pg_writepages+0xbe/0x230 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]\n[   57.202788]  __nfs_pageio_add_request+0x3fd/0x520 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202813]  nfs_pageio_add_request+0x18b/0x390 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202831]  nfs_do_writepage+0x116/0x1e0 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202849]  nfs_writepages_callback+0x13/0x30 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202866]  write_cache_pages+0x265/0x450\n[   57.202870]  ? __pfx_nfs_writepages_callback+0x10/0x10 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202891]  nfs_writepages+0x141/0x230 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202913]  do_writepages+0xd2/0x230\n[   57.202917]  ? filemap_fdatawrite_wbc+0x5c/0x80\n[   57.202921]  filemap_fdatawrite_wbc+0x67/0x80\n[   57.202924]  filemap_write_and_wait_range+0xd9/0x170\n[   57.202930]  nfs_wb_all+0x49/0x180 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202947]  nfs4_file_flush+0x72/0xb0 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]\n[   57.202969]  __se_sys_close+0x46/0xd0\n[   57.202972]  do_syscall_64+0x68/0x100\n[   57.202975]  ? do_syscall_64+0x77/0x100\n[   57.202976]  ? do_syscall_64+0x77/0x100\n[   57.202979]  entry_SYSCALL_64_after_hwframe+0x6e/0x76\n[   57.202982] RIP: 0033:0x7fe2b12e4a94\n[   57.202985] Code: 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d d5 18 0e 00 00 74 13 b8 03 00 00 00 0f 05 \u0026lt;48\u0026gt; 3d 00 f0 ff ff 77 44 c3 0f 1f 00 48 83 ec 18 89 7c 24 0c e8 c3\n[   57.202987] RSP: 002b:00007ffe857ddb38 EFLAGS: 00000202 ORIG_RAX: 0000000000000003\n[   57.202989] RAX: ffffffffffffffda RBX: 00007ffe857dfd68 RCX: 00007fe2b12e4a94\n[   57.202991] RDX: 0000000000002000 RSI: 00007ffe857ddc40 RDI: 0000000000000003\n[   57.202992] RBP: 00007ffe857dfc50 R08: 7fffffffffffffff R09: 0000000065650f49\n[   57.202993] R10: 00007f\n---truncated---(CVE-2023-52623)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nsh: push-switch: Reorder cleanup operations to avoid use-after-free bug\r\n\r\nThe original code puts flush_work() before timer_shutdown_sync()\nin switch_drv_remove(). Although we use flush_work() to stop\nthe worker, it could be rescheduled in switch_timer(). As a result,\na use-after-free bug can occur. The details are shown below:\r\n\r\n      (cpu 0)                    |      (cpu 1)\nswitch_drv_remove()              |\n flush_work()                    |\n  ...                            |  switch_timer // timer\n                                 |   schedule_work(\u0026amp;psw-\u0026gt;work)\n timer_shutdown_sync()           |\n ...                             |  switch_work_handler // worker\n kfree(psw) // free              |\n                                 |   psw-\u0026gt;state = 0 // use\r\n\r\nThis patch puts timer_shutdown_sync() before flush_work() to\nmitigate the bugs. As a result, the worker and timer will be\nstopped safely before the deallocate operations.(CVE-2023-52629)\r\n\r\nRejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.(CVE-2023-52630)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\num: time-travel: fix time corruption\r\n\r\nIn \u0026apos;basic\u0026apos; time-travel mode (without =inf-cpu or =ext), we\nstill get timer interrupts. These can happen at arbitrary\npoints in time, i.e. while in timer_read(), which pushes\ntime forward just a little bit. Then, if we happen to get\nthe interrupt after calculating the new time to push to,\nbut before actually finishing that, the interrupt will set\nthe time to a value that\u0026apos;s incompatible with the forward,\nand we\u0026apos;ll crash because time goes backwards when we do the\nforwarding.\r\n\r\nFix this by reading the time_travel_time, calculating the\nadjustment, and doing the adjustment all with interrupts\ndisabled.(CVE-2023-52633)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nPM / devfreq: Synchronize devfreq_monitor_[start/stop]\r\n\r\nThere is a chance if a frequent switch of the governor\ndone in a loop result in timer list corruption where\ntimer cancel being done from two place one from\ncancel_delayed_work_sync() and followed by expire_timers()\ncan be seen from the traces[1].\r\n\r\nwhile true\ndo\n        echo \u0026quot;simple_ondemand\u0026quot; \u0026gt; /sys/class/devfreq/1d84000.ufshc/governor\n        echo \u0026quot;performance\u0026quot; \u0026gt; /sys/class/devfreq/1d84000.ufshc/governor\ndone\r\n\r\nIt looks to be issue with devfreq driver where\ndevice_monitor_[start/stop] need to synchronized so that\ndelayed work should get corrupted while it is either\nbeing queued or running or being cancelled.\r\n\r\nLet\u0026apos;s use polling flag and devfreq lock to synchronize the\nqueueing the timer instance twice and work data being\ncorrupted.\r\n\r\n[1]\n...\n..\n\u0026lt;idle\u0026gt;-0    [003]   9436.209662:  timer_cancel   timer=0xffffff80444f0428\n\u0026lt;idle\u0026gt;-0    [003]   9436.209664:  timer_expire_entry   timer=0xffffff80444f0428  now=0x10022da1c  function=__typeid__ZTSFvP10timer_listE_global_addr  baseclk=0x10022da1c\n\u0026lt;idle\u0026gt;-0    [003]   9436.209718:  timer_expire_exit   timer=0xffffff80444f0428\nkworker/u16:6-14217    [003]   9436.209863:  timer_start   timer=0xffffff80444f0428  function=__typeid__ZTSFvP10timer_listE_global_addr  expires=0x10022da2b  now=0x10022da1c  flags=182452227\nvendor.xxxyyy.ha-1593    [004]   9436.209888:  timer_cancel   timer=0xffffff80444f0428\nvendor.xxxyyy.ha-1593    [004]   9436.216390:  timer_init   timer=0xffffff80444f0428\nvendor.xxxyyy.ha-1593    [004]   9436.216392:  timer_start   timer=0xffffff80444f0428  function=__typeid__ZTSFvP10timer_listE_global_addr  expires=0x10022da2c  now=0x10022da1d  flags=186646532\nvendor.xxxyyy.ha-1593    [005]   9436.220992:  timer_cancel   timer=0xffffff80444f0428\nxxxyyyTraceManag-7795    [004]   9436.261641:  timer_cancel   timer=0xffffff80444f0428\r\n\r\n[2]\r\n\r\n 9436.261653][    C4] Unable to handle kernel paging request at virtual address dead00000000012a\n[ 9436.261664][    C4] Mem abort info:\n[ 9436.261666][    C4]   ESR = 0x96000044\n[ 9436.261669][    C4]   EC = 0x25: DABT (current EL), IL = 32 bits\n[ 9436.261671][    C4]   SET = 0, FnV = 0\n[ 9436.261673][    C4]   EA = 0, S1PTW = 0\n[ 9436.261675][    C4] Data abort info:\n[ 9436.261677][    C4]   ISV = 0, ISS = 0x00000044\n[ 9436.261680][    C4]   CM = 0, WnR = 1\n[ 9436.261682][    C4] [dead00000000012a] address between user and kernel address ranges\n[ 9436.261685][    C4] Internal error: Oops: 96000044 [#1] PREEMPT SMP\n[ 9436.261701][    C4] Skip md ftrace buffer dump for: 0x3a982d0\n...\r\n\r\n[ 9436.262138][    C4] CPU: 4 PID: 7795 Comm: TraceManag Tainted: G S      W  O      5.10.149-android12-9-o-g17f915d29d0c #1\n[ 9436.262141][    C4] Hardware name: Qualcomm Technologies, Inc.  (DT)\n[ 9436.262144][    C4] pstate: 22400085 (nzCv daIf +PAN -UAO +TCO BTYPE=--)\n[ 9436.262161][    C4] pc : expire_timers+0x9c/0x438\n[ 9436.262164][    C4] lr : expire_timers+0x2a4/0x438\n[ 9436.262168][    C4] sp : ffffffc010023dd0\n[ 9436.262171][    C4] x29: ffffffc010023df0 x28: ffffffd0636fdc18\n[ 9436.262178][    C4] x27: ffffffd063569dd0 x26: ffffffd063536008\n[ 9436.262182][    C4] x25: 0000000000000001 x24: ffffff88f7c69280\n[ 9436.262185][    C4] x23: 00000000000000e0 x22: dead000000000122\n[ 9436.262188][    C4] x21: 000000010022da29 x20: ffffff8af72b4e80\n[ 9436.262191][    C4] x19: ffffffc010023e50 x18: ffffffc010025038\n[ 9436.262195][    C4] x17: 0000000000000240 x16: 0000000000000201\n[ 9436.262199][    C4] x15: ffffffffffffffff x14: ffffff889f3c3100\n[ 9436.262203][    C4] x13: ffffff889f3c3100 x12: 00000000049f56b8\n[ 9436.262207][    C4] x11: 00000000049f56b8 x10: 00000000ffffffff\n[ 9436.262212][    C4] x9 : ffffffc010023e50 x8 : dead000000000122\n[ 9436.262216][    C4] x7 : ffffffffffffffff x6 : ffffffc0100239d8\n[ 9436.262220][    C4] x5 : 0000000000000000 x4 : 0000000000000101\n[ 9436.262223][    C4] x3 : 0000000000000080 x2 : ffffff8\n---truncated---(CVE-2023-52635)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ncan: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)\r\n\r\nLock jsk-\u0026gt;sk to prevent UAF when setsockopt(..., SO_J1939_FILTER, ...)\nmodifies jsk-\u0026gt;filters while receiving packets.\r\n\r\nFollowing trace was seen on affected system:\n ==================================================================\n BUG: KASAN: slab-use-after-free in j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939]\n Read of size 4 at addr ffff888012144014 by task j1939/350\r\n\r\n CPU: 0 PID: 350 Comm: j1939 Tainted: G        W  OE      6.5.0-rc5 #1\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014\n Call Trace:\n  print_report+0xd3/0x620\n  ? kasan_complete_mode_report_info+0x7d/0x200\n  ? j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939]\n  kasan_report+0xc2/0x100\n  ? j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939]\n  __asan_load4+0x84/0xb0\n  j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939]\n  j1939_sk_recv+0x20b/0x320 [can_j1939]\n  ? __kasan_check_write+0x18/0x20\n  ? __pfx_j1939_sk_recv+0x10/0x10 [can_j1939]\n  ? j1939_simple_recv+0x69/0x280 [can_j1939]\n  ? j1939_ac_recv+0x5e/0x310 [can_j1939]\n  j1939_can_recv+0x43f/0x580 [can_j1939]\n  ? __pfx_j1939_can_recv+0x10/0x10 [can_j1939]\n  ? raw_rcv+0x42/0x3c0 [can_raw]\n  ? __pfx_j1939_can_recv+0x10/0x10 [can_j1939]\n  can_rcv_filter+0x11f/0x350 [can]\n  can_receive+0x12f/0x190 [can]\n  ? __pfx_can_rcv+0x10/0x10 [can]\n  can_rcv+0xdd/0x130 [can]\n  ? __pfx_can_rcv+0x10/0x10 [can]\n  __netif_receive_skb_one_core+0x13d/0x150\n  ? __pfx___netif_receive_skb_one_core+0x10/0x10\n  ? __kasan_check_write+0x18/0x20\n  ? _raw_spin_lock_irq+0x8c/0xe0\n  __netif_receive_skb+0x23/0xb0\n  process_backlog+0x107/0x260\n  __napi_poll+0x69/0x310\n  net_rx_action+0x2a1/0x580\n  ? __pfx_net_rx_action+0x10/0x10\n  ? __pfx__raw_spin_lock+0x10/0x10\n  ? handle_irq_event+0x7d/0xa0\n  __do_softirq+0xf3/0x3f8\n  do_softirq+0x53/0x80\n  \u0026lt;/IRQ\u0026gt;\n  \u0026lt;TASK\u0026gt;\n  __local_bh_enable_ip+0x6e/0x70\n  netif_rx+0x16b/0x180\n  can_send+0x32b/0x520 [can]\n  ? __pfx_can_send+0x10/0x10 [can]\n  ? __check_object_size+0x299/0x410\n  raw_sendmsg+0x572/0x6d0 [can_raw]\n  ? __pfx_raw_sendmsg+0x10/0x10 [can_raw]\n  ? apparmor_socket_sendmsg+0x2f/0x40\n  ? __pfx_raw_sendmsg+0x10/0x10 [can_raw]\n  sock_sendmsg+0xef/0x100\n  sock_write_iter+0x162/0x220\n  ? __pfx_sock_write_iter+0x10/0x10\n  ? __rtnl_unlock+0x47/0x80\n  ? security_file_permission+0x54/0x320\n  vfs_write+0x6ba/0x750\n  ? __pfx_vfs_write+0x10/0x10\n  ? __fget_light+0x1ca/0x1f0\n  ? __rcu_read_unlock+0x5b/0x280\n  ksys_write+0x143/0x170\n  ? __pfx_ksys_write+0x10/0x10\n  ? __kasan_check_read+0x15/0x20\n  ? fpregs_assert_state_consistent+0x62/0x70\n  __x64_sys_write+0x47/0x60\n  do_syscall_64+0x60/0x90\n  ? do_syscall_64+0x6d/0x90\n  ? irqentry_exit+0x3f/0x50\n  ? exc_page_fault+0x79/0xf0\n  entry_SYSCALL_64_after_hwframe+0x6e/0xd8\r\n\r\n Allocated by task 348:\n  kasan_save_stack+0x2a/0x50\n  kasan_set_track+0x29/0x40\n  kasan_save_alloc_info+0x1f/0x30\n  __kasan_kmalloc+0xb5/0xc0\n  __kmalloc_node_track_caller+0x67/0x160\n  j1939_sk_setsockopt+0x284/0x450 [can_j1939]\n  __sys_setsockopt+0x15c/0x2f0\n  __x64_sys_setsockopt+0x6b/0x80\n  do_syscall_64+0x60/0x90\n  entry_SYSCALL_64_after_hwframe+0x6e/0xd8\r\n\r\n Freed by task 349:\n  kasan_save_stack+0x2a/0x50\n  kasan_set_track+0x29/0x40\n  kasan_save_free_info+0x2f/0x50\n  __kasan_slab_free+0x12e/0x1c0\n  __kmem_cache_free+0x1b9/0x380\n  kfree+0x7a/0x120\n  j1939_sk_setsockopt+0x3b2/0x450 [can_j1939]\n  __sys_setsockopt+0x15c/0x2f0\n  __x64_sys_setsockopt+0x6b/0x80\n  do_syscall_64+0x60/0x90\n  entry_SYSCALL_64_after_hwframe+0x6e/0xd8(CVE-2023-52637)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nKVM: s390: vsie: fix race during shadow creation\r\n\r\nRight now it is possible to see gmap-\u0026gt;private being zero in\nkvm_s390_vsie_gmap_notifier resulting in a crash.  This is due to the\nfact that we add gmap-\u0026gt;private == kvm after creation:\r\n\r\nstatic int acquire_gmap_shadow(struct kvm_vcpu *vcpu,\n                               struct vsie_page *vsie_page)\n{\n[...]\n        gmap = gmap_shadow(vcpu-\u0026gt;arch.gmap, asce, edat);\n        if (IS_ERR(gmap))\n                return PTR_ERR(gmap);\n        gmap-\u0026gt;private = vcpu-\u0026gt;kvm;\r\n\r\nLet children inherit the private field of the parent.(CVE-2023-52639)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled\r\n\r\nWhen QoS is disabled, the queue priority value will not map to the correct\nieee80211 queue since there is only one queue. Stop/wake queue 0 when QoS\nis disabled to prevent trying to stop/wake a non-existent queue and failing\nto stop/wake the actual queue instantiated.\r\n\r\nLog of issue before change (with kernel parameter qos=0):\n    [  +5.112651] ------------[ cut here ]------------\n    [  +0.000005] WARNING: CPU: 7 PID: 25513 at net/mac80211/util.c:449 __ieee80211_wake_queue+0xd5/0x180 [mac80211]\n    [  +0.000067] Modules linked in: b43(O) snd_seq_dummy snd_hrtimer snd_seq snd_seq_device nft_chain_nat xt_MASQUERADE nf_nat xfrm_user xfrm_algo xt_addrtype overlay ccm af_packet amdgpu snd_hda_codec_cirrus snd_hda_codec_generic ledtrig_audio drm_exec amdxcp gpu_sched xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip6t_rpfilter ipt_rpfilter xt_pkttype xt_LOG nf_log_syslog xt_tcpudp nft_compat nf_tables nfnetlink sch_fq_codel btusb uinput iTCO_wdt ctr btrtl intel_pmc_bxt i915 intel_rapl_msr mei_hdcp mei_pxp joydev at24 watchdog btintel atkbd libps2 serio radeon btbcm vivaldi_fmap btmtk intel_rapl_common snd_hda_codec_hdmi bluetooth uvcvideo nls_iso8859_1 applesmc nls_cp437 x86_pkg_temp_thermal snd_hda_intel intel_powerclamp vfat videobuf2_vmalloc coretemp fat snd_intel_dspcfg crc32_pclmul uvc polyval_clmulni snd_intel_sdw_acpi loop videobuf2_memops snd_hda_codec tun drm_suballoc_helper polyval_generic drm_ttm_helper drm_buddy tap ecdh_generic videobuf2_v4l2 gf128mul macvlan ttm ghash_clmulni_intel ecc tg3\n    [  +0.000044]  videodev bridge snd_hda_core rapl crc16 drm_display_helper cec mousedev snd_hwdep evdev intel_cstate bcm5974 hid_appleir videobuf2_common stp mac_hid libphy snd_pcm drm_kms_helper acpi_als mei_me intel_uncore llc mc snd_timer intel_gtt industrialio_triggered_buffer apple_mfi_fastcharge i2c_i801 mei snd lpc_ich agpgart ptp i2c_smbus thunderbolt apple_gmux i2c_algo_bit kfifo_buf video industrialio soundcore pps_core wmi tiny_power_button sbs sbshc button ac cordic bcma mac80211 cfg80211 ssb rfkill libarc4 kvm_intel kvm drm irqbypass fuse backlight firmware_class efi_pstore configfs efivarfs dmi_sysfs ip_tables x_tables autofs4 dm_crypt cbc encrypted_keys trusted asn1_encoder tee tpm rng_core input_leds hid_apple led_class hid_generic usbhid hid sd_mod t10_pi crc64_rocksoft crc64 crc_t10dif crct10dif_generic ahci libahci libata uhci_hcd ehci_pci ehci_hcd crct10dif_pclmul crct10dif_common sha512_ssse3 sha512_generic sha256_ssse3 sha1_ssse3 aesni_intel usbcore scsi_mod libaes crypto_simd cryptd scsi_common\n    [  +0.000055]  usb_common rtc_cmos btrfs blake2b_generic libcrc32c crc32c_generic crc32c_intel xor raid6_pq dm_snapshot dm_bufio dm_mod dax [last unloaded: b43(O)]\n    [  +0.000009] CPU: 7 PID: 25513 Comm: irq/17-b43 Tainted: G        W  O       6.6.7 #1-NixOS\n    [  +0.000003] Hardware name: Apple Inc. MacBookPro8,3/Mac-942459F5819B171B, BIOS 87.0.0.0.0 06/13/2019\n    [  +0.000001] RIP: 0010:__ieee80211_wake_queue+0xd5/0x180 [mac80211]\n    [  +0.000046] Code: 00 45 85 e4 0f 85 9b 00 00 00 48 8d bd 40 09 00 00 f0 48 0f ba ad 48 09 00 00 00 72 0f 5b 5d 41 5c 41 5d 41 5e e9 cb 6d 3c d0 \u0026lt;0f\u0026gt; 0b 5b 5d 41 5c 41 5d 41 5e c3 cc cc cc cc 48 8d b4 16 94 00 00\n    [  +0.000002] RSP: 0018:ffffc90003c77d60 EFLAGS: 00010097\n    [  +0.000001] RAX: 0000000000000001 RBX: 0000000000000002 RCX: 0000000000000000\n    [  +0.000001] RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffff88820b924900\n    [  +0.000002] RBP: ffff88820b924900 R08: ffffc90003c77d90 R09: 000000000003bfd0\n    [  +0.000001] R10: ffff88820b924900 R11: ffffc90003c77c68 R12: 0000000000000000\n    [  +0.000001] R13: 0000000000000000 R14: ffffc90003c77d90 R15: ffffffffc0fa6f40\n    [  +0.000001] FS:  0000000000000000(0000) GS:ffff88846fb80000(0000) knlGS:0000000000000000\n    [  +0.000001] CS:  0010 DS: 0\n---truncated---(CVE-2023-52644)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\npowerpc/imc-pmu: Add a null pointer check in update_events_in_group()\r\n\r\nkasprintf() returns a pointer to dynamically allocated memory\nwhich can be NULL upon failure.(CVE-2023-52675)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbpf: Guard stack limits against 32bit overflow\r\n\r\nThis patch promotes the arithmetic around checking stack bounds to be\ndone in the 64-bit domain, instead of the current 32bit. The arithmetic\nimplies adding together a 64-bit register with a int offset. The\nregister was checked to be below 1\u0026lt;\u0026lt;29 when it was variable, but not\nwhen it was fixed. The offset either comes from an instruction (in which\ncase it is 16 bit), from another register (in which case the caller\nchecked it to be below 1\u0026lt;\u0026lt;29 [1]), or from the size of an argument to a\nkfunc (in which case it can be a u32 [2]). Between the register being\ninconsistently checked to be below 1\u0026lt;\u0026lt;29, and the offset being up to an\nu32, it appears that we were open to overflowing the `int`s which were\ncurrently used for arithmetic.\r\n\r\n[1] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L7494-L7498\n[2] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L11904(CVE-2023-52676)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\npstore: ram_core: fix possible overflow in persistent_ram_init_ecc()\r\n\r\nIn persistent_ram_init_ecc(), on 64-bit arches DIV_ROUND_UP() will return\n64-bit value since persistent_ram_zone::buffer_size has type size_t which\nis derived from the 64-bit *unsigned long*, while the ecc_blocks variable\nthis value gets assigned to has (always 32-bit) *int* type.  Even if that\nvalue fits into *int* type, an overflow is still possible when calculating\nthe size_t typed ecc_total variable further below since there\u0026apos;s no cast to\nany 64-bit type before multiplication.  Declaring the ecc_blocks variable\nas *size_t* should fix this mess...\r\n\r\nFound by Linux Verification Center (linuxtesting.org) with the SVACE static\nanalysis tool.(CVE-2023-52685)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\npowerpc/powernv: Add a null pointer check to scom_debug_init_one()\r\n\r\nkasprintf() returns a pointer to dynamically allocated memory\nwhich can be NULL upon failure.\nAdd a null pointer check, and release \u0026apos;ent\u0026apos; to avoid memory leaks.(CVE-2023-52690)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/bridge: tpd12s015: Drop buggy __exit annotation for remove function\r\n\r\nWith tpd12s015_remove() marked with __exit this function is discarded\nwhen the driver is compiled as a built-in. The result is that when the\ndriver unbinds there is no cleanup done which results in resource\nleakage or worse.(CVE-2023-52694)\r\n\r\nA race condition was found in the Linux kernel\u0026apos;s bluetooth device driver in {min,max}_key_size_set() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.\r\n\r\n\r\n\r\n\n(CVE-2024-24860)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: iwlwifi: fix a memory corruption\r\n\r\niwl_fw_ini_trigger_tlv::data is a pointer to a __le32, which means that\nif we copy to iwl_fw_ini_trigger_tlv::data + offset while offset is in\nbytes, we\u0026apos;ll write past the buffer.(CVE-2024-26610)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()\r\n\r\nsyzbot pointed out [1] that NEXTHDR_FRAGMENT handling is broken.\r\n\r\nReading frag_off can only be done if we pulled enough bytes\nto skb-\u0026gt;head. Currently we might access garbage.\r\n\r\n[1]\nBUG: KMSAN: uninit-value in ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0\nip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0\nipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline]\nip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432\n__netdev_start_xmit include/linux/netdevice.h:4940 [inline]\nnetdev_start_xmit include/linux/netdevice.h:4954 [inline]\nxmit_one net/core/dev.c:3548 [inline]\ndev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564\n__dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349\ndev_queue_xmit include/linux/netdevice.h:3134 [inline]\nneigh_connected_output+0x569/0x660 net/core/neighbour.c:1592\nneigh_output include/net/neighbour.h:542 [inline]\nip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137\nip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222\nNF_HOOK_COND include/linux/netfilter.h:303 [inline]\nip6_output+0x323/0x610 net/ipv6/ip6_output.c:243\ndst_output include/net/dst.h:451 [inline]\nip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155\nip6_send_skb net/ipv6/ip6_output.c:1952 [inline]\nip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972\nrawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582\nrawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920\ninet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847\nsock_sendmsg_nosec net/socket.c:730 [inline]\n__sock_sendmsg net/socket.c:745 [inline]\n____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584\n___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638\n__sys_sendmsg net/socket.c:2667 [inline]\n__do_sys_sendmsg net/socket.c:2676 [inline]\n__se_sys_sendmsg net/socket.c:2674 [inline]\n__x64_sys_sendmsg+0x307/0x490 net/socket.c:2674\ndo_syscall_x64 arch/x86/entry/common.c:52 [inline]\ndo_syscall_64+0x44/0x110 arch/x86/entry/common.c:83\nentry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nUninit was created at:\nslab_post_alloc_hook+0x129/0xa70 mm/slab.h:768\nslab_alloc_node mm/slub.c:3478 [inline]\n__kmem_cache_alloc_node+0x5c9/0x970 mm/slub.c:3517\n__do_kmalloc_node mm/slab_common.c:1006 [inline]\n__kmalloc_node_track_caller+0x118/0x3c0 mm/slab_common.c:1027\nkmalloc_reserve+0x249/0x4a0 net/core/skbuff.c:582\npskb_expand_head+0x226/0x1a00 net/core/skbuff.c:2098\n__pskb_pull_tail+0x13b/0x2310 net/core/skbuff.c:2655\npskb_may_pull_reason include/linux/skbuff.h:2673 [inline]\npskb_may_pull include/linux/skbuff.h:2681 [inline]\nip6_tnl_parse_tlv_enc_lim+0x901/0xbb0 net/ipv6/ip6_tunnel.c:408\nipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline]\nip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432\n__netdev_start_xmit include/linux/netdevice.h:4940 [inline]\nnetdev_start_xmit include/linux/netdevice.h:4954 [inline]\nxmit_one net/core/dev.c:3548 [inline]\ndev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564\n__dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349\ndev_queue_xmit include/linux/netdevice.h:3134 [inline]\nneigh_connected_output+0x569/0x660 net/core/neighbour.c:1592\nneigh_output include/net/neighbour.h:542 [inline]\nip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137\nip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222\nNF_HOOK_COND include/linux/netfilter.h:303 [inline]\nip6_output+0x323/0x610 net/ipv6/ip6_output.c:243\ndst_output include/net/dst.h:451 [inline]\nip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155\nip6_send_skb net/ipv6/ip6_output.c:1952 [inline]\nip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972\nrawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582\nrawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920\ninet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847\nsock_sendmsg_nosec net/socket.c:730 [inline]\n__sock_sendmsg net/socket.c:745 [inline]\n____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584\n___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638\n__sys_sendmsg net/socket.c:2667 [inline]\n__do_sys_sendms\n---truncated---(CVE-2024-26633)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nllc: Drop support for ETH_P_TR_802_2.\r\n\r\nsyzbot reported an uninit-value bug below. [0]\r\n\r\nllc supports ETH_P_802_2 (0x0004) and used to support ETH_P_TR_802_2\n(0x0011), and syzbot abused the latter to trigger the bug.\r\n\r\n  write$tun(r0, \u0026amp;(0x7f0000000040)={@val={0x0, 0x11}, @val, @mpls={[], @llc={@snap={0xaa, 0x1, \u0026apos;)\u0026apos;, \u0026quot;90e5dd\u0026quot;}}}}, 0x16)\r\n\r\nllc_conn_handler() initialises local variables {saddr,daddr}.mac\nbased on skb in llc_pdu_decode_sa()/llc_pdu_decode_da() and passes\nthem to __llc_lookup().\r\n\r\nHowever, the initialisation is done only when skb-\u0026gt;protocol is\nhtons(ETH_P_802_2), otherwise, __llc_lookup_established() and\n__llc_lookup_listener() will read garbage.\r\n\r\nThe missing initialisation existed prior to commit 211ed865108e\n(\u0026quot;net: delete all instances of special processing for token ring\u0026quot;).\r\n\r\nIt removed the part to kick out the token ring stuff but forgot to\nclose the door allowing ETH_P_TR_802_2 packets to sneak into llc_rcv().\r\n\r\nLet\u0026apos;s remove llc_tr_packet_type and complete the deprecation.\r\n\r\n[0]:\nBUG: KMSAN: uninit-value in __llc_lookup_established+0xe9d/0xf90\n __llc_lookup_established+0xe9d/0xf90\n __llc_lookup net/llc/llc_conn.c:611 [inline]\n llc_conn_handler+0x4bd/0x1360 net/llc/llc_conn.c:791\n llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206\n __netif_receive_skb_one_core net/core/dev.c:5527 [inline]\n __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5641\n netif_receive_skb_internal net/core/dev.c:5727 [inline]\n netif_receive_skb+0x58/0x660 net/core/dev.c:5786\n tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555\n tun_get_user+0x53af/0x66d0 drivers/net/tun.c:2002\n tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048\n call_write_iter include/linux/fs.h:2020 [inline]\n new_sync_write fs/read_write.c:491 [inline]\n vfs_write+0x8ef/0x1490 fs/read_write.c:584\n ksys_write+0x20f/0x4c0 fs/read_write.c:637\n __do_sys_write fs/read_write.c:649 [inline]\n __se_sys_write fs/read_write.c:646 [inline]\n __x64_sys_write+0x93/0xd0 fs/read_write.c:646\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nLocal variable daddr created at:\n llc_conn_handler+0x53/0x1360 net/llc/llc_conn.c:783\n llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206\r\n\r\nCPU: 1 PID: 5004 Comm: syz-executor994 Not tainted 6.6.0-syzkaller-14500-g1c41041124bd #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023(CVE-2024-26635)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nllc: make llc_ui_sendmsg() more robust against bonding changes\r\n\r\nsyzbot was able to trick llc_ui_sendmsg(), allocating an skb with no\nheadroom, but subsequently trying to push 14 bytes of Ethernet header [1]\r\n\r\nLike some others, llc_ui_sendmsg() releases the socket lock before\ncalling sock_alloc_send_skb().\nThen it acquires it again, but does not redo all the sanity checks\nthat were performed.\r\n\r\nThis fix:\r\n\r\n- Uses LL_RESERVED_SPACE() to reserve space.\n- Check all conditions again after socket lock is held again.\n- Do not account Ethernet header for mtu limitation.\r\n\r\n[1]\r\n\r\nskbuff: skb_under_panic: text:ffff800088baa334 len:1514 put:14 head:ffff0000c9c37000 data:ffff0000c9c36ff2 tail:0x5dc end:0x6c0 dev:bond0\r\n\r\n kernel BUG at net/core/skbuff.c:193 !\nInternal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP\nModules linked in:\nCPU: 0 PID: 6875 Comm: syz-executor.0 Not tainted 6.7.0-rc8-syzkaller-00101-g0802e17d9aca-dirty #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023\npstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : skb_panic net/core/skbuff.c:189 [inline]\n pc : skb_under_panic+0x13c/0x140 net/core/skbuff.c:203\n lr : skb_panic net/core/skbuff.c:189 [inline]\n lr : skb_under_panic+0x13c/0x140 net/core/skbuff.c:203\nsp : ffff800096f97000\nx29: ffff800096f97010 x28: ffff80008cc8d668 x27: dfff800000000000\nx26: ffff0000cb970c90 x25: 00000000000005dc x24: ffff0000c9c36ff2\nx23: ffff0000c9c37000 x22: 00000000000005ea x21: 00000000000006c0\nx20: 000000000000000e x19: ffff800088baa334 x18: 1fffe000368261ce\nx17: ffff80008e4ed000 x16: ffff80008a8310f8 x15: 0000000000000001\nx14: 1ffff00012df2d58 x13: 0000000000000000 x12: 0000000000000000\nx11: 0000000000000001 x10: 0000000000ff0100 x9 : e28a51f1087e8400\nx8 : e28a51f1087e8400 x7 : ffff80008028f8d0 x6 : 0000000000000000\nx5 : 0000000000000001 x4 : 0000000000000001 x3 : ffff800082b78714\nx2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000089\nCall trace:\n  skb_panic net/core/skbuff.c:189 [inline]\n  skb_under_panic+0x13c/0x140 net/core/skbuff.c:203\n  skb_push+0xf0/0x108 net/core/skbuff.c:2451\n  eth_header+0x44/0x1f8 net/ethernet/eth.c:83\n  dev_hard_header include/linux/netdevice.h:3188 [inline]\n  llc_mac_hdr_init+0x110/0x17c net/llc/llc_output.c:33\n  llc_sap_action_send_xid_c+0x170/0x344 net/llc/llc_s_ac.c:85\n  llc_exec_sap_trans_actions net/llc/llc_sap.c:153 [inline]\n  llc_sap_next_state net/llc/llc_sap.c:182 [inline]\n  llc_sap_state_process+0x1ec/0x774 net/llc/llc_sap.c:209\n  llc_build_and_send_xid_pkt+0x12c/0x1c0 net/llc/llc_sap.c:270\n  llc_ui_sendmsg+0x7bc/0xb1c net/llc/af_llc.c:997\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg net/socket.c:745 [inline]\n  sock_sendmsg+0x194/0x274 net/socket.c:767\n  splice_to_socket+0x7cc/0xd58 fs/splice.c:881\n  do_splice_from fs/splice.c:933 [inline]\n  direct_splice_actor+0xe4/0x1c0 fs/splice.c:1142\n  splice_direct_to_actor+0x2a0/0x7e4 fs/splice.c:1088\n  do_splice_direct+0x20c/0x348 fs/splice.c:1194\n  do_sendfile+0x4bc/0xc70 fs/read_write.c:1254\n  __do_sys_sendfile64 fs/read_write.c:1322 [inline]\n  __se_sys_sendfile64 fs/read_write.c:1308 [inline]\n  __arm64_sys_sendfile64+0x160/0x3b4 fs/read_write.c:1308\n  __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]\n  invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51\n  el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136\n  do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155\n  el0_svc+0x54/0x158 arch/arm64/kernel/entry-common.c:678\n  el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696\n  el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:595\nCode: aa1803e6 aa1903e7 a90023f5 94792f6a (d4210000)(CVE-2024-26636)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntcp: add sanity checks to rx zerocopy\r\n\r\nTCP rx zerocopy intent is to map pages initially allocated\nfrom NIC drivers, not pages owned by a fs.\r\n\r\nThis patch adds to can_map_frag() these additional checks:\r\n\r\n- Page must not be a compound one.\n- page-\u0026gt;mapping must be NULL.\r\n\r\nThis fixes the panic reported by ZhangPeng.\r\n\r\nsyzbot was able to loopback packets built with sendfile(),\nmapping pages owned by an ext4 file to TCP rx zerocopy.\r\n\r\nr3 = socket$inet_tcp(0x2, 0x1, 0x0)\nmmap(\u0026amp;(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x12, r3, 0x0)\nr4 = socket$inet_tcp(0x2, 0x1, 0x0)\nbind$inet(r4, \u0026amp;(0x7f0000000000)={0x2, 0x4e24, @multicast1}, 0x10)\nconnect$inet(r4, \u0026amp;(0x7f00000006c0)={0x2, 0x4e24, @empty}, 0x10)\nr5 = openat$dir(0xffffffffffffff9c, \u0026amp;(0x7f00000000c0)=\u0026apos;./file0\\x00\u0026apos;,\n    0x181e42, 0x0)\nfallocate(r5, 0x0, 0x0, 0x85b8)\nsendfile(r4, r5, 0x0, 0x8ba0)\ngetsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r4, 0x6, 0x23,\n    \u0026amp;(0x7f00000001c0)={\u0026amp;(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0,\n    0x0, 0x0, 0x0, 0x0}, \u0026amp;(0x7f0000000440)=0x40)\nr6 = openat$dir(0xffffffffffffff9c, \u0026amp;(0x7f00000000c0)=\u0026apos;./file0\\x00\u0026apos;,\n    0x181e42, 0x0)(CVE-2024-26640)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()\r\n\r\nsyzbot found __ip6_tnl_rcv() could access unitiliazed data [1].\r\n\r\nCall pskb_inet_may_pull() to fix this, and initialize ipv6h\nvariable after this call as it can change skb-\u0026gt;head.\r\n\r\n[1]\n BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]\n BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]\n BUG: KMSAN: uninit-value in IP6_ECN_decapsulate+0x7df/0x1e50 include/net/inet_ecn.h:321\n  __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]\n  INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]\n  IP6_ECN_decapsulate+0x7df/0x1e50 include/net/inet_ecn.h:321\n  ip6ip6_dscp_ecn_decapsulate+0x178/0x1b0 net/ipv6/ip6_tunnel.c:727\n  __ip6_tnl_rcv+0xd4e/0x1590 net/ipv6/ip6_tunnel.c:845\n  ip6_tnl_rcv+0xce/0x100 net/ipv6/ip6_tunnel.c:888\n gre_rcv+0x143f/0x1870\n  ip6_protocol_deliver_rcu+0xda6/0x2a60 net/ipv6/ip6_input.c:438\n  ip6_input_finish net/ipv6/ip6_input.c:483 [inline]\n  NF_HOOK include/linux/netfilter.h:314 [inline]\n  ip6_input+0x15d/0x430 net/ipv6/ip6_input.c:492\n  ip6_mc_input+0xa7e/0xc80 net/ipv6/ip6_input.c:586\n  dst_input include/net/dst.h:461 [inline]\n  ip6_rcv_finish+0x5db/0x870 net/ipv6/ip6_input.c:79\n  NF_HOOK include/linux/netfilter.h:314 [inline]\n  ipv6_rcv+0xda/0x390 net/ipv6/ip6_input.c:310\n  __netif_receive_skb_one_core net/core/dev.c:5532 [inline]\n  __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5646\n  netif_receive_skb_internal net/core/dev.c:5732 [inline]\n  netif_receive_skb+0x58/0x660 net/core/dev.c:5791\n  tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555\n  tun_get_user+0x53af/0x66d0 drivers/net/tun.c:2002\n  tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048\n  call_write_iter include/linux/fs.h:2084 [inline]\n  new_sync_write fs/read_write.c:497 [inline]\n  vfs_write+0x786/0x1200 fs/read_write.c:590\n  ksys_write+0x20f/0x4c0 fs/read_write.c:643\n  __do_sys_write fs/read_write.c:655 [inline]\n  __se_sys_write fs/read_write.c:652 [inline]\n  __x64_sys_write+0x93/0xd0 fs/read_write.c:652\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0x6d/0x140 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nUninit was created at:\n  slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768\n  slab_alloc_node mm/slub.c:3478 [inline]\n  kmem_cache_alloc_node+0x5e9/0xb10 mm/slub.c:3523\n  kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560\n  __alloc_skb+0x318/0x740 net/core/skbuff.c:651\n  alloc_skb include/linux/skbuff.h:1286 [inline]\n  alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6334\n  sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2787\n  tun_alloc_skb drivers/net/tun.c:1531 [inline]\n  tun_get_user+0x1e8a/0x66d0 drivers/net/tun.c:1846\n  tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048\n  call_write_iter include/linux/fs.h:2084 [inline]\n  new_sync_write fs/read_write.c:497 [inline]\n  vfs_write+0x786/0x1200 fs/read_write.c:590\n  ksys_write+0x20f/0x4c0 fs/read_write.c:643\n  __do_sys_write fs/read_write.c:655 [inline]\n  __se_sys_write fs/read_write.c:652 [inline]\n  __x64_sys_write+0x93/0xd0 fs/read_write.c:652\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0x6d/0x140 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nCPU: 0 PID: 5034 Comm: syz-executor331 Not tainted 6.7.0-syzkaller-00562-g9f8413c4a66f #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023(CVE-2024-26641)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nf_tables: disallow anonymous set with timeout flag\r\n\r\nAnonymous sets are never used with timeout from userspace, reject this.\nException to this rule is NFT_SET_EVAL to ensure legacy meters still work.(CVE-2024-26642)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntracing: Ensure visibility when inserting an element into tracing_map\r\n\r\nRunning the following two commands in parallel on a multi-processor\nAArch64 machine can sporadically produce an unexpected warning about\nduplicate histogram entries:\r\n\r\n $ while true; do\n     echo hist:key=id.syscall:val=hitcount \u0026gt; \\\n       /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/trigger\n     cat /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/hist\n     sleep 0.001\n   done\n $ stress-ng --sysbadaddr $(nproc)\r\n\r\nThe warning looks as follows:\r\n\r\n[ 2911.172474] ------------[ cut here ]------------\n[ 2911.173111] Duplicates detected: 1\n[ 2911.173574] WARNING: CPU: 2 PID: 12247 at kernel/trace/tracing_map.c:983 tracing_map_sort_entries+0x3e0/0x408\n[ 2911.174702] Modules linked in: iscsi_ibft(E) iscsi_boot_sysfs(E) rfkill(E) af_packet(E) nls_iso8859_1(E) nls_cp437(E) vfat(E) fat(E) ena(E) tiny_power_button(E) qemu_fw_cfg(E) button(E) fuse(E) efi_pstore(E) ip_tables(E) x_tables(E) xfs(E) libcrc32c(E) aes_ce_blk(E) aes_ce_cipher(E) crct10dif_ce(E) polyval_ce(E) polyval_generic(E) ghash_ce(E) gf128mul(E) sm4_ce_gcm(E) sm4_ce_ccm(E) sm4_ce(E) sm4_ce_cipher(E) sm4(E) sm3_ce(E) sm3(E) sha3_ce(E) sha512_ce(E) sha512_arm64(E) sha2_ce(E) sha256_arm64(E) nvme(E) sha1_ce(E) nvme_core(E) nvme_auth(E) t10_pi(E) sg(E) scsi_mod(E) scsi_common(E) efivarfs(E)\n[ 2911.174738] Unloaded tainted modules: cppc_cpufreq(E):1\n[ 2911.180985] CPU: 2 PID: 12247 Comm: cat Kdump: loaded Tainted: G            E      6.7.0-default #2 1b58bbb22c97e4399dc09f92d309344f69c44a01\n[ 2911.182398] Hardware name: Amazon EC2 c7g.8xlarge/, BIOS 1.0 11/1/2018\n[ 2911.183208] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n[ 2911.184038] pc : tracing_map_sort_entries+0x3e0/0x408\n[ 2911.184667] lr : tracing_map_sort_entries+0x3e0/0x408\n[ 2911.185310] sp : ffff8000a1513900\n[ 2911.185750] x29: ffff8000a1513900 x28: ffff0003f272fe80 x27: 0000000000000001\n[ 2911.186600] x26: ffff0003f272fe80 x25: 0000000000000030 x24: 0000000000000008\n[ 2911.187458] x23: ffff0003c5788000 x22: ffff0003c16710c8 x21: ffff80008017f180\n[ 2911.188310] x20: ffff80008017f000 x19: ffff80008017f180 x18: ffffffffffffffff\n[ 2911.189160] x17: 0000000000000000 x16: 0000000000000000 x15: ffff8000a15134b8\n[ 2911.190015] x14: 0000000000000000 x13: 205d373432323154 x12: 5b5d313131333731\n[ 2911.190844] x11: 00000000fffeffff x10: 00000000fffeffff x9 : ffffd1b78274a13c\n[ 2911.191716] x8 : 000000000017ffe8 x7 : c0000000fffeffff x6 : 000000000057ffa8\n[ 2911.192554] x5 : ffff0012f6c24ec0 x4 : 0000000000000000 x3 : ffff2e5b72b5d000\n[ 2911.193404] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0003ff254480\n[ 2911.194259] Call trace:\n[ 2911.194626]  tracing_map_sort_entries+0x3e0/0x408\n[ 2911.195220]  hist_show+0x124/0x800\n[ 2911.195692]  seq_read_iter+0x1d4/0x4e8\n[ 2911.196193]  seq_read+0xe8/0x138\n[ 2911.196638]  vfs_read+0xc8/0x300\n[ 2911.197078]  ksys_read+0x70/0x108\n[ 2911.197534]  __arm64_sys_read+0x24/0x38\n[ 2911.198046]  invoke_syscall+0x78/0x108\n[ 2911.198553]  el0_svc_common.constprop.0+0xd0/0xf8\n[ 2911.199157]  do_el0_svc+0x28/0x40\n[ 2911.199613]  el0_svc+0x40/0x178\n[ 2911.200048]  el0t_64_sync_handler+0x13c/0x158\n[ 2911.200621]  el0t_64_sync+0x1a8/0x1b0\n[ 2911.201115] ---[ end trace 0000000000000000 ]---\r\n\r\nThe problem appears to be caused by CPU reordering of writes issued from\n__tracing_map_insert().\r\n\r\nThe check for the presence of an element with a given key in this\nfunction is:\r\n\r\n val = READ_ONCE(entry-\u0026gt;val);\n if (val \u0026amp;\u0026amp; keys_match(key, val-\u0026gt;key, map-\u0026gt;key_size)) ...\r\n\r\nThe write of a new entry is:\r\n\r\n elt = get_free_elt(map);\n memcpy(elt-\u0026gt;key, key, map-\u0026gt;key_size);\n entry-\u0026gt;val = elt;\r\n\r\nThe \u0026quot;memcpy(elt-\u0026gt;key, key, map-\u0026gt;key_size);\u0026quot; and \u0026quot;entry-\u0026gt;val = elt;\u0026quot;\nstores may become visible in the reversed order on another CPU. This\nsecond CPU might then incorrectly determine that a new key doesn\u0026apos;t match\nan already present val-\u0026gt;key and subse\n---truncated---(CVE-2024-26645)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/amd/display: Add NULL test for \u0026apos;timing generator\u0026apos; in \u0026apos;dcn21_set_pipe()\u0026apos;\r\n\r\nIn \u0026quot;u32 otg_inst = pipe_ctx-\u0026gt;stream_res.tg-\u0026gt;inst;\u0026quot;\npipe_ctx-\u0026gt;stream_res.tg could be NULL, it is relying on the caller to\nensure the tg is not NULL.(CVE-2024-26661)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntunnels: fix out of bounds access when building IPv6 PMTU error\r\n\r\nIf the ICMPv6 error is built from a non-linear skb we get the following\nsplat,\r\n\r\n  BUG: KASAN: slab-out-of-bounds in do_csum+0x220/0x240\n  Read of size 4 at addr ffff88811d402c80 by task netperf/820\n  CPU: 0 PID: 820 Comm: netperf Not tainted 6.8.0-rc1+ #543\n  ...\n   kasan_report+0xd8/0x110\n   do_csum+0x220/0x240\n   csum_partial+0xc/0x20\n   skb_tunnel_check_pmtu+0xeb9/0x3280\n   vxlan_xmit_one+0x14c2/0x4080\n   vxlan_xmit+0xf61/0x5c00\n   dev_hard_start_xmit+0xfb/0x510\n   __dev_queue_xmit+0x7cd/0x32a0\n   br_dev_queue_push_xmit+0x39d/0x6a0\r\n\r\nUse skb_checksum instead of csum_partial who cannot deal with non-linear\nSKBs.(CVE-2024-26665)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nppp_async: limit MRU to 64K\r\n\r\nsyzbot triggered a warning [1] in __alloc_pages():\r\n\r\nWARN_ON_ONCE_GFP(order \u0026gt; MAX_PAGE_ORDER, gfp)\r\n\r\nWillem fixed a similar issue in commit c0a2a1b0d631 (\u0026quot;ppp: limit MRU to 64K\u0026quot;)\r\n\r\nAdopt the same sanity check for ppp_async_ioctl(PPPIOCSMRU)\r\n\r\n[1]:\r\n\r\n WARNING: CPU: 1 PID: 11 at mm/page_alloc.c:4543 __alloc_pages+0x308/0x698 mm/page_alloc.c:4543\nModules linked in:\nCPU: 1 PID: 11 Comm: kworker/u4:0 Not tainted 6.8.0-rc2-syzkaller-g41bccc98fb79 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023\nWorkqueue: events_unbound flush_to_ldisc\npstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : __alloc_pages+0x308/0x698 mm/page_alloc.c:4543\n lr : __alloc_pages+0xc8/0x698 mm/page_alloc.c:4537\nsp : ffff800093967580\nx29: ffff800093967660 x28: ffff8000939675a0 x27: dfff800000000000\nx26: ffff70001272ceb4 x25: 0000000000000000 x24: ffff8000939675c0\nx23: 0000000000000000 x22: 0000000000060820 x21: 1ffff0001272ceb8\nx20: ffff8000939675e0 x19: 0000000000000010 x18: ffff800093967120\nx17: ffff800083bded5c x16: ffff80008ac97500 x15: 0000000000000005\nx14: 1ffff0001272cebc x13: 0000000000000000 x12: 0000000000000000\nx11: ffff70001272cec1 x10: 1ffff0001272cec0 x9 : 0000000000000001\nx8 : ffff800091c91000 x7 : 0000000000000000 x6 : 000000000000003f\nx5 : 00000000ffffffff x4 : 0000000000000000 x3 : 0000000000000020\nx2 : 0000000000000008 x1 : 0000000000000000 x0 : ffff8000939675e0\nCall trace:\n  __alloc_pages+0x308/0x698 mm/page_alloc.c:4543\n  __alloc_pages_node include/linux/gfp.h:238 [inline]\n  alloc_pages_node include/linux/gfp.h:261 [inline]\n  __kmalloc_large_node+0xbc/0x1fc mm/slub.c:3926\n  __do_kmalloc_node mm/slub.c:3969 [inline]\n  __kmalloc_node_track_caller+0x418/0x620 mm/slub.c:4001\n  kmalloc_reserve+0x17c/0x23c net/core/skbuff.c:590\n  __alloc_skb+0x1c8/0x3d8 net/core/skbuff.c:651\n  __netdev_alloc_skb+0xb8/0x3e8 net/core/skbuff.c:715\n  netdev_alloc_skb include/linux/skbuff.h:3235 [inline]\n  dev_alloc_skb include/linux/skbuff.h:3248 [inline]\n  ppp_async_input drivers/net/ppp/ppp_async.c:863 [inline]\n  ppp_asynctty_receive+0x588/0x186c drivers/net/ppp/ppp_async.c:341\n  tty_ldisc_receive_buf+0x12c/0x15c drivers/tty/tty_buffer.c:390\n  tty_port_default_receive_buf+0x74/0xac drivers/tty/tty_port.c:37\n  receive_buf drivers/tty/tty_buffer.c:444 [inline]\n  flush_to_ldisc+0x284/0x6e4 drivers/tty/tty_buffer.c:494\n  process_one_work+0x694/0x1204 kernel/workqueue.c:2633\n  process_scheduled_works kernel/workqueue.c:2706 [inline]\n  worker_thread+0x938/0xef4 kernel/workqueue.c:2787\n  kthread+0x288/0x310 kernel/kthread.c:388\n  ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860(CVE-2024-26675)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ninet: read sk-\u0026gt;sk_family once in inet_recv_error()\r\n\r\ninet_recv_error() is called without holding the socket lock.\r\n\r\nIPv6 socket could mutate to IPv4 with IPV6_ADDRFORM\nsocket option and trigger a KCSAN warning.(CVE-2024-26679)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: stmmac: xgmac: fix handling of DPP safety error for DMA channels\r\n\r\nCommit 56e58d6c8a56 (\u0026quot;net: stmmac: Implement Safety Features in\nXGMAC core\u0026quot;) checks and reports safety errors, but leaves the\nData Path Parity Errors for each channel in DMA unhandled at all, lead to\na storm of interrupt.\nFix it by checking and clearing the DMA_DPP_Interrupt_Status register.(CVE-2024-26684)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnilfs2: fix potential bug in end_buffer_async_write\r\n\r\nAccording to a syzbot report, end_buffer_async_write(), which handles the\ncompletion of block device writes, may detect abnormal condition of the\nbuffer async_write flag and cause a BUG_ON failure when using nilfs2.\r\n\r\nNilfs2 itself does not use end_buffer_async_write().  But, the async_write\nflag is now used as a marker by commit 7f42ec394156 (\u0026quot;nilfs2: fix issue\nwith race condition of competition between segments for dirty blocks\u0026quot;) as\na means of resolving double list insertion of dirty blocks in\nnilfs_lookup_dirty_data_buffers() and nilfs_lookup_node_buffers() and the\nresulting crash.\r\n\r\nThis modification is safe as long as it is used for file data and b-tree\nnode blocks where the page caches are independent.  However, it was\nirrelevant and redundant to also introduce async_write for segment summary\nand super root blocks that share buffers with the backing device.  This\nled to the possibility that the BUG_ON check in end_buffer_async_write\nwould fail as described above, if independent writebacks of the backing\ndevice occurred in parallel.\r\n\r\nThe use of async_write for segment summary buffers has already been\nremoved in a previous change.\r\n\r\nFix this issue by removing the manipulation of the async_write flag for\nthe remaining super root block buffer.(CVE-2024-26685)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nfs/proc: do_task_stat: use sig-\u0026gt;stats_lock to gather the threads/children stats\r\n\r\nlock_task_sighand() can trigger a hard lockup.  If NR_CPUS threads call\ndo_task_stat() at the same time and the process has NR_THREADS, it will\nspin with irqs disabled O(NR_CPUS * NR_THREADS) time.\r\n\r\nChange do_task_stat() to use sig-\u0026gt;stats_lock to gather the statistics\noutside of -\u0026gt;siglock protected section, in the likely case this code will\nrun lockless.(CVE-2024-26686)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnilfs2: fix data corruption in dsync block recovery for small block sizes\r\n\r\nThe helper function nilfs_recovery_copy_block() of\nnilfs_recovery_dsync_blocks(), which recovers data from logs created by\ndata sync writes during a mount after an unclean shutdown, incorrectly\ncalculates the on-page offset when copying repair data to the file\u0026apos;s page\ncache.  In environments where the block size is smaller than the page\nsize, this flaw can cause data corruption and leak uninitialized memory\nbytes during the recovery process.\r\n\r\nFix these issues by correcting this byte offset calculation on the page.(CVE-2024-26697)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\niio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC\r\n\r\nRecently, we encounter kernel crash in function rm3100_common_probe\ncaused by out of bound access of array rm3100_samp_rates (because of\nunderlying hardware failures). Add boundary check to prevent out of\nbound access.(CVE-2024-26702)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nparisc: Fix random data corruption from exception handler\r\n\r\nThe current exception handler implementation, which assists when accessing\nuser space memory, may exhibit random data corruption if the compiler decides\nto use a different register than the specified register %r29 (defined in\nASM_EXCEPTIONTABLE_REG) for the error code. If the compiler choose another\nregister, the fault handler will nevertheless store -EFAULT into %r29 and thus\ntrash whatever this register is used for.\nLooking at the assembly I found that this happens sometimes in emulate_ldd().\r\n\r\nTo solve the issue, the easiest solution would be if it somehow is\npossible to tell the fault handler which register is used to hold the error\ncode. Using %0 or %1 in the inline assembly is not posssible as it will show\nup as e.g. %r29 (with the \u0026quot;%r\u0026quot; prefix), which the GNU assembler can not\nconvert to an integer.\r\n\r\nThis patch takes another, better and more flexible approach:\nWe extend the __ex_table (which is out of the execution path) by one 32-word.\nIn this word we tell the compiler to insert the assembler instruction\n\u0026quot;or %r0,%r0,%reg\u0026quot;, where %reg references the register which the compiler\nchoosed for the error return code.\nIn case of an access failure, the fault handler finds the __ex_table entry and\ncan examine the opcode. The used register is encoded in the lowest 5 bits, and\nthe fault handler can then store -EFAULT into this register.\r\n\r\nSince we extend the __ex_table to 3 words we can\u0026apos;t use the BUILDTIME_TABLE_SORT\nconfig option any longer.(CVE-2024-26706)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: hsr: remove WARN_ONCE() in send_hsr_supervision_frame()\r\n\r\nSyzkaller reported [1] hitting a warning after failing to allocate\nresources for skb in hsr_init_skb(). Since a WARN_ONCE() call will\nnot help much in this case, it might be prudent to switch to\nnetdev_warn_once(). At the very least it will suppress syzkaller\nreports such as [1].\r\n\r\nJust in case, use netdev_warn_once() in send_prp_supervision_frame()\nfor similar reasons.\r\n\r\n[1]\nHSR: Could not send supervision frame\nWARNING: CPU: 1 PID: 85 at net/hsr/hsr_device.c:294 send_hsr_supervision_frame+0x60a/0x810 net/hsr/hsr_device.c:294\nRIP: 0010:send_hsr_supervision_frame+0x60a/0x810 net/hsr/hsr_device.c:294\n...\nCall Trace:\n \u0026lt;IRQ\u0026gt;\n hsr_announce+0x114/0x370 net/hsr/hsr_device.c:382\n call_timer_fn+0x193/0x590 kernel/time/timer.c:1700\n expire_timers kernel/time/timer.c:1751 [inline]\n __run_timers+0x764/0xb20 kernel/time/timer.c:2022\n run_timer_softirq+0x58/0xd0 kernel/time/timer.c:2035\n __do_softirq+0x21a/0x8de kernel/softirq.c:553\n invoke_softirq kernel/softirq.c:427 [inline]\n __irq_exit_rcu kernel/softirq.c:632 [inline]\n irq_exit_rcu+0xb7/0x120 kernel/softirq.c:644\n sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1076\n \u0026lt;/IRQ\u0026gt;\n \u0026lt;TASK\u0026gt;\n asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649\n...\r\n\r\nThis issue is also found in older kernels (at least up to 5.10).(CVE-2024-26707)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\npowerpc/kasan: Fix addr error caused by page alignment\r\n\r\nIn kasan_init_region, when k_start is not page aligned, at the begin of\nfor loop, k_cur = k_start \u0026amp; PAGE_MASK is less than k_start, and then\n`va = block + k_cur - k_start` is less than block, the addr va is invalid,\nbecause the memory address space from va to block is not alloced by\nmemblock_alloc, which will not be reserved by memblock_reserve later, it\nwill be used by other places.\r\n\r\nAs a result, memory overwriting occurs.\r\n\r\nfor example:\nint __init __weak kasan_init_region(void *start, size_t size)\n{\n[...]\n\t/* if say block(dcd97000) k_start(feef7400) k_end(feeff3fe) */\n\tblock = memblock_alloc(k_end - k_start, PAGE_SIZE);\n\t[...]\n\tfor (k_cur = k_start \u0026amp; PAGE_MASK; k_cur \u0026lt; k_end; k_cur += PAGE_SIZE) {\n\t\t/* at the begin of for loop\n\t\t * block(dcd97000) va(dcd96c00) k_cur(feef7000) k_start(feef7400)\n\t\t * va(dcd96c00) is less than block(dcd97000), va is invalid\n\t\t */\n\t\tvoid *va = block + k_cur - k_start;\n\t\t[...]\n\t}\n[...]\n}\r\n\r\nTherefore, page alignment is performed on k_start before\nmemblock_alloc() to ensure the validity of the VA address.(CVE-2024-26712)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again\r\n\r\n(struct dirty_throttle_control *)-\u0026gt;thresh is an unsigned long, but is\npassed as the u32 divisor argument to div_u64().  On architectures where\nunsigned long is 64 bytes, the argument will be implicitly truncated.\r\n\r\nUse div64_u64() instead of div_u64() so that the value used in the \u0026quot;is\nthis a safe division\u0026quot; check is the same as the divisor.\r\n\r\nAlso, remove redundant cast of the numerator to u64, as that should happen\nimplicitly.\r\n\r\nThis would be difficult to exploit in memcg domain, given the ratio-based\narithmetic domain_drity_limits() uses, but is much easier in global\nwriteback domain with a BDI_CAP_STRICTLIMIT-backing device, using e.g. \nvm.dirty_bytes=(1\u0026lt;\u0026lt;32)*PAGE_SIZE so that dtc-\u0026gt;thresh == (1\u0026lt;\u0026lt;32)(CVE-2024-26720)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbtrfs: don\u0026apos;t drop extent_map for free space inode on write error\r\n\r\nWhile running the CI for an unrelated change I hit the following panic\nwith generic/648 on btrfs_holes_spacecache.\r\n\r\nassertion failed: block_start != EXTENT_MAP_HOLE, in fs/btrfs/extent_io.c:1385\n------------[ cut here ]------------\nkernel BUG at fs/btrfs/extent_io.c:1385!\ninvalid opcode: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 1 PID: 2695096 Comm: fsstress Kdump: loaded Tainted: G        W          6.8.0-rc2+ #1\nRIP: 0010:__extent_writepage_io.constprop.0+0x4c1/0x5c0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n extent_write_cache_pages+0x2ac/0x8f0\n extent_writepages+0x87/0x110\n do_writepages+0xd5/0x1f0\n filemap_fdatawrite_wbc+0x63/0x90\n __filemap_fdatawrite_range+0x5c/0x80\n btrfs_fdatawrite_range+0x1f/0x50\n btrfs_write_out_cache+0x507/0x560\n btrfs_write_dirty_block_groups+0x32a/0x420\n commit_cowonly_roots+0x21b/0x290\n btrfs_commit_transaction+0x813/0x1360\n btrfs_sync_file+0x51a/0x640\n __x64_sys_fdatasync+0x52/0x90\n do_syscall_64+0x9c/0x190\n entry_SYSCALL_64_after_hwframe+0x6e/0x76\r\n\r\nThis happens because we fail to write out the free space cache in one\ninstance, come back around and attempt to write it again.  However on\nthe second pass through we go to call btrfs_get_extent() on the inode to\nget the extent mapping.  Because this is a new block group, and with the\nfree space inode we always search the commit root to avoid deadlocking\nwith the tree, we find nothing and return a EXTENT_MAP_HOLE for the\nrequested range.\r\n\r\nThis happens because the first time we try to write the space cache out\nwe hit an error, and on an error we drop the extent mapping.  This is\nnormal for normal files, but the free space cache inode is special.  We\nalways expect the extent map to be correct.  Thus the second time\nthrough we end up with a bogus extent map.\r\n\r\nSince we\u0026apos;re deprecating this feature, the most straightforward way to\nfix this is to simply skip dropping the extent map range for this failed\nrange.\r\n\r\nI shortened the test by using error injection to stress the area to make\nit easier to reproduce.  With this patch in place we no longer panic\nwith my error injection test.(CVE-2024-26726)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\narp: Prevent overflow in arp_req_get().\r\n\r\nsyzkaller reported an overflown write in arp_req_get(). [0]\r\n\r\nWhen ioctl(SIOCGARP) is issued, arp_req_get() looks up an neighbour\nentry and copies neigh-\u0026gt;ha to struct arpreq.arp_ha.sa_data.\r\n\r\nThe arp_ha here is struct sockaddr, not struct sockaddr_storage, so\nthe sa_data buffer is just 14 bytes.\r\n\r\nIn the splat below, 2 bytes are overflown to the next int field,\narp_flags.  We initialise the field just after the memcpy(), so it\u0026apos;s\nnot a problem.\r\n\r\nHowever, when dev-\u0026gt;addr_len is greater than 22 (e.g. MAX_ADDR_LEN),\narp_netmask is overwritten, which could be set as htonl(0xFFFFFFFFUL)\nin arp_ioctl() before calling arp_req_get().\r\n\r\nTo avoid the overflow, let\u0026apos;s limit the max length of memcpy().\r\n\r\nNote that commit b5f0de6df6dc (\u0026quot;net: dev: Convert sa_data to flexible\narray in struct sockaddr\u0026quot;) just silenced syzkaller.\r\n\r\n[0]:\nmemcpy: detected field-spanning write (size 16) of single field \u0026quot;r-\u0026gt;arp_ha.sa_data\u0026quot; at net/ipv4/arp.c:1128 (size 14)\nWARNING: CPU: 0 PID: 144638 at net/ipv4/arp.c:1128 arp_req_get+0x411/0x4a0 net/ipv4/arp.c:1128\nModules linked in:\nCPU: 0 PID: 144638 Comm: syz-executor.4 Not tainted 6.1.74 #31\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-5 04/01/2014\nRIP: 0010:arp_req_get+0x411/0x4a0 net/ipv4/arp.c:1128\nCode: fd ff ff e8 41 42 de fb b9 0e 00 00 00 4c 89 fe 48 c7 c2 20 6d ab 87 48 c7 c7 80 6d ab 87 c6 05 25 af 72 04 01 e8 5f 8d ad fb \u0026lt;0f\u0026gt; 0b e9 6c fd ff ff e8 13 42 de fb be 03 00 00 00 4c 89 e7 e8 a6\nRSP: 0018:ffffc900050b7998 EFLAGS: 00010286\nRAX: 0000000000000000 RBX: ffff88803a815000 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: ffffffff8641a44a RDI: 0000000000000001\nRBP: ffffc900050b7a98 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000000 R11: 203a7970636d656d R12: ffff888039c54000\nR13: 1ffff92000a16f37 R14: ffff88803a815084 R15: 0000000000000010\nFS:  00007f172bf306c0(0000) GS:ffff88805aa00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f172b3569f0 CR3: 0000000057f12005 CR4: 0000000000770ef0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n \u0026lt;TASK\u0026gt;\n arp_ioctl+0x33f/0x4b0 net/ipv4/arp.c:1261\n inet_ioctl+0x314/0x3a0 net/ipv4/af_inet.c:981\n sock_do_ioctl+0xdf/0x260 net/socket.c:1204\n sock_ioctl+0x3ef/0x650 net/socket.c:1321\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:870 [inline]\n __se_sys_ioctl fs/ioctl.c:856 [inline]\n __x64_sys_ioctl+0x18e/0x220 fs/ioctl.c:856\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x37/0x90 arch/x86/entry/common.c:81\n entry_SYSCALL_64_after_hwframe+0x64/0xce\nRIP: 0033:0x7f172b262b8d\nCode: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f172bf300b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 00007f172b3abf80 RCX: 00007f172b262b8d\nRDX: 0000000020000000 RSI: 0000000000008954 RDI: 0000000000000003\nRBP: 00007f172b2d3493 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 000000000000000b R14: 00007f172b3abf80 R15: 00007f172bf10000\n \u0026lt;/TASK\u0026gt;(CVE-2024-26733)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndevlink: fix possible use-after-free and memory leaks in devlink_init()\r\n\r\nThe pernet operations structure for the subsystem must be registered\nbefore registering the generic netlink family.\r\n\r\nMake an unregister in case of unsuccessful registration.(CVE-2024-26734)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nipv6: sr: fix possible use-after-free and null-ptr-deref\r\n\r\nThe pernet operations structure for the subsystem must be registered\nbefore registering the generic netlink family.(CVE-2024-26735)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/sched: act_mirred: use the backlog for mirred ingress\r\n\r\nThe test Davide added in commit ca22da2fbd69 (\u0026quot;act_mirred: use the backlog\nfor nested calls to mirred ingress\u0026quot;) hangs our testing VMs every 10 or so\nruns, with the familiar tcp_v4_rcv -\u0026gt; tcp_v4_rcv deadlock reported by\nlockdep.\r\n\r\nThe problem as previously described by Davide (see Link) is that\nif we reverse flow of traffic with the redirect (egress -\u0026gt; ingress)\nwe may reach the same socket which generated the packet. And we may\nstill be holding its socket lock. The common solution to such deadlocks\nis to put the packet in the Rx backlog, rather than run the Rx path\ninline. Do that for all egress -\u0026gt; ingress reversals, not just once\nwe started to nest mirred calls.\r\n\r\nIn the past there was a concern that the backlog indirection will\nlead to loss of error reporting / less accurate stats. But the current\nworkaround does not seem to address the issue.(CVE-2024-26740)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nRDMA/qedr: Fix qedr_create_user_qp error flow\r\n\r\nAvoid the following warning by making sure to free the allocated\nresources in case that qedr_init_user_queue() fail.\r\n\r\n-----------[ cut here ]-----------\nWARNING: CPU: 0 PID: 143192 at drivers/infiniband/core/rdma_core.c:874 uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]\nModules linked in: tls target_core_user uio target_core_pscsi target_core_file target_core_iblock ib_srpt ib_srp scsi_transport_srp nfsd nfs_acl rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs 8021q garp mrp stp llc ext4 mbcache jbd2 opa_vnic ib_umad ib_ipoib sunrpc rdma_ucm ib_isert iscsi_target_mod target_core_mod ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm hfi1 intel_rapl_msr intel_rapl_common mgag200 qedr sb_edac drm_shmem_helper rdmavt x86_pkg_temp_thermal drm_kms_helper intel_powerclamp ib_uverbs coretemp i2c_algo_bit kvm_intel dell_wmi_descriptor ipmi_ssif sparse_keymap kvm ib_core rfkill syscopyarea sysfillrect video sysimgblt irqbypass ipmi_si ipmi_devintf fb_sys_fops rapl iTCO_wdt mxm_wmi iTCO_vendor_support intel_cstate pcspkr dcdbas intel_uncore ipmi_msghandler lpc_ich acpi_power_meter mei_me mei fuse drm xfs libcrc32c qede sd_mod ahci libahci t10_pi sg crct10dif_pclmul crc32_pclmul crc32c_intel qed libata tg3\nghash_clmulni_intel megaraid_sas crc8 wmi [last unloaded: ib_srpt]\nCPU: 0 PID: 143192 Comm: fi_rdm_tagged_p Kdump: loaded Not tainted 5.14.0-408.el9.x86_64 #1\nHardware name: Dell Inc. PowerEdge R430/03XKDV, BIOS 2.14.0 01/25/2022\nRIP: 0010:uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]\nCode: 5d 41 5c 41 5d 41 5e e9 0f 26 1b dd 48 89 df e8 67 6a ff ff 49 8b 86 10 01 00 00 48 85 c0 74 9c 4c 89 e7 e8 83 c0 cb dd eb 92 \u0026lt;0f\u0026gt; 0b eb be 0f 0b be 04 00 00 00 48 89 df e8 8e f5 ff ff e9 6d ff\nRSP: 0018:ffffb7c6cadfbc60 EFLAGS: 00010286\nRAX: ffff8f0889ee3f60 RBX: ffff8f088c1a5200 RCX: 00000000802a0016\nRDX: 00000000802a0017 RSI: 0000000000000001 RDI: ffff8f0880042600\nRBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000\nR10: ffff8f11fffd5000 R11: 0000000000039000 R12: ffff8f0d5b36cd80\nR13: ffff8f088c1a5250 R14: ffff8f1206d91000 R15: 0000000000000000\nFS: 0000000000000000(0000) GS:ffff8f11d7c00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000147069200e20 CR3: 00000001c7210002 CR4: 00000000001706f0\nCall Trace:\n\u0026lt;TASK\u0026gt;\n? show_trace_log_lvl+0x1c4/0x2df\n? show_trace_log_lvl+0x1c4/0x2df\n? ib_uverbs_close+0x1f/0xb0 [ib_uverbs]\n? uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]\n? __warn+0x81/0x110\n? uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]\n? report_bug+0x10a/0x140\n? handle_bug+0x3c/0x70\n? exc_invalid_op+0x14/0x70\n? asm_exc_invalid_op+0x16/0x20\n? uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]\nib_uverbs_close+0x1f/0xb0 [ib_uverbs]\n__fput+0x94/0x250\ntask_work_run+0x5c/0x90\ndo_exit+0x270/0x4a0\ndo_group_exit+0x2d/0x90\nget_signal+0x87c/0x8c0\narch_do_signal_or_restart+0x25/0x100\n? ib_uverbs_ioctl+0xc2/0x110 [ib_uverbs]\nexit_to_user_mode_loop+0x9c/0x130\nexit_to_user_mode_prepare+0xb6/0x100\nsyscall_exit_to_user_mode+0x12/0x40\ndo_syscall_64+0x69/0x90\n? syscall_exit_work+0x103/0x130\n? syscall_exit_to_user_mode+0x22/0x40\n? do_syscall_64+0x69/0x90\n? syscall_exit_work+0x103/0x130\n? syscall_exit_to_user_mode+0x22/0x40\n? do_syscall_64+0x69/0x90\n? do_syscall_64+0x69/0x90\n? common_interrupt+0x43/0xa0\nentry_SYSCALL_64_after_hwframe+0x72/0xdc\nRIP: 0033:0x1470abe3ec6b\nCode: Unable to access opcode bytes at RIP 0x1470abe3ec41.\nRSP: 002b:00007fff13ce9108 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: fffffffffffffffc RBX: 00007fff13ce9218 RCX: 00001470abe3ec6b\nRDX: 00007fff13ce9200 RSI: 00000000c0181b01 RDI: 0000000000000004\nRBP: 00007fff13ce91e0 R08: 0000558d9655da10 R09: 0000558d9655dd00\nR10: 00007fff13ce95c0 R11: 0000000000000246 R12: 00007fff13ce9358\nR13: 0000000000000013 R14: 0000558d9655db50 R15: 00007fff13ce9470\n\u0026lt;/TASK\u0026gt;\n--[ end trace 888a9b92e04c5c97 ]--(CVE-2024-26743)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nRDMA/srpt: Support specifying the srpt_service_guid parameter\r\n\r\nMake loading ib_srpt with this parameter set work. The current behavior is\nthat setting that parameter while loading the ib_srpt kernel module\ntriggers the following kernel crash:\r\n\r\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nCall Trace:\n \u0026lt;TASK\u0026gt;\n parse_one+0x18c/0x1d0\n parse_args+0xe1/0x230\n load_module+0x8de/0xa60\n init_module_from_file+0x8b/0xd0\n idempotent_init_module+0x181/0x240\n __x64_sys_finit_module+0x5a/0xb0\n do_syscall_64+0x5f/0xe0\n entry_SYSCALL_64_after_hwframe+0x6e/0x76(CVE-2024-26744)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ngtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()\r\n\r\nThe gtp_net_ops pernet operations structure for the subsystem must be\nregistered before registering the generic netlink family.\r\n\r\nSyzkaller hit \u0026apos;general protection fault in gtp_genl_dump_pdp\u0026apos; bug:\r\n\r\ngeneral protection fault, probably for non-canonical address\n0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN NOPTI\nKASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\nCPU: 1 PID: 5826 Comm: gtp Not tainted 6.8.0-rc3-std-def-alt1 #1\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-alt1 04/01/2014\nRIP: 0010:gtp_genl_dump_pdp+0x1be/0x800 [gtp]\nCode: c6 89 c6 e8 64 e9 86 df 58 45 85 f6 0f 85 4e 04 00 00 e8 c5 ee 86\n      df 48 8b 54 24 18 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 \u0026lt;80\u0026gt;\n      3c 02 00 0f 85 de 05 00 00 48 8b 44 24 18 4c 8b 30 4c 39 f0 74\nRSP: 0018:ffff888014107220 EFLAGS: 00010202\nRAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000\nRDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000\nRBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000\nR13: ffff88800fcda588 R14: 0000000000000001 R15: 0000000000000000\nFS:  00007f1be4eb05c0(0000) GS:ffff88806ce80000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f1be4e766cf CR3: 000000000c33e000 CR4: 0000000000750ef0\nPKRU: 55555554\nCall Trace:\n \u0026lt;TASK\u0026gt;\n ? show_regs+0x90/0xa0\n ? die_addr+0x50/0xd0\n ? exc_general_protection+0x148/0x220\n ? asm_exc_general_protection+0x22/0x30\n ? gtp_genl_dump_pdp+0x1be/0x800 [gtp]\n ? __alloc_skb+0x1dd/0x350\n ? __pfx___alloc_skb+0x10/0x10\n genl_dumpit+0x11d/0x230\n netlink_dump+0x5b9/0xce0\n ? lockdep_hardirqs_on_prepare+0x253/0x430\n ? __pfx_netlink_dump+0x10/0x10\n ? kasan_save_track+0x10/0x40\n ? __kasan_kmalloc+0x9b/0xa0\n ? genl_start+0x675/0x970\n __netlink_dump_start+0x6fc/0x9f0\n genl_family_rcv_msg_dumpit+0x1bb/0x2d0\n ? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10\n ? genl_op_from_small+0x2a/0x440\n ? cap_capable+0x1d0/0x240\n ? __pfx_genl_start+0x10/0x10\n ? __pfx_genl_dumpit+0x10/0x10\n ? __pfx_genl_done+0x10/0x10\n ? security_capable+0x9d/0xe0(CVE-2024-26754)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndm-crypt: don\u0026apos;t modify the data when using authenticated encryption\r\n\r\nIt was said that authenticated encryption could produce invalid tag when\nthe data that is being encrypted is modified [1]. So, fix this problem by\ncopying the data into the clone bio first and then encrypt them inside the\nclone bio.\r\n\r\nThis may reduce performance, but it is needed to prevent the user from\ncorrupting the device by writing data with O_DIRECT and modifying them at\nthe same time.\r\n\r\n[1] https://lore.kernel.org/all/20240207004723.GA35324@sol.localdomain/T/(CVE-2024-26763)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nspi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected\r\n\r\nReturn IRQ_NONE from the interrupt handler when no interrupt was\ndetected. Because an empty interrupt will cause a null pointer error:\r\n\r\n    Unable to handle kernel NULL pointer dereference at virtual\n  address 0000000000000008\n    Call trace:\n        complete+0x54/0x100\n        hisi_sfc_v3xx_isr+0x2c/0x40 [spi_hisi_sfc_v3xx]\n        __handle_irq_event_percpu+0x64/0x1e0\n        handle_irq_event+0x7c/0x1cc(CVE-2024-26776)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmptcp: fix double-free on socket dismantle\r\n\r\nwhen MPTCP server accepts an incoming connection, it clones its listener\nsocket. However, the pointer to \u0026apos;inet_opt\u0026apos; for the new socket has the same\nvalue as the original one: as a consequence, on program exit it\u0026apos;s possible\nto observe the following splat:\r\n\r\n  BUG: KASAN: double-free in inet_sock_destruct+0x54f/0x8b0\n  Free of addr ffff888485950880 by task swapper/25/0\r\n\r\n  CPU: 25 PID: 0 Comm: swapper/25 Kdump: loaded Not tainted 6.8.0-rc1+ #609\n  Hardware name: Supermicro SYS-6027R-72RF/X9DRH-7TF/7F/iTF/iF, BIOS 3.0  07/26/2013\n  Call Trace:\n   \u0026lt;IRQ\u0026gt;\n   dump_stack_lvl+0x32/0x50\n   print_report+0xca/0x620\n   kasan_report_invalid_free+0x64/0x90\n   __kasan_slab_free+0x1aa/0x1f0\n   kfree+0xed/0x2e0\n   inet_sock_destruct+0x54f/0x8b0\n   __sk_destruct+0x48/0x5b0\n   rcu_do_batch+0x34e/0xd90\n   rcu_core+0x559/0xac0\n   __do_softirq+0x183/0x5a4\n   irq_exit_rcu+0x12d/0x170\n   sysvec_apic_timer_interrupt+0x6b/0x80\n   \u0026lt;/IRQ\u0026gt;\n   \u0026lt;TASK\u0026gt;\n   asm_sysvec_apic_timer_interrupt+0x16/0x20\n  RIP: 0010:cpuidle_enter_state+0x175/0x300\n  Code: 30 00 0f 84 1f 01 00 00 83 e8 01 83 f8 ff 75 e5 48 83 c4 18 44 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc fb 45 85 ed \u0026lt;0f\u0026gt; 89 60 ff ff ff 48 c1 e5 06 48 c7 43 18 00 00 00 00 48 83 44 2b\n  RSP: 0018:ffff888481cf7d90 EFLAGS: 00000202\n  RAX: 0000000000000000 RBX: ffff88887facddc8 RCX: 0000000000000000\n  RDX: 1ffff1110ff588b1 RSI: 0000000000000019 RDI: ffff88887fac4588\n  RBP: 0000000000000004 R08: 0000000000000002 R09: 0000000000043080\n  R10: 0009b02ea273363f R11: ffff88887fabf42b R12: ffffffff932592e0\n  R13: 0000000000000004 R14: 0000000000000000 R15: 00000022c880ec80\n   cpuidle_enter+0x4a/0xa0\n   do_idle+0x310/0x410\n   cpu_startup_entry+0x51/0x60\n   start_secondary+0x211/0x270\n   secondary_startup_64_no_verify+0x184/0x18b\n   \u0026lt;/TASK\u0026gt;\r\n\r\n  Allocated by task 6853:\n   kasan_save_stack+0x1c/0x40\n   kasan_save_track+0x10/0x30\n   __kasan_kmalloc+0xa6/0xb0\n   __kmalloc+0x1eb/0x450\n   cipso_v4_sock_setattr+0x96/0x360\n   netlbl_sock_setattr+0x132/0x1f0\n   selinux_netlbl_socket_post_create+0x6c/0x110\n   selinux_socket_post_create+0x37b/0x7f0\n   security_socket_post_create+0x63/0xb0\n   __sock_create+0x305/0x450\n   __sys_socket_create.part.23+0xbd/0x130\n   __sys_socket+0x37/0xb0\n   __x64_sys_socket+0x6f/0xb0\n   do_syscall_64+0x83/0x160\n   entry_SYSCALL_64_after_hwframe+0x6e/0x76\r\n\r\n  Freed by task 6858:\n   kasan_save_stack+0x1c/0x40\n   kasan_save_track+0x10/0x30\n   kasan_save_free_info+0x3b/0x60\n   __kasan_slab_free+0x12c/0x1f0\n   kfree+0xed/0x2e0\n   inet_sock_destruct+0x54f/0x8b0\n   __sk_destruct+0x48/0x5b0\n   subflow_ulp_release+0x1f0/0x250\n   tcp_cleanup_ulp+0x6e/0x110\n   tcp_v4_destroy_sock+0x5a/0x3a0\n   inet_csk_destroy_sock+0x135/0x390\n   tcp_fin+0x416/0x5c0\n   tcp_data_queue+0x1bc8/0x4310\n   tcp_rcv_state_process+0x15a3/0x47b0\n   tcp_v4_do_rcv+0x2c1/0x990\n   tcp_v4_rcv+0x41fb/0x5ed0\n   ip_protocol_deliver_rcu+0x6d/0x9f0\n   ip_local_deliver_finish+0x278/0x360\n   ip_local_deliver+0x182/0x2c0\n   ip_rcv+0xb5/0x1c0\n   __netif_receive_skb_one_core+0x16e/0x1b0\n   process_backlog+0x1e3/0x650\n   __napi_poll+0xa6/0x500\n   net_rx_action+0x740/0xbb0\n   __do_softirq+0x183/0x5a4\r\n\r\n  The buggy address belongs to the object at ffff888485950880\n   which belongs to the cache kmalloc-64 of size 64\n  The buggy address is located 0 bytes inside of\n   64-byte region [ffff888485950880, ffff8884859508c0)\r\n\r\n  The buggy address belongs to the physical page:\n  page:0000000056d1e95e refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888485950700 pfn:0x485950\n  flags: 0x57ffffc0000800(slab|node=1|zone=2|lastcpupid=0x1fffff)\n  page_type: 0xffffffff()\n  raw: 0057ffffc0000800 ffff88810004c640 ffffea00121b8ac0 dead000000000006\n  raw: ffff888485950700 0000000000200019 00000001ffffffff 0000000000000000\n  page dumped because: kasan: bad access detected\r\n\r\n  Memory state around the buggy address:\n   ffff888485950780: fa fb fb\n---truncated---(CVE-2024-26782)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetlink: Fix kernel-infoleak-after-free in __skb_datagram_iter\r\n\r\nsyzbot reported the following uninit-value access issue [1]:\r\n\r\nnetlink_to_full_skb() creates a new `skb` and puts the `skb-\u0026gt;data`\npassed as a 1st arg of netlink_to_full_skb() onto new `skb`. The data\nsize is specified as `len` and passed to skb_put_data(). This `len`\nis based on `skb-\u0026gt;end` that is not data offset but buffer offset. The\n`skb-\u0026gt;end` contains data and tailroom. Since the tailroom is not\ninitialized when the new `skb` created, KMSAN detects uninitialized\nmemory area when copying the data.\r\n\r\nThis patch resolved this issue by correct the len from `skb-\u0026gt;end` to\n`skb-\u0026gt;len`, which is the actual data offset.\r\n\r\nBUG: KMSAN: kernel-infoleak-after-free in instrument_copy_to_user include/linux/instrumented.h:114 [inline]\nBUG: KMSAN: kernel-infoleak-after-free in copy_to_user_iter lib/iov_iter.c:24 [inline]\nBUG: KMSAN: kernel-infoleak-after-free in iterate_ubuf include/linux/iov_iter.h:29 [inline]\nBUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance2 include/linux/iov_iter.h:245 [inline]\nBUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance include/linux/iov_iter.h:271 [inline]\nBUG: KMSAN: kernel-infoleak-after-free in _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186\n instrument_copy_to_user include/linux/instrumented.h:114 [inline]\n copy_to_user_iter lib/iov_iter.c:24 [inline]\n iterate_ubuf include/linux/iov_iter.h:29 [inline]\n iterate_and_advance2 include/linux/iov_iter.h:245 [inline]\n iterate_and_advance include/linux/iov_iter.h:271 [inline]\n _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186\n copy_to_iter include/linux/uio.h:197 [inline]\n simple_copy_to_iter+0x68/0xa0 net/core/datagram.c:532\n __skb_datagram_iter+0x123/0xdc0 net/core/datagram.c:420\n skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:546\n skb_copy_datagram_msg include/linux/skbuff.h:3960 [inline]\n packet_recvmsg+0xd9c/0x2000 net/packet/af_packet.c:3482\n sock_recvmsg_nosec net/socket.c:1044 [inline]\n sock_recvmsg net/socket.c:1066 [inline]\n sock_read_iter+0x467/0x580 net/socket.c:1136\n call_read_iter include/linux/fs.h:2014 [inline]\n new_sync_read fs/read_write.c:389 [inline]\n vfs_read+0x8f6/0xe00 fs/read_write.c:470\n ksys_read+0x20f/0x4c0 fs/read_write.c:613\n __do_sys_read fs/read_write.c:623 [inline]\n __se_sys_read fs/read_write.c:621 [inline]\n __x64_sys_read+0x93/0xd0 fs/read_write.c:621\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nUninit was stored to memory at:\n skb_put_data include/linux/skbuff.h:2622 [inline]\n netlink_to_full_skb net/netlink/af_netlink.c:181 [inline]\n __netlink_deliver_tap_skb net/netlink/af_netlink.c:298 [inline]\n __netlink_deliver_tap+0x5be/0xc90 net/netlink/af_netlink.c:325\n netlink_deliver_tap net/netlink/af_netlink.c:338 [inline]\n netlink_deliver_tap_kernel net/netlink/af_netlink.c:347 [inline]\n netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]\n netlink_unicast+0x10f1/0x1250 net/netlink/af_netlink.c:1368\n netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg net/socket.c:745 [inline]\n ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584\n ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638\n __sys_sendmsg net/socket.c:2667 [inline]\n __do_sys_sendmsg net/socket.c:2676 [inline]\n __se_sys_sendmsg net/socket.c:2674 [inline]\n __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nUninit was created at:\n free_pages_prepare mm/page_alloc.c:1087 [inline]\n free_unref_page_prepare+0xb0/0xa40 mm/page_alloc.c:2347\n free_unref_page_list+0xeb/0x1100 mm/page_alloc.c:2533\n release_pages+0x23d3/0x2410 mm/swap.c:1042\n free_pages_and_swap_cache+0xd9/0xf0 mm/swap_state.c:316\n tlb_batch_pages\n---truncated---(CVE-2024-26805)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain\r\n\r\nRemove netdevice from inet/ingress basechain in case NETDEV_UNREGISTER\nevent is reported, otherwise a stale reference to netdevice remains in\nthe hook list.(CVE-2024-26808)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nft_set_pipapo: release elements in clone only from destroy path\r\n\r\nClone already always provides a current view of the lookup table, use it\nto destroy the set, otherwise it is possible to destroy elements twice.\r\n\r\nThis fix requires:\r\n\r\n 212ed75dc5fb (\u0026quot;netfilter: nf_tables: integrate pipapo into commit protocol\u0026quot;)\r\n\r\nwhich came after:\r\n\r\n 9827a0e6e23b (\u0026quot;netfilter: nft_set_pipapo: release elements in clone from abort path\u0026quot;).(CVE-2024-26809)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nf_conntrack_h323: Add protection for bmp length out of range\r\n\r\nUBSAN load reports an exception of BRK#5515 SHIFT_ISSUE:Bitwise shifts\nthat are out of bounds for their data type.\r\n\r\nvmlinux   get_bitmap(b=75) + 712\n\u0026lt;net/netfilter/nf_conntrack_h323_asn1.c:0\u0026gt;\nvmlinux   decode_seq(bs=0xFFFFFFD008037000, f=0xFFFFFFD008037018, level=134443100) + 1956\n\u0026lt;net/netfilter/nf_conntrack_h323_asn1.c:592\u0026gt;\nvmlinux   decode_choice(base=0xFFFFFFD0080370F0, level=23843636) + 1216\n\u0026lt;net/netfilter/nf_conntrack_h323_asn1.c:814\u0026gt;\nvmlinux   decode_seq(f=0xFFFFFFD0080371A8, level=134443500) + 812\n\u0026lt;net/netfilter/nf_conntrack_h323_asn1.c:576\u0026gt;\nvmlinux   decode_choice(base=0xFFFFFFD008037280, level=0) + 1216\n\u0026lt;net/netfilter/nf_conntrack_h323_asn1.c:814\u0026gt;\nvmlinux   DecodeRasMessage() + 304\n\u0026lt;net/netfilter/nf_conntrack_h323_asn1.c:833\u0026gt;\nvmlinux   ras_help() + 684\n\u0026lt;net/netfilter/nf_conntrack_h323_main.c:1728\u0026gt;\nvmlinux   nf_confirm() + 188\n\u0026lt;net/netfilter/nf_conntrack_proto.c:137\u0026gt;\r\n\r\nDue to abnormal data in skb-\u0026gt;data, the extension bitmap length\nexceeds 32 when decoding ras message then uses the length to make\na shift operation. It will change into negative after several loop.\nUBSAN load could detect a negative shift as an undefined behaviour\nand reports exception.\nSo we add the protection to avoid the length exceeding 32. Or else\nit will return out of range error and stop decoding.(CVE-2024-26851)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmd: fix kmemleak of rdev-\u0026gt;serial\r\n\r\nIf kobject_add() is fail in bind_rdev_to_array(), \u0026apos;rdev-\u0026gt;serial\u0026apos; will be\nalloc not be freed, and kmemleak occurs.\r\n\r\nunreferenced object 0xffff88815a350000 (size 49152):\n  comm \u0026quot;mdadm\u0026quot;, pid 789, jiffies 4294716910\n  hex dump (first 32 bytes):\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace (crc f773277a):\n    [\u0026lt;0000000058b0a453\u0026gt;] kmemleak_alloc+0x61/0xe0\n    [\u0026lt;00000000366adf14\u0026gt;] __kmalloc_large_node+0x15e/0x270\n    [\u0026lt;000000002e82961b\u0026gt;] __kmalloc_node.cold+0x11/0x7f\n    [\u0026lt;00000000f206d60a\u0026gt;] kvmalloc_node+0x74/0x150\n    [\u0026lt;0000000034bf3363\u0026gt;] rdev_init_serial+0x67/0x170\n    [\u0026lt;0000000010e08fe9\u0026gt;] mddev_create_serial_pool+0x62/0x220\n    [\u0026lt;00000000c3837bf0\u0026gt;] bind_rdev_to_array+0x2af/0x630\n    [\u0026lt;0000000073c28560\u0026gt;] md_add_new_disk+0x400/0x9f0\n    [\u0026lt;00000000770e30ff\u0026gt;] md_ioctl+0x15bf/0x1c10\n    [\u0026lt;000000006cfab718\u0026gt;] blkdev_ioctl+0x191/0x3f0\n    [\u0026lt;0000000085086a11\u0026gt;] vfs_ioctl+0x22/0x60\n    [\u0026lt;0000000018b656fe\u0026gt;] __x64_sys_ioctl+0xba/0xe0\n    [\u0026lt;00000000e54e675e\u0026gt;] do_syscall_64+0x71/0x150\n    [\u0026lt;000000008b0ad622\u0026gt;] entry_SYSCALL_64_after_hwframe+0x6c/0x74(CVE-2024-26900)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndo_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak\r\n\r\nsyzbot identified a kernel information leak vulnerability in\ndo_sys_name_to_handle() and issued the following report [1].\r\n\r\n[1]\n\u0026quot;BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]\nBUG: KMSAN: kernel-infoleak in _copy_to_user+0xbc/0x100 lib/usercopy.c:40\n instrument_copy_to_user include/linux/instrumented.h:114 [inline]\n _copy_to_user+0xbc/0x100 lib/usercopy.c:40\n copy_to_user include/linux/uaccess.h:191 [inline]\n do_sys_name_to_handle fs/fhandle.c:73 [inline]\n __do_sys_name_to_handle_at fs/fhandle.c:112 [inline]\n __se_sys_name_to_handle_at+0x949/0xb10 fs/fhandle.c:94\n __x64_sys_name_to_handle_at+0xe4/0x140 fs/fhandle.c:94\n ...\r\n\r\nUninit was created at:\n slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768\n slab_alloc_node mm/slub.c:3478 [inline]\n __kmem_cache_alloc_node+0x5c9/0x970 mm/slub.c:3517\n __do_kmalloc_node mm/slab_common.c:1006 [inline]\n __kmalloc+0x121/0x3c0 mm/slab_common.c:1020\n kmalloc include/linux/slab.h:604 [inline]\n do_sys_name_to_handle fs/fhandle.c:39 [inline]\n __do_sys_name_to_handle_at fs/fhandle.c:112 [inline]\n __se_sys_name_to_handle_at+0x441/0xb10 fs/fhandle.c:94\n __x64_sys_name_to_handle_at+0xe4/0x140 fs/fhandle.c:94\n ...\r\n\r\nBytes 18-19 of 20 are uninitialized\nMemory access of size 20 starts at ffff888128a46380\nData copied to user address 0000000020000240\u0026quot;\r\n\r\nPer Chuck Lever\u0026apos;s suggestion, use kzalloc() instead of kmalloc() to\nsolve the problem.(CVE-2024-26901)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nBluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security\r\n\r\nDuring our fuzz testing of the connection and disconnection process at the\nRFCOMM layer, we discovered this bug. By comparing the packets from a\nnormal connection and disconnection process with the testcase that\ntriggered a KASAN report. We analyzed the cause of this bug as follows:\r\n\r\n1. In the packets captured during a normal connection, the host sends a\n`Read Encryption Key Size` type of `HCI_CMD` packet\n(Command Opcode: 0x1408) to the controller to inquire the length of\nencryption key.After receiving this packet, the controller immediately\nreplies with a Command Completepacket (Event Code: 0x0e) to return the\nEncryption Key Size.\r\n\r\n2. In our fuzz test case, the timing of the controller\u0026apos;s response to this\npacket was delayed to an unexpected point: after the RFCOMM and L2CAP\nlayers had disconnected but before the HCI layer had disconnected.\r\n\r\n3. After receiving the Encryption Key Size Response at the time described\nin point 2, the host still called the rfcomm_check_security function.\nHowever, by this time `struct l2cap_conn *conn = l2cap_pi(sk)-\u0026gt;chan-\u0026gt;conn;`\nhad already been released, and when the function executed\n`return hci_conn_security(conn-\u0026gt;hcon, d-\u0026gt;sec_level, auth_type, d-\u0026gt;out);`,\nspecifically when accessing `conn-\u0026gt;hcon`, a null-ptr-deref error occurred.\r\n\r\nTo fix this bug, check if `sk-\u0026gt;sk_state` is BT_CLOSED before calling\nrfcomm_recv_frame in rfcomm_process_rx.(CVE-2024-26903)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nRDMA/mlx5: Fix fortify source warning while accessing Eth segment\r\n\r\n ------------[ cut here ]------------\n memcpy: detected field-spanning write (size 56) of single field \u0026quot;eseg-\u0026gt;inline_hdr.start\u0026quot; at /var/lib/dkms/mlnx-ofed-kernel/5.8/build/drivers/infiniband/hw/mlx5/wr.c:131 (size 2)\n WARNING: CPU: 0 PID: 293779 at /var/lib/dkms/mlnx-ofed-kernel/5.8/build/drivers/infiniband/hw/mlx5/wr.c:131 mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib]\n Modules linked in: 8021q garp mrp stp llc rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) ib_uverbs(OE) ib_core(OE) mlx5_core(OE) pci_hyperv_intf mlxdevm(OE) mlx_compat(OE) tls mlxfw(OE) psample nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink mst_pciconf(OE) knem(OE) vfio_pci vfio_pci_core vfio_iommu_type1 vfio iommufd irqbypass cuse nfsv3 nfs fscache netfs xfrm_user xfrm_algo ipmi_devintf ipmi_msghandler binfmt_misc crct10dif_pclmul crc32_pclmul polyval_clmulni polyval_generic ghash_clmulni_intel sha512_ssse3 snd_pcsp aesni_intel crypto_simd cryptd snd_pcm snd_timer joydev snd soundcore input_leds serio_raw evbug nfsd auth_rpcgss nfs_acl lockd grace sch_fq_codel sunrpc drm efi_pstore ip_tables x_tables autofs4 psmouse virtio_net net_failover failover floppy\n  [last unloaded: mlx_compat(OE)]\n CPU: 0 PID: 293779 Comm: ssh Tainted: G           OE      6.2.0-32-generic #32~22.04.1-Ubuntu\n Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011\n RIP: 0010:mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib]\n Code: 0c 01 00 a8 01 75 25 48 8b 75 a0 b9 02 00 00 00 48 c7 c2 10 5b fd c0 48 c7 c7 80 5b fd c0 c6 05 57 0c 03 00 01 e8 95 4d 93 da \u0026lt;0f\u0026gt; 0b 44 8b 4d b0 4c 8b 45 c8 48 8b 4d c0 e9 49 fb ff ff 41 0f b7\n RSP: 0018:ffffb5b48478b570 EFLAGS: 00010046\n RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000\n RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n RBP: ffffb5b48478b628 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000000 R12: ffffb5b48478b5e8\n R13: ffff963a3c609b5e R14: ffff9639c3fbd800 R15: ffffb5b480475a80\n FS:  00007fc03b444c80(0000) GS:ffff963a3dc00000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000556f46bdf000 CR3: 0000000006ac6003 CR4: 00000000003706f0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  ? show_regs+0x72/0x90\n  ? mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib]\n  ? __warn+0x8d/0x160\n  ? mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib]\n  ? report_bug+0x1bb/0x1d0\n  ? handle_bug+0x46/0x90\n  ? exc_invalid_op+0x19/0x80\n  ? asm_exc_invalid_op+0x1b/0x20\n  ? mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib]\n  mlx5_ib_post_send_nodrain+0xb/0x20 [mlx5_ib]\n  ipoib_send+0x2ec/0x770 [ib_ipoib]\n  ipoib_start_xmit+0x5a0/0x770 [ib_ipoib]\n  dev_hard_start_xmit+0x8e/0x1e0\n  ? validate_xmit_skb_list+0x4d/0x80\n  sch_direct_xmit+0x116/0x3a0\n  __dev_xmit_skb+0x1fd/0x580\n  __dev_queue_xmit+0x284/0x6b0\n  ? _raw_spin_unlock_irq+0xe/0x50\n  ? __flush_work.isra.0+0x20d/0x370\n  ? push_pseudo_header+0x17/0x40 [ib_ipoib]\n  neigh_connected_output+0xcd/0x110\n  ip_finish_output2+0x179/0x480\n  ? __smp_call_single_queue+0x61/0xa0\n  __ip_finish_output+0xc3/0x190\n  ip_finish_output+0x2e/0xf0\n  ip_output+0x78/0x110\n  ? __pfx_ip_finish_output+0x10/0x10\n  ip_local_out+0x64/0x70\n  __ip_queue_xmit+0x18a/0x460\n  ip_queue_xmit+0x15/0x30\n  __tcp_transmit_skb+0x914/0x9c0\n  tcp_write_xmit+0x334/0x8d0\n  tcp_push_one+0x3c/0x60\n  tcp_sendmsg_locked+0x2e1/0xac0\n  tcp_sendmsg+0x2d/0x50\n  inet_sendmsg+0x43/0x90\n  sock_sendmsg+0x68/0x80\n  sock_write_iter+0x93/0x100\n  vfs_write+0x326/0x3c0\n  ksys_write+0xbd/0xf0\n  ? do_syscall_64+0x69/0x90\n  __x64_sys_write+0x19/0x30\n  do_syscall_\n---truncated---(CVE-2024-26907)\r\n\r\nRejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.(CVE-2024-26908)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: openvswitch: Fix Use-After-Free in ovs_ct_exit\r\n\r\nSince kfree_rcu, which is called in the hlist_for_each_entry_rcu traversal\nof ovs_ct_limit_exit, is not part of the RCU read critical section, it\nis possible that the RCU grace period will pass during the traversal and\nthe key will be free.\r\n\r\nTo prevent this, it should be changed to hlist_for_each_entry_safe.(CVE-2024-27395)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: gtp: Fix Use-After-Free in gtp_dellink\r\n\r\nSince call_rcu, which is called in the hlist_for_each_entry_rcu traversal\nof gtp_dellink, is not part of the RCU read critical section, it\nis possible that the RCU grace period will pass during the traversal and\nthe key will be free.\r\n\r\nTo prevent this, it should be changed to hlist_for_each_entry_safe.(CVE-2024-27396)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ncpumap: Zero-initialise xdp_rxq_info struct before running XDP program\r\n\r\nWhen running an XDP program that is attached to a cpumap entry, we don\u0026apos;t\ninitialise the xdp_rxq_info data structure being used in the xdp_buff\nthat backs the XDP program invocation. Tobias noticed that this leads to\nrandom values being returned as the xdp_md-\u0026gt;rx_queue_index value for XDP\nprograms running in a cpumap.\r\n\r\nThis means we\u0026apos;re basically returning the contents of the uninitialised\nmemory, which is bad. Fix this by zero-initialising the rxq data\nstructure before running the XDP program.(CVE-2024-27431)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: iwlwifi: dbg-tlv: ensure NUL termination\r\n\r\nThe iwl_fw_ini_debug_info_tlv is used as a string, so we must\nensure the string is terminated correctly before using it.(CVE-2024-35845)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbtrfs: fix information leak in btrfs_ioctl_logical_to_ino()\r\n\r\nSyzbot reported the following information leak for in\nbtrfs_ioctl_logical_to_ino():\r\n\r\n  BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]\n  BUG: KMSAN: kernel-infoleak in _copy_to_user+0xbc/0x110 lib/usercopy.c:40\n   instrument_copy_to_user include/linux/instrumented.h:114 [inline]\n   _copy_to_user+0xbc/0x110 lib/usercopy.c:40\n   copy_to_user include/linux/uaccess.h:191 [inline]\n   btrfs_ioctl_logical_to_ino+0x440/0x750 fs/btrfs/ioctl.c:3499\n   btrfs_ioctl+0x714/0x1260\n   vfs_ioctl fs/ioctl.c:51 [inline]\n   __do_sys_ioctl fs/ioctl.c:904 [inline]\n   __se_sys_ioctl+0x261/0x450 fs/ioctl.c:890\n   __x64_sys_ioctl+0x96/0xe0 fs/ioctl.c:890\n   x64_sys_call+0x1883/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:17\n   do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n   do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\r\n\r\n  Uninit was created at:\n   __kmalloc_large_node+0x231/0x370 mm/slub.c:3921\n   __do_kmalloc_node mm/slub.c:3954 [inline]\n   __kmalloc_node+0xb07/0x1060 mm/slub.c:3973\n   kmalloc_node include/linux/slab.h:648 [inline]\n   kvmalloc_node+0xc0/0x2d0 mm/util.c:634\n   kvmalloc include/linux/slab.h:766 [inline]\n   init_data_container+0x49/0x1e0 fs/btrfs/backref.c:2779\n   btrfs_ioctl_logical_to_ino+0x17c/0x750 fs/btrfs/ioctl.c:3480\n   btrfs_ioctl+0x714/0x1260\n   vfs_ioctl fs/ioctl.c:51 [inline]\n   __do_sys_ioctl fs/ioctl.c:904 [inline]\n   __se_sys_ioctl+0x261/0x450 fs/ioctl.c:890\n   __x64_sys_ioctl+0x96/0xe0 fs/ioctl.c:890\n   x64_sys_call+0x1883/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:17\n   do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n   do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\r\n\r\n  Bytes 40-65535 of 65536 are uninitialized\n  Memory access of size 65536 starts at ffff888045a40000\r\n\r\nThis happens, because we\u0026apos;re copying a \u0026apos;struct btrfs_data_container\u0026apos; back\nto user-space. This btrfs_data_container is allocated in\n\u0026apos;init_data_container()\u0026apos; via kvmalloc(), which does not zero-fill the\nmemory.\r\n\r\nFix this by using kvzalloc() which zeroes out the memory on allocation.(CVE-2024-35849)","status":"published","published":"2024-05-24T11:07:06Z","modified":"2026-08-18T01:17:24.567299943Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"UBUNTU-CVE-2024-26697","description":"In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix data corruption in dsync block recovery for small block sizes The helper function nilfs_recovery_copy_block() of nilfs_recovery_dsync_blocks(), which recovers data from logs created by data sync writes during a mount after an unclean shutdown, incorrectly calculates the on-page offset when copying repair data to the file's page cache.  In environments where the block size is smaller than the page size, this flaw can cause data corruption and leak uninitialized memory bytes during the recovery process. Fix these issues by correcting this byte offset calculation on the page.","status":"published","published":"2024-04-03T15:15:00Z","modified":"2026-11-11T09:38:13.135749605Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-11T09:59:48.481563Z"},{"id":"CLSA-2024-1716269479","title":"Fix of 42 CVEs","description":"   * CVE-url: https://ubuntu.com/security/CVE-2023-47233\n     - wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52601\n     - jfs: Fix memleak in dbAdjCtl\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26801\n     - Bluetooth: Avoid potential use-after-free in hci_error_reset\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26805\n     - netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52566\n     - nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26622\n     - tomoyo: fix UAF write bug in tomoyo_write_control()\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26614\n     - tcp: make sure init the accept_queue's spinlocks once\n     - ipv6: init the accept_queue's spinlocks in inet6_create\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52530\n     - wifi: mac80211: fix potential key use-after-free\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52524\n     - net: nfc: llcp: Add lock when modifying device list\n   * CVE-url: https://ubuntu.com/security/CVE-2021-47173\n     - misc/uss720: fix memory leak in uss720_probe\n   * Bionic update: upstream stable patchset 2021-07-14 (LP: #1936231) // CVE-\n     url: https://ubuntu.com/security/CVE-2021-47171\n     - net: usb: fix possible use-after-free in smsc75xx_bind\n   * Bionic update: upstream stable patchset 2021-06-11 (LP: #1931740) // CVE-\n     url: https://ubuntu.com/security/CVE-2021-47171\n     - net: usb: fix memory leak in smsc75xx_bind\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26910\n     - timers: Get rid of del_singleshot_timer_sync()\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52595\n     - rt2x00: clear IV's on start to fix AP mode regression\n     - wifi: rt2x00: restart beacon queue when hardware reset\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26696\n     - nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26685\n     - nilfs2: fix potential bug in end_buffer_async_write\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26625\n     - llc: call sock_orphan() at release time\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52615\n     - hwrng: core - Fix page fault dead lock on mmap-ed hwrng\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52486\n     - drm: Don't unref the same fb many times by mistake due to deadlock handling\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26697\n     - nilfs2: fix data corruption in dsync block recovery for small block sizes\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26679\n     - inet: read sk-\u003esk_family once in inet_recv_error()\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52622\n     - ext4: remove unnecessary check from alloc_flex_gd()\n     - ext4: avoid online resizing failures due to oversized flex bg\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26635\n     - llc: Drop support for ETH_P_TR_802_2.\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52594\n     - wifi: ath9k: Fix potential array-index-out-of-bounds read in\n       ath9k_htc_txstatus()\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26720\n     - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26825\n     - nfc: nci: free rx_data_reassembly skb on NCI device cleanup\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26671\n     - blk-mq: fix IO hang from sbitmap wakeup race\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26675\n     - ppp_async: limit MRU to 64K\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52602\n     - jfs: fix slab-out-of-bounds Read in dtSearch\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26704\n     - ext4: fix double-free of blocks due to wrong extents moved_len\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52619\n     - linux/kernel.h: Add ALIGN_DOWN macro\n     - pstore: Make ramoops_init_przs generic for other prz arrays\n     - pstore/ram: Fix crash when setting number of cpus to an odd number\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26636\n     - llc: make llc_ui_sendmsg() more robust against bonding changes\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52587\n     - IB/ipoib: Fix mcast list locking\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52601 // CVE-url:\n     https://ubuntu.com/security/CVE-2023-52604\n     - jfs: fix array-index-out-of-bounds in dbAdjTree\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52604\n     - FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52599\n     - jfs: fix array-index-out-of-bounds in diNewExt\n   * Bionic update: upstream stable patchset 2022-11-15 (LP: #1996650) // CVE-\n     url: https://ubuntu.com/security/CVE-2022-48659\n     - mm/slub: fix to return errno if kmalloc() fails\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26884\n     - bpf: Fix hashtab overflow check on 32-bit arches\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26882\n     - net: add atomic_long_t to net_device_stats fields\n     - net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()\n   * Bionic update: upstream stable patchset 2019-07-19 (LP: #1837257) // CVE-\n     url: https://ubuntu.com/security/CVE-2024-26882\n     - ip: validate header length on virtual device xmit\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26908\n     - x86/xen: Add some null pointer checking to smp.c\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26904\n     - btrfs: fix data race at btrfs_use_block_rsv() when accessing block reserve\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26903\n     - Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26901\n     - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26898\n     - aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts","status":"published","published":"2024-05-21T05:31:22Z","modified":"2026-06-04T10:03:21.554863698Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2024-1716269925","title":"Fix of 42 CVEs","description":"   * CVE-url: https://ubuntu.com/security/CVE-2023-47233\n     - wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52601\n     - jfs: Fix memleak in dbAdjCtl\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26801\n     - Bluetooth: Avoid potential use-after-free in hci_error_reset\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26805\n     - netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52566\n     - nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26622\n     - tomoyo: fix UAF write bug in tomoyo_write_control()\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26614\n     - tcp: make sure init the accept_queue's spinlocks once\n     - ipv6: init the accept_queue's spinlocks in inet6_create\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52530\n     - wifi: mac80211: fix potential key use-after-free\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52524\n     - net: nfc: llcp: Add lock when modifying device list\n   * CVE-url: https://ubuntu.com/security/CVE-2021-47173\n     - misc/uss720: fix memory leak in uss720_probe\n   * Bionic update: upstream stable patchset 2021-07-14 (LP: #1936231) // CVE-\n     url: https://ubuntu.com/security/CVE-2021-47171\n     - net: usb: fix possible use-after-free in smsc75xx_bind\n   * Bionic update: upstream stable patchset 2021-06-11 (LP: #1931740) // CVE-\n     url: https://ubuntu.com/security/CVE-2021-47171\n     - net: usb: fix memory leak in smsc75xx_bind\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26910\n     - timers: Get rid of del_singleshot_timer_sync()\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52595\n     - rt2x00: clear IV's on start to fix AP mode regression\n     - wifi: rt2x00: restart beacon queue when hardware reset\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26696\n     - nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26685\n     - nilfs2: fix potential bug in end_buffer_async_write\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26625\n     - llc: call sock_orphan() at release time\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52615\n     - hwrng: core - Fix page fault dead lock on mmap-ed hwrng\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52486\n     - drm: Don't unref the same fb many times by mistake due to deadlock handling\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26697\n     - nilfs2: fix data corruption in dsync block recovery for small block sizes\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26679\n     - inet: read sk-\u003esk_family once in inet_recv_error()\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52622\n     - ext4: remove unnecessary check from alloc_flex_gd()\n     - ext4: avoid online resizing failures due to oversized flex bg\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26635\n     - llc: Drop support for ETH_P_TR_802_2.\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52594\n     - wifi: ath9k: Fix potential array-index-out-of-bounds read in\n       ath9k_htc_txstatus()\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26720\n     - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26825\n     - nfc: nci: free rx_data_reassembly skb on NCI device cleanup\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26671\n     - blk-mq: fix IO hang from sbitmap wakeup race\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26675\n     - ppp_async: limit MRU to 64K\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52602\n     - jfs: fix slab-out-of-bounds Read in dtSearch\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26704\n     - ext4: fix double-free of blocks due to wrong extents moved_len\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52619\n     - linux/kernel.h: Add ALIGN_DOWN macro\n     - pstore: Make ramoops_init_przs generic for other prz arrays\n     - pstore/ram: Fix crash when setting number of cpus to an odd number\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26636\n     - llc: make llc_ui_sendmsg() more robust against bonding changes\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52587\n     - IB/ipoib: Fix mcast list locking\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52601 // CVE-url:\n     https://ubuntu.com/security/CVE-2023-52604\n     - jfs: fix array-index-out-of-bounds in dbAdjTree\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52604\n     - FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52599\n     - jfs: fix array-index-out-of-bounds in diNewExt\n   * Bionic update: upstream stable patchset 2022-11-15 (LP: #1996650) // CVE-\n     url: https://ubuntu.com/security/CVE-2022-48659\n     - mm/slub: fix to return errno if kmalloc() fails\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26884\n     - bpf: Fix hashtab overflow check on 32-bit arches\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26882\n     - net: add atomic_long_t to net_device_stats fields\n     - net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()\n   * Bionic update: upstream stable patchset 2019-07-19 (LP: #1837257) // CVE-\n     url: https://ubuntu.com/security/CVE-2024-26882\n     - ip: validate header length on virtual device xmit\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26908\n     - x86/xen: Add some null pointer checking to smp.c\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26904\n     - btrfs: fix data race at btrfs_use_block_rsv() when accessing block reserve\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26903\n     - Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26901\n     - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26898\n     - aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts","status":"published","published":"2024-05-21T05:38:48Z","modified":"2026-06-04T10:04:30.104579339Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2024-1716270232","title":"Fix of 48 CVEs","description":"   * CVE-url: https://ubuntu.com/security/CVE-2023-47233\n     - wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52601\n     - jfs: Fix memleak in dbAdjCtl\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26801\n     - Bluetooth: Avoid potential use-after-free in hci_error_reset\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26805\n     - netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26735\n     - ipv6: sr: fix possible use-after-free and null-ptr-deref\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52566\n     - nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()\n   * CVE-url: https://ubuntu.com/security/CVE-2021-46981\n     - nbd: Fix NULL pointer in flush_workqueue\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26622\n     - tomoyo: fix UAF write bug in tomoyo_write_control()\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26614\n     - tcp: make sure init the accept_queue's spinlocks once\n     - ipv6: init the accept_queue's spinlocks in inet6_create\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52530\n     - wifi: mac80211: fix potential key use-after-free\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52524\n     - net: nfc: llcp: Add lock when modifying device list\n   * CVE-url: https://ubuntu.com/security/CVE-2021-47173\n     - misc/uss720: fix memory leak in uss720_probe\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26910\n     - timers: Get rid of del_singleshot_timer_sync()\n     - timers: Update kernel-doc for various functions\n     - timers: Use del_timer_sync() even on UP\n     - timers: Rename del_timer_sync() to timer_delete_sync()\n     - timers: Rename del_timer() to timer_delete()\n     - timers: Silently ignore timers with a NULL function\n     - timers: Split [try_to_]del_timer[_sync]() to prepare for shutdown mode\n     - timers: Add shutdown mechanism to the internal functions\n     - timers: Provide timer_shutdown[_sync]()\n     - netfilter: ipset: fix performance regression in swap operation\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52595\n     - rt2x00: clear IV's on start to fix AP mode regression\n     - wifi: rt2x00: restart beacon queue when hardware reset\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52617\n     - switchtec: Improve MRPC efficiency by enabling write combining\n     - switchtec: Add MRPC DMA mode support\n     - PCI: switchtec: Fix stdev_release() crash after surprise hot remove\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26696\n     - nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26685\n     - nilfs2: fix potential bug in end_buffer_async_write\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26625\n     - llc: call sock_orphan() at release time\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52615\n     - hwrng: core - Fix page fault dead lock on mmap-ed hwrng\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52486\n     - drm: Don't unref the same fb many times by mistake due to deadlock handling\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26920\n     - tracing/trigger: Fix to return error if failed to alloc snapshot\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26697\n     - nilfs2: fix data corruption in dsync block recovery for small block sizes\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26679\n     - inet: read sk-\u003esk_family once in inet_recv_error()\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52622\n     - ext4: remove unnecessary check from alloc_flex_gd()\n     - ext4: avoid online resizing failures due to oversized flex bg\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26635\n     - llc: Drop support for ETH_P_TR_802_2.\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52594\n     - wifi: ath9k: Fix potential array-index-out-of-bounds read in\n       ath9k_htc_txstatus()\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52583\n     - ceph: fix deadlock or deadcode of misusing dget()\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26720\n     - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26825\n     - nfc: nci: free rx_data_reassembly skb on NCI device cleanup\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26671\n     - blk-mq: fix IO hang from sbitmap wakeup race\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26675\n     - ppp_async: limit MRU to 64K\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26663\n     - tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52602\n     - jfs: fix slab-out-of-bounds Read in dtSearch\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26704\n     - ext4: fix double-free of blocks due to wrong extents moved_len\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52619\n     - pstore/ram: Fix crash when setting number of cpus to an odd number\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26636\n     - llc: make llc_ui_sendmsg() more robust against bonding changes\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52587\n     - IB/ipoib: Fix mcast list locking\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52601 // CVE-url:\n     https://ubuntu.com/security/CVE-2023-52604\n     - jfs: fix array-index-out-of-bounds in dbAdjTree\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52604\n     - FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52623\n     - SUNRPC: Fix a suspicious RCU usage warning\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52599\n     - jfs: fix array-index-out-of-bounds in diNewExt\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26884\n     - bpf: Fix hashtab overflow check on 32-bit arches\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26883\n     - bpf: Fix stackmap overflow check on 32-bit arches\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26882\n     - net: add atomic_long_t to net_device_stats fields\n     - net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26908\n     - x86/xen: Add some null pointer checking to smp.c\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26904\n     - btrfs: fix data race at btrfs_use_block_rsv() when accessing block reserve\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26903\n     - Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26901\n     - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26898\n     - aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts","status":"published","published":"2024-05-21T05:43:54Z","modified":"2026-06-04T10:03:25.802328027Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2024-1716270655","title":"Fix of 48 CVEs","description":"   * CVE-url: https://ubuntu.com/security/CVE-2023-47233\n     - wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52601\n     - jfs: Fix memleak in dbAdjCtl\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26801\n     - Bluetooth: Avoid potential use-after-free in hci_error_reset\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26805\n     - netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26735\n     - ipv6: sr: fix possible use-after-free and null-ptr-deref\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52566\n     - nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()\n   * CVE-url: https://ubuntu.com/security/CVE-2021-46981\n     - nbd: Fix NULL pointer in flush_workqueue\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26622\n     - tomoyo: fix UAF write bug in tomoyo_write_control()\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26614\n     - tcp: make sure init the accept_queue's spinlocks once\n     - ipv6: init the accept_queue's spinlocks in inet6_create\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52530\n     - wifi: mac80211: fix potential key use-after-free\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52524\n     - net: nfc: llcp: Add lock when modifying device list\n   * CVE-url: https://ubuntu.com/security/CVE-2021-47173\n     - misc/uss720: fix memory leak in uss720_probe\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26910\n     - timers: Get rid of del_singleshot_timer_sync()\n     - timers: Update kernel-doc for various functions\n     - timers: Use del_timer_sync() even on UP\n     - timers: Rename del_timer_sync() to timer_delete_sync()\n     - timers: Rename del_timer() to timer_delete()\n     - timers: Silently ignore timers with a NULL function\n     - timers: Split [try_to_]del_timer[_sync]() to prepare for shutdown mode\n     - timers: Add shutdown mechanism to the internal functions\n     - timers: Provide timer_shutdown[_sync]()\n     - netfilter: ipset: fix performance regression in swap operation\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52595\n     - rt2x00: clear IV's on start to fix AP mode regression\n     - wifi: rt2x00: restart beacon queue when hardware reset\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52617\n     - switchtec: Improve MRPC efficiency by enabling write combining\n     - switchtec: Add MRPC DMA mode support\n     - PCI: switchtec: Fix stdev_release() crash after surprise hot remove\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26696\n     - nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26685\n     - nilfs2: fix potential bug in end_buffer_async_write\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26625\n     - llc: call sock_orphan() at release time\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52615\n     - hwrng: core - Fix page fault dead lock on mmap-ed hwrng\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52486\n     - drm: Don't unref the same fb many times by mistake due to deadlock handling\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26920\n     - tracing/trigger: Fix to return error if failed to alloc snapshot\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26697\n     - nilfs2: fix data corruption in dsync block recovery for small block sizes\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26679\n     - inet: read sk-\u003esk_family once in inet_recv_error()\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52622\n     - ext4: remove unnecessary check from alloc_flex_gd()\n     - ext4: avoid online resizing failures due to oversized flex bg\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26635\n     - llc: Drop support for ETH_P_TR_802_2.\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52594\n     - wifi: ath9k: Fix potential array-index-out-of-bounds read in\n       ath9k_htc_txstatus()\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52583\n     - ceph: fix deadlock or deadcode of misusing dget()\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26720\n     - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26825\n     - nfc: nci: free rx_data_reassembly skb on NCI device cleanup\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26671\n     - blk-mq: fix IO hang from sbitmap wakeup race\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26675\n     - ppp_async: limit MRU to 64K\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26663\n     - tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52602\n     - jfs: fix slab-out-of-bounds Read in dtSearch\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26704\n     - ext4: fix double-free of blocks due to wrong extents moved_len\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52619\n     - pstore/ram: Fix crash when setting number of cpus to an odd number\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26636\n     - llc: make llc_ui_sendmsg() more robust against bonding changes\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52587\n     - IB/ipoib: Fix mcast list locking\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52601 // CVE-url:\n     https://ubuntu.com/security/CVE-2023-52604\n     - jfs: fix array-index-out-of-bounds in dbAdjTree\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52604\n     - FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52623\n     - SUNRPC: Fix a suspicious RCU usage warning\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52599\n     - jfs: fix array-index-out-of-bounds in diNewExt\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26884\n     - bpf: Fix hashtab overflow check on 32-bit arches\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26883\n     - bpf: Fix stackmap overflow check on 32-bit arches\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26882\n     - net: add atomic_long_t to net_device_stats fields\n     - net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26908\n     - x86/xen: Add some null pointer checking to smp.c\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26904\n     - btrfs: fix data race at btrfs_use_block_rsv() when accessing block reserve\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26903\n     - Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26901\n     - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26898\n     - aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts","status":"published","published":"2024-05-21T05:50:58Z","modified":"2026-06-04T10:04:25.534204365Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2024-1716270851","title":"Fix of 48 CVEs","description":"   [ Ubuntu: 4.15.0-228.239 ]\n   * CVE-url: https://ubuntu.com/security/CVE-2023-47233\n     - wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52601\n     - jfs: Fix memleak in dbAdjCtl\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26801\n     - Bluetooth: Avoid potential use-after-free in hci_error_reset\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26805\n     - netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26735\n     - ipv6: sr: fix possible use-after-free and null-ptr-deref\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52566\n     - nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()\n   * CVE-url: https://ubuntu.com/security/CVE-2021-46981\n     - nbd: Fix NULL pointer in flush_workqueue\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26622\n     - tomoyo: fix UAF write bug in tomoyo_write_control()\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26614\n     - tcp: make sure init the accept_queue's spinlocks once\n     - ipv6: init the accept_queue's spinlocks in inet6_create\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52530\n     - wifi: mac80211: fix potential key use-after-free\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52524\n     - net: nfc: llcp: Add lock when modifying device list\n   * CVE-url: https://ubuntu.com/security/CVE-2021-47173\n     - misc/uss720: fix memory leak in uss720_probe\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26910\n     - timers: Get rid of del_singleshot_timer_sync()\n     - timers: Update kernel-doc for various functions\n     - timers: Use del_timer_sync() even on UP\n     - timers: Rename del_timer_sync() to timer_delete_sync()\n     - timers: Rename del_timer() to timer_delete()\n     - timers: Silently ignore timers with a NULL function\n     - timers: Split [try_to_]del_timer[_sync]() to prepare for shutdown mode\n     - timers: Add shutdown mechanism to the internal functions\n     - timers: Provide timer_shutdown[_sync]()\n     - netfilter: ipset: fix performance regression in swap operation\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52595\n     - rt2x00: clear IV's on start to fix AP mode regression\n     - wifi: rt2x00: restart beacon queue when hardware reset\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52617\n     - switchtec: Improve MRPC efficiency by enabling write combining\n     - switchtec: Add MRPC DMA mode support\n     - PCI: switchtec: Fix stdev_release() crash after surprise hot remove\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26696\n     - nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26685\n     - nilfs2: fix potential bug in end_buffer_async_write\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26625\n     - llc: call sock_orphan() at release time\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52615\n     - hwrng: core - Fix page fault dead lock on mmap-ed hwrng\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52486\n     - drm: Don't unref the same fb many times by mistake due to deadlock handling\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26920\n     - tracing/trigger: Fix to return error if failed to alloc snapshot\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26697\n     - nilfs2: fix data corruption in dsync block recovery for small block sizes\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26679\n     - inet: read sk-\u003esk_family once in inet_recv_error()\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52622\n     - ext4: remove unnecessary check from alloc_flex_gd()\n     - ext4: avoid online resizing failures due to oversized flex bg\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26635\n     - llc: Drop support for ETH_P_TR_802_2.\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52594\n     - wifi: ath9k: Fix potential array-index-out-of-bounds read in\n       ath9k_htc_txstatus()\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52583\n     - ceph: fix deadlock or deadcode of misusing dget()\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26720\n     - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26825\n     - nfc: nci: free rx_data_reassembly skb on NCI device cleanup\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26671\n     - blk-mq: fix IO hang from sbitmap wakeup race\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26675\n     - ppp_async: limit MRU to 64K\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26663\n     - tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52602\n     - jfs: fix slab-out-of-bounds Read in dtSearch\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26704\n     - ext4: fix double-free of blocks due to wrong extents moved_len\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52619\n     - pstore/ram: Fix crash when setting number of cpus to an odd number\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26636\n     - llc: make llc_ui_sendmsg() more robust against bonding changes\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52587\n     - IB/ipoib: Fix mcast list locking\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52601 // CVE-url:\n     https://ubuntu.com/security/CVE-2023-52604\n     - jfs: fix array-index-out-of-bounds in dbAdjTree\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52604\n     - FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52623\n     - SUNRPC: Fix a suspicious RCU usage warning\n   * CVE-url: https://ubuntu.com/security/CVE-2023-52599\n     - jfs: fix array-index-out-of-bounds in diNewExt\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26884\n     - bpf: Fix hashtab overflow check on 32-bit arches\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26883\n     - bpf: Fix stackmap overflow check on 32-bit arches\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26882\n     - net: add atomic_long_t to net_device_stats fields\n     - net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26908\n     - x86/xen: Add some null pointer checking to smp.c\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26904\n     - btrfs: fix data race at btrfs_use_block_rsv() when accessing block reserve\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26903\n     - Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26901\n     - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak\n   * CVE-url: https://ubuntu.com/security/CVE-2024-26898\n     - aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts","status":"published","published":"2026-10-21T08:11:18Z","modified":"2026-10-26T09:43:18.709905884Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"DLA-3840-1","title":"linux - security update","status":"published","published":"2024-06-25T00:00:00Z","modified":"2026-03-09T01:22:46.815448Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DLA-3842-1","title":"linux-5.10 - security update","status":"published","published":"2024-06-25T00:00:00Z","modified":"2026-03-09T01:22:14.203921Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5681-1","title":"linux - security update","status":"published","published":"2024-05-06T00:00:00Z","modified":"2026-03-09T02:09:16.152175Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"SUSE-SU-2024:1490-1","title":"Security update for the Linux Kernel","description":"\n\nThe SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.\n\nThe following security bugs were fixed:\n\n- CVE-2021-46925: Fixed kernel panic caused by race of smc_sock (bsc#1220466).\n- CVE-2021-46926: Fixed bug when detecting controllers in ALSA/hda/intel-sdw-acpi (bsc#1220478).\n- CVE-2021-46927: Fixed assertion bug in nitro_enclaves: Use get_user_pages_unlocked() (bsc#1220443).\n- CVE-2021-46929: Fixed use-after-free issue in sctp_sock_dump() (bsc#1220482).\n- CVE-2021-46930: Fixed usb/mtu3 list_head check warning (bsc#1220484).\n- CVE-2021-46931: Fixed wrong type casting in mlx5e_tx_reporter_dump_sq() (bsc#1220486).\n- CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).\n- CVE-2021-46936: Fixed use-after-free in tw_timer_handler() (bsc#1220439).\n- CVE-2021-47082: Fixed ouble free in tun_free_netdev() (bsc#1220969).\n- CVE-2021-47087: Fixed incorrect page free bug in tee/optee (bsc#1220954).\n- CVE-2021-47091: Fixed locking in ieee80211_start_ap()) error path (bsc#1220959).\n- CVE-2021-47093: Fixed memleak on registration failure in intel_pmc_core (bsc#1220978).\n- CVE-2021-47094: Fixed possible memory leak in KVM x86/mmu (bsc#1221551).\n- CVE-2021-47095: Fixed missing initialization in ipmi/ssif (bsc#1220979).\n- CVE-2021-47096: Fixed uninitalized user_pversion in ALSA rawmidi (bsc#1220981).\n- CVE-2021-47097: Fixed stack out of bound access in elantech_change_report_id() (bsc#1220982).\n- CVE-2021-47098: Fixed integer overflow/underflow in hysteresis calculations hwmon: (lm90) (bsc#1220983).\n- CVE-2021-47099: Fixed BUG_ON assertion in veth when skb entering GRO are cloned (bsc#1220955).\n- CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).\n- CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).\n- CVE-2021-47102: Fixed incorrect structure access In line: upper = info-\u003eupper_dev in net/marvell/prestera (bsc#1221009).\n- CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).\n- CVE-2021-47105: Fixed potential memory leak in ice/xsk (bsc#1220961).\n- CVE-2021-47107: Fixed READDIR buffer overflow in NFSD (bsc#1220965).\n- CVE-2021-47108: Fixed possible NULL pointer dereference for mtk_hdmi_conf in drm/mediatek (bsc#1220986).\n- CVE-2021-47181: Fixed a null pointer dereference caused by calling platform_get_resource()  (bsc#1222660).\n- CVE-2021-47182: Fixed buffer length handling in scsi_mode_sense() in scsi core (bsc#1222662).\n- CVE-2021-47183: Fixed a null pointer dereference during link down processing in scsi lpfc (bsc#1192145, bsc#1222664).\n- CVE-2021-47185: Fixed a softlockup issue in flush_to_ldisc in tty tty_buffer (bsc#1222669).\n- CVE-2021-47189: Fixed denial of service due to memory ordering issues between normal and ordered work functions in btrfs (bsc#1222706).\n- CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver functionality (bsc#1209635).\n- CVE-2022-48626: Fixed a potential use-after-free on remove path moxart (bsc#1220366).\n- CVE-2022-48629: Fixed possible memory leak in qcom-rng (bsc#1220989).\n- CVE-2022-48630: Fixed infinite loop on requests not multiple of WORD_SZ in crypto: qcom-rng (bsc#1220990).\n- CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).\n- CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).\n- CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).\n- CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential information disclosure or a denial of service (bsc#1215221).\n- CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround  (bsc#1220251).\n- CVE-2023-52450: Fixed NULL pointer dereference issue in upi_fill_topology() (bsc#1220237).\n- CVE-2023-52453: Fixed data corruption in hisi_acc_vfio_pci (bsc#1220337).\n- CVE-2023-52454: Fixed a kernel panic when host sends an invalid H2C PDU length (bsc#1220320).\n- CVE-2023-52469: Fixed a use-after-free in kv_parse_power_table (bsc#1220411).\n- CVE-2023-52470: Fixed null-ptr-deref in radeon_crtc_init() (bsc#1220413).\n- CVE-2023-52474: Fixed a vulnerability with non-PAGE_SIZE-end multi-iovec user SDMA requests (bsc#1220445).\n- CVE-2023-52476: Fixed possible unhandled page fault via perf sampling NMI during vsyscall (bsc#1220703).\n- CVE-2023-52477: Fixed USB Hub accesses to uninitialized BOS descriptors (bsc#1220790).\n- CVE-2023-52481: Fixed speculative unprivileged load in Cortex-A520 (bsc#1220887).\n- CVE-2023-52484: Fixed a soft lockup triggered by arm_smmu_mm_invalidate_range (bsc#1220797).\n- CVE-2023-52486: Fixed possible use-after-free in drm (bsc#1221277).\n- CVE-2023-52488: Fixed data corruption due to error on incrementing register address in regmap functions for FIFO in serial sc16is7xx (bsc#1221162).\n- CVE-2023-52492: Fixed a null-pointer-dereference in channel unregistration function __dma_async_device_channel_register() (bsc#1221276).\n- CVE-2023-52493: Fixed possible soft lockup in bus/mhi/host (bsc#1221274).\n- CVE-2023-52494: Fixed missing alignment check for event ring read pointer in bus/mhi/host (bsc#1221273).\n- CVE-2023-52497: Fixed data corruption in erofs (bsc#1220879).\n- CVE-2023-52500: Fixed information leaking when processing OPC_INB_SET_CONTROLLER_CONFIG command (bsc#1220883).\n- CVE-2023-52501: Fixed possible memory corruption in ring-buffer (bsc#1220885).\n- CVE-2023-52502: Fixed a race condition in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() (bsc#1220831).\n- CVE-2023-52503: Fixed use-after-free in amdtee_close_session due to race condition with amdtee_open_session in tee amdtee (bsc#1220915).\n- CVE-2023-52504: Fixed possible out-of bounds in apply_alternatives() on a 5-level paging machine (bsc#1221553).\n- CVE-2023-52507: Fixed possible shift-out-of-bounds in nfc/nci (bsc#1220833).\n- CVE-2023-52508: Fixed null pointer dereference in nvme_fc_io_getuuid() (bsc#1221015).\n- CVE-2023-52509: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1220836).\n- CVE-2023-52510: Fixed a potential UAF in ca8210_probe() (bsc#1220898).\n- CVE-2023-52511: Fixed possible memory corruption in spi/sun6i (bsc#1221012).\n- CVE-2023-52513: Fixed connection failure handling  in RDMA/siw (bsc#1221022).\n- CVE-2023-52515: Fixed possible use-after-free in RDMA/srp (bsc#1221048).\n- CVE-2023-52517: Fixed race between DMA RX transfer completion and RX FIFO drain in spi/sun6i (bsc#1221055).\n- CVE-2023-52518: Fixed information leak in bluetooth/hci_codec (bsc#1221056).\n- CVE-2023-52519: Fixed possible overflow in HID/intel-ish-hid/ipc (bsc#1220920).\n- CVE-2023-52520: Fixed reference leak in platform/x86/think-lmi (bsc#1220921).\n- CVE-2023-52523: Fixed wrong redirects to non-TCP sockets in bpf (bsc#1220926).\n- CVE-2023-52524: Fixed possible corruption in nfc/llcp (bsc#1220927).\n- CVE-2023-52525: Fixed out of bounds check mwifiex_process_rx_packet() (bsc#1220840).\n- CVE-2023-52528: Fixed uninit-value access in __smsc75xx_read_reg() (bsc#1220843).\n- CVE-2023-52529: Fixed a potential memory leak in sony_probe() (bsc#1220929).\n- CVE-2023-52532: Fixed a bug in TX CQE error handling (bsc#1220932).\n- CVE-2023-52561: Fixed denial of service due to missing reserved attribute on cont splash memory region in arm64 dts qcom sdm845-db845c (bsc#1220935).\n- CVE-2023-52563: Fixed memory leak on -\u003ehpd_notify callback() in drm/meson (bsc#1220937).\n- CVE-2023-52564: Reverted invalid fix for UAF in gsm_cleanup_mux() (bsc#1220938).\n- CVE-2023-52566: Fixed potential use after free in nilfs_gccache_submit_read_data() (bsc#1220940).\n- CVE-2023-52567: Fixed possible Oops in  serial/8250_port: when using IRQ polling (irq = 0) (bsc#1220839).\n- CVE-2023-52569: Fixed a bug in btrfs by remoning BUG() after failure to insert delayed dir index item (bsc#1220918).\n- CVE-2023-52574: Fixed a bug by hiding new member header_ops (bsc#1220870).\n- CVE-2023-52575: Fixed SBPB enablement for spec_rstack_overflow=off (bsc#1220871).\n- CVE-2023-52576: Fixed potential use after free in memblock_isolate_range() (bsc#1220872).\n- CVE-2023-52582: Fixed possible oops in netfs (bsc#1220878).\n- CVE-2023-52583: Fixed deadlock or deadcode of misusing dget() inside ceph (bsc#1221058).\n- CVE-2023-52587: Fixed mcast list locking in IB/ipoib (bsc#1221082).\n- CVE-2023-52591: Fixed a possible reiserfs filesystem corruption via directory renaming (bsc#1221044).\n- CVE-2023-52594: Fixed potential array-index-out-of-bounds read in ath9k_htc_txstatus() (bsc#1221045).\n- CVE-2023-52595: Fixed possible deadlock in wifi/rt2x00 (bsc#1221046).\n- CVE-2023-52597: Fixed a setting of fpc register in KVM (bsc#1221040).\n- CVE-2023-52598: Fixed wrong setting of fpc register in s390/ptrace (bsc#1221060).\n- CVE-2023-52599: Fixed array-index-out-of-bounds in diNewExt() in jfs (bsc#1221062).\n- CVE-2023-52600: Fixed uaf in jfs_evict_inode() (bsc#1221071).\n- CVE-2023-52601: Fixed array-index-out-of-bounds in dbAdjTree() in jfs (bsc#1221068).\n- CVE-2023-52602: Fixed slab-out-of-bounds Read in dtSearch() in jfs (bsc#1221070).\n- CVE-2023-52603: Fixed array-index-out-of-bounds in dtSplitRoot() (bsc#1221066).\n- CVE-2023-52604: Fixed array-index-out-of-bounds in dbAdjTree() (bsc#1221067).\n- CVE-2023-52605: Fixed a NULL pointer dereference check (bsc#1221039)\n- CVE-2023-52606: Fixed possible kernel stack corruption in powerpc/lib (bsc#1221069).\n- CVE-2023-52607: Fixed a null-pointer-dereference in pgtable_cache_add kasprintf() (bsc#1221061).\n- CVE-2023-52608: Fixed possible race condition in firmware/arm_scmi (bsc#1221375).\n- CVE-2023-52612: Fixed req-\u003edst buffer overflow in crypto/scomp (bsc#1221616).\n- CVE-2023-52615: Fixed page fault dead lock on mmap-ed hwrng (bsc#1221614).\n- CVE-2023-52617: Fixed stdev_release() crash after surprise hot remove (bsc#1221613).\n- CVE-2023-52619: Fixed possible crash when setting number of cpus to an odd number in pstore/ram (bsc#1221618).\n- CVE-2023-52621: Fixed missing asserion in bpf (bsc#1222073).\n- CVE-2023-52623: Fixed suspicious RCU usage in SUNRPC (bsc#1222060).\n- CVE-2023-52627: Fixed null pointer dereference due to lack of callback functions in iio adc ad7091r (bsc#1222051)\n- CVE-2023-52628: Fixed 4-byte stack OOB write in nftables (bsc#1222117).\n- CVE-2023-52632: Fixed lock dependency warning with srcu in drm/amdkfd (bsc#1222274).\n- CVE-2023-52636: Fixed denial of service due to wrongly init the cursor when preparing sparse read in msgr2 in libceph  (bsc#1222247).\n- CVE-2023-52637: Fixed UAF in j1939_sk_match_filter() in can/k1939 (bsc#1222291).\n- CVE-2023-52639: Fixed race during shadow creation in KVM/s390/vsie Fixed (bsc#1222300).\n- CVE-2023-6356: Fixed a NULL pointer dereference in nvmet_tcp_build_pdu_iovec (bsc#1217987).\n- CVE-2023-6535: Fixed a NULL pointer dereference in nvmet_tcp_execute_request (bsc#1217988).\n- CVE-2023-6536: Fixed a NULL pointer dereference in __nvmet_req_complete (bsc#1217989).\n- CVE-2023-7042: Fixed a null-pointer-dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() (bsc#1218336).\n- CVE-2023-7192: Fixed a memory leak problem in ctnetlink_create_conntrack in net/netfilter/nf_conntrack_netlink.c (bsc#1218479).\n- CVE-2024-0841: Fixed null pointer dereference in hugetlbfs_fill_super() (bsc#1219264).\n- CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).\n- CVE-2024-22099: Fixed a null-pointer-dereference in rfcomm_check_security (bsc#1219170).\n- CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1219169).\n- CVE-2024-23850: Fixed denial of service due to assertion failure due to subvolume readed before root item insertion in btrfs_get_root_ref in btrfs (bsc#1219126).\n- CVE-2024-23850: Fixed double free of anonymous device after snapshot  creation failure (bsc#1219126).\n- CVE-2024-25739: Fixed possible crash in create_empty_lvol() in drivers/mtd/ubi/vtbl.c (bsc#1219834).\n- CVE-2024-25742: Fixed insufficient validation during #VC instruction emulation in x86/sev (bsc#1221725).\n- CVE-2024-26599: Fixed out-of-bounds access in of_pwm_single_xlate() (bsc#1220365).\n- CVE-2024-26600: Fixed NULL pointer dereference for SRP in phy-omap-usb2 (bsc#1220340).\n- CVE-2024-26602: Fixed overall slowdowns with sys_membarrier (bsc1220398).\n- CVE-2024-26612: Fixed Oops in fscache_put_cache() This function dereferences  (bsc#1221291).\n- CVE-2024-26614: Fixed the initialization of accept_queue's spinlocks (bsc#1221293).\n- CVE-2024-26620: Fixed possible device model violation in s390/vfio-ap (bsc#1221298).\n- CVE-2024-26627: Fixed possible hard lockup in scsi (bsc#1221090).\n- CVE-2024-26629: Fixed possible protocol violation via RELEASE_LOCKOWNER in nfsd (bsc#1221379).\n- CVE-2024-26642: Fixed the set of anonymous timeout flag in netfilter nf_tables (bsc#1221830).\n- CVE-2024-26645: Fixed missing visibility when inserting an element into tracing_map (bsc#1222056).\n- CVE-2024-26646: Fixed potential memory corruption when resuming from suspend or hibernation in thermal/intel/hfi (bsc#1222070).\n- CVE-2024-26651: Fixed possible oops via malicious devices in sr9800 (bsc#1221337).\n- CVE-2024-26654: Fixed use after free in ALSA/sh/aica (bsc#1222304).\n- CVE-2024-26659: Fixed wrong handling of isoc Babble and Buffer Overrun events in xhci (bsc#1222317).\n- CVE-2024-26660: Fixed buffer overflow in dcn301_stream_encoder_create in drm amd display (bsc#1222266)\n- CVE-2024-26664: Fixed out-of-bounds memory access in create_core_data() in hwmon coretemp (bsc#1222355).\n- CVE-2024-26667: Fixed null pointer reference in dpu_encoder_helper_phys_cleanup in drm/msm/dpu (bsc#1222331).\n- CVE-2024-26670: Fixed ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD workaround in kernel arm64 (bsc#1222356).\n- CVE-2024-26680: Fixed denial of service due to DMA mapping for PTP hwts ring in net atlantic (bsc#1222427).\n- CVE-2024-26681: Fixed denial of service in nsim_dev_trap_report_work() in netdevsim (bsc#1222431).\n- CVE-2024-26684: Fixed handling of DPP safety error for DMA channels in net stmmac xgmac (bsc#1222445).\n- CVE-2024-26685: Fixed denial of service in end_buffer_async_write() in nilfs2 (bsc#1222437).\n- CVE-2024-26689: Fixed use-after-free in encode_cap_msg() in ceph (bsc#1222503).\n- CVE-2024-26695: Fixed null pointer dereference in __sev_platform_shutdown_locked in crypto ccp (bsc#1222373).\n- CVE-2024-26696: Fixed denial of service in nilfs_lookup_dirty_data_buffers() in nilfs2 (bsc#1222549).\n- CVE-2024-26697: Fixed data corruption in dsync block recovery for small block sizes in nilfs2 (bsc#1222550).\n- CVE-2024-26704: Fixed a double-free of blocks due to wrong extents moved_len in ext4 (bsc#1222422).\n- CVE-2024-26717: Fixed null pointer dereference on failed power up in HID i2c-hid-of (bsc#1222360).\n- CVE-2024-26718: Fixed memory corruption in tasklet_unlock via disabling tasklets in dm-crypt and dm-verify (bsc#1222416).\n- CVE-2024-26722: Fixed denial of service in rt5645_jack_detect_work() due to mutex left locked forever in ASoC rt5645 (bsc#1222520).\n- CVE-2024-26727: Fixed denial of service due to assertion failure during subvolume creation (bsc#1222536).\n- CVE-2024-26733: Fixed an overflow in arp_req_get() in arp (bsc#1222585).\n- CVE-2024-26736: Fixed buffer overflow in afs_update_volume_status() in afs (bsc#1222586).\n- CVE-2024-26737: Fixed use-after-free due to race between bpf_timer_cancel_and_free and bpf_timer_cancel in bpf (bsc#1222557).\n- CVE-2024-26743: Fixed memory leak in qedr_create_user_qp error flow in rdma/qedr (bsc#1222677)\n- CVE-2024-26744: Fixed null pointer dereference in srpt_service_guid parameter in rdma/srpt (bsc#1222449)\n- CVE-2024-26745: Fixed null pointer dereference due to IOMMU table not initialized for kdump over SR-IOV (bsc#1220492, bsc#1222678).\n- CVE-2024-26747: Fixed null pointer issue when put module's reference in usb roles  (bsc#1222609).\n- CVE-2024-26749: Fixed use-after-free at cdns3_gadget_ep_disable() in usb cdns3 (bsc#1222680).\n- CVE-2024-26751: Fixed denial of service due to gpiod_lookup_table search loop not ending correctly (bsc#1222724)\n- CVE-2024-26754: Fixed an use-after-free and null-ptr-deref in gtp_genl_dump_pdp() in gtp  (bsc#1222632).\n- CVE-2024-26760: Fixed null pointer dereference on error case in bio_put() in scsi target pscsi (bsc#1222596)\n- CVE-2024-26763: Fixed user corruption via by writing data with O_DIRECT on device in dm-crypt (bsc#1222720).\n- CVE-2024-26766: Fixed off-by-one error in sdma.h tx-\u003enum_descs in ib/hfi1 (bsc#1222726)\n- CVE-2024-26769: Fixed deadlock on delete association path in nvmet-fc  (bsc#1222727).\n- CVE-2024-26771: Fixed a null pointer dereference on edma_probe in dmaengine ti edma  (bsc#1222610)\n- CVE-2024-26776: Fixed null pointer dereference due to null value returned by interrupt handler in spi hisi-sfc-v3xx (bsc#1222764)\n- CVE-2024-26779: Fixed denial of service due to race condition on enabling fast-xmit in wifi mac80211  (bsc#1222772).\n- CVE-2024-26787: Fixed DMA API overlapping mappings in mmc mmci stm32 (bsc#1222781)\n- CVE-2024-26790: Fixed denial of service on 16 bytes unaligned read in dmaengine fsl-qdma (bsc#1222784)\n- CVE-2024-26793: Fixed an use-after-free and null-ptr-deref in gtp_newlink() in gtp  (bsc#1222428).\n- CVE-2024-26798: Fixed denial of service due to wrongly restore fond data upon failure in fbcon (bsc#1222798).\n- CVE-2024-26805: Fixed a kernel-infoleak-after-free in __skb_datagram_iter in netlink  (bsc#1222630).\n- CVE-2024-26807: Fixed memory corruption due to wrong pointer reference in spi cadence-qspi (bsc#1222801)\n- CVE-2024-26848: Fixed denial of service due to endless loop in directory parsing in afs (bsc#1223030).\n\nThe following non-security bugs were fixed:\n\n- Revert 'PCI: tegra194: Enable support for 256 Byte payload' (git-fixes).\n- Revert 'Revert 'drm/amdgpu/display: change pipe policy for DCN 2.0'' (git-fixes).\n- Revert 'SUNRPC dont update timeout value on connection reset' (git-fixes).\n- Revert 'drm/amd: Disable PSR-SU on Parade 0803 TCON' (git-fixes).\n- Revert 'drm/amd: Disable S/G for APUs when 64GB or more host memory' (git-fixes).\n- Revert 'drm/amdgpu/display: change pipe policy for DCN 2.0' (git-fixes).\n- Revert 'drm/amdgpu/display: change pipe policy for DCN 2.1' (git-fixes).\n- Revert 'drm/vc4: hdmi: Enforce the minimum rate at runtime_resume' (git-fixes).\n- Revert 'fbdev: flush deferred IO before closing (git-fixes).' (bsc#1221814)\n- acpi: CPPC: enable AMD CPPC V2 support for family 17h processors (git-fixes).\n- acpi: processor_idle: Fix memory leak in acpi_processor_power_exit() (git-fixes).\n- acpi: resource: Add Infinity laptops to irq1_edge_low_force_override (stable-fixes).\n- acpi: resource: Add MAIBENBEN X577 to irq1_edge_low_force_override (git-fixes).\n- acpi: resource: Do IRQ override on Lunnen Ground laptops (stable-fixes).\n- acpi: scan: Fix device check notification handling (git-fixes).\n- acpica: debugger: check status of acpi_evaluate_object() in acpi_db_walk_for_fields() (git-fixes).\n- alsa: aaci: Delete unused variable in aaci_do_suspend (git-fixes).\n- alsa: aoa: avoid false-positive format truncation warning (git-fixes).\n- alsa: aw2: avoid casting function pointers (git-fixes).\n- alsa: ctxfi: avoid casting function pointers (git-fixes).\n- alsa: hda/realtek - ALC285 reduce pop noise from Headphone port (stable-fixes).\n- alsa: hda/realtek - Add Headset Mic supported Acer NB platform (stable-fixes).\n- alsa: hda/realtek - Fix headset Mic no show at resume back for Lenovo ALC897 platform (git-fixes).\n- alsa: hda/realtek: Enable Mute LED on HP 840 G8 (MB 8AB8) (git-fixes).\n- alsa: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with microphone (git-fixes).\n- alsa: hda/realtek: fix ALC285 issues on HP Envy x360 laptops (stable-fixes).\n- alsa: hda/realtek: fix mute/micmute LED For HP mt440 (git-fixes).\n- alsa: hda/realtek: fix mute/micmute LEDs for HP EliteBook (stable-fixes).\n- alsa: seq: fix function cast warnings (git-fixes).\n- alsa: sh: aica: reorder cleanup operations to avoid UAF bugs (git-fixes).\n- alsa: usb-audio: Stop parsing channels bits when all channels are found (git-fixes).\n- arm64: dts: allwinner: h6: Add RX DMA channel for SPDIF (git-fixes)\n- arm64: dts: broadcom: bcmbca: bcm4908: drop invalid switch cells (git-fixes)\n- arm64: dts: imx8mm-kontron: Add support for ultra high speed modes on (git-fixes)\n- arm64: dts: imx8mm-venice-gw71xx: fix USB OTG VBUS (git-fixes)\n- arm64: dts: marvell: reorder crypto interrupts on Armada SoCs (git-fixes)\n- arm64: dts: rockchip: add ES8316 codec for ROCK Pi 4 (git-fixes)\n- arm64: dts: rockchip: add SPDIF node for ROCK Pi 4 (git-fixes)\n- arm64: dts: rockchip: fix regulator name on rk3399-rock-4 (git-fixes)\n- arm64: dts: rockchip: set num-cs property for spi on px30 (git-fixes)\n- arm64: mm: fix VA-range sanity check (git-fixes)\n- arm64: set __exception_irq_entry with __irq_entry as a default (git-fixes)\n- asoc: Intel: bytcr_rt5640: Add an extra entry for the Chuwi Vi8 tablet (stable-fixes).\n- asoc: amd: acp: Add missing error handling in sof-mach (git-fixes).\n- asoc: amd: acp: fix for acp_init function error handling (git-fixes).\n- asoc: madera: Fix typo in madera_set_fll_clks shift value (git-fixes).\n- asoc: meson: Use dev_err_probe() helper (stable-fixes).\n- asoc: meson: aiu: fix function pointer type mismatch (git-fixes).\n- asoc: meson: axg-tdm-interface: add frame rate constraint (git-fixes).\n- asoc: meson: axg-tdm-interface: fix mclk setup without mclk-fs (git-fixes).\n- asoc: meson: t9015: fix function pointer type mismatch (git-fixes).\n- asoc: ops: Fix wraparound for mask in snd_soc_get_volsw (git-fixes).\n- asoc: rcar: adg: correct TIMSEL setting for SSI9 (git-fixes).\n- asoc: rt5645: Make LattePanda board DMI match more precise (stable-fixes).\n- asoc: rt5682-sdw: fix locking sequence (git-fixes).\n- asoc: rt711-sdca: fix locking sequence (git-fixes).\n- asoc: rt711-sdw: fix locking sequence (git-fixes).\n- asoc: wm8962: Enable both SPKOUTR_ENA and SPKOUTL_ENA in mono mode (stable-fixes).\n- asoc: wm8962: Enable oscillator if selecting WM8962_FLL_OSC (stable-fixes).\n- asoc: wm8962: Fix up incorrect error message in wm8962_set_fll (stable-fixes).\n- ata: sata_mv: Fix PCI device ID table declaration compilation warning (git-fixes).\n- ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit (git-fixes).\n- backlight: da9052: Fully initialize backlight_properties during probe (git-fixes).\n- backlight: lm3630a: Do not set bl-\u003eprops.brightness in get_brightness (git-fixes).\n- backlight: lm3630a: Initialize backlight_properties on init (git-fixes).\n- backlight: lm3639: Fully initialize backlight_properties during probe (git-fixes).\n- backlight: lp8788: Fully initialize backlight_properties during probe (git-fixes).\n- bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent (git-fixes).\n- bcache: Remove dead references to cache_readaheads (git-fixes).\n- bcache: Remove unnecessary NULL point check in node allocations (git-fixes).\n- bcache: add code comments for bch_btree_node_get() and __bch_btree_node_alloc() (git-fixes).\n- bcache: avoid NULL checking to c-\u003eroot in run_cache_set() (git-fixes).\n- bcache: avoid oversize memory allocation by small stripe_size (git-fixes).\n- bcache: bset: Fix comment typos (git-fixes).\n- bcache: check return value from btree_node_alloc_replacement() (git-fixes).\n- bcache: fix NULL pointer reference in cached_dev_detach_finish (git-fixes).\n- bcache: fix error info in register_bcache() (git-fixes).\n- bcache: fixup bcache_dev_sectors_dirty_add() multithreaded CPU false sharing (git-fixes).\n- bcache: fixup btree_cache_wait list damage (git-fixes).\n- bcache: fixup init dirty data errors (git-fixes).\n- bcache: fixup lock c-\u003eroot error (git-fixes).\n- bcache: fixup multi-threaded bch_sectors_dirty_init() wake-up race (git-fixes).\n- bcache: move calc_cached_dev_sectors to proper place on backing device detach (git-fixes).\n- bcache: move uapi header bcache.h to bcache code directory (git-fixes).\n- bcache: prevent potential division by zero error (git-fixes).\n- bcache: remove EXPERIMENTAL for Kconfig option 'Asynchronous device registration' (git-fixes).\n- bcache: remove bch_crc64_update (git-fixes).\n- bcache: remove redundant assignment to variable cur_idx (git-fixes).\n- bcache: remove the backing_dev_name field from struct cached_dev (git-fixes).\n- bcache: remove the cache_dev_name field from struct cache (git-fixes).\n- bcache: remove unnecessary flush_workqueue (git-fixes).\n- bcache: remove unused bch_mark_cache_readahead function def in stats.h (git-fixes).\n- bcache: replace a mistaken IS_ERR() by IS_ERR_OR_NULL() in btree_gc_coalesce() (git-fixes).\n- bcache: replace snprintf in show functions with sysfs_emit (git-fixes).\n- bcache: revert replacing IS_ERR_OR_NULL with IS_ERR (git-fixes).\n- bcache: use bvec_kmap_local in bch_data_verify (git-fixes).\n- bcache: use bvec_kmap_local in bio_csum (git-fixes).\n- bcache: use default_groups in kobj_type (git-fixes).\n- bcache:: fix repeated words in comments (git-fixes).\n- blocklayoutdriver: Fix reference leak of pnfs_device_node (git-fixes).\n- bluetooth: hci_core: Fix possible buffer overflow (git-fixes).\n- bluetooth: mgmt: Remove leftover queuing of power_off work (git-fixes).\n- bluetooth: remove HCI_POWER_OFF_TIMEOUT (git-fixes).\n- bluetooth: remove superfluous call to hci_conn_check_pending() (git-fixes).\n- bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security (stable-fixes).\n- bpf, scripts: Correct GPL license name (git-fixes).\n- bpf, sockmap: Fix preempt_rt splat when using raw_spin_lock_t (git-fixes).\n- can: softing: remove redundant NULL check (git-fixes).\n- ceph: stop copying to iter at EOF on sync reads (bsc#1223068).\n- ceph: switch to corrected encoding of max_xattr_size in mdsmap (bsc#1223067).\n- clk: zynq: Prevent null pointer dereference caused by kmalloc failure (git-fixes).\n- comedi: comedi_test: Prevent timers rescheduling during deletion (git-fixes).\n- coresight: etm4x: Do not access TRCIDR1 for identification (bsc#1220775)\n- coresight: etm4x: Fix accesses to TRCSEQRSTEVR and TRCSEQSTR (bsc#1220775)\n- coresight: etm: Override TRCIDR3.CCITMIN on errata affected cpus (bsc#1220775)\n- cpufreq: amd-pstate: Fix min_perf assignment in amd_pstate_adjust_perf() (git-fixes).\n- cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value (git-fixes).\n- crypto: arm/sha - fix function cast warnings (git-fixes).\n- crypto: qat - avoid division by zero (git-fixes).\n- crypto: qat - fix deadlock in backlog processing (git-fixes).\n- crypto: qat - fix double free during reset (git-fixes).\n- crypto: qat - fix state machines cleanup paths (bsc#1218321).\n- crypto: qat - fix unregistration of compression algorithms (git-fixes).\n- crypto: qat - fix unregistration of crypto algorithms (git-fixes).\n- crypto: qat - ignore subsequent state up commands (git-fixes).\n- crypto: qat - increase size of buffers (git-fixes).\n- crypto: qat - resolve race condition during AER recovery (git-fixes).\n- crypto: xilinx - call finalize with bh disabled (git-fixes).\n- dm cache policy smq: ensure IO does not prevent cleaner policy progress (git-fixes).\n- dm cache: add cond_resched() to various workqueue loops (git-fixes).\n- dm clone: call kmem_cache_destroy() in dm_clone_init() error path (git-fixes).\n- dm crypt: add cond_resched() to dmcrypt_write() (git-fixes).\n- dm crypt: avoid accessing uninitialized tasklet (git-fixes).\n- dm flakey: do not corrupt the zero page (git-fixes).\n- dm flakey: fix a bug with 32-bit highmem systems (git-fixes).\n- dm flakey: fix a crash with invalid table line (git-fixes).\n- dm flakey: fix logic when corrupting a bio (git-fixes).\n- dm init: add dm-mod.waitfor to wait for asynchronously probed block devices (git-fixes).\n- dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path (git-fixes).\n- dm integrity: fix out-of-range warning (git-fixes).\n- dm integrity: reduce vmalloc space footprint on 32-bit architectures (git-fixes).\n- dm raid: clean up four equivalent goto tags in raid_ctr() (git-fixes).\n- dm raid: fix false positive for requeue needed during reshape (git-fixes).\n- dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths (git-fixes).\n- dm stats: check for and propagate alloc_percpu failure (git-fixes).\n- dm thin metadata: Fix ABBA deadlock by resetting dm_bufio_client (git-fixes).\n- dm thin metadata: check fail_io before using data_sm (git-fixes).\n- dm thin: add cond_resched() to various workqueue loops (git-fixes).\n- dm thin: fix deadlock when swapping to thin device (bsc#1177529).\n- dm verity: do not perform FEC for failed readahead IO (git-fixes).\n- dm verity: fix error handling for check_at_most_once on FEC (git-fixes).\n- dm zoned: free dmz-\u003eddev array in dmz_put_zoned_devices (git-fixes).\n- dm-delay: fix a race between delay_presuspend and delay_bio (git-fixes).\n- dm-integrity: do not modify bio's immutable bio_vec in integrity_metadata() (git-fixes).\n- dm-raid: fix lockdep waring in 'pers-\u003ehot_add_disk' (git-fixes).\n- dm-verity, dm-crypt: align 'struct bvec_iter' correctly (git-fixes).\n- dm-verity: align struct dm_verity_fec_io properly (git-fixes).\n- dm: add cond_resched() to dm_wq_work() (git-fixes).\n- dm: call the resume method on internal suspend (git-fixes).\n- dm: do not lock fs when the map is NULL during suspend or resume (git-fixes).\n- dm: do not lock fs when the map is NULL in process of resume (git-fixes).\n- dm: remove flush_scheduled_work() during local_exit() (git-fixes).\n- dm: send just one event on resize, not two (git-fixes).\n- doc-guide: kernel-doc: tell about object-like macros (git-fixes).\n- doc/README.SUSE: Update information about module support status (jsc#PED-5759)\n- drivers: hv: vmbus: Calculate ring buffer size for more efficient use of memory (git-fixes).\n- drm/amd/display: Add FAMS validation before trying to use it (git-fixes).\n- drm/amd/display: Add function for validate and update new stream (git-fixes).\n- drm/amd/display: Avoid ABM when ODM combine is enabled for eDP (git-fixes).\n- drm/amd/display: Blocking invalid 420 modes on HDMI TMDS for DCN31 (git-fixes).\n- drm/amd/display: Check if link state is valid (git-fixes).\n- drm/amd/display: Copy DC context in the commit streams (git-fixes).\n- drm/amd/display: Disable PSR-SU on Parade 0803 TCON again (git-fixes).\n- drm/amd/display: Enable fast plane updates on DCN3.2 and above (git-fixes).\n- drm/amd/display: Enable new commit sequence only for DCN32x (git-fixes).\n- drm/amd/display: Exit idle optimizations before attempt to access PHY (git-fixes).\n- drm/amd/display: Expand kernel doc for DC (git-fixes).\n- drm/amd/display: Fix a bug when searching for insert_above_mpcc (git-fixes).\n- drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()' (git-fixes).\n- drm/amd/display: Fix possible underflow for displays with large vblank (git-fixes).\n- drm/amd/display: Fix the delta clamping for shaper LUT (git-fixes).\n- drm/amd/display: Fix underflow issue on 175hz timing (git-fixes).\n- drm/amd/display: For prefetch mode \u003e 0, extend prefetch if possible (git-fixes).\n- drm/amd/display: Guard DCN31 PHYD32CLK logic against chip family (git-fixes).\n- drm/amd/display: Guard against invalid RPTR/WPTR being set (git-fixes).\n- drm/amd/display: Handle seamless boot stream (git-fixes).\n- drm/amd/display: Handle virtual hardware detect (git-fixes).\n- drm/amd/display: Include surface of unaffected streams (git-fixes).\n- drm/amd/display: Include udelay when waiting for INBOX0 ACK (git-fixes).\n- drm/amd/display: Increase frame warning limit with KASAN or KCSAN in dml (git-fixes).\n- drm/amd/display: Keep PHY active for dp config (git-fixes).\n- drm/amd/display: Prevent vtotal from being set to 0 (git-fixes).\n- drm/amd/display: Remove min_dst_y_next_start check for Z8 (git-fixes).\n- drm/amd/display: Restore rptr/wptr for DMCUB as workaround (git-fixes).\n- drm/amd/display: Return the correct HDCP error code (stable-fixes).\n- drm/amd/display: Revert vblank change that causes null pointer crash (git-fixes).\n- drm/amd/display: Rework comments on dc file (git-fixes).\n- drm/amd/display: Rework context change check (git-fixes).\n- drm/amd/display: Set minimum requirement for using PSR-SU on Phoenix (git-fixes).\n- drm/amd/display: Set minimum requirement for using PSR-SU on Rembrandt (git-fixes).\n- drm/amd/display: Update OTG instance in the commit stream (git-fixes).\n- drm/amd/display: Update correct DCN314 register header (git-fixes).\n- drm/amd/display: Update min Z8 residency time to 2100 for DCN314 (git-fixes).\n- drm/amd/display: Use DRAM speed from validation for dummy p-state (git-fixes).\n- drm/amd/display: Use DTBCLK as refclk instead of DPREFCLK (git-fixes).\n- drm/amd/display: Use min transition for all SubVP plane add/remove (git-fixes).\n- drm/amd/display: Write to correct dirty_rect (git-fixes).\n- drm/amd/display: Wrong colorimetry workaround (git-fixes).\n- drm/amd/display: add FB_DAMAGE_CLIPS support (git-fixes).\n- drm/amd/display: add ODM case when looking for first split pipe (git-fixes).\n- drm/amd/display: always switch off ODM before committing more streams (git-fixes).\n- drm/amd/display: clean code-style issues in dcn30_set_mpc_shaper_3dlut (git-fixes).\n- drm/amd/display: dc.h: eliminate kernel-doc warnings (git-fixes).\n- drm/amd/display: ensure async flips are only accepted for fast updates (git-fixes).\n- drm/amd/display: fix ABM disablement (git-fixes).\n- drm/amd/display: fix a NULL pointer dereference in amdgpu_dm_i2c_xfer() (git-fixes).\n- drm/amd/display: fix dc/core/dc.c kernel-doc (git-fixes).\n- drm/amd/display: fix hw rotated modes when PSR-SU is enabled (git-fixes).\n- drm/amd/display: fix kernel-doc issues in dc.h (git-fixes).\n- drm/amd/display: fix unbounded requesting for high pixel rate modes on dcn315 (git-fixes).\n- drm/amd/display: handle range offsets in VRR ranges (stable-fixes).\n- drm/amd/display: perform a bounds check before filling dirty rectangles (git-fixes).\n- drm/amd/display: set per pipe dppclk to 0 when dpp is off (git-fixes).\n- drm/amd/display: update extended blank for dcn314 onwards (git-fixes).\n- drm/amd/display: use low clocks for no plane configs (git-fixes).\n- drm/amd/pm: Fix error of MACO flag setting code (git-fixes).\n- drm/amd/pm: fix a memleak in aldebaran_tables_init (git-fixes).\n- drm/amd/smu: use AverageGfxclkFrequency* to replace previous GFX Curr Clock (git-fixes).\n- drm/amd: Enable PCIe PME from D3 (git-fixes).\n- drm/amdgpu/pm: Fix the error of pwm1_enable setting (stable-fixes).\n- drm/amdgpu/pm: make gfxclock consistent for sienna cichlid (git-fixes).\n- drm/amdgpu/pm: make mclk consistent for smu 13.0.7 (git-fixes).\n- drm/amdgpu/smu13: drop compute workload workaround (git-fixes).\n- drm/amdgpu: Enable gpu reset for S3 abort cases on Raven series (stable-fixes).\n- drm/amdgpu: Fix missing break in ATOM_ARG_IMM Case of atom_get_src_int() (git-fixes).\n- drm/amdgpu: Force order between a read and write to the same address (git-fixes).\n- drm/amdgpu: Match against exact bootloader status (git-fixes).\n- drm/amdgpu: Unset context priority is now invalid (git-fixes).\n- drm/amdgpu: Update min() to min_t() in 'amdgpu_info_ioctl' (git-fixes).\n- drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag (stable-fixes).\n- drm/amdgpu: lower CS errors to debug severity (git-fixes).\n- drm/amdkfd: fix TLB flush after unmap for GFX9.4.2 (stable-fixes).\n- drm/bridge: tc358762: Instruct DSI host to generate HSE packets (git-fixes).\n- drm/display: fix typo (git-fixes).\n- drm/edid: Add quirk for OSVR HDK 2.0 (git-fixes).\n- drm/etnaviv: Restore some id values (git-fixes).\n- drm/exynos: do not return negative values from .get_modes() (stable-fixes).\n- drm/exynos: fix a possible null-pointer dereference due to data race in exynos_drm_crtc_atomic_disable() (git-fixes).\n- drm/i915/bios: Tolerate devdata==NULL in intel_bios_encoder_supports_dp_dual_mode() (stable-fixes).\n- drm/i915/gt: Do not generate the command streamer for all the CCS (git-fixes).\n- drm/i915/gt: Reset queue_priority_hint on parking (git-fixes).\n- drm/i915/gt: Use i915_vm_put on ppgtt_create error paths (git-fixes).\n- drm/i915/selftests: Fix dependency of some timeouts on HZ (git-fixes).\n- drm/i915: Add missing CCS documentation (git-fixes).\n- drm/i915: Call intel_pre_plane_updates() also for pipes getting enabled (git-fixes).\n- drm/i915: Check before removing mm notifier (git-fixes).\n- drm/lima: fix a memleak in lima_heap_alloc (git-fixes).\n- drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip (git-fixes).\n- drm/mediatek: dsi: Fix DSI RGB666 formats and definitions (git-fixes).\n- drm/msm/dpu: Only enable DSC_MODE_MULTIPLEX if dsc_merge is enabled (git-fixes).\n- drm/msm/dpu: add division of drm_display_mode's hskew parameter (git-fixes).\n- drm/msm/dpu: fix the programming of INTF_CFG2_DATA_HCTL_EN (git-fixes).\n- drm/msm/dpu: improve DSC allocation (git-fixes).\n- drm/panel-edp: use put_sync in unprepare (git-fixes).\n- drm/panel: Move AUX B116XW03 out of panel-edp back to panel-simple (git-fixes).\n- drm/panel: auo,b101uan08.3: Fine tune the panel power sequence (git-fixes).\n- drm/panel: boe-tv101wum-nl6: Fine tune the panel power sequence (git-fixes).\n- drm/panel: do not return negative error codes from drm_panel_get_modes() (stable-fixes).\n- drm/panfrost: fix power transition timeout warnings (git-fixes).\n- drm/probe-helper: warn about negative .get_modes() (stable-fixes).\n- drm/qxl: remove unused `count` variable from `qxl_surface_id_alloc()` (git-fixes).\n- drm/qxl: remove unused variable from `qxl_process_single_command()` (git-fixes).\n- drm/radeon/ni: Fix wrong firmware size logging in ni_init_microcode() (git-fixes).\n- drm/radeon/ni_dpm: remove redundant NULL check (git-fixes).\n- drm/radeon: remove dead code in ni_mc_load_microcode() (git-fixes).\n- drm/rockchip: dsi: Clean up 'usage_mode' when failing to attach (git-fixes).\n- drm/rockchip: inno_hdmi: Fix video timing (git-fixes).\n- drm/rockchip: lvds: do not overwrite error code (git-fixes).\n- drm/rockchip: lvds: do not print scary message when probing defer (git-fixes).\n- drm/tegra: dpaux: Fix PM disable depth imbalance in tegra_dpaux_probe (git-fixes).\n- drm/tegra: dsi: Add missing check for of_find_device_by_node (git-fixes).\n- drm/tegra: dsi: Fix missing pm_runtime_disable() in the error handling path of tegra_dsi_probe() (git-fixes).\n- drm/tegra: dsi: Fix some error handling paths in tegra_dsi_probe() (git-fixes).\n- drm/tegra: dsi: Make use of the helper function dev_err_probe() (stable-fixes).\n- drm/tegra: hdmi: Convert to devm_platform_ioremap_resource() (stable-fixes).\n- drm/tegra: hdmi: Fix some error handling paths in tegra_hdmi_probe() (git-fixes).\n- drm/tegra: output: Fix missing i2c_put_adapter() in the error handling paths of tegra_output_probe() (git-fixes).\n- drm/tegra: put drm_gem_object ref on error in tegra_fb_create (git-fixes).\n- drm/tegra: rgb: Fix missing clk_put() in the error handling paths of tegra_dc_rgb_probe() (git-fixes).\n- drm/tegra: rgb: Fix some error handling paths in tegra_dc_rgb_probe() (git-fixes).\n- drm/tidss: Fix initial plane zpos values (git-fixes).\n- drm/tidss: Fix sync-lost issue with two displays (git-fixes).\n- drm/ttm: Do not leak a resource on eviction error (git-fixes).\n- drm/ttm: Do not print error message if eviction was interrupted (git-fixes).\n- drm/vc4: Add module dependency on hdmi-codec (git-fixes).\n- drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed (git-fixes).\n- drm/vmwgfx: Fix possible null pointer derefence with invalid contexts (git-fixes).\n- drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node (git-fixes).\n- drm: Do not treat 0 as -1 in drm_fixp2int_ceil (git-fixes).\n- drm: Fix drm_fixp2int_round() making it add 0.5 (git-fixes).\n- drm: panel-orientation-quirks: Add quirk for Acer Switch V 10 (SW5-017) (git-fixes).\n- firewire: core: use long bus reset on gap count error (stable-fixes).\n- fix 'coresight: etm4x: Change etm4_platform_driver driver for MMIO devices' (bsc#1220775) Hunk with clk_put(drvdata-\u003epclk) was incorrectly moved to another function.\n- force config_TCG_TIS_CORE=m on aarch64 for workaround kconfig issues\n- group-source-files.pl: Quote filenames (boo#1221077). The kernel source now contains a file with a space in the name. Add quotes in group-source-files.pl to avoid splitting the filename. Also use -print0 / -0 when updating timestamps.\n- hid: amd_sfh: Update HPD sensor structure elements (git-fixes).\n- hid: lenovo: Add middleclick_workaround sysfs knob for cptkbd (git-fixes).\n- hid: multitouch: Add required quirk for Synaptics 0xcddc device (stable-fixes).\n- hv_netvsc: Calculate correct ring size when PAGE_SIZE is not 4 Kbytes (git-fixes).\n- hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove (git-fixes).\n- hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed (git-fixes).\n- i2c: aspeed: Fix the dummy irq expected print (git-fixes).\n- i2c: i801: Avoid potential double call to gpiod_remove_lookup_table (git-fixes).\n- i2c: wmt: Fix an error handling path in wmt_i2c_probe() (git-fixes).\n- ib/ipoib: fix mcast list locking (git-fixes)\n- iio: dummy_evgen: remove Excess kernel-doc comments (git-fixes).\n- iio: pressure: dlhl60d: Initialize empty DLH bytes (git-fixes).\n- input: gpio_keys_polled - suppress deferred probe error for gpio (stable-fixes).\n- input: synaptics-rmi4 - fix UAF of IRQ domain on driver removal (git-fixes).\n- iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter (git-fixes).\n- iommu/amd: Do not block updates to GATag if guest mode is on (git-fixes).\n- iommu/amd: Fix 'Guest Virtual APIC Table Root Pointer' configuration in IRTE (git-fixes).\n- iommu/amd: Fix domain flush size when syncing iotlb (git-fixes).\n- iommu/amd: Fix error handling for pdev_pri_ats_enable() (git-fixes).\n- iommu/amd: Mark interrupt as managed (git-fixes).\n- iommu/arm-smmu-qcom: Limit the SMR groups to 128 (git-fixes).\n- iommu/arm-smmu-v3: Acknowledge pri/event queue overflow if any (git-fixes).\n- iommu/arm-smmu-v3: Work around MMU-600 erratum 1076982 (git-fixes).\n- iommu/dma: Trace bounce buffer usage when mapping buffers (git-fixes).\n- iommu/fsl: fix all kernel-doc warnings in fsl_pamu.c (git-fixes).\n- iommu/iova: Fix alloc iova overflows issue (git-fixes).\n- iommu/mediatek-v1: Fix an error handling path in mtk_iommu_v1_probe() (git-fixes).\n- iommu/mediatek: Fix forever loop in error handling (git-fixes).\n- iommu/mediatek: Flush IOTLB completely only if domain has been attached (git-fixes).\n- iommu/rockchip: Fix unwind goto issue (git-fixes).\n- iommu/sprd: Release dma buffer to avoid memory leak (git-fixes).\n- iommu/vt-d: Allocate local memory for page request queue (git-fixes).\n- iommu/vt-d: Allow to use flush-queue when first level is default (git-fixes).\n- iommu/vt-d: Allow zero SAGAW if second-stage not supported (git-fixes).\n- iommu/vt-d: Do not issue ATS Invalidation request when device is disconnected (git-fixes).\n- iommu/vt-d: Fix PASID directory pointer coherency (git-fixes).\n- iommu/vt-d: Fix error handling in sva enable/disable paths (git-fixes).\n- iommu/vt-d: Set No Execute Enable bit in PASID table entry (git-fixes).\n- iommu: Fix error unwind in iommu_group_alloc() (git-fixes).\n- kABI: PCI: Add locking to RMW PCI Express Capability Register accessors (kabi).\n- kabi: Adjust trace_iterator.wait_index (git-fixes).\n- kconfig: fix infinite loop when expanding a macro at the end of file (git-fixes).\n- kernel-binary: Fix i386 build Fixes: 89eaf4cdce05 ('rpm templates: Move macro definitions below buildrequires')\n- kernel-binary: Move build script to the end All other spec templates have the build script at the end, only kernel-binary has it in the middle. Align with the other templates.\n- kernel-binary: certs: Avoid trailing space\n- kernel-binary: vdso: fix filelist for non-usrmerged kernel Fixes: a6ad8af207e6 ('rpm templates: Always define usrmerged')\n- kprobes: Fix double free of kretprobe_holder (bsc#1220901).\n- kvm: s390: only deliver the set service event bits (git-fixes bsc#1221631).\n- leds: aw2013: Unlock mutex before destroying it (git-fixes).\n- lib/cmdline: Fix an invalid format specifier in an assertion msg (git-fixes).\n- libnvdimm/of_pmem: Use devm_kstrdup instead of kstrdup and check its return value (git-fixes).\n- libnvdimm/region: Allow setting align attribute on regions without mappings (git-fixes).\n- make nvidia Grace-Hopper TPM related drivers build-ins (bsc#1221156)\n- md/raid1: fix choose next idle in read_balance() (git-fixes).\n- md: Do not clear MD_CLOSING when the raid is about to stop (git-fixes).\n- md: do not clear MD_RECOVERY_FROZEN for new dm-raid until resume (git-fixes).\n- md: fix data corruption for raid456 when reshape restart while grow up (git-fixes).\n- media: dvb-frontends: avoid stack overflow warnings with clang (git-fixes).\n- media: edia: dvbdev: fix a use-after-free (git-fixes).\n- media: em28xx: annotate unchecked call to media_device_register() (git-fixes).\n- media: go7007: add check of return value of go7007_read_addr() (git-fixes).\n- media: go7007: fix a memleak in go7007_load_encoder (git-fixes).\n- media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak (git-fixes).\n- media: pvrusb2: fix pvr2_stream_callback casts (git-fixes).\n- media: pvrusb2: fix uaf in pvr2_context_set_notify (git-fixes).\n- media: pvrusb2: remove redundant NULL check (git-fixes).\n- media: staging: ipu3-imgu: Set fields before media_entity_pads_init() (git-fixes).\n- media: sun8i-di: Fix chroma difference threshold (git-fixes).\n- media: sun8i-di: Fix coefficient writes (git-fixes).\n- media: sun8i-di: Fix power on/off sequences (git-fixes).\n- media: tc358743: register v4l2 async device only after successful setup (git-fixes).\n- media: ttpci: fix two memleaks in budget_av_attach (git-fixes).\n- media: usbtv: Remove useless locks in usbtv_video_free() (git-fixes).\n- media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity (git-fixes).\n- media: v4l2-tpg: fix some memleaks in tpg_alloc (git-fixes).\n- media: xc4000: Fix atomicity violation in xc4000_get_frequency (git-fixes).\n- mfd: altera-sysmgr: Call of_node_put() only when of_parse_phandle() takes a ref (git-fixes).\n- mfd: syscon: Call of_node_put() only when of_parse_phandle() takes a ref (git-fixes).\n- mm,page_owner: Defer enablement of static branch (bsc#1222366).\n- mm,page_owner: Fix accounting of pages when migrating (bsc#1222366).\n- mm,page_owner: Fix printing of stack records (bsc#1222366).\n- mm,page_owner: Fix refcount imbalance (bsc#1222366).\n- mm,page_owner: Update metadata for tail pages (bsc#1222366).\n- mm,page_owner: check for null stack_record before bumping its refcount (bsc#1222366).\n- mm,page_owner: drop unnecessary check (bsc#1222366).\n- mm,page_owner: fix recursion (bsc#1222366).\n- mm/vmalloc: huge vmalloc backing pages should be split rather than compound (bsc#1217829).\n- mmc: core: Avoid negative index with array access (git-fixes).\n- mmc: core: Fix switch on gp3 partition (git-fixes).\n- mmc: core: Initialize mmc_blk_ioc_data (git-fixes).\n- mmc: mmci: stm32: fix DMA API overlapping mappings warning (git-fixes).\n- mmc: mmci: stm32: use a buffer for unaligned DMA requests (git-fixes).\n- mmc: tmio: avoid concurrent runs of mmc_request_done() (git-fixes).\n- mmc: wmt-sdmmc: remove an incorrect release_mem_region() call in the .remove function (git-fixes).\n- mtd: maps: physmap-core: fix flash size larger than 32-bit (git-fixes).\n- mtd: rawnand: lpc32xx_mlc: fix irq handler prototype (git-fixes).\n- mtd: rawnand: meson: fix scrambling mode value in command macro (git-fixes).\n- nd_btt: Make BTT lanes preemptible (git-fixes).\n- net/bnx2x: Prevent access to a freed page in page_pool (bsc#1215322).\n- net/x25: fix incorrect parameter validation in the x25_getsockopt() function (git-fixes).\n- net: Fix features skip in for_each_netdev_feature() (git-fixes).\n- net: lan78xx: fix runtime PM count underflow on link stop (git-fixes).\n- net: ll_temac: platform_get_resource replaced by wrong function (git-fixes).\n- net: mana: Fix Rx DMA datasize and skb_over_panic (git-fixes).\n- net: phy: fix phy_get_internal_delay accessing an empty array (git-fixes).\n- net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr() (git-fixes).\n- net: usb: ax88179_178a: avoid the interface always configured as random address (git-fixes).\n- nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet (git-fixes).\n- nfs: avoid spurious warning of lost lock that is being unlocked (bsc#1221791).\n- nfs: fix an off by one in root_nfs_cat() (git-fixes).\n- nfs: rename nfs_client_kset to nfs_kset (git-fixes).\n- nfsd: change LISTXATTRS cookie encoding to big-endian (git-fixes).\n- nfsd: convert the callback workqueue to use delayed_work (git-fixes).\n- nfsd: do not take fi_lock in nfsd_break_deleg_cb() (git-fixes).\n- nfsd: fix file memleak on client_opens_release (git-fixes).\n- nfsd: fix liSTXATTRS returning a short list with eof=TRUE (git-fixes).\n- nfsd: fix liSTXATTRS returning more bytes than maxcount (git-fixes).\n- nfsd: fix nfsd4_listxattr_validate_cookie (git-fixes).\n- nfsd: lock_rename() needs both directories to live on the same fs (git-fixes).\n- nfsd: reschedule CB operations when backchannel rpc_clnt is shut down (git-fixes).\n- nfsd: reset cb_seq_status after NFS4ERR_DELAY (git-fixes).\n- nfsd: retransmit callbacks after client reconnects (git-fixes).\n- nfsd: use vfs setgid helper (git-fixes).\n- nfsv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT (git-fixes).\n- nfsv4.1: fix SP4_MACH_CRED protection for pnfs IO (git-fixes).\n- nfsv4.1: fixup use EXCHGID4_FLAG_USE_PNFS_DS for DS server (git-fixes).\n- nfsv4.1: use EXCHGID4_FLAG_USE_PNFS_DS for DS server (git-fixes).\n- nfsv4.2: fix listxattr maximum XDR buffer size (git-fixes).\n- nfsv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 (git-fixes).\n- nfsv4.2: fix wrong shrinker_id (git-fixes).\n- nfsv4: fix a nfs4_state_manager() race (git-fixes).\n- nfsv4: fix a state manager thread deadlock regression (git-fixes).\n- nilfs2: fix failure to detect DAT corruption in btree and direct mappings (git-fixes).\n- nilfs2: prevent kernel bug at submit_bh_wbc() (git-fixes).\n- nouveau/dmem: handle kcalloc() allocation failure (git-fixes).\n- nouveau: reset the bo resource bus info after an eviction (git-fixes).\n- ntfs: fix use-after-free in ntfs_ucsncmp() (bsc#1221713).\n- nvdimm/namespace: drop nested variable in create_namespace_pmem() (git-fixes).\n- nvdimm: Allow overwrite in the presence of disabled dimms (git-fixes).\n- nvdimm: Fix badblocks clear off-by-one error (git-fixes).\n- nvdimm: Fix dereference after free in register_nvdimm_pmu() (git-fixes).\n- nvdimm: Fix firmware activation deadlock scenarios (git-fixes).\n- nvdimm: Fix memleak of pmu attr_groups in unregister_nvdimm_pmu() (git-fixes).\n- nvme-fc: do not wait in vain when unloading module (git-fixes).\n- nvme: fix reconnection fail due to reserved tag allocation (git-fixes).\n- nvmet-fc: abort command when there is no binding (git-fixes).\n- nvmet-fc: avoid deadlock on delete association path (git-fixes).\n- nvmet-fc: defer cleanup using RCU properly (git-fixes).\n- nvmet-fc: hold reference on hostport match (git-fixes).\n- nvmet-fc: release reference on target port (git-fixes).\n- nvmet-fc: take ref count on tgtport before delete assoc (git-fixes).\n- nvmet-fcloop: swap the list_add_tail arguments (git-fixes).\n- nvmet-tcp: fix nvme tcp ida memory leak (git-fixes).\n- pNFS/flexfiles: Check the layout validity in ff_layout_mirror_prepare_stats (git-fixes).\n- pNFS: Fix a hang in nfs4_evict_inode() (git-fixes).\n- pNFS: Fix the pnfs block driver's calculation of layoutget size (git-fixes).\n- pci/aer: Block runtime suspend when handling errors (git-fixes).\n- pci/aer: fix rootport attribute paths in ABI docs (git-fixes).\n- pci/aspm: use RMW accessors for changing LNKCTL (git-fixes).\n- pci/dpc: Quirk PIO log size for Intel Ice Lake Root Ports (git-fixes).\n- pci/dpc: Quirk PIO log size for Intel Raptor Lake Root Ports (git-fixes).\n- pci/dpc: Quirk PIO log size for certain Intel Root Ports (git-fixes).\n- pci/dpc: print all TLP Prefixes, not just the first (git-fixes).\n- pci/msi: prevent MSI hardware interrupt number truncation (bsc#1218777)\n- pci/p2pdma: Fix a sleeping issue in a RCU read section (git-fixes).\n- pci/pm: Drain runtime-idle callbacks before driver removal (git-fixes).\n- pci: Drop pci_device_remove() test of pci_dev-\u003edriver (git-fixes).\n- pci: add locking to RMW PCI Express Capability Register accessors (git-fixes).\n- pci: dwc: endpoint: Fix advertised resizable BAR size (git-fixes).\n- pci: dwc: endpoint: Fix dw_pcie_ep_raise_msix_irq() alignment support (git-fixes).\n- pci: dwc: fix a 64bit bug in dw_pcie_ep_raise_msix_irq() (git-fixes).\n- pci: fu740: Set the number of MSI vectors (git-fixes).\n- pci: lengthen reset delay for VideoPropulsion Torrent QN16e card (git-fixes).\n- pci: make link retraining use RMW accessors for changing LNKCTL (git-fixes).\n- pci: mark 3ware-9650SE Root Port Extended Tags as broken (git-fixes).\n- pci: mediatek-gen3: Fix translation window size calculation (git-fixes).\n- pci: mediatek: Clear interrupt status before dispatching handler (git-fixes).\n- pci: qcom: enable BDF to SID translation properly (git-fixes).\n- pci: qcom: use DWC helpers for modifying the read-only DBI registers (git-fixes).\n- pci: rockchip: Do not advertise MSI-X in PCIe capabilities (git-fixes).\n- pci: rockchip: Fix window mapping and address translation for endpoint (git-fixes).\n- pci: rockchip: Use 64-bit mask on MSI 64-bit PCI address (git-fixes).\n- pci: switchtec: Fix an error handling path in switchtec_pci_probe() (git-fixes).\n- pci_iounmap(): Fix MMIO mapping leak (git-fixes).\n- pinctrl: mediatek: Drop bogus slew rate register range for MT8192 (git-fixes).\n- platform/mellanox: mlxreg-hotplug: Remove redundant NULL-check (git-fixes).\n- pm: suspend: Set mem_sleep_current during kernel command line setup (git-fixes).\n- powerpc/64s: POWER10 CPU Kconfig build option (bsc#1194869).\n- powerpc/boot: Disable power10 features after BOOTAFLAGS assignment (bsc#1194869).\n- powerpc/boot: Fix boot wrapper code generation with CONFIG_POWER10_CPU (bsc#1194869).\n- powerpc/lib/sstep: Do not use __{get/put}_user() on kernel addresses (bsc#1194869).\n- powerpc/lib/sstep: Remove unneeded #ifdef __powerpc64__ (bsc#1194869).\n- powerpc/lib/sstep: Use l1_dcache_bytes() instead of opencoding (bsc#1194869).\n- powerpc/lib/sstep: use truncate_if_32bit() (bsc#1194869).\n- powerpc/pseries/iommu: IOMMU table is not initialized for kdump over SR-IOV (bsc#1220492 ltc#205270).\n- powerpc/pseries/iommu: LPAR panics when rebooted with a frozen PE (bsc#1222011 ltc#205900).\n- powerpc/pseries: Fix potential memleak in papr_get_attr() (bsc#1200465 ltc#197256 jsc#SLE-18130 git-fixes).\n- powerpc/sstep: Use bitwise instead of arithmetic operator for flags (bsc#1194869).\n- powerpc: add compile-time support for lbarx, lharx (bsc#1194869).\n- pwm: mediatek: Update kernel doc for struct pwm_mediatek_of_data (git-fixes).\n- qedf: Do not process stag work during unload (bsc#1214852).\n- qedf: Wait for stag work during unload (bsc#1214852).\n- raid1: fix use-after-free for original bio in raid1_write_request() (bsc#1221097).\n- ras/amd/fmpm: Add debugfs interface to print record entries (jsc#PED-7619).\n- ras/amd/fmpm: Avoid NULL ptr deref in get_saved_records() (jsc#PED-7619).\n- ras/amd/fmpm: Fix build when debugfs is not enabled (jsc#PED-7619).\n- ras/amd/fmpm: Fix off by one when unwinding on error (jsc#PED-7619).\n- ras/amd/fmpm: Safely handle saved records of various sizes (jsc#PED-7619).\n- ras/amd/fmpm: Save SPA values (jsc#PED-7619).\n- ras: Avoid build errors when CONFIG_DEBUG_FS=n (git-fixes).\n- ras: Avoid build errors when CONFIG_DEBUG_FS=n (jsc#PED-7619).\n- ras: export helper to get ras_debugfs_dir (jsc#PED-7619).\n- rdma/cm: add timeout to cm_destroy_id wait (git-fixes)\n- rdma/device: Fix a race between mad_client and cm_client init (git-fixes)\n- rdma/hns: fix mis-modifying default congestion control algorithm (git-fixes)\n- rdma/ipoib: Fix error code return in ipoib_mcast_join (git-fixes)\n- rdma/irdma: Remove duplicate assignment (git-fixes)\n- rdma/mana_ib: Fix bug in creation of dma regions (git-fixes).\n- rdma/mlx5: fix fortify source warning while accessing Eth segment (git-fixes)\n- rdma/mlx5: relax DEVX access upon modify commands (git-fixes)\n- rdma/rtrs-clt: Check strnlen return len in sysfs mpath_policy_store() (git-fixes)\n- rdma/srpt: do not register event handler until srpt device is fully setup (git-fixes)\n- ring-buffer: Do not set shortest_full when full target is hit (git-fixes).\n- ring-buffer: Fix full_waiters_pending in poll (git-fixes).\n- ring-buffer: Fix resetting of shortest_full (git-fixes).\n- ring-buffer: Fix waking up ring buffer readers (git-fixes).\n- ring-buffer: Make wake once of ring_buffer_wait() more robust (git-fixes).\n- ring-buffer: Use wait_event_interruptible() in ring_buffer_wait() (git-fixes).\n- rtc: mt6397: select IRQ_DOMAIN instead of depending on it (git-fixes).\n- s390/pai: fix attr_event_free upper limit for pai device drivers (git-fixes bsc#1221633).\n- s390/vfio-ap: realize the VFIO_DEVICE_GET_IRQ_INFO ioctl (bsc#1205316).\n- s390/vfio-ap: realize the VFIO_DEVICE_SET_IRQS ioctl (bsc#1205316).\n- s390/vfio-ap: wire in the vfio_device_ops request callback (bsc#1205316).\n- s390/vtime: fix average steal time calculation (git-fixes bsc#1221951).\n- sched/rt: Disallow writing invalid values to sched_rt_period_us (bsc#1220176).\n- sched/rt: sysctl_sched_rr_timeslice show default timeslice after reset (bsc#1220176).\n- scsi: lpfc: Copyright updates for 14.4.0.1 patches (bsc#1221777).\n- scsi: lpfc: Correct size for cmdwqe/rspwqe for memset() (bsc#1221777).\n- scsi: lpfc: Correct size for wqe for memset() (bsc#1221777).\n- scsi: lpfc: Define lpfc_dmabuf type for ctx_buf ptr (bsc#1221777).\n- scsi: lpfc: Define lpfc_nodelist type for ctx_ndlp ptr (bsc#1221777).\n- scsi: lpfc: Define types in a union for generic void *context3 ptr (bsc#1221777).\n- scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (bsc#1221777).\n- scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1221777).\n- scsi: lpfc: Remove IRQF_ONESHOT flag from threaded IRQ handling (bsc#1221777 bsc#1217959).\n- scsi: lpfc: Remove unnecessary log message in queuecommand path (bsc#1221777).\n- scsi: lpfc: Replace hbalock with ndlp lock in lpfc_nvme_unregister_port() (bsc#1221777).\n- scsi: lpfc: Update lpfc version to 14.4.0.1 (bsc#1221777).\n- scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic (bsc#1221777).\n- scsi: lpfc: Use a dedicated lock for ras_fwlog state (bsc#1221777).\n- scsi: qedf: Remove set but unused variable 'page' (bsc#1214852).\n- scsi: qedf: Remove unused 'num_handled' variable (bsc#1214852).\n- scsi: qedf: Remove unused declaration (bsc#1214852).\n- scsi: qla2xxx: Change debug message during driver unload (bsc1221816).\n- scsi: qla2xxx: Delay I/O Abort on PCI error (bsc1221816).\n- scsi: qla2xxx: Fix N2N stuck connection (bsc1221816).\n- scsi: qla2xxx: Fix command flush on cable pull (bsc1221816).\n- scsi: qla2xxx: Fix double free of fcport (bsc1221816).\n- scsi: qla2xxx: Fix double free of the ha-\u003evp_map pointer (bsc1221816).\n- scsi: qla2xxx: NVME|FCP prefer flag not being honored (bsc1221816).\n- scsi: qla2xxx: Prevent command send on chip reset (bsc1221816).\n- scsi: qla2xxx: Split FCE|EFT trace control (bsc1221816).\n- scsi: qla2xxx: Update manufacturer detail (bsc1221816).\n- scsi: qla2xxx: Update version to 10.02.09.200-k (bsc1221816).\n- scsi: storvsc: Fix ring buffer size calculation (git-fixes).\n- scsi: target: core: Silence the message about unknown VPD pages (bsc#1221252).\n- selftests/bpf: add generic BPF program tester-loader (bsc#1222033).\n- serial: 8250_exar: Do not remove GPIO device on suspend (git-fixes).\n- serial: max310x: fix syntax error in IRQ error message (git-fixes).\n- slimbus: core: Remove usage of the deprecated ida_simple_xx() API (git-fixes).\n- soc: fsl: qbman: Always disable interrupts when taking cgr_lock (git-fixes).\n- spi: lm70llp: fix links in doc and comments (git-fixes).\n- spi: spi-mt65xx: Fix NULL pointer access in interrupt handler (git-fixes).\n- sr9800: Add check for usbnet_get_endpoints (git-fixes).\n- stackdepot: rename pool_index to pool_index_plus_1 (git-fixes).\n- staging: vc04_services: fix information leak in create_component() (git-fixes).\n- sunrpc: Add an IS_ERR() check back to where it was (git-fixes).\n- sunrpc: ECONNRESET might require a rebind (git-fixes).\n- sunrpc: Fix RPC client cleaned up the freed pipefs dentries (git-fixes).\n- sunrpc: Fix a suspicious RCU usage warning (git-fixes).\n- sunrpc: fix a memleak in gss_import_v2_context (git-fixes).\n- sunrpc: fix some memleaks in gssx_dec_option_array (git-fixes).\n- svcrdma: Drop connection after an RDMA Read error (git-fixes).\n- tracing/ring-buffer: Fix wait_on_pipe() race (git-fixes).\n- tracing: Have saved_cmdlines arrays all in one allocation (git-fixes).\n- tracing: Remove precision vsnprintf() check from print event (git-fixes).\n- tracing: Use .flush() call to wake up readers (git-fixes).\n- tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc (bsc#1222619).\n- tty: serial: fsl_lpuart: avoid idle preamble pending if CTS is enabled (git-fixes).\n- tty: serial: samsung: fix tx_empty() to return TIOCSER_TEMT (git-fixes).\n- tty: vt: fix 20 vs 0x20 typo in EScsiignore (git-fixes).\n- ubifs: Queue up space reservation tasks if retrying many times (git-fixes).\n- ubifs: Remove unreachable code in dbg_check_ltab_lnum (git-fixes).\n- ubifs: Set page uptodate in the correct place (git-fixes).\n- ubifs: dbg_check_idx_size: Fix kmemleak if loading znode failed (git-fixes).\n- ubifs: fix sort function prototype (git-fixes).\n- usb: audio-v2: Correct comments for struct uac_clock_selector_descriptor (git-fixes).\n- usb: cdc-wdm: close race between read and workqueue (git-fixes).\n- usb: core: Fix deadlock in usb_deauthorize_interface() (git-fixes).\n- usb: dwc2: gadget: Fix exiting from clock gating (git-fixes).\n- usb: dwc2: gadget: LPM flow fix (git-fixes).\n- usb: dwc2: host: Fix ISOC flow in DDMA mode (git-fixes).\n- usb: dwc2: host: Fix hibernation flow (git-fixes).\n- usb: dwc2: host: Fix remote wakeup from hibernation (git-fixes).\n- usb: dwc3: Properly set system wakeup (git-fixes).\n- usb: gadget: ncm: Fix handling of zero block length packets (git-fixes).\n- usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin (git-fixes).\n- usb: port: Do not try to peer unused USB ports based on location (git-fixes).\n- usb: typec: Return size of buffer if pd_set operation succeeds (git-fixes).\n- usb: typec: ucsi: Check for notifications after init (git-fixes).\n- usb: typec: ucsi: Clean up UCSI_CABLE_PROP macros (git-fixes).\n- usb: typec: ucsi: Clear EVENT_PENDING under PPM lock (git-fixes).\n- usb: usb-storage: Prevent divide-by-0 error in isd200_ata_command (git-fixes).\n- usb: xhci: Add error handling in xhci_map_urb_for_dma (git-fixes).\n- vboxsf: Avoid an spurious warning if load_nls_xxx() fails (git-fixes).\n- vdpa/mlx5: Allow CVQ size changes (git-fixes).\n- vt: fix unicode buffer corruption when deleting characters (git-fixes).\n- watchdog: stm32_iwdg: initialize default timeout (git-fixes).\n- wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() (git-fixes).\n- wifi: ath11k: decrease MHI channel buffer length to 8KB (bsc#1207948).\n- wifi: ath11k: initialize rx_mcs_80 and rx_mcs_160 before use (git-fixes).\n- wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete (git-fixes).\n- wifi: b43: Disable QoS for bcm4331 (git-fixes).\n- wifi: b43: Stop correct queue in DMA worker when QoS is disabled (git-fixes).\n- wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled (git-fixes).\n- wifi: b43: Stop/wake correct queue in PIO Tx path when QoS is disabled (git-fixes).\n- wifi: brcmfmac: fix copyright year mentioned in platform_data header (git-fixes).\n- wifi: brcmsmac: avoid function pointer casts (git-fixes).\n- wifi: iwlwifi: dbg-tlv: ensure NUL termination (git-fixes).\n- wifi: iwlwifi: fix EWRD table validity check (git-fixes).\n- wifi: iwlwifi: fw: do not always use FW dump trig (git-fixes).\n- wifi: iwlwifi: mvm: do not set replay counters to 0xff (git-fixes).\n- wifi: iwlwifi: mvm: report beacon protection failures (git-fixes).\n- wifi: iwlwifi: mvm: rfi: fix potential response leaks (git-fixes).\n- wifi: iwlwifi: mvm: use FW rate for non-data only on new devices (git-fixes).\n- wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer() (git-fixes).\n- wifi: mwifiex: debugfs: Drop unnecessary error check for debugfs_create_dir() (git-fixes).\n- wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work (git-fixes).\n- wifi: rtw88: 8821c: Fix false alarm count (git-fixes).\n- wifi: wilc1000: fix RCU usage in connect path (git-fixes).\n- wifi: wilc1000: fix declarations ordering (stable-fixes).\n- wifi: wilc1000: fix multi-vif management when deleting a vif (git-fixes).\n- wifi: wilc1000: prevent use-after-free on vif when cleaning up all interfaces (git-fixes).\n- x86/CPU/AMD: Update the Zenbleed microcode revisions (git-fixes).\n- x86/bugs: Fix the SRSO mitigation on Zen3/4 (git-fixes).\n- x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD (git-fixes).\n- x86/xen: Add some null pointer checking to smp.c (git-fixes).\n- x86/xen: add CPU dependencies for 32-bit build (git-fixes).\n- x86/xen: fix percpu vcpu_info allocation (git-fixes).\n- xen-netback: properly sync TX responses (git-fixes).\n- xen-netfront: Add missing skb_mark_for_recycle (git-fixes).\n- xen/gntdev: Fix the abuse of underlying struct page in DMA-buf import (git-fixes).\n- xen/xenbus: document will_handle argument for xenbus_watch_path() (git-fixes).\n- xhci: handle isoc Babble and Buffer Overrun events properly (git-fixes).\n- xhci: process isoc TD properly when there was a transaction error mid TD (git-fixes).\n","status":"published","published":"2024-05-03T07:54:25Z","modified":"2026-02-04T03:36:21.688453Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1659-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2024-26760: Fixed scsi/target/pscsi bio_put() for error case (bsc#1222596).\n- CVE-2024-27389: Fixed pstore inode handling with d_invalidate() (bsc#1223705).\n- CVE-2024-27062: Fixed nouveau lock inside client object tree (bsc#1223834).\n- CVE-2024-27056: Fixed wifi/iwlwifi/mvm to ensure offloading TID queue exists (bsc#1223822).\n- CVE-2024-27046: Fixed nfp/flower handling acti_netdevs allocation failure (bsc#1223827).\n- CVE-2024-27043: Fixed a use-after-free in edia/dvbdev in different places (bsc#1223824).\n- CVE-2024-27041: Fixed drm/amd/display NULL checks for adev-\u003edm.dc in amdgpu_dm_fini() (bsc#1223714).\n- CVE-2024-27039: Fixed clk/hisilicon/hi3559a an erroneous devm_kfree() (bsc#1223821).\n- CVE-2024-27038: Fixed clk_core_get NULL pointer dereference (bsc#1223816).\n- CVE-2024-27030: Fixed octeontx2-af to use separate handlers for interrupts (bsc#1223790).\n- CVE-2024-27014: Fixed net/mlx5e to prevent deadlock while disabling aRFS (bsc#1223735).\n- CVE-2024-27013: Fixed tun limit printing rate when illegal packet received by tun device (bsc#1223745).\n- CVE-2024-26993: Fixed fs/sysfs reference leak in sysfs_break_active_protection() (bsc#1223693).\n- CVE-2024-26982: Fixed Squashfs inode number check not to be an invalid value of zero (bsc#1223634).\n- CVE-2024-26970: Fixed clk/qcom/gcc-ipq6018 termination of frequency table arrays (bsc#1223644).\n- CVE-2024-26969: Fixed clk/qcom/gcc-ipq8074 termination of frequency table arrays (bsc#1223645).\n- CVE-2024-26966: Fixed clk/qcom/mmcc-apq8084 termination of frequency table arrays (bsc#1223646).\n- CVE-2024-26965: Fixed clk/qcom/mmcc-msm8974 termination of frequency table arrays (bsc#1223648).\n- CVE-2024-26960: Fixed mm/swap race between free_swap_and_cache() and swapoff() (bsc#1223655).\n- CVE-2024-26951: Fixed wireguard/netlink check for dangling peer via is_dead instead of empty list (bsc#1223660).\n- CVE-2024-26950: Fixed wireguard/netlink to access device through ctx instead of peer (bsc#1223661).\n- CVE-2024-26948: Fixed drm/amd/display by adding dc_state NULL check in dc_state_release (bsc#1223664).\n- CVE-2024-26927: Fixed ASoC/SOF bounds checking to firmware data Smatch (bsc#1223525).\n- CVE-2024-26901: Fixed do_sys_name_to_handle() to use kzalloc() to prevent kernel-infoleak (bsc#1223198).\n- CVE-2024-26896: Fixed wifi/wfx memory leak when starting AP (bsc#1223042).\n- CVE-2024-26893: Fixed firmware/arm_scmi for possible double free in SMC transport cleanup path (bsc#1223196).\n- CVE-2024-26885: Fixed bpf DEVMAP_HASH overflow check on 32-bit arches (bsc#1223190).\n- CVE-2024-26884: Fixed bpf hashtab overflow check on 32-bit arches (bsc#1223189).\n- CVE-2024-26883: Fixed bpf stackmap overflow check on 32-bit arches (bsc#1223035).\n- CVE-2024-26882: Fixed net/ip_tunnel to make sure to pull inner header in ip_tunnel_rcv() (bsc#1223034).\n- CVE-2024-26881: Fixed net/hns3 kernel crash when 1588 is received on HIP08 devices (bsc#1223041).\n- CVE-2024-26879: Fixed clk/meson by adding missing clocks to axg_clk_regmaps (bsc#1223066).\n- CVE-2024-26878: Fixed quota for potential NULL pointer dereference (bsc#1223060).\n- CVE-2024-26866: Fixed spi/spi-fsl-lpspi by removing redundant spi_controller_put call (bsc#1223024).\n- CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).\n- CVE-2024-26861: Fixed wireguard/receive annotate data-race around receiving_counter.counter (bsc#1223076).\n- CVE-2024-26857: Fixed geneve to make sure to pull inner header in geneve_rx() (bsc#1223058).\n- CVE-2024-26856: Fixed use-after-free inside sparx5_del_mact_entry (bsc#1223052).\n- CVE-2024-26855: Fixed net/ice potential NULL pointer dereference in ice_bridge_setlink() (bsc#1223051).\n- CVE-2024-26853: Fixed igc returning frame twice in XDP_REDIRECT (bsc#1223061).\n- CVE-2024-26852: Fixed net/ipv6 to avoid possible UAF in ip6_route_mpath_notify() (bsc#1223057).\n- CVE-2024-26848: Fixed afs endless loop in directory parsing (bsc#1223030).\n- CVE-2024-26836: Fixed platform/x86/think-lmi password opcode ordering for workstations (bsc#1222968).\n- CVE-2024-26830: Fixed i40e to not allow untrusted VF to remove administratively set MAC (bsc#1223012).\n- CVE-2024-26817: Fixed amdkfd to use calloc instead of kzalloc to avoid integer overflow (bsc#1222812).\n- CVE-2024-26816: Fixed relocations in .notes section when building with CONFIG_XEN_PV=y by ignoring them (bsc#1222624).\n- CVE-2024-26807: Fixed spi/cadence-qspi NULL pointer reference in runtime PM hooks (bsc#1222801).\n- CVE-2024-26805: Fixed a kernel-infoleak-after-free in __skb_datagram_iter in netlink  (bsc#1222630).\n- CVE-2024-26793: Fixed an use-after-free and null-ptr-deref in gtp_newlink() in gtp  (bsc#1222428).\n- CVE-2024-26783: Fixed mm/vmscan bug when calling wakeup_kswapd() with a wrong zone index (bsc#1222615).\n- CVE-2024-26773: Fixed ext4 block allocation from corrupted group in ext4_mb_try_best_found() (bsc#1222618).\n- CVE-2024-26772: Fixed ext4 to avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() (bsc#1222613).\n- CVE-2024-26771: Fixed a null pointer dereference on edma_probe in dmaengine ti edma  (bsc#1222610)\n- CVE-2024-26766: Fixed SDMA off-by-one error in _pad_sdma_tx_descs() (bsc#1222726).\n- CVE-2024-26764: Fixed IOCB_AIO_RW check in fs/aio before the struct aio_kiocb conversion (bsc#1222721).\n- CVE-2024-26763: Fixed user corruption via by writing data with O_DIRECT on device in dm-crypt (bsc#1222720).\n- CVE-2024-26754: Fixed an use-after-free and null-ptr-deref in gtp_genl_dump_pdp() in gtp  (bsc#1222632).\n- CVE-2024-26751: Fixed ARM/ep93xx terminator to gpiod_lookup_table (bsc#1222724).\n- CVE-2024-26744: Fixed null pointer dereference in srpt_service_guid parameter in rdma/srpt (bsc#1222449).\n- CVE-2024-26743: Fixed memory leak in qedr_create_user_qp error flow in rdma/qedr (bsc#1222677).\n- CVE-2024-26737: Fixed selftests/bpf racing between bpf_timer_cancel_and_free and bpf_timer_cancel (bsc#1222557).\n- CVE-2024-26733: Fixed an overflow in arp_req_get() in arp (bsc#1222585).\n- CVE-2024-26727: Fixed assertion if a newly created btrfs subvolume already gets read (bsc#1222536).\n- CVE-2024-26718: Fixed dm-crypt/dm-verity disable tasklets (bsc#1222416).\n- CVE-2024-26704: Fixed a double-free of blocks due to wrong extents moved_len in ext4 (bsc#1222422).\n- CVE-2024-26696: Fixed nilfs2 hang in nilfs_lookup_dirty_data_buffers() (bsc#1222549).\n- CVE-2024-26689: Fixed a use-after-free in encode_cap_msg() (bsc#1222503).\n- CVE-2024-26687: Fixed xen/events close evtchn after mapping cleanup (bsc#1222435).\n- CVE-2024-26685: Fixed nilfs2 potential bug in end_buffer_async_write (bsc#1222437).\n- CVE-2024-26684: Fixed net/stmmac/xgmac handling of DPP safety error for DMA channels (bsc#1222445).\n- CVE-2024-26681: Fixed netdevsim to avoid potential loop in nsim_dev_trap_report_work() (bsc#1222431).\n- CVE-2024-26680: Fixed net/atlantic DMA mapping for PTP hwts ring (bsc#1222427).\n- CVE-2024-26675: Fixed ppp_async to limit MRU to 64K (bsc#1222379).\n- CVE-2024-26673: Fixed netfilter/nft_ct layer 3 and 4 protocol sanitization (bsc#1222368).\n- CVE-2024-26671: Fixed blk-mq IO hang from sbitmap wakeup race (bsc#1222357).\n- CVE-2024-26660: Fixed drm/amd/display bounds check for stream encoder creation (bsc#1222266).\n- CVE-2024-26656: Fixed drm/amdgpu use-after-free bug (bsc#1222307).\n- CVE-2024-26610: Fixed memory corruption in wifi/iwlwifi (bsc#1221299).\n- CVE-2024-26601: Fixed ext4 buddy bitmap corruption via fast commit replay (bsc#1220342).\n- CVE-2024-23850: Fixed double free of anonymous device after snapshot  creation failure (bsc#1219126).\n- CVE-2024-23848: Fixed media/cec for possible use-after-free in cec_queue_msg_fh (bsc#1219104).\n- CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1219169).\n- CVE-2024-22099: Fixed a null-pointer-dereference in rfcomm_check_security (bsc#1219170).\n- CVE-2024-0841: Fixed a null pointer dereference in the hugetlbfs_fill_super function in hugetlbfs (HugeTLB pages) functionality (bsc#1219264).\n- CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init in net/sctp/socket.c (bsc#1218917).\n- CVE-2023-6270: Fixed a use-after-free issue in aoecmd_cfg_pkts (bsc#1218562).\n- CVE-2023-52652: Fixed NTB for possible name leak in ntb_register_device() (bsc#1223686).\n- CVE-2023-52645: Fixed pmdomain/mediatek race conditions with genpd (bsc#1223033).\n- CVE-2023-52636: Fixed libceph cursor init when preparing sparse read in msgr2 (bsc#1222247).\n- CVE-2023-52635: Fixed PM/devfreq to synchronize devfreq_monitor_[start/stop] (bsc#1222294).\n- CVE-2023-52627: Fixed iio:adc:ad7091r exports into IIO_AD7091R namespace (bsc#1222051).\n- CVE-2023-52620: Fixed netfilter/nf_tables to disallow timeout for anonymous sets never used from userspace (bsc#1221825).\n- CVE-2023-52616: Fixed unexpected pointer access in crypto/lib/mpi in mpi_ec_init (bsc#1221612).\n- CVE-2023-52614: Fixed PM/devfreq buffer overflow in trans_stat_show (bsc#1221617).\n- CVE-2023-52593: Fixed wifi/wfx possible NULL pointer dereference in wfx_set_mfp_ap() (bsc#1221042).\n- CVE-2023-52591: Fixed a possible reiserfs filesystem corruption via directory renaming (bsc#1221044).\n- CVE-2023-52590: Fixed a possible ocfs2 filesystem corruption via directory renaming (bsc#1221088).\n- CVE-2023-52589: Fixed media/rkisp1 IRQ disable race issue (bsc#1221084).\n- CVE-2023-52585: Fixed drm/amdgpu for possible NULL pointer dereference in amdgpu_ras_query_error_status_helper() (bsc#1221080).\n- CVE-2023-52561: Fixed arm64/dts/qcom/sdm845-db845c to mark cont splash memory region (bsc#1220935).\n- CVE-2023-52503: Fixed tee/amdtee use-after-free vulnerability in amdtee_close_session (bsc#1220915).\n- CVE-2023-52488: Fixed serial/sc16is7xx convert from _raw_ to _noinc_ regmap functions for FIFO (bsc#1221162).\n- CVE-2022-48662: Fixed a general protection fault (GPF) in i915_perf_open_ioctl (bsc#1223505).\n- CVE-2022-48659: Fixed mm/slub to return errno if kmalloc() fails (bsc#1223498).\n- CVE-2022-48658: Fixed mm/slub to avoid a problem in flush_cpu_slab()/__free_slab() task context (bsc#1223496).\n- CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb-\u003emac_header (bsc#1223513).\n- CVE-2022-48642: Fixed netfilter/nf_tables percpu memory leak at nf_tables_addchain() (bsc#1223478).\n- CVE-2022-48640: Fixed bonding for possible NULL pointer dereference in bond_rr_gen_slave_id (bsc#1223499).\n- CVE-2022-48631: Fixed a bug in ext4, when parsing extents where eh_entries == 0 and eh_depth \u003e 0 (bsc#1223475).\n- CVE-2021-47214: Fixed hugetlb/userfaultfd during restore reservation in hugetlb_mcopy_atomic_pte() (bsc#1222710).\n- CVE-2021-47202: Fixed NULL pointer dereferences in of_thermal_ functions (bsc#1222878)\n- CVE-2021-47200: Fixed drm/prime for possible use-after-free in mmap within drm_gem_ttm_mmap() and drm_gem_ttm_mmap() (bsc#1222838).\n- CVE-2021-47195: Fixed use-after-free inside SPI via add_lock mutex (bsc#1222832).\n- CVE-2021-47189: Fixed denial of service due to memory ordering issues between normal and ordered work functions in btrfs (bsc#1222706).\n- CVE-2021-47185: Fixed a softlockup issue in flush_to_ldisc in tty tty_buffer (bsc#1222669).\n- CVE-2021-47183: Fixed a null pointer dereference during link down processing in scsi lpfc (bsc#1192145, bsc#1222664).\n- CVE-2021-47182: Fixed scsi_mode_sense() buffer length handling (bsc#1222662).\n- CVE-2021-47181: Fixed a null pointer dereference caused by calling platform_get_resource()  (bsc#1222660).\n\nThe following non-security bugs were fixed:\n\n- ALSA: firewire-lib: handle quirk to calculate payload quadlets as data block counter (stable-fixes).\n- ALSA: hda/realtek - Enable audio jacks of Haier Boyue G42 with ALC269VC (stable-fixes).\n- ALSA: hda/realtek - Fix inactive headset mic jack (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP SnowWhite laptops (stable-fixes).\n- ALSA: hda/realtek: Fix mute led of HP Laptop 15-da3001TU (stable-fixes).\n- ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node() (git-fixes).\n- ALSA: scarlett2: Add Focusrite Clarett 2Pre and 4Pre USB support (stable-fixes).\n- ALSA: scarlett2: Add Focusrite Clarett+ 2Pre and 4Pre support (stable-fixes).\n- ALSA: scarlett2: Add correct product series name to messages (stable-fixes).\n- ALSA: scarlett2: Add support for Clarett 8Pre USB (stable-fixes).\n- ALSA: scarlett2: Default mixer driver to enabled (stable-fixes).\n- ALSA: scarlett2: Move USB IDs out from device_info struct (stable-fixes).\n- ASoC: meson: axg-card: make links nonatomic (git-fixes).\n- ASoC: meson: axg-tdm-interface: manage formatters in trigger (git-fixes).\n- ASoC: meson: cards: select SND_DYNAMIC_MINORS (git-fixes).\n- ASoC: soc-core.c: Skip dummy codec when adding platforms (stable-fixes).\n- ASoC: tegra: Fix DSPK 16-bit playback (git-fixes).\n- ASoC: ti: davinci-mcasp: Fix race condition during probe (git-fixes).\n- Bluetooth: Add new quirk for broken read key length on ATS2851 (git-fixes).\n- Bluetooth: Fix TOCTOU in HCI debugfs implementation (git-fixes).\n- Bluetooth: Fix memory leak in hci_req_sync_complete() (git-fixes).\n- Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old() (stable-fixes).\n- Bluetooth: L2CAP: Fix not validating setsockopt user input (git-fixes).\n- Bluetooth: RFCOMM: Fix not validating setsockopt user input (git-fixes).\n- Bluetooth: SCO: Fix not validating setsockopt user input (git-fixes).\n- Bluetooth: add quirk for broken address properties (git-fixes).\n- Bluetooth: btintel: Fix null ptr deref in btintel_read_version (stable-fixes).\n- Bluetooth: btintel: Fixe build regression (git-fixes).\n- Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0bda:0x4853 (stable-fixes).\n- Bluetooth: hci_event: Fix sending HCI_OP_READ_ENC_KEY_SIZE (git-fixes).\n- Bluetooth: hci_event: set the conn encrypted before conn establishes (stable-fixes).\n- Bluetooth: hci_sock: Fix not validating setsockopt user input (git-fixes).\n- Bluetooth: qca: fix NULL-deref on non-serdev suspend (git-fixes).\n- Documentation: Add missing documentation for EXPORT_OP flags (stable-fixes).\n- HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev-\u003edevc (git-fixes).\n- HID: logitech-dj: allow mice to use all types of reports (git-fixes).\n- HID: uhid: Use READ_ONCE()/WRITE_ONCE() for -\u003erunning (stable-fixes).\n- Input: synaptics-rmi4 - fail probing if memory allocation for 'phys' fails (stable-fixes).\n- NFC: trf7970a: disable all regulators on removal (git-fixes).\n- NFS: avoid spurious warning of lost lock that is being unlocked (bsc#1221791).\n- PCI/AER: Block runtime suspend when handling errors (git-fixes).\n- PCI/DPC: Quirk PIO log size for Intel Ice Lake Root Ports (git-fixes).\n- PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports (git-fixes).\n- PCI/DPC: Quirk PIO log size for certain Intel Root Ports (git-fixes).\n- PCI/PM: Drain runtime-idle callbacks before driver removal (git-fixes).\n- PCI: Drop pci_device_remove() test of pci_dev-\u003edriver (git-fixes).\n- PCI: rpaphp: Error out on busy status from get-sensor-state (bsc#1223369 ltc#205888).\n- RAS: Avoid build errors when CONFIG_DEBUG_FS=n (jsc#PED-7619).\n- RDMA/cm: Print the old state when cm_destroy_id gets timeout (git-fixes).\n- RDMA/cm: add timeout to cm_destroy_id wait (git-fixes)\n- Reapply 'drm/qxl: simplify qxl_fence_wait' (stable-fixes).\n- Revert 'ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default' (stable-fixes).\n- Revert 'drm/qxl: simplify qxl_fence_wait' (git-fixes).\n- Revert 'ice: Fix ice VF reset during iavf initialization (jsc#PED-376).' (bsc#1223275) \n- Revert 'usb: cdc-wdm: close race between read and workqueue' (git-fixes).\n- Revert 'usb: phy: generic: Get the vbus supply' (git-fixes).\n- USB: UAS: return ENODEV when submit urbs fail with device not attached (stable-fixes).\n- USB: serial: add device ID for VeriFone adapter (stable-fixes).\n- USB: serial: cp210x: add ID for MGP Instruments PDS100 (stable-fixes).\n- USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M (stable-fixes).\n- USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB (stable-fixes).\n- USB: serial: option: add Fibocom FM135-GL variants (stable-fixes).\n- USB: serial: option: add Lonsung U8300/U9300 product (stable-fixes).\n- USB: serial: option: add MeiG Smart SLM320 product (stable-fixes).\n- USB: serial: option: add Rolling RW101-GL and RW135-GL support (stable-fixes).\n- USB: serial: option: add Telit FN920C04 rmnet compositions (stable-fixes).\n- USB: serial: option: add support for Fibocom FM650/FG650 (stable-fixes).\n- USB: serial: option: support Quectel EM060K sub-models (stable-fixes).\n- ahci: asm1064: asm1166: do not limit reported ports (git-fixes).\n- ahci: asm1064: correct count of reported ports (stable-fixes).\n- arm64: dts: imx8-ss-conn: fix usdhc wrong lpcg clock order (git-fixes)\n- arm64: dts: rockchip: Remove unsupported node from the Pinebook Pro (git-fixes)\n- arm64: dts: rockchip: enable internal pull-up for Q7_THRM# on RK3399 (git-fixes)\n- arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for (git-fixes)\n- arm64: dts: rockchip: enable internal pull-up on Q7_USB_ID for RK3399 (git-fixes)\n- arm64: dts: rockchip: fix rk3328 hdmi ports node (git-fixes)\n- arm64: dts: rockchip: fix rk3399 hdmi ports node (git-fixes)\n- arm64: hibernate: Fix level3 translation fault in swsusp_save() (git-fixes).\n- ax25: fix use-after-free bugs caused by ax25_ds_del_timer (git-fixes).\n- batman-adv: Avoid infinite loop trying to resize local TT (git-fixes).\n- bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent (git-fixes).\n- bcache: Remove dead references to cache_readaheads (git-fixes).\n- bcache: Remove unnecessary NULL point check in node allocations (git-fixes).\n- bcache: add code comments for bch_btree_node_get() and __bch_btree_node_alloc() (git-fixes).\n- bcache: avoid NULL checking to c-\u003eroot in run_cache_set() (git-fixes).\n- bcache: avoid oversize memory allocation by small stripe_size (git-fixes).\n- bcache: bset: Fix comment typos (git-fixes).\n- bcache: check return value from btree_node_alloc_replacement() (git-fixes).\n- bcache: fix NULL pointer reference in cached_dev_detach_finish (git-fixes).\n- bcache: fix error info in register_bcache() (git-fixes).\n- bcache: fixup bcache_dev_sectors_dirty_add() multithreaded CPU false sharing (git-fixes).\n- bcache: fixup btree_cache_wait list damage (git-fixes).\n- bcache: fixup init dirty data errors (git-fixes).\n- bcache: fixup lock c-\u003eroot error (git-fixes).\n- bcache: fixup multi-threaded bch_sectors_dirty_init() wake-up race (git-fixes).\n- bcache: move calc_cached_dev_sectors to proper place on backing device detach (git-fixes).\n- bcache: move uapi header bcache.h to bcache code directory (git-fixes).\n- bcache: prevent potential division by zero error (git-fixes).\n- bcache: remove EXPERIMENTAL for Kconfig option 'Asynchronous device registration' (git-fixes).\n- bcache: remove redundant assignment to variable cur_idx (git-fixes).\n- bcache: remove the backing_dev_name field from struct cached_dev (git-fixes).\n- bcache: remove the cache_dev_name field from struct cache (git-fixes).\n- bcache: remove unnecessary flush_workqueue (git-fixes).\n- bcache: remove unused bch_mark_cache_readahead function def in stats.h (git-fixes).\n- bcache: replace a mistaken IS_ERR() by IS_ERR_OR_NULL() in btree_gc_coalesce() (git-fixes).\n- bcache: replace snprintf in show functions with sysfs_emit (git-fixes).\n- bcache: revert replacing IS_ERR_OR_NULL with IS_ERR (git-fixes).\n- bcache: use bvec_kmap_local in bch_data_verify (git-fixes).\n- bcache: use bvec_kmap_local in bio_csum (git-fixes).\n- bcache: use default_groups in kobj_type (git-fixes).\n- bcache:: fix repeated words in comments (git-fixes).\n- ceph: stop copying to iter at EOF on sync reads (bsc#1223068).\n- ceph: switch to corrected encoding of max_xattr_size in mdsmap (bsc#1223067).\n- clk: Get runtime PM before walking tree during disable_unused (git-fixes).\n- clk: Initialize struct clk_core kref earlier (stable-fixes).\n- clk: Mark 'all_lists' as const (stable-fixes).\n- clk: Print an info line before disabling unused clocks (stable-fixes).\n- clk: Remove prepare_lock hold assertion in __clk_release() (git-fixes).\n- clk: remove extra empty line (stable-fixes).\n- comedi: vmk80xx: fix incomplete endpoint checking (git-fixes).\n- dm cache policy smq: ensure IO does not prevent cleaner policy progress (git-fixes).\n- dm cache: add cond_resched() to various workqueue loops (git-fixes).\n- dm clone: call kmem_cache_destroy() in dm_clone_init() error path (git-fixes).\n- dm crypt: add cond_resched() to dmcrypt_write() (git-fixes).\n- dm crypt: avoid accessing uninitialized tasklet (git-fixes).\n- dm flakey: do not corrupt the zero page (git-fixes).\n- dm flakey: fix a bug with 32-bit highmem systems (git-fixes).\n- dm flakey: fix a crash with invalid table line (git-fixes).\n- dm flakey: fix logic when corrupting a bio (git-fixes).\n- dm init: add dm-mod.waitfor to wait for asynchronously probed block devices (git-fixes).\n- dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path (git-fixes).\n- dm integrity: fix out-of-range warning (git-fixes).\n- dm integrity: reduce vmalloc space footprint on 32-bit architectures (git-fixes).\n- dm raid: clean up four equivalent goto tags in raid_ctr() (git-fixes).\n- dm raid: fix false positive for requeue needed during reshape (git-fixes).\n- dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths (git-fixes).\n- dm stats: check for and propagate alloc_percpu failure (git-fixes).\n- dm thin metadata: Fix ABBA deadlock by resetting dm_bufio_client (git-fixes).\n- dm thin metadata: check fail_io before using data_sm (git-fixes).\n- dm thin: add cond_resched() to various workqueue loops (git-fixes).\n- dm thin: fix deadlock when swapping to thin device (bsc#1177529).\n- dm verity: do not perform FEC for failed readahead IO (git-fixes).\n- dm verity: fix error handling for check_at_most_once on FEC (git-fixes).\n- dm zoned: free dmz-\u003eddev array in dmz_put_zoned_devices (git-fixes).\n- dm-delay: fix a race between delay_presuspend and delay_bio (git-fixes).\n- dm-integrity: do not modify bio's immutable bio_vec in integrity_metadata() (git-fixes).\n- dm-raid: fix lockdep waring in 'pers-\u003ehot_add_disk' (git-fixes).\n- dm-verity, dm-crypt: align 'struct bvec_iter' correctly (git-fixes).\n- dm-verity: align struct dm_verity_fec_io properly (git-fixes).\n- dm: add cond_resched() to dm_wq_work() (git-fixes).\n- dm: call the resume method on internal suspend (git-fixes).\n- dm: do not lock fs when the map is NULL during suspend or resume (git-fixes).\n- dm: do not lock fs when the map is NULL in process of resume (git-fixes).\n- dm: remove flush_scheduled_work() during local_exit() (git-fixes).\n- dm: send just one event on resize, not two (git-fixes).\n- dma: xilinx_dpdma: Fix locking (git-fixes).\n- dmaengine: idxd: Fix oops during rmmod on single-CPU platforms (git-fixes).\n- dmaengine: owl: fix register access functions (git-fixes).\n- dmaengine: tegra186: Fix residual calculation (git-fixes).\n- docs: Document the FAN_FS_ERROR event (stable-fixes).\n- drm-print: add drm_dbg_driver to improve namespace symmetry (stable-fixes).\n- drm/amd/display: Do not recursively call manual trigger programming (stable-fixes).\n- drm/amd/display: Fix nanosec stat overflow (stable-fixes).\n- drm/amd/display: fix disable otg wa logic in DCN316 (stable-fixes).\n- drm/amd/pm: fixes a random hang in S4 for SMU v13.0.4/11 (stable-fixes).\n- drm/amdgpu/sdma5.2: use legacy HDP flush for SDMA2/3 (stable-fixes).\n- drm/amdgpu: Fix leak when GPU memory allocation fails (stable-fixes).\n- drm/amdgpu: Reset dGPU if suspend got aborted (stable-fixes).\n- drm/amdgpu: always force full reset for SOC21 (stable-fixes).\n- drm/amdgpu: fix incorrect active rb bitmap for gfx11 (stable-fixes).\n- drm/amdgpu: fix incorrect number of active RBs for gfx11 (stable-fixes).\n- drm/amdgpu: once more fix the call oder in amdgpu_ttm_move() v2 (git-fixes).\n- drm/amdgpu: validate the parameters of bo mapping operations more clearly (git-fixes).\n- drm/amdkfd: Reset GPU on queue preemption failure (stable-fixes).\n- drm/ast: Fix soft lockup (git-fixes).\n- drm/client: Fully protect modes[] with dev-\u003emode_config.mutex (stable-fixes).\n- drm/i915/cdclk: Fix CDCLK programming order when pipes are active (git-fixes).\n- drm/i915/vrr: Disable VRR when using bigjoiner (stable-fixes).\n- drm/i915: Disable port sync when bigjoiner is used (stable-fixes).\n- drm/msm/dp: fix typo in dp_display_handle_port_status_changed() (git-fixes).\n- drm/nouveau/nvkm: add a replacement for nvkm_notify (bsc#1223834)\n- drm/panel: ili9341: Respect deferred probe (git-fixes).\n- drm/panel: ili9341: Use predefined error codes (git-fixes).\n- drm/panel: visionox-rm69299: do not unregister DSI device (git-fixes).\n- drm/vc4: do not check if plane-\u003estate-\u003efb == state-\u003efb (stable-fixes).\n- drm/vmwgfx: Enable DMA mappings with SEV (git-fixes).\n- drm/vmwgfx: Fix crtc's atomic check conditional (git-fixes).\n- drm/vmwgfx: Fix invalid reads in fence signaled events (git-fixes).\n- drm/vmwgfx: Sort primary plane formats by order of preference (git-fixes).\n- drm: nv04: Fix out of bounds access (git-fixes).\n- drm: panel-orientation-quirks: Add quirk for GPD Win Mini (stable-fixes).\n- drm: panel-orientation-quirks: Add quirk for Lenovo Legion Go (stable-fixes).\n- dump_stack: Do not get cpu_sync for panic CPU (bsc#1223574).\n- fbdev: fix incorrect address computation in deferred IO (git-fixes).\n- fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2 (stable-fixes).\n- fbmon: prevent division by zero in fb_videomode_from_videomode() (stable-fixes).\n- fix build warning\n- fuse: do not unhash root (bsc#1223951).\n- fuse: fix root lookup with nonzero generation (bsc#1223950).\n- hwmon: (amc6821) add of_match table (stable-fixes).\n- i2c: pxa: hide unused icr_bits[] variable (git-fixes).\n- i2c: smbus: fix NULL function pointer dereference (git-fixes).\n- i40e: Fix VF MAC filter removal (git-fixes).\n- idma64: Do not try to serve interrupts when device is powered off (git-fixes).\n- iio: accel: mxc4005: Interrupt handling fixes (git-fixes).\n- iio:imu: adis16475: Fix sync mode setting (git-fixes).\n- init/main.c: Fix potential static_command_line memory overflow (git-fixes).\n- iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter (git-fixes).\n- iommu/amd: Fix 'Guest Virtual APIC Table Root Pointer' configuration in IRTE (git-fixes).\n- iommu/amd: Fix domain flush size when syncing iotlb (git-fixes).\n- iommu/amd: Fix error handling for pdev_pri_ats_enable() (git-fixes).\n- iommu/arm-smmu-qcom: Limit the SMR groups to 128 (git-fixes).\n- iommu/arm-smmu-v3: Acknowledge pri/event queue overflow if any (git-fixes).\n- iommu/fsl: fix all kernel-doc warnings in fsl_pamu.c (git-fixes).\n- iommu/iova: Fix alloc iova overflows issue (git-fixes).\n- iommu/mediatek: Flush IOTLB completely only if domain has been attached (git-fixes).\n- iommu/rockchip: Fix unwind goto issue (git-fixes).\n- iommu/sprd: Release dma buffer to avoid memory leak (git-fixes).\n- iommu/vt-d: Allocate local memory for page request queue (git-fixes).\n- iommu/vt-d: Allow zero SAGAW if second-stage not supported (git-fixes).\n- iommu/vt-d: Fix error handling in sva enable/disable paths (git-fixes).\n- iommu: Fix error unwind in iommu_group_alloc() (git-fixes).\n- ipv6/addrconf: fix a potential refcount underflow for idev (git-fixes).\n- kABI: Adjust trace_iterator.wait_index (git-fixes).\n- kprobes: Fix double free of kretprobe_holder (bsc#1220901).\n- kprobes: Fix possible use-after-free issue on kprobe registration (git-fixes).\n- libnvdimm/of_pmem: Use devm_kstrdup instead of kstrdup and check its return value (git-fixes).\n- libnvdimm/region: Allow setting align attribute on regions without mappings (git-fixes).\n- livepatch: Fix missing newline character in klp_resolve_symbols() (bsc#1223539).\n- md/raid1: fix choose next idle in read_balance() (git-fixes).\n- md: Do not clear MD_CLOSING when the raid is about to stop (git-fixes).\n- md: do not clear MD_RECOVERY_FROZEN for new dm-raid until resume (git-fixes).\n- media: cec: core: remove length check of Timer Status (stable-fixes).\n- media: sta2x11: fix irq handler cast (stable-fixes).\n- mei: me: add arrow lake point H DID (stable-fixes).\n- mei: me: add arrow lake point S DID (stable-fixes).\n- mei: me: disable RPL-S on SPS and IGN firmwares (git-fixes).\n- mm/vmscan: make sure wakeup_kswapd with managed zone (bsc#1223473).\n- mmc: sdhci-msm: pervent access to suspended controller (git-fixes).\n- mtd: diskonchip: work around ubsan link failure (stable-fixes).\n- nd_btt: Make BTT lanes preemptible (git-fixes).\n- net: bridge: vlan: fix memory leak in __allowed_ingress (git-fixes).\n- net: fix a memleak when uncloning an skb dst and its metadata (git-fixes).\n- net: fix skb leak in __skb_tstamp_tx() (git-fixes).\n- net: ipv6: ensure we call ipv6_mc_down() at most once (git-fixes).\n- net: mld: fix reference count leak in mld_{query | report}_work() (git-fixes).\n- net: stream: purge sk_error_queue in sk_stream_kill_queues() (git-fixes).\n- net: usb: ax88179_178a: avoid the interface always configured as random address (git-fixes).\n- net: usb: ax88179_178a: avoid writing the mac address before first reading (git-fixes).\n- net: usb: ax88179_178a: stop lying about skb-\u003etruesize (git-fixes).\n- net: vlan: fix underflow for the real_dev refcnt (git-fixes).\n- netfilter: br_netfilter: Drop dst references before setting (git-fixes).\n- netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check() (git-fixes).\n- netfilter: nft_ct: fix l3num expectations with inet pseudo family (git-fixes).\n- nfsd: use __fput_sync() to avoid delayed closing of files (bsc#1223380 bsc#1217408).\n- nilfs2: fix OOB in nilfs_set_de_type (git-fixes).\n- nilfs2: fix OOB in nilfs_set_de_type (git-fixes).\n- nouveau: fix function cast warning (git-fixes).\n- nouveau: fix instmem race condition around ptr stores (git-fixes).\n- nvdimm/namespace: drop nested variable in create_namespace_pmem() (git-fixes).\n- nvdimm: Allow overwrite in the presence of disabled dimms (git-fixes).\n- nvdimm: Fix badblocks clear off-by-one error (git-fixes).\n- nvdimm: Fix dereference after free in register_nvdimm_pmu() (git-fixes).\n- nvdimm: Fix firmware activation deadlock scenarios (git-fixes).\n- nvdimm: Fix memleak of pmu attr_groups in unregister_nvdimm_pmu() (git-fixes).\n- pci_iounmap(): Fix MMIO mapping leak (git-fixes).\n- phy: tegra: xusb: Add API to retrieve the port number of phy (stable-fixes).\n- pinctrl: renesas: checker: Limit cfg reg enum checks to provided IDs (stable-fixes).\n- platform/x86: touchscreen_dmi: Add an extra entry for a variant of the Chuwi Vi8 tablet (stable-fixes).\n- powerpc/kasan: Do not instrument non-maskable or raw interrupts (bsc#1223191).\n- powerpc/pseries/iommu: LPAR panics when rebooted with a frozen PE (bsc#1222011 ltc#205900).\n- powerpc/rtas: define pr_fmt and convert printk call sites (bsc#1223369 ltc#205888).\n- powerpc/rtas: export rtas_error_rc() for reuse (bsc#1223369 ltc#205888).\n- powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt (bsc#1221645 ltc#205739 bsc#1223191).\n- powerpc: Refactor verification of MSR_RI (bsc#1223191).\n- printk: Add this_cpu_in_panic() (bsc#1223574).\n- printk: Adjust mapping for 32bit seq macros (bsc#1223574).\n- printk: Avoid non-panic CPUs writing to ringbuffer (bsc#1223574).\n- printk: Disable passing console lock owner completely during panic() (bsc#1223574).\n- printk: Drop console_sem during panic (bsc#1223574).\n- printk: Rename abandon_console_lock_in_panic() to other_cpu_in_panic() (bsc#1223574).\n- printk: Use prb_first_seq() as base for 32bit seq macros (bsc#1223574).\n- printk: Wait for all reserved records with pr_flush() (bsc#1223574).\n- printk: nbcon: Relocate 32bit seq macros (bsc#1223574).\n- printk: ringbuffer: Clarify special lpos values (bsc#1223574).\n- printk: ringbuffer: Cleanup reader terminology (bsc#1223574).\n- printk: ringbuffer: Do not skip non-finalized records with prb_next_seq() (bsc#1223574).\n- printk: ringbuffer: Improve prb_next_seq() performance (bsc#1223574).\n- printk: ringbuffer: Skip non-finalized records in panic (bsc#1223574).\n- pstore/zone: Add a null pointer check to the psz_kmsg_read (stable-fixes).\n- ring-buffer: Do not set shortest_full when full target is hit (git-fixes).\n- ring-buffer: Fix full_waiters_pending in poll (git-fixes).\n- ring-buffer: Fix resetting of shortest_full (git-fixes).\n- ring-buffer: Fix waking up ring buffer readers (git-fixes).\n- ring-buffer: Make wake once of ring_buffer_wait() more robust (git-fixes).\n- ring-buffer: Use wait_event_interruptible() in ring_buffer_wait() (git-fixes).\n- ring-buffer: use READ_ONCE() to read cpu_buffer-\u003ecommit_page in concurrent environment (git-fixes).\n- s390/cio: Ensure the copied buf is NUL terminated (git-fixes bsc#1223875).\n- s390/decompressor: fix misaligned symbol build error (git-fixes bsc#1223785).\n- s390/mm: Fix clearing storage keys for huge pages (git-fixes bsc#1223877).\n- s390/mm: Fix storage key clearing for guest huge pages (git-fixes bsc#1223878).\n- s390/qeth: Fix kernel panic after setting hsuid (git-fixes bsc#1223879).\n- s390/scm: fix virtual vs physical address confusion (git-fixes bsc#1223784).\n- s390/vdso: Add CFI for RA register to asm macro vdso_func (git-fixes bsc#1223876).\n- s390/vdso: drop '-fPIC' from LDFLAGS (git-fixes bsc#1223598).\n- s390/zcrypt: fix reference counting on zcrypt card objects (git-fixes bsc#1223595).\n- serial/pmac_zilog: Remove flawed mitigation for rx irq flood (git-fixes).\n- serial: core: Provide port lock wrappers (stable-fixes).\n- serial: core: fix kernel-doc for uart_port_unlock_irqrestore() (git-fixes).\n- serial: mxs-auart: add spinlock around changing cts state (git-fixes).\n- slimbus: qcom-ngd-ctrl: Add timeout for wait operation (git-fixes).\n- speakup: Avoid crash on very long word (git-fixes).\n- speakup: Fix 8bit characters from direct synth (git-fixes).\n- tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp (git-fixes).\n- thunderbolt: Avoid notify PM core about runtime PM resume (stable-fixes).\n- thunderbolt: Fix wake configurations after device unplug (stable-fixes).\n- tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string (git-fixes).\n- tracing/ring-buffer: Fix wait_on_pipe() race (git-fixes).\n- tracing: Have saved_cmdlines arrays all in one allocation (git-fixes).\n- tracing: Remove precision vsnprintf() check from print event (git-fixes).\n- tracing: Show size of requested perf buffer (git-fixes).\n- tracing: Use .flush() call to wake up readers (git-fixes).\n- usb: Disable USB3 LPM at shutdown (stable-fixes).\n- usb: Fix regression caused by invalid ep0 maxpacket in virtual SuperSpeed device (git-fixes).\n- usb: dwc2: host: Fix dereference issue in DDMA completion flow (git-fixes).\n- usb: gadget: composite: fix OS descriptors w_value logic (git-fixes).\n- usb: gadget: f_fs: Fix a race condition when processing setup packets (git-fixes).\n- usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error (stable-fixes).\n- usb: gadget: tegra-xudc: Fix USB3 PHY retrieval logic (git-fixes).\n- usb: ohci: Prevent missed ohci interrupts (git-fixes).\n- usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined (stable-fixes).\n- usb: typec: tcpci: add generic tcpci fallback compatible (stable-fixes).\n- usb: typec: tcpm: Check for port partner validity before consuming it (git-fixes).\n- usb: typec: tcpm: unregister existing source caps before re-registration (bsc#1220569).\n- usb: typec: ucsi: Ack unsupported commands (stable-fixes).\n- usb: typec: ucsi: Clear UCSI_CCI_RESET_COMPLETE before reset (stable-fixes).\n- usb: typec: ucsi: Fix connector check on init (git-fixes).\n- usb: udc: remove warning when queue disabled ep (stable-fixes).\n- vdpa/mlx5: Allow CVQ size changes (git-fixes).\n- virtio: treat alloc_dax() -EOPNOTSUPP failure as non-fatal (bsc#1223949).\n- wifi: ath9k: fix LNA selection in ath_ant_try_scan() (stable-fixes).\n- wifi: iwlwifi: mvm: remove old PASN station when adding a new one (git-fixes).\n- wifi: iwlwifi: mvm: return uid from iwl_mvm_build_scan_cmd (git-fixes).\n- wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (stable-fixes).\n- wifi: nl80211: do not free NULL coalescing rule (git-fixes).\n- x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ (git-fixes).\n- x86/mm: Ensure input to pfn_to_kaddr() is treated as a 64-bit type (jsc#PED-7167 git-fixes).\n- x86/sev: Skip ROM range scans and validation for SEV-SNP guests (jsc#PED-7167 git-fixes).\n- x86/xen: Add some null pointer checking to smp.c (git-fixes).\n- x86/xen: add CPU dependencies for 32-bit build (git-fixes).\n- x86/xen: fix percpu vcpu_info allocation (git-fixes).\n- xen-netback: properly sync TX responses (git-fixes).\n- xen-netfront: Add missing skb_mark_for_recycle (git-fixes).\n- xen/gntdev: Fix the abuse of underlying struct page in DMA-buf import (git-fixes).\n- xen/xenbus: document will_handle argument for xenbus_watch_path() (git-fixes).\n- xfrm6: fix inet6_dev refcount underflow problem (git-fixes).\n","status":"published","published":"2024-05-15T09:29:37Z","modified":"2025-05-02T04:32:07.647787Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1663-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP5 Real Time kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2024-27389: Fixed pstore inode handling with d_invalidate() (bsc#1223705).\n- CVE-2024-27062: Fixed nouveau lock inside client object tree (bsc#1223834).\n- CVE-2024-27056: Fixed wifi/iwlwifi/mvm to ensure offloading TID queue exists (bsc#1223822).\n- CVE-2024-27046: Fixed nfp/flower handling acti_netdevs allocation failure (bsc#1223827).\n- CVE-2024-27043: Fixed a use-after-free in edia/dvbdev in different places (bsc#1223824).\n- CVE-2024-27041: Fixed drm/amd/display NULL checks for adev-\u003edm.dc in amdgpu_dm_fini() (bsc#1223714).\n- CVE-2024-27039: Fixed clk/hisilicon/hi3559a an erroneous devm_kfree() (bsc#1223821).\n- CVE-2024-27038: Fixed clk_core_get NULL pointer dereference (bsc#1223816).\n- CVE-2024-27030: Fixed octeontx2-af to use separate handlers for interrupts (bsc#1223790).\n- CVE-2024-27014: Fixed net/mlx5e to prevent deadlock while disabling aRFS (bsc#1223735).\n- CVE-2024-27013: Fixed tun limit printing rate when illegal packet received by tun device (bsc#1223745).\n- CVE-2024-26993: Fixed fs/sysfs reference leak in sysfs_break_active_protection() (bsc#1223693).\n- CVE-2024-26982: Fixed Squashfs inode number check not to be an invalid value of zero (bsc#1223634).\n- CVE-2024-26970: Fixed clk/qcom/gcc-ipq6018 termination of frequency table arrays (bsc#1223644).\n- CVE-2024-26969: Fixed clk/qcom/gcc-ipq8074 termination of frequency table arrays (bsc#1223645).\n- CVE-2024-26966: Fixed clk/qcom/mmcc-apq8084 termination of frequency table arrays (bsc#1223646).\n- CVE-2024-26965: Fixed clk/qcom/mmcc-msm8974 termination of frequency table arrays (bsc#1223648).\n- CVE-2024-26960: Fixed mm/swap race between free_swap_and_cache() and swapoff() (bsc#1223655).\n- CVE-2024-26951: Fixed wireguard/netlink check for dangling peer via is_dead instead of empty list (bsc#1223660).\n- CVE-2024-26950: Fixed wireguard/netlink to access device through ctx instead of peer (bsc#1223661).\n- CVE-2024-26948: Fixed drm/amd/display by adding dc_state NULL check in dc_state_release (bsc#1223664).\n- CVE-2024-26927: Fixed ASoC/SOF bounds checking to firmware data Smatch (bsc#1223525).\n- CVE-2024-26901: Fixed do_sys_name_to_handle() to use kzalloc() to prevent kernel-infoleak (bsc#1223198).\n- CVE-2024-26896: Fixed wifi/wfx memory leak when starting AP (bsc#1223042).\n- CVE-2024-26893: Fixed firmware/arm_scmi for possible double free in SMC transport cleanup path (bsc#1223196).\n- CVE-2024-26885: Fixed bpf DEVMAP_HASH overflow check on 32-bit arches (bsc#1223190).\n- CVE-2024-26884: Fixed bpf hashtab overflow check on 32-bit arches (bsc#1223189).\n- CVE-2024-26883: Fixed bpf stackmap overflow check on 32-bit arches (bsc#1223035).\n- CVE-2024-26882: Fixed net/ip_tunnel to make sure to pull inner header in ip_tunnel_rcv() (bsc#1223034).\n- CVE-2024-26881: Fixed net/hns3 kernel crash when 1588 is received on HIP08 devices (bsc#1223041).\n- CVE-2024-26879: Fixed clk/meson by adding missing clocks to axg_clk_regmaps (bsc#1223066).\n- CVE-2024-26878: Fixed quota for potential NULL pointer dereference (bsc#1223060).\n- CVE-2024-26866: Fixed spi/spi-fsl-lpspi by removing redundant spi_controller_put call (bsc#1223024).\n- CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).\n- CVE-2024-26861: Fixed wireguard/receive annotate data-race around receiving_counter.counter (bsc#1223076).\n- CVE-2024-26857: Fixed geneve to make sure to pull inner header in geneve_rx() (bsc#1223058).\n- CVE-2024-26856: Fixed use-after-free inside sparx5_del_mact_entry (bsc#1223052).\n- CVE-2024-26855: Fixed net/ice potential NULL pointer dereference in ice_bridge_setlink() (bsc#1223051).\n- CVE-2024-26853: Fixed igc returning frame twice in XDP_REDIRECT (bsc#1223061).\n- CVE-2024-26852: Fixed net/ipv6 to avoid possible UAF in ip6_route_mpath_notify() (bsc#1223057).\n- CVE-2024-26848: Fixed afs endless loop in directory parsing (bsc#1223030).\n- CVE-2024-26836: Fixed platform/x86/think-lmi password opcode ordering for workstations (bsc#1222968).\n- CVE-2024-26830: Fixed i40e to not allow untrusted VF to remove administratively set MAC (bsc#1223012).\n- CVE-2024-26817: Fixed amdkfd to use calloc instead of kzalloc to avoid integer overflow (bsc#1222812).\n- CVE-2024-26816: Fixed relocations in .notes section when building with CONFIG_XEN_PV=y by ignoring them (bsc#1222624).\n- CVE-2024-26807: Fixed spi/cadence-qspi NULL pointer reference in runtime PM hooks (bsc#1222801).\n- CVE-2024-26805: Fixed a kernel-infoleak-after-free in __skb_datagram_iter in netlink  (bsc#1222630).\n- CVE-2024-26793: Fixed an use-after-free and null-ptr-deref in gtp_newlink() in gtp  (bsc#1222428).\n- CVE-2024-26783: Fixed mm/vmscan bug when calling wakeup_kswapd() with a wrong zone index (bsc#1222615).\n- CVE-2024-26779: Fixed a race condition on enabling fast-xmit in mac80211 (bsc#1222772).\n- CVE-2024-26773: Fixed ext4 block allocation from corrupted group in ext4_mb_try_best_found() (bsc#1222618).\n- CVE-2024-26772: Fixed ext4 to avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() (bsc#1222613).\n- CVE-2024-26771: Fixed a null pointer dereference on edma_probe in dmaengine ti edma  (bsc#1222610)\n- CVE-2024-26766: Fixed SDMA off-by-one error in _pad_sdma_tx_descs() (bsc#1222726).\n- CVE-2024-26764: Fixed IOCB_AIO_RW check in fs/aio before the struct aio_kiocb conversion (bsc#1222721).\n- CVE-2024-26763: Fixed user corruption via by writing data with O_DIRECT on device in dm-crypt (bsc#1222720).\n- CVE-2024-26760: Fixed scsi/target/pscsi bio_put() for error case (bsc#1222596).\n- CVE-2024-267600: Fixed scsi/target/pscsi error case in bio_put() (bsc#1222596).\n- CVE-2024-26754: Fixed an use-after-free and null-ptr-deref in gtp_genl_dump_pdp() in gtp  (bsc#1222632).\n- CVE-2024-26751: Fixed ARM/ep93xx terminator to gpiod_lookup_table (bsc#1222724).\n- CVE-2024-26747: Fixed a NULL pointer issue with USB parent module's reference (bsc#1222609).\n- CVE-2024-26744: Fixed null pointer dereference in srpt_service_guid parameter in rdma/srpt (bsc#1222449).\n- CVE-2024-26743: Fixed memory leak in qedr_create_user_qp error flow in rdma/qedr (bsc#1222677).\n- CVE-2024-26737: Fixed selftests/bpf racing between bpf_timer_cancel_and_free and bpf_timer_cancel (bsc#1222557).\n- CVE-2024-26733: Fixed an overflow in arp_req_get() in arp (bsc#1222585).\n- CVE-2024-26727: Fixed assertion if a newly created btrfs subvolume already gets read (bsc#1222536).\n- CVE-2024-26718: Fixed dm-crypt/dm-verity disable tasklets (bsc#1222416).\n- CVE-2024-26704: Fixed a double-free of blocks due to wrong extents moved_len in ext4 (bsc#1222422).\n- CVE-2024-26696: Fixed nilfs2 hang in nilfs_lookup_dirty_data_buffers() (bsc#1222549).\n- CVE-2024-26689: Fixed a use-after-free in encode_cap_msg() (bsc#1222503).\n- CVE-2024-26687: Fixed xen/events close evtchn after mapping cleanup (bsc#1222435).\n- CVE-2024-26685: Fixed nilfs2 potential bug in end_buffer_async_write (bsc#1222437).\n- CVE-2024-26684: Fixed net/stmmac/xgmac handling of DPP safety error for DMA channels (bsc#1222445).\n- CVE-2024-26681: Fixed netdevsim to avoid potential loop in nsim_dev_trap_report_work() (bsc#1222431).\n- CVE-2024-26680: Fixed net/atlantic DMA mapping for PTP hwts ring (bsc#1222427).\n- CVE-2024-26675: Fixed ppp_async to limit MRU to 64K (bsc#1222379).\n- CVE-2024-26673: Fixed netfilter/nft_ct layer 3 and 4 protocol sanitization (bsc#1222368).\n- CVE-2024-26671: Fixed blk-mq IO hang from sbitmap wakeup race (bsc#1222357).\n- CVE-2024-26660: Fixed drm/amd/display bounds check for stream encoder creation (bsc#1222266).\n- CVE-2024-26656: Fixed drm/amdgpu use-after-free bug (bsc#1222307).\n- CVE-2024-26610: Fixed memory corruption in wifi/iwlwifi (bsc#1221299).\n- CVE-2024-26601: Fixed ext4 buddy bitmap corruption via fast commit replay (bsc#1220342).\n- CVE-2024-23850: Fixed double free of anonymous device after snapshot  creation failure (bsc#1219126).\n- CVE-2024-23848: Fixed media/cec for possible use-after-free in cec_queue_msg_fh (bsc#1219104).\n- CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1219169).\n- CVE-2024-22099: Fixed a null-pointer-dereference in rfcomm_check_security (bsc#1219170).\n- CVE-2024-0841: Fixed a null pointer dereference in the hugetlbfs_fill_super function in hugetlbfs (HugeTLB pages) functionality (bsc#1219264).\n- CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init in net/sctp/socket.c (bsc#1218917).\n- CVE-2023-6270: Fixed a use-after-free issue in aoecmd_cfg_pkts (bsc#1218562).\n- CVE-2023-52652: Fixed NTB for possible name leak in ntb_register_device() (bsc#1223686).\n- CVE-2023-52645: Fixed pmdomain/mediatek race conditions with genpd (bsc#1223033).\n- CVE-2023-52636: Fixed libceph cursor init when preparing sparse read in msgr2 (bsc#1222247).\n- CVE-2023-52635: Fixed PM/devfreq to synchronize devfreq_monitor_[start/stop] (bsc#1222294).\n- CVE-2023-52627: Fixed iio:adc:ad7091r exports into IIO_AD7091R namespace (bsc#1222051).\n- CVE-2023-52620: Fixed netfilter/nf_tables to disallow timeout for anonymous sets never used from userspace (bsc#1221825).\n- CVE-2023-52616: Fixed unexpected pointer access in crypto/lib/mpi in mpi_ec_init (bsc#1221612).\n- CVE-2023-52614: Fixed PM/devfreq buffer overflow in trans_stat_show (bsc#1221617).\n- CVE-2023-52593: Fixed wifi/wfx possible NULL pointer dereference in wfx_set_mfp_ap() (bsc#1221042).\n- CVE-2023-52591: Fixed a possible reiserfs filesystem corruption via directory renaming (bsc#1221044).\n- CVE-2023-52590: Fixed a possible ocfs2 filesystem corruption via directory renaming (bsc#1221088).\n- CVE-2023-52589: Fixed media/rkisp1 IRQ disable race issue (bsc#1221084).\n- CVE-2023-52585: Fixed drm/amdgpu for possible NULL pointer dereference in amdgpu_ras_query_error_status_helper() (bsc#1221080).\n- CVE-2023-52561: Fixed arm64/dts/qcom/sdm845-db845c to mark cont splash memory region (bsc#1220935).\n- CVE-2023-52503: Fixed tee/amdtee use-after-free vulnerability in amdtee_close_session (bsc#1220915).\n- CVE-2023-52488: Fixed serial/sc16is7xx convert from _raw_ to _noinc_ regmap functions for FIFO (bsc#1221162).\n- CVE-2022-48701: Fixed an out-of-bounds bug in __snd_usb_parse_audio_interface() (bsc#1223921).\n- CVE-2022-48662: Fixed a general protection fault (GPF) in i915_perf_open_ioctl (bsc#1223505).\n- CVE-2022-48659: Fixed mm/slub to return errno if kmalloc() fails (bsc#1223498).\n- CVE-2022-48658: Fixed mm/slub to avoid a problem in flush_cpu_slab()/__free_slab() task context (bsc#1223496).\n- CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb-\u003emac_header (bsc#1223513).\n- CVE-2022-48642: Fixed netfilter/nf_tables percpu memory leak at nf_tables_addchain() (bsc#1223478).\n- CVE-2022-48640: Fixed bonding for possible NULL pointer dereference in bond_rr_gen_slave_id (bsc#1223499).\n- CVE-2022-48631: Fixed a bug in ext4, when parsing extents where eh_entries == 0 and eh_depth \u003e 0 (bsc#1223475).\n- CVE-2021-47214: Fixed hugetlb/userfaultfd during restore reservation in hugetlb_mcopy_atomic_pte() (bsc#1222710).\n- CVE-2021-47211: Fixed a null pointer dereference on pointer cs_desc in usb-audio (bsc#1222869).\n- CVE-2021-47207: Fixed a null pointer dereference on pointer block in gus (bsc#1222790).\n- CVE-2021-47205: Unregistered clocks/resets when unbinding in sunxi-ng (bsc#1222888).\n- CVE-2021-47202: Fixed NULL pointer dereferences in of_thermal_ functions (bsc#1222878)\n- CVE-2021-47200: Fixed drm/prime for possible use-after-free in mmap within drm_gem_ttm_mmap() and drm_gem_ttm_mmap() (bsc#1222838).\n- CVE-2021-47195: Fixed use-after-free inside SPI via add_lock mutex (bsc#1222832).\n- CVE-2021-47189: Fixed denial of service due to memory ordering issues between normal and ordered work functions in btrfs (bsc#1222706).\n- CVE-2021-47185: Fixed a softlockup issue in flush_to_ldisc in tty tty_buffer (bsc#1222669).\n- CVE-2021-47184: Fixed NULL pointer dereference on VSI filter sync (bsc#1222666).\n- CVE-2021-47183: Fixed a null pointer dereference during link down processing in scsi lpfc (bsc#1192145, bsc#1222664).\n- CVE-2021-47182: Fixed scsi_mode_sense() buffer length handling (bsc#1222662).\n- CVE-2021-47181: Fixed a null pointer dereference caused by calling platform_get_resource()  (bsc#1222660).\n\nThe following non-security bugs were fixed:\n\n- ALSA: firewire-lib: handle quirk to calculate payload quadlets as data block counter (stable-fixes).\n- ALSA: hda/realtek - Enable audio jacks of Haier Boyue G42 with ALC269VC (stable-fixes).\n- ALSA: hda/realtek - Fix inactive headset mic jack (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP SnowWhite laptops (stable-fixes).\n- ALSA: hda/realtek: Fix mute led of HP Laptop 15-da3001TU (stable-fixes).\n- ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node() (git-fixes).\n- ALSA: scarlett2: Add Focusrite Clarett 2Pre and 4Pre USB support (stable-fixes).\n- ALSA: scarlett2: Add Focusrite Clarett+ 2Pre and 4Pre support (stable-fixes).\n- ALSA: scarlett2: Add correct product series name to messages (stable-fixes).\n- ALSA: scarlett2: Add support for Clarett 8Pre USB (stable-fixes).\n- ALSA: scarlett2: Default mixer driver to enabled (stable-fixes).\n- ALSA: scarlett2: Move USB IDs out from device_info struct (stable-fixes).\n- ASoC: meson: axg-card: make links nonatomic (git-fixes).\n- ASoC: meson: axg-tdm-interface: manage formatters in trigger (git-fixes).\n- ASoC: meson: cards: select SND_DYNAMIC_MINORS (git-fixes).\n- ASoC: soc-core.c: Skip dummy codec when adding platforms (stable-fixes).\n- ASoC: tegra: Fix DSPK 16-bit playback (git-fixes).\n- ASoC: ti: davinci-mcasp: Fix race condition during probe (git-fixes).\n- Bluetooth: Add new quirk for broken read key length on ATS2851 (git-fixes).\n- Bluetooth: Fix TOCTOU in HCI debugfs implementation (git-fixes).\n- Bluetooth: Fix memory leak in hci_req_sync_complete() (git-fixes).\n- Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old() (stable-fixes).\n- Bluetooth: L2CAP: Fix not validating setsockopt user input (git-fixes).\n- Bluetooth: RFCOMM: Fix not validating setsockopt user input (git-fixes).\n- Bluetooth: SCO: Fix not validating setsockopt user input (git-fixes).\n- Bluetooth: add quirk for broken address properties (git-fixes).\n- Bluetooth: btintel: Fix null ptr deref in btintel_read_version (stable-fixes).\n- Bluetooth: btintel: Fixe build regression (git-fixes).\n- Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0bda:0x4853 (stable-fixes).\n- Bluetooth: hci_event: Fix sending HCI_OP_READ_ENC_KEY_SIZE (git-fixes).\n- Bluetooth: hci_event: set the conn encrypted before conn establishes (stable-fixes).\n- Bluetooth: hci_sock: Fix not validating setsockopt user input (git-fixes).\n- Bluetooth: qca: fix NULL-deref on non-serdev suspend (git-fixes).\n- Documentation: Add missing documentation for EXPORT_OP flags (stable-fixes).\n- HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev-\u003edevc (git-fixes).\n- HID: logitech-dj: allow mice to use all types of reports (git-fixes).\n- HID: uhid: Use READ_ONCE()/WRITE_ONCE() for -\u003erunning (stable-fixes).\n- Input: allocate keycode for Display refresh rate toggle (stable-fixes).\n- Input: synaptics-rmi4 - fail probing if memory allocation for 'phys' fails (stable-fixes).\n- NFC: trf7970a: disable all regulators on removal (git-fixes).\n- NFS: avoid spurious warning of lost lock that is being unlocked (bsc#1221791).\n- PCI/AER: Block runtime suspend when handling errors (git-fixes).\n- PCI/DPC: Quirk PIO log size for Intel Ice Lake Root Ports (git-fixes).\n- PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports (git-fixes).\n- PCI/DPC: Quirk PIO log size for certain Intel Root Ports (git-fixes).\n- PCI/PM: Drain runtime-idle callbacks before driver removal (git-fixes).\n- PCI: Drop pci_device_remove() test of pci_dev-\u003edriver (git-fixes).\n- PCI: rpaphp: Error out on busy status from get-sensor-state (bsc#1223369 ltc#205888).\n- RAS: Avoid build errors when CONFIG_DEBUG_FS=n (jsc#PED-7619).\n- RDMA/cm: Print the old state when cm_destroy_id gets timeout (git-fixes).\n- RDMA/cm: add timeout to cm_destroy_id wait (git-fixes)\n- README.BRANCH: Correct email address for Petr Tesarik\n- README.BRANCH: Remove copy of branch name\n- Reapply 'drm/qxl: simplify qxl_fence_wait' (stable-fixes).\n- Revert 'ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default' (stable-fixes).\n- Revert 'drm/qxl: simplify qxl_fence_wait' (git-fixes).\n- Revert 'ice: Fix ice VF reset during iavf initialization (jsc#PED-376).' (bsc#1223275)\n- Revert 'usb: cdc-wdm: close race between read and workqueue' (git-fixes).\n- Revert 'usb: phy: generic: Get the vbus supply' (git-fixes).\n- USB: UAS: return ENODEV when submit urbs fail with device not attached (stable-fixes).\n- USB: serial: add device ID for VeriFone adapter (stable-fixes).\n- USB: serial: cp210x: add ID for MGP Instruments PDS100 (stable-fixes).\n- USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M (stable-fixes).\n- USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB (stable-fixes).\n- USB: serial: option: add Fibocom FM135-GL variants (stable-fixes).\n- USB: serial: option: add Lonsung U8300/U9300 product (stable-fixes).\n- USB: serial: option: add MeiG Smart SLM320 product (stable-fixes).\n- USB: serial: option: add Rolling RW101-GL and RW135-GL support (stable-fixes).\n- USB: serial: option: add Telit FN920C04 rmnet compositions (stable-fixes).\n- USB: serial: option: add support for Fibocom FM650/FG650 (stable-fixes).\n- USB: serial: option: support Quectel EM060K sub-models (stable-fixes).\n- ahci: asm1064: asm1166: do not limit reported ports (git-fixes).\n- ahci: asm1064: correct count of reported ports (stable-fixes).\n- arm64: dts: imx8-ss-conn: fix usdhc wrong lpcg clock order (git-fixes)\n- arm64: dts: rockchip: Remove unsupported node from the Pinebook Pro (git-fixes)\n- arm64: dts: rockchip: enable internal pull-up for Q7_THRM# on RK3399 (git-fixes)\n- arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for (git-fixes)\n- arm64: dts: rockchip: enable internal pull-up on Q7_USB_ID for RK3399 (git-fixes)\n- arm64: dts: rockchip: fix rk3328 hdmi ports node (git-fixes)\n- arm64: dts: rockchip: fix rk3399 hdmi ports node (git-fixes)\n- arm64: hibernate: Fix level3 translation fault in swsusp_save() (git-fixes).\n- ax25: fix use-after-free bugs caused by ax25_ds_del_timer (git-fixes).\n- batman-adv: Avoid infinite loop trying to resize local TT (git-fixes).\n- bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent (git-fixes).\n- bcache: Remove dead references to cache_readaheads (git-fixes).\n- bcache: Remove unnecessary NULL point check in node allocations (git-fixes).\n- bcache: add code comments for bch_btree_node_get() and __bch_btree_node_alloc() (git-fixes).\n- bcache: avoid NULL checking to c-\u003eroot in run_cache_set() (git-fixes).\n- bcache: avoid oversize memory allocation by small stripe_size (git-fixes).\n- bcache: bset: Fix comment typos (git-fixes).\n- bcache: check return value from btree_node_alloc_replacement() (git-fixes).\n- bcache: fix NULL pointer reference in cached_dev_detach_finish (git-fixes).\n- bcache: fix error info in register_bcache() (git-fixes).\n- bcache: fixup bcache_dev_sectors_dirty_add() multithreaded CPU false sharing (git-fixes).\n- bcache: fixup btree_cache_wait list damage (git-fixes).\n- bcache: fixup init dirty data errors (git-fixes).\n- bcache: fixup lock c-\u003eroot error (git-fixes).\n- bcache: fixup multi-threaded bch_sectors_dirty_init() wake-up race (git-fixes).\n- bcache: move calc_cached_dev_sectors to proper place on backing device detach (git-fixes).\n- bcache: move uapi header bcache.h to bcache code directory (git-fixes).\n- bcache: prevent potential division by zero error (git-fixes).\n- bcache: remove EXPERIMENTAL for Kconfig option 'Asynchronous device registration' (git-fixes).\n- bcache: remove redundant assignment to variable cur_idx (git-fixes).\n- bcache: remove the backing_dev_name field from struct cached_dev (git-fixes).\n- bcache: remove the cache_dev_name field from struct cache (git-fixes).\n- bcache: remove unnecessary flush_workqueue (git-fixes).\n- bcache: remove unused bch_mark_cache_readahead function def in stats.h (git-fixes).\n- bcache: replace a mistaken IS_ERR() by IS_ERR_OR_NULL() in btree_gc_coalesce() (git-fixes).\n- bcache: replace snprintf in show functions with sysfs_emit (git-fixes).\n- bcache: revert replacing IS_ERR_OR_NULL with IS_ERR (git-fixes).\n- bcache: use bvec_kmap_local in bch_data_verify (git-fixes).\n- bcache: use bvec_kmap_local in bio_csum (git-fixes).\n- bcache: use default_groups in kobj_type (git-fixes).\n- bcache:: fix repeated words in comments (git-fixes).\n- ceph: stop copying to iter at EOF on sync reads (bsc#1223068).\n- ceph: switch to corrected encoding of max_xattr_size in mdsmap (bsc#1223067).\n- clk: Get runtime PM before walking tree during disable_unused (git-fixes).\n- clk: Initialize struct clk_core kref earlier (stable-fixes).\n- clk: Mark 'all_lists' as const (stable-fixes).\n- clk: Print an info line before disabling unused clocks (stable-fixes).\n- clk: Remove prepare_lock hold assertion in __clk_release() (git-fixes).\n- clk: remove extra empty line (stable-fixes).\n- comedi: vmk80xx: fix incomplete endpoint checking (git-fixes).\n- dm cache policy smq: ensure IO does not prevent cleaner policy progress (git-fixes).\n- dm cache: add cond_resched() to various workqueue loops (git-fixes).\n- dm clone: call kmem_cache_destroy() in dm_clone_init() error path (git-fixes).\n- dm crypt: add cond_resched() to dmcrypt_write() (git-fixes).\n- dm crypt: avoid accessing uninitialized tasklet (git-fixes).\n- dm flakey: do not corrupt the zero page (git-fixes).\n- dm flakey: fix a bug with 32-bit highmem systems (git-fixes).\n- dm flakey: fix a crash with invalid table line (git-fixes).\n- dm flakey: fix logic when corrupting a bio (git-fixes).\n- dm init: add dm-mod.waitfor to wait for asynchronously probed block devices (git-fixes).\n- dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path (git-fixes).\n- dm integrity: fix out-of-range warning (git-fixes).\n- dm integrity: reduce vmalloc space footprint on 32-bit architectures (git-fixes).\n- dm raid: clean up four equivalent goto tags in raid_ctr() (git-fixes).\n- dm raid: fix false positive for requeue needed during reshape (git-fixes).\n- dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths (git-fixes).\n- dm stats: check for and propagate alloc_percpu failure (git-fixes).\n- dm thin metadata: Fix ABBA deadlock by resetting dm_bufio_client (git-fixes).\n- dm thin metadata: check fail_io before using data_sm (git-fixes).\n- dm thin: add cond_resched() to various workqueue loops (git-fixes).\n- dm thin: fix deadlock when swapping to thin device (bsc#1177529).\n- dm verity: do not perform FEC for failed readahead IO (git-fixes).\n- dm verity: fix error handling for check_at_most_once on FEC (git-fixes).\n- dm zoned: free dmz-\u003eddev array in dmz_put_zoned_devices (git-fixes).\n- dm-delay: fix a race between delay_presuspend and delay_bio (git-fixes).\n- dm-integrity: do not modify bio's immutable bio_vec in integrity_metadata() (git-fixes).\n- dm-raid: fix lockdep waring in 'pers-\u003ehot_add_disk' (git-fixes).\n- dm-verity, dm-crypt: align 'struct bvec_iter' correctly (git-fixes).\n- dm-verity: align struct dm_verity_fec_io properly (git-fixes).\n- dm: add cond_resched() to dm_wq_work() (git-fixes).\n- dm: call the resume method on internal suspend (git-fixes).\n- dm: do not lock fs when the map is NULL during suspend or resume (git-fixes).\n- dm: do not lock fs when the map is NULL in process of resume (git-fixes).\n- dm: remove flush_scheduled_work() during local_exit() (git-fixes).\n- dm: send just one event on resize, not two (git-fixes).\n- dma: xilinx_dpdma: Fix locking (git-fixes).\n- dmaengine: idxd: Fix oops during rmmod on single-CPU platforms (git-fixes).\n- dmaengine: owl: fix register access functions (git-fixes).\n- dmaengine: tegra186: Fix residual calculation (git-fixes).\n- docs: Document the FAN_FS_ERROR event (stable-fixes).\n- drm-print: add drm_dbg_driver to improve namespace symmetry (stable-fixes).\n- drm/amd/display: Do not recursively call manual trigger programming (stable-fixes).\n- drm/amd/display: Fix nanosec stat overflow (stable-fixes).\n- drm/amd/display: fix disable otg wa logic in DCN316 (stable-fixes).\n- drm/amd/pm: fixes a random hang in S4 for SMU v13.0.4/11 (stable-fixes).\n- drm/amdgpu/sdma5.2: use legacy HDP flush for SDMA2/3 (stable-fixes).\n- drm/amdgpu: Fix leak when GPU memory allocation fails (stable-fixes).\n- drm/amdgpu: Reset dGPU if suspend got aborted (stable-fixes).\n- drm/amdgpu: always force full reset for SOC21 (stable-fixes).\n- drm/amdgpu: fix incorrect active rb bitmap for gfx11 (stable-fixes).\n- drm/amdgpu: fix incorrect number of active RBs for gfx11 (stable-fixes).\n- drm/amdgpu: once more fix the call oder in amdgpu_ttm_move() v2 (git-fixes).\n- drm/amdgpu: validate the parameters of bo mapping operations more clearly (git-fixes).\n- drm/amdkfd: Reset GPU on queue preemption failure (stable-fixes).\n- drm/ast: Fix soft lockup (git-fixes).\n- drm/client: Fully protect modes[] with dev-\u003emode_config.mutex (stable-fixes).\n- drm/i915/cdclk: Fix CDCLK programming order when pipes are active (git-fixes).\n- drm/i915/vrr: Disable VRR when using bigjoiner (stable-fixes).\n- drm/i915: Disable port sync when bigjoiner is used (stable-fixes).\n- drm/msm/dp: fix typo in dp_display_handle_port_status_changed() (git-fixes).\n- drm/nouveau/nvkm: add a replacement for nvkm_notify (bsc#1223834)\n- drm/panel: ili9341: Respect deferred probe (git-fixes).\n- drm/panel: ili9341: Use predefined error codes (git-fixes).\n- drm/panel: visionox-rm69299: do not unregister DSI device (git-fixes).\n- drm/vc4: do not check if plane-\u003estate-\u003efb == state-\u003efb (stable-fixes).\n- drm/vmwgfx: Enable DMA mappings with SEV (git-fixes).\n- drm/vmwgfx: Fix crtc's atomic check conditional (git-fixes).\n- drm/vmwgfx: Fix invalid reads in fence signaled events (git-fixes).\n- drm/vmwgfx: Sort primary plane formats by order of preference (git-fixes).\n- drm: nv04: Fix out of bounds access (git-fixes).\n- drm: panel-orientation-quirks: Add quirk for GPD Win Mini (stable-fixes).\n- drm: panel-orientation-quirks: Add quirk for Lenovo Legion Go (stable-fixes).\n- dump_stack: Do not get cpu_sync for panic CPU (bsc#1223574).\n- fbdev: fix incorrect address computation in deferred IO (git-fixes).\n- fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2 (stable-fixes).\n- fbmon: prevent division by zero in fb_videomode_from_videomode() (stable-fixes).\n- fix build warning\n- fuse: do not unhash root (bsc#1223951).\n- fuse: fix root lookup with nonzero generation (bsc#1223950).\n- hwmon: (amc6821) add of_match table (stable-fixes).\n- i2c: pxa: hide unused icr_bits[] variable (git-fixes).\n- i2c: smbus: fix NULL function pointer dereference (git-fixes).\n- i40e: Fix VF MAC filter removal (git-fixes).\n- idma64: Do not try to serve interrupts when device is powered off (git-fixes).\n- iio: accel: mxc4005: Interrupt handling fixes (git-fixes).\n- iio:imu: adis16475: Fix sync mode setting (git-fixes).\n- init/main.c: Fix potential static_command_line memory overflow (git-fixes).\n- iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter (git-fixes).\n- iommu/amd: Do not block updates to GATag if guest mode is on (git-fixes).\n- iommu/amd: Fix 'Guest Virtual APIC Table Root Pointer' configuration in IRTE (git-fixes).\n- iommu/amd: Fix domain flush size when syncing iotlb (git-fixes).\n- iommu/amd: Fix error handling for pdev_pri_ats_enable() (git-fixes).\n- iommu/arm-smmu-qcom: Limit the SMR groups to 128 (git-fixes).\n- iommu/arm-smmu-v3: Acknowledge pri/event queue overflow if any (git-fixes).\n- iommu/arm-smmu-v3: Work around MMU-600 erratum 1076982 (git-fixes).\n- iommu/fsl: fix all kernel-doc warnings in fsl_pamu.c (git-fixes).\n- iommu/iova: Fix alloc iova overflows issue (git-fixes).\n- iommu/mediatek: Flush IOTLB completely only if domain has been attached (git-fixes).\n- iommu/rockchip: Fix unwind goto issue (git-fixes).\n- iommu/sprd: Release dma buffer to avoid memory leak (git-fixes).\n- iommu/vt-d: Allocate local memory for page request queue (git-fixes).\n- iommu/vt-d: Allow zero SAGAW if second-stage not supported (git-fixes).\n- iommu/vt-d: Fix error handling in sva enable/disable paths (git-fixes).\n- iommu: Fix error unwind in iommu_group_alloc() (git-fixes).\n- ipv6/addrconf: fix a potential refcount underflow for idev (git-fixes).\n- kABI: Adjust trace_iterator.wait_index (git-fixes).\n- kprobes: Fix double free of kretprobe_holder (bsc#1220901).\n- kprobes: Fix possible use-after-free issue on kprobe registration (git-fixes).\n- libnvdimm/of_pmem: Use devm_kstrdup instead of kstrdup and check its return value (git-fixes).\n- libnvdimm/region: Allow setting align attribute on regions without mappings (git-fixes).\n- livepatch: Fix missing newline character in klp_resolve_symbols() (bsc#1223539).\n- md/raid1: fix choose next idle in read_balance() (git-fixes).\n- md: Do not clear MD_CLOSING when the raid is about to stop (git-fixes).\n- md: do not clear MD_RECOVERY_FROZEN for new dm-raid until resume (git-fixes).\n- media: cec: core: remove length check of Timer Status (stable-fixes).\n- media: sta2x11: fix irq handler cast (stable-fixes).\n- mei: me: add arrow lake point H DID (stable-fixes).\n- mei: me: add arrow lake point S DID (stable-fixes).\n- mei: me: disable RPL-S on SPS and IGN firmwares (git-fixes).\n- mm/vmscan: make sure wakeup_kswapd with managed zone (bsc#1223473).\n- mmc: sdhci-msm: pervent access to suspended controller (git-fixes).\n- mtd: diskonchip: work around ubsan link failure (stable-fixes).\n- nd_btt: Make BTT lanes preemptible (git-fixes).\n- net: bridge: vlan: fix memory leak in __allowed_ingress (git-fixes).\n- net: fix a memleak when uncloning an skb dst and its metadata (git-fixes).\n- net: fix skb leak in __skb_tstamp_tx() (git-fixes).\n- net: ipv6: ensure we call ipv6_mc_down() at most once (git-fixes).\n- net: mld: fix reference count leak in mld_{query | report}_work() (git-fixes).\n- net: stream: purge sk_error_queue in sk_stream_kill_queues() (git-fixes).\n- net: usb: ax88179_178a: avoid the interface always configured as random address (git-fixes).\n- net: usb: ax88179_178a: avoid writing the mac address before first reading (git-fixes).\n- net: usb: ax88179_178a: stop lying about skb-\u003etruesize (git-fixes).\n- net: vlan: fix underflow for the real_dev refcnt (git-fixes).\n- netfilter: br_netfilter: Drop dst references before setting (git-fixes).\n- netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check() (git-fixes).\n- netfilter: nft_ct: fix l3num expectations with inet pseudo family (git-fixes).\n- nfsd: Fixed mount issue with KOTD (bsc#1223380 bsc#1217408 bsc#1223640).\n- nfsd: use __fput_sync() to avoid delayed closing of files (bsc#1223380 bsc#1217408).\n- nilfs2: fix OOB in nilfs_set_de_type (git-fixes).\n- nilfs2: fix OOB in nilfs_set_de_type (git-fixes).\n- nouveau: fix function cast warning (git-fixes).\n- nouveau: fix instmem race condition around ptr stores (git-fixes).\n- nvdimm/namespace: drop nested variable in create_namespace_pmem() (git-fixes).\n- nvdimm: Allow overwrite in the presence of disabled dimms (git-fixes).\n- nvdimm: Fix badblocks clear off-by-one error (git-fixes).\n- nvdimm: Fix dereference after free in register_nvdimm_pmu() (git-fixes).\n- nvdimm: Fix firmware activation deadlock scenarios (git-fixes).\n- nvdimm: Fix memleak of pmu attr_groups in unregister_nvdimm_pmu() (git-fixes).\n- pci_iounmap(): Fix MMIO mapping leak (git-fixes).\n- phy: tegra: xusb: Add API to retrieve the port number of phy (stable-fixes).\n- pinctrl: renesas: checker: Limit cfg reg enum checks to provided IDs (stable-fixes).\n- platform/x86: intel-vbtn: Update tablet mode switch at end of probe (git-fixes).\n- platform/x86: touchscreen_dmi: Add an extra entry for a variant of the Chuwi Vi8 tablet (stable-fixes).\n- powerpc/kasan: Do not instrument non-maskable or raw interrupts (bsc#1223191).\n- powerpc/pseries/iommu: LPAR panics when rebooted with a frozen PE (bsc#1222011 ltc#205900).\n- powerpc/rtas: define pr_fmt and convert printk call sites (bsc#1223369 ltc#205888).\n- powerpc/rtas: export rtas_error_rc() for reuse (bsc#1223369 ltc#205888).\n- powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt (bsc#1221645 ltc#205739 bsc#1223191).\n- powerpc: Refactor verification of MSR_RI (bsc#1223191).\n- printk: Add this_cpu_in_panic() (bsc#1223574).\n- printk: Adjust mapping for 32bit seq macros (bsc#1223574).\n- printk: Avoid non-panic CPUs writing to ringbuffer (bsc#1223574).\n- printk: Disable passing console lock owner completely during panic() (bsc#1223574).\n- printk: Drop console_sem during panic (bsc#1223574).\n- printk: Rename abandon_console_lock_in_panic() to other_cpu_in_panic() (bsc#1223574).\n- printk: Use prb_first_seq() as base for 32bit seq macros (bsc#1223574).\n- printk: Wait for all reserved records with pr_flush() (bsc#1223574).\n- printk: nbcon: Relocate 32bit seq macros (bsc#1223574).\n- printk: ringbuffer: Clarify special lpos values (bsc#1223574).\n- printk: ringbuffer: Cleanup reader terminology (bsc#1223574).\n- printk: ringbuffer: Do not skip non-finalized records with prb_next_seq() (bsc#1223574).\n- printk: ringbuffer: Improve prb_next_seq() performance (bsc#1223574).\n- printk: ringbuffer: Skip non-finalized records in panic (bsc#1223574).\n- pstore/zone: Add a null pointer check to the psz_kmsg_read (stable-fixes).\n- ring-buffer: Do not set shortest_full when full target is hit (git-fixes).\n- ring-buffer: Fix full_waiters_pending in poll (git-fixes).\n- ring-buffer: Fix resetting of shortest_full (git-fixes).\n- ring-buffer: Fix waking up ring buffer readers (git-fixes).\n- ring-buffer: Make wake once of ring_buffer_wait() more robust (git-fixes).\n- ring-buffer: Use wait_event_interruptible() in ring_buffer_wait() (git-fixes).\n- ring-buffer: use READ_ONCE() to read cpu_buffer-\u003ecommit_page in concurrent environment (git-fixes).\n- s390/cio: Ensure the copied buf is NUL terminated (git-fixes bsc#1223875).\n- s390/decompressor: fix misaligned symbol build error (git-fixes bsc#1223785).\n- s390/mm: Fix clearing storage keys for huge pages (git-fixes bsc#1223877).\n- s390/mm: Fix storage key clearing for guest huge pages (git-fixes bsc#1223878).\n- s390/qeth: Fix kernel panic after setting hsuid (git-fixes bsc#1223879).\n- s390/scm: fix virtual vs physical address confusion (git-fixes bsc#1223784).\n- s390/vdso: Add CFI for RA register to asm macro vdso_func (git-fixes bsc#1223876).\n- s390/vdso: drop '-fPIC' from LDFLAGS (git-fixes bsc#1223598).\n- s390/zcrypt: fix reference counting on zcrypt card objects (git-fixes bsc#1223595).\n- s390: Fixed LPM of lpar failure with error HSCLA2CF in 19th loops (jsc#PED-542 git-fixes bsc#1213573 ltc#203238).\n- s390: Fixed kernel backtrack (bsc#1141539 git-fixes).\n- serial/pmac_zilog: Remove flawed mitigation for rx irq flood (git-fixes).\n- serial: core: Provide port lock wrappers (stable-fixes).\n- serial: core: fix kernel-doc for uart_port_unlock_irqrestore() (git-fixes).\n- serial: mxs-auart: add spinlock around changing cts state (git-fixes).\n- slimbus: qcom-ngd-ctrl: Add timeout for wait operation (git-fixes).\n- speakup: Avoid crash on very long word (git-fixes).\n- speakup: Fix 8bit characters from direct synth (git-fixes).\n- tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp (git-fixes).\n- thunderbolt: Avoid notify PM core about runtime PM resume (stable-fixes).\n- thunderbolt: Fix wake configurations after device unplug (stable-fixes).\n- tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string (git-fixes).\n- tracing/ring-buffer: Fix wait_on_pipe() race (git-fixes).\n- tracing: Have saved_cmdlines arrays all in one allocation (git-fixes).\n- tracing: Remove precision vsnprintf() check from print event (git-fixes).\n- tracing: Show size of requested perf buffer (git-fixes).\n- tracing: Use .flush() call to wake up readers (git-fixes).\n- usb: Disable USB3 LPM at shutdown (stable-fixes).\n- usb: Fix regression caused by invalid ep0 maxpacket in virtual SuperSpeed device (git-fixes).\n- usb: dwc2: host: Fix dereference issue in DDMA completion flow (git-fixes).\n- usb: gadget: composite: fix OS descriptors w_value logic (git-fixes).\n- usb: gadget: f_fs: Fix a race condition when processing setup packets (git-fixes).\n- usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error (stable-fixes).\n- usb: gadget: tegra-xudc: Fix USB3 PHY retrieval logic (git-fixes).\n- usb: ohci: Prevent missed ohci interrupts (git-fixes).\n- usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined (stable-fixes).\n- usb: typec: tcpci: add generic tcpci fallback compatible (stable-fixes).\n- usb: typec: tcpm: Check for port partner validity before consuming it (git-fixes).\n- usb: typec: tcpm: unregister existing source caps before re-registration (bsc#1220569).\n- usb: typec: ucsi: Ack unsupported commands (stable-fixes).\n- usb: typec: ucsi: Clear UCSI_CCI_RESET_COMPLETE before reset (stable-fixes).\n- usb: typec: ucsi: Fix connector check on init (git-fixes).\n- usb: udc: remove warning when queue disabled ep (stable-fixes).\n- vdpa/mlx5: Allow CVQ size changes (git-fixes).\n- virtio: treat alloc_dax() -EOPNOTSUPP failure as non-fatal (bsc#1223949).\n- wifi: ath9k: fix LNA selection in ath_ant_try_scan() (stable-fixes).\n- wifi: iwlwifi: mvm: remove old PASN station when adding a new one (git-fixes).\n- wifi: iwlwifi: mvm: return uid from iwl_mvm_build_scan_cmd (git-fixes).\n- wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (stable-fixes).\n- wifi: nl80211: do not free NULL coalescing rule (git-fixes).\n- x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ (git-fixes).\n- x86/mm: Ensure input to pfn_to_kaddr() is treated as a 64-bit type (jsc#PED-7167 git-fixes).\n- x86/sev: Skip ROM range scans and validation for SEV-SNP guests (jsc#PED-7167 git-fixes).\n- x86/xen: Add some null pointer checking to smp.c (git-fixes).\n- x86/xen: add CPU dependencies for 32-bit build (git-fixes).\n- x86/xen: fix percpu vcpu_info allocation (git-fixes).\n- xen-netback: properly sync TX responses (git-fixes).\n- xen-netfront: Add missing skb_mark_for_recycle (git-fixes).\n- xen/gntdev: Fix the abuse of underlying struct page in DMA-buf import (git-fixes).\n- xen/xenbus: document will_handle argument for xenbus_watch_path() (git-fixes).\n- xfrm6: fix inet6_dev refcount underflow problem (git-fixes).\n","status":"published","published":"2024-05-15T19:08:39Z","modified":"2026-02-04T04:20:21.705752Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:2135-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.\n\nThe following security bugs were fixed:\n\n- CVE-2024-22099: Fixed a null-pointer-dereference in rfcomm_check_security (bsc#1219170).\n- CVE-2024-26764: Fixed IOCB_AIO_RW check in fs/aio before the struct aio_kiocb conversion (bsc#1222721).\n- CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).\n- CVE-2024-26673: Fixed netfilter/nft_ct layer 3 and 4 protocol sanitization (bsc#1222368).\n- CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).\n- CVE-2024-26993: Fixed fs/sysfs reference leak in sysfs_break_active_protection() (bsc#1223693).\n- CVE-2024-27013: Fixed tun limit printing rate when illegal packet received by tun device (bsc#1223745).\n- CVE-2024-27014: Fixed net/mlx5e to prevent deadlock while disabling aRFS (bsc#1223735).\n- CVE-2024-26948: Fixed drm/amd/display by adding dc_state NULL check in dc_state_release (bsc#1223664).\n- CVE-2024-27056: Fixed wifi/iwlwifi/mvm to ensure offloading TID queue exists (bsc#1223822).\n- CVE-2024-26960: Fixed mm/swap race between free_swap_and_cache() and swapoff() (bsc#1223655).\n- CVE-2023-52652: Fixed NTB for possible name leak in ntb_register_device() (bsc#1223686).\n- CVE-2024-23848: Fixed media/cec for possible use-after-free in cec_queue_msg_fh (bsc#1219104).\n- CVE-2024-26982: Fixed Squashfs inode number check not to be an invalid value of zero (bsc#1223634).\n- CVE-2024-26878: Fixed quota for potential NULL pointer dereference (bsc#1223060).\n- CVE-2024-26901: Fixed do_sys_name_to_handle() to use kzalloc() to prevent kernel-infoleak (bsc#1223198).\n- CVE-2024-26671: Fixed blk-mq IO hang from sbitmap wakeup race (bsc#1222357).\n- CVE-2024-26772: Fixed ext4 to avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() (bsc#1222613).\n- CVE-2024-26906: Disallowed vsyscall page read for copy_from_kernel_nofault() (bsc#1223202).\n- CVE-2024-26816: Ignore relocations in .notes section when building with CONFIG_XEN_PV=y (bsc#1222624).\n- CVE-2024-26783: Fixed mm/vmscan bug when calling wakeup_kswapd() with a wrong zone index (bsc#1222615).\n- CVE-2024-26883: Fixed bpf stackmap overflow check on 32-bit arches (bsc#1223035).\n- CVE-2024-26884: Fixed bpf hashtab overflow check on 32-bit arches (bsc#1223189).\n- CVE-2024-26885: Fixed bpf DEVMAP_HASH overflow check on 32-bit arches (bsc#1223190).\n- CVE-2024-26882: Fixed net/ip_tunnel to make sure to pull inner header in ip_tunnel_rcv() (bsc#1223034).\n- CVE-2023-52645: Fixed pmdomain/mediatek race conditions with genpd (bsc#1223033).\n- CVE-2024-26836: Fixed platform/x86/think-lmi password opcode ordering for workstations (bsc#1222968).\n- CVE-2024-26601: Fixed ext4 buddy bitmap corruption via fast commit replay (bsc#1220342).\n- CVE-2024-26773: Fixed ext4 block allocation from corrupted group in ext4_mb_try_best_found() (bsc#1222618).\n- CVE-2024-26807: Fixed spi/cadence-qspi NULL pointer reference in runtime PM hooks (bsc#1222801).\n- CVE-2024-26737: Fixed selftests/bpf racing between bpf_timer_cancel_and_free and bpf_timer_cancel (bsc#1222557).\n- CVE-2024-26733: Fixed an overflow in arp_req_get() in arp (bsc#1222585).\n- CVE-2024-26684: Fixed net/stmmac/xgmac handling of DPP safety error for DMA channels (bsc#1222445).\n- CVE-2024-26704: Fixed a double-free of blocks due to wrong extents moved_len in ext4 (bsc#1222422).\n- CVE-2023-52591: Fixed a possible reiserfs filesystem corruption via directory renaming (bsc#1221044).\n- CVE-2023-52503: Fixed tee/amdtee use-after-free vulnerability in amdtee_close_session (bsc#1220915).\n- CVE-2024-26642: Fixed the set of anonymous timeout flag in netfilter nf_tables (bsc#1221830).\n- CVE-2024-26614: Fixed the initialization of accept_queue's spinlocks (bsc#1221293).\n- CVE-2024-25739: Fixed possible crash in create_empty_lvol() in drivers/mtd/ubi/vtbl.c (bsc#1219834).\n- CVE-2023-6270: Fixed a use-after-free issue in aoecmd_cfg_pkts (bsc#1218562).\n- CVE-2024-36030: Fix the double free in rvu_npc_freemem() (bsc#1225712)\n- CVE-2023-52698: Fix memory leak in netlbl_calipso_add_pass() (bsc#1224621)\n- CVE-2024-26860: Fix a memory leak when rechecking the data (bsc#1223077).\n- CVE-2023-52772: Fix use-after-free in unix_stream_read_actor() (bsc#1224989).\n- CVE-2024-27431: Zero-initialise xdp_rxq_info struct before running XDP program (bsc#1224718).\n- CVE-2024-35860: Support deferring bpf_link dealloc to after RCU grace period BPF link for some program types (bsc#1224531).\n- CVE-2024-35964: Fix not validating setsockopt user input Check user input length before copying data (bsc#1224581).\n- CVE-2023-0160: Prevent lock inversion deadlock in map delete elem  (bsc#1209657).\n- CVE-2024-35903: Fix IP after emitting call depth accounting Adjust the IP passed to `emit_patch` so it calculates the correct offset for the CALL instruction if `x86_call_depth_emit_accounting` emits code (bsc#1224493).\n- CVE-2024-35931: Skip do PCI error slot reset during RAS recovery (bsc#1224652).\n- CVE-2024-35877: Fix VM_PAT handling in COW mappings (bsc#1224525).\n- CVE-2024-35969: Fix race condition between ipv6_get_ifaddr and ipv6_del_addr (bsc#1224580)\n- CVE-2024-35852: Fix memory leak when canceling rehash work The rehash delayed work is rescheduled with a delay if the number of credits at end of the work is not negative as supposedly it means that the migration ended (bsc#1224502).\n- CVE-2024-36006: Fix incorrect list API usage (bsc#1224541).\n- CVE-2024-36007: Fix warning during rehash (bsc#1224543).\n- CVE-2024-35872: Fix GUP-fast succeeding on secretmem folios (bsc#1224530).\n- CVE-2024-35956: Fix qgroup prealloc rsv leak in subvolume operations (bsc#1224674)\n- CVE-2023-52771: Fix delete_endpoint() vs parent unregistration race  (bsc#1225007).\n- CVE-2024-27408: Add sync read before starting the  DMA transfer in remote setup (bsc#1224430).\n- CVE-2024-35943: Add a null pointer check to the omap_prm_domain_init devm_kasprintf()returns a pointer to dynamically allocated memory which can be NULL upon failure (bsc#1224649).\n- CVE-2024-35921: Fix oops when HEVC init fails (bsc#1224477).\n- CVE-2023-52860: Use cpuhp_state_remove_instance_nocalls() for hisi_hns3_pmu uninit process (bsc#1224936).\n- CVE-2024-35991: kABI workaround for struct idxd_evl (bsc#1224553).\n- CVE-2024-35854: Fix possible use-after-free during rehash (bsc#1224636).\n- CVE-2024-27418: Take ownership of skb in mctp_local_output (bsc#1224720)\n- CVE-2024-27417: Fix potential 'struct net' leak in inet6_rtm_getaddr() (bsc#1224721).\n- CVE-2024-35905: Protect against int overflow for stack access size (bsc#1224488).\n- CVE-2024-35917: Fix bpf_plt pointer arithmetic (bsc#1224481).\n- CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put() to nsure the value passed to scarlett2_mixer_ctl_put() is between 0 and SCARLETT2_MIXER_MAX_VALUE so we don't attempt to access outside scarlett2_mixer_values[] (bsc#1224727).\n- CVE-2023-52680: Add missing error checks to *_ctl_get() because the *_ctl_get() functions which call scarlett2_update_*() were not checking the return value (bsc#1224608).\n- CVE-2023-52692: Add missing error check to scarlett2_usb_set_config() scarlett2_usb_set_config() calls scarlett2_usb_get() but was not checking the result (bsc#1224628).\n- CVE-2024-35944: Fix memcpy() run-time warning in dg_dispatch_as_host() Syzkaller hit 'WARNING in dg_dispatch_as_host' bug (bsc#1224648).\n- CVE-2024-26923: Suppress false-positive lockdep splat for spin_lock()  in __unix_gc() (bsc#1223384).\n- CVE-2023-52659: Ensure input to pfn_to_kaddr() is treated as a 64-bit type (bsc#1224442).\n- CVE-2024-21823: Hardware logic with insecure de-synchronization in Intel(R) DSA and Intel(R) IAA for some Intel(R) 4th or 5th generation Xeon(R) processors may have allowed an authorized user to potentially enable denial of service via local access (bsc#1223625).\n- CVE-2024-26828: Fix underflow in parse_server_interfaces() (bsc#1223084).\n- CVE-2024-27395: Fix Use-After-Free in ovs_ct_exit Since kfree_rcu (bsc#1224098).\n- CVE-2023-52483: Perform route lookups under a RCU read-side lock (bsc#1220738).\n- CVE-2024-27396: Fix Use-After-Free in gtp_dellink (bsc#1224096).\n- CVE-2024-26632: Fix iterating over an empty bio with  bio_for_each_folio_all (bsc#1221635).\n- CVE-2024-27401: Ensure that packet_buffer_get respects the user_length provided. (bsc#1224181).\n- CVE-2024-26775: Avoid potential deadlock at set_capacity (bsc#1222627).\n- CVE-2024-26958: Fix UAF in direct writes (bsc#1223653).\n- CVE-2024-26643: Mark set as dead when unbinding anonymous set with timeout While the rhashtable set gc runs asynchronously, a race allowed it to collect elements from anonymous sets with timeouts while it is being released from the commit path. (bsc#1221829).\n- CVE-2023-52618: Check for unlikely string overflow (bsc#1221615).\n- CVE-2023-6238: Only privileged user could specify a small meta buffer and let the device perform larger Direct Memory Access (DMA) into the same buffer, overwriting unrelated kernel memory, causing random kernel crashes and memory corruption (bsc#1217384).\n- CVE-2024-26946: Use copy_from_kernel_nofault() to read from unsafe address Read from an unsafe address with copy_from_kernel_nofault() in arch_adjust_kprobe_addr() because this function is used before checking the address is in text or not (bsc#1223669).\n- CVE-2024-26945: Fix nr_cpus nr_iaa case If nr_cpus nr_iaa, the calculated cpus_per_iaa will be 0, which causes a divide-by-0 in rebalance_wq_table() (bsc#1223732).\n- CVE-2024-26679: Read sk-\u003esk_family once in inet_recv_error() inet_recv_error() is called without holding the socket lock. IPv6 socket could mutate to IPv4 with IPV6_ADDRFORM socket option and trigger a KCSAN warning (bsc#1222385).\n- CVE-2024-26791: Properly validate device names (bsc#1222793)\n- CVE-2023-52641: Add NULL ptr dereference checking at the end of attr_allocate_frame() (bsc#1222303)\n- CVE-2024-26726: Do not drop extent_map for free space inode on write error (bsc#1222532)\n- CVE-2024-27022: Defer linking file vma until vma is fully initialized (bsc#1223774).\n- CVE-2024-26899: Fix deadlock between bd_link_disk_holder and partition scan (bsc#1223045).\n- CVE-2024-26638: Always initialize struct msghdr completely (bsc#1221649).\n- CVE-2024-26909: Fix drm bridge use-after-free A recent DRM series purporting to simplify support (bsc#1223143).\n- CVE-2024-26674: Revert to _ASM_EXTABLE_UA() for {get,put}_user() fixups (bsc#1222378).\n- CVE-2024-26832: Fix missing folio cleanup in writeback race path (bsc#1223007).\n- CVE-2024-26844: Fix WARNING in _copy_from_iter (bsc#1223015).\n- CVE-2024-26774: Avoid dividing by 0 in mb_update_avg_fragment_size() when block bitmap corrupt (bsc#1222622).\n- CVE-2024-26815: Properly check TCA_TAPRIO_TC_ENTRY_INDEX (bsc#1222635).\n- cve-2024-267600: Fix bio_put() for error case (bsc#1222596).\n- CVE-2024-26731: Fix NULL pointer dereference in sk_psock_verdict_data_ready() (bsc#1222371).\n- CVE-2024-26740: Use the backlog for mirred ingress (bsc#1222563).\n- CVE-2023-52640: Fix oob in ntfs_listxattr The length of name cannot exceed the space occupied by ea (bsc#1222301).\n- CVE-2023-52631: Fix a NULL dereference bug (bsc#1222264).\n- CVE-2023-52458: Add check that partition length needs to be aligned  with block size (bsc#1220428).\n- CVE-2023-6270: Fix the potential use-after-free problem in aoecmd_cfg_pkts  (bsc#1218562).\n- CVE-2024-26805: Fix kernel-infoleak-after-free in __skb_datagram_iter (bsc#1222630).\n- CVE-2024-26991: Do not overflow lpage_info when checking attributes (bsc#1223695).\n\n- CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).\n- CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).\n- CVE-2024-26822: Set correct id, uid and cruid for multiuser  automounts (bsc#1223011).\n- CVE-2023-52434: Fixed potential OOBs in smb2_parse_contexts()  (bsc#1220148).\n- CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).\n- CVE-2024-35999: Fixed missing lock when picking channel (bsc#1224550).\n- CVE-2024-35861: Fixed potential UAF in  cifs_signal_cifsd_for_reconnect() (bsc#1224766).\n- CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted()  (bsc#1224764).\n- CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1224763).\n- CVE-2024-35865: Fixed potential UAF in smb2_is_valid_oplock_break()  (bsc#1224668).\n- CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break()  (bsc#1224765).\n- CVE-2024-35867: Fixed potential UAF in cifs_stats_proc_show() (bsc#1224664).\n- CVE-2024-35868: Fixed potential UAF in cifs_stats_proc_write() (bsc#1224678).\n- CVE-2024-35866: Fixed potential UAF in cifs_dump_full_key()  (bsc#1224667).\n- CVE-2024-35869: Guarantee refcounted children from parent session  (bsc#1224679).\n- CVE-2024-35870: Fixed UAF in smb2_reconnect_server() (bsc#1224672).\n- CVE-2024-26692: Fixed regression in writes when non-standard maximum write  size negotiated (bsc#1222464).\n- CVE-2024-27036: Fixed writeback data corruption (bsc#1223810).    \n    \nThe following non-security bugs were fixed:\n\n- 9p: add missing locking around taking dentry fid list (git-fixes)\n- ACPI: CPPC: Fix access width used for PCC registers (git-fixes).\n- ACPI: CPPC: Fix bit_offset shift in MASK_VAL() macro (git-fixes).\n- ACPI: CPPC: Use access_width over bit_width for system memory accesses (stable-fixes).\n- ACPI: Fix Generic Initiator Affinity _OSC bit (git-fixes).\n- ACPI: LPSS: Advertise number of chip selects via property (git-fixes).\n- ACPI: bus: Indicate support for IRQ ResourceSource thru _OSC (git-fixes).\n- ACPI: bus: Indicate support for _TFP thru _OSC (git-fixes).\n- ACPI: bus: Indicate support for the Generic Event Device thru _OSC (git-fixes).\n- ACPI: disable -Wstringop-truncation (git-fixes).\n- ACPI: resource: Add Infinity laptops to irq1_edge_low_force_override (stable-fixes).\n- ACPI: resource: Do IRQ override on Lunnen Ground laptops (stable-fixes).\n- ACPI: scan: Do not increase dep_unmet for already met dependencies (git-fixes).\n- ACPI: video: Add backlight=native quirk for Lenovo Slim 7 16ARH7 (bsc#1217750).\n- ACPI: x86: Move acpi_quirk_skip_serdev_enumeration() out of CONFIG_X86_ANDROID_TABLETS (stable-fixes).\n- ACPICA: debugger: check status of acpi_evaluate_object() in acpi_db_walk_for_fields() (git-fixes).\n- ALSA/hda: intel-dsp-config: reduce log verbosity (git-fixes).\n- ALSA: Fix deadlocks with kctl removals at disconnection (stable-fixes).\n- ALSA: aoa: avoid false-positive format truncation warning (git-fixes).\n- ALSA: core: Fix NULL module pointer assignment at card init (git-fixes).\n- ALSA: core: Remove debugfs at disconnection (git-fixes).\n- ALSA: firewire-lib: handle quirk to calculate payload quadlets as data block counter (stable-fixes).\n- ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup (git-fixes).\n- ALSA: hda/realtek - Enable audio jacks of Haier Boyue G42 with ALC269VC (stable-fixes).\n- ALSA: hda/realtek - Fix inactive headset mic jack (stable-fixes).\n- ALSA: hda/realtek - Set GPIO3 to default at S4 state for Thinkpad with ALC1318 (stable-fixes).\n- ALSA: hda/realtek - fixed headset Mic not show (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP SnowWhite laptops (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP Spectre x360 14 eu0000 (stable-fixes).\n- ALSA: hda/realtek: Add quirks for ASUS Laptops using CS35L56 (stable-fixes).\n- ALSA: hda/realtek: Add quirks for HP Omen models using CS35L41 (stable-fixes).\n- ALSA: hda/realtek: Add quirks for Huawei Matebook D14 NBLB-WAX9N (stable-fixes).\n- ALSA: hda/realtek: Add quirks for Lenovo 13X (stable-fixes).\n- ALSA: hda/realtek: Add quirks for some Clevo laptops (stable-fixes).\n- ALSA: hda/realtek: Add sound quirks for Lenovo Legion slim 7 16ARHA7 models (stable-fixes).\n- ALSA: hda/realtek: Add support for ASUS Zenbook 2024 HN7306W (stable-fixes).\n- ALSA: hda/realtek: Adjust G814JZR to use SPI init for amp (git-fixes).\n- ALSA: hda/realtek: Drop doubly quirk entry for 103c:8a2e (git-fixes).\n- ALSA: hda/realtek: Enable headset mic of JP-IK LEAP W502 with ALC897 (stable-fixes).\n- ALSA: hda/realtek: Fix build error without CONFIG_PM (stable-fixes).\n- ALSA: hda/realtek: Fix conflicting PCI SSID 17aa:386f for Lenovo Legion models (bsc#1223462).\n- ALSA: hda/realtek: Fix internal speakers for Legion Y9000X 2022 IAH7 (stable-fixes).\n- ALSA: hda/realtek: Fix mute led of HP Laptop 15-da3001TU (stable-fixes).\n- ALSA: hda/realtek: Fix volumn control of ThinkBook 16P Gen4 (git-fixes).\n- ALSA: hda/realtek: Fixes for Asus GU605M and GA403U sound (stable-fixes).\n- ALSA: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with microphone (git-fixes).\n- ALSA: hda/realtek: cs35l41: Support ASUS ROG G634JYR (stable-fixes).\n- ALSA: hda/realtek: fix mute/micmute LEDs do not work for ProBook 440/460 G11 (stable-fixes).\n- ALSA: hda/realtek: fix the hp playback volume issue for LG machines (stable-fixes).\n- ALSA: hda/tas2781: Add new vendor_id and subsystem_id to support ThinkPad ICE-1 (stable-fixes).\n- ALSA: hda/tas2781: add locks to kcontrols (git-fixes).\n- ALSA: hda/tas2781: correct the register for pow calibrated data (git-fixes).\n- ALSA: hda/tas2781: remove digital gain kcontrol (git-fixes).\n- ALSA: hda: Add Intel BMG PCI ID and HDMI codec vid (stable-fixes).\n- ALSA: hda: clarify Copyright information (stable-fixes).\n- ALSA: hda: cs35l41: Add support for ASUS ROG 2024 Laptops (stable-fixes).\n- ALSA: hda: cs35l41: Ignore errors when configuring IRQs (stable-fixes).\n- ALSA: hda: cs35l41: Remove Speaker ID for Lenovo Legion slim 7 16ARHA7 (git-fixes).\n- ALSA: hda: cs35l41: Remove redundant argument to cs35l41_request_firmware_file() (stable-fixes).\n- ALSA: hda: cs35l41: Set the max PCM Gain using tuning setting (stable-fixes).\n- ALSA: hda: cs35l41: Support HP Omen models without _DSD (stable-fixes).\n- ALSA: hda: cs35l41: Support Lenovo 13X laptop without _DSD (stable-fixes).\n- ALSA: hda: cs35l41: Update DSP1RX5/6 Sources for DSP config (stable-fixes).\n- ALSA: hda: cs35l56: Add ACPI device match tables (git-fixes).\n- ALSA: hda: cs35l56: Exit cache-only after cs35l56_wait_for_firmware_boot() (stable-fixes).\n- ALSA: hda: cs35l56: Fix lifetime of cs_dsp instance (git-fixes).\n- ALSA: hda: cs35l56: Set the init_done flag before component_add() (git-fixes).\n- ALSA: hda: hda_cs_dsp_ctl: Remove notification of driver write (stable-fixes).\n- ALSA: hda: intel-dsp-config: harden I2C/I2S codec detection (stable-fixes).\n- ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node() (git-fixes).\n- ALSA: line6: Zero-initialize message buffers (stable-fixes).\n- ALSA: scarlett2: Add Focusrite Clarett 2Pre and 4Pre USB support (stable-fixes).\n- ALSA: scarlett2: Add Focusrite Clarett+ 2Pre and 4Pre support (stable-fixes).\n- ALSA: scarlett2: Add correct product series name to messages (stable-fixes).\n- ALSA: scarlett2: Add missing error check to scarlett2_config_save() (git-fixes).\n- ALSA: scarlett2: Add support for Clarett 8Pre USB (stable-fixes).\n- ALSA: scarlett2: Default mixer driver to enabled (stable-fixes).\n- ALSA: scarlett2: Move USB IDs out from device_info struct (stable-fixes).\n- ALSA: seq: Do not clear bank selection at event -\u003e UMP MIDI2 conversion (git-fixes).\n- ALSA: seq: Fix incorrect UMP type for system messages (git-fixes).\n- ALSA: seq: Fix missing bank setup between MIDI1/MIDI2 UMP conversion (git-fixes).\n- ALSA: seq: Fix yet another spot for system message conversion (git-fixes).\n- ALSA: seq: ump: Fix conversion from MIDI2 to MIDI1 UMP messages (git-fixes).\n- ALSA: seq: ump: Fix swapped song position pointer data (git-fixes).\n- ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs (git-fixes).\n- ALSA: timer: Set lower bound of start tick time (stable-fixes).\n- ALSA: ump: Do not accept an invalid UMP protocol number (git-fixes).\n- ALSA: ump: Do not clear bank selection after sending a program change (git-fixes).\n- ALSA: ump: Set default protocol when not given explicitly (git-fixes).\n- ALSA: usb-audio: Add sampling rates support for Mbox3 (stable-fixes).\n- ALSA: usb-audio: Fix for sampling rates support for Mbox3 (stable-fixes).\n- ARM: 9381/1: kasan: clear stale stack poison (git-fixes).\n- ARM: OMAP2+: fix N810 MMC gpiod table (git-fixes).\n- ARM: OMAP2+: fix USB regression on Nokia N8x0 (git-fixes).\n- ARM: imx: Check return value of devm_kasprintf in imx_mmdc_perf_init (git-fixes).\n- ARM: imx_v6_v7_defconfig: Restore CONFIG_BACKLIGHT_CLASS_DEVICE (git-fixes).\n- ARM: prctl: reject PR_SET_MDWE on pre-ARMv6 (stable-fixes).\n- ARM: s5pv210: fix pm.c kernel-doc warning (git-fixes).\n- ASoC: Intel: Disable route checks for Skylake boards (git-fixes).\n- ASoC: Intel: avs: Fix ASRC module initialization (git-fixes).\n- ASoC: Intel: avs: Fix potential integer overflow (git-fixes).\n- ASoC: Intel: avs: Populate board selection with new I2S entries (stable-fixes).\n- ASoC: Intel: avs: Set name of control as in topology (git-fixes).\n- ASoC: Intel: avs: Test result of avs_get_module_entry() (git-fixes).\n- ASoC: Intel: avs: ssm4567: Do not ignore route checks (git-fixes).\n- ASoC: Intel: bytcr_rt5640: Apply Asus T100TA quirk to Asus T100TAM too (git-fixes).\n- ASoC: Intel: common: DMI remap for rebranded Intel NUC M15 (LAPRC710) laptops (stable-fixes).\n- ASoC: SOF: Intel: add default firmware library path for LNL (git-fixes).\n- ASoC: SOF: Intel: hda-dsp: Skip IMR boot on ACE platforms in case of S3 suspend (stable-fixes).\n- ASoC: SOF: Intel: lnl: Correct rom_status_reg (git-fixes).\n- ASoC: SOF: Intel: mtl: Correct rom_status_reg (git-fixes).\n- ASoC: SOF: Intel: mtl: Disable interrupts when firmware boot failed (git-fixes).\n- ASoC: SOF: Intel: mtl: Implement firmware boot state check (git-fixes).\n- ASoC: SOF: Intel: mtl: call dsp dump when boot retry fails (stable-fixes).\n- ASoC: SOF: amd: Optimize quirk for Valve Galileo (stable-fixes).\n- ASoC: SOF: ipc4-pcm: Workaround for crashed firmware on system suspend (stable-fixes).\n- ASoC: SOF: ipc4-topology: Fix input format query of process modules without base extension (git-fixes).\n- ASoC: acp: Support microphone from device Acer 315-24p (git-fixes).\n- ASoC: amd: acp: fix for acp_init function error handling (git-fixes).\n- ASoC: amd: yc: Add Lenovo ThinkBook 21J0 into DMI quirk table (stable-fixes).\n- ASoC: amd: yc: Fix non-functional mic on ASUS M7600RE (stable-fixes).\n- ASoC: amd: yc: Fix non-functional mic on Lenovo 21J2 (stable-fixes).\n- ASoC: amd: yc: Revert 'Fix non-functional mic on Lenovo 21J2' (stable-fixes).\n- ASoC: codecs: wsa881x: set clk_stop_mode1 flag (git-fixes).\n- ASoC: cs35l41: Update DSP1RX5/6 Sources for DSP config (git-fixes).\n- ASoC: cs35l56: Fix unintended bus access while resetting amp (git-fixes).\n- ASoC: cs35l56: Prevent overwriting firmware ASP config (git-fixes).\n- ASoC: da7219-aad: fix usage of device_get_named_child_node() (git-fixes).\n- ASoC: kirkwood: Fix potential NULL dereference (git-fixes).\n- ASoC: mediatek: Assign dummy when codec not specified for a DAI link (git-fixes).\n- ASoC: mediatek: mt8192: fix register configuration for tdm (git-fixes).\n- ASoC: meson: axg-card: make links nonatomic (git-fixes).\n- ASoC: meson: axg-fifo: use FIELD helpers (stable-fixes).\n- ASoC: meson: axg-fifo: use threaded irq to check periods (git-fixes).\n- ASoC: meson: axg-tdm-interface: manage formatters in trigger (git-fixes).\n- ASoC: meson: cards: select SND_DYNAMIC_MINORS (git-fixes).\n- ASoC: ops: Fix wraparound for mask in snd_soc_get_volsw (git-fixes).\n- ASoC: rockchip: i2s-tdm: Fix inaccurate sampling rates (git-fixes).\n- ASoC: rt5645: Fix the electric noise due to the CBJ contacts floating (git-fixes).\n- ASoC: rt5645: Make LattePanda board DMI match more precise (stable-fixes).\n- ASoC: rt5682-sdw: fix locking sequence (git-fixes).\n- ASoC: rt711-sdca: fix locking sequence (git-fixes).\n- ASoC: rt711-sdw: fix locking sequence (git-fixes).\n- ASoC: rt712-sdca-sdw: fix locking sequence (git-fixes).\n- ASoC: rt715-sdca: volume step modification (git-fixes).\n- ASoC: rt715: add vendor clear control register (git-fixes).\n- ASoC: rt722-sdca-sdw: fix locking sequence (git-fixes).\n- ASoC: rt722-sdca: add headset microphone vrefo setting (git-fixes).\n- ASoC: rt722-sdca: modify channel number to support 4 channels (git-fixes).\n- ASoC: soc-core.c: Skip dummy codec when adding platforms (stable-fixes).\n- ASoC: tas2552: Add TX path for capturing AUDIO-OUT data (git-fixes).\n- ASoC: tas2781: Fix a warning reported by robot kernel test (git-fixes).\n- ASoC: tas2781: Fix wrong loading calibrated data sequence (git-fixes).\n- ASoC: tas2781: mark dvc_tlv with __maybe_unused (git-fixes).\n- ASoC: tegra: Fix DSPK 16-bit playback (git-fixes).\n- ASoC: ti: Convert Pandora ASoC to GPIO descriptors (stable-fixes).\n- ASoC: ti: davinci-mcasp: Fix race condition during probe (git-fixes).\n- ASoC: tlv320adc3xxx: Do not strip remove function when driver is builtin (git-fixes).\n- ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value (git-fixes).\n- ASoC: wm_adsp: Add missing MODULE_DESCRIPTION() (git-fixes).\n- ASoC: wm_adsp: Fix missing mutex_lock in wm_adsp_write_ctl() (git-fixes).\n- Add alt-commit to a nouveau patch\n- Add cherry-picked id to amdgpu patch\n- Add cherry-picked id to amdgpu patch (git-fixes)\n- Add cherry-picked patch references to amdgpu patches\n- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756) The L3 bsc#1225765 was created seperately since our customer requires PTF.\n- Bluetooth: Add new quirk for broken read key length on ATS2851 (stable-fixes).\n- Bluetooth: Fix TOCTOU in HCI debugfs implementation (git-fixes).\n- Bluetooth: Fix memory leak in hci_req_sync_complete() (git-fixes).\n- Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old() (stable-fixes).\n- Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (git-fixes).\n- Bluetooth: HCI: Fix potential null-ptr-deref (git-fixes).\n- Bluetooth: ISO: Align broadcast sync_timeout with connection timeout (stable-fixes).\n- Bluetooth: ISO: Do not reject BT_ISO_QOS if parameters are unset (git-fixes).\n- Bluetooth: L2CAP: Fix not validating setsockopt user input (git-fixes).\n- Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() (git-fixes).\n- Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (bsc#1221504).\n- Bluetooth: RFCOMM: Fix not validating setsockopt user input (git-fixes).\n- Bluetooth: SCO: Fix not validating setsockopt user input (git-fixes).\n- Bluetooth: add quirk for broken address properties (git-fixes).\n- Bluetooth: btintel: Fix null ptr deref in btintel_read_version (stable-fixes).\n- Bluetooth: btintel: Fixe build regression (git-fixes).\n- Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0bda:0x4853 (stable-fixes).\n- Bluetooth: btusb: Fix triggering coredump implementation for QCA (git-fixes).\n- Bluetooth: hci_core: Cancel request on command timeout (stable-fixes).\n- Bluetooth: hci_event: Fix sending HCI_OP_READ_ENC_KEY_SIZE (git-fixes).\n- Bluetooth: hci_event: set the conn encrypted before conn establishes (stable-fixes).\n- Bluetooth: hci_sock: Fix not validating setsockopt user input (git-fixes).\n- Bluetooth: hci_sync: Fix not checking error on hci_cmd_sync_cancel_sync (git-fixes).\n- Bluetooth: hci_sync: Fix using the same interval and window for Coded PHY (git-fixes).\n- Bluetooth: hci_sync: Use QoS to determine which PHY to scan (stable-fixes).\n- Bluetooth: l2cap: Do not double set the HCI_CONN_MGMT_CONNECTED bit (git-fixes).\n- Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (git-fixes).\n- Bluetooth: mgmt: Fix limited discoverable off timeout (stable-fixes).\n- Bluetooth: msft: fix slab-use-after-free in msft_do_close() (git-fixes).\n- Bluetooth: qca: Fix error code in qca_read_fw_build_info() (git-fixes).\n- Bluetooth: qca: add missing firmware sanity checks (git-fixes).\n- Bluetooth: qca: fix NULL-deref on non-serdev setup (git-fixes).\n- Bluetooth: qca: fix NULL-deref on non-serdev suspend (git-fixes).\n- Bluetooth: qca: fix NVM configuration parsing (git-fixes).\n- Bluetooth: qca: fix device-address endianness (git-fixes).\n- Bluetooth: qca: fix firmware check error path (git-fixes).\n- Bluetooth: qca: fix info leak when fetching fw build id (git-fixes).\n- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch. Quoting bsc#1225945#c11: 'So the upstream 6.5 kernel commit (1b53e51a4a8f ('btrfs: do not commit transaction for every subvol create') ) was never backported to SLE, so that fix eb96e221937a ('btrfs: fix unwritten extent buffer after snapshotting a new subvolume') was never backported.'\n- Docs/admin-guide/mm/damon/usage: fix wrong example of DAMOS filter matching sysfs file (git-fixes).\n- Drop usb gadget patch that was taken mistakenly and reverted (git-fixes)\n- EDAC/synopsys: Fix ECC status and IRQ control race condition (git-fixes).\n- Edit 'amdkfd: use calloc instead of kzalloc to avoid integer overflow' Reference CVE and bug numbers.\n- Enable CONFIG_FIPS_SIGNATURE_SELFTEST (bsc#1222771)\n- Enable new CONFIG_FIPS_SIGNATURE_SELFTEST_ECDSA.\n- Enable new CONFIG_FIPS_SIGNATURE_SELFTEST_RSA.\n- Fix a potential infinite loop in extract_user_to_sg() (git-fixes).\n- Fix build errors due to new UIO_MEM_DMA_COHERENT mess (git-fixes).\n- Fix patches.suse/coresight-etm4x-Add-ACPI-support-in-platform-driver.patch (bsc#1218779 bsc#1220587) Put back patch hunk which where missed because file rename drivers/acpi/acpi_amba.c -\u003e drivers/acpi/arm64/amba.c\n- HID: amd_sfh: Handle 'no sensors' in PM operations (git-fixes).\n- HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up (git-fixes).\n- HID: input: avoid polling stylus battery on Chromebook Pompom (stable-fixes).\n- HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors (git-fixes).\n- HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev-\u003edevc (git-fixes).\n- HID: logitech-dj: allow mice to use all types of reports (git-fixes).\n- HID: multitouch: Add required quirk for Synaptics 0xcddc device (stable-fixes).\n- IB/mlx5: Use __iowrite64_copy() for write combining stores (git-fixes)\n- Input: cyapa - add missing input core locking to suspend/resume functions (git-fixes).\n- Input: gpio_keys_polled - suppress deferred probe error for gpio (stable-fixes).\n- Input: imagis - use FIELD_GET where applicable (stable-fixes).\n- Input: ims-pcu - fix printf string overflow (git-fixes).\n- Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation (git-fixes).\n- Input: synaptics-rmi4 - fail probing if memory allocation for 'phys' fails (stable-fixes).\n- Input: xpad - add additional HyperX Controller Identifiers (stable-fixes).\n- Input: xpad - add support for Snakebyte GAMEPADs (stable-fixes).\n- KEYS: trusted: Do not use WARN when encode fails (git-fixes).\n- KEYS: trusted: Fix memory leak in tpm2_key_encode() (git-fixes).\n- KVM: SVM: Add support for allowing zero SEV ASIDs (git-fixes).\n- KVM: SVM: Flush pages under kvm-\u003elock to fix UAF in svm_register_enc_region() (git-fixes).\n- KVM: SVM: Use unsigned integers when dealing with ASIDs (git-fixes).\n- KVM: VMX: Disable LBR virtualization if the CPU does not support LBR callstacks (git-fixes).\n- KVM: VMX: Report up-to-date exit qualification to userspace (git-fixes).\n- KVM: nVMX: Clear EXIT_QUALIFICATION when injecting an EPT Misconfig (git-fixes).\n- KVM: s390: Check kvm pointer when testing KVM_CAP_S390_HPAGE_1M (git-fixes bsc#1224790).\n- KVM: x86/mmu: Do not force emulation of L2 accesses to non-APIC internal slots (git-fixes).\n- KVM: x86/mmu: Move private vs. shared check above slot validity checks (git-fixes).\n- KVM: x86/mmu: Restrict KVM_SW_PROTECTED_VM to the TDP MMU (git-fixes).\n- KVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status (git-fixes).\n- KVM: x86/pmu: Allow programming events that match unsupported arch events (git-fixes).\n- KVM: x86/pmu: Always treat Fixed counters as available when supported (git-fixes).\n- KVM: x86/pmu: Apply 'fast' RDPMC only to Intel PMUs (git-fixes).\n- KVM: x86/pmu: Disable support for adaptive PEBS (git-fixes).\n- KVM: x86/pmu: Disallow 'fast' RDPMC for architectural Intel PMUs (git-fixes).\n- KVM: x86/pmu: Do not ignore bits 31:30 for RDPMC index on AMD (git-fixes).\n- KVM: x86/pmu: Do not mask LVTPC when handling a PMI on AMD platforms (git-fixes).\n- KVM: x86/pmu: Explicitly check NMI from guest to reducee false positives (git-fixes).\n- KVM: x86/pmu: Prioritize VMX interception over #GP on RDPMC due to bad index (git-fixes).\n- KVM: x86/pmu: Set enable bits for GP counters in PERF_GLOBAL_CTRL at 'RESET' (git-fixes).\n- KVM: x86/pmu: Zero out PMU metadata on AMD if PMU is disabled (git-fixes).\n- KVM: x86/xen: fix recursive deadlock in timer injection (git-fixes).\n- KVM: x86/xen: improve accuracy of Xen timers (git-fixes).\n- KVM: x86/xen: inject vCPU upcall vector when local APIC is enabled (git-fixes).\n- KVM: x86/xen: remove WARN_ON_ONCE() with false positives in evtchn delivery (git-fixes).\n- KVM: x86: Allow, do not ignore, same-value writes to immutable MSRs (git-fixes).\n- KVM: x86: Fix broken debugregs ABI for 32 bit kernels (git-fixes).\n- KVM: x86: Fully re-initialize supported_mce_cap on vendor module load (git-fixes).\n- KVM: x86: Introduce __kvm_get_hypervisor_cpuid() helper (git-fixes).\n- KVM: x86: Mark target gfn of emulated atomic instruction as dirty (git-fixes).\n- KVM: x86: Only set APICV_INHIBIT_REASON_ABSENT if APICv is enabled (git-fixes).\n- KVM: x86: Snapshot if a vCPU's vendor model is AMD vs. Intel compatible (git-fixes).\n- KVM: x86: Update KVM_SW_PROTECTED_VM docs to make it clear they're a WIP (git-fixes).\n- KVM: x86: Use actual kvm_cpuid.base for clearing KVM_FEATURE_PV_UNHALT (git-fixes).\n- Move out-of-tree powerpc patch to the right section\n- Move the upstreamed BT fix patch to sorted section\n- Move the upstreamed BT patch into sorted section\n- Move upstreamed ACPI patch into sorted section\n- Move upstreamed HD-audio patch into sorted section\n- Move upstreamed USB fix into sorted section\n- Move upstreamed media patches into sorted section\n- Move upstreamed mm patches into sorted section\n- Move upstreamed patches into sorted section\n- Move upstreamed patches into sorted section\n- Move upstreamed patches into sorted section\n- Move upstreamed patches into sorted section\n- Move upstreamed powerpc patches into sorted section\n- Move upstreamed powerpc patches into sorted section\n- NFC: trf7970a: disable all regulators on removal (git-fixes).\n- NFS: Fix an off by one in root_nfs_cat() (git-fixes).\n- NFS: Fix nfs_netfs_issue_read() xarray locking for writeback interrupt (git-fixes).\n- NFS: Read unlock folio on nfs_page_create_from_folio() error (git-fixes).\n- NFSD: Convert the callback workqueue to use delayed_work (git-fixes).\n- NFSD: Fix nfsd_clid_class use of __string_len() macro (git-fixes).\n- NFSD: Reschedule CB operations when backchannel rpc_clnt is shut down (git-fixes).\n- NFSD: Reset cb_seq_status after NFS4ERR_DELAY (git-fixes).\n- NFSD: Retransmit callbacks after client reconnects (git-fixes).\n- NFSD: change LISTXATTRS cookie encoding to big-endian (git-fixes).\n- NFSD: fix LISTXATTRS returning a short list with eof=TRUE (git-fixes).\n- NFSD: fix LISTXATTRS returning more bytes than maxcount (git-fixes).\n- NFSD: fix nfsd4_listxattr_validate_cookie (git-fixes).\n- NFSv4.1/pnfs: fix NFS with TLS in pnfs (git-fixes).\n- NFSv4.2: fix listxattr maximum XDR buffer size (git-fixes).\n- NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 (git-fixes).\n- Octeontx2-af: fix pause frame configuration in GMP mode (git-fixes).\n- PCI/AER: Block runtime suspend when handling errors (stable-fixes).\n- PCI/ASPM: Use RMW accessors for changing LNKCTL (git-fixes).\n- PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports (stable-fixes).\n- PCI/DPC: Use FIELD_GET() (stable-fixes).\n- PCI/EDR: Align EDR_PORT_DPC_ENABLE_DSM with PCI Firmware r3.3 (git-fixes).\n- PCI/EDR: Align EDR_PORT_LOCATE_DSM with PCI Firmware r3.3 (git-fixes).\n- PCI/PM: Drain runtime-idle callbacks before driver removal (stable-fixes).\n- PCI: Delay after FLR of Solidigm P44 Pro NVMe (stable-fixes).\n- PCI: Disable D3cold on Asus B1400 PCI-NVMe bridge (stable-fixes).\n- PCI: Execute quirk_enable_clear_retrain_link() earlier (stable-fixes).\n- PCI: Fix typos in docs and comments (stable-fixes).\n- PCI: Make link retraining use RMW accessors for changing LNKCTL (git-fixes).\n- PCI: Simplify pcie_capability_clear_and_set_word() to ..._clear_word() (stable-fixes).\n- PCI: dwc: ep: Fix DBI access failure for drivers requiring refclk from host (git-fixes).\n- PCI: hv: Fix ring buffer size calculation (git-fixes).\n- PCI: qcom: Add support for sa8775p SoC (git-fixes).\n- PCI: qcom: Disable ASPM L0s for sc8280xp, sa8540p and sa8295p (git-fixes).\n- PCI: rockchip-ep: Remove wrong mask on subsys_vendor_id (git-fixes).\n- PCI: rpaphp: Error out on busy status from get-sensor-state (bsc#1223369 ltc#205888).\n- PCI: switchtec: Add support for PCIe Gen5 devices (stable-fixes).\n- PCI: switchtec: Use normal comment style (stable-fixes).\n- PCI: tegra194: Fix probe path for Endpoint mode (git-fixes).\n- PM / devfreq: Synchronize devfreq_monitor_[start/stop] (stable-fixes).\n- PM: s2idle: Make sure CPUs will wakeup directly on resume (git-fixes).\n- Port 'certs: Add ECDSA signature verification self-test'.\n- Port 'certs: Move RSA self-test data to separate file'.\n- RAS/AMD/FMPM: Avoid NULL ptr deref in get_saved_records() (jsc#PED-7619).\n- RAS/AMD/FMPM: Fix build when debugfs is not enabled (jsc#PED-7619).\n- RAS/AMD/FMPM: Safely handle saved records of various sizes (jsc#PED-7619).\n- RDMA/IPoIB: Fix format truncation compilation errors (git-fixes)\n- RDMA/cm: Print the old state when cm_destroy_id gets timeout (git-fixes)\n- RDMA/cm: add timeout to cm_destroy_id wait (git-fixes)\n- RDMA/cma: Fix kmemleak in rdma_core observed during blktests nvme/rdma use siw (git-fixes)\n- RDMA/hns: Add max_ah and cq moderation capacities in query_device() (git-fixes)\n- RDMA/hns: Fix GMV table pagesize (git-fixes)\n- RDMA/hns: Fix UAF for cq async event (git-fixes)\n- RDMA/hns: Fix deadlock on SRQ async events. (git-fixes)\n- RDMA/hns: Fix return value in hns_roce_map_mr_sg (git-fixes)\n- RDMA/hns: Modify the print level of CQE error (git-fixes)\n- RDMA/hns: Use complete parentheses in macros (git-fixes)\n- RDMA/mana_ib: Fix bug in creation of dma regions (git-fixes).\n- RDMA/mlx5: Adding remote atomic access flag to updatable flags (git-fixes)\n- RDMA/mlx5: Change check for cacheable mkeys (git-fixes)\n- RDMA/mlx5: Fix port number for counter query in multi-port configuration (git-fixes)\n- RDMA/mlx5: Uncacheable mkey has neither rb_key or cache_ent (git-fixes)\n- RDMA/rxe: Allow good work requests to be executed (git-fixes)\n- RDMA/rxe: Fix incorrect rxe_put in error path (git-fixes)\n- RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt (git-fixes)\n- RDMA/rxe: Fix the problem 'mutex_destroy missing' (git-fixes)\n- README.BRANCH: Remove copy of branch name\n- Reapply 'drm/qxl: simplify qxl_fence_wait' (stable-fixes).\n- Refresh patches.suse/0002-PKCS-7-Check-codeSigning-EKU-for-kernel-module-and-k.patch (bsc#1222771). In preparation of enabling CONFIG_FIPS_SIGNATURE_SELFTEST, amend the missing 'usage' argument in the pkcs7_validate_trust() invocation from the PKCS#7 selftest.\n- Refresh patches.suse/ASoC-SOF-Intel-mtl-Implement-firmware-boot-state-che.patch.\n- Remove NTFSv3 from configs (bsc#1224429) References: bsc#1224429 comment#3 We only support fuse version of the NTFS-3g driver. Disable NTFSv3 from all configs. This was enabled in d016c04d731 ('Bump to 6.4 kernel (jsc#PED-4593)')\n- Rename patches.suse/Workaround-broken-chacha-crypto-fallback.patch to patches.suse/powerpc-crypto-chacha-p10-Fix-failure-on-non-Power10.patch.\n- Revert 'ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default' (stable-fixes).\n- Revert 'ASoC: SOF: Intel: hda-dai-ops: only allocate/release streams for first CPU DAI' (stable-fixes).\n- Revert 'ASoC: SOF: Intel: hda-dai-ops: reset device count for SoundWire DAIs' (stable-fixes).\n- Revert 'PCI/MSI: Provide IMS (Interrupt Message Store) support' (git-fixes).\n- Revert 'PCI/MSI: Provide pci_ims_alloc/free_irq()' (git-fixes).\n- Revert 'PCI/MSI: Provide stubs for IMS functions' (git-fixes).\n- Revert 'cifs: reconnect work should have reference on server struct' (git-fixes, bsc#1225172).\n- Revert 'drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init()' (stable-fixes).\n- Revert 'drm/amd/display: Fix sending VSC (+ colorimetry) packets for DP/eDP displays without PSR' (stable-fixes).\n- Revert 'drm/amdkfd: fix gfx_target_version for certain 11.0.3 devices' (stable-fixes).\n- Revert 'drm/bridge: ti-sn65dsi83: Fix enable error path' (git-fixes).\n- Revert 'drm/nouveau/firmware: Fix SG_DEBUG error with nvkm_firmware_ctor()' (stable-fixes).\n- Revert 'drm/qxl: simplify qxl_fence_wait' (git-fixes).\n- Revert 'iommu/amd: Enable PCI/IMS' (git-fixes).\n- Revert 'iommu/vt-d: Enable PCI/IMS' (git-fixes).\n- Revert 'net/mlx5: Block entering switchdev mode with ns inconsistency' (git-fixes).\n- Revert 'net/mlx5e: Check the number of elements before walk TC rhashtable' (git-fixes).\n- Revert 'selinux: introduce an initial SID for early boot processes' (bsc#1208593) It caused a regression on ALP-current branch, kernel-obs-qa build failed.\n- Revert 'usb: cdc-wdm: close race between read and workqueue' (git-fixes).\n- Revert 'usb: phy: generic: Get the vbus supply' (git-fixes).\n- SEV: disable SEV-ES DebugSwap by default (git-fixes).\n- SUNRPC: fix a memleak in gss_import_v2_context (git-fixes).\n- SUNRPC: fix some memleaks in gssx_dec_option_array (git-fixes).\n- USB: UAS: return ENODEV when submit urbs fail with device not attached (stable-fixes).\n- USB: core: Add hub_get() and hub_put() routines (stable-fixes).\n- USB: core: Fix access violation during port device removal (git-fixes).\n- USB: core: Fix deadlock in port 'disable' sysfs attribute (stable-fixes).\n- USB: core: Fix deadlock in usb_deauthorize_interface() (git-fixes).\n- USB: serial: add device ID for VeriFone adapter (stable-fixes).\n- USB: serial: cp210x: add ID for MGP Instruments PDS100 (stable-fixes).\n- USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M (stable-fixes).\n- USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB (stable-fixes).\n- USB: serial: option: add Fibocom FM135-GL variants (stable-fixes).\n- USB: serial: option: add Lonsung U8300/U9300 product (stable-fixes).\n- USB: serial: option: add MeiG Smart SLM320 product (stable-fixes).\n- USB: serial: option: add Rolling RW101-GL and RW135-GL support (stable-fixes).\n- USB: serial: option: add Telit FN920C04 rmnet compositions (stable-fixes).\n- USB: serial: option: add support for Fibocom FM650/FG650 (stable-fixes).\n- USB: serial: option: support Quectel EM060K sub-models (stable-fixes).\n- Update patches.suse/Bluetooth-hci_sync-Don-t-double-print-name-in-add-re.patch (bsc#1216358). Added bugzilla reference\n- Update patches.suse/nvme-ensure-disabling-pairs-with-unquiesce.patch (jsc#PED-6252 jsc#PED-5728 jsc#PED-5062 jsc#PED-3535 bsc#1224534).\n- Update ath11k suspend patches from the latest subsystem tree (bsc#1207948).\n- Update config files. Disable N_GSM (jsc#PED-8240).\n- Update patches.suse/gpio-tegra186-Fix-tegra186_gpio_is_accessible-check.patch (git-fixes bsc#1223439)\n- Update patches.suse/powerpc-pseries-vas-Hold-mmap_mutex-after-mmap-lock-.patch (bsc#1012628 jsc#PED-542 git-fixes bsc#1213573 ltc#203238).\n- Update patches.suse/scsi-qedf-Don-t-process-stag-work-during-unload.patch (bsc#1214852)\n- Update patches.suse/scsi-qedf-Wait-for-stag-work-during-unload.patch (bsc#1214852)\n- VMCI: Fix an error handling path in vmci_guest_probe_device() (git-fixes).\n- VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() (stable-fixes).\n- Workaround broken chacha crypto fallback (bsc#1218205).\n- accel/ivpu: Fix deadlock in context_xa (git-fixes).\n- admin-guide/hw-vuln/core-scheduling: fix return type of PR_SCHED_CORE_GET (git-fixes).\n- ahci: asm1064: asm1166: do not limit reported ports (git-fixes).\n- ahci: asm1064: correct count of reported ports (stable-fixes).\n- amd/amdkfd: sync all devices to wait all processes being evicted (stable-fixes).\n- amdkfd: use calloc instead of kzalloc to avoid integer overflow (stable-fixes).\n- arm64/head: Disable MMU at EL2 before clearing HCR_EL2.E2H (git-fixes).\n- arm64/ptrace: Use saved floating point state type to determine SVE (git-fixes)\n- arm64/sve: Lower the maximum allocation for the SVE ptrace regset (git-fixes)\n- arm64: Add the arm64.no32bit_el0 command line option (jsc#PED-3184). Please note that some adjustments were needed since the upstream commit is based on kernel 6.9 which has idreg-override.c moved under arch/arm64/kernel/pi/.\n- arm64: bpf: fix 32bit unconditional bswap (git-fixes).\n- arm64: dts: Fix dtc interrupt_provider warnings (git-fixes)\n- arm64: dts: allwinner: Pine H64: correctly remove reg_gmac_3v3 (git-fixes)\n- arm64: dts: allwinner: h616: Fix I2C0 pins (git-fixes)\n- arm64: dts: broadcom: bcmbca: bcm4908: drop invalid switch cells (git-fixes)\n- arm64: dts: hi3798cv200: fix the size of GICR (git-fixes)\n- arm64: dts: imx8-ss-conn: fix usb lpcg indices (git-fixes)\n- arm64: dts: imx8-ss-conn: fix usdhc wrong lpcg clock order (git-fixes)\n- arm64: dts: imx8-ss-dma: fix adc lpcg indices (git-fixes)\n- arm64: dts: imx8-ss-dma: fix can lpcg indices (git-fixes)\n- arm64: dts: imx8-ss-dma: fix spi lpcg indices (git-fixes)\n- arm64: dts: imx8-ss-lsio: fix pwm lpcg indices (git-fixes)\n- arm64: dts: imx8qm-ss-dma: fix can lpcg indices (git-fixes)\n- arm64: dts: marvell: reorder crypto interrupts on Armada SoCs (git-fixes)\n- arm64: dts: microchip: sparx5: fix mdio reg (git-fixes)\n- arm64: dts: rockchip: Add enable-strobe-pulldown to emmc phy on ROCK (git-fixes)\n- arm64: dts: rockchip: Add enable-strobe-pulldown to emmc phy on ROCK (git-fixes)\n- arm64: dts: rockchip: Remove unsupported node from the Pinebook Pro (git-fixes)\n- arm64: dts: rockchip: enable internal pull-up for Q7_THRM# on RK3399 (git-fixes)\n- arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for (git-fixes)\n- arm64: dts: rockchip: enable internal pull-up on Q7_USB_ID for RK3399 (git-fixes)\n- arm64: dts: rockchip: fix rk3328 hdmi ports node (git-fixes)\n- arm64: dts: rockchip: fix rk3399 hdmi ports node (git-fixes)\n- arm64: dts: rockchip: regulator for sd needs to be always on for (git-fixes)\n- arm64: dts: rockchip: set PHY address of MT7531 switch to 0x1f (git-fixes)\n- arm64: hibernate: Fix level3 translation fault in swsusp_save() (git-fixes).\n- arm64: tegra: Correct Tegra132 I2C alias (git-fixes)\n- arm64: tegra: Set the correct PHY mode for MGBE (git-fixes)\n- arm_pmu: acpi: Add a representative platform device for TRBE (bsc#1220587)\n- arm_pmu: acpi: Refactor arm_spe_acpi_register_device() (bsc#1220587)\n- asm-generic: make sparse happy with odd-sized put_unaligned_*() (stable-fixes).\n- ata: libata-core: Allow command duration limits detection for ACS-4 drives (git-fixes).\n- ata: pata_legacy: make legacy_exit() work again (git-fixes).\n- ata: sata_gemini: Check clk_enable() result (stable-fixes).\n- ata: sata_mv: Fix PCI device ID table declaration compilation warning (git-fixes).\n- ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit (git-fixes).\n- autofs: use wake_up() instead of wake_up_interruptible(() (bsc#1224166).\n- ax25: Fix netdev refcount issue (git-fixes).\n- ax25: Fix reference count leak issue of net_device (git-fixes).\n- ax25: Fix reference count leak issues of ax25_dev (git-fixes).\n- ax25: fix use-after-free bugs caused by ax25_ds_del_timer (git-fixes).\n- batman-adv: Avoid infinite loop trying to resize local TT (git-fixes).\n- bitops: add missing prototype check (git-fixes).\n- blacklist.conf: workqueues: system-wide nr_active enforcement patchset; \tnot worth the risk (bsc#1225580)\n- blk-cgroup: fix list corruption from reorder of WRITE -\u003elqueued (bsc#1225605).\n- blk-cgroup: fix list corruption from resetting io stat (bsc#1225605).\n- block: fix q-\u003eblkg_list corruption during disk rebind (bsc#1223591).\n- bnx2x: Fix firmware version string character counts (git-fixes).\n- bnxt_en: Fix error recovery for RoCE ulp client (git-fixes).\n- bnxt_en: Fix possible memory leak in bnxt_rdma_aux_device_init() (git-fixes).\n- bnxt_en: Reset PTP tx_avail after possible firmware reset (git-fixes).\n- bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (git-fixes)\n- bootconfig: Fix the kerneldoc of _xbc_exit() (git-fixes).\n- bootconfig: use memblock_free_late to free xbc memory to buddy (git-fixes).\n- bootmem: use kmemleak_free_part_phys in free_bootmem_page (git-fixes).\n- bootmem: use kmemleak_free_part_phys in put_page_bootmem (git-fixes).\n- bpf, arm64: Fix incorrect runtime stats (git-fixes)\n- bpf, arm64: fix bug in BPF_LDX_MEMSX (git-fixes)\n- bpf, scripts: Correct GPL license name (git-fixes).\n- bpf: Fix precision tracking for BPF_ALU | BPF_TO_BE | BPF_END (git-fixes).\n- bpf: fix precision backtracking instruction iteration (bsc#1225756).\n- bpf: handle ldimm64 properly in check_cfg() (bsc#1225756).\n- btrfs: add a helper to read the superblock metadata_uuid (git-fixes)\n- btrfs: add and use helper to check if block group is used (bsc#1220120).\n- btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks() (git-fixes)\n- btrfs: add new unused block groups to the list of unused block groups (bsc#1220120).\n- btrfs: allow to run delayed refs by bytes to be released instead of count (bsc#1220120).\n- btrfs: always clear PERTRANS metadata during commit (git-fixes)\n- btrfs: always print transaction aborted messages with an error level (git-fixes)\n- btrfs: always reserve space for delayed refs when starting transaction (bsc#1220120).\n- btrfs: assert correct lock is held at btrfs_select_ref_head() (bsc#1220120).\n- btrfs: assert delayed node locked when removing delayed item (git-fixes)\n- btrfs: avoid start and commit empty transaction when flushing qgroups (bsc#1220120).\n- btrfs: avoid start and commit empty transaction when starting qgroup rescan (bsc#1220120).\n- btrfs: avoid starting and committing empty transaction when flushing space (bsc#1220120).\n- btrfs: avoid starting new transaction when flushing delayed items and refs (bsc#1220120).\n- btrfs: check for BTRFS_FS_ERROR in pending ordered assert (git-fixes)\n- btrfs: compare the correct fsid/metadata_uuid in btrfs_validate_super (git-fixes)\n- btrfs: defrag: avoid unnecessary defrag caused by incorrect extent size (git-fixes)\n- btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args (git-fixes)\n- btrfs: do not allow non subvolume root targets for snapshot (git-fixes)\n- btrfs: do not arbitrarily slow down delalloc if we're committing (git-fixes)\n- btrfs: do not delete unused block group if it may be used soon (bsc#1220120).\n- btrfs: do not refill whole delayed refs block reserve when starting transaction (bsc#1220120).\n- btrfs: do not start transaction when joining with TRANS_JOIN_NOSTART (git-fixes)\n- btrfs: do not steal space from global rsv after a transaction abort (bsc#1220120).\n- btrfs: do not warn if discard range is not aligned to sector (git-fixes)\n- btrfs: ensure fiemap does not race with writes when FIEMAP_FLAG_SYNC is given (bsc#1223285).\n- btrfs: error out when COWing block using a stale transaction (git-fixes)\n- btrfs: error out when reallocating block for defrag using a stale transaction (git-fixes)\n- btrfs: export: handle invalid inode or root reference in btrfs_get_parent() (git-fixes)\n- btrfs: fail priority metadata ticket with real fs error (bsc#1220120).\n- btrfs: file_remove_privs needs an exclusive lock in direct io write (git-fixes)\n- btrfs: fix 64bit compat send ioctl arguments not initializing version member (git-fixes)\n- btrfs: fix deadlock with fiemap and extent locking (bsc#1223285).\n- btrfs: fix information leak in btrfs_ioctl_logical_to_ino() (git-fixes)\n- btrfs: fix kvcalloc() arguments order in btrfs_ioctl_send() (git-fixes)\n- btrfs: fix lockdep splat and potential deadlock after failure running delayed items (git-fixes)\n- btrfs: fix off-by-one chunk length calculation at contains_pending_extent() (git-fixes)\n- btrfs: fix off-by-one when checking chunk map includes logical address (git-fixes)\n- btrfs: fix race between ordered extent completion and fiemap (bsc#1223285).\n- btrfs: fix race when detecting delalloc ranges during fiemap (bsc#1223285).\n- btrfs: fix race when refilling delayed refs block reserve (git-fixes)\n- btrfs: fix start transaction qgroup rsv double free (git-fixes)\n- btrfs: fix stripe length calculation for non-zoned data chunk allocation (bsc#1217489).\n- btrfs: fix wrong block_start calculation for btrfs_drop_extent_map_range() (git-fixes) Dropped hunk in selftests (test_case_7), 92e1229b204d6.\n- btrfs: free qgroup rsv on io failure (git-fixes)\n- btrfs: free the allocated memory if btrfs_alloc_page_array() fails (git-fixes)\n- btrfs: get rid of label and goto at insert_delayed_ref() (bsc#1220120).\n- btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() (git-fixes)\n- btrfs: handle errors properly in update_inline_extent_backref() (git-fixes)\n- btrfs: initialize key where it's used when running delayed data ref (bsc#1220120).\n- btrfs: log message if extent item not found when running delayed extent op (bsc#1220120).\n- btrfs: make btrfs_cleanup_fs_roots() static (bsc#1220120).\n- btrfs: make btrfs_destroy_delayed_refs() return void (bsc#1220120).\n- btrfs: make btrfs_destroy_marked_extents() return void (bsc#1220120).\n- btrfs: make btrfs_destroy_pinned_extent() return void (bsc#1220120).\n- btrfs: make error messages more clear when getting a chunk map (git-fixes)\n- btrfs: make find_first_extent_bit() return a boolean (bsc#1220120).\n- btrfs: make find_free_dev_extent() static (bsc#1220120).\n- btrfs: make insert_delayed_ref() return a bool instead of an int (bsc#1220120).\n- btrfs: merge find_free_dev_extent() and find_free_dev_extent_start() (bsc#1220120).\n- btrfs: move btrfs_free_excluded_extents() into block-group.c (bsc#1220120).\n- btrfs: open code trivial btrfs_add_excluded_extent() (bsc#1220120).\n- btrfs: output extra debug info if we failed to find an inline backref (git-fixes)\n- btrfs: pass a space_info argument to btrfs_reserve_metadata_bytes() (bsc#1220120).\n- btrfs: prevent transaction block reserve underflow when starting transaction (git-fixes)\n- btrfs: print available space across all block groups when dumping space info (bsc#1220120).\n- btrfs: print available space for a block group when dumping a space info (bsc#1220120).\n- btrfs: print block group super and delalloc bytes when dumping space info (bsc#1220120).\n- btrfs: print target number of bytes when dumping free space (bsc#1220120).\n- btrfs: qgroup: always free reserved space for extent records (bsc#1216196).\n- btrfs: qgroup: convert PREALLOC to PERTRANS after record_root_in_trans (git-fixes)\n- btrfs: record delayed inode root in transaction (git-fixes)\n- btrfs: reject encoded write if inode has nodatasum flag set (git-fixes)\n- btrfs: release path before inode lookup during the ino lookup ioctl (git-fixes)\n- btrfs: remove pointless 'ref_root' variable from run_delayed_data_ref() (bsc#1220120).\n- btrfs: remove pointless in_tree field from struct btrfs_delayed_ref_node (bsc#1220120).\n- btrfs: remove pointless initialization at btrfs_delayed_refs_rsv_release() (bsc#1220120).\n- btrfs: remove redundant BUG_ON() from __btrfs_inc_extent_ref() (bsc#1220120).\n- btrfs: remove refs_to_add argument from __btrfs_inc_extent_ref() (bsc#1220120).\n- btrfs: remove refs_to_drop argument from __btrfs_free_extent() (bsc#1220120).\n- btrfs: remove the refcount warning/check at btrfs_put_delayed_ref() (bsc#1220120).\n- btrfs: remove unnecessary logic when running new delayed references (bsc#1220120).\n- btrfs: remove unnecessary prototype declarations at disk-io.c (bsc#1220120).\n- btrfs: remove unused is_head field from struct btrfs_delayed_ref_node (bsc#1220120).\n- btrfs: rename add_new_free_space() to btrfs_add_new_free_space() (bsc#1220120).\n- btrfs: reorder some members of struct btrfs_delayed_ref_head (bsc#1220120).\n- btrfs: reserve space for delayed refs on a per ref basis (bsc#1220120).\n- btrfs: reset destination buffer when read_extent_buffer() gets invalid range (git-fixes)\n- btrfs: return -EUCLEAN for delayed tree ref with a ref count not equals to 1 (git-fixes)\n- btrfs: return -EUCLEAN if extent item is missing when searching inline backref (bsc#1220120).\n- btrfs: return real error when orphan cleanup fails due to a transaction abort (bsc#1220120).\n- btrfs: send: do not issue unnecessary zero writes for trailing hole (bsc#1222459).\n- btrfs: send: ensure send_fd is writable (git-fixes)\n- btrfs: send: handle path ref underflow in header iterate_inode_ref() (git-fixes)\n- btrfs: send: return EOPNOTSUPP on unknown flags (git-fixes)\n- btrfs: set page extent mapped after read_folio in relocate_one_page (git-fixes)\n- btrfs: simplify check for extent item overrun at lookup_inline_extent_backref() (bsc#1220120).\n- btrfs: stop doing excessive space reservation for csum deletion (bsc#1220120).\n- btrfs: store the error that turned the fs into error state (bsc#1220120).\n- btrfs: sysfs: validate scrub_speed_max value (git-fixes)\n- btrfs: tree-checker: fix inline ref size in error messages (git-fixes)\n- btrfs: update comment for btrfs_join_transaction_nostart() (bsc#1220120).\n- btrfs: update documentation for add_new_free_space() (bsc#1220120).\n- btrfs: use a bool to track qgroup record insertion when adding ref head (bsc#1220120).\n- btrfs: use a single switch statement when initializing delayed ref head (bsc#1220120).\n- btrfs: use a single variable for return value at lookup_inline_extent_backref() (bsc#1220120).\n- btrfs: use a single variable for return value at run_delayed_extent_op() (bsc#1220120).\n- btrfs: use bool type for delayed ref head fields that are used as booleans (bsc#1220120).\n- btrfs: use the correct superblock to compare fsid in btrfs_validate_super (git-fixes)\n- btrfs: use u64 for buffer sizes in the tree search ioctls (git-fixes)\n- btrfs: zoned: do not skip block groups with 100% zone unusable (bsc#1220120).\n- bus: mhi: ep: check the correct variable in mhi_ep_register_controller() (git-fixes).\n- ceph: redirty page before returning AOP_WRITEPAGE_ACTIVATE (bsc#1224866).\n- ceph: stop copying to iter at EOF on sync reads (bsc#1222606).\n- certs: Add ECDSA signature verification self-test (bsc#1222777).\n- certs: Move RSA self-test data to separate file (bsc#1222777).\n- cifs: Do not use certain unnecessary folio_*() functions (bsc#1225172).\n- cifs: account for primary channel in the interface list (bsc#1225172).\n- cifs: cifs_chan_is_iface_active should be called with chan_lock held (bsc#1225172).\n- cifs: distribute channels across interfaces based on speed (bsc#1225172).\n- cifs: do not pass cifs_sb when trying to add channels (bsc#1225172).\n- cifs: failure to add channel on iface should bump up weight (git-fixes, bsc#1225172).\n- cifs: fix charset issue in reconnection (bsc#1225172).\n- cifs: fix leak of iface for primary channel (git-fixes, bsc#1225172).\n- cifs: handle cases where a channel is closed (bsc#1225172).\n- cifs: handle cases where multiple sessions share connection (bsc#1225172).\n- cifs: reconnect work should have reference on server struct (bsc#1225172).\n- clk: Do not hold prepare_lock when calling kref_put() (stable-fixes).\n- clk: Get runtime PM before walking tree during disable_unused (git-fixes).\n- clk: Get runtime PM before walking tree for clk_summary (git-fixes).\n- clk: Initialize struct clk_core kref earlier (stable-fixes).\n- clk: Remove prepare_lock hold assertion in __clk_release() (git-fixes).\n- clk: Show active consumers of clocks in debugfs (stable-fixes).\n- clk: mediatek: Do a runtime PM get on controllers during probe (git-fixes).\n- clk: mediatek: mt8365-mm: fix DPI0 parent (git-fixes).\n- clk: mediatek: pllfh: Do not log error for missing fhctl node (git-fixes).\n- clk: qcom: clk-alpha-pll: fix rate setting for Stromer PLLs (git-fixes).\n- clk: qcom: clk-alpha-pll: remove invalid Stromer register offset (git-fixes).\n- clk: qcom: dispcc-sm6350: fix DisplayPort clocks (git-fixes).\n- clk: qcom: dispcc-sm8450: fix DisplayPort clocks (git-fixes).\n- clk: qcom: dispcc-sm8550: fix DisplayPort clocks (git-fixes).\n- clk: qcom: mmcc-msm8998: fix venus clock issue (git-fixes).\n- clk: qcom: reset: Commonize the de/assert functions (stable-fixes).\n- clk: qcom: reset: Ensure write completion on reset de/assertion (git-fixes).\n- clk: renesas: r8a779a0: Fix CANFD parent clock (git-fixes).\n- clk: renesas: r9a07g043: Add clock and reset entry for PLIC (git-fixes).\n- clk: rs9: fix wrong default value for clock amplitude (git-fixes).\n- clk: samsung: exynosautov9: fix wrong pll clock id value (git-fixes).\n- clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change (git-fixes).\n- clocksource/drivers/arm_global_timer: Fix maximum prescaler value (git-fixes).\n- clocksource/drivers/imx: Fix -Wunused-but-set-variable warning (git-fixes).\n- comedi: vmk80xx: fix incomplete endpoint checking (git-fixes).\n- coresight: trbe: Add a representative coresight_platform_data for (bsc#1220587)\n- coresight: trbe: Allocate platform data per device (bsc#1220587)\n- coresight: trbe: Enable ACPI based TRBE devices (bsc#1220587)\n- counter: linux/counter.h: fix Excess kernel-doc description warning (git-fixes).\n- cppc_cpufreq: Fix possible null pointer dereference (git-fixes).\n- cpufreq: brcmstb-avs-cpufreq: ISO C90 forbids mixed declarations (git-fixes).\n- cpufreq: exit() callback is optional (git-fixes).\n- cpumask: Add for_each_cpu_from() (bsc#1225053).\n- crypto: bcm - Fix pointer arithmetic (git-fixes).\n- crypto: ccp - Add support for PCI device 0x156E (bsc#1223338).\n- crypto: ccp - Add support for PCI device 0x17E0 (bsc#1223338).\n- crypto: ccp - drop platform ifdef checks (git-fixes).\n- crypto: ecc - update ecc_gen_privkey for FIPS 186-5 (bsc#1222782).\n- crypto: ecdsa - Fix module auto-load on add-key (git-fixes).\n- crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init (git-fixes).\n- crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak (git-fixes).\n- crypto: qat - fix ring to service map for dcc in 4xxx (git-fixes).\n- crypto: qat - improve error logging to be consistent across features (git-fixes).\n- crypto: qat - relocate and rename get_service_enabled() (stable-fixes).\n- crypto: qat - specify firmware files for 402xx (git-fixes).\n- crypto: rsa - add a check for allocation failure (bsc#1222775).\n- crypto: rsa - allow only odd e and restrict value in FIPS mode (bsc#1222775).\n- crypto: testmgr - remove unused xts4096 and xts512 algorithms from testmgr.c (bsc#1222769).\n- crypto: x86/nh-avx2 - add missing vzeroupper (git-fixes).\n- crypto: x86/sha256-avx2 - add missing vzeroupper (git-fixes).\n- crypto: x86/sha512-avx2 - add missing vzeroupper (git-fixes).\n- cxl/acpi: Fix load failures due to single window creation failure (git-fixes).\n- cxl/pci: Fix disabling memory if DVSEC CXL Range does not match a CFMWS window (git-fixes).\n- cxl/trace: Properly initialize cxl_poison region name (git-fixes).\n- dax/bus.c: replace driver-core lock usage by a local rwsem (jsc#PED-5853).\n- dax/bus.c: replace several sprintf() with sysfs_emit() (jsc#PED-5853).\n- dax: alloc_dax() return ERR_PTR(-EOPNOTSUPP) for CONFIG_DAX=n (jsc#PED-5853).\n- device-dax: make dax_bus_type const (jsc#PED-5853).\n- dlm: fix user space lkb refcounting (git-fixes).\n- dm crypt: remove redundant state settings after waking up (jsc#PED-7542).\n- dm thin: add braces around conditional code that spans lines (jsc#PED-7542).\n- dm verity: set DM_TARGET_SINGLETON feature flag (jsc#PED-7542).\n- dm-integrity: set max_integrity_segments in dm_integrity_io_hints (jsc#PED-7542).\n- dm-multipath: dont't attempt SG_IO on non-SCSI-disks (bsc#1223575).\n- dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape (bsc#1219596) Also update diff context in patches.suse/dm-raid-fix-false-positive-for-requeue-needed-during-b25b.patch\n- dm-raid: add a new helper prepare_suspend() in md_personality (jsc#PED-7542).\n- dm-raid: really frozen sync_thread during suspend (jsc#PED-7542).\n- dm/amd/pm: Fix problems with reboot/shutdown for some SMU 13.0.4/13.0.11 users (git-fixes).\n- dm: update relevant MODULE_AUTHOR entries to latest dm-devel mailing list (jsc#PED-7542).\n- dma-buf/sw-sync: do not enable IRQ from sync_print_obj() (git-fixes).\n- dma-buf: Fix NULL pointer dereference in sanitycheck() (git-fixes).\n- dma-mapping: benchmark: fix node id validation (git-fixes).\n- dma-mapping: benchmark: handle NUMA_NO_NODE correctly (git-fixes).\n- dma: xilinx_dpdma: Fix locking (git-fixes).\n- dmaengine: axi-dmac: fix possible race in remove() (git-fixes).\n- dmaengine: idma64: Add check for dma_set_max_seg_size (git-fixes).\n- dmaengine: idxd: Avoid unnecessary destruction of file_ida (git-fixes).\n- dmaengine: idxd: Fix oops during rmmod on single-CPU platforms (git-fixes).\n- dmaengine: owl: fix register access functions (git-fixes).\n- dmaengine: tegra186: Fix residual calculation (git-fixes).\n- docs: Restore 'smart quotes' for quotes (stable-fixes).\n- docs: kernel_include.py: Cope with docutils 0.21 (stable-fixes).\n- docs: netdev: Fix typo in Signed-off-by tag (git-fixes).\n- driver core: Introduce device_link_wait_removal() (stable-fixes).\n- drivers/nvme: Add quirks for device 126f:2262 (git-fixes).\n- drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init() (stable-fixes).\n- drm/amd/display: Add dml2 copy functions (stable-fixes).\n- drm/amd/display: Allow dirty rects to be sent to dmub when abm is active (stable-fixes).\n- drm/amd/display: Atom Integrated System Info v2_2 for DCN35 (stable-fixes).\n- drm/amd/display: Change default size for dummy plane in DML2 (stable-fixes).\n- drm/amd/display: Do not recursively call manual trigger programming (stable-fixes).\n- drm/amd/display: Enable colorspace property for MST connectors (git-fixes).\n- drm/amd/display: Fix bounds check for dcn35 DcfClocks (git-fixes).\n- drm/amd/display: Fix division by zero in setup_dsc_config (stable-fixes).\n- drm/amd/display: Fix idle check for shared firmware state (stable-fixes).\n- drm/amd/display: Fix incorrect DSC instance for MST (stable-fixes).\n- drm/amd/display: Fix nanosec stat overflow (stable-fixes).\n- drm/amd/display: Fix noise issue on HDMI AV mute (stable-fixes).\n- drm/amd/display: Fix potential index out of bounds in color transformation function (git-fixes).\n- drm/amd/display: Handle Y carry-over in VCP X.Y calculation (stable-fixes).\n- drm/amd/display: Init DPPCLK from SMU on dcn32 (stable-fixes).\n- drm/amd/display: Override min required DCFCLK in dml1_validate (stable-fixes).\n- drm/amd/display: Prevent crash when disable stream (stable-fixes).\n- drm/amd/display: Program VSC SDP colorimetry for all DP sinks \u003e= 1.4 (stable-fixes).\n- drm/amd/display: Remove MPC rate control logic from DCN30 and above (stable-fixes).\n- drm/amd/display: Remove redundant condition in dcn35_calc_blocks_to_gate() (git-fixes).\n- drm/amd/display: Return the correct HDCP error code (stable-fixes).\n- drm/amd/display: Send DTBCLK disable message on first commit (git-fixes).\n- drm/amd/display: Set DCN351 BB and IP the same as DCN35 (stable-fixes).\n- drm/amd/display: Set VSC SDP Colorimetry same way for MST and SST (stable-fixes).\n- drm/amd/display: Update odm when ODM combine is changed on an otg master pipe with no plane (stable-fixes).\n- drm/amd/display: Use freesync when `DRM_EDID_FEATURE_CONTINUOUS_FREQ` found (stable-fixes).\n- drm/amd/display: fix disable otg wa logic in DCN316 (stable-fixes).\n- drm/amd/display: fix input states translation error for dcn35 \u0026 dcn351 (stable-fixes).\n- drm/amd/display: handle range offsets in VRR ranges (stable-fixes).\n- drm/amd/pm: fixes a random hang in S4 for SMU v13.0.4/11 (stable-fixes).\n- drm/amd/swsmu: modify the gfx activity scaling (stable-fixes).\n- drm/amd: Flush GFXOFF requests in prepare stage (git-fixes).\n- drm/amdgpu/display: Address kdoc for 'is_psr_su' in 'fill_dc_dirty_rects' (git-fixes).\n- drm/amdgpu/pm: Check the validity of overdiver power limit (git-fixes).\n- drm/amdgpu/pm: Fix NULL pointer dereference when get power limit (git-fixes).\n- drm/amdgpu/pm: Fix the error of pwm1_enable setting (stable-fixes).\n- drm/amdgpu/sdma5.2: use legacy HDP flush for SDMA2/3 (stable-fixes).\n- drm/amdgpu: Assign correct bits for SDMA HDP flush (stable-fixes).\n- drm/amdgpu: Enable gpu reset for S3 abort cases on Raven series (stable-fixes).\n- drm/amdgpu: Fix VCN allocation in CPX partition (stable-fixes).\n- drm/amdgpu: Fix comparison in amdgpu_res_cpu_visible (git-fixes).\n- drm/amdgpu: Fix leak when GPU memory allocation fails (stable-fixes).\n- drm/amdgpu: Refine IB schedule error logging (stable-fixes).\n- drm/amdgpu: Reset dGPU if suspend got aborted (stable-fixes).\n- drm/amdgpu: always force full reset for SOC21 (stable-fixes).\n- drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag (stable-fixes).\n- drm/amdgpu: drop setting buffer funcs in sdma442 (git-fixes).\n- drm/amdgpu: fix deadlock while reading mqd from debugfs (git-fixes).\n- drm/amdgpu: fix doorbell regression (git-fixes).\n- drm/amdgpu: fix incorrect number of active RBs for gfx11 (stable-fixes).\n- drm/amdgpu: fix mmhub client id out-of-bounds access (git-fixes).\n- drm/amdgpu: fix use-after-free bug (stable-fixes).\n- drm/amdgpu: fix visible VRAM handling during faults (git-fixes).\n- drm/amdgpu: implement IRQ_STATE_ENABLE for SDMA v4.4.2 (stable-fixes).\n- drm/amdgpu: make damage clips support configurable (stable-fixes).\n- drm/amdgpu: once more fix the call oder in amdgpu_ttm_move() v2 (git-fixes).\n- drm/amdgpu: remove invalid resource-\u003estart check v2 (git-fixes).\n- drm/amdgpu: validate the parameters of bo mapping operations more clearly (git-fixes).\n- drm/amdkfd: Check cgroup when returning DMABuf info (stable-fixes).\n- drm/amdkfd: Fix memory leak in create_process failure (git-fixes).\n- drm/amdkfd: Reset GPU on queue preemption failure (stable-fixes).\n- drm/amdkfd: do not allow mapping the MMIO HDP page with large pages (git-fixes).\n- drm/amdkfd: fix TLB flush after unmap for GFX9.4.2 (stable-fixes).\n- drm/amdkfd: range check cp bad op exception interrupts (stable-fixes).\n- drm/arm/malidp: fix a possible null pointer dereference (git-fixes).\n- drm/ast: Fix soft lockup (git-fixes).\n- drm/bridge: Fix improper bridge init order with pre_enable_prev_first (git-fixes).\n- drm/bridge: anx7625: Do not log an error when DSI host can't be found (git-fixes).\n- drm/bridge: anx7625: Update audio status while detecting (git-fixes).\n- drm/bridge: dpc3433: Do not log an error when DSI host can't be found (git-fixes).\n- drm/bridge: icn6211: Do not log an error when DSI host can't be found (git-fixes).\n- drm/bridge: lt8912b: Do not log an error when DSI host can't be found (git-fixes).\n- drm/bridge: lt9611: Do not log an error when DSI host can't be found (git-fixes).\n- drm/bridge: lt9611uxc: Do not log an error when DSI host can't be found (git-fixes).\n- drm/bridge: tc358775: Do not log an error when DSI host can't be found (git-fixes).\n- drm/bridge: tc358775: fix support for jeida-18 and jeida-24 (git-fixes).\n- drm/buddy: check range allocation matches alignment (stable-fixes).\n- drm/client: Fully protect modes[] with dev-\u003emode_config.mutex (stable-fixes).\n- drm/connector: Add \\n to message about demoting connector force-probes (git-fixes).\n- drm/display: fix typo (git-fixes).\n- drm/exynos: do not return negative values from .get_modes() (stable-fixes).\n- drm/fbdev-generic: Do not set physical framebuffer address (git-fixes).\n- drm/gma500: Remove lid code (git-fixes).\n- drm/i915/audio: Fix audio time stamp programming for DP (stable-fixes).\n- drm/i915/bios: Fix parsing backlight BDB data (git-fixes).\n- drm/i915/bios: Tolerate devdata==NULL in intel_bios_encoder_supports_dp_dual_mode() (stable-fixes).\n- drm/i915/cdclk: Fix CDCLK programming order when pipes are active (git-fixes).\n- drm/i915/display: Use i915_gem_object_get_dma_address to get dma address (stable-fixes).\n- drm/i915/dp: Fix the computation for compressed_bpp for DISPLAY \u0026lt; 13 (git-fixes).\n- drm/i915/dp: Remove support for UHBR13.5 (git-fixes).\n- drm/i915/dpt: Make DPT object unshrinkable (git-fixes).\n- drm/i915/dsb: Fix DSB vblank waits when using VRR (git-fixes).\n- drm/i915/dsi: Go back to the previous INIT_OTP/DISPLAY_ON order, mostly (git-fixes).\n- drm/i915/gt: Automate CCS Mode setting during engine resets (git-fixes).\n- drm/i915/gt: Disable HW load balancing for CCS (git-fixes).\n- drm/i915/gt: Disarm breadcrumbs if engines are already idle (git-fixes).\n- drm/i915/gt: Do not generate the command streamer for all the CCS (git-fixes).\n- drm/i915/gt: Enable only one CCS for compute workload (git-fixes).\n- drm/i915/gt: Fix CCS id's calculation for CCS mode setting (git-fixes).\n- drm/i915/gt: Reset queue_priority_hint on parking (git-fixes).\n- drm/i915/guc: avoid FIELD_PREP warning (git-fixes).\n- drm/i915/hwmon: Fix locking inversion in sysfs getter (git-fixes).\n- drm/i915/lspcon: Separate function to set expected mode (bsc#1193599).\n- drm/i915/lspcon: Separate lspcon probe and lspcon init (bsc#1193599).\n- drm/i915/mst: Limit MST+DSC to TGL+ (git-fixes).\n- drm/i915/mst: Reject FEC+MST on ICL (git-fixes).\n- drm/i915/mtl: Update workaround 14018575942 (git-fixes).\n- drm/i915/vrr: Disable VRR when using bigjoiner (stable-fixes).\n- drm/i915/vrr: Generate VRR 'safe window' for DSB (git-fixes).\n- drm/i915: Disable port sync when bigjoiner is used (stable-fixes).\n- drm/i915: Do not match JSL in ehl_combo_pll_div_frac_wa_needed() (git-fixes).\n- drm/i915: Fix audio component initialization (git-fixes).\n- drm/i915: Include the PLL name in the debug messages (stable-fixes).\n- drm/i915: Pre-populate the cursor physical dma address (git-fixes).\n- drm/i915: Replace a memset() with zero initialization (stable-fixes).\n- drm/i915: Stop printing pipe name as hex (stable-fixes).\n- drm/i915: Suppress old PLL pipe_mask checks for MG/TC/TBT PLLs (stable-fixes).\n- drm/i915: Try to preserve the current shared_dpll for fastset on type-c ports (stable-fixes).\n- drm/i915: Use named initializers for DPLL info (stable-fixes).\n- drm/imx/ipuv3: do not return negative values from .get_modes() (stable-fixes).\n- drm/lcdif: Do not disable clocks on already suspended hardware (git-fixes).\n- drm/mediatek: Add 0 size check to mtk_drm_gem_obj (git-fixes).\n- drm/mediatek: Init `ddp_comp` with devm_kcalloc() (git-fixes).\n- drm/mediatek: dp: Fix mtk_dp_aux_transfer return value (git-fixes).\n- drm/meson: dw-hdmi: add bandgap setting for g12 (git-fixes).\n- drm/meson: dw-hdmi: power up phy on device init (git-fixes).\n- drm/meson: gate px_clk when setting rate (git-fixes).\n- drm/meson: vclk: fix calculation of 59.94 fractional rates (git-fixes).\n- drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails (git-fixes).\n- drm/msm/adreno: fix CP cycles stat retrieval on a7xx (git-fixes).\n- drm/msm/dp: Avoid a long timeout for AUX transfer if nothing connected (git-fixes).\n- drm/msm/dp: allow voltage swing / pre emphasis of 3 (git-fixes).\n- drm/msm/dp: fix typo in dp_display_handle_port_status_changed() (git-fixes).\n- drm/msm/dpu: Add callback function pointer check before its call (git-fixes).\n- drm/msm/dpu: Allow configuring multiple active DSC blocks (git-fixes).\n- drm/msm/dpu: Always flush the slave INTF on the CTL (git-fixes).\n- drm/msm/dpu: do not allow overriding data from catalog (git-fixes).\n- drm/msm/dpu: make error messages at dpu_core_irq_register_callback() more sensible (git-fixes).\n- drm/msm/dpu: use devres-managed allocation for MDP TOP (stable-fixes).\n- drm/msm/dsi: Print dual-DSI-adjusted pclk instead of original mode pclk (git-fixes).\n- drm/msm: Add newlines to some debug prints (git-fixes).\n- drm/nouveau/disp: Fix missing backlight control on Macbook 5, 1 (bsc#1223838).\n- drm/nouveau/dp: Do not probe eDP ports twice harder (stable-fixes).\n- drm/nouveau/dp: Fix incorrect return code in r535_dp_aux_xfer() (git-fixes).\n- drm/nouveau/firmware: Fix SG_DEBUG error with nvkm_firmware_ctor() (stable-fixes).\n- drm/nouveau: use tile_mode and pte_kind for VM_BIND bo allocations (git-fixes).\n- drm/omapdrm: Fix console by implementing fb_dirty (git-fixes).\n- drm/panel: do not return negative error codes from drm_panel_get_modes() (stable-fixes).\n- drm/panel: ili9341: Respect deferred probe (git-fixes).\n- drm/panel: ili9341: Use predefined error codes (git-fixes).\n- drm/panel: ltk050h3146w: add MIPI_DSI_MODE_VIDEO to LTK050H3148W flags (git-fixes).\n- drm/panel: ltk050h3146w: drop duplicate commands from LTK050H3148W init (git-fixes).\n- drm/panel: novatek-nt35950: Do not log an error when DSI host can't be found (git-fixes).\n- drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector (git-fixes).\n- drm/panel: sitronix-st7789v: fix display size for jt240mhqs_hwt_ek_e3 panel (git-fixes).\n- drm/panel: sitronix-st7789v: fix timing for jt240mhqs_hwt_ek_e3 panel (git-fixes).\n- drm/panel: sitronix-st7789v: tweak timing for jt240mhqs_hwt_ek_e3 panel (git-fixes).\n- drm/panel: visionox-rm69299: do not unregister DSI device (git-fixes).\n- drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr() (git-fixes).\n- drm/panfrost: fix power transition timeout warnings (git-fixes).\n- drm/prime: Unbreak virtgpu dma-buf export (git-fixes).\n- drm/probe-helper: warn about negative .get_modes() (stable-fixes).\n- drm/qxl: remove unused `count` variable from `qxl_surface_id_alloc()` (git-fixes).\n- drm/qxl: remove unused variable from `qxl_process_single_command()` (git-fixes).\n- drm/radeon: make -fstrict-flex-arrays=3 happy (git-fixes).\n- drm/radeon: silence UBSAN warning (v3) (stable-fixes).\n- drm/rockchip: vop2: Do not divide height twice for YUV (git-fixes).\n- drm/rockchip: vop2: Remove AR30 and AB30 format support (git-fixes).\n- drm/sched: fix null-ptr-deref in init entity (git-fixes).\n- drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE) (git-fixes).\n- drm/ttm: return ENOSPC from ttm_bo_mem_space v3 (stable-fixes).\n- drm/ttm: stop pooling cached NUMA pages v2 (git-fixes).\n- drm/vc4: do not check if plane-\u003estate-\u003efb == state-\u003efb (stable-fixes).\n- drm/vc4: hdmi: do not return negative values from .get_modes() (stable-fixes).\n- drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed (git-fixes).\n- drm/vmwgfx: Enable DMA mappings with SEV (git-fixes).\n- drm/vmwgfx: Fix Legacy Display Unit (git-fixes).\n- drm/vmwgfx: Fix crtc's atomic check conditional (git-fixes).\n- drm/vmwgfx: Fix invalid reads in fence signaled events (git-fixes).\n- drm/vmwgfx: Fix prime import/export (git-fixes).\n- drm/vmwgfx: Sort primary plane formats by order of preference (git-fixes).\n- drm: Check output polling initialized before disabling (stable-fixes).\n- drm: Check polling initialized before enabling in drm_helper_probe_single_connector_modes (stable-fixes).\n- drm: Fix drm_fixp2int_round() making it add 0.5 (git-fixes).\n- drm: add drm_gem_object_is_shared_for_memory_stats() helper (stable-fixes).\n- drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference (git-fixes).\n- drm: nv04: Fix out of bounds access (git-fixes).\n- drm: panel-orientation-quirks: Add quirk for GPD Win Mini (stable-fixes).\n- drm: vc4: Fix possible null pointer dereference (git-fixes).\n- drm: zynqmp_dpsub: Always register bridge (git-fixes).\n- dt-bindings: clock: qcom: Add missing UFS QREF clocks (git-fixes)\n- dump_stack: Do not get cpu_sync for panic CPU (bsc#1225607).\n- dyndbg: fix old BUG_ON in \u003econtrol parser (stable-fixes).\n- e1000e: Minor flow correction in e1000_shutdown function (git-fixes).\n- e1000e: Workaround for sporadic MDI error on Meteor Lake systems (git-fixes).\n- e1000e: move force SMBUS from enable ulp function to avoid PHY loss issue (git-fixes).\n- ecryptfs: Fix buffer size for tag 66 packet (git-fixes)\n- ecryptfs: Reject casefold directory inodes (git-fixes)\n- efi/unaccepted: do not let /proc/vmcore try to access unaccepted memory (git-fixes).\n- efi/unaccepted: touch soft lockup during memory accept (git-fixes).\n- efi: disable mirror feature during crashkernel (stable-fixes).\n- efi: fix panic in kdump kernel (git-fixes).\n- efi: libstub: only free priv.runtime_map when allocated (git-fixes).\n- extcon: max8997: select IRQ_DOMAIN instead of depending on it (git-fixes).\n- fast_dput(): handle underflows gracefully (git-fixes)\n- fat: fix uninitialized field in nostale filehandles (git-fixes)\n- fbdev: fix incorrect address computation in deferred IO (git-fixes).\n- fbdev: savage: Handle err return when savagefb_check_var failed (git-fixes).\n- fbdev: sh7760fb: allow modular build (git-fixes).\n- fbdev: shmobile: fix snprintf truncation (git-fixes).\n- fbdev: sisfb: hide unused variables (git-fixes).\n- fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2 (stable-fixes).\n- fbmon: prevent division by zero in fb_videomode_from_videomode() (stable-fixes).\n- firewire: core: use long bus reset on gap count error (stable-fixes).\n- firewire: ohci: mask bus reset interrupts between ISR and bottom half (stable-fixes).\n- firmware: arm_scmi: Make raw debugfs entries non-seekable (git-fixes).\n- firmware: dmi-id: add a release callback function (git-fixes).\n- firmware: raspberrypi: Use correct device for DMA mappings (git-fixes).\n- firmware: tegra: bpmp: Return directly after a failed kzalloc() in get_filename() (stable-fixes).\n- fs/9p: only translate RWX permissions for plain 9P2000 (git-fixes)\n- fs/9p: translate O_TRUNC into OTRUNC (git-fixes)\n- fs: Fix error checking for d_hash_and_lookup() (git-fixes)\n- fs: indicate request originates from old mount API (git-fixes)\n- fs: relax mount_setattr() permission checks (git-fixes)\n- fsverity: skip PKCS#7 parser when keyring is empty (git-fixes)\n- ftrace: Fix possible use-after-free issue in ftrace_location() (git-fixes).\n- fuse: do not unhash root (bsc#1223946).\n- fuse: fix root lookup with nonzero generation (bsc#1223945).\n- geneve: fix header validation in geneve[6]_xmit_skb (git-fixes).\n- geneve: make sure to pull inner header in geneve_rx() (git-fixes).\n- gpio: cdev: check for NULL labels when sanitizing them for irqs (git-fixes).\n- gpio: cdev: fix missed label sanitizing in debounce_setup() (git-fixes).\n- gpio: cdev: sanitize the label before requesting the interrupt (stable-fixes).\n- gpio: crystalcove: Use -ENOTSUPP consistently (stable-fixes).\n- gpio: tangier: Use correct type for the IRQ chip data (git-fixes).\n- gpio: tegra186: Fix tegra186_gpio_is_accessible() check (git-fixes).\n- gpio: wcove: Use -ENOTSUPP consistently (stable-fixes).\n- gpiolib: cdev: fix uninitialised kfifo (git-fixes).\n- gpiolib: cdev: relocate debounce_period_us from struct gpio_desc (stable-fixes).\n- gpiolib: swnode: Remove wrong header inclusion (git-fixes).\n- gpu: host1x: Do not setup DMA for virtual devices (stable-fixes).\n- gtp: fix use-after-free and null-ptr-deref in gtp_newlink() (git-fixes).\n- hwmon: (amc6821) add of_match table (stable-fixes).\n- hwmon: (corsair-cpro) Protect ccp-\u003ewait_input_report with a spinlock (git-fixes).\n- hwmon: (corsair-cpro) Use a separate buffer for sending commands (git-fixes).\n- hwmon: (corsair-cpro) Use complete_all() instead of complete() in ccp_raw_event() (git-fixes).\n- hwmon: (intel-m10-bmc-hwmon) Fix multiplier for N6000 board power sensor (git-fixes).\n- hwmon: (lm70) fix links in doc and comments (git-fixes).\n- hwmon: (pmbus/ucd9000) Increase delay from 250 to 500us (git-fixes).\n- hwmon: (shtc1) Fix property misspelling (git-fixes).\n- hwtracing: hisi_ptt: Move type check to the beginning of hisi_ptt_pmu_event_init() (git-fixes).\n- i2c: cadence: Avoid fifo clear after start (git-fixes).\n- i2c: pxa: hide unused icr_bits[] variable (git-fixes).\n- i2c: smbus: fix NULL function pointer dereference (git-fixes).\n- i2c: synquacer: Fix an error handling path in synquacer_i2c_probe() (git-fixes).\n- i3c: master: svc: change ENXIO to EAGAIN when IBI occurs during start frame (git-fixes).\n- i3c: master: svc: fix invalidate IBI type and miss call client IBI handler (git-fixes).\n- i40e: Enforce software interrupt during busy-poll exit (git-fixes).\n- i40e: Fix VF MAC filter removal (git-fixes).\n- i40e: Fix firmware version comparison function (git-fixes).\n- i40e: disable NAPI right after disabling irqs when handling xsk_pool (git-fixes).\n- i40e: fix i40e_count_filters() to count only active/new filters (git-fixes).\n- i40e: fix vf may be used uninitialized in this function warning (git-fixes).\n- i915: make inject_virtual_interrupt() void (stable-fixes).\n- ice: Refactor FW data type and fix bitmap casting issue (git-fixes).\n- ice: fix enabling RX VLAN filtering (git-fixes).\n- ice: fix memory corruption bug with suspend and rebuild (git-fixes).\n- ice: fix stats being updated by way too large values (git-fixes).\n- ice: fix typo in assignment (git-fixes).\n- ice: fix uninitialized dplls mutex usage (git-fixes).\n- ice: reconfig host after changing MSI-X on VF (git-fixes).\n- ice: reorder disabling IRQ and NAPI in ice_qp_dis (git-fixes).\n- ice: use relative VSI index for VFs instead of PF VSI number (git-fixes).\n- ice: virtchnl: stop pretending to support RSS over AQ or registers (git-fixes).\n- ida: make 'ida_dump' static (git-fixes).\n- idma64: Do not try to serve interrupts when device is powered off (git-fixes).\n- idpf: disable local BH when scheduling napi for marker packets (git-fixes).\n- idpf: extend tx watchdog timeout (bsc#1224137).\n- idpf: fix kernel panic on unknown packet types (git-fixes).\n- igb: Fix missing time sync events (git-fixes).\n- igb: extend PTP timestamp adjustments to i211 (git-fixes).\n- igc: Fix missing time sync events (git-fixes).\n- igc: Remove stale comment about Tx timestamping (git-fixes).\n- igc: avoid returning frame twice in XDP_REDIRECT (git-fixes).\n- iio: accel: mxc4005: Interrupt handling fixes (git-fixes).\n- iio: adc: stm32: Fixing err code to not indicate success (git-fixes).\n- iio: core: Leave private pointer NULL when no private data supplied (git-fixes).\n- iio: dummy_evgen: remove Excess kernel-doc comments (git-fixes).\n- iio: gts-helper: Fix division loop (git-fixes).\n- iio: pressure: Fixes BME280 SPI driver data (git-fixes).\n- iio: pressure: dps310: support negative temperature values (git-fixes).\n- iio:imu: adis16475: Fix sync mode setting (git-fixes).\n- inet: frags: eliminate kernel-doc warning (git-fixes).\n- inet_diag: annotate data-races around inet_diag_table[] (git-fixes).\n- init/main.c: Fix potential static_command_line memory overflow (git-fixes).\n- init: open /initrd.image with O_LARGEFILE (stable-fixes).\n- input/touchscreen: imagis: Correct the maximum touch area value (stable-fixes).\n- intel: legacy: Partial revert of field get conversion (git-fixes).\n- interconnect: qcom: osm-l3: Replace custom implementation of COUNT_ARGS() (git-fixes).\n- interconnect: qcom: qcm2290: Fix mas_snoc_bimc QoS port assignment (git-fixes).\n- interconnect: qcom: sc8180x: Mark CO0 BCM keepalive (git-fixes).\n- interconnect: qcom: sm8550: Enable sync_state (git-fixes).\n- io_uring: kabi cookie remove (bsc#1217384).\n- iomap: clear the per-folio dirty bits on all writeback failures (git-fixes)\n- iommu/arm-smmu-v3: Check that the RID domain is S1 in SVA (git-fixes).\n- iommu/dma: Force swiotlb_max_mapping_size on an untrusted device (bsc#1224331)\n- iommu/dma: Trace bounce buffer usage when mapping buffers (git-fixes).\n- iommu/vt-d: Allocate local memory for page request queue (git-fixes).\n- iommu/vt-d: Fix wrong use of pasid config (git-fixes).\n- iommu/vt-d: Set SSADE when attaching to a parent with dirty tracking (git-fixes).\n- iommu: Map reserved memory as cacheable if device is coherent (git-fixes).\n- iommufd/iova_bitmap: Bounds check mapped::pages access (git-fixes).\n- iommufd/iova_bitmap: Consider page offset for the pages to be pinned (git-fixes).\n- iommufd/iova_bitmap: Switch iova_bitmap::bitmap to an u8 array (git-fixes).\n- iommufd: Add missing IOMMUFD_DRIVER kconfig for the selftest (git-fixes).\n- iommufd: Fix iopt_access_list_id overwrite bug (git-fixes).\n- iommufd: Reject non-zero data_type if no data_len is provided (git-fixes).\n- ionic: set adminq irq affinity (git-fixes).\n- ipv4: annotate data-races around fi-\u003efib_dead (git-fixes).\n- irqchip/alpine-msi: Fix off-by-one in allocation error path (git-fixes).\n- irqchip/armada-370-xp: Suppress unused-function warning (git-fixes).\n- irqchip/gic-v3-its: Do not assume vPE tables are preallocated (git-fixes).\n- irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.1 (git-fixes).\n- irqchip/gic-v3-its: Prevent double free on error (git-fixes).\n- irqchip/loongson-pch-msi: Fix off-by-one on allocation error path (git-fixes).\n- irqchip/mbigen: Do not use bus_get_dev_root() to find the parent (git-fixes).\n- irqchip/renesas-rzg2l: Add macro to retrieve TITSR register offset based on register's index (stable-fixes).\n- irqchip/renesas-rzg2l: Flush posted write in irq_eoi() (git-fixes).\n- irqchip/renesas-rzg2l: Implement restriction when writing ISCR register (stable-fixes).\n- irqchip/renesas-rzg2l: Prevent spurious interrupts when setting trigger type (git-fixes).\n- irqchip/renesas-rzg2l: Rename rzg2l_irq_eoi() (stable-fixes).\n- irqchip/renesas-rzg2l: Rename rzg2l_tint_eoi() (stable-fixes).\n- ixgbe: avoid sleeping allocation in ixgbe_ipsec_vf_add_sa() (git-fixes).\n- ixgbe: {dis, en}able irqs in ixgbe_txrx_ring_{dis, en}able (git-fixes).\n- jffs2: prevent xattr node from overflowing the eraseblock (git-fixes).\n- kABI fix of KVM: x86/pmu: Allow programming events that match unsupported arch events (bsc#1225696).\n- kABI fix of KVM: x86: Snapshot if a vCPU's vendor model is AMD vs.  Intel compatible (git-fixes).\n- kABI workaround for cs35l56 (git-fixes).\n- kABI workaround for of driver changes (git-fixes).\n- kABI: Adjust trace_iterator.wait_index (git-fixes).\n- kabi fix of perf/x86/intel: Expose existence of callback support to KVM (git fixes).\n- kabi/severities: Remove mitigation-related symbols Those are used by the core kernel to implement CPU vulnerabilities mitigation and are not expected to be consumed by 3rd party users.\n- kabi/severities: ignore IMS functions They were dropped in previous patches. Noone is supposed to use them.\n- kabi/severities: ignore TAS2781 symbol drop, it's only locally used\n- kabi/severities: ignore Wangxun ethernet driver local symbols\n- kabi/severities: ignore brcmfmac-specific local symbols\n- kasan, fortify: properly rename memintrinsics (git-fixes).\n- kasan/test: avoid gcc warning for intentional overflow (git-fixes).\n- kasan: disable kasan_non_canonical_hook() for HW tags (git-fixes).\n- kasan: print the original fault addr when access invalid shadow (git-fixes).\n- kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1 (stable-fixes).\n- kconfig: fix infinite loop when expanding a macro at the end of file (git-fixes).\n- kexec: do syscore_shutdown() in kernel_kexec (git-fixes).\n- kprobes: Fix possible use-after-free issue on kprobe registration (git-fixes).\n- kselftest: Add a ksft_perror() helper (stable-fixes).\n- kunit/fortify: Fix mismatched kvalloc()/vfree() usage (git-fixes).\n- leds: pwm: Disable PWM when going to suspend (git-fixes).\n- lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure (git-fixes).\n- libnvdimm: Fix ACPI_NFIT in BLK_DEV_PMEM help (jsc#PED-5853).\n- libperf evlist: Avoid out-of-bounds access (git-fixes).\n- libsubcmd: Fix parse-options memory leak (git-fixes).\n- livepatch: Fix missing newline character in klp_resolve_symbols() (bsc#1223539).\n- locks: fix KASAN: use-after-free in trace_event_raw_event_filelock_lock (git-fixes)\n- lsm: fix the logic in security_inode_getsecctx() (git-fixes).\n- mac802154: fix llsec key resources release in mac802154_llsec_key_del (git-fixes).\n- maple_tree: fix mas_empty_area_rev() null pointer dereference (git-fixes).\n- md/dm-raid: do not call md_reap_sync_thread() directly (jsc#PED-7542).\n- md/raid1-10: add a helper raid1_check_read_range() (jsc#PED-7542).\n- md/raid1-10: factor out a new helper raid1_should_read_first() (jsc#PED-7542).\n- md/raid1: factor out choose_bb_rdev() from read_balance() (jsc#PED-7542).\n- md/raid1: factor out choose_slow_rdev() from read_balance() (jsc#PED-7542).\n- md/raid1: factor out helpers to add rdev to conf (jsc#PED-7542).\n- md/raid1: factor out helpers to choose the best rdev from read_balance() (jsc#PED-7542).\n- md/raid1: factor out read_first_rdev() from read_balance() (jsc#PED-7542).\n- md/raid1: factor out the code to manage sequential IO (jsc#PED-7542).\n- md/raid1: fix choose next idle in read_balance() (jsc#PED-7542).\n- md/raid1: record nonrot rdevs while adding/removing rdevs to conf (jsc#PED-7542).\n- md: Do not clear MD_CLOSING when the raid is about to stop (jsc#PED-7542).\n- md: add a new helper rdev_has_badblock() (jsc#PED-7542).\n- md: add a new helper reshape_interrupted() (jsc#PED-7542).\n- md: changed the switch of RAID_VERSION to if (jsc#PED-7542).\n- md: check mddev-\u003epers before calling md_set_readonly() (jsc#PED-7542).\n- md: clean up invalid BUG_ON in md_ioctl (jsc#PED-7542).\n- md: clean up openers check in do_md_stop() and md_set_readonly() (jsc#PED-7542).\n- md: do not clear MD_RECOVERY_FROZEN for new dm-raid until resume (jsc#PED-7542).\n- md: export helper md_is_rdwr() (jsc#PED-7542).\n- md: export helpers to stop sync_thread (jsc#PED-7542).\n- md: factor out a helper to sync mddev (jsc#PED-7542).\n- md: fix kmemleak of rdev-\u003eserial (jsc#PED-7542).\n- md: get rdev-\u003emddev with READ_ONCE() (jsc#PED-7542).\n- md: merge the check of capabilities into md_ioctl_valid() (jsc#PED-7542).\n- md: preserve KABI in struct md_personality (jsc#PED-7542).\n- md: remove redundant check of 'mddev-\u003esync_thread' (jsc#PED-7542).\n- md: remove redundant md_wakeup_thread() (jsc#PED-7542).\n- md: return directly before setting did_set_md_closing (jsc#PED-7542).\n- md: sync blockdev before stopping raid or setting readonly (jsc#PED-7542).\n- md: use RCU lock to protect traversal in md_spares_need_change() (jsc#PED-7542).\n- media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries (git-fixes).\n- media: cadence: csi2rx: use match fwnode for media link (git-fixes).\n- media: cec: core: remove length check of Timer Status (stable-fixes).\n- media: dt-bindings: ovti,ov2680: Fix the power supply names (git-fixes).\n- media: flexcop-usb: fix sanity check of bNumEndpoints (git-fixes).\n- media: i2c: et8ek8: Do not strip remove function when driver is builtin (git-fixes).\n- media: ipu3-cio2: Request IRQ earlier (git-fixes).\n- media: mc: Fix flags handling when creating pad links (stable-fixes).\n- media: mc: Fix graph walk in media_pipeline_start (git-fixes).\n- media: mc: Rename pad variable to clarify intent (stable-fixes).\n- media: mc: mark the media devnode as registered from the, start (git-fixes).\n- media: ngene: Add dvb_ca_en50221_init return value check (git-fixes).\n- media: rcar-vin: work around -Wenum-compare-conditional warning (git-fixes).\n- media: rkisp1: Fix IRQ handling due to shared interrupts (stable-fixes).\n- media: sta2x11: fix irq handler cast (stable-fixes).\n- media: stk1160: fix bounds checking in stk1160_copy_video() (git-fixes).\n- media: sunxi: a83-mips-csi2: also select GENERIC_PHY (git-fixes).\n- media: uvcvideo: Add quirk for Logitech Rally Bar (git-fixes).\n- media: v4l2-subdev: Fix stream handling for crop API (git-fixes).\n- media: v4l: Do not turn on privacy LED if streamon fails (git-fixes).\n- mei: me: add arrow lake point H DID (stable-fixes).\n- mei: me: add arrow lake point S DID (stable-fixes).\n- mei: me: add lunar lake point M DID (stable-fixes).\n- mei: me: disable RPL-S on SPS and IGN firmwares (git-fixes).\n- mlxbf_gige: call request_irq() after NAPI initialized (git-fixes).\n- mlxbf_gige: stop PHY during open() error paths (git-fixes).\n- mlxbf_gige: stop interface during shutdown (git-fixes).\n- mlxsw: Use refcount_t for reference counting (git-fixes).\n- mm,page_owner: Defer enablement of static branch (bsc#1222366).\n- mm,page_owner: Fix accounting of pages when migrating (bsc#1222366).\n- mm,page_owner: Fix printing of stack records (bsc#1222366).\n- mm,page_owner: Fix refcount imbalance (bsc#1222366).\n- mm,page_owner: Update metadata for tail pages (bsc#1222366).\n- mm,page_owner: check for null stack_record before bumping its refcount (bsc#1222366).\n- mm,page_owner: drop unnecessary check (bsc#1222366).\n- mm,page_owner: fix recursion (bsc#1222366).\n- mm/slab: make __free(kfree) accept error pointers (git-fixes).\n- mm: memcg: do not periodically flush stats when memcg is disabled (bsc#1222525).\n- mm: memcg: use larger batches for proactive reclaim (bsc#1222522).\n- mm: page_owner: fix wrong information in dump_page_owner (git-fixes).\n- mm_init kABI workaround (git-fixes).\n- mmc: core: Add HS400 tuning in HS400es initialization (stable-fixes).\n- mmc: core: Avoid negative index with array access (git-fixes).\n- mmc: core: Initialize mmc_blk_ioc_data (git-fixes).\n- mmc: davinci: Do not strip remove function when driver is builtin (git-fixes).\n- mmc: omap: fix broken slot switch lookup (git-fixes).\n- mmc: omap: fix deferred probe (git-fixes).\n- mmc: omap: restore original power up/down steps (git-fixes).\n- mmc: sdhci-msm: pervent access to suspended controller (git-fixes).\n- mmc: sdhci-omap: re-tuning is needed after a pm transition to support emmc HS200 mode (git-fixes).\n- mmc: sdhci_am654: Add ITAPDLYSEL in sdhci_j721e_4bit_set_clock (git-fixes).\n- mmc: sdhci_am654: Add OTAP/ITAP delay enable (git-fixes).\n- mmc: sdhci_am654: Add tuning algorithm for delay chain (git-fixes).\n- mmc: sdhci_am654: Fix ITAPDLY for HS400 timing (git-fixes).\n- mmc: sdhci_am654: Write ITAPDLY for DDR52 timing (git-fixes).\n- modpost: Add '.ltext' and '.ltext.*' to TEXT_SECTIONS (stable-fixes).\n- mptcp: Remove unnecessary test for __mptcp_init_sock() (git-fixes).\n- mptcp: annotate data-races around msk-\u003ermem_fwd_alloc (git-fixes).\n- mptcp: fix bogus receive window shrinkage with multiple subflows (git-fixes).\n- mptcp: move __mptcp_error_report in protocol.c (git-fixes).\n- mptcp: process pending subflow error on close (git-fixes).\n- mtd: core: Report error if first mtd_otp_size() call fails in mtd_otp_nvmem_add() (git-fixes).\n- mtd: diskonchip: work around ubsan link failure (stable-fixes).\n- mtd: rawnand: hynix: fixed typo (git-fixes).\n- mtd: spinand: Add support for 5-byte IDs (stable-fixes).\n- net/mlx5: Correctly compare pkt reformat ids (git-fixes).\n- net/mlx5: E-switch, Change flow rule destination checking (git-fixes).\n- net/mlx5: E-switch, store eswitch pointer before registering devlink_param (git-fixes).\n- net/mlx5: Fix fw reporter diagnose output (git-fixes).\n- net/mlx5: Fix peer devlink set for SF representor devlink port (git-fixes).\n- net/mlx5: Lag, restore buckets number to default after hash LAG deactivation (git-fixes).\n- net/mlx5: Properly link new fs rules into the tree (git-fixes).\n- net/mlx5: Register devlink first under devlink lock (git-fixes).\n- net/mlx5: Restore mistakenly dropped parts in register devlink flow (git-fixes).\n- net/mlx5: SF, Stop waiting for FW as teardown was called (git-fixes).\n- net/mlx5: offset comp irq index in name by one (git-fixes).\n- net/mlx5e: Change the warning when ignore_flow_level is not supported (git-fixes).\n- net/mlx5e: Do not produce metadata freelist entries in Tx port ts WQE xmit (git-fixes).\n- net/mlx5e: Fix mlx5e_priv_init() cleanup flow (git-fixes).\n- net/mlx5e: HTB, Fix inconsistencies with QoS SQs number (git-fixes).\n- net/mlx5e: RSS, Block XOR hash with over 128 channels (git-fixes).\n- net/mlx5e: RSS, Block changing channels number when RXFH is configured (git-fixes).\n- net/mlx5e: Switch to using _bh variant of of spinlock API in port timestamping NAPI poll context (git-fixes).\n- net/mlx5e: Use a memory barrier to enforce PTP WQ xmit submission tracking occurs after populating the metadata_map (git-fixes).\n- net/smc: bugfix for smcr v2 server connect success statistic (git-fixes).\n- net/smc: fix documentation of buffer sizes (git-fixes).\n- net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_add (git-fixes).\n- net/x25: fix incorrect parameter validation in the x25_getsockopt() function (git-fixes).\n- net: NSH: fix kernel-doc notation warning (git-fixes).\n- net: Use sockaddr_storage for getsockopt(SO_PEERNAME) (git-fixes).\n- net: add netdev_lockdep_set_classes() to virtual drivers (git-fixes).\n- net: annotate data-races around sk-\u003esk_bind_phc (git-fixes).\n- net: annotate data-races around sk-\u003esk_forward_alloc (git-fixes).\n- net: annotate data-races around sk-\u003esk_lingertime (git-fixes).\n- net: annotate data-races around sk-\u003esk_tsflags (git-fixes).\n- net: bonding: remove kernel-doc comment marker (git-fixes).\n- net: cfg802154: fix kernel-doc notation warnings (git-fixes).\n- net: dsa: microchip: fix register write order in ksz8_ind_write8() (git-fixes).\n- net: dsa: mt7530: fix handling of all link-local frames (git-fixes).\n- net: dsa: mt7530: fix link-local frames that ingress vlan filtering ports (git-fixes).\n- net: dsa: mt7530: prevent possible incorrect XTAL frequency selection (git-fixes).\n- net: dsa: mt7530: trap link-local frames regardless of ST Port State (git-fixes).\n- net: dsa: sja1105: Fix parameters order in sja1110_pcs_mdio_write_c45() (git-fixes).\n- net: ena: Fix incorrect descriptor free behavior (git-fixes).\n- net: ena: Fix potential sign extension issue (git-fixes).\n- net: ena: Move XDP code to its new files (git-fixes).\n- net: ena: Pass ena_adapter instead of net_device to ena_xmit_common() (git-fixes).\n- net: ena: Remove ena_select_queue (git-fixes).\n- net: ena: Set tx_info-\u003exdpf value to NULL (git-fixes).\n- net: ena: Use tx_ring instead of xdp_ring for XDP channel TX (git-fixes).\n- net: ena: Wrong missing IO completions check order (git-fixes).\n- net: ethernet: mtk_eth_soc: fix PPE hanging issue (git-fixes).\n- net: ethernet: ti: cpsw: enable mac_managed_pm to fix mdio (git-fixes).\n- net: fec: Set mac_managed_pm during probe (git-fixes).\n- net: hns3: fix index limit to support all queue stats (git-fixes).\n- net: hns3: fix kernel crash when 1588 is received on HIP08 devices (git-fixes).\n- net: hns3: fix kernel crash when devlink reload during pf initialization (git-fixes).\n- net: hns3: fix port duplex configure error in IMP reset (git-fixes).\n- net: hns3: fix wrong judgment condition issue (git-fixes).\n- net: hns3: mark unexcuted loopback test result as UNEXECUTED (git-fixes).\n- net: hns3: tracing: fix hclgevf trace event strings (git-fixes).\n- net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() (git-fixes).\n- net: ks8851: Handle softirqs at the end of IRQ thread to fix hang (git-fixes).\n- net: ks8851: Inline ks8851_rx_skb() (git-fixes).\n- net: ks8851: Queue RX packets in IRQ handler instead of disabling BHs (git-fixes).\n- net: lan743x: Add set RFE read fifo threshold for PCI1x1x chips (git-fixes).\n- net: libwx: fix memory leak on free page (git-fixes).\n- net: ll_temac: platform_get_resource replaced by wrong function (git-fixes).\n- net: llc: fix kernel-doc notation warnings (git-fixes).\n- net: mana: Fix Rx DMA datasize and skb_over_panic (git-fixes).\n- net: mediatek: mtk_eth_soc: clear MAC_MCR_FORCE_LINK only when MAC is up (git-fixes).\n- net: nfc: remove inappropriate attrs check (stable-fixes).\n- net: pcs: xpcs: Return EINVAL in the internal methods (git-fixes).\n- net: phy: fix phy_read_poll_timeout argument type in genphy_loopback (git-fixes).\n- net: phy: micrel: Fix potential null pointer dereference (git-fixes).\n- net: phy: micrel: lan8814: Fix when enabling/disabling 1-step timestamping (git-fixes).\n- net: phy: micrel: set soft_reset callback to genphy_soft_reset for KSZ8061 (git-fixes).\n- net: phy: phy_device: Prevent nullptr exceptions on ISR (git-fixes).\n- net: phy: phy_device: Prevent nullptr exceptions on ISR (stable-fixes).\n- net: ravb: Always process TX descriptor ring (git-fixes).\n- net: ravb: Let IP-specific receive function to interrogate descriptors (git-fixes).\n- net: smsc95xx: add support for SYS TEC USB-SPEmodule1 (git-fixes).\n- net: sparx5: Fix use after free inside sparx5_del_mact_entry (git-fixes).\n- net: sparx5: fix wrong config being used when reconfiguring PCS (git-fixes).\n- net: sparx5: flower: fix fragment flags handling (git-fixes).\n- net: stmmac: Fix incorrect dereference in interrupt handlers (git-fixes).\n- net: stmmac: dwmac-starfive: Add support for JH7100 SoC (git-fixes).\n- net: stmmac: fix rx queue priority assignment (git-fixes).\n- net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr() (git-fixes).\n- net: tcp: fix unexcepted socket die when snd_wnd is 0 (git-fixes).\n- net: tls, fix WARNIING in __sk_msg_free (bsc#1221858).\n- net: tls: fix returned read length with async decrypt (bsc#1221858).\n- net: tls: fix use-after-free with partial reads and async (bsc#1221858).\n- net: usb: ax88179_178a: avoid the interface always configured as random address (git-fixes).\n- net: usb: ax88179_178a: avoid writing the mac address before first reading (git-fixes).\n- net: usb: ax88179_178a: fix link status when link is set to down/up (git-fixes).\n- net: usb: ax88179_178a: stop lying about skb-\u003etruesize (git-fixes).\n- net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM (git-fixes).\n- net: usb: smsc95xx: stop lying about skb-\u003etruesize (git-fixes).\n- net: usb: sr9700: stop lying about skb-\u003etruesize (git-fixes).\n- net: veth: do not manipulate GRO when using XDP (git-fixes).\n- net: wwan: t7xx: Split 64bit accesses to fix alignment issues (git-fixes).\n- net:usb:qmi_wwan: support Rolling modules (stable-fixes).\n- netfilter: nf_tables: disable toggling dormant table state more than once (git-fixes).\n- netfilter: nf_tables: uapi: Describe NFTA_RULE_CHAIN_ID (git-fixes).\n- netfilter: nft_ct: fix l3num expectations with inet pseudo family (git-fixes).\n- netfilter: nft_set_rbtree: use read spinlock to avoid datapath contention (git-fixes).\n- nf_conntrack: fix -Wunused-const-variable= (git-fixes).\n- nfc: nci: Fix handling of zero-length payload packets in nci_rx_work() (git-fixes).\n- nfc: nci: Fix kcov check in nci_rx_work() (git-fixes).\n- nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet (git-fixes).\n- nfc: nci: Fix uninit-value in nci_rx_work (git-fixes).\n- nfp: flower: handle acti_netdevs allocation failure (git-fixes).\n- nfs: fix panic when nfs4_ff_layout_prepare_ds() fails (git-fixes).\n- nfsd: Fix a regression in nfsd_setattr() (git-fixes).\n- nfsd: do not call locks_release_private() twice concurrently (git-fixes).\n- nfsd: use __fput_sync() to avoid delayed closing of files (bsc#1223380 bsc#1217408).\n- nilfs2: fix OOB in nilfs_set_de_type (git-fixes).\n- nilfs2: fix out-of-range warning (git-fixes).\n- nilfs2: fix potential bug in end_buffer_async_write (git-fixes).\n- nilfs2: fix unexpected freezing of nilfs_segctor_sync() (git-fixes).\n- nilfs2: fix use-after-free of timer for log writer thread (git-fixes).\n- nilfs2: make superblock data array index computation sparse friendly (git-fixes).\n- nouveau/dmem: handle kcalloc() allocation failure (git-fixes).\n- nouveau/gsp: do not check devinit disable on GSP (git-fixes).\n- nouveau/uvmm: fix addr/range calcs for remap operations (git-fixes).\n- nouveau: fix devinit paths to only handle display on GSP (git-fixes).\n- nouveau: fix function cast warning (git-fixes).\n- nouveau: fix instmem race condition around ptr stores (git-fixes).\n- nouveau: lock the client object tree (stable-fixes).\n- nouveau: reset the bo resource bus info after an eviction (git-fixes).\n- nvdimm/pmem: Treat alloc_dax() -EOPNOTSUPP failure as non-fatal (jsc#PED-5853).\n- nvdimm/pmem: fix leak on dax_add_host() failure (jsc#PED-5853).\n- nvdimm: make nvdimm_bus_type const (jsc#PED-5853).\n- nvme-fc: do not wait in vain when unloading module (git-fixes).\n- nvme-multipath: fix io accounting on failover (git-fixes).\n- nvme-pci: Add quirk for broken MSIs (git-fixes).\n- nvme-tcp: strict pdu pacing to avoid send stalls on TLS (bsc#1221858).\n- nvme: fix multipath batched completion accounting (git-fixes).\n- nvme: fix reconnection fail due to reserved tag allocation (git-fixes).\n- nvme: fix warn output about shared namespaces without CONFIG_NVME_MULTIPATH (git-fixes).\n- nvmet-fc: abort command when there is no binding (git-fixes).\n- nvmet-fc: defer cleanup using RCU properly (git-fixes).\n- nvmet-fc: hold reference on hostport match (git-fixes).\n- nvmet-fc: release reference on target port (git-fixes).\n- nvmet-fcloop: swap the list_add_tail arguments (git-fixes).\n- nvmet-tcp: fix nvme tcp ida memory leak (git-fixes).++ kernel-source-azure.spec (revision 4)%define git_commit ba2f81d0ba1ad117dc6a5494a21d358f354126d7Release:    \u0026lt;RELEASE\u003e.gba2f81d\n- nvmet: fix ns enable/disable possible hang (git-fixes).\n- octeontx2-af: Add array index check (git-fixes).\n- octeontx2-af: Fix NIX SQ mode and BP config (git-fixes).\n- octeontx2-af: Fix devlink params (git-fixes).\n- octeontx2-af: Fix issue with loading coalesced KPU profiles (git-fixes).\n- octeontx2-af: Use matching wake_up API variant in CGX command interface (git-fixes).\n- octeontx2-af: Use separate handlers for interrupts (git-fixes).\n- octeontx2-pf: Fix transmit scheduler resource leak (git-fixes).\n- octeontx2-pf: Send UP messages to VF only when VF is up (git-fixes).\n- octeontx2-pf: Use default max_active works instead of one (git-fixes).\n- octeontx2-pf: Wait till detach_resources msg is complete (git-fixes).\n- octeontx2-pf: check negative error code in otx2_open() (git-fixes).\n- octeontx2-pf: fix FLOW_DIS_IS_FRAGMENT implementation (git-fixes).\n- octeontx2: Detect the mbox up or down message via register (git-fixes).\n- of: dynamic: Synchronize of_changeset_destroy() with the devlink removals (git-fixes).\n- of: module: add buffer overflow check in of_modalias() (git-fixes).\n- of: module: prevent NULL pointer dereference in vsnprintf() (stable-fixes).\n- of: property: Add in-ports/out-ports support to of_graph_get_port_parent() (stable-fixes).\n- of: property: Improve finding the consumer of a remote-endpoint property (git-fixes).\n- of: property: Improve finding the supplier of a remote-endpoint property (git-fixes).\n- of: property: fix typo in io-channels (git-fixes).\n- of: property: fw_devlink: Fix stupid bug in remote-endpoint parsing (git-fixes).\n- of: unittest: Fix compile in the non-dynamic case (git-fixes).\n- overflow: Allow non-type arg to type_max() and type_min() (stable-fixes).\n- peci: linux/peci.h: fix Excess kernel-doc description warning (git-fixes).\n- perf annotate: Fix annotation_calc_lines() to pass correct address to get_srcline() (git-fixes).\n- perf annotate: Get rid of duplicate --group option item (git-fixes).\n- perf auxtrace: Fix multiple use of --itrace option (git-fixes).\n- perf bench internals inject-build-id: Fix trap divide when collecting just one DSO (git-fixes).\n- perf bench uprobe: Remove lib64 from libc.so.6 binary path (git-fixes).\n- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).\n- perf daemon: Fix file leak in daemon_session__control (git-fixes).\n- perf docs: Document bpf event modifier (git-fixes).\n- perf evsel: Fix duplicate initialization of data-\u003eid in evsel__parse_sample() (git-fixes).\n- perf expr: Fix 'has_event' function for metric style events (git-fixes).\n- perf intel-pt: Fix unassigned instruction op (discovered by MemorySanitizer) (git-fixes).\n- perf jevents: Drop or simplify small integer values (git-fixes).\n- perf list: fix short description for some cache events (git-fixes).\n- perf lock contention: Add a missing NULL check (git-fixes).\n- perf metric: Do not remove scale from counts (git-fixes).\n- perf pmu: Count sys and cpuid JSON events separately (git fixes).\n- perf pmu: Fix a potential memory leak in perf_pmu__lookup() (git-fixes).\n- perf pmu: Treat the msr pmu as software (git-fixes).\n- perf print-events: make is_event_supported() more robust (git-fixes).\n- perf probe: Add missing libgen.h header needed for using basename() (git-fixes).\n- perf record: Check conflict between '--timestamp-filename' option and pipe mode before recording (git-fixes).\n- perf record: Fix debug message placement for test consumption (git-fixes).\n- perf record: Fix possible incorrect free in record__switch_output() (git-fixes).\n- perf report: Avoid SEGV in report__setup_sample_type() (git-fixes).\n- perf sched timehist: Fix -g/--call-graph option failure (git-fixes).\n- perf script: Show also errors for --insn-trace option (git-fixes).\n- perf srcline: Add missed addr2line closes (git-fixes).\n- perf stat: Avoid metric-only segv (git-fixes).\n- perf stat: Do not display metric header for non-leader uncore events (git-fixes).\n- perf stat: Do not fail on metrics on s390 z/VM systems (git-fixes).\n- perf symbols: Fix ownership of string in dso__load_vmlinux() (git-fixes).\n- perf test shell arm_coresight: Increase buffer size for Coresight basic tests (git-fixes).\n- perf tests: Apply attributes to all events in object code reading test (git-fixes).\n- perf tests: Make 'test data symbol' more robust on Neoverse N1 (git-fixes).\n- perf tests: Make data symbol test wait for perf to start (bsc#1220045).\n- perf tests: Skip data symbol test if buf1 symbol is missing (bsc#1220045).\n- perf thread: Fixes to thread__new() related to initializing comm (git-fixes).\n- perf thread_map: Free strlist on normal path in thread_map__new_by_tid_str() (git-fixes).\n- perf top: Uniform the event name for the hybrid machine (git-fixes).\n- perf top: Use evsel's cpus to replace user_requested_cpus (git-fixes).\n- perf ui browser: Avoid SEGV on title (git fixes).\n- perf ui browser: Do not save pointer to stack memory (git-fixes).\n- perf vendor events amd: Add Zen 4 memory controller events (git-fixes).\n- perf vendor events amd: Fix Zen 4 cache latency events (git-fixes).\n- perf/x86/amd/core: Avoid register reset when CPU is dead (git-fixes).\n- perf/x86/amd/core: Update and fix stalled-cycles-* events for Zen 2 and later (git-fixes).\n- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).\n- perf/x86/amd/lbr: Use freeze based on availability (git-fixes).\n- perf/x86/intel/ds: Do not clear -\u003epebs_data_cfg for the last PEBS event (git-fixes).\n- perf/x86/intel: Expose existence of callback support to KVM (git-fixes).\n- perf/x86: Fix out of range data (git-fixes).\n- phy: freescale: imx8m-pcie: fix pcie link-up instability (git-fixes).\n- phy: marvell: a3700-comphy: Fix hardcoded array size (git-fixes).\n- phy: marvell: a3700-comphy: Fix out of bounds read (git-fixes).\n- phy: rockchip-snps-pcie3: fix bifurcation on rk3588 (git-fixes).\n- phy: rockchip-snps-pcie3: fix clearing PHP_GRF_PCIESEL_CON bits (git-fixes).\n- phy: rockchip: naneng-combphy: Fix mux on rk3588 (git-fixes).\n- phy: ti: tusb1210: Resolve charger-det crash if charger psy is unregistered (git-fixes).\n- pinctrl/meson: fix typo in PDM's pin name (git-fixes).\n- pinctrl: armada-37xx: remove an unused variable (git-fixes).\n- pinctrl: baytrail: Fix selecting gpio pinctrl state (git-fixes).\n- pinctrl: core: delete incorrect free in pinctrl_enable() (git-fixes).\n- pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map() (git-fixes).\n- pinctrl: mediatek: paris: Fix PIN_CONFIG_INPUT_SCHMITT_ENABLE readback (git-fixes).\n- pinctrl: mediatek: paris: Rework support for PIN_CONFIG_{INPUT,OUTPUT}_ENABLE (git-fixes).\n- pinctrl: pinctrl-aspeed-g6: Fix register offset for pinconf of GPIOR-T (git-fixes).\n- pinctrl: qcom: pinctrl-sm7150: Fix sdc1 and ufs special pins regs (git-fixes).\n- pinctrl: renesas: checker: Limit cfg reg enum checks to provided IDs (stable-fixes).\n- platform/chrome: cros_ec_uart: properly fix race condition (git-fixes).\n- platform/x86/amd/pmc: Extend Framework 13 quirk to more BIOSes (stable-fixes).\n- platform/x86/intel-uncore-freq: Do not present root domain on error (git-fixes).\n- platform/x86: ISST: Add Granite Rapids-D to HPM CPU list (stable-fixes).\n- platform/x86: touchscreen_dmi: Add an extra entry for a variant of the Chuwi Vi8 tablet (stable-fixes).\n- platform/x86: x86-android-tablets: Fix acer_b1_750_goodix_gpios name (stable-fixes).\n- platform/x86: xiaomi-wmi: Fix race condition when reporting key events (git-fixes).\n- power: rt9455: hide unused rt9455_boost_voltage_values (git-fixes).\n- power: supply: mt6360_charger: Fix of_match for usb-otg-vbus regulator (git-fixes).\n- powerpc/crypto/chacha-p10: Fix failure on non Power10 (bsc#1218205).\n- powerpc/eeh: Permanently disable the removed device (bsc#1223991 ltc#205740).\n- powerpc/hv-gpci: Fix the H_GET_PERF_COUNTER_INFO hcall return value checks (git-fixes).\n- powerpc/pseries/lparcfg: drop error message from guest name lookup (bsc#1187716 ltc#193451 git-fixes).\n- powerpc/pseries/vio: Do not return ENODEV if node or compatible missing (bsc#1220783).\n- powerpc/pseries: make max polling consistent for longer H_CALLs (bsc#1215199).\n- powerpc/uaccess: Fix build errors seen with GCC 13/14 (bsc#1194869).\n- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).\n- powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt (bsc#1221645 ltc#205739 bsc#1223191).\n- ppdev: Add an error check in register_device (git-fixes).\n- prctl: generalize PR_SET_MDWE support check to be per-arch (bsc#1225610).\n- printk: Add this_cpu_in_panic() (bsc#1225607).\n- printk: Adjust mapping for 32bit seq macros (bsc#1225607).\n- printk: Avoid non-panic CPUs writing to ringbuffer (bsc#1225607).\n- printk: Consolidate console deferred printing (bsc#1225607).\n- printk: Disable passing console lock owner completely during panic() (bsc#1225607).\n- printk: Do not take console lock for console_flush_on_panic() (bsc#1225607).\n- printk: For @suppress_panic_printk check for other CPU in panic (bsc#1225607).\n- printk: Keep non-panic-CPUs out of console lock (bsc#1225607).\n- printk: Let no_printk() use _printk() (bsc#1225618).\n- printk: Reduce console_unblank() usage in unsafe scenarios (bsc#1225607).\n- printk: Rename abandon_console_lock_in_panic() to other_cpu_in_panic() (bsc#1225607).\n- printk: Update @console_may_schedule in console_trylock_spinning() (bsc#1225616).\n- printk: Use prb_first_seq() as base for 32bit seq macros (bsc#1225607).\n- printk: Wait for all reserved records with pr_flush() (bsc#1225607).\n- printk: nbcon: Relocate 32bit seq macros (bsc#1225607).\n- printk: ringbuffer: Clarify special lpos values (bsc#1225607).\n- printk: ringbuffer: Cleanup reader terminology (bsc#1225607).\n- printk: ringbuffer: Do not skip non-finalized records with prb_next_seq() (bsc#1225607).\n- printk: ringbuffer: Skip non-finalized records in panic (bsc#1225607).\n- proc/kcore: do not try to access unaccepted memory (git-fixes).\n- pstore/zone: Add a null pointer check to the psz_kmsg_read (stable-fixes).\n- pstore: inode: Convert mutex usage to guard(mutex) (stable-fixes).\n- pstore: inode: Only d_invalidate() is needed (git-fixes).\n- pwm: img: fix pwm clock lookup (git-fixes).\n- qibfs: fix dentry leak (git-fixes)\n- r8169: fix issue caused by buggy BIOS on certain boards with RTL8168d (git-fixes).\n- r8169: skip DASH fw status checks when DASH is disabled (git-fixes).\n- random: handle creditable entropy from atomic process context (git-fixes).\n- regmap: Add regmap_read_bypassed() (git-fixes).\n- regmap: kunit: Ensure that changed bytes are actually different (stable-fixes).\n- regmap: maple: Fix cache corruption in regcache_maple_drop() (git-fixes).\n- regmap: maple: Fix uninitialized symbol 'ret' warnings (git-fixes).\n- regulator: bd71828: Do not overwrite runtime voltages (git-fixes).\n- regulator: change devm_regulator_get_enable_optional() stub to return Ok (git-fixes).\n- regulator: change stubbed devm_regulator_get_enable to return Ok (git-fixes).\n- regulator: core: fix debugfs creation regression (git-fixes).\n- regulator: mt6360: De-capitalize devicetree regulator subnodes (git-fixes).\n- regulator: tps65132: Add of_match table (stable-fixes).\n- remoteproc: k3-r5: Do not allow core1 to power up before core0 via sysfs (git-fixes).\n- remoteproc: k3-r5: Jump to error handling labels in start/stop errors (git-fixes).\n- remoteproc: k3-r5: Wait for core0 power-up before powering up core1 (git-fixes).\n- remoteproc: mediatek: Make sure IPI buffer fits in L2TCM (git-fixes).\n- remoteproc: stm32: Fix incorrect type assignment returned by stm32_rproc_get_loaded_rsc_tablef (git-fixes).\n- remoteproc: virtio: Fix wdg cannot recovery remote processor (git-fixes).\n- ring-buffer: Do not set shortest_full when full target is hit (git-fixes).\n- ring-buffer: Fix a race between readers and resize checks (git-fixes).\n- ring-buffer: Fix full_waiters_pending in poll (git-fixes).\n- ring-buffer: Fix resetting of shortest_full (git-fixes).\n- ring-buffer: Fix waking up ring buffer readers (git-fixes).\n- ring-buffer: Make wake once of ring_buffer_wait() more robust (git-fixes).\n- ring-buffer: Use wait_event_interruptible() in ring_buffer_wait() (git-fixes).\n- ring-buffer: use READ_ONCE() to read cpu_buffer-\u003ecommit_page in concurrent environment (git-fixes).\n- rtc: mt6397: select IRQ_DOMAIN instead of depending on it (git-fixes).\n- s390/bpf: Emit a barrier for BPF_FETCH instructions (git-fixes bsc#1224792).\n- s390/cio: Ensure the copied buf is NUL terminated (git-fixes bsc#1223869).\n- s390/cio: fix tracepoint subchannel type field (git-fixes bsc#1224793).\n- s390/cpacf: Split and rework cpacf query functions (git-fixes bsc#1225133).\n- s390/cpum_cf: make crypto counters upward compatible across machine types (bsc#1224348).\n- s390/ipl: Fix incorrect initialization of len fields in nvme reipl block (git-fixes bsc#1225136).\n- s390/ipl: Fix incorrect initialization of nvme dump block (git-fixes bsc#1225134).\n- s390/ism: Properly fix receive message buffer allocation (git-fixes bsc#1223590).\n- s390/mm: Fix clearing storage keys for huge pages (git-fixes bsc#1223871).\n- s390/mm: Fix storage key clearing for guest huge pages (git-fixes bsc#1223872).\n- s390/qeth: Fix kernel panic after setting hsuid (git-fixes bsc#1223874).\n- s390/vdso: Add CFI for RA register to asm macro vdso_func (git-fixes bsc#1223870).\n- s390/vdso: drop '-fPIC' from LDFLAGS (git-fixes bsc#1223593).\n- s390/vtime: fix average steal time calculation (git-fixes bsc#1221783).\n- s390/zcrypt: fix reference counting on zcrypt card objects (git-fixes bsc#1223592).\n- sched-fair-Add-EAS-checks-before-updating-root_domain-overutilized.patch.\n- sched-fair-Combine-EAS-check-with-overutilized-access.patch.\n- sched-fair-Introduce-is_rd_overutilized-helper-function-to-access-root_domain-overutilized.patch.\n- sched/balancing: Rename newidle_balance() =\u003e sched_balance_newidle() (bsc#1222173).\n- sched/fair: Check root_domain::overload value before update (bsc#1222173).\n- sched/fair: Use helper functions to access root_domain::overload (bsc#1222173).\n- sched/psi: Select KERNFS as needed (git-fixes).\n- sched/topology: Optimize topology_span_sane() (bsc#1225053).\n- scsi: bfa: Fix function pointer type mismatch for hcb_qe-\u003ecbfn (git-fixes).\n- scsi: core: Consult supported VPD page list prior to fetching page (git-fixes).\n- scsi: core: Fix unremoved procfs host directory regression (git-fixes).\n- scsi: csiostor: Avoid function pointer casts (git-fixes).\n- scsi: hisi_sas: Modify the deadline for ata_wait_after_reset() (git-fixes).\n- scsi: libsas: Add a helper sas_get_sas_addr_and_dev_type() (git-fixes).\n- scsi: libsas: Fix disk not being scanned in after being removed (git-fixes).\n- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).\n- scsi: lpfc: Change default logging level for unsolicited CT MIB commands (bsc#1225842).\n- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask (bsc#1225842). Refresh: \t- patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch\n- scsi: lpfc: Clear deferred RSCN processing flag when driver is unloading (bsc#1225842).\n- scsi: lpfc: Copyright updates for 14.4.0.1 patches (bsc#1221777).\n- scsi: lpfc: Copyright updates for 14.4.0.2 patches (bsc#1225842).\n- scsi: lpfc: Correct size for cmdwqe/rspwqe for memset() (bsc#1221777).\n- scsi: lpfc: Correct size for wqe for memset() (bsc#1221777).\n- scsi: lpfc: Define lpfc_dmabuf type for ctx_buf ptr (bsc#1221777).\n- scsi: lpfc: Define lpfc_nodelist type for ctx_ndlp ptr (bsc#1221777).\n- scsi: lpfc: Define types in a union for generic void *context3 ptr (bsc#1221777).\n- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list (bsc#1225842).\n- scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (bsc#1221777).\n- scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1221777).\n- scsi: lpfc: Remove IRQF_ONESHOT flag from threaded IRQ handling (bsc#1221777 bsc#1217959).\n- scsi: lpfc: Remove unnecessary log message in queuecommand path (bsc#1221777).\n- scsi: lpfc: Replace hbalock with ndlp lock in lpfc_nvme_unregister_port() (bsc#1221777).\n- scsi: lpfc: Update logging of protection type for T10 DIF I/O (bsc#1225842).\n- scsi: lpfc: Update lpfc version to 14.4.0.1 (bsc#1221777).\n- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).\n- scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic (bsc#1221777).\n- scsi: lpfc: Use a dedicated lock for ras_fwlog state (bsc#1221777).\n- scsi: mpi3mr: Reduce stack usage in mpi3mr_refresh_sas_ports() (git-fixes).\n- scsi: mpt3sas: Prevent sending diag_reset when the controller is ready (git-fixes).\n- scsi: mylex: Fix sysfs buffer lengths (git-fixes).\n- scsi: qla2xxx: Change debug message during driver unload (bsc1221816).\n- scsi: qla2xxx: Delay I/O Abort on PCI error (bsc1221816).\n- scsi: qla2xxx: Fix N2N stuck connection (bsc1221816).\n- scsi: qla2xxx: Fix command flush on cable pull (bsc1221816).\n- scsi: qla2xxx: Fix double free of fcport (bsc1221816).\n- scsi: qla2xxx: Fix double free of the ha-\u003evp_map pointer (bsc1221816).\n- scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() (git-fixes).\n- scsi: qla2xxx: NVME|FCP prefer flag not being honored (bsc1221816).\n- scsi: qla2xxx: Prevent command send on chip reset (bsc1221816).\n- scsi: qla2xxx: Split FCE|EFT trace control (bsc1221816).\n- scsi: qla2xxx: Update manufacturer detail (bsc1221816).\n- scsi: qla2xxx: Update version to 10.02.09.200-k (bsc1221816).\n- scsi: sd: Unregister device if device_add_disk() failed in sd_probe() (git-fixes).\n- scsi: sg: Avoid race in error handling \u0026 drop bogus warn (git-fixes).\n- scsi: sg: Avoid sg device teardown race (git-fixes).\n- scsi: smartpqi: Fix disable_managed_interrupts (git-fixes).\n- sctp: annotate data-races around sk-\u003esk_wmem_queued (git-fixes).\n- sdhci-of-dwcmshc: disable PM runtime in dwcmshc_remove() (git-fixes).\n- selftests/binderfs: use the Makefile's rules, not Make's implicit rules (git-fixes).\n- selftests/bpf: add edge case backtracking logic test (bsc#1225756).\n- selftests/bpf: precision tracking test for BPF_NEG and BPF_END (bsc#1225756).\n- selftests/ftrace: Fix event filter target_func selection (stable-fixes).\n- selftests/ftrace: Limit length in subsystem-enable tests (git-fixes).\n- selftests/kcmp: remove unused open mode (git-fixes).\n- selftests/net: convert test_bridge_neigh_suppress.sh to run it in unique namespace (stable-fixes).\n- selftests/pidfd: Fix config for pidfd_setns_test (git-fixes).\n- selftests/powerpc/dexcr: Add -no-pie to hashchk tests (git-fixes).\n- selftests/powerpc/papr-vpd: Fix missing variable initialization (jsc#PED-4486 git-fixes).\n- selftests/resctrl: fix clang build failure: use LOCAL_HDRS (git-fixes).\n- selftests/timers/posix_timers: Reimplement check_timer_distribution() (git-fixes).\n- selftests: default to host arch for LLVM builds (git-fixes).\n- selftests: forwarding: Fix ping failure due to short timeout (git-fixes).\n- selftests: kselftest: Fix build failure with NOLIBC (git-fixes).\n- selftests: kselftest: Mark functions that unconditionally call exit() as __noreturn (git-fixes).\n- selftests: net: bridge: increase IGMP/MLD exclude timeout membership interval (git-fixes).\n- selftests: net: kill smcrouted in the cleanup logic in amt.sh (git-fixes).\n- selftests: net: move amt to socat for better compatibility (git-fixes).\n- selftests: test_bridge_neigh_suppress.sh: Fix failures due to duplicate MAC (git-fixes).\n- selftests: timers: Convert posix_timers test to generate KTAP output (stable-fixes).\n- selftests: timers: Fix abs() warning in posix_timers test (git-fixes).\n- selftests: timers: Fix posix_timers ksft_print_msg() warning (git-fixes).\n- selftests: timers: Fix valid-adjtimex signed left-shift undefined behavior (stable-fixes).\n- selftests: vxlan_mdb: Fix failures with old libnet (git-fixes).\n- selinux: avoid dereference of garbage after mount failure (git-fixes).\n- selinux: introduce an initial SID for early boot processes (bsc#1208593).\n- serial/pmac_zilog: Remove flawed mitigation for rx irq flood (git-fixes).\n- serial: 8250_bcm7271: use default_mux_rate if possible (git-fixes).\n- serial: 8250_dw: Revert: Do not reclock if already at correct rate (git-fixes).\n- serial: 8250_exar: Do not remove GPIO device on suspend (git-fixes).\n- serial: 8520_mtk: Set RTS on shutdown for Rx in-band wakeup (git-fixes).\n- serial: Lock console when calling into driver before registration (git-fixes).\n- serial: core: Fix atomicity violation in uart_tiocmget (git-fixes).\n- serial: core: only stop transmit when HW fifo is empty (git-fixes).\n- serial: kgdboc: Fix NMI-safety problems from keyboard reset code (stable-fixes).\n- serial: max3100: Fix bitwise types (git-fixes).\n- serial: max3100: Lock port-\u003elock when calling uart_handle_cts_change() (git-fixes).\n- serial: max310x: fix NULL pointer dereference in I2C instantiation (git-fixes).\n- serial: max310x: fix syntax error in IRQ error message (git-fixes).\n- serial: mxs-auart: add spinlock around changing cts state (git-fixes).\n- serial: sc16is7xx: add proper sched.h include for sched_set_fifo() (git-fixes).\n- serial: sc16is7xx: fix bug in sc16is7xx_set_baud() when using prescaler (git-fixes).\n- serial: sh-sci: protect invalidating RXDMA on shutdown (git-fixes).\n- serial: stm32: Reset .throttled state in .startup() (git-fixes).\n- series.conf: cleanup Fix subsection header to silence series_insert error.\n- slimbus: core: Remove usage of the deprecated ida_simple_xx() API (git-fixes).\n- slimbus: qcom-ngd-ctrl: Add timeout for wait operation (git-fixes).\n- smb3: show beginning time for per share stats (bsc#1225172).\n- smb: client: ensure to try all targets when finding nested links (bsc#1225172).\n- smb: client: fix mount when dns_resolver key is not available (git-fixes, bsc#1225172).\n- smb: client: fix parsing of SMB3.1.1 POSIX create context (git-fixes, bsc#1225172).\n- smb: client: get rid of dfs code dep in namespace.c (bsc#1225172).\n- smb: client: get rid of dfs naming in automount code (bsc#1225172).\n- smb: client: introduce DFS_CACHE_TGT_LIST() (bsc#1225172).\n- smb: client: reduce stack usage in cifs_try_adding_channels() (bsc#1225172).\n- smb: client: remove extra @chan_count check in __cifs_put_smb_ses() (bsc#1225172).\n- smb: client: rename cifs_dfs_ref.c to namespace.c (bsc#1225172).\n- soc: fsl: qbman: Always disable interrupts when taking cgr_lock (git-fixes).\n- soc: fsl: qbman: Use raw spinlock for cgr_lock (git-fixes).\n- soc: mediatek: cmdq: Fix typo of CMDQ_JUMP_RELATIVE (git-fixes).\n- soc: microchip: Fix POLARFIRE_SOC_SYS_CTRL input prompt (stable-fixes).\n- soc: qcom: pmic_glink: Make client-lock non-sleeping (git-fixes).\n- soc: qcom: pmic_glink: do not traverse clients list without a lock (git-fixes).\n- soc: qcom: pmic_glink: notify clients about the current state (git-fixes).\n- soc: qcom: rpmh-rsc: Enhance check for VRM in-flight request (git-fixes).\n- sock_diag: annotate data-races around sock_diag_handlers[family] (git-fixes).\n- soundwire: amd: fix for wake interrupt handling for clockstop mode (git-fixes).\n- speakup: Avoid crash on very long word (git-fixes).\n- speakup: Fix 8bit characters from direct synth (git-fixes).\n- speakup: Fix sizeof() vs ARRAY_SIZE() bug (git-fixes).\n- spi: Do not mark message DMA mapped when no transfer in it is (git-fixes).\n- spi: fix null pointer dereference within spi_sync (git-fixes).\n- spi: hisi-kunpeng: Delete the dump interface of data registers in debugfs (git-fixes).\n- spi: intel-pci: Add support for Lunar Lake-M SPI serial flash (stable-fixes).\n- spi: lm70llp: fix links in doc and comments (git-fixes).\n- spi: lpspi: Avoid potential use-after-free in probe() (git-fixes).\n- spi: mchp-pci1xxx: Fix a possible null pointer dereference in pci1xxx_spi_probe (git-fixes).\n- spi: microchip-core-qspi: fix setting spi bus clock rate (git-fixes).\n- spi: spi-fsl-lpspi: remove redundant spi_controller_put call (git-fixes).\n- spi: spi-mt65xx: Fix NULL pointer access in interrupt handler (git-fixes).\n- spi: stm32: Do not warn about spurious interrupts (git-fixes).\n- spi: xilinx: Fix kernel documentation in the xilinx_spi.h (git-fixes).\n- spmi: hisi-spmi-controller: Do not override device identifier (git-fixes).\n- staging: vc04_services: changen strncpy() to strscpy_pad() (stable-fixes).\n- staging: vc04_services: fix information leak in create_component() (git-fixes).\n- staging: vt6655: Remove unused declaration of RFbAL7230SelectChannelPostProcess() (git-fixes).\n- stmmac: Clear variable when destroying workqueue (git-fixes).\n- supported.conf: support tcp_dctcp module (jsc#PED-8111)\n- swiotlb: Fix alignment checks when both allocation and DMA masks are (bsc#1224331)\n- swiotlb: Fix double-allocation of slots due to broken alignment (bsc#1224331)\n- swiotlb: Honour dma_alloc_coherent() alignment in swiotlb_alloc() (bsc#1224331)\n- swiotlb: extend buffer pre-padding to alloc_align_mask if necessary (bsc#1224331)\n- swiotlb: use the calculated number of areas (git-fixes).\n- thermal/drivers/qcom/lmh: Check for SCM availability at probe (git-fixes).\n- thermal/drivers/tsens: Fix null pointer dereference (git-fixes).\n- thermal/of: Assume polling-delay(-passive) 0 when absent (stable-fixes).\n- thermal: devfreq_cooling: Fix perf state when calculate dfc res_util (git-fixes).\n- thunderbolt: Avoid notify PM core about runtime PM resume (stable-fixes).\n- thunderbolt: Do not create DisplayPort tunnels on adapters of the same router (git-fixes).\n- thunderbolt: Fix wake configurations after device unplug (stable-fixes).\n- thunderbolt: Introduce tb_path_deactivate_hop() (stable-fixes).\n- thunderbolt: Introduce tb_port_reset() (stable-fixes).\n- thunderbolt: Make tb_switch_reset() support Thunderbolt 2, 3 and USB4 routers (stable-fixes).\n- thunderbolt: Reset only non-USB4 host routers in resume (git-fixes).\n- tls: break out of main loop when PEEK gets a non-data record (bsc#1221858).\n- tls: do not skip over different type records from the rx_list (bsc#1221858).\n- tls: fix peeking with sync+async decryption (bsc#1221858).\n- tls: stop recv() if initial process_rx_list gave us non-DATA (bsc#1221858).\n- tools/arch/x86/intel_sdsi: Fix maximum meter bundle length (git-fixes).\n- tools/arch/x86/intel_sdsi: Fix meter_certificate decoding (git-fixes).\n- tools/arch/x86/intel_sdsi: Fix meter_show display (git-fixes).\n- tools/latency-collector: Fix -Wformat-security compile warns (git-fixes).\n- tools/power turbostat: Expand probe_intel_uncore_frequency() (bsc#1221765).\n- tools/power/turbostat: Fix uncore frequency file string (bsc#1221765).\n- tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer (git-fixes).\n- tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string (git-fixes).\n- tracing/ring-buffer: Fix wait_on_pipe() race (git-fixes).\n- tracing: Add MODULE_DESCRIPTION() to preemptirq_delay_test (git-fixes).\n- tracing: Have saved_cmdlines arrays all in one allocation (git-fixes).\n- tracing: Remove precision vsnprintf() check from print event (git-fixes).\n- tracing: Use .flush() call to wake up readers (git-fixes).\n- tracing: hide unused ftrace_event_id_fops (git-fixes).\n- tty: n_gsm: fix missing receive state reset after mode switch (git-fixes).\n- tty: n_gsm: fix possible out-of-bounds in gsm0_receive() (git-fixes).\n- tty: serial: samsung: fix tx_empty() to return TIOCSER_TEMT (git-fixes).\n- tty: vt: fix 20 vs 0x20 typo in EScsiignore (git-fixes).\n- ubifs: Queue up space reservation tasks if retrying many times (git-fixes).\n- ubifs: Remove unreachable code in dbg_check_ltab_lnum (git-fixes).\n- ubifs: Set page uptodate in the correct place (git-fixes).\n- ubifs: dbg_check_idx_size: Fix kmemleak if loading znode failed (git-fixes).\n- ubifs: fix sort function prototype (git-fixes).\n- usb: Disable USB3 LPM at shutdown (stable-fixes).\n- usb: Fix regression caused by invalid ep0 maxpacket in virtual SuperSpeed device (bsc#1220569).\n- usb: aqc111: stop lying about skb-\u003etruesize (git-fixes).\n- usb: audio-v2: Correct comments for struct uac_clock_selector_descriptor (git-fixes).\n- usb: cdc-wdm: close race between read and workqueue (git-fixes).\n- usb: dwc2: gadget: Fix exiting from clock gating (git-fixes).\n- usb: dwc2: gadget: LPM flow fix (git-fixes).\n- usb: dwc2: host: Fix ISOC flow in DDMA mode (git-fixes).\n- usb: dwc2: host: Fix dereference issue in DDMA completion flow (git-fixes).\n- usb: dwc2: host: Fix hibernation flow (git-fixes).\n- usb: dwc2: host: Fix remote wakeup from hibernation (git-fixes).\n- usb: dwc3-am62: Disable wakeup at remove (git-fixes).\n- usb: dwc3-am62: Rename private data (git-fixes).\n- usb: dwc3-am62: fix module unload/reload behavior (git-fixes).\n- usb: dwc3: Properly set system wakeup (git-fixes).\n- usb: dwc3: Wait unconditionally after issuing EndXfer command (git-fixes).\n- usb: dwc3: core: Prevent phy suspend during init (Git-fixes).\n- usb: dwc3: pci: Drop duplicate ID (git-fixes).\n- usb: fotg210: Add missing kernel doc description (git-fixes).\n- usb: gadget: composite: fix OS descriptors w_value logic (git-fixes).\n- usb: gadget: f_fs: Fix a race condition when processing setup packets (git-fixes).\n- usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete (git-fixes).\n- usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error (stable-fixes).\n- usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin (git-fixes).\n- usb: gadget: u_audio: Clear uac pointer when freed (git-fixes).\n- usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind (git-fixes).\n- usb: gadget: uvc: mark incomplete frames with UVC_STREAM_ERR (stable-fixes).\n- usb: gadget: uvc: use correct buffer size when parsing configfs lists (git-fixes).\n- usb: ohci: Prevent missed ohci interrupts (git-fixes).\n- usb: phy: generic: Get the vbus supply (git-fixes).\n- usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined (stable-fixes).\n- usb: typec: Return size of buffer if pd_set operation succeeds (git-fixes).\n- usb: typec: tcpci: add generic tcpci fallback compatible (stable-fixes).\n- usb: typec: tcpm: Check for port partner validity before consuming it (git-fixes).\n- usb: typec: tcpm: Correct port source pdo array in pd_set callback (git-fixes).\n- usb: typec: tcpm: Correct the PDO counting in pd_set (git-fixes).\n- usb: typec: tcpm: Update PD of Type-C port upon pd_set (git-fixes).\n- usb: typec: tcpm: clear pd_event queue in PORT_RESET (git-fixes).\n- usb: typec: tcpm: fix double-free issue in tcpm_port_unregister_pd() (git-fixes).\n- usb: typec: tcpm: unregister existing source caps before re-registration (git-fixes).\n- usb: typec: tipd: fix event checking for tps6598x (git-fixes).\n- usb: typec: ucsi: Ack unsupported commands (stable-fixes).\n- usb: typec: ucsi: Check for notifications after init (git-fixes).\n- usb: typec: ucsi: Clean up UCSI_CABLE_PROP macros (git-fixes).\n- usb: typec: ucsi: Clear EVENT_PENDING under PPM lock (git-fixes).\n- usb: typec: ucsi: Clear UCSI_CCI_RESET_COMPLETE before reset (stable-fixes).\n- usb: typec: ucsi: Fix connector check on init (git-fixes).\n- usb: typec: ucsi: Fix race between typec_switch and role_switch (git-fixes).\n- usb: typec: ucsi: Limit read size on v1.2 (stable-fixes).\n- usb: typec: ucsi: always register a link to USB PD device (git-fixes).\n- usb: typec: ucsi: displayport: Fix potential deadlock (git-fixes).\n- usb: typec: ucsi: simplify partner's PD caps registration (git-fixes).\n- usb: typec: ucsi_acpi: Refactor and fix DELL quirk (git-fixes).\n- usb: udc: remove warning when queue disabled ep (stable-fixes).\n- usb: xhci-plat: Do not include xhci.h (stable-fixes).\n- usb: xhci: Add error handling in xhci_map_urb_for_dma (git-fixes).\n- usb: xhci: Implement xhci_handshake_check_state() helper.\n- usb: xhci: correct return value in case of STS_HCE (git-fixes).\n- vboxsf: Avoid an spurious warning if load_nls_xxx() fails (git-fixes).\n- vboxsf: explicitly deny setlease attempts (stable-fixes).\n- vdpa/mlx5: Allow CVQ size changes (git-fixes).\n- vdpa_sim: reset must not run (git-fixes).\n- veth: try harder when allocating queue memory (git-fixes).\n- vhost: Add smp_rmb() in vhost_enable_notify() (git-fixes).\n- vhost: Add smp_rmb() in vhost_vq_avail_empty() (git-fixes).\n- virtio-blk: Ensure no requests in virtqueues before deleting vqs (git-fixes).\n- virtio: treat alloc_dax() -EOPNOTSUPP failure as non-fatal (bsc#1223944).\n- virtio_net: Do not send RSS key if it is not supported (git-fixes).\n- vmci: prevent speculation leaks by sanitizing event in event_deliver() (git-fixes).\n- vsock/virtio: fix packet delivery to tap device (git-fixes).\n- watchdog: bd9576: Drop 'always-running' property (git-fixes).\n- watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger (git-fixes).\n- watchdog: rti_wdt: Set min_hw_heartbeat_ms to accommodate a safety margin (git-fixes).\n- watchdog: sa1100: Fix PTR_ERR_OR_ZERO() vs NULL check in sa1100dog_probe() (git-fixes).\n- wifi: ar5523: enable proper endpoint verification (git-fixes).\n- wifi: ath10k: Fix an error code problem in ath10k_dbg_sta_write_peer_debug_trigger() (git-fixes).\n- wifi: ath10k: poll service ready message before failing (git-fixes).\n- wifi: ath10k: populate board data for WCN3990 (git-fixes).\n- wifi: ath11k: decrease MHI channel buffer length to 8KB (bsc#1207948).\n- wifi: ath11k: do not force enable power save on non-running vdevs (git-fixes).\n- wifi: ath12k: fix out-of-bound access of qmi_invoke_handler() (git-fixes).\n- wifi: ath9k: fix LNA selection in ath_ant_try_scan() (stable-fixes).\n- wifi: brcmfmac: Add DMI nvram filename quirk for ACEPC W5 Pro (stable-fixes).\n- wifi: brcmfmac: Demote vendor-specific attach/detach messages to info (git-fixes).\n- wifi: brcmfmac: add per-vendor feature detection callback (stable-fixes).\n- wifi: brcmfmac: cfg80211: Use WSEC to set SAE password (stable-fixes).\n- wifi: brcmfmac: pcie: handle randbuf allocation failure (git-fixes).\n- wifi: carl9170: add a proper sanity check for endpoints (git-fixes).\n- wifi: carl9170: re-fix fortified-memset warning (git-fixes).\n- wifi: cfg80211: check A-MSDU format more carefully (stable-fixes).\n- wifi: cfg80211: fix rdev_dump_mpp() arguments order (stable-fixes).\n- wifi: ieee80211: fix ieee80211_mle_basic_sta_prof_size_ok() (git-fixes).\n- wifi: iwlwifi: fw: do not always use FW dump trig (git-fixes).\n- wifi: iwlwifi: fw: fix compile w/o CONFIG_ACPI (git-fixes).\n- wifi: iwlwifi: mvm: allocate STA links only for active links (git-fixes).\n- wifi: iwlwifi: mvm: fix active link counting during recovery (git-fixes).\n- wifi: iwlwifi: mvm: fix check in iwl_mvm_sta_fw_id_mask (git-fixes).\n- wifi: iwlwifi: mvm: guard against invalid STA ID on removal (stable-fixes).\n- wifi: iwlwifi: mvm: include link ID when releasing frames (git-fixes).\n- wifi: iwlwifi: mvm: init vif works only once (git-fixes).\n- wifi: iwlwifi: mvm: remove old PASN station when adding a new one (git-fixes).\n- wifi: iwlwifi: mvm: return uid from iwl_mvm_build_scan_cmd (git-fixes).\n- wifi: iwlwifi: mvm: rfi: fix potential response leaks (git-fixes).\n- wifi: iwlwifi: mvm: select STA mask only for active links (git-fixes).\n- wifi: iwlwifi: mvm: use correct address 3 in A-MSDU (stable-fixes).\n- wifi: iwlwifi: pcie: Add the PCI device id for new hardware (stable-fixes).\n- wifi: iwlwifi: pcie: fix RB status reading (stable-fixes).\n- wifi: iwlwifi: read txq-\u003eread_ptr under lock (stable-fixes).\n- wifi: iwlwifi: reconfigure TLC during HW restart (git-fixes).\n- wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (stable-fixes).\n- wifi: mac80211: clean up assignments to pointer cache (stable-fixes).\n- wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc (stable-fixes).\n- wifi: mac80211: fix prep_connection error path (stable-fixes).\n- wifi: mac80211: fix unaligned le16 access (git-fixes).\n- wifi: mac80211: only call drv_sta_rc_update for uploaded stations (stable-fixes).\n- wifi: mac80211: remove link before AP (git-fixes).\n- wifi: mac80211_hwsim: init peer measurement result (git-fixes).\n- wifi: mt76: mt7603: add wpdma tx eof flag for PSE client reset (git-fixes).\n- wifi: mt76: mt7603: fix tx queue of loopback packets (git-fixes).\n- wifi: mt76: mt7915: workaround too long expansion sparse warnings (git-fixes).\n- wifi: mt76: mt7996: add locking for accessing mapped registers (stable-fixes).\n- wifi: mt76: mt7996: disable AMSDU for non-data frames (stable-fixes).\n- wifi: mwl8k: initialize cmd-\u003eaddr[] properly (git-fixes).\n- wifi: nl80211: do not free NULL coalescing rule (git-fixes).\n- wifi: rtw88: 8821cu: Fix connection failure (stable-fixes).\n- wifi: rtw88: Add missing VID/PIDs for 8811CU and 8821CU (stable-fixes).\n- wifi: rtw89: fix null pointer access when abort scan (stable-fixes).\n- wifi: rtw89: pci: correct TX resource checking for PCI DMA channel of firmware command (git-fixes).\n- wifi: rtw89: pci: enlarge RX DMA buffer to consider size of RX descriptor (stable-fixes).\n- wireguard: netlink: access device through ctx instead of peer (git-fixes).\n- wireguard: netlink: check for dangling peer via is_dead instead of empty list (git-fixes).\n- wireguard: receive: annotate data-race around receiving_counter.counter (git-fixes).\n- x86/CPU/AMD: Add models 0x10-0x1f to the Zen5 range (git-fixes).\n- x86/Kconfig: Remove CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT (git-fixes).\n- x86/bugs: Fix BHI retpoline check (git-fixes).\n- x86/bugs: Fix the SRSO mitigation on Zen3/4 (git-fixes).\n- x86/bugs: Remove default case for fully switched enums (git-fixes).\n- x86/calldepth: Rename __x86_return_skl() to call_depth_return_thunk() (git-fixes).\n- x86/coco: Require seeding RNG with RDRAND on CoCo systems (git-fixes).\n- x86/cpu: Add model number for Intel Arrow Lake mobile processor (git-fixes).\n- x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ (git-fixes).\n- x86/efistub: Add missing boot_params for mixed mode compat entry (git-fixes).\n- x86/efistub: Call mixed mode boot services on the firmware's stack (git-fixes).\n- x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD (git-fixes).\n- x86/hyperv: Allow 15-bit APIC IDs for VTL platforms (git-fixes).\n- x86/hyperv: Use per cpu initial stack for vtl context (git-fixes).\n- x86/kconfig: Select ARCH_WANT_FRAME_POINTERS again when UNWINDER_FRAME_POINTER=y (git-fixes).\n- x86/kvm/Kconfig: Have KVM_AMD_SEV select ARCH_HAS_CC_PLATFORM (git-fixes).\n- x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() (git-fixes).\n- x86/nmi: Fix the inverse 'in NMI handler' check (git-fixes).\n- x86/nospec: Refactor UNTRAIN_RET[_*] (git-fixes).\n- x86/pm: Work around false positive kmemleak report in msr_build_context() (git-fixes).\n- x86/purgatory: Switch to the position-independent small code model (git-fixes).\n- x86/rethunk: Use SYM_CODE_START[_LOCAL]_NOALIGN macros (git-fixes).\n- x86/retpoline: Add NOENDBR annotation to the SRSO dummy return thunk (git-fixes).\n- x86/retpoline: Do the necessary fixup to the Zen3/4 srso return thunk for !SRSO (git-fixes).\n- x86/srso: Disentangle rethunk-dependent options (git-fixes).\n- x86/srso: Fix unret validation dependencies (git-fixes).\n- x86/srso: Improve i-cache locality for alias mitigation (git-fixes).\n- x86/srso: Print actual mitigation if requested mitigation isn't possible (git-fixes).\n- x86/srso: Remove 'pred_cmd' label (git-fixes).\n- x86/srso: Unexport untraining functions (git-fixes).\n- x86/xen: Add some null pointer checking to smp.c (git-fixes).\n- x86/xen: attempt to inflate the memory balloon on PVH (git-fixes).\n- xdp, bonding: Fix feature flags when there are no slave devs anymore (git-fixes).\n- xen-netfront: Add missing skb_mark_for_recycle (git-fixes).\n- xen/events: drop xen_allocate_irqs_dynamic() (git-fixes).\n- xen/events: fix error code in xen_bind_pirq_msi_to_irq() (git-fixes).\n- xen/events: increment refcnt only if event channel is refcounted (git-fixes).\n- xen/events: modify internal [un]bind interfaces (git-fixes).\n- xen/events: reduce externally visible helper functions (git-fixes).\n- xen/events: remove some simple helpers from events_base.c (git-fixes).\n- xen/evtchn: avoid WARN() when unbinding an event channel (git-fixes).\n- xen: evtchn: Allow shared registration of IRQ handers (git-fixes).\n- xfs: add lock protection when remove perag from radix tree (git-fixes).\n- xfs: allow extent free intents to be retried (git-fixes).\n- xfs: fix perag leak when growfs fails (git-fixes).\n- xfs: force all buffers to be written during btree bulk load (git-fixes).\n- xfs: make xchk_iget safer in the presence of corrupt inode btrees (git-fixes).\n- xfs: pass the xfs_defer_pending object to iop_recover (git-fixes).\n- xfs: recompute growfsrtfree transaction reservation while growing rt volume (git-fixes).\n- xfs: transfer recovered intent item ownership in -\u003eiop_recover (git-fixes).\n- xfs: use xfs_defer_pending objects to recover intent items (git-fixes).\n- xhci: Simplify event ring dequeue pointer update for port change events (git-fixes).\n- xhci: add helper that checks for unhandled events on a event ring (git-fixes).\n- xhci: remove unnecessary event_ring_deq parameter from xhci_handle_event() (git-fixes).\n- xhci: simplify event ring dequeue tracking for transfer events (git-fixes).\n- 9p: add missing locking around taking dentry fid list (git-fixes)\n- accel/ivpu: Fix deadlock in context_xa (git-fixes).\n- ACPI: bus: Indicate support for _TFP thru _OSC (git-fixes).\n- ACPI: bus: Indicate support for IRQ ResourceSource thru _OSC (git-fixes).\n- ACPI: bus: Indicate support for the Generic Event Device thru _OSC (git-fixes).\n- ACPI: CPPC: Fix access width used for PCC registers (git-fixes).\n- ACPI: CPPC: Fix bit_offset shift in MASK_VAL() macro (git-fixes).\n- ACPI: CPPC: Use access_width over bit_width for system memory accesses (stable-fixes).\n- ACPI: disable -Wstringop-truncation (git-fixes).\n- ACPI: Fix Generic Initiator Affinity _OSC bit (git-fixes).\n- ACPI: LPSS: Advertise number of chip selects via property (git-fixes).\n- ACPI: resource: Add Infinity laptops to irq1_edge_low_force_override (stable-fixes).\n- ACPI: resource: Do IRQ override on Lunnen Ground laptops (stable-fixes).\n- ACPI: scan: Do not increase dep_unmet for already met dependencies (git-fixes).\n- ACPI: video: Add backlight=native quirk for Lenovo Slim 7 16ARH7 (bsc#1217750).\n- ACPI: x86: Move acpi_quirk_skip_serdev_enumeration() out of CONFIG_X86_ANDROID_TABLETS (stable-fixes).\n- ACPICA: debugger: check status of acpi_evaluate_object() in acpi_db_walk_for_fields() (git-fixes).\n- admin-guide/hw-vuln/core-scheduling: fix return type of PR_SCHED_CORE_GET (git-fixes).\n- ahci: asm1064: asm1166: do not limit reported ports (git-fixes).\n- ahci: asm1064: correct count of reported ports (stable-fixes).\n- ALSA: aoa: avoid false-positive format truncation warning (git-fixes).\n- ALSA: core: Fix NULL module pointer assignment at card init (git-fixes).\n- ALSA: core: Remove debugfs at disconnection (git-fixes).\n- ALSA: firewire-lib: handle quirk to calculate payload quadlets as data block counter (stable-fixes).\n- ALSA: Fix deadlocks with kctl removals at disconnection (stable-fixes).\n- ALSA: hda: Add Intel BMG PCI ID and HDMI codec vid (stable-fixes).\n- ALSA: hda: clarify Copyright information (stable-fixes).\n- ALSA: hda: cs35l41: Add support for ASUS ROG 2024 Laptops (stable-fixes).\n- ALSA: hda: cs35l41: Ignore errors when configuring IRQs (stable-fixes).\n- ALSA: hda: cs35l41: Remove redundant argument to cs35l41_request_firmware_file() (stable-fixes).\n- ALSA: hda: cs35l41: Remove Speaker ID for Lenovo Legion slim 7 16ARHA7 (git-fixes).\n- ALSA: hda: cs35l41: Set the max PCM Gain using tuning setting (stable-fixes).\n- ALSA: hda: cs35l41: Support HP Omen models without _DSD (stable-fixes).\n- ALSA: hda: cs35l41: Support Lenovo 13X laptop without _DSD (stable-fixes).\n- ALSA: hda: cs35l41: Update DSP1RX5/6 Sources for DSP config (stable-fixes).\n- ALSA: hda: cs35l56: Add ACPI device match tables (git-fixes).\n- ALSA: hda: cs35l56: Exit cache-only after cs35l56_wait_for_firmware_boot() (stable-fixes).\n- ALSA: hda: cs35l56: Fix lifetime of cs_dsp instance (git-fixes).\n- ALSA: hda: cs35l56: Set the init_done flag before component_add() (git-fixes).\n- ALSA: hda: hda_cs_dsp_ctl: Remove notification of driver write (stable-fixes).\n- ALSA: hda: intel-dsp-config: harden I2C/I2S codec detection (stable-fixes).\n- ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node() (git-fixes).\n- ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup (git-fixes).\n- ALSA: hda/realtek - Enable audio jacks of Haier Boyue G42 with ALC269VC (stable-fixes).\n- ALSA: hda/realtek - Fix inactive headset mic jack (stable-fixes).\n- ALSA: hda/realtek - fixed headset Mic not show (stable-fixes).\n- ALSA: hda/realtek - Set GPIO3 to default at S4 state for Thinkpad with ALC1318 (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP SnowWhite laptops (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP Spectre x360 14 eu0000 (stable-fixes).\n- ALSA: hda/realtek: Add quirks for ASUS Laptops using CS35L56 (stable-fixes).\n- ALSA: hda/realtek: Add quirks for HP Omen models using CS35L41 (stable-fixes).\n- ALSA: hda/realtek: Add quirks for Huawei Matebook D14 NBLB-WAX9N (stable-fixes).\n- ALSA: hda/realtek: Add quirks for Lenovo 13X (stable-fixes).\n- ALSA: hda/realtek: Add quirks for some Clevo laptops (stable-fixes).\n- ALSA: hda/realtek: Add sound quirks for Lenovo Legion slim 7 16ARHA7 models (stable-fixes).\n- ALSA: hda/realtek: Add support for ASUS Zenbook 2024 HN7306W (stable-fixes).\n- ALSA: hda/realtek: Adjust G814JZR to use SPI init for amp (git-fixes).\n- ALSA: hda/realtek: cs35l41: Support ASUS ROG G634JYR (stable-fixes).\n- ALSA: hda/realtek: Drop doubly quirk entry for 103c:8a2e (git-fixes).\n- ALSA: hda/realtek: Enable headset mic of JP-IK LEAP W502 with ALC897 (stable-fixes).\n- ALSA: hda/realtek: Fix build error without CONFIG_PM (stable-fixes).\n- ALSA: hda/realtek: Fix conflicting PCI SSID 17aa:386f for Lenovo Legion models (bsc#1223462).\n- ALSA: hda/realtek: Fix internal speakers for Legion Y9000X 2022 IAH7 (stable-fixes).\n- ALSA: hda/realtek: Fix mute led of HP Laptop 15-da3001TU (stable-fixes).\n- ALSA: hda/realtek: fix mute/micmute LEDs do not work for ProBook 440/460 G11 (stable-fixes).\n- ALSA: hda/realtek: fix the hp playback volume issue for LG machines (stable-fixes).\n- ALSA: hda/realtek: Fix volumn control of ThinkBook 16P Gen4 (git-fixes).\n- ALSA: hda/realtek: Fixes for Asus GU605M and GA403U sound (stable-fixes).\n- ALSA: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with microphone (git-fixes).\n- ALSA: hda/tas2781: add locks to kcontrols (git-fixes).\n- ALSA: hda/tas2781: Add new vendor_id and subsystem_id to support ThinkPad ICE-1 (stable-fixes).\n- ALSA: hda/tas2781: correct the register for pow calibrated data (git-fixes).\n- ALSA: hda/tas2781: remove digital gain kcontrol (git-fixes).\n- ALSA: line6: Zero-initialize message buffers (stable-fixes).\n- ALSA: scarlett2: Add correct product series name to messages (stable-fixes).\n- ALSA: scarlett2: Add Focusrite Clarett 2Pre and 4Pre USB support (stable-fixes).\n- ALSA: scarlett2: Add Focusrite Clarett+ 2Pre and 4Pre support (stable-fixes).\n- ALSA: scarlett2: Add missing error check to scarlett2_config_save() (git-fixes).\n- ALSA: scarlett2: Add support for Clarett 8Pre USB (stable-fixes).\n- ALSA: scarlett2: Default mixer driver to enabled (stable-fixes).\n- ALSA: scarlett2: Move USB IDs out from device_info struct (stable-fixes).\n- ALSA: seq: Do not clear bank selection at event -\u003e UMP MIDI2 conversion (git-fixes).\n- ALSA: seq: Fix incorrect UMP type for system messages (git-fixes).\n- ALSA: seq: Fix missing bank setup between MIDI1/MIDI2 UMP conversion (git-fixes).\n- ALSA: seq: Fix yet another spot for system message conversion (git-fixes).\n- ALSA: seq: ump: Fix conversion from MIDI2 to MIDI1 UMP messages (git-fixes).\n- ALSA: seq: ump: Fix swapped song position pointer data (git-fixes).\n- ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs (git-fixes).\n- ALSA: timer: Set lower bound of start tick time (stable-fixes).\n- ALSA: ump: Do not accept an invalid UMP protocol number (git-fixes).\n- ALSA: ump: Do not clear bank selection after sending a program change (git-fixes).\n- ALSA: ump: Set default protocol when not given explicitly (git-fixes).\n- ALSA: usb-audio: Add sampling rates support for Mbox3 (stable-fixes).\n- ALSA: usb-audio: Fix for sampling rates support for Mbox3 (stable-fixes).\n- ALSA/hda: intel-dsp-config: reduce log verbosity (git-fixes).\n- amd/amdkfd: sync all devices to wait all processes being evicted (stable-fixes).\n- amdkfd: use calloc instead of kzalloc to avoid integer overflow (stable-fixes).\n- arm_pmu: acpi: Add a representative platform device for TRBE (bsc#1220587)\n- arm_pmu: acpi: Refactor arm_spe_acpi_register_device() (bsc#1220587)\n- ARM: 9381/1: kasan: clear stale stack poison (git-fixes).\n- ARM: imx_v6_v7_defconfig: Restore CONFIG_BACKLIGHT_CLASS_DEVICE (git-fixes).\n- ARM: imx: Check return value of devm_kasprintf in imx_mmdc_perf_init (git-fixes).\n- ARM: OMAP2+: fix N810 MMC gpiod table (git-fixes).\n- ARM: OMAP2+: fix USB regression on Nokia N8x0 (git-fixes).\n- ARM: prctl: reject PR_SET_MDWE on pre-ARMv6 (stable-fixes).\n- ARM: s5pv210: fix pm.c kernel-doc warning (git-fixes).\n- arm64: Add the arm64.no32bit_el0 command line option (jsc#PED-3184).\n- arm64: bpf: fix 32bit unconditional bswap (git-fixes).\n- arm64: dts: allwinner: h616: Fix I2C0 pins (git-fixes)\n- arm64: dts: allwinner: Pine H64: correctly remove reg_gmac_3v3 (git-fixes)\n- arm64: dts: broadcom: bcmbca: bcm4908: drop invalid switch cells (git-fixes)\n- arm64: dts: Fix dtc interrupt_provider warnings (git-fixes)\n- arm64: dts: hi3798cv200: fix the size of GICR (git-fixes)\n- arm64: dts: imx8-ss-conn: fix usb lpcg indices (git-fixes)\n- arm64: dts: imx8-ss-conn: fix usdhc wrong lpcg clock order (git-fixes)\n- arm64: dts: imx8-ss-dma: fix adc lpcg indices (git-fixes)\n- arm64: dts: imx8-ss-dma: fix can lpcg indices (git-fixes)\n- arm64: dts: imx8-ss-dma: fix spi lpcg indices (git-fixes)\n- arm64: dts: imx8-ss-lsio: fix pwm lpcg indices (git-fixes)\n- arm64: dts: imx8qm-ss-dma: fix can lpcg indices (git-fixes)\n- arm64: dts: marvell: reorder crypto interrupts on Armada SoCs (git-fixes)\n- arm64: dts: microchip: sparx5: fix mdio reg (git-fixes)\n- arm64: dts: rockchip: Add enable-strobe-pulldown to emmc phy on ROCK (git-fixes)\n- arm64: dts: rockchip: Add enable-strobe-pulldown to emmc phy on ROCK (git-fixes)\n- arm64: dts: rockchip: enable internal pull-up for Q7_THRM# on RK3399 (git-fixes)\n- arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for (git-fixes)\n- arm64: dts: rockchip: enable internal pull-up on Q7_USB_ID for RK3399 (git-fixes)\n- arm64: dts: rockchip: fix rk3328 hdmi ports node (git-fixes)\n- arm64: dts: rockchip: fix rk3399 hdmi ports node (git-fixes)\n- arm64: dts: rockchip: regulator for sd needs to be always on for (git-fixes)\n- arm64: dts: rockchip: Remove unsupported node from the Pinebook Pro (git-fixes)\n- arm64: dts: rockchip: set PHY address of MT7531 switch to 0x1f (git-fixes)\n- arm64: hibernate: Fix level3 translation fault in swsusp_save() (git-fixes).\n- arm64: tegra: Correct Tegra132 I2C alias (git-fixes)\n- arm64: tegra: Set the correct PHY mode for MGBE (git-fixes)\n- arm64/head: Disable MMU at EL2 before clearing HCR_EL2.E2H (git-fixes).\n- arm64/ptrace: Use saved floating point state type to determine SVE (git-fixes)\n- arm64/sve: Lower the maximum allocation for the SVE ptrace regset (git-fixes)\n- asm-generic: make sparse happy with odd-sized put_unaligned_*() (stable-fixes).\n- ASoC: acp: Support microphone from device Acer 315-24p (git-fixes).\n- ASoC: amd: acp: fix for acp_init function error handling (git-fixes).\n- ASoC: amd: yc: Add Lenovo ThinkBook 21J0 into DMI quirk table (stable-fixes).\n- ASoC: amd: yc: Fix non-functional mic on ASUS M7600RE (stable-fixes).\n- ASoC: amd: yc: Fix non-functional mic on Lenovo 21J2 (stable-fixes).\n- ASoC: amd: yc: Revert 'Fix non-functional mic on Lenovo 21J2' (stable-fixes).\n- ASoC: codecs: wsa881x: set clk_stop_mode1 flag (git-fixes).\n- ASoC: cs35l41: Update DSP1RX5/6 Sources for DSP config (git-fixes).\n- ASoC: cs35l56: Fix unintended bus access while resetting amp (git-fixes).\n- ASoC: cs35l56: Prevent overwriting firmware ASP config (git-fixes).\n- ASoC: da7219-aad: fix usage of device_get_named_child_node() (git-fixes).\n- ASoC: Intel: avs: Fix ASRC module initialization (git-fixes).\n- ASoC: Intel: avs: Fix potential integer overflow (git-fixes).\n- ASoC: Intel: avs: Populate board selection with new I2S entries (stable-fixes).\n- ASoC: Intel: avs: Set name of control as in topology (git-fixes).\n- ASoC: Intel: avs: ssm4567: Do not ignore route checks (git-fixes).\n- ASoC: Intel: avs: Test result of avs_get_module_entry() (git-fixes).\n- ASoC: Intel: bytcr_rt5640: Apply Asus T100TA quirk to Asus T100TAM too (git-fixes).\n- ASoC: Intel: common: DMI remap for rebranded Intel NUC M15 (LAPRC710) laptops (stable-fixes).\n- ASoC: Intel: Disable route checks for Skylake boards (git-fixes).\n- ASoC: kirkwood: Fix potential NULL dereference (git-fixes).\n- ASoC: mediatek: Assign dummy when codec not specified for a DAI link (git-fixes).\n- ASoC: mediatek: mt8192: fix register configuration for tdm (git-fixes).\n- ASoC: meson: axg-card: make links nonatomic (git-fixes).\n- ASoC: meson: axg-fifo: use FIELD helpers (stable-fixes).\n- ASoC: meson: axg-fifo: use threaded irq to check periods (git-fixes).\n- ASoC: meson: axg-tdm-interface: manage formatters in trigger (git-fixes).\n- ASoC: meson: cards: select SND_DYNAMIC_MINORS (git-fixes).\n- ASoC: ops: Fix wraparound for mask in snd_soc_get_volsw (git-fixes).\n- ASoC: rockchip: i2s-tdm: Fix inaccurate sampling rates (git-fixes).\n- ASoC: rt5645: Fix the electric noise due to the CBJ contacts floating (git-fixes).\n- ASoC: rt5645: Make LattePanda board DMI match more precise (stable-fixes).\n- ASoC: rt5682-sdw: fix locking sequence (git-fixes).\n- ASoC: rt711-sdca: fix locking sequence (git-fixes).\n- ASoC: rt711-sdw: fix locking sequence (git-fixes).\n- ASoC: rt712-sdca-sdw: fix locking sequence (git-fixes).\n- ASoC: rt715-sdca: volume step modification (git-fixes).\n- ASoC: rt715: add vendor clear control register (git-fixes).\n- ASoC: rt722-sdca-sdw: fix locking sequence (git-fixes).\n- ASoC: rt722-sdca: add headset microphone vrefo setting (git-fixes).\n- ASoC: rt722-sdca: modify channel number to support 4 channels (git-fixes).\n- ASoC: soc-core.c: Skip dummy codec when adding platforms (stable-fixes).\n- ASoC: SOF: amd: Optimize quirk for Valve Galileo (stable-fixes).\n- ASoC: SOF: Intel: add default firmware library path for LNL (git-fixes).\n- ASoC: SOF: Intel: hda-dsp: Skip IMR boot on ACE platforms in case of S3 suspend (stable-fixes).\n- ASoC: SOF: Intel: lnl: Correct rom_status_reg (git-fixes).\n- ASoC: SOF: Intel: mtl: call dsp dump when boot retry fails (stable-fixes).\n- ASoC: SOF: Intel: mtl: Correct rom_status_reg (git-fixes).\n- ASoC: SOF: Intel: mtl: Disable interrupts when firmware boot failed (git-fixes).\n- ASoC: SOF: Intel: mtl: Implement firmware boot state check (git-fixes).\n- ASoC: SOF: ipc4-pcm: Workaround for crashed firmware on system suspend (stable-fixes).\n- ASoC: SOF: ipc4-topology: Fix input format query of process modules without base extension (git-fixes).\n- ASoC: tas2552: Add TX path for capturing AUDIO-OUT data (git-fixes).\n- ASoC: tas2781: Fix a warning reported by robot kernel test (git-fixes).\n- ASoC: tas2781: Fix wrong loading calibrated data sequence (git-fixes).\n- ASoC: tas2781: mark dvc_tlv with __maybe_unused (git-fixes).\n- ASoC: tegra: Fix DSPK 16-bit playback (git-fixes).\n- ASoC: ti: Convert Pandora ASoC to GPIO descriptors (stable-fixes).\n- ASoC: ti: davinci-mcasp: Fix race condition during probe (git-fixes).\n- ASoC: tlv320adc3xxx: Do not strip remove function when driver is builtin (git-fixes).\n- ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value (git-fixes).\n- ASoC: wm_adsp: Add missing MODULE_DESCRIPTION() (git-fixes).\n- ASoC: wm_adsp: Fix missing mutex_lock in wm_adsp_write_ctl() (git-fixes).\n- ata: libata-core: Allow command duration limits detection for ACS-4 drives (git-fixes).\n- ata: pata_legacy: make legacy_exit() work again (git-fixes).\n- ata: sata_gemini: Check clk_enable() result (stable-fixes).\n- ata: sata_mv: Fix PCI device ID table declaration compilation warning (git-fixes).\n- ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit (git-fixes).\n- autofs: use wake_up() instead of wake_up_interruptible(() (bsc#1224166).\n- ax25: Fix netdev refcount issue (git-fixes).\n- ax25: Fix reference count leak issue of net_device (git-fixes).\n- ax25: Fix reference count leak issues of ax25_dev (git-fixes).\n- ax25: fix use-after-free bugs caused by ax25_ds_del_timer (git-fixes).\n- batman-adv: Avoid infinite loop trying to resize local TT (git-fixes).\n- bitops: add missing prototype check (git-fixes).\n- blk-cgroup: fix list corruption from reorder of WRITE -\u003elqueued (bsc#1225605).\n- blk-cgroup: fix list corruption from resetting io stat (bsc#1225605).\n- block: fix q-\u003eblkg_list corruption during disk rebind (bsc#1223591).\n- Bluetooth: Add new quirk for broken read key length on ATS2851 (stable-fixes).\n- Bluetooth: add quirk for broken address properties (git-fixes).\n- Bluetooth: btintel: Fix null ptr deref in btintel_read_version (stable-fixes).\n- Bluetooth: btintel: Fixe build regression (git-fixes).\n- Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0bda:0x4853 (stable-fixes).\n- Bluetooth: btusb: Fix triggering coredump implementation for QCA (git-fixes).\n- Bluetooth: Fix memory leak in hci_req_sync_complete() (git-fixes).\n- Bluetooth: Fix TOCTOU in HCI debugfs implementation (git-fixes).\n- Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old() (stable-fixes).\n- Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (git-fixes).\n- Bluetooth: hci_core: Cancel request on command timeout (stable-fixes).\n- Bluetooth: hci_event: Fix sending HCI_OP_READ_ENC_KEY_SIZE (git-fixes).\n- Bluetooth: hci_event: set the conn encrypted before conn establishes (stable-fixes).\n- Bluetooth: hci_sock: Fix not validating setsockopt user input (git-fixes).\n- Bluetooth: hci_sync: Fix not checking error on hci_cmd_sync_cancel_sync (git-fixes).\n- Bluetooth: hci_sync: Fix using the same interval and window for Coded PHY (git-fixes).\n- Bluetooth: hci_sync: Use QoS to determine which PHY to scan (stable-fixes).\n- Bluetooth: HCI: Fix potential null-ptr-deref (git-fixes).\n- Bluetooth: ISO: Align broadcast sync_timeout with connection timeout (stable-fixes).\n- Bluetooth: ISO: Do not reject BT_ISO_QOS if parameters are unset (git-fixes).\n- Bluetooth: l2cap: Do not double set the HCI_CONN_MGMT_CONNECTED bit (git-fixes).\n- Bluetooth: L2CAP: Fix not validating setsockopt user input (git-fixes).\n- Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (git-fixes).\n- Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() (git-fixes).\n- Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (bsc#1221504).\n- Bluetooth: mgmt: Fix limited discoverable off timeout (stable-fixes).\n- Bluetooth: msft: fix slab-use-after-free in msft_do_close() (git-fixes).\n- Bluetooth: qca: add missing firmware sanity checks (git-fixes).\n- Bluetooth: qca: fix device-address endianness (git-fixes).\n- Bluetooth: qca: Fix error code in qca_read_fw_build_info() (git-fixes).\n- Bluetooth: qca: fix firmware check error path (git-fixes).\n- Bluetooth: qca: fix info leak when fetching fw build id (git-fixes).\n- Bluetooth: qca: fix NULL-deref on non-serdev setup (git-fixes).\n- Bluetooth: qca: fix NULL-deref on non-serdev suspend (git-fixes).\n- Bluetooth: qca: fix NVM configuration parsing (git-fixes).\n- Bluetooth: RFCOMM: Fix not validating setsockopt user input (git-fixes).\n- Bluetooth: SCO: Fix not validating setsockopt user input (git-fixes).\n- bnx2x: Fix firmware version string character counts (git-fixes).\n- bnxt_en: Fix error recovery for RoCE ulp client (git-fixes).\n- bnxt_en: Fix possible memory leak in bnxt_rdma_aux_device_init() (git-fixes).\n- bnxt_en: Reset PTP tx_avail after possible firmware reset (git-fixes).\n- bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (git-fixes)\n- bootconfig: Fix the kerneldoc of _xbc_exit() (git-fixes).\n- bootconfig: use memblock_free_late to free xbc memory to buddy (git-fixes).\n- bootmem: use kmemleak_free_part_phys in free_bootmem_page (git-fixes).\n- bootmem: use kmemleak_free_part_phys in put_page_bootmem (git-fixes).\n- bpf, arm64: fix bug in BPF_LDX_MEMSX (git-fixes)\n- bpf, arm64: Fix incorrect runtime stats (git-fixes)\n- bpf, scripts: Correct GPL license name (git-fixes).\n- bpf: fix precision backtracking instruction iteration (bsc#1225756).\n- bpf: Fix precision tracking for BPF_ALU | BPF_TO_BE | BPF_END (git-fixes).\n- bpf: handle ldimm64 properly in check_cfg() (bsc#1225756).\n- btrfs: add a helper to read the superblock metadata_uuid (git-fixes)\n- btrfs: add and use helper to check if block group is used (bsc#1220120).\n- btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks() (git-fixes)\n- btrfs: add new unused block groups to the list of unused block groups (bsc#1220120).\n- btrfs: allow to run delayed refs by bytes to be released instead of count (bsc#1220120).\n- btrfs: always clear PERTRANS metadata during commit (git-fixes)\n- btrfs: always print transaction aborted messages with an error level (git-fixes)\n- btrfs: always reserve space for delayed refs when starting transaction (bsc#1220120).\n- btrfs: assert correct lock is held at btrfs_select_ref_head() (bsc#1220120).\n- btrfs: assert delayed node locked when removing delayed item (git-fixes)\n- btrfs: avoid start and commit empty transaction when flushing qgroups (bsc#1220120).\n- btrfs: avoid start and commit empty transaction when starting qgroup rescan (bsc#1220120).\n- btrfs: avoid starting and committing empty transaction when flushing space (bsc#1220120).\n- btrfs: avoid starting new transaction when flushing delayed items and refs (bsc#1220120).\n- btrfs: check for BTRFS_FS_ERROR in pending ordered assert (git-fixes)\n- btrfs: compare the correct fsid/metadata_uuid in btrfs_validate_super (git-fixes)\n- btrfs: defrag: avoid unnecessary defrag caused by incorrect extent size (git-fixes)\n- btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args (git-fixes)\n- btrfs: do not allow non subvolume root targets for snapshot (git-fixes)\n- btrfs: do not arbitrarily slow down delalloc if we're committing (git-fixes)\n- btrfs: do not delete unused block group if it may be used soon (bsc#1220120).\n- btrfs: do not refill whole delayed refs block reserve when starting transaction (bsc#1220120).\n- btrfs: do not start transaction when joining with TRANS_JOIN_NOSTART (git-fixes)\n- btrfs: do not steal space from global rsv after a transaction abort (bsc#1220120).\n- btrfs: do not warn if discard range is not aligned to sector (git-fixes)\n- btrfs: ensure fiemap does not race with writes when FIEMAP_FLAG_SYNC is given (bsc#1223285).\n- btrfs: error out when COWing block using a stale transaction (git-fixes)\n- btrfs: error out when reallocating block for defrag using a stale transaction (git-fixes)\n- btrfs: error when COWing block from a root that is being deleted (git-fixes)\n- btrfs: export: handle invalid inode or root reference in btrfs_get_parent() (git-fixes)\n- btrfs: fail priority metadata ticket with real fs error (bsc#1220120).\n- btrfs: file_remove_privs needs an exclusive lock in direct io write (git-fixes)\n- btrfs: fix 64bit compat send ioctl arguments not initializing version member (git-fixes)\n- btrfs: fix deadlock with fiemap and extent locking (bsc#1223285).\n- btrfs: fix information leak in btrfs_ioctl_logical_to_ino() (git-fixes)\n- btrfs: fix kvcalloc() arguments order in btrfs_ioctl_send() (git-fixes)\n- btrfs: fix lockdep splat and potential deadlock after failure running delayed items (git-fixes)\n- btrfs: fix off-by-one chunk length calculation at contains_pending_extent() (git-fixes)\n- btrfs: fix off-by-one when checking chunk map includes logical address (git-fixes)\n- btrfs: fix race between ordered extent completion and fiemap (bsc#1223285).\n- btrfs: fix race when detecting delalloc ranges during fiemap (bsc#1223285).\n- btrfs: fix race when refilling delayed refs block reserve (git-fixes)\n- btrfs: fix start transaction qgroup rsv double free (git-fixes)\n- btrfs: fix stripe length calculation for non-zoned data chunk allocation (bsc#1217489).\n- btrfs: fix wrong block_start calculation for btrfs_drop_extent_map_range() (git-fixes) Dropped hunk in selftests (test_case_7), 92e1229b204d6.\n- btrfs: free qgroup rsv on io failure (git-fixes)\n- btrfs: free the allocated memory if btrfs_alloc_page_array() fails (git-fixes)\n- btrfs: get rid of label and goto at insert_delayed_ref() (bsc#1220120).\n- btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() (git-fixes)\n- btrfs: handle errors properly in update_inline_extent_backref() (git-fixes)\n- btrfs: initialize key where it's used when running delayed data ref (bsc#1220120).\n- btrfs: log message if extent item not found when running delayed extent op (bsc#1220120).\n- btrfs: make btrfs_cleanup_fs_roots() static (bsc#1220120).\n- btrfs: make btrfs_destroy_delayed_refs() return void (bsc#1220120).\n- btrfs: make btrfs_destroy_marked_extents() return void (bsc#1220120).\n- btrfs: make btrfs_destroy_pinned_extent() return void (bsc#1220120).\n- btrfs: make error messages more clear when getting a chunk map (git-fixes)\n- btrfs: make find_first_extent_bit() return a boolean (bsc#1220120).\n- btrfs: make find_free_dev_extent() static (bsc#1220120).\n- btrfs: make insert_delayed_ref() return a bool instead of an int (bsc#1220120).\n- btrfs: merge find_free_dev_extent() and find_free_dev_extent_start() (bsc#1220120).\n- btrfs: move btrfs_free_excluded_extents() into block-group.c (bsc#1220120).\n- btrfs: open code trivial btrfs_add_excluded_extent() (bsc#1220120).\n- btrfs: output extra debug info if we failed to find an inline backref (git-fixes)\n- btrfs: pass a space_info argument to btrfs_reserve_metadata_bytes() (bsc#1220120).\n- btrfs: prevent transaction block reserve underflow when starting transaction (git-fixes)\n- btrfs: print available space across all block groups when dumping space info (bsc#1220120).\n- btrfs: print available space for a block group when dumping a space info (bsc#1220120).\n- btrfs: print block group super and delalloc bytes when dumping space info (bsc#1220120).\n- btrfs: print target number of bytes when dumping free space (bsc#1220120).\n- btrfs: qgroup: always free reserved space for extent records (bsc#1216196).\n- btrfs: qgroup: convert PREALLOC to PERTRANS after record_root_in_trans (git-fixes)\n- btrfs: record delayed inode root in transaction (git-fixes)\n- btrfs: reject encoded write if inode has nodatasum flag set (git-fixes)\n- btrfs: release path before inode lookup during the ino lookup ioctl (git-fixes)\n- btrfs: remove pointless 'ref_root' variable from run_delayed_data_ref() (bsc#1220120).\n- btrfs: remove pointless in_tree field from struct btrfs_delayed_ref_node (bsc#1220120).\n- btrfs: remove pointless initialization at btrfs_delayed_refs_rsv_release() (bsc#1220120).\n- btrfs: remove redundant BUG_ON() from __btrfs_inc_extent_ref() (bsc#1220120).\n- btrfs: remove refs_to_add argument from __btrfs_inc_extent_ref() (bsc#1220120).\n- btrfs: remove refs_to_drop argument from __btrfs_free_extent() (bsc#1220120).\n- btrfs: remove the refcount warning/check at btrfs_put_delayed_ref() (bsc#1220120).\n- btrfs: remove unnecessary logic when running new delayed references (bsc#1220120).\n- btrfs: remove unnecessary prototype declarations at disk-io.c (bsc#1220120).\n- btrfs: remove unused is_head field from struct btrfs_delayed_ref_node (bsc#1220120).\n- btrfs: rename add_new_free_space() to btrfs_add_new_free_space() (bsc#1220120).\n- btrfs: reorder some members of struct btrfs_delayed_ref_head (bsc#1220120).\n- btrfs: reserve space for delayed refs on a per ref basis (bsc#1220120).\n- btrfs: reset destination buffer when read_extent_buffer() gets invalid range (git-fixes)\n- btrfs: return -EUCLEAN for delayed tree ref with a ref count not equals to 1 (git-fixes)\n- btrfs: return -EUCLEAN if extent item is missing when searching inline backref (bsc#1220120).\n- btrfs: return real error when orphan cleanup fails due to a transaction abort (bsc#1220120).\n- btrfs: send: do not issue unnecessary zero writes for trailing hole (bsc#1222459).\n- btrfs: send: ensure send_fd is writable (git-fixes)\n- btrfs: send: handle path ref underflow in header iterate_inode_ref() (git-fixes)\n- btrfs: send: return EOPNOTSUPP on unknown flags (git-fixes)\n- btrfs: set page extent mapped after read_folio in relocate_one_page (git-fixes)\n- btrfs: simplify check for extent item overrun at lookup_inline_extent_backref() (bsc#1220120).\n- btrfs: stop doing excessive space reservation for csum deletion (bsc#1220120).\n- btrfs: store the error that turned the fs into error state (bsc#1220120).\n- btrfs: sysfs: validate scrub_speed_max value (git-fixes)\n- btrfs: tree-checker: fix inline ref size in error messages (git-fixes)\n- btrfs: update comment for btrfs_join_transaction_nostart() (bsc#1220120).\n- btrfs: update documentation for add_new_free_space() (bsc#1220120).\n- btrfs: use a bool to track qgroup record insertion when adding ref head (bsc#1220120).\n- btrfs: use a single switch statement when initializing delayed ref head (bsc#1220120).\n- btrfs: use a single variable for return value at lookup_inline_extent_backref() (bsc#1220120).\n- btrfs: use a single variable for return value at run_delayed_extent_op() (bsc#1220120).\n- btrfs: use bool type for delayed ref head fields that are used as booleans (bsc#1220120).\n- btrfs: use the correct superblock to compare fsid in btrfs_validate_super (git-fixes)\n- btrfs: use u64 for buffer sizes in the tree search ioctls (git-fixes)\n- btrfs: zoned: do not skip block groups with 100% zone unusable (bsc#1220120).\n- bus: mhi: ep: check the correct variable in mhi_ep_register_controller() (git-fixes).\n- ceph: redirty page before returning AOP_WRITEPAGE_ACTIVATE (bsc#1224866).\n- ceph: stop copying to iter at EOF on sync reads (bsc#1222606).\n- certs: Add ECDSA signature verification self-test (bsc#1222777).\n- certs: Move RSA self-test data to separate file (bsc#1222777).\n- clk: Do not hold prepare_lock when calling kref_put() (stable-fixes).\n- clk: Get runtime PM before walking tree during disable_unused (git-fixes).\n- clk: Get runtime PM before walking tree for clk_summary (git-fixes).\n- clk: Initialize struct clk_core kref earlier (stable-fixes).\n- clk: mediatek: Do a runtime PM get on controllers during probe (git-fixes).\n- clk: mediatek: mt8365-mm: fix DPI0 parent (git-fixes).\n- clk: mediatek: pllfh: Do not log error for missing fhctl node (git-fixes).\n- clk: qcom: clk-alpha-pll: fix rate setting for Stromer PLLs (git-fixes).\n- clk: qcom: clk-alpha-pll: remove invalid Stromer register offset (git-fixes).\n- clk: qcom: dispcc-sm6350: fix DisplayPort clocks (git-fixes).\n- clk: qcom: dispcc-sm8450: fix DisplayPort clocks (git-fixes).\n- clk: qcom: dispcc-sm8550: fix DisplayPort clocks (git-fixes).\n- clk: qcom: mmcc-msm8998: fix venus clock issue (git-fixes).\n- clk: qcom: reset: Commonize the de/assert functions (stable-fixes).\n- clk: qcom: reset: Ensure write completion on reset de/assertion (git-fixes).\n- clk: Remove prepare_lock hold assertion in __clk_release() (git-fixes).\n- clk: renesas: r8a779a0: Fix CANFD parent clock (git-fixes).\n- clk: renesas: r9a07g043: Add clock and reset entry for PLIC (git-fixes).\n- clk: rs9: fix wrong default value for clock amplitude (git-fixes).\n- clk: samsung: exynosautov9: fix wrong pll clock id value (git-fixes).\n- clk: Show active consumers of clocks in debugfs (stable-fixes).\n- clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change (git-fixes).\n- clocksource/drivers/arm_global_timer: Fix maximum prescaler value (git-fixes).\n- clocksource/drivers/imx: Fix -Wunused-but-set-variable warning (git-fixes).\n- comedi: vmk80xx: fix incomplete endpoint checking (git-fixes).\n- coresight: trbe: Add a representative coresight_platform_data for (bsc#1220587)\n- coresight: trbe: Allocate platform data per device (bsc#1220587)\n- coresight: trbe: Enable ACPI based TRBE devices (bsc#1220587)\n- counter: linux/counter.h: fix Excess kernel-doc description warning (git-fixes).\n- cppc_cpufreq: Fix possible null pointer dereference (git-fixes).\n- cpufreq: brcmstb-avs-cpufreq: ISO C90 forbids mixed declarations (git-fixes).\n- cpufreq: exit() callback is optional (git-fixes).\n- cpumask: Add for_each_cpu_from() (bsc#1225053).\n- crypto: bcm - Fix pointer arithmetic (git-fixes).\n- crypto: ccp - Add support for PCI device 0x156E (bsc#1223338).\n- crypto: ccp - Add support for PCI device 0x17E0 (bsc#1223338).\n- crypto: ccp - drop platform ifdef checks (git-fixes).\n- crypto: ecc - update ecc_gen_privkey for FIPS 186-5 (bsc#1222782).\n- crypto: ecdsa - Fix module auto-load on add-key (git-fixes).\n- crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init (git-fixes).\n- crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak (git-fixes).\n- crypto: qat - fix ring to service map for dcc in 4xxx (git-fixes).\n- crypto: qat - improve error logging to be consistent across features (git-fixes).\n- crypto: qat - relocate and rename get_service_enabled() (stable-fixes).\n- crypto: qat - specify firmware files for 402xx (git-fixes).\n- crypto: rsa - add a check for allocation failure (bsc#1222775).\n- crypto: rsa - allow only odd e and restrict value in FIPS mode (bsc#1222775).\n- crypto: testmgr - remove unused xts4096 and xts512 algorithms from testmgr.c (bsc#1222769).\n- crypto: x86/nh-avx2 - add missing vzeroupper (git-fixes).\n- crypto: x86/sha256-avx2 - add missing vzeroupper (git-fixes).\n- crypto: x86/sha512-avx2 - add missing vzeroupper (git-fixes).\n- cxl/acpi: Fix load failures due to single window creation failure (git-fixes).\n- cxl/pci: Fix disabling memory if DVSEC CXL Range does not match a CFMWS window (git-fixes).\n- cxl/trace: Properly initialize cxl_poison region name (git-fixes).\n- dax: alloc_dax() return ERR_PTR(-EOPNOTSUPP) for CONFIG_DAX=n (jsc#PED-5853).\n- dax/bus.c: replace driver-core lock usage by a local rwsem (jsc#PED-5853).\n- dax/bus.c: replace several sprintf() with sysfs_emit() (jsc#PED-5853).\n- device-dax: make dax_bus_type const (jsc#PED-5853).\n- dlm: fix user space lkb refcounting (git-fixes).\n- dm crypt: remove redundant state settings after waking up (jsc#PED-7542).\n- dm thin: add braces around conditional code that spans lines (jsc#PED-7542).\n- dm verity: set DM_TARGET_SINGLETON feature flag (jsc#PED-7542).\n- dm-integrity: set max_integrity_segments in dm_integrity_io_hints (jsc#PED-7542).\n- dm-multipath: dont't attempt SG_IO on non-SCSI-disks (bsc#1223575).\n- dm-raid: add a new helper prepare_suspend() in md_personality (jsc#PED-7542).\n- dm-raid: really frozen sync_thread during suspend (jsc#PED-7542).\n- dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape (bsc#1219596)\n- dm: update relevant MODULE_AUTHOR entries to latest dm-devel mailing list (jsc#PED-7542).\n- dm/amd/pm: Fix problems with reboot/shutdown for some SMU 13.0.4/13.0.11 users (git-fixes).\n- dma-buf: Fix NULL pointer dereference in sanitycheck() (git-fixes).\n- dma-buf/sw-sync: do not enable IRQ from sync_print_obj() (git-fixes).\n- dma-mapping: benchmark: fix node id validation (git-fixes).\n- dma-mapping: benchmark: handle NUMA_NO_NODE correctly (git-fixes).\n- dma: xilinx_dpdma: Fix locking (git-fixes).\n- dmaengine: axi-dmac: fix possible race in remove() (git-fixes).\n- dmaengine: idma64: Add check for dma_set_max_seg_size (git-fixes).\n- dmaengine: idxd: Avoid unnecessary destruction of file_ida (git-fixes).\n- dmaengine: idxd: Fix oops during rmmod on single-CPU platforms (git-fixes).\n- dmaengine: owl: fix register access functions (git-fixes).\n- dmaengine: tegra186: Fix residual calculation (git-fixes).\n- driver core: Introduce device_link_wait_removal() (stable-fixes).\n- drivers/nvme: Add quirks for device 126f:2262 (git-fixes).\n- drm: add drm_gem_object_is_shared_for_memory_stats() helper (stable-fixes).\n- drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference (git-fixes).\n- drm: Check output polling initialized before disabling (stable-fixes).\n- drm: Check polling initialized before enabling in drm_helper_probe_single_connector_modes (stable-fixes).\n- drm: Fix drm_fixp2int_round() making it add 0.5 (git-fixes).\n- drm: nv04: Fix out of bounds access (git-fixes).\n- drm: panel-orientation-quirks: Add quirk for GPD Win Mini (stable-fixes).\n- drm: vc4: Fix possible null pointer dereference (git-fixes).\n- drm: zynqmp_dpsub: Always register bridge (git-fixes).\n- drm/amd: Flush GFXOFF requests in prepare stage (git-fixes).\n- drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init() (stable-fixes).\n- drm/amd/display: Add dml2 copy functions (stable-fixes).\n- drm/amd/display: Allow dirty rects to be sent to dmub when abm is active (stable-fixes).\n- drm/amd/display: Atom Integrated System Info v2_2 for DCN35 (stable-fixes).\n- drm/amd/display: Change default size for dummy plane in DML2 (stable-fixes).\n- drm/amd/display: Do not recursively call manual trigger programming (stable-fixes).\n- drm/amd/display: Enable colorspace property for MST connectors (git-fixes).\n- drm/amd/display: Fix bounds check for dcn35 DcfClocks (git-fixes).\n- drm/amd/display: fix disable otg wa logic in DCN316 (stable-fixes).\n- drm/amd/display: Fix division by zero in setup_dsc_config (stable-fixes).\n- drm/amd/display: Fix idle check for shared firmware state (stable-fixes).\n- drm/amd/display: Fix incorrect DSC instance for MST (stable-fixes).\n- drm/amd/display: fix input states translation error for dcn35 \u0026 dcn351 (stable-fixes).\n- drm/amd/display: Fix nanosec stat overflow (stable-fixes).\n- drm/amd/display: Fix noise issue on HDMI AV mute (stable-fixes).\n- drm/amd/display: Fix potential index out of bounds in color transformation function (git-fixes).\n- drm/amd/display: handle range offsets in VRR ranges (stable-fixes).\n- drm/amd/display: Handle Y carry-over in VCP X.Y calculation (stable-fixes).\n- drm/amd/display: Init DPPCLK from SMU on dcn32 (stable-fixes).\n- drm/amd/display: Override min required DCFCLK in dml1_validate (stable-fixes).\n- drm/amd/display: Prevent crash when disable stream (stable-fixes).\n- drm/amd/display: Program VSC SDP colorimetry for all DP sinks \u003e= 1.4 (stable-fixes).\n- drm/amd/display: Remove MPC rate control logic from DCN30 and above (stable-fixes).\n- drm/amd/display: Remove redundant condition in dcn35_calc_blocks_to_gate() (git-fixes).\n- drm/amd/display: Return the correct HDCP error code (stable-fixes).\n- drm/amd/display: Send DTBCLK disable message on first commit (git-fixes).\n- drm/amd/display: Set DCN351 BB and IP the same as DCN35 (stable-fixes).\n- drm/amd/display: Set VSC SDP Colorimetry same way for MST and SST (stable-fixes).\n- drm/amd/display: Update odm when ODM combine is changed on an otg master pipe with no plane (stable-fixes).\n- drm/amd/display: Use freesync when `DRM_EDID_FEATURE_CONTINUOUS_FREQ` found (stable-fixes).\n- drm/amd/pm: fixes a random hang in S4 for SMU v13.0.4/11 (stable-fixes).\n- drm/amd/swsmu: modify the gfx activity scaling (stable-fixes).\n- drm/amdgpu: always force full reset for SOC21 (stable-fixes).\n- drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag (stable-fixes).\n- drm/amdgpu: Assign correct bits for SDMA HDP flush (stable-fixes).\n- drm/amdgpu: drop setting buffer funcs in sdma442 (git-fixes).\n- drm/amdgpu: Enable gpu reset for S3 abort cases on Raven series (stable-fixes).\n- drm/amdgpu: Fix comparison in amdgpu_res_cpu_visible (git-fixes).\n- drm/amdgpu: fix deadlock while reading mqd from debugfs (git-fixes).\n- drm/amdgpu: fix doorbell regression (git-fixes).\n- drm/amdgpu: fix incorrect number of active RBs for gfx11 (stable-fixes).\n- drm/amdgpu: Fix leak when GPU memory allocation fails (stable-fixes).\n- drm/amdgpu: fix mmhub client id out-of-bounds access (git-fixes).\n- drm/amdgpu: fix use-after-free bug (stable-fixes).\n- drm/amdgpu: Fix VCN allocation in CPX partition (stable-fixes).\n- drm/amdgpu: fix visible VRAM handling during faults (git-fixes).\n- drm/amdgpu: implement IRQ_STATE_ENABLE for SDMA v4.4.2 (stable-fixes).\n- drm/amdgpu: make damage clips support configurable (stable-fixes).\n- drm/amdgpu: once more fix the call oder in amdgpu_ttm_move() v2 (git-fixes).\n- drm/amdgpu: Refine IB schedule error logging (stable-fixes).\n- drm/amdgpu: remove invalid resource-\u003estart check v2 (git-fixes).\n- drm/amdgpu: Reset dGPU if suspend got aborted (stable-fixes).\n- drm/amdgpu: validate the parameters of bo mapping operations more clearly (git-fixes).\n- drm/amdgpu/display: Address kdoc for 'is_psr_su' in 'fill_dc_dirty_rects' (git-fixes).\n- drm/amdgpu/pm: Check the validity of overdiver power limit (git-fixes).\n- drm/amdgpu/pm: Fix NULL pointer dereference when get power limit (git-fixes).\n- drm/amdgpu/pm: Fix the error of pwm1_enable setting (stable-fixes).\n- drm/amdgpu/sdma5.2: use legacy HDP flush for SDMA2/3 (stable-fixes).\n- drm/amdkfd: Check cgroup when returning DMABuf info (stable-fixes).\n- drm/amdkfd: do not allow mapping the MMIO HDP page with large pages (git-fixes).\n- drm/amdkfd: Fix memory leak in create_process failure (git-fixes).\n- drm/amdkfd: fix TLB flush after unmap for GFX9.4.2 (stable-fixes).\n- drm/amdkfd: range check cp bad op exception interrupts (stable-fixes).\n- drm/amdkfd: Reset GPU on queue preemption failure (stable-fixes).\n- drm/arm/malidp: fix a possible null pointer dereference (git-fixes).\n- drm/ast: Fix soft lockup (git-fixes).\n- drm/bridge: anx7625: Do not log an error when DSI host can't be found (git-fixes).\n- drm/bridge: anx7625: Update audio status while detecting (git-fixes).\n- drm/bridge: dpc3433: Do not log an error when DSI host can't be found (git-fixes).\n- drm/bridge: Fix improper bridge init order with pre_enable_prev_first (git-fixes).\n- drm/bridge: icn6211: Do not log an error when DSI host can't be found (git-fixes).\n- drm/bridge: lt8912b: Do not log an error when DSI host can't be found (git-fixes).\n- drm/bridge: lt9611: Do not log an error when DSI host can't be found (git-fixes).\n- drm/bridge: lt9611uxc: Do not log an error when DSI host can't be found (git-fixes).\n- drm/bridge: tc358775: Do not log an error when DSI host can't be found (git-fixes).\n- drm/bridge: tc358775: fix support for jeida-18 and jeida-24 (git-fixes).\n- drm/buddy: check range allocation matches alignment (stable-fixes).\n- drm/ci: update device type for volteer devices (git-fixes).\n- drm/client: Fully protect modes[] with dev-\u003emode_config.mutex (stable-fixes).\n- drm/connector: Add \\n to message about demoting connector force-probes (git-fixes).\n- drm/display: fix typo (git-fixes).\n- drm/exynos: do not return negative values from .get_modes() (stable-fixes).\n- drm/fbdev-generic: Do not set physical framebuffer address (git-fixes).\n- drm/gma500: Remove lid code (git-fixes).\n- drm/i915: Disable live M/N updates when using bigjoiner (stable-fixes).\n- drm/i915: Disable port sync when bigjoiner is used (stable-fixes).\n- drm/i915: Do not match JSL in ehl_combo_pll_div_frac_wa_needed() (git-fixes).\n- drm/i915: Fix audio component initialization (git-fixes).\n- drm/i915: Include the PLL name in the debug messages (stable-fixes).\n- drm/i915: Pre-populate the cursor physical dma address (git-fixes).\n- drm/i915: Replace a memset() with zero initialization (stable-fixes).\n- drm/i915: Stop printing pipe name as hex (stable-fixes).\n- drm/i915: Suppress old PLL pipe_mask checks for MG/TC/TBT PLLs (stable-fixes).\n- drm/i915: Try to preserve the current shared_dpll for fastset on type-c ports (stable-fixes).\n- drm/i915: Use named initializers for DPLL info (stable-fixes).\n- drm/i915/audio: Fix audio time stamp programming for DP (stable-fixes).\n- drm/i915/bios: Fix parsing backlight BDB data (git-fixes).\n- drm/i915/bios: Tolerate devdata==NULL in intel_bios_encoder_supports_dp_dual_mode() (stable-fixes).\n- drm/i915/cdclk: Fix CDCLK programming order when pipes are active (git-fixes).\n- drm/i915/display: Use i915_gem_object_get_dma_address to get dma address (stable-fixes).\n- drm/i915/dp: Fix the computation for compressed_bpp for DISPLAY \u0026lt; 13 (git-fixes).\n- drm/i915/dp: Remove support for UHBR13.5 (git-fixes).\n- drm/i915/dpt: Make DPT object unshrinkable (git-fixes).\n- drm/i915/dsb: Fix DSB vblank waits when using VRR (git-fixes).\n- drm/i915/dsi: Go back to the previous INIT_OTP/DISPLAY_ON order, mostly (git-fixes).\n- drm/i915/gt: Automate CCS Mode setting during engine resets (git-fixes).\n- drm/i915/gt: Disable HW load balancing for CCS (git-fixes).\n- drm/i915/gt: Disarm breadcrumbs if engines are already idle (git-fixes).\n- drm/i915/gt: Do not generate the command streamer for all the CCS (git-fixes).\n- drm/i915/gt: Enable only one CCS for compute workload (git-fixes).\n- drm/i915/gt: Fix CCS id's calculation for CCS mode setting (git-fixes).\n- drm/i915/gt: Reset queue_priority_hint on parking (git-fixes).\n- drm/i915/guc: avoid FIELD_PREP warning (git-fixes).\n- drm/i915/hwmon: Fix locking inversion in sysfs getter (git-fixes).\n- drm/i915/lspcon: Separate function to set expected mode (bsc#1193599).\n- drm/i915/lspcon: Separate lspcon probe and lspcon init (bsc#1193599).\n- drm/i915/mst: Limit MST+DSC to TGL+ (git-fixes).\n- drm/i915/mst: Reject FEC+MST on ICL (git-fixes).\n- drm/i915/mtl: Update workaround 14018575942 (git-fixes).\n- drm/i915/vrr: Disable VRR when using bigjoiner (stable-fixes).\n- drm/i915/vrr: Generate VRR 'safe window' for DSB (git-fixes).\n- drm/imx/ipuv3: do not return negative values from .get_modes() (stable-fixes).\n- drm/lcdif: Do not disable clocks on already suspended hardware (git-fixes).\n- drm/mediatek: Add 0 size check to mtk_drm_gem_obj (git-fixes).\n- drm/mediatek: dp: Fix mtk_dp_aux_transfer return value (git-fixes).\n- drm/mediatek: Init `ddp_comp` with devm_kcalloc() (git-fixes).\n- drm/meson: dw-hdmi: add bandgap setting for g12 (git-fixes).\n- drm/meson: dw-hdmi: power up phy on device init (git-fixes).\n- drm/meson: gate px_clk when setting rate (git-fixes).\n- drm/meson: vclk: fix calculation of 59.94 fractional rates (git-fixes).\n- drm/msm: Add newlines to some debug prints (git-fixes).\n- drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails (git-fixes).\n- drm/msm/adreno: fix CP cycles stat retrieval on a7xx (git-fixes).\n- drm/msm/dp: allow voltage swing / pre emphasis of 3 (git-fixes).\n- drm/msm/dp: Avoid a long timeout for AUX transfer if nothing connected (git-fixes).\n- drm/msm/dp: fix typo in dp_display_handle_port_status_changed() (git-fixes).\n- drm/msm/dpu: Add callback function pointer check before its call (git-fixes).\n- drm/msm/dpu: Allow configuring multiple active DSC blocks (git-fixes).\n- drm/msm/dpu: Always flush the slave INTF on the CTL (git-fixes).\n- drm/msm/dpu: do not allow overriding data from catalog (git-fixes).\n- drm/msm/dpu: make error messages at dpu_core_irq_register_callback() more sensible (git-fixes).\n- drm/msm/dpu: use devres-managed allocation for MDP TOP (stable-fixes).\n- drm/msm/dsi: Print dual-DSI-adjusted pclk instead of original mode pclk (git-fixes).\n- drm/nouveau: use tile_mode and pte_kind for VM_BIND bo allocations (git-fixes).\n- drm/nouveau/disp: Fix missing backlight control on Macbook 5, 1 (bsc#1223838).\n- drm/nouveau/dp: Do not probe eDP ports twice harder (stable-fixes).\n- drm/nouveau/dp: Fix incorrect return code in r535_dp_aux_xfer() (git-fixes).\n- drm/nouveau/firmware: Fix SG_DEBUG error with nvkm_firmware_ctor() (stable-fixes).\n- drm/omapdrm: Fix console by implementing fb_dirty (git-fixes).\n- drm/panel: do not return negative error codes from drm_panel_get_modes() (stable-fixes).\n- drm/panel: ili9341: Respect deferred probe (git-fixes).\n- drm/panel: ili9341: Use predefined error codes (git-fixes).\n- drm/panel: ltk050h3146w: add MIPI_DSI_MODE_VIDEO to LTK050H3148W flags (git-fixes).\n- drm/panel: ltk050h3146w: drop duplicate commands from LTK050H3148W init (git-fixes).\n- drm/panel: novatek-nt35950: Do not log an error when DSI host can't be found (git-fixes).\n- drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector (git-fixes).\n- drm/panel: sitronix-st7789v: fix display size for jt240mhqs_hwt_ek_e3 panel (git-fixes).\n- drm/panel: sitronix-st7789v: fix timing for jt240mhqs_hwt_ek_e3 panel (git-fixes).\n- drm/panel: sitronix-st7789v: tweak timing for jt240mhqs_hwt_ek_e3 panel (git-fixes).\n- drm/panel: visionox-rm69299: do not unregister DSI device (git-fixes).\n- drm/panfrost: fix power transition timeout warnings (git-fixes).\n- drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr() (git-fixes).\n- drm/prime: Unbreak virtgpu dma-buf export (git-fixes).\n- drm/probe-helper: warn about negative .get_modes() (stable-fixes).\n- drm/qxl: remove unused `count` variable from `qxl_surface_id_alloc()` (git-fixes).\n- drm/qxl: remove unused variable from `qxl_process_single_command()` (git-fixes).\n- drm/radeon: make -fstrict-flex-arrays=3 happy (git-fixes).\n- drm/radeon: silence UBSAN warning (v3) (stable-fixes).\n- drm/rockchip: vop2: Do not divide height twice for YUV (git-fixes).\n- drm/rockchip: vop2: Remove AR30 and AB30 format support (git-fixes).\n- drm/sched: fix null-ptr-deref in init entity (git-fixes).\n- drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE) (git-fixes).\n- drm/ttm: return ENOSPC from ttm_bo_mem_space v3 (stable-fixes).\n- drm/ttm: stop pooling cached NUMA pages v2 (git-fixes).\n- drm/vc4: do not check if plane-\u003estate-\u003efb == state-\u003efb (stable-fixes).\n- drm/vc4: hdmi: do not return negative values from .get_modes() (stable-fixes).\n- drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed (git-fixes).\n- drm/vmwgfx: Enable DMA mappings with SEV (git-fixes).\n- drm/vmwgfx: Fix crtc's atomic check conditional (git-fixes).\n- drm/vmwgfx: Fix invalid reads in fence signaled events (git-fixes).\n- drm/vmwgfx: Fix Legacy Display Unit (git-fixes).\n- drm/vmwgfx: Fix prime import/export (git-fixes).\n- drm/vmwgfx: Sort primary plane formats by order of preference (git-fixes).\n- dt-bindings: clock: qcom: Add missing UFS QREF clocks (git-fixes)\n- dump_stack: Do not get cpu_sync for panic CPU (bsc#1225607).\n- dyndbg: fix old BUG_ON in \u003econtrol parser (stable-fixes).\n- e1000e: Minor flow correction in e1000_shutdown function (git-fixes).\n- e1000e: move force SMBUS from enable ulp function to avoid PHY loss issue (git-fixes).\n- e1000e: Workaround for sporadic MDI error on Meteor Lake systems (git-fixes).\n- ecryptfs: Fix buffer size for tag 66 packet (git-fixes)\n- ecryptfs: Reject casefold directory inodes (git-fixes)\n- EDAC/synopsys: Fix ECC status and IRQ control race condition (git-fixes).\n- efi: disable mirror feature during crashkernel (stable-fixes).\n- efi: fix panic in kdump kernel (git-fixes).\n- efi: libstub: only free priv.runtime_map when allocated (git-fixes).\n- efi/unaccepted: do not let /proc/vmcore try to access unaccepted memory (git-fixes).\n- efi/unaccepted: touch soft lockup during memory accept (git-fixes).\n- extcon: max8997: select IRQ_DOMAIN instead of depending on it (git-fixes).\n- fast_dput(): handle underflows gracefully (git-fixes)\n- fat: fix uninitialized field in nostale filehandles (git-fixes)\n- fbdev: fix incorrect address computation in deferred IO (git-fixes).\n- fbdev: savage: Handle err return when savagefb_check_var failed (git-fixes).\n- fbdev: sh7760fb: allow modular build (git-fixes).\n- fbdev: shmobile: fix snprintf truncation (git-fixes).\n- fbdev: sisfb: hide unused variables (git-fixes).\n- fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2 (stable-fixes).\n- fbmon: prevent division by zero in fb_videomode_from_videomode() (stable-fixes).\n- firewire: core: use long bus reset on gap count error (stable-fixes).\n- firewire: ohci: mask bus reset interrupts between ISR and bottom half (stable-fixes).\n- firmware: arm_scmi: Make raw debugfs entries non-seekable (git-fixes).\n- firmware: dmi-id: add a release callback function (git-fixes).\n- firmware: raspberrypi: Use correct device for DMA mappings (git-fixes).\n- firmware: tegra: bpmp: Return directly after a failed kzalloc() in get_filename() (stable-fixes).\n- fs: Fix error checking for d_hash_and_lookup() (git-fixes)\n- fs: indicate request originates from old mount API (git-fixes)\n- fs: relax mount_setattr() permission checks (git-fixes)\n- fs/9p: only translate RWX permissions for plain 9P2000 (git-fixes)\n- fs/9p: translate O_TRUNC into OTRUNC (git-fixes)\n- fsverity: skip PKCS#7 parser when keyring is empty (git-fixes)\n- ftrace: Fix possible use-after-free issue in ftrace_location() (git-fixes).\n- fuse: do not unhash root (bsc#1223946).\n- fuse: fix root lookup with nonzero generation (bsc#1223945).\n- geneve: fix header validation in geneve[6]_xmit_skb (git-fixes).\n- geneve: make sure to pull inner header in geneve_rx() (git-fixes).\n- gpio: cdev: check for NULL labels when sanitizing them for irqs (git-fixes).\n- gpio: cdev: fix missed label sanitizing in debounce_setup() (git-fixes).\n- gpio: cdev: sanitize the label before requesting the interrupt (stable-fixes).\n- gpio: crystalcove: Use -ENOTSUPP consistently (stable-fixes).\n- gpio: tangier: Use correct type for the IRQ chip data (git-fixes).\n- gpio: tegra186: Fix tegra186_gpio_is_accessible() check (git-fixes).\n- gpio: wcove: Use -ENOTSUPP consistently (stable-fixes).\n- gpiolib: cdev: fix uninitialised kfifo (git-fixes).\n- gpiolib: cdev: relocate debounce_period_us from struct gpio_desc (stable-fixes).\n- gpiolib: swnode: Remove wrong header inclusion (git-fixes).\n- gpu: host1x: Do not setup DMA for virtual devices (stable-fixes).\n- gtp: fix use-after-free and null-ptr-deref in gtp_newlink() (git-fixes).\n- HID: amd_sfh: Handle 'no sensors' in PM operations (git-fixes).\n- HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up (git-fixes).\n- HID: input: avoid polling stylus battery on Chromebook Pompom (stable-fixes).\n- HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors (git-fixes).\n- HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev-\u003edevc (git-fixes).\n- HID: logitech-dj: allow mice to use all types of reports (git-fixes).\n- HID: multitouch: Add required quirk for Synaptics 0xcddc device (stable-fixes).\n- hwmon: (amc6821) add of_match table (stable-fixes).\n- hwmon: (corsair-cpro) Protect ccp-\u003ewait_input_report with a spinlock (git-fixes).\n- hwmon: (corsair-cpro) Use a separate buffer for sending commands (git-fixes).\n- hwmon: (corsair-cpro) Use complete_all() instead of complete() in ccp_raw_event() (git-fixes).\n- hwmon: (intel-m10-bmc-hwmon) Fix multiplier for N6000 board power sensor (git-fixes).\n- hwmon: (lm70) fix links in doc and comments (git-fixes).\n- hwmon: (pmbus/ucd9000) Increase delay from 250 to 500us (git-fixes).\n- hwmon: (shtc1) Fix property misspelling (git-fixes).\n- hwtracing: hisi_ptt: Move type check to the beginning of hisi_ptt_pmu_event_init() (git-fixes).\n- i2c: acpi: Unbind mux adapters before delete (git-fixes).\n- i2c: cadence: Avoid fifo clear after start (git-fixes).\n- i2c: pxa: hide unused icr_bits[] variable (git-fixes).\n- i2c: smbus: fix NULL function pointer dereference (git-fixes).\n- i2c: synquacer: Fix an error handling path in synquacer_i2c_probe() (git-fixes).\n- i3c: master: svc: change ENXIO to EAGAIN when IBI occurs during start frame (git-fixes).\n- i3c: master: svc: fix invalidate IBI type and miss call client IBI handler (git-fixes).\n- i40e: disable NAPI right after disabling irqs when handling xsk_pool (git-fixes).\n- i40e: Enforce software interrupt during busy-poll exit (git-fixes).\n- i40e: Fix firmware version comparison function (git-fixes).\n- i40e: fix i40e_count_filters() to count only active/new filters (git-fixes).\n- i40e: Fix VF MAC filter removal (git-fixes).\n- i40e: fix vf may be used uninitialized in this function warning (git-fixes).\n- i915: make inject_virtual_interrupt() void (stable-fixes).\n- IB/mlx5: Use __iowrite64_copy() for write combining stores (git-fixes)\n- ice: fix enabling RX VLAN filtering (git-fixes).\n- ice: fix memory corruption bug with suspend and rebuild (git-fixes).\n- ice: fix stats being updated by way too large values (git-fixes).\n- ice: fix typo in assignment (git-fixes).\n- ice: fix uninitialized dplls mutex usage (git-fixes).\n- ice: reconfig host after changing MSI-X on VF (git-fixes).\n- ice: Refactor FW data type and fix bitmap casting issue (git-fixes).\n- ice: reorder disabling IRQ and NAPI in ice_qp_dis (git-fixes).\n- ice: use relative VSI index for VFs instead of PF VSI number (git-fixes).\n- ice: virtchnl: stop pretending to support RSS over AQ or registers (git-fixes).\n- ida: make 'ida_dump' static (git-fixes).\n- idma64: Do not try to serve interrupts when device is powered off (git-fixes).\n- idpf: disable local BH when scheduling napi for marker packets (git-fixes).\n- idpf: extend tx watchdog timeout (bsc#1224137).\n- idpf: fix kernel panic on unknown packet types (git-fixes).\n- igb: extend PTP timestamp adjustments to i211 (git-fixes).\n- igb: Fix missing time sync events (git-fixes).\n- igc: avoid returning frame twice in XDP_REDIRECT (git-fixes).\n- igc: Fix missing time sync events (git-fixes).\n- igc: Remove stale comment about Tx timestamping (git-fixes).\n- iio: accel: mxc4005: Interrupt handling fixes (git-fixes).\n- iio: adc: stm32: Fixing err code to not indicate success (git-fixes).\n- iio: core: Leave private pointer NULL when no private data supplied (git-fixes).\n- iio: dummy_evgen: remove Excess kernel-doc comments (git-fixes).\n- iio: gts-helper: Fix division loop (git-fixes).\n- iio: pressure: dps310: support negative temperature values (git-fixes).\n- iio: pressure: Fixes BME280 SPI driver data (git-fixes).\n- iio:imu: adis16475: Fix sync mode setting (git-fixes).\n- inet_diag: annotate data-races around inet_diag_table[] (git-fixes).\n- inet: frags: eliminate kernel-doc warning (git-fixes).\n- init: open /initrd.image with O_LARGEFILE (stable-fixes).\n- init/main.c: Fix potential static_command_line memory overflow (git-fixes).\n- Input: allocate keycode for Display refresh rate toggle (stable-fixes).\n- Input: cyapa - add missing input core locking to suspend/resume functions (git-fixes).\n- Input: gpio_keys_polled - suppress deferred probe error for gpio (stable-fixes).\n- Input: imagis - use FIELD_GET where applicable (stable-fixes).\n- Input: ims-pcu - fix printf string overflow (git-fixes).\n- Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation (git-fixes).\n- Input: synaptics-rmi4 - fail probing if memory allocation for 'phys' fails (stable-fixes).\n- Input: xpad - add additional HyperX Controller Identifiers (stable-fixes).\n- Input: xpad - add support for Snakebyte GAMEPADs (stable-fixes).\n- input/touchscreen: imagis: Correct the maximum touch area value (stable-fixes).\n- intel: legacy: Partial revert of field get conversion (git-fixes).\n- interconnect: qcom: osm-l3: Replace custom implementation of COUNT_ARGS() (git-fixes).\n- interconnect: qcom: qcm2290: Fix mas_snoc_bimc QoS port assignment (git-fixes).\n- interconnect: qcom: sc8180x: Mark CO0 BCM keepalive (git-fixes).\n- interconnect: qcom: sm8550: Enable sync_state (git-fixes).\n- io_uring: kabi cookie remove (bsc#1217384).\n- iomap: clear the per-folio dirty bits on all writeback failures (git-fixes)\n- iommu: Map reserved memory as cacheable if device is coherent (git-fixes).\n- iommu/arm-smmu-v3: Check that the RID domain is S1 in SVA (git-fixes).\n- iommu/dma: Force swiotlb_max_mapping_size on an untrusted device (bsc#1224331)\n- iommu/dma: Trace bounce buffer usage when mapping buffers (git-fixes).\n- iommu/vt-d: Allocate local memory for page request queue (git-fixes).\n- iommu/vt-d: Fix wrong use of pasid config (git-fixes).\n- iommu/vt-d: Set SSADE when attaching to a parent with dirty tracking (git-fixes).\n- iommu/vt-d: Update iotlb in nested domain attach (git-fixes).\n- iommufd: Add missing IOMMUFD_DRIVER kconfig for the selftest (git-fixes).\n- iommufd: Fix iopt_access_list_id overwrite bug (git-fixes).\n- iommufd: Reject non-zero data_type if no data_len is provided (git-fixes).\n- iommufd/iova_bitmap: Bounds check mapped::pages access (git-fixes).\n- iommufd/iova_bitmap: Consider page offset for the pages to be pinned (git-fixes).\n- iommufd/iova_bitmap: Switch iova_bitmap::bitmap to an u8 array (git-fixes).\n- ionic: set adminq irq affinity (git-fixes).\n- ipv4: annotate data-races around fi-\u003efib_dead (git-fixes).\n- irqchip/alpine-msi: Fix off-by-one in allocation error path (git-fixes).\n- irqchip/armada-370-xp: Suppress unused-function warning (git-fixes).\n- irqchip/gic-v3-its: Do not assume vPE tables are preallocated (git-fixes).\n- irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.1 (git-fixes).\n- irqchip/gic-v3-its: Prevent double free on error (git-fixes).\n- irqchip/loongson-pch-msi: Fix off-by-one on allocation error path (git-fixes).\n- irqchip/mbigen: Do not use bus_get_dev_root() to find the parent (git-fixes).\n- irqchip/renesas-rzg2l: Add macro to retrieve TITSR register offset based on register's index (stable-fixes).\n- irqchip/renesas-rzg2l: Flush posted write in irq_eoi() (git-fixes).\n- irqchip/renesas-rzg2l: Implement restriction when writing ISCR register (stable-fixes).\n- irqchip/renesas-rzg2l: Prevent spurious interrupts when setting trigger type (git-fixes).\n- irqchip/renesas-rzg2l: Rename rzg2l_irq_eoi() (stable-fixes).\n- irqchip/renesas-rzg2l: Rename rzg2l_tint_eoi() (stable-fixes).\n- ixgbe: {dis, en}able irqs in ixgbe_txrx_ring_{dis, en}able (git-fixes).\n- ixgbe: avoid sleeping allocation in ixgbe_ipsec_vf_add_sa() (git-fixes).\n- jffs2: prevent xattr node from overflowing the eraseblock (git-fixes).\n- kabi/severities: ignore brcmfmac-specific local symbols\n- kabi/severities: ignore IMS functions They were dropped in previous patches. Noone is supposed to use them.\n- kabi/severities: ignore TAS2781 symbol drop, it's only locally used\n- kabi/severities: ignore Wangxun ethernet driver local symbols\n- kabi/severities: Remove mitigation-related symbols Those are used by the core kernel to implement CPU vulnerabilities mitigation and are not expected to be consumed by 3rd party users.\n- kasan, fortify: properly rename memintrinsics (git-fixes).\n- kasan: disable kasan_non_canonical_hook() for HW tags (git-fixes).\n- kasan: print the original fault addr when access invalid shadow (git-fixes).\n- kasan/test: avoid gcc warning for intentional overflow (git-fixes).\n- kexec: do syscore_shutdown() in kernel_kexec (git-fixes).\n- KEYS: trusted: Do not use WARN when encode fails (git-fixes).\n- KEYS: trusted: Fix memory leak in tpm2_key_encode() (git-fixes).\n- kprobes: Fix possible use-after-free issue on kprobe registration (git-fixes).\n- kselftest: Add a ksft_perror() helper (stable-fixes).\n- kunit/fortify: Fix mismatched kvalloc()/vfree() usage (git-fixes).\n- KVM: nVMX: Clear EXIT_QUALIFICATION when injecting an EPT Misconfig (git-fixes).\n- KVM: s390: Check kvm pointer when testing KVM_CAP_S390_HPAGE_1M (git-fixes bsc#1224790).\n- KVM: SVM: Add support for allowing zero SEV ASIDs (git-fixes).\n- KVM: SVM: Flush pages under kvm-\u003elock to fix UAF in svm_register_enc_region() (git-fixes).\n- KVM: SVM: Use unsigned integers when dealing with ASIDs (git-fixes).\n- KVM: VMX: Disable LBR virtualization if the CPU does not support LBR callstacks (git-fixes).\n- KVM: VMX: Report up-to-date exit qualification to userspace (git-fixes).\n- KVM: x86: Allow, do not ignore, same-value writes to immutable MSRs (git-fixes).\n- KVM: x86: Fix broken debugregs ABI for 32 bit kernels (git-fixes).\n- KVM: x86: Fully re-initialize supported_mce_cap on vendor module load (git-fixes).\n- KVM: x86: Introduce __kvm_get_hypervisor_cpuid() helper (git-fixes).\n- KVM: x86: Mark target gfn of emulated atomic instruction as dirty (git-fixes).\n- KVM: x86: Only set APICV_INHIBIT_REASON_ABSENT if APICv is enabled (git-fixes).\n- KVM: x86: Snapshot if a vCPU's vendor model is AMD vs. Intel compatible (git-fixes).\n- KVM: x86: Update KVM_SW_PROTECTED_VM docs to make it clear they're a WIP (git-fixes).\n- KVM: x86: Use actual kvm_cpuid.base for clearing KVM_FEATURE_PV_UNHALT (git-fixes).\n- KVM: x86/mmu: Do not force emulation of L2 accesses to non-APIC internal slots (git-fixes).\n- KVM: x86/mmu: Move private vs. shared check above slot validity checks (git-fixes).\n- KVM: x86/mmu: Restrict KVM_SW_PROTECTED_VM to the TDP MMU (git-fixes).\n- KVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status (git-fixes).\n- KVM: x86/pmu: Allow programming events that match unsupported arch events (git-fixes).\n- KVM: x86/pmu: Always treat Fixed counters as available when supported (git-fixes).\n- KVM: x86/pmu: Apply 'fast' RDPMC only to Intel PMUs (git-fixes).\n- KVM: x86/pmu: Disable support for adaptive PEBS (git-fixes).\n- KVM: x86/pmu: Disallow 'fast' RDPMC for architectural Intel PMUs (git-fixes).\n- KVM: x86/pmu: Do not ignore bits 31:30 for RDPMC index on AMD (git-fixes).\n- KVM: x86/pmu: Do not mask LVTPC when handling a PMI on AMD platforms (git-fixes).\n- KVM: x86/pmu: Explicitly check NMI from guest to reducee false positives (git-fixes).\n- KVM: x86/pmu: Prioritize VMX interception over #GP on RDPMC due to bad index (git-fixes).\n- KVM: x86/pmu: Set enable bits for GP counters in PERF_GLOBAL_CTRL at 'RESET' (git-fixes).\n- KVM: x86/pmu: Zero out PMU metadata on AMD if PMU is disabled (git-fixes).\n- KVM: x86/xen: fix recursive deadlock in timer injection (git-fixes).\n- KVM: x86/xen: improve accuracy of Xen timers (git-fixes).\n- KVM: x86/xen: inject vCPU upcall vector when local APIC is enabled (git-fixes).\n- KVM: x86/xen: remove WARN_ON_ONCE() with false positives in evtchn delivery (git-fixes).\n- leds: pwm: Disable PWM when going to suspend (git-fixes).\n- lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure (git-fixes).\n- libnvdimm: Fix ACPI_NFIT in BLK_DEV_PMEM help (jsc#PED-5853).\n- libsubcmd: Fix parse-options memory leak (git-fixes).\n- livepatch: Fix missing newline character in klp_resolve_symbols() (bsc#1223539).\n- locks: fix KASAN: use-after-free in trace_event_raw_event_filelock_lock (git-fixes)\n- lsm: fix the logic in security_inode_getsecctx() (git-fixes).\n- mac802154: fix llsec key resources release in mac802154_llsec_key_del (git-fixes).\n- maple_tree: fix mas_empty_area_rev() null pointer dereference (git-fixes).\n- md: add a new helper rdev_has_badblock() (jsc#PED-7542).\n- md: add a new helper reshape_interrupted() (jsc#PED-7542).\n- md: changed the switch of RAID_VERSION to if (jsc#PED-7542).\n- md: check mddev-\u003epers before calling md_set_readonly() (jsc#PED-7542).\n- md: clean up invalid BUG_ON in md_ioctl (jsc#PED-7542).\n- md: clean up openers check in do_md_stop() and md_set_readonly() (jsc#PED-7542).\n- md: Do not clear MD_CLOSING when the raid is about to stop (jsc#PED-7542).\n- md: do not clear MD_RECOVERY_FROZEN for new dm-raid until resume (jsc#PED-7542).\n- md: export helper md_is_rdwr() (jsc#PED-7542).\n- md: export helpers to stop sync_thread (jsc#PED-7542).\n- md: factor out a helper to sync mddev (jsc#PED-7542).\n- md: fix kmemleak of rdev-\u003eserial (jsc#PED-7542).\n- md: get rdev-\u003emddev with READ_ONCE() (jsc#PED-7542).\n- md: merge the check of capabilities into md_ioctl_valid() (jsc#PED-7542).\n- md: preserve KABI in struct md_personality (jsc#PED-7542).\n- md: remove redundant check of 'mddev-\u003esync_thread' (jsc#PED-7542).\n- md: remove redundant md_wakeup_thread() (jsc#PED-7542).\n- md: return directly before setting did_set_md_closing (jsc#PED-7542).\n- md: sync blockdev before stopping raid or setting readonly (jsc#PED-7542).\n- md: use RCU lock to protect traversal in md_spares_need_change() (jsc#PED-7542).\n- md/dm-raid: do not call md_reap_sync_thread() directly (jsc#PED-7542).\n- md/raid1-10: add a helper raid1_check_read_range() (jsc#PED-7542).\n- md/raid1-10: factor out a new helper raid1_should_read_first() (jsc#PED-7542).\n- md/raid1: factor out choose_bb_rdev() from read_balance() (jsc#PED-7542).\n- md/raid1: factor out choose_slow_rdev() from read_balance() (jsc#PED-7542).\n- md/raid1: factor out helpers to add rdev to conf (jsc#PED-7542).\n- md/raid1: factor out helpers to choose the best rdev from read_balance() (jsc#PED-7542).\n- md/raid1: factor out read_first_rdev() from read_balance() (jsc#PED-7542).\n- md/raid1: factor out the code to manage sequential IO (jsc#PED-7542).\n- md/raid1: fix choose next idle in read_balance() (jsc#PED-7542).\n- md/raid1: record nonrot rdevs while adding/removing rdevs to conf (jsc#PED-7542).\n- media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries (git-fixes).\n- media: cadence: csi2rx: use match fwnode for media link (git-fixes).\n- media: cec: core: remove length check of Timer Status (stable-fixes).\n- media: dt-bindings: ovti,ov2680: Fix the power supply names (git-fixes).\n- media: flexcop-usb: fix sanity check of bNumEndpoints (git-fixes).\n- media: i2c: et8ek8: Do not strip remove function when driver is builtin (git-fixes).\n- media: ipu3-cio2: Request IRQ earlier (git-fixes).\n- media: mc: Fix flags handling when creating pad links (stable-fixes).\n- media: mc: Fix graph walk in media_pipeline_start (git-fixes).\n- media: mc: mark the media devnode as registered from the, start (git-fixes).\n- media: mc: Rename pad variable to clarify intent (stable-fixes).\n- media: ngene: Add dvb_ca_en50221_init return value check (git-fixes).\n- media: rcar-vin: work around -Wenum-compare-conditional warning (git-fixes).\n- media: rkisp1: Fix IRQ handling due to shared interrupts (stable-fixes).\n- media: sta2x11: fix irq handler cast (stable-fixes).\n- media: stk1160: fix bounds checking in stk1160_copy_video() (git-fixes).\n- media: sunxi: a83-mips-csi2: also select GENERIC_PHY (git-fixes).\n- media: uvcvideo: Add quirk for Logitech Rally Bar (git-fixes).\n- media: v4l: Do not turn on privacy LED if streamon fails (git-fixes).\n- media: v4l2-subdev: Fix stream handling for crop API (git-fixes).\n- mei: me: add arrow lake point H DID (stable-fixes).\n- mei: me: add arrow lake point S DID (stable-fixes).\n- mei: me: add lunar lake point M DID (stable-fixes).\n- mei: me: disable RPL-S on SPS and IGN firmwares (git-fixes).\n- mlxbf_gige: call request_irq() after NAPI initialized (git-fixes).\n- mlxbf_gige: stop interface during shutdown (git-fixes).\n- mlxbf_gige: stop PHY during open() error paths (git-fixes).\n- mlxsw: Use refcount_t for reference counting (git-fixes).\n- mm_init kABI workaround (git-fixes).\n- mm,page_owner: check for null stack_record before bumping its refcount (bsc#1222366).\n- mm,page_owner: Defer enablement of static branch (bsc#1222366).\n- mm,page_owner: drop unnecessary check (bsc#1222366).\n- mm,page_owner: Fix accounting of pages when migrating (bsc#1222366).\n- mm,page_owner: Fix printing of stack records (bsc#1222366).\n- mm,page_owner: fix recursion (bsc#1222366).\n- mm,page_owner: Fix refcount imbalance (bsc#1222366).\n- mm,page_owner: Update metadata for tail pages (bsc#1222366).\n- mm: memcg: do not periodically flush stats when memcg is disabled (bsc#1222525).\n- mm: memcg: use larger batches for proactive reclaim (bsc#1222522).\n- mm: page_owner: fix wrong information in dump_page_owner (git-fixes).\n- mm/slab: make __free(kfree) accept error pointers (git-fixes).\n- mmc: core: Add HS400 tuning in HS400es initialization (stable-fixes).\n- mmc: core: Avoid negative index with array access (git-fixes).\n- mmc: core: Initialize mmc_blk_ioc_data (git-fixes).\n- mmc: davinci: Do not strip remove function when driver is builtin (git-fixes).\n- mmc: omap: fix broken slot switch lookup (git-fixes).\n- mmc: omap: fix deferred probe (git-fixes).\n- mmc: omap: restore original power up/down steps (git-fixes).\n- mmc: sdhci_am654: Add ITAPDLYSEL in sdhci_j721e_4bit_set_clock (git-fixes).\n- mmc: sdhci_am654: Add OTAP/ITAP delay enable (git-fixes).\n- mmc: sdhci_am654: Add tuning algorithm for delay chain (git-fixes).\n- mmc: sdhci_am654: Fix ITAPDLY for HS400 timing (git-fixes).\n- mmc: sdhci_am654: Write ITAPDLY for DDR52 timing (git-fixes).\n- mmc: sdhci-msm: pervent access to suspended controller (git-fixes).\n- mmc: sdhci-omap: re-tuning is needed after a pm transition to support emmc HS200 mode (git-fixes).\n- modpost: Add '.ltext' and '.ltext.*' to TEXT_SECTIONS (stable-fixes).\n- mptcp: annotate data-races around msk-\u003ermem_fwd_alloc (git-fixes).\n- mptcp: fix bogus receive window shrinkage with multiple subflows (git-fixes).\n- mptcp: move __mptcp_error_report in protocol.c (git-fixes).\n- mptcp: process pending subflow error on close (git-fixes).\n- mptcp: Remove unnecessary test for __mptcp_init_sock() (git-fixes).\n- mtd: core: Report error if first mtd_otp_size() call fails in mtd_otp_nvmem_add() (git-fixes).\n- mtd: diskonchip: work around ubsan link failure (stable-fixes).\n- mtd: rawnand: hynix: fixed typo (git-fixes).\n- mtd: spinand: Add support for 5-byte IDs (stable-fixes).\n- net: add netdev_lockdep_set_classes() to virtual drivers (git-fixes).\n- net: annotate data-races around sk-\u003esk_bind_phc (git-fixes).\n- net: annotate data-races around sk-\u003esk_forward_alloc (git-fixes).\n- net: annotate data-races around sk-\u003esk_lingertime (git-fixes).\n- net: annotate data-races around sk-\u003esk_tsflags (git-fixes).\n- net: bonding: remove kernel-doc comment marker (git-fixes).\n- net: cfg802154: fix kernel-doc notation warnings (git-fixes).\n- net: dsa: microchip: fix register write order in ksz8_ind_write8() (git-fixes).\n- net: dsa: mt7530: fix handling of all link-local frames (git-fixes).\n- net: dsa: mt7530: fix link-local frames that ingress vlan filtering ports (git-fixes).\n- net: dsa: mt7530: prevent possible incorrect XTAL frequency selection (git-fixes).\n- net: dsa: mt7530: trap link-local frames regardless of ST Port State (git-fixes).\n- net: dsa: sja1105: Fix parameters order in sja1110_pcs_mdio_write_c45() (git-fixes).\n- net: ena: Fix incorrect descriptor free behavior (git-fixes).\n- net: ena: Fix potential sign extension issue (git-fixes).\n- net: ena: Move XDP code to its new files (git-fixes).\n- net: ena: Pass ena_adapter instead of net_device to ena_xmit_common() (git-fixes).\n- net: ena: Remove ena_select_queue (git-fixes).\n- net: ena: Set tx_info-\u003exdpf value to NULL (git-fixes).\n- net: ena: Use tx_ring instead of xdp_ring for XDP channel TX (git-fixes).\n- net: ena: Wrong missing IO completions check order (git-fixes).\n- net: ethernet: mtk_eth_soc: fix PPE hanging issue (git-fixes).\n- net: ethernet: ti: cpsw: enable mac_managed_pm to fix mdio (git-fixes).\n- net: fec: Set mac_managed_pm during probe (git-fixes).\n- net: hns3: fix index limit to support all queue stats (git-fixes).\n- net: hns3: fix kernel crash when 1588 is received on HIP08 devices (git-fixes).\n- net: hns3: fix kernel crash when devlink reload during pf initialization (git-fixes).\n- net: hns3: fix port duplex configure error in IMP reset (git-fixes).\n- net: hns3: fix wrong judgment condition issue (git-fixes).\n- net: hns3: mark unexcuted loopback test result as UNEXECUTED (git-fixes).\n- net: hns3: tracing: fix hclgevf trace event strings (git-fixes).\n- net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() (git-fixes).\n- net: ks8851: Handle softirqs at the end of IRQ thread to fix hang (git-fixes).\n- net: ks8851: Inline ks8851_rx_skb() (git-fixes).\n- net: ks8851: Queue RX packets in IRQ handler instead of disabling BHs (git-fixes).\n- net: lan743x: Add set RFE read fifo threshold for PCI1x1x chips (git-fixes).\n- net: libwx: fix memory leak on free page (git-fixes).\n- net: ll_temac: platform_get_resource replaced by wrong function (git-fixes).\n- net: llc: fix kernel-doc notation warnings (git-fixes).\n- net: mana: Fix Rx DMA datasize and skb_over_panic (git-fixes).\n- net: mediatek: mtk_eth_soc: clear MAC_MCR_FORCE_LINK only when MAC is up (git-fixes).\n- net: nfc: remove inappropriate attrs check (stable-fixes).\n- net: NSH: fix kernel-doc notation warning (git-fixes).\n- net: pcs: xpcs: Return EINVAL in the internal methods (git-fixes).\n- net: phy: fix phy_read_poll_timeout argument type in genphy_loopback (git-fixes).\n- net: phy: micrel: Fix potential null pointer dereference (git-fixes).\n- net: phy: micrel: lan8814: Fix when enabling/disabling 1-step timestamping (git-fixes).\n- net: phy: micrel: set soft_reset callback to genphy_soft_reset for KSZ8061 (git-fixes).\n- net: phy: phy_device: Prevent nullptr exceptions on ISR (git-fixes).\n- net: phy: phy_device: Prevent nullptr exceptions on ISR (stable-fixes).\n- net: ravb: Always process TX descriptor ring (git-fixes).\n- net: ravb: Always update error counters (git-fixes).\n- net: ravb: Let IP-specific receive function to interrogate descriptors (git-fixes).\n- net: smsc95xx: add support for SYS TEC USB-SPEmodule1 (git-fixes).\n- net: sparx5: Fix use after free inside sparx5_del_mact_entry (git-fixes).\n- net: sparx5: fix wrong config being used when reconfiguring PCS (git-fixes).\n- net: sparx5: flower: fix fragment flags handling (git-fixes).\n- net: stmmac: dwmac-starfive: Add support for JH7100 SoC (git-fixes).\n- net: stmmac: Fix incorrect dereference in interrupt handlers (git-fixes).\n- net: stmmac: fix rx queue priority assignment (git-fixes).\n- net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr() (git-fixes).\n- net: tcp: fix unexcepted socket die when snd_wnd is 0 (git-fixes).\n- net: tls, fix WARNIING in __sk_msg_free (bsc#1221858).\n- net: tls: fix returned read length with async decrypt (bsc#1221858).\n- net: tls: fix use-after-free with partial reads and async (bsc#1221858).\n- net: usb: ax88179_178a: avoid the interface always configured as random address (git-fixes).\n- net: usb: ax88179_178a: avoid writing the mac address before first reading (git-fixes).\n- net: usb: ax88179_178a: fix link status when link is set to down/up (git-fixes).\n- net: usb: ax88179_178a: stop lying about skb-\u003etruesize (git-fixes).\n- net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM (git-fixes).\n- net: usb: smsc95xx: stop lying about skb-\u003etruesize (git-fixes).\n- net: usb: sr9700: stop lying about skb-\u003etruesize (git-fixes).\n- net: Use sockaddr_storage for getsockopt(SO_PEERNAME) (git-fixes).\n- net: veth: do not manipulate GRO when using XDP (git-fixes).\n- net: wwan: t7xx: Split 64bit accesses to fix alignment issues (git-fixes).\n- net:usb:qmi_wwan: support Rolling modules (stable-fixes).\n- net/mlx5: Correctly compare pkt reformat ids (git-fixes).\n- net/mlx5: E-switch, Change flow rule destination checking (git-fixes).\n- net/mlx5: E-switch, store eswitch pointer before registering devlink_param (git-fixes).\n- net/mlx5: Fix fw reporter diagnose output (git-fixes).\n- net/mlx5: Fix peer devlink set for SF representor devlink port (git-fixes).\n- net/mlx5: Lag, restore buckets number to default after hash LAG deactivation (git-fixes).\n- net/mlx5: offset comp irq index in name by one (git-fixes).\n- net/mlx5: Properly link new fs rules into the tree (git-fixes).\n- net/mlx5: Register devlink first under devlink lock (git-fixes).\n- net/mlx5: Restore mistakenly dropped parts in register devlink flow (git-fixes).\n- net/mlx5: SF, Stop waiting for FW as teardown was called (git-fixes).\n- net/mlx5e: Change the warning when ignore_flow_level is not supported (git-fixes).\n- net/mlx5e: Do not produce metadata freelist entries in Tx port ts WQE xmit (git-fixes).\n- net/mlx5e: Fix MACsec state loss upon state update in offload path (git-fixes).\n- net/mlx5e: Fix mlx5e_priv_init() cleanup flow (git-fixes).\n- net/mlx5e: HTB, Fix inconsistencies with QoS SQs number (git-fixes).\n- net/mlx5e: RSS, Block changing channels number when RXFH is configured (git-fixes).\n- net/mlx5e: RSS, Block XOR hash with over 128 channels (git-fixes).\n- net/mlx5e: Switch to using _bh variant of of spinlock API in port timestamping NAPI poll context (git-fixes).\n- net/mlx5e: Use a memory barrier to enforce PTP WQ xmit submission tracking occurs after populating the metadata_map (git-fixes).\n- net/smc: bugfix for smcr v2 server connect success statistic (git-fixes).\n- net/smc: fix documentation of buffer sizes (git-fixes).\n- net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_add (git-fixes).\n- net/x25: fix incorrect parameter validation in the x25_getsockopt() function (git-fixes).\n- netfilter: nf_tables: disable toggling dormant table state more than once (git-fixes).\n- netfilter: nf_tables: uapi: Describe NFTA_RULE_CHAIN_ID (git-fixes).\n- netfilter: nft_ct: fix l3num expectations with inet pseudo family (git-fixes).\n- netfilter: nft_set_rbtree: use read spinlock to avoid datapath contention (git-fixes).\n- nf_conntrack: fix -Wunused-const-variable= (git-fixes).\n- nfc: nci: Fix handling of zero-length payload packets in nci_rx_work() (git-fixes).\n- nfc: nci: Fix kcov check in nci_rx_work() (git-fixes).\n- nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet (git-fixes).\n- nfc: nci: Fix uninit-value in nci_rx_work (git-fixes).\n- NFC: trf7970a: disable all regulators on removal (git-fixes).\n- nfp: flower: handle acti_netdevs allocation failure (git-fixes).\n- NFS: Fix an off by one in root_nfs_cat() (git-fixes).\n- NFS: Fix nfs_netfs_issue_read() xarray locking for writeback interrupt (git-fixes).\n- nfs: fix panic when nfs4_ff_layout_prepare_ds() fails (git-fixes).\n- NFS: Read unlock folio on nfs_page_create_from_folio() error (git-fixes).\n- NFSD: change LISTXATTRS cookie encoding to big-endian (git-fixes).\n- NFSD: Convert the callback workqueue to use delayed_work (git-fixes).\n- nfsd: do not call locks_release_private() twice concurrently (git-fixes).\n- nfsd: Fix a regression in nfsd_setattr() (git-fixes).\n- NFSD: fix LISTXATTRS returning a short list with eof=TRUE (git-fixes).\n- NFSD: fix LISTXATTRS returning more bytes than maxcount (git-fixes).\n- NFSD: Fix nfsd_clid_class use of __string_len() macro (git-fixes).\n- NFSD: fix nfsd4_listxattr_validate_cookie (git-fixes).\n- NFSD: Reschedule CB operations when backchannel rpc_clnt is shut down (git-fixes).\n- NFSD: Reset cb_seq_status after NFS4ERR_DELAY (git-fixes).\n- NFSD: Retransmit callbacks after client reconnects (git-fixes).\n- nfsd: use __fput_sync() to avoid delayed closing of files (bsc#1223380 bsc#1217408).\n- NFSv4.1/pnfs: fix NFS with TLS in pnfs (git-fixes).\n- NFSv4.2: fix listxattr maximum XDR buffer size (git-fixes).\n- NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 (git-fixes).\n- nilfs2: fix OOB in nilfs_set_de_type (git-fixes).\n- nilfs2: fix out-of-range warning (git-fixes).\n- nilfs2: fix potential bug in end_buffer_async_write (git-fixes).\n- nilfs2: fix unexpected freezing of nilfs_segctor_sync() (git-fixes).\n- nilfs2: fix use-after-free of timer for log writer thread (git-fixes).\n- nilfs2: make superblock data array index computation sparse friendly (git-fixes).\n- nouveau: fix devinit paths to only handle display on GSP (git-fixes).\n- nouveau: fix function cast warning (git-fixes).\n- nouveau: fix instmem race condition around ptr stores (git-fixes).\n- nouveau: lock the client object tree (stable-fixes).\n- nouveau: reset the bo resource bus info after an eviction (git-fixes).\n- nouveau/dmem: handle kcalloc() allocation failure (git-fixes).\n- nouveau/gsp: do not check devinit disable on GSP (git-fixes).\n- nouveau/uvmm: fix addr/range calcs for remap operations (git-fixes).\n- nvdimm: make nvdimm_bus_type const (jsc#PED-5853).\n- nvdimm/pmem: fix leak on dax_add_host() failure (jsc#PED-5853).\n- nvdimm/pmem: Treat alloc_dax() -EOPNOTSUPP failure as non-fatal (jsc#PED-5853).\n- nvme-fc: do not wait in vain when unloading module (git-fixes).\n- nvme-pci: Add quirk for broken MSIs (git-fixes).\n- nvme-tcp: strict pdu pacing to avoid send stalls on TLS (bsc#1221858).\n- nvme: fix reconnection fail due to reserved tag allocation (git-fixes).\n- nvme: fix warn output about shared namespaces without CONFIG_NVME_MULTIPATH (git-fixes).\n- nvmet-fc: abort command when there is no binding (git-fixes).\n- nvmet-fc: avoid deadlock on delete association path (git-fixes).\n- nvmet-fc: defer cleanup using RCU properly (git-fixes).\n- nvmet-fc: hold reference on hostport match (git-fixes).\n- nvmet-fc: release reference on target port (git-fixes).\n- nvmet-fc: take ref count on tgtport before delete assoc (git-fixes).\n- nvmet-fcloop: swap the list_add_tail arguments (git-fixes).\n- nvmet-tcp: fix nvme tcp ida memory leak (git-fixes).\n- octeontx2-af: Add array index check (git-fixes).\n- octeontx2-af: Fix devlink params (git-fixes).\n- octeontx2-af: Fix issue with loading coalesced KPU profiles (git-fixes).\n- octeontx2-af: Fix NIX SQ mode and BP config (git-fixes).\n- Octeontx2-af: fix pause frame configuration in GMP mode (git-fixes).\n- octeontx2-af: Use matching wake_up API variant in CGX command interface (git-fixes).\n- octeontx2-af: Use separate handlers for interrupts (git-fixes).\n- octeontx2-pf: check negative error code in otx2_open() (git-fixes).\n- octeontx2-pf: fix FLOW_DIS_IS_FRAGMENT implementation (git-fixes).\n- octeontx2-pf: Fix transmit scheduler resource leak (git-fixes).\n- octeontx2-pf: Send UP messages to VF only when VF is up (git-fixes).\n- octeontx2-pf: Use default max_active works instead of one (git-fixes).\n- octeontx2-pf: Wait till detach_resources msg is complete (git-fixes).\n- octeontx2: Detect the mbox up or down message via register (git-fixes).\n- of: dynamic: Synchronize of_changeset_destroy() with the devlink removals (git-fixes).\n- of: module: add buffer overflow check in of_modalias() (git-fixes).\n- of: module: prevent NULL pointer dereference in vsnprintf() (stable-fixes).\n- of: property: Add in-ports/out-ports support to of_graph_get_port_parent() (stable-fixes).\n- of: property: fix typo in io-channels (git-fixes).\n- of: property: fw_devlink: Fix stupid bug in remote-endpoint parsing (git-fixes).\n- of: property: Improve finding the consumer of a remote-endpoint property (git-fixes).\n- of: property: Improve finding the supplier of a remote-endpoint property (git-fixes).\n- of: unittest: Fix compile in the non-dynamic case (git-fixes).\n- PCI: Delay after FLR of Solidigm P44 Pro NVMe (stable-fixes).\n- PCI: Disable D3cold on Asus B1400 PCI-NVMe bridge (stable-fixes).\n- PCI: dwc: ep: Fix DBI access failure for drivers requiring refclk from host (git-fixes).\n- PCI: Execute quirk_enable_clear_retrain_link() earlier (stable-fixes).\n- PCI: Fix typos in docs and comments (stable-fixes).\n- PCI: hv: Fix ring buffer size calculation (git-fixes).\n- PCI: Make link retraining use RMW accessors for changing LNKCTL (git-fixes).\n- PCI: qcom: Add support for sa8775p SoC (git-fixes).\n- PCI: qcom: Disable ASPM L0s for sc8280xp, sa8540p and sa8295p (git-fixes).\n- PCI: rockchip-ep: Remove wrong mask on subsys_vendor_id (git-fixes).\n- PCI: rpaphp: Error out on busy status from get-sensor-state (bsc#1223369 ltc#205888).\n- PCI: Simplify pcie_capability_clear_and_set_word() to ..._clear_word() (stable-fixes).\n- PCI: switchtec: Add support for PCIe Gen5 devices (stable-fixes).\n- PCI: switchtec: Use normal comment style (stable-fixes).\n- PCI: tegra194: Fix probe path for Endpoint mode (git-fixes).\n- PCI/AER: Block runtime suspend when handling errors (stable-fixes).\n- PCI/ASPM: Use RMW accessors for changing LNKCTL (git-fixes).\n- PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports (stable-fixes).\n- PCI/DPC: Use FIELD_GET() (stable-fixes).\n- PCI/EDR: Align EDR_PORT_DPC_ENABLE_DSM with PCI Firmware r3.3 (git-fixes).\n- PCI/EDR: Align EDR_PORT_LOCATE_DSM with PCI Firmware r3.3 (git-fixes).\n- PCI/PM: Drain runtime-idle callbacks before driver removal (stable-fixes).\n- peci: linux/peci.h: fix Excess kernel-doc description warning (git-fixes).\n- perf tests: Make data symbol test wait for perf to start (bsc#1220045).\n- perf tests: Skip data symbol test if buf1 symbol is missing (bsc#1220045).\n- perf/x86/amd/core: Avoid register reset when CPU is dead (git-fixes).\n- perf/x86/amd/core: Update and fix stalled-cycles-* events for Zen 2 and later (git-fixes).\n- perf/x86/amd/lbr: Use freeze based on availability (git-fixes).\n- perf/x86/intel: Expose existence of callback support to KVM (git-fixes).\n- phy: freescale: imx8m-pcie: fix pcie link-up instability (git-fixes).\n- phy: marvell: a3700-comphy: Fix hardcoded array size (git-fixes).\n- phy: marvell: a3700-comphy: Fix out of bounds read (git-fixes).\n- phy: rockchip-snps-pcie3: fix bifurcation on rk3588 (git-fixes).\n- phy: rockchip-snps-pcie3: fix clearing PHP_GRF_PCIESEL_CON bits (git-fixes).\n- phy: rockchip: naneng-combphy: Fix mux on rk3588 (git-fixes).\n- phy: ti: tusb1210: Resolve charger-det crash if charger psy is unregistered (git-fixes).\n- pinctrl: armada-37xx: remove an unused variable (git-fixes).\n- pinctrl: baytrail: Fix selecting gpio pinctrl state (git-fixes).\n- pinctrl: core: delete incorrect free in pinctrl_enable() (git-fixes).\n- pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map() (git-fixes).\n- pinctrl: mediatek: paris: Fix PIN_CONFIG_INPUT_SCHMITT_ENABLE readback (git-fixes).\n- pinctrl: mediatek: paris: Rework support for PIN_CONFIG_{INPUT,OUTPUT}_ENABLE (git-fixes).\n- pinctrl: pinctrl-aspeed-g6: Fix register offset for pinconf of GPIOR-T (git-fixes).\n- pinctrl: qcom: pinctrl-sm7150: Fix sdc1 and ufs special pins regs (git-fixes).\n- pinctrl: renesas: checker: Limit cfg reg enum checks to provided IDs (stable-fixes).\n- pinctrl/meson: fix typo in PDM's pin name (git-fixes).\n- platform/chrome: cros_ec_uart: properly fix race condition (git-fixes).\n- platform/x86: intel-vbtn: Update tablet mode switch at end of probe (git-fixes).\n- platform/x86: ISST: Add Granite Rapids-D to HPM CPU list (stable-fixes).\n- platform/x86: touchscreen_dmi: Add an extra entry for a variant of the Chuwi Vi8 tablet (stable-fixes).\n- platform/x86: x86-android-tablets: Fix acer_b1_750_goodix_gpios name (stable-fixes).\n- platform/x86: xiaomi-wmi: Fix race condition when reporting key events (git-fixes).\n- platform/x86/amd/pmc: Extend Framework 13 quirk to more BIOSes (stable-fixes).\n- platform/x86/intel-uncore-freq: Do not present root domain on error (git-fixes).\n- PM / devfreq: Synchronize devfreq_monitor_[start/stop] (stable-fixes).\n- PM: s2idle: Make sure CPUs will wakeup directly on resume (git-fixes).\n- power: rt9455: hide unused rt9455_boost_voltage_values (git-fixes).\n- power: supply: mt6360_charger: Fix of_match for usb-otg-vbus regulator (git-fixes).\n- powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt (bsc#1221645 ltc#205739 bsc#1223191).\n- powerpc/crypto/chacha-p10: Fix failure on non Power10 (bsc#1218205).\n- powerpc/eeh: Permanently disable the removed device (bsc#1223991 ltc#205740).\n- powerpc/hv-gpci: Fix the H_GET_PERF_COUNTER_INFO hcall return value checks (git-fixes).\n- powerpc/pseries: make max polling consistent for longer H_CALLs (bsc#1215199).\n- powerpc/pseries/vio: Do not return ENODEV if node or compatible missing (bsc#1220783).\n- ppdev: Add an error check in register_device (git-fixes).\n- prctl: generalize PR_SET_MDWE support check to be per-arch (bsc#1225610).\n- printk: Add this_cpu_in_panic() (bsc#1225607).\n- printk: Adjust mapping for 32bit seq macros (bsc#1225607).\n- printk: Avoid non-panic CPUs writing to ringbuffer (bsc#1225607).\n- printk: Consolidate console deferred printing (bsc#1225607).\n- printk: Disable passing console lock owner completely during panic() (bsc#1225607).\n- printk: Do not take console lock for console_flush_on_panic() (bsc#1225607).\n- printk: For @suppress_panic_printk check for other CPU in panic (bsc#1225607).\n- printk: Keep non-panic-CPUs out of console lock (bsc#1225607).\n- printk: Let no_printk() use _printk() (bsc#1225618).\n- printk: nbcon: Relocate 32bit seq macros (bsc#1225607).\n- printk: Reduce console_unblank() usage in unsafe scenarios (bsc#1225607).\n- printk: Rename abandon_console_lock_in_panic() to other_cpu_in_panic() (bsc#1225607).\n- printk: ringbuffer: Clarify special lpos values (bsc#1225607).\n- printk: ringbuffer: Cleanup reader terminology (bsc#1225607).\n- printk: ringbuffer: Do not skip non-finalized records with prb_next_seq() (bsc#1225607).\n- printk: ringbuffer: Skip non-finalized records in panic (bsc#1225607).\n- printk: Update @console_may_schedule in console_trylock_spinning() (bsc#1225616).\n- printk: Use prb_first_seq() as base for 32bit seq macros (bsc#1225607).\n- printk: Wait for all reserved records with pr_flush() (bsc#1225607).\n- proc/kcore: do not try to access unaccepted memory (git-fixes).\n- pstore: inode: Convert mutex usage to guard(mutex) (stable-fixes).\n- pstore: inode: Only d_invalidate() is needed (git-fixes).\n- pstore/zone: Add a null pointer check to the psz_kmsg_read (stable-fixes).\n- pwm: img: fix pwm clock lookup (git-fixes).\n- qibfs: fix dentry leak (git-fixes)\n- r8169: fix issue caused by buggy BIOS on certain boards with RTL8168d (git-fixes).\n- r8169: skip DASH fw status checks when DASH is disabled (git-fixes).\n- random: handle creditable entropy from atomic process context (git-fixes).\n- RAS/AMD/FMPM: Avoid NULL ptr deref in get_saved_records() (jsc#PED-7619).\n- RAS/AMD/FMPM: Fix build when debugfs is not enabled (jsc#PED-7619).\n- RAS/AMD/FMPM: Safely handle saved records of various sizes (jsc#PED-7619).\n- RDMA/cm: add timeout to cm_destroy_id wait (git-fixes)\n- RDMA/cm: Print the old state when cm_destroy_id gets timeout (git-fixes)\n- RDMA/cma: Fix kmemleak in rdma_core observed during blktests nvme/rdma use siw (git-fixes)\n- RDMA/hns: Add max_ah and cq moderation capacities in query_device() (git-fixes)\n- RDMA/hns: Fix deadlock on SRQ async events. (git-fixes)\n- RDMA/hns: Fix GMV table pagesize (git-fixes)\n- RDMA/hns: Fix return value in hns_roce_map_mr_sg (git-fixes)\n- RDMA/hns: Fix UAF for cq async event (git-fixes)\n- RDMA/hns: Modify the print level of CQE error (git-fixes)\n- RDMA/hns: Use complete parentheses in macros (git-fixes)\n- RDMA/IPoIB: Fix format truncation compilation errors (git-fixes)\n- RDMA/mana_ib: Fix bug in creation of dma regions (git-fixes).\n- RDMA/mlx5: Adding remote atomic access flag to updatable flags (git-fixes)\n- RDMA/mlx5: Change check for cacheable mkeys (git-fixes)\n- RDMA/mlx5: Fix port number for counter query in multi-port configuration (git-fixes)\n- RDMA/mlx5: Uncacheable mkey has neither rb_key or cache_ent (git-fixes)\n- RDMA/rxe: Allow good work requests to be executed (git-fixes)\n- RDMA/rxe: Fix incorrect rxe_put in error path (git-fixes)\n- RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt (git-fixes)\n- RDMA/rxe: Fix the problem 'mutex_destroy missing' (git-fixes)\n- regmap: Add regmap_read_bypassed() (git-fixes).\n- regmap: kunit: Ensure that changed bytes are actually different (stable-fixes).\n- regmap: maple: Fix cache corruption in regcache_maple_drop() (git-fixes).\n- regmap: maple: Fix uninitialized symbol 'ret' warnings (git-fixes).\n- regulator: bd71828: Do not overwrite runtime voltages (git-fixes).\n- regulator: change devm_regulator_get_enable_optional() stub to return Ok (git-fixes).\n- regulator: change stubbed devm_regulator_get_enable to return Ok (git-fixes).\n- regulator: core: fix debugfs creation regression (git-fixes).\n- regulator: mt6360: De-capitalize devicetree regulator subnodes (git-fixes).\n- regulator: tps65132: Add of_match table (stable-fixes).\n- remoteproc: k3-r5: Do not allow core1 to power up before core0 via sysfs (git-fixes).\n- remoteproc: k3-r5: Jump to error handling labels in start/stop errors (git-fixes).\n- remoteproc: k3-r5: Wait for core0 power-up before powering up core1 (git-fixes).\n- remoteproc: mediatek: Make sure IPI buffer fits in L2TCM (git-fixes).\n- remoteproc: stm32: Fix incorrect type assignment returned by stm32_rproc_get_loaded_rsc_tablef (git-fixes).\n- remoteproc: virtio: Fix wdg cannot recovery remote processor (git-fixes).\n- Revert 'ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default' (stable-fixes).\n- Revert 'ASoC: SOF: Intel: hda-dai-ops: only allocate/release streams for first CPU DAI' (stable-fixes).\n- Revert 'ASoC: SOF: Intel: hda-dai-ops: reset device count for SoundWire DAIs' (stable-fixes).\n- Revert 'drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init()' (stable-fixes).\n- Revert 'drm/amd/display: Fix sending VSC (+ colorimetry) packets for DP/eDP displays without PSR' (stable-fixes).\n- Revert 'drm/amd/display: fix USB-C flag update after enc10 feature init' (stable-fixes).\n- Revert 'drm/amdkfd: fix gfx_target_version for certain 11.0.3 devices' (stable-fixes).\n- Revert 'drm/bridge: ti-sn65dsi83: Fix enable error path' (git-fixes).\n- Revert 'drm/nouveau/firmware: Fix SG_DEBUG error with nvkm_firmware_ctor()' (stable-fixes).\n- Revert 'drm/qxl: simplify qxl_fence_wait' (git-fixes).\n- Revert 'iommu/amd: Enable PCI/IMS' (git-fixes).\n- Revert 'iommu/vt-d: Enable PCI/IMS' (git-fixes).\n- Revert 'net/mlx5: Block entering switchdev mode with ns inconsistency' (git-fixes).\n- Revert 'net/mlx5e: Check the number of elements before walk TC rhashtable' (git-fixes).\n- Revert 'PCI/MSI: Provide IMS (Interrupt Message Store) support' (git-fixes).\n- Revert 'PCI/MSI: Provide pci_ims_alloc/free_irq()' (git-fixes).\n- Revert 'PCI/MSI: Provide stubs for IMS functions' (git-fixes).\n- Revert 'selinux: introduce an initial SID for early boot processes' (bsc#1208593) It caused a regression on ALP-current branch, kernel-obs-qa build failed.\n- Revert 'thermal: core: Do not update trip points inside the hysteresis range' (git-fixes).\n- Revert 'usb: cdc-wdm: close race between read and workqueue' (git-fixes).\n- Revert 'usb: phy: generic: Get the vbus supply' (git-fixes).\n- ring-buffer: Do not set shortest_full when full target is hit (git-fixes).\n- ring-buffer: Fix a race between readers and resize checks (git-fixes).\n- ring-buffer: Fix full_waiters_pending in poll (git-fixes).\n- ring-buffer: Fix resetting of shortest_full (git-fixes).\n- ring-buffer: Fix waking up ring buffer readers (git-fixes).\n- ring-buffer: Make wake once of ring_buffer_wait() more robust (git-fixes).\n- ring-buffer: Only update pages_touched when a new page is touched (git-fixes).\n- ring-buffer: use READ_ONCE() to read cpu_buffer-\u003ecommit_page in concurrent environment (git-fixes).\n- ring-buffer: Use wait_event_interruptible() in ring_buffer_wait() (git-fixes).\n- rtc: mt6397: select IRQ_DOMAIN instead of depending on it (git-fixes).\n- s390/bpf: Emit a barrier for BPF_FETCH instructions (git-fixes bsc#1224792).\n- s390/cio: Ensure the copied buf is NUL terminated (git-fixes bsc#1223869).\n- s390/cio: fix tracepoint subchannel type field (git-fixes bsc#1224793).\n- s390/cpacf: Split and rework cpacf query functions (git-fixes bsc#1225133).\n- s390/cpum_cf: make crypto counters upward compatible across machine types (bsc#1224348).\n- s390/ipl: Fix incorrect initialization of len fields in nvme reipl block (git-fixes bsc#1225136).\n- s390/ipl: Fix incorrect initialization of nvme dump block (git-fixes bsc#1225134).\n- s390/ism: Properly fix receive message buffer allocation (git-fixes bsc#1223590).\n- s390/mm: Fix clearing storage keys for huge pages (git-fixes bsc#1223871).\n- s390/mm: Fix storage key clearing for guest huge pages (git-fixes bsc#1223872).\n- s390/qeth: Fix kernel panic after setting hsuid (git-fixes bsc#1223874).\n- s390/vdso: Add CFI for RA register to asm macro vdso_func (git-fixes bsc#1223870).\n- s390/vdso: drop '-fPIC' from LDFLAGS (git-fixes bsc#1223593).\n- s390/vtime: fix average steal time calculation (git-fixes bsc#1221783).\n- s390/zcrypt: fix reference counting on zcrypt card objects (git-fixes bsc#1223592).\n- sched/balancing: Rename newidle_balance() =\u003e sched_balance_newidle() (bsc#1222173).\n- sched/fair: Check root_domain::overload value before update (bsc#1222173).\n- sched/fair: Use helper functions to access root_domain::overload (bsc#1222173).\n- sched/psi: Select KERNFS as needed (git-fixes).\n- sched/topology: Optimize topology_span_sane() (bsc#1225053).\n- scsi: bfa: Fix function pointer type mismatch for hcb_qe-\u003ecbfn (git-fixes).\n- scsi: core: Consult supported VPD page list prior to fetching page (git-fixes).\n- scsi: core: Fix unremoved procfs host directory regression (git-fixes).\n- scsi: csiostor: Avoid function pointer casts (git-fixes).\n- scsi: hisi_sas: Modify the deadline for ata_wait_after_reset() (git-fixes).\n- scsi: libsas: Add a helper sas_get_sas_addr_and_dev_type() (git-fixes).\n- scsi: libsas: Fix disk not being scanned in after being removed (git-fixes).\n- scsi: lpfc: Copyright updates for 14.4.0.1 patches (bsc#1221777).\n- scsi: lpfc: Correct size for cmdwqe/rspwqe for memset() (bsc#1221777).\n- scsi: lpfc: Correct size for wqe for memset() (bsc#1221777).\n- scsi: lpfc: Define lpfc_dmabuf type for ctx_buf ptr (bsc#1221777).\n- scsi: lpfc: Define lpfc_nodelist type for ctx_ndlp ptr (bsc#1221777).\n- scsi: lpfc: Define types in a union for generic void *context3 ptr (bsc#1221777).\n- scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (bsc#1221777).\n- scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1221777).\n- scsi: lpfc: Remove IRQF_ONESHOT flag from threaded IRQ handling (bsc#1221777 bsc#1217959).\n- scsi: lpfc: Remove unnecessary log message in queuecommand path (bsc#1221777).\n- scsi: lpfc: Replace hbalock with ndlp lock in lpfc_nvme_unregister_port() (bsc#1221777).\n- scsi: lpfc: Update lpfc version to 14.4.0.1 (bsc#1221777).\n- scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic (bsc#1221777).\n- scsi: lpfc: Use a dedicated lock for ras_fwlog state (bsc#1221777).\n- scsi: mpi3mr: Reduce stack usage in mpi3mr_refresh_sas_ports() (git-fixes).\n- scsi: mpt3sas: Prevent sending diag_reset when the controller is ready (git-fixes).\n- scsi: mylex: Fix sysfs buffer lengths (git-fixes).\n- scsi: qla2xxx: Change debug message during driver unload (bsc1221816).\n- scsi: qla2xxx: Delay I/O Abort on PCI error (bsc1221816).\n- scsi: qla2xxx: Fix command flush on cable pull (bsc1221816).\n- scsi: qla2xxx: Fix double free of fcport (bsc1221816).\n- scsi: qla2xxx: Fix double free of the ha-\u003evp_map pointer (bsc1221816).\n- scsi: qla2xxx: Fix N2N stuck connection (bsc1221816).\n- scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() (git-fixes).\n- scsi: qla2xxx: NVME|FCP prefer flag not being honored (bsc1221816).\n- scsi: qla2xxx: Prevent command send on chip reset (bsc1221816).\n- scsi: qla2xxx: Split FCE|EFT trace control (bsc1221816).\n- scsi: qla2xxx: Update manufacturer detail (bsc1221816).\n- scsi: qla2xxx: Update version to 10.02.09.200-k (bsc1221816).\n- scsi: sd: Unregister device if device_add_disk() failed in sd_probe() (git-fixes).\n- scsi: sg: Avoid race in error handling \u0026 drop bogus warn (git-fixes).\n- scsi: sg: Avoid sg device teardown race (git-fixes).\n- scsi: smartpqi: Fix disable_managed_interrupts (git-fixes).\n- sctp: annotate data-races around sk-\u003esk_wmem_queued (git-fixes).\n- sdhci-of-dwcmshc: disable PM runtime in dwcmshc_remove() (git-fixes).\n- selftests: default to host arch for LLVM builds (git-fixes).\n- selftests: forwarding: Fix ping failure due to short timeout (git-fixes).\n- selftests: kselftest: Fix build failure with NOLIBC (git-fixes).\n- selftests: kselftest: Mark functions that unconditionally call exit() as __noreturn (git-fixes).\n- selftests: net: bridge: increase IGMP/MLD exclude timeout membership interval (git-fixes).\n- selftests: net: kill smcrouted in the cleanup logic in amt.sh (git-fixes).\n- selftests: net: move amt to socat for better compatibility (git-fixes).\n- selftests: test_bridge_neigh_suppress.sh: Fix failures due to duplicate MAC (git-fixes).\n- selftests: timers: Convert posix_timers test to generate KTAP output (stable-fixes).\n- selftests: timers: Fix abs() warning in posix_timers test (git-fixes).\n- selftests: timers: Fix posix_timers ksft_print_msg() warning (git-fixes).\n- selftests: timers: Fix valid-adjtimex signed left-shift undefined behavior (stable-fixes).\n- selftests: vxlan_mdb: Fix failures with old libnet (git-fixes).\n- selftests/binderfs: use the Makefile's rules, not Make's implicit rules (git-fixes).\n- selftests/bpf: add edge case backtracking logic test (bsc#1225756).\n- selftests/bpf: precision tracking test for BPF_NEG and BPF_END (bsc#1225756).\n- selftests/ftrace: Fix event filter target_func selection (stable-fixes).\n- selftests/ftrace: Limit length in subsystem-enable tests (git-fixes).\n- selftests/kcmp: remove unused open mode (git-fixes).\n- selftests/net: convert test_bridge_neigh_suppress.sh to run it in unique namespace (stable-fixes).\n- selftests/pidfd: Fix config for pidfd_setns_test (git-fixes).\n- selftests/powerpc/dexcr: Add -no-pie to hashchk tests (git-fixes).\n- selftests/powerpc/papr-vpd: Fix missing variable initialization (jsc#PED-4486 git-fixes).\n- selftests/resctrl: fix clang build failure: use LOCAL_HDRS (git-fixes).\n- selftests/timers/posix_timers: Reimplement check_timer_distribution() (git-fixes).\n- selinux: avoid dereference of garbage after mount failure (git-fixes).\n- selinux: introduce an initial SID for early boot processes (bsc#1208593).\n- serial: 8250_bcm7271: use default_mux_rate if possible (git-fixes).\n- serial: 8250_dw: Revert: Do not reclock if already at correct rate (git-fixes).\n- serial: 8250_exar: Do not remove GPIO device on suspend (git-fixes).\n- serial: 8520_mtk: Set RTS on shutdown for Rx in-band wakeup (git-fixes).\n- serial: core: Fix atomicity violation in uart_tiocmget (git-fixes).\n- serial: core: only stop transmit when HW fifo is empty (git-fixes).\n- serial: kgdboc: Fix NMI-safety problems from keyboard reset code (stable-fixes).\n- serial: Lock console when calling into driver before registration (git-fixes).\n- serial: max3100: Fix bitwise types (git-fixes).\n- serial: max3100: Lock port-\u003elock when calling uart_handle_cts_change() (git-fixes).\n- serial: max3100: Update uart_driver_registered on driver removal (git-fixes).\n- serial: max310x: fix NULL pointer dereference in I2C instantiation (git-fixes).\n- serial: max310x: fix syntax error in IRQ error message (git-fixes).\n- serial: mxs-auart: add spinlock around changing cts state (git-fixes).\n- serial: sc16is7xx: add proper sched.h include for sched_set_fifo() (git-fixes).\n- serial: sc16is7xx: fix bug in sc16is7xx_set_baud() when using prescaler (git-fixes).\n- serial: sh-sci: protect invalidating RXDMA on shutdown (git-fixes).\n- serial: stm32: Reset .throttled state in .startup() (git-fixes).\n- serial/pmac_zilog: Remove flawed mitigation for rx irq flood (git-fixes).\n- SEV: disable SEV-ES DebugSwap by default (git-fixes).\n- slimbus: core: Remove usage of the deprecated ida_simple_xx() API (git-fixes).\n- slimbus: qcom-ngd-ctrl: Add timeout for wait operation (git-fixes).\n- soc: fsl: qbman: Always disable interrupts when taking cgr_lock (git-fixes).\n- soc: fsl: qbman: Use raw spinlock for cgr_lock (git-fixes).\n- soc: mediatek: cmdq: Fix typo of CMDQ_JUMP_RELATIVE (git-fixes).\n- soc: microchip: Fix POLARFIRE_SOC_SYS_CTRL input prompt (stable-fixes).\n- soc: qcom: pmic_glink: do not traverse clients list without a lock (git-fixes).\n- soc: qcom: pmic_glink: Make client-lock non-sleeping (git-fixes).\n- soc: qcom: pmic_glink: notify clients about the current state (git-fixes).\n- soc: qcom: rpmh-rsc: Enhance check for VRM in-flight request (git-fixes).\n- sock_diag: annotate data-races around sock_diag_handlers[family] (git-fixes).\n- soundwire: amd: fix for wake interrupt handling for clockstop mode (git-fixes).\n- speakup: Avoid crash on very long word (git-fixes).\n- speakup: Fix 8bit characters from direct synth (git-fixes).\n- speakup: Fix sizeof() vs ARRAY_SIZE() bug (git-fixes).\n- spi: Do not mark message DMA mapped when no transfer in it is (git-fixes).\n- spi: fix null pointer dereference within spi_sync (git-fixes).\n- spi: hisi-kunpeng: Delete the dump interface of data registers in debugfs (git-fixes).\n- spi: intel-pci: Add support for Lunar Lake-M SPI serial flash (stable-fixes).\n- spi: lm70llp: fix links in doc and comments (git-fixes).\n- spi: lpspi: Avoid potential use-after-free in probe() (git-fixes).\n- spi: mchp-pci1xxx: Fix a possible null pointer dereference in pci1xxx_spi_probe (git-fixes).\n- spi: microchip-core-qspi: fix setting spi bus clock rate (git-fixes).\n- spi: spi-fsl-lpspi: remove redundant spi_controller_put call (git-fixes).\n- spi: spi-mt65xx: Fix NULL pointer access in interrupt handler (git-fixes).\n- spi: stm32: Do not warn about spurious interrupts (git-fixes).\n- spi: xilinx: Fix kernel documentation in the xilinx_spi.h (git-fixes).\n- spmi: hisi-spmi-controller: Do not override device identifier (git-fixes).\n- staging: vc04_services: changen strncpy() to strscpy_pad() (stable-fixes).\n- staging: vc04_services: fix information leak in create_component() (git-fixes).\n- staging: vt6655: Remove unused declaration of RFbAL7230SelectChannelPostProcess() (git-fixes).\n- stmmac: Clear variable when destroying workqueue (git-fixes).\n- SUNRPC: fix a memleak in gss_import_v2_context (git-fixes).\n- SUNRPC: fix some memleaks in gssx_dec_option_array (git-fixes).\n- supported.conf: support tcp_dctcp module (jsc#PED-8111)\n- swiotlb: extend buffer pre-padding to alloc_align_mask if necessary (bsc#1224331)\n- swiotlb: Fix alignment checks when both allocation and DMA masks are (bsc#1224331)\n- swiotlb: Fix double-allocation of slots due to broken alignment (bsc#1224331)\n- swiotlb: Honour dma_alloc_coherent() alignment in swiotlb_alloc() (bsc#1224331)\n- swiotlb: use the calculated number of areas (git-fixes).\n- thermal: devfreq_cooling: Fix perf state when calculate dfc res_util (git-fixes).\n- thermal/drivers/qcom/lmh: Check for SCM availability at probe (git-fixes).\n- thermal/drivers/tsens: Fix null pointer dereference (git-fixes).\n- thermal/of: Assume polling-delay(-passive) 0 when absent (stable-fixes).\n- thunderbolt: Avoid notify PM core about runtime PM resume (stable-fixes).\n- thunderbolt: Do not create DisplayPort tunnels on adapters of the same router (git-fixes).\n- thunderbolt: Fix wake configurations after device unplug (stable-fixes).\n- thunderbolt: Introduce tb_path_deactivate_hop() (stable-fixes).\n- thunderbolt: Introduce tb_port_reset() (stable-fixes).\n- thunderbolt: Make tb_switch_reset() support Thunderbolt 2, 3 and USB4 routers (stable-fixes).\n- thunderbolt: Reset only non-USB4 host routers in resume (git-fixes).\n- tls: break out of main loop when PEEK gets a non-data record (bsc#1221858).\n- tls: do not skip over different type records from the rx_list (bsc#1221858).\n- tls: fix peeking with sync+async decryption (bsc#1221858).\n- tls: stop recv() if initial process_rx_list gave us non-DATA (bsc#1221858).\n- tools/arch/x86/intel_sdsi: Fix maximum meter bundle length (git-fixes).\n- tools/arch/x86/intel_sdsi: Fix meter_certificate decoding (git-fixes).\n- tools/arch/x86/intel_sdsi: Fix meter_show display (git-fixes).\n- tools/latency-collector: Fix -Wformat-security compile warns (git-fixes).\n- tools/power turbostat: Expand probe_intel_uncore_frequency() (bsc#1221765).\n- tools/power/turbostat: Fix uncore frequency file string (bsc#1221765).\n- tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer (git-fixes).\n- tracing: Add MODULE_DESCRIPTION() to preemptirq_delay_test (git-fixes).\n- tracing: Have saved_cmdlines arrays all in one allocation (git-fixes).\n- tracing: hide unused ftrace_event_id_fops (git-fixes).\n- tracing: Remove precision vsnprintf() check from print event (git-fixes).\n- tracing: Use .flush() call to wake up readers (git-fixes).\n- tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string (git-fixes).\n- tracing/ring-buffer: Fix wait_on_pipe() race (git-fixes).\n- tty: n_gsm: fix missing receive state reset after mode switch (git-fixes).\n- tty: n_gsm: fix possible out-of-bounds in gsm0_receive() (git-fixes).\n- tty: serial: samsung: fix tx_empty() to return TIOCSER_TEMT (git-fixes).\n- tty: vt: fix 20 vs 0x20 typo in EScsiignore (git-fixes).\n- ubifs: dbg_check_idx_size: Fix kmemleak if loading znode failed (git-fixes).\n- ubifs: fix sort function prototype (git-fixes).\n- ubifs: Queue up space reservation tasks if retrying many times (git-fixes).\n- ubifs: Remove unreachable code in dbg_check_ltab_lnum (git-fixes).\n- ubifs: Set page uptodate in the correct place (git-fixes).\n- usb: aqc111: stop lying about skb-\u003etruesize (git-fixes).\n- usb: audio-v2: Correct comments for struct uac_clock_selector_descriptor (git-fixes).\n- usb: cdc-wdm: close race between read and workqueue (git-fixes).\n- USB: core: Add hub_get() and hub_put() routines (stable-fixes).\n- USB: core: Fix access violation during port device removal (git-fixes).\n- USB: core: Fix deadlock in port 'disable' sysfs attribute (stable-fixes).\n- USB: core: Fix deadlock in usb_deauthorize_interface() (git-fixes).\n- usb: Disable USB3 LPM at shutdown (stable-fixes).\n- usb: dwc2: gadget: Fix exiting from clock gating (git-fixes).\n- usb: dwc2: gadget: LPM flow fix (git-fixes).\n- usb: dwc2: host: Fix dereference issue in DDMA completion flow (git-fixes).\n- usb: dwc2: host: Fix hibernation flow (git-fixes).\n- usb: dwc2: host: Fix ISOC flow in DDMA mode (git-fixes).\n- usb: dwc2: host: Fix remote wakeup from hibernation (git-fixes).\n- usb: dwc3-am62: Disable wakeup at remove (git-fixes).\n- usb: dwc3-am62: fix module unload/reload behavior (git-fixes).\n- usb: dwc3-am62: Rename private data (git-fixes).\n- usb: dwc3: core: Prevent phy suspend during init (Git-fixes).\n- usb: dwc3: pci: Drop duplicate ID (git-fixes).\n- usb: dwc3: Properly set system wakeup (git-fixes).\n- usb: dwc3: Wait unconditionally after issuing EndXfer command (git-fixes).\n- usb: Fix regression caused by invalid ep0 maxpacket in virtual SuperSpeed device (bsc#1220569).\n- usb: fotg210: Add missing kernel doc description (git-fixes).\n- usb: gadget: composite: fix OS descriptors w_value logic (git-fixes).\n- usb: gadget: f_fs: Fix a race condition when processing setup packets (git-fixes).\n- usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete (git-fixes).\n- usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error (stable-fixes).\n- usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin (git-fixes).\n- usb: gadget: u_audio: Clear uac pointer when freed (git-fixes).\n- usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind (git-fixes).\n- usb: gadget: uvc: mark incomplete frames with UVC_STREAM_ERR (stable-fixes).\n- usb: gadget: uvc: use correct buffer size when parsing configfs lists (git-fixes).\n- usb: ohci: Prevent missed ohci interrupts (git-fixes).\n- usb: phy: generic: Get the vbus supply (git-fixes).\n- USB: serial: add device ID for VeriFone adapter (stable-fixes).\n- USB: serial: cp210x: add ID for MGP Instruments PDS100 (stable-fixes).\n- USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M (stable-fixes).\n- USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB (stable-fixes).\n- USB: serial: option: add Fibocom FM135-GL variants (stable-fixes).\n- USB: serial: option: add Lonsung U8300/U9300 product (stable-fixes).\n- USB: serial: option: add MeiG Smart SLM320 product (stable-fixes).\n- USB: serial: option: add Rolling RW101-GL and RW135-GL support (stable-fixes).\n- USB: serial: option: add support for Fibocom FM650/FG650 (stable-fixes).\n- USB: serial: option: add Telit FN920C04 rmnet compositions (stable-fixes).\n- USB: serial: option: support Quectel EM060K sub-models (stable-fixes).\n- usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined (stable-fixes).\n- usb: typec: Return size of buffer if pd_set operation succeeds (git-fixes).\n- usb: typec: tcpci: add generic tcpci fallback compatible (stable-fixes).\n- usb: typec: tcpm: Check for port partner validity before consuming it (git-fixes).\n- usb: typec: tcpm: clear pd_event queue in PORT_RESET (git-fixes).\n- usb: typec: tcpm: Correct port source pdo array in pd_set callback (git-fixes).\n- usb: typec: tcpm: Correct the PDO counting in pd_set (git-fixes).\n- usb: typec: tcpm: fix double-free issue in tcpm_port_unregister_pd() (git-fixes).\n- usb: typec: tcpm: unregister existing source caps before re-registration (git-fixes).\n- usb: typec: tcpm: Update PD of Type-C port upon pd_set (git-fixes).\n- usb: typec: tipd: fix event checking for tps6598x (git-fixes).\n- usb: typec: ucsi_acpi: Refactor and fix DELL quirk (git-fixes).\n- usb: typec: ucsi: Ack unsupported commands (stable-fixes).\n- usb: typec: ucsi: always register a link to USB PD device (git-fixes).\n- usb: typec: ucsi: Check for notifications after init (git-fixes).\n- usb: typec: ucsi: Clean up UCSI_CABLE_PROP macros (git-fixes).\n- usb: typec: ucsi: Clear EVENT_PENDING under PPM lock (git-fixes).\n- usb: typec: ucsi: Clear UCSI_CCI_RESET_COMPLETE before reset (stable-fixes).\n- usb: typec: ucsi: displayport: Fix potential deadlock (git-fixes).\n- usb: typec: ucsi: Fix connector check on init (git-fixes).\n- usb: typec: ucsi: Fix race between typec_switch and role_switch (git-fixes).\n- usb: typec: ucsi: Limit read size on v1.2 (stable-fixes).\n- usb: typec: ucsi: simplify partner's PD caps registration (git-fixes).\n- USB: UAS: return ENODEV when submit urbs fail with device not attached (stable-fixes).\n- usb: udc: remove warning when queue disabled ep (stable-fixes).\n- usb: xhci-plat: Do not include xhci.h (stable-fixes).\n- usb: xhci: Add error handling in xhci_map_urb_for_dma (git-fixes).\n- usb: xhci: correct return value in case of STS_HCE (git-fixes).\n- usb: xhci: Implement xhci_handshake_check_state() helper.\n- vboxsf: Avoid an spurious warning if load_nls_xxx() fails (git-fixes).\n- vboxsf: explicitly deny setlease attempts (stable-fixes).\n- vdpa_sim: reset must not run (git-fixes).\n- vdpa/mlx5: Allow CVQ size changes (git-fixes).\n- veth: try harder when allocating queue memory (git-fixes).\n- vhost: Add smp_rmb() in vhost_enable_notify() (git-fixes).\n- vhost: Add smp_rmb() in vhost_vq_avail_empty() (git-fixes).\n- virtio_net: Do not send RSS key if it is not supported (git-fixes).\n- virtio-blk: Ensure no requests in virtqueues before deleting vqs (git-fixes).\n- virtio: treat alloc_dax() -EOPNOTSUPP failure as non-fatal (bsc#1223944).\n- VMCI: Fix an error handling path in vmci_guest_probe_device() (git-fixes).\n- VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() (stable-fixes).\n- vmci: prevent speculation leaks by sanitizing event in event_deliver() (git-fixes).\n- vsock/virtio: fix packet delivery to tap device (git-fixes).\n- watchdog: bd9576: Drop 'always-running' property (git-fixes).\n- watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger (git-fixes).\n- watchdog: rti_wdt: Set min_hw_heartbeat_ms to accommodate a safety margin (git-fixes).\n- watchdog: sa1100: Fix PTR_ERR_OR_ZERO() vs NULL check in sa1100dog_probe() (git-fixes).\n- wifi: ar5523: enable proper endpoint verification (git-fixes).\n- wifi: ath10k: Fix an error code problem in ath10k_dbg_sta_write_peer_debug_trigger() (git-fixes).\n- wifi: ath10k: poll service ready message before failing (git-fixes).\n- wifi: ath10k: populate board data for WCN3990 (git-fixes).\n- wifi: ath11k: decrease MHI channel buffer length to 8KB (bsc#1207948).\n- wifi: ath11k: do not force enable power save on non-running vdevs (git-fixes).\n- wifi: ath12k: fix out-of-bound access of qmi_invoke_handler() (git-fixes).\n- wifi: ath12k: Update Qualcomm Innovation Center, Inc. copyrights (stable-fixes).\n- wifi: ath9k: fix LNA selection in ath_ant_try_scan() (stable-fixes).\n- wifi: brcmfmac: Add DMI nvram filename quirk for ACEPC W5 Pro (stable-fixes).\n- wifi: brcmfmac: add per-vendor feature detection callback (stable-fixes).\n- wifi: brcmfmac: cfg80211: Use WSEC to set SAE password (stable-fixes).\n- wifi: brcmfmac: Demote vendor-specific attach/detach messages to info (git-fixes).\n- wifi: brcmfmac: pcie: handle randbuf allocation failure (git-fixes).\n- wifi: carl9170: add a proper sanity check for endpoints (git-fixes).\n- wifi: carl9170: re-fix fortified-memset warning (git-fixes).\n- wifi: cfg80211: check A-MSDU format more carefully (stable-fixes).\n- wifi: cfg80211: fix rdev_dump_mpp() arguments order (stable-fixes).\n- wifi: ieee80211: fix ieee80211_mle_basic_sta_prof_size_ok() (git-fixes).\n- wifi: iwlwifi: fw: do not always use FW dump trig (git-fixes).\n- wifi: iwlwifi: fw: fix compile w/o CONFIG_ACPI (git-fixes).\n- wifi: iwlwifi: mvm: allocate STA links only for active links (git-fixes).\n- wifi: iwlwifi: mvm: fix active link counting during recovery (git-fixes).\n- wifi: iwlwifi: mvm: fix check in iwl_mvm_sta_fw_id_mask (git-fixes).\n- wifi: iwlwifi: mvm: guard against invalid STA ID on removal (stable-fixes).\n- wifi: iwlwifi: mvm: include link ID when releasing frames (git-fixes).\n- wifi: iwlwifi: mvm: init vif works only once (git-fixes).\n- wifi: iwlwifi: mvm: remove old PASN station when adding a new one (git-fixes).\n- wifi: iwlwifi: mvm: return uid from iwl_mvm_build_scan_cmd (git-fixes).\n- wifi: iwlwifi: mvm: rfi: fix potential response leaks (git-fixes).\n- wifi: iwlwifi: mvm: select STA mask only for active links (git-fixes).\n- wifi: iwlwifi: mvm: use correct address 3 in A-MSDU (stable-fixes).\n- wifi: iwlwifi: pcie: Add the PCI device id for new hardware (stable-fixes).\n- wifi: iwlwifi: pcie: fix RB status reading (stable-fixes).\n- wifi: iwlwifi: read txq-\u003eread_ptr under lock (stable-fixes).\n- wifi: iwlwifi: reconfigure TLC during HW restart (git-fixes).\n- wifi: mac80211_hwsim: init peer measurement result (git-fixes).\n- wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (stable-fixes).\n- wifi: mac80211: clean up assignments to pointer cache (stable-fixes).\n- wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc (stable-fixes).\n- wifi: mac80211: fix prep_connection error path (stable-fixes).\n- wifi: mac80211: fix unaligned le16 access (git-fixes).\n- wifi: mac80211: only call drv_sta_rc_update for uploaded stations (stable-fixes).\n- wifi: mac80211: remove link before AP (git-fixes).\n- wifi: mt76: mt7603: add wpdma tx eof flag for PSE client reset (git-fixes).\n- wifi: mt76: mt7603: fix tx queue of loopback packets (git-fixes).\n- wifi: mt76: mt7915: workaround too long expansion sparse warnings (git-fixes).\n- wifi: mt76: mt7996: add locking for accessing mapped registers (stable-fixes).\n- wifi: mt76: mt7996: disable AMSDU for non-data frames (stable-fixes).\n- wifi: mwl8k: initialize cmd-\u003eaddr[] properly (git-fixes).\n- wifi: nl80211: do not free NULL coalescing rule (git-fixes).\n- wifi: rtw88: 8821cu: Fix connection failure (stable-fixes).\n- wifi: rtw88: Add missing VID/PIDs for 8811CU and 8821CU (stable-fixes).\n- wifi: rtw89: fix null pointer access when abort scan (stable-fixes).\n- wifi: rtw89: pci: correct TX resource checking for PCI DMA channel of firmware command (git-fixes).\n- wifi: rtw89: pci: enlarge RX DMA buffer to consider size of RX descriptor (stable-fixes).\n- wireguard: netlink: access device through ctx instead of peer (git-fixes).\n- wireguard: netlink: check for dangling peer via is_dead instead of empty list (git-fixes).\n- wireguard: receive: annotate data-race around receiving_counter.counter (git-fixes).\n- x86/bugs: Fix BHI retpoline check (git-fixes).\n- x86/bugs: Fix the SRSO mitigation on Zen3/4 (git-fixes).\n- x86/bugs: Remove default case for fully switched enums (git-fixes).\n- x86/calldepth: Rename __x86_return_skl() to call_depth_return_thunk() (git-fixes).\n- x86/coco: Require seeding RNG with RDRAND on CoCo systems (git-fixes).\n- x86/cpu: Add model number for Intel Arrow Lake mobile processor (git-fixes).\n- x86/CPU/AMD: Add models 0x10-0x1f to the Zen5 range (git-fixes).\n- x86/CPU/AMD: Update the Zenbleed microcode revisions (git-fixes).\n- x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ (git-fixes).\n- x86/efistub: Add missing boot_params for mixed mode compat entry (git-fixes).\n- x86/efistub: Call mixed mode boot services on the firmware's stack (git-fixes).\n- x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD (git-fixes).\n- x86/hyperv: Allow 15-bit APIC IDs for VTL platforms (git-fixes).\n- x86/hyperv: Use per cpu initial stack for vtl context (git-fixes).\n- x86/Kconfig: Remove CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT (git-fixes).\n- x86/kconfig: Select ARCH_WANT_FRAME_POINTERS again when UNWINDER_FRAME_POINTER=y (git-fixes).\n- x86/kvm/Kconfig: Have KVM_AMD_SEV select ARCH_HAS_CC_PLATFORM (git-fixes).\n- x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() (git-fixes).\n- x86/nmi: Fix the inverse 'in NMI handler' check (git-fixes).\n- x86/nospec: Refactor UNTRAIN_RET[_*] (git-fixes).\n- x86/pm: Work around false positive kmemleak report in msr_build_context() (git-fixes).\n- x86/purgatory: Switch to the position-independent small code model (git-fixes).\n- x86/rethunk: Use SYM_CODE_START[_LOCAL]_NOALIGN macros (git-fixes).\n- x86/retpoline: Add NOENDBR annotation to the SRSO dummy return thunk (git-fixes).\n- x86/retpoline: Do the necessary fixup to the Zen3/4 srso return thunk for !SRSO (git-fixes).\n- x86/srso: Disentangle rethunk-dependent options (git-fixes).\n- x86/srso: Fix unret validation dependencies (git-fixes).\n- x86/srso: Improve i-cache locality for alias mitigation (git-fixes).\n- x86/srso: Print actual mitigation if requested mitigation isn't possible (git-fixes).\n- x86/srso: Remove 'pred_cmd' label (git-fixes).\n- x86/srso: Unexport untraining functions (git-fixes).\n- x86/xen: Add some null pointer checking to smp.c (git-fixes).\n- x86/xen: attempt to inflate the memory balloon on PVH (git-fixes).\n- xdp, bonding: Fix feature flags when there are no slave devs anymore (git-fixes).\n- xen-netfront: Add missing skb_mark_for_recycle (git-fixes).\n- xen: evtchn: Allow shared registration of IRQ handers (git-fixes).\n- xen/events: drop xen_allocate_irqs_dynamic() (git-fixes).\n- xen/events: fix error code in xen_bind_pirq_msi_to_irq() (git-fixes).\n- xen/events: increment refcnt only if event channel is refcounted (git-fixes).\n- xen/events: modify internal [un]bind interfaces (git-fixes).\n- xen/events: reduce externally visible helper functions (git-fixes).\n- xen/events: remove some simple helpers from events_base.c (git-fixes).\n- xen/evtchn: avoid WARN() when unbinding an event channel (git-fixes).\n- xfs: add lock protection when remove perag from radix tree (git-fixes).\n- xfs: allow extent free intents to be retried (git-fixes).\n- xfs: fix perag leak when growfs fails (git-fixes).\n- xfs: force all buffers to be written during btree bulk load (git-fixes).\n- xfs: make xchk_iget safer in the presence of corrupt inode btrees (git-fixes).\n- xfs: pass the xfs_defer_pending object to iop_recover (git-fixes).\n- xfs: recompute growfsrtfree transaction reservation while growing rt volume (git-fixes).\n- xfs: transfer recovered intent item ownership in -\u003eiop_recover (git-fixes).\n- xfs: use xfs_defer_pending objects to recover intent items (git-fixes).\n- xhci: add helper that checks for unhandled events on a event ring (git-fixes).\n- xhci: remove unnecessary event_ring_deq parameter from xhci_handle_event() (git-fixes).\n- xhci: Simplify event ring dequeue pointer update for port change events (git-fixes).\n- xhci: simplify event ring dequeue tracking for transfer events (git-fixes).\n- xhci: update event ring dequeue pointer position to controller correctly (git-fixes). Altered because we cannot take the multiple interrupter code\n","status":"published","published":"2024-06-21T11:03:42Z","modified":"2026-02-04T02:45:05.211998Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"USN-6766-1","title":"linux, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-gkeop-5.15, linux-ibm, linux-ibm-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15 vulnerabilities","description":"\nIt was discovered that the Open vSwitch implementation in the Linux kernel\ncould overflow its stack during recursive action operations under certain\nconditions. A local attacker could use this to cause a denial of service\n(system crash). (CVE-2024-1151)\n\nSander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida\ndiscovered that the Linux kernel mitigations for the initial Branch History\nInjection vulnerability (CVE-2022-0001) were insufficient for Intel\nprocessors. A local attacker could potentially use this to expose sensitive\ninformation. (CVE-2024-2201)\n\nChenyuan Yang discovered that the RDS Protocol implementation in the Linux\nkernel contained an out-of-bounds read vulnerability. An attacker could use\nthis to possibly cause a denial of service (system crash). (CVE-2024-23849)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - PowerPC architecture;\n  - S390 architecture;\n  - Core kernel;\n  - Block layer subsystem;\n  - Android drivers;\n  - Power management core;\n  - Bus devices;\n  - Hardware random number generator core;\n  - Cryptographic API;\n  - Device frequency;\n  - DMA engine subsystem;\n  - ARM SCMI message protocol;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - IIO ADC drivers;\n  - IIO subsystem;\n  - IIO Magnetometer sensors drivers;\n  - InfiniBand drivers;\n  - Media drivers;\n  - Network drivers;\n  - PCI driver for MicroSemi Switchtec;\n  - PHY drivers;\n  - SCSI drivers;\n  - DesignWare USB3 driver;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - JFS file system;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - Pstore file system;\n  - SMB network file system;\n  - Memory management;\n  - CAN network layer;\n  - Networking core;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - Logical Link layer;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - Unix domain sockets;\n  - Realtek audio codecs;\n(CVE-2023-52594, CVE-2023-52601, CVE-2024-26826, CVE-2023-52622,\nCVE-2024-26665, CVE-2023-52493, CVE-2023-52633, CVE-2024-26684,\nCVE-2024-26663, CVE-2023-52618, CVE-2023-52588, CVE-2023-52637,\nCVE-2024-26825, CVE-2023-52606, CVE-2024-26594, CVE-2024-26625,\nCVE-2024-26720, CVE-2024-26614, CVE-2023-52627, CVE-2023-52602,\nCVE-2024-26673, CVE-2024-26685, CVE-2023-52638, CVE-2023-52498,\nCVE-2023-52619, CVE-2024-26910, CVE-2024-26689, CVE-2023-52583,\nCVE-2024-26676, CVE-2024-26671, CVE-2024-26704, CVE-2024-26608,\nCVE-2024-26610, CVE-2024-26592, CVE-2023-52599, CVE-2023-52595,\nCVE-2024-26660, CVE-2023-52617, CVE-2024-26645, CVE-2023-52486,\nCVE-2023-52631, CVE-2023-52607, CVE-2023-52608, CVE-2024-26722,\nCVE-2024-26615, CVE-2023-52615, CVE-2024-26636, CVE-2023-52642,\nCVE-2023-52587, CVE-2024-26712, CVE-2024-26675, CVE-2023-52614,\nCVE-2024-26606, CVE-2024-26916, CVE-2024-26600, CVE-2024-26679,\nCVE-2024-26829, CVE-2024-26641, CVE-2023-52623, CVE-2024-26627,\nCVE-2024-26696, CVE-2024-26640, CVE-2024-26635, CVE-2023-52491,\nCVE-2024-26664, CVE-2024-26602, CVE-2023-52604, CVE-2024-26717,\nCVE-2023-52643, CVE-2024-26593, CVE-2023-52598, CVE-2024-26668,\nCVE-2023-52435, CVE-2023-52597, CVE-2024-26715, CVE-2024-26707,\nCVE-2023-52635, CVE-2024-26695, CVE-2024-26698, CVE-2023-52494,\nCVE-2024-26920, CVE-2024-26808, CVE-2023-52616, CVE-2023-52492,\nCVE-2024-26702, CVE-2024-26644, CVE-2023-52489, CVE-2024-26697)\n","status":"published","published":"2024-05-07T19:22:43Z","modified":"2026-10-29T20:03:02.990286666Z","updated_at":"2026-11-02T16:58:17.914523Z"},{"id":"USN-6766-2","title":"linux-hwe-5.15, linux-raspi vulnerabilities","description":"It was discovered that the Open vSwitch implementation in the Linux kernel\ncould overflow its stack during recursive action operations under certain\nconditions. A local attacker could use this to cause a denial of service\n(system crash). (CVE-2024-1151)\n\nSander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida\ndiscovered that the Linux kernel mitigations for the initial Branch History\nInjection vulnerability (CVE-2022-0001) were insufficient for Intel\nprocessors. A local attacker could potentially use this to expose sensitive\ninformation. (CVE-2024-2201)\n\nChenyuan Yang discovered that the RDS Protocol implementation in the Linux\nkernel contained an out-of-bounds read vulnerability. An attacker could use\nthis to possibly cause a denial of service (system crash). (CVE-2024-23849)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - PowerPC architecture;\n  - S390 architecture;\n  - Core kernel;\n  - Block layer subsystem;\n  - Android drivers;\n  - Power management core;\n  - Bus devices;\n  - Hardware random number generator core;\n  - Cryptographic API;\n  - Device frequency;\n  - DMA engine subsystem;\n  - ARM SCMI message protocol;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - IIO ADC drivers;\n  - IIO subsystem;\n  - IIO Magnetometer sensors drivers;\n  - InfiniBand drivers;\n  - Media drivers;\n  - Network drivers;\n  - PCI driver for MicroSemi Switchtec;\n  - PHY drivers;\n  - SCSI drivers;\n  - DesignWare USB3 driver;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - JFS file system;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - Pstore file system;\n  - SMB network file system;\n  - Memory management;\n  - CAN network layer;\n  - Networking core;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - Logical Link layer;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - Unix domain sockets;\n  - Realtek audio codecs;\n(CVE-2023-52594, CVE-2023-52601, CVE-2024-26826, CVE-2023-52622,\nCVE-2024-26665, CVE-2023-52493, CVE-2023-52633, CVE-2024-26684,\nCVE-2024-26663, CVE-2023-52618, CVE-2023-52588, CVE-2023-52637,\nCVE-2024-26825, CVE-2023-52606, CVE-2024-26594, CVE-2024-26625,\nCVE-2024-26720, CVE-2024-26614, CVE-2023-52627, CVE-2023-52602,\nCVE-2024-26673, CVE-2024-26685, CVE-2023-52638, CVE-2023-52498,\nCVE-2023-52619, CVE-2024-26910, CVE-2024-26689, CVE-2023-52583,\nCVE-2024-26676, CVE-2024-26671, CVE-2024-26704, CVE-2024-26608,\nCVE-2024-26610, CVE-2024-26592, CVE-2023-52599, CVE-2023-52595,\nCVE-2024-26660, CVE-2023-52617, CVE-2024-26645, CVE-2023-52486,\nCVE-2023-52631, CVE-2023-52607, CVE-2023-52608, CVE-2024-26722,\nCVE-2024-26615, CVE-2023-52615, CVE-2024-26636, CVE-2023-52642,\nCVE-2023-52587, CVE-2024-26712, CVE-2024-26675, CVE-2023-52614,\nCVE-2024-26606, CVE-2024-26916, CVE-2024-26600, CVE-2024-26679,\nCVE-2024-26829, CVE-2024-26641, CVE-2023-52623, CVE-2024-26627,\nCVE-2024-26696, CVE-2024-26640, CVE-2024-26635, CVE-2023-52491,\nCVE-2024-26664, CVE-2024-26602, CVE-2023-52604, CVE-2024-26717,\nCVE-2023-52643, CVE-2024-26593, CVE-2023-52598, CVE-2024-26668,\nCVE-2023-52435, CVE-2023-52597, CVE-2024-26715, CVE-2024-26707,\nCVE-2023-52635, CVE-2024-26695, CVE-2024-26698, CVE-2023-52494,\nCVE-2024-26920, CVE-2024-26808, CVE-2023-52616, CVE-2023-52492,\nCVE-2024-26702, CVE-2024-26644, CVE-2023-52489, CVE-2024-26697)\n","status":"published","published":"2024-05-15T15:15:08Z","modified":"2026-10-29T20:01:56.015645889Z","updated_at":"2026-11-02T16:58:17.914523Z"},{"id":"USN-6766-3","title":"linux-aws, linux-aws-5.15 vulnerabilities","description":"It was discovered that the Open vSwitch implementation in the Linux kernel\ncould overflow its stack during recursive action operations under certain\nconditions. A local attacker could use this to cause a denial of service\n(system crash). (CVE-2024-1151)\n\nSander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida\ndiscovered that the Linux kernel mitigations for the initial Branch History\nInjection vulnerability (CVE-2022-0001) were insufficient for Intel\nprocessors. A local attacker could potentially use this to expose sensitive\ninformation. (CVE-2024-2201)\n\nChenyuan Yang discovered that the RDS Protocol implementation in the Linux\nkernel contained an out-of-bounds read vulnerability. An attacker could use\nthis to possibly cause a denial of service (system crash). (CVE-2024-23849)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - PowerPC architecture;\n  - S390 architecture;\n  - Core kernel;\n  - Block layer subsystem;\n  - Android drivers;\n  - Power management core;\n  - Bus devices;\n  - Hardware random number generator core;\n  - Cryptographic API;\n  - Device frequency;\n  - DMA engine subsystem;\n  - ARM SCMI message protocol;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - IIO ADC drivers;\n  - IIO subsystem;\n  - IIO Magnetometer sensors drivers;\n  - InfiniBand drivers;\n  - Media drivers;\n  - Network drivers;\n  - PCI driver for MicroSemi Switchtec;\n  - PHY drivers;\n  - SCSI drivers;\n  - DesignWare USB3 driver;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - JFS file system;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - Pstore file system;\n  - SMB network file system;\n  - Memory management;\n  - CAN network layer;\n  - Networking core;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - Logical Link layer;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - Unix domain sockets;\n  - Realtek audio codecs;\n(CVE-2023-52594, CVE-2023-52601, CVE-2024-26826, CVE-2023-52622,\nCVE-2024-26665, CVE-2023-52493, CVE-2023-52633, CVE-2024-26684,\nCVE-2024-26663, CVE-2023-52618, CVE-2023-52588, CVE-2023-52637,\nCVE-2024-26825, CVE-2023-52606, CVE-2024-26594, CVE-2024-26625,\nCVE-2024-26720, CVE-2024-26614, CVE-2023-52627, CVE-2023-52602,\nCVE-2024-26673, CVE-2024-26685, CVE-2023-52638, CVE-2023-52498,\nCVE-2023-52619, CVE-2024-26910, CVE-2024-26689, CVE-2023-52583,\nCVE-2024-26676, CVE-2024-26671, CVE-2024-26704, CVE-2024-26608,\nCVE-2024-26610, CVE-2024-26592, CVE-2023-52599, CVE-2023-52595,\nCVE-2024-26660, CVE-2023-52617, CVE-2024-26645, CVE-2023-52486,\nCVE-2023-52631, CVE-2023-52607, CVE-2023-52608, CVE-2024-26722,\nCVE-2024-26615, CVE-2023-52615, CVE-2024-26636, CVE-2023-52642,\nCVE-2023-52587, CVE-2024-26712, CVE-2024-26675, CVE-2023-52614,\nCVE-2024-26606, CVE-2024-26916, CVE-2024-26600, CVE-2024-26679,\nCVE-2024-26829, CVE-2024-26641, CVE-2023-52623, CVE-2024-26627,\nCVE-2024-26696, CVE-2024-26640, CVE-2024-26635, CVE-2023-52491,\nCVE-2024-26664, CVE-2024-26602, CVE-2023-52604, CVE-2024-26717,\nCVE-2023-52643, CVE-2024-26593, CVE-2023-52598, CVE-2024-26668,\nCVE-2023-52435, CVE-2023-52597, CVE-2024-26715, CVE-2024-26707,\nCVE-2023-52635, CVE-2024-26695, CVE-2024-26698, CVE-2023-52494,\nCVE-2024-26920, CVE-2024-26808, CVE-2023-52616, CVE-2023-52492,\nCVE-2024-26702, CVE-2024-26644, CVE-2023-52489, CVE-2024-26697)\n","status":"published","published":"2024-05-20T13:05:13Z","modified":"2026-10-29T20:02:33.345781548Z","updated_at":"2026-11-02T16:58:17.914523Z"},{"id":"USN-6767-1","title":"linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-iot, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4, linux-xilinx-zynqmp vulnerabilities","description":"\nChenyuan Yang discovered that the RDS Protocol implementation in the Linux\nkernel contained an out-of-bounds read vulnerability. An attacker could use\nthis to possibly cause a denial of service (system crash). (CVE-2024-23849)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - PowerPC architecture;\n  - S390 architecture;\n  - Block layer subsystem;\n  - Android drivers;\n  - Hardware random number generator core;\n  - GPU drivers;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - IIO Magnetometer sensors drivers;\n  - InfiniBand drivers;\n  - Network drivers;\n  - PCI driver for MicroSemi Switchtec;\n  - PHY drivers;\n  - Ceph distributed file system;\n  - Ext4 file system;\n  - JFS file system;\n  - NILFS2 file system;\n  - Pstore file system;\n  - Core kernel;\n  - Memory management;\n  - CAN network layer;\n  - Networking core;\n  - IPv4 networking;\n  - Logical Link layer;\n  - Netfilter;\n  - NFC subsystem;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - Realtek audio codecs;\n(CVE-2024-26696, CVE-2023-52583, CVE-2024-26720, CVE-2023-52615,\nCVE-2023-52599, CVE-2023-52587, CVE-2024-26635, CVE-2024-26704,\nCVE-2024-26625, CVE-2024-26825, CVE-2023-52622, CVE-2023-52435,\nCVE-2023-52617, CVE-2023-52598, CVE-2024-26645, CVE-2023-52619,\nCVE-2024-26593, CVE-2024-26685, CVE-2023-52602, CVE-2023-52486,\nCVE-2024-26697, CVE-2024-26675, CVE-2024-26600, CVE-2023-52604,\nCVE-2024-26664, CVE-2024-26606, CVE-2023-52594, CVE-2024-26671,\nCVE-2024-26598, CVE-2024-26673, CVE-2024-26920, CVE-2024-26722,\nCVE-2023-52601, CVE-2024-26602, CVE-2023-52637, CVE-2023-52623,\nCVE-2024-26702, CVE-2023-52597, CVE-2024-26684, CVE-2023-52606,\nCVE-2024-26679, CVE-2024-26663, CVE-2024-26910, CVE-2024-26615,\nCVE-2023-52595, CVE-2023-52607, CVE-2024-26636)\n","status":"published","published":"2024-05-07T19:36:29Z","modified":"2026-10-22T23:20:42.378176063Z","updated_at":"2026-11-02T16:58:17.914523Z"},{"id":"USN-6767-2","title":"linux-bluefield vulnerabilities","description":"Chenyuan Yang discovered that the RDS Protocol implementation in the Linux\nkernel contained an out-of-bounds read vulnerability. An attacker could use\nthis to possibly cause a denial of service (system crash). (CVE-2024-23849)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - PowerPC architecture;\n  - S390 architecture;\n  - Block layer subsystem;\n  - Android drivers;\n  - Hardware random number generator core;\n  - GPU drivers;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - IIO Magnetometer sensors drivers;\n  - InfiniBand drivers;\n  - Network drivers;\n  - PCI driver for MicroSemi Switchtec;\n  - PHY drivers;\n  - Ceph distributed file system;\n  - Ext4 file system;\n  - JFS file system;\n  - NILFS2 file system;\n  - Pstore file system;\n  - Core kernel;\n  - Memory management;\n  - CAN network layer;\n  - Networking core;\n  - IPv4 networking;\n  - Logical Link layer;\n  - Netfilter;\n  - NFC subsystem;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - Realtek audio codecs;\n(CVE-2024-26696, CVE-2023-52583, CVE-2024-26720, CVE-2023-52615,\nCVE-2023-52599, CVE-2023-52587, CVE-2024-26635, CVE-2024-26704,\nCVE-2024-26625, CVE-2024-26825, CVE-2023-52622, CVE-2023-52435,\nCVE-2023-52617, CVE-2023-52598, CVE-2024-26645, CVE-2023-52619,\nCVE-2024-26593, CVE-2024-26685, CVE-2023-52602, CVE-2023-52486,\nCVE-2024-26697, CVE-2024-26675, CVE-2024-26600, CVE-2023-52604,\nCVE-2024-26664, CVE-2024-26606, CVE-2023-52594, CVE-2024-26671,\nCVE-2024-26598, CVE-2024-26673, CVE-2024-26920, CVE-2024-26722,\nCVE-2023-52601, CVE-2024-26602, CVE-2023-52637, CVE-2023-52623,\nCVE-2024-26702, CVE-2023-52597, CVE-2024-26684, CVE-2023-52606,\nCVE-2024-26679, CVE-2024-26663, CVE-2024-26910, CVE-2024-26615,\nCVE-2023-52595, CVE-2023-52607, CVE-2024-26636)\n","status":"published","published":"2024-05-14T09:00:08Z","modified":"2026-10-22T23:19:13.071604436Z","updated_at":"2026-11-02T16:58:17.914523Z"},{"id":"USN-6795-1","title":"linux-intel-iotg vulnerabilities","description":"Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux\nkernel contained a race condition during device removal, leading to a use-\nafter-free vulnerability. A physically proximate attacker could possibly\nuse this to cause a denial of service (system crash). (CVE-2023-47233)\n\nIt was discovered that the Open vSwitch implementation in the Linux kernel\ncould overflow its stack during recursive action operations under certain\nconditions. A local attacker could use this to cause a denial of service\n(system crash). (CVE-2024-1151)\n\nSander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida\ndiscovered that the Linux kernel mitigations for the initial Branch History\nInjection vulnerability (CVE-2022-0001) were insufficient for Intel\nprocessors. A local attacker could potentially use this to expose sensitive\ninformation. (CVE-2024-2201)\n\nChenyuan Yang discovered that the RDS Protocol implementation in the Linux\nkernel contained an out-of-bounds read vulnerability. An attacker could use\nthis to possibly cause a denial of service (system crash). (CVE-2024-23849)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - PowerPC architecture;\n  - S390 architecture;\n  - Core kernel;\n  - Block layer subsystem;\n  - Android drivers;\n  - Power management core;\n  - Bus devices;\n  - Hardware random number generator core;\n  - Cryptographic API;\n  - Device frequency;\n  - DMA engine subsystem;\n  - ARM SCMI message protocol;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - IIO ADC drivers;\n  - IIO subsystem;\n  - IIO Magnetometer sensors drivers;\n  - InfiniBand drivers;\n  - Media drivers;\n  - Network drivers;\n  - PCI driver for MicroSemi Switchtec;\n  - PHY drivers;\n  - SCSI drivers;\n  - DesignWare USB3 driver;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - JFS file system;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - Pstore file system;\n  - SMB network file system;\n  - Memory management;\n  - CAN network layer;\n  - Networking core;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - Logical Link layer;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - Unix domain sockets;\n  - Tomoyo security module;\n  - Realtek audio codecs;\n(CVE-2023-52616, CVE-2024-26679, CVE-2024-26608, CVE-2023-52594,\nCVE-2024-26622, CVE-2023-52643, CVE-2024-26594, CVE-2023-52598,\nCVE-2023-52627, CVE-2023-52491, CVE-2024-26592, CVE-2024-26717,\nCVE-2023-52638, CVE-2024-26704, CVE-2023-52637, CVE-2024-26645,\nCVE-2023-52602, CVE-2024-26722, CVE-2024-26671, CVE-2023-52599,\nCVE-2024-26720, CVE-2023-52631, CVE-2023-52486, CVE-2024-26640,\nCVE-2023-52606, CVE-2023-52633, CVE-2024-26593, CVE-2024-26664,\nCVE-2023-52618, CVE-2024-26625, CVE-2023-52604, CVE-2024-26695,\nCVE-2024-26644, CVE-2024-26826, CVE-2024-26600, CVE-2024-26808,\nCVE-2023-52619, CVE-2023-52597, CVE-2024-26602, CVE-2024-26635,\nCVE-2023-52623, CVE-2024-26665, CVE-2024-26916, CVE-2024-26689,\nCVE-2023-52635, CVE-2024-26712, CVE-2023-52614, CVE-2024-26606,\nCVE-2024-26610, CVE-2024-26675, CVE-2023-52617, CVE-2024-26697,\nCVE-2023-52595, CVE-2023-52494, CVE-2024-26641, CVE-2024-26698,\nCVE-2024-26707, CVE-2024-26673, CVE-2023-52493, CVE-2024-26676,\nCVE-2024-26910, CVE-2023-52601, CVE-2024-26660, CVE-2023-52608,\nCVE-2024-26615, CVE-2023-52587, CVE-2024-26825, CVE-2023-52498,\nCVE-2023-52492, CVE-2024-26668, CVE-2024-26715, CVE-2024-26685,\nCVE-2024-26702, CVE-2024-26663, CVE-2024-26636, CVE-2024-26627,\nCVE-2024-26696, CVE-2023-52583, CVE-2023-52642, CVE-2023-52489,\nCVE-2024-26614, CVE-2024-26829, CVE-2024-26684, CVE-2023-52615,\nCVE-2023-52435, CVE-2023-52530, CVE-2023-52607, CVE-2024-26920,\nCVE-2023-52622, CVE-2023-52588)\n","status":"published","published":"2024-05-28T19:06:59Z","modified":"2026-10-29T20:02:32.661195287Z","updated_at":"2026-11-02T16:58:17.914523Z"},{"id":"USN-6828-1","title":"linux-intel-iotg-5.15 vulnerabilities","description":"Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux\nkernel contained a race condition during device removal, leading to a use-\nafter-free vulnerability. A physically proximate attacker could possibly\nuse this to cause a denial of service (system crash). (CVE-2023-47233)\n\nIt was discovered that the ATA over Ethernet (AoE) driver in the Linux\nkernel contained a race condition, leading to a use-after-free\nvulnerability. An attacker could use this to cause a denial of service or\npossibly execute arbitrary code. (CVE-2023-6270)\n\nIt was discovered that the Atheros 802.11ac wireless driver did not\nproperly validate certain data structures, leading to a NULL pointer\ndereference. An attacker could possibly use this to cause a denial of\nservice. (CVE-2023-7042)\n\nIt was discovered that the HugeTLB file system component of the Linux\nKernel contained a NULL pointer dereference vulnerability. A privileged\nattacker could possibly use this to to cause a denial of service.\n(CVE-2024-0841)\n\nIt was discovered that the Open vSwitch implementation in the Linux kernel\ncould overflow its stack during recursive action operations under certain\nconditions. A local attacker could use this to cause a denial of service\n(system crash). (CVE-2024-1151)\n\nSander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida\ndiscovered that the Linux kernel mitigations for the initial Branch History\nInjection vulnerability (CVE-2022-0001) were insufficient for Intel\nprocessors. A local attacker could potentially use this to expose sensitive\ninformation. (CVE-2024-2201)\n\nYuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux\nKernel contained a race condition, leading to a NULL pointer dereference.\nAn attacker could possibly use this to cause a denial of service (system\ncrash). (CVE-2024-22099)\n\nChenyuan Yang discovered that the RDS Protocol implementation in the Linux\nkernel contained an out-of-bounds read vulnerability. An attacker could use\nthis to possibly cause a denial of service (system crash). (CVE-2024-23849)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM32 architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - Core kernel;\n  - x86 architecture;\n  - Block layer subsystem;\n  - ACPI drivers;\n  - Android drivers;\n  - Power management core;\n  - Bus devices;\n  - Hardware random number generator core;\n  - Clock framework and drivers;\n  - CPU frequency scaling framework;\n  - Cryptographic API;\n  - Device frequency scaling framework;\n  - DMA engine subsystem;\n  - ARM SCMI message protocol;\n  - EFI core;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - IIO ADC drivers;\n  - IIO subsystem;\n  - IIO Magnetometer sensors drivers;\n  - InfiniBand drivers;\n  - IOMMU subsystem;\n  - Multiple devices driver;\n  - Media drivers;\n  - MMC subsystem;\n  - Network drivers;\n  - NTB driver;\n  - NVME drivers;\n  - PCI subsystem;\n  - PCI driver for MicroSemi Switchtec;\n  - PHY drivers;\n  - MediaTek PM domains;\n  - Power supply drivers;\n  - SCSI drivers;\n  - SPI subsystem;\n  - Media staging drivers;\n  - TCM subsystem;\n  - USB subsystem;\n  - DesignWare USB3 driver;\n  - Framebuffer layer;\n  - AFS file system;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EROFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - JFS file system;\n  - Network file system client;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - Pstore file system;\n  - Diskquota system;\n  - SMB network file system;\n  - BPF subsystem;\n  - Memory management;\n  - Netfilter;\n  - TLS protocol;\n  - io_uring subsystem;\n  - Bluetooth subsystem;\n  - Ethernet bridge;\n  - CAN network layer;\n  - Networking core;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - L2TP protocol;\n  - Logical Link layer;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netlink;\n  - NET/ROM layer;\n  - NFC subsystem;\n  - Packet sockets;\n  - RDS protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - Unix domain sockets;\n  - Wireless networking;\n  - Tomoyo security module;\n  - Realtek audio codecs;\n  - USB sound devices;\n(CVE-2024-26910, CVE-2024-27074, CVE-2023-52494, CVE-2023-52594,\nCVE-2024-26915, CVE-2024-26766, CVE-2023-52489, CVE-2024-35845,\nCVE-2024-26846, CVE-2024-26898, CVE-2024-26897, CVE-2024-26826,\nCVE-2024-26798, CVE-2023-52662, CVE-2024-26856, CVE-2023-52608,\nCVE-2024-26782, CVE-2024-27047, CVE-2024-27390, CVE-2024-26610,\nCVE-2024-26804, CVE-2023-52638, CVE-2024-26771, CVE-2024-26752,\nCVE-2024-26585, CVE-2024-26645, CVE-2024-26715, CVE-2024-27028,\nCVE-2024-26809, CVE-2024-26880, CVE-2024-27432, CVE-2024-27065,\nCVE-2024-26717, CVE-2023-52616, CVE-2024-26748, CVE-2024-26795,\nCVE-2024-26671, CVE-2024-26743, CVE-2024-27412, CVE-2024-26802,\nCVE-2024-26733, CVE-2024-26736, CVE-2023-52618, CVE-2024-27046,\nCVE-2024-26688, CVE-2024-26679, CVE-2024-26769, CVE-2024-27051,\nCVE-2024-26603, CVE-2024-26744, CVE-2023-52434, CVE-2024-26697,\nCVE-2024-27075, CVE-2023-52583, CVE-2024-26583, CVE-2024-27403,\nCVE-2024-26907, CVE-2024-26636, CVE-2024-27410, CVE-2023-52530,\nCVE-2024-26840, CVE-2024-26851, CVE-2024-26862, CVE-2023-52640,\nCVE-2024-35829, CVE-2024-26906, CVE-2024-26777, CVE-2024-27419,\nCVE-2024-26664, CVE-2024-26627, CVE-2024-26859, CVE-2023-52486,\nCVE-2023-52652, CVE-2024-26835, CVE-2024-35844, CVE-2024-26702,\nCVE-2024-26635, CVE-2024-26704, CVE-2023-52633, CVE-2024-26816,\nCVE-2024-26894, CVE-2024-26778, CVE-2023-52599, CVE-2024-35828,\nCVE-2024-26776, CVE-2023-52493, CVE-2024-26845, CVE-2024-26594,\nCVE-2024-26885, CVE-2024-26829, CVE-2023-52645, CVE-2024-26695,\nCVE-2023-52615, CVE-2024-26651, CVE-2024-26843, CVE-2023-52606,\nCVE-2024-26675, CVE-2024-26874, CVE-2024-26883, CVE-2024-26772,\nCVE-2024-26673, CVE-2024-26737, CVE-2023-52631, CVE-2024-26640,\nCVE-2023-52598, CVE-2024-26735, CVE-2024-26895, CVE-2024-26592,\nCVE-2023-52492, CVE-2024-26861, CVE-2023-52644, CVE-2024-26920,\nCVE-2024-26877, CVE-2024-26863, CVE-2024-26720, CVE-2024-26722,\nCVE-2024-27045, CVE-2024-27038, CVE-2024-26763, CVE-2024-26833,\nCVE-2024-27417, CVE-2024-26916, CVE-2024-26857, CVE-2024-26875,\nCVE-2024-26606, CVE-2024-27024, CVE-2024-26615, CVE-2023-52614,\nCVE-2023-52641, CVE-2024-26600, CVE-2024-27043, CVE-2023-52635,\nCVE-2024-26787, CVE-2024-26622, CVE-2024-27413, CVE-2024-26791,\nCVE-2023-52622, CVE-2023-52491, CVE-2023-52604, CVE-2024-27037,\nCVE-2024-26881, CVE-2024-26754, CVE-2024-26659, CVE-2024-26663,\nCVE-2024-26747, CVE-2023-52602, CVE-2024-26712, CVE-2024-26839,\nCVE-2024-26749, CVE-2024-26764, CVE-2024-26820, CVE-2024-26882,\nCVE-2024-27039, CVE-2024-27078, CVE-2024-26889, CVE-2024-26870,\nCVE-2024-26788, CVE-2024-26602, CVE-2024-26903, CVE-2024-27044,\nCVE-2024-27073, CVE-2023-52601, CVE-2023-52595, CVE-2024-26707,\nCVE-2024-27415, CVE-2023-52637, CVE-2024-26660, CVE-2024-27414,\nCVE-2024-27054, CVE-2023-52497, CVE-2024-26801, CVE-2023-52435,\nCVE-2023-52620, CVE-2023-52627, CVE-2024-26698, CVE-2023-52597,\nCVE-2024-27077, CVE-2023-52650, CVE-2024-26750, CVE-2024-26852,\nCVE-2024-27053, CVE-2023-52656, CVE-2024-26625, CVE-2024-26779,\nCVE-2024-27431, CVE-2024-26751, CVE-2024-26684, CVE-2024-26803,\nCVE-2024-26593, CVE-2023-52642, CVE-2023-52447, CVE-2024-26790,\nCVE-2024-26825, CVE-2024-26668, CVE-2023-52607, CVE-2024-26872,\nCVE-2024-27030, CVE-2023-52643, CVE-2024-26901, CVE-2024-35830,\nCVE-2024-26855, CVE-2023-52588, CVE-2023-52587, CVE-2024-26891,\nCVE-2024-26644, CVE-2024-26884, CVE-2024-26793, CVE-2024-26805,\nCVE-2024-26584, CVE-2024-27405, CVE-2023-52623, CVE-2024-26608,\nCVE-2024-26878, CVE-2024-27388, CVE-2024-27416, CVE-2024-26685,\nCVE-2024-27034, CVE-2024-26879, CVE-2024-26614, CVE-2024-26792,\nCVE-2023-52617, CVE-2024-26773, CVE-2024-26665, CVE-2024-26641,\nCVE-2023-52619, CVE-2024-35811, CVE-2024-27052, CVE-2024-27076,\nCVE-2024-26838, CVE-2024-26808, CVE-2024-26696, CVE-2024-26676,\nCVE-2024-26689, CVE-2024-26774, CVE-2024-26601, CVE-2023-52498,\nCVE-2024-27436)\n","status":"published","published":"2024-06-11T17:45:43Z","modified":"2026-10-29T20:02:33.692909025Z","updated_at":"2026-11-02T16:58:17.914523Z"},{"id":"USN-6895-1","title":"linux, linux-gcp, linux-nvidia-6.5, linux-raspi vulnerabilities","description":"\nIt was discovered that the ATA over Ethernet (AoE) driver in the Linux\nkernel contained a race condition, leading to a use-after-free\nvulnerability. An attacker could use this to cause a denial of service or\npossibly execute arbitrary code. (CVE-2023-6270)\n\nIt was discovered that the HugeTLB file system component of the Linux\nKernel contained a NULL pointer dereference vulnerability. A privileged\nattacker could possibly use this to to cause a denial of service.\n(CVE-2024-0841)\n\nIt was discovered that the Open vSwitch implementation in the Linux kernel\ncould overflow its stack during recursive action operations under certain\nconditions. A local attacker could use this to cause a denial of service\n(system crash). (CVE-2024-1151)\n\nGui-Dong Han discovered that the software RAID driver in the Linux kernel\ncontained a race condition, leading to an integer overflow vulnerability. A\nprivileged attacker could possibly use this to cause a denial of service\n(system crash). (CVE-2024-23307)\n\nBai Jiaju discovered that the Xceive XC4000 silicon tuner device driver in\nthe Linux kernel contained a race condition, leading to an integer overflow\nvulnerability. An attacker could possibly use this to cause a denial of\nservice (system crash). (CVE-2024-24861)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - PowerPC architecture;\n  - x86 architecture;\n  - Cryptographic API;\n  - Android drivers;\n  - Block layer subsystem;\n  - Bluetooth drivers;\n  - DMA engine subsystem;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - IIO ADC drivers;\n  - IIO subsystem;\n  - IIO Magnetometer sensors drivers;\n  - InfiniBand drivers;\n  - On-Chip Interconnect management framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - Network drivers;\n  - PHY drivers;\n  - MediaTek PM domains;\n  - SCSI drivers;\n  - TTY drivers;\n  - USB subsystem;\n  - DesignWare USB3 driver;\n  - Framebuffer layer;\n  - AFS file system;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - Ext4 file system;\n  - File systems infrastructure;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - SMB network file system;\n  - Core kernel;\n  - Memory management;\n  - Bluetooth subsystem;\n  - CAN network layer;\n  - Devlink API;\n  - Handshake API;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - RxRPC session sockets;\n  - TIPC protocol;\n  - Unix domain sockets;\n  - Realtek audio codecs;\n(CVE-2024-26822, CVE-2024-26917, CVE-2024-26723, CVE-2024-26715,\nCVE-2024-26718, CVE-2024-26664, CVE-2024-26707, CVE-2024-26697,\nCVE-2024-26720, CVE-2024-26660, CVE-2024-26677, CVE-2024-26736,\nCVE-2024-26719, CVE-2024-26642, CVE-2024-26700, CVE-2024-26666,\nCVE-2024-26684, CVE-2024-26803, CVE-2024-26698, CVE-2024-26711,\nCVE-2024-26922, CVE-2024-26828, CVE-2024-26910, CVE-2024-26829,\nCVE-2024-26685, CVE-2024-26920, CVE-2024-26696, CVE-2024-26826,\nCVE-2023-52642, CVE-2024-26703, CVE-2024-26708, CVE-2024-26838,\nCVE-2024-26716, CVE-2023-52631, CVE-2024-26782, CVE-2024-26593,\nCVE-2024-26659, CVE-2024-26825, CVE-2024-26824, CVE-2024-26712,\nCVE-2024-26674, CVE-2024-26722, CVE-2023-52643, CVE-2024-26714,\nCVE-2024-26691, CVE-2024-27416, CVE-2024-26830, CVE-2023-52880,\nCVE-2024-26702, CVE-2023-52645, CVE-2024-26820, CVE-2024-26662,\nCVE-2024-26689, CVE-2024-26676, CVE-2024-26923, CVE-2024-26603,\nCVE-2024-26818, CVE-2023-52638, CVE-2024-26733, CVE-2024-26601,\nCVE-2024-26790, CVE-2024-26661, CVE-2024-26600, CVE-2024-26680,\nCVE-2024-26748, CVE-2024-26792, CVE-2024-26889, CVE-2024-26681,\nCVE-2024-26688, CVE-2024-26665, CVE-2024-26602, CVE-2024-26734,\nCVE-2024-35833, CVE-2024-26919, CVE-2024-26916, CVE-2024-26667,\nCVE-2024-26606, CVE-2024-26693, CVE-2024-26717, CVE-2023-52637,\nCVE-2024-26831, CVE-2024-26663, CVE-2024-26694, CVE-2024-26802,\nCVE-2024-26710, CVE-2024-26789, CVE-2024-26679, CVE-2024-26675,\nCVE-2024-26798, CVE-2024-26695, CVE-2024-26726, CVE-2024-26926,\nCVE-2024-26735, CVE-2024-26898, CVE-2024-26890)\n","status":"published","published":"2024-07-12T10:02:16Z","modified":"2026-10-23T10:33:05.968932948Z","updated_at":"2026-11-02T16:58:17.914523Z"},{"id":"USN-6895-2","title":"linux-azure-6.5, linux-gcp-6.5 vulnerabilities","description":"\nIt was discovered that the ATA over Ethernet (AoE) driver in the Linux\nkernel contained a race condition, leading to a use-after-free\nvulnerability. An attacker could use this to cause a denial of service or\npossibly execute arbitrary code. (CVE-2023-6270)\n\nIt was discovered that the HugeTLB file system component of the Linux\nKernel contained a NULL pointer dereference vulnerability. A privileged\nattacker could possibly use this to to cause a denial of service.\n(CVE-2024-0841)\n\nIt was discovered that the Open vSwitch implementation in the Linux kernel\ncould overflow its stack during recursive action operations under certain\nconditions. A local attacker could use this to cause a denial of service\n(system crash). (CVE-2024-1151)\n\nGui-Dong Han discovered that the software RAID driver in the Linux kernel\ncontained a race condition, leading to an integer overflow vulnerability. A\nprivileged attacker could possibly use this to cause a denial of service\n(system crash). (CVE-2024-23307)\n\nBai Jiaju discovered that the Xceive XC4000 silicon tuner device driver in\nthe Linux kernel contained a race condition, leading to an integer overflow\nvulnerability. An attacker could possibly use this to cause a denial of\nservice (system crash). (CVE-2024-24861)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - PowerPC architecture;\n  - x86 architecture;\n  - Cryptographic API;\n  - Android drivers;\n  - Block layer subsystem;\n  - Bluetooth drivers;\n  - DMA engine subsystem;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - IIO ADC drivers;\n  - IIO subsystem;\n  - IIO Magnetometer sensors drivers;\n  - InfiniBand drivers;\n  - On-Chip Interconnect management framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - Network drivers;\n  - PHY drivers;\n  - MediaTek PM domains;\n  - SCSI drivers;\n  - TTY drivers;\n  - USB subsystem;\n  - DesignWare USB3 driver;\n  - Framebuffer layer;\n  - AFS file system;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - Ext4 file system;\n  - File systems infrastructure;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - SMB network file system;\n  - Core kernel;\n  - Memory management;\n  - Bluetooth subsystem;\n  - CAN network layer;\n  - Devlink API;\n  - Handshake API;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - RxRPC session sockets;\n  - TIPC protocol;\n  - Unix domain sockets;\n  - Realtek audio codecs;\n(CVE-2024-26684, CVE-2024-26889, CVE-2024-26662, CVE-2024-26660,\nCVE-2024-26708, CVE-2024-26677, CVE-2024-26696, CVE-2024-26664,\nCVE-2024-26642, CVE-2023-52637, CVE-2024-26680, CVE-2024-26822,\nCVE-2023-52638, CVE-2024-26830, CVE-2024-26715, CVE-2024-26693,\nCVE-2024-26697, CVE-2024-26694, CVE-2024-26685, CVE-2023-52642,\nCVE-2024-26691, CVE-2024-26798, CVE-2024-26828, CVE-2024-26663,\nCVE-2024-26710, CVE-2024-26601, CVE-2024-26707, CVE-2024-26802,\nCVE-2024-26675, CVE-2024-26826, CVE-2024-26916, CVE-2024-26803,\nCVE-2024-26700, CVE-2024-26917, CVE-2024-26600, CVE-2024-26825,\nCVE-2024-26716, CVE-2024-26602, CVE-2024-26698, CVE-2024-26711,\nCVE-2024-26920, CVE-2024-26722, CVE-2024-26681, CVE-2024-26674,\nCVE-2024-26712, CVE-2024-26735, CVE-2024-26782, CVE-2024-26734,\nCVE-2024-26926, CVE-2024-26923, CVE-2023-52880, CVE-2024-26719,\nCVE-2024-26593, CVE-2024-26603, CVE-2024-26922, CVE-2024-26717,\nCVE-2024-26695, CVE-2023-52643, CVE-2024-35833, CVE-2024-26733,\nCVE-2024-26667, CVE-2024-26659, CVE-2024-26714, CVE-2024-26748,\nCVE-2024-26702, CVE-2024-26676, CVE-2024-26718, CVE-2024-27416,\nCVE-2024-26890, CVE-2024-26720, CVE-2024-26838, CVE-2024-26665,\nCVE-2024-26792, CVE-2024-26818, CVE-2024-26679, CVE-2024-26606,\nCVE-2024-26736, CVE-2024-26829, CVE-2023-52631, CVE-2024-26790,\nCVE-2024-26824, CVE-2024-26820, CVE-2024-26831, CVE-2024-26689,\nCVE-2024-26898, CVE-2024-26789, CVE-2024-26703, CVE-2023-52645,\nCVE-2024-26688, CVE-2024-26723, CVE-2024-26919, CVE-2024-26661,\nCVE-2024-26726, CVE-2024-26910, CVE-2024-26666)\n","status":"published","published":"2024-07-16T10:12:28Z","modified":"2026-10-23T10:33:16.143449627Z","updated_at":"2026-11-02T16:58:17.914523Z"},{"id":"USN-6895-3","title":"linux-aws-6.5, linux-lowlatency-hwe-6.5, linux-oracle-6.5, linux-starfive-6.5 vulnerabilities","description":"\nIt was discovered that the ATA over Ethernet (AoE) driver in the Linux\nkernel contained a race condition, leading to a use-after-free\nvulnerability. An attacker could use this to cause a denial of service or\npossibly execute arbitrary code. (CVE-2023-6270)\n\nIt was discovered that the HugeTLB file system component of the Linux\nKernel contained a NULL pointer dereference vulnerability. A privileged\nattacker could possibly use this to to cause a denial of service.\n(CVE-2024-0841)\n\nIt was discovered that the Open vSwitch implementation in the Linux kernel\ncould overflow its stack during recursive action operations under certain\nconditions. A local attacker could use this to cause a denial of service\n(system crash). (CVE-2024-1151)\n\nGui-Dong Han discovered that the software RAID driver in the Linux kernel\ncontained a race condition, leading to an integer overflow vulnerability. A\nprivileged attacker could possibly use this to cause a denial of service\n(system crash). (CVE-2024-23307)\n\nBai Jiaju discovered that the Xceive XC4000 silicon tuner device driver in\nthe Linux kernel contained a race condition, leading to an integer overflow\nvulnerability. An attacker could possibly use this to cause a denial of\nservice (system crash). (CVE-2024-24861)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - PowerPC architecture;\n  - x86 architecture;\n  - Cryptographic API;\n  - Android drivers;\n  - Block layer subsystem;\n  - Bluetooth drivers;\n  - DMA engine subsystem;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - IIO ADC drivers;\n  - IIO subsystem;\n  - IIO Magnetometer sensors drivers;\n  - InfiniBand drivers;\n  - On-Chip Interconnect management framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - Network drivers;\n  - PHY drivers;\n  - MediaTek PM domains;\n  - SCSI drivers;\n  - TTY drivers;\n  - USB subsystem;\n  - DesignWare USB3 driver;\n  - Framebuffer layer;\n  - AFS file system;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - Ext4 file system;\n  - File systems infrastructure;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - SMB network file system;\n  - Core kernel;\n  - Memory management;\n  - Bluetooth subsystem;\n  - CAN network layer;\n  - Devlink API;\n  - Handshake API;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - RxRPC session sockets;\n  - TIPC protocol;\n  - Unix domain sockets;\n  - Realtek audio codecs;\n(CVE-2024-26922, CVE-2024-26691, CVE-2024-26698, CVE-2024-26696,\nCVE-2024-26688, CVE-2024-26734, CVE-2024-26660, CVE-2024-26736,\nCVE-2024-26600, CVE-2024-26826, CVE-2024-26890, CVE-2023-52643,\nCVE-2024-26917, CVE-2024-26676, CVE-2024-26916, CVE-2024-26919,\nCVE-2024-26662, CVE-2024-26714, CVE-2023-52880, CVE-2024-26679,\nCVE-2024-26711, CVE-2024-26707, CVE-2024-26735, CVE-2023-52631,\nCVE-2024-26694, CVE-2023-52637, CVE-2024-26830, CVE-2024-26675,\nCVE-2024-26715, CVE-2024-26642, CVE-2024-26659, CVE-2024-26838,\nCVE-2024-26926, CVE-2024-26684, CVE-2024-26716, CVE-2024-26825,\nCVE-2024-26664, CVE-2024-26666, CVE-2024-26820, CVE-2024-26680,\nCVE-2024-26681, CVE-2024-26829, CVE-2024-26748, CVE-2024-26920,\nCVE-2024-26593, CVE-2024-26831, CVE-2024-26703, CVE-2024-35833,\nCVE-2024-26697, CVE-2023-52638, CVE-2024-26665, CVE-2024-26603,\nCVE-2024-26602, CVE-2024-26824, CVE-2024-26710, CVE-2024-26828,\nCVE-2024-26790, CVE-2024-26722, CVE-2024-26803, CVE-2024-26798,\nCVE-2024-27416, CVE-2024-26661, CVE-2024-26677, CVE-2024-26720,\nCVE-2024-26695, CVE-2024-26726, CVE-2024-26723, CVE-2024-26889,\nCVE-2024-26702, CVE-2024-26606, CVE-2024-26792, CVE-2024-26733,\nCVE-2024-26782, CVE-2024-26923, CVE-2023-52645, CVE-2024-26700,\nCVE-2024-26898, CVE-2024-26822, CVE-2024-26712, CVE-2023-52642,\nCVE-2024-26601, CVE-2024-26667, CVE-2024-26910, CVE-2024-26818,\nCVE-2024-26689, CVE-2024-26708, CVE-2024-26663, CVE-2024-26802,\nCVE-2024-26717, CVE-2024-26719, CVE-2024-26718, CVE-2024-26685,\nCVE-2024-26789, CVE-2024-26693, CVE-2024-26674)\n","status":"published","published":"2024-07-19T09:04:56Z","modified":"2026-10-23T10:33:27.123894253Z","updated_at":"2026-11-02T16:58:17.914523Z"},{"id":"USN-6895-4","title":"linux-oem-6.5 vulnerabilities","description":"\nIt was discovered that the ATA over Ethernet (AoE) driver in the Linux\nkernel contained a race condition, leading to a use-after-free\nvulnerability. An attacker could use this to cause a denial of service or\npossibly execute arbitrary code. (CVE-2023-6270)\n\nIt was discovered that the HugeTLB file system component of the Linux\nKernel contained a NULL pointer dereference vulnerability. A privileged\nattacker could possibly use this to to cause a denial of service.\n(CVE-2024-0841)\n\nIt was discovered that the Open vSwitch implementation in the Linux kernel\ncould overflow its stack during recursive action operations under certain\nconditions. A local attacker could use this to cause a denial of service\n(system crash). (CVE-2024-1151)\n\nGui-Dong Han discovered that the software RAID driver in the Linux kernel\ncontained a race condition, leading to an integer overflow vulnerability. A\nprivileged attacker could possibly use this to cause a denial of service\n(system crash). (CVE-2024-23307)\n\nBai Jiaju discovered that the Xceive XC4000 silicon tuner device driver in\nthe Linux kernel contained a race condition, leading to an integer overflow\nvulnerability. An attacker could possibly use this to cause a denial of\nservice (system crash). (CVE-2024-24861)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - PowerPC architecture;\n  - x86 architecture;\n  - Cryptographic API;\n  - Android drivers;\n  - Block layer subsystem;\n  - Bluetooth drivers;\n  - DMA engine subsystem;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - IIO ADC drivers;\n  - IIO subsystem;\n  - IIO Magnetometer sensors drivers;\n  - InfiniBand drivers;\n  - On-Chip Interconnect management framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - Network drivers;\n  - PHY drivers;\n  - MediaTek PM domains;\n  - SCSI drivers;\n  - TTY drivers;\n  - USB subsystem;\n  - DesignWare USB3 driver;\n  - Framebuffer layer;\n  - AFS file system;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - Ext4 file system;\n  - File systems infrastructure;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - SMB network file system;\n  - Core kernel;\n  - Memory management;\n  - Bluetooth subsystem;\n  - CAN network layer;\n  - Devlink API;\n  - Handshake API;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - RxRPC session sockets;\n  - TIPC protocol;\n  - Unix domain sockets;\n  - Realtek audio codecs;\n(CVE-2023-52638, CVE-2024-26684, CVE-2024-26659, CVE-2024-26708,\nCVE-2024-26663, CVE-2024-26662, CVE-2024-26789, CVE-2024-26831,\nCVE-2024-26703, CVE-2023-52643, CVE-2024-26688, CVE-2024-26733,\nCVE-2024-26818, CVE-2024-26707, CVE-2024-26820, CVE-2024-26719,\nCVE-2024-26726, CVE-2024-26830, CVE-2024-26694, CVE-2024-26715,\nCVE-2024-26829, CVE-2024-26697, CVE-2024-26916, CVE-2024-26735,\nCVE-2024-26717, CVE-2024-26748, CVE-2024-26696, CVE-2024-26710,\nCVE-2024-26642, CVE-2024-26680, CVE-2024-26675, CVE-2024-26723,\nCVE-2024-26718, CVE-2024-26666, CVE-2024-26720, CVE-2024-26838,\nCVE-2024-26824, CVE-2024-26676, CVE-2024-26665, CVE-2024-26693,\nCVE-2024-26698, CVE-2024-26890, CVE-2024-26601, CVE-2024-26826,\nCVE-2024-26711, CVE-2024-26602, CVE-2023-52645, CVE-2024-26716,\nCVE-2024-26660, CVE-2023-52642, CVE-2024-26898, CVE-2024-26803,\nCVE-2024-26923, CVE-2024-26722, CVE-2024-26677, CVE-2024-26825,\nCVE-2024-26606, CVE-2024-26790, CVE-2024-26828, CVE-2024-26910,\nCVE-2024-26681, CVE-2024-26689, CVE-2024-26667, CVE-2024-26798,\nCVE-2024-26679, CVE-2023-52631, CVE-2024-26926, CVE-2024-26661,\nCVE-2024-26700, CVE-2023-52637, CVE-2024-26919, CVE-2024-26917,\nCVE-2024-26712, CVE-2024-26889, CVE-2024-26674, CVE-2024-26792,\nCVE-2024-35833, CVE-2024-26822, CVE-2024-26734, CVE-2024-26691,\nCVE-2024-26685, CVE-2024-26782, CVE-2024-26702, CVE-2024-26600,\nCVE-2024-26922, CVE-2024-26593, CVE-2024-26736, CVE-2024-26920,\nCVE-2024-26603, CVE-2024-26714, CVE-2024-27416, CVE-2024-26695,\nCVE-2023-52880, CVE-2024-26664, CVE-2024-26802)\n","status":"published","published":"2024-08-02T09:36:04Z","modified":"2026-10-23T10:33:05.563853487Z","updated_at":"2026-11-02T16:58:17.914523Z"},{"id":"USN-6900-1","title":"linux-hwe-6.5 vulnerabilities","description":"\nIt was discovered that the ATA over Ethernet (AoE) driver in the Linux\nkernel contained a race condition, leading to a use-after-free\nvulnerability. An attacker could use this to cause a denial of service or\npossibly execute arbitrary code. (CVE-2023-6270)\n\nIt was discovered that the HugeTLB file system component of the Linux\nKernel contained a NULL pointer dereference vulnerability. A privileged\nattacker could possibly use this to to cause a denial of service.\n(CVE-2024-0841)\n\nIt was discovered that the Open vSwitch implementation in the Linux kernel\ncould overflow its stack during recursive action operations under certain\nconditions. A local attacker could use this to cause a denial of service\n(system crash). (CVE-2024-1151)\n\nGui-Dong Han discovered that the software RAID driver in the Linux kernel\ncontained a race condition, leading to an integer overflow vulnerability. A\nprivileged attacker could possibly use this to cause a denial of service\n(system crash). (CVE-2024-23307)\n\nBai Jiaju discovered that the Xceive XC4000 silicon tuner device driver in\nthe Linux kernel contained a race condition, leading to an integer overflow\nvulnerability. An attacker could possibly use this to cause a denial of\nservice (system crash). (CVE-2024-24861)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - PowerPC architecture;\n  - x86 architecture;\n  - Cryptographic API;\n  - Android drivers;\n  - Block layer subsystem;\n  - Bluetooth drivers;\n  - DMA engine subsystem;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - IIO ADC drivers;\n  - IIO subsystem;\n  - IIO Magnetometer sensors drivers;\n  - InfiniBand drivers;\n  - On-Chip Interconnect management framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - Network drivers;\n  - PHY drivers;\n  - MediaTek PM domains;\n  - SCSI drivers;\n  - TTY drivers;\n  - USB subsystem;\n  - DesignWare USB3 driver;\n  - Framebuffer layer;\n  - AFS file system;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - Ext4 file system;\n  - File systems infrastructure;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - SMB network file system;\n  - Core kernel;\n  - Memory management;\n  - Bluetooth subsystem;\n  - CAN network layer;\n  - Devlink API;\n  - Handshake API;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - RxRPC session sockets;\n  - TIPC protocol;\n  - Unix domain sockets;\n  - Realtek audio codecs;\n(CVE-2024-26666, CVE-2024-26691, CVE-2024-26681, CVE-2024-26715,\nCVE-2024-26674, CVE-2024-26790, CVE-2024-26677, CVE-2024-26675,\nCVE-2024-26696, CVE-2024-26925, CVE-2024-26782, CVE-2024-26798,\nCVE-2024-26702, CVE-2024-35833, CVE-2024-26825, CVE-2024-26680,\nCVE-2024-26723, CVE-2024-26703, CVE-2024-26822, CVE-2024-26718,\nCVE-2024-26695, CVE-2024-26693, CVE-2024-26733, CVE-2024-26659,\nCVE-2023-52643, CVE-2024-26667, CVE-2024-26601, CVE-2024-26923,\nCVE-2024-26726, CVE-2024-26676, CVE-2024-26924, CVE-2024-26889,\nCVE-2024-26685, CVE-2024-26720, CVE-2024-26820, CVE-2024-26919,\nCVE-2024-26642, CVE-2024-26890, CVE-2023-52637, CVE-2024-26602,\nCVE-2024-26603, CVE-2023-52880, CVE-2024-26606, CVE-2024-26708,\nCVE-2024-26697, CVE-2024-26643, CVE-2024-26916, CVE-2024-26661,\nCVE-2024-26707, CVE-2024-26910, CVE-2024-27416, CVE-2024-26716,\nCVE-2023-52645, CVE-2024-26600, CVE-2023-52642, CVE-2023-52631,\nCVE-2024-26926, CVE-2024-26593, CVE-2024-26735, CVE-2024-26917,\nCVE-2024-26698, CVE-2024-26838, CVE-2024-26694, CVE-2024-26664,\nCVE-2024-26898, CVE-2024-26719, CVE-2024-26802, CVE-2024-26826,\nCVE-2024-26679, CVE-2024-26824, CVE-2024-26831, CVE-2024-26792,\nCVE-2024-26700, CVE-2024-26818, CVE-2024-26920, CVE-2024-26829,\nCVE-2024-26710, CVE-2023-52638, CVE-2024-26714, CVE-2024-26809,\nCVE-2024-26789, CVE-2024-26689, CVE-2024-26722, CVE-2024-26660,\nCVE-2024-26734, CVE-2024-26736, CVE-2024-26828, CVE-2024-26717,\nCVE-2024-26830, CVE-2024-26711, CVE-2024-26665, CVE-2024-26662,\nCVE-2024-26748, CVE-2024-26688, CVE-2024-26712, CVE-2024-26922,\nCVE-2024-26684, CVE-2024-26663, CVE-2024-26803)\n","status":"published","published":"2024-07-17T15:48:31Z","modified":"2026-10-23T10:33:24.424530046Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}