{"id":"CVE-2024-43855","aliases":["AZL-47968","AZL-48003","BELL-CVE-2024-43855","DEBIAN-CVE-2024-43855","DLA-4008-1","EUVD-2024-40505","GHSA-5ffp-85mp-h2q2","MGASA-2024-0309","MGASA-2024-0310","OESA-2024-2124","OESA-2024-2255","OESA-2024-2257","OESA-2024-2258","RHSA-2025:3506","SUSE-SU-2024:3194-1","SUSE-SU-2024:3195-1","SUSE-SU-2024:3383-1","SUSE-SU-2025:20044-1","SUSE-SU-2025:20047-1","UBUNTU-CVE-2024-43855","USN-7089-1","USN-7089-2","USN-7089-3","USN-7089-4","USN-7089-5","USN-7089-6","USN-7089-7","USN-7090-1","USN-7095-1","USN-7156-1"],"status":"published","title":"md: fix deadlock between mddev_suspend and flush bio","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd: fix deadlock between mddev_suspend and flush bio\n\nDeadlock occurs when mddev is being suspended while some flush bio is in\nprogress. It is a complex issue.\n\nT1. the first flush is at the ending stage, it clears 'mddev-\u003eflush_bio'\n    and tries to submit data, but is blocked because mddev is suspended\n    by T4.\nT2. the second flush sets 'mddev-\u003eflush_bio', and attempts to queue\n    md_submit_flush_data(), which is already running (T1) and won't\n    execute again if on the same CPU as T1.\nT3. the third flush inc active_io and tries to flush, but is blocked because\n    'mddev-\u003eflush_bio' is not NULL (set by T2).\nT4. mddev_suspend() is called and waits for active_io dec to 0 which is inc\n    by T3.\n\n  T1\t\tT2\t\tT3\t\tT4\n  (flush 1)\t(flush 2)\t(third 3)\t(suspend)\n  md_submit_flush_data\n   mddev-\u003eflush_bio = NULL;\n   .\n   .\t \tmd_flush_request\n   .\t  \t mddev-\u003eflush_bio = bio\n   .\t  \t queue submit_flushes\n   .\t\t .\n   .\t\t .\t\tmd_handle_request\n   .\t\t .\t\t active_io + 1\n   .\t\t .\t\t md_flush_request\n   .\t\t .\t\t  wait !mddev-\u003eflush_bio\n   .\t\t .\n   .\t\t .\t\t\t\tmddev_suspend\n   .\t\t .\t\t\t\t wait !active_io\n   .\t\t .\n   .\t\t submit_flushes\n   .\t\t queue_work md_submit_flush_data\n   .\t\t //md_submit_flush_data is already running (T1)\n   .\n   md_handle_request\n    wait resume\n\nThe root issue is non-atomic inc/dec of active_io during flush process.\nactive_io is dec before md_submit_flush_data is queued, and inc soon\nafter md_submit_flush_data() run.\n  md_flush_request\n    active_io + 1\n    submit_flushes\n      active_io - 1\n      md_submit_flush_data\n        md_handle_request\n        active_io + 1\n          make_request\n        active_io - 1\n\nIf active_io is dec after md_handle_request() instead of within\nsubmit_flushes(), make_request() can be called directly intead of\nmd_handle_request() in md_submit_flush_data(), and active_io will\nonly inc and dec once in the whole flush process. Deadlock will be\nfixed.\n\nAdditionally, the only difference between fixing the issue and before is\nthat there is no return error handling of make_request(). But after\nprevious patch cleaned md_write_start(), make_requst() only return error\nin raid5_make_request() by dm-raid, see commit 41425f96d7aa (\"dm-raid456,\nmd/raid456: fix a deadlock for dm-raid456 while io concurrent with\nreshape)\". Since dm always splits data and flush operation into two\nseparate io, io size of flush submitted by dm always is 0, make_request()\nwill not be called in md_submit_flush_data(). To prevent future\nmodifications from introducing issues, add WARN_ON to ensure\nmake_request() no error is returned in this context.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00209,"percentile":0.11116,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2024-08-17T09:22:11Z","modified":"2026-11-02T12:03:14Z","fixes":[{"ecosystem":"Azure Linux:2","package":"kernel","fixed_in":["5.15.167.1-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"kernel","fixed_in":["6.6.47.1-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"linux-lts","fixed_in":["6.1.104-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"linux-lts","fixed_in":["6.12.41-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"linux-lts","fixed_in":["6.12.41-r0"],"sources":["osv"]},{"ecosystem":"Linux","package":"Kernel","fixed_in":["6.1.103","6.6.44","6.10.3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"linux","fixed_in":["6.1.106-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["6.10.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["6.10.3-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bpftool-debuginfo","fixed_in":["0:7.4.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-64k-debug-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-64k-debug-devel","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-64k-debug-devel-matched","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-64k-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-64k-devel","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-64k-devel-matched","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-debug-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-debug-devel","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-debug-devel-matched","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-debuginfo-common-aarch64","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-debuginfo-common-ppc64le","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-debuginfo-common-s390x","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-debuginfo-common-x86_64","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-devel","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-devel-matched","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-doc","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-rt-debug-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-rt-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-tools-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-zfcpdump-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-zfcpdump-devel","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-zfcpdump-devel-matched","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libperf-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"perf","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"perf-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-perf-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rtla","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rv","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bpftool","fixed_in":["0:7.4.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bpftool-debuginfo","fixed_in":["0:7.4.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-64k","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-64k-core","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-64k-debug","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-64k-debug-core","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-64k-debug-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-64k-debug-modules","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-64k-debug-modules-core","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-64k-debug-modules-extra","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-64k-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-64k-modules","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-64k-modules-core","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-64k-modules-extra","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-abi-stablelists","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-core","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-debug","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-debug-core","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-debug-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-debug-modules","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-debug-modules-core","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-debug-modules-extra","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-debug-uki-virt","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-debuginfo-common-aarch64","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-debuginfo-common-ppc64le","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-debuginfo-common-s390x","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-debuginfo-common-x86_64","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-modules","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-modules-core","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-modules-extra","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-rt-debug-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-rt-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-tools","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-tools-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-tools-libs","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-uki-virt","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-uki-virt-addons","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-zfcpdump","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-zfcpdump-core","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-zfcpdump-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-zfcpdump-modules","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-zfcpdump-modules-core","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-zfcpdump-modules-extra","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libperf-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"perf-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"python3-perf","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"python3-perf-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"bpftool-debuginfo","fixed_in":["0:7.4.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"kernel-64k-debug-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"kernel-64k-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"kernel-debug-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"kernel-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"kernel-debuginfo-common-aarch64","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"kernel-debuginfo-common-ppc64le","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"kernel-debuginfo-common-s390x","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"kernel-debuginfo-common-x86_64","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"kernel-rt-debug-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"kernel-rt-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"kernel-tools-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"kernel-tools-libs-devel","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"kernel-zfcpdump-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libperf","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libperf-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"perf-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"python3-perf-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"bpftool-debuginfo","fixed_in":["0:7.4.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-debug-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-debuginfo-common-x86_64","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-rt","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-rt-core","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-rt-debug","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-rt-debug-core","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-rt-debug-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-rt-debug-devel","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-rt-debug-kvm","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-rt-debug-modules","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-rt-debug-modules-core","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-rt-debug-modules-extra","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-rt-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-rt-devel","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-rt-kvm","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-rt-modules","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-rt-modules-core","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-rt-modules-extra","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-tools-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"libperf-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"perf-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"python3-perf-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"bpftool-debuginfo","fixed_in":["0:7.4.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"kernel-debug-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"kernel-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"kernel-debuginfo-common-x86_64","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"kernel-rt","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"kernel-rt-core","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"kernel-rt-debug","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"kernel-rt-debug-core","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"kernel-rt-debug-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"kernel-rt-debug-devel","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"kernel-rt-debug-modules","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"kernel-rt-debug-modules-core","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"kernel-rt-debug-modules-extra","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"kernel-rt-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"kernel-rt-devel","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"kernel-rt-modules","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"kernel-rt-modules-core","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"kernel-rt-modules-extra","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"kernel-tools-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"libperf-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"perf-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"python3-perf-debuginfo","fixed_in":["0:5.14.0-503.35.1.el9_5"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.8","fixed_in":["6.8.0-1018.19~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.8","fixed_in":["6.8.0-1017.20~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.8","fixed_in":["6.8.0-1017.19~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.8","fixed_in":["6.8.0-48.48~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.8","fixed_in":["6.8.0-48.48.3~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.8","fixed_in":["6.8.0-1017.19~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.8","fixed_in":["6.8.0-1015.15~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.8","fixed_in":["6.8.0-48.48.1~22.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux","fixed_in":["6.8.0-48.48"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws","fixed_in":["6.8.0-1018.20"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure","fixed_in":["6.8.0-1017.20"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp","fixed_in":["6.8.0-1017.19"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-gke","fixed_in":["6.8.0-1013.17"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-gkeop","fixed_in":["6.8.0-1002.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-ibm","fixed_in":["6.8.0-1015.15"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency","fixed_in":["6.8.0-48.48.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia","fixed_in":["6.8.0-1017.19"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-lowlatency","fixed_in":["6.8.0-1017.19.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.8","fixed_in":["6.8.0-1016.16"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle","fixed_in":["6.8.0-1015.16"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi","fixed_in":["6.8.0-1014.16"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv","fixed_in":["6.8.0-48.48.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-raspi-realtime","fixed_in":["6.8.0-2013.14"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime","fixed_in":["6.8.1-1011.11"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.167.1-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.47.1-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.99-r0"},{"fixed":"6.1.104-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.6.89-r0"},{"fixed":"6.12.41-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.6.100-r0"},{"fixed":"6.12.41-r0"}]}]},{"source":"osv","ecosystem":"Linux","package":"Kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.103"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.44"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.10.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.106-1"}]}],"versions":["6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.10.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.10.3-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"linux-6.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.119-1~deb11u1"}]}],"versions":["6.1.106-3~deb11u1","6.1.106-3~deb11u2","6.1.106-3~deb11u3","6.1.112-1~deb11u1"],"bundled":838},{"source":"osv","ecosystem":"Mageia:9","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.50-1.mga9"}]}],"bundled":172},{"source":"osv","ecosystem":"Mageia:9","package":"kmod-xtables-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.24-61.mga9"}]}],"bundled":172},{"source":"osv","ecosystem":"Mageia:9","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.20-53.mga9"}]}],"bundled":172},{"source":"osv","ecosystem":"Mageia:9","package":"kernel-linus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.50-1.mga9"}]}],"bundled":172},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.0-41.0.0.48.oe2403"}]}],"bundled":93},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-232.0.0.134.oe2203sp3"}]}],"bundled":46},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-136.97.0.178.oe2203sp1"}]}],"bundled":46},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-232.0.0.131.oe2203sp4"}]}],"bundled":72},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bpftool-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-64k-debug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-64k-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-64k-debug-devel-matched","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-64k-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-64k-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-64k-devel-matched","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-debug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-debug-devel-matched","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-debuginfo-common-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-debuginfo-common-ppc64le","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-debuginfo-common-s390x","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-debuginfo-common-x86_64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-devel-matched","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-rt-debug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-rt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-zfcpdump-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-zfcpdump-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"kernel-zfcpdump-devel-matched","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libperf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"perf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-perf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rtla","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bpftool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bpftool-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-64k","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-64k-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-64k-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-64k-debug-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-64k-debug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-64k-debug-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-64k-debug-modules-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-64k-debug-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-64k-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-64k-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-64k-modules-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-64k-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-abi-stablelists","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-debug-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-debug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-debug-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-debug-modules-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-debug-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-debug-uki-virt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-debuginfo-common-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-debuginfo-common-ppc64le","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-debuginfo-common-s390x","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-debuginfo-common-x86_64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-modules-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-rt-debug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-rt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-tools-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-uki-virt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-uki-virt-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-zfcpdump-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-zfcpdump-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-zfcpdump-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-zfcpdump-modules-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kernel-zfcpdump-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libperf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"perf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"python3-perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"python3-perf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"bpftool-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"kernel-64k-debug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"kernel-64k-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"kernel-debug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"kernel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"kernel-debuginfo-common-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"kernel-debuginfo-common-ppc64le","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"kernel-debuginfo-common-s390x","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"kernel-debuginfo-common-x86_64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"kernel-rt-debug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"kernel-rt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"kernel-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"kernel-tools-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"kernel-zfcpdump-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libperf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libperf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"perf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"python3-perf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"bpftool-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-debug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-debuginfo-common-x86_64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-rt-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-rt-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-rt-debug-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-rt-debug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-rt-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-rt-debug-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-rt-debug-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-rt-debug-modules-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-rt-debug-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-rt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-rt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-rt-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-rt-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-rt-modules-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-rt-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"kernel-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"libperf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"perf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::nfv","package":"python3-perf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"bpftool-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"kernel-debug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"kernel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"kernel-debuginfo-common-x86_64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"kernel-rt-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"kernel-rt-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"kernel-rt-debug-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"kernel-rt-debug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"kernel-rt-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"kernel-rt-debug-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"kernel-rt-debug-modules-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"kernel-rt-debug-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"kernel-rt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"kernel-rt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"kernel-rt-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"kernel-rt-modules-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"kernel-rt-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"kernel-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"libperf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"perf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::realtime","package":"python3-perf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.0-503.35.1.el9_5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.8.11.1"}]}],"bundled":394},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"kernel-source-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.8.11.1"}]}],"bundled":394},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"kernel-syms-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.8.11.1"}]}],"bundled":394},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.8.11.1"}]}],"bundled":394},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-source-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.8.11.1"}]}],"bundled":394},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-syms-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.8.11.1"}]}],"bundled":394},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6","package":"kernel-livepatch-SLE15-SP6-RT_Update_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150600.1.3.2"}]}],"bundled":393},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP6","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.10.8.3"}]}],"bundled":393},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP6","package":"kernel-rt_debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.10.8.3"}]}],"bundled":393},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP6","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.10.8.3"}]}],"bundled":393},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP6","package":"kernel-syms-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.10.8.1"}]}],"bundled":393},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.10.8.3"}]}],"bundled":393},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-rt_debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.10.8.3"}]}],"bundled":393},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.10.8.3"}]}],"bundled":393},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-syms-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.10.8.1"}]}],"bundled":393},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.22.1"}]}],"bundled":394},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.22.1"}]}],"bundled":394},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.22.1.150600.12.8.3"}]}],"bundled":394},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.22.1"}]}],"bundled":394},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.22.1"}]}],"bundled":394},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.22.1"}]}],"bundled":394},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.22.1"}]}],"bundled":394},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.22.1"}]}],"bundled":394},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.22.1"}]}],"bundled":394},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.22.1"}]}],"bundled":394},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.22.1"}]}],"bundled":394},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6","package":"kernel-livepatch-SLE15-SP6_Update_4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150600.13.3.3"}]}],"bundled":394},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.22.1"}]}],"bundled":394},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.22.1"}]}],"bundled":394},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"dtb-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.22.1"}]}],"bundled":394},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.22.1"}]}],"bundled":394},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.22.1"}]}],"bundled":394},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.22.1"}]}],"bundled":394},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.22.1.150600.12.8.3"}]}],"bundled":394},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.22.1"}]}],"bundled":394},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.22.1"}]}],"bundled":394},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.22.1"}]}],"bundled":394},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.22.1"}]}],"bundled":394},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.22.1"}]}],"bundled":394},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.22.1"}]}],"bundled":394},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.22.1"}]}],"bundled":394},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-19.1"}]}],"bundled":383},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-17.1.1.51"}]}],"bundled":383},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-19.1"}]}],"bundled":383},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-livepatch-MICRO-6-0_Update_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-1.1"}]}],"bundled":383},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-19.1"}]}],"bundled":383},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-livepatch-MICRO-6-0-RT_Update_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-1.1"}]}],"bundled":383},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-10.1"}]}],"bundled":383},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-10.1"}]}],"bundled":383},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.0-28.30~16.04.1","4.8.0-30.32~16.04.1","4.8.0-32.34~16.04.1","4.8.0-34.36~16.04.1","4.10.0-14.16~16.04.1","4.10.0-19.21~16.04.1","4.10.0-20.22~16.04.1","4.10.0-21.23~16.04.1","4.10.0-22.24~16.04.1","4.10.0-24.28~16.04.1","4.10.0-26.30~16.04.1","4.11.0-13.19~16.04.1","4.11.0-14.20~16.04.1","4.13.0-16.19~16.04.3","4.13.0-17.20~16.04.1","4.13.0-19.22~16.04.1","4.13.0-21.24~16.04.1","4.13.0-25.29~16.04.2","4.15.0-13.14~16.04.1","4.15.0-15.16~16.04.1","4.15.0-20.21~16.04.1","4.15.0-22.24~16.04.1","4.15.0-23.25~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1021.24~18.04.1","5.0.0-1022.25~18.04.1","5.0.0-1023.26~18.04.1","5.0.0-1024.27~18.04.1","5.0.0-1025.28","5.0.0-1027.30"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1019.21~18.04.1","5.3.0-1023.25~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.2","5.3.0-1033.35","5.3.0-1034.36","5.3.0-1035.37"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1012.12","4.15.0-1013.13","4.15.0-1014.14","4.15.0-1018.18","4.15.0-1019.19","4.15.0-1021.21","4.15.0-1022.23","4.15.0-1023.24","4.15.0-1025.26","4.15.0-1028.29","4.15.0-1030.31","4.15.0-1031.32","4.15.0-1032.33","4.15.0-1035.36","4.15.0-1036.38","4.15.0-1037.39","4.18.0-1011.11~18.04.1","4.18.0-1013.13~18.04.1","4.18.0-1014.14~18.04.1","4.18.0-1018.18~18.04.1","4.18.0-1019.19~18.04.1","4.18.0-1020.20~18.04.1","4.18.0-1023.24~18.04.1","4.18.0-1024.25~18.04.1","4.18.0-1025.27~18.04.1","5.0.0-1014.14~18.04.1","5.0.0-1016.17~18.04.1","5.0.0-1018.19~18.04.1","5.0.0-1020.21~18.04.1","5.0.0-1022.23~18.04.1","5.0.0-1023.24~18.04.1","5.0.0-1025.27~18.04.1","5.0.0-1027.29~18.04.1","5.0.0-1028.30~18.04.1","5.0.0-1029.31~18.04.1","5.0.0-1031.33","5.0.0-1032.34","5.0.0-1035.37","5.0.0-1036.38"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8~18.04.1","5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1019.20~18.04.1","5.3.0-1020.21~18.04.1","5.3.0-1022.23~18.04.1","5.3.0-1028.29~18.04.1","5.3.0-1031.32~18.04.1","5.3.0-1032.33~18.04.1","5.3.0-1034.35~18.04.1","5.3.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-1006.6~18.04.1","4.18.0-1007.7~18.04.1","4.18.0-1008.8~18.04.1","5.0.0-1012.12~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1014.14","4.15.0-1015.15","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1019.20","4.15.0-1021.22","4.15.0-1023.24","4.15.0-1024.25","4.15.0-1025.26","4.15.0-1026.27","4.15.0-1027.28","4.15.0-1028.29","4.15.0-1029.31","4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1042.45","4.15.0-1044.70","5.0.0-1020.20~18.04.1","5.0.0-1021.21~18.04.1","5.0.0-1025.26~18.04.1","5.0.0-1026.27~18.04.1","5.0.0-1028.29~18.04.1","5.0.0-1029.30~18.04.1","5.0.0-1031.32","5.0.0-1033.34","5.0.0-1034.35"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1020.22~18.04.1","5.3.0-1026.28~18.04.1","5.3.0-1029.31~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-4.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1041.43","4.15.0-1042.44","4.15.0-1044.46","4.15.0-1045.48","4.15.0-1046.49","4.15.0-1048.51","4.15.0-1049.52","4.15.0-1050.53","4.15.0-1052.55","4.15.0-1055.58","4.15.0-1057.60","4.15.0-1058.61","4.15.0-1059.62","4.15.0-1063.66","4.15.0-1064.67","4.15.0-1066.69","4.15.0-1067.70","4.15.0-1069.72","4.15.0-1070.73","4.15.0-1072.76","4.15.0-1073.78","4.15.0-1074.79","4.15.0-1076.81","4.15.0-1077.82","4.15.0-1078.83","4.15.0-1079.84"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1025.25~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.31~18.04.1","5.4.0-1030.32~18.04.1","5.4.0-1032.34~18.04.1","5.4.0-1033.35~18.04.1","5.4.0-1035.37~18.04.1","5.4.0-1036.38~18.04.1","5.4.0-1037.39~18.04.1","5.4.0-1039.41~18.04.1","5.4.0-1040.42~18.04.1","5.4.0-1042.44~18.04.1","5.4.0-1043.45~18.04.1","5.4.0-1044.46~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1","5.4.0-1052.55~18.04.1","5.4.0-1053.56~18.04.1","5.4.0-1054.57~18.04.1","5.4.0-1055.58~18.04.1","5.4.0-1056.59~18.04.1","5.4.0-1057.60~18.04.1","5.4.0-1059.62~18.04.1","5.4.0-1061.64~18.04.1","5.4.0-1062.65~18.04.1","5.4.0-1063.66~18.04.1","5.4.0-1065.68~18.04.1","5.4.0-1066.69~18.04.1","5.4.0-1067.70~18.04.1","5.4.0-1068.71~18.04.1","5.4.0-1071.76~18.04.3","5.4.0-1072.77~18.04.1","5.4.0-1074.79~18.04.1","5.4.0-1076.82~18.04.1","5.4.0-1078.84~18.04.1","5.4.0-1080.86~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gkeop-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1001.1","5.4.0-1003.3","5.4.0-1004.5","5.4.0-1005.6","5.4.0-1007.8~18.04.1","5.4.0-1008.9~18.04.1","5.4.0-1009.10~18.04.1","5.4.0-1010.11~18.04.1","5.4.0-1011.12~18.04.2","5.4.0-1012.13~18.04.1","5.4.0-1013.14~18.04.1","5.4.0-1014.15~18.04.1","5.4.0-1015.16~18.04.1","5.4.0-1016.17~18.04.1","5.4.0-1018.19~18.04.1","5.4.0-1021.22~18.04.1","5.4.0-1022.23~18.04.1","5.4.0-1023.24~18.04.1","5.4.0-1024.25~18.04.1","5.4.0-1025.26~18.04.1","5.4.0-1026.27~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.30~18.04.2","5.4.0-1031.32~18.04.1","5.4.0-1032.33~18.04.1","5.4.0-1033.34~18.04.1","5.4.0-1034.35~18.04.1","5.4.0-1036.37~18.04.1","5.4.0-1037.38~18.04.1","5.4.0-1038.39~18.04.1","5.4.0-1039.40~18.04.1","5.4.0-1040.41~18.04.1","5.4.0-1043.44~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1048.51~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-13.14~18.04.1","4.18.0-14.15~18.04.1","4.18.0-15.16~18.04.1","4.18.0-16.17~18.04.1","4.18.0-17.18~18.04.1","4.18.0-18.19~18.04.1","4.18.0-20.21~18.04.1","4.18.0-21.22~18.04.1","4.18.0-22.23~18.04.1","4.18.0-24.25~18.04.1","4.18.0-25.26~18.04.1","5.0.0-23.24~18.04.1","5.0.0-25.26~18.04.1","5.0.0-27.28~18.04.1","5.0.0-29.31~18.04.1","5.0.0-31.33~18.04.1","5.0.0-32.34~18.04.2","5.0.0-35.38~18.04.1","5.0.0-36.39~18.04.1","5.0.0-37.40~18.04.1","5.3.0-26.28~18.04.1","5.3.0-28.30~18.04.1","5.3.0-40.32~18.04.1","5.3.0-42.34~18.04.1","5.3.0-45.37~18.04.1","5.3.0-46.38~18.04.1","5.3.0-51.44~18.04.2","5.3.0-53.47~18.04.1","5.3.0-59.53~18.04.1","5.3.0-61.55~18.04.1","5.3.0-62.56~18.04.1","5.3.0-64.58~18.04.1","5.3.0-65.59","5.3.0-66.60","5.3.0-67.61","5.3.0-68.63","5.3.0-69.65","5.3.0-70.66","5.3.0-72.68","5.3.0-73.69","5.3.0-74.70","5.3.0-75.71","5.3.0-76.72"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.3","4.15.0-1004.5","4.15.0-1006.9","4.15.0-1008.11","4.15.0-1009.12","4.15.0-1012.15","4.15.0-1013.16","4.15.0-1015.18","4.15.0-1017.20","4.15.0-1018.21","4.15.0-1021.24","4.15.0-1024.29","4.15.0-1026.31","4.15.0-1028.33","4.15.0-1030.35","4.15.0-1033.38","4.15.0-1034.39","4.15.0-1035.40","4.15.0-1036.41","4.15.0-1038.43","4.15.0-1039.44","4.15.0-1043.48","4.15.0-1045.50","4.15.0-1050.57","4.15.0-1056.65","4.15.0-1057.66","4.15.0-1059.68","4.15.0-1063.72","4.15.0-1064.73","4.15.0-1065.75","4.15.0-1066.76","4.15.0-1067.77","4.15.0-1069.79","4.15.0-1073.83","4.15.0-1076.86","4.15.0-1079.89","4.15.0-1080.90","4.15.0-1081.91","4.15.0-1087.97","4.15.0-1090.100","4.15.0-1091.101","4.15.0-1093.103","4.15.0-1094.104","4.15.0-1096.106","4.15.0-1097.107","4.15.0-1099.109","4.15.0-1100.110","4.15.0-1101.112","4.15.0-1102.113","4.15.0-1103.114"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1007.12~18.04.1","5.0.0-1008.13~18.04.1","5.0.0-1009.14~18.04.1","5.0.0-1010.15~18.04.1","5.0.0-1011.16","5.0.0-1013.18","5.0.0-1014.19"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1011.12~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.18~18.04.1","5.3.0-1018.20~18.04.1","5.3.0-1024.26~18.04.1","5.3.0-1027.29~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.9~20.04.2","5.11.0-1014.15~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.2","5.11.0-1021.22~20.04.2","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.2","5.13.0-1011.12~20.04.1","5.13.0-1012.13~20.04.1","5.13.0-1014.15~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1019.21~20.04.1","5.13.0-1021.23~20.04.2","5.13.0-1022.24~20.04.1","5.13.0-1023.25~20.04.1","5.13.0-1025.27~20.04.1","5.13.0-1028.31~20.04.1","5.13.0-1029.32~20.04.1","5.13.0-1031.35~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1041.43~20.04.1","5.8.0-1042.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1007.7~20.04.2","5.11.0-1012.13~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10~20.04.2","5.13.0-1012.14~20.04.1","5.13.0-1013.15~20.04.1","5.13.0-1014.16~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1021.24~20.04.1","5.13.0-1022.26~20.04.1","5.13.0-1023.27~20.04.1","5.13.0-1025.29~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1029.34~20.04.1","5.13.0-1031.37~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1033.35~20.04.1","5.8.0-1036.38~20.04.1","5.8.0-1039.42~20.04.1","5.8.0-1040.43~20.04.1","5.8.0-1041.44~20.04.1","5.8.0-1042.45~20.04.1","5.8.0-1043.46~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1063.66+cvm2.2","5.4.0-1063.66+cvm3.2","5.4.0-1064.67+cvm1.1","5.4.0-1065.68+cvm2.1","5.4.0-1067.70+cvm1.1","5.4.0-1068.71+cvm1.1","5.4.0-1069.72+cvm1.1","5.4.0-1070.73+cvm1.1","5.4.0-1072.75+cvm1.1","5.4.0-1073.76+cvm1.1","5.4.0-1074.77+cvm1.1","5.4.0-1076.79+cvm1.1","5.4.0-1078.81+cvm1.1","5.4.0-1080.83+cvm1.1","5.4.0-1083.87+cvm1.1","5.4.0-1085.90+cvm1.1","5.4.0-1085.90+cvm2.1","5.4.0-1086.91+cvm1.1","5.4.0-1089.94+cvm1.2","5.4.0-1090.95+cvm1.1","5.4.0-1091.96+cvm1.1","5.4.0-1092.97+cvm1.1","5.4.0-1095.101+cvm1.1","5.4.0-1098.104+cvm1.1","5.4.0-1100.106+cvm1.1","5.4.0-1103.109+cvm1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.10~20.04.1","5.11.0-1014.16~20.04.1","5.11.0-1017.19~20.04.1","5.11.0-1018.20~20.04.2","5.11.0-1020.22~20.04.1","5.11.0-1021.23~20.04.1","5.11.0-1022.24~20.04.1","5.11.0-1023.25~20.04.1","5.11.0-1024.26~20.04.1","5.11.0-1026.29~20.04.1","5.11.0-1028.32~20.04.1","5.11.0-1029.33~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.3","5.13.0-1012.15~20.04.1","5.13.0-1013.16~20.04.1","5.13.0-1015.18~20.04.1","5.13.0-1019.23~20.04.1","5.13.0-1021.25~20.04.1","5.13.0-1023.28~20.04.1","5.13.0-1024.29~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1030.36~20.04.1","5.13.0-1031.37~20.04.1","5.13.0-1033.40~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1032.34~20.04.1","5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1039.41"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1033.35","5.4.0-1035.37","5.4.0-1036.38","5.4.0-1037.39","5.4.0-1039.41","5.4.0-1041.43","5.4.0-1042.44","5.4.0-1043.45","5.4.0-1044.46","5.4.0-1046.48","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1074.79","5.4.0-1076.82","5.4.0-1078.84","5.4.0-1080.86","5.4.0-1081.87","5.4.0-1083.89","5.4.0-1084.90","5.4.0-1086.93","5.4.0-1087.94","5.4.0-1090.97","5.4.0-1091.98","5.4.0-1094.101","5.4.0-1095.102","5.4.0-1096.103","5.4.0-1097.104","5.4.0-1098.105","5.4.0-1099.106","5.4.0-1100.107","5.4.0-1101.108","5.4.0-1102.109","5.4.0-1103.110","5.4.0-1104.111","5.4.0-1105.112"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1011.14~20.04.1","5.15.0-1014.17~20.04.1","5.15.0-1015.18~20.04.1","5.15.0-1016.19~20.04.1","5.15.0-1019.23~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1023.28~20.04.2","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1029.34~20.04.1","5.15.0-1031.36~20.04.1","5.15.0-1032.37~20.04.1","5.15.0-1033.38~20.04.1","5.15.0-1034.39~20.04.1","5.15.0-1036.41~20.04.1","5.15.0-1037.42~20.04.1","5.15.0-1038.43~20.04.1","5.15.0-1039.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-22.23~20.04.1","5.11.0-25.27~20.04.1","5.11.0-27.29~20.04.1","5.11.0-34.36~20.04.1","5.11.0-36.40~20.04.1","5.11.0-37.41~20.04.2","5.11.0-38.42~20.04.1","5.11.0-40.44~20.04.2","5.11.0-41.45~20.04.1","5.11.0-43.47~20.04.2","5.11.0-44.48~20.04.2","5.11.0-46.51~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-21.21~20.04.1","5.13.0-22.22~20.04.1","5.13.0-23.23~20.04.2","5.13.0-25.26~20.04.1","5.13.0-27.29~20.04.1","5.13.0-28.31~20.04.1","5.13.0-30.33~20.04.1","5.13.0-35.40~20.04.1","5.13.0-37.42~20.04.1","5.13.0-39.44~20.04.1","5.13.0-40.45~20.04.1","5.13.0-41.46~20.04.1","5.13.0-44.49~20.04.1","5.13.0-48.54~20.04.1","5.13.0-51.58~20.04.1","5.13.0-52.59~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-23.24~20.04.1","5.8.0-25.26~20.04.1","5.8.0-28.30~20.04.1","5.8.0-29.31~20.04.1","5.8.0-31.33~20.04.1","5.8.0-33.36~20.04.1","5.8.0-34.37~20.04.2","5.8.0-36.40~20.04.1","5.8.0-38.43~20.04.1","5.8.0-40.45~20.04.1","5.8.0-41.46~20.04.1","5.8.0-43.49~20.04.1","5.8.0-44.50~20.04.1","5.8.0-45.51~20.04.1","5.8.0-48.54~20.04.1","5.8.0-49.55~20.04.1","5.8.0-50.56~20.04.1","5.8.0-53.60~20.04.1","5.8.0-55.62~20.04.1","5.8.0-59.66~20.04.1","5.8.0-63.71~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-intel-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1007.7","5.13.0-1008.8","5.13.0-1009.9","5.13.0-1010.10","5.13.0-1011.11","5.13.0-1014.15","5.13.0-1017.19"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.0-1008.9","5.10.0-1011.12","5.10.0-1013.14","5.10.0-1014.15","5.10.0-1016.17","5.10.0-1017.18","5.10.0-1019.20","5.10.0-1021.22","5.10.0-1022.23","5.10.0-1023.24","5.10.0-1025.26","5.10.0-1026.27","5.10.0-1029.30","5.10.0-1032.33","5.10.0-1033.34","5.10.0-1034.35","5.10.0-1038.40","5.10.0-1044.46","5.10.0-1045.47","5.10.0-1049.51","5.10.0-1050.52","5.10.0-1051.53","5.10.0-1052.54","5.10.0-1053.55","5.10.0-1055.58","5.10.0-1057.61"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10","5.13.0-1010.11","5.13.0-1012.16","5.13.0-1014.18","5.13.0-1017.21","5.13.0-1019.23","5.13.0-1020.24","5.13.0-1021.25","5.13.0-1022.26","5.13.0-1026.32","5.13.0-1028.35","5.13.0-1029.36"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.14.0-1004.4","5.14.0-1005.5","5.14.0-1007.7","5.14.0-1008.8","5.14.0-1010.10","5.14.0-1011.11","5.14.0-1013.13","5.14.0-1018.19","5.14.0-1020.22","5.14.0-1022.24","5.14.0-1024.26","5.14.0-1027.30","5.14.0-1029.32","5.14.0-1031.34","5.14.0-1032.35","5.14.0-1033.36","5.14.0-1034.37","5.14.0-1036.40","5.14.0-1038.42","5.14.0-1042.47","5.14.0-1044.49","5.14.0-1045.51","5.14.0-1046.53","5.14.0-1047.54","5.14.0-1048.55","5.14.0-1049.56","5.14.0-1050.57","5.14.0-1051.58","5.14.0-1052.59","5.14.0-1054.61","5.14.0-1055.62","5.14.0-1056.63","5.14.0-1057.64","5.14.0-1058.66","5.14.0-1059.67"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.0-1007.7","5.6.0-1008.8","5.6.0-1010.10","5.6.0-1011.11","5.6.0-1013.13","5.6.0-1017.17","5.6.0-1018.18","5.6.0-1020.20","5.6.0-1021.21","5.6.0-1023.23","5.6.0-1026.26","5.6.0-1027.27","5.6.0-1028.28","5.6.0-1031.32","5.6.0-1032.33","5.6.0-1033.35","5.6.0-1034.36","5.6.0-1035.37","5.6.0-1036.39","5.6.0-1039.43","5.6.0-1042.46","5.6.0-1047.51","5.6.0-1048.52","5.6.0-1050.54","5.6.0-1052.56","5.6.0-1053.57","5.6.0-1054.58","5.6.0-1055.59","5.6.0-1056.60"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1008.8~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1011.13~20.04.2","5.13.0-1015.19~20.04.1","5.13.0-1016.20~20.04.1","5.13.0-1018.22~20.04.1","5.13.0-1021.26~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1030.35~20.04.1","5.13.0-1033.39~20.04.1","5.13.0-1034.40~20.04.1","5.13.0-1036.43~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1031.32~20.04.2","5.8.0-1033.34~20.04.1","5.8.0-1034.35~20.04.2","5.8.0-1037.38~20.04.1","5.8.0-1038.39~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8","5.3.0-1014.16","5.3.0-1015.17","5.3.0-1017.19","5.4.0-1004.4","5.4.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-24.28","5.4.0-26.30","5.4.0-27.31","5.4.0-28.32","5.4.0-30.34","5.4.0-31.35","5.4.0-33.37","5.4.0-34.38","5.4.0-36.41","5.4.0-37.42","5.4.0-39.44","5.4.0-40.45"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1018.19~20.04.2","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1024.25~20.04.1","5.11.0-1026.28~20.04.1","5.11.0-1028.31~20.04.1","5.11.0-1029.32~20.04.1","5.11.0-1030.34","5.11.0-1031.35"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14.16~20.04.1","5.8.0-14.16~20.04.3","5.8.0-16.18~20.04.1","5.8.0-17.19~20.04.1","5.8.0-18.20~20.04.1","5.8.0-20.22~20.04.1","5.8.0-22.24~20.04.1","5.8.0-25.27~20.04.1","5.8.0-26.28~20.04.1","5.8.0-29.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-allwinner-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1007.7~22.04.1","5.19.0-1009.9~22.04.1","5.19.0-1010.10~22.04.1","5.19.0-1011.11~22.04.1","5.19.0-1012.12~22.04.1","5.19.0-1013.13~22.04.1","5.19.0-1014.14~22.04.1","5.19.0-1015.15~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1019.20~22.04.1","5.19.0-1020.21~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1026.27~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1029.30~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1008.8~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1012.12~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.2","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1022.22~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1018.19~22.04.1"}]}],"versions":["6.8.0-1009.9~22.04.2","6.8.0-1010.10~22.04.2","6.8.0-1011.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1","6.8.0-1016.17~22.04.2","6.8.0-1017.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.21~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1025.28~22.04.1","5.19.0-1026.29~22.04.1","5.19.0-1027.30~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1","6.2.0-1019.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.7~22.04.1","6.5.0-1009.9~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.19~22.04.2","6.5.0-1019.20~22.04.1","6.5.0-1021.22~22.04.1","6.5.0-1022.23~22.04.1","6.5.0-1023.24~22.04.1","6.5.0-1024.25~22.04.1","6.5.0-1025.26~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1017.20~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1012.14~22.04.1","6.8.0-1013.15~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1025.28~22.04.1.1","5.19.0-1026.29~22.04.1.1","5.19.0-1027.30~22.04.2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1.1","6.2.0-1009.9~22.04.3.1","6.2.0-1011.11~22.04.1.1","6.2.0-1012.12~22.04.1.1","6.2.0-1014.14~22.04.1.1","6.2.0-1015.15~22.04.1.1","6.2.0-1016.16~22.04.1.1","6.2.0-1017.17~22.04.1.1","6.2.0-1018.18~22.04.1.1","6.2.0-1019.19~22.04.1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.22~22.04.2","5.19.0-1021.23~22.04.1","5.19.0-1022.24~22.04.1","5.19.0-1024.26~22.04.1","5.19.0-1025.27~22.04.1","5.19.0-1026.28~22.04.1","5.19.0-1027.29~22.04.1","5.19.0-1030.32~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1011.11~22.04.3","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1016.18~22.04.1","6.2.0-1017.19~22.04.1","6.2.0-1018.20~22.04.1","6.2.0-1019.21~22.04.1","6.2.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1010.10~22.04.3","6.5.0-1011.11~22.04.1","6.5.0-1013.13~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1022.24~22.04.1","6.5.0-1023.25~22.04.1","6.5.0-1024.26~22.04.1","6.5.0-1025.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1017.19~22.04.1"}]}],"versions":["6.8.0-1010.11~22.04.1","6.8.0-1011.12~22.04.1","6.8.0-1012.13~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.1","6.8.0-1016.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-28.29~22.04.1","5.19.0-32.33~22.04.1","5.19.0-35.36~22.04.1","5.19.0-38.39~22.04.1","5.19.0-40.41~22.04.1","5.19.0-41.42~22.04.1","5.19.0-42.43~22.04.1","5.19.0-43.44~22.04.1","5.19.0-45.46~22.04.1","5.19.0-46.47~22.04.1","5.19.0-50.50"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-25.25~22.04.2","6.2.0-26.26~22.04.1","6.2.0-31.31~22.04.1","6.2.0-32.32~22.04.1","6.2.0-33.33~22.04.1","6.2.0-34.34~22.04.1","6.2.0-35.35~22.04.1","6.2.0-36.37~22.04.1","6.2.0-37.38~22.04.1","6.2.0-39.40~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14~22.04.1","6.5.0-15.15~22.04.1","6.5.0-17.17~22.04.1","6.5.0-18.18~22.04.1","6.5.0-21.21~22.04.1","6.5.0-25.25~22.04.1","6.5.0-26.26~22.04.1","6.5.0-27.28~22.04.1","6.5.0-28.29~22.04.1","6.5.0-35.35~22.04.1","6.5.0-41.41~22.04.2","6.5.0-44.44~22.04.1","6.5.0-45.45~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-48.48~22.04.1"}]}],"versions":["6.8.0-38.38~22.04.1","6.8.0-39.39~22.04.1","6.8.0-40.40~22.04.3","6.8.0-45.45~22.04.1","6.8.0-47.47~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-intel-iot-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1073.75"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1030.30"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14.1~22.04.1","6.5.0-15.15.1.1~22.04.1","6.5.0-17.17.1.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-41.41.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-44.44.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-48.48.3~22.04.1"}]}],"versions":["6.8.0-38.38.1~22.04.2","6.8.0-40.40.1~22.04.1","6.8.0-44.44.1~22.04.1","6.8.0-45.45.1~22.04.1","6.8.0-47.47.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1003.3~22.04.1","6.2.0-1009.9","6.2.0-1010.10","6.2.0-1011.11","6.2.0-1012.12","6.2.0-1013.13","6.2.0-1015.15"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1004.4","6.5.0-1007.7","6.5.0-1013.13","6.5.0-1014.14","6.5.0-1015.15","6.5.0-1018.18","6.5.0-1019.19","6.5.0-1021.22","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1017.19~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-5.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.17.0-1003.3","5.17.0-1004.4","5.17.0-1006.6","5.17.0-1011.12","5.17.0-1012.13","5.17.0-1013.14","5.17.0-1014.15","5.17.0-1015.16","5.17.0-1016.17","5.17.0-1017.18","5.17.0-1018.19","5.17.0-1019.20","5.17.0-1020.21","5.17.0-1021.22","5.17.0-1024.25","5.17.0-1025.26","5.17.0-1026.27","5.17.0-1027.28","5.17.0-1028.29","5.17.0-1029.30","5.17.0-1030.31","5.17.0-1031.32","5.17.0-1032.33","5.17.0-1033.34","5.17.0-1034.35","5.17.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.0-1006.6","6.0.0-1007.7","6.0.0-1008.8","6.0.0-1009.9","6.0.0-1010.10","6.0.0-1011.11","6.0.0-1012.12","6.0.0-1013.13","6.0.0-1014.14","6.0.0-1015.15","6.0.0-1016.16","6.0.0-1017.17","6.0.0-1018.18","6.0.0-1019.19","6.0.0-1020.20","6.0.0-1021.21"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.0-1004.4","6.1.0-1006.6","6.1.0-1007.7","6.1.0-1008.8","6.1.0-1009.9","6.1.0-1010.10","6.1.0-1012.12","6.1.0-1013.13","6.1.0-1014.14","6.1.0-1015.15","6.1.0-1016.16","6.1.0-1017.17","6.1.0-1019.19","6.1.0-1020.20","6.1.0-1021.21","6.1.0-1022.22","6.1.0-1023.23","6.1.0-1024.24","6.1.0-1025.25","6.1.0-1026.26","6.1.0-1027.27","6.1.0-1028.28","6.1.0-1029.29","6.1.0-1033.33","6.1.0-1034.34","6.1.0-1035.35","6.1.0-1036.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1003.3","6.5.0-1004.4","6.5.0-1006.6","6.5.0-1007.7","6.5.0-1008.8","6.5.0-1009.10","6.5.0-1011.12","6.5.0-1013.14","6.5.0-1014.15","6.5.0-1015.16","6.5.0-1016.17","6.5.0-1018.19","6.5.0-1019.20","6.5.0-1020.21","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25","6.5.0-1025.26","6.5.0-1027.28"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1013.13~22.04.4","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1019.19~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1","6.5.0-1025.25~22.04.1","6.5.0-1026.26~22.04.1","6.5.0-1027.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1015.15~22.04.1"}]}],"versions":["6.8.0-1006.6~22.04.3","6.8.0-1008.8~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.13~22.04.1","6.8.0-1014.14~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1032.35"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1011.12","5.15.0-1012.13","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1016.18","5.15.0-1017.19","5.15.0-1018.21","5.15.0-1019.22","5.15.0-1020.23","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1012.13~22.04.1","5.19.0-1015.16~22.04.1","5.19.0-1016.17~22.04.1","5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1","5.19.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-17.17.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-40.40.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-48.48.1~22.04.2"}]}],"versions":["6.8.0-38.38.1~22.04.1","6.8.0-39.39.1~22.04.1","6.8.0-40.40.1~22.04.1","6.8.0-41.41.1~22.04.1","6.8.0-44.44.1~22.04.1","6.8.0-47.47.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1014.16~22.04.1","5.19.0-1015.17~22.04.1","5.19.0-1016.18~22.04.1","5.19.0-1017.19~22.04.1","5.19.0-1018.20~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1006.7~22.04.1","6.2.0-1007.8~22.04.1","6.2.0-1009.10~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.8~22.04.1","6.5.0-1008.9~22.04.1","6.5.0-1009.10~22.04.1","6.5.0-1010.11~22.04.1","6.5.0-1011.12~22.04.1","6.5.0-1012.13~22.04.1","6.5.0-1014.15~22.04.1","6.5.0-1015.16~22.04.1","6.5.0-1016.17~22.04.1","6.5.0-1017.18~22.04.1","6.5.0-1018.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-48.48"}]}],"versions":["6.5.0-9.9","6.6.0-14.14","6.8.0-11.11","6.8.0-20.20","6.8.0-22.22","6.8.0-28.28","6.8.0-31.31","6.8.0-35.35","6.8.0-36.36","6.8.0-38.38","6.8.0-39.39","6.8.0-40.40","6.8.0-41.41","6.8.0-44.44","6.8.0-45.45","6.8.0-47.47"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1018.20"}]}],"versions":["6.5.0-1008.8","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1016.17","6.8.0-1017.18"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1017.20"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1012.14","6.8.0-1013.15","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1017.19"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1002.2","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.9","6.8.0-1009.10","6.8.0-1010.11","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1013.17"}]}],"versions":["6.8.0-1003.5","6.8.0-1004.7","6.8.0-1005.8","6.8.0-1006.9","6.8.0-1007.10","6.8.0-1008.11","6.8.0-1009.12","6.8.0-1010.13","6.8.0-1011.14","6.8.0-1012.15"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1002.4"}]}],"versions":["6.8.0-1001.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1015.15"}]}],"versions":["6.5.0-1009.9","6.8.0-1001.1","6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-48.48.3"}]}],"versions":["6.5.0-9.9.1","6.6.0-14.14.1","6.8.0-7.7.1","6.8.0-25.25.3","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-45.45.1","6.8.0-47.47.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1017.19"}]}],"versions":["6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1017.19.1"}]}],"versions":["6.8.0-1009.9.1","6.8.0-1011.11.1","6.8.0-1012.12.1","6.8.0-1013.14.1","6.8.0-1014.15.1","6.8.0-1015.16.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1016.16"}]}],"versions":["6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1015.16"}]}],"versions":["6.5.0-1010.10","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1014.16"}]}],"versions":["6.5.0-1005.7","6.7.0-1001.1","6.8.0-1001.1","6.8.0-1002.2","6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.10","6.8.0-1010.11","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-48.48.1"}]}],"versions":["6.5.0-9.9.1","6.8.0-20.20.1","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-47.47.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-2013.14"}]}],"versions":["6.7.0-2001.1","6.8.0-2001.1","6.8.0-2002.2","6.8.0-2004.4","6.8.0-2005.5","6.8.0-2006.6","6.8.0-2007.7","6.8.0-2008.8","6.8.0-2009.9","6.8.0-2010.10","6.8.0-2011.11","6.8.0-2012.12"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.1-1011.11"}]}],"versions":["6.8.0-1008.19","6.8.1-1001.1","6.8.1-1002.2","6.8.1-1003.3","6.8.1-1004.4","6.8.1-1005.5","6.8.1-1006.6","6.8.1-1007.7","6.8.1-1008.8","6.8.1-1009.9","6.8.1-1010.10"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1017.19~22.04.1"}]}],"versions":["6.8.0-1010.11~22.04.1","6.8.0-1011.12~22.04.1","6.8.0-1012.13~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.1","6.8.0-1016.18~22.04.1"],"bundled":196},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-48.48~22.04.1"}]}],"versions":["6.8.0-38.38~22.04.1","6.8.0-39.39~22.04.1","6.8.0-40.40~22.04.3","6.8.0-45.45~22.04.1","6.8.0-47.47~22.04.1"],"bundled":196},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-48.48"}]}],"versions":["6.5.0-9.9","6.6.0-14.14","6.8.0-11.11","6.8.0-20.20","6.8.0-22.22","6.8.0-28.28","6.8.0-31.31","6.8.0-35.35","6.8.0-36.36","6.8.0-38.38","6.8.0-39.39","6.8.0-40.40","6.8.0-41.41","6.8.0-44.44","6.8.0-45.45","6.8.0-47.47"],"bundled":196},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1017.20"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1012.14","6.8.0-1013.15","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18"],"bundled":196},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1017.19"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1002.2","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.9","6.8.0-1009.10","6.8.0-1010.11","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18"],"bundled":196},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1015.15"}]}],"versions":["6.5.0-1009.9","6.8.0-1001.1","6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14"],"bundled":196},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1018.19~22.04.1"}]}],"versions":["6.8.0-1009.9~22.04.2","6.8.0-1010.10~22.04.2","6.8.0-1011.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1","6.8.0-1016.17~22.04.2","6.8.0-1017.18~22.04.1"],"bundled":196},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1015.15~22.04.1"}]}],"versions":["6.8.0-1006.6~22.04.3","6.8.0-1008.8~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.13~22.04.1","6.8.0-1014.14~22.04.1"],"bundled":196},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1018.20"}]}],"versions":["6.5.0-1008.8","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1016.17","6.8.0-1017.18"],"bundled":196},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1015.16"}]}],"versions":["6.5.0-1010.10","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14"],"bundled":196},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1016.16"}]}],"versions":["6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14"],"bundled":196},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1014.16"}]}],"versions":["6.5.0-1005.7","6.7.0-1001.1","6.8.0-1001.1","6.8.0-1002.2","6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.10","6.8.0-1010.11","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14"],"bundled":196},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1013.17"}]}],"versions":["6.8.0-1003.5","6.8.0-1004.7","6.8.0-1005.8","6.8.0-1006.9","6.8.0-1007.10","6.8.0-1008.11","6.8.0-1009.12","6.8.0-1010.13","6.8.0-1011.14","6.8.0-1012.15"],"bundled":196},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-48.48.3~22.04.1"}]}],"versions":["6.8.0-38.38.1~22.04.2","6.8.0-40.40.1~22.04.1","6.8.0-44.44.1~22.04.1","6.8.0-45.45.1~22.04.1","6.8.0-47.47.1~22.04.1"],"bundled":196},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-48.48.3"}]}],"versions":["6.5.0-9.9.1","6.6.0-14.14.1","6.8.0-7.7.1","6.8.0-25.25.3","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-45.45.1","6.8.0-47.47.1"],"bundled":196},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1017.20~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1012.14~22.04.1","6.8.0-1013.15~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.2"],"bundled":198},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1017.19~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1"],"bundled":197},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1017.19"}]}],"versions":["6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16"],"bundled":197},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1017.19.1"}]}],"versions":["6.8.0-1009.9.1","6.8.0-1011.11.1","6.8.0-1012.12.1","6.8.0-1013.14.1","6.8.0-1014.15.1","6.8.0-1015.16.1"],"bundled":197},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1002.4"}]}],"versions":["6.8.0-1001.3"],"bundled":607}],"products":[{"vendor":"linux","product":"linux"},{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"https://git.kernel.org/stable/c/32226070813140234b6c507084738e8e8385c5c6","tags":["Patch","web","report"]},{"url":"https://git.kernel.org/stable/c/2d0738a8322bf4e5bfe693d16b3111928a9ccfbf","tags":["Patch","web","report"]},{"url":"https://git.kernel.org/stable/c/ca963eefbc3331222b6121baa696d49ba2008811","tags":["Patch","web","report"]},{"url":"https://git.kernel.org/stable/c/611d5cbc0b35a752e657a83eebadf40d814d006b","tags":["Patch","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43855","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-5ffp-85mp-h2q2"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-43855","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43855.json","tags":["advisory"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-43855","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0309.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33546","tags":["report"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.44","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.45","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.46","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.47","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.48","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.49","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.50","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2024-0310.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33552","tags":["report"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2124","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36934","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37078","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40959","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40976","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40978","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41012","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41016","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41037","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41052","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41071","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41082","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41098","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42139","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42152","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42153","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42234","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42235","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42237","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42238","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42239","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42240","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42241","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42243","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42248","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42250","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42253","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42258","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42259","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42271","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42272","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42276","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42277","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42279","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42291","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42294","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42296","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42298","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42303","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42307","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42314","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42315","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42316","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42317","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42320","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42321","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43817","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43818","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43821","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43825","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43826","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43829","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43832","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43833","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43837","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43841","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43842","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43845","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43846","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43847","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43849","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43850","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43851","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43856","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43859","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43883","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43884","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43889","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43890","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43891","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43895","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43897","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43898","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43899","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43900","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43902","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43905","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43906","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43907","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43908","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43909","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43912","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43913","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43914","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-44934","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-44935","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-44940","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-44942","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-44946","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-44947","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-44961","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-44966","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-44971","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2255","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48893","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52444","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52463","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52482","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52612","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52843","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26820","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36005","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40998","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42067","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42283","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42290","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42306","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42309","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42313","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42322","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43823","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43830","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43840","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43872","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43892","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43893","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-44954","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-44998","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45006","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45026","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46676","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46719","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46754","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46770","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46795","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46819","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46826","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46828","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46840","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46848","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46854","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46855","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46858","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47658","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47664","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47670","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47671","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47672","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2257","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48688","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48848","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48869","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48879","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48945","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0597","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4134","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52707","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52741","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52880","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36031","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2258","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47382","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35825","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35969","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36270","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36880","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36915","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36946","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38546","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38560","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38611","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38613","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38659","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39292","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39494","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40932","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40988","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41019","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41040","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41041","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41048","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41049","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41063","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41069","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41080","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41090","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41091","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42086","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42097","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42115","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42129","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42228","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:3506","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3506.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-43855","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2305513","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-43855","tags":["advisory","report"]},{"url":"https://lore.kernel.org/linux-cve-announce/2024081734-CVE-2024-43855-b78a@gregkh/T","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243194-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1012628","tags":["report"]},{"url":"https://bugzilla.suse.com/1193454","tags":["report"]},{"url":"https://bugzilla.suse.com/1194869","tags":["report"]},{"url":"https://bugzilla.suse.com/1205462","tags":["report"]},{"url":"https://bugzilla.suse.com/1208783","tags":["report"]},{"url":"https://bugzilla.suse.com/1213123","tags":["report"]},{"url":"https://bugzilla.suse.com/1214285","tags":["report"]},{"url":"https://bugzilla.suse.com/1215199","tags":["report"]},{"url":"https://bugzilla.suse.com/1220066","tags":["report"]},{"url":"https://bugzilla.suse.com/1220252","tags":["report"]},{"url":"https://bugzilla.suse.com/1220877","tags":["report"]},{"url":"https://bugzilla.suse.com/1221326","tags":["report"]},{"url":"https://bugzilla.suse.com/1221630","tags":["report"]},{"url":"https://bugzilla.suse.com/1221645","tags":["report"]},{"url":"https://bugzilla.suse.com/1221652","tags":["report"]},{"url":"https://bugzilla.suse.com/1221857","tags":["report"]},{"url":"https://bugzilla.suse.com/1222254","tags":["report"]},{"url":"https://bugzilla.suse.com/1222335","tags":["report"]},{"url":"https://bugzilla.suse.com/1222350","tags":["report"]},{"url":"https://bugzilla.suse.com/1222364","tags":["report"]},{"url":"https://bugzilla.suse.com/1222372","tags":["report"]},{"url":"https://bugzilla.suse.com/1222387","tags":["report"]},{"url":"https://bugzilla.suse.com/1222433","tags":["report"]},{"url":"https://bugzilla.suse.com/1222434","tags":["report"]},{"url":"https://bugzilla.suse.com/1222463","tags":["report"]},{"url":"https://bugzilla.suse.com/1222625","tags":["report"]},{"url":"https://bugzilla.suse.com/1222633","tags":["report"]},{"url":"https://bugzilla.suse.com/1222634","tags":["report"]},{"url":"https://bugzilla.suse.com/1222808","tags":["report"]},{"url":"https://bugzilla.suse.com/1222967","tags":["report"]},{"url":"https://bugzilla.suse.com/1222973","tags":["report"]},{"url":"https://bugzilla.suse.com/1223053","tags":["report"]},{"url":"https://bugzilla.suse.com/1223074","tags":["report"]},{"url":"https://bugzilla.suse.com/1223191","tags":["report"]},{"url":"https://bugzilla.suse.com/1223395","tags":["report"]},{"url":"https://bugzilla.suse.com/1223635","tags":["report"]},{"url":"https://bugzilla.suse.com/1223720","tags":["report"]},{"url":"https://bugzilla.suse.com/1223731","tags":["report"]},{"url":"https://bugzilla.suse.com/1223742","tags":["report"]},{"url":"https://bugzilla.suse.com/1223763","tags":["report"]},{"url":"https://bugzilla.suse.com/1223767","tags":["report"]},{"url":"https://bugzilla.suse.com/1223777","tags":["report"]},{"url":"https://bugzilla.suse.com/1223803","tags":["report"]},{"url":"https://bugzilla.suse.com/1224105","tags":["report"]},{"url":"https://bugzilla.suse.com/1224415","tags":["report"]},{"url":"https://bugzilla.suse.com/1224485","tags":["report"]},{"url":"https://bugzilla.suse.com/1224496","tags":["report"]},{"url":"https://bugzilla.suse.com/1224510","tags":["report"]},{"url":"https://bugzilla.suse.com/1224535","tags":["report"]},{"url":"https://bugzilla.suse.com/1224631","tags":["report"]},{"url":"https://bugzilla.suse.com/1224636","tags":["report"]},{"url":"https://bugzilla.suse.com/1224690","tags":["report"]},{"url":"https://bugzilla.suse.com/1224694","tags":["report"]},{"url":"https://bugzilla.suse.com/1224700","tags":["report"]},{"url":"https://bugzilla.suse.com/1224711","tags":["report"]},{"url":"https://bugzilla.suse.com/1225475","tags":["report"]},{"url":"https://bugzilla.suse.com/1225582","tags":["report"]},{"url":"https://bugzilla.suse.com/1225607","tags":["report"]},{"url":"https://bugzilla.suse.com/1225717","tags":["report"]},{"url":"https://bugzilla.suse.com/1225718","tags":["report"]},{"url":"https://bugzilla.suse.com/1225744","tags":["report"]},{"url":"https://bugzilla.suse.com/1225745","tags":["report"]},{"url":"https://bugzilla.suse.com/1225751","tags":["report"]},{"url":"https://bugzilla.suse.com/1225814","tags":["report"]},{"url":"https://bugzilla.suse.com/1225832","tags":["report"]},{"url":"https://bugzilla.suse.com/1225838","tags":["report"]},{"url":"https://bugzilla.suse.com/1225903","tags":["report"]},{"url":"https://bugzilla.suse.com/1226031","tags":["report"]},{"url":"https://bugzilla.suse.com/1226127","tags":["report"]},{"url":"https://bugzilla.suse.com/1226502","tags":["report"]},{"url":"https://bugzilla.suse.com/1226530","tags":["report"]},{"url":"https://bugzilla.suse.com/1226588","tags":["report"]},{"url":"https://bugzilla.suse.com/1226604","tags":["report"]},{"url":"https://bugzilla.suse.com/1226743","tags":["report"]},{"url":"https://bugzilla.suse.com/1226751","tags":["report"]},{"url":"https://bugzilla.suse.com/1226765","tags":["report"]},{"url":"https://bugzilla.suse.com/1226798","tags":["report"]},{"url":"https://bugzilla.suse.com/1226801","tags":["report"]},{"url":"https://bugzilla.suse.com/1226834","tags":["report"]},{"url":"https://bugzilla.suse.com/1226874","tags":["report"]},{"url":"https://bugzilla.suse.com/1226885","tags":["report"]},{"url":"https://bugzilla.suse.com/1226920","tags":["report"]},{"url":"https://bugzilla.suse.com/1227149","tags":["report"]},{"url":"https://bugzilla.suse.com/1227182","tags":["report"]},{"url":"https://bugzilla.suse.com/1227383","tags":["report"]},{"url":"https://bugzilla.suse.com/1227437","tags":["report"]},{"url":"https://bugzilla.suse.com/1227492","tags":["report"]},{"url":"https://bugzilla.suse.com/1227493","tags":["report"]},{"url":"https://bugzilla.suse.com/1227494","tags":["report"]},{"url":"https://bugzilla.suse.com/1227618","tags":["report"]},{"url":"https://bugzilla.suse.com/1227620","tags":["report"]},{"url":"https://bugzilla.suse.com/1227623","tags":["report"]},{"url":"https://bugzilla.suse.com/1227627","tags":["report"]},{"url":"https://bugzilla.suse.com/1227634","tags":["report"]},{"url":"https://bugzilla.suse.com/1227706","tags":["report"]},{"url":"https://bugzilla.suse.com/1227722","tags":["report"]},{"url":"https://bugzilla.suse.com/1227724","tags":["report"]},{"url":"https://bugzilla.suse.com/1227725","tags":["report"]},{"url":"https://bugzilla.suse.com/1227728","tags":["report"]},{"url":"https://bugzilla.suse.com/1227729","tags":["report"]},{"url":"https://bugzilla.suse.com/1227732","tags":["report"]},{"url":"https://bugzilla.suse.com/1227733","tags":["report"]},{"url":"https://bugzilla.suse.com/1227734","tags":["report"]},{"url":"https://bugzilla.suse.com/1227747","tags":["report"]},{"url":"https://bugzilla.suse.com/1227750","tags":["report"]},{"url":"https://bugzilla.suse.com/1227754","tags":["report"]},{"url":"https://bugzilla.suse.com/1227758","tags":["report"]},{"url":"https://bugzilla.suse.com/1227760","tags":["report"]},{"url":"https://bugzilla.suse.com/1227761","tags":["report"]},{"url":"https://bugzilla.suse.com/1227764","tags":["report"]},{"url":"https://bugzilla.suse.com/1227766","tags":["report"]},{"url":"https://bugzilla.suse.com/1227770","tags":["report"]},{"url":"https://bugzilla.suse.com/1227771","tags":["report"]},{"url":"https://bugzilla.suse.com/1227772","tags":["report"]},{"url":"https://bugzilla.suse.com/1227774","tags":["report"]},{"url":"https://bugzilla.suse.com/1227781","tags":["report"]},{"url":"https://bugzilla.suse.com/1227784","tags":["report"]},{"url":"https://bugzilla.suse.com/1227785","tags":["report"]},{"url":"https://bugzilla.suse.com/1227787","tags":["report"]},{"url":"https://bugzilla.suse.com/1227790","tags":["report"]},{"url":"https://bugzilla.suse.com/1227791","tags":["report"]},{"url":"https://bugzilla.suse.com/1227792","tags":["report"]},{"url":"https://bugzilla.suse.com/1227796","tags":["report"]},{"url":"https://bugzilla.suse.com/1227798","tags":["report"]},{"url":"https://bugzilla.suse.com/1227799","tags":["report"]},{"url":"https://bugzilla.suse.com/1227802","tags":["report"]},{"url":"https://bugzilla.suse.com/1227808","tags":["report"]},{"url":"https://bugzilla.suse.com/1227810","tags":["report"]},{"url":"https://bugzilla.suse.com/1227811","tags":["report"]},{"url":"https://bugzilla.suse.com/1227812","tags":["report"]},{"url":"https://bugzilla.suse.com/1227815","tags":["report"]},{"url":"https://bugzilla.suse.com/1227816","tags":["report"]},{"url":"https://bugzilla.suse.com/1227818","tags":["report"]},{"url":"https://bugzilla.suse.com/1227820","tags":["report"]},{"url":"https://bugzilla.suse.com/1227823","tags":["report"]},{"url":"https://bugzilla.suse.com/1227824","tags":["report"]},{"url":"https://bugzilla.suse.com/1227826","tags":["report"]},{"url":"https://bugzilla.suse.com/1227828","tags":["report"]},{"url":"https://bugzilla.suse.com/1227829","tags":["report"]},{"url":"https://bugzilla.suse.com/1227830","tags":["report"]},{"url":"https://bugzilla.suse.com/1227832","tags":["report"]},{"url":"https://bugzilla.suse.com/1227833","tags":["report"]},{"url":"https://bugzilla.suse.com/1227834","tags":["report"]},{"url":"https://bugzilla.suse.com/1227839","tags":["report"]},{"url":"https://bugzilla.suse.com/1227840","tags":["report"]},{"url":"https://bugzilla.suse.com/1227846","tags":["report"]},{"url":"https://bugzilla.suse.com/1227849","tags":["report"]},{"url":"https://bugzilla.suse.com/1227851","tags":["report"]},{"url":"https://bugzilla.suse.com/1227853","tags":["report"]},{"url":"https://bugzilla.suse.com/1227863","tags":["report"]},{"url":"https://bugzilla.suse.com/1227864","tags":["report"]},{"url":"https://bugzilla.suse.com/1227865","tags":["report"]},{"url":"https://bugzilla.suse.com/1227867","tags":["report"]},{"url":"https://bugzilla.suse.com/1227869","tags":["report"]},{"url":"https://bugzilla.suse.com/1227870","tags":["report"]},{"url":"https://bugzilla.suse.com/1227883","tags":["report"]},{"url":"https://bugzilla.suse.com/1227884","tags":["report"]},{"url":"https://bugzilla.suse.com/1227891","tags":["report"]},{"url":"https://bugzilla.suse.com/1227893","tags":["report"]},{"url":"https://bugzilla.suse.com/1227929","tags":["report"]},{"url":"https://bugzilla.suse.com/1227950","tags":["report"]},{"url":"https://bugzilla.suse.com/1227957","tags":["report"]},{"url":"https://bugzilla.suse.com/1227981","tags":["report"]},{"url":"https://bugzilla.suse.com/1228020","tags":["report"]},{"url":"https://bugzilla.suse.com/1228021","tags":["report"]},{"url":"https://bugzilla.suse.com/1228114","tags":["report"]},{"url":"https://bugzilla.suse.com/1228192","tags":["report"]},{"url":"https://bugzilla.suse.com/1228195","tags":["report"]},{"url":"https://bugzilla.suse.com/1228202","tags":["report"]},{"url":"https://bugzilla.suse.com/1228235","tags":["report"]},{"url":"https://bugzilla.suse.com/1228236","tags":["report"]},{"url":"https://bugzilla.suse.com/1228237","tags":["report"]},{"url":"https://bugzilla.suse.com/1228247","tags":["report"]},{"url":"https://bugzilla.suse.com/1228321","tags":["report"]},{"url":"https://bugzilla.suse.com/1228409","tags":["report"]},{"url":"https://bugzilla.suse.com/1228410","tags":["report"]},{"url":"https://bugzilla.suse.com/1228426","tags":["report"]},{"url":"https://bugzilla.suse.com/1228427","tags":["report"]},{"url":"https://bugzilla.suse.com/1228429","tags":["report"]},{"url":"https://bugzilla.suse.com/1228446","tags":["report"]},{"url":"https://bugzilla.suse.com/1228447","tags":["report"]},{"url":"https://bugzilla.suse.com/1228449","tags":["report"]},{"url":"https://bugzilla.suse.com/1228450","tags":["report"]},{"url":"https://bugzilla.suse.com/1228452","tags":["report"]},{"url":"https://bugzilla.suse.com/1228456","tags":["report"]},{"url":"https://bugzilla.suse.com/1228457","tags":["report"]},{"url":"https://bugzilla.suse.com/1228458","tags":["report"]},{"url":"https://bugzilla.suse.com/1228459","tags":["report"]},{"url":"https://bugzilla.suse.com/1228460","tags":["report"]},{"url":"https://bugzilla.suse.com/1228462","tags":["report"]},{"url":"https://bugzilla.suse.com/1228463","tags":["report"]},{"url":"https://bugzilla.suse.com/1228466","tags":["report"]},{"url":"https://bugzilla.suse.com/1228467","tags":["report"]},{"url":"https://bugzilla.suse.com/1228468","tags":["report"]},{"url":"https://bugzilla.suse.com/1228469","tags":["report"]},{"url":"https://bugzilla.suse.com/1228470","tags":["report"]},{"url":"https://bugzilla.suse.com/1228472","tags":["report"]},{"url":"https://bugzilla.suse.com/1228479","tags":["report"]},{"url":"https://bugzilla.suse.com/1228480","tags":["report"]},{"url":"https://bugzilla.suse.com/1228481","tags":["report"]},{"url":"https://bugzilla.suse.com/1228482","tags":["report"]},{"url":"https://bugzilla.suse.com/1228483","tags":["report"]},{"url":"https://bugzilla.suse.com/1228484","tags":["report"]},{"url":"https://bugzilla.suse.com/1228485","tags":["report"]},{"url":"https://bugzilla.suse.com/1228486","tags":["report"]},{"url":"https://bugzilla.suse.com/1228487","tags":["report"]},{"url":"https://bugzilla.suse.com/1228489","tags":["report"]},{"url":"https://bugzilla.suse.com/1228491","tags":["report"]},{"url":"https://bugzilla.suse.com/1228492","tags":["report"]},{"url":"https://bugzilla.suse.com/1228493","tags":["report"]},{"url":"https://bugzilla.suse.com/1228494","tags":["report"]},{"url":"https://bugzilla.suse.com/1228495","tags":["report"]},{"url":"https://bugzilla.suse.com/1228496","tags":["report"]},{"url":"https://bugzilla.suse.com/1228499","tags":["report"]},{"url":"https://bugzilla.suse.com/1228500","tags":["report"]},{"url":"https://bugzilla.suse.com/1228501","tags":["report"]},{"url":"https://bugzilla.suse.com/1228502","tags":["report"]},{"url":"https://bugzilla.suse.com/1228503","tags":["report"]},{"url":"https://bugzilla.suse.com/1228505","tags":["report"]},{"url":"https://bugzilla.suse.com/1228508","tags":["report"]},{"url":"https://bugzilla.suse.com/1228509","tags":["report"]},{"url":"https://bugzilla.suse.com/1228510","tags":["report"]},{"url":"https://bugzilla.suse.com/1228511","tags":["report"]},{"url":"https://bugzilla.suse.com/1228513","tags":["report"]},{"url":"https://bugzilla.suse.com/1228515","tags":["report"]},{"url":"https://bugzilla.suse.com/1228516","tags":["report"]},{"url":"https://bugzilla.suse.com/1228518","tags":["report"]},{"url":"https://bugzilla.suse.com/1228520","tags":["report"]},{"url":"https://bugzilla.suse.com/1228525","tags":["report"]},{"url":"https://bugzilla.suse.com/1228527","tags":["report"]},{"url":"https://bugzilla.suse.com/1228530","tags":["report"]},{"url":"https://bugzilla.suse.com/1228531","tags":["report"]},{"url":"https://bugzilla.suse.com/1228539","tags":["report"]},{"url":"https://bugzilla.suse.com/1228561","tags":["report"]},{"url":"https://bugzilla.suse.com/1228563","tags":["report"]},{"url":"https://bugzilla.suse.com/1228564","tags":["report"]},{"url":"https://bugzilla.suse.com/1228565","tags":["report"]},{"url":"https://bugzilla.suse.com/1228567","tags":["report"]},{"url":"https://bugzilla.suse.com/1228568","tags":["report"]},{"url":"https://bugzilla.suse.com/1228572","tags":["report"]},{"url":"https://bugzilla.suse.com/1228576","tags":["report"]},{"url":"https://bugzilla.suse.com/1228579","tags":["report"]},{"url":"https://bugzilla.suse.com/1228580","tags":["report"]},{"url":"https://bugzilla.suse.com/1228581","tags":["report"]},{"url":"https://bugzilla.suse.com/1228582","tags":["report"]},{"url":"https://bugzilla.suse.com/1228584","tags":["report"]},{"url":"https://bugzilla.suse.com/1228586","tags":["report"]},{"url":"https://bugzilla.suse.com/1228588","tags":["report"]},{"url":"https://bugzilla.suse.com/1228590","tags":["report"]},{"url":"https://bugzilla.suse.com/1228591","tags":["report"]},{"url":"https://bugzilla.suse.com/1228599","tags":["report"]},{"url":"https://bugzilla.suse.com/1228615","tags":["report"]},{"url":"https://bugzilla.suse.com/1228616","tags":["report"]},{"url":"https://bugzilla.suse.com/1228617","tags":["report"]},{"url":"https://bugzilla.suse.com/1228625","tags":["report"]},{"url":"https://bugzilla.suse.com/1228626","tags":["report"]},{"url":"https://bugzilla.suse.com/1228633","tags":["report"]},{"url":"https://bugzilla.suse.com/1228635","tags":["report"]},{"url":"https://bugzilla.suse.com/1228636","tags":["report"]},{"url":"https://bugzilla.suse.com/1228640","tags":["report"]},{"url":"https://bugzilla.suse.com/1228643","tags":["report"]},{"url":"https://bugzilla.suse.com/1228644","tags":["report"]},{"url":"https://bugzilla.suse.com/1228646","tags":["report"]},{"url":"https://bugzilla.suse.com/1228649","tags":["report"]},{"url":"https://bugzilla.suse.com/1228650","tags":["report"]},{"url":"https://bugzilla.suse.com/1228654","tags":["report"]},{"url":"https://bugzilla.suse.com/1228655","tags":["report"]},{"url":"https://bugzilla.suse.com/1228656","tags":["report"]},{"url":"https://bugzilla.suse.com/1228658","tags":["report"]},{"url":"https://bugzilla.suse.com/1228660","tags":["report"]},{"url":"https://bugzilla.suse.com/1228662","tags":["report"]},{"url":"https://bugzilla.suse.com/1228665","tags":["report"]},{"url":"https://bugzilla.suse.com/1228666","tags":["report"]},{"url":"https://bugzilla.suse.com/1228667","tags":["report"]},{"url":"https://bugzilla.suse.com/1228672","tags":["report"]},{"url":"https://bugzilla.suse.com/1228673","tags":["report"]},{"url":"https://bugzilla.suse.com/1228674","tags":["report"]},{"url":"https://bugzilla.suse.com/1228677","tags":["report"]},{"url":"https://bugzilla.suse.com/1228680","tags":["report"]},{"url":"https://bugzilla.suse.com/1228687","tags":["report"]},{"url":"https://bugzilla.suse.com/1228705","tags":["report"]},{"url":"https://bugzilla.suse.com/1228706","tags":["report"]},{"url":"https://bugzilla.suse.com/1228707","tags":["report"]},{"url":"https://bugzilla.suse.com/1228708","tags":["report"]},{"url":"https://bugzilla.suse.com/1228709","tags":["report"]},{"url":"https://bugzilla.suse.com/1228710","tags":["report"]},{"url":"https://bugzilla.suse.com/1228718","tags":["report"]},{"url":"https://bugzilla.suse.com/1228720","tags":["report"]},{"url":"https://bugzilla.suse.com/1228721","tags":["report"]},{"url":"https://bugzilla.suse.com/1228722","tags":["report"]},{"url":"https://bugzilla.suse.com/1228723","tags":["report"]},{"url":"https://bugzilla.suse.com/1228724","tags":["report"]},{"url":"https://bugzilla.suse.com/1228726","tags":["report"]},{"url":"https://bugzilla.suse.com/1228727","tags":["report"]},{"url":"https://bugzilla.suse.com/1228733","tags":["report"]},{"url":"https://bugzilla.suse.com/1228737","tags":["report"]},{"url":"https://bugzilla.suse.com/1228743","tags":["report"]},{"url":"https://bugzilla.suse.com/1228748","tags":["report"]},{"url":"https://bugzilla.suse.com/1228754","tags":["report"]},{"url":"https://bugzilla.suse.com/1228756","tags":["report"]},{"url":"https://bugzilla.suse.com/1228757","tags":["report"]},{"url":"https://bugzilla.suse.com/1228758","tags":["report"]},{"url":"https://bugzilla.suse.com/1228764","tags":["report"]},{"url":"https://bugzilla.suse.com/1228766","tags":["report"]},{"url":"https://bugzilla.suse.com/1228779","tags":["report"]},{"url":"https://bugzilla.suse.com/1228801","tags":["report"]},{"url":"https://bugzilla.suse.com/1228849","tags":["report"]},{"url":"https://bugzilla.suse.com/1228850","tags":["report"]},{"url":"https://bugzilla.suse.com/1228857","tags":["report"]},{"url":"https://bugzilla.suse.com/1228959","tags":["report"]},{"url":"https://bugzilla.suse.com/1228964","tags":["report"]},{"url":"https://bugzilla.suse.com/1228966","tags":["report"]},{"url":"https://bugzilla.suse.com/1228967","tags":["report"]},{"url":"https://bugzilla.suse.com/1228973","tags":["report"]},{"url":"https://bugzilla.suse.com/1228977","tags":["report"]},{"url":"https://bugzilla.suse.com/1228978","tags":["report"]},{"url":"https://bugzilla.suse.com/1228979","tags":["report"]},{"url":"https://bugzilla.suse.com/1228986","tags":["report"]},{"url":"https://bugzilla.suse.com/1228988","tags":["report"]},{"url":"https://bugzilla.suse.com/1228989","tags":["report"]},{"url":"https://bugzilla.suse.com/1228991","tags":["report"]},{"url":"https://bugzilla.suse.com/1228992","tags":["report"]},{"url":"https://bugzilla.suse.com/1229005","tags":["report"]},{"url":"https://bugzilla.suse.com/1229024","tags":["report"]},{"url":"https://bugzilla.suse.com/1229042","tags":["report"]},{"url":"https://bugzilla.suse.com/1229045","tags":["report"]},{"url":"https://bugzilla.suse.com/1229046","tags":["report"]},{"url":"https://bugzilla.suse.com/1229054","tags":["report"]},{"url":"https://bugzilla.suse.com/1229056","tags":["report"]},{"url":"https://bugzilla.suse.com/1229086","tags":["report"]},{"url":"https://bugzilla.suse.com/1229134","tags":["report"]},{"url":"https://bugzilla.suse.com/1229136","tags":["report"]},{"url":"https://bugzilla.suse.com/1229154","tags":["report"]},{"url":"https://bugzilla.suse.com/1229156","tags":["report"]},{"url":"https://bugzilla.suse.com/1229160","tags":["report"]},{"url":"https://bugzilla.suse.com/1229167","tags":["report"]},{"url":"https://bugzilla.suse.com/1229168","tags":["report"]},{"url":"https://bugzilla.suse.com/1229169","tags":["report"]},{"url":"https://bugzilla.suse.com/1229170","tags":["report"]},{"url":"https://bugzilla.suse.com/1229171","tags":["report"]},{"url":"https://bugzilla.suse.com/1229172","tags":["report"]},{"url":"https://bugzilla.suse.com/1229173","tags":["report"]},{"url":"https://bugzilla.suse.com/1229174","tags":["report"]},{"url":"https://bugzilla.suse.com/1229239","tags":["report"]},{"url":"https://bugzilla.suse.com/1229240","tags":["report"]},{"url":"https://bugzilla.suse.com/1229241","tags":["report"]},{"url":"https://bugzilla.suse.com/1229243","tags":["report"]},{"url":"https://bugzilla.suse.com/1229244","tags":["report"]},{"url":"https://bugzilla.suse.com/1229245","tags":["report"]},{"url":"https://bugzilla.suse.com/1229246","tags":["report"]},{"url":"https://bugzilla.suse.com/1229247","tags":["report"]},{"url":"https://bugzilla.suse.com/1229248","tags":["report"]},{"url":"https://bugzilla.suse.com/1229249","tags":["report"]},{"url":"https://bugzilla.suse.com/1229250","tags":["report"]},{"url":"https://bugzilla.suse.com/1229251","tags":["report"]},{"url":"https://bugzilla.suse.com/1229252","tags":["report"]},{"url":"https://bugzilla.suse.com/1229253","tags":["report"]},{"url":"https://bugzilla.suse.com/1229254","tags":["report"]},{"url":"https://bugzilla.suse.com/1229255","tags":["report"]},{"url":"https://bugzilla.suse.com/1229256","tags":["report"]},{"url":"https://bugzilla.suse.com/1229287","tags":["report"]},{"url":"https://bugzilla.suse.com/1229290","tags":["report"]},{"url":"https://bugzilla.suse.com/1229291","tags":["report"]},{"url":"https://bugzilla.suse.com/1229292","tags":["report"]},{"url":"https://bugzilla.suse.com/1229294","tags":["report"]},{"url":"https://bugzilla.suse.com/1229296","tags":["report"]},{"url":"https://bugzilla.suse.com/1229297","tags":["report"]},{"url":"https://bugzilla.suse.com/1229298","tags":["report"]},{"url":"https://bugzilla.suse.com/1229299","tags":["report"]},{"url":"https://bugzilla.suse.com/1229301","tags":["report"]},{"url":"https://bugzilla.suse.com/1229303","tags":["report"]},{"url":"https://bugzilla.suse.com/1229304","tags":["report"]},{"url":"https://bugzilla.suse.com/1229305","tags":["report"]},{"url":"https://bugzilla.suse.com/1229307","tags":["report"]},{"url":"https://bugzilla.suse.com/1229309","tags":["report"]},{"url":"https://bugzilla.suse.com/1229312","tags":["report"]},{"url":"https://bugzilla.suse.com/1229313","tags":["report"]},{"url":"https://bugzilla.suse.com/1229314","tags":["report"]},{"url":"https://bugzilla.suse.com/1229315","tags":["report"]},{"url":"https://bugzilla.suse.com/1229316","tags":["report"]},{"url":"https://bugzilla.suse.com/1229317","tags":["report"]},{"url":"https://bugzilla.suse.com/1229318","tags":["report"]},{"url":"https://bugzilla.suse.com/1229319","tags":["report"]},{"url":"https://bugzilla.suse.com/1229320","tags":["report"]},{"url":"https://bugzilla.suse.com/1229327","tags":["report"]},{"url":"https://bugzilla.suse.com/1229341","tags":["report"]},{"url":"https://bugzilla.suse.com/1229342","tags":["report"]},{"url":"https://bugzilla.suse.com/1229344","tags":["report"]},{"url":"https://bugzilla.suse.com/1229345","tags":["report"]},{"url":"https://bugzilla.suse.com/1229346","tags":["report"]},{"url":"https://bugzilla.suse.com/1229347","tags":["report"]},{"url":"https://bugzilla.suse.com/1229349","tags":["report"]},{"url":"https://bugzilla.suse.com/1229350","tags":["report"]},{"url":"https://bugzilla.suse.com/1229351","tags":["report"]},{"url":"https://bugzilla.suse.com/1229353","tags":["report"]},{"url":"https://bugzilla.suse.com/1229354","tags":["report"]},{"url":"https://bugzilla.suse.com/1229355","tags":["report"]},{"url":"https://bugzilla.suse.com/1229356","tags":["report"]},{"url":"https://bugzilla.suse.com/1229357","tags":["report"]},{"url":"https://bugzilla.suse.com/1229358","tags":["report"]},{"url":"https://bugzilla.suse.com/1229359","tags":["report"]},{"url":"https://bugzilla.suse.com/1229360","tags":["report"]},{"url":"https://bugzilla.suse.com/1229365","tags":["report"]},{"url":"https://bugzilla.suse.com/1229366","tags":["report"]},{"url":"https://bugzilla.suse.com/1229369","tags":["report"]},{"url":"https://bugzilla.suse.com/1229370","tags":["report"]},{"url":"https://bugzilla.suse.com/1229373","tags":["report"]},{"url":"https://bugzilla.suse.com/1229374","tags":["report"]},{"url":"https://bugzilla.suse.com/1229379","tags":["report"]},{"url":"https://bugzilla.suse.com/1229381","tags":["report"]},{"url":"https://bugzilla.suse.com/1229382","tags":["report"]},{"url":"https://bugzilla.suse.com/1229383","tags":["report"]},{"url":"https://bugzilla.suse.com/1229386","tags":["report"]},{"url":"https://bugzilla.suse.com/1229388","tags":["report"]},{"url":"https://bugzilla.suse.com/1229390","tags":["report"]},{"url":"https://bugzilla.suse.com/1229391","tags":["report"]},{"url":"https://bugzilla.suse.com/1229392","tags":["report"]},{"url":"https://bugzilla.suse.com/1229395","tags":["report"]},{"url":"https://bugzilla.suse.com/1229398","tags":["report"]},{"url":"https://bugzilla.suse.com/1229399","tags":["report"]},{"url":"https://bugzilla.suse.com/1229400","tags":["report"]},{"url":"https://bugzilla.suse.com/1229402","tags":["report"]},{"url":"https://bugzilla.suse.com/1229403","tags":["report"]},{"url":"https://bugzilla.suse.com/1229404","tags":["report"]},{"url":"https://bugzilla.suse.com/1229407","tags":["report"]},{"url":"https://bugzilla.suse.com/1229409","tags":["report"]},{"url":"https://bugzilla.suse.com/1229410","tags":["report"]},{"url":"https://bugzilla.suse.com/1229411","tags":["report"]},{"url":"https://bugzilla.suse.com/1229413","tags":["report"]},{"url":"https://bugzilla.suse.com/1229414","tags":["report"]},{"url":"https://bugzilla.suse.com/1229417","tags":["report"]},{"url":"https://bugzilla.suse.com/1229444","tags":["report"]},{"url":"https://bugzilla.suse.com/1229451","tags":["report"]},{"url":"https://bugzilla.suse.com/1229452","tags":["report"]},{"url":"https://bugzilla.suse.com/1229455","tags":["report"]},{"url":"https://bugzilla.suse.com/1229456","tags":["report"]},{"url":"https://bugzilla.suse.com/1229480","tags":["report"]},{"url":"https://bugzilla.suse.com/1229481","tags":["report"]},{"url":"https://bugzilla.suse.com/1229482","tags":["report"]},{"url":"https://bugzilla.suse.com/1229484","tags":["report"]},{"url":"https://bugzilla.suse.com/1229485","tags":["report"]},{"url":"https://bugzilla.suse.com/1229486","tags":["report"]},{"url":"https://bugzilla.suse.com/1229487","tags":["report"]},{"url":"https://bugzilla.suse.com/1229488","tags":["report"]},{"url":"https://bugzilla.suse.com/1229489","tags":["report"]},{"url":"https://bugzilla.suse.com/1229490","tags":["report"]},{"url":"https://bugzilla.suse.com/1229493","tags":["report"]},{"url":"https://bugzilla.suse.com/1229495","tags":["report"]},{"url":"https://bugzilla.suse.com/1229496","tags":["report"]},{"url":"https://bugzilla.suse.com/1229497","tags":["report"]},{"url":"https://bugzilla.suse.com/1229500","tags":["report"]},{"url":"https://bugzilla.suse.com/1229503","tags":["report"]},{"url":"https://bugzilla.suse.com/1229707","tags":["report"]},{"url":"https://bugzilla.suse.com/1229739","tags":["report"]},{"url":"https://bugzilla.suse.com/1229743","tags":["report"]},{"url":"https://bugzilla.suse.com/1229746","tags":["report"]},{"url":"https://bugzilla.suse.com/1229747","tags":["report"]},{"url":"https://bugzilla.suse.com/1229752","tags":["report"]},{"url":"https://bugzilla.suse.com/1229754","tags":["report"]},{"url":"https://bugzilla.suse.com/1229755","tags":["report"]},{"url":"https://bugzilla.suse.com/1229756","tags":["report"]},{"url":"https://bugzilla.suse.com/1229759","tags":["report"]},{"url":"https://bugzilla.suse.com/1229761","tags":["report"]},{"url":"https://bugzilla.suse.com/1229767","tags":["report"]},{"url":"https://bugzilla.suse.com/1229781","tags":["report"]},{"url":"https://bugzilla.suse.com/1229784","tags":["report"]},{"url":"https://bugzilla.suse.com/1229785","tags":["report"]},{"url":"https://bugzilla.suse.com/1229787","tags":["report"]},{"url":"https://bugzilla.suse.com/1229788","tags":["report"]},{"url":"https://bugzilla.suse.com/1229789","tags":["report"]},{"url":"https://bugzilla.suse.com/1229792","tags":["report"]},{"url":"https://bugzilla.suse.com/1229820","tags":["report"]},{"url":"https://bugzilla.suse.com/1229827","tags":["report"]},{"url":"https://bugzilla.suse.com/1229830","tags":["report"]},{"url":"https://bugzilla.suse.com/1229837","tags":["report"]},{"url":"https://bugzilla.suse.com/1229940","tags":["report"]},{"url":"https://bugzilla.suse.com/1230056","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52489","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52887","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26590","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26682","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26808","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26837","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26920","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31076","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36489","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36881","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38548","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38609","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39486","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39488","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39489","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40916","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40920","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40926","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40977","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40992","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40994","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41007","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41048","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41057","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41071","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41076","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41087","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41094","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41096","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42076","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42077","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42082","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42087","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42096","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42124","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42228","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42250","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42279","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42280","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42295","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42301","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42302","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42311","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42322","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43826","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43837","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43881","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43892","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44939","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243195-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1219596","tags":["report"]},{"url":"https://bugzilla.suse.com/1222777","tags":["report"]},{"url":"https://bugzilla.suse.com/1225461","tags":["report"]},{"url":"https://bugzilla.suse.com/1225474","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26767","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243383-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1230350","tags":["report"]},{"url":"https://bugzilla.suse.com/1230413","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520044-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1228971","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520047-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1229025","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43855","tags":["report"]},{"url":"https://git.kernel.org/linus/611d5cbc0b35a752e657a83eebadf40d814d006b","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7089-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7090-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7089-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7089-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7095-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7089-4","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7089-5","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7089-6","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7089-7","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7156-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-52887","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52888","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-25741","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-39486","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-39487","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41007","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41010","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41012","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41015","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41017","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41018","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41019","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41020","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41021","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41022","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41023","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41025","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41027","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41028","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41029","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41030","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41031","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41032","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41033","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41034","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41035","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41036","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41037","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41038","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41039","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41041","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41042","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41044","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41045","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41046","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41047","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41048","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41049","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41050","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41051","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41052","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41053","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41054","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41055","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41056","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41057","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41058","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41059","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41060","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41061","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41062","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41063","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41064","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41065","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41066","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41067","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41068","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41069","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41070","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41071","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41072","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41073","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41074","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41075","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41076","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41077","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41078","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41079","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41080","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41081","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41082","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41083","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41084","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41085","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41086","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41087","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41088","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41089","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41090","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41091","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41092","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41093","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41094","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41095","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41096","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41097","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41098","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42063","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42064","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42065","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42066","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42067","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42068","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42069","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42070","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42073","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42074","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42076","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42077","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42079","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42080","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42082","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42084","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42085","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42086","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42087","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42088","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42089","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42090","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42091","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42092","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42093","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42094","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42095","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42096","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42097","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42098","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42100","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42101","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42102","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42103","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42104","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42105","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42106","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42108","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42109","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42110","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42111","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42112","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42113","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42114","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42115","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42117","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42118","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42119","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42120","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42121","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42124","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42126","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42127","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42128","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42129","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42130","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42131","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42132","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42133","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42135","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42136","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42137","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42138","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42140","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42141","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42142","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42144","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42145","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42146","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42147","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42149","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42150","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42151","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42152","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42153","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42155","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42156","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42157","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42158","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42161","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42223","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42225","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42227","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42229","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42230","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42231","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42232","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42234","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42235","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42236","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42237","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42238","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42239","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42240","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42241","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42243","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42244","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42245","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42246","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42247","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42248","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42250","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42251","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42252","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42253","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42271","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42280","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43858","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45001","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45016","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52889","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52918","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27022","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-39472","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41009","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42154","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42159","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42160","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42224","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42228","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42258","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42259","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42260","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42261","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42262","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42263","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42264","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42265","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42267","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42268","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42269","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42270","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42272","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42273","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42274","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42276","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42277","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42278","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42279","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42281","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42283","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42284","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42285","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42286","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42287","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42288","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42289","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42290","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42291","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42292","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42294","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42295","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42296","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42297","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42298","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42299","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42301","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42302","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42303","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42304","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42305","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42306","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42307","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42309","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42310","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42311","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42312","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42313","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42314","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42315","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42316","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42317","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42318","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42319","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42320","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42321","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-42322","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43817","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43818","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43819","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43820","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43821","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43823","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43824","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43825","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43826","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43827","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43828","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43829","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43830","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43831","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43832","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43833","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43834","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43835","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43837","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43839","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43840","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43841","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43842","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43843","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43845","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43846","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43847","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43849","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43850","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43852","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43853","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43854","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43856","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43857","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43859","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43860","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43861","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43863","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43864","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43866","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43867","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43868","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43869","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43870","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43871","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43873","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43875","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43876","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43877","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43879","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43880","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43881","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43882","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43883","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43884","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43886","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43887","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43888","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43889","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43890","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43891","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43892","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43893","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43894","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43895","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43899","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43900","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43902","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43904","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43905","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43906","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43907","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43908","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43909","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43910","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43911","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43912","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43913","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43914","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44931","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44934","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44935","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44937","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44938","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44939","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44940","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44941","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44942","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44943","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44944","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44946","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44947","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44948","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44950","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44953","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44954","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44956","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44957","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44958","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44959","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44960","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44961","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44962","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44963","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44965","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44966","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44967","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44969","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44970","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44971","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44972","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44973","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44974","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44975","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44977","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44978","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44979","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44980","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44982","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44983","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44984","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44985","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44986","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44987","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44988","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44989","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44990","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44991","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44993","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44995","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44996","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44998","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-44999","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45000","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45002","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45003","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45005","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45006","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45007","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45008","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45009","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45010","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45011","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45012","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45013","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45015","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45017","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45018","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45019","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45020","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45021","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45022","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45025","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45026","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45027","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45028","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45029","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45030","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46672","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46673","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46675","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46676","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46677","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46678","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46679","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46680","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46681","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46683","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46685","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46686","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46687","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46689","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46691","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46692","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46693","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46694","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46695","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46697","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46698","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46701","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46702","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46703","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46705","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46706","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46707","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46708","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46709","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46710","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46711","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46713","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46714","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46715","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46716","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46717","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46718","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46719","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46720","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46721","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46722","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46723","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46724","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46725","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46726","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46727","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46728","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46729","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46730","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46731","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46732","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46733","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46735","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46737","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46738","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46739","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46740","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46741","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46743","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46744","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46745","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46746","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46747","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46749","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46750","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46751","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46752","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46753","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46754","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46755","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46756","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46757","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46758","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46759","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46760","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46761","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46762","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46763","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46765","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46766","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46767","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46768","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46770","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46771","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46772","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46773","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46774","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46775","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46776","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46777","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46778","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46779","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46780","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46781","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46782","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46783","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46784","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46785","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46786","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46787","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46788","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46791","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46792","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46793","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46794","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46795","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46797","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46798","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46800","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46802","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46803","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46804","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46805","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46806","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46807","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46808","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46809","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46810","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46811","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46812","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46813","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46814","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46815","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46816","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46817","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46818","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46819","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46821","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46822","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46823","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46824","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46825","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46826","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46827","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46828","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46829","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46830","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46831","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46832","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46834","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46835","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46836","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46838","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46840","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46841","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46842","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46843","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46844","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46845","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46846","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46848","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46849","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46850","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46851","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46852","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46853","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46854","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46855","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46857","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46858","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46859","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46860","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46861","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46864","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46866","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46867","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46868","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46870","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46871","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47658","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47659","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47660","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47661","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47662","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47663","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47664","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47665","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47666","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47667","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47668","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47669","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47674","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47683","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49984","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-43855","title":"md: fix deadlock between mddev_suspend and flush bio","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd: fix deadlock between mddev_suspend and flush bio\n\nDeadlock occurs when mddev is being suspended while some flush bio is in\nprogress. It is a complex issue.\n\nT1. the first flush is at the ending stage, it clears 'mddev-\u003eflush_bio'\n    and tries to submit data, but is blocked because mddev is suspended\n    by T4.\nT2. the second flush sets 'mddev-\u003eflush_bio', and attempts to queue\n    md_submit_flush_data(), which is already running (T1) and won't\n    execute again if on the same CPU as T1.\nT3. the third flush inc active_io and tries to flush, but is blocked because\n    'mddev-\u003eflush_bio' is not NULL (set by T2).\nT4. mddev_suspend() is called and waits for active_io dec to 0 which is inc\n    by T3.\n\n  T1\t\tT2\t\tT3\t\tT4\n  (flush 1)\t(flush 2)\t(third 3)\t(suspend)\n  md_submit_flush_data\n   mddev-\u003eflush_bio = NULL;\n   .\n   .\t \tmd_flush_request\n   .\t  \t mddev-\u003eflush_bio = bio\n   .\t  \t queue submit_flushes\n   .\t\t .\n   .\t\t .\t\tmd_handle_request\n   .\t\t .\t\t active_io + 1\n   .\t\t .\t\t md_flush_request\n   .\t\t .\t\t  wait !mddev-\u003eflush_bio\n   .\t\t .\n   .\t\t .\t\t\t\tmddev_suspend\n   .\t\t .\t\t\t\t wait !active_io\n   .\t\t .\n   .\t\t submit_flushes\n   .\t\t queue_work md_submit_flush_data\n   .\t\t //md_submit_flush_data is already running (T1)\n   .\n   md_handle_request\n    wait resume\n\nThe root issue is non-atomic inc/dec of active_io during flush process.\nactive_io is dec before md_submit_flush_data is queued, and inc soon\nafter md_submit_flush_data() run.\n  md_flush_request\n    active_io + 1\n    submit_flushes\n      active_io - 1\n      md_submit_flush_data\n        md_handle_request\n        active_io + 1\n          make_request\n        active_io - 1\n\nIf active_io is dec after md_handle_request() instead of within\nsubmit_flushes(), make_request() can be called directly intead of\nmd_handle_request() in md_submit_flush_data(), and active_io will\nonly inc and dec once in the whole flush process. Deadlock will be\nfixed.\n\nAdditionally, the only difference between fixing the issue and before is\nthat there is no return error handling of make_request(). But after\nprevious patch cleaned md_write_start(), make_requst() only return error\nin raid5_make_request() by dm-raid, see commit 41425f96d7aa (\"dm-raid456,\nmd/raid456: fix a deadlock for dm-raid456 while io concurrent with\nreshape)\". Since dm always splits data and flush operation into two\nseparate io, io size of flush submitted by dm always is 0, make_request()\nwill not be called in md_submit_flush_data(). To prevent future\nmodifications from introducing issues, add WARN_ON to ensure\nmake_request() no error is returned in this context.","status":"published","published":"2024-08-17T09:22:11.985Z","modified":"2026-05-23T15:53:01.402Z","updated_at":"2026-11-02T14:33:58.357949Z"}],"euvd":[{"id":"EUVD-2024-40505","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd: fix deadlock between mddev_suspend and flush bio\n\nDeadlock occurs when mddev is being suspended while some flush bio is in\nprogress. It is a complex issue.\n\nT1. the first flush is at the ending stage, it clears 'mddev-\u003eflush_bio'\n    and tries to submit data, but is blocked because mddev is suspended\n    by T4.\nT2. the second flush sets 'mddev-\u003eflush_bio', and attempts to queue\n    md_submit_flush_data(), which is already running (T1) and won't\n    execute again if on the same CPU as T1.\nT3. the third flush inc active_io and tries to flush, but is blocked because\n    'mddev-\u003eflush_bio' is not NULL (set by T2).\nT4. mddev_suspend() is called and waits for active_io dec to 0 which is inc\n    by T3.\n\n  T1\t\tT2\t\tT3\t\tT4\n  (flush 1)\t(flush 2)\t(third 3)\t(suspend)\n  md_submit_flush_data\n   mddev-\u003eflush_bio = NULL;\n   .\n   .\t \tmd_flush_request\n   .\t  \t mddev-\u003eflush_bio = bio\n   .\t  \t queue submit_flushes\n   .\t\t .\n   .\t\t .\t\tmd_handle_request\n   .\t\t .\t\t active_io + 1\n   .\t\t .\t\t md_flush_request\n   .\t\t .\t\t  wait !mddev-\u003eflush_bio\n   .\t\t .\n   .\t\t .\t\t\t\tmddev_suspend\n   .\t\t .\t\t\t\t wait !active_io\n   .\t\t .\n   .\t\t submit_flushes\n   .\t\t queue_work md_submit_flush_data\n   .\t\t //md_submit_flush_data is already running (T1)\n   .\n   md_handle_request\n    wait resume\n\nThe root issue is non-atomic inc/dec of active_io during flush process.\nactive_io is dec before md_submit_flush_data is queued, and inc soon\nafter md_submit_flush_data() run.\n  md_flush_request\n    active_io + 1\n    submit_flushes\n      active_io - 1\n      md_submit_flush_data\n        md_handle_request\n        active_io + 1\n          make_request\n        active_io - 1\n\nIf active_io is dec after md_handle_request() instead of within\nsubmit_flushes(), make_request() can be called directly intead of\nmd_handle_request() in md_submit_flush_data(), and active_io will\nonly inc and dec once in the whole flush process. Deadlock will be\nfixed.\n\nAdditionally, the only difference between fixing the issue and before is\nthat there is no return error handling of make_request(). But after\nprevious patch cleaned md_write_start(), make_requst() only return error\nin raid5_make_request() by dm-raid, see commit 41425f96d7aa (\"dm-raid456,\nmd/raid456: fix a deadlock for dm-raid456 while io concurrent with\nreshape)\". Since dm always splits data and flush operation into two\nseparate io, io size of flush submitted by dm always is 0, make_request()\nwill not be called in md_submit_flush_data(). To prevent future\nmodifications from introducing issues, add WARN_ON to ensure\nmake_request() no error is returned in this context.","status":"published","published":"2024-08-17T09:22:11Z","modified":"2026-05-23T15:53:01Z","updated_at":"2026-11-02T18:21:10.23567Z"}],"ghsa":[{"id":"GHSA-5ffp-85mp-h2q2","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd: fix deadlock between...","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd: fix deadlock between mddev_suspend and flush bio\n\nDeadlock occurs when mddev is being suspended while some flush bio is in\nprogress. It is a complex issue.\n\nT1. the first flush is at the ending stage, it clears 'mddev-\u003eflush_bio'\n    and tries to submit data, but is blocked because mddev is suspended\n    by T4.\nT2. the second flush sets 'mddev-\u003eflush_bio', and attempts to queue\n    md_submit_flush_data(), which is already running (T1) and won't\n    execute again if on the same CPU as T1.\nT3. the third flush inc active_io and tries to flush, but is blocked because\n    'mddev-\u003eflush_bio' is not NULL (set by T2).\nT4. mddev_suspend() is called and waits for active_io dec to 0 which is inc\n    by T3.\n\n  T1\t\tT2\t\tT3\t\tT4\n  (flush 1)\t(flush 2)\t(third 3)\t(suspend)\n  md_submit_flush_data\n   mddev-\u003eflush_bio = NULL;\n   .\n   .\t \tmd_flush_request\n   .\t  \t mddev-\u003eflush_bio = bio\n   .\t  \t queue submit_flushes\n   .\t\t .\n   .\t\t .\t\tmd_handle_request\n   .\t\t .\t\t active_io + 1\n   .\t\t .\t\t md_flush_request\n   .\t\t .\t\t  wait !mddev-\u003eflush_bio\n   .\t\t .\n   .\t\t .\t\t\t\tmddev_suspend\n   .\t\t .\t\t\t\t wait !active_io\n   .\t\t .\n   .\t\t submit_flushes\n   .\t\t queue_work md_submit_flush_data\n   .\t\t //md_submit_flush_data is already running (T1)\n   .\n   md_handle_request\n    wait resume\n\nThe root issue is non-atomic inc/dec of active_io during flush process.\nactive_io is dec before md_submit_flush_data is queued, and inc soon\nafter md_submit_flush_data() run.\n  md_flush_request\n    active_io + 1\n    submit_flushes\n      active_io - 1\n      md_submit_flush_data\n        md_handle_request\n        active_io + 1\n          make_request\n        active_io - 1\n\nIf active_io is dec after md_handle_request() instead of within\nsubmit_flushes(), make_request() can be called directly intead of\nmd_handle_request() in md_submit_flush_data(), and active_io will\nonly inc and dec once in the whole flush process. Deadlock will be\nfixed.\n\nAdditionally, the only difference between fixing the issue and before is\nthat there is no return error handling of make_request(). But after\nprevious patch cleaned md_write_start(), make_requst() only return error\nin raid5_make_request() by dm-raid, see commit 41425f96d7aa (\"dm-raid456,\nmd/raid456: fix a deadlock for dm-raid456 while io concurrent with\nreshape)\". Since dm always splits data and flush operation into two\nseparate io, io size of flush submitted by dm always is 0, make_request()\nwill not be called in md_submit_flush_data(). To prevent future\nmodifications from introducing issues, add WARN_ON to ensure\nmake_request() no error is returned in this context.","status":"published","published":"2024-08-17T12:30:33Z","modified":"2025-11-04T00:31:17Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:04:27.827902Z"}],"nvd":[{"id":"CVE-2024-43855","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd: fix deadlock between mddev_suspend and flush bio\n\nDeadlock occurs when mddev is being suspended while some flush bio is in\nprogress. It is a complex issue.\n\nT1. the first flush is at the ending stage, it clears 'mddev-\u003eflush_bio'\n    and tries to submit data, but is blocked because mddev is suspended\n    by T4.\nT2. the second flush sets 'mddev-\u003eflush_bio', and attempts to queue\n    md_submit_flush_data(), which is already running (T1) and won't\n    execute again if on the same CPU as T1.\nT3. the third flush inc active_io and tries to flush, but is blocked because\n    'mddev-\u003eflush_bio' is not NULL (set by T2).\nT4. mddev_suspend() is called and waits for active_io dec to 0 which is inc\n    by T3.\n\n  T1\t\tT2\t\tT3\t\tT4\n  (flush 1)\t(flush 2)\t(third 3)\t(suspend)\n  md_submit_flush_data\n   mddev-\u003eflush_bio = NULL;\n   .\n   .\t \tmd_flush_request\n   .\t  \t mddev-\u003eflush_bio = bio\n   .\t  \t queue submit_flushes\n   .\t\t .\n   .\t\t .\t\tmd_handle_request\n   .\t\t .\t\t active_io + 1\n   .\t\t .\t\t md_flush_request\n   .\t\t .\t\t  wait !mddev-\u003eflush_bio\n   .\t\t .\n   .\t\t .\t\t\t\tmddev_suspend\n   .\t\t .\t\t\t\t wait !active_io\n   .\t\t .\n   .\t\t submit_flushes\n   .\t\t queue_work md_submit_flush_data\n   .\t\t //md_submit_flush_data is already running (T1)\n   .\n   md_handle_request\n    wait resume\n\nThe root issue is non-atomic inc/dec of active_io during flush process.\nactive_io is dec before md_submit_flush_data is queued, and inc soon\nafter md_submit_flush_data() run.\n  md_flush_request\n    active_io + 1\n    submit_flushes\n      active_io - 1\n      md_submit_flush_data\n        md_handle_request\n        active_io + 1\n          make_request\n        active_io - 1\n\nIf active_io is dec after md_handle_request() instead of within\nsubmit_flushes(), make_request() can be called directly intead of\nmd_handle_request() in md_submit_flush_data(), and active_io will\nonly inc and dec once in the whole flush process. Deadlock will be\nfixed.\n\nAdditionally, the only difference between fixing the issue and before is\nthat there is no return error handling of make_request(). But after\nprevious patch cleaned md_write_start(), make_requst() only return error\nin raid5_make_request() by dm-raid, see commit 41425f96d7aa (\"dm-raid456,\nmd/raid456: fix a deadlock for dm-raid456 while io concurrent with\nreshape)\". Since dm always splits data and flush operation into two\nseparate io, io size of flush submitted by dm always is 0, make_request()\nwill not be called in md_submit_flush_data(). To prevent future\nmodifications from introducing issues, add WARN_ON to ensure\nmake_request() no error is returned in this context.","status":"published","published":"2024-08-17T10:15:10.527Z","modified":"2026-06-17T07:51:50.773Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:10:19.135392Z"}],"osv":[{"id":"AZL-47968","title":"CVE-2024-43855 affecting package kernel for versions less than 5.15.167.1-1","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd: fix deadlock between mddev_suspend and flush bio\n\nDeadlock occurs when mddev is being suspended while some flush bio is in\nprogress. It is a complex issue.\n\nT1. the first flush is at the ending stage, it clears 'mddev-\u003eflush_bio'\n    and tries to submit data, but is blocked because mddev is suspended\n    by T4.\nT2. the second flush sets 'mddev-\u003eflush_bio', and attempts to queue\n    md_submit_flush_data(), which is already running (T1) and won't\n    execute again if on the same CPU as T1.\nT3. the third flush inc active_io and tries to flush, but is blocked because\n    'mddev-\u003eflush_bio' is not NULL (set by T2).\nT4. mddev_suspend() is called and waits for active_io dec to 0 which is inc\n    by T3.\n\n  T1\t\tT2\t\tT3\t\tT4\n  (flush 1)\t(flush 2)\t(third 3)\t(suspend)\n  md_submit_flush_data\n   mddev-\u003eflush_bio = NULL;\n   .\n   .\t \tmd_flush_request\n   .\t  \t mddev-\u003eflush_bio = bio\n   .\t  \t queue submit_flushes\n   .\t\t .\n   .\t\t .\t\tmd_handle_request\n   .\t\t .\t\t active_io + 1\n   .\t\t .\t\t md_flush_request\n   .\t\t .\t\t  wait !mddev-\u003eflush_bio\n   .\t\t .\n   .\t\t .\t\t\t\tmddev_suspend\n   .\t\t .\t\t\t\t wait !active_io\n   .\t\t .\n   .\t\t submit_flushes\n   .\t\t queue_work md_submit_flush_data\n   .\t\t //md_submit_flush_data is already running (T1)\n   .\n   md_handle_request\n    wait resume\n\nThe root issue is non-atomic inc/dec of active_io during flush process.\nactive_io is dec before md_submit_flush_data is queued, and inc soon\nafter md_submit_flush_data() run.\n  md_flush_request\n    active_io + 1\n    submit_flushes\n      active_io - 1\n      md_submit_flush_data\n        md_handle_request\n        active_io + 1\n          make_request\n        active_io - 1\n\nIf active_io is dec after md_handle_request() instead of within\nsubmit_flushes(), make_request() can be called directly intead of\nmd_handle_request() in md_submit_flush_data(), and active_io will\nonly inc and dec once in the whole flush process. Deadlock will be\nfixed.\n\nAdditionally, the only difference between fixing the issue and before is\nthat there is no return error handling of make_request(). But after\nprevious patch cleaned md_write_start(), make_requst() only return error\nin raid5_make_request() by dm-raid, see commit 41425f96d7aa (\"dm-raid456,\nmd/raid456: fix a deadlock for dm-raid456 while io concurrent with\nreshape)\". Since dm always splits data and flush operation into two\nseparate io, io size of flush submitted by dm always is 0, make_request()\nwill not be called in md_submit_flush_data(). To prevent future\nmodifications from introducing issues, add WARN_ON to ensure\nmake_request() no error is returned in this context.","status":"published","published":"2024-08-17T10:15:10Z","modified":"2026-04-21T04:31:43.668404Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:05.694722Z"},{"id":"AZL-48003","title":"CVE-2024-43855 affecting package kernel for versions less than 6.6.47.1-1","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd: fix deadlock between mddev_suspend and flush bio\n\nDeadlock occurs when mddev is being suspended while some flush bio is in\nprogress. It is a complex issue.\n\nT1. the first flush is at the ending stage, it clears 'mddev-\u003eflush_bio'\n    and tries to submit data, but is blocked because mddev is suspended\n    by T4.\nT2. the second flush sets 'mddev-\u003eflush_bio', and attempts to queue\n    md_submit_flush_data(), which is already running (T1) and won't\n    execute again if on the same CPU as T1.\nT3. the third flush inc active_io and tries to flush, but is blocked because\n    'mddev-\u003eflush_bio' is not NULL (set by T2).\nT4. mddev_suspend() is called and waits for active_io dec to 0 which is inc\n    by T3.\n\n  T1\t\tT2\t\tT3\t\tT4\n  (flush 1)\t(flush 2)\t(third 3)\t(suspend)\n  md_submit_flush_data\n   mddev-\u003eflush_bio = NULL;\n   .\n   .\t \tmd_flush_request\n   .\t  \t mddev-\u003eflush_bio = bio\n   .\t  \t queue submit_flushes\n   .\t\t .\n   .\t\t .\t\tmd_handle_request\n   .\t\t .\t\t active_io + 1\n   .\t\t .\t\t md_flush_request\n   .\t\t .\t\t  wait !mddev-\u003eflush_bio\n   .\t\t .\n   .\t\t .\t\t\t\tmddev_suspend\n   .\t\t .\t\t\t\t wait !active_io\n   .\t\t .\n   .\t\t submit_flushes\n   .\t\t queue_work md_submit_flush_data\n   .\t\t //md_submit_flush_data is already running (T1)\n   .\n   md_handle_request\n    wait resume\n\nThe root issue is non-atomic inc/dec of active_io during flush process.\nactive_io is dec before md_submit_flush_data is queued, and inc soon\nafter md_submit_flush_data() run.\n  md_flush_request\n    active_io + 1\n    submit_flushes\n      active_io - 1\n      md_submit_flush_data\n        md_handle_request\n        active_io + 1\n          make_request\n        active_io - 1\n\nIf active_io is dec after md_handle_request() instead of within\nsubmit_flushes(), make_request() can be called directly intead of\nmd_handle_request() in md_submit_flush_data(), and active_io will\nonly inc and dec once in the whole flush process. Deadlock will be\nfixed.\n\nAdditionally, the only difference between fixing the issue and before is\nthat there is no return error handling of make_request(). But after\nprevious patch cleaned md_write_start(), make_requst() only return error\nin raid5_make_request() by dm-raid, see commit 41425f96d7aa (\"dm-raid456,\nmd/raid456: fix a deadlock for dm-raid456 while io concurrent with\nreshape)\". Since dm always splits data and flush operation into two\nseparate io, io size of flush submitted by dm always is 0, make_request()\nwill not be called in md_submit_flush_data(). To prevent future\nmodifications from introducing issues, add WARN_ON to ensure\nmake_request() no error is returned in this context.","status":"published","published":"2024-08-17T10:15:10Z","modified":"2026-04-21T04:53:38.824122Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:05.694722Z"},{"id":"BELL-CVE-2024-43855","status":"published","published":"2024-08-22T05:56:36.434427Z","modified":"2026-01-26T09:37:21.129086Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:20.452786Z"},{"id":"DEBIAN-CVE-2024-43855","description":"In the Linux kernel, the following vulnerability has been resolved:  md: fix deadlock between mddev_suspend and flush bio  Deadlock occurs when mddev is being suspended while some flush bio is in progress. It is a complex issue.  T1. the first flush is at the ending stage, it clears 'mddev-\u003eflush_bio'     and tries to submit data, but is blocked because mddev is suspended     by T4. T2. the second flush sets 'mddev-\u003eflush_bio', and attempts to queue     md_submit_flush_data(), which is already running (T1) and won't     execute again if on the same CPU as T1. T3. the third flush inc active_io and tries to flush, but is blocked because     'mddev-\u003eflush_bio' is not NULL (set by T2). T4. mddev_suspend() is called and waits for active_io dec to 0 which is inc     by T3.    T1\t\tT2\t\tT3\t\tT4   (flush 1)\t(flush 2)\t(third 3)\t(suspend)   md_submit_flush_data    mddev-\u003eflush_bio = NULL;    .    .\t \tmd_flush_request    .\t  \t mddev-\u003eflush_bio = bio    .\t  \t queue submit_flushes    .\t\t .    .\t\t .\t\tmd_handle_request    .\t\t .\t\t active_io + 1    .\t\t .\t\t md_flush_request    .\t\t .\t\t  wait !mddev-\u003eflush_bio    .\t\t .    .\t\t .\t\t\t\tmddev_suspend    .\t\t .\t\t\t\t wait !active_io    .\t\t .    .\t\t submit_flushes    .\t\t queue_work md_submit_flush_data    .\t\t //md_submit_flush_data is already running (T1)    .    md_handle_request     wait resume  The root issue is non-atomic inc/dec of active_io during flush process. active_io is dec before md_submit_flush_data is queued, and inc soon after md_submit_flush_data() run.   md_flush_request     active_io + 1     submit_flushes       active_io - 1       md_submit_flush_data         md_handle_request         active_io + 1           make_request         active_io - 1  If active_io is dec after md_handle_request() instead of within submit_flushes(), make_request() can be called directly intead of md_handle_request() in md_submit_flush_data(), and active_io will only inc and dec once in the whole flush process. Deadlock will be fixed.  Additionally, the only difference between fixing the issue and before is that there is no return error handling of make_request(). But after previous patch cleaned md_write_start(), make_requst() only return error in raid5_make_request() by dm-raid, see commit 41425f96d7aa (\"dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape)\". Since dm always splits data and flush operation into two separate io, io size of flush submitted by dm always is 0, make_request() will not be called in md_submit_flush_data(). To prevent future modifications from introducing issues, add WARN_ON to ensure make_request() no error is returned in this context.","status":"published","published":"2024-08-17T10:15:10.527Z","modified":"2026-11-02T12:03:14.053820152Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:43.473331Z"},{"id":"OESA-2024-2124","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbna: ensure the copied buf is NUL terminated\r\n\r\nCurrently, we allocate a nbytes-sized kernel buffer and copy nbytes from\nuserspace to that buffer. Later, we use sscanf on this buffer but we don\u0026apos;t\nensure that the string is terminated inside the buffer, this can lead to\nOOB read when using sscanf. Fix this issue by using memdup_user_nul\ninstead of memdup_user.(CVE-2024-36934)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnilfs2: fix potential kernel bug due to lack of writeback flag waiting\r\n\r\nDestructive writes to a block device on which nilfs2 is mounted can cause\na kernel bug in the folio/page writeback start routine or writeback end\nroutine (__folio_start_writeback in the log below):\r\n\r\n kernel BUG at mm/page-writeback.c:3070!\n Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI\n ...\n RIP: 0010:__folio_start_writeback+0xbaa/0x10e0\n Code: 25 ff 0f 00 00 0f 84 18 01 00 00 e8 40 ca c6 ff e9 17 f6 ff ff\n  e8 36 ca c6 ff 4c 89 f7 48 c7 c6 80 c0 12 84 e8 e7 b3 0f 00 90 \u0026lt;0f\u0026gt;\n  0b e8 1f ca c6 ff 4c 89 f7 48 c7 c6 a0 c6 12 84 e8 d0 b3 0f 00\n ...\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  nilfs_segctor_do_construct+0x4654/0x69d0 [nilfs2]\n  nilfs_segctor_construct+0x181/0x6b0 [nilfs2]\n  nilfs_segctor_thread+0x548/0x11c0 [nilfs2]\n  kthread+0x2f0/0x390\n  ret_from_fork+0x4b/0x80\n  ret_from_fork_asm+0x1a/0x30\n  \u0026lt;/TASK\u0026gt;\r\n\r\nThis is because when the log writer starts a writeback for segment summary\nblocks or a super root block that use the backing device\u0026apos;s page cache, it\ndoes not wait for the ongoing folio/page writeback, resulting in an\ninconsistent writeback state.\r\n\r\nFix this issue by waiting for ongoing writebacks when putting\nfolios/pages on the backing device into writeback state.(CVE-2024-37078)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nxfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()\r\n\r\nip6_dst_idev() can return NULL, xfrm6_get_saddr() must act accordingly.\r\n\r\nsyzbot reported:\r\n\r\nOops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nCPU: 1 PID: 12 Comm: kworker/u8:1 Not tainted 6.10.0-rc2-syzkaller-00383-gb8481381d4e2 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024\nWorkqueue: wg-kex-wg1 wg_packet_handshake_send_worker\n RIP: 0010:xfrm6_get_saddr+0x93/0x130 net/ipv6/xfrm6_policy.c:64\nCode: df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 97 00 00 00 4c 8b ab d8 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 ea 48 c1 ea 03 \u0026lt;80\u0026gt; 3c 02 00 0f 85 86 00 00 00 4d 8b 6d 00 e8 ca 13 47 01 48 b8 00\nRSP: 0018:ffffc90000117378 EFLAGS: 00010246\nRAX: dffffc0000000000 RBX: ffff88807b079dc0 RCX: ffffffff89a0d6d7\nRDX: 0000000000000000 RSI: ffffffff89a0d6e9 RDI: ffff88807b079e98\nRBP: ffff88807ad73248 R08: 0000000000000007 R09: fffffffffffff000\nR10: ffff88807b079dc0 R11: 0000000000000007 R12: ffffc90000117480\nR13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\nFS:  0000000000000000(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f4586d00440 CR3: 0000000079042000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u0026lt;TASK\u0026gt;\n  xfrm_get_saddr net/xfrm/xfrm_policy.c:2452 [inline]\n  xfrm_tmpl_resolve_one net/xfrm/xfrm_policy.c:2481 [inline]\n  xfrm_tmpl_resolve+0xa26/0xf10 net/xfrm/xfrm_policy.c:2541\n  xfrm_resolve_and_create_bundle+0x140/0x2570 net/xfrm/xfrm_policy.c:2835\n  xfrm_bundle_lookup net/xfrm/xfrm_policy.c:3070 [inline]\n  xfrm_lookup_with_ifid+0x4d1/0x1e60 net/xfrm/xfrm_policy.c:3201\n  xfrm_lookup net/xfrm/xfrm_policy.c:3298 [inline]\n  xfrm_lookup_route+0x3b/0x200 net/xfrm/xfrm_policy.c:3309\n  ip6_dst_lookup_flow+0x15c/0x1d0 net/ipv6/ip6_output.c:1256\n  send6+0x611/0xd20 drivers/net/wireguard/socket.c:139\n  wg_socket_send_skb_to_peer+0xf9/0x220 drivers/net/wireguard/socket.c:178\n  wg_socket_send_buffer_to_peer+0x12b/0x190 drivers/net/wireguard/socket.c:200\n  wg_packet_send_handshake_initiation+0x227/0x360 drivers/net/wireguard/send.c:40\n  wg_packet_handshake_send_worker+0x1c/0x30 drivers/net/wireguard/send.c:51\n  process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231\n  process_scheduled_works kernel/workqueue.c:3312 [inline]\n  worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393\n  kthread+0x2c1/0x3a0 kernel/kthread.c:389\n  ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147\n  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244(CVE-2024-40959)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/lima: mask irqs in timeout path before hard reset\r\n\r\nThere is a race condition in which a rendering job might take just long\nenough to trigger the drm sched job timeout handler but also still\ncomplete before the hard reset is done by the timeout handler.\nThis runs into race conditions not expected by the timeout handler.\nIn some very specific cases it currently may result in a refcount\nimbalance on lima_pm_idle, with a stack dump such as:\r\n\r\n[10136.669170] WARNING: CPU: 0 PID: 0 at drivers/gpu/drm/lima/lima_devfreq.c:205 lima_devfreq_record_idle+0xa0/0xb0\n...\n[10136.669459] pc : lima_devfreq_record_idle+0xa0/0xb0\n...\n[10136.669628] Call trace:\n[10136.669634]  lima_devfreq_record_idle+0xa0/0xb0\n[10136.669646]  lima_sched_pipe_task_done+0x5c/0xb0\n[10136.669656]  lima_gp_irq_handler+0xa8/0x120\n[10136.669666]  __handle_irq_event_percpu+0x48/0x160\n[10136.669679]  handle_irq_event+0x4c/0xc0\r\n\r\nWe can prevent that race condition entirely by masking the irqs at the\nbeginning of the timeout handler, at which point we give up on waiting\nfor that job entirely.\nThe irqs will be enabled again at the next hard reset which is already\ndone as a recovery by the timeout handler.(CVE-2024-40976)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nscsi: qedi: Fix crash while reading debugfs attribute\r\n\r\nThe qedi_dbg_do_not_recover_cmd_read() function invokes sprintf() directly\non a __user pointer, which results into the crash.\r\n\r\nTo fix this issue, use a small local stack buffer for sprintf() and then\ncall simple_read_from_buffer(), which in turns make the copy_to_user()\ncall.\r\n\r\nBUG: unable to handle page fault for address: 00007f4801111000\nPGD 8000000864df6067 P4D 8000000864df6067 PUD 864df7067 PMD 846028067 PTE 0\nOops: 0002 [#1] PREEMPT SMP PTI\nHardware name: HPE ProLiant DL380 Gen10/ProLiant DL380 Gen10, BIOS U30 06/15/2023\nRIP: 0010:memcpy_orig+0xcd/0x130\nRSP: 0018:ffffb7a18c3ffc40 EFLAGS: 00010202\nRAX: 00007f4801111000 RBX: 00007f4801111000 RCX: 000000000000000f\nRDX: 000000000000000f RSI: ffffffffc0bfd7a0 RDI: 00007f4801111000\nRBP: ffffffffc0bfd7a0 R08: 725f746f6e5f6f64 R09: 3d7265766f636572\nR10: ffffb7a18c3ffd08 R11: 0000000000000000 R12: 00007f4881110fff\nR13: 000000007fffffff R14: ffffb7a18c3ffca0 R15: ffffffffc0bfd7af\nFS:  00007f480118a740(0000) GS:ffff98e38af00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f4801111000 CR3: 0000000864b8e001 CR4: 00000000007706e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n \u0026lt;TASK\u0026gt;\n ? __die_body+0x1a/0x60\n ? page_fault_oops+0x183/0x510\n ? exc_page_fault+0x69/0x150\n ? asm_exc_page_fault+0x22/0x30\n ? memcpy_orig+0xcd/0x130\n vsnprintf+0x102/0x4c0\n sprintf+0x51/0x80\n qedi_dbg_do_not_recover_cmd_read+0x2f/0x50 [qedi 6bcfdeeecdea037da47069eca2ba717c84a77324]\n full_proxy_read+0x50/0x80\n vfs_read+0xa5/0x2e0\n ? folio_add_new_anon_rmap+0x44/0xa0\n ? set_pte_at+0x15/0x30\n ? do_pte_missing+0x426/0x7f0\n ksys_read+0xa5/0xe0\n do_syscall_64+0x58/0x80\n ? __count_memcg_events+0x46/0x90\n ? count_memcg_event_mm+0x3d/0x60\n ? handle_mm_fault+0x196/0x2f0\n ? do_user_addr_fault+0x267/0x890\n ? exc_page_fault+0x69/0x150\n entry_SYSCALL_64_after_hwframe+0x72/0xdc\nRIP: 0033:0x7f4800f20b4d(CVE-2024-40978)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nfilelock: Remove locks reliably when fcntl/close race is detected\r\n\r\nWhen fcntl_setlk() races with close(), it removes the created lock with\ndo_lock_file_wait().\nHowever, LSMs can allow the first do_lock_file_wait() that created the lock\nwhile denying the second do_lock_file_wait() that tries to remove the lock.\nSeparately, posix_lock_file() could also fail to\nremove a lock due to GFP_KERNEL allocation failure (when splitting a range\nin the middle).\r\n\r\nAfter the bug has been triggered, use-after-free reads will occur in\nlock_get_status() when userspace reads /proc/locks. This can likely be used\nto read arbitrary kernel memory, but can\u0026apos;t corrupt kernel memory.\r\n\r\nFix it by calling locks_remove_posix() instead, which is designed to\nreliably get rid of POSIX locks associated with the given file and\nfiles_struct and is also used by filp_flush().(CVE-2024-41012)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()\r\n\r\nxattr in ocfs2 maybe \u0026apos;non-indexed\u0026apos;, which saved with additional space\nrequested.  It\u0026apos;s better to check if the memory is out of bound before\nmemcmp, although this possibility mainly comes from crafted poisonous\nimages.(CVE-2024-41016)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nASoC: SOF: Intel: hda: fix null deref on system suspend entry\r\n\r\nWhen system enters suspend with an active stream, SOF core\ncalls hw_params_upon_resume(). On Intel platforms with HDA DMA used\nto manage the link DMA, this leads to call chain of\r\n\r\n   hda_dsp_set_hw_params_upon_resume()\n -\u0026gt; hda_dsp_dais_suspend()\n -\u0026gt; hda_dai_suspend()\n -\u0026gt; hda_ipc4_post_trigger()\r\n\r\nA bug is hit in hda_dai_suspend() as hda_link_dma_cleanup() is run first,\nwhich clears hext_stream-\u0026gt;link_substream, and then hda_ipc4_post_trigger()\nis called with a NULL snd_pcm_substream pointer.(CVE-2024-41037)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nvfio/pci: Init the count variable in collecting hot-reset devices\r\n\r\nThe count variable is used without initialization, it results in mistakes\nin the device counting and crashes the userspace if the get hot reset info\npath is triggered.(CVE-2024-41052)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: mac80211: Avoid address calculations via out of bounds array indexing\r\n\r\nreq-\u0026gt;n_channels must be set before req-\u0026gt;channels[] can be used.\r\n\r\nThis patch fixes one of the issues encountered in [1].\r\n\r\n[   83.964255] UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:364:4\n[   83.964258] index 0 is out of range for type \u0026apos;struct ieee80211_channel *[]\u0026apos;\n[...]\n[   83.964264] Call Trace:\n[   83.964267]  \u0026lt;TASK\u0026gt;\n[   83.964269]  dump_stack_lvl+0x3f/0xc0\n[   83.964274]  __ubsan_handle_out_of_bounds+0xec/0x110\n[   83.964278]  ieee80211_prep_hw_scan+0x2db/0x4b0\n[   83.964281]  __ieee80211_start_scan+0x601/0x990\n[   83.964291]  nl80211_trigger_scan+0x874/0x980\n[   83.964295]  genl_family_rcv_msg_doit+0xe8/0x160\n[   83.964298]  genl_rcv_msg+0x240/0x270\n[...]\r\n\r\n[1] https://bugzilla.kernel.org/show_bug.cgi?id=218810(CVE-2024-41071)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnvme-fabrics: use reserved tag for reg read/write command\r\n\r\nIn some scenarios, if too many commands are issued by nvme command in\nthe same time by user tasks, this may exhaust all tags of admin_q. If\na reset (nvme reset or IO timeout) occurs before these commands finish,\nreconnect routine may fail to update nvme regs due to insufficient tags,\nwhich will cause kernel hang forever. In order to workaround this issue,\nmaybe we can let reg_read32()/reg_read64()/reg_write32() use reserved\ntags. This maybe safe for nvmf:\r\n\r\n1. For the disable ctrl path,  we will not issue connect command\n2. For the enable ctrl / fw activate path, since connect and reg_xx()\n   are called serially.\r\n\r\nSo the reserved tags may still be enough while reg_xx() use reserved tags.(CVE-2024-41082)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nata: libata-core: Fix null pointer dereference on error\r\n\r\nIf the ata_port_alloc() call in ata_host_alloc() fails,\nata_host_release() will get called.\r\n\r\nHowever, the code in ata_host_release() tries to free ata_port struct\nmembers unconditionally, which can lead to the following:\r\n\r\nBUG: unable to handle page fault for address: 0000000000003990\nPGD 0 P4D 0\nOops: Oops: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 10 PID: 594 Comm: (udev-worker) Not tainted 6.10.0-rc5 #44\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014\nRIP: 0010:ata_host_release.cold+0x2f/0x6e [libata]\nCode: e4 4d 63 f4 44 89 e2 48 c7 c6 90 ad 32 c0 48 c7 c7 d0 70 33 c0 49 83 c6 0e 41\nRSP: 0018:ffffc90000ebb968 EFLAGS: 00010246\nRAX: 0000000000000041 RBX: ffff88810fb52e78 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: ffff88813b3218c0 RDI: ffff88813b3218c0\nRBP: ffff88810fb52e40 R08: 0000000000000000 R09: 6c65725f74736f68\nR10: ffffc90000ebb738 R11: 73692033203a746e R12: 0000000000000004\nR13: 0000000000000000 R14: 0000000000000011 R15: 0000000000000006\nFS:  00007f6cc55b9980(0000) GS:ffff88813b300000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000003990 CR3: 00000001122a2000 CR4: 0000000000750ef0\nPKRU: 55555554\nCall Trace:\n \u0026lt;TASK\u0026gt;\n ? __die_body.cold+0x19/0x27\n ? page_fault_oops+0x15a/0x2f0\n ? exc_page_fault+0x7e/0x180\n ? asm_exc_page_fault+0x26/0x30\n ? ata_host_release.cold+0x2f/0x6e [libata]\n ? ata_host_release.cold+0x2f/0x6e [libata]\n release_nodes+0x35/0xb0\n devres_release_group+0x113/0x140\n ata_host_alloc+0xed/0x120 [libata]\n ata_host_alloc_pinfo+0x14/0xa0 [libata]\n ahci_init_one+0x6c9/0xd20 [ahci]\r\n\r\nDo not access ata_port struct members unconditionally.(CVE-2024-41098)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nice: Fix improper extts handling\r\n\r\nExtts events are disabled and enabled by the application ts2phc.\nHowever, in case where the driver is removed when the application is\nrunning, a specific extts event remains enabled and can cause a kernel\ncrash.\nAs a side effect, when the driver is reloaded and application is started\nagain, remaining extts event for the channel from a previous run will\nkeep firing and the message \u0026quot;extts on unexpected channel\u0026quot; might be\nprinted to the user.\r\n\r\nTo avoid that, extts events shall be disabled when PTP is released.(CVE-2024-42139)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnvmet: fix a possible leak when destroy a ctrl during qp establishment\r\n\r\nIn nvmet_sq_destroy we capture sq-\u0026gt;ctrl early and if it is non-NULL we\nknow that a ctrl was allocated (in the admin connect request handler)\nand we need to release pending AERs, clear ctrl-\u0026gt;sqs and sq-\u0026gt;ctrl\n(for nvme-loop primarily), and drop the final reference on the ctrl.\r\n\r\nHowever, a small window is possible where nvmet_sq_destroy starts (as\na result of the client giving up and disconnecting) concurrently with\nthe nvme admin connect cmd (which may be in an early stage). But *before*\nkill_and_confirm of sq-\u0026gt;ref (i.e. the admin connect managed to get an sq\nlive reference). In this case, sq-\u0026gt;ctrl was allocated however after it was\ncaptured in a local variable in nvmet_sq_destroy.\nThis prevented the final reference drop on the ctrl.\r\n\r\nSolve this by re-capturing the sq-\u0026gt;ctrl after all inflight request has\ncompleted, where for sure sq-\u0026gt;ctrl reference is final, and move forward\nbased on that.\r\n\r\nThis issue was observed in an environment with many hosts connecting\nmultiple ctrls simoutanuosly, creating a delay in allocating a ctrl\nleading up to this race window.(CVE-2024-42152)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ni2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr\r\n\r\nWhen del_timer_sync() is called in an interrupt context it throws a warning\nbecause of potential deadlock. The timer is used only to exit from\nwait_for_completion() after a timeout so replacing the call with\nwait_for_completion_timeout() allows to remove the problematic timer and\nits related functions altogether.(CVE-2024-42153)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmm: fix crashes from deferred split racing folio migration\r\n\r\nEven on 6.10-rc6, I\u0026apos;ve been seeing elusive \u0026quot;Bad page state\u0026quot;s (often on\nflags when freeing, yet the flags shown are not bad: PG_locked had been\nset and cleared??), and VM_BUG_ON_PAGE(page_ref_count(page) == 0)s from\ndeferred_split_scan()\u0026apos;s folio_put(), and a variety of other BUG and WARN\nsymptoms implying double free by deferred split and large folio migration.\r\n\r\n6.7 commit 9bcef5973e31 (\u0026quot;mm: memcg: fix split queue list crash when large\nfolio migration\u0026quot;) was right to fix the memcg-dependent locking broken in\n85ce2c517ade (\u0026quot;memcontrol: only transfer the memcg data for migration\u0026quot;),\nbut missed a subtlety of deferred_split_scan(): it moves folios to its own\nlocal list to work on them without split_queue_lock, during which time\nfolio-\u0026gt;_deferred_list is not empty, but even the \u0026quot;right\u0026quot; lock does nothing\nto secure the folio and the list it is on.\r\n\r\nFortunately, deferred_split_scan() is careful to use folio_try_get(): so\nfolio_migrate_mapping() can avoid the race by folio_undo_large_rmappable()\nwhile the old folio\u0026apos;s reference count is temporarily frozen to 0 - adding\nsuch a freeze in the !mapping case too (originally, folio lock and\nunmapping and no swap cache left an anon folio unreachable, so no freezing\nwas needed there: but the deferred split queue offers a way to reach it).(CVE-2024-42234)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ns390/mm: Add NULL pointer check to crst_table_free() base_crst_free()\r\n\r\ncrst_table_free() used to work with NULL pointers before the conversion\nto ptdescs.  Since crst_table_free() can be called with a NULL pointer\n(error handling in crst_table_upgrade() add an explicit check.\r\n\r\nAlso add the same check to base_crst_free() for consistency reasons.\r\n\r\nIn real life this should not happen, since order two GFP_KERNEL\nallocations will not fail, unless FAIL_PAGE_ALLOC is enabled and used.(CVE-2024-42235)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nfirmware: cs_dsp: Validate payload length before processing block\r\n\r\nMove the payload length check in cs_dsp_load() and cs_dsp_coeff_load()\nto be done before the block is processed.\r\n\r\nThe check that the length of a block payload does not exceed the number\nof remaining bytes in the firwmware file buffer was being done near the\nend of the loop iteration. However, some code before that check used the\nlength field without validating it.(CVE-2024-42237)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nfirmware: cs_dsp: Return error if block header overflows file\r\n\r\nReturn an error from cs_dsp_power_up() if a block header is longer\nthan the amount of data left in the file.\r\n\r\nThe previous code in cs_dsp_load() and cs_dsp_load_coeff() would loop\nwhile there was enough data left in the file for a valid region. This\nprotected against overrunning the end of the file data, but it didn\u0026apos;t\nabort the file processing with an error.(CVE-2024-42238)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbpf: Fail bpf_timer_cancel when callback is being cancelled\r\n\r\nGiven a schedule:\r\n\r\ntimer1 cb\t\t\ttimer2 cb\r\n\r\nbpf_timer_cancel(timer2);\tbpf_timer_cancel(timer1);\r\n\r\nBoth bpf_timer_cancel calls would wait for the other callback to finish\nexecuting, introducing a lockup.\r\n\r\nAdd an atomic_t count named \u0026apos;cancelling\u0026apos; in bpf_hrtimer. This keeps\ntrack of all in-flight cancellation requests for a given BPF timer.\nWhenever cancelling a BPF timer, we must check if we have outstanding\ncancellation requests, and if so, we must fail the operation with an\nerror (-EDEADLK) since cancellation is synchronous and waits for the\ncallback to finish executing. This implies that we can enter a deadlock\nsituation involving two or more timer callbacks executing in parallel\nand attempting to cancel one another.\r\n\r\nNote that we avoid incrementing the cancelling counter for the target\ntimer (the one being cancelled) if bpf_timer_cancel is not invoked from\na callback, to avoid spurious errors. The whole point of detecting\ncur-\u0026gt;cancelling and returning -EDEADLK is to not enter a busy wait loop\n(which may or may not lead to a lockup). This does not apply in case the\ncaller is in a non-callback context, the other side can continue to\ncancel as it sees fit without running into errors.\r\n\r\nBackground on prior attempts:\r\n\r\nEarlier versions of this patch used a bool \u0026apos;cancelling\u0026apos; bit and used the\nfollowing pattern under timer-\u0026gt;lock to publish cancellation status.\r\n\r\nlock(t-\u0026gt;lock);\nt-\u0026gt;cancelling = true;\nmb();\nif (cur-\u0026gt;cancelling)\n\treturn -EDEADLK;\nunlock(t-\u0026gt;lock);\nhrtimer_cancel(t-\u0026gt;timer);\nt-\u0026gt;cancelling = false;\r\n\r\nThe store outside the critical section could overwrite a parallel\nrequests t-\u0026gt;cancelling assignment to true, to ensure the parallely\nexecuting callback observes its cancellation status.\r\n\r\nIt would be necessary to clear this cancelling bit once hrtimer_cancel\nis done, but lack of serialization introduced races. Another option was\nexplored where bpf_timer_start would clear the bit when (re)starting the\ntimer under timer-\u0026gt;lock. This would ensure serialized access to the\ncancelling bit, but may allow it to be cleared before in-flight\nhrtimer_cancel has finished executing, such that lockups can occur\nagain.\r\n\r\nThus, we choose an atomic counter to keep track of all outstanding\ncancellation requests and use it to prevent lockups in case callbacks\nattempt to cancel each other while executing in parallel.(CVE-2024-42239)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nx86/bhi: Avoid warning in #DB handler due to BHI mitigation\r\n\r\nWhen BHI mitigation is enabled, if SYSENTER is invoked with the TF flag set\nthen entry_SYSENTER_compat() uses CLEAR_BRANCH_HISTORY and calls the\nclear_bhb_loop() before the TF flag is cleared. This causes the #DB handler\n(exc_debug_kernel()) to issue a warning because single-step is used outside the\nentry_SYSENTER_compat() function.\r\n\r\nTo address this issue, entry_SYSENTER_compat() should use CLEAR_BRANCH_HISTORY\nafter making sure the TF flag is cleared.\r\n\r\nThe problem can be reproduced with the following sequence:\r\n\r\n  $ cat sysenter_step.c\n  int main()\n  { asm(\u0026quot;pushf; pop %ax; bts $8,%ax; push %ax; popf; sysenter\u0026quot;); }\r\n\r\n  $ gcc -o sysenter_step sysenter_step.c\r\n\r\n  $ ./sysenter_step\n  Segmentation fault (core dumped)\r\n\r\nThe program is expected to crash, and the #DB handler will issue a warning.\r\n\r\nKernel log:\r\n\r\n  WARNING: CPU: 27 PID: 7000 at arch/x86/kernel/traps.c:1009 exc_debug_kernel+0xd2/0x160\n  ...\n  RIP: 0010:exc_debug_kernel+0xd2/0x160\n  ...\n  Call Trace:\n  \u0026lt;#DB\u0026gt;\n   ? show_regs+0x68/0x80\n   ? __warn+0x8c/0x140\n   ? exc_debug_kernel+0xd2/0x160\n   ? report_bug+0x175/0x1a0\n   ? handle_bug+0x44/0x90\n   ? exc_invalid_op+0x1c/0x70\n   ? asm_exc_invalid_op+0x1f/0x30\n   ? exc_debug_kernel+0xd2/0x160\n   exc_debug+0x43/0x50\n   asm_exc_debug+0x1e/0x40\n  RIP: 0010:clear_bhb_loop+0x0/0xb0\n  ...\n  \u0026lt;/#DB\u0026gt;\n  \u0026lt;TASK\u0026gt;\n   ? entry_SYSENTER_compat_after_hwframe+0x6e/0x8d\n  \u0026lt;/TASK\u0026gt;\r\n\r\n  [ bp: Massage commit message. ](CVE-2024-42240)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmm/shmem: disable PMD-sized page cache if needed\r\n\r\nFor shmem files, it\u0026apos;s possible that PMD-sized page cache can\u0026apos;t be\nsupported by xarray.  For example, 512MB page cache on ARM64 when the base\npage size is 64KB can\u0026apos;t be supported by xarray.  It leads to errors as the\nfollowing messages indicate when this sort of xarray entry is split.\r\n\r\nWARNING: CPU: 34 PID: 7578 at lib/xarray.c:1025 xas_split_alloc+0xf8/0x128\nModules linked in: binfmt_misc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6   \\\nnft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject        \\\nnft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4  \\\nip_set rfkill nf_tables nfnetlink vfat fat virtio_balloon drm fuse xfs  \\\nlibcrc32c crct10dif_ce ghash_ce sha2_ce sha256_arm64 sha1_ce virtio_net \\\nnet_failover virtio_console virtio_blk failover dimlib virtio_mmio\nCPU: 34 PID: 7578 Comm: test Kdump: loaded Tainted: G W 6.10.0-rc5-gavin+ #9\nHardware name: QEMU KVM Virtual Machine, BIOS edk2-20240524-1.el9 05/24/2024\npstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\npc : xas_split_alloc+0xf8/0x128\nlr : split_huge_page_to_list_to_order+0x1c4/0x720\nsp : ffff8000882af5f0\nx29: ffff8000882af5f0 x28: ffff8000882af650 x27: ffff8000882af768\nx26: 0000000000000cc0 x25: 000000000000000d x24: ffff00010625b858\nx23: ffff8000882af650 x22: ffffffdfc0900000 x21: 0000000000000000\nx20: 0000000000000000 x19: ffffffdfc0900000 x18: 0000000000000000\nx17: 0000000000000000 x16: 0000018000000000 x15: 52f8004000000000\nx14: 0000e00000000000 x13: 0000000000002000 x12: 0000000000000020\nx11: 52f8000000000000 x10: 52f8e1c0ffff6000 x9 : ffffbeb9619a681c\nx8 : 0000000000000003 x7 : 0000000000000000 x6 : ffff00010b02ddb0\nx5 : ffffbeb96395e378 x4 : 0000000000000000 x3 : 0000000000000cc0\nx2 : 000000000000000d x1 : 000000000000000c x0 : 0000000000000000\nCall trace:\n xas_split_alloc+0xf8/0x128\n split_huge_page_to_list_to_order+0x1c4/0x720\n truncate_inode_partial_folio+0xdc/0x160\n shmem_undo_range+0x2bc/0x6a8\n shmem_fallocate+0x134/0x430\n vfs_fallocate+0x124/0x2e8\n ksys_fallocate+0x4c/0xa0\n __arm64_sys_fallocate+0x24/0x38\n invoke_syscall.constprop.0+0x7c/0xd8\n do_el0_svc+0xb4/0xd0\n el0_svc+0x44/0x1d8\n el0t_64_sync_handler+0x134/0x150\n el0t_64_sync+0x17c/0x180\r\n\r\nFix it by disabling PMD-sized page cache when HPAGE_PMD_ORDER is larger\nthan MAX_PAGECACHE_ORDER.  As Matthew Wilcox pointed, the page cache in a\nshmem file isn\u0026apos;t represented by a multi-index entry and doesn\u0026apos;t have this\nlimitation when the xarry entry is split until commit 6b24ca4a1a8d (\u0026quot;mm:\nUse multi-index entries in the page cache\u0026quot;).(CVE-2024-42241)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray\r\n\r\nPatch series \u0026quot;mm/filemap: Limit page cache size to that supported by\nxarray\u0026quot;, v2.\r\n\r\nCurrently, xarray can\u0026apos;t support arbitrary page cache size.  More details\ncan be found from the WARN_ON() statement in xas_split_alloc().  In our\ntest whose code is attached below, we hit the WARN_ON() on ARM64 system\nwhere the base page size is 64KB and huge page size is 512MB.  The issue\nwas reported long time ago and some discussions on it can be found here\n[1].\r\n\r\n[1] https://www.spinics.net/lists/linux-xfs/msg75404.html\r\n\r\nIn order to fix the issue, we need to adjust MAX_PAGECACHE_ORDER to one\nsupported by xarray and avoid PMD-sized page cache if needed.  The code\nchanges are suggested by David Hildenbrand.\r\n\r\nPATCH[1] adjusts MAX_PAGECACHE_ORDER to that supported by xarray\nPATCH[2-3] avoids PMD-sized page cache in the synchronous readahead path\nPATCH[4] avoids PMD-sized page cache for shmem files if needed\r\n\r\nTest program\n============\n# cat test.c\n#define _GNU_SOURCE\n#include \u0026lt;stdio.h\u0026gt;\n#include \u0026lt;stdlib.h\u0026gt;\n#include \u0026lt;unistd.h\u0026gt;\n#include \u0026lt;string.h\u0026gt;\n#include \u0026lt;fcntl.h\u0026gt;\n#include \u0026lt;errno.h\u0026gt;\n#include \u0026lt;sys/syscall.h\u0026gt;\n#include \u0026lt;sys/mman.h\u0026gt;\r\n\r\n#define TEST_XFS_FILENAME\t\u0026quot;/tmp/data\u0026quot;\n#define TEST_SHMEM_FILENAME\t\u0026quot;/dev/shm/data\u0026quot;\n#define TEST_MEM_SIZE\t\t0x20000000\r\n\r\nint main(int argc, char **argv)\n{\n\tconst char *filename;\n\tint fd = 0;\n\tvoid *buf = (void *)-1, *p;\n\tint pgsize = getpagesize();\n\tint ret;\r\n\r\n\tif (pgsize != 0x10000) {\n\t\tfprintf(stderr, \u0026quot;64KB base page size is required\\n\u0026quot;);\n\t\treturn -EPERM;\n\t}\r\n\r\n\tsystem(\u0026quot;echo force \u0026gt; /sys/kernel/mm/transparent_hugepage/shmem_enabled\u0026quot;);\n\tsystem(\u0026quot;rm -fr /tmp/data\u0026quot;);\n\tsystem(\u0026quot;rm -fr /dev/shm/data\u0026quot;);\n\tsystem(\u0026quot;echo 1 \u0026gt; /proc/sys/vm/drop_caches\u0026quot;);\r\n\r\n\t/* Open xfs or shmem file */\n\tfilename = TEST_XFS_FILENAME;\n\tif (argc \u0026gt; 1 \u0026amp;\u0026amp; !strcmp(argv[1], \u0026quot;shmem\u0026quot;))\n\t\tfilename = TEST_SHMEM_FILENAME;\r\n\r\n\tfd = open(filename, O_CREAT | O_RDWR | O_TRUNC);\n\tif (fd \u0026lt; 0) {\n\t\tfprintf(stderr, \u0026quot;Unable to open \u0026lt;%s\u0026gt;\\n\u0026quot;, filename);\n\t\treturn -EIO;\n\t}\r\n\r\n\t/* Extend file size */\n\tret = ftruncate(fd, TEST_MEM_SIZE);\n\tif (ret) {\n\t\tfprintf(stderr, \u0026quot;Error %d to ftruncate()\\n\u0026quot;, ret);\n\t\tgoto cleanup;\n\t}\r\n\r\n\t/* Create VMA */\n\tbuf = mmap(NULL, TEST_MEM_SIZE,\n\t\t   PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);\n\tif (buf == (void *)-1) {\n\t\tfprintf(stderr, \u0026quot;Unable to mmap \u0026lt;%s\u0026gt;\\n\u0026quot;, filename);\n\t\tgoto cleanup;\n\t}\r\n\r\n\tfprintf(stdout, \u0026quot;mapped buffer at 0x%p\\n\u0026quot;, buf);\n\tret = madvise(buf, TEST_MEM_SIZE, MADV_HUGEPAGE);\n        if (ret) {\n\t\tfprintf(stderr, \u0026quot;Unable to madvise(MADV_HUGEPAGE)\\n\u0026quot;);\n\t\tgoto cleanup;\n\t}\r\n\r\n\t/* Populate VMA */\n\tret = madvise(buf, TEST_MEM_SIZE, MADV_POPULATE_WRITE);\n\tif (ret) {\n\t\tfprintf(stderr, \u0026quot;Error %d to madvise(MADV_POPULATE_WRITE)\\n\u0026quot;, ret);\n\t\tgoto cleanup;\n\t}\r\n\r\n\t/* Punch the file to enforce xarray split */\n\tret = fallocate(fd, FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE,\n        \t\tTEST_MEM_SIZE - pgsize, pgsize);\n\tif (ret)\n\t\tfprintf(stderr, \u0026quot;Error %d to fallocate()\\n\u0026quot;, ret);\r\n\r\ncleanup:\n\tif (buf != (void *)-1)\n\t\tmunmap(buf, TEST_MEM_SIZE);\n\tif (fd \u0026gt; 0)\n\t\tclose(fd);\r\n\r\n\treturn 0;\n}\r\n\r\n# gcc test.c -o test\n# cat /proc/1/smaps | grep KernelPageSize | head -n 1\nKernelPageSize:       64 kB\n# ./test shmem\n   :\n------------[ cut here ]------------\nWARNING: CPU: 17 PID: 5253 at lib/xarray.c:1025 xas_split_alloc+0xf8/0x128\nModules linked in: nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib  \\\nnft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct    \\\nnft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4    \\\nip_set nf_tables rfkill nfnetlink vfat fat virtio_balloon          \\\ndrm fuse xfs libcrc32c crct10dif_ce ghash_ce sha2_ce sha256_arm64  \\\nvirtio_net sha1_ce net_failover failover virtio_console virtio_blk \\\ndimlib virtio_mmio\nCPU: 17 PID: 5253 Comm: test Kdump: loaded Tainted: G W 6.10.0-rc5-gavin+ #12\nHardware name: QEMU KVM Virtual Machine, BIOS edk2-20240524-1.el9 05/24/2024\npstate: 83400005 (Nzcv daif +PAN -UAO +TC\n---truncated---(CVE-2024-42243)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntty: serial: ma35d1: Add a NULL check for of_node\r\n\r\nThe pdev-\u0026gt;dev.of_node can be NULL if the \u0026quot;serial\u0026quot; node is absent.\nAdd a NULL check to return an error in such cases.(CVE-2024-42248)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ncachefiles: add missing lock protection when polling\r\n\r\nAdd missing lock protection in poll routine when iterating xarray,\notherwise:\r\n\r\nEven with RCU read lock held, only the slot of the radix tree is\nensured to be pinned there, while the data structure (e.g. struct\ncachefiles_req) stored in the slot has no such guarantee.  The poll\nroutine will iterate the radix tree and dereference cachefiles_req\naccordingly.  Thus RCU read lock is not adequate in this case and\nspinlock is needed here.(CVE-2024-42250)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ngpio: pca953x: fix pca953x_irq_bus_sync_unlock race\r\n\r\nEnsure that `i2c_lock\u0026apos; is held when setting interrupt latch and mask in\npca953x_irq_bus_sync_unlock() in order to avoid races.\r\n\r\nThe other (non-probe) call site pca953x_gpio_set_multiple() ensures the\nlock is held before calling pca953x_write_regs().\r\n\r\nThe problem occurred when a request raced against irq_bus_sync_unlock()\napproximately once per thousand reboots on an i.MX8MP based system.\r\n\r\n * Normal case\r\n\r\n   0-0022: write register AI|3a {03,02,00,00,01} Input latch P0\n   0-0022: write register AI|49 {fc,fd,ff,ff,fe} Interrupt mask P0\n   0-0022: write register AI|08 {ff,00,00,00,00} Output P3\n   0-0022: write register AI|12 {fc,00,00,00,00} Config P3\r\n\r\n * Race case\r\n\r\n   0-0022: write register AI|08 {ff,00,00,00,00} Output P3\n   0-0022: write register AI|08 {03,02,00,00,01} *** Wrong register ***\n   0-0022: write register AI|12 {fc,00,00,00,00} Config P3\n   0-0022: write register AI|49 {fc,fd,ff,ff,fe} Interrupt mask P0(CVE-2024-42253)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmm: huge_memory: use !CONFIG_64BIT to relax huge page alignment on 32 bit machines\r\n\r\nYves-Alexis Perez reported commit 4ef9ad19e176 (\u0026quot;mm: huge_memory: don\u0026apos;t\nforce huge page alignment on 32 bit\u0026quot;) didn\u0026apos;t work for x86_32 [1].  It is\nbecause x86_32 uses CONFIG_X86_32 instead of CONFIG_32BIT.\r\n\r\n!CONFIG_64BIT should cover all 32 bit machines.\r\n\r\n[1] https://lore.kernel.org/linux-mm/CAHbLzkr1LwH3pcTgM+aGQ31ip2bKqiqEQ8=FQB+t2c3dhNKNHA@mail.gmail.com/(CVE-2024-42258)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/i915/gem: Fix Virtual Memory mapping boundaries calculation\r\n\r\nCalculating the size of the mapped area as the lesser value\nbetween the requested size and the actual size does not consider\nthe partial mapping offset. This can cause page fault access.\r\n\r\nFix the calculation of the starting and ending addresses, the\ntotal size is now deduced from the difference between the end and\nstart addresses.\r\n\r\nAdditionally, the calculations have been rewritten in a clearer\nand more understandable form.\r\n\r\n[Joonas: Add Requires: tag]\nRequires: 60a2066c5005 (\u0026quot;drm/i915/gem: Adjust vma offset for framebuffer mmap offset\u0026quot;)\n(cherry picked from commit 97b6784753da06d9d40232328efc5c5367e53417)(CVE-2024-42259)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/iucv: fix use after free in iucv_sock_close()\r\n\r\niucv_sever_path() is called from process context and from bh context.\niucv-\u0026gt;path is used as indicator whether somebody else is taking care of\nsevering the path (or it is already removed / never existed).\nThis needs to be done with atomic compare and swap, otherwise there is a\nsmall window where iucv_sock_close() will try to work with a path that has\nalready been severed and freed by iucv_callback_connrej() called by\niucv_tasklet_fn().\r\n\r\nExample:\n[452744.123844] Call Trace:\n[452744.123845] ([\u0026lt;0000001e87f03880\u0026gt;] 0x1e87f03880)\n[452744.123966]  [\u0026lt;00000000d593001e\u0026gt;] iucv_path_sever+0x96/0x138\n[452744.124330]  [\u0026lt;000003ff801ddbca\u0026gt;] iucv_sever_path+0xc2/0xd0 [af_iucv]\n[452744.124336]  [\u0026lt;000003ff801e01b6\u0026gt;] iucv_sock_close+0xa6/0x310 [af_iucv]\n[452744.124341]  [\u0026lt;000003ff801e08cc\u0026gt;] iucv_sock_release+0x3c/0xd0 [af_iucv]\n[452744.124345]  [\u0026lt;00000000d574794e\u0026gt;] __sock_release+0x5e/0xe8\n[452744.124815]  [\u0026lt;00000000d5747a0c\u0026gt;] sock_close+0x34/0x48\n[452744.124820]  [\u0026lt;00000000d5421642\u0026gt;] __fput+0xba/0x268\n[452744.124826]  [\u0026lt;00000000d51b382c\u0026gt;] task_work_run+0xbc/0xf0\n[452744.124832]  [\u0026lt;00000000d5145710\u0026gt;] do_notify_resume+0x88/0x90\n[452744.124841]  [\u0026lt;00000000d5978096\u0026gt;] system_call+0xe2/0x2c8\n[452744.125319] Last Breaking-Event-Address:\n[452744.125321]  [\u0026lt;00000000d5930018\u0026gt;] iucv_path_sever+0x90/0x138\n[452744.125324]\n[452744.125325] Kernel panic - not syncing: Fatal exception in interrupt\r\n\r\nNote that bh_lock_sock() is not serializing the tasklet context against\nprocess context, because the check for sock_owned_by_user() and\ncorresponding handling is missing.\r\n\r\nIdeas for a future clean-up patch:\nA) Correct usage of bh_lock_sock() in tasklet context, as described in\nRe-enqueue, if needed. This may require adding return values to the\ntasklet functions and thus changes to all users of iucv.\r\n\r\nB) Change iucv tasklet into worker and use only lock_sock() in af_iucv.(CVE-2024-42271)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nsched: act_ct: take care of padding in struct zones_ht_key\r\n\r\nBlamed commit increased lookup key size from 2 bytes to 16 bytes,\nbecause zones_ht_key got a struct net pointer.\r\n\r\nMake sure rhashtable_lookup() is not using the padding bytes\nwhich are not initialized.\r\n\r\n BUG: KMSAN: uninit-value in rht_ptr_rcu include/linux/rhashtable.h:376 [inline]\n BUG: KMSAN: uninit-value in __rhashtable_lookup include/linux/rhashtable.h:607 [inline]\n BUG: KMSAN: uninit-value in rhashtable_lookup include/linux/rhashtable.h:646 [inline]\n BUG: KMSAN: uninit-value in rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline]\n BUG: KMSAN: uninit-value in tcf_ct_flow_table_get+0x611/0x2260 net/sched/act_ct.c:329\n  rht_ptr_rcu include/linux/rhashtable.h:376 [inline]\n  __rhashtable_lookup include/linux/rhashtable.h:607 [inline]\n  rhashtable_lookup include/linux/rhashtable.h:646 [inline]\n  rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline]\n  tcf_ct_flow_table_get+0x611/0x2260 net/sched/act_ct.c:329\n  tcf_ct_init+0xa67/0x2890 net/sched/act_ct.c:1408\n  tcf_action_init_1+0x6cc/0xb30 net/sched/act_api.c:1425\n  tcf_action_init+0x458/0xf00 net/sched/act_api.c:1488\n  tcf_action_add net/sched/act_api.c:2061 [inline]\n  tc_ctl_action+0x4be/0x19d0 net/sched/act_api.c:2118\n  rtnetlink_rcv_msg+0x12fc/0x1410 net/core/rtnetlink.c:6647\n  netlink_rcv_skb+0x375/0x650 net/netlink/af_netlink.c:2550\n  rtnetlink_rcv+0x34/0x40 net/core/rtnetlink.c:6665\n  netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline]\n  netlink_unicast+0xf52/0x1260 net/netlink/af_netlink.c:1357\n  netlink_sendmsg+0x10da/0x11e0 net/netlink/af_netlink.c:1901\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg+0x30f/0x380 net/socket.c:745\n  ____sys_sendmsg+0x877/0xb60 net/socket.c:2597\n  ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2651\n  __sys_sendmsg net/socket.c:2680 [inline]\n  __do_sys_sendmsg net/socket.c:2689 [inline]\n  __se_sys_sendmsg net/socket.c:2687 [inline]\n  __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2687\n  x64_sys_call+0x2dd6/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:47\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\r\n\r\nLocal variable key created at:\n  tcf_ct_flow_table_get+0x4a/0x2260 net/sched/act_ct.c:324\n  tcf_ct_init+0xa67/0x2890 net/sched/act_ct.c:1408(CVE-2024-42272)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnvme-pci: add missing condition check for existence of mapped data\r\n\r\nnvme_map_data() is called when request has physical segments, hence\nthe nvme_unmap_data() should have same condition to avoid dereference.(CVE-2024-42276)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\niommu: sprd: Avoid NULL deref in sprd_iommu_hw_en\r\n\r\nIn sprd_iommu_cleanup() before calling function sprd_iommu_hw_en()\ndom-\u0026gt;sdev is equal to NULL, which leads to null dereference.\r\n\r\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2024-42277)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nspi: microchip-core: ensure TX and RX FIFOs are empty at start of a transfer\r\n\r\nWhile transmitting with rx_len == 0, the RX FIFO is not going to be\nemptied in the interrupt handler. A subsequent transfer could then\nread crap from the previous transfer out of the RX FIFO into the\nstart RX buffer. The core provides a register that will empty the RX and\nTX FIFOs, so do that before each transfer.(CVE-2024-42279)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nice: Add a per-VF limit on number of FDIR filters\r\n\r\nWhile the iavf driver adds a s/w limit (128) on the number of FDIR\nfilters that the VF can request, a malicious VF driver can request more\nthan that and exhaust the resources for other VFs.\r\n\r\nAdd a similar limit in ice.(CVE-2024-42291)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nblock: fix deadlock between sd_remove \u0026amp; sd_release\r\n\r\nOur test report the following hung task:\r\n\r\n[ 2538.459400] INFO: task \u0026quot;kworker/0:0\u0026quot;:7 blocked for more than 188 seconds.\n[ 2538.459427] Call trace:\n[ 2538.459430]  __switch_to+0x174/0x338\n[ 2538.459436]  __schedule+0x628/0x9c4\n[ 2538.459442]  schedule+0x7c/0xe8\n[ 2538.459447]  schedule_preempt_disabled+0x24/0x40\n[ 2538.459453]  __mutex_lock+0x3ec/0xf04\n[ 2538.459456]  __mutex_lock_slowpath+0x14/0x24\n[ 2538.459459]  mutex_lock+0x30/0xd8\n[ 2538.459462]  del_gendisk+0xdc/0x350\n[ 2538.459466]  sd_remove+0x30/0x60\n[ 2538.459470]  device_release_driver_internal+0x1c4/0x2c4\n[ 2538.459474]  device_release_driver+0x18/0x28\n[ 2538.459478]  bus_remove_device+0x15c/0x174\n[ 2538.459483]  device_del+0x1d0/0x358\n[ 2538.459488]  __scsi_remove_device+0xa8/0x198\n[ 2538.459493]  scsi_forget_host+0x50/0x70\n[ 2538.459497]  scsi_remove_host+0x80/0x180\n[ 2538.459502]  usb_stor_disconnect+0x68/0xf4\n[ 2538.459506]  usb_unbind_interface+0xd4/0x280\n[ 2538.459510]  device_release_driver_internal+0x1c4/0x2c4\n[ 2538.459514]  device_release_driver+0x18/0x28\n[ 2538.459518]  bus_remove_device+0x15c/0x174\n[ 2538.459523]  device_del+0x1d0/0x358\n[ 2538.459528]  usb_disable_device+0x84/0x194\n[ 2538.459532]  usb_disconnect+0xec/0x300\n[ 2538.459537]  hub_event+0xb80/0x1870\n[ 2538.459541]  process_scheduled_works+0x248/0x4dc\n[ 2538.459545]  worker_thread+0x244/0x334\n[ 2538.459549]  kthread+0x114/0x1bc\r\n\r\n[ 2538.461001] INFO: task \u0026quot;fsck.\u0026quot;:15415 blocked for more than 188 seconds.\n[ 2538.461014] Call trace:\n[ 2538.461016]  __switch_to+0x174/0x338\n[ 2538.461021]  __schedule+0x628/0x9c4\n[ 2538.461025]  schedule+0x7c/0xe8\n[ 2538.461030]  blk_queue_enter+0xc4/0x160\n[ 2538.461034]  blk_mq_alloc_request+0x120/0x1d4\n[ 2538.461037]  scsi_execute_cmd+0x7c/0x23c\n[ 2538.461040]  ioctl_internal_command+0x5c/0x164\n[ 2538.461046]  scsi_set_medium_removal+0x5c/0xb0\n[ 2538.461051]  sd_release+0x50/0x94\n[ 2538.461054]  blkdev_put+0x190/0x28c\n[ 2538.461058]  blkdev_release+0x28/0x40\n[ 2538.461063]  __fput+0xf8/0x2a8\n[ 2538.461066]  __fput_sync+0x28/0x5c\n[ 2538.461070]  __arm64_sys_close+0x84/0xe8\n[ 2538.461073]  invoke_syscall+0x58/0x114\n[ 2538.461078]  el0_svc_common+0xac/0xe0\n[ 2538.461082]  do_el0_svc+0x1c/0x28\n[ 2538.461087]  el0_svc+0x38/0x68\n[ 2538.461090]  el0t_64_sync_handler+0x68/0xbc\n[ 2538.461093]  el0t_64_sync+0x1a8/0x1ac\r\n\r\n  T1:\t\t\t\tT2:\n  sd_remove\n  del_gendisk\n  __blk_mark_disk_dead\n  blk_freeze_queue_start\n  ++q-\u0026gt;mq_freeze_depth\n  \t\t\t\tbdev_release\n \t\t\t\tmutex_lock(\u0026amp;disk-\u0026gt;open_mutex)\n  \t\t\t\tsd_release\n \t\t\t\tscsi_execute_cmd\n \t\t\t\tblk_queue_enter\n \t\t\t\twait_event(!q-\u0026gt;mq_freeze_depth)\n  mutex_lock(\u0026amp;disk-\u0026gt;open_mutex)\r\n\r\nSCSI does not set GD_OWNS_QUEUE, so QUEUE_FLAG_DYING is not set in\nthis scenario. This is a classic ABBA deadlock. To fix the deadlock,\nmake sure we don\u0026apos;t try to acquire disk-\u0026gt;open_mutex after freezing\nthe queue.(CVE-2024-42294)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nf2fs: fix return value of f2fs_convert_inline_inode()\r\n\r\nIf device is readonly, make f2fs_convert_inline_inode()\nreturn EROFS instead of zero, otherwise it may trigger\npanic during writeback of inline inode\u0026apos;s dirty page as\nbelow:\r\n\r\n f2fs_write_single_data_page+0xbb6/0x1e90 fs/f2fs/data.c:2888\n f2fs_write_cache_pages fs/f2fs/data.c:3187 [inline]\n __f2fs_write_data_pages fs/f2fs/data.c:3342 [inline]\n f2fs_write_data_pages+0x1efe/0x3a90 fs/f2fs/data.c:3369\n do_writepages+0x359/0x870 mm/page-writeback.c:2634\n filemap_fdatawrite_wbc+0x125/0x180 mm/filemap.c:397\n __filemap_fdatawrite_range mm/filemap.c:430 [inline]\n file_write_and_wait_range+0x1aa/0x290 mm/filemap.c:788\n f2fs_do_sync_file+0x68a/0x1ae0 fs/f2fs/file.c:276\n generic_write_sync include/linux/fs.h:2806 [inline]\n f2fs_file_write_iter+0x7bd/0x24e0 fs/f2fs/file.c:4977\n call_write_iter include/linux/fs.h:2114 [inline]\n new_sync_write fs/read_write.c:497 [inline]\n vfs_write+0xa72/0xc90 fs/read_write.c:590\n ksys_write+0x1a0/0x2c0 fs/read_write.c:643\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f(CVE-2024-42296)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nASoC: fsl: fsl_qmc_audio: Check devm_kasprintf() returned value\r\n\r\ndevm_kasprintf() can return a NULL pointer on failure but this returned\nvalue is not checked.\r\n\r\nFix this lack and check the returned value.(CVE-2024-42298)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmedia: imx-pxp: Fix ERR_PTR dereference in pxp_probe()\r\n\r\ndevm_regmap_init_mmio() can fail, add a check and bail out in case of\nerror.(CVE-2024-42303)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ncifs: fix potential null pointer use in destroy_workqueue in init_cifs error path\r\n\r\nDan Carpenter reported a Smack static checker warning:\n   fs/smb/client/cifsfs.c:1981 init_cifs()\n   error: we previously assumed \u0026apos;serverclose_wq\u0026apos; could be null (see line 1895)\r\n\r\nThe patch which introduced the serverclose workqueue used the wrong\noredering in error paths in init_cifs() for freeing it on errors.(CVE-2024-42307)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbtrfs: fix extent map use-after-free when adding pages to compressed bio\r\n\r\nAt add_ra_bio_pages() we are accessing the extent map to calculate\n\u0026apos;add_size\u0026apos; after we dropped our reference on the extent map, resulting\nin a use-after-free. Fix this by computing \u0026apos;add_size\u0026apos; before dropping our\nextent map reference.(CVE-2024-42314)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nexfat: fix potential deadlock on __exfat_get_dentry_set\r\n\r\nWhen accessing a file with more entries than ES_MAX_ENTRY_NUM, the bh-array\nis allocated in __exfat_get_entry_set. The problem is that the bh-array is\nallocated with GFP_KERNEL. It does not make sense. In the following cases,\na deadlock for sbi-\u0026gt;s_lock between the two processes may occur.\r\n\r\n       CPU0                CPU1\n       ----                ----\n  kswapd\n   balance_pgdat\n    lock(fs_reclaim)\n                      exfat_iterate\n                       lock(\u0026amp;sbi-\u0026gt;s_lock)\n                       exfat_readdir\n                        exfat_get_uniname_from_ext_entry\n                         exfat_get_dentry_set\n                          __exfat_get_dentry_set\n                           kmalloc_array\n                            ...\n                            lock(fs_reclaim)\n    ...\n    evict\n     exfat_evict_inode\n      lock(\u0026amp;sbi-\u0026gt;s_lock)\r\n\r\nTo fix this, let\u0026apos;s allocate bh-array with GFP_NOFS.(CVE-2024-42315)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmm/mglru: fix div-by-zero in vmpressure_calc_level()\r\n\r\nevict_folios() uses a second pass to reclaim folios that have gone through\npage writeback and become clean before it finishes the first pass, since\nfolio_rotate_reclaimable() cannot handle those folios due to the\nisolation.\r\n\r\nThe second pass tries to avoid potential double counting by deducting\nscan_control-\u0026gt;nr_scanned.  However, this can result in underflow of\nnr_scanned, under a condition where shrink_folio_list() does not increment\nnr_scanned, i.e., when folio_trylock() fails.\r\n\r\nThe underflow can cause the divisor, i.e., scale=scanned+reclaimed in\nvmpressure_calc_level(), to become zero, resulting in the following crash:\r\n\r\n  [exception RIP: vmpressure_work_fn+101]\n  process_one_work at ffffffffa3313f2b\r\n\r\nSince scan_control-\u0026gt;nr_scanned has no established semantics, the potential\ndouble counting has minimal risks.  Therefore, fix the problem by not\ndeducting scan_control-\u0026gt;nr_scanned in evict_folios().(CVE-2024-42316)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmm/huge_memory: avoid PMD-size page cache if needed\r\n\r\nxarray can\u0026apos;t support arbitrary page cache size.  the largest and supported\npage cache size is defined as MAX_PAGECACHE_ORDER by commit 099d90642a71\n(\u0026quot;mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray\u0026quot;).  However,\nit\u0026apos;s possible to have 512MB page cache in the huge memory\u0026apos;s collapsing\npath on ARM64 system whose base page size is 64KB.  512MB page cache is\nbreaking the limitation and a warning is raised when the xarray entry is\nsplit as shown in the following example.\r\n\r\n[root@dhcp-10-26-1-207 ~]# cat /proc/1/smaps | grep KernelPageSize\nKernelPageSize:       64 kB\n[root@dhcp-10-26-1-207 ~]# cat /tmp/test.c\n   :\nint main(int argc, char **argv)\n{\n\tconst char *filename = TEST_XFS_FILENAME;\n\tint fd = 0;\n\tvoid *buf = (void *)-1, *p;\n\tint pgsize = getpagesize();\n\tint ret = 0;\r\n\r\n\tif (pgsize != 0x10000) {\n\t\tfprintf(stdout, \u0026quot;System with 64KB base page size is required!\\n\u0026quot;);\n\t\treturn -EPERM;\n\t}\r\n\r\n\tsystem(\u0026quot;echo 0 \u0026gt; /sys/devices/virtual/bdi/253:0/read_ahead_kb\u0026quot;);\n\tsystem(\u0026quot;echo 1 \u0026gt; /proc/sys/vm/drop_caches\u0026quot;);\r\n\r\n\t/* Open the xfs file */\n\tfd = open(filename, O_RDONLY);\n\tassert(fd \u0026gt; 0);\r\n\r\n\t/* Create VMA */\n\tbuf = mmap(NULL, TEST_MEM_SIZE, PROT_READ, MAP_SHARED, fd, 0);\n\tassert(buf != (void *)-1);\n\tfprintf(stdout, \u0026quot;mapped buffer at 0x%p\\n\u0026quot;, buf);\r\n\r\n\t/* Populate VMA */\n\tret = madvise(buf, TEST_MEM_SIZE, MADV_NOHUGEPAGE);\n\tassert(ret == 0);\n\tret = madvise(buf, TEST_MEM_SIZE, MADV_POPULATE_READ);\n\tassert(ret == 0);\r\n\r\n\t/* Collapse VMA */\n\tret = madvise(buf, TEST_MEM_SIZE, MADV_HUGEPAGE);\n\tassert(ret == 0);\n\tret = madvise(buf, TEST_MEM_SIZE, MADV_COLLAPSE);\n\tif (ret) {\n\t\tfprintf(stdout, \u0026quot;Error %d to madvise(MADV_COLLAPSE)\\n\u0026quot;, errno);\n\t\tgoto out;\n\t}\r\n\r\n\t/* Split xarray entry. Write permission is needed */\n\tmunmap(buf, TEST_MEM_SIZE);\n\tbuf = (void *)-1;\n\tclose(fd);\n\tfd = open(filename, O_RDWR);\n\tassert(fd \u0026gt; 0);\n\tfallocate(fd, FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE,\n \t\t  TEST_MEM_SIZE - pgsize, pgsize);\nout:\n\tif (buf != (void *)-1)\n\t\tmunmap(buf, TEST_MEM_SIZE);\n\tif (fd \u0026gt; 0)\n\t\tclose(fd);\r\n\r\n\treturn ret;\n}\r\n\r\n[root@dhcp-10-26-1-207 ~]# gcc /tmp/test.c -o /tmp/test\n[root@dhcp-10-26-1-207 ~]# /tmp/test\n ------------[ cut here ]------------\n WARNING: CPU: 25 PID: 7560 at lib/xarray.c:1025 xas_split_alloc+0xf8/0x128\n Modules linked in: nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib    \\\n nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct      \\\n nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4      \\\n ip_set rfkill nf_tables nfnetlink vfat fat virtio_balloon drm fuse   \\\n xfs libcrc32c crct10dif_ce ghash_ce sha2_ce sha256_arm64 virtio_net  \\\n sha1_ce net_failover virtio_blk virtio_console failover dimlib virtio_mmio\n CPU: 25 PID: 7560 Comm: test Kdump: loaded Not tainted 6.10.0-rc7-gavin+ #9\n Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20240524-1.el9 05/24/2024\n pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\n pc : xas_split_alloc+0xf8/0x128\n lr : split_huge_page_to_list_to_order+0x1c4/0x780\n sp : ffff8000ac32f660\n x29: ffff8000ac32f660 x28: ffff0000e0969eb0 x27: ffff8000ac32f6c0\n x26: 0000000000000c40 x25: ffff0000e0969eb0 x24: 000000000000000d\n x23: ffff8000ac32f6c0 x22: ffffffdfc0700000 x21: 0000000000000000\n x20: 0000000000000000 x19: ffffffdfc0700000 x18: 0000000000000000\n x17: 0000000000000000 x16: ffffd5f3708ffc70 x15: 0000000000000000\n x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000\n x11: ffffffffffffffc0 x10: 0000000000000040 x9 : ffffd5f3708e692c\n x8 : 0000000000000003 x7 : 0000000000000000 x6 : ffff0000e0969eb8\n x5 : ffffd5f37289e378 x4 : 0000000000000000 x3 : 0000000000000c40\n x2 : 000000000000000d x1 : 000000000000000c x0 : 0000000000000000\n Call trace:\n  xas_split_alloc+0xf8/0x128\n  split_huge_page_to_list_to_order+0x1c4/0x780\n  truncate_inode_partial_folio+0xdc/0x160\n  truncate_inode_pages_range+0x1b4/0x4a8\n  truncate_pagecache_range+0x84/0xa\n---truncated---(CVE-2024-42317)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ns390/dasd: fix error checks in dasd_copy_pair_store()\r\n\r\ndasd_add_busid() can return an error via ERR_PTR() if an allocation\nfails. However, two callsites in dasd_copy_pair_store() do not check\nthe result, potentially resulting in a NULL pointer dereference. Fix\nthis by checking the result with IS_ERR() and returning the error up\nthe stack.(CVE-2024-42320)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: flow_dissector: use DEBUG_NET_WARN_ON_ONCE\r\n\r\nThe following splat is easy to reproduce upstream as well as in -stable\nkernels. Florian Westphal provided the following commit:\r\n\r\n  d1dab4f71d37 (\u0026quot;net: add and use __skb_get_hash_symmetric_net\u0026quot;)\r\n\r\nbut this complementary fix has been also suggested by Willem de Bruijn\nand it can be easily backported to -stable kernel which consists in\nusing DEBUG_NET_WARN_ON_ONCE instead to silence the following splat\ngiven __skb_get_hash() is used by the nftables tracing infrastructure to\nto identify packets in traces.\r\n\r\n[69133.561393] ------------[ cut here ]------------\n[69133.561404] WARNING: CPU: 0 PID: 43576 at net/core/flow_dissector.c:1104 __skb_flow_dissect+0x134f/\n[...]\n[69133.561944] CPU: 0 PID: 43576 Comm: socat Not tainted 6.10.0-rc7+ #379\n[69133.561959] RIP: 0010:__skb_flow_dissect+0x134f/0x2ad0\n[69133.561970] Code: 83 f9 04 0f 84 b3 00 00 00 45 85 c9 0f 84 aa 00 00 00 41 83 f9 02 0f 84 81 fc ff\nff 44 0f b7 b4 24 80 00 00 00 e9 8b f9 ff ff \u0026lt;0f\u0026gt; 0b e9 20 f3 ff ff 41 f6 c6 20 0f 84 e4 ef ff ff 48 8d 7b 12 e8\n[69133.561979] RSP: 0018:ffffc90000006fc0 EFLAGS: 00010246\n[69133.561988] RAX: 0000000000000000 RBX: ffffffff82f33e20 RCX: ffffffff81ab7e19\n[69133.561994] RDX: dffffc0000000000 RSI: ffffc90000007388 RDI: ffff888103a1b418\n[69133.562001] RBP: ffffc90000007310 R08: 0000000000000000 R09: 0000000000000000\n[69133.562007] R10: ffffc90000007388 R11: ffffffff810cface R12: ffff888103a1b400\n[69133.562013] R13: 0000000000000000 R14: ffffffff82f33e2a R15: ffffffff82f33e28\n[69133.562020] FS:  00007f40f7131740(0000) GS:ffff888390800000(0000) knlGS:0000000000000000\n[69133.562027] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[69133.562033] CR2: 00007f40f7346ee0 CR3: 000000015d200001 CR4: 00000000001706f0\n[69133.562040] Call Trace:\n[69133.562044]  \u0026lt;IRQ\u0026gt;\n[69133.562049]  ? __warn+0x9f/0x1a0\n[ 1211.841384]  ? __skb_flow_dissect+0x107e/0x2860\n[...]\n[ 1211.841496]  ? bpf_flow_dissect+0x160/0x160\n[ 1211.841753]  __skb_get_hash+0x97/0x280\n[ 1211.841765]  ? __skb_get_hash_symmetric+0x230/0x230\n[ 1211.841776]  ? mod_find+0xbf/0xe0\n[ 1211.841786]  ? get_stack_info_noinstr+0x12/0xe0\n[ 1211.841798]  ? bpf_ksym_find+0x56/0xe0\n[ 1211.841807]  ? __rcu_read_unlock+0x2a/0x70\n[ 1211.841819]  nft_trace_init+0x1b9/0x1c0 [nf_tables]\n[ 1211.841895]  ? nft_trace_notify+0x830/0x830 [nf_tables]\n[ 1211.841964]  ? get_stack_info+0x2b/0x80\n[ 1211.841975]  ? nft_do_chain_arp+0x80/0x80 [nf_tables]\n[ 1211.842044]  nft_do_chain+0x79c/0x850 [nf_tables](CVE-2024-42321)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: missing check virtio\r\n\r\nTwo missing check in virtio_net_hdr_to_skb() allowed syzbot\nto crash kernels again\r\n\r\n1. After the skb_segment function the buffer may become non-linear\n(nr_frags != 0), but since the SKBTX_SHARED_FRAG flag is not set anywhere\nthe __skb_linearize function will not be executed, then the buffer will\nremain non-linear. Then the condition (offset \u0026gt;= skb_headlen(skb))\nbecomes true, which causes WARN_ON_ONCE in skb_checksum_help.\r\n\r\n2. The struct sk_buff and struct virtio_net_hdr members must be\nmathematically related.\n(gso_size) must be greater than (needed) otherwise WARN_ON_ONCE.\n(remainder) must be greater than (needed) otherwise WARN_ON_ONCE.\n(remainder) may be 0 if division is without remainder.\r\n\r\noffset+2 (4191) \u0026gt; skb_headlen() (1116)\nWARNING: CPU: 1 PID: 5084 at net/core/dev.c:3303 skb_checksum_help+0x5e2/0x740 net/core/dev.c:3303\nModules linked in:\nCPU: 1 PID: 5084 Comm: syz-executor336 Not tainted 6.7.0-rc3-syzkaller-00014-gdf60cee26a2e #0\nHardware name: Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023\nRIP: 0010:skb_checksum_help+0x5e2/0x740 net/core/dev.c:3303\nCode: 89 e8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 52 01 00 00 44 89 e2 2b 53 74 4c 89 ee 48 c7 c7 40 57 e9 8b e8 af 8f dd f8 90 \u0026lt;0f\u0026gt; 0b 90 90 e9 87 fe ff ff e8 40 0f 6e f9 e9 4b fa ff ff 48 89 ef\nRSP: 0018:ffffc90003a9f338 EFLAGS: 00010286\nRAX: 0000000000000000 RBX: ffff888025125780 RCX: ffffffff814db209\nRDX: ffff888015393b80 RSI: ffffffff814db216 RDI: 0000000000000001\nRBP: ffff8880251257f4 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000001 R12: 000000000000045c\nR13: 000000000000105f R14: ffff8880251257f0 R15: 000000000000105d\nFS:  0000555555c24380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000002000f000 CR3: 0000000023151000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u0026lt;TASK\u0026gt;\n ip_do_fragment+0xa1b/0x18b0 net/ipv4/ip_output.c:777\n ip_fragment.constprop.0+0x161/0x230 net/ipv4/ip_output.c:584\n ip_finish_output_gso net/ipv4/ip_output.c:286 [inline]\n __ip_finish_output net/ipv4/ip_output.c:308 [inline]\n __ip_finish_output+0x49c/0x650 net/ipv4/ip_output.c:295\n ip_finish_output+0x31/0x310 net/ipv4/ip_output.c:323\n NF_HOOK_COND include/linux/netfilter.h:303 [inline]\n ip_output+0x13b/0x2a0 net/ipv4/ip_output.c:433\n dst_output include/net/dst.h:451 [inline]\n ip_local_out+0xaf/0x1a0 net/ipv4/ip_output.c:129\n iptunnel_xmit+0x5b4/0x9b0 net/ipv4/ip_tunnel_core.c:82\n ipip6_tunnel_xmit net/ipv6/sit.c:1034 [inline]\n sit_tunnel_xmit+0xed2/0x28f0 net/ipv6/sit.c:1076\n __netdev_start_xmit include/linux/netdevice.h:4940 [inline]\n netdev_start_xmit include/linux/netdevice.h:4954 [inline]\n xmit_one net/core/dev.c:3545 [inline]\n dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3561\n __dev_queue_xmit+0x7c1/0x3d60 net/core/dev.c:4346\n dev_queue_xmit include/linux/netdevice.h:3134 [inline]\n packet_xmit+0x257/0x380 net/packet/af_packet.c:276\n packet_snd net/packet/af_packet.c:3087 [inline]\n packet_sendmsg+0x24ca/0x5240 net/packet/af_packet.c:3119\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg+0xd5/0x180 net/socket.c:745\n __sys_sendto+0x255/0x340 net/socket.c:2190\n __do_sys_sendto net/socket.c:2202 [inline]\n __se_sys_sendto net/socket.c:2198 [inline]\n __x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller(CVE-2024-43817)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nASoC: amd: Adjust error handling in case of absent codec device\r\n\r\nacpi_get_first_physical_node() can return NULL in several cases (no such\ndevice, ACPI table error, reference count drop to 0, etc).\nExisting check just emit error message, but doesn\u0026apos;t perform return.\nThen this NULL pointer is passed to devm_acpi_dev_add_driver_gpios()\nwhere it is dereferenced.\r\n\r\nAdjust this error handling by adding error code return.\r\n\r\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2024-43818)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nscsi: lpfc: Fix a possible null pointer dereference\r\n\r\nIn function lpfc_xcvr_data_show, the memory allocation with kmalloc might\nfail, thereby making rdp_context a null pointer. In the following context\nand functions that use this pointer, there are dereferencing operations,\nleading to null pointer dereference.\r\n\r\nTo fix this issue, a null pointer check should be added. If it is null,\nuse scnprintf to notify the user and return len.(CVE-2024-43821)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\niio: Fix the sorting functionality in iio_gts_build_avail_time_table\r\n\r\nThe sorting in iio_gts_build_avail_time_table is not working as intended.\nIt could result in an out-of-bounds access when the time is zero.\r\n\r\nHere are more details:\r\n\r\n1. When the gts-\u0026gt;itime_table[i].time_us is zero, e.g., the time\nsequence is `3, 0, 1`, the inner for-loop will not terminate and do\nout-of-bound writes. This is because once `times[j] \u0026gt; new`, the value\n`new` will be added in the current position and the `times[j]` will be\nmoved to `j+1` position, which makes the if-condition always hold.\nMeanwhile, idx will be added one, making the loop keep running without\ntermination and out-of-bound write.\n2. If none of the gts-\u0026gt;itime_table[i].time_us is zero, the elements\nwill just be copied without being sorted as described in the comment\n\u0026quot;Sort times from all tables to one and remove duplicates\u0026quot;.\r\n\r\nFor more details, please refer to\nhttps://lore.kernel.org/all/6dd0d822-046c-4dd2-9532-79d7ab96ec05@gmail.com.(CVE-2024-43825)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnfs: pass explicit offset/count to trace events\r\n\r\nnfs_folio_length is unsafe to use without having the folio locked and a\ncheck for a NULL -\u0026gt;f_mapping that protects against truncations and can\nlead to kernel crashes.  E.g. when running xfstests generic/065 with\nall nfs trace points enabled.\r\n\r\nFollow the model of the XFS trace points and pass in an explіcit offset\nand length.  This has the additional benefit that these values can\nbe more accurate as some of the users touch partial folio ranges.(CVE-2024-43826)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/qxl: Add check for drm_cvt_mode\r\n\r\nAdd check for the return value of drm_cvt_mode() and return the error if\nit fails in order to avoid NULL pointer dereference.(CVE-2024-43829)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ns390/uv: Don\u0026apos;t call folio_wait_writeback() without a folio reference\r\n\r\nfolio_wait_writeback() requires that no spinlocks are held and that\na folio reference is held, as documented. After we dropped the PTL, the\nfolio could get freed concurrently. So grab a temporary reference.(CVE-2024-43832)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmedia: v4l: async: Fix NULL pointer dereference in adding ancillary links\r\n\r\nIn v4l2_async_create_ancillary_links(), ancillary links are created for\nlens and flash sub-devices. These are sub-device to sub-device links and\nif the async notifier is related to a V4L2 device, the source sub-device\nof the ancillary link is NULL, leading to a NULL pointer dereference.\nCheck the notifier\u0026apos;s sd field is non-NULL in\nv4l2_async_create_ancillary_links().\r\n\r\n[Sakari Ailus: Reword the subject and commit messages slightly.](CVE-2024-43833)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbpf: Fix null pointer dereference in resolve_prog_type() for BPF_PROG_TYPE_EXT\r\n\r\nWhen loading a EXT program without specifying `attr-\u0026gt;attach_prog_fd`,\nthe `prog-\u0026gt;aux-\u0026gt;dst_prog` will be null. At this time, calling\nresolve_prog_type() anywhere will result in a null pointer dereference.\r\n\r\nExample stack trace:\r\n\r\n[    8.107863] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004\n[    8.108262] Mem abort info:\n[    8.108384]   ESR = 0x0000000096000004\n[    8.108547]   EC = 0x25: DABT (current EL), IL = 32 bits\n[    8.108722]   SET = 0, FnV = 0\n[    8.108827]   EA = 0, S1PTW = 0\n[    8.108939]   FSC = 0x04: level 0 translation fault\n[    8.109102] Data abort info:\n[    8.109203]   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n[    8.109399]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n[    8.109614]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n[    8.109836] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000101354000\n[    8.110011] [0000000000000004] pgd=0000000000000000, p4d=0000000000000000\n[    8.112624] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP\n[    8.112783] Modules linked in:\n[    8.113120] CPU: 0 PID: 99 Comm: may_access_dire Not tainted 6.10.0-rc3-next-20240613-dirty #1\n[    8.113230] Hardware name: linux,dummy-virt (DT)\n[    8.113390] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[    8.113429] pc : may_access_direct_pkt_data+0x24/0xa0\n[    8.113746] lr : add_subprog_and_kfunc+0x634/0x8e8\n[    8.113798] sp : ffff80008283b9f0\n[    8.113813] x29: ffff80008283b9f0 x28: ffff800082795048 x27: 0000000000000001\n[    8.113881] x26: ffff0000c0bb2600 x25: 0000000000000000 x24: 0000000000000000\n[    8.113897] x23: ffff0000c1134000 x22: 000000000001864f x21: ffff0000c1138000\n[    8.113912] x20: 0000000000000001 x19: ffff0000c12b8000 x18: ffffffffffffffff\n[    8.113929] x17: 0000000000000000 x16: 0000000000000000 x15: 0720072007200720\n[    8.113944] x14: 0720072007200720 x13: 0720072007200720 x12: 0720072007200720\n[    8.113958] x11: 0720072007200720 x10: 0000000000f9fca4 x9 : ffff80008021f4e4\n[    8.113991] x8 : 0101010101010101 x7 : 746f72705f6d656d x6 : 000000001e0e0f5f\n[    8.114006] x5 : 000000000001864f x4 : ffff0000c12b8000 x3 : 000000000000001c\n[    8.114020] x2 : 0000000000000002 x1 : 0000000000000000 x0 : 0000000000000000\n[    8.114126] Call trace:\n[    8.114159]  may_access_direct_pkt_data+0x24/0xa0\n[    8.114202]  bpf_check+0x3bc/0x28c0\n[    8.114214]  bpf_prog_load+0x658/0xa58\n[    8.114227]  __sys_bpf+0xc50/0x2250\n[    8.114240]  __arm64_sys_bpf+0x28/0x40\n[    8.114254]  invoke_syscall.constprop.0+0x54/0xf0\n[    8.114273]  do_el0_svc+0x4c/0xd8\n[    8.114289]  el0_svc+0x3c/0x140\n[    8.114305]  el0t_64_sync_handler+0x134/0x150\n[    8.114331]  el0t_64_sync+0x168/0x170\n[    8.114477] Code: 7100707f 54000081 f9401c00 f9403800 (b9400403)\n[    8.118672] ---[ end trace 0000000000000000 ]---\r\n\r\nOne way to fix it is by forcing `attach_prog_fd` non-empty when\nbpf_prog_load(). But this will lead to `libbpf_probe_bpf_prog_type`\nAPI broken which use verifier log to probe prog type and will log\nnothing if we reject invalid EXT prog before bpf_check().\r\n\r\nAnother way is by adding null check in resolve_prog_type().\r\n\r\nThe issue was introduced by commit 4a9c7bbe2ed4 (\u0026quot;bpf: Resolve to\nprog-\u0026gt;aux-\u0026gt;dst_prog-\u0026gt;type only for BPF_PROG_TYPE_EXT\u0026quot;) which wanted\nto correct type resolution for BPF_PROG_TYPE_TRACING programs. Before\nthat, the type resolution of BPF_PROG_TYPE_EXT prog actually follows\nthe logic below:\r\n\r\n  prog-\u0026gt;aux-\u0026gt;dst_prog ? prog-\u0026gt;aux-\u0026gt;dst_prog-\u0026gt;type : prog-\u0026gt;type;\r\n\r\nIt implies that when EXT program is not yet attached to `dst_prog`,\nthe prog type should be EXT itself. This code worked fine in the past.\nSo just keep using it.\r\n\r\nFix this by returning `prog-\u0026gt;type` for BPF_PROG_TYPE_EXT if `dst_prog`\nis not present in resolve_prog_type().(CVE-2024-43837)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: virt_wifi: avoid reporting connection success with wrong SSID\r\n\r\nWhen user issues a connection with a different SSID than the one\nvirt_wifi has advertised, the __cfg80211_connect_result() will\ntrigger the warning: WARN_ON(bss_not_found).\r\n\r\nThe issue is because the connection code in virt_wifi does not\ncheck the SSID from user space (it only checks the BSSID), and\nvirt_wifi will call cfg80211_connect_result() with WLAN_STATUS_SUCCESS\neven if the SSID is different from the one virt_wifi has advertised.\nEventually cfg80211 won\u0026apos;t be able to find the cfg80211_bss and generate\nthe warning.\r\n\r\nFixed it by checking the SSID (from user space) in the connection code.(CVE-2024-43841)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter()\r\n\r\nIn rtw89_sta_info_get_iter() \u0026apos;status-\u0026gt;he_gi\u0026apos; is compared to array size.\nBut then \u0026apos;rate-\u0026gt;he_gi\u0026apos; is used as array index instead of \u0026apos;status-\u0026gt;he_gi\u0026apos;.\nThis can lead to go beyond array boundaries in case of \u0026apos;rate-\u0026gt;he_gi\u0026apos; is\nnot equal to \u0026apos;status-\u0026gt;he_gi\u0026apos; and is bigger than array size. Looks like\n\u0026quot;copy-paste\u0026quot; mistake.\r\n\r\nFix this mistake by replacing \u0026apos;rate-\u0026gt;he_gi\u0026apos; with \u0026apos;status-\u0026gt;he_gi\u0026apos;.\r\n\r\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2024-43842)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nudf: Fix bogus checksum computation in udf_rename()\r\n\r\nSyzbot reports uninitialized memory access in udf_rename() when updating\nchecksum of \u0026apos;..\u0026apos; directory entry of a moved directory. This is indeed\ntrue as we pass on-stack diriter.fi to the udf_update_tag() and because\nthat has only struct fileIdentDesc included in it and not the impUse or\nname fields, the checksumming function is going to checksum random stack\ncontents beyond the end of the structure. This is actually harmless\nbecause the following udf_fiiter_write_fi() will recompute the checksum\nfrom on-disk buffers where everything is properly included. So all that\nis needed is just removing the bogus calculation.(CVE-2024-43845)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nlib: objagg: Fix general protection fault\r\n\r\nThe library supports aggregation of objects into other objects only if\nthe parent object does not have a parent itself. That is, nesting is not\nsupported.\r\n\r\nAggregation happens in two cases: Without and with hints, where hints\nare a pre-computed recommendation on how to aggregate the provided\nobjects.\r\n\r\nNesting is not possible in the first case due to a check that prevents\nit, but in the second case there is no check because the assumption is\nthat nesting cannot happen when creating objects based on hints. The\nviolation of this assumption leads to various warnings and eventually to\na general protection fault [1].\r\n\r\nBefore fixing the root cause, error out when nesting happens and warn.\r\n\r\n[1]\ngeneral protection fault, probably for non-canonical address 0xdead000000000d90: 0000 [#1] PREEMPT SMP PTI\nCPU: 1 PID: 1083 Comm: kworker/1:9 Tainted: G        W          6.9.0-rc6-custom-gd9b4f1cca7fb #7\nHardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019\nWorkqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work\nRIP: 0010:mlxsw_sp_acl_erp_bf_insert+0x25/0x80\n[...]\nCall Trace:\n \u0026lt;TASK\u0026gt;\n mlxsw_sp_acl_atcam_entry_add+0x256/0x3c0\n mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0\n mlxsw_sp_acl_tcam_vchunk_migrate_one+0x16b/0x270\n mlxsw_sp_acl_tcam_vregion_rehash_work+0xbe/0x510\n process_one_work+0x151/0x370\n worker_thread+0x2cb/0x3e0\n kthread+0xd0/0x100\n ret_from_fork+0x34/0x50\n ret_from_fork_asm+0x1a/0x30\n \u0026lt;/TASK\u0026gt;(CVE-2024-43846)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: ath12k: fix invalid memory access while processing fragmented packets\r\n\r\nThe monitor ring and the reo reinject ring share the same ring mask index.\nWhen the driver receives an interrupt for the reo reinject ring, the\nmonitor ring is also processed, leading to invalid memory access. Since\nmonitor support is not yet enabled in ath12k, the ring mask for the monitor\nring should be removed.\r\n\r\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00209-QCAHKSWPL_SILICONZ-1(CVE-2024-43847)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nsoc: qcom: pdr: protect locator_addr with the main mutex\r\n\r\nIf the service locator server is restarted fast enough, the PDR can\nrewrite locator_addr fields concurrently. Protect them by placing\nmodification of those fields under the main pdr-\u0026gt;lock.(CVE-2024-43849)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nsoc: qcom: icc-bwmon: Fix refcount imbalance seen during bwmon_remove\r\n\r\nThe following warning is seen during bwmon_remove due to refcount\nimbalance, fix this by releasing the OPPs after use.\r\n\r\nLogs:\nWARNING: at drivers/opp/core.c:1640 _opp_table_kref_release+0x150/0x158\nHardware name: Qualcomm Technologies, Inc. X1E80100 CRD (DT)\n...\nCall trace:\n_opp_table_kref_release+0x150/0x158\ndev_pm_opp_remove_table+0x100/0x1b4\ndevm_pm_opp_of_table_release+0x10/0x1c\ndevm_action_release+0x14/0x20\ndevres_release_all+0xa4/0x104\ndevice_unbind_cleanup+0x18/0x60\ndevice_release_driver_internal+0x1ec/0x228\ndriver_detach+0x50/0x98\nbus_remove_driver+0x6c/0xbc\ndriver_unregister+0x30/0x60\nplatform_driver_unregister+0x14/0x20\nbwmon_driver_exit+0x18/0x524 [icc_bwmon]\n__arm64_sys_delete_module+0x184/0x264\ninvoke_syscall+0x48/0x118\nel0_svc_common.constprop.0+0xc8/0xe8\ndo_el0_svc+0x20/0x2c\nel0_svc+0x34/0xdc\nel0t_64_sync_handler+0x13c/0x158\nel0t_64_sync+0x190/0x194\n--[ end trace 0000000000000000 ]---(CVE-2024-43850)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nsoc: xilinx: rename cpu_number1 to dummy_cpu_number\r\n\r\nThe per cpu variable cpu_number1 is passed to xlnx_event_handler as\nargument \u0026quot;dev_id\u0026quot;, but it is not used in this function. So drop the\ninitialization of this variable and rename it to dummy_cpu_number.\nThis patch is to fix the following call trace when the kernel option\nCONFIG_DEBUG_ATOMIC_SLEEP is enabled:\r\n\r\nBUG: sleeping function called from invalid context at include/linux/sched/mm.h:274\n    in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1, name: swapper/0\n    preempt_count: 1, expected: 0\n    CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.1.0 #53\n    Hardware name: Xilinx Versal vmk180 Eval board rev1.1 (QSPI) (DT)\n    Call trace:\n     dump_backtrace+0xd0/0xe0\n     show_stack+0x18/0x40\n     dump_stack_lvl+0x7c/0xa0\n     dump_stack+0x18/0x34\n     __might_resched+0x10c/0x140\n     __might_sleep+0x4c/0xa0\n     __kmem_cache_alloc_node+0xf4/0x168\n     kmalloc_trace+0x28/0x38\n     __request_percpu_irq+0x74/0x138\n     xlnx_event_manager_probe+0xf8/0x298\n     platform_probe+0x68/0xd8(CVE-2024-43851)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmd: fix deadlock between mddev_suspend and flush bio\r\n\r\nDeadlock occurs when mddev is being suspended while some flush bio is in\nprogress. It is a complex issue.\r\n\r\nT1. the first flush is at the ending stage, it clears \u0026apos;mddev-\u0026gt;flush_bio\u0026apos;\n    and tries to submit data, but is blocked because mddev is suspended\n    by T4.\nT2. the second flush sets \u0026apos;mddev-\u0026gt;flush_bio\u0026apos;, and attempts to queue\n    md_submit_flush_data(), which is already running (T1) and won\u0026apos;t\n    execute again if on the same CPU as T1.\nT3. the third flush inc active_io and tries to flush, but is blocked because\n    \u0026apos;mddev-\u0026gt;flush_bio\u0026apos; is not NULL (set by T2).\nT4. mddev_suspend() is called and waits for active_io dec to 0 which is inc\n    by T3.\r\n\r\n  T1\t\tT2\t\tT3\t\tT4\n  (flush 1)\t(flush 2)\t(third 3)\t(suspend)\n  md_submit_flush_data\n   mddev-\u0026gt;flush_bio = NULL;\n   .\n   .\t \tmd_flush_request\n   .\t  \t mddev-\u0026gt;flush_bio = bio\n   .\t  \t queue submit_flushes\n   .\t\t .\n   .\t\t .\t\tmd_handle_request\n   .\t\t .\t\t active_io + 1\n   .\t\t .\t\t md_flush_request\n   .\t\t .\t\t  wait !mddev-\u0026gt;flush_bio\n   .\t\t .\n   .\t\t .\t\t\t\tmddev_suspend\n   .\t\t .\t\t\t\t wait !active_io\n   .\t\t .\n   .\t\t submit_flushes\n   .\t\t queue_work md_submit_flush_data\n   .\t\t //md_submit_flush_data is already running (T1)\n   .\n   md_handle_request\n    wait resume\r\n\r\nThe root issue is non-atomic inc/dec of active_io during flush process.\nactive_io is dec before md_submit_flush_data is queued, and inc soon\nafter md_submit_flush_data() run.\n  md_flush_request\n    active_io + 1\n    submit_flushes\n      active_io - 1\n      md_submit_flush_data\n        md_handle_request\n        active_io + 1\n          make_request\n        active_io - 1\r\n\r\nIf active_io is dec after md_handle_request() instead of within\nsubmit_flushes(), make_request() can be called directly intead of\nmd_handle_request() in md_submit_flush_data(), and active_io will\nonly inc and dec once in the whole flush process. Deadlock will be\nfixed.\r\n\r\nAdditionally, the only difference between fixing the issue and before is\nthat there is no return error handling of make_request(). But after\nprevious patch cleaned md_write_start(), make_requst() only return error\nin raid5_make_request() by dm-raid, see commit 41425f96d7aa (\u0026quot;dm-raid456,\nmd/raid456: fix a deadlock for dm-raid456 while io concurrent with\nreshape)\u0026quot;. Since dm always splits data and flush operation into two\nseparate io, io size of flush submitted by dm always is 0, make_request()\nwill not be called in md_submit_flush_data(). To prevent future\nmodifications from introducing issues, add WARN_ON to ensure\nmake_request() no error is returned in this context.(CVE-2024-43855)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndma: fix call order in dmam_free_coherent\r\n\r\ndmam_free_coherent() frees a DMA allocation, which makes the\nfreed vaddr available for reuse, then calls devres_destroy()\nto remove and free the data structure used to track the DMA\nallocation. Between the two calls, it is possible for a\nconcurrent task to make an allocation with the same vaddr\nand add it to the devres list.\r\n\r\nIf this happens, there will be two entries in the devres list\nwith the same vaddr and devres_destroy() can free the wrong\nentry, triggering the WARN_ON() in dmam_match.\r\n\r\nFix by destroying the devres entry before freeing the DMA\nallocation.\r\n\r\n  kokonut //net/encryption\n    http://sponge2/b9145fe6-0f72-4325-ac2f-a84d81075b03(CVE-2024-43856)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nf2fs: fix to truncate preallocated blocks in f2fs_file_open()\r\n\r\nchenyuwen reports a f2fs bug as below:\r\n\r\nUnable to handle kernel NULL pointer dereference at virtual address 0000000000000011\n fscrypt_set_bio_crypt_ctx+0x78/0x1e8\n f2fs_grab_read_bio+0x78/0x208\n f2fs_submit_page_read+0x44/0x154\n f2fs_get_read_data_page+0x288/0x5f4\n f2fs_get_lock_data_page+0x60/0x190\n truncate_partial_data_page+0x108/0x4fc\n f2fs_do_truncate_blocks+0x344/0x5f0\n f2fs_truncate_blocks+0x6c/0x134\n f2fs_truncate+0xd8/0x200\n f2fs_iget+0x20c/0x5ac\n do_garbage_collect+0x5d0/0xf6c\n f2fs_gc+0x22c/0x6a4\n f2fs_disable_checkpoint+0xc8/0x310\n f2fs_fill_super+0x14bc/0x1764\n mount_bdev+0x1b4/0x21c\n f2fs_mount+0x20/0x30\n legacy_get_tree+0x50/0xbc\n vfs_get_tree+0x5c/0x1b0\n do_new_mount+0x298/0x4cc\n path_mount+0x33c/0x5fc\n __arm64_sys_mount+0xcc/0x15c\n invoke_syscall+0x60/0x150\n el0_svc_common+0xb8/0xf8\n do_el0_svc+0x28/0xa0\n el0_svc+0x24/0x84\n el0t_64_sync_handler+0x88/0xec\r\n\r\nIt is because inode.i_crypt_info is not initialized during below path:\n- mount\n - f2fs_fill_super\n  - f2fs_disable_checkpoint\n   - f2fs_gc\n    - f2fs_iget\n     - f2fs_truncate\r\n\r\nSo, let\u0026apos;s relocate truncation of preallocated blocks to f2fs_file_open(),\nafter fscrypt_file_open().(CVE-2024-43859)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nusb: vhci-hcd: Do not drop references before new references are gained\r\n\r\nAt a few places the driver carries stale pointers\nto references that can still be used. Make sure that does not happen.\nThis strictly speaking closes ZDI-CAN-22273, though there may be\nsimilar races in the driver.(CVE-2024-43883)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nBluetooth: MGMT: Add error handling to pair_device()\r\n\r\nhci_conn_params_add() never checks for a NULL value and could lead to a NULL\npointer dereference causing a crash.\r\n\r\nFixed by adding error handling in the function.(CVE-2024-43884)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\npadata: Fix possible divide-by-0 panic in padata_mt_helper()\r\n\r\nWe are hit with a not easily reproducible divide-by-0 panic in padata.c at\nbootup time.\r\n\r\n  [   10.017908] Oops: divide error: 0000 1 PREEMPT SMP NOPTI\n  [   10.017908] CPU: 26 PID: 2627 Comm: kworker/u1666:1 Not tainted 6.10.0-15.el10.x86_64 #1\n  [   10.017908] Hardware name: Lenovo ThinkSystem SR950 [7X12CTO1WW]/[7X12CTO1WW], BIOS [PSE140J-2.30] 07/20/2021\n  [   10.017908] Workqueue: events_unbound padata_mt_helper\n  [   10.017908] RIP: 0010:padata_mt_helper+0x39/0xb0\n    :\n  [   10.017963] Call Trace:\n  [   10.017968]  \u0026lt;TASK\u0026gt;\n  [   10.018004]  ? padata_mt_helper+0x39/0xb0\n  [   10.018084]  process_one_work+0x174/0x330\n  [   10.018093]  worker_thread+0x266/0x3a0\n  [   10.018111]  kthread+0xcf/0x100\n  [   10.018124]  ret_from_fork+0x31/0x50\n  [   10.018138]  ret_from_fork_asm+0x1a/0x30\n  [   10.018147]  \u0026lt;/TASK\u0026gt;\r\n\r\nLooking at the padata_mt_helper() function, the only way a divide-by-0\npanic can happen is when ps-\u0026gt;chunk_size is 0.  The way that chunk_size is\ninitialized in padata_do_multithreaded(), chunk_size can be 0 when the\nmin_chunk in the passed-in padata_mt_job structure is 0.\r\n\r\nFix this divide-by-0 panic by making sure that chunk_size will be at least\n1 no matter what the input parameters are.(CVE-2024-43889)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntracing: Fix overflow in get_free_elt()\r\n\r\n\u0026quot;tracing_map-\u0026gt;next_elt\u0026quot; in get_free_elt() is at risk of overflowing.\r\n\r\nOnce it overflows, new elements can still be inserted into the tracing_map\neven though the maximum number of elements (`max_elts`) has been reached.\nContinuing to insert elements after the overflow could result in the\ntracing_map containing \u0026quot;tracing_map-\u0026gt;max_size\u0026quot; elements, leaving no empty\nentries.\nIf any attempt is made to insert an element into a full tracing_map using\n`__tracing_map_insert()`, it will cause an infinite loop with preemption\ndisabled, leading to a CPU hang problem.\r\n\r\nFix this by preventing any further increments to \u0026quot;tracing_map-\u0026gt;next_elt\u0026quot;\nonce it reaches \u0026quot;tracing_map-\u0026gt;max_elt\u0026quot;.(CVE-2024-43890)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntracing: Have format file honor EVENT_FILE_FL_FREED\r\n\r\nWhen eventfs was introduced, special care had to be done to coordinate the\nfreeing of the file meta data with the files that are exposed to user\nspace. The file meta data would have a ref count that is set when the file\nis created and would be decremented and freed after the last user that\nopened the file closed it. When the file meta data was to be freed, it\nwould set a flag (EVENT_FILE_FL_FREED) to denote that the file is freed,\nand any new references made (like new opens or reads) would fail as it is\nmarked freed. This allowed other meta data to be freed after this flag was\nset (under the event_mutex).\r\n\r\nAll the files that were dynamically created in the events directory had a\npointer to the file meta data and would call event_release() when the last\nreference to the user space file was closed. This would be the time that it\nis safe to free the file meta data.\r\n\r\nA shortcut was made for the \u0026quot;format\u0026quot; file. It\u0026apos;s i_private would point to\nthe \u0026quot;call\u0026quot; entry directly and not point to the file\u0026apos;s meta data. This is\nbecause all format files are the same for the same \u0026quot;call\u0026quot;, so it was\nthought there was no reason to differentiate them.  The other files\nmaintain state (like the \u0026quot;enable\u0026quot;, \u0026quot;trigger\u0026quot;, etc). But this meant if the\nfile were to disappear, the \u0026quot;format\u0026quot; file would be unaware of it.\r\n\r\nThis caused a race that could be trigger via the user_events test (that\nwould create dynamic events and free them), and running a loop that would\nread the user_events format files:\r\n\r\nIn one console run:\r\n\r\n # cd tools/testing/selftests/user_events\n # while true; do ./ftrace_test; done\r\n\r\nAnd in another console run:\r\n\r\n # cd /sys/kernel/tracing/\n # while true; do cat events/user_events/__test_event/format; done 2\u0026gt;/dev/null\r\n\r\nWith KASAN memory checking, it would trigger a use-after-free bug report\n(which was a real bug). This was because the format file was not checking\nthe file\u0026apos;s meta data flag \u0026quot;EVENT_FILE_FL_FREED\u0026quot;, so it would access the\nevent that the file meta data pointed to after the event was freed.\r\n\r\nAfter inspection, there are other locations that were found to not check\nthe EVENT_FILE_FL_FREED flag when accessing the trace_event_file. Add a\nnew helper function: event_file_file() that will make sure that the\nevent_mutex is held, and will return NULL if the trace_event_file has the\nEVENT_FILE_FL_FREED flag set. Have the first reference of the struct file\npointer use event_file_file() and check for NULL. Later uses can still use\nthe event_file_data() helper function if the event_mutex is still held and\nwas not released since the event_file_file() call.(CVE-2024-43891)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/amd/display: Skip Recompute DSC Params if no Stream on Link\r\n\r\n[why]\nEncounter NULL pointer dereference uner mst + dsc setup.\r\n\r\nBUG: kernel NULL pointer dereference, address: 0000000000000008\n    PGD 0 P4D 0\n    Oops: 0000 [#1] PREEMPT SMP NOPTI\n    CPU: 4 PID: 917 Comm: sway Not tainted 6.3.9-arch1-1 #1 124dc55df4f5272ccb409f39ef4872fc2b3376a2\n    Hardware name: LENOVO 20NKS01Y00/20NKS01Y00, BIOS R12ET61W(1.31 ) 07/28/2022\n    RIP: 0010:drm_dp_atomic_find_time_slots+0x5e/0x260 [drm_display_helper]\n    Code: 01 00 00 48 8b 85 60 05 00 00 48 63 80 88 00 00 00 3b 43 28 0f 8d 2e 01 00 00 48 8b 53 30 48 8d 04 80 48 8d 04 c2 48 8b 40 18 \u0026lt;48\u0026gt; 8\u0026gt;\n    RSP: 0018:ffff960cc2df77d8 EFLAGS: 00010293\n    RAX: 0000000000000000 RBX: ffff8afb87e81280 RCX: 0000000000000224\n    RDX: ffff8afb9ee37c00 RSI: ffff8afb8da1a578 RDI: ffff8afb87e81280\n    RBP: ffff8afb83d67000 R08: 0000000000000001 R09: ffff8afb9652f850\n    R10: ffff960cc2df7908 R11: 0000000000000002 R12: 0000000000000000\n    R13: ffff8afb8d7688a0 R14: ffff8afb8da1a578 R15: 0000000000000224\n    FS:  00007f4dac35ce00(0000) GS:ffff8afe30b00000(0000) knlGS:0000000000000000\n    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n    CR2: 0000000000000008 CR3: 000000010ddc6000 CR4: 00000000003506e0\n    Call Trace:\n\u0026lt;TASK\u0026gt;\n     ? __die+0x23/0x70\n     ? page_fault_oops+0x171/0x4e0\n     ? plist_add+0xbe/0x100\n     ? exc_page_fault+0x7c/0x180\n     ? asm_exc_page_fault+0x26/0x30\n     ? drm_dp_atomic_find_time_slots+0x5e/0x260 [drm_display_helper 0e67723696438d8e02b741593dd50d80b44c2026]\n     ? drm_dp_atomic_find_time_slots+0x28/0x260 [drm_display_helper 0e67723696438d8e02b741593dd50d80b44c2026]\n     compute_mst_dsc_configs_for_link+0x2ff/0xa40 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054]\n     ? fill_plane_buffer_attributes+0x419/0x510 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054]\n     compute_mst_dsc_configs_for_state+0x1e1/0x250 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054]\n     amdgpu_dm_atomic_check+0xecd/0x1190 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054]\n     drm_atomic_check_only+0x5c5/0xa40\n     drm_mode_atomic_ioctl+0x76e/0xbc0\r\n\r\n[how]\ndsc recompute should be skipped if no mode change detected on the new\nrequest. If detected, keep checking whether the stream is already on\ncurrent state or not.\r\n\r\n(cherry picked from commit 8151a6c13111b465dbabe07c19f572f7cbd16fef)(CVE-2024-43895)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: drop bad gso csum_start and offset in virtio_net_hdr\r\n\r\nTighten csum_start and csum_offset checks in virtio_net_hdr_to_skb\nfor GSO packets.\r\n\r\nThe function already checks that a checksum requested with\nVIRTIO_NET_HDR_F_NEEDS_CSUM is in skb linear. But for GSO packets\nthis might not hold for segs after segmentation.\r\n\r\nSyzkaller demonstrated to reach this warning in skb_checksum_help\r\n\r\n\toffset = skb_checksum_start_offset(skb);\n\tret = -EINVAL;\n\tif (WARN_ON_ONCE(offset \u0026gt;= skb_headlen(skb)))\r\n\r\nBy injecting a TSO packet:\r\n\r\nWARNING: CPU: 1 PID: 3539 at net/core/dev.c:3284 skb_checksum_help+0x3d0/0x5b0\n ip_do_fragment+0x209/0x1b20 net/ipv4/ip_output.c:774\n ip_finish_output_gso net/ipv4/ip_output.c:279 [inline]\n __ip_finish_output+0x2bd/0x4b0 net/ipv4/ip_output.c:301\n iptunnel_xmit+0x50c/0x930 net/ipv4/ip_tunnel_core.c:82\n ip_tunnel_xmit+0x2296/0x2c70 net/ipv4/ip_tunnel.c:813\n __gre_xmit net/ipv4/ip_gre.c:469 [inline]\n ipgre_xmit+0x759/0xa60 net/ipv4/ip_gre.c:661\n __netdev_start_xmit include/linux/netdevice.h:4850 [inline]\n netdev_start_xmit include/linux/netdevice.h:4864 [inline]\n xmit_one net/core/dev.c:3595 [inline]\n dev_hard_start_xmit+0x261/0x8c0 net/core/dev.c:3611\n __dev_queue_xmit+0x1b97/0x3c90 net/core/dev.c:4261\n packet_snd net/packet/af_packet.c:3073 [inline]\r\n\r\nThe geometry of the bad input packet at tcp_gso_segment:\r\n\r\n[   52.003050][ T8403] skb len=12202 headroom=244 headlen=12093 tailroom=0\n[   52.003050][ T8403] mac=(168,24) mac_len=24 net=(192,52) trans=244\n[   52.003050][ T8403] shinfo(txflags=0 nr_frags=1 gso(size=1552 type=3 segs=0))\n[   52.003050][ T8403] csum(0x60000c7 start=199 offset=1536\nip_summed=3 complete_sw=0 valid=0 level=0)\r\n\r\nMitigate with stricter input validation.\r\n\r\ncsum_offset: for GSO packets, deduce the correct value from gso_type.\nThis is already done for USO. Extend it to TSO. Let UFO be:\nudp[46]_ufo_fragment ignores these fields and always computes the\nchecksum in software.\r\n\r\ncsum_start: finding the real offset requires parsing to the transport\nheader. Do not add a parser, use existing segmentation parsing. Thanks\nto SKB_GSO_DODGY, that also catches bad packets that are hw offloaded.\nAgain test both TSO and USO. Do not test UFO for the above reason, and\ndo not test UDP tunnel offload.\r\n\r\nGSO packet are almost always CHECKSUM_PARTIAL. USO packets may be\nCHECKSUM_NONE since commit 10154dbded6d6 (\u0026quot;udp: Allow GSO transmit\nfrom devices with no checksum offload\u0026quot;), but then still these fields\nare initialized correctly in udp4_hwcsum/udp6_hwcsum_outgoing. So no\nneed to test for ip_summed == CHECKSUM_PARTIAL first.\r\n\r\nThis revises an existing fix mentioned in the Fixes tag, which broke\nsmall packets with GSO offload, as detected by kselftests.(CVE-2024-43897)\r\n\r\nRejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.(CVE-2024-43898)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/amd/display: Fix null pointer deref in dcn20_resource.c\r\n\r\nFixes a hang thats triggered when MPV is run on a DCN401 dGPU:\r\n\r\nmpv --hwdec=vaapi --vo=gpu --hwdec-codecs=all\r\n\r\nand then enabling fullscreen playback (double click on the video)\r\n\r\nThe following calltrace will be seen:\r\n\r\n[  181.843989] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[  181.843997] #PF: supervisor instruction fetch in kernel mode\n[  181.844003] #PF: error_code(0x0010) - not-present page\n[  181.844009] PGD 0 P4D 0\n[  181.844020] Oops: 0010 [#1] PREEMPT SMP NOPTI\n[  181.844028] CPU: 6 PID: 1892 Comm: gnome-shell Tainted: G        W  OE      6.5.0-41-generic #41~22.04.2-Ubuntu\n[  181.844038] Hardware name: System manufacturer System Product Name/CROSSHAIR VI HERO, BIOS 6302 10/23/2018\n[  181.844044] RIP: 0010:0x0\n[  181.844079] Code: Unable to access opcode bytes at 0xffffffffffffffd6.\n[  181.844084] RSP: 0018:ffffb593c2b8f7b0 EFLAGS: 00010246\n[  181.844093] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000004\n[  181.844099] RDX: ffffb593c2b8f804 RSI: ffffb593c2b8f7e0 RDI: ffff9e3c8e758400\n[  181.844105] RBP: ffffb593c2b8f7b8 R08: ffffb593c2b8f9c8 R09: ffffb593c2b8f96c\n[  181.844110] R10: 0000000000000000 R11: 0000000000000000 R12: ffffb593c2b8f9c8\n[  181.844115] R13: 0000000000000001 R14: ffff9e3c88000000 R15: 0000000000000005\n[  181.844121] FS:  00007c6e323bb5c0(0000) GS:ffff9e3f85f80000(0000) knlGS:0000000000000000\n[  181.844128] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  181.844134] CR2: ffffffffffffffd6 CR3: 0000000140fbe000 CR4: 00000000003506e0\n[  181.844141] Call Trace:\n[  181.844146]  \u0026lt;TASK\u0026gt;\n[  181.844153]  ? show_regs+0x6d/0x80\n[  181.844167]  ? __die+0x24/0x80\n[  181.844179]  ? page_fault_oops+0x99/0x1b0\n[  181.844192]  ? do_user_addr_fault+0x31d/0x6b0\n[  181.844204]  ? exc_page_fault+0x83/0x1b0\n[  181.844216]  ? asm_exc_page_fault+0x27/0x30\n[  181.844237]  dcn20_get_dcc_compression_cap+0x23/0x30 [amdgpu]\n[  181.845115]  amdgpu_dm_plane_validate_dcc.constprop.0+0xe5/0x180 [amdgpu]\n[  181.845985]  amdgpu_dm_plane_fill_plane_buffer_attributes+0x300/0x580 [amdgpu]\n[  181.846848]  fill_dc_plane_info_and_addr+0x258/0x350 [amdgpu]\n[  181.847734]  fill_dc_plane_attributes+0x162/0x350 [amdgpu]\n[  181.848748]  dm_update_plane_state.constprop.0+0x4e3/0x6b0 [amdgpu]\n[  181.849791]  ? dm_update_plane_state.constprop.0+0x4e3/0x6b0 [amdgpu]\n[  181.850840]  amdgpu_dm_atomic_check+0xdfe/0x1760 [amdgpu](CVE-2024-43899)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmedia: xc2028: avoid use-after-free in load_firmware_cb()\r\n\r\nsyzkaller reported use-after-free in load_firmware_cb() [1].\nThe reason is because the module allocated a struct tuner in tuner_probe(),\nand then the module initialization failed, the struct tuner was released.\nA worker which created during module initialization accesses this struct\ntuner later, it caused use-after-free.\r\n\r\nThe process is as follows:\r\n\r\ntask-6504           worker_thread\ntuner_probe                             \u0026lt;= alloc dvb_frontend [2]\n...\nrequest_firmware_nowait                 \u0026lt;= create a worker\n...\ntuner_remove                            \u0026lt;= free dvb_frontend\n...\n                    request_firmware_work_func  \u0026lt;= the firmware is ready\n                    load_firmware_cb    \u0026lt;= but now the dvb_frontend has been freed\r\n\r\nTo fix the issue, check the dvd_frontend in load_firmware_cb(), if it is\nnull, report a warning and just return.\r\n\r\n[1]:\n    ==================================================================\n     BUG: KASAN: use-after-free in load_firmware_cb+0x1310/0x17a0\n     Read of size 8 at addr ffff8000d7ca2308 by task kworker/2:3/6504\r\n\r\n     Call trace:\n      load_firmware_cb+0x1310/0x17a0\n      request_firmware_work_func+0x128/0x220\n      process_one_work+0x770/0x1824\n      worker_thread+0x488/0xea0\n      kthread+0x300/0x430\n      ret_from_fork+0x10/0x20\r\n\r\n     Allocated by task 6504:\n      kzalloc\n      tuner_probe+0xb0/0x1430\n      i2c_device_probe+0x92c/0xaf0\n      really_probe+0x678/0xcd0\n      driver_probe_device+0x280/0x370\n      __device_attach_driver+0x220/0x330\n      bus_for_each_drv+0x134/0x1c0\n      __device_attach+0x1f4/0x410\n      device_initial_probe+0x20/0x30\n      bus_probe_device+0x184/0x200\n      device_add+0x924/0x12c0\n      device_register+0x24/0x30\n      i2c_new_device+0x4e0/0xc44\n      v4l2_i2c_new_subdev_board+0xbc/0x290\n      v4l2_i2c_new_subdev+0xc8/0x104\n      em28xx_v4l2_init+0x1dd0/0x3770\r\n\r\n     Freed by task 6504:\n      kfree+0x238/0x4e4\n      tuner_remove+0x144/0x1c0\n      i2c_device_remove+0xc8/0x290\n      __device_release_driver+0x314/0x5fc\n      device_release_driver+0x30/0x44\n      bus_remove_device+0x244/0x490\n      device_del+0x350/0x900\n      device_unregister+0x28/0xd0\n      i2c_unregister_device+0x174/0x1d0\n      v4l2_device_unregister+0x224/0x380\n      em28xx_v4l2_init+0x1d90/0x3770\r\n\r\n     The buggy address belongs to the object at ffff8000d7ca2000\n      which belongs to the cache kmalloc-2k of size 2048\n     The buggy address is located 776 bytes inside of\n      2048-byte region [ffff8000d7ca2000, ffff8000d7ca2800)\n     The buggy address belongs to the page:\n     page:ffff7fe00035f280 count:1 mapcount:0 mapping:ffff8000c001f000 index:0x0\n     flags: 0x7ff800000000100(slab)\n     raw: 07ff800000000100 ffff7fe00049d880 0000000300000003 ffff8000c001f000\n     raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000\n     page dumped because: kasan: bad access detected\r\n\r\n     Memory state around the buggy address:\n      ffff8000d7ca2200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n      ffff8000d7ca2280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n     \u0026gt;ffff8000d7ca2300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n                           ^\n      ffff8000d7ca2380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n      ffff8000d7ca2400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n     ==================================================================\r\n\r\n[2]\n    Actually, it is allocated for struct tuner, and dvb_frontend is inside.(CVE-2024-43900)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/amd/display: Add null checker before passing variables\r\n\r\nChecks null pointer before passing variables to functions.\r\n\r\nThis fixes 3 NULL_RETURNS issues reported by Coverity.(CVE-2024-43902)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/amd/pm: Fix the null pointer dereference for vega10_hwmgr\r\n\r\nCheck return value and conduct null pointer handling to avoid null pointer dereference.(CVE-2024-43905)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/admgpu: fix dereferencing null pointer context\r\n\r\nWhen user space sets an invalid ta type, the pointer context will be empty.\nSo it need to check the pointer context before using it(CVE-2024-43906)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rules\r\n\r\nCheck the pointer value to fix potential null pointer\ndereference(CVE-2024-43907)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/amdgpu: Fix the null pointer dereference to ras_manager\r\n\r\nCheck ras_manager before using it(CVE-2024-43908)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/amdgpu/pm: Fix the null pointer dereference for smu7\r\n\r\noptimize the code to avoid pass a null pointer (hwmgr-\u0026gt;backend)\nto function smu7_update_edc_leakage_table.(CVE-2024-43909)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: nl80211: disallow setting special AP channel widths\r\n\r\nSetting the AP channel width is meant for use with the normal\n20/40/... MHz channel width progression, and switching around\nin S1G or narrow channels isn\u0026apos;t supported. Disallow that.(CVE-2024-43912)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnvme: apple: fix device reference counting\r\n\r\nDrivers must call nvme_uninit_ctrl after a successful nvme_init_ctrl.\nSplit the allocation side out to make the error handling boundary easier\nto navigate. The apple driver had been doing this wrong, leaking the\ncontroller device memory on a tagset failure.(CVE-2024-43913)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmd/raid5: avoid BUG_ON() while continue reshape after reassembling\r\n\r\nCurrently, mdadm support --revert-reshape to abort the reshape while\nreassembling, as the test 07revert-grow. However, following BUG_ON()\ncan be triggerred by the test:\r\n\r\nkernel BUG at drivers/md/raid5.c:6278!\ninvalid opcode: 0000 [#1] PREEMPT SMP PTI\nirq event stamp: 158985\nCPU: 6 PID: 891 Comm: md0_reshape Not tainted 6.9.0-03335-g7592a0b0049a #94\nRIP: 0010:reshape_request+0x3f1/0xe60\nCall Trace:\n \u0026lt;TASK\u0026gt;\n raid5_sync_request+0x43d/0x550\n md_do_sync+0xb7a/0x2110\n md_thread+0x294/0x2b0\n kthread+0x147/0x1c0\n ret_from_fork+0x59/0x70\n ret_from_fork_asm+0x1a/0x30\n \u0026lt;/TASK\u0026gt;\r\n\r\nRoot cause is that --revert-reshape update the raid_disks from 5 to 4,\nwhile reshape position is still set, and after reassembling the array,\nreshape position will be read from super block, then during reshape the\nchecking of \u0026apos;writepos\u0026apos; that is caculated by old reshape position will\nfail.\r\n\r\nFix this panic the easy way first, by converting the BUG_ON() to\nWARN_ON(), and stop the reshape if checkings fail.\r\n\r\nNoted that mdadm must fix --revert-shape as well, and probably md/raid\nshould enhance metadata validation as well, however this means\nreassemble will fail and there must be user tools to fix the wrong\nmetadata.(CVE-2024-43914)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: bridge: mcast: wait for previous gc cycles when removing port\r\n\r\nsyzbot hit a use-after-free[1] which is caused because the bridge doesn\u0026apos;t\nmake sure that all previous garbage has been collected when removing a\nport. What happens is:\n      CPU 1                   CPU 2\n start gc cycle           remove port\n                         acquire gc lock first\n wait for lock\n                         call br_multicasg_gc() directly\n acquire lock now but    free port\n the port can be freed\n while grp timers still\n running\r\n\r\nMake sure all previous gc cycles have finished by using flush_work before\nfreeing the port.\r\n\r\n[1]\n  BUG: KASAN: slab-use-after-free in br_multicast_port_group_expired+0x4c0/0x550 net/bridge/br_multicast.c:861\n  Read of size 8 at addr ffff888071d6d000 by task syz.5.1232/9699\r\n\r\n  CPU: 1 PID: 9699 Comm: syz.5.1232 Not tainted 6.10.0-rc5-syzkaller-00021-g24ca36a562d6 #0\n  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024\n  Call Trace:\n   \u0026lt;IRQ\u0026gt;\n   __dump_stack lib/dump_stack.c:88 [inline]\n   dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114\n   print_address_description mm/kasan/report.c:377 [inline]\n   print_report+0xc3/0x620 mm/kasan/report.c:488\n   kasan_report+0xd9/0x110 mm/kasan/report.c:601\n   br_multicast_port_group_expired+0x4c0/0x550 net/bridge/br_multicast.c:861\n   call_timer_fn+0x1a3/0x610 kernel/time/timer.c:1792\n   expire_timers kernel/time/timer.c:1843 [inline]\n   __run_timers+0x74b/0xaf0 kernel/time/timer.c:2417\n   __run_timer_base kernel/time/timer.c:2428 [inline]\n   __run_timer_base kernel/time/timer.c:2421 [inline]\n   run_timer_base+0x111/0x190 kernel/time/timer.c:2437(CVE-2024-44934)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nsctp: Fix null-ptr-deref in reuseport_add_sock().\r\n\r\nsyzbot reported a null-ptr-deref while accessing sk2-\u0026gt;sk_reuseport_cb in\nreuseport_add_sock(). [0]\r\n\r\nThe repro first creates a listener with SO_REUSEPORT.  Then, it creates\nanother listener on the same port and concurrently closes the first\nlistener.\r\n\r\nThe second listen() calls reuseport_add_sock() with the first listener as\nsk2, where sk2-\u0026gt;sk_reuseport_cb is not expected to be cleared concurrently,\nbut the close() does clear it by reuseport_detach_sock().\r\n\r\nThe problem is SCTP does not properly synchronise reuseport_alloc(),\nreuseport_add_sock(), and reuseport_detach_sock().\r\n\r\nThe caller of reuseport_alloc() and reuseport_{add,detach}_sock() must\nprovide synchronisation for sockets that are classified into the same\nreuseport group.\r\n\r\nOtherwise, such sockets form multiple identical reuseport groups, and\nall groups except one would be silently dead.\r\n\r\n  1. Two sockets call listen() concurrently\n  2. No socket in the same group found in sctp_ep_hashtable[]\n  3. Two sockets call reuseport_alloc() and form two reuseport groups\n  4. Only one group hit first in __sctp_rcv_lookup_endpoint() receives\n      incoming packets\r\n\r\nAlso, the reported null-ptr-deref could occur.\r\n\r\nTCP/UDP guarantees that would not happen by holding the hash bucket lock.\r\n\r\nLet\u0026apos;s apply the locking strategy to __sctp_hash_endpoint() and\n__sctp_unhash_endpoint().\r\n\r\n[0]:\nOops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\nCPU: 1 UID: 0 PID: 10230 Comm: syz-executor119 Not tainted 6.10.0-syzkaller-12585-g301927d2d2eb #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024\nRIP: 0010:reuseport_add_sock+0x27e/0x5e0 net/core/sock_reuseport.c:350\nCode: 00 0f b7 5d 00 bf 01 00 00 00 89 de e8 1b a4 ff f7 83 fb 01 0f 85 a3 01 00 00 e8 6d a0 ff f7 49 8d 7e 12 48 89 f8 48 c1 e8 03 \u0026lt;42\u0026gt; 0f b6 04 28 84 c0 0f 85 4b 02 00 00 41 0f b7 5e 12 49 8d 7e 14\nRSP: 0018:ffffc9000b947c98 EFLAGS: 00010202\nRAX: 0000000000000002 RBX: ffff8880252ddf98 RCX: ffff888079478000\nRDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000012\nRBP: 0000000000000001 R08: ffffffff8993e18d R09: 1ffffffff1fef385\nR10: dffffc0000000000 R11: fffffbfff1fef386 R12: ffff8880252ddac0\nR13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000\nFS:  00007f24e45b96c0(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007ffcced5f7b8 CR3: 00000000241be000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u0026lt;TASK\u0026gt;\n __sctp_hash_endpoint net/sctp/input.c:762 [inline]\n sctp_hash_endpoint+0x52a/0x600 net/sctp/input.c:790\n sctp_listen_start net/sctp/socket.c:8570 [inline]\n sctp_inet_listen+0x767/0xa20 net/sctp/socket.c:8625\n __sys_listen_socket net/socket.c:1883 [inline]\n __sys_listen+0x1b7/0x230 net/socket.c:1894\n __do_sys_listen net/socket.c:1902 [inline]\n __se_sys_listen net/socket.c:1900 [inline]\n __x64_sys_listen+0x5a/0x70 net/socket.c:1900\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f24e46039b9\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 91 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f24e45b9228 EFLAGS: 00000246 ORIG_RAX: 0000000000000032\nRAX: ffffffffffffffda RBX: 00007f24e468e428 RCX: 00007f24e46039b9\nRDX: 00007f24e46039b9 RSI: 0000000000000003 RDI: 0000000000000004\nRBP: 00007f24e468e420 R08: 00007f24e45b96c0 R09: 00007f24e45b96c0\nR10: 00007f24e45b96c0 R11: 0000000000000246 R12: 00007f24e468e42c\nR13:\n---truncated---(CVE-2024-44935)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nfou: remove warn in gue_gro_receive on unsupported protocol\r\n\r\nDrop the WARN_ON_ONCE inn gue_gro_receive if the encapsulated type is\nnot known or does not have a GRO handler.\r\n\r\nSuch a packet is easily constructed. Syzbot generates them and sets\noff this warning.\r\n\r\nRemove the warning as it is expected and not actionable.\r\n\r\nThe warning was previously reduced from WARN_ON to WARN_ON_ONCE in\ncommit 270136613bf7 (\u0026quot;fou: Do WARN_ON_ONCE in gue_gro_receive for bad\nproto callbacks\u0026quot;).(CVE-2024-44940)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nf2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC\r\n\r\nsyzbot reports a f2fs bug as below:\r\n\r\n------------[ cut here ]------------\nkernel BUG at fs/f2fs/inline.c:258!\nCPU: 1 PID: 34 Comm: kworker/u8:2 Not tainted 6.9.0-rc6-syzkaller-00012-g9e4bc4bcae01 #0\nRIP: 0010:f2fs_write_inline_data+0x781/0x790 fs/f2fs/inline.c:258\nCall Trace:\n f2fs_write_single_data_page+0xb65/0x1d60 fs/f2fs/data.c:2834\n f2fs_write_cache_pages fs/f2fs/data.c:3133 [inline]\n __f2fs_write_data_pages fs/f2fs/data.c:3288 [inline]\n f2fs_write_data_pages+0x1efe/0x3a90 fs/f2fs/data.c:3315\n do_writepages+0x35b/0x870 mm/page-writeback.c:2612\n __writeback_single_inode+0x165/0x10b0 fs/fs-writeback.c:1650\n writeback_sb_inodes+0x905/0x1260 fs/fs-writeback.c:1941\n wb_writeback+0x457/0xce0 fs/fs-writeback.c:2117\n wb_do_writeback fs/fs-writeback.c:2264 [inline]\n wb_workfn+0x410/0x1090 fs/fs-writeback.c:2304\n process_one_work kernel/workqueue.c:3254 [inline]\n process_scheduled_works+0xa12/0x17c0 kernel/workqueue.c:3335\n worker_thread+0x86d/0xd70 kernel/workqueue.c:3416\n kthread+0x2f2/0x390 kernel/kthread.c:388\n ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\r\n\r\nThe root cause is: inline_data inode can be fuzzed, so that there may\nbe valid blkaddr in its direct node, once f2fs triggers background GC\nto migrate the block, it will hit f2fs_bug_on() during dirty page\nwriteback.\r\n\r\nLet\u0026apos;s add sanity check on F2FS_INLINE_DATA flag in inode during GC,\nso that, it can forbid migrating inline_data inode\u0026apos;s data block for\nfixing.(CVE-2024-44942)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nkcm: Serialise kcm_sendmsg() for the same socket.\r\n\r\nsyzkaller reported UAF in kcm_release(). [0]\r\n\r\nThe scenario is\r\n\r\n  1. Thread A builds a skb with MSG_MORE and sets kcm-\u0026gt;seq_skb.\r\n\r\n  2. Thread A resumes building skb from kcm-\u0026gt;seq_skb but is blocked\n     by sk_stream_wait_memory()\r\n\r\n  3. Thread B calls sendmsg() concurrently, finishes building kcm-\u0026gt;seq_skb\n     and puts the skb to the write queue\r\n\r\n  4. Thread A faces an error and finally frees skb that is already in the\n     write queue\r\n\r\n  5. kcm_release() does double-free the skb in the write queue\r\n\r\nWhen a thread is building a MSG_MORE skb, another thread must not touch it.\r\n\r\nLet\u0026apos;s add a per-sk mutex and serialise kcm_sendmsg().\r\n\r\n[0]:\nBUG: KASAN: slab-use-after-free in __skb_unlink include/linux/skbuff.h:2366 [inline]\nBUG: KASAN: slab-use-after-free in __skb_dequeue include/linux/skbuff.h:2385 [inline]\nBUG: KASAN: slab-use-after-free in __skb_queue_purge_reason include/linux/skbuff.h:3175 [inline]\nBUG: KASAN: slab-use-after-free in __skb_queue_purge include/linux/skbuff.h:3181 [inline]\nBUG: KASAN: slab-use-after-free in kcm_release+0x170/0x4c8 net/kcm/kcmsock.c:1691\nRead of size 8 at addr ffff0000ced0fc80 by task syz-executor329/6167\r\n\r\nCPU: 1 PID: 6167 Comm: syz-executor329 Tainted: G    B              6.8.0-rc5-syzkaller-g9abbc24128bc #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024\nCall trace:\n dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:291\n show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:298\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0xd0/0x124 lib/dump_stack.c:106\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0x178/0x518 mm/kasan/report.c:488\n kasan_report+0xd8/0x138 mm/kasan/report.c:601\n __asan_report_load8_noabort+0x20/0x2c mm/kasan/report_generic.c:381\n __skb_unlink include/linux/skbuff.h:2366 [inline]\n __skb_dequeue include/linux/skbuff.h:2385 [inline]\n __skb_queue_purge_reason include/linux/skbuff.h:3175 [inline]\n __skb_queue_purge include/linux/skbuff.h:3181 [inline]\n kcm_release+0x170/0x4c8 net/kcm/kcmsock.c:1691\n __sock_release net/socket.c:659 [inline]\n sock_close+0xa4/0x1e8 net/socket.c:1421\n __fput+0x30c/0x738 fs/file_table.c:376\n ____fput+0x20/0x30 fs/file_table.c:404\n task_work_run+0x230/0x2e0 kernel/task_work.c:180\n exit_task_work include/linux/task_work.h:38 [inline]\n do_exit+0x618/0x1f64 kernel/exit.c:871\n do_group_exit+0x194/0x22c kernel/exit.c:1020\n get_signal+0x1500/0x15ec kernel/signal.c:2893\n do_signal+0x23c/0x3b44 arch/arm64/kernel/signal.c:1249\n do_notify_resume+0x74/0x1f4 arch/arm64/kernel/entry-common.c:148\n exit_to_user_mode_prepare arch/arm64/kernel/entry-common.c:169 [inline]\n exit_to_user_mode arch/arm64/kernel/entry-common.c:178 [inline]\n el0_svc+0xac/0x168 arch/arm64/kernel/entry-common.c:713\n el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730\n el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598\r\n\r\nAllocated by task 6166:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x40/0x78 mm/kasan/common.c:68\n kasan_save_alloc_info+0x70/0x84 mm/kasan/generic.c:626\n unpoison_slab_object mm/kasan/common.c:314 [inline]\n __kasan_slab_alloc+0x74/0x8c mm/kasan/common.c:340\n kasan_slab_alloc include/linux/kasan.h:201 [inline]\n slab_post_alloc_hook mm/slub.c:3813 [inline]\n slab_alloc_node mm/slub.c:3860 [inline]\n kmem_cache_alloc_node+0x204/0x4c0 mm/slub.c:3903\n __alloc_skb+0x19c/0x3d8 net/core/skbuff.c:641\n alloc_skb include/linux/skbuff.h:1296 [inline]\n kcm_sendmsg+0x1d3c/0x2124 net/kcm/kcmsock.c:783\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg net/socket.c:745 [inline]\n sock_sendmsg+0x220/0x2c0 net/socket.c:768\n splice_to_socket+0x7cc/0xd58 fs/splice.c:889\n do_splice_from fs/splice.c:941 [inline]\n direct_splice_actor+0xec/0x1d8 fs/splice.c:1164\n splice_direct_to_actor+0x438/0xa0c fs/splice.c:1108\n do_splice_direct_actor \n---truncated---(CVE-2024-44946)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nfuse: Initialize beyond-EOF page contents before setting uptodate\r\n\r\nfuse_notify_store(), unlike fuse_do_readpage(), does not enable page\nzeroing (because it can be used to change partial page contents).\r\n\r\nSo fuse_notify_store() must be more careful to fully initialize page\ncontents (including parts of the page that are beyond end-of-file)\nbefore marking the page uptodate.\r\n\r\nThe current code can leave beyond-EOF page contents uninitialized, which\nmakes these uninitialized page contents visible to userspace via mmap().\r\n\r\nThis is an information leak, but only affects systems which do not\nenable init-on-alloc (via CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y or the\ncorresponding kernel command line parameter).(CVE-2024-44947)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/amdgpu: Forward soft recovery errors to userspace\r\n\r\nAs we discussed before[1], soft recovery should be\nforwarded to userspace, or we can get into a really\nbad state where apps will keep submitting hanging\ncommand buffers cascading us to a hard reset.\r\n\r\n1: https://lore.kernel.org/all/bf23d5ed-9a6b-43e7-84ee-8cbfd0d60f18@froggi.es/\n(cherry picked from commit 434967aadbbbe3ad9103cc29e9a327de20fdba01)(CVE-2024-44961)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbinfmt_flat: Fix corruption when not offsetting data start\r\n\r\nCommit 04d82a6d0881 (\u0026quot;binfmt_flat: allow not offsetting data start\u0026quot;)\nintroduced a RISC-V specific variant of the FLAT format which does\nnot allocate any space for the (obsolete) array of shared library\npointers. However, it did not disable the code which initializes the\narray, resulting in the corruption of sizeof(long) bytes before the DATA\nsegment, generally the end of the TEXT segment.\r\n\r\nIntroduce MAX_SHARED_LIBS_UPDATE which depends on the state of\nCONFIG_BINFMT_FLAT_NO_DATA_START_OFFSET to guard the initialization of\nthe shared library pointer region so that it will only be initialized\nif space is reserved for it.(CVE-2024-44966)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register()\r\n\r\nbcm_sf2_mdio_register() calls of_phy_find_device() and then\nphy_device_remove() in a loop to remove existing PHY devices.\nof_phy_find_device() eventually calls bus_find_device(), which calls\nget_device() on the returned struct device * to increment the refcount.\nThe current implementation does not decrement the refcount, which causes\nmemory leak.\r\n\r\nThis commit adds the missing phy_device_free() call to decrement the\nrefcount via put_device() to balance the refcount.(CVE-2024-44971)","status":"published","published":"2024-09-14T11:07:36Z","modified":"2026-08-18T01:18:36.810734965Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2255","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/i915/gt: Cleanup partial engine discovery failures\r\n\r\nIf we abort driver initialisation in the middle of gt/engine discovery,\nsome engines will be fully setup and some not. Those incompletely setup\nengines only have \u0026apos;engine-\u0026gt;release == NULL\u0026apos; and so will leak any of the\ncommon objects allocated.\r\n\r\nv2:\n - Drop the destroy_pinned_context() helper for now.  It\u0026apos;s not really\n   worth it with just a single callsite at the moment.  (Janusz)(CVE-2022-48893)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nf2fs: fix to avoid dirent corruption\r\n\r\nAs Al reported in link[1]:\r\n\r\nf2fs_rename()\n...\n\tif (old_dir != new_dir \u0026amp;\u0026amp; !whiteout)\n\t\tf2fs_set_link(old_inode, old_dir_entry,\n\t\t\t\t\told_dir_page, new_dir);\n\telse\n\t\tf2fs_put_page(old_dir_page, 0);\r\n\r\nYou want correct inumber in the \u0026quot;..\u0026quot; link.  And cross-directory\nrename does move the source to new parent, even if you\u0026apos;d been asked\nto leave a whiteout in the old place.\r\n\r\n[1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/\r\n\r\nWith below testcase, it may cause dirent corruption, due to it missed\nto call f2fs_set_link() to update \u0026quot;..\u0026quot; link to new directory.\n- mkdir -p dir/foo\n- renameat2 -w dir/foo bar\r\n\r\n[ASSERT] (__chk_dots_dentries:1421)  --\u0026gt; Bad inode number[0x4] for \u0026apos;..\u0026apos;, parent parent ino is [0x3]\n[FSCK] other corrupted bugs                           [Fail](CVE-2023-52444)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nefivarfs: force RO when remounting if SetVariable is not supported\r\n\r\nIf SetVariable at runtime is not supported by the firmware we never assign\na callback for that function. At the same time mount the efivarfs as\nRO so no one can call that.  However, we never check the permission flags\nwhen someone remounts the filesystem as RW. As a result this leads to a\ncrash looking like this:\r\n\r\n$ mount -o remount,rw /sys/firmware/efi/efivars\n$ efi-updatevar -f PK.auth PK\r\n\r\n[  303.279166] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\n[  303.280482] Mem abort info:\n[  303.280854]   ESR = 0x0000000086000004\n[  303.281338]   EC = 0x21: IABT (current EL), IL = 32 bits\n[  303.282016]   SET = 0, FnV = 0\n[  303.282414]   EA = 0, S1PTW = 0\n[  303.282821]   FSC = 0x04: level 0 translation fault\n[  303.283771] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004258c000\n[  303.284913] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000\n[  303.286076] Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP\n[  303.286936] Modules linked in: qrtr tpm_tis tpm_tis_core crct10dif_ce arm_smccc_trng rng_core drm fuse ip_tables x_tables ipv6\n[  303.288586] CPU: 1 PID: 755 Comm: efi-updatevar Not tainted 6.3.0-rc1-00108-gc7d0c4695c68 #1\n[  303.289748] Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.04-00627-g88336918701d 04/01/2023\n[  303.291150] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[  303.292123] pc : 0x0\n[  303.292443] lr : efivar_set_variable_locked+0x74/0xec\n[  303.293156] sp : ffff800008673c10\n[  303.293619] x29: ffff800008673c10 x28: ffff0000037e8000 x27: 0000000000000000\n[  303.294592] x26: 0000000000000800 x25: ffff000002467400 x24: 0000000000000027\n[  303.295572] x23: ffffd49ea9832000 x22: ffff0000020c9800 x21: ffff000002467000\n[  303.296566] x20: 0000000000000001 x19: 00000000000007fc x18: 0000000000000000\n[  303.297531] x17: 0000000000000000 x16: 0000000000000000 x15: 0000aaaac807ab54\n[  303.298495] x14: ed37489f673633c0 x13: 71c45c606de13f80 x12: 47464259e219acf4\n[  303.299453] x11: ffff000002af7b01 x10: 0000000000000003 x9 : 0000000000000002\n[  303.300431] x8 : 0000000000000010 x7 : ffffd49ea8973230 x6 : 0000000000a85201\n[  303.301412] x5 : 0000000000000000 x4 : ffff0000020c9800 x3 : 00000000000007fc\n[  303.302370] x2 : 0000000000000027 x1 : ffff000002467400 x0 : ffff000002467000\n[  303.303341] Call trace:\n[  303.303679]  0x0\n[  303.303938]  efivar_entry_set_get_size+0x98/0x16c\n[  303.304585]  efivarfs_file_write+0xd0/0x1a4\n[  303.305148]  vfs_write+0xc4/0x2e4\n[  303.305601]  ksys_write+0x70/0x104\n[  303.306073]  __arm64_sys_write+0x1c/0x28\n[  303.306622]  invoke_syscall+0x48/0x114\n[  303.307156]  el0_svc_common.constprop.0+0x44/0xec\n[  303.307803]  do_el0_svc+0x38/0x98\n[  303.308268]  el0_svc+0x2c/0x84\n[  303.308702]  el0t_64_sync_handler+0xf4/0x120\n[  303.309293]  el0t_64_sync+0x190/0x194\n[  303.309794] Code: ???????? ???????? ???????? ???????? (????????)\n[  303.310612] ---[ end trace 0000000000000000 ]---\r\n\r\nFix this by adding a .reconfigure() function to the fs operations which\nwe can use to check the requested flags and deny anything that\u0026apos;s not RO\nif the firmware doesn\u0026apos;t implement SetVariable at runtime.(CVE-2023-52463)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nx86/srso: Add SRSO mitigation for Hygon processors\r\n\r\nAdd mitigation for the speculative return stack overflow vulnerability\nwhich exists on Hygon processors too.(CVE-2023-52482)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ncrypto: scomp - fix req-\u0026gt;dst buffer overflow\r\n\r\nThe req-\u0026gt;dst buffer size should be checked before copying from the\nscomp_scratch-\u0026gt;dst to avoid req-\u0026gt;dst buffer overflow problem.(CVE-2023-52612)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nllc: verify mac len before reading mac header\r\n\r\nLLC reads the mac header with eth_hdr without verifying that the skb\nhas an Ethernet header.\r\n\r\nSyzbot was able to enter llc_rcv on a tun device. Tun can insert\npackets without mac len and with user configurable skb-\u0026gt;protocol\n(passing a tun_pi header when not configuring IFF_NO_PI).\r\n\r\n    BUG: KMSAN: uninit-value in llc_station_ac_send_test_r net/llc/llc_station.c:81 [inline]\n    BUG: KMSAN: uninit-value in llc_station_rcv+0x6fb/0x1290 net/llc/llc_station.c:111\n    llc_station_ac_send_test_r net/llc/llc_station.c:81 [inline]\n    llc_station_rcv+0x6fb/0x1290 net/llc/llc_station.c:111\n    llc_rcv+0xc5d/0x14a0 net/llc/llc_input.c:218\n    __netif_receive_skb_one_core net/core/dev.c:5523 [inline]\n    __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5637\n    netif_receive_skb_internal net/core/dev.c:5723 [inline]\n    netif_receive_skb+0x58/0x660 net/core/dev.c:5782\n    tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555\n    tun_get_user+0x54c5/0x69c0 drivers/net/tun.c:2002\r\n\r\nAdd a mac_len test before all three eth_hdr(skb) calls under net/llc.\r\n\r\nThere are further uses in include/net/llc_pdu.h. All these are\nprotected by a test skb-\u0026gt;protocol == ETH_P_802_2. Which does not\nprotect against this tun scenario.\r\n\r\nBut the mac_len test added in this patch in llc_fixup_skb will\nindirectly protect those too. That is called from llc_rcv before any\nother LLC code.\r\n\r\nIt is tempting to just add a blanket mac_len check in llc_rcv, but\nnot sure whether that could break valid LLC paths that do not assume\nan Ethernet header. 802.2 LLC may be used on top of non-802.3\nprotocols in principle. The below referenced commit shows that used\nto, on top of Token Ring.\r\n\r\nAt least one of the three eth_hdr uses goes back to before the start\nof git history. But the one that syzbot exercises is introduced in\nthis commit. That commit is old enough (2008), that effectively all\nstable kernels should receive this.(CVE-2023-52843)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nhv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed\r\n\r\nIf hv_netvsc driver is unloaded and reloaded, the NET_DEVICE_REGISTER\nhandler cannot perform VF register successfully as the register call\nis received before netvsc_probe is finished. This is because we\nregister register_netdevice_notifier() very early( even before\nvmbus_driver_register()).\nTo fix this, we try to register each such matching VF( if it is visible\nas a netdevice) at the end of netvsc_probe.(CVE-2024-26820)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nf_tables: honor table dormant flag from netdev release event path\r\n\r\nCheck for table dormant flag otherwise netdev release event path tries\nto unregister an already unregistered hook.\r\n\r\n[524854.857999] ------------[ cut here ]------------\n[524854.858010] WARNING: CPU: 0 PID: 3386599 at net/netfilter/core.c:501 __nf_unregister_net_hook+0x21a/0x260\n[...]\n[524854.858848] CPU: 0 PID: 3386599 Comm: kworker/u32:2 Not tainted 6.9.0-rc3+ #365\n[524854.858869] Workqueue: netns cleanup_net\n[524854.858886] RIP: 0010:__nf_unregister_net_hook+0x21a/0x260\n[524854.858903] Code: 24 e8 aa 73 83 ff 48 63 43 1c 83 f8 01 0f 85 3d ff ff ff e8 98 d1 f0 ff 48 8b 3c 24 e8 8f 73 83 ff 48 63 43 1c e9 26 ff ff ff \u0026lt;0f\u0026gt; 0b 48 83 c4 18 48 c7 c7 00 68 e9 82 5b 5d 41 5c 41 5d 41 5e 41\n[524854.858914] RSP: 0018:ffff8881e36d79e0 EFLAGS: 00010246\n[524854.858926] RAX: 0000000000000000 RBX: ffff8881339ae790 RCX: ffffffff81ba524a\n[524854.858936] RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff8881c8a16438\n[524854.858945] RBP: ffff8881c8a16438 R08: 0000000000000001 R09: ffffed103c6daf34\n[524854.858954] R10: ffff8881e36d79a7 R11: 0000000000000000 R12: 0000000000000005\n[524854.858962] R13: ffff8881c8a16000 R14: 0000000000000000 R15: ffff8881351b5a00\n[524854.858971] FS:  0000000000000000(0000) GS:ffff888390800000(0000) knlGS:0000000000000000\n[524854.858982] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[524854.858991] CR2: 00007fc9be0f16f4 CR3: 00000001437cc004 CR4: 00000000001706f0\n[524854.859000] Call Trace:\n[524854.859006]  \u0026lt;TASK\u0026gt;\n[524854.859013]  ? __warn+0x9f/0x1a0\n[524854.859027]  ? __nf_unregister_net_hook+0x21a/0x260\n[524854.859044]  ? report_bug+0x1b1/0x1e0\n[524854.859060]  ? handle_bug+0x3c/0x70\n[524854.859071]  ? exc_invalid_op+0x17/0x40\n[524854.859083]  ? asm_exc_invalid_op+0x1a/0x20\n[524854.859100]  ? __nf_unregister_net_hook+0x6a/0x260\n[524854.859116]  ? __nf_unregister_net_hook+0x21a/0x260\n[524854.859135]  nf_tables_netdev_event+0x337/0x390 [nf_tables]\n[524854.859304]  ? __pfx_nf_tables_netdev_event+0x10/0x10 [nf_tables]\n[524854.859461]  ? packet_notifier+0xb3/0x360\n[524854.859476]  ? _raw_spin_unlock_irqrestore+0x11/0x40\n[524854.859489]  ? dcbnl_netdevice_event+0x35/0x140\n[524854.859507]  ? __pfx_nf_tables_netdev_event+0x10/0x10 [nf_tables]\n[524854.859661]  notifier_call_chain+0x7d/0x140\n[524854.859677]  unregister_netdevice_many_notify+0x5e1/0xae0(CVE-2024-36005)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\next4: fix uninitialized ratelimit_state-\u0026gt;lock access in __ext4_fill_super()\r\n\r\nIn the following concurrency we will access the uninitialized rs-\u0026gt;lock:\r\n\r\next4_fill_super\n  ext4_register_sysfs\n   // sysfs registered msg_ratelimit_interval_ms\n                             // Other processes modify rs-\u0026gt;interval to\n                             // non-zero via msg_ratelimit_interval_ms\n  ext4_orphan_cleanup\n    ext4_msg(sb, KERN_INFO, \u0026quot;Errors on filesystem, \u0026quot;\n      __ext4_msg\n        ___ratelimit(\u0026amp;(EXT4_SB(sb)-\u0026gt;s_msg_ratelimit_state)\n          if (!rs-\u0026gt;interval)  // do nothing if interval is 0\n            return 1;\n          raw_spin_trylock_irqsave(\u0026amp;rs-\u0026gt;lock, flags)\n            raw_spin_trylock(lock)\n              _raw_spin_trylock\n                __raw_spin_trylock\n                  spin_acquire(\u0026amp;lock-\u0026gt;dep_map, 0, 1, _RET_IP_)\n                    lock_acquire\n                      __lock_acquire\n                        register_lock_class\n                          assign_lock_key\n                            dump_stack();\n  ratelimit_state_init(\u0026amp;sbi-\u0026gt;s_msg_ratelimit_state, 5 * HZ, 10);\n    raw_spin_lock_init(\u0026amp;rs-\u0026gt;lock);\n    // init rs-\u0026gt;lock here\r\n\r\nand get the following dump_stack:\r\n\r\n=========================================================\nINFO: trying to register non-static key.\nThe code is fine but needs lockdep annotation, or maybe\nyou didn\u0026apos;t initialize this object before use?\nturning off the locking correctness validator.\nCPU: 12 PID: 753 Comm: mount Tainted: G E 6.7.0-rc6-next-20231222 #504\n[...]\nCall Trace:\n dump_stack_lvl+0xc5/0x170\n dump_stack+0x18/0x30\n register_lock_class+0x740/0x7c0\n __lock_acquire+0x69/0x13a0\n lock_acquire+0x120/0x450\n _raw_spin_trylock+0x98/0xd0\n ___ratelimit+0xf6/0x220\n __ext4_msg+0x7f/0x160 [ext4]\n ext4_orphan_cleanup+0x665/0x740 [ext4]\n __ext4_fill_super+0x21ea/0x2b10 [ext4]\n ext4_fill_super+0x14d/0x360 [ext4]\n[...]\n=========================================================\r\n\r\nNormally interval is 0 until s_msg_ratelimit_state is initialized, so\n___ratelimit() does nothing. But registering sysfs precedes initializing\nrs-\u0026gt;lock, so it is possible to change rs-\u0026gt;interval to a non-zero value\nvia the msg_ratelimit_interval_ms interface of sysfs while rs-\u0026gt;lock is\nuninitialized, and then a call to ext4_msg triggers the problem by\naccessing an uninitialized rs-\u0026gt;lock. Therefore register sysfs after all\ninitializations are complete to avoid such problems.(CVE-2024-40998)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro()\r\n\r\nset_memory_rox() can fail, leaving memory unprotected.\r\n\r\nCheck return and bail out when bpf_jit_binary_lock_ro() returns\nan error.(CVE-2024-42067)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: nexthop: Initialize all fields in dumped nexthops\r\n\r\nstruct nexthop_grp contains two reserved fields that are not initialized by\nnla_put_nh_group(), and carry garbage. This can be observed e.g. with\nstrace (edited for clarity):\r\n\r\n    # ip nexthop add id 1 dev lo\n    # ip nexthop add id 101 group 1\n    # strace -e recvmsg ip nexthop get id 101\n    ...\n    recvmsg(... [{nla_len=12, nla_type=NHA_GROUP},\n                 [{id=1, weight=0, resvd1=0x69, resvd2=0x67}]] ...) = 52\r\n\r\nThe fields are reserved and therefore not currently used. But as they are, they\nleak kernel memory, and the fact they are not just zero complicates repurposing\nof the fields for new ends. Initialize the full structure.(CVE-2024-42283)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nirqchip/imx-irqsteer: Handle runtime power management correctly\r\n\r\nThe power domain is automatically activated from clk_prepare(). However, on\ncertain platforms like i.MX8QM and i.MX8QXP, the power-on handling invokes\nsleeping functions, which triggers the \u0026apos;scheduling while atomic\u0026apos; bug in the\ncontext switch path during device probing:\r\n\r\n BUG: scheduling while atomic: kworker/u13:1/48/0x00000002\n Call trace:\n  __schedule_bug+0x54/0x6c\n  __schedule+0x7f0/0xa94\n  schedule+0x5c/0xc4\n  schedule_preempt_disabled+0x24/0x40\n  __mutex_lock.constprop.0+0x2c0/0x540\n  __mutex_lock_slowpath+0x14/0x20\n  mutex_lock+0x48/0x54\n  clk_prepare_lock+0x44/0xa0\n  clk_prepare+0x20/0x44\n  imx_irqsteer_resume+0x28/0xe0\n  pm_generic_runtime_resume+0x2c/0x44\n  __genpd_runtime_resume+0x30/0x80\n  genpd_runtime_resume+0xc8/0x2c0\n  __rpm_callback+0x48/0x1d8\n  rpm_callback+0x6c/0x78\n  rpm_resume+0x490/0x6b4\n  __pm_runtime_resume+0x50/0x94\n  irq_chip_pm_get+0x2c/0xa0\n  __irq_do_set_handler+0x178/0x24c\n  irq_set_chained_handler_and_data+0x60/0xa4\n  mxc_gpio_probe+0x160/0x4b0\r\n\r\nCure this by implementing the irq_bus_lock/sync_unlock() interrupt chip\ncallbacks and handle power management in them as they are invoked from\nnon-atomic context.\r\n\r\n[ tglx: Rewrote change log, added Fixes tag ](CVE-2024-42290)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nudf: Avoid using corrupted block bitmap buffer\r\n\r\nWhen the filesystem block bitmap is corrupted, we detect the corruption\nwhile loading the bitmap and fail the allocation with error. However the\nnext allocation from the same bitmap will notice the bitmap buffer is\nalready loaded and tries to allocate from the bitmap with mixed results\n(depending on the exact nature of the bitmap corruption). Fix the\nproblem by using BH_verified bit to indicate whether the bitmap is valid\nor not.(CVE-2024-42306)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes\r\n\r\nIn psb_intel_lvds_get_modes(), the return value of drm_mode_duplicate() is\nassigned to mode, which will lead to a possible NULL pointer dereference\non failure of drm_mode_duplicate(). Add a check to avoid npd.(CVE-2024-42309)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmedia: venus: fix use after free in vdec_close\r\n\r\nThere appears to be a possible use after free with vdec_close().\nThe firmware will add buffer release work to the work queue through\nHFI callbacks as a normal part of decoding. Randomly closing the\ndecoder device from userspace during normal decoding can incur\na read after free for inst.\r\n\r\nFix it by cancelling the work in vdec_close.(CVE-2024-42313)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nipvs: properly dereference pe in ip_vs_add_service\r\n\r\nUse pe directly to resolve sparse warning:\r\n\r\n  net/netfilter/ipvs/ip_vs_ctl.c:1471:27: warning: dereference of noderef expression(CVE-2024-42322)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nPCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs()\r\n\r\nIf IORESOURCE_MEM is not provided in Device Tree due to\nany error, resource_list_first_type() will return NULL and\npci_parse_request_of_pci_ranges() will just emit a warning.\r\n\r\nThis will cause a NULL pointer dereference. Fix this bug by adding NULL\nreturn check.\r\n\r\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2024-43823)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nleds: trigger: Unregister sysfs attributes before calling deactivate()\r\n\r\nTriggers which have trigger specific sysfs attributes typically store\nrelated data in trigger-data allocated by the activate() callback and\nfreed by the deactivate() callback.\r\n\r\nCalling device_remove_groups() after calling deactivate() leaves a window\nwhere the sysfs attributes show/store functions could be called after\ndeactivation and then operate on the just freed trigger-data.\r\n\r\nMove the device_remove_groups() call to before deactivate() to close\nthis race window.\r\n\r\nThis also makes the deactivation path properly do things in reverse order\nof the activation path which calls the activate() callback before calling\ndevice_add_groups().(CVE-2024-43830)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG\r\n\r\nWhen BPF_TRAMP_F_CALL_ORIG is set, the trampoline calls\n__bpf_tramp_enter() and __bpf_tramp_exit() functions, passing them\nthe struct bpf_tramp_image *im pointer as an argument in R0.\r\n\r\nThe trampoline generation code uses emit_addr_mov_i64() to emit\ninstructions for moving the bpf_tramp_image address into R0, but\nemit_addr_mov_i64() assumes the address to be in the vmalloc() space\nand uses only 48 bits. Because bpf_tramp_image is allocated using\nkzalloc(), its address can use more than 48-bits, in this case the\ntrampoline will pass an invalid address to __bpf_tramp_enter/exit()\ncausing a kernel crash.\r\n\r\nFix this by using emit_a64_mov_i64() in place of emit_addr_mov_i64()\nas it can work with addresses that are greater than 48-bits.(CVE-2024-43840)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmd: fix deadlock between mddev_suspend and flush bio\r\n\r\nDeadlock occurs when mddev is being suspended while some flush bio is in\nprogress. It is a complex issue.\r\n\r\nT1. the first flush is at the ending stage, it clears \u0026apos;mddev-\u0026gt;flush_bio\u0026apos;\n    and tries to submit data, but is blocked because mddev is suspended\n    by T4.\nT2. the second flush sets \u0026apos;mddev-\u0026gt;flush_bio\u0026apos;, and attempts to queue\n    md_submit_flush_data(), which is already running (T1) and won\u0026apos;t\n    execute again if on the same CPU as T1.\nT3. the third flush inc active_io and tries to flush, but is blocked because\n    \u0026apos;mddev-\u0026gt;flush_bio\u0026apos; is not NULL (set by T2).\nT4. mddev_suspend() is called and waits for active_io dec to 0 which is inc\n    by T3.\r\n\r\n  T1\t\tT2\t\tT3\t\tT4\n  (flush 1)\t(flush 2)\t(third 3)\t(suspend)\n  md_submit_flush_data\n   mddev-\u0026gt;flush_bio = NULL;\n   .\n   .\t \tmd_flush_request\n   .\t  \t mddev-\u0026gt;flush_bio = bio\n   .\t  \t queue submit_flushes\n   .\t\t .\n   .\t\t .\t\tmd_handle_request\n   .\t\t .\t\t active_io + 1\n   .\t\t .\t\t md_flush_request\n   .\t\t .\t\t  wait !mddev-\u0026gt;flush_bio\n   .\t\t .\n   .\t\t .\t\t\t\tmddev_suspend\n   .\t\t .\t\t\t\t wait !active_io\n   .\t\t .\n   .\t\t submit_flushes\n   .\t\t queue_work md_submit_flush_data\n   .\t\t //md_submit_flush_data is already running (T1)\n   .\n   md_handle_request\n    wait resume\r\n\r\nThe root issue is non-atomic inc/dec of active_io during flush process.\nactive_io is dec before md_submit_flush_data is queued, and inc soon\nafter md_submit_flush_data() run.\n  md_flush_request\n    active_io + 1\n    submit_flushes\n      active_io - 1\n      md_submit_flush_data\n        md_handle_request\n        active_io + 1\n          make_request\n        active_io - 1\r\n\r\nIf active_io is dec after md_handle_request() instead of within\nsubmit_flushes(), make_request() can be called directly intead of\nmd_handle_request() in md_submit_flush_data(), and active_io will\nonly inc and dec once in the whole flush process. Deadlock will be\nfixed.\r\n\r\nAdditionally, the only difference between fixing the issue and before is\nthat there is no return error handling of make_request(). But after\nprevious patch cleaned md_write_start(), make_requst() only return error\nin raid5_make_request() by dm-raid, see commit 41425f96d7aa (\u0026quot;dm-raid456,\nmd/raid456: fix a deadlock for dm-raid456 while io concurrent with\nreshape)\u0026quot;. Since dm always splits data and flush operation into two\nseparate io, io size of flush submitted by dm always is 0, make_request()\nwill not be called in md_submit_flush_data(). To prevent future\nmodifications from introducing issues, add WARN_ON to ensure\nmake_request() no error is returned in this context.(CVE-2024-43855)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nRDMA/hns: Fix soft lockup under heavy CEQE load\r\n\r\nCEQEs are handled in interrupt handler currently. This may cause the\nCPU core staying in interrupt context too long and lead to soft lockup\nunder heavy load.\r\n\r\nHandle CEQEs in BH workqueue and set an upper limit for the number of\nCEQE handled by a single call of work handler.(CVE-2024-43872)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmemcg: protect concurrent access to mem_cgroup_idr\r\n\r\nCommit 73f576c04b94 (\u0026quot;mm: memcontrol: fix cgroup creation failure after\nmany small jobs\u0026quot;) decoupled the memcg IDs from the CSS ID space to fix the\ncgroup creation failures.  It introduced IDR to maintain the memcg ID\nspace.  The IDR depends on external synchronization mechanisms for\nmodifications.  For the mem_cgroup_idr, the idr_alloc() and idr_replace()\nhappen within css callback and thus are protected through cgroup_mutex\nfrom concurrent modifications.  However idr_remove() for mem_cgroup_idr\nwas not protected against concurrency and can be run concurrently for\ndifferent memcgs when they hit their refcnt to zero.  Fix that.\r\n\r\nWe have been seeing list_lru based kernel crashes at a low frequency in\nour fleet for a long time.  These crashes were in different part of\nlist_lru code including list_lru_add(), list_lru_del() and reparenting\ncode.  Upon further inspection, it looked like for a given object (dentry\nand inode), the super_block\u0026apos;s list_lru didn\u0026apos;t have list_lru_one for the\nmemcg of that object.  The initial suspicions were either the object is\nnot allocated through kmem_cache_alloc_lru() or somehow\nmemcg_list_lru_alloc() failed to allocate list_lru_one() for a memcg but\nreturned success.  No evidence were found for these cases.\r\n\r\nLooking more deeply, we started seeing situations where valid memcg\u0026apos;s id\nis not present in mem_cgroup_idr and in some cases multiple valid memcgs\nhave same id and mem_cgroup_idr is pointing to one of them.  So, the most\nreasonable explanation is that these situations can happen due to race\nbetween multiple idr_remove() calls or race between\nidr_alloc()/idr_replace() and idr_remove().  These races are causing\nmultiple memcgs to acquire the same ID and then offlining of one of them\nwould cleanup list_lrus on the system for all of them.  Later access from\nother memcgs to the list_lru cause crashes due to missing list_lru_one.(CVE-2024-43892)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nserial: core: check uartclk for zero to avoid divide by zero\r\n\r\nCalling ioctl TIOCSSERIAL with an invalid baud_base can\nresult in uartclk being zero, which will result in a\ndivide by zero error in uart_get_divisor(). The check for\nuartclk being zero in uart_set_info() needs to be done\nbefore other settings are made as subsequent calls to\nioctl TIOCSSERIAL for the same port would be impacted if\nthe uartclk check was done where uartclk gets set.\r\n\r\nOops: divide error: 0000  PREEMPT SMP KASAN PTI\nRIP: 0010:uart_get_divisor (drivers/tty/serial/serial_core.c:580)\nCall Trace:\n \u0026lt;TASK\u0026gt;\nserial8250_get_divisor (drivers/tty/serial/8250/8250_port.c:2576\n    drivers/tty/serial/8250/8250_port.c:2589)\nserial8250_do_set_termios (drivers/tty/serial/8250/8250_port.c:502\n    drivers/tty/serial/8250/8250_port.c:2741)\nserial8250_set_termios (drivers/tty/serial/8250/8250_port.c:2862)\nuart_change_line_settings (./include/linux/spinlock.h:376\n    ./include/linux/serial_core.h:608 drivers/tty/serial/serial_core.c:222)\nuart_port_startup (drivers/tty/serial/serial_core.c:342)\nuart_startup (drivers/tty/serial/serial_core.c:368)\nuart_set_info (drivers/tty/serial/serial_core.c:1034)\nuart_set_info_user (drivers/tty/serial/serial_core.c:1059)\ntty_set_serial (drivers/tty/tty_io.c:2637)\ntty_ioctl (drivers/tty/tty_io.c:2647 drivers/tty/tty_io.c:2791)\n__x64_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:907\n    fs/ioctl.c:893 fs/ioctl.c:893)\ndo_syscall_64 (arch/x86/entry/common.c:52\n    (discriminator 1) arch/x86/entry/common.c:83 (discriminator 1))\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\r\n\r\nRule: add(CVE-2024-43893)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nfou: remove warn in gue_gro_receive on unsupported protocol\r\n\r\nDrop the WARN_ON_ONCE inn gue_gro_receive if the encapsulated type is\nnot known or does not have a GRO handler.\r\n\r\nSuch a packet is easily constructed. Syzbot generates them and sets\noff this warning.\r\n\r\nRemove the warning as it is expected and not actionable.\r\n\r\nThe warning was previously reduced from WARN_ON to WARN_ON_ONCE in\ncommit 270136613bf7 (\u0026quot;fou: Do WARN_ON_ONCE in gue_gro_receive for bad\nproto callbacks\u0026quot;).(CVE-2024-44940)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nALSA: line6: Fix racy access to midibuf\r\n\r\nThere can be concurrent accesses to line6 midibuf from both the URB\ncompletion callback and the rawmidi API access.  This could be a cause\nof KMSAN warning triggered by syzkaller below (so put as reported-by\nhere).\r\n\r\nThis patch protects the midibuf call of the former code path with a\nspinlock for avoiding the possible races.(CVE-2024-44954)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\natm: idt77252: prevent use after free in dequeue_rx()\r\n\r\nWe can\u0026apos;t dereference \u0026quot;skb\u0026quot; after calling vcc-\u0026gt;push() because the skb\nis released.(CVE-2024-44998)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nxhci: Fix Panther point NULL pointer deref at full-speed re-enumeration\r\n\r\nre-enumerating full-speed devices after a failed address device command\ncan trigger a NULL pointer dereference.\r\n\r\nFull-speed devices may need to reconfigure the endpoint 0 Max Packet Size\nvalue during enumeration. Usb core calls usb_ep0_reinit() in this case,\nwhich ends up calling xhci_configure_endpoint().\r\n\r\nOn Panther point xHC the xhci_configure_endpoint() function will\nadditionally check and reserve bandwidth in software. Other hosts do\nthis in hardware\r\n\r\nIf xHC address device command fails then a new xhci_virt_device structure\nis allocated as part of re-enabling the slot, but the bandwidth table\npointers are not set up properly here.\nThis triggers the NULL pointer dereference the next time usb_ep0_reinit()\nis called and xhci_configure_endpoint() tries to check and reserve\nbandwidth\r\n\r\n[46710.713538] usb 3-1: new full-speed USB device number 5 using xhci_hcd\n[46710.713699] usb 3-1: Device not responding to setup address.\n[46710.917684] usb 3-1: Device not responding to setup address.\n[46711.125536] usb 3-1: device not accepting address 5, error -71\n[46711.125594] BUG: kernel NULL pointer dereference, address: 0000000000000008\n[46711.125600] #PF: supervisor read access in kernel mode\n[46711.125603] #PF: error_code(0x0000) - not-present page\n[46711.125606] PGD 0 P4D 0\n[46711.125610] Oops: Oops: 0000 [#1] PREEMPT SMP PTI\n[46711.125615] CPU: 1 PID: 25760 Comm: kworker/1:2 Not tainted 6.10.3_2 #1\n[46711.125620] Hardware name: Gigabyte Technology Co., Ltd.\n[46711.125623] Workqueue: usb_hub_wq hub_event [usbcore]\n[46711.125668] RIP: 0010:xhci_reserve_bandwidth (drivers/usb/host/xhci.c\r\n\r\nFix this by making sure bandwidth table pointers are set up correctly\nafter a failed address device command, and additionally by avoiding\nchecking for bandwidth in cases like this where no actual endpoints are\nadded or removed, i.e. only context for default control endpoint 0 is\nevaluated.(CVE-2024-45006)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ns390/dasd: fix error recovery leading to data corruption on ESE devices\r\n\r\nExtent Space Efficient (ESE) or thin provisioned volumes need to be\nformatted on demand during usual IO processing.\r\n\r\nThe dasd_ese_needs_format function checks for error codes that signal\nthe non existence of a proper track format.\r\n\r\nThe check for incorrect length is to imprecise since other error cases\nleading to transport of insufficient data also have this flag set.\nThis might lead to data corruption in certain error cases for example\nduring a storage server warmstart.\r\n\r\nFix by removing the check for incorrect length and replacing by\nexplicitly checking for invalid track format in transport mode.\r\n\r\nAlso remove the check for file protected since this is not a valid\nESE handling case.(CVE-2024-45026)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnfc: pn533: Add poll mod list filling check\r\n\r\nIn case of im_protocols value is 1 and tm_protocols value is 0 this\ncombination successfully passes the check\n\u0026apos;if (!im_protocols \u0026amp;\u0026amp; !tm_protocols)\u0026apos; in the nfc_start_poll().\nBut then after pn533_poll_create_mod_list() call in pn533_start_poll()\npoll mod list will remain empty and dev-\u0026gt;poll_mod_count will remain 0\nwhich lead to division by zero.\r\n\r\nNormally no im protocol has value 1 in the mask, so this combination is\nnot expected by driver. But these protocol values actually come from\nuserspace via Netlink interface (NFC_CMD_START_POLL operation). So a\nbroken or malicious program may pass a message containing a \u0026quot;bad\u0026quot;\ncombination of protocol parameter values so that dev-\u0026gt;poll_mod_count\nis not incremented inside pn533_poll_create_mod_list(), thus leading\nto division by zero.\nCall trace looks like:\nnfc_genl_start_poll()\n  nfc_start_poll()\n    -\u0026gt;start_poll()\n    pn533_start_poll()\r\n\r\nAdd poll mod list filling check.\r\n\r\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2024-46676)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nusb: typec: ucsi: Fix null pointer dereference in trace\r\n\r\nucsi_register_altmode checks IS_ERR for the alt pointer and treats\nNULL as valid. When CONFIG_TYPEC_DP_ALTMODE is not enabled,\nucsi_register_displayport returns NULL which causes a NULL pointer\ndereference in trace. Rather than return NULL, call\ntypec_port_register_altmode to register DisplayPort alternate mode\nas a non-controllable mode when CONFIG_TYPEC_DP_ALTMODE is not enabled.(CVE-2024-46719)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbpf: Remove tst_run from lwt_seg6local_prog_ops.\r\n\r\nThe syzbot reported that the lwt_seg6 related BPF ops can be invoked\nvia bpf_test_run() without without entering input_action_end_bpf()\nfirst.\r\n\r\nMartin KaFai Lau said that self test for BPF_PROG_TYPE_LWT_SEG6LOCAL\nprobably didn\u0026apos;t work since it was introduced in commit 04d4b274e2a\n(\u0026quot;ipv6: sr: Add seg6local action End.BPF\u0026quot;). The reason is that the\nper-CPU variable seg6_bpf_srh_states::srh is never assigned in the self\ntest case but each BPF function expects it.\r\n\r\nRemove test_run for BPF_PROG_TYPE_LWT_SEG6LOCAL.(CVE-2024-46754)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nice: Add netif_device_attach/detach into PF reset flow\r\n\r\nEthtool callbacks can be executed while reset is in progress and try to\naccess deleted resources, e.g. getting coalesce settings can result in a\nNULL pointer dereference seen below.\r\n\r\nReproduction steps:\nOnce the driver is fully initialized, trigger reset:\n\t# echo 1 \u0026gt; /sys/class/net/\u0026lt;interface\u0026gt;/device/reset\nwhen reset is in progress try to get coalesce settings using ethtool:\n\t# ethtool -c \u0026lt;interface\u0026gt;\r\n\r\nBUG: kernel NULL pointer dereference, address: 0000000000000020\nPGD 0 P4D 0\nOops: Oops: 0000 [#1] PREEMPT SMP PTI\nCPU: 11 PID: 19713 Comm: ethtool Tainted: G S                 6.10.0-rc7+ #7\nRIP: 0010:ice_get_q_coalesce+0x2e/0xa0 [ice]\nRSP: 0018:ffffbab1e9bcf6a8 EFLAGS: 00010206\nRAX: 000000000000000c RBX: ffff94512305b028 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: ffff9451c3f2e588 RDI: ffff9451c3f2e588\nRBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\nR10: ffff9451c3f2e580 R11: 000000000000001f R12: ffff945121fa9000\nR13: ffffbab1e9bcf760 R14: 0000000000000013 R15: ffffffff9e65dd40\nFS:  00007faee5fbe740(0000) GS:ffff94546fd80000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000020 CR3: 0000000106c2e005 CR4: 00000000001706f0\nCall Trace:\n\u0026lt;TASK\u0026gt;\nice_get_coalesce+0x17/0x30 [ice]\ncoalesce_prepare_data+0x61/0x80\nethnl_default_doit+0xde/0x340\ngenl_family_rcv_msg_doit+0xf2/0x150\ngenl_rcv_msg+0x1b3/0x2c0\nnetlink_rcv_skb+0x5b/0x110\ngenl_rcv+0x28/0x40\nnetlink_unicast+0x19c/0x290\nnetlink_sendmsg+0x222/0x490\n__sys_sendto+0x1df/0x1f0\n__x64_sys_sendto+0x24/0x30\ndo_syscall_64+0x82/0x160\nentry_SYSCALL_64_after_hwframe+0x76/0x7e\nRIP: 0033:0x7faee60d8e27\r\n\r\nCalling netif_device_detach() before reset makes the net core not call\nthe driver when ethtool command is issued, the attempt to execute an\nethtool command during reset will result in the following message:\r\n\r\n    netlink error: No such device\r\n\r\ninstead of NULL pointer dereference. Once reset is done and\nice_rebuild() is executing, the netif_device_attach() is called to allow\nfor ethtool operations to occur again in a safe manner.(CVE-2024-46770)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nksmbd: unset the binding mark of a reused connection\r\n\r\nSteve French reported null pointer dereference error from sha256 lib.\ncifs.ko can send session setup requests on reused connection.\nIf reused connection is used for binding session, conn-\u0026gt;binding can\nstill remain true and generate_preauth_hash() will not set\nsess-\u0026gt;Preauth_HashValue and it will be NULL.\nIt is used as a material to create an encryption key in\nksmbd_gen_smb311_encryptionkey. -\u0026gt;Preauth_HashValue cause null pointer\ndereference error from crypto_shash_update().\r\n\r\nBUG: kernel NULL pointer dereference, address: 0000000000000000\n#PF: supervisor read access in kernel mode\n#PF: error_code(0x0000) - not-present page\nPGD 0 P4D 0\nOops: 0000 [#1] PREEMPT SMP PTI\nCPU: 8 PID: 429254 Comm: kworker/8:39\nHardware name: LENOVO 20MAS08500/20MAS08500, BIOS N2CET69W (1.52 )\nWorkqueue: ksmbd-io handle_ksmbd_work [ksmbd]\nRIP: 0010:lib_sha256_base_do_update.isra.0+0x11e/0x1d0 [sha256_ssse3]\n\u0026lt;TASK\u0026gt;\n? show_regs+0x6d/0x80\n? __die+0x24/0x80\n? page_fault_oops+0x99/0x1b0\n? do_user_addr_fault+0x2ee/0x6b0\n? exc_page_fault+0x83/0x1b0\n? asm_exc_page_fault+0x27/0x30\n? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3]\n? lib_sha256_base_do_update.isra.0+0x11e/0x1d0 [sha256_ssse3]\n? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3]\n? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3]\n_sha256_update+0x77/0xa0 [sha256_ssse3]\nsha256_avx2_update+0x15/0x30 [sha256_ssse3]\ncrypto_shash_update+0x1e/0x40\nhmac_update+0x12/0x20\ncrypto_shash_update+0x1e/0x40\ngenerate_key+0x234/0x380 [ksmbd]\ngenerate_smb3encryptionkey+0x40/0x1c0 [ksmbd]\nksmbd_gen_smb311_encryptionkey+0x72/0xa0 [ksmbd]\nntlm_authenticate.isra.0+0x423/0x5d0 [ksmbd]\nsmb2_sess_setup+0x952/0xaa0 [ksmbd]\n__process_request+0xa3/0x1d0 [ksmbd]\n__handle_ksmbd_work+0x1c4/0x2f0 [ksmbd]\nhandle_ksmbd_work+0x2d/0xa0 [ksmbd]\nprocess_one_work+0x16c/0x350\nworker_thread+0x306/0x440\n? __pfx_worker_thread+0x10/0x10\nkthread+0xef/0x120\n? __pfx_kthread+0x10/0x10\nret_from_fork+0x44/0x70\n? __pfx_kthread+0x10/0x10\nret_from_fork_asm+0x1b/0x30\n\u0026lt;/TASK\u0026gt;(CVE-2024-46795)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/amdgpu: the warning dereferencing obj for nbio_v7_4\r\n\r\nif ras_manager obj null, don\u0026apos;t print NBIO err data(CVE-2024-46819)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nELF: fix kernel.randomize_va_space double read\r\n\r\nELF loader uses \u0026quot;randomize_va_space\u0026quot; twice. It is sysctl and can change\nat any moment, so 2 loads could see 2 different values in theory with\nunpredictable consequences.\r\n\r\nIssue exactly one load for consistent value across one exec.(CVE-2024-46826)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nsched: sch_cake: fix bulk flow accounting logic for host fairness\r\n\r\nIn sch_cake, we keep track of the count of active bulk flows per host,\nwhen running in dst/src host fairness mode, which is used as the\nround-robin weight when iterating through flows. The count of active\nbulk flows is updated whenever a flow changes state.\r\n\r\nThis has a peculiar interaction with the hash collision handling: when a\nhash collision occurs (after the set-associative hashing), the state of\nthe hash bucket is simply updated to match the new packet that collided,\nand if host fairness is enabled, that also means assigning new per-host\nstate to the flow. For this reason, the bulk flow counters of the\nhost(s) assigned to the flow are decremented, before new state is\nassigned (and the counters, which may not belong to the same host\nanymore, are incremented again).\r\n\r\nBack when this code was introduced, the host fairness mode was always\nenabled, so the decrement was unconditional. When the configuration\nflags were introduced the *increment* was made conditional, but\nthe *decrement* was not. Which of course can lead to a spurious\ndecrement (and associated wrap-around to U16_MAX).\r\n\r\nAFAICT, when host fairness is disabled, the decrement and wrap-around\nhappens as soon as a hash collision occurs (which is not that common in\nitself, due to the set-associative hashing). However, in most cases this\nis harmless, as the value is only used when host fairness mode is\nenabled. So in order to trigger an array overflow, sch_cake has to first\nbe configured with host fairness disabled, and while running in this\nmode, a hash collision has to occur to cause the overflow. Then, the\nqdisc has to be reconfigured to enable host fairness, which leads to the\narray out-of-bounds because the wrapped-around value is retained and\nused as an array index. It seems that syzbot managed to trigger this,\nwhich is quite impressive in its own right.\r\n\r\nThis patch fixes the issue by introducing the same conditional check on\ndecrement as is used on increment.\r\n\r\nThe original bug predates the upstreaming of cake, but the commit listed\nin the Fixes tag touched that code, meaning that this patch won\u0026apos;t apply\nbefore that.(CVE-2024-46828)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbtrfs: clean up our handling of refs == 0 in snapshot delete\r\n\r\nIn reada we BUG_ON(refs == 0), which could be unkind since we aren\u0026apos;t\nholding a lock on the extent leaf and thus could get a transient\nincorrect answer.  In walk_down_proc we also BUG_ON(refs == 0), which\ncould happen if we have extent tree corruption.  Change that to return\n-EUCLEAN.  In do_walk_down() we catch this case and handle it correctly,\nhowever we return -EIO, which -EUCLEAN is a more appropriate error code.\nFinally in walk_up_proc we have the same BUG_ON(refs == 0), so convert\nthat to proper error handling.  Also adjust the error message so we can\nactually do something with the information.(CVE-2024-46840)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nperf/x86/intel: Limit the period on Haswell\r\n\r\nRunning the ltp test cve-2015-3290 concurrently reports the following\nwarnings.\r\n\r\nperfevents: irq loop stuck!\n  WARNING: CPU: 31 PID: 32438 at arch/x86/events/intel/core.c:3174\n  intel_pmu_handle_irq+0x285/0x370\n  Call Trace:\n   \u0026lt;NMI\u0026gt;\n   ? __warn+0xa4/0x220\n   ? intel_pmu_handle_irq+0x285/0x370\n   ? __report_bug+0x123/0x130\n   ? intel_pmu_handle_irq+0x285/0x370\n   ? __report_bug+0x123/0x130\n   ? intel_pmu_handle_irq+0x285/0x370\n   ? report_bug+0x3e/0xa0\n   ? handle_bug+0x3c/0x70\n   ? exc_invalid_op+0x18/0x50\n   ? asm_exc_invalid_op+0x1a/0x20\n   ? irq_work_claim+0x1e/0x40\n   ? intel_pmu_handle_irq+0x285/0x370\n   perf_event_nmi_handler+0x3d/0x60\n   nmi_handle+0x104/0x330\r\n\r\nThanks to Thomas Gleixner\u0026apos;s analysis, the issue is caused by the low\ninitial period (1) of the frequency estimation algorithm, which triggers\nthe defects of the HW, specifically erratum HSW11 and HSW143. (For the\ndetails, please refer https://lore.kernel.org/lkml/87plq9l5d2.ffs@tglx/)\r\n\r\nThe HSW11 requires a period larger than 100 for the INST_RETIRED.ALL\nevent, but the initial period in the freq mode is 1. The erratum is the\nsame as the BDM11, which has been supported in the kernel. A minimum\nperiod of 128 is enforced as well on HSW.\r\n\r\nHSW143 is regarding that the fixed counter 1 may overcount 32 with the\nHyper-Threading is enabled. However, based on the test, the hardware\nhas more issues than it tells. Besides the fixed counter 1, the message\n\u0026apos;interrupt took too long\u0026apos; can be observed on any counter which was armed\nwith a period \u0026lt; 32 and two events expired in the same NMI. A minimum\nperiod of 32 is enforced for the rest of the events.\nThe recommended workaround code of the HSW143 is not implemented.\nBecause it only addresses the issue for the fixed counter. It brings\nextra overhead through extra MSR writing. No related overcounting issue\nhas been reported so far.(CVE-2024-46848)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: dpaa: Pad packets to ETH_ZLEN\r\n\r\nWhen sending packets under 60 bytes, up to three bytes of the buffer\nfollowing the data may be leaked. Avoid this by extending all packets to\nETH_ZLEN, ensuring nothing is leaked in the padding. This bug can be\nreproduced by running\r\n\r\n\t$ ping -s 11 destination(CVE-2024-46854)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nft_socket: fix sk refcount leaks\r\n\r\nWe must put \u0026apos;sk\u0026apos; reference before returning.(CVE-2024-46855)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmptcp: pm: Fix uaf in __timer_delete_sync\r\n\r\nThere are two paths to access mptcp_pm_del_add_timer, result in a race\ncondition:\r\n\r\n     CPU1\t\t\t\tCPU2\n     ====                               ====\n     net_rx_action\n     napi_poll                          netlink_sendmsg\n     __napi_poll                        netlink_unicast\n     process_backlog                    netlink_unicast_kernel\n     __netif_receive_skb                genl_rcv\n     __netif_receive_skb_one_core       netlink_rcv_skb\n     NF_HOOK                            genl_rcv_msg\n     ip_local_deliver_finish            genl_family_rcv_msg\n     ip_protocol_deliver_rcu            genl_family_rcv_msg_doit\n     tcp_v4_rcv                         mptcp_pm_nl_flush_addrs_doit\n     tcp_v4_do_rcv                      mptcp_nl_remove_addrs_list\n     tcp_rcv_established                mptcp_pm_remove_addrs_and_subflows\n     tcp_data_queue                     remove_anno_list_by_saddr\n     mptcp_incoming_options             mptcp_pm_del_add_timer\n     mptcp_pm_del_add_timer             kfree(entry)\r\n\r\nIn remove_anno_list_by_saddr(running on CPU2), after leaving the critical\nzone protected by \u0026quot;pm.lock\u0026quot;, the entry will be released, which leads to the\noccurrence of uaf in the mptcp_pm_del_add_timer(running on CPU1).\r\n\r\nKeeping a reference to add_timer inside the lock, and calling\nsk_stop_timer_sync() with this reference, instead of \u0026quot;entry-\u0026gt;add_timer\u0026quot;.\r\n\r\nMove list_del(\u0026amp;entry-\u0026gt;list) to mptcp_pm_del_add_timer and inside the pm lock,\ndo not directly access any members of the entry outside the pm lock, which\ncan avoid similar \u0026quot;entry-\u0026gt;x\u0026quot; uaf.(CVE-2024-46858)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ncrypto: stm32/cryp - call finalize with bh disabled\r\n\r\nThe finalize operation in interrupt mode produce a produces a spinlock\nrecursion warning. The reason is the fact that BH must be disabled\nduring this process.(CVE-2024-47658)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nspi: hisi-kunpeng: Add verification for the max_frequency provided by the firmware\r\n\r\nIf the value of max_speed_hz is 0, it may cause a division by zero\nerror in hisi_calc_effective_speed().\nThe value of max_speed_hz is provided by firmware.\nFirmware is generally considered as a trusted domain. However, as\ndivision by zero errors can cause system failure, for defense measure,\nthe value of max_speed is validated here. So 0 is regarded as invalid\nand an error code is returned.(CVE-2024-47664)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nocfs2: add bounds checking to ocfs2_xattr_find_entry()\r\n\r\nAdd a paranoia check to make sure it doesn\u0026apos;t stray beyond valid memory\nregion containing ocfs2 xattr entries when scanning for a match.  It will\nprevent out-of-bound access in case of crafted images.(CVE-2024-47670)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nUSB: usbtmc: prevent kernel-usb-infoleak\r\n\r\nThe syzbot reported a kernel-usb-infoleak in usbtmc_write,\nwe need to clear the structure before filling fields.(CVE-2024-47671)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: iwlwifi: mvm: don\u0026apos;t wait for tx queues if firmware is dead\r\n\r\nThere is a WARNING in iwl_trans_wait_tx_queues_empty() (that was\nrecently converted from just a message), that can be hit if we\nwait for TX queues to become empty after firmware died. Clearly,\nwe can\u0026apos;t expect anything from the firmware after it\u0026apos;s declared dead.\r\n\r\nDon\u0026apos;t call iwl_trans_wait_tx_queues_empty() in this case. While it could\nbe a good idea to stop the flow earlier, the flush functions do some\nmaintenance work that is not related to the firmware, so keep that part\nof the code running even when the firmware is not running.\r\n\r\n[edit commit message](CVE-2024-47672)","status":"published","published":"2024-10-18T11:07:43Z","modified":"2026-08-18T01:18:37.568583109Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2257","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ni40e: Fix kernel crash during module removal\r\n\r\nThe driver incorrectly frees client instance and subsequent\ni40e module removal leads to kernel crash.\r\n\r\nReproducer:\n1. Do ethtool offline test followed immediately by another one\nhost# ethtool -t eth0 offline; ethtool -t eth0 offline\n2. Remove recursively irdma module that also removes i40e module\nhost# modprobe -r irdma\r\n\r\nResult:\n[ 8675.035651] i40e 0000:3d:00.0 eno1: offline testing starting\n[ 8675.193774] i40e 0000:3d:00.0 eno1: testing finished\n[ 8675.201316] i40e 0000:3d:00.0 eno1: offline testing starting\n[ 8675.358921] i40e 0000:3d:00.0 eno1: testing finished\n[ 8675.496921] i40e 0000:3d:00.0: IRDMA hardware initialization FAILED init_state=2 status=-110\n[ 8686.188955] i40e 0000:3d:00.1: i40e_ptp_stop: removed PHC on eno2\n[ 8686.943890] i40e 0000:3d:00.1: Deleted LAN device PF1 bus=0x3d dev=0x00 func=0x01\n[ 8686.952669] i40e 0000:3d:00.0: i40e_ptp_stop: removed PHC on eno1\n[ 8687.761787] BUG: kernel NULL pointer dereference, address: 0000000000000030\n[ 8687.768755] #PF: supervisor read access in kernel mode\n[ 8687.773895] #PF: error_code(0x0000) - not-present page\n[ 8687.779034] PGD 0 P4D 0\n[ 8687.781575] Oops: 0000 [#1] PREEMPT SMP NOPTI\n[ 8687.785935] CPU: 51 PID: 172891 Comm: rmmod Kdump: loaded Tainted: G        W I        5.19.0+ #2\n[ 8687.794800] Hardware name: Intel Corporation S2600WFD/S2600WFD, BIOS SE5C620.86B.0X.02.0001.051420190324 05/14/2019\n[ 8687.805222] RIP: 0010:i40e_lan_del_device+0x13/0xb0 [i40e]\n[ 8687.810719] Code: d4 84 c0 0f 84 b8 25 01 00 e9 9c 25 01 00 41 bc f4 ff ff ff eb 91 90 0f 1f 44 00 00 41 54 55 53 48 8b 87 58 08 00 00 48 89 fb \u0026lt;48\u0026gt; 8b 68 30 48 89 ef e8 21 8a 0f d5 48 89 ef e8 a9 78 0f d5 48 8b\n[ 8687.829462] RSP: 0018:ffffa604072efce0 EFLAGS: 00010202\n[ 8687.834689] RAX: 0000000000000000 RBX: ffff8f43833b2000 RCX: 0000000000000000\n[ 8687.841821] RDX: 0000000000000000 RSI: ffff8f4b0545b298 RDI: ffff8f43833b2000\n[ 8687.848955] RBP: ffff8f43833b2000 R08: 0000000000000001 R09: 0000000000000000\n[ 8687.856086] R10: 0000000000000000 R11: 000ffffffffff000 R12: ffff8f43833b2ef0\n[ 8687.863218] R13: ffff8f43833b2ef0 R14: ffff915103966000 R15: ffff8f43833b2008\n[ 8687.870342] FS:  00007f79501c3740(0000) GS:ffff8f4adffc0000(0000) knlGS:0000000000000000\n[ 8687.878427] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 8687.884174] CR2: 0000000000000030 CR3: 000000014276e004 CR4: 00000000007706e0\n[ 8687.891306] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 8687.898441] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[ 8687.905572] PKRU: 55555554\n[ 8687.908286] Call Trace:\n[ 8687.910737]  \u0026lt;TASK\u0026gt;\n[ 8687.912843]  i40e_remove+0x2c0/0x330 [i40e]\n[ 8687.917040]  pci_device_remove+0x33/0xa0\n[ 8687.920962]  device_release_driver_internal+0x1aa/0x230\n[ 8687.926188]  driver_detach+0x44/0x90\n[ 8687.929770]  bus_remove_driver+0x55/0xe0\n[ 8687.933693]  pci_unregister_driver+0x2a/0xb0\n[ 8687.937967]  i40e_exit_module+0xc/0xf48 [i40e]\r\n\r\nTwo offline tests cause IRDMA driver failure (ETIMEDOUT) and this\nfailure is indicated back to i40e_client_subtask() that calls\ni40e_client_del_instance() to free client instance referenced\nby pf-\u0026gt;cinst and sets this pointer to NULL. During the module\nremoval i40e_remove() calls i40e_lan_del_device() that dereferences\npf-\u0026gt;cinst that is NULL -\u0026gt; crash.\nDo not remove client instance when client open callbacks fails and\njust clear __I40E_CLIENT_INSTANCE_OPENED bit. The driver also needs\nto take care about this situation (when netdev is up and client\nis NOT opened) in i40e_notify_client_of_netdev_close() and\ncalls client close callback only when __I40E_CLIENT_INSTANCE_OPENED\nis set.(CVE-2022-48688)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntracing/osnoise: Do not unregister events twice\r\n\r\nNicolas reported that using:\r\n\r\n # trace-cmd record -e all -M 10 -p osnoise --poll\r\n\r\nResulted in the following kernel warning:\r\n\r\n ------------[ cut here ]------------\n WARNING: CPU: 0 PID: 1217 at kernel/tracepoint.c:404 tracepoint_probe_unregister+0x280/0x370\n [...]\n CPU: 0 PID: 1217 Comm: trace-cmd Not tainted 5.17.0-rc6-next-20220307-nico+ #19\n RIP: 0010:tracepoint_probe_unregister+0x280/0x370\n [...]\n CR2: 00007ff919b29497 CR3: 0000000109da4005 CR4: 0000000000170ef0\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  osnoise_workload_stop+0x36/0x90\n  tracing_set_tracer+0x108/0x260\n  tracing_set_trace_write+0x94/0xd0\n  ? __check_object_size.part.0+0x10a/0x150\n  ? selinux_file_permission+0x104/0x150\n  vfs_write+0xb5/0x290\n  ksys_write+0x5f/0xe0\n  do_syscall_64+0x3b/0x90\n  entry_SYSCALL_64_after_hwframe+0x44/0xae\n RIP: 0033:0x7ff919a18127\n [...]\n ---[ end trace 0000000000000000 ]---\r\n\r\nThe warning complains about an attempt to unregister an\nunregistered tracepoint.\r\n\r\nThis happens on trace-cmd because it first stops tracing, and\nthen switches the tracer to nop. Which is equivalent to:\r\n\r\n  # cd /sys/kernel/tracing/\n  # echo osnoise \u0026gt; current_tracer\n  # echo 0 \u0026gt; tracing_on\n  # echo nop \u0026gt; current_tracer\r\n\r\nThe osnoise tracer stops the workload when no trace instance\nis actually collecting data. This can be caused both by\ndisabling tracing or disabling the tracer itself.\r\n\r\nTo avoid unregistering events twice, use the existing\ntrace_osnoise_callback_enabled variable to check if the events\n(and the workload) are actually active before trying to\ndeactivate them.(CVE-2022-48848)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nUSB: gadgetfs: Fix race between mounting and unmounting\r\n\r\nThe syzbot fuzzer and Gerald Lee have identified a use-after-free bug\nin the gadgetfs driver, involving processes concurrently mounting and\nunmounting the gadgetfs filesystem.  In particular, gadgetfs_fill_super()\ncan race with gadgetfs_kill_sb(), causing the latter to deallocate\nthe_device while the former is using it.  The output from KASAN says,\nin part:\r\n\r\nBUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:102 [inline]\nBUG: KASAN: use-after-free in atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:176 [inline]\nBUG: KASAN: use-after-free in __refcount_sub_and_test include/linux/refcount.h:272 [inline]\nBUG: KASAN: use-after-free in __refcount_dec_and_test include/linux/refcount.h:315 [inline]\nBUG: KASAN: use-after-free in refcount_dec_and_test include/linux/refcount.h:333 [inline]\nBUG: KASAN: use-after-free in put_dev drivers/usb/gadget/legacy/inode.c:159 [inline]\nBUG: KASAN: use-after-free in gadgetfs_kill_sb+0x33/0x100 drivers/usb/gadget/legacy/inode.c:2086\nWrite of size 4 at addr ffff8880276d7840 by task syz-executor126/18689\r\n\r\nCPU: 0 PID: 18689 Comm: syz-executor126 Not tainted 6.1.0-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022\nCall Trace:\n \u0026lt;TASK\u0026gt;\n...\n atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:176 [inline]\n __refcount_sub_and_test include/linux/refcount.h:272 [inline]\n __refcount_dec_and_test include/linux/refcount.h:315 [inline]\n refcount_dec_and_test include/linux/refcount.h:333 [inline]\n put_dev drivers/usb/gadget/legacy/inode.c:159 [inline]\n gadgetfs_kill_sb+0x33/0x100 drivers/usb/gadget/legacy/inode.c:2086\n deactivate_locked_super+0xa7/0xf0 fs/super.c:332\n vfs_get_super fs/super.c:1190 [inline]\n get_tree_single+0xd0/0x160 fs/super.c:1207\n vfs_get_tree+0x88/0x270 fs/super.c:1531\n vfs_fsconfig_locked fs/fsopen.c:232 [inline]\r\n\r\nThe simplest solution is to ensure that gadgetfs_fill_super() and\ngadgetfs_kill_sb() are serialized by making them both acquire a new\nmutex.(CVE-2022-48869)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nefi: fix NULL-deref in init error path\r\n\r\nIn cases where runtime services are not supported or have been disabled,\nthe runtime services workqueue will never have been allocated.\r\n\r\nDo not try to destroy the workqueue unconditionally in the unlikely\nevent that EFI initialisation fails to avoid dereferencing a NULL\npointer.(CVE-2022-48879)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/i915/gt: Cleanup partial engine discovery failures\r\n\r\nIf we abort driver initialisation in the middle of gt/engine discovery,\nsome engines will be fully setup and some not. Those incompletely setup\nengines only have \u0026apos;engine-\u0026gt;release == NULL\u0026apos; and so will leak any of the\ncommon objects allocated.\r\n\r\nv2:\n - Drop the destroy_pinned_context() helper for now.  It\u0026apos;s not really\n   worth it with just a single callsite at the moment.  (Janusz)(CVE-2022-48893)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmedia: vivid: fix compose size exceed boundary\r\n\r\nsyzkaller found a bug:\r\n\r\n BUG: unable to handle page fault for address: ffffc9000a3b1000\n #PF: supervisor write access in kernel mode\n #PF: error_code(0x0002) - not-present page\n PGD 100000067 P4D 100000067 PUD 10015f067 PMD 1121ca067 PTE 0\n Oops: 0002 [#1] PREEMPT SMP\n CPU: 0 PID: 23489 Comm: vivid-000-vid-c Not tainted 6.1.0-rc1+ #512\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014\n RIP: 0010:memcpy_erms+0x6/0x10\n[...]\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  ? tpg_fill_plane_buffer+0x856/0x15b0\n  vivid_fillbuff+0x8ac/0x1110\n  vivid_thread_vid_cap_tick+0x361/0xc90\n  vivid_thread_vid_cap+0x21a/0x3a0\n  kthread+0x143/0x180\n  ret_from_fork+0x1f/0x30\n  \u0026lt;/TASK\u0026gt;\r\n\r\nThis is because we forget to check boundary after adjust compose-\u0026gt;height\nint V4L2_SEL_TGT_CROP case. Add v4l2_rect_map_inside() to fix this problem\nfor this case.(CVE-2022-48945)\r\n\r\nA flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping of X86 CPU data to memory was found in the way user can guess location of exception stack(s) or other important data. A local user could use this flaw to get access to some important data with expected location in memory.(CVE-2023-0597)\r\n\r\nFrom the upstream fix below: The watchdog_timer can schedule tx_timeout_task and watchdog_work can also arm watchdog_timer [..] Although del_timer_sync() and cancel_work_sync() are called in cyttsp4_remove(), the timer and workqueue could still be rearmed. As a result, the possible use after free bugs could happen.\r\n\r\nUpstream commit:\nhttps://github.com/torvalds/linux/commit/dbe836576f12743a7d2d170ad4ad4fd324c4d47a(CVE-2023-4134)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nefivarfs: force RO when remounting if SetVariable is not supported\r\n\r\nIf SetVariable at runtime is not supported by the firmware we never assign\na callback for that function. At the same time mount the efivarfs as\nRO so no one can call that.  However, we never check the permission flags\nwhen someone remounts the filesystem as RW. As a result this leads to a\ncrash looking like this:\r\n\r\n$ mount -o remount,rw /sys/firmware/efi/efivars\n$ efi-updatevar -f PK.auth PK\r\n\r\n[  303.279166] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\n[  303.280482] Mem abort info:\n[  303.280854]   ESR = 0x0000000086000004\n[  303.281338]   EC = 0x21: IABT (current EL), IL = 32 bits\n[  303.282016]   SET = 0, FnV = 0\n[  303.282414]   EA = 0, S1PTW = 0\n[  303.282821]   FSC = 0x04: level 0 translation fault\n[  303.283771] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004258c000\n[  303.284913] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000\n[  303.286076] Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP\n[  303.286936] Modules linked in: qrtr tpm_tis tpm_tis_core crct10dif_ce arm_smccc_trng rng_core drm fuse ip_tables x_tables ipv6\n[  303.288586] CPU: 1 PID: 755 Comm: efi-updatevar Not tainted 6.3.0-rc1-00108-gc7d0c4695c68 #1\n[  303.289748] Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.04-00627-g88336918701d 04/01/2023\n[  303.291150] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[  303.292123] pc : 0x0\n[  303.292443] lr : efivar_set_variable_locked+0x74/0xec\n[  303.293156] sp : ffff800008673c10\n[  303.293619] x29: ffff800008673c10 x28: ffff0000037e8000 x27: 0000000000000000\n[  303.294592] x26: 0000000000000800 x25: ffff000002467400 x24: 0000000000000027\n[  303.295572] x23: ffffd49ea9832000 x22: ffff0000020c9800 x21: ffff000002467000\n[  303.296566] x20: 0000000000000001 x19: 00000000000007fc x18: 0000000000000000\n[  303.297531] x17: 0000000000000000 x16: 0000000000000000 x15: 0000aaaac807ab54\n[  303.298495] x14: ed37489f673633c0 x13: 71c45c606de13f80 x12: 47464259e219acf4\n[  303.299453] x11: ffff000002af7b01 x10: 0000000000000003 x9 : 0000000000000002\n[  303.300431] x8 : 0000000000000010 x7 : ffffd49ea8973230 x6 : 0000000000a85201\n[  303.301412] x5 : 0000000000000000 x4 : ffff0000020c9800 x3 : 00000000000007fc\n[  303.302370] x2 : 0000000000000027 x1 : ffff000002467400 x0 : ffff000002467000\n[  303.303341] Call trace:\n[  303.303679]  0x0\n[  303.303938]  efivar_entry_set_get_size+0x98/0x16c\n[  303.304585]  efivarfs_file_write+0xd0/0x1a4\n[  303.305148]  vfs_write+0xc4/0x2e4\n[  303.305601]  ksys_write+0x70/0x104\n[  303.306073]  __arm64_sys_write+0x1c/0x28\n[  303.306622]  invoke_syscall+0x48/0x114\n[  303.307156]  el0_svc_common.constprop.0+0x44/0xec\n[  303.307803]  do_el0_svc+0x38/0x98\n[  303.308268]  el0_svc+0x2c/0x84\n[  303.308702]  el0t_64_sync_handler+0xf4/0x120\n[  303.309293]  el0t_64_sync+0x190/0x194\n[  303.309794] Code: ???????? ???????? ???????? ???????? (????????)\n[  303.310612] ---[ end trace 0000000000000000 ]---\r\n\r\nFix this by adding a .reconfigure() function to the fs operations which\nwe can use to check the requested flags and deny anything that\u0026apos;s not RO\nif the firmware doesn\u0026apos;t implement SetVariable at runtime.(CVE-2023-52463)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nsched/psi: Fix use-after-free in ep_remove_wait_queue()\r\n\r\nIf a non-root cgroup gets removed when there is a thread that registered\ntrigger and is polling on a pressure file within the cgroup, the polling\nwaitqueue gets freed in the following path:\r\n\r\n do_rmdir\n   cgroup_rmdir\n     kernfs_drain_open_files\n       cgroup_file_release\n         cgroup_pressure_release\n           psi_trigger_destroy\r\n\r\nHowever, the polling thread still has a reference to the pressure file and\nwill access the freed waitqueue when the file is closed or upon exit:\r\n\r\n fput\n   ep_eventpoll_release\n     ep_free\n       ep_remove_wait_queue\n         remove_wait_queue\r\n\r\nThis results in use-after-free as pasted below.\r\n\r\nThe fundamental problem here is that cgroup_file_release() (and\nconsequently waitqueue\u0026apos;s lifetime) is not tied to the file\u0026apos;s real lifetime.\nUsing wake_up_pollfree() here might be less than ideal, but it is in line\nwith the comment at commit 42288cb44c4b (\u0026quot;wait: add wake_up_pollfree()\u0026quot;)\nsince the waitqueue\u0026apos;s lifetime is not tied to file\u0026apos;s one and can be\nconsidered as another special case. While this would be fixable by somehow\nmaking cgroup_file_release() be tied to the fput(), it would require\nsizable refactoring at cgroups or higher layer which might be more\njustifiable if we identify more cases like this.\r\n\r\n  BUG: KASAN: use-after-free in _raw_spin_lock_irqsave+0x60/0xc0\n  Write of size 4 at addr ffff88810e625328 by task a.out/4404\r\n\r\n\tCPU: 19 PID: 4404 Comm: a.out Not tainted 6.2.0-rc6 #38\n\tHardware name: Amazon EC2 c5a.8xlarge/, BIOS 1.0 10/16/2017\n\tCall Trace:\n\t\u0026lt;TASK\u0026gt;\n\tdump_stack_lvl+0x73/0xa0\n\tprint_report+0x16c/0x4e0\n\tkasan_report+0xc3/0xf0\n\tkasan_check_range+0x2d2/0x310\n\t_raw_spin_lock_irqsave+0x60/0xc0\n\tremove_wait_queue+0x1a/0xa0\n\tep_free+0x12c/0x170\n\tep_eventpoll_release+0x26/0x30\n\t__fput+0x202/0x400\n\ttask_work_run+0x11d/0x170\n\tdo_exit+0x495/0x1130\n\tdo_group_exit+0x100/0x100\n\tget_signal+0xd67/0xde0\n\tarch_do_signal_or_restart+0x2a/0x2b0\n\texit_to_user_mode_prepare+0x94/0x100\n\tsyscall_exit_to_user_mode+0x20/0x40\n\tdo_syscall_64+0x52/0x90\n\tentry_SYSCALL_64_after_hwframe+0x63/0xcd\n\t\u0026lt;/TASK\u0026gt;\r\n\r\n Allocated by task 4404:\r\n\r\n\tkasan_set_track+0x3d/0x60\n\t__kasan_kmalloc+0x85/0x90\n\tpsi_trigger_create+0x113/0x3e0\n\tpressure_write+0x146/0x2e0\n\tcgroup_file_write+0x11c/0x250\n\tkernfs_fop_write_iter+0x186/0x220\n\tvfs_write+0x3d8/0x5c0\n\tksys_write+0x90/0x110\n\tdo_syscall_64+0x43/0x90\n\tentry_SYSCALL_64_after_hwframe+0x63/0xcd\r\n\r\n Freed by task 4407:\r\n\r\n\tkasan_set_track+0x3d/0x60\n\tkasan_save_free_info+0x27/0x40\n\t____kasan_slab_free+0x11d/0x170\n\tslab_free_freelist_hook+0x87/0x150\n\t__kmem_cache_free+0xcb/0x180\n\tpsi_trigger_destroy+0x2e8/0x310\n\tcgroup_file_release+0x4f/0xb0\n\tkernfs_drain_open_files+0x165/0x1f0\n\tkernfs_drain+0x162/0x1a0\n\t__kernfs_remove+0x1fb/0x310\n\tkernfs_remove_by_name_ns+0x95/0xe0\n\tcgroup_addrm_files+0x67f/0x700\n\tcgroup_destroy_locked+0x283/0x3c0\n\tcgroup_rmdir+0x29/0x100\n\tkernfs_iop_rmdir+0xd1/0x140\n\tvfs_rmdir+0xfe/0x240\n\tdo_rmdir+0x13d/0x280\n\t__x64_sys_rmdir+0x2c/0x30\n\tdo_syscall_64+0x43/0x90\n\tentry_SYSCALL_64_after_hwframe+0x63/0xcd(CVE-2023-52707)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ncifs: Fix use-after-free in rdata-\u0026gt;read_into_pages()\r\n\r\nWhen the network status is unstable, use-after-free may occur when\nread data from the server.\r\n\r\n  BUG: KASAN: use-after-free in readpages_fill_pages+0x14c/0x7e0\r\n\r\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   dump_stack_lvl+0x38/0x4c\n   print_report+0x16f/0x4a6\n   kasan_report+0xb7/0x130\n   readpages_fill_pages+0x14c/0x7e0\n   cifs_readv_receive+0x46d/0xa40\n   cifs_demultiplex_thread+0x121c/0x1490\n   kthread+0x16b/0x1a0\n   ret_from_fork+0x2c/0x50\n   \u0026lt;/TASK\u0026gt;\r\n\r\n  Allocated by task 2535:\n   kasan_save_stack+0x22/0x50\n   kasan_set_track+0x25/0x30\n   __kasan_kmalloc+0x82/0x90\n   cifs_readdata_direct_alloc+0x2c/0x110\n   cifs_readdata_alloc+0x2d/0x60\n   cifs_readahead+0x393/0xfe0\n   read_pages+0x12f/0x470\n   page_cache_ra_unbounded+0x1b1/0x240\n   filemap_get_pages+0x1c8/0x9a0\n   filemap_read+0x1c0/0x540\n   cifs_strict_readv+0x21b/0x240\n   vfs_read+0x395/0x4b0\n   ksys_read+0xb8/0x150\n   do_syscall_64+0x3f/0x90\n   entry_SYSCALL_64_after_hwframe+0x72/0xdc\r\n\r\n  Freed by task 79:\n   kasan_save_stack+0x22/0x50\n   kasan_set_track+0x25/0x30\n   kasan_save_free_info+0x2e/0x50\n   __kasan_slab_free+0x10e/0x1a0\n   __kmem_cache_free+0x7a/0x1a0\n   cifs_readdata_release+0x49/0x60\n   process_one_work+0x46c/0x760\n   worker_thread+0x2a4/0x6f0\n   kthread+0x16b/0x1a0\n   ret_from_fork+0x2c/0x50\r\n\r\n  Last potentially related work creation:\n   kasan_save_stack+0x22/0x50\n   __kasan_record_aux_stack+0x95/0xb0\n   insert_work+0x2b/0x130\n   __queue_work+0x1fe/0x660\n   queue_work_on+0x4b/0x60\n   smb2_readv_callback+0x396/0x800\n   cifs_abort_connection+0x474/0x6a0\n   cifs_reconnect+0x5cb/0xa50\n   cifs_readv_from_socket.cold+0x22/0x6c\n   cifs_read_page_from_socket+0xc1/0x100\n   readpages_fill_pages.cold+0x2f/0x46\n   cifs_readv_receive+0x46d/0xa40\n   cifs_demultiplex_thread+0x121c/0x1490\n   kthread+0x16b/0x1a0\n   ret_from_fork+0x2c/0x50\r\n\r\nThe following function calls will cause UAF of the rdata pointer.\r\n\r\nreadpages_fill_pages\n cifs_read_page_from_socket\n  cifs_readv_from_socket\n   cifs_reconnect\n    __cifs_reconnect\n     cifs_abort_connection\n      mid-\u0026gt;callback() --\u0026gt; smb2_readv_callback\n       queue_work(\u0026amp;rdata-\u0026gt;work)  # if the worker completes first,\n                                 # the rdata is freed\n          cifs_readv_complete\n            kref_put\n              cifs_readdata_release\n                kfree(rdata)\n return rdata-\u0026gt;...               # UAF in readpages_fill_pages()\r\n\r\nSimilarly, this problem also occurs in the uncache_fill_pages().\r\n\r\nFix this by adjusts the order of condition judgment in the return\nstatement.(CVE-2023-52741)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc\r\n\r\nAny unprivileged user can attach N_GSM0710 ldisc, but it requires\nCAP_NET_ADMIN to create a GSM network anyway.\r\n\r\nRequire initial namespace CAP_NET_ADMIN to do that.(CVE-2023-52880)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nkeys: Fix overwrite of key expiration on instantiation\r\n\r\nThe expiry time of a key is unconditionally overwritten during\ninstantiation, defaulting to turn it permanent. This causes a problem\nfor DNS resolution as the expiration set by user-space is overwritten to\nTIME64_MAX, disabling further DNS updates. Fix this by restoring the\ncondition that key_set_expiry is only called when the pre-parser sets a\nspecific expiry.(CVE-2024-36031)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\next4: fix uninitialized ratelimit_state-\u0026gt;lock access in __ext4_fill_super()\r\n\r\nIn the following concurrency we will access the uninitialized rs-\u0026gt;lock:\r\n\r\next4_fill_super\n  ext4_register_sysfs\n   // sysfs registered msg_ratelimit_interval_ms\n                             // Other processes modify rs-\u0026gt;interval to\n                             // non-zero via msg_ratelimit_interval_ms\n  ext4_orphan_cleanup\n    ext4_msg(sb, KERN_INFO, \u0026quot;Errors on filesystem, \u0026quot;\n      __ext4_msg\n        ___ratelimit(\u0026amp;(EXT4_SB(sb)-\u0026gt;s_msg_ratelimit_state)\n          if (!rs-\u0026gt;interval)  // do nothing if interval is 0\n            return 1;\n          raw_spin_trylock_irqsave(\u0026amp;rs-\u0026gt;lock, flags)\n            raw_spin_trylock(lock)\n              _raw_spin_trylock\n                __raw_spin_trylock\n                  spin_acquire(\u0026amp;lock-\u0026gt;dep_map, 0, 1, _RET_IP_)\n                    lock_acquire\n                      __lock_acquire\n                        register_lock_class\n                          assign_lock_key\n                            dump_stack();\n  ratelimit_state_init(\u0026amp;sbi-\u0026gt;s_msg_ratelimit_state, 5 * HZ, 10);\n    raw_spin_lock_init(\u0026amp;rs-\u0026gt;lock);\n    // init rs-\u0026gt;lock here\r\n\r\nand get the following dump_stack:\r\n\r\n=========================================================\nINFO: trying to register non-static key.\nThe code is fine but needs lockdep annotation, or maybe\nyou didn\u0026apos;t initialize this object before use?\nturning off the locking correctness validator.\nCPU: 12 PID: 753 Comm: mount Tainted: G E 6.7.0-rc6-next-20231222 #504\n[...]\nCall Trace:\n dump_stack_lvl+0xc5/0x170\n dump_stack+0x18/0x30\n register_lock_class+0x740/0x7c0\n __lock_acquire+0x69/0x13a0\n lock_acquire+0x120/0x450\n _raw_spin_trylock+0x98/0xd0\n ___ratelimit+0xf6/0x220\n __ext4_msg+0x7f/0x160 [ext4]\n ext4_orphan_cleanup+0x665/0x740 [ext4]\n __ext4_fill_super+0x21ea/0x2b10 [ext4]\n ext4_fill_super+0x14d/0x360 [ext4]\n[...]\n=========================================================\r\n\r\nNormally interval is 0 until s_msg_ratelimit_state is initialized, so\n___ratelimit() does nothing. But registering sysfs precedes initializing\nrs-\u0026gt;lock, so it is possible to change rs-\u0026gt;interval to a non-zero value\nvia the msg_ratelimit_interval_ms interface of sysfs while rs-\u0026gt;lock is\nuninitialized, and then a call to ext4_msg triggers the problem by\naccessing an uninitialized rs-\u0026gt;lock. Therefore register sysfs after all\ninitializations are complete to avoid such problems.(CVE-2024-40998)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro()\r\n\r\nset_memory_rox() can fail, leaving memory unprotected.\r\n\r\nCheck return and bail out when bpf_jit_binary_lock_ro() returns\nan error.(CVE-2024-42067)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: nexthop: Initialize all fields in dumped nexthops\r\n\r\nstruct nexthop_grp contains two reserved fields that are not initialized by\nnla_put_nh_group(), and carry garbage. This can be observed e.g. with\nstrace (edited for clarity):\r\n\r\n    # ip nexthop add id 1 dev lo\n    # ip nexthop add id 101 group 1\n    # strace -e recvmsg ip nexthop get id 101\n    ...\n    recvmsg(... [{nla_len=12, nla_type=NHA_GROUP},\n                 [{id=1, weight=0, resvd1=0x69, resvd2=0x67}]] ...) = 52\r\n\r\nThe fields are reserved and therefore not currently used. But as they are, they\nleak kernel memory, and the fact they are not just zero complicates repurposing\nof the fields for new ends. Initialize the full structure.(CVE-2024-42283)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nirqchip/imx-irqsteer: Handle runtime power management correctly\r\n\r\nThe power domain is automatically activated from clk_prepare(). However, on\ncertain platforms like i.MX8QM and i.MX8QXP, the power-on handling invokes\nsleeping functions, which triggers the \u0026apos;scheduling while atomic\u0026apos; bug in the\ncontext switch path during device probing:\r\n\r\n BUG: scheduling while atomic: kworker/u13:1/48/0x00000002\n Call trace:\n  __schedule_bug+0x54/0x6c\n  __schedule+0x7f0/0xa94\n  schedule+0x5c/0xc4\n  schedule_preempt_disabled+0x24/0x40\n  __mutex_lock.constprop.0+0x2c0/0x540\n  __mutex_lock_slowpath+0x14/0x20\n  mutex_lock+0x48/0x54\n  clk_prepare_lock+0x44/0xa0\n  clk_prepare+0x20/0x44\n  imx_irqsteer_resume+0x28/0xe0\n  pm_generic_runtime_resume+0x2c/0x44\n  __genpd_runtime_resume+0x30/0x80\n  genpd_runtime_resume+0xc8/0x2c0\n  __rpm_callback+0x48/0x1d8\n  rpm_callback+0x6c/0x78\n  rpm_resume+0x490/0x6b4\n  __pm_runtime_resume+0x50/0x94\n  irq_chip_pm_get+0x2c/0xa0\n  __irq_do_set_handler+0x178/0x24c\n  irq_set_chained_handler_and_data+0x60/0xa4\n  mxc_gpio_probe+0x160/0x4b0\r\n\r\nCure this by implementing the irq_bus_lock/sync_unlock() interrupt chip\ncallbacks and handle power management in them as they are invoked from\nnon-atomic context.\r\n\r\n[ tglx: Rewrote change log, added Fixes tag ](CVE-2024-42290)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes\r\n\r\nIn psb_intel_lvds_get_modes(), the return value of drm_mode_duplicate() is\nassigned to mode, which will lead to a possible NULL pointer dereference\non failure of drm_mode_duplicate(). Add a check to avoid npd.(CVE-2024-42309)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmedia: venus: fix use after free in vdec_close\r\n\r\nThere appears to be a possible use after free with vdec_close().\nThe firmware will add buffer release work to the work queue through\nHFI callbacks as a normal part of decoding. Randomly closing the\ndecoder device from userspace during normal decoding can incur\na read after free for inst.\r\n\r\nFix it by cancelling the work in vdec_close.(CVE-2024-42313)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nipvs: properly dereference pe in ip_vs_add_service\r\n\r\nUse pe directly to resolve sparse warning:\r\n\r\n  net/netfilter/ipvs/ip_vs_ctl.c:1471:27: warning: dereference of noderef expression(CVE-2024-42322)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nPCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs()\r\n\r\nIf IORESOURCE_MEM is not provided in Device Tree due to\nany error, resource_list_first_type() will return NULL and\npci_parse_request_of_pci_ranges() will just emit a warning.\r\n\r\nThis will cause a NULL pointer dereference. Fix this bug by adding NULL\nreturn check.\r\n\r\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2024-43823)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nleds: trigger: Unregister sysfs attributes before calling deactivate()\r\n\r\nTriggers which have trigger specific sysfs attributes typically store\nrelated data in trigger-data allocated by the activate() callback and\nfreed by the deactivate() callback.\r\n\r\nCalling device_remove_groups() after calling deactivate() leaves a window\nwhere the sysfs attributes show/store functions could be called after\ndeactivation and then operate on the just freed trigger-data.\r\n\r\nMove the device_remove_groups() call to before deactivate() to close\nthis race window.\r\n\r\nThis also makes the deactivation path properly do things in reverse order\nof the activation path which calls the activate() callback before calling\ndevice_add_groups().(CVE-2024-43830)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmd: fix deadlock between mddev_suspend and flush bio\r\n\r\nDeadlock occurs when mddev is being suspended while some flush bio is in\nprogress. It is a complex issue.\r\n\r\nT1. the first flush is at the ending stage, it clears \u0026apos;mddev-\u0026gt;flush_bio\u0026apos;\n    and tries to submit data, but is blocked because mddev is suspended\n    by T4.\nT2. the second flush sets \u0026apos;mddev-\u0026gt;flush_bio\u0026apos;, and attempts to queue\n    md_submit_flush_data(), which is already running (T1) and won\u0026apos;t\n    execute again if on the same CPU as T1.\nT3. the third flush inc active_io and tries to flush, but is blocked because\n    \u0026apos;mddev-\u0026gt;flush_bio\u0026apos; is not NULL (set by T2).\nT4. mddev_suspend() is called and waits for active_io dec to 0 which is inc\n    by T3.\r\n\r\n  T1\t\tT2\t\tT3\t\tT4\n  (flush 1)\t(flush 2)\t(third 3)\t(suspend)\n  md_submit_flush_data\n   mddev-\u0026gt;flush_bio = NULL;\n   .\n   .\t \tmd_flush_request\n   .\t  \t mddev-\u0026gt;flush_bio = bio\n   .\t  \t queue submit_flushes\n   .\t\t .\n   .\t\t .\t\tmd_handle_request\n   .\t\t .\t\t active_io + 1\n   .\t\t .\t\t md_flush_request\n   .\t\t .\t\t  wait !mddev-\u0026gt;flush_bio\n   .\t\t .\n   .\t\t .\t\t\t\tmddev_suspend\n   .\t\t .\t\t\t\t wait !active_io\n   .\t\t .\n   .\t\t submit_flushes\n   .\t\t queue_work md_submit_flush_data\n   .\t\t //md_submit_flush_data is already running (T1)\n   .\n   md_handle_request\n    wait resume\r\n\r\nThe root issue is non-atomic inc/dec of active_io during flush process.\nactive_io is dec before md_submit_flush_data is queued, and inc soon\nafter md_submit_flush_data() run.\n  md_flush_request\n    active_io + 1\n    submit_flushes\n      active_io - 1\n      md_submit_flush_data\n        md_handle_request\n        active_io + 1\n          make_request\n        active_io - 1\r\n\r\nIf active_io is dec after md_handle_request() instead of within\nsubmit_flushes(), make_request() can be called directly intead of\nmd_handle_request() in md_submit_flush_data(), and active_io will\nonly inc and dec once in the whole flush process. Deadlock will be\nfixed.\r\n\r\nAdditionally, the only difference between fixing the issue and before is\nthat there is no return error handling of make_request(). But after\nprevious patch cleaned md_write_start(), make_requst() only return error\nin raid5_make_request() by dm-raid, see commit 41425f96d7aa (\u0026quot;dm-raid456,\nmd/raid456: fix a deadlock for dm-raid456 while io concurrent with\nreshape)\u0026quot;. Since dm always splits data and flush operation into two\nseparate io, io size of flush submitted by dm always is 0, make_request()\nwill not be called in md_submit_flush_data(). To prevent future\nmodifications from introducing issues, add WARN_ON to ensure\nmake_request() no error is returned in this context.(CVE-2024-43855)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmemcg: protect concurrent access to mem_cgroup_idr\r\n\r\nCommit 73f576c04b94 (\u0026quot;mm: memcontrol: fix cgroup creation failure after\nmany small jobs\u0026quot;) decoupled the memcg IDs from the CSS ID space to fix the\ncgroup creation failures.  It introduced IDR to maintain the memcg ID\nspace.  The IDR depends on external synchronization mechanisms for\nmodifications.  For the mem_cgroup_idr, the idr_alloc() and idr_replace()\nhappen within css callback and thus are protected through cgroup_mutex\nfrom concurrent modifications.  However idr_remove() for mem_cgroup_idr\nwas not protected against concurrency and can be run concurrently for\ndifferent memcgs when they hit their refcnt to zero.  Fix that.\r\n\r\nWe have been seeing list_lru based kernel crashes at a low frequency in\nour fleet for a long time.  These crashes were in different part of\nlist_lru code including list_lru_add(), list_lru_del() and reparenting\ncode.  Upon further inspection, it looked like for a given object (dentry\nand inode), the super_block\u0026apos;s list_lru didn\u0026apos;t have list_lru_one for the\nmemcg of that object.  The initial suspicions were either the object is\nnot allocated through kmem_cache_alloc_lru() or somehow\nmemcg_list_lru_alloc() failed to allocate list_lru_one() for a memcg but\nreturned success.  No evidence were found for these cases.\r\n\r\nLooking more deeply, we started seeing situations where valid memcg\u0026apos;s id\nis not present in mem_cgroup_idr and in some cases multiple valid memcgs\nhave same id and mem_cgroup_idr is pointing to one of them.  So, the most\nreasonable explanation is that these situations can happen due to race\nbetween multiple idr_remove() calls or race between\nidr_alloc()/idr_replace() and idr_remove().  These races are causing\nmultiple memcgs to acquire the same ID and then offlining of one of them\nwould cleanup list_lrus on the system for all of them.  Later access from\nother memcgs to the list_lru cause crashes due to missing list_lru_one.(CVE-2024-43892)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nserial: core: check uartclk for zero to avoid divide by zero\r\n\r\nCalling ioctl TIOCSSERIAL with an invalid baud_base can\nresult in uartclk being zero, which will result in a\ndivide by zero error in uart_get_divisor(). The check for\nuartclk being zero in uart_set_info() needs to be done\nbefore other settings are made as subsequent calls to\nioctl TIOCSSERIAL for the same port would be impacted if\nthe uartclk check was done where uartclk gets set.\r\n\r\nOops: divide error: 0000  PREEMPT SMP KASAN PTI\nRIP: 0010:uart_get_divisor (drivers/tty/serial/serial_core.c:580)\nCall Trace:\n \u0026lt;TASK\u0026gt;\nserial8250_get_divisor (drivers/tty/serial/8250/8250_port.c:2576\n    drivers/tty/serial/8250/8250_port.c:2589)\nserial8250_do_set_termios (drivers/tty/serial/8250/8250_port.c:502\n    drivers/tty/serial/8250/8250_port.c:2741)\nserial8250_set_termios (drivers/tty/serial/8250/8250_port.c:2862)\nuart_change_line_settings (./include/linux/spinlock.h:376\n    ./include/linux/serial_core.h:608 drivers/tty/serial/serial_core.c:222)\nuart_port_startup (drivers/tty/serial/serial_core.c:342)\nuart_startup (drivers/tty/serial/serial_core.c:368)\nuart_set_info (drivers/tty/serial/serial_core.c:1034)\nuart_set_info_user (drivers/tty/serial/serial_core.c:1059)\ntty_set_serial (drivers/tty/tty_io.c:2637)\ntty_ioctl (drivers/tty/tty_io.c:2647 drivers/tty/tty_io.c:2791)\n__x64_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:907\n    fs/ioctl.c:893 fs/ioctl.c:893)\ndo_syscall_64 (arch/x86/entry/common.c:52\n    (discriminator 1) arch/x86/entry/common.c:83 (discriminator 1))\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\r\n\r\nRule: add(CVE-2024-43893)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nfou: remove warn in gue_gro_receive on unsupported protocol\r\n\r\nDrop the WARN_ON_ONCE inn gue_gro_receive if the encapsulated type is\nnot known or does not have a GRO handler.\r\n\r\nSuch a packet is easily constructed. Syzbot generates them and sets\noff this warning.\r\n\r\nRemove the warning as it is expected and not actionable.\r\n\r\nThe warning was previously reduced from WARN_ON to WARN_ON_ONCE in\ncommit 270136613bf7 (\u0026quot;fou: Do WARN_ON_ONCE in gue_gro_receive for bad\nproto callbacks\u0026quot;).(CVE-2024-44940)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\natm: idt77252: prevent use after free in dequeue_rx()\r\n\r\nWe can\u0026apos;t dereference \u0026quot;skb\u0026quot; after calling vcc-\u0026gt;push() because the skb\nis released.(CVE-2024-44998)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nxhci: Fix Panther point NULL pointer deref at full-speed re-enumeration\r\n\r\nre-enumerating full-speed devices after a failed address device command\ncan trigger a NULL pointer dereference.\r\n\r\nFull-speed devices may need to reconfigure the endpoint 0 Max Packet Size\nvalue during enumeration. Usb core calls usb_ep0_reinit() in this case,\nwhich ends up calling xhci_configure_endpoint().\r\n\r\nOn Panther point xHC the xhci_configure_endpoint() function will\nadditionally check and reserve bandwidth in software. Other hosts do\nthis in hardware\r\n\r\nIf xHC address device command fails then a new xhci_virt_device structure\nis allocated as part of re-enabling the slot, but the bandwidth table\npointers are not set up properly here.\nThis triggers the NULL pointer dereference the next time usb_ep0_reinit()\nis called and xhci_configure_endpoint() tries to check and reserve\nbandwidth\r\n\r\n[46710.713538] usb 3-1: new full-speed USB device number 5 using xhci_hcd\n[46710.713699] usb 3-1: Device not responding to setup address.\n[46710.917684] usb 3-1: Device not responding to setup address.\n[46711.125536] usb 3-1: device not accepting address 5, error -71\n[46711.125594] BUG: kernel NULL pointer dereference, address: 0000000000000008\n[46711.125600] #PF: supervisor read access in kernel mode\n[46711.125603] #PF: error_code(0x0000) - not-present page\n[46711.125606] PGD 0 P4D 0\n[46711.125610] Oops: Oops: 0000 [#1] PREEMPT SMP PTI\n[46711.125615] CPU: 1 PID: 25760 Comm: kworker/1:2 Not tainted 6.10.3_2 #1\n[46711.125620] Hardware name: Gigabyte Technology Co., Ltd.\n[46711.125623] Workqueue: usb_hub_wq hub_event [usbcore]\n[46711.125668] RIP: 0010:xhci_reserve_bandwidth (drivers/usb/host/xhci.c\r\n\r\nFix this by making sure bandwidth table pointers are set up correctly\nafter a failed address device command, and additionally by avoiding\nchecking for bandwidth in cases like this where no actual endpoints are\nadded or removed, i.e. only context for default control endpoint 0 is\nevaluated.(CVE-2024-45006)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ns390/dasd: fix error recovery leading to data corruption on ESE devices\r\n\r\nExtent Space Efficient (ESE) or thin provisioned volumes need to be\nformatted on demand during usual IO processing.\r\n\r\nThe dasd_ese_needs_format function checks for error codes that signal\nthe non existence of a proper track format.\r\n\r\nThe check for incorrect length is to imprecise since other error cases\nleading to transport of insufficient data also have this flag set.\nThis might lead to data corruption in certain error cases for example\nduring a storage server warmstart.\r\n\r\nFix by removing the check for incorrect length and replacing by\nexplicitly checking for invalid track format in transport mode.\r\n\r\nAlso remove the check for file protected since this is not a valid\nESE handling case.(CVE-2024-45026)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnfc: pn533: Add poll mod list filling check\r\n\r\nIn case of im_protocols value is 1 and tm_protocols value is 0 this\ncombination successfully passes the check\n\u0026apos;if (!im_protocols \u0026amp;\u0026amp; !tm_protocols)\u0026apos; in the nfc_start_poll().\nBut then after pn533_poll_create_mod_list() call in pn533_start_poll()\npoll mod list will remain empty and dev-\u0026gt;poll_mod_count will remain 0\nwhich lead to division by zero.\r\n\r\nNormally no im protocol has value 1 in the mask, so this combination is\nnot expected by driver. But these protocol values actually come from\nuserspace via Netlink interface (NFC_CMD_START_POLL operation). So a\nbroken or malicious program may pass a message containing a \u0026quot;bad\u0026quot;\ncombination of protocol parameter values so that dev-\u0026gt;poll_mod_count\nis not incremented inside pn533_poll_create_mod_list(), thus leading\nto division by zero.\nCall trace looks like:\nnfc_genl_start_poll()\n  nfc_start_poll()\n    -\u0026gt;start_poll()\n    pn533_start_poll()\r\n\r\nAdd poll mod list filling check.\r\n\r\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2024-46676)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nusb: typec: ucsi: Fix null pointer dereference in trace\r\n\r\nucsi_register_altmode checks IS_ERR for the alt pointer and treats\nNULL as valid. When CONFIG_TYPEC_DP_ALTMODE is not enabled,\nucsi_register_displayport returns NULL which causes a NULL pointer\ndereference in trace. Rather than return NULL, call\ntypec_port_register_altmode to register DisplayPort alternate mode\nas a non-controllable mode when CONFIG_TYPEC_DP_ALTMODE is not enabled.(CVE-2024-46719)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbpf: Remove tst_run from lwt_seg6local_prog_ops.\r\n\r\nThe syzbot reported that the lwt_seg6 related BPF ops can be invoked\nvia bpf_test_run() without without entering input_action_end_bpf()\nfirst.\r\n\r\nMartin KaFai Lau said that self test for BPF_PROG_TYPE_LWT_SEG6LOCAL\nprobably didn\u0026apos;t work since it was introduced in commit 04d4b274e2a\n(\u0026quot;ipv6: sr: Add seg6local action End.BPF\u0026quot;). The reason is that the\nper-CPU variable seg6_bpf_srh_states::srh is never assigned in the self\ntest case but each BPF function expects it.\r\n\r\nRemove test_run for BPF_PROG_TYPE_LWT_SEG6LOCAL.(CVE-2024-46754)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nice: Add netif_device_attach/detach into PF reset flow\r\n\r\nEthtool callbacks can be executed while reset is in progress and try to\naccess deleted resources, e.g. getting coalesce settings can result in a\nNULL pointer dereference seen below.\r\n\r\nReproduction steps:\nOnce the driver is fully initialized, trigger reset:\n\t# echo 1 \u0026gt; /sys/class/net/\u0026lt;interface\u0026gt;/device/reset\nwhen reset is in progress try to get coalesce settings using ethtool:\n\t# ethtool -c \u0026lt;interface\u0026gt;\r\n\r\nBUG: kernel NULL pointer dereference, address: 0000000000000020\nPGD 0 P4D 0\nOops: Oops: 0000 [#1] PREEMPT SMP PTI\nCPU: 11 PID: 19713 Comm: ethtool Tainted: G S                 6.10.0-rc7+ #7\nRIP: 0010:ice_get_q_coalesce+0x2e/0xa0 [ice]\nRSP: 0018:ffffbab1e9bcf6a8 EFLAGS: 00010206\nRAX: 000000000000000c RBX: ffff94512305b028 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: ffff9451c3f2e588 RDI: ffff9451c3f2e588\nRBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\nR10: ffff9451c3f2e580 R11: 000000000000001f R12: ffff945121fa9000\nR13: ffffbab1e9bcf760 R14: 0000000000000013 R15: ffffffff9e65dd40\nFS:  00007faee5fbe740(0000) GS:ffff94546fd80000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000020 CR3: 0000000106c2e005 CR4: 00000000001706f0\nCall Trace:\n\u0026lt;TASK\u0026gt;\nice_get_coalesce+0x17/0x30 [ice]\ncoalesce_prepare_data+0x61/0x80\nethnl_default_doit+0xde/0x340\ngenl_family_rcv_msg_doit+0xf2/0x150\ngenl_rcv_msg+0x1b3/0x2c0\nnetlink_rcv_skb+0x5b/0x110\ngenl_rcv+0x28/0x40\nnetlink_unicast+0x19c/0x290\nnetlink_sendmsg+0x222/0x490\n__sys_sendto+0x1df/0x1f0\n__x64_sys_sendto+0x24/0x30\ndo_syscall_64+0x82/0x160\nentry_SYSCALL_64_after_hwframe+0x76/0x7e\nRIP: 0033:0x7faee60d8e27\r\n\r\nCalling netif_device_detach() before reset makes the net core not call\nthe driver when ethtool command is issued, the attempt to execute an\nethtool command during reset will result in the following message:\r\n\r\n    netlink error: No such device\r\n\r\ninstead of NULL pointer dereference. Once reset is done and\nice_rebuild() is executing, the netif_device_attach() is called to allow\nfor ethtool operations to occur again in a safe manner.(CVE-2024-46770)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nksmbd: unset the binding mark of a reused connection\r\n\r\nSteve French reported null pointer dereference error from sha256 lib.\ncifs.ko can send session setup requests on reused connection.\nIf reused connection is used for binding session, conn-\u0026gt;binding can\nstill remain true and generate_preauth_hash() will not set\nsess-\u0026gt;Preauth_HashValue and it will be NULL.\nIt is used as a material to create an encryption key in\nksmbd_gen_smb311_encryptionkey. -\u0026gt;Preauth_HashValue cause null pointer\ndereference error from crypto_shash_update().\r\n\r\nBUG: kernel NULL pointer dereference, address: 0000000000000000\n#PF: supervisor read access in kernel mode\n#PF: error_code(0x0000) - not-present page\nPGD 0 P4D 0\nOops: 0000 [#1] PREEMPT SMP PTI\nCPU: 8 PID: 429254 Comm: kworker/8:39\nHardware name: LENOVO 20MAS08500/20MAS08500, BIOS N2CET69W (1.52 )\nWorkqueue: ksmbd-io handle_ksmbd_work [ksmbd]\nRIP: 0010:lib_sha256_base_do_update.isra.0+0x11e/0x1d0 [sha256_ssse3]\n\u0026lt;TASK\u0026gt;\n? show_regs+0x6d/0x80\n? __die+0x24/0x80\n? page_fault_oops+0x99/0x1b0\n? do_user_addr_fault+0x2ee/0x6b0\n? exc_page_fault+0x83/0x1b0\n? asm_exc_page_fault+0x27/0x30\n? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3]\n? lib_sha256_base_do_update.isra.0+0x11e/0x1d0 [sha256_ssse3]\n? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3]\n? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3]\n_sha256_update+0x77/0xa0 [sha256_ssse3]\nsha256_avx2_update+0x15/0x30 [sha256_ssse3]\ncrypto_shash_update+0x1e/0x40\nhmac_update+0x12/0x20\ncrypto_shash_update+0x1e/0x40\ngenerate_key+0x234/0x380 [ksmbd]\ngenerate_smb3encryptionkey+0x40/0x1c0 [ksmbd]\nksmbd_gen_smb311_encryptionkey+0x72/0xa0 [ksmbd]\nntlm_authenticate.isra.0+0x423/0x5d0 [ksmbd]\nsmb2_sess_setup+0x952/0xaa0 [ksmbd]\n__process_request+0xa3/0x1d0 [ksmbd]\n__handle_ksmbd_work+0x1c4/0x2f0 [ksmbd]\nhandle_ksmbd_work+0x2d/0xa0 [ksmbd]\nprocess_one_work+0x16c/0x350\nworker_thread+0x306/0x440\n? __pfx_worker_thread+0x10/0x10\nkthread+0xef/0x120\n? __pfx_kthread+0x10/0x10\nret_from_fork+0x44/0x70\n? __pfx_kthread+0x10/0x10\nret_from_fork_asm+0x1b/0x30\n\u0026lt;/TASK\u0026gt;(CVE-2024-46795)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/amdgpu: the warning dereferencing obj for nbio_v7_4\r\n\r\nif ras_manager obj null, don\u0026apos;t print NBIO err data(CVE-2024-46819)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nsched: sch_cake: fix bulk flow accounting logic for host fairness\r\n\r\nIn sch_cake, we keep track of the count of active bulk flows per host,\nwhen running in dst/src host fairness mode, which is used as the\nround-robin weight when iterating through flows. The count of active\nbulk flows is updated whenever a flow changes state.\r\n\r\nThis has a peculiar interaction with the hash collision handling: when a\nhash collision occurs (after the set-associative hashing), the state of\nthe hash bucket is simply updated to match the new packet that collided,\nand if host fairness is enabled, that also means assigning new per-host\nstate to the flow. For this reason, the bulk flow counters of the\nhost(s) assigned to the flow are decremented, before new state is\nassigned (and the counters, which may not belong to the same host\nanymore, are incremented again).\r\n\r\nBack when this code was introduced, the host fairness mode was always\nenabled, so the decrement was unconditional. When the configuration\nflags were introduced the *increment* was made conditional, but\nthe *decrement* was not. Which of course can lead to a spurious\ndecrement (and associated wrap-around to U16_MAX).\r\n\r\nAFAICT, when host fairness is disabled, the decrement and wrap-around\nhappens as soon as a hash collision occurs (which is not that common in\nitself, due to the set-associative hashing). However, in most cases this\nis harmless, as the value is only used when host fairness mode is\nenabled. So in order to trigger an array overflow, sch_cake has to first\nbe configured with host fairness disabled, and while running in this\nmode, a hash collision has to occur to cause the overflow. Then, the\nqdisc has to be reconfigured to enable host fairness, which leads to the\narray out-of-bounds because the wrapped-around value is retained and\nused as an array index. It seems that syzbot managed to trigger this,\nwhich is quite impressive in its own right.\r\n\r\nThis patch fixes the issue by introducing the same conditional check on\ndecrement as is used on increment.\r\n\r\nThe original bug predates the upstreaming of cake, but the commit listed\nin the Fixes tag touched that code, meaning that this patch won\u0026apos;t apply\nbefore that.(CVE-2024-46828)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbtrfs: clean up our handling of refs == 0 in snapshot delete\r\n\r\nIn reada we BUG_ON(refs == 0), which could be unkind since we aren\u0026apos;t\nholding a lock on the extent leaf and thus could get a transient\nincorrect answer.  In walk_down_proc we also BUG_ON(refs == 0), which\ncould happen if we have extent tree corruption.  Change that to return\n-EUCLEAN.  In do_walk_down() we catch this case and handle it correctly,\nhowever we return -EIO, which -EUCLEAN is a more appropriate error code.\nFinally in walk_up_proc we have the same BUG_ON(refs == 0), so convert\nthat to proper error handling.  Also adjust the error message so we can\nactually do something with the information.(CVE-2024-46840)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nperf/x86/intel: Limit the period on Haswell\r\n\r\nRunning the ltp test cve-2015-3290 concurrently reports the following\nwarnings.\r\n\r\nperfevents: irq loop stuck!\n  WARNING: CPU: 31 PID: 32438 at arch/x86/events/intel/core.c:3174\n  intel_pmu_handle_irq+0x285/0x370\n  Call Trace:\n   \u0026lt;NMI\u0026gt;\n   ? __warn+0xa4/0x220\n   ? intel_pmu_handle_irq+0x285/0x370\n   ? __report_bug+0x123/0x130\n   ? intel_pmu_handle_irq+0x285/0x370\n   ? __report_bug+0x123/0x130\n   ? intel_pmu_handle_irq+0x285/0x370\n   ? report_bug+0x3e/0xa0\n   ? handle_bug+0x3c/0x70\n   ? exc_invalid_op+0x18/0x50\n   ? asm_exc_invalid_op+0x1a/0x20\n   ? irq_work_claim+0x1e/0x40\n   ? intel_pmu_handle_irq+0x285/0x370\n   perf_event_nmi_handler+0x3d/0x60\n   nmi_handle+0x104/0x330\r\n\r\nThanks to Thomas Gleixner\u0026apos;s analysis, the issue is caused by the low\ninitial period (1) of the frequency estimation algorithm, which triggers\nthe defects of the HW, specifically erratum HSW11 and HSW143. (For the\ndetails, please refer https://lore.kernel.org/lkml/87plq9l5d2.ffs@tglx/)\r\n\r\nThe HSW11 requires a period larger than 100 for the INST_RETIRED.ALL\nevent, but the initial period in the freq mode is 1. The erratum is the\nsame as the BDM11, which has been supported in the kernel. A minimum\nperiod of 128 is enforced as well on HSW.\r\n\r\nHSW143 is regarding that the fixed counter 1 may overcount 32 with the\nHyper-Threading is enabled. However, based on the test, the hardware\nhas more issues than it tells. Besides the fixed counter 1, the message\n\u0026apos;interrupt took too long\u0026apos; can be observed on any counter which was armed\nwith a period \u0026lt; 32 and two events expired in the same NMI. A minimum\nperiod of 32 is enforced for the rest of the events.\nThe recommended workaround code of the HSW143 is not implemented.\nBecause it only addresses the issue for the fixed counter. It brings\nextra overhead through extra MSR writing. No related overcounting issue\nhas been reported so far.(CVE-2024-46848)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: dpaa: Pad packets to ETH_ZLEN\r\n\r\nWhen sending packets under 60 bytes, up to three bytes of the buffer\nfollowing the data may be leaked. Avoid this by extending all packets to\nETH_ZLEN, ensuring nothing is leaked in the padding. This bug can be\nreproduced by running\r\n\r\n\t$ ping -s 11 destination(CVE-2024-46854)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nft_socket: fix sk refcount leaks\r\n\r\nWe must put \u0026apos;sk\u0026apos; reference before returning.(CVE-2024-46855)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmptcp: pm: Fix uaf in __timer_delete_sync\r\n\r\nThere are two paths to access mptcp_pm_del_add_timer, result in a race\ncondition:\r\n\r\n     CPU1\t\t\t\tCPU2\n     ====                               ====\n     net_rx_action\n     napi_poll                          netlink_sendmsg\n     __napi_poll                        netlink_unicast\n     process_backlog                    netlink_unicast_kernel\n     __netif_receive_skb                genl_rcv\n     __netif_receive_skb_one_core       netlink_rcv_skb\n     NF_HOOK                            genl_rcv_msg\n     ip_local_deliver_finish            genl_family_rcv_msg\n     ip_protocol_deliver_rcu            genl_family_rcv_msg_doit\n     tcp_v4_rcv                         mptcp_pm_nl_flush_addrs_doit\n     tcp_v4_do_rcv                      mptcp_nl_remove_addrs_list\n     tcp_rcv_established                mptcp_pm_remove_addrs_and_subflows\n     tcp_data_queue                     remove_anno_list_by_saddr\n     mptcp_incoming_options             mptcp_pm_del_add_timer\n     mptcp_pm_del_add_timer             kfree(entry)\r\n\r\nIn remove_anno_list_by_saddr(running on CPU2), after leaving the critical\nzone protected by \u0026quot;pm.lock\u0026quot;, the entry will be released, which leads to the\noccurrence of uaf in the mptcp_pm_del_add_timer(running on CPU1).\r\n\r\nKeeping a reference to add_timer inside the lock, and calling\nsk_stop_timer_sync() with this reference, instead of \u0026quot;entry-\u0026gt;add_timer\u0026quot;.\r\n\r\nMove list_del(\u0026amp;entry-\u0026gt;list) to mptcp_pm_del_add_timer and inside the pm lock,\ndo not directly access any members of the entry outside the pm lock, which\ncan avoid similar \u0026quot;entry-\u0026gt;x\u0026quot; uaf.(CVE-2024-46858)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ncrypto: stm32/cryp - call finalize with bh disabled\r\n\r\nThe finalize operation in interrupt mode produce a produces a spinlock\nrecursion warning. The reason is the fact that BH must be disabled\nduring this process.(CVE-2024-47658)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nspi: hisi-kunpeng: Add verification for the max_frequency provided by the firmware\r\n\r\nIf the value of max_speed_hz is 0, it may cause a division by zero\nerror in hisi_calc_effective_speed().\nThe value of max_speed_hz is provided by firmware.\nFirmware is generally considered as a trusted domain. However, as\ndivision by zero errors can cause system failure, for defense measure,\nthe value of max_speed is validated here. So 0 is regarded as invalid\nand an error code is returned.(CVE-2024-47664)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nocfs2: add bounds checking to ocfs2_xattr_find_entry()\r\n\r\nAdd a paranoia check to make sure it doesn\u0026apos;t stray beyond valid memory\nregion containing ocfs2 xattr entries when scanning for a match.  It will\nprevent out-of-bound access in case of crafted images.(CVE-2024-47670)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nUSB: usbtmc: prevent kernel-usb-infoleak\r\n\r\nThe syzbot reported a kernel-usb-infoleak in usbtmc_write,\nwe need to clear the structure before filling fields.(CVE-2024-47671)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: iwlwifi: mvm: don\u0026apos;t wait for tx queues if firmware is dead\r\n\r\nThere is a WARNING in iwl_trans_wait_tx_queues_empty() (that was\nrecently converted from just a message), that can be hit if we\nwait for TX queues to become empty after firmware died. Clearly,\nwe can\u0026apos;t expect anything from the firmware after it\u0026apos;s declared dead.\r\n\r\nDon\u0026apos;t call iwl_trans_wait_tx_queues_empty() in this case. While it could\nbe a good idea to stop the flow earlier, the flush functions do some\nmaintenance work that is not related to the firmware, so keep that part\nof the code running even when the firmware is not running.\r\n\r\n[edit commit message](CVE-2024-47672)","status":"published","published":"2024-10-18T11:07:44Z","modified":"2026-08-18T01:17:35.636859842Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2258","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ns390/qeth: fix deadlock during failing recovery\r\n\r\nCommit 0b9902c1fcc5 (\u0026quot;s390/qeth: fix deadlock during recovery\u0026quot;) removed\ntaking discipline_mutex inside qeth_do_reset(), fixing potential\ndeadlocks. An error path was missed though, that still takes\ndiscipline_mutex and thus has the original deadlock potential.\r\n\r\nIntermittent deadlocks were seen when a qeth channel path is configured\noffline, causing a race between qeth_do_reset and ccwgroup_remove.\nCall qeth_set_offline() directly in the qeth_do_reset() error case and\nthen a new variant of ccwgroup_set_offline(), without taking\ndiscipline_mutex.(CVE-2021-47382)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/i915/gt: Cleanup partial engine discovery failures\r\n\r\nIf we abort driver initialisation in the middle of gt/engine discovery,\nsome engines will be fully setup and some not. Those incompletely setup\nengines only have \u0026apos;engine-\u0026gt;release == NULL\u0026apos; and so will leak any of the\ncommon objects allocated.\r\n\r\nv2:\n - Drop the destroy_pinned_context() helper for now.  It\u0026apos;s not really\n   worth it with just a single callsite at the moment.  (Janusz)(CVE-2022-48893)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nusb: gadget: ncm: Fix handling of zero block length packets\r\n\r\nWhile connecting to a Linux host with CDC_NCM_NTB_DEF_SIZE_TX\nset to 65536, it has been observed that we receive short packets,\nwhich come at interval of 5-10 seconds sometimes and have block\nlength zero but still contain 1-2 valid datagrams present.\r\n\r\nAccording to the NCM spec:\r\n\r\n\u0026quot;If wBlockLength = 0x0000, the block is terminated by a\nshort packet. In this case, the USB transfer must still\nbe shorter than dwNtbInMaxSize or dwNtbOutMaxSize. If\nexactly dwNtbInMaxSize or dwNtbOutMaxSize bytes are sent,\nand the size is a multiple of wMaxPacketSize for the\ngiven pipe, then no ZLP shall be sent.\r\n\r\nwBlockLength= 0x0000 must be used with extreme care, because\nof the possibility that the host and device may get out of\nsync, and because of test issues.\r\n\r\nwBlockLength = 0x0000 allows the sender to reduce latency by\nstarting to send a very large NTB, and then shortening it when\nthe sender discovers that there’s not sufficient data to justify\nsending a large NTB\u0026quot;\r\n\r\nHowever, there is a potential issue with the current implementation,\nas it checks for the occurrence of multiple NTBs in a single\ngiveback by verifying if the leftover bytes to be processed is zero\nor not. If the block length reads zero, we would process the same\nNTB infintely because the leftover bytes is never zero and it leads\nto a crash. Fix this by bailing out if block length reads zero.(CVE-2024-35825)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr\r\n\r\nAlthough ipv6_get_ifaddr walks inet6_addr_lst under the RCU lock, it\nstill means hlist_for_each_entry_rcu can return an item that got removed\nfrom the list. The memory itself of such item is not freed thanks to RCU\nbut nothing guarantees the actual content of the memory is sane.\r\n\r\nIn particular, the reference count can be zero. This can happen if\nipv6_del_addr is called in parallel. ipv6_del_addr removes the entry\nfrom inet6_addr_lst (hlist_del_init_rcu(\u0026amp;ifp-\u0026gt;addr_lst)) and drops all\nreferences (__in6_ifa_put(ifp) + in6_ifa_put(ifp)). With bad enough\ntiming, this can happen:\r\n\r\n1. In ipv6_get_ifaddr, hlist_for_each_entry_rcu returns an entry.\r\n\r\n2. Then, the whole ipv6_del_addr is executed for the given entry. The\n   reference count drops to zero and kfree_rcu is scheduled.\r\n\r\n3. ipv6_get_ifaddr continues and tries to increments the reference count\n   (in6_ifa_hold).\r\n\r\n4. The rcu is unlocked and the entry is freed.\r\n\r\n5. The freed entry is returned.\r\n\r\nPrevent increasing of the reference count in such case. The name\nin6_ifa_hold_safe is chosen to mimic the existing fib6_info_hold_safe.\r\n\r\n[   41.506330] refcount_t: addition on 0; use-after-free.\n[   41.506760] WARNING: CPU: 0 PID: 595 at lib/refcount.c:25 refcount_warn_saturate+0xa5/0x130\n[   41.507413] Modules linked in: veth bridge stp llc\n[   41.507821] CPU: 0 PID: 595 Comm: python3 Not tainted 6.9.0-rc2.main-00208-g49563be82afa #14\n[   41.508479] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)\n[   41.509163] RIP: 0010:refcount_warn_saturate+0xa5/0x130\n[   41.509586] Code: ad ff 90 0f 0b 90 90 c3 cc cc cc cc 80 3d c0 30 ad 01 00 75 a0 c6 05 b7 30 ad 01 01 90 48 c7 c7 38 cc 7a 8c e8 cc 18 ad ff 90 \u0026lt;0f\u0026gt; 0b 90 90 c3 cc cc cc cc 80 3d 98 30 ad 01 00 0f 85 75 ff ff ff\n[   41.510956] RSP: 0018:ffffbda3c026baf0 EFLAGS: 00010282\n[   41.511368] RAX: 0000000000000000 RBX: ffff9e9c46914800 RCX: 0000000000000000\n[   41.511910] RDX: ffff9e9c7ec29c00 RSI: ffff9e9c7ec1c900 RDI: ffff9e9c7ec1c900\n[   41.512445] RBP: ffff9e9c43660c9c R08: 0000000000009ffb R09: 00000000ffffdfff\n[   41.512998] R10: 00000000ffffdfff R11: ffffffff8ca58a40 R12: ffff9e9c4339a000\n[   41.513534] R13: 0000000000000001 R14: ffff9e9c438a0000 R15: ffffbda3c026bb48\n[   41.514086] FS:  00007fbc4cda1740(0000) GS:ffff9e9c7ec00000(0000) knlGS:0000000000000000\n[   41.514726] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   41.515176] CR2: 000056233b337d88 CR3: 000000000376e006 CR4: 0000000000370ef0\n[   41.515713] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[   41.516252] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[   41.516799] Call Trace:\n[   41.517037]  \u0026lt;TASK\u0026gt;\n[   41.517249]  ? __warn+0x7b/0x120\n[   41.517535]  ? refcount_warn_saturate+0xa5/0x130\n[   41.517923]  ? report_bug+0x164/0x190\n[   41.518240]  ? handle_bug+0x3d/0x70\n[   41.518541]  ? exc_invalid_op+0x17/0x70\n[   41.520972]  ? asm_exc_invalid_op+0x1a/0x20\n[   41.521325]  ? refcount_warn_saturate+0xa5/0x130\n[   41.521708]  ipv6_get_ifaddr+0xda/0xe0\n[   41.522035]  inet6_rtm_getaddr+0x342/0x3f0\n[   41.522376]  ? __pfx_inet6_rtm_getaddr+0x10/0x10\n[   41.522758]  rtnetlink_rcv_msg+0x334/0x3d0\n[   41.523102]  ? netlink_unicast+0x30f/0x390\n[   41.523445]  ? __pfx_rtnetlink_rcv_msg+0x10/0x10\n[   41.523832]  netlink_rcv_skb+0x53/0x100\n[   41.524157]  netlink_unicast+0x23b/0x390\n[   41.524484]  netlink_sendmsg+0x1f2/0x440\n[   41.524826]  __sys_sendto+0x1d8/0x1f0\n[   41.525145]  __x64_sys_sendto+0x1f/0x30\n[   41.525467]  do_syscall_64+0xa5/0x1b0\n[   41.525794]  entry_SYSCALL_64_after_hwframe+0x72/0x7a\n[   41.526213] RIP: 0033:0x7fbc4cfcea9a\n[   41.526528] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 \u0026lt;48\u0026gt; 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89\n[   41.527942] RSP: 002b:00007f\n---truncated---(CVE-2024-35969)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nf_tables: honor table dormant flag from netdev release event path\r\n\r\nCheck for table dormant flag otherwise netdev release event path tries\nto unregister an already unregistered hook.\r\n\r\n[524854.857999] ------------[ cut here ]------------\n[524854.858010] WARNING: CPU: 0 PID: 3386599 at net/netfilter/core.c:501 __nf_unregister_net_hook+0x21a/0x260\n[...]\n[524854.858848] CPU: 0 PID: 3386599 Comm: kworker/u32:2 Not tainted 6.9.0-rc3+ #365\n[524854.858869] Workqueue: netns cleanup_net\n[524854.858886] RIP: 0010:__nf_unregister_net_hook+0x21a/0x260\n[524854.858903] Code: 24 e8 aa 73 83 ff 48 63 43 1c 83 f8 01 0f 85 3d ff ff ff e8 98 d1 f0 ff 48 8b 3c 24 e8 8f 73 83 ff 48 63 43 1c e9 26 ff ff ff \u0026lt;0f\u0026gt; 0b 48 83 c4 18 48 c7 c7 00 68 e9 82 5b 5d 41 5c 41 5d 41 5e 41\n[524854.858914] RSP: 0018:ffff8881e36d79e0 EFLAGS: 00010246\n[524854.858926] RAX: 0000000000000000 RBX: ffff8881339ae790 RCX: ffffffff81ba524a\n[524854.858936] RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff8881c8a16438\n[524854.858945] RBP: ffff8881c8a16438 R08: 0000000000000001 R09: ffffed103c6daf34\n[524854.858954] R10: ffff8881e36d79a7 R11: 0000000000000000 R12: 0000000000000005\n[524854.858962] R13: ffff8881c8a16000 R14: 0000000000000000 R15: ffff8881351b5a00\n[524854.858971] FS:  0000000000000000(0000) GS:ffff888390800000(0000) knlGS:0000000000000000\n[524854.858982] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[524854.858991] CR2: 00007fc9be0f16f4 CR3: 00000001437cc004 CR4: 00000000001706f0\n[524854.859000] Call Trace:\n[524854.859006]  \u0026lt;TASK\u0026gt;\n[524854.859013]  ? __warn+0x9f/0x1a0\n[524854.859027]  ? __nf_unregister_net_hook+0x21a/0x260\n[524854.859044]  ? report_bug+0x1b1/0x1e0\n[524854.859060]  ? handle_bug+0x3c/0x70\n[524854.859071]  ? exc_invalid_op+0x17/0x40\n[524854.859083]  ? asm_exc_invalid_op+0x1a/0x20\n[524854.859100]  ? __nf_unregister_net_hook+0x6a/0x260\n[524854.859116]  ? __nf_unregister_net_hook+0x21a/0x260\n[524854.859135]  nf_tables_netdev_event+0x337/0x390 [nf_tables]\n[524854.859304]  ? __pfx_nf_tables_netdev_event+0x10/0x10 [nf_tables]\n[524854.859461]  ? packet_notifier+0xb3/0x360\n[524854.859476]  ? _raw_spin_unlock_irqrestore+0x11/0x40\n[524854.859489]  ? dcbnl_netdevice_event+0x35/0x140\n[524854.859507]  ? __pfx_nf_tables_netdev_event+0x10/0x10 [nf_tables]\n[524854.859661]  notifier_call_chain+0x7d/0x140\n[524854.859677]  unregister_netdevice_many_notify+0x5e1/0xae0(CVE-2024-36005)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nkeys: Fix overwrite of key expiration on instantiation\r\n\r\nThe expiry time of a key is unconditionally overwritten during\ninstantiation, defaulting to turn it permanent. This causes a problem\nfor DNS resolution as the expiration set by user-space is overwritten to\nTIME64_MAX, disabling further DNS updates. Fix this by restoring the\ncondition that key_set_expiry is only called when the pre-parser sets a\nspecific expiry.(CVE-2024-36031)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: tproxy: bail out if IP has been disabled on the device\r\n\r\nsyzbot reports:\ngeneral protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]\n[..]\nRIP: 0010:nf_tproxy_laddr4+0xb7/0x340 net/ipv4/netfilter/nf_tproxy_ipv4.c:62\nCall Trace:\n nft_tproxy_eval_v4 net/netfilter/nft_tproxy.c:56 [inline]\n nft_tproxy_eval+0xa9a/0x1a00 net/netfilter/nft_tproxy.c:168\r\n\r\n__in_dev_get_rcu() can return NULL, so check for this.(CVE-2024-36270)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nBluetooth: qca: add missing firmware sanity checks\r\n\r\nAdd the missing sanity checks when parsing the firmware files before\ndownloading them to avoid accessing and corrupting memory beyond the\nvmalloced buffer.(CVE-2024-36880)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnfc: llcp: fix nfc_llcp_setsockopt() unsafe copies\r\n\r\nsyzbot reported unsafe calls to copy_from_sockptr() [1]\r\n\r\nUse copy_safe_from_sockptr() instead.\r\n\r\n[1]\r\n\r\nBUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]\n BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline]\n BUG: KASAN: slab-out-of-bounds in nfc_llcp_setsockopt+0x6c2/0x850 net/nfc/llcp_sock.c:255\nRead of size 4 at addr ffff88801caa1ec3 by task syz-executor459/5078\r\n\r\nCPU: 0 PID: 5078 Comm: syz-executor459 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\nCall Trace:\n \u0026lt;TASK\u0026gt;\n  __dump_stack lib/dump_stack.c:88 [inline]\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114\n  print_address_description mm/kasan/report.c:377 [inline]\n  print_report+0x169/0x550 mm/kasan/report.c:488\n  kasan_report+0x143/0x180 mm/kasan/report.c:601\n  copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]\n  copy_from_sockptr include/linux/sockptr.h:55 [inline]\n  nfc_llcp_setsockopt+0x6c2/0x850 net/nfc/llcp_sock.c:255\n  do_sock_setsockopt+0x3b1/0x720 net/socket.c:2311\n  __sys_setsockopt+0x1ae/0x250 net/socket.c:2334\n  __do_sys_setsockopt net/socket.c:2343 [inline]\n  __se_sys_setsockopt net/socket.c:2340 [inline]\n  __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340\n do_syscall_64+0xfd/0x240\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\nRIP: 0033:0x7f7fac07fd89\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 91 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007fff660eb788 EFLAGS: 00000246 ORIG_RAX: 0000000000000036\nRAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f7fac07fd89\nRDX: 0000000000000000 RSI: 0000000000000118 RDI: 0000000000000004\nRBP: 0000000000000000 R08: 0000000000000002 R09: 0000000000000000\nR10: 0000000020000a80 R11: 0000000000000246 R12: 0000000000000000\nR13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000(CVE-2024-36915)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbna: ensure the copied buf is NUL terminated\r\n\r\nCurrently, we allocate a nbytes-sized kernel buffer and copy nbytes from\nuserspace to that buffer. Later, we use sscanf on this buffer but we don\u0026apos;t\nensure that the string is terminated inside the buffer, this can lead to\nOOB read when using sscanf. Fix this issue by using memdup_user_nul\ninstead of memdup_user.(CVE-2024-36934)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nphonet: fix rtm_phonet_notify() skb allocation\r\n\r\nfill_route() stores three components in the skb:\r\n\r\n- struct rtmsg\n- RTA_DST (u8)\n- RTA_OIF (u32)\r\n\r\nTherefore, rtm_phonet_notify() should use\r\n\r\nNLMSG_ALIGN(sizeof(struct rtmsg)) +\nnla_total_size(1) +\nnla_total_size(4)(CVE-2024-36946)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm: vc4: Fix possible null pointer dereference\r\n\r\nIn vc4_hdmi_audio_init() of_get_address() may return\nNULL which is later dereferenced. Fix this bug by adding NULL check.\r\n\r\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2024-38546)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nscsi: bfa: Ensure the copied buf is NUL terminated\r\n\r\nCurrently, we allocate a nbytes-sized kernel buffer and copy nbytes from\nuserspace to that buffer. Later, we use sscanf on this buffer but we don\u0026apos;t\nensure that the string is terminated inside the buffer, this can lead to\nOOB read when using sscanf. Fix this issue by using memdup_user_nul instead\nof memdup_user.(CVE-2024-38560)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmedia: i2c: et8ek8: Don\u0026apos;t strip remove function when driver is builtin\r\n\r\nUsing __exit for the remove function results in the remove callback\nbeing discarded with CONFIG_VIDEO_ET8EK8=y. When such a device gets\nunbound (e.g. using sysfs or hotplug), the driver is just removed\nwithout the cleanup being performed. This results in resource leaks. Fix\nit by compiling in the remove callback unconditionally.\r\n\r\nThis also fixes a W=1 modpost warning:\r\n\r\n\tWARNING: modpost: drivers/media/i2c/et8ek8/et8ek8: section mismatch in reference: et8ek8_i2c_driver+0x10 (section: .data) -\u0026gt; et8ek8_remove (section: .exit.text)(CVE-2024-38611)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nm68k: Fix spinlock race in kernel thread creation\r\n\r\nContext switching does take care to retain the correct lock owner across\nthe switch from \u0026apos;prev\u0026apos; to \u0026apos;next\u0026apos; tasks.  This does rely on interrupts\nremaining disabled for the entire duration of the switch.\r\n\r\nThis condition is guaranteed for normal process creation and context\nswitching between already running processes, because both \u0026apos;prev\u0026apos; and\n\u0026apos;next\u0026apos; already have interrupts disabled in their saved copies of the\nstatus register.\r\n\r\nThe situation is different for newly created kernel threads.  The status\nregister is set to PS_S in copy_thread(), which does leave the IPL at 0.\nUpon restoring the \u0026apos;next\u0026apos; thread\u0026apos;s status register in switch_to() aka\nresume(), interrupts then become enabled prematurely.  resume() then\nreturns via ret_from_kernel_thread() and schedule_tail() where run queue\nlock is released (see finish_task_switch() and finish_lock_switch()).\r\n\r\nA timer interrupt calling scheduler_tick() before the lock is released\nin finish_task_switch() will find the lock already taken, with the\ncurrent task as lock owner.  This causes a spinlock recursion warning as\nreported by Guenter Roeck.\r\n\r\nAs far as I can ascertain, this race has been opened in commit\n533e6903bea0 (\u0026quot;m68k: split ret_from_fork(), simplify kernel_thread()\u0026quot;)\nbut I haven\u0026apos;t done a detailed study of kernel history so it may well\npredate that commit.\r\n\r\nInterrupts cannot be disabled in the saved status register copy for\nkernel threads (init will complain about interrupts disabled when\nfinally starting user space).  Disable interrupts temporarily when\nswitching the tasks\u0026apos; register sets in resume().\r\n\r\nNote that a simple oriw 0x700,%sr after restoring sr is not enough here\n- this leaves enough of a race for the \u0026apos;spinlock recursion\u0026apos; warning to\nstill be observed.\r\n\r\nTested on ARAnyM and qemu (Quadra 800 emulation).(CVE-2024-38613)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nenic: Validate length of nl attributes in enic_set_vf_port\r\n\r\nenic_set_vf_port assumes that the nl attribute IFLA_PORT_PROFILE\nis of length PORT_PROFILE_MAX and that the nl attributes\nIFLA_PORT_INSTANCE_UUID, IFLA_PORT_HOST_UUID are of length PORT_UUID_MAX.\nThese attributes are validated (in the function do_setlink in rtnetlink.c)\nusing the nla_policy ifla_port_policy. The policy defines IFLA_PORT_PROFILE\nas NLA_STRING, IFLA_PORT_INSTANCE_UUID as NLA_BINARY and\nIFLA_PORT_HOST_UUID as NLA_STRING. That means that the length validation\nusing the policy is for the max size of the attributes and not on exact\nsize so the length of these attributes might be less than the sizes that\nenic_set_vf_port expects. This might cause an out of bands\nread access in the memcpys of the data of these\nattributes in enic_set_vf_port.(CVE-2024-38659)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\num: Add winch to winch_handlers before registering winch IRQ\r\n\r\nRegistering a winch IRQ is racy, an interrupt may occur before the winch is\nadded to the winch_handlers list.\r\n\r\nIf that happens, register_winch_irq() adds to that list a winch that is\nscheduled to be (or has already been) freed, causing a panic later in\nwinch_cleanup().\r\n\r\nAvoid the race by adding the winch to the winch_handlers list before\nregistering the IRQ, and rolling back if um_request_irq() fails.(CVE-2024-39292)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nima: Fix use-after-free on a dentry\u0026apos;s dname.name\r\n\r\n-\u0026gt;d_name.name can change on rename and the earlier value can be freed;\nthere are conditions sufficient to stabilize it (-\u0026gt;d_lock on dentry,\n-\u0026gt;d_lock on its parent, -\u0026gt;i_rwsem exclusive on the parent\u0026apos;s inode,\nrename_lock), but none of those are met at any of the sites. Take a stable\nsnapshot of the name instead.(CVE-2024-39494)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/exynos/vidi: fix memory leak in .get_modes()\r\n\r\nThe duplicated EDID is never freed. Fix it.(CVE-2024-40932)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/radeon: fix UBSAN warning in kv_dpm.c\r\n\r\nAdds bounds check for sumo_vid_mapping_entry.(CVE-2024-40988)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nfs/ntfs3: Validate ff offset\r\n\r\nThis adds sanity checks for ff offset. There is a check\non rt-\u0026gt;first_free at first, but walking through by ff\nwithout any check. If the second ff is a large offset.\nWe may encounter an out-of-bound read.(CVE-2024-41019)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/sched: Fix UAF when resolving a clash\r\n\r\nKASAN reports the following UAF:\r\n\r\n BUG: KASAN: slab-use-after-free in tcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct]\n Read of size 1 at addr ffff888c07603600 by task handler130/6469\r\n\r\n Call Trace:\n  \u0026lt;IRQ\u0026gt;\n  dump_stack_lvl+0x48/0x70\n  print_address_description.constprop.0+0x33/0x3d0\n  print_report+0xc0/0x2b0\n  kasan_report+0xd0/0x120\n  __asan_load1+0x6c/0x80\n  tcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct]\n  tcf_ct_act+0x886/0x1350 [act_ct]\n  tcf_action_exec+0xf8/0x1f0\n  fl_classify+0x355/0x360 [cls_flower]\n  __tcf_classify+0x1fd/0x330\n  tcf_classify+0x21c/0x3c0\n  sch_handle_ingress.constprop.0+0x2c5/0x500\n  __netif_receive_skb_core.constprop.0+0xb25/0x1510\n  __netif_receive_skb_list_core+0x220/0x4c0\n  netif_receive_skb_list_internal+0x446/0x620\n  napi_complete_done+0x157/0x3d0\n  gro_cell_poll+0xcf/0x100\n  __napi_poll+0x65/0x310\n  net_rx_action+0x30c/0x5c0\n  __do_softirq+0x14f/0x491\n  __irq_exit_rcu+0x82/0xc0\n  irq_exit_rcu+0xe/0x20\n  common_interrupt+0xa1/0xb0\n  \u0026lt;/IRQ\u0026gt;\n  \u0026lt;TASK\u0026gt;\n  asm_common_interrupt+0x27/0x40\r\n\r\n Allocated by task 6469:\n  kasan_save_stack+0x38/0x70\n  kasan_set_track+0x25/0x40\n  kasan_save_alloc_info+0x1e/0x40\n  __kasan_krealloc+0x133/0x190\n  krealloc+0xaa/0x130\n  nf_ct_ext_add+0xed/0x230 [nf_conntrack]\n  tcf_ct_act+0x1095/0x1350 [act_ct]\n  tcf_action_exec+0xf8/0x1f0\n  fl_classify+0x355/0x360 [cls_flower]\n  __tcf_classify+0x1fd/0x330\n  tcf_classify+0x21c/0x3c0\n  sch_handle_ingress.constprop.0+0x2c5/0x500\n  __netif_receive_skb_core.constprop.0+0xb25/0x1510\n  __netif_receive_skb_list_core+0x220/0x4c0\n  netif_receive_skb_list_internal+0x446/0x620\n  napi_complete_done+0x157/0x3d0\n  gro_cell_poll+0xcf/0x100\n  __napi_poll+0x65/0x310\n  net_rx_action+0x30c/0x5c0\n  __do_softirq+0x14f/0x491\r\n\r\n Freed by task 6469:\n  kasan_save_stack+0x38/0x70\n  kasan_set_track+0x25/0x40\n  kasan_save_free_info+0x2b/0x60\n  ____kasan_slab_free+0x180/0x1f0\n  __kasan_slab_free+0x12/0x30\n  slab_free_freelist_hook+0xd2/0x1a0\n  __kmem_cache_free+0x1a2/0x2f0\n  kfree+0x78/0x120\n  nf_conntrack_free+0x74/0x130 [nf_conntrack]\n  nf_ct_destroy+0xb2/0x140 [nf_conntrack]\n  __nf_ct_resolve_clash+0x529/0x5d0 [nf_conntrack]\n  nf_ct_resolve_clash+0xf6/0x490 [nf_conntrack]\n  __nf_conntrack_confirm+0x2c6/0x770 [nf_conntrack]\n  tcf_ct_act+0x12ad/0x1350 [act_ct]\n  tcf_action_exec+0xf8/0x1f0\n  fl_classify+0x355/0x360 [cls_flower]\n  __tcf_classify+0x1fd/0x330\n  tcf_classify+0x21c/0x3c0\n  sch_handle_ingress.constprop.0+0x2c5/0x500\n  __netif_receive_skb_core.constprop.0+0xb25/0x1510\n  __netif_receive_skb_list_core+0x220/0x4c0\n  netif_receive_skb_list_internal+0x446/0x620\n  napi_complete_done+0x157/0x3d0\n  gro_cell_poll+0xcf/0x100\n  __napi_poll+0x65/0x310\n  net_rx_action+0x30c/0x5c0\n  __do_softirq+0x14f/0x491\r\n\r\nThe ct may be dropped if a clash has been resolved but is still passed to\nthe tcf_ct_flow_table_process_conn function for further usage. This issue\ncan be fixed by retrieving ct from skb again after confirming conntrack.(CVE-2024-41040)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nudp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().\r\n\r\nsyzkaller triggered the warning [0] in udp_v4_early_demux().\r\n\r\nIn udp_v[46]_early_demux() and sk_lookup(), we do not touch the refcount\nof the looked-up sk and use sock_pfree() as skb-\u0026gt;destructor, so we check\nSOCK_RCU_FREE to ensure that the sk is safe to access during the RCU grace\nperiod.\r\n\r\nCurrently, SOCK_RCU_FREE is flagged for a bound socket after being put\ninto the hash table.  Moreover, the SOCK_RCU_FREE check is done too early\nin udp_v[46]_early_demux() and sk_lookup(), so there could be a small race\nwindow:\r\n\r\n  CPU1                                 CPU2\n  ----                                 ----\n  udp_v4_early_demux()                 udp_lib_get_port()\n  |                                    |- hlist_add_head_rcu()\n  |- sk = __udp4_lib_demux_lookup()    |\n  |- DEBUG_NET_WARN_ON_ONCE(sk_is_refcounted(sk));\n                                       `- sock_set_flag(sk, SOCK_RCU_FREE)\r\n\r\nWe had the same bug in TCP and fixed it in commit 871019b22d1b (\u0026quot;net:\nset SOCK_RCU_FREE before inserting socket into hashtable\u0026quot;).\r\n\r\nLet\u0026apos;s apply the same fix for UDP.\r\n\r\n[0]:\nWARNING: CPU: 0 PID: 11198 at net/ipv4/udp.c:2599 udp_v4_early_demux+0x481/0xb70 net/ipv4/udp.c:2599\nModules linked in:\nCPU: 0 PID: 11198 Comm: syz-executor.1 Not tainted 6.9.0-g93bda33046e7 #13\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\nRIP: 0010:udp_v4_early_demux+0x481/0xb70 net/ipv4/udp.c:2599\nCode: c5 7a 15 fe bb 01 00 00 00 44 89 e9 31 ff d3 e3 81 e3 bf ef ff ff 89 de e8 2c 74 15 fe 85 db 0f 85 02 06 00 00 e8 9f 7a 15 fe \u0026lt;0f\u0026gt; 0b e8 98 7a 15 fe 49 8d 7e 60 e8 4f 39 2f fe 49 c7 46 60 20 52\nRSP: 0018:ffffc9000ce3fa58 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8318c92c\nRDX: ffff888036ccde00 RSI: ffffffff8318c2f1 RDI: 0000000000000001\nRBP: ffff88805a2dd6e0 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000000 R11: 0001ffffffffffff R12: ffff88805a2dd680\nR13: 0000000000000007 R14: ffff88800923f900 R15: ffff88805456004e\nFS:  00007fc449127640(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fc449126e38 CR3: 000000003de4b002 CR4: 0000000000770ef0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600\nPKRU: 55555554\nCall Trace:\n \u0026lt;TASK\u0026gt;\n ip_rcv_finish_core.constprop.0+0xbdd/0xd20 net/ipv4/ip_input.c:349\n ip_rcv_finish+0xda/0x150 net/ipv4/ip_input.c:447\n NF_HOOK include/linux/netfilter.h:314 [inline]\n NF_HOOK include/linux/netfilter.h:308 [inline]\n ip_rcv+0x16c/0x180 net/ipv4/ip_input.c:569\n __netif_receive_skb_one_core+0xb3/0xe0 net/core/dev.c:5624\n __netif_receive_skb+0x21/0xd0 net/core/dev.c:5738\n netif_receive_skb_internal net/core/dev.c:5824 [inline]\n netif_receive_skb+0x271/0x300 net/core/dev.c:5884\n tun_rx_batched drivers/net/tun.c:1549 [inline]\n tun_get_user+0x24db/0x2c50 drivers/net/tun.c:2002\n tun_chr_write_iter+0x107/0x1a0 drivers/net/tun.c:2048\n new_sync_write fs/read_write.c:497 [inline]\n vfs_write+0x76f/0x8d0 fs/read_write.c:590\n ksys_write+0xbf/0x190 fs/read_write.c:643\n __do_sys_write fs/read_write.c:655 [inline]\n __se_sys_write fs/read_write.c:652 [inline]\n __x64_sys_write+0x41/0x50 fs/read_write.c:652\n x64_sys_call+0xe66/0x1990 arch/x86/include/generated/asm/syscalls_64.h:2\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x4b/0x110 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\nRIP: 0033:0x7fc44a68bc1f\nCode: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 e9 cf f5 ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 \u0026lt;48\u0026gt; 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 3c d0 f5 ff 48\nRSP: 002b:00007fc449126c90 EFLAGS: 00000293 ORIG_RAX: 0000000000000001\nRAX: ffffffffffffffda RBX: 00000000004bc050 RCX: 00007fc44a68bc1f\nR\n---truncated---(CVE-2024-41041)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nskmsg: Skip zero length skb in sk_msg_recvmsg\r\n\r\nWhen running BPF selftests (./test_progs -t sockmap_basic) on a Loongarch\nplatform, the following kernel panic occurs:\r\n\r\n  [...]\n  Oops[#1]:\n  CPU: 22 PID: 2824 Comm: test_progs Tainted: G           OE  6.10.0-rc2+ #18\n  Hardware name: LOONGSON Dabieshan/Loongson-TC542F0, BIOS Loongson-UDK2018\n     ... ...\n     ra: 90000000048bf6c0 sk_msg_recvmsg+0x120/0x560\n    ERA: 9000000004162774 copy_page_to_iter+0x74/0x1c0\n   CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)\n   PRMD: 0000000c (PPLV0 +PIE +PWE)\n   EUEN: 00000007 (+FPE +SXE +ASXE -BTE)\n   ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7)\n  ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0)\n   BADV: 0000000000000040\n   PRID: 0014c011 (Loongson-64bit, Loongson-3C5000)\n  Modules linked in: bpf_testmod(OE) xt_CHECKSUM xt_MASQUERADE xt_conntrack\n  Process test_progs (pid: 2824, threadinfo=0000000000863a31, task=...)\n  Stack : ...\n  Call Trace:\n  [\u0026lt;9000000004162774\u0026gt;] copy_page_to_iter+0x74/0x1c0\n  [\u0026lt;90000000048bf6c0\u0026gt;] sk_msg_recvmsg+0x120/0x560\n  [\u0026lt;90000000049f2b90\u0026gt;] tcp_bpf_recvmsg_parser+0x170/0x4e0\n  [\u0026lt;90000000049aae34\u0026gt;] inet_recvmsg+0x54/0x100\n  [\u0026lt;900000000481ad5c\u0026gt;] sock_recvmsg+0x7c/0xe0\n  [\u0026lt;900000000481e1a8\u0026gt;] __sys_recvfrom+0x108/0x1c0\n  [\u0026lt;900000000481e27c\u0026gt;] sys_recvfrom+0x1c/0x40\n  [\u0026lt;9000000004c076ec\u0026gt;] do_syscall+0x8c/0xc0\n  [\u0026lt;9000000003731da4\u0026gt;] handle_syscall+0xc4/0x160\n  Code: ...\n  ---[ end trace 0000000000000000 ]---\n  Kernel panic - not syncing: Fatal exception\n  Kernel relocated by 0x3510000\n   .text @ 0x9000000003710000\n   .data @ 0x9000000004d70000\n   .bss  @ 0x9000000006469400\n  ---[ end Kernel panic - not syncing: Fatal exception ]---\n  [...]\r\n\r\nThis crash happens every time when running sockmap_skb_verdict_shutdown\nsubtest in sockmap_basic.\r\n\r\nThis crash is because a NULL pointer is passed to page_address() in the\nsk_msg_recvmsg(). Due to the different implementations depending on the\narchitecture, page_address(NULL) will trigger a panic on Loongarch\nplatform but not on x86 platform. So this bug was hidden on x86 platform\nfor a while, but now it is exposed on Loongarch platform. The root cause\nis that a zero length skb (skb-\u0026gt;len == 0) was put on the queue.\r\n\r\nThis zero length skb is a TCP FIN packet, which was sent by shutdown(),\ninvoked in test_sockmap_skb_verdict_shutdown():\r\n\r\n\tshutdown(p1, SHUT_WR);\r\n\r\nIn this case, in sk_psock_skb_ingress_enqueue(), num_sge is zero, and no\npage is put to this sge (see sg_set_page in sg_set_page), but this empty\nsge is queued into ingress_msg list.\r\n\r\nAnd in sk_msg_recvmsg(), this empty sge is used, and a NULL page is got by\nsg_page(sge). Pass this NULL page to copy_page_to_iter(), which passes it\nto kmap_local_page() and to page_address(), then kernel panics.\r\n\r\nTo solve this, we should skip this zero length skb. So in sk_msg_recvmsg(),\nif copy is zero, that means it\u0026apos;s a zero length skb, skip invoking\ncopy_page_to_iter(). We are using the EFAULT return triggered by\ncopy_page_to_iter to check for is_fin in tcp_bpf.c.(CVE-2024-41048)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nfilelock: fix potential use-after-free in posix_lock_inode\r\n\r\nLight Hsieh reported a KASAN UAF warning in trace_posix_lock_inode().\nThe request pointer had been changed earlier to point to a lock entry\nthat was added to the inode\u0026apos;s list. However, before the tracepoint could\nfire, another task raced in and freed that lock.\r\n\r\nFix this by moving the tracepoint inside the spinlock, which should\nensure that this doesn\u0026apos;t happen.(CVE-2024-41049)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nBluetooth: hci_core: cancel all works upon hci_unregister_dev()\r\n\r\nsyzbot is reporting that calling hci_release_dev() from hci_error_reset()\ndue to hci_dev_put() from hci_error_reset() can cause deadlock at\ndestroy_workqueue(), for hci_error_reset() is called from\nhdev-\u0026gt;req_workqueue which destroy_workqueue() needs to flush.\r\n\r\nWe need to make sure that hdev-\u0026gt;{rx_work,cmd_work,tx_work} which are\nqueued into hdev-\u0026gt;workqueue and hdev-\u0026gt;{power_on,error_reset} which are\nqueued into hdev-\u0026gt;req_workqueue are no longer running by the moment\r\n\r\n       destroy_workqueue(hdev-\u0026gt;workqueue);\n       destroy_workqueue(hdev-\u0026gt;req_workqueue);\r\n\r\nare called from hci_release_dev().\r\n\r\nCall cancel_work_sync() on these work items from hci_unregister_dev()\nas soon as hdev-\u0026gt;list is removed from hci_dev_list.(CVE-2024-41063)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nASoC: topology: Fix references to freed memory\r\n\r\nMost users after parsing a topology file, release memory used by it, so\nhaving pointer references directly into topology file contents is wrong.\nUse devm_kmemdup(), to allocate memory as needed.(CVE-2024-41069)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nio_uring: fix possible deadlock in io_register_iowq_max_workers()\r\n\r\nThe io_register_iowq_max_workers() function calls io_put_sq_data(),\nwhich acquires the sqd-\u0026gt;lock without releasing the uring_lock.\nSimilar to the commit 009ad9f0c6ee (\u0026quot;io_uring: drop ctx-\u0026gt;uring_lock\nbefore acquiring sqd-\u0026gt;lock\u0026quot;), this can lead to a potential deadlock\nsituation.\r\n\r\nTo resolve this issue, the uring_lock is released before calling\nio_put_sq_data(), and then it is re-acquired after the function call.\r\n\r\nThis change ensures that the locks are acquired in the correct\norder, preventing the possibility of a deadlock.(CVE-2024-41080)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntap: add missing verification for short frame\r\n\r\nThe cited commit missed to check against the validity of the frame length\nin the tap_get_user_xdp() path, which could cause a corrupted skb to be\nsent downstack. Even before the skb is transmitted, the\ntap_get_user_xdp()--\u0026gt;skb_set_network_header() may assume the size is more\nthan ETH_HLEN. Once transmitted, this could either cause out-of-bound\naccess beyond the actual length, or confuse the underlayer with incorrect\nor inconsistent header length in the skb metadata.\r\n\r\nIn the alternative path, tap_get_user() already prohibits short frame which\nhas the length less than Ethernet header size from being transmitted.\r\n\r\nThis is to drop any frame shorter than the Ethernet header size just like\nhow tap_get_user() does.\r\n\r\nCVE: CVE-2024-41090(CVE-2024-41090)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntun: add missing verification for short frame\r\n\r\nThe cited commit missed to check against the validity of the frame length\nin the tun_xdp_one() path, which could cause a corrupted skb to be sent\ndownstack. Even before the skb is transmitted, the\ntun_xdp_one--\u0026gt;eth_type_trans() may access the Ethernet header although it\ncan be less than ETH_HLEN. Once transmitted, this could either cause\nout-of-bound access beyond the actual length, or confuse the underlayer\nwith incorrect or inconsistent header length in the skb metadata.\r\n\r\nIn the alternative path, tun_get_user() already prohibits short frame which\nhas the length less than Ethernet header size from being transmitted for\nIFF_TAP.\r\n\r\nThis is to drop any frame shorter than the Ethernet header size just like\nhow tun_get_user() does.\r\n\r\nCVE: CVE-2024-41091(CVE-2024-41091)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro()\r\n\r\nset_memory_rox() can fail, leaving memory unprotected.\r\n\r\nCheck return and bail out when bpf_jit_binary_lock_ro() returns\nan error.(CVE-2024-42067)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\niio: chemical: bme680: Fix overflows in compensate() functions\r\n\r\nThere are cases in the compensate functions of the driver that\nthere could be overflows of variables due to bit shifting ops.\nThese implications were initially discussed here [1] and they\nwere mentioned in log message of Commit 1b3bd8592780 (\u0026quot;iio:\nchemical: Add support for Bosch BME680 sensor\u0026quot;).\r\n\r\n[1]: https://lore.kernel.org/linux-iio/20180728114028.3c1bbe81@archlinux/(CVE-2024-42086)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nALSA: emux: improve patch ioctl data validation\r\n\r\nIn load_data(), make the validation of and skipping over the main info\nblock match that in load_guspatch().\r\n\r\nIn load_guspatch(), add checking that the specified patch length matches\nthe actually supplied data, like load_data() already did.(CVE-2024-42097)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\njffs2: Fix potential illegal address access in jffs2_free_inode\r\n\r\nDuring the stress testing of the jffs2 file system,the following\nabnormal printouts were found:\n[ 2430.649000] Unable to handle kernel paging request at virtual address 0069696969696948\n[ 2430.649622] Mem abort info:\n[ 2430.649829]   ESR = 0x96000004\n[ 2430.650115]   EC = 0x25: DABT (current EL), IL = 32 bits\n[ 2430.650564]   SET = 0, FnV = 0\n[ 2430.650795]   EA = 0, S1PTW = 0\n[ 2430.651032]   FSC = 0x04: level 0 translation fault\n[ 2430.651446] Data abort info:\n[ 2430.651683]   ISV = 0, ISS = 0x00000004\n[ 2430.652001]   CM = 0, WnR = 0\n[ 2430.652558] [0069696969696948] address between user and kernel address ranges\n[ 2430.653265] Internal error: Oops: 96000004 [#1] PREEMPT SMP\n[ 2430.654512] CPU: 2 PID: 20919 Comm: cat Not tainted 5.15.25-g512f31242bf6 #33\n[ 2430.655008] Hardware name: linux,dummy-virt (DT)\n[ 2430.655517] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[ 2430.656142] pc : kfree+0x78/0x348\n[ 2430.656630] lr : jffs2_free_inode+0x24/0x48\n[ 2430.657051] sp : ffff800009eebd10\n[ 2430.657355] x29: ffff800009eebd10 x28: 0000000000000001 x27: 0000000000000000\n[ 2430.658327] x26: ffff000038f09d80 x25: 0080000000000000 x24: ffff800009d38000\n[ 2430.658919] x23: 5a5a5a5a5a5a5a5a x22: ffff000038f09d80 x21: ffff8000084f0d14\n[ 2430.659434] x20: ffff0000bf9a6ac0 x19: 0169696969696940 x18: 0000000000000000\n[ 2430.659969] x17: ffff8000b6506000 x16: ffff800009eec000 x15: 0000000000004000\n[ 2430.660637] x14: 0000000000000000 x13: 00000001000820a1 x12: 00000000000d1b19\n[ 2430.661345] x11: 0004000800000000 x10: 0000000000000001 x9 : ffff8000084f0d14\n[ 2430.662025] x8 : ffff0000bf9a6b40 x7 : ffff0000bf9a6b48 x6 : 0000000003470302\n[ 2430.662695] x5 : ffff00002e41dcc0 x4 : ffff0000bf9aa3b0 x3 : 0000000003470342\n[ 2430.663486] x2 : 0000000000000000 x1 : ffff8000084f0d14 x0 : fffffc0000000000\n[ 2430.664217] Call trace:\n[ 2430.664528]  kfree+0x78/0x348\n[ 2430.664855]  jffs2_free_inode+0x24/0x48\n[ 2430.665233]  i_callback+0x24/0x50\n[ 2430.665528]  rcu_do_batch+0x1ac/0x448\n[ 2430.665892]  rcu_core+0x28c/0x3c8\n[ 2430.666151]  rcu_core_si+0x18/0x28\n[ 2430.666473]  __do_softirq+0x138/0x3cc\n[ 2430.666781]  irq_exit+0xf0/0x110\n[ 2430.667065]  handle_domain_irq+0x6c/0x98\n[ 2430.667447]  gic_handle_irq+0xac/0xe8\n[ 2430.667739]  call_on_irq_stack+0x28/0x54\nThe parameter passed to kfree was 5a5a5a5a, which corresponds to the target field of\nthe jffs_inode_info structure. It was found that all variables in the jffs_inode_info\nstructure were 5a5a5a5a, except for the first member sem. It is suspected that these\nvariables are not initialized because they were set to 5a5a5a5a during memory testing,\nwhich is meant to detect uninitialized memory.The sem variable is initialized in the\nfunction jffs2_i_init_once, while other members are initialized in\nthe function jffs2_init_inode_info.\r\n\r\nThe function jffs2_init_inode_info is called after iget_locked,\nbut in the iget_locked function, the destroy_inode process is triggered,\nwhich releases the inode and consequently, the target member of the inode\nis not initialized.In concurrent high pressure scenarios, iget_locked\nmay enter the destroy_inode branch as described in the code.\r\n\r\nSince the destroy_inode functionality of jffs2 only releases the target,\nthe fix method is to set target to NULL in jffs2_i_init_once.(CVE-2024-42115)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nleds: mlxreg: Use devm_mutex_init() for mutex initialization\r\n\r\nIn this driver LEDs are registered using devm_led_classdev_register()\nso they are automatically unregistered after module\u0026apos;s remove() is done.\nled_classdev_unregister() calls module\u0026apos;s led_set_brightness() to turn off\nthe LEDs and that callback uses mutex which was destroyed already\nin module\u0026apos;s remove() so use devm API instead.(CVE-2024-42129)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc\r\n\r\nInitialize the size before calling amdgpu_vce_cs_reloc, such as case 0x03000001.\nV2: To really improve the handling we would actually\n   need to have a separate value of 0xffffffff.(Christian)(CVE-2024-42228)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: nexthop: Initialize all fields in dumped nexthops\r\n\r\nstruct nexthop_grp contains two reserved fields that are not initialized by\nnla_put_nh_group(), and carry garbage. This can be observed e.g. with\nstrace (edited for clarity):\r\n\r\n    # ip nexthop add id 1 dev lo\n    # ip nexthop add id 101 group 1\n    # strace -e recvmsg ip nexthop get id 101\n    ...\n    recvmsg(... [{nla_len=12, nla_type=NHA_GROUP},\n                 [{id=1, weight=0, resvd1=0x69, resvd2=0x67}]] ...) = 52\r\n\r\nThe fields are reserved and therefore not currently used. But as they are, they\nleak kernel memory, and the fact they are not just zero complicates repurposing\nof the fields for new ends. Initialize the full structure.(CVE-2024-42283)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nirqchip/imx-irqsteer: Handle runtime power management correctly\r\n\r\nThe power domain is automatically activated from clk_prepare(). However, on\ncertain platforms like i.MX8QM and i.MX8QXP, the power-on handling invokes\nsleeping functions, which triggers the \u0026apos;scheduling while atomic\u0026apos; bug in the\ncontext switch path during device probing:\r\n\r\n BUG: scheduling while atomic: kworker/u13:1/48/0x00000002\n Call trace:\n  __schedule_bug+0x54/0x6c\n  __schedule+0x7f0/0xa94\n  schedule+0x5c/0xc4\n  schedule_preempt_disabled+0x24/0x40\n  __mutex_lock.constprop.0+0x2c0/0x540\n  __mutex_lock_slowpath+0x14/0x20\n  mutex_lock+0x48/0x54\n  clk_prepare_lock+0x44/0xa0\n  clk_prepare+0x20/0x44\n  imx_irqsteer_resume+0x28/0xe0\n  pm_generic_runtime_resume+0x2c/0x44\n  __genpd_runtime_resume+0x30/0x80\n  genpd_runtime_resume+0xc8/0x2c0\n  __rpm_callback+0x48/0x1d8\n  rpm_callback+0x6c/0x78\n  rpm_resume+0x490/0x6b4\n  __pm_runtime_resume+0x50/0x94\n  irq_chip_pm_get+0x2c/0xa0\n  __irq_do_set_handler+0x178/0x24c\n  irq_set_chained_handler_and_data+0x60/0xa4\n  mxc_gpio_probe+0x160/0x4b0\r\n\r\nCure this by implementing the irq_bus_lock/sync_unlock() interrupt chip\ncallbacks and handle power management in them as they are invoked from\nnon-atomic context.\r\n\r\n[ tglx: Rewrote change log, added Fixes tag ](CVE-2024-42290)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nudf: Avoid using corrupted block bitmap buffer\r\n\r\nWhen the filesystem block bitmap is corrupted, we detect the corruption\nwhile loading the bitmap and fail the allocation with error. However the\nnext allocation from the same bitmap will notice the bitmap buffer is\nalready loaded and tries to allocate from the bitmap with mixed results\n(depending on the exact nature of the bitmap corruption). Fix the\nproblem by using BH_verified bit to indicate whether the bitmap is valid\nor not.(CVE-2024-42306)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes\r\n\r\nIn psb_intel_lvds_get_modes(), the return value of drm_mode_duplicate() is\nassigned to mode, which will lead to a possible NULL pointer dereference\non failure of drm_mode_duplicate(). Add a check to avoid npd.(CVE-2024-42309)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmedia: venus: fix use after free in vdec_close\r\n\r\nThere appears to be a possible use after free with vdec_close().\nThe firmware will add buffer release work to the work queue through\nHFI callbacks as a normal part of decoding. Randomly closing the\ndecoder device from userspace during normal decoding can incur\na read after free for inst.\r\n\r\nFix it by cancelling the work in vdec_close.(CVE-2024-42313)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nipvs: properly dereference pe in ip_vs_add_service\r\n\r\nUse pe directly to resolve sparse warning:\r\n\r\n  net/netfilter/ipvs/ip_vs_ctl.c:1471:27: warning: dereference of noderef expression(CVE-2024-42322)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nPCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs()\r\n\r\nIf IORESOURCE_MEM is not provided in Device Tree due to\nany error, resource_list_first_type() will return NULL and\npci_parse_request_of_pci_ranges() will just emit a warning.\r\n\r\nThis will cause a NULL pointer dereference. Fix this bug by adding NULL\nreturn check.\r\n\r\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2024-43823)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nleds: trigger: Unregister sysfs attributes before calling deactivate()\r\n\r\nTriggers which have trigger specific sysfs attributes typically store\nrelated data in trigger-data allocated by the activate() callback and\nfreed by the deactivate() callback.\r\n\r\nCalling device_remove_groups() after calling deactivate() leaves a window\nwhere the sysfs attributes show/store functions could be called after\ndeactivation and then operate on the just freed trigger-data.\r\n\r\nMove the device_remove_groups() call to before deactivate() to close\nthis race window.\r\n\r\nThis also makes the deactivation path properly do things in reverse order\nof the activation path which calls the activate() callback before calling\ndevice_add_groups().(CVE-2024-43830)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG\r\n\r\nWhen BPF_TRAMP_F_CALL_ORIG is set, the trampoline calls\n__bpf_tramp_enter() and __bpf_tramp_exit() functions, passing them\nthe struct bpf_tramp_image *im pointer as an argument in R0.\r\n\r\nThe trampoline generation code uses emit_addr_mov_i64() to emit\ninstructions for moving the bpf_tramp_image address into R0, but\nemit_addr_mov_i64() assumes the address to be in the vmalloc() space\nand uses only 48 bits. Because bpf_tramp_image is allocated using\nkzalloc(), its address can use more than 48-bits, in this case the\ntrampoline will pass an invalid address to __bpf_tramp_enter/exit()\ncausing a kernel crash.\r\n\r\nFix this by using emit_a64_mov_i64() in place of emit_addr_mov_i64()\nas it can work with addresses that are greater than 48-bits.(CVE-2024-43840)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmd: fix deadlock between mddev_suspend and flush bio\r\n\r\nDeadlock occurs when mddev is being suspended while some flush bio is in\nprogress. It is a complex issue.\r\n\r\nT1. the first flush is at the ending stage, it clears \u0026apos;mddev-\u0026gt;flush_bio\u0026apos;\n    and tries to submit data, but is blocked because mddev is suspended\n    by T4.\nT2. the second flush sets \u0026apos;mddev-\u0026gt;flush_bio\u0026apos;, and attempts to queue\n    md_submit_flush_data(), which is already running (T1) and won\u0026apos;t\n    execute again if on the same CPU as T1.\nT3. the third flush inc active_io and tries to flush, but is blocked because\n    \u0026apos;mddev-\u0026gt;flush_bio\u0026apos; is not NULL (set by T2).\nT4. mddev_suspend() is called and waits for active_io dec to 0 which is inc\n    by T3.\r\n\r\n  T1\t\tT2\t\tT3\t\tT4\n  (flush 1)\t(flush 2)\t(third 3)\t(suspend)\n  md_submit_flush_data\n   mddev-\u0026gt;flush_bio = NULL;\n   .\n   .\t \tmd_flush_request\n   .\t  \t mddev-\u0026gt;flush_bio = bio\n   .\t  \t queue submit_flushes\n   .\t\t .\n   .\t\t .\t\tmd_handle_request\n   .\t\t .\t\t active_io + 1\n   .\t\t .\t\t md_flush_request\n   .\t\t .\t\t  wait !mddev-\u0026gt;flush_bio\n   .\t\t .\n   .\t\t .\t\t\t\tmddev_suspend\n   .\t\t .\t\t\t\t wait !active_io\n   .\t\t .\n   .\t\t submit_flushes\n   .\t\t queue_work md_submit_flush_data\n   .\t\t //md_submit_flush_data is already running (T1)\n   .\n   md_handle_request\n    wait resume\r\n\r\nThe root issue is non-atomic inc/dec of active_io during flush process.\nactive_io is dec before md_submit_flush_data is queued, and inc soon\nafter md_submit_flush_data() run.\n  md_flush_request\n    active_io + 1\n    submit_flushes\n      active_io - 1\n      md_submit_flush_data\n        md_handle_request\n        active_io + 1\n          make_request\n        active_io - 1\r\n\r\nIf active_io is dec after md_handle_request() instead of within\nsubmit_flushes(), make_request() can be called directly intead of\nmd_handle_request() in md_submit_flush_data(), and active_io will\nonly inc and dec once in the whole flush process. Deadlock will be\nfixed.\r\n\r\nAdditionally, the only difference between fixing the issue and before is\nthat there is no return error handling of make_request(). But after\nprevious patch cleaned md_write_start(), make_requst() only return error\nin raid5_make_request() by dm-raid, see commit 41425f96d7aa (\u0026quot;dm-raid456,\nmd/raid456: fix a deadlock for dm-raid456 while io concurrent with\nreshape)\u0026quot;. Since dm always splits data and flush operation into two\nseparate io, io size of flush submitted by dm always is 0, make_request()\nwill not be called in md_submit_flush_data(). To prevent future\nmodifications from introducing issues, add WARN_ON to ensure\nmake_request() no error is returned in this context.(CVE-2024-43855)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nRDMA/hns: Fix soft lockup under heavy CEQE load\r\n\r\nCEQEs are handled in interrupt handler currently. This may cause the\nCPU core staying in interrupt context too long and lead to soft lockup\nunder heavy load.\r\n\r\nHandle CEQEs in BH workqueue and set an upper limit for the number of\nCEQE handled by a single call of work handler.(CVE-2024-43872)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmemcg: protect concurrent access to mem_cgroup_idr\r\n\r\nCommit 73f576c04b94 (\u0026quot;mm: memcontrol: fix cgroup creation failure after\nmany small jobs\u0026quot;) decoupled the memcg IDs from the CSS ID space to fix the\ncgroup creation failures.  It introduced IDR to maintain the memcg ID\nspace.  The IDR depends on external synchronization mechanisms for\nmodifications.  For the mem_cgroup_idr, the idr_alloc() and idr_replace()\nhappen within css callback and thus are protected through cgroup_mutex\nfrom concurrent modifications.  However idr_remove() for mem_cgroup_idr\nwas not protected against concurrency and can be run concurrently for\ndifferent memcgs when they hit their refcnt to zero.  Fix that.\r\n\r\nWe have been seeing list_lru based kernel crashes at a low frequency in\nour fleet for a long time.  These crashes were in different part of\nlist_lru code including list_lru_add(), list_lru_del() and reparenting\ncode.  Upon further inspection, it looked like for a given object (dentry\nand inode), the super_block\u0026apos;s list_lru didn\u0026apos;t have list_lru_one for the\nmemcg of that object.  The initial suspicions were either the object is\nnot allocated through kmem_cache_alloc_lru() or somehow\nmemcg_list_lru_alloc() failed to allocate list_lru_one() for a memcg but\nreturned success.  No evidence were found for these cases.\r\n\r\nLooking more deeply, we started seeing situations where valid memcg\u0026apos;s id\nis not present in mem_cgroup_idr and in some cases multiple valid memcgs\nhave same id and mem_cgroup_idr is pointing to one of them.  So, the most\nreasonable explanation is that these situations can happen due to race\nbetween multiple idr_remove() calls or race between\nidr_alloc()/idr_replace() and idr_remove().  These races are causing\nmultiple memcgs to acquire the same ID and then offlining of one of them\nwould cleanup list_lrus on the system for all of them.  Later access from\nother memcgs to the list_lru cause crashes due to missing list_lru_one.(CVE-2024-43892)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nserial: core: check uartclk for zero to avoid divide by zero\r\n\r\nCalling ioctl TIOCSSERIAL with an invalid baud_base can\nresult in uartclk being zero, which will result in a\ndivide by zero error in uart_get_divisor(). The check for\nuartclk being zero in uart_set_info() needs to be done\nbefore other settings are made as subsequent calls to\nioctl TIOCSSERIAL for the same port would be impacted if\nthe uartclk check was done where uartclk gets set.\r\n\r\nOops: divide error: 0000  PREEMPT SMP KASAN PTI\nRIP: 0010:uart_get_divisor (drivers/tty/serial/serial_core.c:580)\nCall Trace:\n \u0026lt;TASK\u0026gt;\nserial8250_get_divisor (drivers/tty/serial/8250/8250_port.c:2576\n    drivers/tty/serial/8250/8250_port.c:2589)\nserial8250_do_set_termios (drivers/tty/serial/8250/8250_port.c:502\n    drivers/tty/serial/8250/8250_port.c:2741)\nserial8250_set_termios (drivers/tty/serial/8250/8250_port.c:2862)\nuart_change_line_settings (./include/linux/spinlock.h:376\n    ./include/linux/serial_core.h:608 drivers/tty/serial/serial_core.c:222)\nuart_port_startup (drivers/tty/serial/serial_core.c:342)\nuart_startup (drivers/tty/serial/serial_core.c:368)\nuart_set_info (drivers/tty/serial/serial_core.c:1034)\nuart_set_info_user (drivers/tty/serial/serial_core.c:1059)\ntty_set_serial (drivers/tty/tty_io.c:2637)\ntty_ioctl (drivers/tty/tty_io.c:2647 drivers/tty/tty_io.c:2791)\n__x64_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:907\n    fs/ioctl.c:893 fs/ioctl.c:893)\ndo_syscall_64 (arch/x86/entry/common.c:52\n    (discriminator 1) arch/x86/entry/common.c:83 (discriminator 1))\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\r\n\r\nRule: add(CVE-2024-43893)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nfou: remove warn in gue_gro_receive on unsupported protocol\r\n\r\nDrop the WARN_ON_ONCE inn gue_gro_receive if the encapsulated type is\nnot known or does not have a GRO handler.\r\n\r\nSuch a packet is easily constructed. Syzbot generates them and sets\noff this warning.\r\n\r\nRemove the warning as it is expected and not actionable.\r\n\r\nThe warning was previously reduced from WARN_ON to WARN_ON_ONCE in\ncommit 270136613bf7 (\u0026quot;fou: Do WARN_ON_ONCE in gue_gro_receive for bad\nproto callbacks\u0026quot;).(CVE-2024-44940)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nALSA: line6: Fix racy access to midibuf\r\n\r\nThere can be concurrent accesses to line6 midibuf from both the URB\ncompletion callback and the rawmidi API access.  This could be a cause\nof KMSAN warning triggered by syzkaller below (so put as reported-by\nhere).\r\n\r\nThis patch protects the midibuf call of the former code path with a\nspinlock for avoiding the possible races.(CVE-2024-44954)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\natm: idt77252: prevent use after free in dequeue_rx()\r\n\r\nWe can\u0026apos;t dereference \u0026quot;skb\u0026quot; after calling vcc-\u0026gt;push() because the skb\nis released.(CVE-2024-44998)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nxhci: Fix Panther point NULL pointer deref at full-speed re-enumeration\r\n\r\nre-enumerating full-speed devices after a failed address device command\ncan trigger a NULL pointer dereference.\r\n\r\nFull-speed devices may need to reconfigure the endpoint 0 Max Packet Size\nvalue during enumeration. Usb core calls usb_ep0_reinit() in this case,\nwhich ends up calling xhci_configure_endpoint().\r\n\r\nOn Panther point xHC the xhci_configure_endpoint() function will\nadditionally check and reserve bandwidth in software. Other hosts do\nthis in hardware\r\n\r\nIf xHC address device command fails then a new xhci_virt_device structure\nis allocated as part of re-enabling the slot, but the bandwidth table\npointers are not set up properly here.\nThis triggers the NULL pointer dereference the next time usb_ep0_reinit()\nis called and xhci_configure_endpoint() tries to check and reserve\nbandwidth\r\n\r\n[46710.713538] usb 3-1: new full-speed USB device number 5 using xhci_hcd\n[46710.713699] usb 3-1: Device not responding to setup address.\n[46710.917684] usb 3-1: Device not responding to setup address.\n[46711.125536] usb 3-1: device not accepting address 5, error -71\n[46711.125594] BUG: kernel NULL pointer dereference, address: 0000000000000008\n[46711.125600] #PF: supervisor read access in kernel mode\n[46711.125603] #PF: error_code(0x0000) - not-present page\n[46711.125606] PGD 0 P4D 0\n[46711.125610] Oops: Oops: 0000 [#1] PREEMPT SMP PTI\n[46711.125615] CPU: 1 PID: 25760 Comm: kworker/1:2 Not tainted 6.10.3_2 #1\n[46711.125620] Hardware name: Gigabyte Technology Co., Ltd.\n[46711.125623] Workqueue: usb_hub_wq hub_event [usbcore]\n[46711.125668] RIP: 0010:xhci_reserve_bandwidth (drivers/usb/host/xhci.c\r\n\r\nFix this by making sure bandwidth table pointers are set up correctly\nafter a failed address device command, and additionally by avoiding\nchecking for bandwidth in cases like this where no actual endpoints are\nadded or removed, i.e. only context for default control endpoint 0 is\nevaluated.(CVE-2024-45006)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ns390/dasd: fix error recovery leading to data corruption on ESE devices\r\n\r\nExtent Space Efficient (ESE) or thin provisioned volumes need to be\nformatted on demand during usual IO processing.\r\n\r\nThe dasd_ese_needs_format function checks for error codes that signal\nthe non existence of a proper track format.\r\n\r\nThe check for incorrect length is to imprecise since other error cases\nleading to transport of insufficient data also have this flag set.\nThis might lead to data corruption in certain error cases for example\nduring a storage server warmstart.\r\n\r\nFix by removing the check for incorrect length and replacing by\nexplicitly checking for invalid track format in transport mode.\r\n\r\nAlso remove the check for file protected since this is not a valid\nESE handling case.(CVE-2024-45026)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnfc: pn533: Add poll mod list filling check\r\n\r\nIn case of im_protocols value is 1 and tm_protocols value is 0 this\ncombination successfully passes the check\n\u0026apos;if (!im_protocols \u0026amp;\u0026amp; !tm_protocols)\u0026apos; in the nfc_start_poll().\nBut then after pn533_poll_create_mod_list() call in pn533_start_poll()\npoll mod list will remain empty and dev-\u0026gt;poll_mod_count will remain 0\nwhich lead to division by zero.\r\n\r\nNormally no im protocol has value 1 in the mask, so this combination is\nnot expected by driver. But these protocol values actually come from\nuserspace via Netlink interface (NFC_CMD_START_POLL operation). So a\nbroken or malicious program may pass a message containing a \u0026quot;bad\u0026quot;\ncombination of protocol parameter values so that dev-\u0026gt;poll_mod_count\nis not incremented inside pn533_poll_create_mod_list(), thus leading\nto division by zero.\nCall trace looks like:\nnfc_genl_start_poll()\n  nfc_start_poll()\n    -\u0026gt;start_poll()\n    pn533_start_poll()\r\n\r\nAdd poll mod list filling check.\r\n\r\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2024-46676)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nusb: typec: ucsi: Fix null pointer dereference in trace\r\n\r\nucsi_register_altmode checks IS_ERR for the alt pointer and treats\nNULL as valid. When CONFIG_TYPEC_DP_ALTMODE is not enabled,\nucsi_register_displayport returns NULL which causes a NULL pointer\ndereference in trace. Rather than return NULL, call\ntypec_port_register_altmode to register DisplayPort alternate mode\nas a non-controllable mode when CONFIG_TYPEC_DP_ALTMODE is not enabled.(CVE-2024-46719)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbpf: Remove tst_run from lwt_seg6local_prog_ops.\r\n\r\nThe syzbot reported that the lwt_seg6 related BPF ops can be invoked\nvia bpf_test_run() without without entering input_action_end_bpf()\nfirst.\r\n\r\nMartin KaFai Lau said that self test for BPF_PROG_TYPE_LWT_SEG6LOCAL\nprobably didn\u0026apos;t work since it was introduced in commit 04d4b274e2a\n(\u0026quot;ipv6: sr: Add seg6local action End.BPF\u0026quot;). The reason is that the\nper-CPU variable seg6_bpf_srh_states::srh is never assigned in the self\ntest case but each BPF function expects it.\r\n\r\nRemove test_run for BPF_PROG_TYPE_LWT_SEG6LOCAL.(CVE-2024-46754)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nice: Add netif_device_attach/detach into PF reset flow\r\n\r\nEthtool callbacks can be executed while reset is in progress and try to\naccess deleted resources, e.g. getting coalesce settings can result in a\nNULL pointer dereference seen below.\r\n\r\nReproduction steps:\nOnce the driver is fully initialized, trigger reset:\n\t# echo 1 \u0026gt; /sys/class/net/\u0026lt;interface\u0026gt;/device/reset\nwhen reset is in progress try to get coalesce settings using ethtool:\n\t# ethtool -c \u0026lt;interface\u0026gt;\r\n\r\nBUG: kernel NULL pointer dereference, address: 0000000000000020\nPGD 0 P4D 0\nOops: Oops: 0000 [#1] PREEMPT SMP PTI\nCPU: 11 PID: 19713 Comm: ethtool Tainted: G S                 6.10.0-rc7+ #7\nRIP: 0010:ice_get_q_coalesce+0x2e/0xa0 [ice]\nRSP: 0018:ffffbab1e9bcf6a8 EFLAGS: 00010206\nRAX: 000000000000000c RBX: ffff94512305b028 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: ffff9451c3f2e588 RDI: ffff9451c3f2e588\nRBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\nR10: ffff9451c3f2e580 R11: 000000000000001f R12: ffff945121fa9000\nR13: ffffbab1e9bcf760 R14: 0000000000000013 R15: ffffffff9e65dd40\nFS:  00007faee5fbe740(0000) GS:ffff94546fd80000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000020 CR3: 0000000106c2e005 CR4: 00000000001706f0\nCall Trace:\n\u0026lt;TASK\u0026gt;\nice_get_coalesce+0x17/0x30 [ice]\ncoalesce_prepare_data+0x61/0x80\nethnl_default_doit+0xde/0x340\ngenl_family_rcv_msg_doit+0xf2/0x150\ngenl_rcv_msg+0x1b3/0x2c0\nnetlink_rcv_skb+0x5b/0x110\ngenl_rcv+0x28/0x40\nnetlink_unicast+0x19c/0x290\nnetlink_sendmsg+0x222/0x490\n__sys_sendto+0x1df/0x1f0\n__x64_sys_sendto+0x24/0x30\ndo_syscall_64+0x82/0x160\nentry_SYSCALL_64_after_hwframe+0x76/0x7e\nRIP: 0033:0x7faee60d8e27\r\n\r\nCalling netif_device_detach() before reset makes the net core not call\nthe driver when ethtool command is issued, the attempt to execute an\nethtool command during reset will result in the following message:\r\n\r\n    netlink error: No such device\r\n\r\ninstead of NULL pointer dereference. Once reset is done and\nice_rebuild() is executing, the netif_device_attach() is called to allow\nfor ethtool operations to occur again in a safe manner.(CVE-2024-46770)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nksmbd: unset the binding mark of a reused connection\r\n\r\nSteve French reported null pointer dereference error from sha256 lib.\ncifs.ko can send session setup requests on reused connection.\nIf reused connection is used for binding session, conn-\u0026gt;binding can\nstill remain true and generate_preauth_hash() will not set\nsess-\u0026gt;Preauth_HashValue and it will be NULL.\nIt is used as a material to create an encryption key in\nksmbd_gen_smb311_encryptionkey. -\u0026gt;Preauth_HashValue cause null pointer\ndereference error from crypto_shash_update().\r\n\r\nBUG: kernel NULL pointer dereference, address: 0000000000000000\n#PF: supervisor read access in kernel mode\n#PF: error_code(0x0000) - not-present page\nPGD 0 P4D 0\nOops: 0000 [#1] PREEMPT SMP PTI\nCPU: 8 PID: 429254 Comm: kworker/8:39\nHardware name: LENOVO 20MAS08500/20MAS08500, BIOS N2CET69W (1.52 )\nWorkqueue: ksmbd-io handle_ksmbd_work [ksmbd]\nRIP: 0010:lib_sha256_base_do_update.isra.0+0x11e/0x1d0 [sha256_ssse3]\n\u0026lt;TASK\u0026gt;\n? show_regs+0x6d/0x80\n? __die+0x24/0x80\n? page_fault_oops+0x99/0x1b0\n? do_user_addr_fault+0x2ee/0x6b0\n? exc_page_fault+0x83/0x1b0\n? asm_exc_page_fault+0x27/0x30\n? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3]\n? lib_sha256_base_do_update.isra.0+0x11e/0x1d0 [sha256_ssse3]\n? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3]\n? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3]\n_sha256_update+0x77/0xa0 [sha256_ssse3]\nsha256_avx2_update+0x15/0x30 [sha256_ssse3]\ncrypto_shash_update+0x1e/0x40\nhmac_update+0x12/0x20\ncrypto_shash_update+0x1e/0x40\ngenerate_key+0x234/0x380 [ksmbd]\ngenerate_smb3encryptionkey+0x40/0x1c0 [ksmbd]\nksmbd_gen_smb311_encryptionkey+0x72/0xa0 [ksmbd]\nntlm_authenticate.isra.0+0x423/0x5d0 [ksmbd]\nsmb2_sess_setup+0x952/0xaa0 [ksmbd]\n__process_request+0xa3/0x1d0 [ksmbd]\n__handle_ksmbd_work+0x1c4/0x2f0 [ksmbd]\nhandle_ksmbd_work+0x2d/0xa0 [ksmbd]\nprocess_one_work+0x16c/0x350\nworker_thread+0x306/0x440\n? __pfx_worker_thread+0x10/0x10\nkthread+0xef/0x120\n? __pfx_kthread+0x10/0x10\nret_from_fork+0x44/0x70\n? __pfx_kthread+0x10/0x10\nret_from_fork_asm+0x1b/0x30\n\u0026lt;/TASK\u0026gt;(CVE-2024-46795)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/amdgpu: the warning dereferencing obj for nbio_v7_4\r\n\r\nif ras_manager obj null, don\u0026apos;t print NBIO err data(CVE-2024-46819)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nELF: fix kernel.randomize_va_space double read\r\n\r\nELF loader uses \u0026quot;randomize_va_space\u0026quot; twice. It is sysctl and can change\nat any moment, so 2 loads could see 2 different values in theory with\nunpredictable consequences.\r\n\r\nIssue exactly one load for consistent value across one exec.(CVE-2024-46826)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nsched: sch_cake: fix bulk flow accounting logic for host fairness\r\n\r\nIn sch_cake, we keep track of the count of active bulk flows per host,\nwhen running in dst/src host fairness mode, which is used as the\nround-robin weight when iterating through flows. The count of active\nbulk flows is updated whenever a flow changes state.\r\n\r\nThis has a peculiar interaction with the hash collision handling: when a\nhash collision occurs (after the set-associative hashing), the state of\nthe hash bucket is simply updated to match the new packet that collided,\nand if host fairness is enabled, that also means assigning new per-host\nstate to the flow. For this reason, the bulk flow counters of the\nhost(s) assigned to the flow are decremented, before new state is\nassigned (and the counters, which may not belong to the same host\nanymore, are incremented again).\r\n\r\nBack when this code was introduced, the host fairness mode was always\nenabled, so the decrement was unconditional. When the configuration\nflags were introduced the *increment* was made conditional, but\nthe *decrement* was not. Which of course can lead to a spurious\ndecrement (and associated wrap-around to U16_MAX).\r\n\r\nAFAICT, when host fairness is disabled, the decrement and wrap-around\nhappens as soon as a hash collision occurs (which is not that common in\nitself, due to the set-associative hashing). However, in most cases this\nis harmless, as the value is only used when host fairness mode is\nenabled. So in order to trigger an array overflow, sch_cake has to first\nbe configured with host fairness disabled, and while running in this\nmode, a hash collision has to occur to cause the overflow. Then, the\nqdisc has to be reconfigured to enable host fairness, which leads to the\narray out-of-bounds because the wrapped-around value is retained and\nused as an array index. It seems that syzbot managed to trigger this,\nwhich is quite impressive in its own right.\r\n\r\nThis patch fixes the issue by introducing the same conditional check on\ndecrement as is used on increment.\r\n\r\nThe original bug predates the upstreaming of cake, but the commit listed\nin the Fixes tag touched that code, meaning that this patch won\u0026apos;t apply\nbefore that.(CVE-2024-46828)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbtrfs: clean up our handling of refs == 0 in snapshot delete\r\n\r\nIn reada we BUG_ON(refs == 0), which could be unkind since we aren\u0026apos;t\nholding a lock on the extent leaf and thus could get a transient\nincorrect answer.  In walk_down_proc we also BUG_ON(refs == 0), which\ncould happen if we have extent tree corruption.  Change that to return\n-EUCLEAN.  In do_walk_down() we catch this case and handle it correctly,\nhowever we return -EIO, which -EUCLEAN is a more appropriate error code.\nFinally in walk_up_proc we have the same BUG_ON(refs == 0), so convert\nthat to proper error handling.  Also adjust the error message so we can\nactually do something with the information.(CVE-2024-46840)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nperf/x86/intel: Limit the period on Haswell\r\n\r\nRunning the ltp test cve-2015-3290 concurrently reports the following\nwarnings.\r\n\r\nperfevents: irq loop stuck!\n  WARNING: CPU: 31 PID: 32438 at arch/x86/events/intel/core.c:3174\n  intel_pmu_handle_irq+0x285/0x370\n  Call Trace:\n   \u0026lt;NMI\u0026gt;\n   ? __warn+0xa4/0x220\n   ? intel_pmu_handle_irq+0x285/0x370\n   ? __report_bug+0x123/0x130\n   ? intel_pmu_handle_irq+0x285/0x370\n   ? __report_bug+0x123/0x130\n   ? intel_pmu_handle_irq+0x285/0x370\n   ? report_bug+0x3e/0xa0\n   ? handle_bug+0x3c/0x70\n   ? exc_invalid_op+0x18/0x50\n   ? asm_exc_invalid_op+0x1a/0x20\n   ? irq_work_claim+0x1e/0x40\n   ? intel_pmu_handle_irq+0x285/0x370\n   perf_event_nmi_handler+0x3d/0x60\n   nmi_handle+0x104/0x330\r\n\r\nThanks to Thomas Gleixner\u0026apos;s analysis, the issue is caused by the low\ninitial period (1) of the frequency estimation algorithm, which triggers\nthe defects of the HW, specifically erratum HSW11 and HSW143. (For the\ndetails, please refer https://lore.kernel.org/lkml/87plq9l5d2.ffs@tglx/)\r\n\r\nThe HSW11 requires a period larger than 100 for the INST_RETIRED.ALL\nevent, but the initial period in the freq mode is 1. The erratum is the\nsame as the BDM11, which has been supported in the kernel. A minimum\nperiod of 128 is enforced as well on HSW.\r\n\r\nHSW143 is regarding that the fixed counter 1 may overcount 32 with the\nHyper-Threading is enabled. However, based on the test, the hardware\nhas more issues than it tells. Besides the fixed counter 1, the message\n\u0026apos;interrupt took too long\u0026apos; can be observed on any counter which was armed\nwith a period \u0026lt; 32 and two events expired in the same NMI. A minimum\nperiod of 32 is enforced for the rest of the events.\nThe recommended workaround code of the HSW143 is not implemented.\nBecause it only addresses the issue for the fixed counter. It brings\nextra overhead through extra MSR writing. No related overcounting issue\nhas been reported so far.(CVE-2024-46848)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: dpaa: Pad packets to ETH_ZLEN\r\n\r\nWhen sending packets under 60 bytes, up to three bytes of the buffer\nfollowing the data may be leaked. Avoid this by extending all packets to\nETH_ZLEN, ensuring nothing is leaked in the padding. This bug can be\nreproduced by running\r\n\r\n\t$ ping -s 11 destination(CVE-2024-46854)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nft_socket: fix sk refcount leaks\r\n\r\nWe must put \u0026apos;sk\u0026apos; reference before returning.(CVE-2024-46855)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmptcp: pm: Fix uaf in __timer_delete_sync\r\n\r\nThere are two paths to access mptcp_pm_del_add_timer, result in a race\ncondition:\r\n\r\n     CPU1\t\t\t\tCPU2\n     ====                               ====\n     net_rx_action\n     napi_poll                          netlink_sendmsg\n     __napi_poll                        netlink_unicast\n     process_backlog                    netlink_unicast_kernel\n     __netif_receive_skb                genl_rcv\n     __netif_receive_skb_one_core       netlink_rcv_skb\n     NF_HOOK                            genl_rcv_msg\n     ip_local_deliver_finish            genl_family_rcv_msg\n     ip_protocol_deliver_rcu            genl_family_rcv_msg_doit\n     tcp_v4_rcv                         mptcp_pm_nl_flush_addrs_doit\n     tcp_v4_do_rcv                      mptcp_nl_remove_addrs_list\n     tcp_rcv_established                mptcp_pm_remove_addrs_and_subflows\n     tcp_data_queue                     remove_anno_list_by_saddr\n     mptcp_incoming_options             mptcp_pm_del_add_timer\n     mptcp_pm_del_add_timer             kfree(entry)\r\n\r\nIn remove_anno_list_by_saddr(running on CPU2), after leaving the critical\nzone protected by \u0026quot;pm.lock\u0026quot;, the entry will be released, which leads to the\noccurrence of uaf in the mptcp_pm_del_add_timer(running on CPU1).\r\n\r\nKeeping a reference to add_timer inside the lock, and calling\nsk_stop_timer_sync() with this reference, instead of \u0026quot;entry-\u0026gt;add_timer\u0026quot;.\r\n\r\nMove list_del(\u0026amp;entry-\u0026gt;list) to mptcp_pm_del_add_timer and inside the pm lock,\ndo not directly access any members of the entry outside the pm lock, which\ncan avoid similar \u0026quot;entry-\u0026gt;x\u0026quot; uaf.(CVE-2024-46858)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ncrypto: stm32/cryp - call finalize with bh disabled\r\n\r\nThe finalize operation in interrupt mode produce a produces a spinlock\nrecursion warning. The reason is the fact that BH must be disabled\nduring this process.(CVE-2024-47658)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nspi: hisi-kunpeng: Add verification for the max_frequency provided by the firmware\r\n\r\nIf the value of max_speed_hz is 0, it may cause a division by zero\nerror in hisi_calc_effective_speed().\nThe value of max_speed_hz is provided by firmware.\nFirmware is generally considered as a trusted domain. However, as\ndivision by zero errors can cause system failure, for defense measure,\nthe value of max_speed is validated here. So 0 is regarded as invalid\nand an error code is returned.(CVE-2024-47664)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nocfs2: add bounds checking to ocfs2_xattr_find_entry()\r\n\r\nAdd a paranoia check to make sure it doesn\u0026apos;t stray beyond valid memory\nregion containing ocfs2 xattr entries when scanning for a match.  It will\nprevent out-of-bound access in case of crafted images.(CVE-2024-47670)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nUSB: usbtmc: prevent kernel-usb-infoleak\r\n\r\nThe syzbot reported a kernel-usb-infoleak in usbtmc_write,\nwe need to clear the structure before filling fields.(CVE-2024-47671)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: iwlwifi: mvm: don\u0026apos;t wait for tx queues if firmware is dead\r\n\r\nThere is a WARNING in iwl_trans_wait_tx_queues_empty() (that was\nrecently converted from just a message), that can be hit if we\nwait for TX queues to become empty after firmware died. Clearly,\nwe can\u0026apos;t expect anything from the firmware after it\u0026apos;s declared dead.\r\n\r\nDon\u0026apos;t call iwl_trans_wait_tx_queues_empty() in this case. While it could\nbe a good idea to stop the flow earlier, the flush functions do some\nmaintenance work that is not related to the firmware, so keep that part\nof the code running even when the firmware is not running.\r\n\r\n[edit commit message](CVE-2024-47672)","status":"published","published":"2024-10-18T11:07:44Z","modified":"2026-08-18T01:17:34.647251189Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"RHSA-2025:3506","title":"Red Hat Security Advisory: kernel security update","status":"published","published":"2025-04-03T10:06:58Z","modified":"2026-06-26T12:22:34.604767743Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"UBUNTU-CVE-2024-43855","description":"In the Linux kernel, the following vulnerability has been resolved: md: fix deadlock between mddev_suspend and flush bio Deadlock occurs when mddev is being suspended while some flush bio is in progress. It is a complex issue. T1. the first flush is at the ending stage, it clears 'mddev-\u003eflush_bio'     and tries to submit data, but is blocked because mddev is suspended     by T4. T2. the second flush sets 'mddev-\u003eflush_bio', and attempts to queue     md_submit_flush_data(), which is already running (T1) and won't     execute again if on the same CPU as T1. T3. the third flush inc active_io and tries to flush, but is blocked because     'mddev-\u003eflush_bio' is not NULL (set by T2). T4. mddev_suspend() is called and waits for active_io dec to 0 which is inc     by T3.   T1\t\tT2\t\tT3\t\tT4   (flush 1)\t(flush 2)\t(third 3)\t(suspend)   md_submit_flush_data    mddev-\u003eflush_bio = NULL;    .    .\t \tmd_flush_request    .\t  \t mddev-\u003eflush_bio = bio    .\t  \t queue submit_flushes    .\t\t .    .\t\t .\t\tmd_handle_request    .\t\t .\t\t active_io + 1    .\t\t .\t\t md_flush_request    .\t\t .\t\t  wait !mddev-\u003eflush_bio    .\t\t .    .\t\t .\t\t\t\tmddev_suspend    .\t\t .\t\t\t\t wait !active_io    .\t\t .    .\t\t submit_flushes    .\t\t queue_work md_submit_flush_data    .\t\t //md_submit_flush_data is already running (T1)    .    md_handle_request     wait resume The root issue is non-atomic inc/dec of active_io during flush process. active_io is dec before md_submit_flush_data is queued, and inc soon after md_submit_flush_data() run.   md_flush_request     active_io + 1     submit_flushes       active_io - 1       md_submit_flush_data         md_handle_request         active_io + 1           make_request         active_io - 1 If active_io is dec after md_handle_request() instead of within submit_flushes(), make_request() can be called directly intead of md_handle_request() in md_submit_flush_data(), and active_io will only inc and dec once in the whole flush process. Deadlock will be fixed. Additionally, the only difference between fixing the issue and before is that there is no return error handling of make_request(). But after previous patch cleaned md_write_start(), make_requst() only return error in raid5_make_request() by dm-raid, see commit 41425f96d7aa (\"dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape)\". Since dm always splits data and flush operation into two separate io, io size of flush submitted by dm always is 0, make_request() will not be called in md_submit_flush_data(). To prevent future modifications from introducing issues, add WARN_ON to ensure make_request() no error is returned in this context.","status":"published","published":"2024-08-17T10:15:00Z","modified":"2026-04-22T15:04:54.546721Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:58.679387Z"},{"id":"CVE-2024-43855","title":"md: fix deadlock between mddev_suspend and flush bio","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd: fix deadlock between mddev_suspend and flush bio\n\nDeadlock occurs when mddev is being suspended while some flush bio is in\nprogress. It is a complex issue.\n\nT1. the first flush is at the ending stage, it clears 'mddev-\u003eflush_bio'\n    and tries to submit data, but is blocked because mddev is suspended\n    by T4.\nT2. the second flush sets 'mddev-\u003eflush_bio', and attempts to queue\n    md_submit_flush_data(), which is already running (T1) and won't\n    execute again if on the same CPU as T1.\nT3. the third flush inc active_io and tries to flush, but is blocked because\n    'mddev-\u003eflush_bio' is not NULL (set by T2).\nT4. mddev_suspend() is called and waits for active_io dec to 0 which is inc\n    by T3.\n\n  T1\t\tT2\t\tT3\t\tT4\n  (flush 1)\t(flush 2)\t(third 3)\t(suspend)\n  md_submit_flush_data\n   mddev-\u003eflush_bio = NULL;\n   .\n   .\t \tmd_flush_request\n   .\t  \t mddev-\u003eflush_bio = bio\n   .\t  \t queue submit_flushes\n   .\t\t .\n   .\t\t .\t\tmd_handle_request\n   .\t\t .\t\t active_io + 1\n   .\t\t .\t\t md_flush_request\n   .\t\t .\t\t  wait !mddev-\u003eflush_bio\n   .\t\t .\n   .\t\t .\t\t\t\tmddev_suspend\n   .\t\t .\t\t\t\t wait !active_io\n   .\t\t .\n   .\t\t submit_flushes\n   .\t\t queue_work md_submit_flush_data\n   .\t\t //md_submit_flush_data is already running (T1)\n   .\n   md_handle_request\n    wait resume\n\nThe root issue is non-atomic inc/dec of active_io during flush process.\nactive_io is dec before md_submit_flush_data is queued, and inc soon\nafter md_submit_flush_data() run.\n  md_flush_request\n    active_io + 1\n    submit_flushes\n      active_io - 1\n      md_submit_flush_data\n        md_handle_request\n        active_io + 1\n          make_request\n        active_io - 1\n\nIf active_io is dec after md_handle_request() instead of within\nsubmit_flushes(), make_request() can be called directly intead of\nmd_handle_request() in md_submit_flush_data(), and active_io will\nonly inc and dec once in the whole flush process. Deadlock will be\nfixed.\n\nAdditionally, the only difference between fixing the issue and before is\nthat there is no return error handling of make_request(). But after\nprevious patch cleaned md_write_start(), make_requst() only return error\nin raid5_make_request() by dm-raid, see commit 41425f96d7aa (\"dm-raid456,\nmd/raid456: fix a deadlock for dm-raid456 while io concurrent with\nreshape)\". Since dm always splits data and flush operation into two\nseparate io, io size of flush submitted by dm always is 0, make_request()\nwill not be called in md_submit_flush_data(). To prevent future\nmodifications from introducing issues, add WARN_ON to ensure\nmake_request() no error is returned in this context.","status":"published","published":"2024-08-17T09:22:11.985Z","modified":"2026-10-28T02:31:13.087873456Z","updated_at":"2026-11-02T15:44:42.322107Z"},{"id":"DLA-4008-1","title":"linux-6.1 - security update","status":"published","published":"2025-01-02T00:00:00Z","modified":"2026-03-09T02:11:41.013831Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2024-0309","title":"Updated kernel, kmod-xtables-addons \u0026 kmod-virtualbox packages fix security vulnerabilities","description":"Upstream kernel version 6.6.50 fix bugs and vulnerabilities.\nThe kmod-virtualbox and kmod-xtables-addons packages have been\nupdated to work with this new kernel.\nFor information about the vulnerabilities see the links.\n","status":"published","published":"2024-09-19T18:04:01Z","modified":"2026-04-16T04:43:14.241085904Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"MGASA-2024-0310","title":"Updated kernel-linus packages fix security vulnerabilities","description":"Vanilla upstream kernel version 6.6.50 fix bugs and vulnerabilities.\nFor information about the vulnerabilities see the links.\n","status":"published","published":"2024-09-19T18:04:01Z","modified":"2026-04-16T04:40:43.560753704Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"SUSE-SU-2024:3194-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.\n\nThe following security bugs were fixed:\n\n- CVE-2024-41062: Sync sock recv cb and release (bsc#1228576).\n- CVE-2023-52489: Fix race in accessing memory_section-\u003eusage (bsc#1221326).\n- CVE-2024-43821: Fix a possible null pointer dereference (bsc#1229315).\n- CVE-2024-43911: Fix NULL dereference at band check in starting tx ba session (bsc#1229827).\n- CVE-2024-42277: Avoid NULL deref in sprd_iommu_hw_en (bsc#1229409).\n- CVE-2024-43880: Put back removed metod in struct objagg_ops (bsc#1229481).\n- CVE-2024-43899: Fix null pointer deref in dcn20_resource.c (bsc#1229754).\n- CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)\n- CVE-2024-43866: Always drain health in shutdown callback (bsc#1229495).\n- CVE-2024-26812: Struct virqfd kABI workaround (bsc#1222808).\n- CVE-2024-27010: Fix mirred deadlock on device recursion (bsc#1223720).\n- CVE-2024-36270: Fix reference in patches.suse/netfilter-tproxy-bail-out-if-IP-has-been-disabled-on.patch (bsc#1226798)\n- CVE-2024-36881: Reset ptes when close() for wr-protected ones (bsc#1225718).\n- CVE-2024-42316: Fix div-by-zero in vmpressure_calc_level() (bsc#1229353).\n- CVE-2024-43855: Fix deadlock between mddev_suspend and flush bio (bsc#1229342,).\n- CVE-2024-43864: Fix CT entry update leaks of modify header context (bsc#1229496)\n- CVE-2024-26631: Fix data-race in ipv6_mc_down / mld_ifc_work (bsc#1221630).\n- CVE-2024-42109: Unconditionally flush pending work before notifier (bsc#1228505)\n- CVE-2024-41084: Avoid null pointer dereference in region lookup (bsc#1228472)\n- CVE-2024-40905: Fix possible race in __fib6_drop_pcpu_from() (bsc#1227761)\n- CVE-2024-39489: Fix memleak in seg6_hmac_init_algo (bsc#1227623)\n- CVE-2024-36489: Fix missing memory barrier in tls_init (bsc#1226874)\n- CVE-2024-27079: Add kABI workaround patch (bsc#1223742).\n- CVE-2024-41020: Fix fcntl/close race recovery compat path (bsc#1228427).\n- CVE-2024-35897: Discard table flag update with pending basechain deletion (bsc#1224510).\n- CVE-2024-27403: Restore const specifier in flow_offload_route_init() (bsc#1224415).\n- CVE-2024-27011: Fix memleak in map from abort path (bsc#1223803).\n- CVE-2024-26668: Reject configurations that cause integer overflow (bsc#1222335).\n- CVE-2024-26835: Set dormant flag on hook register failure (bsc#1222967).\n- CVE-2024-26808: Handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).\n- CVE-2024-26809: Release elements in clone only from destroy path (bsc#1222633).\n- CVE-2023-52581: Fix memleak when more than 255 elements expired (bsc#1220877).\n- CVE-2024-43837: Fix updating attached freplace prog in prog_array map (bsc#1229297).\n- CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure (bsc#1224535).\n- CVE-2024-42291: Add a per-VF limit on number of FDIR filters (bsc#1229374).\n- CVE-2024-42268: Fix missing lock on sync reset reload (bsc#1229391).\n- CVE-2024-43834: Fix invalid wait context of page_pool_destroy() (bsc#1229314)\n- CVE-2024-27433: Fix an error handling path in clk_mt8135_apmixed_probe() (bsc#1224711).\n- CVE-2024-36286: Acquire rcu_read_lock() in instance_destroy_rcu() (bsc#1226801)\n- CVE-2024-26851: Add protection for bmp length out of range (bsc#1223074)\n- CVE-2024-40920: Fix suspicious rcu usage in br_mst_set_state (bsc#1227781).\n- CVE-2024-40921: Pass vlan group directly to br_mst_vlan_set_state (bsc#1227784).\n- CVE-2024-36979: Fix vlan use-after-free (bsc#1226604).\n- CVE-2024-26590: Fix inconsistent per-file compression format (bsc#1220252,).\n- CVE-2023-52859: Fix use-after-free when register pmu fails (bsc#1225582).\n- CVE-2024-42270: Fix null-ptr-deref in iptable_nat_table_init() (bsc#1229404)\n- CVE-2024-42269: Fix potential null-ptr-deref in ip6table_nat_table_init() (bsc#1229402)\n- CVE-2024-42284: Return non-zero value from tipc_udp_addr2str() on error (bsc#1229382)\n- CVE-2024-42283: Initialize all fields in dumped nexthops (bsc#1229383)\n- CVE-2024-42312: Always initialize i_uid/i_gid (bsc#1229357)\n- CVE-2024-43854: Initialize integrity buffer to zero before writing it to media (bsc#1229345)\n- CVE-2024-42322: Properly dereference pe in ip_vs_add_service (bsc#1229347)\n- CVE-2024-42308: Update DRM patch reference (bsc#1229411)\n- CVE-2024-42301: Update parport patch reference (bsc#1229407)\n- CVE-2024-42290: Handle runtime power management correctly (bsc#1229379).\n- CVE-2024-42318: Do not lose track of restrictions on cred_transfer (bsc#1229351).\n- CVE-2023-52889: Fix null pointer deref when receiving skb during sock creation (bsc#1229287,).\n- CVE-2024-42295: Handle inconsistent state in nilfs_btnode_create_block() (bsc#1229370).\n- CVE-2024-43850: Fix refcount imbalance seen during bwmon_remove (bsc#1229316).\n- CVE-2024-43831: Handle invalid decoder vsi (bsc#1229309).\n- CVE-2024-43839: Adjust 'name' buf size of bna_tcb and bna_ccb structures (bsc#1229301).\n- CVE-2024-41007: Use signed arithmetic in tcp_rtx_probe0_timed_out() (bsc#1227863).\n- CVE-2024-42281: Fix a segment issue when downgrading gso_size (bsc#1229386).\n- CVE-2024-26669: kABI fix for --Fix chain template offload (bsc#1222350).\n- CVE-2024-26677: kABI fix for -Fix delayed ACKs to not set the reference serial number (bsc#1222387).\n- CVE-2024-41050: Cyclic allocation of msg_id to avoid reuse (bsc#1228499).\n- CVE-2024-41051: Wait for ondemand_object_worker to finish when dropping object (bsc#1228468).\n- CVE-2024-41074: Set object to close if ondemand_id \u003e 0 in copen (bsc#1228643).\n- CVE-2024-41075: Add consistency check for copen/cread (bsc#1228646).\n- CVE-2024-41012: Remove locks reliably when fcntl/close race is detected (bsc#1228247).\n- CVE-2024-41080: Fix possible deadlock in io_register_iowq_max_workers() (bsc#1228616).\n- CVE-2024-42246: Remap EPERM in case of connection failure in xs_tcp_setup_socket (bsc#1228989).\n- CVE-2024-42159: Use proper format specifier in mpi3mr_sas_port_add() (bsc#1228754 CVE-2024-42159 git-fixes).\n- CVE-2024-42241: Disable PMD-sized page cache if needed (bsc#1228986).\n- CVE-2024-42245: Revert 'Make sure to try to detach at least one movable task' (bsc#1228978).\n- CVE-2024-26735: Fix possible use-after-free and null-ptr-deref (bsc#1222372).\n- CVE-2024-26837: Skip MDB replays of deferred events on offload (bsc#1222973).\n- CVE-2024-42155: Wipe copies of protected- and secure-keys (bsc#1228733).\n- CVE-2024-42156: Wipe copies of clear-key structures on failure (bsc#1228722).\n- CVE-2024-42157: Wipe sensitive data on failure (bsc#1228727).\n- CVE-2024-42158: Use kfree_sensitive() to fix Coccinelle warnings (bsc#1228720).\n- CVE-2024-38662: Cover verifier checks for mutating sockmap/sockhash (bsc#1226885).\n- CVE-2024-36911: Do not free decrypted memory (bsc#1225745).\n- CVE-2024-36910: Do not free decrypted memory (bsc#1225717).\n- CVE-2024-36909: Do not free ring buffers that couldn't be re-encrypted (bsc#1225744).\n- CVE-2024-40938: Fix d_parent walk (bsc#1227840).\n- CVE-2024-42247: Avoid unaligned 64-bit memory accesses (bsc#1228988).\n- CVE-2024-41010: Add netlink helper library (bsc#1228021).\n- CVE-2024-42106: Initialize pad field in struct inet_diag_req_v2 (bsc#1228493).\n- CVE-2024-42095: Fix Errata i2310 with RX FIFO level check (bsc#1228446).\n- CVE-2024-41068: Fix sclp_init() cleanup on failure (bsc#1228579).\n- CVE-2024-42138: Fix double memory deallocation in case of invalid INI file (bsc#1228500).\n- CVE-2024-42107: Do not process extts if PTP is disabled (bsc#1228494).\n- CVE-2024-42139: Fix improper extts handling (bsc#1228503).\n- CVE-2024-42110: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() (bsc#1228501).\n- CVE-2024-42113: Initialize num_q_vectors for MSI/INTx interrupts (bsc#1228568).\n- CVE-2024-42148: Fix multiple UBSAN array-index-out-of-bounds (bsc#1228487).\n- CVE-2024-42142: E-switch, Create ingress ACL when needed (bsc#1228491).\n- CVE-2024-42073: Fix memory corruptions on Spectrum-4 systems (bsc#1228457).\n- CVE-2024-42162: Account for stopped queues when reading NIC stats (bsc#1228706).\n- CVE-2024-42082: Remove WARN() from __xdp_reg_mem_model() (bsc#1228482).\n- CVE-2024-40978: Fix crash while reading debugfs attribute (bsc#1227929).\n- CVE-2024-41000: Prefer different overflow check (bsc#1227867).\n- CVE-2024-40995: Fix possible infinite loop in tcf_idr_check_alloc() (bsc#1227830).\n- CVE-2024-42161: Avoid uninitialized value in BPF_CORE_READ_BITFIELD (bsc#1228756).\n- CVE-2024-41069: Fix route memory corruption (bsc#1228644).\n- CVE-2024-39506: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet (bsc#1227729).\n- CVE-2024-42145: Implement a limit on UMAD receive List (bsc#1228743).\n- CVE-2024-40994: Fix integer overflow in max_vclocks_store (bsc#1227829).\n- CVE-2024-42124: Make qedf_execute_tmf() non-preemptible (bsc#1228705).\n- CVE-2024-42096: Stop playing stack games in profile_pc() (bsc#1228633).\n- CVE-2024-42224: Correct check for empty list (bsc#1228723).\n- CVE-2024-41048: Skip zero length skb in sk_msg_recvmsg (bsc#1228565).\n- CVE-2024-40958: Make get_net_ns() handle zero refcount net (bsc#1227812).\n- CVE-2024-40939: Fix tainted pointer delete is case of region creation fail (bsc#1227799).\n- CVE-2024-36933: Restore skb-\u003e{protocol,data,mac_header} for outer header in nsh_gso_segment() (bsc#1225832).\n- CVE-2024-36929: Reject skb_copy(_expand) for fraglist GSO skbs (bsc#1225814).\n- CVE-2024-41044: Reject claimed-as-LCP but actually malformed packets (bsc#1228530).\n- CVE-2024-41066: Add tx check to prevent skb leak (bsc#1228640).\n- CVE-2024-42093: Avoid explicit cpumask var allocation on stack (bsc#1228680).\n- CVE-2024-42122: Add NULL pointer check for kzalloc (bsc#1228591).\n- CVE-2024-41078: Fix quota root leak after quota disable failure (bsc#1228655).\n- CVE-2024-40989: Disassociate vcpus from redistributor region on teardown (bsc#1227823).\n- CVE-2024-41064: Avoid possible crash when edev-\u003epdev changes (bsc#1228599).\n- CVE-2024-41036: Fix deadlock with the SPI chip variant (bsc#1228496)\n- CVE-2024-41040: Fix UAF when resolving a clash (bsc#1228518).\n- CVE-2024-35949: Make sure that WRITTEN is set on all metadata blocks (bsc#1224700).\n- CVE-2024-41081: Block BH in ila_output() (bsc#1228617).\n- CVE-2024-41076: Fix memory leak in nfs4_set_security_label (bsc#1228649).\n- CVE-2024-42079: Fix NULL pointer dereference in gfs2_log_flush (bsc#1228672).\n- CVE-2024-41057: Fix slab-use-after-free in cachefiles_withdraw_cookie() (bsc#1228462).\n- CVE-2024-41058: Fix slab-use-after-free in fscache_withdraw_volume() (bsc#1228459).\n- CVE-2024-41015: Add bounds checking to ocfs2_check_dir_entry() (bsc#1228409).\n- CVE-2024-40956: Fix possible Use-After-Free in irq_process_work_list (bsc#1227810).\n- CVE-2024-27437: Disable auto-enable of exclusive INTx IRQ (bsc#1222625).\n- CVE-2024-41032: Check if a hash-index is in cpu_possible_mask (bsc#1228460)\n- CVE-2024-40957: Fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors (bsc#1227811)\n- CVE-2024-41041: Set SOCK_RCU_FREE earlier in udp_lib_get_port() (bsc#1228520).\n- CVE-2024-40954: Do not leave a dangling sk pointer, when socket creation fails (bsc#1227808)\n- CVE-2024-42070: Fully validate NFT_DATA_VALUE on store to data registers (bsc#1228470).\n- CVE-2024-41070: Prevent UAF in kvm_spapr_tce_attach_iommu_group() (bsc#1228581).\n- CVE-2024-40959: Check ip6_dst_idev() return value in xfrm6_get_saddr() (bsc#1227884).\n- CVE-2024-41009: Fix overrunning reservations in ringbuf (bsc#1228020).\n- CVE-2024-40909: Fix a potential use-after-free in bpf_link_free() (bsc#1227798).\n- CVE-2024-27024: Fix WARNING in rds_conn_connect_if_down (bsc#1223777).\n\nThe following non-security bugs were fixed:\n\n- ACPI: battery: create alarm sysfs attribute atomically (stable-fixes).\n- ACPI: processor_idle: use raw_safe_halt() in acpi_idle_play_dead() (git-fixes).\n- ACPI: SBS: manage alarm sysfs attribute through psy core (stable-fixes).\n- ACPI/NUMA: Apply SRAT proximity domain to entire CFMWS window (git-fixes).\n- afs: fix __afs_break_callback() / afs_drop_open_mmap() race (git-fixes).\n- ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list (stable-fixes).\n- ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list (stable-fixes).\n- ALSA: hda: Conditionally use snooping for AMD HDMI (git-fixes).\n- ALSA: hda: conexant: Fix headset auto detect fail in the polling mode (git-fixes).\n- ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4 (stable-fixes).\n- ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4 (stable-fixes).\n- ALSA: hda/realtek - Fixed ALC256 headphone no sound (stable-fixes).\n- ALSA: hda/realtek - FIxed ALC285 headphone no sound (stable-fixes).\n- ALSA: hda/realtek: Add Framework Laptop 13 (Intel Core Ultra) to quirks (stable-fixes).\n- ALSA: hda/realtek: Add Framework Laptop 13 (Intel Core Ultra) to quirks (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Acer Aspire E5-574G (stable-fixes).\n- ALSA: hda/realtek: Add support for new HP G12 laptops (stable-fixes).\n- ALSA: hda/realtek: Enable mute/micmute LEDs on HP Laptop 14-ey0xxx (stable-fixes).\n- ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7 (git-fixes).\n- ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book3 Ultra (stable-fixes).\n- ALSA: hda/realtek: Implement sound init sequence for Samsung Galaxy Book3 Pro 360 (stable-fixes).\n- ALSA: hda/realtek: support HP Pavilion Aero 13-bg0xxx Mute LED (stable-fixes).\n- ALSA: hda/tas2781: fix wrong calibrated data order (git-fixes).\n- ALSA: hda/tas2781: Use correct endian conversion (git-fixes).\n- ALSA: line6: Fix racy access to midibuf (stable-fixes).\n- ALSA: line6: Fix racy access to midibuf (stable-fixes).\n- ALSA: seq: Skip event type filtering for UMP events (git-fixes).\n- ALSA: seq: ump: Explicitly reset RPN with Null RPN (stable-fixes).\n- ALSA: seq: ump: Optimize conversions from SysEx to UMP (git-fixes).\n- ALSA: seq: ump: Transmit RPN/NRPN message at each MSB/LSB data reception (stable-fixes).\n- ALSA: seq: ump: Use the common RPN/bank conversion context (stable-fixes).\n- ALSA: timer: Relax start tick time check for slave timer elements (git-fixes).\n- ALSA: ump: Explicitly reset RPN with Null RPN (stable-fixes).\n- ALSA: ump: Transmit RPN/NRPN message at each MSB/LSB data reception (stable-fixes).\n- ALSA: usb-audio: Add delay quirk for VIVO USB-C-XE710 HEADSET (stable-fixes).\n- ALSA: usb-audio: Correct surround channels in UAC1 channel map (git-fixes).\n- ALSA: usb-audio: Re-add ScratchAmp quirk entries (git-fixes).\n- ALSA: usb-audio: Re-add ScratchAmp quirk entries (git-fixes).\n- ALSA: usb-audio: Support Yamaha P-125 quirk entry (stable-fixes).\n- ALSA: usb: Fix UBSAN warning in parse_audio_unit() (stable-fixes).\n- apparmor: unpack transition table if dfa is not present (bsc#1226031).\n- arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to (git-fixes)\n- arm64: Add Neoverse-V2 part (git-fixes)\n- arm64: armv8_deprecated: Fix warning in isndep cpuhp starting process (git-fixes)\n- arm64: barrier: Restore spec_bar() macro (git-fixes)\n- arm64: cputype: Add Cortex-A720 definitions (git-fixes)\n- arm64: cputype: Add Cortex-A725 definitions (git-fixes)\n- arm64: cputype: Add Cortex-X1C definitions (git-fixes)\n- arm64: cputype: Add Cortex-X3 definitions (git-fixes)\n- arm64: cputype: Add Cortex-X4 definitions (git-fixes)\n- arm64: cputype: Add Cortex-X925 definitions (git-fixes)\n- arm64: cputype: Add Neoverse-V3 definitions (git-fixes)\n- arm64: dts: imx8mp: add HDMI power-domains (git-fixes)\n- arm64: dts: imx8mp: Add NPU Node (git-fixes)\n- arm64: dts: imx8mp: Fix pgc vpu locations (git-fixes)\n- arm64: dts: imx8mp: Fix pgc_mlmix location (git-fixes)\n- arm64: errata: Expand speculative SSBS workaround (again) (git-fixes)\n- arm64: errata: Expand speculative SSBS workaround (git-fixes)\n- arm64: errata: Unify speculative SSBS errata logic (git-fixes). Update config files.\n- arm64: Fix KASAN random tag seed initialization (git-fixes)\n- arm64: jump_label: Ensure patched jump_labels are visible to all CPUs (git-fixes)\n- ASoC: allow module autoloading for table board_ids (stable-fixes).\n- ASoC: allow module autoloading for table db1200_pids (stable-fixes).\n- ASoC: amd: acp: fix module autoloading (git-fixes).\n- ASoC: amd: yc: Add quirk entry for OMEN by HP Gaming Laptop 16-n0xxx (bsc#1227182).\n- ASoC: amd: yc: Support mic on HP 14-em0002la (stable-fixes).\n- ASoC: amd: yc: Support mic on HP 14-em0002la (stable-fixes).\n- ASoC: amd: yc: Support mic on Lenovo Thinkpad E14 Gen 6 (stable-fixes).\n- ASoC: amd: yc: Support mic on Lenovo Thinkpad E14 Gen 6 (stable-fixes).\n- ASoC: codecs: wcd938x-sdw: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wcd938x-sdw: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa881x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa881x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa883x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa883x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa884x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa884x: Correct Soundwire ports mask (git-fixes).\n- ASoC: cs35l45: Checks index of cs35l45_irqs[] (stable-fixes).\n- ASoC: cs35l56: Handle OTP read latency over SoundWire (stable-fixes).\n- ASoC: cs35l56: Handle OTP read latency over SoundWire (stable-fixes).\n- ASoC: cs35l56: Patch CS35L56_IRQ1_MASK_18 to the default value (stable-fixes).\n- ASoC: cs35l56: Patch CS35L56_IRQ1_MASK_18 to the default value (stable-fixes).\n- ASoC: fsl_micfil: Expand the range of FIFO watermark mask (stable-fixes).\n- ASoC: fsl_micfil: Expand the range of FIFO watermark mask (stable-fixes).\n- ASoC: mediatek: mt8188: Mark AFE_DAC_CON0 register as volatile (stable-fixes).\n- ASoC: meson: axg-fifo: fix irq scheduling issue with PREEMPT_RT (git-fixes).\n- ASoC: meson: axg-fifo: fix irq scheduling issue with PREEMPT_RT (git-fixes).\n- ASoC: nau8822: Lower debug print priority (stable-fixes).\n- ASoC: nau8822: Lower debug print priority (stable-fixes).\n- ASoC: SOF: amd: Fix for acp init sequence (git-fixes).\n- ASoC: SOF: Intel: hda-dsp: Make sure that no irq handler is pending before suspend (stable-fixes).\n- ASoC: SOF: ipc4: check return value of snd_sof_ipc_msg_data (stable-fixes).\n- ASoC: SOF: mediatek: Add missing board compatible (stable-fixes).\n- ASoC: SOF: Remove libraries from topology lookups (git-fixes).\n- ASoC: SOF: Remove libraries from topology lookups (git-fixes).\n- ata: libata-scsi: Do not overwrite valid sense data when CK_COND=1 (stable-fixes).\n- ata: libata-scsi: Honor the D_SENSE bit for CK_COND=1 and no error (stable-fixes).\n- Bluetooth: Add device 13d3:3572 IMC Networks Bluetooth Radio (stable-fixes).\n- Bluetooth: bnep: Fix out-of-bound access (stable-fixes).\n- Bluetooth: btintel: Fail setup on error (git-fixes).\n- Bluetooth: btnxpuart: Shutdown timer and prevent rearming when driver unloading (stable-fixes).\n- Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x13d3:0x3591 (stable-fixes).\n- Bluetooth: btusb: Add RTL8852BE device 0489:e125 to device tables (stable-fixes).\n- Bluetooth: Fix usage of __hci_cmd_sync_status (git-fixes).\n- Bluetooth: hci_conn: Check non NULL function before calling for HFP offload (stable-fixes).\n- Bluetooth: hci_core: Fix LE quote calculation (git-fixes).\n- Bluetooth: hci_core: Fix not handling hibernation actions (git-fixes).\n- Bluetooth: hci_sync: avoid dup filtering when passive scanning with adv monitor (git-fixes).\n- Bluetooth: hci_sync: Fix suspending with wrong filter policy (git-fixes).\n- Bluetooth: l2cap: always unlock channel in l2cap_conless_channel() (git-fixes).\n- Bluetooth: L2CAP: Fix deadlock (git-fixes).\n- Bluetooth: MGMT: Add error handling to pair_device() (git-fixes).\n- Bluetooth: SMP: Fix assumption of Central always being Initiator (git-fixes).\n- bnxt_re: Fix imm_data endianness (git-fixes)\n- bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG (git-fixes)\n- bpf, lpm: Fix check prefixlen before walking trie (git-fixes).\n- bpf: Add crosstask check to __bpf_get_stack (git-fixes).\n- bpf: Detect IP == ksym.end as part of BPF program (git-fixes).\n- bpf: do not infer PTR_TO_CTX for programs with unnamed context type (git-fixes).\n- bpf: enforce precision of R0 on callback return (git-fixes).\n- bpf: Ensure proper register state printing for cond jumps (git-fixes).\n- bpf: extract bpf_ctx_convert_map logic and make it more reusable (git-fixes).\n- bpf: Fix a few selftest failures due to llvm18 change (git-fixes).\n- bpf: Fix a kernel verifier crash in stacksafe() (bsc#1225903).\n- bpf: Fix check_stack_write_fixed_off() to correctly spill imm (git-fixes).\n- bpf: fix control-flow graph checking in privileged mode (git-fixes).\n- bpf: Fix kfunc callback register type handling (git-fixes).\n- bpf: Fix prog_array_map_poke_run map poke update (git-fixes).\n- bpf: Fix unnecessary -EBUSY from htab_lock_bucket (git-fixes).\n- bpf: handle bpf_user_pt_regs_t typedef explicitly for PTR_TO_CTX global arg (git-fixes).\n- bpf: hardcode BPF_PROG_PACK_SIZE to 2MB * num_possible_nodes() (git-fixes).\n- bpf: kprobe: remove unused declaring of bpf_kprobe_override (git-fixes).\n- bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly (git-fixes).\n- bpf: Remove unnecessary wait from bpf_map_copy_value() (git-fixes).\n- bpf: Set uattr-\u003ebatch.count as zero before batched update or deletion (git-fixes).\n- bpf: simplify btf_get_prog_ctx_type() into btf_is_prog_ctx_type() (git-fixes).\n- bpf/tests: Remove duplicate JSGT tests (git-fixes).\n- bpftool: Align output skeleton ELF code (git-fixes).\n- bpftool: Fix -Wcast-qual warning (git-fixes).\n- bpftool: mark orphaned programs during prog show (git-fixes).\n- bpftool: Silence build warning about calloc() (git-fixes).\n- btrfs: add a btrfs_finish_ordered_extent helper (git-fixes).\n- btrfs: add a is_data_bbio helper (git-fixes).\n- btrfs: add an ordered_extent pointer to struct btrfs_bio (git-fixes).\n- btrfs: copy dir permission and time when creating a stub subvolume (bsc#1228321).\n- btrfs: ensure fast fsync waits for ordered extents after a write failure (git-fixes).\n- btrfs: factor out a btrfs_queue_ordered_fn helper (git-fixes).\n- btrfs: factor out a can_finish_ordered_extent helper (git-fixes).\n- btrfs: fix corruption after buffer fault in during direct IO append write (git-fixes).\n- btrfs: fix double inode unlock for direct IO sync writes (git-fixes).\n- btrfs: fix extent map use-after-free when adding pages to compressed bio (git-fixes).\n- btrfs: fix leak of qgroup extent records after transaction abort (git-fixes).\n- btrfs: fix ordered extent split error handling in btrfs_dio_submit_io (git-fixes).\n- btrfs: limit write bios to a single ordered extent (git-fixes).\n- btrfs: make btrfs_finish_ordered_extent() return void (git-fixes).\n- btrfs: merge the two calls to btrfs_add_ordered_extent in run_delalloc_nocow (git-fixes).\n- btrfs: open code btrfs_bio_end_io in btrfs_dio_submit_io (git-fixes).\n- btrfs: open code end_extent_writepage in end_bio_extent_writepage (git-fixes).\n- btrfs: pass a btrfs_inode to btrfs_fdatawrite_range() (git-fixes).\n- btrfs: pass a btrfs_inode to btrfs_wait_ordered_range() (git-fixes).\n- btrfs: pass an ordered_extent to btrfs_reloc_clone_csums (git-fixes).\n- btrfs: pass an ordered_extent to btrfs_submit_compressed_write (git-fixes).\n- btrfs: remove btrfs_add_ordered_extent (git-fixes).\n- btrfs: rename err to ret in btrfs_direct_write() (git-fixes).\n- btrfs: uninline some static inline helpers from tree-log.h (git-fixes).\n- btrfs: use a btrfs_inode in the log context (struct btrfs_log_ctx) (git-fixes).\n- btrfs: use a btrfs_inode local variable at btrfs_sync_file() (git-fixes).\n- btrfs: use bbio-\u003eordered in btrfs_csum_one_bio (git-fixes).\n- btrfs: use btrfs_finish_ordered_extent to complete buffered writes (git-fixes).\n- btrfs: use btrfs_finish_ordered_extent to complete compressed writes (git-fixes).\n- btrfs: use btrfs_finish_ordered_extent to complete direct writes (git-fixes).\n- btrfs: use irq safe locking when running and adding delayed iputs (git-fixes).\n- cachefiles, erofs: Fix NULL deref in when cachefiles is not doing ondemand-mode (bsc#1229245).\n- cachefiles: add missing lock protection when polling (bsc#1229256).\n- cachefiles: add restore command to recover inflight ondemand read requests (bsc#1229244).\n- cachefiles: add spin_lock for cachefiles_ondemand_info (bsc#1229249).\n- cachefiles: cancel all requests for the object that is being dropped (bsc#1229255).\n- cachefiles: defer exposing anon_fd until after copy_to_user() succeeds (bsc#1229251).\n- cachefiles: extract ondemand info field from cachefiles_object (bsc#1229240).\n- cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read() (bsc#1229247).\n- cachefiles: fix slab-use-after-free in cachefiles_ondemand_get_fd() (bsc#1229246).\n- cachefiles: introduce object ondemand state (bsc#1229239).\n- cachefiles: make on-demand read killable (bsc#1229252).\n- cachefiles: narrow the scope of triggering EPOLLIN events in ondemand mode (bsc#1229243).\n- cachefiles: never get a new anonymous fd if ondemand_id is valid (bsc#1229250).\n- cachefiles: propagate errors from vfs_getxattr() to avoid infinite loop (bsc#1229253).\n- cachefiles: remove err_put_fd label in cachefiles_ondemand_daemon_read() (bsc#1229248).\n- cachefiles: resend an open request if the read request's object is closed (bsc#1229241).\n- cachefiles: stop sending new request when dropping object (bsc#1229254).\n- can: mcp251xfd: tef: prepare to workaround broken TEF FIFO tail index erratum (stable-fixes).\n- can: mcp251xfd: tef: update workaround for erratum DS80000789E 6 of mcp2518fd (stable-fixes).\n- ceph: periodically flush the cap releases (bsc#1230056).\n- cgroup: Add annotation for holding namespace_sem in current_cgns_cgroup_from_root() (bsc#1222254).\n- cgroup: Eliminate the need for cgroup_mutex in proc_cgroup_show() (bsc#1222254).\n- cgroup: Make operations on the cgroup root_list RCU safe (bsc#1222254).\n- cgroup: preserve KABI of cgroup_root (bsc#1222254).\n- cgroup: Remove unnecessary list_empty() (bsc#1222254).\n- cgroup/cpuset: Prevent UAF in proc_cpuset_show() (bsc#1228801).\n- char: xillybus: Check USB endpoints when probing device (git-fixes).\n- char: xillybus: Do not destroy workqueue from work item running on it (stable-fixes).\n- char: xillybus: Refine workqueue handling (git-fixes).\n- clk: en7523: fix rate divider for slic and spi clocks (git-fixes).\n- clk: qcom: camcc-sc7280: Add parent dependency to all camera GDSCs (git-fixes).\n- clk: qcom: gcc-sa8775p: Update the GDSC wait_val fields and flags (git-fixes).\n- clk: qcom: gcc-sc7280: Update force mem core bit for UFS ICE clock (git-fixes).\n- clk: qcom: gpucc-sa8775p: Park RCG's clk source at XO during disable (git-fixes).\n- clk: qcom: gpucc-sa8775p: Remove the CLK_IS_CRITICAL and ALWAYS_ON flags (git-fixes).\n- clk: qcom: gpucc-sa8775p: Update wait_val fields for GPU GDSC's (git-fixes).\n- clk: qcom: gpucc-sm8350: Park RCG's clk source at XO during disable (git-fixes).\n- clk: qcom: kpss-xcc: Return of_clk_add_hw_provider to transfer the error (git-fixes).\n- clk: qcom: Park shared RCGs upon registration (git-fixes).\n- clk: visconti: Add bounds-checking coverage for struct visconti_pll_provider (stable-fixes).\n- clocksource/drivers/sh_cmt: Address race condition for clock events (stable-fixes).\n- cpu/SMT: Enable SMT only if a core is online (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588 git-fixes).\n- cxl/region: Move cxl_dpa_to_region() work to the region driver (bsc#1228472)\n- dev/parport: fix the array out-of-bounds risk (stable-fixes).\n- device property: Add cleanup.h based fwnode_handle_put() scope based cleanup (stable-fixes).\n- dmaengine: dw: Add memory bus width verification (git-fixes).\n- dmaengine: dw: Add peripheral bus width verification (git-fixes).\n- docs: KVM: Fix register ID of SPSR_FIQ (git-fixes).\n- driver core: Fix uevent_show() vs driver detach race (git-fixes).\n- drm/admgpu: fix dereferencing null pointer context (stable-fixes).\n- drm/amd/display: Add delay to improve LTTPR UHBR interop (stable-fixes).\n- drm/amd/display: Add NULL check for 'afb' before dereferencing in amdgpu_dm_plane_handle_cursor_update (stable-fixes).\n- drm/amd/display: Add null checker before passing variables (stable-fixes).\n- drm/amd/display: Adjust cursor position (git-fixes).\n- drm/amd/display: avoid using null object of framebuffer (git-fixes).\n- drm/amd/display: Check for NULL pointer (stable-fixes).\n- drm/amd/display: fix cursor offset on rotation 180 (git-fixes).\n- drm/amd/display: fix s2idle entry for DCN3.5+ (stable-fixes).\n- drm/amd/display: Skip Recompute DSC Params if no Stream on Link (stable-fixes).\n- drm/amd/pm: Fix the null pointer dereference for vega10_hwmgr (stable-fixes).\n- drm/amdgpu: Actually check flags for all context ops (stable-fixes).\n- drm/amdgpu: Add lock around VF RLCG interface (stable-fixes).\n- drm/amdgpu: fix dereference null return value for the function amdgpu_vm_pt_parent (stable-fixes).\n- drm/amdgpu: fix potential resource leak warning (stable-fixes).\n- drm/amdgpu: Fix the null pointer dereference to ras_manager (stable-fixes).\n- drm/amdgpu: Forward soft recovery errors to userspace (stable-fixes).\n- drm/amdgpu: reset vm state machine after gpu reset(vram lost) (stable-fixes).\n- drm/amdgpu: Validate TA binary size (stable-fixes).\n- drm/amdgpu/jpeg2: properly set atomics vmid field (stable-fixes).\n- drm/amdgpu/jpeg4: properly set atomics vmid field (stable-fixes).\n- drm/amdgpu/pm: Fix the null pointer dereference for smu7 (stable-fixes).\n- drm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rules (stable-fixes).\n- drm/amdgpu/pm: Fix the param type of set_power_profile_mode (stable-fixes).\n- drm/amdgpu/sdma5.2: limit wptr workaround to sdma 5.2.1 (git-fixes).\n- drm/amdgpu/sdma5.2: Update wptr registers as well as doorbell (stable-fixes).\n- drm/bridge: analogix_dp: properly handle zero sized AUX transactions (stable-fixes).\n- drm/client: fix null pointer dereference in drm_client_modeset_probe (git-fixes).\n- drm/dp_mst: Skip CSN if topology probing is not done yet (stable-fixes).\n- drm/etnaviv: do not block scheduler when GPU is still active (stable-fixes).\n- drm/i915: Fix possible int overflow in skl_ddi_calculate_wrpll() (git-fixes).\n- drm/i915/dsi: Make Lenovo Yoga Tab 3 X90F DMI match less strict (git-fixes).\n- drm/i915/gem: Adjust vma offset for framebuffer mmap offset (stable-fixes).\n- drm/i915/gem: Fix Virtual Memory mapping boundaries calculation (git-fixes).\n- drm/i915/hdcp: Fix HDCP2_STREAM_STATUS macro (git-fixes).\n- drm/lima: set gp bus_stop bit before hard reset (stable-fixes).\n- drm/mediatek/dp: Fix spurious kfree() (git-fixes).\n- drm/msm: Reduce fallout of fence signaling vs reclaim hangs (stable-fixes).\n- drm/msm/dp: fix the max supported bpp logic (git-fixes).\n- drm/msm/dp: reset the link phy params before link training (git-fixes).\n- drm/msm/dpu: capture snapshot on the first commit_done timeout (stable-fixes).\n- drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails (git-fixes).\n- drm/msm/dpu: do not play tricks with debug macros (git-fixes).\n- drm/msm/dpu: drop MSM_ENC_VBLANK support (stable-fixes).\n- drm/msm/dpu: move dpu_encoder's connector assignment to atomic_enable() (git-fixes).\n- drm/msm/dpu: split dpu_encoder_wait_for_event into two functions (stable-fixes).\n- drm/msm/dpu: take plane rotation into account for wide planes (git-fixes).\n- drm/msm/dpu: try multirect based on mdp clock limits (stable-fixes).\n- drm/msm/dpu: use drmm-managed allocation for dpu_encoder_phys (stable-fixes).\n- drm/msm/mdss: Rename path references to mdp_path (stable-fixes).\n- drm/msm/mdss: switch mdss to use devm_of_icc_get() (stable-fixes).\n- drm/nouveau: prime: fix refcount underflow (git-fixes).\n- drm/panel: nt36523: Set 120Hz fps for xiaomi,elish panels (stable-fixes).\n- drm/radeon: Remove __counted_by from StateArray.states[] (git-fixes).\n- drm/radeon/evergreen_cs: Clean up errors in evergreen_cs.c (bsc#1229024).\n- drm/rockchip: vop2: clear afbc en and transform bit for cluster window at linear mode (stable-fixes).\n- drm/virtio: Fix type of dma-fence context variable (git-fixes).\n- drm/vmwgfx: Fix a deadlock in dma buf fence polling (git-fixes).\n- drm/vmwgfx: Fix overlay when using Screen Targets (git-fixes).\n- drm/vmwgfx: Fix prime with external buffers (git-fixes).\n- efi/libstub: Zero initialize heap allocated struct screen_info (git-fixes).\n- evm: do not copy up 'security.evm' xattr (git-fixes).\n- firmware: cirrus: cs_dsp: Initialize debugfs_root to invalid (stable-fixes).\n- fs/netfs/fscache_cookie: add missing 'n_accesses' check (bsc#1229455).\n- fuse: Initialize beyond-EOF page contents before setting uptodate (bsc#1229456).\n- genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline (git-fixes).\n- genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware (git-fixes).\n- genirq/matrix: Exclude managed interrupts in irq_matrix_allocated() (git-fixes).\n- gfs2: setattr_chown: Add missing initialization (git-fixes).\n- gpio: mlxbf3: Support shutdown() function (git-fixes).\n- gpio: prevent potential speculation leaks in gpio_device_get_desc() (stable-fixes).\n- gpio: sysfs: extend the critical section for unregistering sysfs devices (stable-fixes).\n- gss_krb5: Fix the error handling path for crypto_sync_skcipher_setkey (git-fixes).\n- hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode() (git-fixes).\n- HID: wacom: Defer calculation of resolution until resolution_code is known (git-fixes).\n- hwmon: (ltc2992) Avoid division by zero (stable-fixes).\n- hwmon: (ltc2992) Fix memory leak in ltc2992_parse_dt() (git-fixes).\n- hwmon: (pc87360) Bounds check data-\u003einnr usage (stable-fixes).\n- i2c: Fix conditional for substituting empty ACPI functions (stable-fixes).\n- i2c: qcom-geni: Add missing clk_disable_unprepare in geni_i2c_runtime_resume (git-fixes).\n- i2c: qcom-geni: Add missing geni_icc_disable in geni_i2c_runtime_resume (git-fixes).\n- i2c: qcom-geni: Add missing geni_icc_disable in geni_i2c_runtime_resume (git-fixes).\n- i2c: riic: avoid potential division by zero (stable-fixes).\n- i2c: smbus: Improve handling of stuck alerts (git-fixes).\n- i2c: smbus: Send alert notifications to all devices if source not found (git-fixes).\n- i2c: stm32f7: Add atomic_xfer method to driver (stable-fixes).\n- i2c: Use IS_REACHABLE() for substituting empty ACPI functions (git-fixes).\n- i3c: mipi-i3c-hci: Do not unmap region not mapped for transfer (stable-fixes).\n- i3c: mipi-i3c-hci: Remove BUG() when Ring Abort request times out (stable-fixes).\n- i915/perf: Remove code to update PWR_CLK_STATE for gen12 (git-fixes).\n- ice: Fix NULL pointer access, if PF does not support SRIOV_LAG (bsc#1228737).\n- Input: i8042 - add forcenorestore quirk to leave controller untouched even on s3 (stable-fixes).\n- Input: i8042 - add Fujitsu Lifebook E756 to i8042 quirk table (bsc#1229056).\n- Input: i8042 - use new forcenorestore quirk to replace old buggy quirk combination (stable-fixes).\n- Input: MT - limit max slots (stable-fixes).\n- io_uring: Drop per-ctx dummy_ubuf (git-fixes).\n- io_uring: fix io_match_task must_hold (git-fixes).\n- io_uring: Fix probe of disabled operations (git-fixes).\n- io_uring: tighten task exit cancellations (git-fixes).\n- io_uring/advise: support 64-bit lengths (git-fixes).\n- iommu/amd: Convert comma to semicolon (git-fixes).\n- iommu/vt-d: Fix identity map bounds in si_domain_init() (git-fixes).\n- iommufd/device: Fix hwpt at err_unresv in iommufd_device_do_replace() (git-fixes).\n- ip6_tunnel: Fix broken GRO (bsc#1229444).\n- ipv6: sr: fix incorrect unregister order (git-fixes).\n- irqdomain: Fixed unbalanced fwnode get and put (git-fixes).\n- jfs: define xtree root and page independently (git-fixes).\n- jfs: fix null ptr deref in dtInsertEntry (git-fixes).\n- jfs: Fix shift-out-of-bounds in dbDiscardAG (git-fixes).\n- jump_label: Clarify condition in static_key_fast_inc_not_disabled() (git-fixes).\n- jump_label: Fix concurrency issues in static_key_slow_dec() (git-fixes).\n- jump_label: Fix the fix, brown paper bags galore (git-fixes).\n- jump_label: Simplify and clarify static_key_fast_inc_cpus_locked() (git-fixes).\n- kabi fix for KVM: s390: fix LPSWEY handling (bsc#1227634 git-fixes).\n- kabi fix for SUNRPC: add a missing rpc_stat for TCP TLS (git-fixes).\n- kABI fix of: virtio-crypto: handle config changed by work queue (git-fixes).\n- kABI workaround for sound core UMP conversion (stable-fixes).\n- kabi/severities: ignore kABI for FireWire sound local symbols (bsc#1208783)\n- kabi/severity: add nvme common code The nvme common code is also allowed to change the data structures, there are only internal users.\n- kcov: properly check for softirq context (git-fixes).\n- kernfs: Convert kernfs_path_from_node_locked() from strlcpy() to strscpy() (bsc#1229134).\n- kernfs: fix false-positive WARN(nr_mmapped) in kernfs_drain_open_files (git-fixes).\n- kprobes: Fix to check symbol prefixes correctly (git-fixes).\n- kprobes: Prohibit probing on CFI preamble symbol (git-fixes).\n- KVM: Always flush async #PF workqueue when vCPU is being destroyed (git-fixes).\n- KVM: arm64: AArch32: Fix spurious trapping of conditional instructions (git-fixes).\n- KVM: arm64: Add missing memory barriers when switching to pKVM's hyp pgd (git-fixes).\n- KVM: arm64: Allow AArch32 PSTATE.M to be restored as System mode (git-fixes).\n- KVM: arm64: Fix __pkvm_init_switch_pgd call ABI (git-fixes).\n- KVM: arm64: Fix AArch32 register narrowing on userspace write (git-fixes).\n- KVM: arm64: Fix clobbered ELR in sync abort/SError (git-fixes)\n- KVM: arm64: GICv4: Do not perform a map to a mapped vLPI (git-fixes).\n- KVM: arm64: timers: Correctly handle TGE flip with CNTPOFF_EL2 (git-fixes).\n- KVM: arm64: timers: Fix resource leaks in kvm_timer_hyp_init() (git-fixes).\n- KVM: arm64: vgic-its: Test for valid IRQ in its_sync_lpi_pending_table() (git-fixes).\n- KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler (git-fixes).\n- KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id (git-fixes).\n- KVM: arm64: vgic-v4: Restore pending state on host userspace write (git-fixes).\n- KVM: arm64: vgic: Add a non-locking primitive for kvm_vgic_vcpu_destroy() (git-fixes).\n- KVM: arm64: vgic: Force vcpu vgic teardown on vcpu destroy (git-fixes).\n- KVM: arm64: vgic: Simplify kvm_vgic_destroy() (git-fixes).\n- KVM: fix kvm_mmu_memory_cache allocation warning (git-fixes).\n- KVM: Make KVM_MEM_GUEST_MEMFD mutually exclusive with KVM_MEM_READONLY (git-fixes).\n- KVM: nVMX: Add a helper to get highest pending from Posted Interrupt vector (git-fixes).\n- KVM: nVMX: Check for pending posted interrupts when looking for nested events (git-fixes).\n- KVM: nVMX: Request immediate exit iff pending nested event needs injection (git-fixes).\n- KVM: PPC: Book3S HV: Fix the set_one_reg for MMCR3 (bsc#1194869).\n- KVM: PPC: Book3S HV: Handle pending exceptions on guest entry with MSR_EE (bsc#1215199).\n- KVM: Protect vcpu-\u003epid dereference via debugfs with RCU (git-fixes).\n- KVM: Reject overly excessive IDs in KVM_CREATE_VCPU (git-fixes).\n- KVM: s390: fix LPSWEY handling (bsc#1227634 git-fixes).\n- KVM: s390: fix validity interception issue when gisa is switched off (git-fixes bsc#1229167).\n- kvm: s390: Reject memory region operations for ucontrol VMs (git-fixes bsc#1229168).\n- KVM: Stop processing *all* memslots when 'null' mmu_notifier handler is found (git-fixes).\n- KVM: VMX: Move posted interrupt descriptor out of VMX code (git-fixes).\n- KVM: VMX: Split out the non-virtualization part of vmx_interrupt_blocked() (git-fixes).\n- KVM: VMX: Switch __vmx_exit() and kvm_x86_vendor_exit() in vmx_exit() (git-fixes).\n- KVM: x86: Limit check IDs for KVM_SET_BOOT_CPU_ID (git-fixes).\n- KVM: x86/mmu: Bug the VM if KVM tries to split a !hugepage SPTE (git-fixes).\n- libbpf: Add missing LIBBPF_API annotation to libbpf_set_memlock_rlim API (git-fixes).\n- libbpf: Apply map_set_def_max_entries() for inner_maps on creation (git-fixes).\n- libbpf: Fix faccessat() usage on Android (git-fixes).\n- libbpf: Use OPTS_SET() macro in bpf_xdp_query() (git-fixes).\n- md-cluster: fix hanging issue while a new disk adding (bsc#1223395).\n- md-cluster: fix hanging issue while a new disk adding (bsc#1223395).\n- md-cluster: fix no recovery job when adding/re-adding a disk (bsc#1223395).\n- md-cluster: fix no recovery job when adding/re-adding a disk (bsc#1223395).\n- md-cluster: keeping kabi compatibility for upstream commit 35a0a409fa26 (bsc#1223395).\n- md: add a mddev_add_trace_msg helper (git-fixes).\n- md: add check for sleepers in md_wakeup_thread() (git-fixes).\n- md: change the return value type of md_write_start to void (git-fixes).\n- md: do not account sync_io if iostats of the disk is disabled (git-fixes).\n- md: do not delete safemode_timer in mddev_suspend (git-fixes).\n- md: Do not wait for MD_RECOVERY_NEEDED for HOT_REMOVE_DISK ioctl (git-fixes).\n- md: factor out a helper exceed_read_errors() to check read_errors (git-fixes).\n- md: fix a suspicious RCU usage warning (git-fixes).\n- md/md-bitmap: fix writing non bitmap pages (git-fixes).\n- md/raid1: set max_sectors during early return from choose_slow_rdev() (git-fixes).\n- md/raid1: support read error check (git-fixes).\n- md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (git-fixes).\n- md/raid5: fix spares errors about rcu usage (git-fixes).\n- md/raid5: recheck if reshape has finished with device_lock held (git-fixes).\n- media: amphion: Remove lock in s_ctrl callback (stable-fixes).\n- media: drivers/media/dvb-core: copy user arrays safely (stable-fixes).\n- media: pci: cx23885: check cx23885_vdev_init() return (stable-fixes).\n- media: Revert 'media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()' (git-fixes).\n- media: uvcvideo: Add quirk for invalid dev_sof in Logitech C920 (git-fixes).\n- media: uvcvideo: Disable autosuspend for Insta360 Link (stable-fixes).\n- media: uvcvideo: Fix the bandwdith quirk on USB 3.x (stable-fixes).\n- media: uvcvideo: Ignore empty TS packets (stable-fixes).\n- media: uvcvideo: Quirk for invalid dev_sof in Logitech C922 (stable-fixes).\n- media: xc2028: avoid use-after-free in load_firmware_cb() (stable-fixes).\n- memcg: protect concurrent access to mem_cgroup_idr (git-fixes).\n- memory: stm32-fmc2-ebi: check regmap_read return value (stable-fixes).\n- memory: tegra: Skip SID programming if SID registers are not set (stable-fixes).\n- minmax: add a few more MIN_T/MAX_T users (bsc#1229024).\n- minmax: avoid overly complicated constant expressions in VM code (bsc#1229024).\n- minmax: do not use max() in situations that want a C constant expression (bsc#1229024).\n- minmax: fix up min3() and max3() too (bsc#1229024).\n- minmax: improve macro expansion and type checking (bsc#1229024).\n- minmax: make generic MIN() and MAX() macros available everywhere (bsc#1229024).\n- minmax: simplify and clarify min_t()/max_t() implementation (bsc#1229024).\n- minmax: simplify min()/max()/clamp() implementation (bsc#1229024).\n- mm, kmsan: fix infinite recursion due to RCU critical section (git-fixes).\n- mm: prevent derefencing NULL ptr in pfn_section_valid() (git-fixes).\n- mmc: dw_mmc: allow biu and ciu clocks to defer (git-fixes).\n- mmc: mmc_test: Fix NULL dereference on allocation failure (git-fixes).\n- mmc: mtk-sd: receive cmd8 data when hs400 tuning fail (git-fixes).\n- net: drop bad gso csum_start and offset in virtio_net_hdr (git-fixes).\n- net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb() (git-fixes).\n- net: fix sk_memory_allocated_{add|sub} vs softirqs (bsc#1228757).\n- net: mana: Add support for page sizes other than 4KB on ARM64 (jsc#PED-8491 bsc#1226530).\n- net: mana: Fix doorbell out of order violation and avoid unnecessary doorbell rings (bsc#1229154).\n- net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response (git-fixes).\n- net: mana: Fix RX buf alloc_size alignment and atomic op panic (bsc#1229086).\n- net: missing check virtio (git-fixes).\n- net: phy: micrel: Fix the KSZ9131 MDI-X status issue (git-fixes).\n- net: phy: realtek: add support for RTL8366S Gigabit PHY (git-fixes).\n- net: usb: qmi_wwan: fix memory leak for not ip packets (git-fixes).\n- net: usb: sr9700: fix uninitialized variable use in sr_mdio_read (git-fixes).\n- net/iucv: fix the allocation size of iucv_path_table array (git-fixes bsc#1229451).\n- net/iucv: fix use after free in iucv_sock_close() (bsc#1228973).\n- net/rds: fix possible cp null dereference (git-fixes).\n- net/sched: initialize noop_qdisc owner (git-fixes).\n- netfs, fscache: export fscache_put_volume() and add fscache_try_get_volume() (bsc#1228459 bsc#1228462).\n- nfc: pn533: Add poll mod list filling check (git-fixes).\n- nfs: do not invalidate dentries on transient errors (git-fixes).\n- nfs: expose /proc/net/sunrpc/nfs in net namespaces (git-fixes).\n- nfs: make the rpc_stat per net namespace (git-fixes).\n- nfs: pass explicit offset/count to trace events (git-fixes).\n- nfs: propagate readlink errors in nfs_symlink_filler (git-fixes).\n- NFSD: Support write delegations in LAYOUTGET (git-fixes).\n- NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (git-fixes).\n- nouveau/firmware: use dma non-coherent allocator (git-fixes).\n- nvme_core: scan namespaces asynchronously (bsc#1224105).\n- nvme-multipath: find NUMA path only for online numa-node (git-fixes).\n- nvme-multipath: implement 'queue-depth' iopolicy (bsc#1227706).\n- nvme-multipath: prepare for 'queue-depth' iopolicy (bsc#1227706).\n- nvme-pci: add missing condition check for existence of mapped data (git-fixes).\n- nvme-pci: do not directly handle subsys reset fallout (bsc#1220066).\n- nvme-pci: Fix the instructions for disabling power management (git-fixes).\n- nvme-sysfs: add 'tls_configured_key' sysfs attribute (bsc#1221857).\n- nvme-sysfs: add 'tls_keyring' attribute (bsc#1221857).\n- nvme-tcp: check for invalidated or revoked key (bsc#1221857).\n- nvme-tcp: sanitize TLS key handling (bsc#1221857).\n- nvme: add a newline to the 'tls_key' sysfs attribute (bsc#1221857).\n- nvme: adjust multiples of NVME_CTRL_PAGE_SIZE in offset (git-fixes).\n- nvme: avoid double free special payload (git-fixes).\n- nvme: fix NVME_NS_DEAC may incorrectly identifying the disk as EXT_LBA (git-fixes).\n- nvme: fixup comment for nvme RDMA Provider Type (git-fixes).\n- nvme: split off TLS sysfs attributes into a separate group (bsc#1221857).\n- nvme: tcp: remove unnecessary goto statement (bsc#1221857).\n- nvmet-auth: fix nvmet_auth hash error handling (git-fixes).\n- nvmet: always initialize cqe.result (git-fixes).\n- nvmet: do not return 'reserved' for empty TSAS values (git-fixes).\n- nvmet: fix a possible leak when destroy a ctrl during qp establishment (git-fixes).\n- nvmet: make 'tsas' attribute idempotent for RDMA (git-fixes).\n- ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry() (bsc#1228410).\n- padata: Fix possible divide-by-0 panic in padata_mt_helper() (git-fixes).\n- PCI: Add Edimax Vendor ID to pci_ids.h (stable-fixes).\n- PCI: hv: Return zero, not garbage, when reading PCI_INTERRUPT_PIN (git-fixes).\n- PCI: loongson: Enable MSI in LS7A Root Complex (stable-fixes).\n- perf/smmuv3: Enable HiSilicon Erratum 162001900 quirk for HIP08/09 (git-fixes).\n- pinctrl: mediatek: common-v2: Fix broken bias-disable for PULL_PU_PD_RSEL_TYPE (git-fixes).\n- pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B pins (git-fixes).\n- pinctrl: single: fix potential NULL dereference in pcs_get_function() (git-fixes).\n- pinctrl: starfive: jh7110: Correct the level trigger configuration of iev register (git-fixes).\n- platform/chrome: cros_ec_proto: Lock device when updating MKBP version (git-fixes).\n- platform/chrome: cros_ec_proto: Lock device when updating MKBP version (git-fixes).\n- platform/surface: aggregator: Fix warning when controller is destroyed in probe (git-fixes).\n- platform/x86: lg-laptop: fix %s null argument warning (stable-fixes).\n- platform/x86/amd/hsmp: Add support for ACPI based probing (jsc#PED-8779).\n- platform/x86/amd/hsmp: Cache pci_dev in struct hsmp_socket (jsc#PED-8779).\n- platform/x86/amd/hsmp: Change devm_kzalloc() to devm_kcalloc() (jsc#PED-8779).\n- platform/x86/amd/hsmp: Check HSMP support on AMD family of processors (jsc#PED-8779).\n- platform/x86/amd/hsmp: Check num_sockets against MAX_AMD_SOCKETS (jsc#PED-8779).\n- platform/x86/amd/hsmp: Create static func to handle platdev (jsc#PED-8779).\n- platform/x86/amd/hsmp: Define a struct to hold mailbox regs (jsc#PED-8779).\n- platform/x86/amd/hsmp: Move dev from platdev to hsmp_socket (jsc#PED-8779).\n- platform/x86/amd/hsmp: Move hsmp_test to probe (jsc#PED-8779).\n- platform/x86/amd/hsmp: Non-ACPI support for AMD F1A_M00~0Fh (jsc#PED-8779).\n- platform/x86/amd/hsmp: Remove extra parenthesis and add a space (jsc#PED-8779).\n- platform/x86/amd/hsmp: Restructure sysfs group creation (jsc#PED-8779).\n- platform/x86/amd/hsmp: switch to use device_add_groups() (jsc#PED-8779).\n- platform/x86/intel/ifs: Initialize union ifs_status to zero (git-fixes).\n- power: supply: axp288_charger: Fix constant_charge_voltage writes (git-fixes).\n- power: supply: axp288_charger: Round constant_charge_voltage writes down (git-fixes).\n- power: supply: qcom_battmgr: return EAGAIN when firmware service is not up (git-fixes).\n- powerpc: fix a file leak in kvm_vcpu_ioctl_enable_cap() (bsc#1194869).\n- powerpc: xor_vmx: Add '-mhard-float' to CFLAGS (bsc#1194869).\n- powerpc/64: Set _IO_BASE to POISON_POINTER_DELTA not 0 for CONFIG_PCI=n (bsc#1194869).\n- powerpc/io: Avoid clang null pointer arithmetic warnings (bsc#1194869).\n- powerpc/kexec_file: fix cpus node update to FDT (bsc#1194869).\n- powerpc/kexec: make the update_cpus_node() function public (bsc#1194869).\n- powerpc/kexec: split CONFIG_KEXEC_FILE and CONFIG_CRASH_DUMP (bsc#1194869).\n- powerpc/pseries: Add failure related checks for h_get_mpp and h_get_ppp (bsc#1194869).\n- powerpc/pseries: Whitelist dtl slub object for copying to userspace (bsc#1194869).\n- powerpc/radix: Move some functions into #ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE (bsc#1194869).\n- powerpc/topology: Check if a core is online (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588 git-fixes).\n- powerpc/xmon: Check cpu id in commands 'c#', 'dp#' and 'dx#' (bsc#1194869).\n- printk/panic: Allow cpu backtraces to be written into ringbuffer during panic (bsc#1225607).\n- RDMA: Fix netdev tracker in ib_device_set_netdev (git-fixes)\n- RDMA/cache: Release GID table even if leak is detected (git-fixes)\n- RDMA/device: Return error earlier if port in not valid (git-fixes)\n- RDMA/hns: Check atomic wr length (git-fixes)\n- RDMA/hns: Fix insufficient extend DB for VFs. (git-fixes)\n- RDMA/hns: Fix mbx timing out before CMD execution is completed (git-fixes)\n- RDMA/hns: Fix missing pagesize and alignment check in FRMR (git-fixes)\n- RDMA/hns: Fix shift-out-bounds when max_inline_data is 0 (git-fixes)\n- RDMA/hns: Fix soft lockup under heavy CEQE load (git-fixes)\n- RDMA/hns: Fix undifined behavior caused by invalid max_sge (git-fixes)\n- RDMA/hns: Fix unmatch exception handling when init eq table fails (git-fixes)\n- RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (git-fixes)\n- RDMA/mana_ib: Use virtual address in dma regions for MRs (git-fixes).\n- RDMA/mlx4: Fix truncated output warning in alias_GUID.c (git-fixes)\n- RDMA/mlx4: Fix truncated output warning in mad.c (git-fixes)\n- RDMA/mlx5: Set mkeys for dmabuf at PAGE_SIZE (git-fixes)\n- RDMA/rxe: Do not set BTH_ACK_MASK for UC or UD QPs (git-fixes)\n- reiserfs: fix uninit-value in comp_keys (git-fixes).\n- rtc: nct3018y: fix possible NULL dereference (stable-fixes).\n- s390/cpum_cf: Fix endless loop in CF_DIAG event stop (git-fixes bsc#1229171).\n- s390/dasd: fix error checks in dasd_copy_pair_store() (git-fixes bsc#1229173).\n- s390/dasd: fix error recovery leading to data corruption on ESE devices (git-fixes bsc#1229452).\n- s390/pci: Add missing virt_to_phys() for directed DIBV (git-fixes bsc#1229174).\n- s390/pci: Allow allocation of more than 1 MSI interrupt (git-fixes bsc#1229172).\n- s390/pci: Refactor arch_setup_msi_irqs() (git-fixes bsc#1229172).\n- s390/pkey: harmonize pkey s390 debug feature calls (bsc#1228720).\n- s390/pkey: introduce dynamic debugging for pkey (bsc#1228720).\n- s390/sclp: Prevent release of buffer in I/O (git-fixes bsc#1229169).\n- s390/uv: Panic for set and remove shared access UVC errors (git-fixes bsc#1229170).\n- samples/bpf: syscall_tp_user: Fix array out-of-bound access (git-fixes).\n- samples/bpf: syscall_tp_user: Rename num_progs into nr_tests (git-fixes).\n- sbitmap: use READ_ONCE to access map-\u003eword (stable-fixes).\n- scsi: lpfc: Allow DEVICE_RECOVERY mode after RSCN receipt if in PRLI_ISSUE state (bsc#1228857).\n- scsi: lpfc: Cancel ELS WQE instead of issuing abort when SLI port is inactive (bsc#1228857).\n- scsi: lpfc: Fix handling of fully recovered fabric node in dev_loss callbk (bsc#1228857).\n- scsi: lpfc: Fix incorrect request len mbox field when setting trunking via sysfs (bsc#1228857).\n- scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (bsc#1228857).\n- scsi: lpfc: Relax PRLI issue conditions after GID_FT response (bsc#1228857).\n- scsi: lpfc: Revise lpfc_prep_embed_io routine with proper endian macro usages (bsc#1228857).\n- scsi: lpfc: Update lpfc version to 14.4.0.3 (bsc#1228857).\n- scsi: qla2xxx: Avoid possible run-time warning with long model_num (bsc#1228850).\n- scsi: qla2xxx: Complete command early within lock (bsc#1228850).\n- scsi: qla2xxx: Convert comma to semicolon (bsc#1228850).\n- scsi: qla2xxx: Drop driver owner assignment (bsc#1228850).\n- scsi: qla2xxx: During vport delete send async logout explicitly (bsc#1228850).\n- scsi: qla2xxx: Fix debugfs output for fw_resource_count (bsc#1228850).\n- scsi: qla2xxx: Fix flash read failure (bsc#1228850).\n- scsi: qla2xxx: Fix for possible memory corruption (bsc#1228850).\n- scsi: qla2xxx: Fix optrom version displayed in FDMI (bsc#1228850).\n- scsi: qla2xxx: Indent help text (bsc#1228850).\n- scsi: qla2xxx: Reduce fabric scan duplicate code (bsc#1228850).\n- scsi: qla2xxx: Remove unused struct 'scsi_dif_tuple' (bsc#1228850).\n- scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for ELS cmds (bsc#1228850).\n- scsi: qla2xxx: Unable to act on RSCN for port online (bsc#1228850).\n- scsi: qla2xxx: Update version to 10.02.09.300-k (bsc#1228850).\n- scsi: qla2xxx: Use QP lock to search for bsg (bsc#1228850).\n- scsi: qla2xxx: validate nvme_local_port correctly (bsc#1228850).\n- selftest/bpf: Add map_in_maps with BPF_MAP_TYPE_PERF_EVENT_ARRAY values (git-fixes).\n- selftests/bpf: Add a test to verify previous stacksafe() fix (bsc#1225903).\n- selftests/bpf: Add assert for user stacks in test_task_stack (git-fixes).\n- selftests/bpf: Add netkit to tc_redirect selftest (git-fixes).\n- selftests/bpf: De-veth-ize the tc_redirect test case (git-fixes).\n- selftests/bpf: Disable IPv6 for lwt_redirect test (git-fixes).\n- selftests/bpf: fix bpf_loop_bench for new callback verification scheme (git-fixes).\n- selftests/bpf: fix compiler warnings in RELEASE=1 mode (git-fixes).\n- selftests/bpf: Fix erroneous bitmask operation (git-fixes).\n- selftests/bpf: Fix issues in setup_classid_environment() (git-fixes).\n- selftests/bpf: Fix potential premature unload in bpf_testmod (git-fixes).\n- selftests/bpf: Fix pyperf180 compilation failure with clang18 (git-fixes).\n- selftests/bpf: fix RELEASE=1 build for tc_opts (git-fixes).\n- selftests/bpf: Fix the flaky tc_redirect_dtime test (git-fixes).\n- selftests/bpf: Fix up xdp bonding test wrt feature flags (git-fixes).\n- selftests/bpf: Make linked_list failure test more robust (git-fixes).\n- selftests/bpf: Relax time_tai test for equal timestamps in tai_forward (git-fixes).\n- selftests/bpf: satisfy compiler by having explicit return in btf test (git-fixes).\n- selftests/bpf: Skip module_fentry_shadow test when bpf_testmod is not available (git-fixes).\n- selftests/bpf: Wait for the netstamp_needed_key static key to be turned on (git-fixes).\n- serial: core: check uartclk for zero to avoid divide by zero (stable-fixes).\n- soc: qcom: cmd-db: Map shared memory as WC, not WB (git-fixes).\n- soc: qcom: pmic_glink: Actually communicate when remote goes down (git-fixes).\n- soundwire: stream: fix programming slave ports for non-continous port maps (git-fixes).\n- spi: Add empty versions of ACPI functions (stable-fixes).\n- spi: microchip-core: fix init function not setting the master and motorola modes (git-fixes).\n- spi: microchip-core: switch to use modern name (stable-fixes).\n- spi: spi-fsl-lpspi: Fix scldiv calculation (git-fixes).\n- spi: spidev: Add missing spi_device_id for bh2228fv (git-fixes).\n- Squashfs: fix variable overflow triggered by sysbot (git-fixes).\n- squashfs: squashfs_read_data need to check if the length is 0 (git-fixes).\n- ssb: Fix division by zero issue in ssb_calc_clock_rate (stable-fixes).\n- staging: iio: resolver: ad2s1210: fix use before initialization (stable-fixes).\n- staging: ks7010: disable bh on tx_dev_lock (stable-fixes).\n- string.h: Introduce memtostr() and memtostr_pad() (bsc#1228849).\n- SUNRPC: add a missing rpc_stat for TCP TLS (git-fixes).\n- sunrpc: add a struct rpc_stats arg to rpc_create_args (git-fixes).\n- SUNRPC: Fix a race to wake a sync task (git-fixes).\n- swiotlb: do not set total_used to 0 in swiotlb_create_debugfs_files() (git-fixes).\n- swiotlb: fix swiotlb_bounce() to do partial sync's correctly (git-fixes).\n- syscalls: fix compat_sys_io_pgetevents_time64 usage (git-fixes).\n- thermal: bcm2835: Convert to platform remove callback returning void (stable-fixes).\n- thermal/drivers/broadcom: Fix race between removal and clock disable (git-fixes).\n- thunderbolt: Mark XDomain as unplugged when router is removed (stable-fixes).\n- tools/perf: Fix perf bench epoll to enable the run when some CPU's are offline (bsc#1227747).\n- tools/perf: Fix perf bench futex to enable the run when some CPU's are offline (bsc#1227747).\n- tools/perf: Fix timing issue with parallel threads in perf bench wake-up-parallel (bsc#1227747).\n- tools/resolve_btfids: fix build with musl libc (git-fixes).\n- tools/resolve_btfids: Fix comparison of distinct pointer types warning in resolve_btfids (git-fixes).\n- tools/resolve_btfids: Fix cross-compilation to non-host endianness (git-fixes).\n- tools/resolve_btfids: Refactor set sorting with types from btf_ids.h (git-fixes).\n- trace/pid_list: Change gfp flags in pid_list_fill_irq() (git-fixes).\n- tracing: Return from tracing_buffers_read() if the file has been closed (bsc#1229136 git-fixes).\n- tty: atmel_serial: use the correct RTS flag (git-fixes).\n- tty: serial: fsl_lpuart: mark last busy before uart_add_one_port (git-fixes).\n- usb: cdnsp: fix for Link TRB with TC (git-fixes).\n- usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function (git-fixes).\n- usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes() (git-fixes).\n- usb: dwc3: core: Skip setting event buffers for host only controllers (stable-fixes).\n- usb: dwc3: omap: add missing depopulate in probe error path (git-fixes).\n- usb: dwc3: st: add missing depopulate in probe error path (git-fixes).\n- usb: dwc3: st: fix probed platform device ref count on probe error path (git-fixes).\n- usb: gadget: core: Check for unset descriptor (git-fixes).\n- usb: gadget: fsl: Increase size of name buffer for endpoints (stable-fixes).\n- usb: gadget: u_audio: Check return codes from usb_ep_enable and config_ep_by_speed (git-fixes).\n- usb: gadget: u_serial: Set start_delayed during suspend (git-fixes).\n- usb: gadget: uvc: cleanup request when not in correct state (stable-fixes).\n- USB: serial: debug: do not echo input by default (stable-fixes).\n- usb: typec: fsa4480: add support for Audio Accessory Mode (git-fixes).\n- usb: typec: fsa4480: Add support to swap SBU orientation (git-fixes).\n- usb: typec: fsa4480: Check if the chip is really there (git-fixes).\n- usb: typec: fsa4480: Relax CHIP_ID check (git-fixes).\n- usb: typec: fsa4480: rework mux \u0026 switch setup to handle more states (git-fixes).\n- usb: vhci-hcd: Do not drop references before new references are gained (stable-fixes).\n- vfio/pci: fix potential memory leak in vfio_intx_enable() (git-fixes).\n- vhost-scsi: Handle vhost_vq_work_queue failures for events (git-fixes).\n- vhost-vdpa: switch to use vmf_insert_pfn() in the fault handler (git-fixes).\n- vhost: Release worker mutex during flushes (git-fixes).\n- vhost: Use virtqueue mutex for swapping worker (git-fixes).\n- vhost/vsock: always initialize seqpacket_allow (git-fixes).\n- virt: guest_memfd: fix reference leak on hwpoisoned page (git-fixes).\n- virtio_net: use u64_stats_t infra to avoid data-races (git-fixes).\n- virtio-crypto: handle config changed by work queue (git-fixes).\n- virtio: reenable config if freezing device failed (git-fixes).\n- virtiofs: forbid newlines in tags (bsc#1229940).\n- wifi: ath12k: fix memory leak in ath12k_dp_rx_peer_frag_setup() (stable-fixes).\n- wifi: ath12k: fix soft lockup on suspend (git-fixes).\n- wifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion (git-fixes).\n- wifi: cfg80211: fix reporting failed MLO links status with cfg80211_connect_done (git-fixes).\n- wifi: iwlwifi: fw: fix wgds rev 3 exact size (git-fixes).\n- wifi: mac80211: use monitor sdata with driver only if desired (git-fixes).\n- wifi: mwifiex: duplicate static structs used in driver instances (git-fixes).\n- wifi: nl80211: disallow setting special AP channel widths (stable-fixes).\n- wifi: nl80211: do not give key data to userspace (stable-fixes).\n- wifi: rtw88: usb: Fix disconnection after beacon loss (stable-fixes).\n- wifi: wfx: repair open network AP mode (git-fixes).\n- workqueue: Improve scalability of workqueue watchdog touch (bsc#1193454).\n- workqueue: wq_watchdog_touch is always called with valid CPU (bsc#1193454).\n- x86/asm: Use %c/%n instead of %P operand modifier in asm templates (git-fixes).\n- x86/entry/64: Remove obsolete comment on tracing vs. SYSRET (git-fixes).\n- x86/mm: Fix pti_clone_entry_text() for i386 (git-fixes).\n- x86/mm: Fix pti_clone_pgtable() alignment assumption (git-fixes).\n- x86/mtrr: Check if fixed MTRRs exist before saving them (git-fixes).\n- x86/numa: Fix SRAT lookup of CFMWS ranges with numa_fill_memblks() (git-fixes).\n- x86/numa: Fix the address overlap check in numa_fill_memblks() (git-fixes).\n- x86/numa: Fix the sort compare func used in numa_fill_memblks() (git-fixes).\n- x86/numa: Introduce numa_fill_memblks() (git-fixes).\n- x86/pci: Skip early E820 check for ECAM region (git-fixes).\n- x86/xen: Convert comma to semicolon (git-fixes).\n- xfs: allow cross-linking special files without project quota (git-fixes).\n- xfs: allow symlinks with short remote targets (bsc#1229160).\n- xfs: allow unlinked symlinks and dirs with zero size (git-fixes).\n- xfs: attr forks require attr, not attr2 (git-fixes).\n- xfs: convert comma to semicolon (git-fixes).\n- xfs: do not use current-\u003ejournal_info (git-fixes).\n- xfs: Fix missing interval for missing_owner in xfs fsmap (git-fixes).\n- xfs: Fix the owner setting issue for rmap query in xfs fsmap (git-fixes).\n- xfs: fix unlink vs cluster buffer instantiation race (git-fixes).\n- xfs: honor init_xattrs in xfs_init_new_inode for !ATTR fs (git-fixes).\n- xfs: journal geometry is not properly bounds checked (git-fixes).\n- xfs: match lock mode in xfs_buffered_write_iomap_begin() (git-fixes).\n- xfs: require XFS_SB_FEAT_INCOMPAT_LOG_XATTRS for attr log intent item recovery (git-fixes).\n- xfs: upgrade the extent counters in xfs_reflink_end_cow_extent later (git-fixes).\n- xfs: use consistent uid/gid when grabbing dquots for inodes (git-fixes).\n- xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code (git-fixes).\n- xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration (git-fixes).\n- xprtrdma: Fix rpcrdma_reqs_reset() (git-fixes).\n","status":"published","published":"2024-09-10T09:06:25Z","modified":"2026-02-04T02:14:25.258066Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3195-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.\n\nThe following security bugs were fixed:\n\n- CVE-2024-41062: Sync sock recv cb and release (bsc#1228576).\n- CVE-2023-52489: Fix race in accessing memory_section-\u003eusage (bsc#1221326).\n- CVE-2024-43821: Fix a possible null pointer dereference (bsc#1229315).\n- CVE-2024-43911: Fix NULL dereference at band check in starting tx ba session (bsc#1229827).\n- CVE-2024-42277: Avoid NULL deref in sprd_iommu_hw_en (bsc#1229409).\n- CVE-2024-43880: Put back removed metod in struct objagg_ops (bsc#1229481).\n- CVE-2024-43899: Fix null pointer deref in dcn20_resource.c (bsc#1229754).\n- CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)\n- CVE-2024-43866: Always drain health in shutdown callback (bsc#1229495).\n- CVE-2024-26812: Struct virqfd kABI workaround (bsc#1222808).\n- CVE-2024-27010: Fix mirred deadlock on device recursion (bsc#1223720).\n- CVE-2024-36881: Fix reset ptes when close() for wr-protected (bsc#1225718).\n- CVE-2024-42316: Fix div-by-zero in vmpressure_calc_level() (bsc#1229353).\n- CVE-2024-43855: Fix deadlock between mddev_suspend and flush bio (bsc#1229342).\n- CVE-2024-43864: Fix CT entry update leaks of modify header context (bsc#1229496).\n- CVE-2024-26631: Fix data-race in ipv6_mc_down / mld_ifc_work (bsc#1221630).\n- CVE-2024-42109: Unconditionally flush pending work before notifier (bsc#1228505).\n- CVE-2024-41084: Avoid null pointer dereference in region lookup (bsc#1228472).\n- CVE-2024-40905: Fix possible race in __fib6_drop_pcpu_from() (bsc#1227761)\n- CVE-2024-39489: Fix memleak in seg6_hmac_init_algo (bsc#1227623)\n- CVE-2024-36489: Fix missing memory barrier in tls_init (bsc#1226874)\n- CVE-2024-27079: Fix NULL domain on device release (bsc#1223742).\n- CVE-2024-41020: Fix fcntl/close race recovery compat path (bsc#1228427).\n- CVE-2024-35897: Discard table flag update with pending basechain deletion (bsc#1224510).\n- CVE-2024-27403: Restore const specifier in flow_offload_route_init() (bsc#1224415).\n- CVE-2024-27011: Fix memleak in map from abort path (bsc#1223803).\n- CVE-2024-26668: Reject configurations that cause integer overflow (bsc#1222335).\n- CVE-2024-26835: Set dormant flag on hook register failure (bsc#1222967).\n- CVE-2024-26808: Handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).\n- CVE-2024-26809: Release elements in clone only from destroy path (bsc#1222633).\n- CVE-2023-52581: Fix memleak when more than 255 elements expired (bsc#1220877).\n- CVE-2024-43837: Fix updating attached freplace prog in prog_array map (bsc#1229297).\n- CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure (bsc#1224535).\n- CVE-2024-42291: Add a per-VF limit on number of FDIR filters (bsc#1229374).\n- CVE-2024-42268: Fix missing lock on sync reset reload (bsc#1229391).\n- CVE-2024-43834: Fix invalid wait context of page_pool_destroy() (bsc#1229314)\n- CVE-2024-27433: Fix an error handling path in clk_mt8135_apmixed_probe() (bsc#1224711).\n- CVE-2024-36286: Acquire rcu_read_lock() in instance_destroy_rcu() (bsc#1226801)\n- CVE-2024-26851: Add protection for bmp length out of range (bsc#1223074)\n- CVE-2024-40920: Fix suspicious rcu usage in br_mst_set_state (bsc#1227781).\n- CVE-2024-40921: Pass vlan group directly to br_mst_vlan_set_state (bsc#1227784).\n- CVE-2024-36979: Fix vlan use-after-free (bsc#1226604).\n- CVE-2024-26590: Fix inconsistent per-file compression format (bsc#1220252).\n- CVE-2023-52859: Fix use-after-free when register pmu fails (bsc#1225582).\n- CVE-2024-42270: Fix null-ptr-deref in iptable_nat_table_init() (bsc#1229404).\n- CVE-2024-42269: Fix potential null-ptr-deref in ip6table_nat_table_init() (bsc#1229402).\n- CVE-2024-42284: Return non-zero value from tipc_udp_addr2str() on error (bsc#1229382)\n- CVE-2024-42283: Initialize all fields in dumped nexthops (bsc#1229383)\n- CVE-2024-42312: Always initialize i_uid/i_gid (bsc#1229357)\n- CVE-2024-43854: Initialize integrity buffer to zero before writing it to media (bsc#1229345)\n- CVE-2024-42322: Properly dereference pe in ip_vs_add_service (bsc#1229347)\n- CVE-2024-42290: Handle runtime power management correctly (bsc#1229379).\n- CVE-2024-42318: Do not lose track of restrictions on cred_transfer (bsc#1229351).\n- CVE-2023-52889: Fix null pointer deref when receiving skb during sock creation (bsc#1229287).\n- CVE-2024-42295: Handle inconsistent state in nilfs_btnode_create_block() (bsc#1229370).\n- CVE-2024-43850: Fix refcount imbalance seen during bwmon_remove (bsc#1229316).\n- CVE-2024-43831: Handle invalid decoder vsi (bsc#1229309).\n- CVE-2024-43839: Adjust 'name' buf size of bna_tcb and bna_ccb structures (bsc#1229301).\n- CVE-2024-41007: Use signed arithmetic in tcp_rtx_probe0_timed_out() (bsc#1227863).\n- CVE-2024-42281: Fix a segment issue when downgrading gso_size (bsc#1229386).\n- CVE-2024-26669: Fix chain template offload (bsc#1222350).\n- CVE-2024-26677: Blacklist e7870cf13d20 (' Fix delayed ACKs to not set the reference serial number') (bsc#1222387)\n- CVE-2024-41050: Cyclic allocation of msg_id to avoid reuse (bsc#1228499).\n- CVE-2024-41051: Wait for ondemand_object_worker to finish when dropping object (bsc#1228468).\n- CVE-2024-41074: Set object to close if ondemand_id \u003c 0 in copen (bsc#1228643).\n- CVE-2024-41075: Add consistency check for copen/cread (bsc#1228646).\n- CVE-2024-41012: Remove locks reliably when fcntl/close race is detected (bsc#1228247).\n- CVE-2024-41080: Fix possible deadlock in io_register_iowq_max_workers() (bsc#1228616).\n- CVE-2024-42246: Remap EPERM in case of connection failure in xs_tcp_setup_socket (bsc#1228989).\n- CVE-2024-42159: Fix sanitise num_phys (bsc#1228754).\n- CVE-2024-42241: Disable PMD-sized page cache if needed (bsc#1228986).\n- CVE-2024-42245: Revert 'sched/fair: Make sure to try to detach at least one movable task' (bsc#1228978).\n- CVE-2024-26735: Fix possible use-after-free and null-ptr-deref (bsc#1222372).\n- CVE-2024-26837: Race between creation of new group memberships and generation of the list of MDB events to replay (bsc#1222973).\n- CVE-2024-42155: Wipe copies of protected- and secure-keys (bsc#1228733).\n- CVE-2024-42156: Wipe copies of clear-key structures on failure (bsc#1228722).\n- CVE-2024-42157: Wipe sensitive data on failure (bsc#1228727).\n- CVE-2024-42158: Use kfree_sensitive() to fix Coccinelle warnings (bsc#1228720).\n- CVE-2024-38662: Cover verifier checks for mutating sockmap/sockhash (bsc#1226885).\n- CVE-2024-40938: Fix d_parent walk (bsc#1227840).\n- CVE-2024-42247: Avoid unaligned 64-bit memory accesses (bsc#1228988).\n- CVE-2024-41010: Fix too early release of tcx_entry (bsc#1228021).\n- CVE-2024-42106: Initialize pad field in struct inet_diag_req_v2 (bsc#1228493).\n- CVE-2024-42095: Fix Errata i2310 with RX FIFO level check (bsc#1228446).\n- CVE-2024-41068: Fix sclp_init() cleanup on failure (bsc#1228579).\n- CVE-2024-42138: Fix double memory deallocation in case of invalid INI file (bsc#1228500).\n- CVE-2024-42107: Do not process extts if PTP is disabled (bsc#1228494).\n- CVE-2024-42139: Fix improper extts handling (bsc#1228503).\n- CVE-2024-42110: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() (bsc#1228501).\n- CVE-2024-42113: Initialize num_q_vectors for MSI/INTx interrupts (bsc#1228568).\n- CVE-2024-42148: Fix multiple UBSAN array-index-out-of-bounds (bsc#1228487).\n- CVE-2024-42142: E-switch, Create ingress ACL when needed (bsc#1228491).\n- CVE-2024-42073: Fix memory corruptions on Spectrum-4 systems (bsc#1228457).\n- CVE-2024-42162: Account for stopped queues when reading NIC stats (bsc#1228706).\n- CVE-2024-42082: Remove WARN() from __xdp_reg_mem_model() (bsc#1228482).\n- CVE-2024-40978: Fix crash while reading debugfs attribute (bsc#1227929).\n- CVE-2024-41000: Prefer different overflow check (bsc#1227867).\n- CVE-2024-40995: Fix possible infinite loop in tcf_idr_check_alloc() (bsc#1227830).\n- CVE-2024-42161: Avoid uninitialized value in BPF_CORE_READ_BITFIELD (bsc#1228756).\n- CVE-2024-41069: Fix route memory corruption (bsc#1228644).\n- CVE-2024-39506: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet (bsc#1227729).\n- CVE-2024-42145: Implement a limit on UMAD receive List (bsc#1228743).\n- CVE-2024-40994: Fix integer overflow in max_vclocks_store (bsc#1227829).\n- CVE-2024-42124: Make qedf_execute_tmf() non-preemptible (bsc#1228705).\n- CVE-2024-42096: Stop playing stack games in profile_pc() (bsc#1228633).\n- CVE-2024-42224: Correct check for empty list (bsc#1228723).\n- CVE-2024-41048: Skip zero length skb in sk_msg_recvmsg (bsc#1228565).\n- CVE-2024-40958: Make get_net_ns() handle zero refcount net (bsc#1227812).\n- CVE-2024-40939: Fix tainted pointer delete is case of region creation fail (bsc#1227799).\n- CVE-2024-36933: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (bsc#1225832).\n- CVE-2024-36929: Reject skb_copy(_expand) for fraglist GSO skbs (bsc#1225814).\n- CVE-2024-41044: Reject claimed-as-LCP but actually malformed packets (bsc#1228530).\n- CVE-2024-41066: Add tx check to prevent skb leak (bsc#1228640).\n- CVE-2024-42093: Avoid explicit cpumask var allocation on stack (bsc#1228680).\n- CVE-2024-42122: Add NULL pointer check for kzalloc (bsc#1228591).\n- CVE-2024-41078: Fix quota root leak after quota disable failure (bsc#1228655).\n- CVE-2024-40989: Disassociate vcpus from redistributor region on teardown (bsc#1227823).\n- CVE-2024-41064: Avoid possible crash when edev-\u003epdev changes (bsc#1228599).\n- CVE-2024-41036: Fix deadlock with the SPI chip variant (bsc#1228496).\n- CVE-2024-41040: Fix UAF when resolving a clash (bsc#1228518).\n- CVE-2024-35949: Make sure that WRITTEN is set on all metadata blocks (bsc#1224700).\n- CVE-2024-41081: Block BH in ila_output() (bsc#1228617).\n- CVE-2024-41076: Fix memory leak in nfs4_set_security_label (bsc#1228649).\n- CVE-2024-42079: Fix NULL pointer dereference in gfs2_log_flush (bsc#1228672).\n- CVE-2024-41057: Fix slab-use-after-free in cachefiles_withdraw_cookie() (bsc#1228462).\n- CVE-2024-41058: Fix slab-use-after-free in fscache_withdraw_volume() (bsc#1228459).\n- CVE-2024-41015: Add bounds checking to ocfs2_check_dir_entry() (bsc#1228409).\n- CVE-2024-40956: Fix possible Use-After-Free in irq_process_work_list (bsc#1227810).\n- CVE-2024-27437: Disable auto-enable of exclusive INTx IRQ (bsc#1222625).\n- CVE-2024-41032: Check if a hash-index is in cpu_possible_mask (bsc#1228460).\n- CVE-2024-40957: Fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors (bsc#1227811).\n- CVE-2024-41041: Set SOCK_RCU_FREE earlier in udp_lib_get_port() (bsc#1228520).\n- CVE-2024-40954: Do not leave a dangling sk pointer, when socket creation fails (bsc#1227808)\n- CVE-2024-42070: Fully validate NFT_DATA_VALUE on store to data registers (bsc#1228470).\n- CVE-2024-41070: Prevent UAF in kvm_spapr_tce_attach_iommu_group() (bsc#1228581).\n- CVE-2024-40959: Check ip6_dst_idev() return value in xfrm6_get_saddr() (bsc#1227884).\n- CVE-2024-41009: Fix overrunning reservations in ringbuf (bsc#1228020).\n- CVE-2024-40909: Fix a potential use-after-free in bpf_link_free() (bsc#1227798).\n- CVE-2024-27024: Fix WARNING in rds_conn_connect_if_down (bsc#1223777).\n\nThe following non-security bugs were fixed:\n\n- ACPI: battery: create alarm sysfs attribute atomically (stable-fixes).\n- ACPI: processor_idle: use raw_safe_halt() in acpi_idle_play_dead() (git-fixes).\n- ACPI: SBS: manage alarm sysfs attribute through psy core (stable-fixes).\n- ACPI/NUMA: Apply SRAT proximity domain to entire CFMWS window (git-fixes).\n- afs: fix __afs_break_callback() / afs_drop_open_mmap() race (git-fixes).\n- ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list (stable-fixes).\n- ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list (stable-fixes).\n- ALSA: hda: Conditionally use snooping for AMD HDMI (git-fixes).\n- ALSA: hda: conexant: Fix headset auto detect fail in the polling mode (git-fixes).\n- ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4 (stable-fixes).\n- ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4 (stable-fixes).\n- ALSA: hda/realtek - Fixed ALC256 headphone no sound (stable-fixes).\n- ALSA: hda/realtek - FIxed ALC285 headphone no sound (stable-fixes).\n- ALSA: hda/realtek: Add Framework Laptop 13 (Intel Core Ultra) to quirks (stable-fixes).\n- ALSA: hda/realtek: Add Framework Laptop 13 (Intel Core Ultra) to quirks (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Acer Aspire E5-574G (stable-fixes).\n- ALSA: hda/realtek: Add support for new HP G12 laptops (stable-fixes).\n- ALSA: hda/realtek: Enable mute/micmute LEDs on HP Laptop 14-ey0xxx (stable-fixes).\n- ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7 (git-fixes).\n- ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book3 Ultra (stable-fixes).\n- ALSA: hda/realtek: Implement sound init sequence for Samsung Galaxy Book3 Pro 360 (stable-fixes).\n- ALSA: hda/realtek: support HP Pavilion Aero 13-bg0xxx Mute LED (stable-fixes).\n- ALSA: hda/tas2781: fix wrong calibrated data order (git-fixes).\n- ALSA: hda/tas2781: Use correct endian conversion (git-fixes).\n- ALSA: line6: Fix racy access to midibuf (stable-fixes).\n- ALSA: line6: Fix racy access to midibuf (stable-fixes).\n- ALSA: seq: Skip event type filtering for UMP events (git-fixes).\n- ALSA: seq: ump: Explicitly reset RPN with Null RPN (stable-fixes).\n- ALSA: seq: ump: Optimize conversions from SysEx to UMP (git-fixes).\n- ALSA: seq: ump: Transmit RPN/NRPN message at each MSB/LSB data reception (stable-fixes).\n- ALSA: seq: ump: Use the common RPN/bank conversion context (stable-fixes).\n- ALSA: timer: Relax start tick time check for slave timer elements (git-fixes).\n- ALSA: ump: Explicitly reset RPN with Null RPN (stable-fixes).\n- ALSA: ump: Transmit RPN/NRPN message at each MSB/LSB data reception (stable-fixes).\n- ALSA: usb-audio: Add delay quirk for VIVO USB-C-XE710 HEADSET (stable-fixes).\n- ALSA: usb-audio: Correct surround channels in UAC1 channel map (git-fixes).\n- ALSA: usb-audio: Re-add ScratchAmp quirk entries (git-fixes).\n- ALSA: usb-audio: Re-add ScratchAmp quirk entries (git-fixes).\n- ALSA: usb-audio: Support Yamaha P-125 quirk entry (stable-fixes).\n- ALSA: usb: Fix UBSAN warning in parse_audio_unit() (stable-fixes).\n- apparmor: unpack transition table if dfa is not present (bsc#1226031).\n- arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to (git-fixes)\n- arm64: Add Neoverse-V2 part (git-fixes)\n- arm64: armv8_deprecated: Fix warning in isndep cpuhp starting process (git-fixes)\n- arm64: barrier: Restore spec_bar() macro (git-fixes)\n- arm64: cputype: Add Cortex-A720 definitions (git-fixes)\n- arm64: cputype: Add Cortex-A725 definitions (git-fixes)\n- arm64: cputype: Add Cortex-X1C definitions (git-fixes)\n- arm64: cputype: Add Cortex-X3 definitions (git-fixes)\n- arm64: cputype: Add Cortex-X4 definitions (git-fixes)\n- arm64: cputype: Add Cortex-X925 definitions (git-fixes)\n- arm64: cputype: Add Neoverse-V3 definitions (git-fixes)\n- arm64: dts: imx8mp: add HDMI power-domains (git-fixes)\n- arm64: dts: imx8mp: Add NPU Node (git-fixes)\n- arm64: dts: imx8mp: Fix pgc vpu locations (git-fixes)\n- arm64: dts: imx8mp: Fix pgc_mlmix location (git-fixes)\n- arm64: errata: Expand speculative SSBS workaround (again) (git-fixes)\n- arm64: errata: Expand speculative SSBS workaround (git-fixes)\n- arm64: errata: Unify speculative SSBS errata logic (git-fixes). Update config files.\n- arm64: Fix KASAN random tag seed initialization (git-fixes)\n- arm64: jump_label: Ensure patched jump_labels are visible to all CPUs (git-fixes)\n- ASoC: allow module autoloading for table board_ids (stable-fixes).\n- ASoC: allow module autoloading for table db1200_pids (stable-fixes).\n- ASoC: amd: acp: fix module autoloading (git-fixes).\n- ASoC: amd: yc: Add quirk entry for OMEN by HP Gaming Laptop 16-n0xxx (bsc#1227182).\n- ASoC: amd: yc: Support mic on HP 14-em0002la (stable-fixes).\n- ASoC: amd: yc: Support mic on HP 14-em0002la (stable-fixes).\n- ASoC: amd: yc: Support mic on Lenovo Thinkpad E14 Gen 6 (stable-fixes).\n- ASoC: amd: yc: Support mic on Lenovo Thinkpad E14 Gen 6 (stable-fixes).\n- ASoC: codecs: wcd938x-sdw: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wcd938x-sdw: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa881x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa881x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa883x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa883x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa884x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa884x: Correct Soundwire ports mask (git-fixes).\n- ASoC: cs35l45: Checks index of cs35l45_irqs[] (stable-fixes).\n- ASoC: cs35l56: Handle OTP read latency over SoundWire (stable-fixes).\n- ASoC: cs35l56: Handle OTP read latency over SoundWire (stable-fixes).\n- ASoC: cs35l56: Patch CS35L56_IRQ1_MASK_18 to the default value (stable-fixes).\n- ASoC: cs35l56: Patch CS35L56_IRQ1_MASK_18 to the default value (stable-fixes).\n- ASoC: fsl_micfil: Expand the range of FIFO watermark mask (stable-fixes).\n- ASoC: fsl_micfil: Expand the range of FIFO watermark mask (stable-fixes).\n- ASoC: mediatek: mt8188: Mark AFE_DAC_CON0 register as volatile (stable-fixes).\n- ASoC: meson: axg-fifo: fix irq scheduling issue with PREEMPT_RT (git-fixes).\n- ASoC: meson: axg-fifo: fix irq scheduling issue with PREEMPT_RT (git-fixes).\n- ASoC: nau8822: Lower debug print priority (stable-fixes).\n- ASoC: nau8822: Lower debug print priority (stable-fixes).\n- ASoC: SOF: amd: Fix for acp init sequence (git-fixes).\n- ASoC: SOF: Intel: hda-dsp: Make sure that no irq handler is pending before suspend (stable-fixes).\n- ASoC: SOF: ipc4: check return value of snd_sof_ipc_msg_data (stable-fixes).\n- ASoC: SOF: mediatek: Add missing board compatible (stable-fixes).\n- ASoC: SOF: Remove libraries from topology lookups (git-fixes).\n- ASoC: SOF: Remove libraries from topology lookups (git-fixes).\n- ata: libata-scsi: Do not overwrite valid sense data when CK_COND=1 (stable-fixes).\n- ata: libata-scsi: Honor the D_SENSE bit for CK_COND=1 and no error (stable-fixes).\n- Bluetooth: Add device 13d3:3572 IMC Networks Bluetooth Radio (stable-fixes).\n- Bluetooth: bnep: Fix out-of-bound access (stable-fixes).\n- Bluetooth: btintel: Fail setup on error (git-fixes).\n- Bluetooth: btnxpuart: Shutdown timer and prevent rearming when driver unloading (stable-fixes).\n- Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x13d3:0x3591 (stable-fixes).\n- Bluetooth: btusb: Add RTL8852BE device 0489:e125 to device tables (stable-fixes).\n- Bluetooth: Fix usage of __hci_cmd_sync_status (git-fixes).\n- Bluetooth: hci_conn: Check non NULL function before calling for HFP offload (stable-fixes).\n- Bluetooth: hci_core: Fix LE quote calculation (git-fixes).\n- Bluetooth: hci_core: Fix not handling hibernation actions (git-fixes).\n- Bluetooth: hci_sync: avoid dup filtering when passive scanning with adv monitor (git-fixes).\n- Bluetooth: hci_sync: Fix suspending with wrong filter policy (git-fixes).\n- Bluetooth: l2cap: always unlock channel in l2cap_conless_channel() (git-fixes).\n- Bluetooth: L2CAP: Fix deadlock (git-fixes).\n- Bluetooth: MGMT: Add error handling to pair_device() (git-fixes).\n- Bluetooth: SMP: Fix assumption of Central always being Initiator (git-fixes).\n- bnxt_re: Fix imm_data endianness (git-fixes)\n- bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG (git-fixes)\n- bpf, lpm: Fix check prefixlen before walking trie (git-fixes).\n- bpf: Add crosstask check to __bpf_get_stack (git-fixes).\n- bpf: Detect IP == ksym.end as part of BPF program (git-fixes).\n- bpf: do not infer PTR_TO_CTX for programs with unnamed context type (git-fixes).\n- bpf: enforce precision of R0 on callback return (git-fixes).\n- bpf: Ensure proper register state printing for cond jumps (git-fixes).\n- bpf: extract bpf_ctx_convert_map logic and make it more reusable (git-fixes).\n- bpf: Fix a few selftest failures due to llvm18 change (git-fixes).\n- bpf: Fix a kernel verifier crash in stacksafe() (bsc#1225903).\n- bpf: Fix check_stack_write_fixed_off() to correctly spill imm (git-fixes).\n- bpf: fix control-flow graph checking in privileged mode (git-fixes).\n- bpf: Fix kfunc callback register type handling (git-fixes).\n- bpf: Fix prog_array_map_poke_run map poke update (git-fixes).\n- bpf: Fix unnecessary -EBUSY from htab_lock_bucket (git-fixes).\n- bpf: handle bpf_user_pt_regs_t typedef explicitly for PTR_TO_CTX global arg (git-fixes).\n- bpf: hardcode BPF_PROG_PACK_SIZE to 2MB * num_possible_nodes() (git-fixes).\n- bpf: kprobe: remove unused declaring of bpf_kprobe_override (git-fixes).\n- bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly (git-fixes).\n- bpf: Remove unnecessary wait from bpf_map_copy_value() (git-fixes).\n- bpf: Set uattr-\u003ebatch.count as zero before batched update or deletion (git-fixes).\n- bpf: simplify btf_get_prog_ctx_type() into btf_is_prog_ctx_type() (git-fixes).\n- bpf/tests: Remove duplicate JSGT tests (git-fixes).\n- bpftool: Align output skeleton ELF code (git-fixes).\n- bpftool: Fix -Wcast-qual warning (git-fixes).\n- bpftool: mark orphaned programs during prog show (git-fixes).\n- bpftool: Silence build warning about calloc() (git-fixes).\n- btrfs: add a btrfs_finish_ordered_extent helper (git-fixes).\n- btrfs: add a is_data_bbio helper (git-fixes).\n- btrfs: add an ordered_extent pointer to struct btrfs_bio (git-fixes).\n- btrfs: copy dir permission and time when creating a stub subvolume (bsc#1228321).\n- btrfs: ensure fast fsync waits for ordered extents after a write failure (git-fixes).\n- btrfs: factor out a btrfs_queue_ordered_fn helper (git-fixes).\n- btrfs: factor out a can_finish_ordered_extent helper (git-fixes).\n- btrfs: fix corruption after buffer fault in during direct IO append write (git-fixes).\n- btrfs: fix double inode unlock for direct IO sync writes (git-fixes).\n- btrfs: fix extent map use-after-free when adding pages to compressed bio (git-fixes).\n- btrfs: fix leak of qgroup extent records after transaction abort (git-fixes).\n- btrfs: fix ordered extent split error handling in btrfs_dio_submit_io (git-fixes).\n- btrfs: limit write bios to a single ordered extent (git-fixes).\n- btrfs: make btrfs_finish_ordered_extent() return void (git-fixes).\n- btrfs: merge the two calls to btrfs_add_ordered_extent in run_delalloc_nocow (git-fixes).\n- btrfs: open code btrfs_bio_end_io in btrfs_dio_submit_io (git-fixes).\n- btrfs: open code end_extent_writepage in end_bio_extent_writepage (git-fixes).\n- btrfs: pass a btrfs_inode to btrfs_fdatawrite_range() (git-fixes).\n- btrfs: pass a btrfs_inode to btrfs_wait_ordered_range() (git-fixes).\n- btrfs: pass an ordered_extent to btrfs_reloc_clone_csums (git-fixes).\n- btrfs: pass an ordered_extent to btrfs_submit_compressed_write (git-fixes).\n- btrfs: remove btrfs_add_ordered_extent (git-fixes).\n- btrfs: rename err to ret in btrfs_direct_write() (git-fixes).\n- btrfs: uninline some static inline helpers from tree-log.h (git-fixes).\n- btrfs: use a btrfs_inode in the log context (struct btrfs_log_ctx) (git-fixes).\n- btrfs: use a btrfs_inode local variable at btrfs_sync_file() (git-fixes).\n- btrfs: use bbio-\u003eordered in btrfs_csum_one_bio (git-fixes).\n- btrfs: use btrfs_finish_ordered_extent to complete buffered writes (git-fixes).\n- btrfs: use btrfs_finish_ordered_extent to complete compressed writes (git-fixes).\n- btrfs: use btrfs_finish_ordered_extent to complete direct writes (git-fixes).\n- btrfs: use irq safe locking when running and adding delayed iputs (git-fixes).\n- cachefiles, erofs: Fix NULL deref in when cachefiles is not doing ondemand-mode (bsc#1229245).\n- cachefiles: add missing lock protection when polling (bsc#1229256).\n- cachefiles: add restore command to recover inflight ondemand read requests (bsc#1229244).\n- cachefiles: add spin_lock for cachefiles_ondemand_info (bsc#1229249).\n- cachefiles: cancel all requests for the object that is being dropped (bsc#1229255).\n- cachefiles: defer exposing anon_fd until after copy_to_user() succeeds (bsc#1229251).\n- cachefiles: extract ondemand info field from cachefiles_object (bsc#1229240).\n- cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read() (bsc#1229247).\n- cachefiles: fix slab-use-after-free in cachefiles_ondemand_get_fd() (bsc#1229246).\n- cachefiles: introduce object ondemand state (bsc#1229239).\n- cachefiles: make on-demand read killable (bsc#1229252).\n- cachefiles: narrow the scope of triggering EPOLLIN events in ondemand mode (bsc#1229243).\n- cachefiles: never get a new anonymous fd if ondemand_id is valid (bsc#1229250).\n- cachefiles: propagate errors from vfs_getxattr() to avoid infinite loop (bsc#1229253).\n- cachefiles: remove err_put_fd label in cachefiles_ondemand_daemon_read() (bsc#1229248).\n- cachefiles: resend an open request if the read request's object is closed (bsc#1229241).\n- cachefiles: stop sending new request when dropping object (bsc#1229254).\n- can: mcp251xfd: tef: prepare to workaround broken TEF FIFO tail index erratum (stable-fixes).\n- can: mcp251xfd: tef: update workaround for erratum DS80000789E 6 of mcp2518fd (stable-fixes).\n- ceph: periodically flush the cap releases (bsc#1230056).\n- certs: Move RSA self-test data to separate file (bsc#1222777).\n- cgroup: Add annotation for holding namespace_sem in current_cgns_cgroup_from_root() (bsc#1222254).\n- cgroup: Eliminate the need for cgroup_mutex in proc_cgroup_show() (bsc#1222254).\n- cgroup: Make operations on the cgroup root_list RCU safe (bsc#1222254).\n- cgroup: preserve KABI of cgroup_root (bsc#1222254).\n- cgroup: Remove unnecessary list_empty() (bsc#1222254).\n- cgroup/cpuset: Prevent UAF in proc_cpuset_show() (bsc#1228801).\n- char: xillybus: Check USB endpoints when probing device (git-fixes).\n- char: xillybus: Do not destroy workqueue from work item running on it (stable-fixes).\n- char: xillybus: Refine workqueue handling (git-fixes).\n- clk: en7523: fix rate divider for slic and spi clocks (git-fixes).\n- clk: qcom: camcc-sc7280: Add parent dependency to all camera GDSCs (git-fixes).\n- clk: qcom: gcc-sa8775p: Update the GDSC wait_val fields and flags (git-fixes).\n- clk: qcom: gcc-sc7280: Update force mem core bit for UFS ICE clock (git-fixes).\n- clk: qcom: gpucc-sa8775p: Park RCG's clk source at XO during disable (git-fixes).\n- clk: qcom: gpucc-sa8775p: Remove the CLK_IS_CRITICAL and ALWAYS_ON flags (git-fixes).\n- clk: qcom: gpucc-sa8775p: Update wait_val fields for GPU GDSC's (git-fixes).\n- clk: qcom: gpucc-sm8350: Park RCG's clk source at XO during disable (git-fixes).\n- clk: qcom: kpss-xcc: Return of_clk_add_hw_provider to transfer the error (git-fixes).\n- clk: qcom: Park shared RCGs upon registration (git-fixes).\n- clk: visconti: Add bounds-checking coverage for struct visconti_pll_provider (stable-fixes).\n- clocksource/drivers/sh_cmt: Address race condition for clock events (stable-fixes).\n- cpu/SMT: Enable SMT only if a core is online (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588 git-fixes).\n- cxl/region: Move cxl_dpa_to_region() work to the region driver (bsc#1228472)\n- dev/parport: fix the array out-of-bounds risk (stable-fixes).\n- device property: Add cleanup.h based fwnode_handle_put() scope based cleanup (stable-fixes).\n- dmaengine: dw: Add memory bus width verification (git-fixes).\n- dmaengine: dw: Add peripheral bus width verification (git-fixes).\n- docs: KVM: Fix register ID of SPSR_FIQ (git-fixes).\n- driver core: Fix uevent_show() vs driver detach race (git-fixes).\n- drm/admgpu: fix dereferencing null pointer context (stable-fixes).\n- drm/amd/display: Add delay to improve LTTPR UHBR interop (stable-fixes).\n- drm/amd/display: Add NULL check for 'afb' before dereferencing in amdgpu_dm_plane_handle_cursor_update (stable-fixes).\n- drm/amd/display: Add null checker before passing variables (stable-fixes).\n- drm/amd/display: Adjust cursor position (git-fixes).\n- drm/amd/display: avoid using null object of framebuffer (git-fixes).\n- drm/amd/display: Check for NULL pointer (stable-fixes).\n- drm/amd/display: fix cursor offset on rotation 180 (git-fixes).\n- drm/amd/display: fix s2idle entry for DCN3.5+ (stable-fixes).\n- drm/amd/display: Skip Recompute DSC Params if no Stream on Link (stable-fixes).\n- drm/amd/pm: Fix the null pointer dereference for vega10_hwmgr (stable-fixes).\n- drm/amdgpu: Actually check flags for all context ops (stable-fixes).\n- drm/amdgpu: Add lock around VF RLCG interface (stable-fixes).\n- drm/amdgpu: fix dereference null return value for the function amdgpu_vm_pt_parent (stable-fixes).\n- drm/amdgpu: fix potential resource leak warning (stable-fixes).\n- drm/amdgpu: Fix the null pointer dereference to ras_manager (stable-fixes).\n- drm/amdgpu: Forward soft recovery errors to userspace (stable-fixes).\n- drm/amdgpu: reset vm state machine after gpu reset(vram lost) (stable-fixes).\n- drm/amdgpu: Validate TA binary size (stable-fixes).\n- drm/amdgpu/jpeg2: properly set atomics vmid field (stable-fixes).\n- drm/amdgpu/jpeg4: properly set atomics vmid field (stable-fixes).\n- drm/amdgpu/pm: Fix the null pointer dereference for smu7 (stable-fixes).\n- drm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rules (stable-fixes).\n- drm/amdgpu/pm: Fix the param type of set_power_profile_mode (stable-fixes).\n- drm/amdgpu/sdma5.2: limit wptr workaround to sdma 5.2.1 (git-fixes).\n- drm/amdgpu/sdma5.2: Update wptr registers as well as doorbell (stable-fixes).\n- drm/bridge: analogix_dp: properly handle zero sized AUX transactions (stable-fixes).\n- drm/client: fix null pointer dereference in drm_client_modeset_probe (git-fixes).\n- drm/dp_mst: Skip CSN if topology probing is not done yet (stable-fixes).\n- drm/etnaviv: do not block scheduler when GPU is still active (stable-fixes).\n- drm/i915: Fix possible int overflow in skl_ddi_calculate_wrpll() (git-fixes).\n- drm/i915/dsi: Make Lenovo Yoga Tab 3 X90F DMI match less strict (git-fixes).\n- drm/i915/gem: Adjust vma offset for framebuffer mmap offset (stable-fixes).\n- drm/i915/gem: Fix Virtual Memory mapping boundaries calculation (git-fixes).\n- drm/i915/hdcp: Fix HDCP2_STREAM_STATUS macro (git-fixes).\n- drm/lima: set gp bus_stop bit before hard reset (stable-fixes).\n- drm/mediatek/dp: Fix spurious kfree() (git-fixes).\n- drm/msm: Reduce fallout of fence signaling vs reclaim hangs (stable-fixes).\n- drm/msm/dp: fix the max supported bpp logic (git-fixes).\n- drm/msm/dp: reset the link phy params before link training (git-fixes).\n- drm/msm/dpu: capture snapshot on the first commit_done timeout (stable-fixes).\n- drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails (git-fixes).\n- drm/msm/dpu: do not play tricks with debug macros (git-fixes).\n- drm/msm/dpu: drop MSM_ENC_VBLANK support (stable-fixes).\n- drm/msm/dpu: move dpu_encoder's connector assignment to atomic_enable() (git-fixes).\n- drm/msm/dpu: split dpu_encoder_wait_for_event into two functions (stable-fixes).\n- drm/msm/dpu: take plane rotation into account for wide planes (git-fixes).\n- drm/msm/dpu: try multirect based on mdp clock limits (stable-fixes).\n- drm/msm/dpu: use drmm-managed allocation for dpu_encoder_phys (stable-fixes).\n- drm/msm/mdss: Rename path references to mdp_path (stable-fixes).\n- drm/msm/mdss: switch mdss to use devm_of_icc_get() (stable-fixes).\n- drm/nouveau: prime: fix refcount underflow (git-fixes).\n- drm/panel: nt36523: Set 120Hz fps for xiaomi,elish panels (stable-fixes).\n- drm/radeon: Remove __counted_by from StateArray.states[] (git-fixes).\n- drm/radeon/evergreen_cs: Clean up errors in evergreen_cs.c (bsc#1229024).\n- drm/rockchip: vop2: clear afbc en and transform bit for cluster window at linear mode (stable-fixes).\n- drm/virtio: Fix type of dma-fence context variable (git-fixes).\n- drm/vmwgfx: Fix a deadlock in dma buf fence polling (git-fixes).\n- drm/vmwgfx: Fix overlay when using Screen Targets (git-fixes).\n- drm/vmwgfx: Fix prime with external buffers (git-fixes).\n- efi/libstub: Zero initialize heap allocated struct screen_info (git-fixes).\n- evm: do not copy up 'security.evm' xattr (git-fixes).\n- firmware: cirrus: cs_dsp: Initialize debugfs_root to invalid (stable-fixes).\n- fs/netfs/fscache_cookie: add missing 'n_accesses' check (bsc#1229455).\n- fuse: Initialize beyond-EOF page contents before setting uptodate (bsc#1229456).\n- genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline (git-fixes).\n- genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware (git-fixes).\n- genirq/matrix: Exclude managed interrupts in irq_matrix_allocated() (git-fixes).\n- gfs2: setattr_chown: Add missing initialization (git-fixes).\n- gpio: mlxbf3: Support shutdown() function (git-fixes).\n- gpio: prevent potential speculation leaks in gpio_device_get_desc() (stable-fixes).\n- gpio: sysfs: extend the critical section for unregistering sysfs devices (stable-fixes).\n- gss_krb5: Fix the error handling path for crypto_sync_skcipher_setkey (git-fixes).\n- hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode() (git-fixes).\n- HID: wacom: Defer calculation of resolution until resolution_code is known (git-fixes).\n- hwmon: (ltc2992) Avoid division by zero (stable-fixes).\n- hwmon: (ltc2992) Fix memory leak in ltc2992_parse_dt() (git-fixes).\n- hwmon: (pc87360) Bounds check data-\u003einnr usage (stable-fixes).\n- i2c: Fix conditional for substituting empty ACPI functions (stable-fixes).\n- i2c: qcom-geni: Add missing clk_disable_unprepare in geni_i2c_runtime_resume (git-fixes).\n- i2c: qcom-geni: Add missing geni_icc_disable in geni_i2c_runtime_resume (git-fixes).\n- i2c: qcom-geni: Add missing geni_icc_disable in geni_i2c_runtime_resume (git-fixes).\n- i2c: riic: avoid potential division by zero (stable-fixes).\n- i2c: smbus: Improve handling of stuck alerts (git-fixes).\n- i2c: smbus: Send alert notifications to all devices if source not found (git-fixes).\n- i2c: stm32f7: Add atomic_xfer method to driver (stable-fixes).\n- i2c: Use IS_REACHABLE() for substituting empty ACPI functions (git-fixes).\n- i3c: mipi-i3c-hci: Do not unmap region not mapped for transfer (stable-fixes).\n- i3c: mipi-i3c-hci: Remove BUG() when Ring Abort request times out (stable-fixes).\n- i915/perf: Remove code to update PWR_CLK_STATE for gen12 (git-fixes).\n- ice: Fix NULL pointer access, if PF does not support SRIOV_LAG (bsc#1228737).\n- Input: i8042 - add forcenorestore quirk to leave controller untouched even on s3 (stable-fixes).\n- Input: i8042 - add Fujitsu Lifebook E756 to i8042 quirk table (bsc#1229056).\n- Input: i8042 - use new forcenorestore quirk to replace old buggy quirk combination (stable-fixes).\n- Input: MT - limit max slots (stable-fixes).\n- io_uring: Drop per-ctx dummy_ubuf (git-fixes).\n- io_uring: fix io_match_task must_hold (git-fixes).\n- io_uring: Fix probe of disabled operations (git-fixes).\n- io_uring: tighten task exit cancellations (git-fixes).\n- io_uring/advise: support 64-bit lengths (git-fixes).\n- iommu/amd: Convert comma to semicolon (git-fixes).\n- iommu/vt-d: Fix identity map bounds in si_domain_init() (git-fixes).\n- iommufd/device: Fix hwpt at err_unresv in iommufd_device_do_replace() (git-fixes).\n- ip6_tunnel: Fix broken GRO (bsc#1229444).\n- ipv6: sr: fix incorrect unregister order (git-fixes).\n- irqdomain: Fixed unbalanced fwnode get and put (git-fixes).\n- jfs: define xtree root and page independently (git-fixes).\n- jfs: fix null ptr deref in dtInsertEntry (git-fixes).\n- jfs: Fix shift-out-of-bounds in dbDiscardAG (git-fixes).\n- jump_label: Clarify condition in static_key_fast_inc_not_disabled() (git-fixes).\n- jump_label: Fix concurrency issues in static_key_slow_dec() (git-fixes).\n- jump_label: Fix the fix, brown paper bags galore (git-fixes).\n- jump_label: Simplify and clarify static_key_fast_inc_cpus_locked() (git-fixes).\n- kabi fix for KVM: s390: fix LPSWEY handling (bsc#1227634 git-fixes).\n- kabi fix for SUNRPC: add a missing rpc_stat for TCP TLS (git-fixes).\n- kABI fix of: virtio-crypto: handle config changed by work queue (git-fixes).\n- kABI workaround for sound core UMP conversion (stable-fixes).\n- kabi/severities: ignore kABI for FireWire sound local symbols (bsc#1208783)\n- kabi/severity: add nvme common code The nvme common code is also allowed to change the data structures, there are only internal users.\n- kcov: properly check for softirq context (git-fixes).\n- kernfs: Convert kernfs_path_from_node_locked() from strlcpy() to strscpy() (bsc#1229134).\n- kernfs: fix false-positive WARN(nr_mmapped) in kernfs_drain_open_files (git-fixes).\n- kprobes: Fix to check symbol prefixes correctly (git-fixes).\n- kprobes: Prohibit probing on CFI preamble symbol (git-fixes).\n- KVM: Always flush async #PF workqueue when vCPU is being destroyed (git-fixes).\n- KVM: arm64: AArch32: Fix spurious trapping of conditional instructions (git-fixes).\n- KVM: arm64: Add missing memory barriers when switching to pKVM's hyp pgd (git-fixes).\n- KVM: arm64: Allow AArch32 PSTATE.M to be restored as System mode (git-fixes).\n- KVM: arm64: Fix __pkvm_init_switch_pgd call ABI (git-fixes).\n- KVM: arm64: Fix AArch32 register narrowing on userspace write (git-fixes).\n- KVM: arm64: Fix clobbered ELR in sync abort/SError (git-fixes)\n- KVM: arm64: GICv4: Do not perform a map to a mapped vLPI (git-fixes).\n- KVM: arm64: timers: Correctly handle TGE flip with CNTPOFF_EL2 (git-fixes).\n- KVM: arm64: timers: Fix resource leaks in kvm_timer_hyp_init() (git-fixes).\n- KVM: arm64: vgic-its: Test for valid IRQ in its_sync_lpi_pending_table() (git-fixes).\n- KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler (git-fixes).\n- KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id (git-fixes).\n- KVM: arm64: vgic-v4: Restore pending state on host userspace write (git-fixes).\n- KVM: arm64: vgic: Add a non-locking primitive for kvm_vgic_vcpu_destroy() (git-fixes).\n- KVM: arm64: vgic: Force vcpu vgic teardown on vcpu destroy (git-fixes).\n- KVM: arm64: vgic: Simplify kvm_vgic_destroy() (git-fixes).\n- KVM: fix kvm_mmu_memory_cache allocation warning (git-fixes).\n- KVM: Make KVM_MEM_GUEST_MEMFD mutually exclusive with KVM_MEM_READONLY (git-fixes).\n- KVM: nVMX: Add a helper to get highest pending from Posted Interrupt vector (git-fixes).\n- KVM: nVMX: Check for pending posted interrupts when looking for nested events (git-fixes).\n- KVM: nVMX: Request immediate exit iff pending nested event needs injection (git-fixes).\n- KVM: PPC: Book3S HV: Fix the set_one_reg for MMCR3 (bsc#1194869).\n- KVM: PPC: Book3S HV: Handle pending exceptions on guest entry with MSR_EE (bsc#1215199).\n- KVM: Protect vcpu-\u003epid dereference via debugfs with RCU (git-fixes).\n- KVM: Reject overly excessive IDs in KVM_CREATE_VCPU (git-fixes).\n- KVM: s390: fix LPSWEY handling (bsc#1227634 git-fixes).\n- KVM: s390: fix validity interception issue when gisa is switched off (git-fixes bsc#1229167).\n- kvm: s390: Reject memory region operations for ucontrol VMs (git-fixes bsc#1229168).\n- KVM: Stop processing *all* memslots when 'null' mmu_notifier handler is found (git-fixes).\n- KVM: VMX: Move posted interrupt descriptor out of VMX code (git-fixes).\n- KVM: VMX: Split out the non-virtualization part of vmx_interrupt_blocked() (git-fixes).\n- KVM: VMX: Switch __vmx_exit() and kvm_x86_vendor_exit() in vmx_exit() (git-fixes).\n- KVM: x86: Limit check IDs for KVM_SET_BOOT_CPU_ID (git-fixes).\n- KVM: x86/mmu: Bug the VM if KVM tries to split a !hugepage SPTE (git-fixes).\n- libbpf: Add missing LIBBPF_API annotation to libbpf_set_memlock_rlim API (git-fixes).\n- libbpf: Apply map_set_def_max_entries() for inner_maps on creation (git-fixes).\n- libbpf: Fix faccessat() usage on Android (git-fixes).\n- libbpf: Use OPTS_SET() macro in bpf_xdp_query() (git-fixes).\n- md-cluster: fix hanging issue while a new disk adding (bsc#1223395).\n- md-cluster: fix hanging issue while a new disk adding (bsc#1223395).\n- md-cluster: fix no recovery job when adding/re-adding a disk (bsc#1223395).\n- md-cluster: fix no recovery job when adding/re-adding a disk (bsc#1223395).\n- md-cluster: keeping kabi compatibility for upstream commit 35a0a409fa26 (bsc#1223395).\n- md: add a mddev_add_trace_msg helper (git-fixes).\n- md: add check for sleepers in md_wakeup_thread() (git-fixes).\n- md: change the return value type of md_write_start to void (git-fixes).\n- md: do not account sync_io if iostats of the disk is disabled (git-fixes).\n- md: do not delete safemode_timer in mddev_suspend (git-fixes).\n- md: Do not wait for MD_RECOVERY_NEEDED for HOT_REMOVE_DISK ioctl (git-fixes).\n- md: factor out a helper exceed_read_errors() to check read_errors (git-fixes).\n- md: fix a suspicious RCU usage warning (git-fixes).\n- md/md-bitmap: fix writing non bitmap pages (git-fixes).\n- md/raid1: set max_sectors during early return from choose_slow_rdev() (git-fixes).\n- md/raid1: support read error check (git-fixes).\n- md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (git-fixes).\n- md/raid5: fix spares errors about rcu usage (git-fixes).\n- md/raid5: recheck if reshape has finished with device_lock held (git-fixes).\n- media: amphion: Remove lock in s_ctrl callback (stable-fixes).\n- media: drivers/media/dvb-core: copy user arrays safely (stable-fixes).\n- media: pci: cx23885: check cx23885_vdev_init() return (stable-fixes).\n- media: Revert 'media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()' (git-fixes).\n- media: uvcvideo: Add quirk for invalid dev_sof in Logitech C920 (git-fixes).\n- media: uvcvideo: Disable autosuspend for Insta360 Link (stable-fixes).\n- media: uvcvideo: Fix the bandwdith quirk on USB 3.x (stable-fixes).\n- media: uvcvideo: Ignore empty TS packets (stable-fixes).\n- media: uvcvideo: Quirk for invalid dev_sof in Logitech C922 (stable-fixes).\n- media: xc2028: avoid use-after-free in load_firmware_cb() (stable-fixes).\n- memcg: protect concurrent access to mem_cgroup_idr (git-fixes).\n- memory: stm32-fmc2-ebi: check regmap_read return value (stable-fixes).\n- memory: tegra: Skip SID programming if SID registers are not set (stable-fixes).\n- minmax: add a few more MIN_T/MAX_T users (bsc#1229024).\n- minmax: avoid overly complicated constant expressions in VM code (bsc#1229024).\n- minmax: do not use max() in situations that want a C constant expression (bsc#1229024).\n- minmax: fix up min3() and max3() too (bsc#1229024).\n- minmax: improve macro expansion and type checking (bsc#1229024).\n- minmax: make generic MIN() and MAX() macros available everywhere (bsc#1229024).\n- minmax: simplify and clarify min_t()/max_t() implementation (bsc#1229024).\n- minmax: simplify min()/max()/clamp() implementation (bsc#1229024).\n- mm, kmsan: fix infinite recursion due to RCU critical section (git-fixes).\n- mm: prevent derefencing NULL ptr in pfn_section_valid() (git-fixes).\n- mmc: dw_mmc: allow biu and ciu clocks to defer (git-fixes).\n- mmc: mmc_test: Fix NULL dereference on allocation failure (git-fixes).\n- mmc: mtk-sd: receive cmd8 data when hs400 tuning fail (git-fixes).\n- net: drop bad gso csum_start and offset in virtio_net_hdr (git-fixes).\n- net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb() (git-fixes).\n- net: fix sk_memory_allocated_{add|sub} vs softirqs (bsc#1228757).\n- net: mana: Add support for page sizes other than 4KB on ARM64 (jsc#PED-8491 bsc#1226530).\n- net: mana: Fix doorbell out of order violation and avoid unnecessary doorbell rings (bsc#1229154).\n- net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response (git-fixes).\n- net: mana: Fix RX buf alloc_size alignment and atomic op panic (bsc#1229086).\n- net: missing check virtio (git-fixes).\n- net: phy: micrel: Fix the KSZ9131 MDI-X status issue (git-fixes).\n- net: phy: realtek: add support for RTL8366S Gigabit PHY (git-fixes).\n- net: usb: qmi_wwan: fix memory leak for not ip packets (git-fixes).\n- net: usb: sr9700: fix uninitialized variable use in sr_mdio_read (git-fixes).\n- net/iucv: fix the allocation size of iucv_path_table array (git-fixes bsc#1229451).\n- net/iucv: fix use after free in iucv_sock_close() (bsc#1228973).\n- net/rds: fix possible cp null dereference (git-fixes).\n- net/sched: initialize noop_qdisc owner (git-fixes).\n- netfs, fscache: export fscache_put_volume() and add fscache_try_get_volume() (bsc#1228459 bsc#1228462).\n- nfc: pn533: Add poll mod list filling check (git-fixes).\n- nfs: do not invalidate dentries on transient errors (git-fixes).\n- nfs: expose /proc/net/sunrpc/nfs in net namespaces (git-fixes).\n- nfs: make the rpc_stat per net namespace (git-fixes).\n- nfs: pass explicit offset/count to trace events (git-fixes).\n- nfs: propagate readlink errors in nfs_symlink_filler (git-fixes).\n- NFSD: Support write delegations in LAYOUTGET (git-fixes).\n- NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (git-fixes).\n- nouveau/firmware: use dma non-coherent allocator (git-fixes).\n- nvme_core: scan namespaces asynchronously (bsc#1224105).\n- nvme-multipath: find NUMA path only for online numa-node (git-fixes).\n- nvme-multipath: implement 'queue-depth' iopolicy (bsc#1227706).\n- nvme-multipath: prepare for 'queue-depth' iopolicy (bsc#1227706).\n- nvme-pci: add missing condition check for existence of mapped data (git-fixes).\n- nvme-pci: do not directly handle subsys reset fallout (bsc#1220066).\n- nvme-pci: Fix the instructions for disabling power management (git-fixes).\n- nvme-sysfs: add 'tls_configured_key' sysfs attribute (bsc#1221857).\n- nvme-sysfs: add 'tls_keyring' attribute (bsc#1221857).\n- nvme-tcp: check for invalidated or revoked key (bsc#1221857).\n- nvme-tcp: sanitize TLS key handling (bsc#1221857).\n- nvme: add a newline to the 'tls_key' sysfs attribute (bsc#1221857).\n- nvme: adjust multiples of NVME_CTRL_PAGE_SIZE in offset (git-fixes).\n- nvme: avoid double free special payload (git-fixes).\n- nvme: fix NVME_NS_DEAC may incorrectly identifying the disk as EXT_LBA (git-fixes).\n- nvme: fixup comment for nvme RDMA Provider Type (git-fixes).\n- nvme: split off TLS sysfs attributes into a separate group (bsc#1221857).\n- nvme: tcp: remove unnecessary goto statement (bsc#1221857).\n- nvmet-auth: fix nvmet_auth hash error handling (git-fixes).\n- nvmet: always initialize cqe.result (git-fixes).\n- nvmet: do not return 'reserved' for empty TSAS values (git-fixes).\n- nvmet: fix a possible leak when destroy a ctrl during qp establishment (git-fixes).\n- nvmet: make 'tsas' attribute idempotent for RDMA (git-fixes).\n- ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry() (bsc#1228410).\n- padata: Fix possible divide-by-0 panic in padata_mt_helper() (git-fixes).\n- PCI: Add Edimax Vendor ID to pci_ids.h (stable-fixes).\n- PCI: hv: Return zero, not garbage, when reading PCI_INTERRUPT_PIN (git-fixes).\n- PCI: loongson: Enable MSI in LS7A Root Complex (stable-fixes).\n- perf/smmuv3: Enable HiSilicon Erratum 162001900 quirk for HIP08/09 (git-fixes).\n- pinctrl: mediatek: common-v2: Fix broken bias-disable for PULL_PU_PD_RSEL_TYPE (git-fixes).\n- pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B pins (git-fixes).\n- pinctrl: single: fix potential NULL dereference in pcs_get_function() (git-fixes).\n- pinctrl: starfive: jh7110: Correct the level trigger configuration of iev register (git-fixes).\n- platform/chrome: cros_ec_proto: Lock device when updating MKBP version (git-fixes).\n- platform/chrome: cros_ec_proto: Lock device when updating MKBP version (git-fixes).\n- platform/surface: aggregator: Fix warning when controller is destroyed in probe (git-fixes).\n- platform/x86: lg-laptop: fix %s null argument warning (stable-fixes).\n- platform/x86/amd/hsmp: Add support for ACPI based probing (jsc#PED-8779).\n- platform/x86/amd/hsmp: Cache pci_dev in struct hsmp_socket (jsc#PED-8779).\n- platform/x86/amd/hsmp: Change devm_kzalloc() to devm_kcalloc() (jsc#PED-8779).\n- platform/x86/amd/hsmp: Check HSMP support on AMD family of processors (jsc#PED-8779).\n- platform/x86/amd/hsmp: Check num_sockets against MAX_AMD_SOCKETS (jsc#PED-8779).\n- platform/x86/amd/hsmp: Create static func to handle platdev (jsc#PED-8779).\n- platform/x86/amd/hsmp: Define a struct to hold mailbox regs (jsc#PED-8779).\n- platform/x86/amd/hsmp: Move dev from platdev to hsmp_socket (jsc#PED-8779).\n- platform/x86/amd/hsmp: Move hsmp_test to probe (jsc#PED-8779).\n- platform/x86/amd/hsmp: Non-ACPI support for AMD F1A_M00~0Fh (jsc#PED-8779).\n- platform/x86/amd/hsmp: Remove extra parenthesis and add a space (jsc#PED-8779).\n- platform/x86/amd/hsmp: Restructure sysfs group creation (jsc#PED-8779).\n- platform/x86/amd/hsmp: switch to use device_add_groups() (jsc#PED-8779).\n- platform/x86/intel/ifs: Initialize union ifs_status to zero (git-fixes).\n- power: supply: axp288_charger: Fix constant_charge_voltage writes (git-fixes).\n- power: supply: axp288_charger: Round constant_charge_voltage writes down (git-fixes).\n- power: supply: qcom_battmgr: return EAGAIN when firmware service is not up (git-fixes).\n- powerpc: fix a file leak in kvm_vcpu_ioctl_enable_cap() (bsc#1194869).\n- powerpc: xor_vmx: Add '-mhard-float' to CFLAGS (bsc#1194869).\n- powerpc/64: Set _IO_BASE to POISON_POINTER_DELTA not 0 for CONFIG_PCI=n (bsc#1194869).\n- powerpc/io: Avoid clang null pointer arithmetic warnings (bsc#1194869).\n- powerpc/kexec_file: fix cpus node update to FDT (bsc#1194869).\n- powerpc/kexec: make the update_cpus_node() function public (bsc#1194869).\n- powerpc/kexec: split CONFIG_KEXEC_FILE and CONFIG_CRASH_DUMP (bsc#1194869).\n- powerpc/pseries: Add failure related checks for h_get_mpp and h_get_ppp (bsc#1194869).\n- powerpc/pseries: Whitelist dtl slub object for copying to userspace (bsc#1194869).\n- powerpc/radix: Move some functions into #ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE (bsc#1194869).\n- powerpc/topology: Check if a core is online (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588 git-fixes).\n- powerpc/xmon: Check cpu id in commands 'c#', 'dp#' and 'dx#' (bsc#1194869).\n- printk/panic: Allow cpu backtraces to be written into ringbuffer during panic (bsc#1225607).\n- RDMA: Fix netdev tracker in ib_device_set_netdev (git-fixes)\n- RDMA/cache: Release GID table even if leak is detected (git-fixes)\n- RDMA/device: Return error earlier if port in not valid (git-fixes)\n- RDMA/hns: Check atomic wr length (git-fixes)\n- RDMA/hns: Fix insufficient extend DB for VFs. (git-fixes)\n- RDMA/hns: Fix mbx timing out before CMD execution is completed (git-fixes)\n- RDMA/hns: Fix missing pagesize and alignment check in FRMR (git-fixes)\n- RDMA/hns: Fix shift-out-bounds when max_inline_data is 0 (git-fixes)\n- RDMA/hns: Fix soft lockup under heavy CEQE load (git-fixes)\n- RDMA/hns: Fix undifined behavior caused by invalid max_sge (git-fixes)\n- RDMA/hns: Fix unmatch exception handling when init eq table fails (git-fixes)\n- RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (git-fixes)\n- RDMA/mana_ib: Use virtual address in dma regions for MRs (git-fixes).\n- RDMA/mlx4: Fix truncated output warning in alias_GUID.c (git-fixes)\n- RDMA/mlx4: Fix truncated output warning in mad.c (git-fixes)\n- RDMA/mlx5: Set mkeys for dmabuf at PAGE_SIZE (git-fixes)\n- RDMA/rxe: Do not set BTH_ACK_MASK for UC or UD QPs (git-fixes)\n- reiserfs: fix uninit-value in comp_keys (git-fixes).\n- rtc: nct3018y: fix possible NULL dereference (stable-fixes).\n- s390/cpum_cf: Fix endless loop in CF_DIAG event stop (git-fixes bsc#1229171).\n- s390/dasd: fix error checks in dasd_copy_pair_store() (git-fixes bsc#1229173).\n- s390/dasd: fix error recovery leading to data corruption on ESE devices (git-fixes bsc#1229452).\n- s390/pci: Add missing virt_to_phys() for directed DIBV (git-fixes bsc#1229174).\n- s390/pci: Allow allocation of more than 1 MSI interrupt (git-fixes bsc#1229172).\n- s390/pci: Refactor arch_setup_msi_irqs() (git-fixes bsc#1229172).\n- s390/pkey: harmonize pkey s390 debug feature calls (bsc#1228720).\n- s390/pkey: introduce dynamic debugging for pkey (bsc#1228720).\n- s390/sclp: Prevent release of buffer in I/O (git-fixes bsc#1229169).\n- s390/uv: Panic for set and remove shared access UVC errors (git-fixes bsc#1229170).\n- samples/bpf: syscall_tp_user: Fix array out-of-bound access (git-fixes).\n- samples/bpf: syscall_tp_user: Rename num_progs into nr_tests (git-fixes).\n- sbitmap: use READ_ONCE to access map-\u003eword (stable-fixes).\n- scsi: lpfc: Allow DEVICE_RECOVERY mode after RSCN receipt if in PRLI_ISSUE state (bsc#1228857).\n- scsi: lpfc: Cancel ELS WQE instead of issuing abort when SLI port is inactive (bsc#1228857).\n- scsi: lpfc: Fix handling of fully recovered fabric node in dev_loss callbk (bsc#1228857).\n- scsi: lpfc: Fix incorrect request len mbox field when setting trunking via sysfs (bsc#1228857).\n- scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (bsc#1228857).\n- scsi: lpfc: Relax PRLI issue conditions after GID_FT response (bsc#1228857).\n- scsi: lpfc: Revise lpfc_prep_embed_io routine with proper endian macro usages (bsc#1228857).\n- scsi: lpfc: Update lpfc version to 14.4.0.3 (bsc#1228857).\n- scsi: qla2xxx: Avoid possible run-time warning with long model_num (bsc#1228850).\n- scsi: qla2xxx: Complete command early within lock (bsc#1228850).\n- scsi: qla2xxx: Convert comma to semicolon (bsc#1228850).\n- scsi: qla2xxx: Drop driver owner assignment (bsc#1228850).\n- scsi: qla2xxx: During vport delete send async logout explicitly (bsc#1228850).\n- scsi: qla2xxx: Fix debugfs output for fw_resource_count (bsc#1228850).\n- scsi: qla2xxx: Fix flash read failure (bsc#1228850).\n- scsi: qla2xxx: Fix for possible memory corruption (bsc#1228850).\n- scsi: qla2xxx: Fix optrom version displayed in FDMI (bsc#1228850).\n- scsi: qla2xxx: Indent help text (bsc#1228850).\n- scsi: qla2xxx: Reduce fabric scan duplicate code (bsc#1228850).\n- scsi: qla2xxx: Remove unused struct 'scsi_dif_tuple' (bsc#1228850).\n- scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for ELS cmds (bsc#1228850).\n- scsi: qla2xxx: Unable to act on RSCN for port online (bsc#1228850).\n- scsi: qla2xxx: Update version to 10.02.09.300-k (bsc#1228850).\n- scsi: qla2xxx: Use QP lock to search for bsg (bsc#1228850).\n- scsi: qla2xxx: validate nvme_local_port correctly (bsc#1228850).\n- selftest/bpf: Add map_in_maps with BPF_MAP_TYPE_PERF_EVENT_ARRAY values (git-fixes).\n- selftests/bpf: Add a test to verify previous stacksafe() fix (bsc#1225903).\n- selftests/bpf: Add assert for user stacks in test_task_stack (git-fixes).\n- selftests/bpf: Add netkit to tc_redirect selftest (git-fixes).\n- selftests/bpf: De-veth-ize the tc_redirect test case (git-fixes).\n- selftests/bpf: Disable IPv6 for lwt_redirect test (git-fixes).\n- selftests/bpf: fix bpf_loop_bench for new callback verification scheme (git-fixes).\n- selftests/bpf: fix compiler warnings in RELEASE=1 mode (git-fixes).\n- selftests/bpf: Fix erroneous bitmask operation (git-fixes).\n- selftests/bpf: Fix issues in setup_classid_environment() (git-fixes).\n- selftests/bpf: Fix potential premature unload in bpf_testmod (git-fixes).\n- selftests/bpf: Fix pyperf180 compilation failure with clang18 (git-fixes).\n- selftests/bpf: fix RELEASE=1 build for tc_opts (git-fixes).\n- selftests/bpf: Fix the flaky tc_redirect_dtime test (git-fixes).\n- selftests/bpf: Fix up xdp bonding test wrt feature flags (git-fixes).\n- selftests/bpf: Make linked_list failure test more robust (git-fixes).\n- selftests/bpf: Relax time_tai test for equal timestamps in tai_forward (git-fixes).\n- selftests/bpf: satisfy compiler by having explicit return in btf test (git-fixes).\n- selftests/bpf: Skip module_fentry_shadow test when bpf_testmod is not available (git-fixes).\n- selftests/bpf: Wait for the netstamp_needed_key static key to be turned on (git-fixes).\n- serial: core: check uartclk for zero to avoid divide by zero (stable-fixes).\n- soc: qcom: cmd-db: Map shared memory as WC, not WB (git-fixes).\n- soc: qcom: pmic_glink: Actually communicate when remote goes down (git-fixes).\n- soundwire: stream: fix programming slave ports for non-continous port maps (git-fixes).\n- spi: Add empty versions of ACPI functions (stable-fixes).\n- spi: microchip-core: fix init function not setting the master and motorola modes (git-fixes).\n- spi: microchip-core: switch to use modern name (stable-fixes).\n- spi: spi-fsl-lpspi: Fix scldiv calculation (git-fixes).\n- spi: spidev: Add missing spi_device_id for bh2228fv (git-fixes).\n- Squashfs: fix variable overflow triggered by sysbot (git-fixes).\n- squashfs: squashfs_read_data need to check if the length is 0 (git-fixes).\n- ssb: Fix division by zero issue in ssb_calc_clock_rate (stable-fixes).\n- staging: iio: resolver: ad2s1210: fix use before initialization (stable-fixes).\n- staging: ks7010: disable bh on tx_dev_lock (stable-fixes).\n- string.h: Introduce memtostr() and memtostr_pad() (bsc#1228849).\n- SUNRPC: add a missing rpc_stat for TCP TLS (git-fixes).\n- sunrpc: add a struct rpc_stats arg to rpc_create_args (git-fixes).\n- SUNRPC: Fix a race to wake a sync task (git-fixes).\n- swiotlb: do not set total_used to 0 in swiotlb_create_debugfs_files() (git-fixes).\n- swiotlb: fix swiotlb_bounce() to do partial sync's correctly (git-fixes).\n- syscalls: fix compat_sys_io_pgetevents_time64 usage (git-fixes).\n- thermal: bcm2835: Convert to platform remove callback returning void (stable-fixes).\n- thermal/drivers/broadcom: Fix race between removal and clock disable (git-fixes).\n- thunderbolt: Mark XDomain as unplugged when router is removed (stable-fixes).\n- tools/perf: Fix perf bench epoll to enable the run when some CPU's are offline (bsc#1227747).\n- tools/perf: Fix perf bench futex to enable the run when some CPU's are offline (bsc#1227747).\n- tools/perf: Fix timing issue with parallel threads in perf bench wake-up-parallel (bsc#1227747).\n- tools/resolve_btfids: fix build with musl libc (git-fixes).\n- tools/resolve_btfids: Fix comparison of distinct pointer types warning in resolve_btfids (git-fixes).\n- tools/resolve_btfids: Fix cross-compilation to non-host endianness (git-fixes).\n- tools/resolve_btfids: Refactor set sorting with types from btf_ids.h (git-fixes).\n- trace/pid_list: Change gfp flags in pid_list_fill_irq() (git-fixes).\n- tracing: Return from tracing_buffers_read() if the file has been closed (bsc#1229136 git-fixes).\n- tty: atmel_serial: use the correct RTS flag (git-fixes).\n- tty: serial: fsl_lpuart: mark last busy before uart_add_one_port (git-fixes).\n- usb: cdnsp: fix for Link TRB with TC (git-fixes).\n- usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function (git-fixes).\n- usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes() (git-fixes).\n- usb: dwc3: core: Skip setting event buffers for host only controllers (stable-fixes).\n- usb: dwc3: omap: add missing depopulate in probe error path (git-fixes).\n- usb: dwc3: st: add missing depopulate in probe error path (git-fixes).\n- usb: dwc3: st: fix probed platform device ref count on probe error path (git-fixes).\n- usb: gadget: core: Check for unset descriptor (git-fixes).\n- usb: gadget: fsl: Increase size of name buffer for endpoints (stable-fixes).\n- usb: gadget: u_audio: Check return codes from usb_ep_enable and config_ep_by_speed (git-fixes).\n- usb: gadget: u_serial: Set start_delayed during suspend (git-fixes).\n- usb: gadget: uvc: cleanup request when not in correct state (stable-fixes).\n- USB: serial: debug: do not echo input by default (stable-fixes).\n- usb: typec: fsa4480: add support for Audio Accessory Mode (git-fixes).\n- usb: typec: fsa4480: Add support to swap SBU orientation (git-fixes).\n- usb: typec: fsa4480: Check if the chip is really there (git-fixes).\n- usb: typec: fsa4480: Relax CHIP_ID check (git-fixes).\n- usb: typec: fsa4480: rework mux \u0026 switch setup to handle more states (git-fixes).\n- usb: vhci-hcd: Do not drop references before new references are gained (stable-fixes).\n- vfio/pci: fix potential memory leak in vfio_intx_enable() (git-fixes).\n- vhost-scsi: Handle vhost_vq_work_queue failures for events (git-fixes).\n- vhost-vdpa: switch to use vmf_insert_pfn() in the fault handler (git-fixes).\n- vhost: Release worker mutex during flushes (git-fixes).\n- vhost: Use virtqueue mutex for swapping worker (git-fixes).\n- vhost/vsock: always initialize seqpacket_allow (git-fixes).\n- virt: guest_memfd: fix reference leak on hwpoisoned page (git-fixes).\n- virtio_net: use u64_stats_t infra to avoid data-races (git-fixes).\n- virtio-crypto: handle config changed by work queue (git-fixes).\n- virtio: reenable config if freezing device failed (git-fixes).\n- virtiofs: forbid newlines in tags (bsc#1229940).\n- wifi: ath12k: fix memory leak in ath12k_dp_rx_peer_frag_setup() (stable-fixes).\n- wifi: ath12k: fix soft lockup on suspend (git-fixes).\n- wifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion (git-fixes).\n- wifi: cfg80211: fix reporting failed MLO links status with cfg80211_connect_done (git-fixes).\n- wifi: iwlwifi: fw: fix wgds rev 3 exact size (git-fixes).\n- wifi: mac80211: use monitor sdata with driver only if desired (git-fixes).\n- wifi: mwifiex: duplicate static structs used in driver instances (git-fixes).\n- wifi: nl80211: disallow setting special AP channel widths (stable-fixes).\n- wifi: nl80211: do not give key data to userspace (stable-fixes).\n- wifi: rtw88: usb: Fix disconnection after beacon loss (stable-fixes).\n- wifi: wfx: repair open network AP mode (git-fixes).\n- workqueue: Improve scalability of workqueue watchdog touch (bsc#1193454).\n- workqueue: wq_watchdog_touch is always called with valid CPU (bsc#1193454).\n- x86/asm: Use %c/%n instead of %P operand modifier in asm templates (git-fixes).\n- x86/entry/64: Remove obsolete comment on tracing vs. SYSRET (git-fixes).\n- x86/mm: Fix pti_clone_entry_text() for i386 (git-fixes).\n- x86/mm: Fix pti_clone_pgtable() alignment assumption (git-fixes).\n- x86/mtrr: Check if fixed MTRRs exist before saving them (git-fixes).\n- x86/numa: Fix SRAT lookup of CFMWS ranges with numa_fill_memblks() (git-fixes).\n- x86/numa: Fix the address overlap check in numa_fill_memblks() (git-fixes).\n- x86/numa: Fix the sort compare func used in numa_fill_memblks() (git-fixes).\n- x86/numa: Introduce numa_fill_memblks() (git-fixes).\n- x86/pci: Skip early E820 check for ECAM region (git-fixes).\n- x86/xen: Convert comma to semicolon (git-fixes).\n- xfs: allow cross-linking special files without project quota (git-fixes).\n- xfs: allow symlinks with short remote targets (bsc#1229160).\n- xfs: allow unlinked symlinks and dirs with zero size (git-fixes).\n- xfs: attr forks require attr, not attr2 (git-fixes).\n- xfs: convert comma to semicolon (git-fixes).\n- xfs: do not use current-\u003ejournal_info (git-fixes).\n- xfs: Fix missing interval for missing_owner in xfs fsmap (git-fixes).\n- xfs: Fix the owner setting issue for rmap query in xfs fsmap (git-fixes).\n- xfs: fix unlink vs cluster buffer instantiation race (git-fixes).\n- xfs: honor init_xattrs in xfs_init_new_inode for !ATTR fs (git-fixes).\n- xfs: journal geometry is not properly bounds checked (git-fixes).\n- xfs: match lock mode in xfs_buffered_write_iomap_begin() (git-fixes).\n- xfs: require XFS_SB_FEAT_INCOMPAT_LOG_XATTRS for attr log intent item recovery (git-fixes).\n- xfs: upgrade the extent counters in xfs_reflink_end_cow_extent later (git-fixes).\n- xfs: use consistent uid/gid when grabbing dquots for inodes (git-fixes).\n- xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code (git-fixes).\n- xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration (git-fixes).\n- xprtrdma: Fix rpcrdma_reqs_reset() (git-fixes).\n","status":"published","published":"2024-09-10T14:10:24Z","modified":"2026-02-04T02:36:48.443793Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3383-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2024-43911: wifi: mac80211: fix NULL dereference at band check in starting tx ba session (bsc#1229827).\n- CVE-2024-43899: drm/amd/display: Fix null pointer deref in dcn20_resource.c (bsc#1229754).\n- CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)\n- CVE-2024-43880: kabi: lib: objagg: Put back removed metod in struct objagg_ops (bsc#1229481).\n- CVE-2024-43866: net/mlx5: Always drain health in shutdown callback (bsc#1229495).\n- CVE-2024-43864: net/mlx5e: Fix CT entry update leaks of modify header context (bsc#1229496).\n- CVE-2024-43855: md: fix deadlock between mddev_suspend and flush bio (bsc#1229342).\n- CVE-2024-43854: block: initialize integrity buffer to zero before writing it to media (bsc#1229345)\n- CVE-2024-43850: soc: qcom: icc-bwmon: Fix refcount imbalance seen during bwmon_remove (bsc#1229316).\n- CVE-2024-43839: bna: adjust 'name' buf size of bna_tcb and bna_ccb structures (bsc#1229301).\n- CVE-2024-43837: bpf: Fix updating attached freplace prog in prog_array map (bsc#1229297).\n- CVE-2024-43834: xdp: fix invalid wait context of page_pool_destroy() (bsc#1229314)\n- CVE-2024-43831: media: mediatek: vcodec: Handle invalid decoder vsi (bsc#1229309).\n- CVE-2024-43821: scsi: lpfc: Fix a possible null pointer dereference (bsc#1229315).\n- CVE-2024-42322: ipvs: properly dereference pe in ip_vs_add_service (bsc#1229347)\n- CVE-2024-42318: landlock: Do not lose track of restrictions on cred_transfer (bsc#1229351).\n- CVE-2024-42316: mm/mglru: fix div-by-zero in vmpressure_calc_level() (bsc#1229353).\n- CVE-2024-42312: sysctl: always initialize i_uid/i_gid (bsc#1229357)\n- CVE-2024-42308: Update DRM patch reference (bsc#1229411)\n- CVE-2024-42301: dev/parport: fix the array out-of-bounds risk (bsc#1229407).\n- CVE-2024-42295: nilfs2: handle inconsistent state in nilfs_btnode_create_block() (bsc#1229370).\n- CVE-2024-42291: ice: Add a per-VF limit on number of FDIR filters (bsc#1229374).\n- CVE-2024-42290: irqchip/imx-irqsteer: Handle runtime power management correctly (bsc#1229379).\n- CVE-2024-42284: tipc: Return non-zero value from tipc_udp_addr2str() on error (bsc#1229382)\n- CVE-2024-42283: net: nexthop: Initialize all fields in dumped nexthops (bsc#1229383)\n- CVE-2024-42281: bpf: Fix a segment issue when downgrading gso_size (bsc#1229386).\n- CVE-2024-42277: iommu: sprd: Avoid NULL deref in sprd_iommu_hw_en (bsc#1229409).\n- CVE-2024-42270: netfilter: iptables: Fix null-ptr-deref in iptable_nat_table_init() (bsc#1229404).\n- CVE-2024-42269: netfilter: iptables: Fix potential null-ptr-deref in ip6table_nat_table_init() (bsc#1229402).\n- CVE-2024-42268: net/mlx5: Fix missing lock on sync reset reload (bsc#1229391).\n- CVE-2024-42247: wireguard: allowedips: avoid unaligned 64-bit memory accesses (bsc#1228988).\n- CVE-2024-42246: net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (bsc#1228989).\n- CVE-2024-42245: Revert 'sched/fair: Make sure to try to detach at least one movable task' (bsc#1228978).\n- CVE-2024-42241: mm/shmem: disable PMD-sized page cache if needed (bsc#1228986).\n- CVE-2024-42224: net: dsa: mv88e6xxx: Correct check for empty list (bsc#1228723).\n- CVE-2024-42162: gve: Account for stopped queues when reading NIC stats (bsc#1228706).\n- CVE-2024-42161: bpf: avoid uninitialized value in BPF_CORE_READ_BITFIELD (bsc#1228756).\n- CVE-2024-42159: scsi: mpi3mr: fix sanitise num_phys (bsc#1228754).\n- CVE-2024-42158: s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings (bsc#1228720).\n- CVE-2024-42157: s390/pkey: Wipe sensitive data on failure (bsc#1228727).\n- CVE-2024-42156: s390/pkey: Wipe copies of clear-key structures on failure (bsc#1228722).\n- CVE-2024-42155: s390/pkey: Wipe copies of protected- and secure-keys (bsc#1228733).\n- CVE-2024-42148: bnx2x: Fix multiple UBSAN array-index-out-of-bounds (bsc#1228487).\n- CVE-2024-42145: IB/core: Implement a limit on UMAD receive List (bsc#1228743).\n- CVE-2024-42142: net/mlx5: E-switch, Create ingress ACL when needed (bsc#1228491).\n- CVE-2024-42139: ice: Fix improper extts handling (bsc#1228503).\n- CVE-2024-42138: mlxsw: core_linecards: Fix double memory deallocation in case of invalid INI file (bsc#1228500).\n- CVE-2024-42124: scsi: qedf: Make qedf_execute_tmf() non-preemptible (bsc#1228705).\n- CVE-2024-42122: drm/amd/display: Add NULL pointer check for kzalloc (bsc#1228591).\n- CVE-2024-42113: net: txgbe: initialize num_q_vectors for MSI/INTx interrupts (bsc#1228568).\n- CVE-2024-42110: net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() (bsc#1228501).\n- CVE-2024-42109: netfilter: nf_tables: unconditionally flush pending work before notifier (bsc#1228505).\n- CVE-2024-42107: ice: Do not process extts if PTP is disabled (bsc#1228494).\n- CVE-2024-42106: inet_diag: Initialize pad field in struct inet_diag_req_v2 (bsc#1228493).\n- CVE-2024-42096: x86: stop playing stack games in profile_pc() (bsc#1228633).\n- CVE-2024-42095: serial: 8250_omap: Fix Errata i2310 with RX FIFO level check (bsc#1228446).\n- CVE-2024-42093: net/dpaa2: Avoid explicit cpumask var allocation on stack (bsc#1228680).\n- CVE-2024-42082: xdp: Remove WARN() from __xdp_reg_mem_model() (bsc#1228482).\n- CVE-2024-42079: gfs2: Fix NULL pointer dereference in gfs2_log_flush (bsc#1228672).\n- CVE-2024-42073: mlxsw: spectrum_buffers: Fix memory corruptions on Spectrum-4 systems (bsc#1228457).\n- CVE-2024-42070: netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (bsc#1228470).\n- CVE-2024-41084: cxl/region: Avoid null pointer dereference in region lookup (bsc#1228472).\n- CVE-2024-41081: ila: block BH in ila_output() (bsc#1228617).\n- CVE-2024-41080: io_uring: fix possible deadlock in io_register_iowq_max_workers() (bsc#1228616).\n- CVE-2024-41078: btrfs: qgroup: fix quota root leak after quota disable failure (bsc#1228655).\n- CVE-2024-41076: NFSv4: Fix memory leak in nfs4_set_security_label (bsc#1228649).\n- CVE-2024-41075: cachefiles: add consistency check for copen/cread (bsc#1228646).\n- CVE-2024-41074: cachefiles: Set object to close if ondemand_id \u003c 0 in copen (bsc#1228643).\n- CVE-2024-41070: KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group() (bsc#1228581).\n- CVE-2024-41069: ASoC: topology: Fix route memory corruption (bsc#1228644).\n- CVE-2024-41068: s390/sclp: Fix sclp_init() cleanup on failure (bsc#1228579).\n- CVE-2024-41066: ibmvnic: add tx check to prevent skb leak (bsc#1228640).\n- CVE-2024-41064: powerpc/eeh: avoid possible crash when edev-\u003epdev changes (bsc#1228599).\n- CVE-2024-41062: bluetooth/l2cap: sync sock recv cb and release (bsc#1228576).\n- CVE-2024-41058: cachefiles: fix slab-use-after-free in fscache_withdraw_volume() (bsc#1228459).\n- CVE-2024-41057: cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie() (bsc#1228462).\n- CVE-2024-41051: cachefiles: wait for ondemand_object_worker to finish when dropping object (bsc#1228468).\n- CVE-2024-41050: cachefiles: cyclic allocation of msg_id to avoid reuse (bsc#1228499).\n- CVE-2024-41048: skmsg: Skip zero length skb in sk_msg_recvmsg (bsc#1228565).\n- CVE-2024-41044: ppp: reject claimed-as-LCP but actually malformed packets (bsc#1228530).\n- CVE-2024-41041: udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port() (bsc#1228520).\n- CVE-2024-41040: net/sched: Fix UAF when resolving a clash (bsc#1228518).\n- CVE-2024-41036: net: ks8851: Fix deadlock with the SPI chip variant (bsc#1228496).\n- CVE-2024-41032: mm: vmalloc: check if a hash-index is in cpu_possible_mask (bsc#1228460).\n- CVE-2024-41020: filelock: Fix fcntl/close race recovery compat path (bsc#1228427).\n- CVE-2024-41015: ocfs2: add bounds checking to ocfs2_check_dir_entry() (bsc#1228409).\n- CVE-2024-41012: filelock: Remove locks reliably when fcntl/close race is detected (bsc#1228247).\n- CVE-2024-41010: bpf: Fix too early release of tcx_entry (bsc#1228021).\n- CVE-2024-41009: bpf: Fix overrunning reservations in ringbuf (bsc#1228020).\n- CVE-2024-41007: tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() (bsc#1227863).\n- CVE-2024-41000: block/ioctl: prefer different overflow check (bsc#1227867).\n- CVE-2024-40995: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() (bsc#1227830).\n- CVE-2024-40994: ptp: fix integer overflow in max_vclocks_store (bsc#1227829).\n- CVE-2024-40989: KVM: arm64: Disassociate vcpus from redistributor region on teardown (bsc#1227823).\n- CVE-2024-40978: scsi: qedi: Fix crash while reading debugfs attribute (bsc#1227929).\n- CVE-2024-40959: xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() (bsc#1227884).\n- CVE-2024-40958: netns: Make get_net_ns() handle zero refcount net (bsc#1227812).\n- CVE-2024-40957: seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors (bsc#1227811).\n- CVE-2024-40956: dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list (bsc#1227810).\n- CVE-2024-40954: net: do not leave a dangling sk pointer, when socket creation fails (bsc#1227808)\n- CVE-2024-40939: net: wwan: iosm: Fix tainted pointer delete is case of region creation fail (bsc#1227799).\n- CVE-2024-40938: landlock: fix d_parent walk (bsc#1227840).\n- CVE-2024-40921: net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state (bsc#1227784).\n- CVE-2024-40920: net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (bsc#1227781).\n- CVE-2024-40909: bpf: Fix a potential use-after-free in bpf_link_free() (bsc#1227798).\n- CVE-2024-40905: ipv6: fix possible race in __fib6_drop_pcpu_from() (bsc#1227761)\n- CVE-2024-39506: liquidio: adjust a NULL pointer handling path in lio_vf_rep_copy_packet (bsc#1227729).\n- CVE-2024-39489: ipv6: sr: fix memleak in seg6_hmac_init_algo (bsc#1227623)\n- CVE-2024-38662: selftests/bpf: Cover verifier checks for mutating sockmap/sockhash (bsc#1226885).\n- CVE-2024-36979: net: bridge: mst: fix vlan use-after-free (bsc#1226604).\n- CVE-2024-36933: net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (bsc#1225832).\n- CVE-2024-36929: net: core: reject skb_copy(_expand) for fraglist GSO skbs (bsc#1225814).\n- CVE-2024-36911: hv_netvsc: Do not free decrypted memory (bsc#1225745).\n- CVE-2024-36910: uio_hv_generic: Do not free decrypted memory (bsc#1225717).\n- CVE-2024-36909: Drivers: hv: vmbus: Do not free ring buffers that couldn't be re-encrypted (bsc#1225744).\n- CVE-2024-36881: mm/userfaultfd: Fix reset ptes when close() for wr-protected (bsc#1225718).\n- CVE-2024-36489: tls: fix missing memory barrier in tls_init (bsc#1226874)\n- CVE-2024-36286: netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (bsc#1226801)\n- CVE-2024-36270: Fix reference in patches.suse/netfilter-tproxy-bail-out-if-IP-has-been-disabled-on.patch (bsc#1226798)\n- CVE-2024-35949: btrfs: make sure that WRITTEN is set on all metadata blocks (bsc#1224700).\n- CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure (bsc#1224535).\n- CVE-2024-35897: netfilter: nf_tables: discard table flag update with pending basechain deletion (bsc#1224510).\n- CVE-2024-27437: vfio/pci: Disable auto-enable of exclusive INTx IRQ (bsc#1222625).\n- CVE-2024-27433: clk: mediatek: mt7622-apmixedsys: Fix an error handling path in clk_mt8135_apmixed_probe() (bsc#1224711).\n- CVE-2024-27403: kabi: restore const specifier in flow_offload_route_init() (bsc#1224415).\n- CVE-2024-27079: iommu/vt-d: Fix NULL domain on device release (bsc#1223742).\n- CVE-2024-27024: net/rds: fix WARNING in rds_conn_connect_if_down (bsc#1223777).\n- CVE-2024-27011: netfilter: nf_tables: fix memleak in map from abort path (bsc#1223803).\n- CVE-2024-27010: net/sched: Fix mirred deadlock on device recursion (bsc#1223720).\n- CVE-2024-26851: netfilter: nf_conntrack_h323: Add protection for bmp length out of range (bsc#1223074)\n- CVE-2024-26837: net: bridge: switchdev: race between creation of new group memberships and generation of the list of MDB events to replay (bsc#1222973).\n- CVE-2024-26835: netfilter: nf_tables: set dormant flag on hook register failure (bsc#1222967).\n- CVE-2024-26812: kABI: vfio: struct virqfd kABI workaround (bsc#1222808).\n- CVE-2024-26809: netfilter: nft_set_pipapo: release elements in clone only from destroy path (bsc#1222633).\n- CVE-2024-26808: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).\n- CVE-2024-26735: ipv6: sr: fix possible use-after-free and null-ptr-deref (bsc#1222372).\n- CVE-2024-26677: blacklist.conf: Add e7870cf13d20 ('rxrpc: Fix delayed ACKs to not set the reference serial number') (bsc#1222387)\n- CVE-2024-26669: kABI fix for net/sched: flower: Fix chain template offload (bsc#1222350).\n- CVE-2024-26668: netfilter: nft_limit: reject configurations that cause integer overflow (bsc#1222335).\n- CVE-2024-26631: ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work (bsc#1221630).\n- CVE-2024-26590: erofs: fix inconsistent per-file compression format (bsc#1220252).\n- CVE-2023-52889: apparmor: Fix null pointer deref when receiving skb during sock creation (bsc#1229287).\n- CVE-2023-52859: perf: hisi: Fix use-after-free when register pmu fails (bsc#1225582).\n- CVE-2023-52581: netfilter: nf_tables: fix memleak when more than 255 elements expired (bsc#1220877).\n- CVE-2023-52489: mm/sparsemem: fix race in accessing memory_section-\u003eusage (bsc#1221326).\n\n\nThe following non-security bugs were fixed:\n\n- ACPI/NUMA: Apply SRAT proximity domain to entire CFMWS window (git-fixes).\n- ACPI: SBS: manage alarm sysfs attribute through psy core (stable-fixes).\n- ACPI: battery: create alarm sysfs attribute atomically (stable-fixes).\n- ACPI: processor_idle: use raw_safe_halt() in acpi_idle_play_dead() (git-fixes).\n- ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4 (stable-fixes).\n- ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4 (stable-fixes).\n- ALSA: hda/realtek - Fixed ALC256 headphone no sound (stable-fixes).\n- ALSA: hda/realtek - Fixed ALC285 headphone no sound (stable-fixes).\n- ALSA: hda/realtek: Add Framework Laptop 13 (Intel Core Ultra) to quirks (stable-fixes).\n- ALSA: hda/realtek: Add Framework Laptop 13 (Intel Core Ultra) to quirks (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Acer Aspire E5-574G (stable-fixes).\n- ALSA: hda/realtek: Add support for new HP G12 laptops (stable-fixes).\n- ALSA: hda/realtek: Enable mute/micmute LEDs on HP Laptop 14-ey0xxx (stable-fixes).\n- ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7 (git-fixes).\n- ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book3 Ultra (stable-fixes).\n- ALSA: hda/realtek: Implement sound init sequence for Samsung Galaxy Book3 Pro 360 (stable-fixes).\n- ALSA: hda/realtek: support HP Pavilion Aero 13-bg0xxx Mute LED (stable-fixes).\n- ALSA: hda/tas2781: Use correct endian conversion (git-fixes).\n- ALSA: hda/tas2781: fix wrong calibrated data order (git-fixes).\n- ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list (stable-fixes).\n- ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list (stable-fixes).\n- ALSA: hda: Conditionally use snooping for AMD HDMI (git-fixes).\n- ALSA: hda: conexant: Fix headset auto detect fail in the polling mode (git-fixes).\n- ALSA: line6: Fix racy access to midibuf (stable-fixes).\n- ALSA: line6: Fix racy access to midibuf (stable-fixes).\n- ALSA: seq: Skip event type filtering for UMP events (git-fixes).\n- ALSA: seq: ump: Explicitly reset RPN with Null RPN (stable-fixes).\n- ALSA: seq: ump: Optimize conversions from SysEx to UMP (git-fixes).\n- ALSA: seq: ump: Transmit RPN/NRPN message at each MSB/LSB data reception (stable-fixes).\n- ALSA: seq: ump: Use the common RPN/bank conversion context (stable-fixes).\n- ALSA: timer: Relax start tick time check for slave timer elements (git-fixes).\n- ALSA: ump: Explicitly reset RPN with Null RPN (stable-fixes).\n- ALSA: ump: Transmit RPN/NRPN message at each MSB/LSB data reception (stable-fixes).\n- ALSA: usb-audio: Add delay quirk for VIVO USB-C-XE710 HEADSET (stable-fixes).\n- ALSA: usb-audio: Correct surround channels in UAC1 channel map (git-fixes).\n- ALSA: usb-audio: Re-add ScratchAmp quirk entries (git-fixes).\n- ALSA: usb-audio: Re-add ScratchAmp quirk entries (git-fixes).\n- ALSA: usb-audio: Support Yamaha P-125 quirk entry (stable-fixes).\n- ALSA: usb: Fix UBSAN warning in parse_audio_unit() (stable-fixes).\n- ASoC: SOF: Intel: hda-dsp: Make sure that no irq handler is pending before suspend (stable-fixes).\n- ASoC: SOF: Remove libraries from topology lookups (git-fixes).\n- ASoC: SOF: Remove libraries from topology lookups (git-fixes).\n- ASoC: SOF: amd: Fix for acp init sequence (git-fixes).\n- ASoC: SOF: ipc4: check return value of snd_sof_ipc_msg_data (stable-fixes).\n- ASoC: SOF: mediatek: Add missing board compatible (stable-fixes).\n- ASoC: allow module autoloading for table board_ids (stable-fixes).\n- ASoC: allow module autoloading for table db1200_pids (stable-fixes).\n- ASoC: amd: acp: fix module autoloading (git-fixes).\n- ASoC: amd: yc: Add quirk entry for OMEN by HP Gaming Laptop 16-n0xxx (bsc#1227182).\n- ASoC: amd: yc: Support mic on HP 14-em0002la (stable-fixes).\n- ASoC: amd: yc: Support mic on HP 14-em0002la (stable-fixes).\n- ASoC: amd: yc: Support mic on Lenovo Thinkpad E14 Gen 6 (stable-fixes).\n- ASoC: amd: yc: Support mic on Lenovo Thinkpad E14 Gen 6 (stable-fixes).\n- ASoC: codecs: wcd938x-sdw: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wcd938x-sdw: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa881x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa881x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa883x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa883x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa884x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa884x: Correct Soundwire ports mask (git-fixes).\n- ASoC: cs35l45: Checks index of cs35l45_irqs[] (stable-fixes).\n- ASoC: cs35l56: Handle OTP read latency over SoundWire (stable-fixes).\n- ASoC: cs35l56: Handle OTP read latency over SoundWire (stable-fixes).\n- ASoC: cs35l56: Patch CS35L56_IRQ1_MASK_18 to the default value (stable-fixes).\n- ASoC: cs35l56: Patch CS35L56_IRQ1_MASK_18 to the default value (stable-fixes).\n- ASoC: fsl_micfil: Expand the range of FIFO watermark mask (stable-fixes).\n- ASoC: fsl_micfil: Expand the range of FIFO watermark mask (stable-fixes).\n- ASoC: mediatek: mt8188: Mark AFE_DAC_CON0 register as volatile (stable-fixes).\n- ASoC: meson: axg-fifo: fix irq scheduling issue with PREEMPT_RT (git-fixes).\n- ASoC: meson: axg-fifo: fix irq scheduling issue with PREEMPT_RT (git-fixes).\n- ASoC: nau8822: Lower debug print priority (stable-fixes).\n- ASoC: nau8822: Lower debug print priority (stable-fixes).\n- Bluetooth: Add device 13d3:3572 IMC Networks Bluetooth Radio (stable-fixes).\n- Bluetooth: Fix usage of __hci_cmd_sync_status (git-fixes).\n- Bluetooth: L2CAP: Fix deadlock (git-fixes).\n- Bluetooth: MGMT: Add error handling to pair_device() (git-fixes).\n- Bluetooth: SMP: Fix assumption of Central always being Initiator (git-fixes).\n- Bluetooth: bnep: Fix out-of-bound access (stable-fixes).\n- Bluetooth: btintel: Fail setup on error (git-fixes).\n- Bluetooth: btnxpuart: Shutdown timer and prevent rearming when driver unloading (stable-fixes).\n- Bluetooth: btusb: Add RTL8852BE device 0489:e125 to device tables (stable-fixes).\n- Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x13d3:0x3591 (stable-fixes).\n- Bluetooth: hci_conn: Check non NULL function before calling for HFP offload (stable-fixes).\n- Bluetooth: hci_core: Fix LE quote calculation (git-fixes).\n- Bluetooth: hci_core: Fix not handling hibernation actions (git-fixes).\n- Bluetooth: hci_sync: Fix suspending with wrong filter policy (git-fixes).\n- Bluetooth: hci_sync: avoid dup filtering when passive scanning with adv monitor (git-fixes).\n- Bluetooth: l2cap: always unlock channel in l2cap_conless_channel() (git-fixes).\n- Drop libata patch that caused a regression (bsc#1229054)\n- HID: wacom: Defer calculation of resolution until resolution_code is known (git-fixes).\n- Input: i8042 - add Fujitsu Lifebook E756 to i8042 quirk table (bsc#1229056).\n- Input: i8042 - add forcenorestore quirk to leave controller untouched even on s3 (stable-fixes).\n- Input: i8042 - use new forcenorestore quirk to replace old buggy quirk combination (stable-fixes).\n- KVM: Always flush async #PF workqueue when vCPU is being destroyed (git-fixes).\n- KVM: Make KVM_MEM_GUEST_MEMFD mutually exclusive with KVM_MEM_READONLY (git-fixes).\n- KVM: PPC: Book3S HV: Fix the set_one_reg for MMCR3 (bsc#1194869).\n- KVM: PPC: Book3S HV: Handle pending exceptions on guest entry with MSR_EE (bsc#1215199).\n- KVM: Protect vcpu-\u003epid dereference via debugfs with RCU (git-fixes).\n- KVM: Reject overly excessive IDs in KVM_CREATE_VCPU (git-fixes).\n- KVM: Stop processing *all* memslots when 'null' mmu_notifier handler is found (git-fixes).\n- KVM: VMX: Move posted interrupt descriptor out of VMX code (git-fixes).\n- KVM: VMX: Split out the non-virtualization part of vmx_interrupt_blocked() (git-fixes).\n- KVM: VMX: Switch __vmx_exit() and kvm_x86_vendor_exit() in vmx_exit() (git-fixes).\n- KVM: arm64: AArch32: Fix spurious trapping of conditional instructions (git-fixes).\n- KVM: arm64: Add missing memory barriers when switching to pKVM's hyp pgd (git-fixes).\n- KVM: arm64: Allow AArch32 PSTATE.M to be restored as System mode (git-fixes).\n- KVM: arm64: Fix AArch32 register narrowing on userspace write (git-fixes).\n- KVM: arm64: Fix __pkvm_init_switch_pgd call ABI (git-fixes).\n- KVM: arm64: Fix clobbered ELR in sync abort/SError (git-fixes)\n- KVM: arm64: GICv4: Do not perform a map to a mapped vLPI (git-fixes).\n- KVM: arm64: timers: Correctly handle TGE flip with CNTPOFF_EL2 (git-fixes).\n- KVM: arm64: timers: Fix resource leaks in kvm_timer_hyp_init() (git-fixes).\n- KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler (git-fixes).\n- KVM: arm64: vgic-its: Test for valid IRQ in its_sync_lpi_pending_table() (git-fixes).\n- KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id (git-fixes).\n- KVM: arm64: vgic-v4: Restore pending state on host userspace write (git-fixes).\n- KVM: arm64: vgic: Add a non-locking primitive for kvm_vgic_vcpu_destroy() (git-fixes).\n- KVM: arm64: vgic: Force vcpu vgic teardown on vcpu destroy (git-fixes).\n- KVM: arm64: vgic: Simplify kvm_vgic_destroy() (git-fixes).\n- KVM: fix kvm_mmu_memory_cache allocation warning (git-fixes).\n- KVM: nVMX: Add a helper to get highest pending from Posted Interrupt vector (git-fixes).\n- KVM: nVMX: Check for pending posted interrupts when looking for nested events (git-fixes).\n- KVM: nVMX: Request immediate exit iff pending nested event needs injection (git-fixes).\n- KVM: s390: fix LPSWEY handling (bsc#1227634 git-fixes).\n- KVM: s390: fix validity interception issue when gisa is switched off (git-fixes bsc#1229167).\n- KVM: x86/mmu: Bug the VM if KVM tries to split a !hugepage SPTE (git-fixes).\n- KVM: x86: Limit check IDs for KVM_SET_BOOT_CPU_ID (git-fixes).\n- Move upstreamed powerpc patches into sorted section\n- Move upstreamed sound patches into sorted section\n- Moved upstreamed ASoC patch into sorted section\n- NFSD: Support write delegations in LAYOUTGET (git-fixes).\n- NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (git-fixes).\n- PCI: Add Edimax Vendor ID to pci_ids.h (stable-fixes).\n- PCI: hv: Return zero, not garbage, when reading PCI_INTERRUPT_PIN (git-fixes).\n- PCI: loongson: Enable MSI in LS7A Root Complex (stable-fixes).\n- RDMA/cache: Release GID table even if leak is detected (git-fixes)\n- RDMA/device: Return error earlier if port in not valid (git-fixes)\n- RDMA/hns: Check atomic wr length (git-fixes)\n- RDMA/hns: Fix insufficient extend DB for VFs. (git-fixes)\n- RDMA/hns: Fix mbx timing out before CMD execution is completed (git-fixes)\n- RDMA/hns: Fix missing pagesize and alignment check in FRMR (git-fixes)\n- RDMA/hns: Fix shift-out-bounds when max_inline_data is 0 (git-fixes)\n- RDMA/hns: Fix soft lockup under heavy CEQE load (git-fixes)\n- RDMA/hns: Fix undifined behavior caused by invalid max_sge (git-fixes)\n- RDMA/hns: Fix unmatch exception handling when init eq table fails (git-fixes)\n- RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (git-fixes)\n- RDMA/mana_ib: Use virtual address in dma regions for MRs (git-fixes).\n- RDMA/mlx4: Fix truncated output warning in alias_GUID.c (git-fixes)\n- RDMA/mlx4: Fix truncated output warning in mad.c (git-fixes)\n- RDMA/mlx5: Set mkeys for dmabuf at PAGE_SIZE (git-fixes)\n- RDMA/rxe: Do not set BTH_ACK_MASK for UC or UD QPs (git-fixes)\n- RDMA: Fix netdev tracker in ib_device_set_netdev (git-fixes)\n- Revert 'ALSA: firewire-lib: obsolete workqueue for period update' (bsc#1208783).\n- Revert 'ALSA: firewire-lib: operate for period elapse event in process context' (bsc#1208783).\n- Revert 'KVM: Prevent module exit until all VMs are freed' (git-fixes).\n- Revert 'Revert 'md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d'' (git-fixes).\n- Revert 'md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d' (git-fixes).\n- Revert 'misc: fastrpc: Restrict untrusted app to attach to privileged PD' (git-fixes).\n- Revert 'mm: prevent derefencing NULL ptr in pfn_section_valid()' (bsc#1230413).\n- Revert 'mm, kmsan: fix infinite recursion due to RCU critical section' (bsc#1230413).\n- Revert 'mm/sparsemem: fix race in accessing memory_section-\u003eusage' (bsc#1230413).\n- Revert 'usb: gadget: uvc: cleanup request when not in correct state' (stable-fixes).\n- Revert 'usb: typec: tcpm: clear pd_event queue in PORT_RESET' (git-fixes).\n- SUNRPC: Fix a race to wake a sync task (git-fixes).\n- SUNRPC: add a missing rpc_stat for TCP TLS (git-fixes).\n- Squashfs: fix variable overflow triggered by sysbot (git-fixes).\n- USB: serial: debug: do not echo input by default (stable-fixes).\n- Update config files. Disable CONFIG_KFENCE on ppc64le (bsc#1226920)\n- Update config files. Disable vdpa drivers for Alibaba ENI and SolidNET (jsc#PED-8954, bsc#1227834)\n- Update patch references for ASoC regression fixes (bsc#1229045, bsc#1229046)\n- afs: fix __afs_break_callback() / afs_drop_open_mmap() race (git-fixes).\n- apparmor: unpack transition table if dfa is not present (bsc#1226031).\n- arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to (git-fixes)\n- arm64: Add Neoverse-V2 part (git-fixes)\n- arm64: Fix KASAN random tag seed initialization (git-fixes)\n- arm64: armv8_deprecated: Fix warning in isndep cpuhp starting process (git-fixes)\n- arm64: barrier: Restore spec_bar() macro (git-fixes)\n- arm64: cputype: Add Cortex-A720 definitions (git-fixes)\n- arm64: cputype: Add Cortex-A725 definitions (git-fixes)\n- arm64: cputype: Add Cortex-X1C definitions (git-fixes)\n- arm64: cputype: Add Cortex-X3 definitions (git-fixes)\n- arm64: cputype: Add Cortex-X4 definitions (git-fixes)\n- arm64: cputype: Add Cortex-X925 definitions (git-fixes)\n- arm64: cputype: Add Neoverse-V3 definitions (git-fixes)\n- arm64: dts: imx8mp: Add NPU Node (git-fixes)\n- arm64: dts: imx8mp: Fix pgc vpu locations (git-fixes)\n- arm64: dts: imx8mp: Fix pgc_mlmix location (git-fixes)\n- arm64: dts: imx8mp: add HDMI power-domains (git-fixes)\n- arm64: errata: Expand speculative SSBS workaround (again) (git-fixes)\n- arm64: errata: Expand speculative SSBS workaround (git-fixes)\n- arm64: errata: Unify speculative SSBS errata logic (git-fixes). Update config files.\n- arm64: jump_label: Ensure patched jump_labels are visible to all CPUs (git-fixes)\n- ata: libata-scsi: Do not overwrite valid sense data when CK_COND=1 (stable-fixes).\n- ata: libata-scsi: Honor the D_SENSE bit for CK_COND=1 and no error (stable-fixes).\n- blacklist.conf: Add libata upstream revert entry (bsc#1229054)\n- bnxt_re: Fix imm_data endianness (git-fixes)\n- bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG (git-fixes)\n- bpf, lpm: Fix check prefixlen before walking trie (git-fixes).\n- bpf/tests: Remove duplicate JSGT tests (git-fixes).\n- bpf: Add crosstask check to __bpf_get_stack (git-fixes).\n- bpf: Detect IP == ksym.end as part of BPF program (git-fixes).\n- bpf: Ensure proper register state printing for cond jumps (git-fixes).\n- bpf: Fix a few selftest failures due to llvm18 change (git-fixes).\n- bpf: Fix a kernel verifier crash in stacksafe() (bsc#1225903).\n- bpf: Fix check_stack_write_fixed_off() to correctly spill imm (git-fixes).\n- bpf: Fix kfunc callback register type handling (git-fixes).\n- bpf: Fix prog_array_map_poke_run map poke update (git-fixes).\n- bpf: Fix unnecessary -EBUSY from htab_lock_bucket (git-fixes).\n- bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly (git-fixes).\n- bpf: Remove unnecessary wait from bpf_map_copy_value() (git-fixes).\n- bpf: Set uattr-\u003ebatch.count as zero before batched update or deletion (git-fixes).\n- bpf: do not infer PTR_TO_CTX for programs with unnamed context type (git-fixes).\n- bpf: enforce precision of R0 on callback return (git-fixes).\n- bpf: extract bpf_ctx_convert_map logic and make it more reusable (git-fixes).\n- bpf: fix control-flow graph checking in privileged mode (git-fixes).\n- bpf: handle bpf_user_pt_regs_t typedef explicitly for PTR_TO_CTX global arg (git-fixes).\n- bpf: hardcode BPF_PROG_PACK_SIZE to 2MB * num_possible_nodes() (git-fixes).\n- bpf: kprobe: remove unused declaring of bpf_kprobe_override (git-fixes).\n- bpf: simplify btf_get_prog_ctx_type() into btf_is_prog_ctx_type() (git-fixes).\n- bpftool: Align output skeleton ELF code (git-fixes).\n- bpftool: Fix -Wcast-qual warning (git-fixes).\n- bpftool: Silence build warning about calloc() (git-fixes).\n- bpftool: mark orphaned programs during prog show (git-fixes).\n- btrfs: add a btrfs_finish_ordered_extent helper (git-fixes).\n- btrfs: add a is_data_bbio helper (git-fixes).\n- btrfs: add an ordered_extent pointer to struct btrfs_bio (git-fixes).\n- btrfs: copy dir permission and time when creating a stub subvolume (bsc#1228321).\n- btrfs: ensure fast fsync waits for ordered extents after a write failure (git-fixes).\n- btrfs: factor out a btrfs_queue_ordered_fn helper (git-fixes).\n- btrfs: factor out a can_finish_ordered_extent helper (git-fixes).\n- btrfs: fix corruption after buffer fault in during direct IO append write (git-fixes).\n- btrfs: fix double inode unlock for direct IO sync writes (git-fixes).\n- btrfs: fix extent map use-after-free when adding pages to compressed bio (git-fixes).\n- btrfs: fix leak of qgroup extent records after transaction abort (git-fixes).\n- btrfs: fix ordered extent split error handling in btrfs_dio_submit_io (git-fixes).\n- btrfs: limit write bios to a single ordered extent (git-fixes).\n- btrfs: make btrfs_finish_ordered_extent() return void (git-fixes).\n- btrfs: merge the two calls to btrfs_add_ordered_extent in run_delalloc_nocow (git-fixes).\n- btrfs: open code btrfs_bio_end_io in btrfs_dio_submit_io (git-fixes).\n- btrfs: open code end_extent_writepage in end_bio_extent_writepage (git-fixes).\n- btrfs: pass a btrfs_inode to btrfs_fdatawrite_range() (git-fixes).\n- btrfs: pass a btrfs_inode to btrfs_wait_ordered_range() (git-fixes).\n- btrfs: pass an ordered_extent to btrfs_reloc_clone_csums (git-fixes).\n- btrfs: pass an ordered_extent to btrfs_submit_compressed_write (git-fixes).\n- btrfs: remove btrfs_add_ordered_extent (git-fixes).\n- btrfs: rename err to ret in btrfs_direct_write() (git-fixes).\n- btrfs: uninline some static inline helpers from tree-log.h (git-fixes).\n- btrfs: use a btrfs_inode in the log context (struct btrfs_log_ctx) (git-fixes).\n- btrfs: use a btrfs_inode local variable at btrfs_sync_file() (git-fixes).\n- btrfs: use bbio-\u003eordered in btrfs_csum_one_bio (git-fixes).\n- btrfs: use btrfs_finish_ordered_extent to complete buffered writes (git-fixes).\n- btrfs: use btrfs_finish_ordered_extent to complete compressed writes (git-fixes).\n- btrfs: use btrfs_finish_ordered_extent to complete direct writes (git-fixes).\n- btrfs: use irq safe locking when running and adding delayed iputs (git-fixes).\n- cachefiles, erofs: Fix NULL deref in when cachefiles is not doing ondemand-mode (bsc#1229245).\n- cachefiles: add missing lock protection when polling (bsc#1229256).\n- cachefiles: add restore command to recover inflight ondemand read requests (bsc#1229244).\n- cachefiles: add spin_lock for cachefiles_ondemand_info (bsc#1229249).\n- cachefiles: cancel all requests for the object that is being dropped (bsc#1229255).\n- cachefiles: defer exposing anon_fd until after copy_to_user() succeeds (bsc#1229251).\n- cachefiles: extract ondemand info field from cachefiles_object (bsc#1229240).\n- cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read() (bsc#1229247).\n- cachefiles: fix slab-use-after-free in cachefiles_ondemand_get_fd() (bsc#1229246).\n- cachefiles: introduce object ondemand state (bsc#1229239).\n- cachefiles: make on-demand read killable (bsc#1229252).\n- cachefiles: narrow the scope of triggering EPOLLIN events in ondemand mode (bsc#1229243).\n- cachefiles: never get a new anonymous fd if ondemand_id is valid (bsc#1229250).\n- cachefiles: propagate errors from vfs_getxattr() to avoid infinite loop (bsc#1229253).\n- cachefiles: remove err_put_fd label in cachefiles_ondemand_daemon_read() (bsc#1229248).\n- cachefiles: resend an open request if the read request's object is closed (bsc#1229241).\n- cachefiles: stop sending new request when dropping object (bsc#1229254).\n- can: mcp251xfd: tef: prepare to workaround broken TEF FIFO tail index erratum (stable-fixes).\n- can: mcp251xfd: tef: update workaround for erratum DS80000789E 6 of mcp2518fd (stable-fixes).\n- ceph: periodically flush the cap releases (bsc#1230056).\n- cgroup/cpuset: Prevent UAF in proc_cpuset_show() (bsc#1228801).\n- cgroup: Add annotation for holding namespace_sem in current_cgns_cgroup_from_root() (bsc#1222254).\n- cgroup: Eliminate the need for cgroup_mutex in proc_cgroup_show() (bsc#1222254).\n- cgroup: Make operations on the cgroup root_list RCU safe (bsc#1222254).\n- cgroup: Remove unnecessary list_empty() (bsc#1222254).\n- cgroup: preserve KABI of cgroup_root (bsc#1222254).\n- char: xillybus: Check USB endpoints when probing device (git-fixes).\n- char: xillybus: Do not destroy workqueue from work item running on it (stable-fixes).\n- char: xillybus: Refine workqueue handling (git-fixes).\n- clk: en7523: fix rate divider for slic and spi clocks (git-fixes).\n- clk: qcom: Park shared RCGs upon registration (git-fixes).\n- clk: qcom: camcc-sc7280: Add parent dependency to all camera GDSCs (git-fixes).\n- clk: qcom: gcc-sa8775p: Update the GDSC wait_val fields and flags (git-fixes).\n- clk: qcom: gcc-sc7280: Update force mem core bit for UFS ICE clock (git-fixes).\n- clk: qcom: gpucc-sa8775p: Park RCG's clk source at XO during disable (git-fixes).\n- clk: qcom: gpucc-sa8775p: Remove the CLK_IS_CRITICAL and ALWAYS_ON flags (git-fixes).\n- clk: qcom: gpucc-sa8775p: Update wait_val fields for GPU GDSC's (git-fixes).\n- clk: qcom: gpucc-sm8350: Park RCG's clk source at XO during disable (git-fixes).\n- clk: qcom: kpss-xcc: Return of_clk_add_hw_provider to transfer the error (git-fixes).\n- clk: visconti: Add bounds-checking coverage for struct visconti_pll_provider (stable-fixes).\n- clocksource/drivers/sh_cmt: Address race condition for clock events (stable-fixes).\n- cpu/SMT: Enable SMT only if a core is online (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588 git-fixes).\n- dev/parport: fix the array out-of-bounds risk (stable-fixes).\n- device property: Add cleanup.h based fwnode_handle_put() scope based cleanup (stable-fixes).\n- dmaengine: dw: Add memory bus width verification (git-fixes).\n- dmaengine: dw: Add peripheral bus width verification (git-fixes).\n- docs: KVM: Fix register ID of SPSR_FIQ (git-fixes).\n- driver core: Fix uevent_show() vs driver detach race (git-fixes).\n- drm/admgpu: fix dereferencing null pointer context (stable-fixes).\n- drm/amd/display: Add delay to improve LTTPR UHBR interop (stable-fixes).\n- drm/amd/display: Add null checker before passing variables (stable-fixes).\n- drm/amd/display: Adjust cursor position (git-fixes).\n- drm/amd/display: Check for NULL pointer (stable-fixes).\n- drm/amd/display: Skip Recompute DSC Params if no Stream on Link (stable-fixes).\n- drm/amd/display: avoid using null object of framebuffer (git-fixes).\n- drm/amd/display: fix cursor offset on rotation 180 (git-fixes).\n- drm/amd/display: fix s2idle entry for DCN3.5+ (stable-fixes).\n- drm/amd/pm: Fix the null pointer dereference for vega10_hwmgr (stable-fixes).\n- drm/amdgpu/jpeg2: properly set atomics vmid field (stable-fixes).\n- drm/amdgpu/jpeg4: properly set atomics vmid field (stable-fixes).\n- drm/amdgpu/pm: Fix the null pointer dereference for smu7 (stable-fixes).\n- drm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rules (stable-fixes).\n- drm/amdgpu/pm: Fix the param type of set_power_profile_mode (stable-fixes).\n- drm/amdgpu/sdma5.2: Update wptr registers as well as doorbell (stable-fixes).\n- drm/amdgpu/sdma5.2: limit wptr workaround to sdma 5.2.1 (git-fixes).\n- drm/amdgpu: Actually check flags for all context ops (stable-fixes).\n- drm/amdgpu: Add lock around VF RLCG interface (stable-fixes).\n- drm/amdgpu: Fix the null pointer dereference to ras_manager (stable-fixes).\n- drm/amdgpu: Forward soft recovery errors to userspace (stable-fixes).\n- drm/amdgpu: Validate TA binary size (stable-fixes).\n- drm/amdgpu: fix dereference null return value for the function amdgpu_vm_pt_parent (stable-fixes).\n- drm/amdgpu: fix potential resource leak warning (stable-fixes).\n- drm/amdgpu: reset vm state machine after gpu reset(vram lost) (stable-fixes).\n- drm/bridge: analogix_dp: properly handle zero sized AUX transactions (stable-fixes).\n- drm/client: fix null pointer dereference in drm_client_modeset_probe (git-fixes).\n- drm/dp_mst: Skip CSN if topology probing is not done yet (stable-fixes).\n- drm/etnaviv: do not block scheduler when GPU is still active (stable-fixes).\n- drm/i915/dsi: Make Lenovo Yoga Tab 3 X90F DMI match less strict (git-fixes).\n- drm/i915/gem: Adjust vma offset for framebuffer mmap offset (stable-fixes).\n- drm/i915/gem: Fix Virtual Memory mapping boundaries calculation (git-fixes).\n- drm/i915/hdcp: Fix HDCP2_STREAM_STATUS macro (git-fixes).\n- drm/i915: Fix possible int overflow in skl_ddi_calculate_wrpll() (git-fixes).\n- drm/lima: set gp bus_stop bit before hard reset (stable-fixes).\n- drm/mediatek/dp: Fix spurious kfree() (git-fixes).\n- drm/msm/dp: fix the max supported bpp logic (git-fixes).\n- drm/msm/dp: reset the link phy params before link training (git-fixes).\n- drm/msm/dpu: capture snapshot on the first commit_done timeout (stable-fixes).\n- drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails (git-fixes).\n- drm/msm/dpu: do not play tricks with debug macros (git-fixes).\n- drm/msm/dpu: drop MSM_ENC_VBLANK support (stable-fixes).\n- drm/msm/dpu: move dpu_encoder's connector assignment to atomic_enable() (git-fixes).\n- drm/msm/dpu: split dpu_encoder_wait_for_event into two functions (stable-fixes).\n- drm/msm/dpu: take plane rotation into account for wide planes (git-fixes).\n- drm/msm/dpu: try multirect based on mdp clock limits (stable-fixes).\n- drm/msm/dpu: use drmm-managed allocation for dpu_encoder_phys (stable-fixes).\n- drm/msm/mdss: Rename path references to mdp_path (stable-fixes).\n- drm/msm/mdss: switch mdss to use devm_of_icc_get() (stable-fixes).\n- drm/msm: Reduce fallout of fence signaling vs reclaim hangs (stable-fixes).\n- drm/nouveau: prime: fix refcount underflow (git-fixes).\n- drm/panel: nt36523: Set 120Hz fps for xiaomi,elish panels (stable-fixes).\n- drm/radeon/evergreen_cs: Clean up errors in evergreen_cs.c (bsc#1229024).\n- drm/radeon: Remove __counted_by from StateArray.states[] (git-fixes).\n- drm/rockchip: vop2: clear afbc en and transform bit for cluster window at linear mode (stable-fixes).\n- drm/virtio: Fix type of dma-fence context variable (git-fixes).\n- drm/vmwgfx: Fix a deadlock in dma buf fence polling (git-fixes).\n- drm/vmwgfx: Fix overlay when using Screen Targets (git-fixes).\n- drm/vmwgfx: Fix prime with external buffers (git-fixes).\n- efi/libstub: Zero initialize heap allocated struct screen_info (git-fixes).\n- evm: do not copy up 'security.evm' xattr (git-fixes).\n- firmware: cirrus: cs_dsp: Initialize debugfs_root to invalid (stable-fixes).\n- fs/netfs/fscache_cookie: add missing 'n_accesses' check (bsc#1229455).\n- fuse: Initialize beyond-EOF page contents before setting uptodate (bsc#1229456).\n- genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline (git-fixes).\n- genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware (git-fixes).\n- genirq/matrix: Exclude managed interrupts in irq_matrix_allocated() (git-fixes).\n- gfs2: setattr_chown: Add missing initialization (git-fixes).\n- gpio: mlxbf3: Support shutdown() function (git-fixes).\n- gpio: prevent potential speculation leaks in gpio_device_get_desc() (stable-fixes).\n- gpio: sysfs: extend the critical section for unregistering sysfs devices (stable-fixes).\n- gss_krb5: Fix the error handling path for crypto_sync_skcipher_setkey (git-fixes).\n- hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode() (git-fixes).\n- hwmon: (ltc2992) Avoid division by zero (stable-fixes).\n- hwmon: (ltc2992) Fix memory leak in ltc2992_parse_dt() (git-fixes).\n- hwmon: (pc87360) Bounds check data-\u003einnr usage (stable-fixes).\n- i2c: Fix conditional for substituting empty ACPI functions (stable-fixes).\n- i2c: Use IS_REACHABLE() for substituting empty ACPI functions (git-fixes).\n- i2c: qcom-geni: Add missing clk_disable_unprepare in geni_i2c_runtime_resume (git-fixes).\n- i2c: qcom-geni: Add missing geni_icc_disable in geni_i2c_runtime_resume (git-fixes).\n- i2c: qcom-geni: Add missing geni_icc_disable in geni_i2c_runtime_resume (git-fixes).\n- i2c: riic: avoid potential division by zero (stable-fixes).\n- i2c: smbus: Improve handling of stuck alerts (git-fixes).\n- i2c: smbus: Send alert notifications to all devices if source not found (git-fixes).\n- i2c: stm32f7: Add atomic_xfer method to driver (stable-fixes).\n- i3c: mipi-i3c-hci: Do not unmap region not mapped for transfer (stable-fixes).\n- i3c: mipi-i3c-hci: Remove BUG() when Ring Abort request times out (stable-fixes).\n- i915/perf: Remove code to update PWR_CLK_STATE for gen12 (git-fixes).\n- ice: Fix NULL pointer access, if PF does not support SRIOV_LAG (bsc#1228737).\n- io_uring/advise: support 64-bit lengths (git-fixes).\n- io_uring: Drop per-ctx dummy_ubuf (git-fixes).\n- io_uring: Fix probe of disabled operations (git-fixes).\n- io_uring: fix io_match_task must_hold (git-fixes).\n- io_uring: tighten task exit cancellations (git-fixes).\n- iommu/amd: Convert comma to semicolon (git-fixes).\n- iommu/vt-d: Fix identity map bounds in si_domain_init() (git-fixes).\n- iommufd/device: Fix hwpt at err_unresv in iommufd_device_do_replace() (git-fixes).\n- ip6_tunnel: Fix broken GRO (bsc#1229444).\n- ipv6: sr: fix incorrect unregister order (git-fixes).\n- irqdomain: Fixed unbalanced fwnode get and put (git-fixes).\n- jfs: Fix shift-out-of-bounds in dbDiscardAG (git-fixes).\n- jfs: define xtree root and page independently (git-fixes).\n- jfs: fix null ptr deref in dtInsertEntry (git-fixes).\n- jump_label: Clarify condition in static_key_fast_inc_not_disabled() (git-fixes).\n- jump_label: Fix concurrency issues in static_key_slow_dec() (git-fixes).\n- jump_label: Fix the fix, brown paper bags galore (git-fixes).\n- jump_label: Simplify and clarify static_key_fast_inc_cpus_locked() (git-fixes).\n- kABI fix of: virtio-crypto: handle config changed by work queue (git-fixes).\n- kABI workaround for sound core UMP conversion (stable-fixes).\n- kabi fix for KVM: s390: fix LPSWEY handling (bsc#1227634 git-fixes).\n- kabi fix for SUNRPC: add a missing rpc_stat for TCP TLS (git-fixes).\n- kabi/severities: ignore kABI for FireWire sound local symbols (bsc#1208783)\n- kabi: more build fix without patches.kabi (bsc#1226502)\n- kcov: properly check for softirq context (git-fixes).\n- kernel-binary.spec.in: Enable klp_symbols on openSUSE Tumbleweed (boo#1229042). \n- kernel-binary: generate and install compile_commands.json (bsc#1228971). \n- kernfs: Convert kernfs_path_from_node_locked() from strlcpy() to strscpy() (bsc#1229134).\n- kernfs: fix false-positive WARN(nr_mmapped) in kernfs_drain_open_files (git-fixes).\n- kprobes: Fix to check symbol prefixes correctly (git-fixes).\n- kprobes: Prohibit probing on CFI preamble symbol (git-fixes).\n- kvm: s390: Reject memory region operations for ucontrol VMs (git-fixes bsc#1229168).\n- libbpf: Add missing LIBBPF_API annotation to libbpf_set_memlock_rlim API (git-fixes).\n- libbpf: Apply map_set_def_max_entries() for inner_maps on creation (git-fixes).\n- libbpf: Fix faccessat() usage on Android (git-fixes).\n- libbpf: Use OPTS_SET() macro in bpf_xdp_query() (git-fixes).\n- md-cluster: fix hanging issue while a new disk adding (bsc#1223395).\n- md-cluster: fix hanging issue while a new disk adding (bsc#1223395).\n- md-cluster: fix no recovery job when adding/re-adding a disk (bsc#1223395).\n- md-cluster: fix no recovery job when adding/re-adding a disk (bsc#1223395).\n- md-cluster: keeping kabi compatibility for upstream commit 35a0a409fa26 (bsc#1223395).\n- md/md-bitmap: fix writing non bitmap pages (git-fixes).\n- md/raid1: set max_sectors during early return from choose_slow_rdev() (git-fixes).\n- md/raid1: support read error check (git-fixes).\n- md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (git-fixes).\n- md/raid5: fix spares errors about rcu usage (git-fixes).\n- md/raid5: recheck if reshape has finished with device_lock held (git-fixes).\n- md: Do not wait for MD_RECOVERY_NEEDED for HOT_REMOVE_DISK ioctl (git-fixes).\n- md: add a mddev_add_trace_msg helper (git-fixes).\n- md: add check for sleepers in md_wakeup_thread() (git-fixes).\n- md: change the return value type of md_write_start to void (git-fixes).\n- md: do not account sync_io if iostats of the disk is disabled (git-fixes).\n- md: do not delete safemode_timer in mddev_suspend (git-fixes).\n- md: factor out a helper exceed_read_errors() to check read_errors (git-fixes).\n- md: fix a suspicious RCU usage warning (git-fixes).\n- media: Revert 'media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()' (git-fixes).\n- media: amphion: Remove lock in s_ctrl callback (stable-fixes).\n- media: drivers/media/dvb-core: copy user arrays safely (stable-fixes).\n- media: pci: cx23885: check cx23885_vdev_init() return (stable-fixes).\n- media: uvcvideo: Add quirk for invalid dev_sof in Logitech C920 (git-fixes).\n- media: uvcvideo: Disable autosuspend for Insta360 Link (stable-fixes).\n- media: uvcvideo: Fix the bandwdith quirk on USB 3.x (stable-fixes).\n- media: uvcvideo: Ignore empty TS packets (stable-fixes).\n- media: uvcvideo: Quirk for invalid dev_sof in Logitech C922 (stable-fixes).\n- media: xc2028: avoid use-after-free in load_firmware_cb() (stable-fixes).\n- memcg: protect concurrent access to mem_cgroup_idr (git-fixes).\n- memory: stm32-fmc2-ebi: check regmap_read return value (stable-fixes).\n- memory: tegra: Skip SID programming if SID registers are not set (stable-fixes).\n- minmax: add a few more MIN_T/MAX_T users (bsc#1229024).\n- minmax: avoid overly complicated constant expressions in VM code (bsc#1229024).\n- minmax: do not use max() in situations that want a C constant expression (bsc#1229024).\n- minmax: fix up min3() and max3() too (bsc#1229024).\n- minmax: improve macro expansion and type checking (bsc#1229024).\n- minmax: make generic MIN() and MAX() macros available everywhere (bsc#1229024).\n- minmax: simplify and clarify min_t()/max_t() implementation (bsc#1229024).\n- minmax: simplify min()/max()/clamp() implementation (bsc#1229024).\n- mm, kmsan: fix infinite recursion due to RCU critical section (git-fixes).\n- mm: prevent derefencing NULL ptr in pfn_section_valid() (git-fixes).\n- mmc: dw_mmc: allow biu and ciu clocks to defer (git-fixes).\n- mmc: mmc_test: Fix NULL dereference on allocation failure (git-fixes).\n- mmc: mtk-sd: receive cmd8 data when hs400 tuning fail (git-fixes).\n- net/iucv: fix the allocation size of iucv_path_table array (git-fixes bsc#1229451).\n- net/iucv: fix use after free in iucv_sock_close() (bsc#1228973).\n- net/rds: fix possible cp null dereference (git-fixes).\n- net/sched: initialize noop_qdisc owner (git-fixes).\n- net: drop bad gso csum_start and offset in virtio_net_hdr (git-fixes).\n- net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb() (git-fixes).\n- net: fix sk_memory_allocated_{add|sub} vs softirqs (bsc#1228757).\n- net: mana: Add support for page sizes other than 4KB on ARM64 (jsc#PED-8491 bsc#1226530).\n- net: mana: Fix RX buf alloc_size alignment and atomic op panic (bsc#1229086).\n- net: mana: Fix doorbell out of order violation and avoid unnecessary doorbell rings (bsc#1229154).\n- net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response (git-fixes).\n- net: missing check virtio (git-fixes).\n- net: phy: micrel: Fix the KSZ9131 MDI-X status issue (git-fixes).\n- net: phy: realtek: add support for RTL8366S Gigabit PHY (git-fixes).\n- net: usb: qmi_wwan: fix memory leak for not ip packets (git-fixes).\n- net: usb: sr9700: fix uninitialized variable use in sr_mdio_read (git-fixes).\n- netfs, fscache: export fscache_put_volume() and add fscache_try_get_volume() (bsc#1228459 bsc#1228462).\n- nfc: pn533: Add poll mod list filling check (git-fixes).\n- nfs: do not invalidate dentries on transient errors (git-fixes).\n- nfs: expose /proc/net/sunrpc/nfs in net namespaces (git-fixes).\n- nfs: make the rpc_stat per net namespace (git-fixes).\n- nfs: pass explicit offset/count to trace events (git-fixes).\n- nfs: propagate readlink errors in nfs_symlink_filler (git-fixes).\n- nouveau/firmware: use dma non-coherent allocator (git-fixes).\n- nvme-multipath: find NUMA path only for online numa-node (git-fixes).\n- nvme-multipath: implement 'queue-depth' iopolicy (bsc#1227706).\n- nvme-multipath: prepare for 'queue-depth' iopolicy (bsc#1227706).\n- nvme-pci: Fix the instructions for disabling power management (git-fixes).\n- nvme-pci: add missing condition check for existence of mapped data (git-fixes).\n- nvme-pci: do not directly handle subsys reset fallout (bsc#1220066).\n- nvme-sysfs: add 'tls_configured_key' sysfs attribute (bsc#1221857).\n- nvme-sysfs: add 'tls_keyring' attribute (bsc#1221857).\n- nvme-tcp: check for invalidated or revoked key (bsc#1221857).\n- nvme-tcp: sanitize TLS key handling (bsc#1221857).\n- nvme: add a newline to the 'tls_key' sysfs attribute (bsc#1221857).\n- nvme: adjust multiples of NVME_CTRL_PAGE_SIZE in offset (git-fixes).\n- nvme: avoid double free special payload (git-fixes).\n- nvme: fix NVME_NS_DEAC may incorrectly identifying the disk as EXT_LBA (git-fixes).\n- nvme: fixup comment for nvme RDMA Provider Type (git-fixes).\n- nvme: split off TLS sysfs attributes into a separate group (bsc#1221857).\n- nvme: tcp: remove unnecessary goto statement (bsc#1221857).\n- nvme_core: scan namespaces asynchronously (bsc#1224105).\n- nvmet-auth: fix nvmet_auth hash error handling (git-fixes).\n- nvmet: always initialize cqe.result (git-fixes).\n- nvmet: do not return 'reserved' for empty TSAS values (git-fixes).\n- nvmet: fix a possible leak when destroy a ctrl during qp establishment (git-fixes).\n- nvmet: make 'tsas' attribute idempotent for RDMA (git-fixes).\n- ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry() (bsc#1228410).\n- padata: Fix possible divide-by-0 panic in padata_mt_helper() (git-fixes).\n- perf/smmuv3: Enable HiSilicon Erratum 162001900 quirk for HIP08/09 (git-fixes).\n- pinctrl: mediatek: common-v2: Fix broken bias-disable for PULL_PU_PD_RSEL_TYPE (git-fixes).\n- pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B pins (git-fixes).\n- pinctrl: single: fix potential NULL dereference in pcs_get_function() (git-fixes).\n- pinctrl: starfive: jh7110: Correct the level trigger configuration of iev register (git-fixes).\n- platform/chrome: cros_ec_proto: Lock device when updating MKBP version (git-fixes).\n- platform/chrome: cros_ec_proto: Lock device when updating MKBP version (git-fixes).\n- platform/surface: aggregator: Fix warning when controller is destroyed in probe (git-fixes).\n- platform/x86/amd/hsmp: Add support for ACPI based probing (jsc#PED-8779).\n- platform/x86/amd/hsmp: Cache pci_dev in struct hsmp_socket (jsc#PED-8779).\n- platform/x86/amd/hsmp: Change devm_kzalloc() to devm_kcalloc() (jsc#PED-8779).\n- platform/x86/amd/hsmp: Check HSMP support on AMD family of processors (jsc#PED-8779).\n- platform/x86/amd/hsmp: Check num_sockets against MAX_AMD_SOCKETS (jsc#PED-8779).\n- platform/x86/amd/hsmp: Create static func to handle platdev (jsc#PED-8779).\n- platform/x86/amd/hsmp: Define a struct to hold mailbox regs (jsc#PED-8779).\n- platform/x86/amd/hsmp: Move dev from platdev to hsmp_socket (jsc#PED-8779).\n- platform/x86/amd/hsmp: Move hsmp_test to probe (jsc#PED-8779).\n- platform/x86/amd/hsmp: Non-ACPI support for AMD F1A_M00~0Fh (jsc#PED-8779).\n- platform/x86/amd/hsmp: Remove extra parenthesis and add a space (jsc#PED-8779).\n- platform/x86/amd/hsmp: Restructure sysfs group creation (jsc#PED-8779).\n- platform/x86/amd/hsmp: switch to use device_add_groups() (jsc#PED-8779).\n- platform/x86/intel/ifs: Initialize union ifs_status to zero (git-fixes).\n- platform/x86: lg-laptop: fix %s null argument warning (stable-fixes).\n- power: supply: axp288_charger: Fix constant_charge_voltage writes (git-fixes).\n- power: supply: axp288_charger: Round constant_charge_voltage writes down (git-fixes).\n- power: supply: qcom_battmgr: return EAGAIN when firmware service is not up (git-fixes).\n- powerpc/64: Set _IO_BASE to POISON_POINTER_DELTA not 0 for CONFIG_PCI=n (bsc#1194869).\n- powerpc/io: Avoid clang null pointer arithmetic warnings (bsc#1194869).\n- powerpc/kexec: make the update_cpus_node() function public (bsc#1194869).\n- powerpc/kexec: split CONFIG_KEXEC_FILE and CONFIG_CRASH_DUMP (bsc#1194869).\n- powerpc/kexec_file: fix cpus node update to FDT (bsc#1194869).\n- powerpc/pseries: Add failure related checks for h_get_mpp and h_get_ppp (bsc#1194869).\n- powerpc/pseries: Whitelist dtl slub object for copying to userspace (bsc#1194869).\n- powerpc/radix: Move some functions into #ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE (bsc#1194869).\n- powerpc/topology: Check if a core is online (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588 git-fixes).\n- powerpc/xmon: Check cpu id in commands 'c#', 'dp#' and 'dx#' (bsc#1194869).\n- powerpc: fix a file leak in kvm_vcpu_ioctl_enable_cap() (bsc#1194869).\n- powerpc: xor_vmx: Add '-mhard-float' to CFLAGS (bsc#1194869).\n- printk/panic: Allow cpu backtraces to be written into ringbuffer during panic (bsc#1225607).\n- reiserfs: fix uninit-value in comp_keys (git-fixes).\n- rtc: nct3018y: fix possible NULL dereference (stable-fixes).\n- s390/cpum_cf: Fix endless loop in CF_DIAG event stop (git-fixes bsc#1229171).\n- s390/dasd: fix error checks in dasd_copy_pair_store() (git-fixes bsc#1229173).\n- s390/dasd: fix error recovery leading to data corruption on ESE devices (git-fixes bsc#1229452).\n- s390/pci: Add missing virt_to_phys() for directed DIBV (git-fixes bsc#1229174).\n- s390/pci: Allow allocation of more than 1 MSI interrupt (git-fixes bsc#1229172).\n- s390/pci: Refactor arch_setup_msi_irqs() (git-fixes bsc#1229172).\n- s390/pkey: harmonize pkey s390 debug feature calls (bsc#1228720).\n- s390/pkey: introduce dynamic debugging for pkey (bsc#1228720).\n- s390/sclp: Prevent release of buffer in I/O (git-fixes bsc#1229169).\n- s390/uv: Panic for set and remove shared access UVC errors (git-fixes bsc#1229170).\n- samples/bpf: syscall_tp_user: Fix array out-of-bound access (git-fixes).\n- samples/bpf: syscall_tp_user: Rename num_progs into nr_tests (git-fixes).\n- sbitmap: use READ_ONCE to access map-\u003eword (stable-fixes).\n- scsi: lpfc: Allow DEVICE_RECOVERY mode after RSCN receipt if in PRLI_ISSUE state (bsc#1228857).\n- scsi: lpfc: Cancel ELS WQE instead of issuing abort when SLI port is inactive (bsc#1228857).\n- scsi: lpfc: Fix handling of fully recovered fabric node in dev_loss callbk (bsc#1228857).\n- scsi: lpfc: Fix incorrect request len mbox field when setting trunking via sysfs (bsc#1228857).\n- scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (bsc#1228857).\n- scsi: lpfc: Relax PRLI issue conditions after GID_FT response (bsc#1228857).\n- scsi: lpfc: Revise lpfc_prep_embed_io routine with proper endian macro usages (bsc#1228857).\n- scsi: lpfc: Update lpfc version to 14.4.0.3 (bsc#1228857).\n- scsi: qla2xxx: Avoid possible run-time warning with long model_num (bsc#1228850).\n- scsi: qla2xxx: Complete command early within lock (bsc#1228850).\n- scsi: qla2xxx: Convert comma to semicolon (bsc#1228850).\n- scsi: qla2xxx: Drop driver owner assignment (bsc#1228850).\n- scsi: qla2xxx: During vport delete send async logout explicitly (bsc#1228850).\n- scsi: qla2xxx: Fix debugfs output for fw_resource_count (bsc#1228850).\n- scsi: qla2xxx: Fix flash read failure (bsc#1228850).\n- scsi: qla2xxx: Fix for possible memory corruption (bsc#1228850).\n- scsi: qla2xxx: Fix optrom version displayed in FDMI (bsc#1228850).\n- scsi: qla2xxx: Indent help text (bsc#1228850).\n- scsi: qla2xxx: Reduce fabric scan duplicate code (bsc#1228850).\n- scsi: qla2xxx: Remove unused struct 'scsi_dif_tuple' (bsc#1228850).\n- scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for ELS cmds (bsc#1228850).\n- scsi: qla2xxx: Unable to act on RSCN for port online (bsc#1228850).\n- scsi: qla2xxx: Update version to 10.02.09.300-k (bsc#1228850).\n- scsi: qla2xxx: Use QP lock to search for bsg (bsc#1228850).\n- scsi: qla2xxx: validate nvme_local_port correctly (bsc#1228850).\n- selftest/bpf: Add map_in_maps with BPF_MAP_TYPE_PERF_EVENT_ARRAY values (git-fixes).\n- selftests/bpf: Add a test to verify previous stacksafe() fix (bsc#1225903).\n- selftests/bpf: Add assert for user stacks in test_task_stack (git-fixes).\n- selftests/bpf: Add netkit to tc_redirect selftest (git-fixes).\n- selftests/bpf: De-veth-ize the tc_redirect test case (git-fixes).\n- selftests/bpf: Disable IPv6 for lwt_redirect test (git-fixes).\n- selftests/bpf: Fix erroneous bitmask operation (git-fixes).\n- selftests/bpf: Fix issues in setup_classid_environment() (git-fixes).\n- selftests/bpf: Fix potential premature unload in bpf_testmod (git-fixes).\n- selftests/bpf: Fix pyperf180 compilation failure with clang18 (git-fixes).\n- selftests/bpf: Fix the flaky tc_redirect_dtime test (git-fixes).\n- selftests/bpf: Fix up xdp bonding test wrt feature flags (git-fixes).\n- selftests/bpf: Make linked_list failure test more robust (git-fixes).\n- selftests/bpf: Relax time_tai test for equal timestamps in tai_forward (git-fixes).\n- selftests/bpf: Skip module_fentry_shadow test when bpf_testmod is not available (git-fixes).\n- selftests/bpf: Wait for the netstamp_needed_key static key to be turned on (git-fixes).\n- selftests/bpf: fix RELEASE=1 build for tc_opts (git-fixes).\n- selftests/bpf: fix bpf_loop_bench for new callback verification scheme (git-fixes).\n- selftests/bpf: fix compiler warnings in RELEASE=1 mode (git-fixes).\n- selftests/bpf: satisfy compiler by having explicit return in btf test (git-fixes).\n- serial: core: check uartclk for zero to avoid divide by zero (stable-fixes).\n- soc: qcom: cmd-db: Map shared memory as WC, not WB (git-fixes).\n- soc: qcom: pmic_glink: Actually communicate when remote goes down (git-fixes).\n- soundwire: stream: fix programming slave ports for non-continous port maps (git-fixes).\n- spi: Add empty versions of ACPI functions (stable-fixes).\n- spi: microchip-core: fix init function not setting the master and motorola modes (git-fixes).\n- spi: microchip-core: switch to use modern name (stable-fixes).\n- spi: spi-fsl-lpspi: Fix scldiv calculation (git-fixes).\n- spi: spidev: Add missing spi_device_id for bh2228fv (git-fixes).\n- squashfs: squashfs_read_data need to check if the length is 0 (git-fixes).\n- ssb: Fix division by zero issue in ssb_calc_clock_rate (stable-fixes).\n- staging: iio: resolver: ad2s1210: fix use before initialization (stable-fixes).\n- staging: ks7010: disable bh on tx_dev_lock (stable-fixes).\n- string.h: Introduce memtostr() and memtostr_pad() (bsc#1228849).\n- sunrpc: add a struct rpc_stats arg to rpc_create_args (git-fixes).\n- swiotlb: do not set total_used to 0 in swiotlb_create_debugfs_files() (git-fixes).\n- swiotlb: fix swiotlb_bounce() to do partial sync's correctly (git-fixes).\n- syscalls: fix compat_sys_io_pgetevents_time64 usage (git-fixes).\n- thermal/drivers/broadcom: Fix race between removal and clock disable (git-fixes).\n- thermal: bcm2835: Convert to platform remove callback returning void (stable-fixes).\n- thunderbolt: Mark XDomain as unplugged when router is removed (stable-fixes).\n- tools/perf: Fix perf bench epoll to enable the run when some CPU's are offline (bsc#1227747).\n- tools/perf: Fix perf bench futex to enable the run when some CPU's are offline (bsc#1227747).\n- tools/perf: Fix timing issue with parallel threads in perf bench wake-up-parallel (bsc#1227747).\n- tools/resolve_btfids: Fix comparison of distinct pointer types warning in resolve_btfids (git-fixes).\n- tools/resolve_btfids: Fix cross-compilation to non-host endianness (git-fixes).\n- tools/resolve_btfids: Refactor set sorting with types from btf_ids.h (git-fixes).\n- tools/resolve_btfids: fix build with musl libc (git-fixes).\n- trace/pid_list: Change gfp flags in pid_list_fill_irq() (git-fixes).\n- tracing: Return from tracing_buffers_read() if the file has been closed (bsc#1229136 git-fixes).\n- tty: atmel_serial: use the correct RTS flag (git-fixes).\n- tty: serial: fsl_lpuart: mark last busy before uart_add_one_port (git-fixes).\n- usb: cdnsp: fix for Link TRB with TC (git-fixes).\n- usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function (git-fixes).\n- usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes() (git-fixes).\n- usb: dwc3: core: Skip setting event buffers for host only controllers (stable-fixes).\n- usb: dwc3: omap: add missing depopulate in probe error path (git-fixes).\n- usb: dwc3: st: add missing depopulate in probe error path (git-fixes).\n- usb: dwc3: st: fix probed platform device ref count on probe error path (git-fixes).\n- usb: gadget: core: Check for unset descriptor (git-fixes).\n- usb: gadget: fsl: Increase size of name buffer for endpoints (stable-fixes).\n- usb: gadget: u_audio: Check return codes from usb_ep_enable and config_ep_by_speed (git-fixes).\n- usb: gadget: u_serial: Set start_delayed during suspend (git-fixes).\n- usb: gadget: uvc: cleanup request when not in correct state (stable-fixes).\n- usb: typec: fsa4480: Add support to swap SBU orientation (git-fixes).\n- usb: typec: fsa4480: Check if the chip is really there (git-fixes).\n- usb: typec: fsa4480: Relax CHIP_ID check (git-fixes).\n- usb: typec: fsa4480: add support for Audio Accessory Mode (git-fixes).\n- usb: typec: fsa4480: rework mux \u0026 switch setup to handle more states (git-fixes).\n- usb: vhci-hcd: Do not drop references before new references are gained (stable-fixes).\n- vfio/pci: fix potential memory leak in vfio_intx_enable() (git-fixes).\n- vhost-scsi: Handle vhost_vq_work_queue failures for events (git-fixes).\n- vhost-vdpa: switch to use vmf_insert_pfn() in the fault handler (git-fixes).\n- vhost/vsock: always initialize seqpacket_allow (git-fixes).\n- vhost: Release worker mutex during flushes (git-fixes).\n- vhost: Use virtqueue mutex for swapping worker (git-fixes).\n- virt: guest_memfd: fix reference leak on hwpoisoned page (git-fixes).\n- virtio-crypto: handle config changed by work queue (git-fixes).\n- virtio: reenable config if freezing device failed (git-fixes).\n- virtio_net: use u64_stats_t infra to avoid data-races (git-fixes).\n- virtiofs: forbid newlines in tags (bsc#1229940).\n- wifi: ath12k: fix memory leak in ath12k_dp_rx_peer_frag_setup() (stable-fixes).\n- wifi: ath12k: fix soft lockup on suspend (git-fixes).\n- wifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion (git-fixes).\n- wifi: cfg80211: fix reporting failed MLO links status with cfg80211_connect_done (git-fixes).\n- wifi: iwlwifi: fw: fix wgds rev 3 exact size (git-fixes).\n- wifi: mac80211: use monitor sdata with driver only if desired (git-fixes).\n- wifi: mwifiex: duplicate static structs used in driver instances (git-fixes).\n- wifi: nl80211: disallow setting special AP channel widths (stable-fixes).\n- wifi: nl80211: do not give key data to userspace (stable-fixes).\n- wifi: rtw88: usb: Fix disconnection after beacon loss (stable-fixes).\n- wifi: wfx: repair open network AP mode (git-fixes).\n- workqueue: Improve scalability of workqueue watchdog touch (bsc#1193454).\n- workqueue: wq_watchdog_touch is always called with valid CPU (bsc#1193454).\n- x86/asm: Use %c/%n instead of %P operand modifier in asm templates (git-fixes).\n- x86/entry/64: Remove obsolete comment on tracing vs. SYSRET (git-fixes).\n- x86/mm: Fix pti_clone_entry_text() for i386 (git-fixes).\n- x86/mm: Fix pti_clone_pgtable() alignment assumption (git-fixes).\n- x86/mtrr: Check if fixed MTRRs exist before saving them (git-fixes).\n- x86/numa: Fix SRAT lookup of CFMWS ranges with numa_fill_memblks() (git-fixes).\n- x86/numa: Fix the address overlap check in numa_fill_memblks() (git-fixes).\n- x86/numa: Fix the sort compare func used in numa_fill_memblks() (git-fixes).\n- x86/numa: Introduce numa_fill_memblks() (git-fixes).\n- x86/pci: Skip early E820 check for ECAM region (git-fixes).\n- x86/xen: Convert comma to semicolon (git-fixes).\n- xfs: Fix missing interval for missing_owner in xfs fsmap (git-fixes).\n- xfs: Fix the owner setting issue for rmap query in xfs fsmap (git-fixes).\n- xfs: allow cross-linking special files without project quota (git-fixes).\n- xfs: allow symlinks with short remote targets (bsc#1229160).\n- xfs: allow unlinked symlinks and dirs with zero size (git-fixes).\n- xfs: attr forks require attr, not attr2 (git-fixes).\n- xfs: convert comma to semicolon (git-fixes).\n- xfs: do not use current-\u003ejournal_info (git-fixes).\n- xfs: fix unlink vs cluster buffer instantiation race (git-fixes).\n- xfs: honor init_xattrs in xfs_init_new_inode for !ATTR fs (git-fixes).\n- xfs: journal geometry is not properly bounds checked (git-fixes).\n- xfs: match lock mode in xfs_buffered_write_iomap_begin() (git-fixes).\n- xfs: require XFS_SB_FEAT_INCOMPAT_LOG_XATTRS for attr log intent item recovery (git-fixes).\n- xfs: upgrade the extent counters in xfs_reflink_end_cow_extent later (git-fixes).\n- xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code (git-fixes).\n- xfs: use consistent uid/gid when grabbing dquots for inodes (git-fixes).\n- xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration (git-fixes).\n- xprtrdma: Fix rpcrdma_reqs_reset() (git-fixes).\n","status":"published","published":"2024-09-23T08:29:55Z","modified":"2026-02-04T02:30:48.4895Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2025:20044-1","title":"Security update for the Linux Kernel","description":"\n\nThe SUSE Linux Enterprise Micro 6.0 kernel was updated to receive various security bugfixes.\n\nThis release includes the first live patch.\n\nThe following security bugs were fixed:\n\n- CVE-2023-52489: mm/sparsemem: fix race in accessing memory_section-\u003eusage (bsc#1221326).\n- CVE-2023-52581: netfilter: nf_tables: fix memleak when more than 255 elements expired (bsc#1220877).\n- CVE-2023-52859: perf: hisi: Fix use-after-free when register pmu fails (bsc#1225582).\n- CVE-2023-52889: apparmor: Fix null pointer deref when receiving skb during sock creation (bsc#1229287,).\n- CVE-2024-26590: erofs: fix inconsistent per-file compression format (bsc#1220252).\n- CVE-2024-26631: ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work (bsc#1221630).\n- CVE-2024-26668: netfilter: nft_limit: reject configurations that cause integer overflow (bsc#1222335).\n- CVE-2024-26669: kABI fix for net/sched: flower: Fix chain template offload (bsc#1222350).\n- CVE-2024-26677: blacklist.conf: Add e7870cf13d20 (\"rxrpc: Fix delayed ACKs to not set the reference serial number\") (bsc#1222387)\n- CVE-2024-26735: ipv6: sr: fix possible use-after-free and null-ptr-deref (bsc#1222372).\n- CVE-2024-26808: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).\n- CVE-2024-26809: netfilter: nft_set_pipapo: release elements in clone only from destroy path (bsc#1222633).\n- CVE-2024-26812: kABI: vfio: struct virqfd kABI workaround (bsc#1222808).\n- CVE-2024-26835: netfilter: nf_tables: set dormant flag on hook register failure (bsc#1222967).\n- CVE-2024-26837: net: bridge: switchdev: Skip MDB replays of deferred events on offload (bsc#1222973).\n- CVE-2024-26851: netfilter: nf_conntrack_h323: Add protection for bmp length out of range (bsc#1223074)\n- CVE-2024-27010: net/sched: Fix mirred deadlock on device recursion (bsc#1223720).\n- CVE-2024-27011: netfilter: nf_tables: fix memleak in map from abort path (bsc#1223803).\n- CVE-2024-27024: net/rds: fix WARNING in rds_conn_connect_if_down (bsc#1223777).\n- CVE-2024-27079: iommu/vt-d: Fix NULL domain on device release (bsc#1223742).\n- CVE-2024-27403: kabi: restore const specifier in flow_offload_route_init() (bsc#1224415).\n- CVE-2024-27433: clk: mediatek: mt7622-apmixedsys: Fix an error handling path in clk_mt8135_apmixed_probe() (bsc#1224711).\n- CVE-2024-27437: vfio/pci: Disable auto-enable of exclusive INTx IRQ (bsc#1222625).\n- CVE-2024-35897: netfilter: nf_tables: discard table flag update with pending basechain deletion (bsc#1224510).\n- CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure (bsc#1224535).\n- CVE-2024-35949: btrfs: make sure that WRITTEN is set on all metadata blocks (bsc#1224700).\n- CVE-2024-36286: netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (bsc#1226801)\n- CVE-2024-36489: tls: fix missing memory barrier in tls_init (bsc#1226874)\n- CVE-2024-36881: mm/userfaultfd: reset ptes when close() for wr-protected ones (bsc#1225718).\n- CVE-2024-36929: net: core: reject skb_copy(_expand) for fraglist GSO skbs (bsc#1225814).\n- CVE-2024-36933: net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (bsc#1225832).\n- CVE-2024-36979: net: bridge: mst: fix vlan use-after-free syzbot reported a suspicious rcu usage[1] in bridge's mst code. (bsc#1226604).\n- CVE-2024-38662: selftests/bpf: Cover verifier checks for mutating sockmap/sockhash (bsc#1226885).\n- CVE-2024-39489: ipv6: sr: fix memleak in seg6_hmac_init_algo (bsc#1227623)\n- CVE-2024-39506: liquidio: adjust a NULL pointer handling path in lio_vf_rep_copy_packet (bsc#1227729).\n- CVE-2024-40905: ipv6: fix possible race in __fib6_drop_pcpu_from() (bsc#1227761)\n- CVE-2024-40909: bpf: Fix a potential use-after-free in bpf_link_free() (bsc#1227798).\n- CVE-2024-40920: net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (bsc#1227781).\n- CVE-2024-40921: net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state (bsc#1227784).\n- CVE-2024-40938: landlock: fix d_parent walk (bsc#1227840).\n- CVE-2024-40939: net: wwan: iosm: Fix tainted pointer delete is case of region creation fail (bsc#1227799).\n- CVE-2024-40954: net: do not leave a dangling sk pointer, when socket creation fails (bsc#1227808)\n- CVE-2024-40956: dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list (bsc#1227810).\n- CVE-2024-40957: seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors (bsc#1227811).\n- CVE-2024-40958: netns: Make get_net_ns() handle zero refcount net (bsc#1227812).\n- CVE-2024-40959: xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() (bsc#1227884).\n- CVE-2024-40978: scsi: qedi: Fix crash while reading debugfs attribute (bsc#1227929).\n- CVE-2024-40989: KVM: arm64: Disassociate vcpus from redistributor region on teardown (bsc#1227823).\n- CVE-2024-40994: ptp: fix integer overflow in max_vclocks_store (bsc#1227829).\n- CVE-2024-40995: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() (bsc#1227830).\n- CVE-2024-41000: block/ioctl: prefer different overflow check (bsc#1227867).\n- CVE-2024-41007: tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() (bsc#1227863).\n- CVE-2024-41009: bpf: Fix overrunning reservations in ringbuf (bsc#1228020).\n- CVE-2024-41010: bpf: Fix too early release of tcx_entry (bsc#1228021).\n- CVE-2024-41012: filelock: Remove locks reliably when fcntl/close race is detected (bsc#1228247).\n- CVE-2024-41015: ocfs2: add bounds checking to ocfs2_check_dir_entry() (bsc#1228409).\n- CVE-2024-41020: filelock: Fix fcntl/close race recovery compat path (bsc#1228427).\n- CVE-2024-41032: mm: vmalloc: check if a hash-index is in cpu_possible_mask (bsc#1228460).\n- CVE-2024-41036: net: ks8851: Fix deadlock with the SPI chip variant (bsc#1228496).\n- CVE-2024-41040: net/sched: Fix UAF when resolving a clash (bsc#1228518).\n- CVE-2024-41041: udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port() (bsc#1228520).\n- CVE-2024-41044: ppp: reject claimed-as-LCP but actually malformed packets (bsc#1228530).\n- CVE-2024-41048: skmsg: Skip zero length skb in sk_msg_recvmsg (bsc#1228565).\n- CVE-2024-41050: cachefiles: cyclic allocation of msg_id to avoid reuse (bsc#1228499).\n- CVE-2024-41051: cachefiles: wait for ondemand_object_worker to finish when dropping object (bsc#1228468).\n- CVE-2024-41057: cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie() (bsc#1228462).\n- CVE-2024-41058: cachefiles: fix slab-use-after-free in fscache_withdraw_volume() (bsc#1228459).\n- CVE-2024-41062: bluetooth/l2cap: sync sock recv cb and release (bsc#1228576).\n- CVE-2024-41064: powerpc/eeh: avoid possible crash when edev-\u003epdev changes (bsc#1228599).\n- CVE-2024-41066: ibmvnic: add tx check to prevent skb leak (bsc#1228640).\n- CVE-2024-41068: s390/sclp: Fix sclp_init() cleanup on failure (bsc#1228579).\n- CVE-2024-41069: ASoC: topology: Fix route memory corruption (bsc#1228644).\n- CVE-2024-41070: KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group() (bsc#1228581).\n- CVE-2024-41074: cachefiles: Set object to close if ondemand_id \u003c 0 in copen (bsc#1228643).\n- CVE-2024-41075: cachefiles: add consistency check for copen/cread (bsc#1228646).\n- CVE-2024-41076: NFSv4: Fix memory leak in nfs4_set_security_label (bsc#1228649).\n- CVE-2024-41078: btrfs: qgroup: fix quota root leak after quota disable failure (bsc#1228655).\n- CVE-2024-41080: io_uring: fix possible deadlock in io_register_iowq_max_workers() (bsc#1228616).\n- CVE-2024-41081: ila: block BH in ila_output() (bsc#1228617).\n- CVE-2024-41084: cxl/region: Avoid null pointer dereference in region lookup (bsc#1228472).\n- CVE-2024-42070: netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (bsc#1228470).\n- CVE-2024-42073: mlxsw: spectrum_buffers: Fix memory corruptions on Spectrum-4 systems (bsc#1228457).\n- CVE-2024-42079: gfs2: Fix NULL pointer dereference in gfs2_log_flush (bsc#1228672).\n- CVE-2024-42082: xdp: Remove WARN() from __xdp_reg_mem_model() (bsc#1228482).\n- CVE-2024-42093: net/dpaa2: Avoid explicit cpumask var allocation on stack (bsc#1228680).\n- CVE-2024-42095: serial: 8250_omap: Fix Errata i2310 with RX FIFO level check (bsc#1228446).\n- CVE-2024-42096: x86: stop playing stack games in profile_pc() (bsc#1228633).\n- CVE-2024-42106: inet_diag: Initialize pad field in struct inet_diag_req_v2 (bsc#1228493).\n- CVE-2024-42107: ice: Do not process extts if PTP is disabled (bsc#1228494).\n- CVE-2024-42109: netfilter: nf_tables: unconditionall (bsc#1228505).\n- CVE-2024-42110: net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() (bsc#1228501).\n- CVE-2024-42113: net: txgbe: initialize num_q_vectors for MSI/INTx interrupts (bsc#1228568).\n- CVE-2024-42122: drm/amd/display: Add NULL pointer check for kzalloc (bsc#1228591).\n- CVE-2024-42124: scsi: qedf: Make qedf_execute_tmf() non-preemptible (bsc#1228705).\n- CVE-2024-42138: mlxsw: core_linecards: Fix double memory deallocation in case of invalid INI file (bsc#1228500).\n- CVE-2024-42139: ice: Fix improper extts handling (bsc#1228503).\n- CVE-2024-42142: net/mlx5: E-switch, Create ingress ACL when needed (bsc#1228491).\n- CVE-2024-42145: IB/core: Implement a limit on UMAD receive List (bsc#1228743).\n- CVE-2024-42148: bnx2x: Fix multiple UBSAN array-index-out-of-bounds (bsc#1228487).\n- CVE-2024-42155: s390/pkey: Wipe copies of protected- and secure-keys (bsc#1228733).\n- CVE-2024-42156: s390/pkey: Wipe copies of clear-key structures on failure (bsc#1228722).\n- CVE-2024-42157: s390/pkey: Wipe sensitive data on failure (bsc#1228727 CVE-2024-42157 git-fixes).\n- CVE-2024-42158: s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings (bsc#1228720).\n- CVE-2024-42159: scsi: mpi3mr: sanitise num_phys (bsc#1228754).\n- CVE-2024-42161: bpf: avoid uninitialized value in BPF_CORE_READ_BITFIELD (bsc#1228756).\n- CVE-2024-42162: gve: Account for stopped queues when reading NIC stats (bsc#1228706).\n- CVE-2024-42224: net: dsa: mv88e6xxx: Correct check for empty list (bsc#1228723).\n- CVE-2024-42241: mm/shmem: disable PMD-sized page cache if needed (bsc#1228986).\n- CVE-2024-42245: Revert \"sched/fair: Make sure to try to detach at least one movable task\" (bsc#1228978).\n- CVE-2024-42246: net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (bsc#1228989).\n- CVE-2024-42247: wireguard: allowedips: avoid unaligned 64-bit memory accesses (bsc#1228988).\n- CVE-2024-42268: net/mlx5: Fix missing lock on sync reset reload (bsc#1229391).\n- CVE-2024-42269: netfilter: iptables: Fix potential null-ptr-deref in ip6table_nat_table_init(). (bsc#1229402).\n- CVE-2024-42270: netfilter: iptables: Fix null-ptr-deref in iptable_nat_table_init(). (bsc#1229404).\n- CVE-2024-42277: iommu: sprd: Avoid NULL deref in sprd_iommu_hw_en (bsc#1229409).\n- CVE-2024-42281: bpf: Fix a segment issue when downgrading gso_size (bsc#1229386).\n- CVE-2024-42283: net: nexthop: Initialize all fields in dumped nexthops (bsc#1229383)\n- CVE-2024-42284: tipc: Return non-zero value from tipc_udp_addr2str() on error (bsc#1229382)\n- CVE-2024-42290: irqchip/imx-irqsteer: Handle runtime power management correctly (bsc#1229379).\n- CVE-2024-42291: ice: Add a per-VF limit on number of FDIR filters (bsc#1229374).\n- CVE-2024-42295: nilfs2: handle inconsistent state in nilfs_btnode_create_block() (bsc#1229370).\n- CVE-2024-42301: dev/parport: fix the array out-of-bounds risk (bsc#1229407).\n- CVE-2024-42308: Update DRM patch reference (bsc#1229411)\n- CVE-2024-42312: sysctl: always initialize i_uid/i_gid (bsc#1229357)\n- CVE-2024-42316: mm/mglru: fix div-by-zero in vmpressure_calc_level()  (bsc#1229353).\n- CVE-2024-42318: landlock: Do not lose track of restrictions on cred_transfer (bsc#1229351).\n- CVE-2024-42322: ipvs: properly dereference pe in ip_vs_add_service (bsc#1229347)\n- CVE-2024-43821: scsi: lpfc: Fix a possible null pointer dereference (bsc#1229315).\n- CVE-2024-43831: media: mediatek: vcodec: Handle invalid decoder vsi (bsc#1229309).\n- CVE-2024-43834: xdp: fix invalid wait context of page_pool_destroy() (bsc#1229314)\n- CVE-2024-43837: bpf: Fix updating attached freplace prog in prog_array map (bsc#1229297).\n- CVE-2024-43839: bna: adjust 'name' buf size of bna_tcb and bna_ccb structures (bsc#1229301).\n- CVE-2024-43850: soc: qcom: icc-bwmon: Fix refcount imbalance seen during bwmon_remove (bsc#1229316).\n- CVE-2024-43854: block: initialize integrity buffer to zero before writing it to media (bsc#1229345)\n- CVE-2024-43855: md: fix deadlock between mddev_suspend and flush bio (bsc#1229342).\n- CVE-2024-43864: net/mlx5e: Fix CT entry update leaks of modify header context (bsc#1229496).\n- CVE-2024-43866: net/mlx5: Always drain health in shutdown callback (bsc#1229495).\n- CVE-2024-43880: kabi: lib: objagg: Put back removed metod in struct objagg_ops (bsc#1229481).\n- CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)\n- CVE-2024-43899: drm/amd/display: Fix null pointer deref in dcn20_resource.c (bsc#1229754).\n- CVE-2024-43911: wifi: mac80211: fix NULL dereference at band check in starting tx ba session  (bsc#1229827).\n\nAdditional CVEs were previously fixed and are only mentioned in the metadata.\n\nThe following non-security bugs were fixed:\n\n- ACPI/NUMA: Apply SRAT proximity domain to entire CFMWS window (git-fixes).\n- ACPI: SBS: manage alarm sysfs attribute through psy core (stable-fixes).\n- ACPI: battery: create alarm sysfs attribute atomically (stable-fixes).\n- ACPI: processor_idle: use raw_safe_halt() in acpi_idle_play_dead() (git-fixes).\n- ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4 (stable-fixes).\n- ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4 (stable-fixes).\n- ALSA: hda/realtek - FIxed ALC285 headphone no sound (stable-fixes).\n- ALSA: hda/realtek - Fixed ALC256 headphone no sound (stable-fixes).\n- ALSA: hda/realtek: Add Framework Laptop 13 (Intel Core Ultra) to quirks (stable-fixes).\n- ALSA: hda/realtek: Add Framework Laptop 13 (Intel Core Ultra) to quirks (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Acer Aspire E5-574G (stable-fixes).\n- ALSA: hda/realtek: Add support for new HP G12 laptops (stable-fixes).\n- ALSA: hda/realtek: Enable mute/micmute LEDs on HP Laptop 14-ey0xxx (stable-fixes).\n- ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7 (git-fixes).\n- ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book3 Ultra (stable-fixes).\n- ALSA: hda/realtek: Implement sound init sequence for Samsung Galaxy Book3 Pro 360 (stable-fixes).\n- ALSA: hda/realtek: support HP Pavilion Aero 13-bg0xxx Mute LED (stable-fixes).\n- ALSA: hda/tas2781: Use correct endian conversion (git-fixes).\n- ALSA: hda/tas2781: fix wrong calibrated data order (git-fixes).\n- ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list (stable-fixes).\n- ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list (stable-fixes).\n- ALSA: hda: Conditionally use snooping for AMD HDMI (git-fixes).\n- ALSA: hda: conexant: Fix headset auto detect fail in the polling mode (git-fixes).\n- ALSA: line6: Fix racy access to midibuf (stable-fixes).\n- ALSA: line6: Fix racy access to midibuf (stable-fixes).\n- ALSA: seq: Skip event type filtering for UMP events (git-fixes).\n- ALSA: seq: ump: Explicitly reset RPN with Null RPN (stable-fixes).\n- ALSA: seq: ump: Optimize conversions from SysEx to UMP (git-fixes).\n- ALSA: seq: ump: Transmit RPN/NRPN message at each MSB/LSB data reception (stable-fixes).\n- ALSA: seq: ump: Use the common RPN/bank conversion context (stable-fixes).\n- ALSA: timer: Relax start tick time check for slave timer elements (git-fixes).\n- ALSA: ump: Explicitly reset RPN with Null RPN (stable-fixes).\n- ALSA: ump: Transmit RPN/NRPN message at each MSB/LSB data reception (stable-fixes).\n- ALSA: usb-audio: Add delay quirk for VIVO USB-C-XE710 HEADSET (stable-fixes).\n- ALSA: usb-audio: Correct surround channels in UAC1 channel map (git-fixes).\n- ALSA: usb-audio: Re-add ScratchAmp quirk entries (git-fixes).\n- ALSA: usb-audio: Re-add ScratchAmp quirk entries (git-fixes).\n- ALSA: usb-audio: Support Yamaha P-125 quirk entry (stable-fixes).\n- ALSA: usb: Fix UBSAN warning in parse_audio_unit() (stable-fixes).\n- ASoC: SOF: Intel: hda-dsp: Make sure that no irq handler is pending before suspend (stable-fixes).\n- ASoC: SOF: Remove libraries from topology lookups (git-fixes).\n- ASoC: SOF: Remove libraries from topology lookups (git-fixes).\n- ASoC: SOF: amd: Fix for acp init sequence (git-fixes).\n- ASoC: SOF: ipc4: check return value of snd_sof_ipc_msg_data (stable-fixes).\n- ASoC: SOF: mediatek: Add missing board compatible (stable-fixes).\n- ASoC: allow module autoloading for table board_ids (stable-fixes).\n- ASoC: allow module autoloading for table db1200_pids (stable-fixes).\n- ASoC: amd: acp: fix module autoloading (git-fixes).\n- ASoC: amd: yc: Add quirk entry for OMEN by HP Gaming Laptop 16-n0xxx (bsc#1227182).\n- ASoC: amd: yc: Support mic on HP 14-em0002la (stable-fixes).\n- ASoC: amd: yc: Support mic on HP 14-em0002la (stable-fixes).\n- ASoC: amd: yc: Support mic on Lenovo Thinkpad E14 Gen 6 (stable-fixes).\n- ASoC: amd: yc: Support mic on Lenovo Thinkpad E14 Gen 6 (stable-fixes).\n- ASoC: codecs: wcd938x-sdw: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wcd938x-sdw: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa881x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa881x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa883x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa883x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa884x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa884x: Correct Soundwire ports mask (git-fixes).\n- ASoC: cs35l45: Checks index of cs35l45_irqs[] (stable-fixes).\n- ASoC: cs35l56: Handle OTP read latency over SoundWire (stable-fixes).\n- ASoC: cs35l56: Handle OTP read latency over SoundWire (stable-fixes).\n- ASoC: cs35l56: Patch CS35L56_IRQ1_MASK_18 to the default value (stable-fixes).\n- ASoC: cs35l56: Patch CS35L56_IRQ1_MASK_18 to the default value (stable-fixes).\n- ASoC: fsl_micfil: Expand the range of FIFO watermark mask (stable-fixes).\n- ASoC: fsl_micfil: Expand the range of FIFO watermark mask (stable-fixes).\n- ASoC: mediatek: mt8188: Mark AFE_DAC_CON0 register as volatile (stable-fixes).\n- ASoC: meson: axg-fifo: fix irq scheduling issue with PREEMPT_RT (git-fixes).\n- ASoC: meson: axg-fifo: fix irq scheduling issue with PREEMPT_RT (git-fixes).\n- ASoC: nau8822: Lower debug print priority (stable-fixes).\n- ASoC: nau8822: Lower debug print priority (stable-fixes).\n- Bluetooth: Add device 13d3:3572 IMC Networks Bluetooth Radio (stable-fixes).\n- Bluetooth: Fix usage of __hci_cmd_sync_status (git-fixes).\n- Bluetooth: L2CAP: Fix deadlock (git-fixes).\n- Bluetooth: MGMT: Add error handling to pair_device() (git-fixes).\n- Bluetooth: SMP: Fix assumption of Central always being Initiator (git-fixes).\n- Bluetooth: bnep: Fix out-of-bound access (stable-fixes).\n- Bluetooth: btintel: Fail setup on error (git-fixes).\n- Bluetooth: btnxpuart: Shutdown timer and prevent rearming when driver unloading (stable-fixes).\n- Bluetooth: btusb: Add RTL8852BE device 0489:e125 to device tables (stable-fixes).\n- Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x13d3:0x3591 (stable-fixes).\n- Bluetooth: hci_conn: Check non NULL function before calling for HFP offload (stable-fixes).\n- Bluetooth: hci_core: Fix LE quote calculation (git-fixes).\n- Bluetooth: hci_core: Fix not handling hibernation actions (git-fixes).\n- Bluetooth: hci_sync: Fix suspending with wrong filter policy (git-fixes).\n- Bluetooth: hci_sync: avoid dup filtering when passive scanning with adv monitor (git-fixes).\n- Bluetooth: l2cap: always unlock channel in l2cap_conless_channel() (git-fixes).\n- Drop libata patch that caused a regression (bsc#1229054)\n- HID: wacom: Defer calculation of resolution until resolution_code is known (git-fixes).\n- Input: MT - limit max slots (stable-fixes).\n- Input: i8042 - add Fujitsu Lifebook E756 to i8042 quirk table (bsc#1229056).\n- Input: i8042 - add forcenorestore quirk to leave controller untouched even on s3 (stable-fixes).\n- Input: i8042 - use new forcenorestore quirk to replace old buggy quirk combination (stable-fixes).\n- KVM: Always flush async #PF workqueue when vCPU is being destroyed (git-fixes).\n- KVM: Make KVM_MEM_GUEST_MEMFD mutually exclusive with KVM_MEM_READONLY (git-fixes).\n- KVM: PPC: Book3S HV: Fix the set_one_reg for MMCR3 (bsc#1194869).\n- KVM: PPC: Book3S HV: Handle pending exceptions on guest entry with MSR_EE (bsc#1215199).\n- KVM: Protect vcpu-\u003epid dereference via debugfs with RCU (git-fixes).\n- KVM: Reject overly excessive IDs in KVM_CREATE_VCPU (git-fixes).\n- KVM: Stop processing *all* memslots when \"null\" mmu_notifier handler is found (git-fixes).\n- KVM: VMX: Move posted interrupt descriptor out of VMX code (git-fixes).\n- KVM: VMX: Split out the non-virtualization part of vmx_interrupt_blocked() (git-fixes).\n- KVM: VMX: Switch __vmx_exit() and kvm_x86_vendor_exit() in vmx_exit() (git-fixes).\n- KVM: arm64: AArch32: Fix spurious trapping of conditional instructions (git-fixes).\n- KVM: arm64: Add missing memory barriers when switching to pKVM's hyp pgd (git-fixes).\n- KVM: arm64: Allow AArch32 PSTATE.M to be restored as System mode (git-fixes).\n- KVM: arm64: Fix AArch32 register narrowing on userspace write (git-fixes).\n- KVM: arm64: Fix __pkvm_init_switch_pgd call ABI (git-fixes).\n- KVM: arm64: Fix clobbered ELR in sync abort/SError (git-fixes)\n- KVM: arm64: GICv4: Do not perform a map to a mapped vLPI (git-fixes).\n- KVM: arm64: timers: Correctly handle TGE flip with CNTPOFF_EL2 (git-fixes).\n- KVM: arm64: timers: Fix resource leaks in kvm_timer_hyp_init() (git-fixes).\n- KVM: arm64: vgic-its: Test for valid IRQ in its_sync_lpi_pending_table() (git-fixes).\n- KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler (git-fixes).\n- KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id (git-fixes).\n- KVM: arm64: vgic-v4: Restore pending state on host userspace write (git-fixes).\n- KVM: arm64: vgic: Add a non-locking primitive for kvm_vgic_vcpu_destroy() (git-fixes).\n- KVM: arm64: vgic: Force vcpu vgic teardown on vcpu destroy (git-fixes).\n- KVM: arm64: vgic: Simplify kvm_vgic_destroy() (git-fixes).\n- KVM: fix kvm_mmu_memory_cache allocation warning (git-fixes).\n- KVM: nVMX: Add a helper to get highest pending from Posted Interrupt vector (git-fixes).\n- KVM: nVMX: Check for pending posted interrupts when looking for nested events (git-fixes).\n- KVM: nVMX: Request immediate exit iff pending nested event needs injection (git-fixes).\n- KVM: s390: fix LPSWEY handling (bsc#1227634 git-fixes).\n- KVM: s390: fix validity interception issue when gisa is switched off (git-fixes bsc#1229167).\n- KVM: x86/mmu: Bug the VM if KVM tries to split a !hugepage SPTE (git-fixes).\n- KVM: x86: Limit check IDs for KVM_SET_BOOT_CPU_ID (git-fixes).\n- Move upstreamed powerpc patches into sorted section\n- Move upstreamed sound patches into sorted section\n- Moved upstreamed ASoC patch into sorted section\n- NFSD: Support write delegations in LAYOUTGET (git-fixes).\n- NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (git-fixes).\n- PCI: Add Edimax Vendor ID to pci_ids.h (stable-fixes).\n- PCI: hv: Return zero, not garbage, when reading PCI_INTERRUPT_PIN (git-fixes).\n- PCI: loongson: Enable MSI in LS7A Root Complex (stable-fixes).\n- RDMA/cache: Release GID table even if leak is detected (git-fixes)\n- RDMA/device: Return error earlier if port in not valid (git-fixes)\n- RDMA/hns: Check atomic wr length (git-fixes)\n- RDMA/hns: Fix insufficient extend DB for VFs. (git-fixes)\n- RDMA/hns: Fix mbx timing out before CMD execution is completed (git-fixes)\n- RDMA/hns: Fix missing pagesize and alignment check in FRMR (git-fixes)\n- RDMA/hns: Fix shift-out-bounds when max_inline_data is 0 (git-fixes)\n- RDMA/hns: Fix soft lockup under heavy CEQE load (git-fixes)\n- RDMA/hns: Fix undifined behavior caused by invalid max_sge (git-fixes)\n- RDMA/hns: Fix unmatch exception handling when init eq table fails (git-fixes)\n- RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (git-fixes)\n- RDMA/mana_ib: Use virtual address in dma regions for MRs (git-fixes).\n- RDMA/mlx4: Fix truncated output warning in alias_GUID.c (git-fixes)\n- RDMA/mlx4: Fix truncated output warning in mad.c (git-fixes)\n- RDMA/mlx5: Set mkeys for dmabuf at PAGE_SIZE (git-fixes)\n- RDMA/rxe: Do not set BTH_ACK_MASK for UC or UD QPs (git-fixes)\n- RDMA: Fix netdev tracker in ib_device_set_netdev (git-fixes)\n- Revert \"ALSA: firewire-lib: obsolete workqueue for period update\" (bsc#1208783).\n- Revert \"ALSA: firewire-lib: operate for period elapse event in process context\" (bsc#1208783).\n- Revert \"KVM: Prevent module exit until all VMs are freed\" (git-fixes).\n- Revert \"Revert \"md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d\"\" (git-fixes).\n- Revert \"md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d\" (git-fixes).\n- Revert \"misc: fastrpc: Restrict untrusted app to attach to privileged PD\" (git-fixes).\n- Revert \"usb: gadget: uvc: cleanup request when not in correct state\" (stable-fixes).\n- Revert \"usb: typec: tcpm: clear pd_event queue in PORT_RESET\" (git-fixes).\n- SUNRPC: Fix a race to wake a sync task (git-fixes).\n- SUNRPC: add a missing rpc_stat for TCP TLS (git-fixes).\n- Squashfs: fix variable overflow triggered by sysbot (git-fixes).\n- USB: serial: debug: do not echo input by default (stable-fixes).\n- Update config files. Disable vdpa drivers for Alibaba ENI and SolidNET (jsc#PED-8954, bsc#1227834)\n- Update config files. Disable CONFIG_KFENCE on ppc64le (bsc#1226920)\n- Update patch references for ASoC regression fixes (bsc#1229045 bsc#1229046)\n- afs: fix __afs_break_callback() / afs_drop_open_mmap() race (git-fixes).\n- apparmor: unpack transition table if dfa is not present (bsc#1226031).\n- arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to (git-fixes)\n- arm64: Add Neoverse-V2 part (git-fixes)\n- arm64: Fix KASAN random tag seed initialization (git-fixes)\n- arm64: armv8_deprecated: Fix warning in isndep cpuhp starting process (git-fixes)\n- arm64: barrier: Restore spec_bar() macro (git-fixes)\n- arm64: cputype: Add Cortex-A720 definitions (git-fixes)\n- arm64: cputype: Add Cortex-A725 definitions (git-fixes)\n- arm64: cputype: Add Cortex-X1C definitions (git-fixes)\n- arm64: cputype: Add Cortex-X3 definitions (git-fixes)\n- arm64: cputype: Add Cortex-X4 definitions (git-fixes)\n- arm64: cputype: Add Cortex-X925 definitions (git-fixes)\n- arm64: cputype: Add Neoverse-V3 definitions (git-fixes)\n- arm64: dts: imx8mp: Add NPU Node (git-fixes)\n- arm64: dts: imx8mp: Fix pgc vpu locations (git-fixes)\n- arm64: dts: imx8mp: Fix pgc_mlmix location (git-fixes)\n- arm64: dts: imx8mp: add HDMI power-domains (git-fixes)\n- arm64: errata: Expand speculative SSBS workaround (again) (git-fixes)\n- arm64: errata: Expand speculative SSBS workaround (git-fixes)\n- arm64: errata: Unify speculative SSBS errata logic (git-fixes). Update config files.\n- arm64: jump_label: Ensure patched jump_labels are visible to all CPUs (git-fixes)\n- ata: libata-scsi: Do not overwrite valid sense data when CK_COND=1 (stable-fixes).\n- ata: libata-scsi: Honor the D_SENSE bit for CK_COND=1 and no error (stable-fixes).\n- blacklist.conf: Add libata upstream revert entry (bsc#1229054)\n- bnxt_re: Fix imm_data endianness (git-fixes)\n- bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG (git-fixes)\n- bpf, lpm: Fix check prefixlen before walking trie (git-fixes).\n- bpf/tests: Remove duplicate JSGT tests (git-fixes).\n- bpf: Add crosstask check to __bpf_get_stack (git-fixes).\n- bpf: Detect IP == ksym.end as part of BPF program (git-fixes).\n- bpf: Ensure proper register state printing for cond jumps (git-fixes).\n- bpf: Fix a few selftest failures due to llvm18 change (git-fixes).\n- bpf: Fix a kernel verifier crash in stacksafe() (bsc#1225903).\n- bpf: Fix check_stack_write_fixed_off() to correctly spill imm (git-fixes).\n- bpf: Fix kfunc callback register type handling (git-fixes).\n- bpf: Fix prog_array_map_poke_run map poke update (git-fixes).\n- bpf: Fix unnecessary -EBUSY from htab_lock_bucket (git-fixes).\n- bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly (git-fixes).\n- bpf: Remove unnecessary wait from bpf_map_copy_value() (git-fixes).\n- bpf: Set uattr-\u003ebatch.count as zero before batched update or deletion (git-fixes).\n- bpf: do not infer PTR_TO_CTX for programs with unnamed context type (git-fixes).\n- bpf: enforce precision of R0 on callback return (git-fixes).\n- bpf: extract bpf_ctx_convert_map logic and make it more reusable (git-fixes).\n- bpf: fix control-flow graph checking in privileged mode (git-fixes).\n- bpf: handle bpf_user_pt_regs_t typedef explicitly for PTR_TO_CTX global arg (git-fixes).\n- bpf: hardcode BPF_PROG_PACK_SIZE to 2MB * num_possible_nodes() (git-fixes).\n- bpf: kprobe: remove unused declaring of bpf_kprobe_override (git-fixes).\n- bpf: simplify btf_get_prog_ctx_type() into btf_is_prog_ctx_type() (git-fixes).\n- bpftool: Align output skeleton ELF code (git-fixes).\n- bpftool: Fix -Wcast-qual warning (git-fixes).\n- bpftool: Silence build warning about calloc() (git-fixes).\n- bpftool: mark orphaned programs during prog show (git-fixes).\n- btrfs: add a btrfs_finish_ordered_extent helper (git-fixes).\n- btrfs: add a is_data_bbio helper (git-fixes).\n- btrfs: add an ordered_extent pointer to struct btrfs_bio (git-fixes).\n- btrfs: copy dir permission and time when creating a stub subvolume (bsc#1228321).\n- btrfs: ensure fast fsync waits for ordered extents after a write failure (git-fixes).\n- btrfs: factor out a btrfs_queue_ordered_fn helper (git-fixes).\n- btrfs: factor out a can_finish_ordered_extent helper (git-fixes).\n- btrfs: fix corruption after buffer fault in during direct IO append write (git-fixes).\n- btrfs: fix double inode unlock for direct IO sync writes (git-fixes).\n- btrfs: fix extent map use-after-free when adding pages to compressed bio (git-fixes).\n- btrfs: fix leak of qgroup extent records after transaction abort (git-fixes).\n- btrfs: fix ordered extent split error handling in btrfs_dio_submit_io (git-fixes).\n- btrfs: limit write bios to a single ordered extent (git-fixes).\n- btrfs: make btrfs_finish_ordered_extent() return void (git-fixes).\n- btrfs: merge the two calls to btrfs_add_ordered_extent in run_delalloc_nocow (git-fixes).\n- btrfs: open code btrfs_bio_end_io in btrfs_dio_submit_io (git-fixes).\n- btrfs: open code end_extent_writepage in end_bio_extent_writepage (git-fixes).\n- btrfs: pass a btrfs_inode to btrfs_fdatawrite_range() (git-fixes).\n- btrfs: pass a btrfs_inode to btrfs_wait_ordered_range() (git-fixes).\n- btrfs: pass an ordered_extent to btrfs_reloc_clone_csums (git-fixes).\n- btrfs: pass an ordered_extent to btrfs_submit_compressed_write (git-fixes).\n- btrfs: remove btrfs_add_ordered_extent (git-fixes).\n- btrfs: rename err to ret in btrfs_direct_write() (git-fixes).\n- btrfs: uninline some static inline helpers from tree-log.h (git-fixes).\n- btrfs: use a btrfs_inode in the log context (struct btrfs_log_ctx) (git-fixes).\n- btrfs: use a btrfs_inode local variable at btrfs_sync_file() (git-fixes).\n- btrfs: use bbio-\u003eordered in btrfs_csum_one_bio (git-fixes).\n- btrfs: use btrfs_finish_ordered_extent to complete buffered writes (git-fixes).\n- btrfs: use btrfs_finish_ordered_extent to complete compressed writes (git-fixes).\n- btrfs: use btrfs_finish_ordered_extent to complete direct writes (git-fixes).\n- btrfs: use irq safe locking when running and adding delayed iputs (git-fixes).\n- cachefiles, erofs: Fix NULL deref in when cachefiles is not doing ondemand-mode (bsc#1229245).\n- cachefiles: add missing lock protection when polling (bsc#1229256).\n- cachefiles: add restore command to recover inflight ondemand read requests (bsc#1229244).\n- cachefiles: add spin_lock for cachefiles_ondemand_info (bsc#1229249).\n- cachefiles: cancel all requests for the object that is being dropped (bsc#1229255).\n- cachefiles: defer exposing anon_fd until after copy_to_user() succeeds (bsc#1229251).\n- cachefiles: extract ondemand info field from cachefiles_object (bsc#1229240).\n- cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read() (bsc#1229247).\n- cachefiles: fix slab-use-after-free in cachefiles_ondemand_get_fd() (bsc#1229246).\n- cachefiles: introduce object ondemand state (bsc#1229239).\n- cachefiles: make on-demand read killable (bsc#1229252).\n- cachefiles: narrow the scope of triggering EPOLLIN events in ondemand mode (bsc#1229243).\n- cachefiles: never get a new anonymous fd if ondemand_id is valid (bsc#1229250).\n- cachefiles: propagate errors from vfs_getxattr() to avoid infinite loop (bsc#1229253).\n- cachefiles: remove err_put_fd label in cachefiles_ondemand_daemon_read() (bsc#1229248).\n- cachefiles: resend an open request if the read request's object is closed (bsc#1229241).\n- cachefiles: stop sending new request when dropping object (bsc#1229254).\n- can: mcp251xfd: tef: prepare to workaround broken TEF FIFO tail index erratum (stable-fixes).\n- can: mcp251xfd: tef: update workaround for erratum DS80000789E 6 of mcp2518fd (stable-fixes).\n- ceph: periodically flush the cap releases (bsc#1230056).\n- cgroup/cpuset: Prevent UAF in proc_cpuset_show() (bsc#1228801).\n- cgroup: Add annotation for holding namespace_sem in current_cgns_cgroup_from_root() (bsc#1222254).\n- cgroup: Eliminate the need for cgroup_mutex in proc_cgroup_show() (bsc#1222254).\n- cgroup: Make operations on the cgroup root_list RCU safe (bsc#1222254).\n- cgroup: Remove unnecessary list_empty() (bsc#1222254).\n- cgroup: preserve KABI of cgroup_root (bsc#1222254).\n- char: xillybus: Check USB endpoints when probing device (git-fixes).\n- char: xillybus: Do not destroy workqueue from work item running on it (stable-fixes).\n- char: xillybus: Refine workqueue handling (git-fixes).\n- clk: en7523: fix rate divider for slic and spi clocks (git-fixes).\n- clk: qcom: Park shared RCGs upon registration (git-fixes).\n- clk: qcom: camcc-sc7280: Add parent dependency to all camera GDSCs (git-fixes).\n- clk: qcom: gcc-sa8775p: Update the GDSC wait_val fields and flags (git-fixes).\n- clk: qcom: gcc-sc7280: Update force mem core bit for UFS ICE clock (git-fixes).\n- clk: qcom: gpucc-sa8775p: Park RCG's clk source at XO during disable (git-fixes).\n- clk: qcom: gpucc-sa8775p: Remove the CLK_IS_CRITICAL and ALWAYS_ON flags (git-fixes).\n- clk: qcom: gpucc-sa8775p: Update wait_val fields for GPU GDSC's (git-fixes).\n- clk: qcom: gpucc-sm8350: Park RCG's clk source at XO during disable (git-fixes).\n- clk: qcom: kpss-xcc: Return of_clk_add_hw_provider to transfer the error (git-fixes).\n- clk: visconti: Add bounds-checking coverage for struct visconti_pll_provider (stable-fixes).\n- clocksource/drivers/sh_cmt: Address race condition for clock events (stable-fixes).\n- cpu/SMT: Enable SMT only if a core is online (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588 git-fixes).\n- cxl/region: Move cxl_dpa_to_region() work to the region driver (bsc#1228472)\n- dev/parport: fix the array out-of-bounds risk (stable-fixes).\n- device property: Add cleanup.h based fwnode_handle_put() scope based cleanup (stable-fixes).\n- dmaengine: dw: Add memory bus width verification (git-fixes).\n- dmaengine: dw: Add peripheral bus width verification (git-fixes).\n- docs: KVM: Fix register ID of SPSR_FIQ (git-fixes).\n- driver core: Fix uevent_show() vs driver detach race (git-fixes).\n- drm/admgpu: fix dereferencing null pointer context (stable-fixes).\n- drm/amd/display: Add delay to improve LTTPR UHBR interop (stable-fixes).\n- drm/amd/display: Add null checker before passing variables (stable-fixes).\n- drm/amd/display: Adjust cursor position (git-fixes).\n- drm/amd/display: Check for NULL pointer (stable-fixes).\n- drm/amd/display: Skip Recompute DSC Params if no Stream on Link (stable-fixes).\n- drm/amd/display: avoid using null object of framebuffer (git-fixes).\n- drm/amd/display: fix cursor offset on rotation 180 (git-fixes).\n- drm/amd/display: fix s2idle entry for DCN3.5+ (stable-fixes).\n- drm/amd/pm: Fix the null pointer dereference for vega10_hwmgr (stable-fixes).\n- drm/amdgpu/jpeg2: properly set atomics vmid field (stable-fixes).\n- drm/amdgpu/jpeg4: properly set atomics vmid field (stable-fixes).\n- drm/amdgpu/pm: Fix the null pointer dereference for smu7 (stable-fixes).\n- drm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rules (stable-fixes).\n- drm/amdgpu/pm: Fix the param type of set_power_profile_mode (stable-fixes).\n- drm/amdgpu/sdma5.2: Update wptr registers as well as doorbell (stable-fixes).\n- drm/amdgpu/sdma5.2: limit wptr workaround to sdma 5.2.1 (git-fixes).\n- drm/amdgpu: Actually check flags for all context ops (stable-fixes).\n- drm/amdgpu: Add lock around VF RLCG interface (stable-fixes).\n- drm/amdgpu: Fix the null pointer dereference to ras_manager (stable-fixes).\n- drm/amdgpu: Forward soft recovery errors to userspace (stable-fixes).\n- drm/amdgpu: Validate TA binary size (stable-fixes).\n- drm/amdgpu: fix dereference null return value for the function amdgpu_vm_pt_parent (stable-fixes).\n- drm/amdgpu: fix potential resource leak warning (stable-fixes).\n- drm/amdgpu: reset vm state machine after gpu reset(vram lost) (stable-fixes).\n- drm/bridge: analogix_dp: properly handle zero sized AUX transactions (stable-fixes).\n- drm/client: fix null pointer dereference in drm_client_modeset_probe (git-fixes).\n- drm/dp_mst: Skip CSN if topology probing is not done yet (stable-fixes).\n- drm/etnaviv: do not block scheduler when GPU is still active (stable-fixes).\n- drm/i915/dsi: Make Lenovo Yoga Tab 3 X90F DMI match less strict (git-fixes).\n- drm/i915/gem: Adjust vma offset for framebuffer mmap offset (stable-fixes).\n- drm/i915/gem: Fix Virtual Memory mapping boundaries calculation (git-fixes).\n- drm/i915/hdcp: Fix HDCP2_STREAM_STATUS macro (git-fixes).\n- drm/i915: Fix possible int overflow in skl_ddi_calculate_wrpll() (git-fixes).\n- drm/lima: set gp bus_stop bit before hard reset (stable-fixes).\n- drm/mediatek/dp: Fix spurious kfree() (git-fixes).\n- drm/msm/dp: fix the max supported bpp logic (git-fixes).\n- drm/msm/dp: reset the link phy params before link training (git-fixes).\n- drm/msm/dpu: capture snapshot on the first commit_done timeout (stable-fixes).\n- drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails (git-fixes).\n- drm/msm/dpu: do not play tricks with debug macros (git-fixes).\n- drm/msm/dpu: drop MSM_ENC_VBLANK support (stable-fixes).\n- drm/msm/dpu: move dpu_encoder's connector assignment to atomic_enable() (git-fixes).\n- drm/msm/dpu: split dpu_encoder_wait_for_event into two functions (stable-fixes).\n- drm/msm/dpu: take plane rotation into account for wide planes (git-fixes).\n- drm/msm/dpu: try multirect based on mdp clock limits (stable-fixes).\n- drm/msm/dpu: use drmm-managed allocation for dpu_encoder_phys (stable-fixes).\n- drm/msm/mdss: Rename path references to mdp_path (stable-fixes).\n- drm/msm/mdss: switch mdss to use devm_of_icc_get() (stable-fixes).\n- drm/msm: Reduce fallout of fence signaling vs reclaim hangs (stable-fixes).\n- drm/nouveau: prime: fix refcount underflow (git-fixes).\n- drm/panel: nt36523: Set 120Hz fps for xiaomi,elish panels (stable-fixes).\n- drm/radeon/evergreen_cs: Clean up errors in evergreen_cs.c (bsc#1229024).\n- drm/radeon: Remove __counted_by from StateArray.states[] (git-fixes).\n- drm/rockchip: vop2: clear afbc en and transform bit for cluster window at linear mode (stable-fixes).\n- drm/virtio: Fix type of dma-fence context variable (git-fixes).\n- drm/vmwgfx: Fix a deadlock in dma buf fence polling (git-fixes).\n- drm/vmwgfx: Fix overlay when using Screen Targets (git-fixes).\n- drm/vmwgfx: Fix prime with external buffers (git-fixes).\n- efi/libstub: Zero initialize heap allocated struct screen_info (git-fixes).\n- evm: do not copy up 'security.evm' xattr (git-fixes).\n- firmware: cirrus: cs_dsp: Initialize debugfs_root to invalid (stable-fixes).\n- fs/netfs/fscache_cookie: add missing \"n_accesses\" check (bsc#1229455).\n- fuse: Initialize beyond-EOF page contents before setting uptodate (bsc#1229456).\n- genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline (git-fixes).\n- genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware (git-fixes).\n- genirq/matrix: Exclude managed interrupts in irq_matrix_allocated() (git-fixes).\n- gfs2: setattr_chown: Add missing initialization (git-fixes).\n- gpio: mlxbf3: Support shutdown() function (git-fixes).\n- gpio: prevent potential speculation leaks in gpio_device_get_desc() (stable-fixes).\n- gpio: sysfs: extend the critical section for unregistering sysfs devices (stable-fixes).\n- gss_krb5: Fix the error handling path for crypto_sync_skcipher_setkey (git-fixes).\n- hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode() (git-fixes).\n- hwmon: (ltc2992) Avoid division by zero (stable-fixes).\n- hwmon: (ltc2992) Fix memory leak in ltc2992_parse_dt() (git-fixes).\n- hwmon: (pc87360) Bounds check data-\u003einnr usage (stable-fixes).\n- i2c: Fix conditional for substituting empty ACPI functions (stable-fixes).\n- i2c: Use IS_REACHABLE() for substituting empty ACPI functions (git-fixes).\n- i2c: qcom-geni: Add missing clk_disable_unprepare in geni_i2c_runtime_resume (git-fixes).\n- i2c: qcom-geni: Add missing geni_icc_disable in geni_i2c_runtime_resume (git-fixes).\n- i2c: qcom-geni: Add missing geni_icc_disable in geni_i2c_runtime_resume (git-fixes).\n- i2c: riic: avoid potential division by zero (stable-fixes).\n- i2c: smbus: Improve handling of stuck alerts (git-fixes).\n- i2c: smbus: Send alert notifications to all devices if source not found (git-fixes).\n- i2c: stm32f7: Add atomic_xfer method to driver (stable-fixes).\n- i3c: mipi-i3c-hci: Do not unmap region not mapped for transfer (stable-fixes).\n- i3c: mipi-i3c-hci: Remove BUG() when Ring Abort request times out (stable-fixes).\n- i915/perf: Remove code to update PWR_CLK_STATE for gen12 (git-fixes).\n- ice: Fix NULL pointer access, if PF does not support SRIOV_LAG (bsc#1228737).\n- io_uring/advise: support 64-bit lengths (git-fixes).\n- io_uring: Drop per-ctx dummy_ubuf (git-fixes).\n- io_uring: Fix probe of disabled operations (git-fixes).\n- io_uring: fix io_match_task must_hold (git-fixes).\n- io_uring: tighten task exit cancellations (git-fixes).\n- iommu/amd: Convert comma to semicolon (git-fixes).\n- iommu/vt-d: Fix identity map bounds in si_domain_init() (git-fixes).\n- iommufd/device: Fix hwpt at err_unresv in iommufd_device_do_replace() (git-fixes).\n- ip6_tunnel: Fix broken GRO (bsc#1229444).\n- ipv6: sr: fix incorrect unregister order (git-fixes).\n- irqdomain: Fixed unbalanced fwnode get and put (git-fixes).\n- jfs: Fix shift-out-of-bounds in dbDiscardAG (git-fixes).\n- jfs: define xtree root and page independently (git-fixes).\n- jfs: fix null ptr deref in dtInsertEntry (git-fixes).\n- jump_label: Clarify condition in static_key_fast_inc_not_disabled() (git-fixes).\n- jump_label: Fix concurrency issues in static_key_slow_dec() (git-fixes).\n- jump_label: Fix the fix, brown paper bags galore (git-fixes).\n- jump_label: Simplify and clarify static_key_fast_inc_cpus_locked() (git-fixes).\n- kABI fix of: virtio-crypto: handle config changed by work queue (git-fixes).\n- kABI workaround for sound core UMP conversion (stable-fixes).\n- kabi fix for KVM: s390: fix LPSWEY handling (bsc#1227634 git-fixes).\n- kabi fix for SUNRPC: add a missing rpc_stat for TCP TLS (git-fixes).\n- kabi/severities: ignore kABI for FireWire sound local symbols (bsc#1208783)\n- kcov: properly check for softirq context (git-fixes).\n- kernel-binary: generate and install compile_commands.json (bsc#1228971)\n- kernfs: Convert kernfs_path_from_node_locked() from strlcpy() to strscpy() (bsc#1229134).\n- kernfs: fix false-positive WARN(nr_mmapped) in kernfs_drain_open_files (git-fixes).\n- kprobes: Fix to check symbol prefixes correctly (git-fixes).\n- kprobes: Prohibit probing on CFI preamble symbol (git-fixes).\n- kvm: s390: Reject memory region operations for ucontrol VMs (git-fixes bsc#1229168).\n- libbpf: Add missing LIBBPF_API annotation to libbpf_set_memlock_rlim API (git-fixes).\n- libbpf: Apply map_set_def_max_entries() for inner_maps on creation (git-fixes).\n- libbpf: Fix faccessat() usage on Android (git-fixes).\n- libbpf: Use OPTS_SET() macro in bpf_xdp_query() (git-fixes).\n- md-cluster: fix hanging issue while a new disk adding (bsc#1223395).\n- md-cluster: fix hanging issue while a new disk adding (bsc#1223395).\n- md-cluster: fix no recovery job when adding/re-adding a disk (bsc#1223395).\n- md-cluster: fix no recovery job when adding/re-adding a disk (bsc#1223395).\n- md-cluster: keeping kabi compatibility for upstream commit 35a0a409fa26 (bsc#1223395).\n- md/md-bitmap: fix writing non bitmap pages (git-fixes).\n- md/raid1: set max_sectors during early return from choose_slow_rdev() (git-fixes).\n- md/raid1: support read error check (git-fixes).\n- md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (git-fixes).\n- md/raid5: fix spares errors about rcu usage (git-fixes).\n- md/raid5: recheck if reshape has finished with device_lock held (git-fixes).\n- md: Do not wait for MD_RECOVERY_NEEDED for HOT_REMOVE_DISK ioctl (git-fixes).\n- md: add a mddev_add_trace_msg helper (git-fixes).\n- md: add check for sleepers in md_wakeup_thread() (git-fixes).\n- md: change the return value type of md_write_start to void (git-fixes).\n- md: do not account sync_io if iostats of the disk is disabled (git-fixes).\n- md: do not delete safemode_timer in mddev_suspend (git-fixes).\n- md: factor out a helper exceed_read_errors() to check read_errors (git-fixes).\n- md: fix a suspicious RCU usage warning (git-fixes).\n- media: Revert \"media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()\" (git-fixes).\n- media: amphion: Remove lock in s_ctrl callback (stable-fixes).\n- media: drivers/media/dvb-core: copy user arrays safely (stable-fixes).\n- media: pci: cx23885: check cx23885_vdev_init() return (stable-fixes).\n- media: uvcvideo: Add quirk for invalid dev_sof in Logitech C920 (git-fixes).\n- media: uvcvideo: Disable autosuspend for Insta360 Link (stable-fixes).\n- media: uvcvideo: Fix the bandwdith quirk on USB 3.x (stable-fixes).\n- media: uvcvideo: Ignore empty TS packets (stable-fixes).\n- media: uvcvideo: Quirk for invalid dev_sof in Logitech C922 (stable-fixes).\n- media: xc2028: avoid use-after-free in load_firmware_cb() (stable-fixes).\n- memcg: protect concurrent access to mem_cgroup_idr (git-fixes).\n- memory: stm32-fmc2-ebi: check regmap_read return value (stable-fixes).\n- memory: tegra: Skip SID programming if SID registers are not set (stable-fixes).\n- minmax: add a few more MIN_T/MAX_T users (bsc#1229024).\n- minmax: avoid overly complicated constant expressions in VM code (bsc#1229024).\n- minmax: do not use max() in situations that want a C constant expression (bsc#1229024).\n- minmax: fix up min3() and max3() too (bsc#1229024).\n- minmax: improve macro expansion and type checking (bsc#1229024).\n- minmax: make generic MIN() and MAX() macros available everywhere (bsc#1229024).\n- minmax: simplify and clarify min_t()/max_t() implementation (bsc#1229024).\n- minmax: simplify min()/max()/clamp() implementation (bsc#1229024).\n- mm, kmsan: fix infinite recursion due to RCU critical section (git-fixes).\n- mm: prevent derefencing NULL ptr in pfn_section_valid() (git-fixes).\n- mmc: dw_mmc: allow biu and ciu clocks to defer (git-fixes).\n- mmc: mmc_test: Fix NULL dereference on allocation failure (git-fixes).\n- mmc: mtk-sd: receive cmd8 data when hs400 tuning fail (git-fixes).\n- net/iucv: fix the allocation size of iucv_path_table array (git-fixes bsc#1229451).\n- net/iucv: fix use after free in iucv_sock_close() (bsc#1228973).\n- net/rds: fix possible cp null dereference (git-fixes).\n- net/sched: initialize noop_qdisc owner (git-fixes).\n- net: drop bad gso csum_start and offset in virtio_net_hdr (git-fixes).\n- net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb() (git-fixes).\n- net: fix sk_memory_allocated_{add|sub} vs softirqs (bsc#1228757).\n- net: mana: Add support for page sizes other than 4KB on ARM64 (jsc#PED-8491 bsc#1226530).\n- net: mana: Fix RX buf alloc_size alignment and atomic op panic (bsc#1229086).\n- net: mana: Fix doorbell out of order violation and avoid unnecessary doorbell rings (bsc#1229154).\n- net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response (git-fixes).\n- net: missing check virtio (git-fixes).\n- net: phy: micrel: Fix the KSZ9131 MDI-X status issue (git-fixes).\n- net: phy: realtek: add support for RTL8366S Gigabit PHY (git-fixes).\n- net: usb: qmi_wwan: fix memory leak for not ip packets (git-fixes).\n- net: usb: sr9700: fix uninitialized variable use in sr_mdio_read (git-fixes).\n- netfs, fscache: export fscache_put_volume() and add fscache_try_get_volume() (bsc#1228459 bsc#1228462).\n- nfc: pn533: Add poll mod list filling check (git-fixes).\n- nfs: do not invalidate dentries on transient errors (git-fixes).\n- nfs: expose /proc/net/sunrpc/nfs in net namespaces (git-fixes).\n- nfs: make the rpc_stat per net namespace (git-fixes).\n- nfs: pass explicit offset/count to trace events (git-fixes).\n- nfs: propagate readlink errors in nfs_symlink_filler (git-fixes).\n- nouveau/firmware: use dma non-coherent allocator (git-fixes).\n- nvme-multipath: find NUMA path only for online numa-node (git-fixes).\n- nvme-multipath: implement \"queue-depth\" iopolicy (bsc#1227706).\n- nvme-multipath: prepare for \"queue-depth\" iopolicy (bsc#1227706).\n- nvme-pci: Fix the instructions for disabling power management (git-fixes).\n- nvme-pci: add missing condition check for existence of mapped data (git-fixes).\n- nvme-pci: do not directly handle subsys reset fallout (bsc#1220066).\n- nvme-sysfs: add 'tls_configured_key' sysfs attribute (bsc#1221857).\n- nvme-sysfs: add 'tls_keyring' attribute (bsc#1221857).\n- nvme-tcp: check for invalidated or revoked key (bsc#1221857).\n- nvme-tcp: sanitize TLS key handling (bsc#1221857).\n- nvme: add a newline to the 'tls_key' sysfs attribute (bsc#1221857).\n- nvme: adjust multiples of NVME_CTRL_PAGE_SIZE in offset (git-fixes).\n- nvme: avoid double free special payload (git-fixes).\n- nvme: fix NVME_NS_DEAC may incorrectly identifying the disk as EXT_LBA (git-fixes).\n- nvme: fixup comment for nvme RDMA Provider Type (git-fixes).\n- nvme: split off TLS sysfs attributes into a separate group (bsc#1221857).\n- nvme: tcp: remove unnecessary goto statement (bsc#1221857).\n- nvme_core: scan namespaces asynchronously (bsc#1224105).\n- nvmet-auth: fix nvmet_auth hash error handling (git-fixes).\n- nvmet: always initialize cqe.result (git-fixes).\n- nvmet: do not return 'reserved' for empty TSAS values (git-fixes).\n- nvmet: fix a possible leak when destroy a ctrl during qp establishment (git-fixes).\n- nvmet: make 'tsas' attribute idempotent for RDMA (git-fixes).\n- ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry() (bsc#1228410).\n- padata: Fix possible divide-by-0 panic in padata_mt_helper() (git-fixes).\n- perf/smmuv3: Enable HiSilicon Erratum 162001900 quirk for HIP08/09 (git-fixes).\n- pinctrl: mediatek: common-v2: Fix broken bias-disable for PULL_PU_PD_RSEL_TYPE (git-fixes).\n- pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B pins (git-fixes).\n- pinctrl: single: fix potential NULL dereference in pcs_get_function() (git-fixes).\n- pinctrl: starfive: jh7110: Correct the level trigger configuration of iev register (git-fixes).\n- platform/chrome: cros_ec_proto: Lock device when updating MKBP version (git-fixes).\n- platform/chrome: cros_ec_proto: Lock device when updating MKBP version (git-fixes).\n- platform/surface: aggregator: Fix warning when controller is destroyed in probe (git-fixes).\n- platform/x86/amd/hsmp: Add support for ACPI based probing (jsc#PED-8779).\n- platform/x86/amd/hsmp: Cache pci_dev in struct hsmp_socket (jsc#PED-8779).\n- platform/x86/amd/hsmp: Change devm_kzalloc() to devm_kcalloc() (jsc#PED-8779).\n- platform/x86/amd/hsmp: Check HSMP support on AMD family of processors (jsc#PED-8779).\n- platform/x86/amd/hsmp: Check num_sockets against MAX_AMD_SOCKETS (jsc#PED-8779).\n- platform/x86/amd/hsmp: Create static func to handle platdev (jsc#PED-8779).\n- platform/x86/amd/hsmp: Define a struct to hold mailbox regs (jsc#PED-8779).\n- platform/x86/amd/hsmp: Move dev from platdev to hsmp_socket (jsc#PED-8779).\n- platform/x86/amd/hsmp: Move hsmp_test to probe (jsc#PED-8779).\n- platform/x86/amd/hsmp: Non-ACPI support for AMD F1A_M00~0Fh (jsc#PED-8779).\n- platform/x86/amd/hsmp: Remove extra parenthesis and add a space (jsc#PED-8779).\n- platform/x86/amd/hsmp: Restructure sysfs group creation (jsc#PED-8779).\n- platform/x86/amd/hsmp: switch to use device_add_groups() (jsc#PED-8779).\n- platform/x86/intel/ifs: Initialize union ifs_status to zero (git-fixes).\n- platform/x86: lg-laptop: fix %s null argument warning (stable-fixes).\n- power: supply: axp288_charger: Fix constant_charge_voltage writes (git-fixes).\n- power: supply: axp288_charger: Round constant_charge_voltage writes down (git-fixes).\n- power: supply: qcom_battmgr: return EAGAIN when firmware service is not up (git-fixes).\n- powerpc/64: Set _IO_BASE to POISON_POINTER_DELTA not 0 for CONFIG_PCI=n (bsc#1194869).\n- powerpc/io: Avoid clang null pointer arithmetic warnings (bsc#1194869).\n- powerpc/kexec: make the update_cpus_node() function public (bsc#1194869).\n- powerpc/kexec: split CONFIG_KEXEC_FILE and CONFIG_CRASH_DUMP (bsc#1194869).\n- powerpc/kexec_file: fix cpus node update to FDT (bsc#1194869).\n- powerpc/pseries: Add failure related checks for h_get_mpp and h_get_ppp (bsc#1194869).\n- powerpc/pseries: Whitelist dtl slub object for copying to userspace (bsc#1194869).\n- powerpc/radix: Move some functions into #ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE (bsc#1194869).\n- powerpc/topology: Check if a core is online (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588 git-fixes).\n- powerpc/xmon: Check cpu id in commands \"c#\", \"dp#\" and \"dx#\" (bsc#1194869).\n- powerpc: fix a file leak in kvm_vcpu_ioctl_enable_cap() (bsc#1194869).\n- powerpc: xor_vmx: Add '-mhard-float' to CFLAGS (bsc#1194869).\n- printk/panic: Allow cpu backtraces to be written into ringbuffer during panic (bsc#1225607).\n- reiserfs: fix uninit-value in comp_keys (git-fixes).\n- rtc: nct3018y: fix possible NULL dereference (stable-fixes).\n- s390/cpum_cf: Fix endless loop in CF_DIAG event stop (git-fixes bsc#1229171).\n- s390/dasd: fix error checks in dasd_copy_pair_store() (git-fixes bsc#1229173).\n- s390/dasd: fix error recovery leading to data corruption on ESE devices (git-fixes bsc#1229452).\n- s390/pci: Add missing virt_to_phys() for directed DIBV (git-fixes bsc#1229174).\n- s390/pci: Allow allocation of more than 1 MSI interrupt (git-fixes bsc#1229172).\n- s390/pci: Refactor arch_setup_msi_irqs() (git-fixes bsc#1229172).\n- s390/pkey: harmonize pkey s390 debug feature calls (bsc#1228720).\n- s390/pkey: introduce dynamic debugging for pkey (bsc#1228720).\n- s390/sclp: Prevent release of buffer in I/O (git-fixes bsc#1229169).\n- s390/uv: Panic for set and remove shared access UVC errors (git-fixes bsc#1229170).\n- samples/bpf: syscall_tp_user: Fix array out-of-bound access (git-fixes).\n- samples/bpf: syscall_tp_user: Rename num_progs into nr_tests (git-fixes).\n- sbitmap: use READ_ONCE to access map-\u003eword (stable-fixes).\n- scsi: lpfc: Allow DEVICE_RECOVERY mode after RSCN receipt if in PRLI_ISSUE state (bsc#1228857).\n- scsi: lpfc: Cancel ELS WQE instead of issuing abort when SLI port is inactive (bsc#1228857).\n- scsi: lpfc: Fix handling of fully recovered fabric node in dev_loss callbk (bsc#1228857).\n- scsi: lpfc: Fix incorrect request len mbox field when setting trunking via sysfs (bsc#1228857).\n- scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (bsc#1228857).\n- scsi: lpfc: Relax PRLI issue conditions after GID_FT response (bsc#1228857).\n- scsi: lpfc: Revise lpfc_prep_embed_io routine with proper endian macro usages (bsc#1228857).\n- scsi: lpfc: Update lpfc version to 14.4.0.3 (bsc#1228857).\n- scsi: qla2xxx: Avoid possible run-time warning with long model_num (bsc#1228850).\n- scsi: qla2xxx: Complete command early within lock (bsc#1228850).\n- scsi: qla2xxx: Convert comma to semicolon (bsc#1228850).\n- scsi: qla2xxx: Drop driver owner assignment (bsc#1228850).\n- scsi: qla2xxx: During vport delete send async logout explicitly (bsc#1228850).\n- scsi: qla2xxx: Fix debugfs output for fw_resource_count (bsc#1228850).\n- scsi: qla2xxx: Fix flash read failure (bsc#1228850).\n- scsi: qla2xxx: Fix for possible memory corruption (bsc#1228850).\n- scsi: qla2xxx: Fix optrom version displayed in FDMI (bsc#1228850).\n- scsi: qla2xxx: Indent help text (bsc#1228850).\n- scsi: qla2xxx: Reduce fabric scan duplicate code (bsc#1228850).\n- scsi: qla2xxx: Remove unused struct 'scsi_dif_tuple' (bsc#1228850).\n- scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for ELS cmds (bsc#1228850).\n- scsi: qla2xxx: Unable to act on RSCN for port online (bsc#1228850).\n- scsi: qla2xxx: Update version to 10.02.09.300-k (bsc#1228850).\n- scsi: qla2xxx: Use QP lock to search for bsg (bsc#1228850).\n- scsi: qla2xxx: validate nvme_local_port correctly (bsc#1228850).\n- selftest/bpf: Add map_in_maps with BPF_MAP_TYPE_PERF_EVENT_ARRAY values (git-fixes).\n- selftests/bpf: Add a test to verify previous stacksafe() fix (bsc#1225903).\n- selftests/bpf: Add assert for user stacks in test_task_stack (git-fixes).\n- selftests/bpf: Add netkit to tc_redirect selftest (git-fixes).\n- selftests/bpf: De-veth-ize the tc_redirect test case (git-fixes).\n- selftests/bpf: Disable IPv6 for lwt_redirect test (git-fixes).\n- selftests/bpf: Fix erroneous bitmask operation (git-fixes).\n- selftests/bpf: Fix issues in setup_classid_environment() (git-fixes).\n- selftests/bpf: Fix potential premature unload in bpf_testmod (git-fixes).\n- selftests/bpf: Fix pyperf180 compilation failure with clang18 (git-fixes).\n- selftests/bpf: Fix the flaky tc_redirect_dtime test (git-fixes).\n- selftests/bpf: Fix up xdp bonding test wrt feature flags (git-fixes).\n- selftests/bpf: Make linked_list failure test more robust (git-fixes).\n- selftests/bpf: Relax time_tai test for equal timestamps in tai_forward (git-fixes).\n- selftests/bpf: Skip module_fentry_shadow test when bpf_testmod is not available (git-fixes).\n- selftests/bpf: Wait for the netstamp_needed_key static key to be turned on (git-fixes).\n- selftests/bpf: fix RELEASE=1 build for tc_opts (git-fixes).\n- selftests/bpf: fix bpf_loop_bench for new callback verification scheme (git-fixes).\n- selftests/bpf: fix compiler warnings in RELEASE=1 mode (git-fixes).\n- selftests/bpf: satisfy compiler by having explicit return in btf test (git-fixes).\n- serial: core: check uartclk for zero to avoid divide by zero (stable-fixes).\n- soc: qcom: cmd-db: Map shared memory as WC, not WB (git-fixes).\n- soc: qcom: pmic_glink: Actually communicate when remote goes down (git-fixes).\n- soundwire: stream: fix programming slave ports for non-continous port maps (git-fixes).\n- spi: Add empty versions of ACPI functions (stable-fixes).\n- spi: microchip-core: fix init function not setting the master and motorola modes (git-fixes).\n- spi: microchip-core: switch to use modern name (stable-fixes).\n- spi: spi-fsl-lpspi: Fix scldiv calculation (git-fixes).\n- spi: spidev: Add missing spi_device_id for bh2228fv (git-fixes).\n- squashfs: squashfs_read_data need to check if the length is 0 (git-fixes).\n- ssb: Fix division by zero issue in ssb_calc_clock_rate (stable-fixes).\n- staging: iio: resolver: ad2s1210: fix use before initialization (stable-fixes).\n- staging: ks7010: disable bh on tx_dev_lock (stable-fixes).\n- string.h: Introduce memtostr() and memtostr_pad() (bsc#1228849).\n- sunrpc: add a struct rpc_stats arg to rpc_create_args (git-fixes).\n- swiotlb: do not set total_used to 0 in swiotlb_create_debugfs_files() (git-fixes).\n- swiotlb: fix swiotlb_bounce() to do partial sync's correctly (git-fixes).\n- syscalls: fix compat_sys_io_pgetevents_time64 usage (git-fixes).\n- thermal/drivers/broadcom: Fix race between removal and clock disable (git-fixes).\n- thermal: bcm2835: Convert to platform remove callback returning void (stable-fixes).\n- thunderbolt: Mark XDomain as unplugged when router is removed (stable-fixes).\n- tools/perf: Fix perf bench epoll to enable the run when some CPU's are offline (bsc#1227747).\n- tools/perf: Fix perf bench futex to enable the run when some CPU's are offline (bsc#1227747).\n- tools/perf: Fix timing issue with parallel threads in perf bench wake-up-parallel (bsc#1227747).\n- tools/resolve_btfids: Fix comparison of distinct pointer types warning in resolve_btfids (git-fixes).\n- tools/resolve_btfids: Fix cross-compilation to non-host endianness (git-fixes).\n- tools/resolve_btfids: Refactor set sorting with types from btf_ids.h (git-fixes).\n- tools/resolve_btfids: fix build with musl libc (git-fixes).\n- trace/pid_list: Change gfp flags in pid_list_fill_irq() (git-fixes).\n- tracing: Return from tracing_buffers_read() if the file has been closed (bsc#1229136 git-fixes).\n- tty: atmel_serial: use the correct RTS flag (git-fixes).\n- tty: serial: fsl_lpuart: mark last busy before uart_add_one_port (git-fixes).\n- usb: cdnsp: fix for Link TRB with TC (git-fixes).\n- usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function (git-fixes).\n- usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes() (git-fixes).\n- usb: dwc3: core: Skip setting event buffers for host only controllers (stable-fixes).\n- usb: dwc3: omap: add missing depopulate in probe error path (git-fixes).\n- usb: dwc3: st: add missing depopulate in probe error path (git-fixes).\n- usb: dwc3: st: fix probed platform device ref count on probe error path (git-fixes).\n- usb: gadget: core: Check for unset descriptor (git-fixes).\n- usb: gadget: fsl: Increase size of name buffer for endpoints (stable-fixes).\n- usb: gadget: u_audio: Check return codes from usb_ep_enable and config_ep_by_speed (git-fixes).\n- usb: gadget: u_serial: Set start_delayed during suspend (git-fixes).\n- usb: gadget: uvc: cleanup request when not in correct state (stable-fixes).\n- usb: typec: fsa4480: Add support to swap SBU orientation (git-fixes).\n- usb: typec: fsa4480: Check if the chip is really there (git-fixes).\n- usb: typec: fsa4480: Relax CHIP_ID check (git-fixes).\n- usb: typec: fsa4480: add support for Audio Accessory Mode (git-fixes).\n- usb: typec: fsa4480: rework mux \u0026 switch setup to handle more states (git-fixes).\n- usb: vhci-hcd: Do not drop references before new references are gained (stable-fixes).\n- vfio/pci: fix potential memory leak in vfio_intx_enable() (git-fixes).\n- vhost-scsi: Handle vhost_vq_work_queue failures for events (git-fixes).\n- vhost-vdpa: switch to use vmf_insert_pfn() in the fault handler (git-fixes).\n- vhost/vsock: always initialize seqpacket_allow (git-fixes).\n- vhost: Release worker mutex during flushes (git-fixes).\n- vhost: Use virtqueue mutex for swapping worker (git-fixes).\n- virt: guest_memfd: fix reference leak on hwpoisoned page (git-fixes).\n- virtio-crypto: handle config changed by work queue (git-fixes).\n- virtio: reenable config if freezing device failed (git-fixes).\n- virtio_net: use u64_stats_t infra to avoid data-races (git-fixes).\n- virtiofs: forbid newlines in tags (bsc#1229940).\n- wifi: ath12k: fix memory leak in ath12k_dp_rx_peer_frag_setup() (stable-fixes).\n- wifi: ath12k: fix soft lockup on suspend (git-fixes).\n- wifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion (git-fixes).\n- wifi: cfg80211: fix reporting failed MLO links status with cfg80211_connect_done (git-fixes).\n- wifi: iwlwifi: fw: fix wgds rev 3 exact size (git-fixes).\n- wifi: mac80211: use monitor sdata with driver only if desired (git-fixes).\n- wifi: mwifiex: duplicate static structs used in driver instances (git-fixes).\n- wifi: nl80211: disallow setting special AP channel widths (stable-fixes).\n- wifi: nl80211: do not give key data to userspace (stable-fixes).\n- wifi: rtw88: usb: Fix disconnection after beacon loss (stable-fixes).\n- wifi: wfx: repair open network AP mode (git-fixes).\n- workqueue: Improve scalability of workqueue watchdog touch (bsc#1193454).\n- workqueue: wq_watchdog_touch is always called with valid CPU (bsc#1193454).\n- x86/asm: Use %c/%n instead of %P operand modifier in asm templates (git-fixes).\n- x86/entry/64: Remove obsolete comment on tracing vs. SYSRET (git-fixes).\n- x86/mm: Fix pti_clone_entry_text() for i386 (git-fixes).\n- x86/mm: Fix pti_clone_pgtable() alignment assumption (git-fixes).\n- x86/mtrr: Check if fixed MTRRs exist before saving them (git-fixes).\n- x86/numa: Fix SRAT lookup of CFMWS ranges with numa_fill_memblks() (git-fixes).\n- x86/numa: Fix the address overlap check in numa_fill_memblks() (git-fixes).\n- x86/numa: Fix the sort compare func used in numa_fill_memblks() (git-fixes).\n- x86/numa: Introduce numa_fill_memblks() (git-fixes).\n- x86/pci: Skip early E820 check for ECAM region (git-fixes).\n- x86/xen: Convert comma to semicolon (git-fixes).\n- xfs: Fix missing interval for missing_owner in xfs fsmap (git-fixes).\n- xfs: Fix the owner setting issue for rmap query in xfs fsmap (git-fixes).\n- xfs: allow cross-linking special files without project quota (git-fixes).\n- xfs: allow symlinks with short remote targets (bsc#1229160).\n- xfs: allow unlinked symlinks and dirs with zero size (git-fixes).\n- xfs: attr forks require attr, not attr2 (git-fixes).\n- xfs: convert comma to semicolon (git-fixes).\n- xfs: do not use current-\u003ejournal_info (git-fixes).\n- xfs: fix unlink vs cluster buffer instantiation race (git-fixes).\n- xfs: honor init_xattrs in xfs_init_new_inode for !ATTR fs (git-fixes).\n- xfs: journal geometry is not properly bounds checked (git-fixes).\n- xfs: match lock mode in xfs_buffered_write_iomap_begin() (git-fixes).\n- xfs: require XFS_SB_FEAT_INCOMPAT_LOG_XATTRS for attr log intent item recovery (git-fixes).\n- xfs: upgrade the extent counters in xfs_reflink_end_cow_extent later (git-fixes).\n- xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code (git-fixes).\n- xfs: use consistent uid/gid when grabbing dquots for inodes (git-fixes).\n- xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration (git-fixes).\n- xprtrdma: Fix rpcrdma_reqs_reset() (git-fixes).\n","status":"published","published":"2025-02-03T08:54:39Z","modified":"2026-03-23T04:50:03.568046Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:20047-1","title":"Security update for the Linux Kernel","description":"\n\nThe SUSE Linux Enterprise Micro 6.0 RT kernel was updated to receive various security bugfixes.\n\nThe following security bugs were fixed:\n\n- CVE-2023-52489: mm/sparsemem: fix race in accessing memory_section-\u003eusage (bsc#1221326).\n- CVE-2023-52581: netfilter: nf_tables: fix memleak when more than 255 elements expired (bsc#1220877).\n- CVE-2023-52859: perf: hisi: Fix use-after-free when register pmu fails (bsc#1225582).\n- CVE-2023-52889: apparmor: Fix null pointer deref when receiving skb during sock creation (bsc#1229287).\n- CVE-2024-26590: erofs: fix inconsistent per-file compression format (bsc#1220252).\n- CVE-2024-26631: ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work (bsc#1221630).\n- CVE-2024-26668: netfilter: nft_limit: reject configurations that cause integer overflow (bsc#1222335).\n- CVE-2024-26669: kABI fix for net/sched: flower: Fix chain template offload (bsc#1222350).\n- CVE-2024-26677: Blacklist e7870cf13d20 (\" Fix delayed ACKs to not set the reference serial number\") (bsc#1222387)\n- CVE-2024-26735: ipv6: sr: fix possible use-after-free and null-ptr-deref (bsc#1222372).\n- CVE-2024-26808: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).\n- CVE-2024-26809: netfilter: nft_set_pipapo: release elements in clone only from destroy path (bsc#1222633).\n- CVE-2024-26812: kABI: vfio: struct virqfd kABI workaround (bsc#1222808).\n- CVE-2024-26835: netfilter: nf_tables: set dormant flag on hook register failure (bsc#1222967).\n- CVE-2024-26837: net: bridge: switchdev: race between creation of new group memberships and generation of the list of MDB events to replay (bsc#1222973).\n- CVE-2024-26851: netfilter: nf_conntrack_h323: Add protection for bmp length out of range (bsc#1223074)\n- CVE-2024-27010: net/sched: Fix mirred deadlock on device recursion (bsc#1223720).\n- CVE-2024-27011: netfilter: nf_tables: fix memleak in map from abort path (bsc#1223803).\n- CVE-2024-27024: net/rds: fix WARNING in rds_conn_connect_if_down (bsc#1223777).\n- CVE-2024-27079: iommu/vt-d: Fix NULL domain on device release (bsc#1223742).\n- CVE-2024-27403: kabi: restore const specifier in flow_offload_route_init() (bsc#1224415).\n- CVE-2024-27433: clk: mediatek: mt7622-apmixedsys: Fix an error handling path in clk_mt8135_apmixed_probe() (bsc#1224711).\n- CVE-2024-27437: vfio/pci: Disable auto-enable of exclusive INTx IRQ (bsc#1222625).\n- CVE-2024-35897: netfilter: nf_tables: discard table flag update with pending basechain deletion (bsc#1224510).\n- CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure (bsc#1224535).\n- CVE-2024-35949: btrfs: make sure that WRITTEN is set on all metadata blocks (bsc#1224700).\n- CVE-2024-36286: netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (bsc#1226801)\n- CVE-2024-36489: tls: fix missing memory barrier in tls_init (bsc#1226874)\n- CVE-2024-36881: mm/userfaultfd: Fix reset ptes when close() for wr-protected (bsc#1225718).\n- CVE-2024-36929: net: core: reject skb_copy(_expand) for fraglist GSO skbs (bsc#1225814).\n- CVE-2024-36933: net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (bsc#1225832).\n- CVE-2024-36979: net: bridge: mst: fix vlan use-after-free (bsc#1226604).\n- CVE-2024-38662: selftests/bpf: Cover verifier checks for mutating sockmap/sockhash (bsc#1226885).\n- CVE-2024-39489: ipv6: sr: fix memleak in seg6_hmac_init_algo (bsc#1227623)\n- CVE-2024-39506: liquidio: adjust a NULL pointer handling path in lio_vf_rep_copy_packet (bsc#1227729).\n- CVE-2024-40905: ipv6: fix possible race in __fib6_drop_pcpu_from() (bsc#1227761)\n- CVE-2024-40909: bpf: Fix a potential use-after-free in bpf_link_free() (bsc#1227798).\n- CVE-2024-40920: net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (bsc#1227781).\n- CVE-2024-40921: net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state (bsc#1227784).\n- CVE-2024-40938: landlock: fix d_parent walk (bsc#1227840).\n- CVE-2024-40939: net: wwan: iosm: Fix tainted pointer delete is case of region creation fail (bsc#1227799).\n- CVE-2024-40954: net: do not leave a dangling sk pointer, when socket creation fails (bsc#1227808)\n- CVE-2024-40956: dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list (bsc#1227810).\n- CVE-2024-40957: seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors (bsc#1227811).\n- CVE-2024-40958: netns: Make get_net_ns() handle zero refcount net (bsc#1227812).\n- CVE-2024-40959: xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() (bsc#1227884).\n- CVE-2024-40978: scsi: qedi: Fix crash while reading debugfs attribute (bsc#1227929).\n- CVE-2024-40989: KVM: arm64: Disassociate vcpus from redistributor region on teardown (bsc#1227823).\n- CVE-2024-40994: ptp: fix integer overflow in max_vclocks_store (bsc#1227829).\n- CVE-2024-40995: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() (bsc#1227830).\n- CVE-2024-41000: block/ioctl: prefer different overflow check (bsc#1227867).\n- CVE-2024-41007: tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() (bsc#1227863).\n- CVE-2024-41009: bpf: Fix overrunning reservations in ringbuf (bsc#1228020).\n- CVE-2024-41010: bpf: Fix too early release of tcx_entry (bsc#1228021).\n- CVE-2024-41012: filelock: Remove locks reliably when fcntl/close race is detected (bsc#1228247).\n- CVE-2024-41015: ocfs2: add bounds checking to ocfs2_check_dir_entry() (bsc#1228409).\n- CVE-2024-41020: filelock: Fix fcntl/close race recovery compat path (bsc#1228427).\n- CVE-2024-41032: mm: vmalloc: check if a hash-index is in cpu_possible_mask (bsc#1228460).\n- CVE-2024-41036: net: ks8851: Fix deadlock with the SPI chip variant (bsc#1228496).\n- CVE-2024-41040: net/sched: Fix UAF when resolving a clash (bsc#1228518).\n- CVE-2024-41041: udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port() (bsc#1228520).\n- CVE-2024-41044: ppp: reject claimed-as-LCP but actually malformed packets (bsc#1228530).\n- CVE-2024-41048: skmsg: Skip zero length skb in sk_msg_recvmsg (bsc#1228565).\n- CVE-2024-41050: cachefiles: cyclic allocation of msg_id to avoid reuse (bsc#1228499).\n- CVE-2024-41051: cachefiles: wait for ondemand_object_worker to finish when dropping object (bsc#1228468).\n- CVE-2024-41057: cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie() (bsc#1228462).\n- CVE-2024-41058: cachefiles: fix slab-use-after-free in fscache_withdraw_volume() (bsc#1228459).\n- CVE-2024-41062: bluetooth/l2cap: sync sock recv cb and release (bsc#1228576).\n- CVE-2024-41064: powerpc/eeh: avoid possible crash when edev-\u003epdev changes (bsc#1228599).\n- CVE-2024-41066: ibmvnic: add tx check to prevent skb leak (bsc#1228640).\n- CVE-2024-41068: s390/sclp: Fix sclp_init() cleanup on failure (bsc#1228579).\n- CVE-2024-41069: ASoC: topology: Fix route memory corruption (bsc#1228644).\n- CVE-2024-41070: KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group() (bsc#1228581).\n- CVE-2024-41074: cachefiles: Set object to close if ondemand_id \u003c 0 in copen (bsc#1228643).\n- CVE-2024-41075: cachefiles: add consistency check for copen/cread (bsc#1228646).\n- CVE-2024-41076: NFSv4: Fix memory leak in nfs4_set_security_label (bsc#1228649).\n- CVE-2024-41078: btrfs: qgroup: fix quota root leak after quota disable failure (bsc#1228655).\n- CVE-2024-41080: io_uring: fix possible deadlock in io_register_iowq_max_workers() (bsc#1228616).\n- CVE-2024-41081: ila: block BH in ila_output() (bsc#1228617).\n- CVE-2024-41084: cxl/region: Avoid null pointer dereference in region lookup (bsc#1228472).\n- CVE-2024-42070: netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (bsc#1228470).\n- CVE-2024-42073: mlxsw: spectrum_buffers: Fix memory corruptions on Spectrum-4 systems (bsc#1228457).\n- CVE-2024-42079: gfs2: Fix NULL pointer dereference in gfs2_log_flush (bsc#1228672).\n- CVE-2024-42082: xdp: Remove WARN() from __xdp_reg_mem_model() (bsc#1228482).\n- CVE-2024-42093: net/dpaa2: Avoid explicit cpumask var allocation on stack (bsc#1228680).\n- CVE-2024-42095: serial: 8250_omap: Fix Errata i2310 with RX FIFO level check (bsc#1228446).\n- CVE-2024-42096: x86: stop playing stack games in profile_pc() (bsc#1228633).\n- CVE-2024-42106: inet_diag: Initialize pad field in struct inet_diag_req_v2 (bsc#1228493).\n- CVE-2024-42107: ice: Do not process extts if PTP is disabled (bsc#1228494).\n- CVE-2024-42109: netfilter: nf_tables: unconditionally flush pending work before notifier (bsc#1228505).\n- CVE-2024-42110: net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() (bsc#1228501).\n- CVE-2024-42113: net: txgbe: initialize num_q_vectors for MSI/INTx interrupts (bsc#1228568).\n- CVE-2024-42122: drm/amd/display: Add NULL pointer check for kzalloc (bsc#1228591).\n- CVE-2024-42124: scsi: qedf: Make qedf_execute_tmf() non-preemptible (bsc#1228705).\n- CVE-2024-42138: mlxsw: core_linecards: Fix double memory deallocation in case of invalid INI file (bsc#1228500).\n- CVE-2024-42139: ice: Fix improper extts handling (bsc#1228503).\n- CVE-2024-42142: net/mlx5: E-switch, Create ingress ACL when needed (bsc#1228491).\n- CVE-2024-42145: IB/core: Implement a limit on UMAD receive List (bsc#1228743).\n- CVE-2024-42148: bnx2x: Fix multiple UBSAN array-index-out-of-bounds (bsc#1228487).\n- CVE-2024-42155: s390/pkey: Wipe copies of protected- and secure-keys (bsc#1228733).\n- CVE-2024-42156: s390/pkey: Wipe copies of clear-key structures on failure (bsc#1228722).\n- CVE-2024-42157: s390/pkey: Wipe sensitive data on failure (bsc#1228727).\n- CVE-2024-42158: s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings (bsc#1228720).\n- CVE-2024-42159: scsi: mpi3mr: fix sanitise num_phys (bsc#1228754).\n- CVE-2024-42161: bpf: avoid uninitialized value in BPF_CORE_READ_BITFIELD (bsc#1228756).\n- CVE-2024-42162: gve: Account for stopped queues when reading NIC stats (bsc#1228706).\n- CVE-2024-42224: net: dsa: mv88e6xxx: Correct check for empty list (bsc#1228723).\n- CVE-2024-42241: mm/shmem: disable PMD-sized page cache if needed (bsc#1228986).\n- CVE-2024-42245: Revert \"sched/fair: Make sure to try to detach at least one movable task\" (bsc#1228978).\n- CVE-2024-42246: net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (bsc#1228989).\n- CVE-2024-42247: wireguard: allowedips: avoid unaligned 64-bit memory accesses (bsc#1228988).\n- CVE-2024-42268: net/mlx5: Fix missing lock on sync reset reload (bsc#1229391).\n- CVE-2024-42269: netfilter: iptables: Fix potential null-ptr-deref in ip6table_nat_table_init() (bsc#1229402).\n- CVE-2024-42270: netfilter: iptables: Fix null-ptr-deref in iptable_nat_table_init() (bsc#1229404).\n- CVE-2024-42277: iommu: sprd: Avoid NULL deref in sprd_iommu_hw_en (bsc#1229409).\n- CVE-2024-42281: bpf: Fix a segment issue when downgrading gso_size (bsc#1229386).\n- CVE-2024-42283: net: nexthop: Initialize all fields in dumped nexthops (bsc#1229383)\n- CVE-2024-42284: tipc: Return non-zero value from tipc_udp_addr2str() on error (bsc#1229382)\n- CVE-2024-42290: irqchip/imx-irqsteer: Handle runtime power management correctly (bsc#1229379).\n- CVE-2024-42291: ice: Add a per-VF limit on number of FDIR filters (bsc#1229374).\n- CVE-2024-42295: nilfs2: handle inconsistent state in nilfs_btnode_create_block() (bsc#1229370).\n- CVE-2024-42301: dev/parport: fix the array out-of-bounds risk (bsc#1229407).\n- CVE-2024-42312: sysctl: always initialize i_uid/i_gid (bsc#1229357)\n- CVE-2024-42316: mm/mglru: fix div-by-zero in vmpressure_calc_level() (bsc#1229353).\n- CVE-2024-42318: landlock: Do not lose track of restrictions on cred_transfer (bsc#1229351).\n- CVE-2024-42322: ipvs: properly dereference pe in ip_vs_add_service (bsc#1229347)\n- CVE-2024-43821: scsi: lpfc: Fix a possible null pointer dereference (bsc#1229315).\n- CVE-2024-43831: media: mediatek: vcodec: Handle invalid decoder vsi (bsc#1229309).\n- CVE-2024-43834: xdp: fix invalid wait context of page_pool_destroy() (bsc#1229314)\n- CVE-2024-43837: bpf: Fix updating attached freplace prog in prog_array map (bsc#1229297).\n- CVE-2024-43839: bna: adjust 'name' buf size of bna_tcb and bna_ccb structures (bsc#1229301).\n- CVE-2024-43850: soc: qcom: icc-bwmon: Fix refcount imbalance seen during bwmon_remove (bsc#1229316).\n- CVE-2024-43854: block: initialize integrity buffer to zero before writing it to media (bsc#1229345)\n- CVE-2024-43855: md: fix deadlock between mddev_suspend and flush bio (bsc#1229342).\n- CVE-2024-43864: net/mlx5e: Fix CT entry update leaks of modify header context (bsc#1229496).\n- CVE-2024-43866: net/mlx5: Always drain health in shutdown callback (bsc#1229495).\n- CVE-2024-43880: kabi: lib: objagg: Put back removed metod in struct objagg_ops (bsc#1229481).\n- CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)\n- CVE-2024-43899: drm/amd/display: Fix null pointer deref in dcn20_resource.c (bsc#1229754).\n- CVE-2024-43911: wifi: mac80211: fix NULL dereference at band check in starting tx ba session (bsc#1229827).\n\nThe following non-security bugs were fixed:\n\n- ACPI/NUMA: Apply SRAT proximity domain to entire CFMWS window (git-fixes).\n- ACPI: SBS: manage alarm sysfs attribute through psy core (stable-fixes).\n- ACPI: battery: create alarm sysfs attribute atomically (stable-fixes).\n- ACPI: processor_idle: use raw_safe_halt() in acpi_idle_play_dead() (git-fixes).\n- ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4 (stable-fixes).\n- ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4 (stable-fixes).\n- ALSA: hda/realtek - FIxed ALC285 headphone no sound (stable-fixes).\n- ALSA: hda/realtek - Fixed ALC256 headphone no sound (stable-fixes).\n- ALSA: hda/realtek: Add Framework Laptop 13 (Intel Core Ultra) to quirks (stable-fixes).\n- ALSA: hda/realtek: Add Framework Laptop 13 (Intel Core Ultra) to quirks (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Acer Aspire E5-574G (stable-fixes).\n- ALSA: hda/realtek: Add support for new HP G12 laptops (stable-fixes).\n- ALSA: hda/realtek: Enable mute/micmute LEDs on HP Laptop 14-ey0xxx (stable-fixes).\n- ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7 (git-fixes).\n- ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book3 Ultra (stable-fixes).\n- ALSA: hda/realtek: Implement sound init sequence for Samsung Galaxy Book3 Pro 360 (stable-fixes).\n- ALSA: hda/realtek: support HP Pavilion Aero 13-bg0xxx Mute LED (stable-fixes).\n- ALSA: hda/tas2781: Use correct endian conversion (git-fixes).\n- ALSA: hda/tas2781: fix wrong calibrated data order (git-fixes).\n- ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list (stable-fixes).\n- ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list (stable-fixes).\n- ALSA: hda: Conditionally use snooping for AMD HDMI (git-fixes).\n- ALSA: hda: conexant: Fix headset auto detect fail in the polling mode (git-fixes).\n- ALSA: line6: Fix racy access to midibuf (stable-fixes).\n- ALSA: line6: Fix racy access to midibuf (stable-fixes).\n- ALSA: seq: Skip event type filtering for UMP events (git-fixes).\n- ALSA: seq: ump: Explicitly reset RPN with Null RPN (stable-fixes).\n- ALSA: seq: ump: Optimize conversions from SysEx to UMP (git-fixes).\n- ALSA: seq: ump: Transmit RPN/NRPN message at each MSB/LSB data reception (stable-fixes).\n- ALSA: seq: ump: Use the common RPN/bank conversion context (stable-fixes).\n- ALSA: timer: Relax start tick time check for slave timer elements (git-fixes).\n- ALSA: ump: Explicitly reset RPN with Null RPN (stable-fixes).\n- ALSA: ump: Transmit RPN/NRPN message at each MSB/LSB data reception (stable-fixes).\n- ALSA: usb-audio: Add delay quirk for VIVO USB-C-XE710 HEADSET (stable-fixes).\n- ALSA: usb-audio: Correct surround channels in UAC1 channel map (git-fixes).\n- ALSA: usb-audio: Re-add ScratchAmp quirk entries (git-fixes).\n- ALSA: usb-audio: Re-add ScratchAmp quirk entries (git-fixes).\n- ALSA: usb-audio: Support Yamaha P-125 quirk entry (stable-fixes).\n- ALSA: usb: Fix UBSAN warning in parse_audio_unit() (stable-fixes).\n- ASoC: SOF: Intel: hda-dsp: Make sure that no irq handler is pending before suspend (stable-fixes).\n- ASoC: SOF: Remove libraries from topology lookups (git-fixes).\n- ASoC: SOF: Remove libraries from topology lookups (git-fixes).\n- ASoC: SOF: amd: Fix for acp init sequence (git-fixes).\n- ASoC: SOF: ipc4: check return value of snd_sof_ipc_msg_data (stable-fixes).\n- ASoC: SOF: mediatek: Add missing board compatible (stable-fixes).\n- ASoC: allow module autoloading for table board_ids (stable-fixes).\n- ASoC: allow module autoloading for table db1200_pids (stable-fixes).\n- ASoC: amd: acp: fix module autoloading (git-fixes).\n- ASoC: amd: yc: Add quirk entry for OMEN by HP Gaming Laptop 16-n0xxx (bsc#1227182).\n- ASoC: amd: yc: Support mic on HP 14-em0002la (stable-fixes).\n- ASoC: amd: yc: Support mic on HP 14-em0002la (stable-fixes).\n- ASoC: amd: yc: Support mic on Lenovo Thinkpad E14 Gen 6 (stable-fixes).\n- ASoC: amd: yc: Support mic on Lenovo Thinkpad E14 Gen 6 (stable-fixes).\n- ASoC: codecs: wcd938x-sdw: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wcd938x-sdw: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa881x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa881x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa883x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa883x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa884x: Correct Soundwire ports mask (git-fixes).\n- ASoC: codecs: wsa884x: Correct Soundwire ports mask (git-fixes).\n- ASoC: cs35l45: Checks index of cs35l45_irqs[] (stable-fixes).\n- ASoC: cs35l56: Handle OTP read latency over SoundWire (stable-fixes).\n- ASoC: cs35l56: Handle OTP read latency over SoundWire (stable-fixes).\n- ASoC: cs35l56: Patch CS35L56_IRQ1_MASK_18 to the default value (stable-fixes).\n- ASoC: cs35l56: Patch CS35L56_IRQ1_MASK_18 to the default value (stable-fixes).\n- ASoC: fsl_micfil: Expand the range of FIFO watermark mask (stable-fixes).\n- ASoC: fsl_micfil: Expand the range of FIFO watermark mask (stable-fixes).\n- ASoC: mediatek: mt8188: Mark AFE_DAC_CON0 register as volatile (stable-fixes).\n- ASoC: meson: axg-fifo: fix irq scheduling issue with PREEMPT_RT (git-fixes).\n- ASoC: meson: axg-fifo: fix irq scheduling issue with PREEMPT_RT (git-fixes).\n- ASoC: nau8822: Lower debug print priority (stable-fixes).\n- ASoC: nau8822: Lower debug print priority (stable-fixes).\n- Bluetooth: Add device 13d3:3572 IMC Networks Bluetooth Radio (stable-fixes).\n- Bluetooth: Fix usage of __hci_cmd_sync_status (git-fixes).\n- Bluetooth: L2CAP: Fix deadlock (git-fixes).\n- Bluetooth: MGMT: Add error handling to pair_device() (git-fixes).\n- Bluetooth: SMP: Fix assumption of Central always being Initiator (git-fixes).\n- Bluetooth: bnep: Fix out-of-bound access (stable-fixes).\n- Bluetooth: btintel: Fail setup on error (git-fixes).\n- Bluetooth: btnxpuart: Shutdown timer and prevent rearming when driver unloading (stable-fixes).\n- Bluetooth: btusb: Add RTL8852BE device 0489:e125 to device tables (stable-fixes).\n- Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x13d3:0x3591 (stable-fixes).\n- Bluetooth: hci_conn: Check non NULL function before calling for HFP offload (stable-fixes).\n- Bluetooth: hci_core: Fix LE quote calculation (git-fixes).\n- Bluetooth: hci_core: Fix not handling hibernation actions (git-fixes).\n- Bluetooth: hci_sync: Fix suspending with wrong filter policy (git-fixes).\n- Bluetooth: hci_sync: avoid dup filtering when passive scanning with adv monitor (git-fixes).\n- Bluetooth: l2cap: always unlock channel in l2cap_conless_channel() (git-fixes).\n- Drop libata patch that caused a regression (bsc#1229054)\n- Fix build errors without patches.kabi (bsc#1226502)\n- HID: wacom: Defer calculation of resolution until resolution_code is known (git-fixes).\n- Input: MT - limit max slots (stable-fixes).\n- Input: i8042 - add Fujitsu Lifebook E756 to i8042 quirk table (bsc#1229056).\n- Input: i8042 - add forcenorestore quirk to leave controller untouched even on s3 (stable-fixes).\n- Input: i8042 - use new forcenorestore quirk to replace old buggy quirk combination (stable-fixes).\n- KVM: Always flush async #PF workqueue when vCPU is being destroyed (git-fixes).\n- KVM: Make KVM_MEM_GUEST_MEMFD mutually exclusive with KVM_MEM_READONLY (git-fixes).\n- KVM: PPC: Book3S HV: Fix the set_one_reg for MMCR3 (bsc#1194869).\n- KVM: PPC: Book3S HV: Handle pending exceptions on guest entry with MSR_EE (bsc#1215199).\n- KVM: Protect vcpu-\u003epid dereference via debugfs with RCU (git-fixes).\n- KVM: Reject overly excessive IDs in KVM_CREATE_VCPU (git-fixes).\n- KVM: Stop processing *all* memslots when \"null\" mmu_notifier handler is found (git-fixes).\n- KVM: VMX: Move posted interrupt descriptor out of VMX code (git-fixes).\n- KVM: VMX: Split out the non-virtualization part of vmx_interrupt_blocked() (git-fixes).\n- KVM: VMX: Switch __vmx_exit() and kvm_x86_vendor_exit() in vmx_exit() (git-fixes).\n- KVM: arm64: AArch32: Fix spurious trapping of conditional instructions (git-fixes).\n- KVM: arm64: Add missing memory barriers when switching to pKVM's hyp pgd (git-fixes).\n- KVM: arm64: Allow AArch32 PSTATE.M to be restored as System mode (git-fixes).\n- KVM: arm64: Fix AArch32 register narrowing on userspace write (git-fixes).\n- KVM: arm64: Fix __pkvm_init_switch_pgd call ABI (git-fixes).\n- KVM: arm64: Fix clobbered ELR in sync abort/SError (git-fixes)\n- KVM: arm64: GICv4: Do not perform a map to a mapped vLPI (git-fixes).\n- KVM: arm64: timers: Correctly handle TGE flip with CNTPOFF_EL2 (git-fixes).\n- KVM: arm64: timers: Fix resource leaks in kvm_timer_hyp_init() (git-fixes).\n- KVM: arm64: vgic-its: Test for valid IRQ in its_sync_lpi_pending_table() (git-fixes).\n- KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler (git-fixes).\n- KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id (git-fixes).\n- KVM: arm64: vgic-v4: Restore pending state on host userspace write (git-fixes).\n- KVM: arm64: vgic: Add a non-locking primitive for kvm_vgic_vcpu_destroy() (git-fixes).\n- KVM: arm64: vgic: Force vcpu vgic teardown on vcpu destroy (git-fixes).\n- KVM: arm64: vgic: Simplify kvm_vgic_destroy() (git-fixes).\n- KVM: fix kvm_mmu_memory_cache allocation warning (git-fixes).\n- KVM: nVMX: Add a helper to get highest pending from Posted Interrupt vector (git-fixes).\n- KVM: nVMX: Check for pending posted interrupts when looking for nested events (git-fixes).\n- KVM: nVMX: Request immediate exit iff pending nested event needs injection (git-fixes).\n- KVM: s390: fix LPSWEY handling (bsc#1227634 git-fixes).\n- KVM: s390: fix validity interception issue when gisa is switched off (git-fixes bsc#1229167).\n- KVM: x86/mmu: Bug the VM if KVM tries to split a !hugepage SPTE (git-fixes).\n- KVM: x86: Limit check IDs for KVM_SET_BOOT_CPU_ID (git-fixes).\n- Move upstreamed powerpc patches into sorted section\n- Move upstreamed sound patches into sorted section\n- Moved upstreamed ASoC patch into sorted section\n- NFSD: Support write delegations in LAYOUTGET (git-fixes).\n- NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server (git-fixes).\n- PCI: Add Edimax Vendor ID to pci_ids.h (stable-fixes).\n- PCI: hv: Return zero, not garbage, when reading PCI_INTERRUPT_PIN (git-fixes).\n- PCI: loongson: Enable MSI in LS7A Root Complex (stable-fixes).\n- RDMA/cache: Release GID table even if leak is detected (git-fixes)\n- RDMA/device: Return error earlier if port in not valid (git-fixes)\n- RDMA/hns: Check atomic wr length (git-fixes)\n- RDMA/hns: Fix insufficient extend DB for VFs. (git-fixes)\n- RDMA/hns: Fix mbx timing out before CMD execution is completed (git-fixes)\n- RDMA/hns: Fix missing pagesize and alignment check in FRMR (git-fixes)\n- RDMA/hns: Fix shift-out-bounds when max_inline_data is 0 (git-fixes)\n- RDMA/hns: Fix soft lockup under heavy CEQE load (git-fixes)\n- RDMA/hns: Fix undifined behavior caused by invalid max_sge (git-fixes)\n- RDMA/hns: Fix unmatch exception handling when init eq table fails (git-fixes)\n- RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (git-fixes)\n- RDMA/mana_ib: Use virtual address in dma regions for MRs (git-fixes).\n- RDMA/mlx4: Fix truncated output warning in alias_GUID.c (git-fixes)\n- RDMA/mlx4: Fix truncated output warning in mad.c (git-fixes)\n- RDMA/mlx5: Set mkeys for dmabuf at PAGE_SIZE (git-fixes)\n- RDMA/rxe: Do not set BTH_ACK_MASK for UC or UD QPs (git-fixes)\n- RDMA: Fix netdev tracker in ib_device_set_netdev (git-fixes)\n- README.BRANCH: Add Petr Tesarik as branch maintainer\n- Revert \"ALSA: firewire-lib: obsolete workqueue for period update\" (bsc#1208783).\n- Revert \"ALSA: firewire-lib: operate for period elapse event in process context\" (bsc#1208783).\n- Revert \"KVM: Prevent module exit until all VMs are freed\" (git-fixes).\n- Revert \"Revert \"md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d\"\" (git-fixes).\n- Revert \"md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d\" (git-fixes).\n- Revert \"misc: fastrpc: Restrict untrusted app to attach to privileged PD\" (git-fixes).\n- Revert \"usb: gadget: uvc: cleanup request when not in correct state\" (stable-fixes).\n- Revert \"usb: typec: tcpm: clear pd_event queue in PORT_RESET\" (git-fixes).\n- SUNRPC: Fix a race to wake a sync task (git-fixes).\n- SUNRPC: add a missing rpc_stat for TCP TLS (git-fixes).\n- Squashfs: fix variable overflow triggered by sysbot (git-fixes).\n- USB: serial: debug: do not echo input by default (stable-fixes).\n- Update config files. Disable vdpa drivers for Alibaba ENI and SolidNET (jsc#PED-8954, bsc#1227834)\n- Update config files. Disable CONFIG_KFENCE on ppc64le (bsc#1226920)\n- Update patch refefernce for MFD patch (jsc#PED-10029)\n- Update patch reference for MD patch (jsc#PED-10029 jsc#PED-10045)\n- Update patch reference for SPI patch (jsc#PED-10105)\n- Update patch reference for iwlwifi fix (jsc#PED-10055)\n- Update patch reference of USB patch (jsc#PED-10108)\n- Update patch references for ASoC regression fixes (bsc#1229045 bsc#1229046)\n- afs: fix __afs_break_callback() / afs_drop_open_mmap() race (git-fixes).\n- apparmor: unpack transition table if dfa is not present (bsc#1226031).\n- arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to (git-fixes)\n- arm64: Add Neoverse-V2 part (git-fixes)\n- arm64: Fix KASAN random tag seed initialization (git-fixes)\n- arm64: armv8_deprecated: Fix warning in isndep cpuhp starting process (git-fixes)\n- arm64: barrier: Restore spec_bar() macro (git-fixes)\n- arm64: cputype: Add Cortex-A720 definitions (git-fixes)\n- arm64: cputype: Add Cortex-A725 definitions (git-fixes)\n- arm64: cputype: Add Cortex-X1C definitions (git-fixes)\n- arm64: cputype: Add Cortex-X3 definitions (git-fixes)\n- arm64: cputype: Add Cortex-X4 definitions (git-fixes)\n- arm64: cputype: Add Cortex-X925 definitions (git-fixes)\n- arm64: cputype: Add Neoverse-V3 definitions (git-fixes)\n- arm64: dts: imx8mp: Add NPU Node (git-fixes)\n- arm64: dts: imx8mp: Fix pgc vpu locations (git-fixes)\n- arm64: dts: imx8mp: Fix pgc_mlmix location (git-fixes)\n- arm64: dts: imx8mp: add HDMI power-domains (git-fixes)\n- arm64: errata: Expand speculative SSBS workaround (again) (git-fixes)\n- arm64: errata: Expand speculative SSBS workaround (git-fixes)\n- arm64: errata: Unify speculative SSBS errata logic (git-fixes). Update config files.\n- arm64: jump_label: Ensure patched jump_labels are visible to all CPUs (git-fixes)\n- ata: libata-scsi: Do not overwrite valid sense data when CK_COND=1 (stable-fixes).\n- ata: libata-scsi: Honor the D_SENSE bit for CK_COND=1 and no error (stable-fixes).\n- blacklist.conf: Add libata upstream revert entry (bsc#1229054)\n- blacklist.conf: printk/sysctl: breaks kernel without pre-requisite patches (bsc#1229025)\n- bnxt_re: Fix imm_data endianness (git-fixes)\n- bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG (git-fixes)\n- bpf, lpm: Fix check prefixlen before walking trie (git-fixes).\n- bpf/tests: Remove duplicate JSGT tests (git-fixes).\n- bpf: Add crosstask check to __bpf_get_stack (git-fixes).\n- bpf: Detect IP == ksym.end as part of BPF program (git-fixes).\n- bpf: Ensure proper register state printing for cond jumps (git-fixes).\n- bpf: Fix a few selftest failures due to llvm18 change (git-fixes).\n- bpf: Fix a kernel verifier crash in stacksafe() (bsc#1225903).\n- bpf: Fix check_stack_write_fixed_off() to correctly spill imm (git-fixes).\n- bpf: Fix kfunc callback register type handling (git-fixes).\n- bpf: Fix prog_array_map_poke_run map poke update (git-fixes).\n- bpf: Fix unnecessary -EBUSY from htab_lock_bucket (git-fixes).\n- bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly (git-fixes).\n- bpf: Remove unnecessary wait from bpf_map_copy_value() (git-fixes).\n- bpf: Set uattr-\u003ebatch.count as zero before batched update or deletion (git-fixes).\n- bpf: do not infer PTR_TO_CTX for programs with unnamed context type (git-fixes).\n- bpf: enforce precision of R0 on callback return (git-fixes).\n- bpf: extract bpf_ctx_convert_map logic and make it more reusable (git-fixes).\n- bpf: fix control-flow graph checking in privileged mode (git-fixes).\n- bpf: handle bpf_user_pt_regs_t typedef explicitly for PTR_TO_CTX global arg (git-fixes).\n- bpf: hardcode BPF_PROG_PACK_SIZE to 2MB * num_possible_nodes() (git-fixes).\n- bpf: kprobe: remove unused declaring of bpf_kprobe_override (git-fixes).\n- bpf: simplify btf_get_prog_ctx_type() into btf_is_prog_ctx_type() (git-fixes).\n- bpftool: Align output skeleton ELF code (git-fixes).\n- bpftool: Fix -Wcast-qual warning (git-fixes).\n- bpftool: Silence build warning about calloc() (git-fixes).\n- bpftool: mark orphaned programs during prog show (git-fixes).\n- btrfs: add a btrfs_finish_ordered_extent helper (git-fixes).\n- btrfs: add a is_data_bbio helper (git-fixes).\n- btrfs: add an ordered_extent pointer to struct btrfs_bio (git-fixes).\n- btrfs: copy dir permission and time when creating a stub subvolume (bsc#1228321).\n- btrfs: ensure fast fsync waits for ordered extents after a write failure (git-fixes).\n- btrfs: factor out a btrfs_queue_ordered_fn helper (git-fixes).\n- btrfs: factor out a can_finish_ordered_extent helper (git-fixes).\n- btrfs: fix corruption after buffer fault in during direct IO append write (git-fixes).\n- btrfs: fix double inode unlock for direct IO sync writes (git-fixes).\n- btrfs: fix extent map use-after-free when adding pages to compressed bio (git-fixes).\n- btrfs: fix leak of qgroup extent records after transaction abort (git-fixes).\n- btrfs: fix ordered extent split error handling in btrfs_dio_submit_io (git-fixes).\n- btrfs: limit write bios to a single ordered extent (git-fixes).\n- btrfs: make btrfs_finish_ordered_extent() return void (git-fixes).\n- btrfs: merge the two calls to btrfs_add_ordered_extent in run_delalloc_nocow (git-fixes).\n- btrfs: open code btrfs_bio_end_io in btrfs_dio_submit_io (git-fixes).\n- btrfs: open code end_extent_writepage in end_bio_extent_writepage (git-fixes).\n- btrfs: pass a btrfs_inode to btrfs_fdatawrite_range() (git-fixes).\n- btrfs: pass a btrfs_inode to btrfs_wait_ordered_range() (git-fixes).\n- btrfs: pass an ordered_extent to btrfs_reloc_clone_csums (git-fixes).\n- btrfs: pass an ordered_extent to btrfs_submit_compressed_write (git-fixes).\n- btrfs: remove btrfs_add_ordered_extent (git-fixes).\n- btrfs: rename err to ret in btrfs_direct_write() (git-fixes).\n- btrfs: uninline some static inline helpers from tree-log.h (git-fixes).\n- btrfs: use a btrfs_inode in the log context (struct btrfs_log_ctx) (git-fixes).\n- btrfs: use a btrfs_inode local variable at btrfs_sync_file() (git-fixes).\n- btrfs: use bbio-\u003eordered in btrfs_csum_one_bio (git-fixes).\n- btrfs: use btrfs_finish_ordered_extent to complete buffered writes (git-fixes).\n- btrfs: use btrfs_finish_ordered_extent to complete compressed writes (git-fixes).\n- btrfs: use btrfs_finish_ordered_extent to complete direct writes (git-fixes).\n- btrfs: use irq safe locking when running and adding delayed iputs (git-fixes).\n- cachefiles, erofs: Fix NULL deref in when cachefiles is not doing ondemand-mode (bsc#1229245).\n- cachefiles: add missing lock protection when polling (bsc#1229256).\n- cachefiles: add restore command to recover inflight ondemand read requests (bsc#1229244).\n- cachefiles: add spin_lock for cachefiles_ondemand_info (bsc#1229249).\n- cachefiles: cancel all requests for the object that is being dropped (bsc#1229255).\n- cachefiles: defer exposing anon_fd until after copy_to_user() succeeds (bsc#1229251).\n- cachefiles: extract ondemand info field from cachefiles_object (bsc#1229240).\n- cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read() (bsc#1229247).\n- cachefiles: fix slab-use-after-free in cachefiles_ondemand_get_fd() (bsc#1229246).\n- cachefiles: introduce object ondemand state (bsc#1229239).\n- cachefiles: make on-demand read killable (bsc#1229252).\n- cachefiles: narrow the scope of triggering EPOLLIN events in ondemand mode (bsc#1229243).\n- cachefiles: never get a new anonymous fd if ondemand_id is valid (bsc#1229250).\n- cachefiles: propagate errors from vfs_getxattr() to avoid infinite loop (bsc#1229253).\n- cachefiles: remove err_put_fd label in cachefiles_ondemand_daemon_read() (bsc#1229248).\n- cachefiles: resend an open request if the read request's object is closed (bsc#1229241).\n- cachefiles: stop sending new request when dropping object (bsc#1229254).\n- can: mcp251xfd: tef: prepare to workaround broken TEF FIFO tail index erratum (stable-fixes).\n- can: mcp251xfd: tef: update workaround for erratum DS80000789E 6 of mcp2518fd (stable-fixes).\n- ceph: periodically flush the cap releases (bsc#1230056).\n- cgroup/cpuset: Prevent UAF in proc_cpuset_show() (bsc#1228801).\n- cgroup: Add annotation for holding namespace_sem in current_cgns_cgroup_from_root() (bsc#1222254).\n- cgroup: Eliminate the need for cgroup_mutex in proc_cgroup_show() (bsc#1222254).\n- cgroup: Make operations on the cgroup root_list RCU safe (bsc#1222254).\n- cgroup: Remove unnecessary list_empty() (bsc#1222254).\n- cgroup: preserve KABI of cgroup_root (bsc#1222254).\n- char: xillybus: Check USB endpoints when probing device (git-fixes).\n- char: xillybus: Do not destroy workqueue from work item running on it (stable-fixes).\n- char: xillybus: Refine workqueue handling (git-fixes).\n- check-for-config-changes: ignore also GCC_ASM_GOTO_OUTPUT_BROKEN Mainline commit f2f6a8e88717 (\"init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND\") replaced GCC_ASM_GOTO_OUTPUT_WORKAROUND with GCC_ASM_GOTO_OUTPUT_BROKEN. Ignore both when checking config changes.\n- clk: en7523: fix rate divider for slic and spi clocks (git-fixes).\n- clk: qcom: Park shared RCGs upon registration (git-fixes).\n- clk: qcom: camcc-sc7280: Add parent dependency to all camera GDSCs (git-fixes).\n- clk: qcom: gcc-sa8775p: Update the GDSC wait_val fields and flags (git-fixes).\n- clk: qcom: gcc-sc7280: Update force mem core bit for UFS ICE clock (git-fixes).\n- clk: qcom: gpucc-sa8775p: Park RCG's clk source at XO during disable (git-fixes).\n- clk: qcom: gpucc-sa8775p: Remove the CLK_IS_CRITICAL and ALWAYS_ON flags (git-fixes).\n- clk: qcom: gpucc-sa8775p: Update wait_val fields for GPU GDSC's (git-fixes).\n- clk: qcom: gpucc-sm8350: Park RCG's clk source at XO during disable (git-fixes).\n- clk: qcom: kpss-xcc: Return of_clk_add_hw_provider to transfer the error (git-fixes).\n- clk: visconti: Add bounds-checking coverage for struct visconti_pll_provider (stable-fixes).\n- clocksource/drivers/sh_cmt: Address race condition for clock events (stable-fixes).\n- config.sh: generate and install compile_commands.json (bsc#1228971) This file contains the command line options used to compile every C file. It's useful for the livepatching team.\n- cpu/SMT: Enable SMT only if a core is online (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588 git-fixes).\n- cxl/region: Move cxl_dpa_to_region() work to the region driver (bsc#1228472)\n- dev/parport: fix the array out-of-bounds risk (stable-fixes).\n- device property: Add cleanup.h based fwnode_handle_put() scope based cleanup (stable-fixes).\n- dmaengine: dw: Add memory bus width verification (git-fixes).\n- dmaengine: dw: Add peripheral bus width verification (git-fixes).\n- docs: KVM: Fix register ID of SPSR_FIQ (git-fixes).\n- driver core: Fix uevent_show() vs driver detach race (git-fixes).\n- drm/admgpu: fix dereferencing null pointer context (stable-fixes).\n- drm/amd/display: Add delay to improve LTTPR UHBR interop (stable-fixes).\n- drm/amd/display: Add null checker before passing variables (stable-fixes).\n- drm/amd/display: Adjust cursor position (git-fixes).\n- drm/amd/display: Check for NULL pointer (stable-fixes).\n- drm/amd/display: Skip Recompute DSC Params if no Stream on Link (stable-fixes).\n- drm/amd/display: avoid using null object of framebuffer (git-fixes).\n- drm/amd/display: fix cursor offset on rotation 180 (git-fixes).\n- drm/amd/display: fix s2idle entry for DCN3.5+ (stable-fixes).\n- drm/amd/pm: Fix the null pointer dereference for vega10_hwmgr (stable-fixes).\n- drm/amdgpu/jpeg2: properly set atomics vmid field (stable-fixes).\n- drm/amdgpu/jpeg4: properly set atomics vmid field (stable-fixes).\n- drm/amdgpu/pm: Fix the null pointer dereference for smu7 (stable-fixes).\n- drm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rules (stable-fixes).\n- drm/amdgpu/pm: Fix the param type of set_power_profile_mode (stable-fixes).\n- drm/amdgpu/sdma5.2: Update wptr registers as well as doorbell (stable-fixes).\n- drm/amdgpu/sdma5.2: limit wptr workaround to sdma 5.2.1 (git-fixes).\n- drm/amdgpu: Actually check flags for all context ops (stable-fixes).\n- drm/amdgpu: Add lock around VF RLCG interface (stable-fixes).\n- drm/amdgpu: Fix the null pointer dereference to ras_manager (stable-fixes).\n- drm/amdgpu: Forward soft recovery errors to userspace (stable-fixes).\n- drm/amdgpu: Validate TA binary size (stable-fixes).\n- drm/amdgpu: fix dereference null return value for the function amdgpu_vm_pt_parent (stable-fixes).\n- drm/amdgpu: fix potential resource leak warning (stable-fixes).\n- drm/amdgpu: reset vm state machine after gpu reset(vram lost) (stable-fixes).\n- drm/bridge: analogix_dp: properly handle zero sized AUX transactions (stable-fixes).\n- drm/client: fix null pointer dereference in drm_client_modeset_probe (git-fixes).\n- drm/dp_mst: Skip CSN if topology probing is not done yet (stable-fixes).\n- drm/etnaviv: do not block scheduler when GPU is still active (stable-fixes).\n- drm/i915/dsi: Make Lenovo Yoga Tab 3 X90F DMI match less strict (git-fixes).\n- drm/i915/gem: Adjust vma offset for framebuffer mmap offset (stable-fixes).\n- drm/i915/gem: Fix Virtual Memory mapping boundaries calculation (git-fixes).\n- drm/i915/hdcp: Fix HDCP2_STREAM_STATUS macro (git-fixes).\n- drm/i915: Fix possible int overflow in skl_ddi_calculate_wrpll() (git-fixes).\n- drm/lima: set gp bus_stop bit before hard reset (stable-fixes).\n- drm/mediatek/dp: Fix spurious kfree() (git-fixes).\n- drm/msm/dp: fix the max supported bpp logic (git-fixes).\n- drm/msm/dp: reset the link phy params before link training (git-fixes).\n- drm/msm/dpu: capture snapshot on the first commit_done timeout (stable-fixes).\n- drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails (git-fixes).\n- drm/msm/dpu: do not play tricks with debug macros (git-fixes).\n- drm/msm/dpu: drop MSM_ENC_VBLANK support (stable-fixes).\n- drm/msm/dpu: move dpu_encoder's connector assignment to atomic_enable() (git-fixes).\n- drm/msm/dpu: split dpu_encoder_wait_for_event into two functions (stable-fixes).\n- drm/msm/dpu: take plane rotation into account for wide planes (git-fixes).\n- drm/msm/dpu: try multirect based on mdp clock limits (stable-fixes).\n- drm/msm/dpu: use drmm-managed allocation for dpu_encoder_phys (stable-fixes).\n- drm/msm/mdss: Rename path references to mdp_path (stable-fixes).\n- drm/msm/mdss: switch mdss to use devm_of_icc_get() (stable-fixes).\n- drm/msm: Reduce fallout of fence signaling vs reclaim hangs (stable-fixes).\n- drm/nouveau: prime: fix refcount underflow (git-fixes).\n- drm/panel: nt36523: Set 120Hz fps for xiaomi,elish panels (stable-fixes).\n- drm/radeon/evergreen_cs: Clean up errors in evergreen_cs.c (bsc#1229024).\n- drm/radeon: Remove __counted_by from StateArray.states[] (git-fixes).\n- drm/rockchip: vop2: clear afbc en and transform bit for cluster window at linear mode (stable-fixes).\n- drm/virtio: Fix type of dma-fence context variable (git-fixes).\n- drm/vmwgfx: Fix a deadlock in dma buf fence polling (git-fixes).\n- drm/vmwgfx: Fix overlay when using Screen Targets (git-fixes).\n- drm/vmwgfx: Fix prime with external buffers (git-fixes).\n- efi/libstub: Zero initialize heap allocated struct screen_info (git-fixes).\n- evm: do not copy up 'security.evm' xattr (git-fixes).\n- firmware: cirrus: cs_dsp: Initialize debugfs_root to invalid (stable-fixes).\n- fs/netfs/fscache_cookie: add missing \"n_accesses\" check (bsc#1229455).\n- fuse: Initialize beyond-EOF page contents before setting uptodate (bsc#1229456).\n- genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline (git-fixes).\n- genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware (git-fixes).\n- genirq/matrix: Exclude managed interrupts in irq_matrix_allocated() (git-fixes).\n- gfs2: setattr_chown: Add missing initialization (git-fixes).\n- gpio: mlxbf3: Support shutdown() function (git-fixes).\n- gpio: prevent potential speculation leaks in gpio_device_get_desc() (stable-fixes).\n- gpio: sysfs: extend the critical section for unregistering sysfs devices (stable-fixes).\n- gss_krb5: Fix the error handling path for crypto_sync_skcipher_setkey (git-fixes).\n- hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode() (git-fixes).\n- hwmon: (ltc2992) Avoid division by zero (stable-fixes).\n- hwmon: (ltc2992) Fix memory leak in ltc2992_parse_dt() (git-fixes).\n- hwmon: (pc87360) Bounds check data-\u003einnr usage (stable-fixes).\n- i2c: Fix conditional for substituting empty ACPI functions (stable-fixes).\n- i2c: Use IS_REACHABLE() for substituting empty ACPI functions (git-fixes).\n- i2c: qcom-geni: Add missing clk_disable_unprepare in geni_i2c_runtime_resume (git-fixes).\n- i2c: qcom-geni: Add missing geni_icc_disable in geni_i2c_runtime_resume (git-fixes).\n- i2c: qcom-geni: Add missing geni_icc_disable in geni_i2c_runtime_resume (git-fixes).\n- i2c: riic: avoid potential division by zero (stable-fixes).\n- i2c: smbus: Improve handling of stuck alerts (git-fixes).\n- i2c: smbus: Send alert notifications to all devices if source not found (git-fixes).\n- i2c: stm32f7: Add atomic_xfer method to driver (stable-fixes).\n- i3c: mipi-i3c-hci: Do not unmap region not mapped for transfer (stable-fixes).\n- i3c: mipi-i3c-hci: Remove BUG() when Ring Abort request times out (stable-fixes).\n- i915/perf: Remove code to update PWR_CLK_STATE for gen12 (git-fixes).\n- ice: Fix NULL pointer access, if PF does not support SRIOV_LAG (bsc#1228737).\n- io_uring/advise: support 64-bit lengths (git-fixes).\n- io_uring: Drop per-ctx dummy_ubuf (git-fixes).\n- io_uring: Fix probe of disabled operations (git-fixes).\n- io_uring: fix io_match_task must_hold (git-fixes).\n- io_uring: tighten task exit cancellations (git-fixes).\n- iommu/amd: Convert comma to semicolon (git-fixes).\n- iommu/vt-d: Fix identity map bounds in si_domain_init() (git-fixes).\n- iommufd/device: Fix hwpt at err_unresv in iommufd_device_do_replace() (git-fixes).\n- ip6_tunnel: Fix broken GRO (bsc#1229444).\n- ipv6: sr: fix incorrect unregister order (git-fixes).\n- irqdomain: Fixed unbalanced fwnode get and put (git-fixes).\n- jfs: Fix shift-out-of-bounds in dbDiscardAG (git-fixes).\n- jfs: define xtree root and page independently (git-fixes).\n- jfs: fix null ptr deref in dtInsertEntry (git-fixes).\n- jump_label: Clarify condition in static_key_fast_inc_not_disabled() (git-fixes).\n- jump_label: Fix concurrency issues in static_key_slow_dec() (git-fixes).\n- jump_label: Fix the fix, brown paper bags galore (git-fixes).\n- jump_label: Simplify and clarify static_key_fast_inc_cpus_locked() (git-fixes).\n- kABI fix of: virtio-crypto: handle config changed by work queue (git-fixes).\n- kABI workaround for sound core UMP conversion (stable-fixes).\n- kabi fix for KVM: s390: fix LPSWEY handling (bsc#1227634 git-fixes).\n- kabi fix for SUNRPC: add a missing rpc_stat for TCP TLS (git-fixes).\n- kabi/severities: ignore kABI for FireWire sound local symbols (bsc#1208783)\n- kabi/severity: add nvme common code The nvme common code is also allowed to change the data structures, there are only internal users.\n- kcov: properly check for softirq context (git-fixes).\n- kernel-binary: generate and install compile_commands.json (bsc#1228971)\n- kernfs: Convert kernfs_path_from_node_locked() from strlcpy() to strscpy() (bsc#1229134).\n- kernfs: fix false-positive WARN(nr_mmapped) in kernfs_drain_open_files (git-fixes).\n- kprobes: Fix to check symbol prefixes correctly (git-fixes).\n- kprobes: Prohibit probing on CFI preamble symbol (git-fixes).\n- kvm: s390: Reject memory region operations for ucontrol VMs (git-fixes bsc#1229168).\n- libbpf: Add missing LIBBPF_API annotation to libbpf_set_memlock_rlim API (git-fixes).\n- libbpf: Apply map_set_def_max_entries() for inner_maps on creation (git-fixes).\n- libbpf: Fix faccessat() usage on Android (git-fixes).\n- libbpf: Use OPTS_SET() macro in bpf_xdp_query() (git-fixes).\n- md-cluster: fix hanging issue while a new disk adding (bsc#1223395).\n- md-cluster: fix hanging issue while a new disk adding (bsc#1223395).\n- md-cluster: fix no recovery job when adding/re-adding a disk (bsc#1223395).\n- md-cluster: fix no recovery job when adding/re-adding a disk (bsc#1223395).\n- md-cluster: keeping kabi compatibility for upstream commit 35a0a409fa26 (bsc#1223395).\n- md/md-bitmap: fix writing non bitmap pages (git-fixes).\n- md/raid1: set max_sectors during early return from choose_slow_rdev() (git-fixes).\n- md/raid1: support read error check (git-fixes).\n- md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (git-fixes).\n- md/raid5: fix spares errors about rcu usage (git-fixes).\n- md/raid5: recheck if reshape has finished with device_lock held (git-fixes).\n- md: Do not wait for MD_RECOVERY_NEEDED for HOT_REMOVE_DISK ioctl (git-fixes).\n- md: add a mddev_add_trace_msg helper (git-fixes).\n- md: add check for sleepers in md_wakeup_thread() (git-fixes).\n- md: change the return value type of md_write_start to void (git-fixes).\n- md: do not account sync_io if iostats of the disk is disabled (git-fixes).\n- md: do not delete safemode_timer in mddev_suspend (git-fixes).\n- md: factor out a helper exceed_read_errors() to check read_errors (git-fixes).\n- md: fix a suspicious RCU usage warning (git-fixes).\n- media: Revert \"media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()\" (git-fixes).\n- media: amphion: Remove lock in s_ctrl callback (stable-fixes).\n- media: drivers/media/dvb-core: copy user arrays safely (stable-fixes).\n- media: pci: cx23885: check cx23885_vdev_init() return (stable-fixes).\n- media: uvcvideo: Add quirk for invalid dev_sof in Logitech C920 (git-fixes).\n- media: uvcvideo: Disable autosuspend for Insta360 Link (stable-fixes).\n- media: uvcvideo: Fix the bandwdith quirk on USB 3.x (stable-fixes).\n- media: uvcvideo: Ignore empty TS packets (stable-fixes).\n- media: uvcvideo: Quirk for invalid dev_sof in Logitech C922 (stable-fixes).\n- media: xc2028: avoid use-after-free in load_firmware_cb() (stable-fixes).\n- memcg: protect concurrent access to mem_cgroup_idr (git-fixes).\n- memory: stm32-fmc2-ebi: check regmap_read return value (stable-fixes).\n- memory: tegra: Skip SID programming if SID registers are not set (stable-fixes).\n- minmax: add a few more MIN_T/MAX_T users (bsc#1229024).\n- minmax: avoid overly complicated constant expressions in VM code (bsc#1229024).\n- minmax: do not use max() in situations that want a C constant expression (bsc#1229024).\n- minmax: fix up min3() and max3() too (bsc#1229024).\n- minmax: improve macro expansion and type checking (bsc#1229024).\n- minmax: make generic MIN() and MAX() macros available everywhere (bsc#1229024).\n- minmax: simplify and clarify min_t()/max_t() implementation (bsc#1229024).\n- minmax: simplify min()/max()/clamp() implementation (bsc#1229024).\n- mm, kmsan: fix infinite recursion due to RCU critical section (git-fixes).\n- mm: prevent derefencing NULL ptr in pfn_section_valid() (git-fixes).\n- mmc: dw_mmc: allow biu and ciu clocks to defer (git-fixes).\n- mmc: mmc_test: Fix NULL dereference on allocation failure (git-fixes).\n- mmc: mtk-sd: receive cmd8 data when hs400 tuning fail (git-fixes).\n- net/iucv: fix the allocation size of iucv_path_table array (git-fixes bsc#1229451).\n- net/iucv: fix use after free in iucv_sock_close() (bsc#1228973).\n- net/rds: fix possible cp null dereference (git-fixes).\n- net/sched: initialize noop_qdisc owner (git-fixes).\n- net: drop bad gso csum_start and offset in virtio_net_hdr (git-fixes).\n- net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb() (git-fixes).\n- net: fix sk_memory_allocated_{add|sub} vs softirqs (bsc#1228757).\n- net: mana: Add support for page sizes other than 4KB on ARM64 (jsc#PED-8491 bsc#1226530).\n- net: mana: Fix RX buf alloc_size alignment and atomic op panic (bsc#1229086).\n- net: mana: Fix doorbell out of order violation and avoid unnecessary doorbell rings (bsc#1229154).\n- net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response (git-fixes).\n- net: missing check virtio (git-fixes).\n- net: phy: micrel: Fix the KSZ9131 MDI-X status issue (git-fixes).\n- net: phy: realtek: add support for RTL8366S Gigabit PHY (git-fixes).\n- net: usb: qmi_wwan: fix memory leak for not ip packets (git-fixes).\n- net: usb: sr9700: fix uninitialized variable use in sr_mdio_read (git-fixes).\n- netfs, fscache: export fscache_put_volume() and add fscache_try_get_volume() (bsc#1228459 bsc#1228462).\n- nfc: pn533: Add poll mod list filling check (git-fixes).\n- nfs: do not invalidate dentries on transient errors (git-fixes).\n- nfs: expose /proc/net/sunrpc/nfs in net namespaces (git-fixes).\n- nfs: make the rpc_stat per net namespace (git-fixes).\n- nfs: pass explicit offset/count to trace events (git-fixes).\n- nfs: propagate readlink errors in nfs_symlink_filler (git-fixes).\n- nouveau/firmware: use dma non-coherent allocator (git-fixes).\n- nvme-multipath: find NUMA path only for online numa-node (git-fixes).\n- nvme-multipath: implement \"queue-depth\" iopolicy (bsc#1227706).\n- nvme-multipath: prepare for \"queue-depth\" iopolicy (bsc#1227706).\n- nvme-pci: Fix the instructions for disabling power management (git-fixes).\n- nvme-pci: add missing condition check for existence of mapped data (git-fixes).\n- nvme-pci: do not directly handle subsys reset fallout (bsc#1220066).\n- nvme-sysfs: add 'tls_configured_key' sysfs attribute (bsc#1221857).\n- nvme-sysfs: add 'tls_keyring' attribute (bsc#1221857).\n- nvme-tcp: check for invalidated or revoked key (bsc#1221857).\n- nvme-tcp: sanitize TLS key handling (bsc#1221857).\n- nvme: add a newline to the 'tls_key' sysfs attribute (bsc#1221857).\n- nvme: adjust multiples of NVME_CTRL_PAGE_SIZE in offset (git-fixes).\n- nvme: avoid double free special payload (git-fixes).\n- nvme: fix NVME_NS_DEAC may incorrectly identifying the disk as EXT_LBA (git-fixes).\n- nvme: fixup comment for nvme RDMA Provider Type (git-fixes).\n- nvme: split off TLS sysfs attributes into a separate group (bsc#1221857).\n- nvme: tcp: remove unnecessary goto statement (bsc#1221857).\n- nvme_core: scan namespaces asynchronously (bsc#1224105).\n- nvmet-auth: fix nvmet_auth hash error handling (git-fixes).\n- nvmet: always initialize cqe.result (git-fixes).\n- nvmet: do not return 'reserved' for empty TSAS values (git-fixes).\n- nvmet: fix a possible leak when destroy a ctrl during qp establishment (git-fixes).\n- nvmet: make 'tsas' attribute idempotent for RDMA (git-fixes).\n- ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry() (bsc#1228410).\n- padata: Fix possible divide-by-0 panic in padata_mt_helper() (git-fixes).\n- perf/smmuv3: Enable HiSilicon Erratum 162001900 quirk for HIP08/09 (git-fixes).\n- pinctrl: mediatek: common-v2: Fix broken bias-disable for PULL_PU_PD_RSEL_TYPE (git-fixes).\n- pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B pins (git-fixes).\n- pinctrl: single: fix potential NULL dereference in pcs_get_function() (git-fixes).\n- pinctrl: starfive: jh7110: Correct the level trigger configuration of iev register (git-fixes).\n- platform/chrome: cros_ec_proto: Lock device when updating MKBP version (git-fixes).\n- platform/chrome: cros_ec_proto: Lock device when updating MKBP version (git-fixes).\n- platform/surface: aggregator: Fix warning when controller is destroyed in probe (git-fixes).\n- platform/x86/amd/hsmp: Add support for ACPI based probing (jsc#PED-8779).\n- platform/x86/amd/hsmp: Cache pci_dev in struct hsmp_socket (jsc#PED-8779).\n- platform/x86/amd/hsmp: Change devm_kzalloc() to devm_kcalloc() (jsc#PED-8779).\n- platform/x86/amd/hsmp: Check HSMP support on AMD family of processors (jsc#PED-8779).\n- platform/x86/amd/hsmp: Check num_sockets against MAX_AMD_SOCKETS (jsc#PED-8779).\n- platform/x86/amd/hsmp: Create static func to handle platdev (jsc#PED-8779).\n- platform/x86/amd/hsmp: Define a struct to hold mailbox regs (jsc#PED-8779).\n- platform/x86/amd/hsmp: Move dev from platdev to hsmp_socket (jsc#PED-8779).\n- platform/x86/amd/hsmp: Move hsmp_test to probe (jsc#PED-8779).\n- platform/x86/amd/hsmp: Non-ACPI support for AMD F1A_M00~0Fh (jsc#PED-8779).\n- platform/x86/amd/hsmp: Remove extra parenthesis and add a space (jsc#PED-8779).\n- platform/x86/amd/hsmp: Restructure sysfs group creation (jsc#PED-8779).\n- platform/x86/amd/hsmp: switch to use device_add_groups() (jsc#PED-8779).\n- platform/x86/intel/ifs: Initialize union ifs_status to zero (git-fixes).\n- platform/x86: lg-laptop: fix %s null argument warning (stable-fixes).\n- power: supply: axp288_charger: Fix constant_charge_voltage writes (git-fixes).\n- power: supply: axp288_charger: Round constant_charge_voltage writes down (git-fixes).\n- power: supply: qcom_battmgr: return EAGAIN when firmware service is not up (git-fixes).\n- powerpc/64: Set _IO_BASE to POISON_POINTER_DELTA not 0 for CONFIG_PCI=n (bsc#1194869).\n- powerpc/io: Avoid clang null pointer arithmetic warnings (bsc#1194869).\n- powerpc/kexec: make the update_cpus_node() function public (bsc#1194869).\n- powerpc/kexec: split CONFIG_KEXEC_FILE and CONFIG_CRASH_DUMP (bsc#1194869).\n- powerpc/kexec_file: fix cpus node update to FDT (bsc#1194869).\n- powerpc/pseries: Add failure related checks for h_get_mpp and h_get_ppp (bsc#1194869).\n- powerpc/pseries: Whitelist dtl slub object for copying to userspace (bsc#1194869).\n- powerpc/radix: Move some functions into #ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE (bsc#1194869).\n- powerpc/topology: Check if a core is online (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588 git-fixes).\n- powerpc/xmon: Check cpu id in commands \"c#\", \"dp#\" and \"dx#\" (bsc#1194869).\n- powerpc: fix a file leak in kvm_vcpu_ioctl_enable_cap() (bsc#1194869).\n- powerpc: xor_vmx: Add '-mhard-float' to CFLAGS (bsc#1194869).\n- printk/panic: Allow cpu backtraces to be written into ringbuffer during panic (bsc#1225607).\n- reiserfs: fix uninit-value in comp_keys (git-fixes).\n- rtc: nct3018y: fix possible NULL dereference (stable-fixes).\n- s390/cpum_cf: Fix endless loop in CF_DIAG event stop (git-fixes bsc#1229171).\n- s390/dasd: fix error checks in dasd_copy_pair_store() (git-fixes bsc#1229173).\n- s390/dasd: fix error recovery leading to data corruption on ESE devices (git-fixes bsc#1229452).\n- s390/pci: Add missing virt_to_phys() for directed DIBV (git-fixes bsc#1229174).\n- s390/pci: Allow allocation of more than 1 MSI interrupt (git-fixes bsc#1229172).\n- s390/pci: Refactor arch_setup_msi_irqs() (git-fixes bsc#1229172).\n- s390/pkey: harmonize pkey s390 debug feature calls (bsc#1228720).\n- s390/pkey: introduce dynamic debugging for pkey (bsc#1228720).\n- s390/sclp: Prevent release of buffer in I/O (git-fixes bsc#1229169).\n- s390/uv: Panic for set and remove shared access UVC errors (git-fixes bsc#1229170).\n- samples/bpf: syscall_tp_user: Fix array out-of-bound access (git-fixes).\n- samples/bpf: syscall_tp_user: Rename num_progs into nr_tests (git-fixes).\n- sbitmap: use READ_ONCE to access map-\u003eword (stable-fixes).\n- scsi: lpfc: Allow DEVICE_RECOVERY mode after RSCN receipt if in PRLI_ISSUE state (bsc#1228857).\n- scsi: lpfc: Cancel ELS WQE instead of issuing abort when SLI port is inactive (bsc#1228857).\n- scsi: lpfc: Fix handling of fully recovered fabric node in dev_loss callbk (bsc#1228857).\n- scsi: lpfc: Fix incorrect request len mbox field when setting trunking via sysfs (bsc#1228857).\n- scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (bsc#1228857).\n- scsi: lpfc: Relax PRLI issue conditions after GID_FT response (bsc#1228857).\n- scsi: lpfc: Revise lpfc_prep_embed_io routine with proper endian macro usages (bsc#1228857).\n- scsi: lpfc: Update lpfc version to 14.4.0.3 (bsc#1228857).\n- scsi: qla2xxx: Avoid possible run-time warning with long model_num (bsc#1228850).\n- scsi: qla2xxx: Complete command early within lock (bsc#1228850).\n- scsi: qla2xxx: Convert comma to semicolon (bsc#1228850).\n- scsi: qla2xxx: Drop driver owner assignment (bsc#1228850).\n- scsi: qla2xxx: During vport delete send async logout explicitly (bsc#1228850).\n- scsi: qla2xxx: Fix debugfs output for fw_resource_count (bsc#1228850).\n- scsi: qla2xxx: Fix flash read failure (bsc#1228850).\n- scsi: qla2xxx: Fix for possible memory corruption (bsc#1228850).\n- scsi: qla2xxx: Fix optrom version displayed in FDMI (bsc#1228850).\n- scsi: qla2xxx: Indent help text (bsc#1228850).\n- scsi: qla2xxx: Reduce fabric scan duplicate code (bsc#1228850).\n- scsi: qla2xxx: Remove unused struct 'scsi_dif_tuple' (bsc#1228850).\n- scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for ELS cmds (bsc#1228850).\n- scsi: qla2xxx: Unable to act on RSCN for port online (bsc#1228850).\n- scsi: qla2xxx: Update version to 10.02.09.300-k (bsc#1228850).\n- scsi: qla2xxx: Use QP lock to search for bsg (bsc#1228850).\n- scsi: qla2xxx: validate nvme_local_port correctly (bsc#1228850).\n- selftest/bpf: Add map_in_maps with BPF_MAP_TYPE_PERF_EVENT_ARRAY values (git-fixes).\n- selftests/bpf: Add a test to verify previous stacksafe() fix (bsc#1225903).\n- selftests/bpf: Add assert for user stacks in test_task_stack (git-fixes).\n- selftests/bpf: Add netkit to tc_redirect selftest (git-fixes).\n- selftests/bpf: De-veth-ize the tc_redirect test case (git-fixes).\n- selftests/bpf: Disable IPv6 for lwt_redirect test (git-fixes).\n- selftests/bpf: Fix erroneous bitmask operation (git-fixes).\n- selftests/bpf: Fix issues in setup_classid_environment() (git-fixes).\n- selftests/bpf: Fix potential premature unload in bpf_testmod (git-fixes).\n- selftests/bpf: Fix pyperf180 compilation failure with clang18 (git-fixes).\n- selftests/bpf: Fix the flaky tc_redirect_dtime test (git-fixes).\n- selftests/bpf: Fix up xdp bonding test wrt feature flags (git-fixes).\n- selftests/bpf: Make linked_list failure test more robust (git-fixes).\n- selftests/bpf: Relax time_tai test for equal timestamps in tai_forward (git-fixes).\n- selftests/bpf: Skip module_fentry_shadow test when bpf_testmod is not available (git-fixes).\n- selftests/bpf: Wait for the netstamp_needed_key static key to be turned on (git-fixes).\n- selftests/bpf: fix RELEASE=1 build for tc_opts (git-fixes).\n- selftests/bpf: fix bpf_loop_bench for new callback verification scheme (git-fixes).\n- selftests/bpf: fix compiler warnings in RELEASE=1 mode (git-fixes).\n- selftests/bpf: satisfy compiler by having explicit return in btf test (git-fixes).\n- serial: core: check uartclk for zero to avoid divide by zero (stable-fixes).\n- soc: qcom: cmd-db: Map shared memory as WC, not WB (git-fixes).\n- soc: qcom: pmic_glink: Actually communicate when remote goes down (git-fixes).\n- soundwire: stream: fix programming slave ports for non-continous port maps (git-fixes).\n- spi: Add empty versions of ACPI functions (stable-fixes).\n- spi: microchip-core: fix init function not setting the master and motorola modes (git-fixes).\n- spi: microchip-core: switch to use modern name (stable-fixes).\n- spi: spi-fsl-lpspi: Fix scldiv calculation (git-fixes).\n- spi: spidev: Add missing spi_device_id for bh2228fv (git-fixes).\n- squashfs: squashfs_read_data need to check if the length is 0 (git-fixes).\n- ssb: Fix division by zero issue in ssb_calc_clock_rate (stable-fixes).\n- staging: iio: resolver: ad2s1210: fix use before initialization (stable-fixes).\n- staging: ks7010: disable bh on tx_dev_lock (stable-fixes).\n- string.h: Introduce memtostr() and memtostr_pad() (bsc#1228849).\n- sunrpc: add a struct rpc_stats arg to rpc_create_args (git-fixes).\n- swiotlb: do not set total_used to 0 in swiotlb_create_debugfs_files() (git-fixes).\n- swiotlb: fix swiotlb_bounce() to do partial sync's correctly (git-fixes).\n- syscalls: fix compat_sys_io_pgetevents_time64 usage (git-fixes).\n- thermal/drivers/broadcom: Fix race between removal and clock disable (git-fixes).\n- thermal: bcm2835: Convert to platform remove callback returning void (stable-fixes).\n- thunderbolt: Mark XDomain as unplugged when router is removed (stable-fixes).\n- tools/perf: Fix perf bench epoll to enable the run when some CPU's are offline (bsc#1227747).\n- tools/perf: Fix perf bench futex to enable the run when some CPU's are offline (bsc#1227747).\n- tools/perf: Fix timing issue with parallel threads in perf bench wake-up-parallel (bsc#1227747).\n- tools/resolve_btfids: Fix comparison of distinct pointer types warning in resolve_btfids (git-fixes).\n- tools/resolve_btfids: Fix cross-compilation to non-host endianness (git-fixes).\n- tools/resolve_btfids: Refactor set sorting with types from btf_ids.h (git-fixes).\n- tools/resolve_btfids: fix build with musl libc (git-fixes).\n- trace/pid_list: Change gfp flags in pid_list_fill_irq() (git-fixes).\n- tracing: Return from tracing_buffers_read() if the file has been closed (bsc#1229136 git-fixes).\n- tty: atmel_serial: use the correct RTS flag (git-fixes).\n- tty: serial: fsl_lpuart: mark last busy before uart_add_one_port (git-fixes).\n- usb: cdnsp: fix for Link TRB with TC (git-fixes).\n- usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function (git-fixes).\n- usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes() (git-fixes).\n- usb: dwc3: core: Skip setting event buffers for host only controllers (stable-fixes).\n- usb: dwc3: omap: add missing depopulate in probe error path (git-fixes).\n- usb: dwc3: st: add missing depopulate in probe error path (git-fixes).\n- usb: dwc3: st: fix probed platform device ref count on probe error path (git-fixes).\n- usb: gadget: core: Check for unset descriptor (git-fixes).\n- usb: gadget: fsl: Increase size of name buffer for endpoints (stable-fixes).\n- usb: gadget: u_audio: Check return codes from usb_ep_enable and config_ep_by_speed (git-fixes).\n- usb: gadget: u_serial: Set start_delayed during suspend (git-fixes).\n- usb: gadget: uvc: cleanup request when not in correct state (stable-fixes).\n- usb: typec: fsa4480: Add support to swap SBU orientation (git-fixes).\n- usb: typec: fsa4480: Check if the chip is really there (git-fixes).\n- usb: typec: fsa4480: Relax CHIP_ID check (git-fixes).\n- usb: typec: fsa4480: add support for Audio Accessory Mode (git-fixes).\n- usb: typec: fsa4480: rework mux \u0026 switch setup to handle more states (git-fixes).\n- usb: vhci-hcd: Do not drop references before new references are gained (stable-fixes).\n- vfio/pci: fix potential memory leak in vfio_intx_enable() (git-fixes).\n- vhost-scsi: Handle vhost_vq_work_queue failures for events (git-fixes).\n- vhost-vdpa: switch to use vmf_insert_pfn() in the fault handler (git-fixes).\n- vhost/vsock: always initialize seqpacket_allow (git-fixes).\n- vhost: Release worker mutex during flushes (git-fixes).\n- vhost: Use virtqueue mutex for swapping worker (git-fixes).\n- virt: guest_memfd: fix reference leak on hwpoisoned page (git-fixes).\n- virtio-crypto: handle config changed by work queue (git-fixes).\n- virtio: reenable config if freezing device failed (git-fixes).\n- virtio_net: use u64_stats_t infra to avoid data-races (git-fixes).\n- virtiofs: forbid newlines in tags (bsc#1229940).\n- wifi: ath12k: fix memory leak in ath12k_dp_rx_peer_frag_setup() (stable-fixes).\n- wifi: ath12k: fix soft lockup on suspend (git-fixes).\n- wifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion (git-fixes).\n- wifi: cfg80211: fix reporting failed MLO links status with cfg80211_connect_done (git-fixes).\n- wifi: iwlwifi: fw: fix wgds rev 3 exact size (git-fixes).\n- wifi: mac80211: use monitor sdata with driver only if desired (git-fixes).\n- wifi: mwifiex: duplicate static structs used in driver instances (git-fixes).\n- wifi: nl80211: disallow setting special AP channel widths (stable-fixes).\n- wifi: nl80211: do not give key data to userspace (stable-fixes).\n- wifi: rtw88: usb: Fix disconnection after beacon loss (stable-fixes).\n- wifi: wfx: repair open network AP mode (git-fixes).\n- workqueue: Improve scalability of workqueue watchdog touch (bsc#1193454).\n- workqueue: wq_watchdog_touch is always called with valid CPU (bsc#1193454).\n- x86/asm: Use %c/%n instead of %P operand modifier in asm templates (git-fixes).\n- x86/entry/64: Remove obsolete comment on tracing vs. SYSRET (git-fixes).\n- x86/mm: Fix pti_clone_entry_text() for i386 (git-fixes).\n- x86/mm: Fix pti_clone_pgtable() alignment assumption (git-fixes).\n- x86/mtrr: Check if fixed MTRRs exist before saving them (git-fixes).\n- x86/numa: Fix SRAT lookup of CFMWS ranges with numa_fill_memblks() (git-fixes).\n- x86/numa: Fix the address overlap check in numa_fill_memblks() (git-fixes).\n- x86/numa: Fix the sort compare func used in numa_fill_memblks() (git-fixes).\n- x86/numa: Introduce numa_fill_memblks() (git-fixes).\n- x86/pci: Skip early E820 check for ECAM region (git-fixes).\n- x86/xen: Convert comma to semicolon (git-fixes).\n- xfs: Fix missing interval for missing_owner in xfs fsmap (git-fixes).\n- xfs: Fix the owner setting issue for rmap query in xfs fsmap (git-fixes).\n- xfs: allow cross-linking special files without project quota (git-fixes).\n- xfs: allow symlinks with short remote targets (bsc#1229160).\n- xfs: allow unlinked symlinks and dirs with zero size (git-fixes).\n- xfs: attr forks require attr, not attr2 (git-fixes).\n- xfs: convert comma to semicolon (git-fixes).\n- xfs: do not use current-\u003ejournal_info (git-fixes).\n- xfs: fix unlink vs cluster buffer instantiation race (git-fixes).\n- xfs: honor init_xattrs in xfs_init_new_inode for !ATTR fs (git-fixes).\n- xfs: journal geometry is not properly bounds checked (git-fixes).\n- xfs: match lock mode in xfs_buffered_write_iomap_begin() (git-fixes).\n- xfs: require XFS_SB_FEAT_INCOMPAT_LOG_XATTRS for attr log intent item recovery (git-fixes).\n- xfs: upgrade the extent counters in xfs_reflink_end_cow_extent later (git-fixes).\n- xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code (git-fixes).\n- xfs: use consistent uid/gid when grabbing dquots for inodes (git-fixes).\n- xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration (git-fixes).\n- xprtrdma: Fix rpcrdma_reqs_reset() (git-fixes).\n","status":"published","published":"2025-02-03T08:55:15Z","modified":"2026-03-23T04:50:42.230219Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"USN-7089-1","title":"linux, linux-gcp-6.8, linux-hwe-6.8 vulnerabilities","description":"Chenyuan Yang discovered that the USB Gadget subsystem in the Linux kernel\ndid not properly check for the device to be enabled before writing. A local\nattacker could possibly use this to cause a denial of service. (CVE-2024-25741)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM32 architecture;\n  - MIPS architecture;\n  - PA-RISC architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Cryptographic API;\n  - Serial ATA and Parallel ATA drivers;\n  - Null block device driver;\n  - Bluetooth drivers;\n  - Cdrom driver;\n  - Clock framework and drivers;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - Cirrus firmware drivers;\n  - GPIO subsystem;\n  - GPU drivers;\n  - I2C subsystem;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - ISDN/mISDN subsystem;\n  - LED subsystem;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - Network drivers;\n  - Microsoft Azure Network Adapter (MANA) driver;\n  - Near Field Communication (NFC) drivers;\n  - NVME drivers;\n  - NVMEM (Non Volatile Memory) drivers;\n  - PCI subsystem;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - S/390 drivers;\n  - SCSI drivers;\n  - Thermal drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - USB DSL drivers;\n  - USB core drivers;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Serial drivers;\n  - VFIO drivers;\n  - VHOST drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - GFS2 file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file systems library;\n  - Network file system client;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - SMB network file system;\n  - Memory management;\n  - Netfilter;\n  - Tracing infrastructure;\n  - io_uring subsystem;\n  - BPF subsystem;\n  - Core kernel;\n  - Bluetooth subsystem;\n  - CAN network layer;\n  - Ceph Core library;\n  - Networking core;\n  - IPv4 networking;\n  - IPv6 networking;\n  - IUCV driver;\n  - MAC80211 subsystem;\n  - Network traffic control;\n  - Sun RPC protocol;\n  - Wireless networking;\n  - AMD SoC Alsa drivers;\n  - SoC Audio for Freescale CPUs drivers;\n  - MediaTek ASoC drivers;\n  - SoC audio core drivers;\n  - SOF drivers;\n  - Sound sequencer drivers;\n(CVE-2024-42104, CVE-2024-42084, CVE-2024-42252, CVE-2024-41096,\nCVE-2024-42237, CVE-2024-42140, CVE-2024-42150, CVE-2024-41031,\nCVE-2024-41059, CVE-2024-41062, CVE-2024-41051, CVE-2024-41028,\nCVE-2024-41090, CVE-2024-41092, CVE-2024-43855, CVE-2024-41021,\nCVE-2024-42229, CVE-2024-41056, CVE-2024-41048, CVE-2024-41036,\nCVE-2024-42094, CVE-2024-41089, CVE-2024-41068, CVE-2024-41039,\nCVE-2024-41095, CVE-2024-41069, CVE-2024-42234, CVE-2024-42136,\nCVE-2024-41025, CVE-2024-42157, CVE-2024-42248, CVE-2024-42087,\nCVE-2024-41041, CVE-2024-42230, CVE-2024-42151, CVE-2024-42130,\nCVE-2024-42244, CVE-2024-41079, CVE-2024-42253, CVE-2024-42092,\nCVE-2024-41022, CVE-2024-42137, CVE-2024-42132, CVE-2024-42108,\nCVE-2024-42155, CVE-2024-42127, CVE-2024-41060, CVE-2024-42074,\nCVE-2024-41081, CVE-2024-42066, CVE-2024-42098, CVE-2024-42082,\nCVE-2024-42093, CVE-2024-42245, CVE-2024-41072, CVE-2024-41052,\nCVE-2024-42161, CVE-2024-42096, CVE-2024-42115, CVE-2024-41074,\nCVE-2024-42120, CVE-2024-41046, CVE-2024-42239, CVE-2024-41063,\nCVE-2024-42090, CVE-2024-41023, CVE-2024-42069, CVE-2024-41087,\nCVE-2024-42158, CVE-2024-41067, CVE-2024-41084, CVE-2024-41077,\nCVE-2024-42240, CVE-2024-42145, CVE-2024-42102, CVE-2024-41020,\nCVE-2024-42231, CVE-2024-41053, CVE-2024-42131, CVE-2024-42089,\nCVE-2024-41083, CVE-2024-42247, CVE-2024-42105, CVE-2024-41044,\nCVE-2024-42128, CVE-2024-42271, CVE-2024-41037, CVE-2024-42114,\nCVE-2024-42106, CVE-2024-41076, CVE-2024-42088, CVE-2024-41057,\nCVE-2024-41091, CVE-2024-42152, CVE-2024-41070, CVE-2024-41035,\nCVE-2024-41050, CVE-2024-39487, CVE-2024-42113, CVE-2024-42250,\nCVE-2024-41047, CVE-2024-42149, CVE-2024-42079, CVE-2024-42091,\nCVE-2024-42227, CVE-2024-42095, CVE-2024-42109, CVE-2024-41033,\nCVE-2023-52888, CVE-2024-41061, CVE-2024-42223, CVE-2024-42235,\nCVE-2024-41086, CVE-2024-42133, CVE-2024-41082, CVE-2024-41071,\nCVE-2024-41007, CVE-2023-52887, CVE-2024-39486, CVE-2024-41075,\nCVE-2024-42101, CVE-2024-42077, CVE-2024-41042, CVE-2024-42225,\nCVE-2024-42126, CVE-2024-41094, CVE-2024-41085, CVE-2024-41019,\nCVE-2024-41058, CVE-2024-41066, CVE-2024-42156, CVE-2024-42119,\nCVE-2024-41032, CVE-2024-41088, CVE-2024-42100, CVE-2024-42142,\nCVE-2024-41054, CVE-2024-42103, CVE-2024-42124, CVE-2024-41034,\nCVE-2024-42251, CVE-2024-42153, CVE-2024-41045, CVE-2024-42086,\nCVE-2024-42243, CVE-2024-41055, CVE-2024-41078, CVE-2024-42117,\nCVE-2024-41030, CVE-2024-42068, CVE-2024-42110, CVE-2024-42147,\nCVE-2024-42121, CVE-2024-41080, CVE-2024-41027, CVE-2024-43858,\nCVE-2024-42085, CVE-2024-42111, CVE-2024-42238, CVE-2024-41018,\nCVE-2024-42138, CVE-2024-41038, CVE-2024-42070, CVE-2024-42141,\nCVE-2024-41098, CVE-2024-42118, CVE-2024-41073, CVE-2024-42144,\nCVE-2024-42280, CVE-2024-41049, CVE-2024-42076, CVE-2024-41065,\nCVE-2024-42063, CVE-2024-41064, CVE-2024-41017, CVE-2024-42112,\nCVE-2024-42064, CVE-2024-42135, CVE-2024-42146, CVE-2024-41010,\nCVE-2024-41097, CVE-2024-41012, CVE-2024-42097, CVE-2024-42067,\nCVE-2024-42236, CVE-2024-42080, CVE-2024-42241, CVE-2024-42065,\nCVE-2024-42232, CVE-2024-42246, CVE-2024-41093, CVE-2024-41015,\nCVE-2024-42129, CVE-2024-42073, CVE-2024-41029)\n","status":"published","published":"2024-11-01T13:15:22Z","modified":"2026-10-26T22:33:59.398740884Z","updated_at":"2026-11-02T16:58:18.876384Z"},{"id":"USN-7089-2","title":"linux-azure, linux-gcp, linux-ibm vulnerabilities","description":"\nChenyuan Yang discovered that the USB Gadget subsystem in the Linux\nkernel did not properly check for the device to be enabled before\nwriting. A local attacker could possibly use this to cause a denial of\nservice. (CVE-2024-25741)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM32 architecture;\n  - MIPS architecture;\n  - PA-RISC architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Cryptographic API;\n  - Serial ATA and Parallel ATA drivers;\n  - Null block device driver;\n  - Bluetooth drivers;\n  - Cdrom driver;\n  - Clock framework and drivers;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - Cirrus firmware drivers;\n  - GPIO subsystem;\n  - GPU drivers;\n  - I2C subsystem;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - ISDN/mISDN subsystem;\n  - LED subsystem;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - Network drivers;\n  - Microsoft Azure Network Adapter (MANA) driver;\n  - Near Field Communication (NFC) drivers;\n  - NVME drivers;\n  - NVMEM (Non Volatile Memory) drivers;\n  - PCI subsystem;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - S/390 drivers;\n  - SCSI drivers;\n  - Thermal drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - USB DSL drivers;\n  - USB core drivers;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Serial drivers;\n  - VFIO drivers;\n  - VHOST drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - GFS2 file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file systems library;\n  - Network file system client;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - SMB network file system;\n  - Memory management;\n  - Netfilter;\n  - Tracing infrastructure;\n  - io_uring subsystem;\n  - BPF subsystem;\n  - Core kernel;\n  - Bluetooth subsystem;\n  - CAN network layer;\n  - Ceph Core library;\n  - Networking core;\n  - IPv4 networking;\n  - IPv6 networking;\n  - IUCV driver;\n  - MAC80211 subsystem;\n  - Network traffic control;\n  - Sun RPC protocol;\n  - Wireless networking;\n  - AMD SoC Alsa drivers;\n  - SoC Audio for Freescale CPUs drivers;\n  - MediaTek ASoC drivers;\n  - SoC audio core drivers;\n  - SOF drivers;\n  - Sound sequencer drivers;\n(CVE-2024-42104, CVE-2024-42101, CVE-2024-41052, CVE-2024-42157,\nCVE-2024-41020, CVE-2024-41055, CVE-2024-42124, CVE-2023-52888,\nCVE-2024-42079, CVE-2024-43858, CVE-2024-41075, CVE-2024-42073,\nCVE-2024-42113, CVE-2024-42110, CVE-2024-41080, CVE-2024-42097,\nCVE-2024-41046, CVE-2024-42076, CVE-2024-41010, CVE-2024-41018,\nCVE-2024-42115, CVE-2024-41048, CVE-2024-42231, CVE-2024-42241,\nCVE-2024-41034, CVE-2024-42065, CVE-2024-42140, CVE-2024-42094,\nCVE-2024-41029, CVE-2024-42225, CVE-2024-41096, CVE-2024-42088,\nCVE-2024-41087, CVE-2023-52887, CVE-2024-42141, CVE-2024-42135,\nCVE-2024-42247, CVE-2024-39487, CVE-2024-42229, CVE-2024-42147,\nCVE-2024-42252, CVE-2024-41038, CVE-2024-41083, CVE-2024-42091,\nCVE-2024-42156, CVE-2024-42149, CVE-2024-41015, CVE-2024-41047,\nCVE-2024-42129, CVE-2024-42120, CVE-2024-41097, CVE-2024-42243,\nCVE-2024-42084, CVE-2024-42250, CVE-2024-41023, CVE-2024-41028,\nCVE-2024-42108, CVE-2024-41045, CVE-2024-42098, CVE-2024-41064,\nCVE-2024-42087, CVE-2024-42080, CVE-2024-41049, CVE-2024-42271,\nCVE-2024-41037, CVE-2024-42114, CVE-2024-41044, CVE-2024-42126,\nCVE-2024-42119, CVE-2024-42223, CVE-2024-42280, CVE-2024-42112,\nCVE-2024-41019, CVE-2024-42133, CVE-2024-42152, CVE-2024-41074,\nCVE-2024-41042, CVE-2024-41093, CVE-2024-41025, CVE-2024-42253,\nCVE-2024-42136, CVE-2024-42127, CVE-2024-41036, CVE-2024-42237,\nCVE-2024-42111, CVE-2024-41031, CVE-2024-41069, CVE-2024-41084,\nCVE-2024-41076, CVE-2024-41090, CVE-2024-41088, CVE-2024-41070,\nCVE-2024-42118, CVE-2024-42238, CVE-2024-42234, CVE-2024-41089,\nCVE-2024-41095, CVE-2024-41085, CVE-2024-42106, CVE-2024-42155,\nCVE-2024-42146, CVE-2024-42130, CVE-2024-42089, CVE-2024-42132,\nCVE-2024-41091, CVE-2024-42153, CVE-2024-42236, CVE-2024-42085,\nCVE-2024-41065, CVE-2024-41032, CVE-2024-42090, CVE-2024-41030,\nCVE-2024-41017, CVE-2024-42230, CVE-2024-42144, CVE-2024-42137,\nCVE-2024-41082, CVE-2024-41056, CVE-2024-42145, CVE-2024-41041,\nCVE-2024-42240, CVE-2024-41081, CVE-2024-42103, CVE-2024-41053,\nCVE-2024-42070, CVE-2024-42121, CVE-2024-42105, CVE-2024-41022,\nCVE-2024-42151, CVE-2024-42142, CVE-2024-41035, CVE-2024-42232,\nCVE-2024-41058, CVE-2024-42109, CVE-2024-41077, CVE-2024-42095,\nCVE-2024-39486, CVE-2024-42131, CVE-2024-42068, CVE-2024-41073,\nCVE-2024-41079, CVE-2024-42082, CVE-2024-41071, CVE-2024-41066,\nCVE-2024-42102, CVE-2024-43855, CVE-2024-41061, CVE-2024-41072,\nCVE-2024-41059, CVE-2024-41094, CVE-2024-41021, CVE-2024-41098,\nCVE-2024-42158, CVE-2024-41033, CVE-2024-42096, CVE-2024-42251,\nCVE-2024-42077, CVE-2024-42063, CVE-2024-42227, CVE-2024-41007,\nCVE-2024-41057, CVE-2024-41063, CVE-2024-41039, CVE-2024-41067,\nCVE-2024-41062, CVE-2024-42100, CVE-2024-42074, CVE-2024-42064,\nCVE-2024-41092, CVE-2024-42128, CVE-2024-41086, CVE-2024-41054,\nCVE-2024-42239, CVE-2024-41027, CVE-2024-42093, CVE-2024-42244,\nCVE-2024-41050, CVE-2024-41012, CVE-2024-42246, CVE-2024-42117,\nCVE-2024-42069, CVE-2024-42067, CVE-2024-42086, CVE-2024-42066,\nCVE-2024-41060, CVE-2024-42248, CVE-2024-41068, CVE-2024-42161,\nCVE-2024-42092, CVE-2024-42245, CVE-2024-41078, CVE-2024-42235,\nCVE-2024-42150, CVE-2024-41051, CVE-2024-42138)\n","status":"published","published":"2024-11-04T17:30:30Z","modified":"2026-10-26T22:34:00.39355758Z","updated_at":"2026-11-02T16:58:18.876384Z"},{"id":"USN-7089-3","title":"linux-aws, linux-aws-6.8, linux-oracle, linux-oracle-6.8 vulnerabilities","description":"\nChenyuan Yang discovered that the USB Gadget subsystem in the Linux\nkernel did not properly check for the device to be enabled before\nwriting. A local attacker could possibly use this to cause a denial of\nservice. (CVE-2024-25741)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM32 architecture;\n  - MIPS architecture;\n  - PA-RISC architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Cryptographic API;\n  - Serial ATA and Parallel ATA drivers;\n  - Null block device driver;\n  - Bluetooth drivers;\n  - Cdrom driver;\n  - Clock framework and drivers;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - Cirrus firmware drivers;\n  - GPIO subsystem;\n  - GPU drivers;\n  - I2C subsystem;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - ISDN/mISDN subsystem;\n  - LED subsystem;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - Network drivers;\n  - Microsoft Azure Network Adapter (MANA) driver;\n  - Near Field Communication (NFC) drivers;\n  - NVME drivers;\n  - NVMEM (Non Volatile Memory) drivers;\n  - PCI subsystem;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - S/390 drivers;\n  - SCSI drivers;\n  - Thermal drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - USB DSL drivers;\n  - USB core drivers;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Serial drivers;\n  - VFIO drivers;\n  - VHOST drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - GFS2 file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file systems library;\n  - Network file system client;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - SMB network file system;\n  - Memory management;\n  - Netfilter;\n  - Tracing infrastructure;\n  - io_uring subsystem;\n  - BPF subsystem;\n  - Core kernel;\n  - Bluetooth subsystem;\n  - CAN network layer;\n  - Ceph Core library;\n  - Networking core;\n  - IPv4 networking;\n  - IPv6 networking;\n  - IUCV driver;\n  - MAC80211 subsystem;\n  - Network traffic control;\n  - Sun RPC protocol;\n  - Wireless networking;\n  - AMD SoC Alsa drivers;\n  - SoC Audio for Freescale CPUs drivers;\n  - MediaTek ASoC drivers;\n  - SoC audio core drivers;\n  - SOF drivers;\n  - Sound sequencer drivers;\n(CVE-2024-42239, CVE-2024-42079, CVE-2024-41080, CVE-2024-42064,\nCVE-2024-42127, CVE-2024-41049, CVE-2024-41086, CVE-2024-42142,\nCVE-2024-42244, CVE-2024-41060, CVE-2024-42131, CVE-2024-42085,\nCVE-2024-42246, CVE-2024-41062, CVE-2024-42115, CVE-2024-42234,\nCVE-2024-42080, CVE-2024-41095, CVE-2024-41063, CVE-2024-42227,\nCVE-2024-41089, CVE-2024-42133, CVE-2024-43858, CVE-2024-42135,\nCVE-2024-42113, CVE-2024-42120, CVE-2024-42149, CVE-2024-42132,\nCVE-2024-41038, CVE-2024-41069, CVE-2024-41090, CVE-2024-41059,\nCVE-2024-41028, CVE-2024-42126, CVE-2024-42121, CVE-2024-42155,\nCVE-2024-42110, CVE-2024-41021, CVE-2024-41044, CVE-2024-42098,\nCVE-2024-42235, CVE-2024-41083, CVE-2024-41065, CVE-2024-42094,\nCVE-2024-42229, CVE-2024-42240, CVE-2024-42225, CVE-2024-42230,\nCVE-2024-41088, CVE-2024-42073, CVE-2024-42145, CVE-2024-42076,\nCVE-2024-42087, CVE-2024-42241, CVE-2024-41019, CVE-2024-41052,\nCVE-2024-42093, CVE-2024-42063, CVE-2024-41039, CVE-2024-42106,\nCVE-2024-42108, CVE-2024-42237, CVE-2024-41048, CVE-2024-41033,\nCVE-2023-52888, CVE-2024-41096, CVE-2024-41032, CVE-2024-41091,\nCVE-2024-42238, CVE-2024-41056, CVE-2024-42091, CVE-2024-42088,\nCVE-2024-41047, CVE-2024-42271, CVE-2024-41064, CVE-2024-42223,\nCVE-2024-42129, CVE-2024-42102, CVE-2024-42146, CVE-2024-42138,\nCVE-2024-41079, CVE-2024-42232, CVE-2024-42112, CVE-2024-39487,\nCVE-2024-42245, CVE-2024-41093, CVE-2024-41066, CVE-2024-43855,\nCVE-2024-41055, CVE-2024-42100, CVE-2024-41053, CVE-2024-42069,\nCVE-2024-42252, CVE-2024-42243, CVE-2024-42124, CVE-2024-41054,\nCVE-2024-42151, CVE-2024-42118, CVE-2024-42251, CVE-2024-42137,\nCVE-2024-41071, CVE-2024-41010, CVE-2024-41087, CVE-2024-41050,\nCVE-2024-42068, CVE-2024-42158, CVE-2024-41075, CVE-2024-42141,\nCVE-2024-42236, CVE-2024-41068, CVE-2024-42157, CVE-2024-42140,\nCVE-2024-41058, CVE-2024-41076, CVE-2024-42097, CVE-2024-41029,\nCVE-2024-41097, CVE-2024-42109, CVE-2024-41051, CVE-2024-41061,\nCVE-2024-42156, CVE-2024-42101, CVE-2024-41031, CVE-2024-41017,\nCVE-2024-42247, CVE-2024-42128, CVE-2024-41085, CVE-2024-41072,\nCVE-2024-42248, CVE-2024-41045, CVE-2024-42104, CVE-2024-42253,\nCVE-2024-42117, CVE-2024-41078, CVE-2024-42130, CVE-2024-42090,\nCVE-2024-42280, CVE-2024-42250, CVE-2024-42231, CVE-2024-41042,\nCVE-2024-42077, CVE-2024-42153, CVE-2024-41015, CVE-2024-41035,\nCVE-2024-41082, CVE-2024-42114, CVE-2024-41007, CVE-2024-41073,\nCVE-2024-42161, CVE-2024-42082, CVE-2024-42150, CVE-2024-42111,\nCVE-2024-42086, CVE-2024-42095, CVE-2024-41025, CVE-2024-41081,\nCVE-2024-42105, CVE-2024-41027, CVE-2024-42089, CVE-2024-39486,\nCVE-2024-41084, CVE-2024-42092, CVE-2024-42152, CVE-2024-41022,\nCVE-2024-41077, CVE-2024-41098, CVE-2024-41023, CVE-2024-42066,\nCVE-2024-41034, CVE-2024-41037, CVE-2024-41046, CVE-2023-52887,\nCVE-2024-42147, CVE-2024-42065, CVE-2024-42096, CVE-2024-41018,\nCVE-2024-42067, CVE-2024-41041, CVE-2024-42103, CVE-2024-42084,\nCVE-2024-42074, CVE-2024-41094, CVE-2024-42119, CVE-2024-41012,\nCVE-2024-41020, CVE-2024-41074, CVE-2024-42144, CVE-2024-41067,\nCVE-2024-42070, CVE-2024-41057, CVE-2024-41036, CVE-2024-42136,\nCVE-2024-41030, CVE-2024-41070, CVE-2024-41092)\n","status":"published","published":"2024-11-07T09:15:50Z","modified":"2026-10-26T22:34:10.691578849Z","updated_at":"2026-11-02T16:58:18.876384Z"},{"id":"USN-7089-4","title":"linux-oem-6.8 vulnerabilities","description":"\nChenyuan Yang discovered that the USB Gadget subsystem in the Linux\nkernel did not properly check for the device to be enabled before\nwriting. A local attacker could possibly use this to cause a denial of\nservice. (CVE-2024-25741)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM32 architecture;\n  - MIPS architecture;\n  - PA-RISC architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Cryptographic API;\n  - Serial ATA and Parallel ATA drivers;\n  - Null block device driver;\n  - Bluetooth drivers;\n  - Cdrom driver;\n  - Clock framework and drivers;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - Cirrus firmware drivers;\n  - GPIO subsystem;\n  - GPU drivers;\n  - I2C subsystem;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - ISDN/mISDN subsystem;\n  - LED subsystem;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - Network drivers;\n  - Microsoft Azure Network Adapter (MANA) driver;\n  - Near Field Communication (NFC) drivers;\n  - NVME drivers;\n  - NVMEM (Non Volatile Memory) drivers;\n  - PCI subsystem;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - S/390 drivers;\n  - SCSI drivers;\n  - Thermal drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - USB DSL drivers;\n  - USB core drivers;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Serial drivers;\n  - VFIO drivers;\n  - VHOST drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - GFS2 file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file systems library;\n  - Network file system client;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - SMB network file system;\n  - Memory management;\n  - Netfilter;\n  - Tracing infrastructure;\n  - io_uring subsystem;\n  - BPF subsystem;\n  - Core kernel;\n  - Bluetooth subsystem;\n  - CAN network layer;\n  - Ceph Core library;\n  - Networking core;\n  - IPv4 networking;\n  - IPv6 networking;\n  - IUCV driver;\n  - MAC80211 subsystem;\n  - Network traffic control;\n  - Sun RPC protocol;\n  - Wireless networking;\n  - AMD SoC Alsa drivers;\n  - SoC Audio for Freescale CPUs drivers;\n  - MediaTek ASoC drivers;\n  - SoC audio core drivers;\n  - SOF drivers;\n  - Sound sequencer drivers;\n(CVE-2024-41064, CVE-2024-41087, CVE-2023-52888, CVE-2024-42098,\nCVE-2024-42111, CVE-2024-42076, CVE-2024-42088, CVE-2024-42135,\nCVE-2024-42145, CVE-2024-42142, CVE-2024-41036, CVE-2024-41071,\nCVE-2024-41012, CVE-2024-42091, CVE-2024-42253, CVE-2024-42119,\nCVE-2024-42097, CVE-2024-42243, CVE-2024-39487, CVE-2024-42235,\nCVE-2024-42120, CVE-2024-42149, CVE-2024-41015, CVE-2024-41074,\nCVE-2024-42067, CVE-2024-42090, CVE-2024-42128, CVE-2024-41038,\nCVE-2024-42113, CVE-2024-42102, CVE-2024-42231, CVE-2024-42080,\nCVE-2024-42241, CVE-2024-42106, CVE-2024-42130, CVE-2024-42073,\nCVE-2024-42153, CVE-2024-42156, CVE-2024-42118, CVE-2024-41007,\nCVE-2024-41049, CVE-2024-39486, CVE-2024-42240, CVE-2024-41018,\nCVE-2024-42251, CVE-2024-42280, CVE-2024-42096, CVE-2024-42121,\nCVE-2024-42246, CVE-2024-42092, CVE-2024-41090, CVE-2024-42157,\nCVE-2024-43858, CVE-2024-42150, CVE-2024-42110, CVE-2024-41010,\nCVE-2024-41081, CVE-2024-41061, CVE-2024-41078, CVE-2024-41094,\nCVE-2024-41039, CVE-2024-42114, CVE-2024-42109, CVE-2024-41030,\nCVE-2024-42066, CVE-2024-41035, CVE-2024-42146, CVE-2024-42131,\nCVE-2024-41059, CVE-2024-41067, CVE-2024-42138, CVE-2024-41050,\nCVE-2024-41034, CVE-2024-41077, CVE-2024-41076, CVE-2024-41088,\nCVE-2024-41096, CVE-2024-41073, CVE-2024-41037, CVE-2024-42232,\nCVE-2024-41063, CVE-2024-42117, CVE-2024-42155, CVE-2024-41080,\nCVE-2024-42132, CVE-2024-42084, CVE-2024-42136, CVE-2024-42223,\nCVE-2024-41068, CVE-2024-42225, CVE-2024-42065, CVE-2024-41051,\nCVE-2024-43855, CVE-2024-42238, CVE-2024-42250, CVE-2024-42112,\nCVE-2024-41070, CVE-2023-52887, CVE-2024-42094, CVE-2024-42095,\nCVE-2024-41086, CVE-2024-41020, CVE-2024-41082, CVE-2024-42115,\nCVE-2024-42152, CVE-2024-42239, CVE-2024-42093, CVE-2024-42126,\nCVE-2024-41022, CVE-2024-41017, CVE-2024-41092, CVE-2024-41044,\nCVE-2024-42140, CVE-2024-41029, CVE-2024-41054, CVE-2024-42158,\nCVE-2024-41066, CVE-2024-42244, CVE-2024-42070, CVE-2024-41025,\nCVE-2024-42229, CVE-2024-42085, CVE-2024-41084, CVE-2024-41060,\nCVE-2024-41062, CVE-2024-42105, CVE-2024-42124, CVE-2024-41045,\nCVE-2024-42227, CVE-2024-41047, CVE-2024-41042, CVE-2024-42100,\nCVE-2024-42247, CVE-2024-41041, CVE-2024-42087, CVE-2024-42252,\nCVE-2024-41058, CVE-2024-42063, CVE-2024-42271, CVE-2024-41027,\nCVE-2024-42079, CVE-2024-42104, CVE-2024-41098, CVE-2024-41033,\nCVE-2024-41072, CVE-2024-41031, CVE-2024-42089, CVE-2024-41032,\nCVE-2024-42127, CVE-2024-41093, CVE-2024-42082, CVE-2024-41023,\nCVE-2024-41075, CVE-2024-42151, CVE-2024-42141, CVE-2024-42108,\nCVE-2024-42068, CVE-2024-41085, CVE-2024-42103, CVE-2024-41057,\nCVE-2024-42064, CVE-2024-42161, CVE-2024-41052, CVE-2024-41053,\nCVE-2024-42069, CVE-2024-41021, CVE-2024-42147, CVE-2024-41065,\nCVE-2024-41091, CVE-2024-41079, CVE-2024-42086, CVE-2024-42234,\nCVE-2024-41055, CVE-2024-41083, CVE-2024-42101, CVE-2024-42230,\nCVE-2024-41095, CVE-2024-41019, CVE-2024-42245, CVE-2024-42129,\nCVE-2024-42144, CVE-2024-42236, CVE-2024-41028, CVE-2024-42077,\nCVE-2024-42248, CVE-2024-41046, CVE-2024-42133, CVE-2024-42074,\nCVE-2024-41089, CVE-2024-42237, CVE-2024-41056, CVE-2024-41048,\nCVE-2024-42137, CVE-2024-41069, CVE-2024-41097)\n","status":"published","published":"2024-11-13T12:05:57Z","modified":"2026-10-26T22:33:54.911543556Z","updated_at":"2026-11-02T16:58:18.876384Z"},{"id":"USN-7089-5","title":"linux-raspi vulnerabilities","description":"Chenyuan Yang discovered that the USB Gadget subsystem in the Linux\nkernel did not properly check for the device to be enabled before\nwriting. A local attacker could possibly use this to cause a denial of\nservice. (CVE-2024-25741)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM32 architecture;\n  - MIPS architecture;\n  - PA-RISC architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Cryptographic API;\n  - Serial ATA and Parallel ATA drivers;\n  - Null block device driver;\n  - Bluetooth drivers;\n  - Cdrom driver;\n  - Clock framework and drivers;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - Cirrus firmware drivers;\n  - GPIO subsystem;\n  - GPU drivers;\n  - I2C subsystem;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - ISDN/mISDN subsystem;\n  - LED subsystem;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - Network drivers;\n  - Microsoft Azure Network Adapter (MANA) driver;\n  - Near Field Communication (NFC) drivers;\n  - NVME drivers;\n  - NVMEM (Non Volatile Memory) drivers;\n  - PCI subsystem;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - S/390 drivers;\n  - SCSI drivers;\n  - Thermal drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - USB DSL drivers;\n  - USB core drivers;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Serial drivers;\n  - VFIO drivers;\n  - VHOST drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - GFS2 file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file systems library;\n  - Network file system client;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - SMB network file system;\n  - Memory management;\n  - Netfilter;\n  - Tracing infrastructure;\n  - io_uring subsystem;\n  - BPF subsystem;\n  - Core kernel;\n  - Bluetooth subsystem;\n  - CAN network layer;\n  - Ceph Core library;\n  - Networking core;\n  - IPv4 networking;\n  - IPv6 networking;\n  - IUCV driver;\n  - MAC80211 subsystem;\n  - Network traffic control;\n  - Sun RPC protocol;\n  - Wireless networking;\n  - AMD SoC Alsa drivers;\n  - SoC Audio for Freescale CPUs drivers;\n  - MediaTek ASoC drivers;\n  - SoC audio core drivers;\n  - SOF drivers;\n  - Sound sequencer drivers;\n(CVE-2024-42223, CVE-2024-42244, CVE-2024-42105, CVE-2024-42100,\nCVE-2024-42235, CVE-2024-41007, CVE-2024-41047, CVE-2024-42088,\nCVE-2024-42079, CVE-2024-41053, CVE-2024-41094, CVE-2024-42227,\nCVE-2024-42253, CVE-2024-42150, CVE-2024-41049, CVE-2024-42096,\nCVE-2024-42093, CVE-2024-41079, CVE-2024-41037, CVE-2024-42129,\nCVE-2024-41031, CVE-2024-39486, CVE-2024-41065, CVE-2024-42101,\nCVE-2024-41082, CVE-2024-42135, CVE-2024-42236, CVE-2024-41078,\nCVE-2024-42098, CVE-2024-41056, CVE-2024-41096, CVE-2024-41074,\nCVE-2024-42246, CVE-2024-42137, CVE-2024-42232, CVE-2024-42121,\nCVE-2024-41093, CVE-2024-41076, CVE-2024-42157, CVE-2024-41062,\nCVE-2024-42104, CVE-2024-42085, CVE-2024-41092, CVE-2024-41034,\nCVE-2024-41036, CVE-2024-41072, CVE-2024-41012, CVE-2024-39487,\nCVE-2024-42124, CVE-2024-42065, CVE-2024-41061, CVE-2024-41064,\nCVE-2024-41091, CVE-2024-42119, CVE-2024-41088, CVE-2024-42089,\nCVE-2024-41048, CVE-2024-41032, CVE-2024-41020, CVE-2024-42066,\nCVE-2024-42068, CVE-2024-42238, CVE-2024-41069, CVE-2024-41044,\nCVE-2024-41025, CVE-2024-42161, CVE-2023-52887, CVE-2024-42127,\nCVE-2024-42239, CVE-2024-42149, CVE-2024-42091, CVE-2024-42097,\nCVE-2024-41054, CVE-2024-41041, CVE-2024-42131, CVE-2024-41089,\nCVE-2024-41018, CVE-2024-42067, CVE-2024-41039, CVE-2024-42128,\nCVE-2024-42248, CVE-2024-41090, CVE-2024-42073, CVE-2024-43858,\nCVE-2024-42225, CVE-2024-42077, CVE-2024-42247, CVE-2024-42109,\nCVE-2024-41045, CVE-2024-41019, CVE-2024-42231, CVE-2024-41017,\nCVE-2024-42145, CVE-2024-41046, CVE-2024-42063, CVE-2024-41087,\nCVE-2024-41033, CVE-2024-41021, CVE-2024-42241, CVE-2024-42229,\nCVE-2024-41015, CVE-2024-42087, CVE-2024-42133, CVE-2024-41073,\nCVE-2024-42070, CVE-2024-41067, CVE-2024-41077, CVE-2024-42102,\nCVE-2024-42158, CVE-2024-42126, CVE-2024-41042, CVE-2024-41055,\nCVE-2024-42092, CVE-2024-42114, CVE-2024-41059, CVE-2024-41058,\nCVE-2024-41071, CVE-2024-42144, CVE-2024-42146, CVE-2024-41084,\nCVE-2024-42155, CVE-2024-42245, CVE-2024-42156, CVE-2024-41050,\nCVE-2024-42141, CVE-2024-42095, CVE-2024-41097, CVE-2024-42103,\nCVE-2024-42152, CVE-2024-42140, CVE-2024-41023, CVE-2024-41083,\nCVE-2024-42138, CVE-2024-42271, CVE-2024-42252, CVE-2024-42237,\nCVE-2024-42132, CVE-2024-41098, CVE-2024-42086, CVE-2024-41063,\nCVE-2024-42153, CVE-2024-41070, CVE-2024-42115, CVE-2024-42111,\nCVE-2024-42142, CVE-2024-42069, CVE-2024-41027, CVE-2024-42130,\nCVE-2024-42090, CVE-2024-42251, CVE-2024-42118, CVE-2024-41060,\nCVE-2024-41029, CVE-2024-41095, CVE-2024-41038, CVE-2024-42243,\nCVE-2024-42112, CVE-2024-41035, CVE-2024-42240, CVE-2024-41066,\nCVE-2024-41085, CVE-2024-42082, CVE-2024-42117, CVE-2024-42250,\nCVE-2024-41080, CVE-2024-42147, CVE-2024-41081, CVE-2024-42113,\nCVE-2023-52888, CVE-2024-42136, CVE-2024-41057, CVE-2024-41086,\nCVE-2024-42064, CVE-2024-42234, CVE-2024-42076, CVE-2024-42084,\nCVE-2024-42094, CVE-2024-42230, CVE-2024-41068, CVE-2024-43855,\nCVE-2024-42080, CVE-2024-41052, CVE-2024-41051, CVE-2024-42074,\nCVE-2024-41010, CVE-2024-41028, CVE-2024-41030, CVE-2024-41022,\nCVE-2024-42120, CVE-2024-42108, CVE-2024-41075, CVE-2024-42106,\nCVE-2024-42280, CVE-2024-42110, CVE-2024-42151)\n","status":"published","published":"2024-11-14T16:55:06Z","modified":"2026-10-26T22:33:56.031381167Z","updated_at":"2026-11-02T16:58:18.876384Z"},{"id":"USN-7089-6","title":"linux-gke vulnerabilities","description":"\nChenyuan Yang discovered that the USB Gadget subsystem in the Linux\nkernel did not properly check for the device to be enabled before\nwriting. A local attacker could possibly use this to cause a denial of\nservice. (CVE-2024-25741)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM32 architecture;\n  - MIPS architecture;\n  - PA-RISC architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Cryptographic API;\n  - Serial ATA and Parallel ATA drivers;\n  - Null block device driver;\n  - Bluetooth drivers;\n  - Cdrom driver;\n  - Clock framework and drivers;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - Cirrus firmware drivers;\n  - GPIO subsystem;\n  - GPU drivers;\n  - I2C subsystem;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - ISDN/mISDN subsystem;\n  - LED subsystem;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - Network drivers;\n  - Microsoft Azure Network Adapter (MANA) driver;\n  - Near Field Communication (NFC) drivers;\n  - NVME drivers;\n  - NVMEM (Non Volatile Memory) drivers;\n  - PCI subsystem;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - S/390 drivers;\n  - SCSI drivers;\n  - Thermal drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - USB DSL drivers;\n  - USB core drivers;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Serial drivers;\n  - VFIO drivers;\n  - VHOST drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - GFS2 file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file systems library;\n  - Network file system client;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - SMB network file system;\n  - Memory management;\n  - Netfilter;\n  - Tracing infrastructure;\n  - io_uring subsystem;\n  - BPF subsystem;\n  - Core kernel;\n  - Bluetooth subsystem;\n  - CAN network layer;\n  - Ceph Core library;\n  - Networking core;\n  - IPv4 networking;\n  - IPv6 networking;\n  - IUCV driver;\n  - MAC80211 subsystem;\n  - Network traffic control;\n  - Sun RPC protocol;\n  - Wireless networking;\n  - AMD SoC Alsa drivers;\n  - SoC Audio for Freescale CPUs drivers;\n  - MediaTek ASoC drivers;\n  - SoC audio core drivers;\n  - SOF drivers;\n  - Sound sequencer drivers;\n(CVE-2024-41062, CVE-2024-41029, CVE-2024-42142, CVE-2024-41070,\nCVE-2024-41066, CVE-2024-42150, CVE-2024-42120, CVE-2023-52888,\nCVE-2024-42141, CVE-2024-41032, CVE-2024-42245, CVE-2024-41053,\nCVE-2024-42247, CVE-2024-42161, CVE-2024-42094, CVE-2024-41072,\nCVE-2024-42076, CVE-2024-42091, CVE-2024-42103, CVE-2024-41007,\nCVE-2024-42064, CVE-2024-41075, CVE-2024-42157, CVE-2024-42069,\nCVE-2024-41045, CVE-2024-42068, CVE-2024-42090, CVE-2024-41071,\nCVE-2024-42082, CVE-2024-42146, CVE-2024-41018, CVE-2024-42238,\nCVE-2024-41079, CVE-2024-42241, CVE-2024-42067, CVE-2024-42132,\nCVE-2024-42121, CVE-2024-41025, CVE-2024-42231, CVE-2024-42225,\nCVE-2024-41080, CVE-2024-41086, CVE-2024-41012, CVE-2024-42234,\nCVE-2024-41088, CVE-2024-42129, CVE-2024-42158, CVE-2024-41078,\nCVE-2024-41038, CVE-2024-41055, CVE-2024-42106, CVE-2024-42227,\nCVE-2024-42102, CVE-2024-41082, CVE-2024-42108, CVE-2024-41085,\nCVE-2024-41020, CVE-2024-41054, CVE-2024-42085, CVE-2024-42140,\nCVE-2024-42089, CVE-2024-41047, CVE-2024-42092, CVE-2024-41044,\nCVE-2024-42246, CVE-2024-41035, CVE-2024-42250, CVE-2024-42070,\nCVE-2024-41039, CVE-2024-41061, CVE-2024-42147, CVE-2024-42104,\nCVE-2024-41090, CVE-2024-41096, CVE-2024-41063, CVE-2024-41084,\nCVE-2024-41059, CVE-2024-41097, CVE-2024-41089, CVE-2024-42093,\nCVE-2024-42126, CVE-2024-42135, CVE-2024-42128, CVE-2024-42098,\nCVE-2024-42105, CVE-2024-42124, CVE-2024-42101, CVE-2024-41091,\nCVE-2024-42127, CVE-2024-41077, CVE-2024-42111, CVE-2024-41037,\nCVE-2024-42136, CVE-2024-41083, CVE-2024-42243, CVE-2024-41033,\nCVE-2024-41046, CVE-2024-42230, CVE-2024-42080, CVE-2024-42096,\nCVE-2024-42100, CVE-2024-42236, CVE-2024-41022, CVE-2024-42086,\nCVE-2024-42251, CVE-2024-41015, CVE-2024-41027, CVE-2024-42155,\nCVE-2024-42117, CVE-2024-41036, CVE-2024-42133, CVE-2024-41010,\nCVE-2024-42151, CVE-2024-42118, CVE-2024-39486, CVE-2024-42066,\nCVE-2024-42131, CVE-2024-42223, CVE-2024-41081, CVE-2024-42244,\nCVE-2024-41073, CVE-2024-42114, CVE-2024-42252, CVE-2024-42248,\nCVE-2024-42110, CVE-2024-41051, CVE-2023-52887, CVE-2024-42156,\nCVE-2024-41074, CVE-2024-41017, CVE-2024-42079, CVE-2024-41034,\nCVE-2024-41028, CVE-2024-42109, CVE-2024-42235, CVE-2024-41058,\nCVE-2024-42232, CVE-2024-42084, CVE-2024-41076, CVE-2024-41030,\nCVE-2024-41023, CVE-2024-42271, CVE-2024-41050, CVE-2024-41042,\nCVE-2024-41031, CVE-2024-42112, CVE-2024-41092, CVE-2024-42253,\nCVE-2024-42152, CVE-2024-41049, CVE-2024-42237, CVE-2024-41095,\nCVE-2024-42280, CVE-2024-42153, CVE-2024-42115, CVE-2024-42130,\nCVE-2024-41064, CVE-2024-42077, CVE-2024-41067, CVE-2024-42137,\nCVE-2024-41019, CVE-2024-42240, CVE-2024-41093, CVE-2024-41048,\nCVE-2024-42063, CVE-2024-42113, CVE-2024-42145, CVE-2024-42073,\nCVE-2024-43858, CVE-2024-42088, CVE-2024-41069, CVE-2024-41068,\nCVE-2024-42138, CVE-2024-41065, CVE-2024-42087, CVE-2024-42239,\nCVE-2024-42149, CVE-2024-41021, CVE-2024-42065, CVE-2024-39487,\nCVE-2024-41052, CVE-2024-42095, CVE-2024-42074, CVE-2024-42097,\nCVE-2024-41098, CVE-2024-41057, CVE-2024-41060, CVE-2024-42119,\nCVE-2024-42229, CVE-2024-43855, CVE-2024-41056, CVE-2024-41041,\nCVE-2024-42144, CVE-2024-41087, CVE-2024-41094)\n","status":"published","published":"2024-11-15T10:36:16Z","modified":"2026-10-26T22:34:10.328493163Z","updated_at":"2026-11-02T16:58:18.876384Z"},{"id":"USN-7089-7","title":"linux-lowlatency, linux-lowlatency-hwe-6.8 vulnerabilities","description":"Chenyuan Yang discovered that the USB Gadget subsystem in the Linux\nkernel did not properly check for the device to be enabled before\nwriting. A local attacker could possibly use this to cause a denial of\nservice. (CVE-2024-25741)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM32 architecture;\n  - MIPS architecture;\n  - PA-RISC architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Cryptographic API;\n  - Serial ATA and Parallel ATA drivers;\n  - Null block device driver;\n  - Bluetooth drivers;\n  - Cdrom driver;\n  - Clock framework and drivers;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - Cirrus firmware drivers;\n  - GPIO subsystem;\n  - GPU drivers;\n  - I2C subsystem;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - ISDN/mISDN subsystem;\n  - LED subsystem;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - Network drivers;\n  - Microsoft Azure Network Adapter (MANA) driver;\n  - Near Field Communication (NFC) drivers;\n  - NVME drivers;\n  - NVMEM (Non Volatile Memory) drivers;\n  - PCI subsystem;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - S/390 drivers;\n  - SCSI drivers;\n  - Thermal drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - USB DSL drivers;\n  - USB core drivers;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Serial drivers;\n  - VFIO drivers;\n  - VHOST drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - GFS2 file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file systems library;\n  - Network file system client;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - SMB network file system;\n  - Memory management;\n  - Netfilter;\n  - Tracing infrastructure;\n  - io_uring subsystem;\n  - BPF subsystem;\n  - Core kernel;\n  - Bluetooth subsystem;\n  - CAN network layer;\n  - Ceph Core library;\n  - Networking core;\n  - IPv4 networking;\n  - IPv6 networking;\n  - IUCV driver;\n  - MAC80211 subsystem;\n  - Network traffic control;\n  - Sun RPC protocol;\n  - Wireless networking;\n  - AMD SoC Alsa drivers;\n  - SoC Audio for Freescale CPUs drivers;\n  - MediaTek ASoC drivers;\n  - SoC audio core drivers;\n  - SOF drivers;\n  - Sound sequencer drivers;\n(CVE-2024-42104, CVE-2024-42084, CVE-2024-42252, CVE-2024-41096,\nCVE-2024-42237, CVE-2024-42140, CVE-2024-42150, CVE-2024-41031,\nCVE-2024-41059, CVE-2024-41062, CVE-2024-41051, CVE-2024-41028,\nCVE-2024-41090, CVE-2024-41092, CVE-2024-43855, CVE-2024-41021,\nCVE-2024-42229, CVE-2024-41056, CVE-2024-41048, CVE-2024-41036,\nCVE-2024-42094, CVE-2024-41089, CVE-2024-41068, CVE-2024-41039,\nCVE-2024-41095, CVE-2024-41069, CVE-2024-42234, CVE-2024-42136,\nCVE-2024-41025, CVE-2024-42157, CVE-2024-42248, CVE-2024-42087,\nCVE-2024-41041, CVE-2024-42230, CVE-2024-42151, CVE-2024-42130,\nCVE-2024-42244, CVE-2024-41079, CVE-2024-42253, CVE-2024-42092,\nCVE-2024-41022, CVE-2024-42137, CVE-2024-42132, CVE-2024-42108,\nCVE-2024-42155, CVE-2024-42127, CVE-2024-41060, CVE-2024-42074,\nCVE-2024-41081, CVE-2024-42066, CVE-2024-42098, CVE-2024-42082,\nCVE-2024-42093, CVE-2024-42245, CVE-2024-41072, CVE-2024-41052,\nCVE-2024-42161, CVE-2024-42096, CVE-2024-42115, CVE-2024-41074,\nCVE-2024-42120, CVE-2024-41046, CVE-2024-42239, CVE-2024-41063,\nCVE-2024-42090, CVE-2024-41023, CVE-2024-42069, CVE-2024-41087,\nCVE-2024-42158, CVE-2024-41067, CVE-2024-41084, CVE-2024-41077,\nCVE-2024-42240, CVE-2024-42145, CVE-2024-42102, CVE-2024-41020,\nCVE-2024-42231, CVE-2024-41053, CVE-2024-42131, CVE-2024-42089,\nCVE-2024-41083, CVE-2024-42247, CVE-2024-42105, CVE-2024-41044,\nCVE-2024-42128, CVE-2024-42271, CVE-2024-41037, CVE-2024-42114,\nCVE-2024-42106, CVE-2024-41076, CVE-2024-42088, CVE-2024-41057,\nCVE-2024-41091, CVE-2024-42152, CVE-2024-41070, CVE-2024-41035,\nCVE-2024-41050, CVE-2024-39487, CVE-2024-42113, CVE-2024-42250,\nCVE-2024-41047, CVE-2024-42149, CVE-2024-42079, CVE-2024-42091,\nCVE-2024-42227, CVE-2024-42095, CVE-2024-42109, CVE-2024-41033,\nCVE-2023-52888, CVE-2024-41061, CVE-2024-42223, CVE-2024-42235,\nCVE-2024-41086, CVE-2024-42133, CVE-2024-41082, CVE-2024-41071,\nCVE-2024-41007, CVE-2023-52887, CVE-2024-39486, CVE-2024-41075,\nCVE-2024-42101, CVE-2024-42077, CVE-2024-41042, CVE-2024-42225,\nCVE-2024-42126, CVE-2024-41094, CVE-2024-41085, CVE-2024-41019,\nCVE-2024-41058, CVE-2024-41066, CVE-2024-42156, CVE-2024-42119,\nCVE-2024-41032, CVE-2024-41088, CVE-2024-42100, CVE-2024-42142,\nCVE-2024-41054, CVE-2024-42103, CVE-2024-42124, CVE-2024-41034,\nCVE-2024-42251, CVE-2024-42153, CVE-2024-41045, CVE-2024-42086,\nCVE-2024-42243, CVE-2024-41055, CVE-2024-41078, CVE-2024-42117,\nCVE-2024-41030, CVE-2024-42068, CVE-2024-42110, CVE-2024-42147,\nCVE-2024-42121, CVE-2024-41080, CVE-2024-41027, CVE-2024-43858,\nCVE-2024-42085, CVE-2024-42111, CVE-2024-42238, CVE-2024-41018,\nCVE-2024-42138, CVE-2024-41038, CVE-2024-42070, CVE-2024-42141,\nCVE-2024-41098, CVE-2024-42118, CVE-2024-41073, CVE-2024-42144,\nCVE-2024-42280, CVE-2024-41049, CVE-2024-42076, CVE-2024-41065,\nCVE-2024-42063, CVE-2024-41064, CVE-2024-41017, CVE-2024-42112,\nCVE-2024-42064, CVE-2024-42135, CVE-2024-42146, CVE-2024-41010,\nCVE-2024-41097, CVE-2024-41012, CVE-2024-42097, CVE-2024-42067,\nCVE-2024-42236, CVE-2024-42080, CVE-2024-42241, CVE-2024-42065,\nCVE-2024-42232, CVE-2024-42246, CVE-2024-41093, CVE-2024-41015,\nCVE-2024-42129, CVE-2024-42073, CVE-2024-41029)\n","status":"published","published":"2024-11-19T22:35:31Z","modified":"2026-10-26T22:34:04.239512543Z","updated_at":"2026-11-02T16:58:18.876384Z"},{"id":"USN-7090-1","title":"linux-azure-6.8 vulnerabilities","description":"\nChenyuan Yang discovered that the USB Gadget subsystem in the Linux\nkernel did not properly check for the device to be enabled before\nwriting. A local attacker could possibly use this to cause a denial of\nservice. (CVE-2024-25741)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM32 architecture;\n  - MIPS architecture;\n  - PA-RISC architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Cryptographic API;\n  - Serial ATA and Parallel ATA drivers;\n  - Null block device driver;\n  - Bluetooth drivers;\n  - Cdrom driver;\n  - Clock framework and drivers;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - Cirrus firmware drivers;\n  - GPIO subsystem;\n  - GPU drivers;\n  - I2C subsystem;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - ISDN/mISDN subsystem;\n  - LED subsystem;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - Network drivers;\n  - Microsoft Azure Network Adapter (MANA) driver;\n  - Near Field Communication (NFC) drivers;\n  - NVME drivers;\n  - NVMEM (Non Volatile Memory) drivers;\n  - PCI subsystem;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - S/390 drivers;\n  - SCSI drivers;\n  - Thermal drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - USB DSL drivers;\n  - USB core drivers;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Serial drivers;\n  - VFIO drivers;\n  - VHOST drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - GFS2 file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file systems library;\n  - Network file system client;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - SMB network file system;\n  - Memory management;\n  - Netfilter;\n  - Tracing infrastructure;\n  - io_uring subsystem;\n  - BPF subsystem;\n  - Core kernel;\n  - Bluetooth subsystem;\n  - CAN network layer;\n  - Ceph Core library;\n  - Networking core;\n  - IPv4 networking;\n  - IPv6 networking;\n  - IUCV driver;\n  - MAC80211 subsystem;\n  - Network traffic control;\n  - Sun RPC protocol;\n  - Wireless networking;\n  - AMD SoC Alsa drivers;\n  - SoC Audio for Freescale CPUs drivers;\n  - MediaTek ASoC drivers;\n  - SoC audio core drivers;\n  - SOF drivers;\n  - Sound sequencer drivers;\n(CVE-2024-42064, CVE-2024-43858, CVE-2024-42251, CVE-2024-42113,\nCVE-2024-41020, CVE-2024-41093, CVE-2024-45016, CVE-2024-42150,\nCVE-2024-42069, CVE-2024-42157, CVE-2024-42126, CVE-2024-42144,\nCVE-2024-42093, CVE-2024-41035, CVE-2024-41032, CVE-2024-41077,\nCVE-2024-42097, CVE-2024-41071, CVE-2024-42227, CVE-2024-42253,\nCVE-2024-42237, CVE-2024-41060, CVE-2024-42080, CVE-2024-42068,\nCVE-2024-41058, CVE-2024-42140, CVE-2024-42231, CVE-2024-42127,\nCVE-2024-42243, CVE-2023-52887, CVE-2024-39486, CVE-2024-41063,\nCVE-2024-42128, CVE-2024-42074, CVE-2024-41028, CVE-2024-42110,\nCVE-2024-45001, CVE-2024-41090, CVE-2024-41084, CVE-2024-41088,\nCVE-2024-42118, CVE-2024-41094, CVE-2024-41091, CVE-2024-41007,\nCVE-2024-42280, CVE-2024-41044, CVE-2024-41012, CVE-2024-42063,\nCVE-2024-41078, CVE-2024-42082, CVE-2024-41055, CVE-2024-41031,\nCVE-2024-42142, CVE-2024-41083, CVE-2024-42145, CVE-2024-41039,\nCVE-2024-41019, CVE-2024-42149, CVE-2024-42248, CVE-2024-42111,\nCVE-2024-41074, CVE-2024-42096, CVE-2024-42100, CVE-2024-41010,\nCVE-2024-43855, CVE-2024-42136, CVE-2024-41054, CVE-2024-41053,\nCVE-2024-41061, CVE-2024-42104, CVE-2024-41025, CVE-2024-42129,\nCVE-2024-41086, CVE-2024-42133, CVE-2024-42115, CVE-2024-42158,\nCVE-2024-42091, CVE-2024-42088, CVE-2024-42161, CVE-2024-42236,\nCVE-2024-41065, CVE-2024-41062, CVE-2024-42153, CVE-2024-41030,\nCVE-2024-41079, CVE-2023-52888, CVE-2024-42223, CVE-2024-42119,\nCVE-2024-42238, CVE-2024-41052, CVE-2024-41064, CVE-2024-42138,\nCVE-2024-41081, CVE-2024-41034, CVE-2024-42147, CVE-2024-41095,\nCVE-2024-42132, CVE-2024-42137, CVE-2024-42106, CVE-2024-41041,\nCVE-2024-41073, CVE-2024-41033, CVE-2024-41075, CVE-2024-42112,\nCVE-2024-41070, CVE-2024-42234, CVE-2024-41027, CVE-2024-42105,\nCVE-2024-41089, CVE-2024-41098, CVE-2024-42152, CVE-2024-42101,\nCVE-2024-41050, CVE-2024-41069, CVE-2024-42120, CVE-2024-42130,\nCVE-2024-42084, CVE-2024-41066, CVE-2024-42108, CVE-2024-42087,\nCVE-2024-41067, CVE-2024-41023, CVE-2024-41046, CVE-2024-42079,\nCVE-2024-42065, CVE-2024-42098, CVE-2024-42070, CVE-2024-41076,\nCVE-2024-41082, CVE-2024-41096, CVE-2024-42235, CVE-2024-42085,\nCVE-2024-42246, CVE-2024-41049, CVE-2024-42076, CVE-2024-41048,\nCVE-2024-41038, CVE-2024-42241, CVE-2024-41092, CVE-2024-42114,\nCVE-2024-41036, CVE-2024-41047, CVE-2024-41029, CVE-2024-42092,\nCVE-2024-41068, CVE-2024-42067, CVE-2024-42094, CVE-2024-42245,\nCVE-2024-41051, CVE-2024-42250, CVE-2024-42151, CVE-2024-41059,\nCVE-2024-41056, CVE-2024-42095, CVE-2024-42131, CVE-2024-42271,\nCVE-2024-42066, CVE-2024-42240, CVE-2024-41017, CVE-2024-42141,\nCVE-2024-41072, CVE-2024-42229, CVE-2024-42239, CVE-2024-42073,\nCVE-2024-42124, CVE-2024-41080, CVE-2024-42146, CVE-2024-41018,\nCVE-2024-41021, CVE-2024-39487, CVE-2024-42086, CVE-2024-42109,\nCVE-2024-41045, CVE-2024-41037, CVE-2024-41097, CVE-2024-42225,\nCVE-2024-42102, CVE-2024-42117, CVE-2024-42077, CVE-2024-42230,\nCVE-2024-41087, CVE-2024-42089, CVE-2024-42252, CVE-2024-42247,\nCVE-2024-41057, CVE-2024-42121, CVE-2024-42232, CVE-2024-42090,\nCVE-2024-41042, CVE-2024-42244, CVE-2024-42156, CVE-2024-42135,\nCVE-2024-42155, CVE-2024-42103, CVE-2024-41015, CVE-2024-41022,\nCVE-2024-41085)\n","status":"published","published":"2024-11-01T13:48:18Z","modified":"2026-10-29T20:02:33.244524175Z","updated_at":"2026-11-02T16:58:18.876384Z"},{"id":"USN-7095-1","title":"linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency vulnerabilities","description":"\nChenyuan Yang discovered that the USB Gadget subsystem in the Linux\nkernel did not properly check for the device to be enabled before\nwriting. A local attacker could possibly use this to cause a denial of\nservice. (CVE-2024-25741)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM32 architecture;\n  - MIPS architecture;\n  - PA-RISC architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Cryptographic API;\n  - Serial ATA and Parallel ATA drivers;\n  - Null block device driver;\n  - Bluetooth drivers;\n  - Cdrom driver;\n  - Clock framework and drivers;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - Cirrus firmware drivers;\n  - GPIO subsystem;\n  - GPU drivers;\n  - I2C subsystem;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - ISDN/mISDN subsystem;\n  - LED subsystem;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - Network drivers;\n  - Microsoft Azure Network Adapter (MANA) driver;\n  - Near Field Communication (NFC) drivers;\n  - NVME drivers;\n  - NVMEM (Non Volatile Memory) drivers;\n  - PCI subsystem;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - S/390 drivers;\n  - SCSI drivers;\n  - Thermal drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - USB DSL drivers;\n  - USB core drivers;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Serial drivers;\n  - VFIO drivers;\n  - VHOST drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - GFS2 file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file systems library;\n  - Network file system client;\n  - NILFS2 file system;\n  - NTFS3 file system;\n  - SMB network file system;\n  - Memory management;\n  - Netfilter;\n  - Tracing infrastructure;\n  - io_uring subsystem;\n  - BPF subsystem;\n  - Core kernel;\n  - Bluetooth subsystem;\n  - CAN network layer;\n  - Ceph Core library;\n  - Networking core;\n  - IPv4 networking;\n  - IPv6 networking;\n  - IUCV driver;\n  - MAC80211 subsystem;\n  - Network traffic control;\n  - Sun RPC protocol;\n  - Wireless networking;\n  - AMD SoC Alsa drivers;\n  - SoC Audio for Freescale CPUs drivers;\n  - MediaTek ASoC drivers;\n  - SoC audio core drivers;\n  - SOF drivers;\n  - Sound sequencer drivers;\n(CVE-2024-42271, CVE-2024-42068, CVE-2024-42086, CVE-2024-42132,\nCVE-2024-42074, CVE-2024-41017, CVE-2024-42090, CVE-2024-42280,\nCVE-2024-41030, CVE-2024-41037, CVE-2024-42248, CVE-2024-42084,\nCVE-2024-41057, CVE-2024-42252, CVE-2024-41055, CVE-2024-42158,\nCVE-2024-42097, CVE-2024-42101, CVE-2024-42095, CVE-2024-41084,\nCVE-2024-41051, CVE-2024-41032, CVE-2024-41046, CVE-2024-42231,\nCVE-2024-42133, CVE-2024-42089, CVE-2024-41062, CVE-2024-41033,\nCVE-2024-41012, CVE-2024-41077, CVE-2024-41064, CVE-2024-41082,\nCVE-2024-41090, CVE-2024-42065, CVE-2024-41096, CVE-2024-42119,\nCVE-2024-41054, CVE-2024-42064, CVE-2024-42253, CVE-2024-42237,\nCVE-2024-42120, CVE-2024-41066, CVE-2024-41083, CVE-2024-42129,\nCVE-2024-41085, CVE-2024-41058, CVE-2024-42146, CVE-2024-42156,\nCVE-2024-42076, CVE-2024-42149, CVE-2024-42069, CVE-2024-41039,\nCVE-2024-42110, CVE-2024-42150, CVE-2024-41015, CVE-2024-39486,\nCVE-2024-42144, CVE-2024-42131, CVE-2024-42087, CVE-2024-42091,\nCVE-2024-42236, CVE-2024-42088, CVE-2024-42112, CVE-2024-42142,\nCVE-2024-42082, CVE-2024-42111, CVE-2024-41028, CVE-2024-45001,\nCVE-2024-42077, CVE-2024-42102, CVE-2024-42239, CVE-2024-42140,\nCVE-2024-41091, CVE-2024-41050, CVE-2024-41034, CVE-2024-43858,\nCVE-2024-42145, CVE-2024-42227, CVE-2024-41029, CVE-2024-42230,\nCVE-2024-42096, CVE-2024-42238, CVE-2024-41027, CVE-2024-42063,\nCVE-2024-41023, CVE-2024-41041, CVE-2024-41038, CVE-2024-41073,\nCVE-2024-41067, CVE-2024-41025, CVE-2024-42152, CVE-2024-42247,\nCVE-2024-41065, CVE-2024-42121, CVE-2024-42157, CVE-2024-42080,\nCVE-2024-41076, CVE-2024-41059, CVE-2024-42108, CVE-2024-42251,\nCVE-2024-42093, CVE-2024-42130, CVE-2024-42126, CVE-2024-42079,\nCVE-2024-42246, CVE-2024-41081, CVE-2024-42092, CVE-2024-43855,\nCVE-2024-42235, CVE-2024-42118, CVE-2024-42067, CVE-2024-41047,\nCVE-2024-42155, CVE-2024-41010, CVE-2024-41061, CVE-2024-41007,\nCVE-2024-42245, CVE-2024-42106, CVE-2024-42066, CVE-2024-41078,\nCVE-2024-42113, CVE-2024-41087, CVE-2024-41092, CVE-2024-42234,\nCVE-2024-42124, CVE-2024-42100, CVE-2024-42128, CVE-2024-41072,\nCVE-2024-41022, CVE-2024-41049, CVE-2024-42229, CVE-2024-42225,\nCVE-2024-41052, CVE-2024-42151, CVE-2024-41094, CVE-2024-41098,\nCVE-2024-41035, CVE-2024-41042, CVE-2024-42114, CVE-2024-42250,\nCVE-2024-41095, CVE-2024-42138, CVE-2024-42241, CVE-2024-42103,\nCVE-2024-42094, CVE-2024-41045, CVE-2024-41075, CVE-2024-42073,\nCVE-2024-42153, CVE-2024-41048, CVE-2024-42085, CVE-2024-41074,\nCVE-2024-42244, CVE-2024-41018, CVE-2024-41079, CVE-2024-42127,\nCVE-2023-52887, CVE-2023-52888, CVE-2024-41071, CVE-2024-41020,\nCVE-2024-41036, CVE-2024-42117, CVE-2024-41068, CVE-2024-41056,\nCVE-2024-39487, CVE-2024-42243, CVE-2024-41019, CVE-2024-41070,\nCVE-2024-41044, CVE-2024-41060, CVE-2024-41088, CVE-2024-41021,\nCVE-2024-41053, CVE-2024-42137, CVE-2024-41086, CVE-2024-42104,\nCVE-2024-42109, CVE-2024-42105, CVE-2024-42136, CVE-2024-41080,\nCVE-2024-42098, CVE-2024-41093, CVE-2024-41063, CVE-2024-42161,\nCVE-2024-42147, CVE-2024-42223, CVE-2024-41097, CVE-2024-41069,\nCVE-2024-42240, CVE-2024-42135, CVE-2024-42070, CVE-2024-41089,\nCVE-2024-42141, CVE-2024-42115, CVE-2024-41031, CVE-2024-42232)\n","status":"published","published":"2024-11-07T09:49:52Z","modified":"2026-10-29T20:02:37.125807872Z","updated_at":"2026-11-02T16:58:18.876384Z"},{"id":"USN-7156-1","title":"linux-gkeop vulnerabilities","description":"\nChenyuan Yang discovered that the USB Gadget subsystem in the Linux kernel\ndid not properly check for the device to be enabled before writing. A local\nattacker could possibly use this to cause a denial of service.\n(CVE-2024-25741)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM32 architecture;\n  - ARM64 architecture;\n  - MIPS architecture;\n  - PA-RISC architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Android drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - ATM drivers;\n  - Drivers core;\n  - Null block device driver;\n  - Ublk userspace block driver;\n  - Bluetooth drivers;\n  - Cdrom driver;\n  - Character device driver;\n  - Clock framework and drivers;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - Buffer Sharing and Synchronization framework;\n  - DMA engine subsystem;\n  - Cirrus firmware drivers;\n  - Qualcomm firmware drivers;\n  - GPIO subsystem;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - I2C subsystem;\n  - I3C subsystem;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - ISDN/mISDN subsystem;\n  - LED subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - VMware VMCI Driver;\n  - MMC subsystem;\n  - Ethernet bonding driver;\n  - Network drivers;\n  - Mellanox network drivers;\n  - Microsoft Azure Network Adapter (MANA) driver;\n  - Near Field Communication (NFC) drivers;\n  - NVME drivers;\n  - NVMEM (Non Volatile Memory) drivers;\n  - Device tree and open firmware driver;\n  - Parport drivers;\n  - PCI subsystem;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Power supply drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - QCOM SoC drivers;\n  - SPI subsystem;\n  - Direct Digital Synthesis drivers;\n  - Thermal drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Userspace I/O drivers;\n  - USB DSL drivers;\n  - USB core drivers;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - USB Serial drivers;\n  - USB Type-C Connector System Software Interface driver;\n  - USB over IP driver;\n  - VFIO drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - GFS2 file system;\n  - JFFS2 file system;\n  - JFS file system;\n  - Network file systems library;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - Proc file system;\n  - SMB network file system;\n  - Tracing file system;\n  - Bitmap API;\n  - BPF subsystem;\n  - Syscall compatibility layer;\n  - Memory Management;\n  - Memory management;\n  - Objagg library;\n  - Perf events;\n  - Syscall interfaces;\n  - Virtio network driver;\n  - VMware vSockets driver;\n  - KCM (Kernel Connection Multiplexor) sockets driver;\n  - Netfilter;\n  - Tracing infrastructure;\n  - io_uring subsystem;\n  - Control group (cgroup);\n  - DMA mapping infrastructure;\n  - Locking primitives;\n  - Padata parallel execution mechanism;\n  - Scheduler infrastructure;\n  - Closures library;\n  - Radix Tree data structure library;\n  - Kernel userspace event delivery library;\n  - KUnit for arithmetic overflow checks;\n  - Bluetooth subsystem;\n  - Ethernet bridge;\n  - CAN network layer;\n  - Ceph Core library;\n  - Networking core;\n  - Ethtool driver;\n  - IPv4 networking;\n  - IPv6 networking;\n  - IUCV driver;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Network traffic control;\n  - SCTP protocol;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - Wireless networking;\n  - AppArmor security module;\n  - Landlock security;\n  - SELinux security module;\n  - Simplified Mandatory Access Control Kernel framework;\n  - FireWire sound drivers;\n  - AMD SoC Alsa drivers;\n  - Texas InstrumentS Audio (ASoC/HDA) drivers;\n  - SoC Audio for Freescale CPUs drivers;\n  - Intel ASoC drivers;\n  - MediaTek ASoC drivers;\n  - Amlogic Meson SoC drivers;\n  - SoC audio core drivers;\n  - SOF drivers;\n  - Sound sequencer drivers;\n  - USB sound devices;\n  - Real-Time Linux Analysis tools;\n(CVE-2024-43911, CVE-2024-46762, CVE-2024-46794, CVE-2024-43843,\nCVE-2024-42229, CVE-2024-43888, CVE-2024-44978, CVE-2024-46693,\nCVE-2024-46695, CVE-2024-42290, CVE-2024-42067, CVE-2024-45012,\nCVE-2024-42316, CVE-2024-47665, CVE-2024-41052, CVE-2024-42074,\nCVE-2024-41058, CVE-2024-44975, CVE-2024-46709, CVE-2024-46871,\nCVE-2024-42090, CVE-2024-42296, CVE-2024-42096, CVE-2024-42146,\nCVE-2024-46855, CVE-2024-39487, CVE-2024-43825, CVE-2024-42066,\nCVE-2024-42126, CVE-2024-41022, CVE-2024-41025, CVE-2023-52888,\nCVE-2024-46702, CVE-2024-42269, CVE-2024-41082, CVE-2024-42284,\nCVE-2024-42227, CVE-2024-41017, CVE-2024-42250, CVE-2024-46778,\nCVE-2024-47661, CVE-2024-46727, CVE-2024-46845, CVE-2024-44953,\nCVE-2024-47659, CVE-2024-42137, CVE-2024-42245, CVE-2024-41096,\nCVE-2024-46829, CVE-2024-41053, CVE-2024-46782, CVE-2024-44972,\nCVE-2024-41095, CVE-2024-42239, CVE-2024-42127, CVE-2024-42292,\nCVE-2024-46752, CVE-2024-46679, CVE-2024-41076, CVE-2024-46784,\nCVE-2024-46786, CVE-2024-46678, CVE-2024-44957, CVE-2024-46755,\nCVE-2024-47660, CVE-2024-41067, CVE-2024-46838, CVE-2024-43879,\nCVE-2024-45007, CVE-2024-45025, CVE-2024-45001, CVE-2024-41009,\nCVE-2024-41051, CVE-2024-46836, CVE-2024-49984, CVE-2024-45028,\nCVE-2024-43871, CVE-2024-46783, CVE-2024-42272, CVE-2024-42087,\nCVE-2024-46785, CVE-2024-42276, CVE-2024-47658, CVE-2024-46761,\nCVE-2024-46715, CVE-2024-46676, CVE-2024-43824, CVE-2024-42100,\nCVE-2024-46745, CVE-2024-41084, CVE-2024-41086, CVE-2024-45015,\nCVE-2024-46797, CVE-2024-42160, CVE-2024-46706, CVE-2024-46803,\nCVE-2024-46708, CVE-2024-47669, CVE-2024-45009, CVE-2024-41021,\nCVE-2024-42159, CVE-2024-42321, CVE-2024-46868, CVE-2024-41078,\nCVE-2024-42303, CVE-2024-45027, CVE-2024-42309, CVE-2024-43849,\nCVE-2024-43907, CVE-2024-43899, CVE-2024-43823, CVE-2024-42232,\nCVE-2024-44937, CVE-2024-41046, CVE-2024-42237, CVE-2024-42063,\nCVE-2024-42065, CVE-2024-42154, CVE-2024-42259, CVE-2024-46698,\nCVE-2024-46741, CVE-2024-45020, CVE-2024-42151, CVE-2024-41073,\nCVE-2024-46719, CVE-2024-42295, CVE-2024-46859, CVE-2024-41035,\nCVE-2024-46751, CVE-2024-47667, CVE-2024-46728, CVE-2024-46824,\nCVE-2024-42121, CVE-2024-46776, CVE-2024-46768, CVE-2024-43908,\nCVE-2024-43900, CVE-2024-46707, CVE-2024-44934, CVE-2024-41062,\nCVE-2024-42304, CVE-2024-42312, CVE-2024-42157, CVE-2024-41092,\nCVE-2024-41041, CVE-2024-43832, CVE-2024-41039, CVE-2024-44962,\nCVE-2024-46858, CVE-2024-43856, CVE-2024-41060, CVE-2024-45010,\nCVE-2024-41044, CVE-2024-44942, CVE-2024-42307, CVE-2024-44984,\nCVE-2024-41075, CVE-2024-43817, CVE-2024-46791, CVE-2024-46853,\nCVE-2024-42301, CVE-2024-44993, CVE-2024-41094, CVE-2024-27022,\nCVE-2024-41088, CVE-2024-43883, CVE-2024-41087, CVE-2024-46780,\nCVE-2024-42070, CVE-2024-44965, CVE-2024-46823, CVE-2024-46737,\nCVE-2024-44982, CVE-2024-46697, CVE-2024-45021, CVE-2024-44987,\nCVE-2024-41072, CVE-2024-41063, CVE-2024-46757, CVE-2024-46831,\nCVE-2024-44966, CVE-2024-42322, CVE-2024-42231, CVE-2024-46717,\nCVE-2024-41065, CVE-2024-44969, CVE-2023-52887, CVE-2024-42105,\nCVE-2024-44971, CVE-2024-46798, CVE-2024-42262, CVE-2024-44938,\nCVE-2024-42088, CVE-2024-44970, CVE-2024-43876, CVE-2024-46800,\nCVE-2024-42086, CVE-2024-43826, CVE-2024-46729, CVE-2024-46747,\nCVE-2024-46691, CVE-2024-46723, CVE-2024-41018, CVE-2024-42258,\nCVE-2024-41081, CVE-2024-41049, CVE-2024-43837, CVE-2024-45008,\nCVE-2024-41047, CVE-2024-41019, CVE-2024-42152, CVE-2024-41090,\nCVE-2024-46716, CVE-2024-42104, CVE-2024-46804, CVE-2024-43852,\nCVE-2024-42129, CVE-2024-46870, CVE-2024-41093, CVE-2024-45011,\nCVE-2024-41064, CVE-2024-46722, CVE-2024-42286, CVE-2024-45026,\nCVE-2024-46818, CVE-2024-42281, CVE-2024-43854, CVE-2024-41037,\nCVE-2024-44946, CVE-2024-41012, CVE-2024-41098, CVE-2024-42263,\nCVE-2024-42095, CVE-2024-46756, CVE-2024-43913, CVE-2024-46822,\nCVE-2024-44944, CVE-2024-42156, CVE-2024-42073, CVE-2024-42093,\nCVE-2024-44931, CVE-2024-42223, CVE-2024-42264, CVE-2024-42278,\nCVE-2024-46759, CVE-2024-46826, CVE-2024-43828, CVE-2024-42318,\nCVE-2024-42240, CVE-2024-45000, CVE-2024-43909, CVE-2024-46792,\nCVE-2024-42109, CVE-2024-43867, CVE-2024-42130, CVE-2024-42244,\nCVE-2024-44977, CVE-2024-46774, CVE-2024-41030, CVE-2024-42310,\nCVE-2024-42138, CVE-2024-42317, CVE-2024-42224, CVE-2024-46694,\nCVE-2024-46815, CVE-2024-46677, CVE-2024-46763, CVE-2024-46860,\nCVE-2024-46767, CVE-2024-42111, CVE-2024-41020, CVE-2024-46726,\nCVE-2024-42117, CVE-2024-43831, CVE-2024-42285, CVE-2024-46842,\nCVE-2024-43857, CVE-2024-41031, CVE-2024-43834, CVE-2024-42135,\nCVE-2024-42241, CVE-2024-46846, CVE-2024-44988, CVE-2024-43892,\nCVE-2024-44991, CVE-2024-46806, CVE-2024-41015, CVE-2024-43906,\nCVE-2024-42238, CVE-2024-46779, CVE-2024-41010, CVE-2024-41068,\nCVE-2024-46730, CVE-2024-46827, CVE-2024-42120, CVE-2024-41059,\nCVE-2024-46850, CVE-2023-52889, CVE-2024-45017, CVE-2024-45003,\nCVE-2024-46844, CVE-2024-46816, CVE-2024-46811, CVE-2024-41023,\nCVE-2024-44948, CVE-2024-46753, CVE-2024-45002, CVE-2024-42251,\nCVE-2024-46713, CVE-2024-42273, CVE-2024-46733, CVE-2024-46739,\nCVE-2024-42108, CVE-2024-41085, CVE-2024-41033, CVE-2024-42298,\nCVE-2024-46835, CVE-2024-39472, CVE-2024-47663, CVE-2024-43859,\nCVE-2024-43820, CVE-2024-42118, CVE-2024-41036, CVE-2024-47683,\nCVE-2024-42161, CVE-2024-42235, CVE-2024-43861, CVE-2024-43863,\nCVE-2024-47668, CVE-2024-46685, CVE-2024-43864, CVE-2024-46749,\nCVE-2024-44983, CVE-2024-46841, CVE-2024-42082, CVE-2024-43818,\nCVE-2024-41071, CVE-2024-45006, CVE-2024-42080, CVE-2024-46825,\nCVE-2024-46687, CVE-2024-44959, CVE-2024-43835, CVE-2024-43891,\nCVE-2024-46851, CVE-2024-42248, CVE-2024-42103, CVE-2024-42079,\nCVE-2024-42068, CVE-2024-47664, CVE-2024-46854, CVE-2024-44973,\nCVE-2024-42077, CVE-2024-46821, CVE-2024-43886, CVE-2024-41089,\nCVE-2024-43850, CVE-2024-44995, CVE-2024-46809, CVE-2024-42084,\nCVE-2024-46758, CVE-2024-47662, CVE-2024-43839, CVE-2024-46738,\nCVE-2024-41034, CVE-2024-42228, CVE-2024-42147, CVE-2024-43855,\nCVE-2024-41032, CVE-2024-46819, CVE-2024-44989, CVE-2024-42265,\nCVE-2024-42110, CVE-2024-42155, CVE-2024-45005, CVE-2024-45016,\nCVE-2024-42141, CVE-2024-43821, CVE-2024-42299, CVE-2024-44950,\nCVE-2024-42279, CVE-2024-44943, CVE-2024-43904, CVE-2024-42268,\nCVE-2024-42089, CVE-2024-46807, CVE-2024-44996, CVE-2024-42069,\nCVE-2024-46672, CVE-2024-44940, CVE-2024-42270, CVE-2024-46735,\nCVE-2024-42319, CVE-2024-46754, CVE-2024-46861, CVE-2024-42277,\nCVE-2024-41054, CVE-2024-42131, CVE-2024-41056, CVE-2024-44963,\nCVE-2024-42267, CVE-2024-42283, CVE-2024-42320, CVE-2024-46740,\nCVE-2024-46787, CVE-2024-43895, CVE-2024-43881, CVE-2024-44961,\nCVE-2024-43910, CVE-2024-43875, CVE-2024-42289, CVE-2024-43853,\nCVE-2024-42315, CVE-2024-43884, CVE-2024-46867, CVE-2024-43912,\nCVE-2024-41007, CVE-2024-46743, CVE-2024-46675, CVE-2024-43877,\nCVE-2024-39486, CVE-2024-41050, CVE-2024-43858, CVE-2024-45018,\nCVE-2024-46744, CVE-2024-46750, CVE-2024-46840, CVE-2024-42150,\nCVE-2024-41028, CVE-2024-42091, CVE-2024-43894, CVE-2024-43869,\nCVE-2024-42132, CVE-2024-46777, CVE-2024-42106, CVE-2024-46848,\nCVE-2024-41038, CVE-2024-46711, CVE-2024-43833, CVE-2024-46710,\nCVE-2024-46812, CVE-2024-42311, CVE-2024-46701, CVE-2024-46683,\nCVE-2024-45029, CVE-2024-46830, CVE-2024-46857, CVE-2024-44979,\nCVE-2024-44999, CVE-2024-44985, CVE-2024-46773, CVE-2024-45022,\nCVE-2024-46772, CVE-2024-44960, CVE-2024-42243, CVE-2024-42158,\nCVE-2024-43819, CVE-2024-45030, CVE-2024-42085, CVE-2024-42274,\nCVE-2024-44986, CVE-2024-41048, CVE-2024-42098, CVE-2024-46680,\nCVE-2023-52918, CVE-2024-46673, CVE-2024-46834, CVE-2024-42288,\nCVE-2024-44998, CVE-2024-42113, CVE-2024-42094, CVE-2024-42225,\nCVE-2024-42112, CVE-2024-42153, CVE-2024-43880, CVE-2024-43905,\nCVE-2024-43902, CVE-2024-46681, CVE-2024-42236, CVE-2024-42294,\nCVE-2024-46793, CVE-2024-43882, CVE-2024-44947, CVE-2024-46849,\nCVE-2024-44954, CVE-2024-46852, CVE-2024-41070, CVE-2024-41069,\nCVE-2024-46864, CVE-2024-46703, CVE-2024-43829, CVE-2024-46802,\nCVE-2024-42101, CVE-2024-44990, CVE-2024-43830, CVE-2024-41029,\nCVE-2024-43866, CVE-2024-43889, CVE-2024-42230, CVE-2024-46692,\nCVE-2024-42133, CVE-2024-45013, CVE-2024-42076, CVE-2024-46810,\nCVE-2024-42128, CVE-2024-46718, CVE-2024-46814, CVE-2024-43841,\nCVE-2024-43873, CVE-2024-42092, CVE-2024-41074, CVE-2024-41083,\nCVE-2024-46731, CVE-2024-43842, CVE-2024-41077, CVE-2024-46720,\nCVE-2024-46795, CVE-2024-46813, CVE-2024-46805, CVE-2024-42142,\nCVE-2024-42291, CVE-2024-43846, CVE-2024-41057, CVE-2024-43870,\nCVE-2024-44980, CVE-2024-46866, CVE-2024-43827, CVE-2024-43840,\nCVE-2024-42280, CVE-2024-42261, CVE-2024-42246, CVE-2024-42115,\nCVE-2024-46686, CVE-2024-43860, CVE-2024-46808, CVE-2024-42149,\nCVE-2024-46828, CVE-2024-44935, CVE-2024-43847, CVE-2024-44967,\nCVE-2024-46817, CVE-2024-46721, CVE-2024-42305, CVE-2024-46766,\nCVE-2024-43914, CVE-2024-46760, CVE-2024-41061, CVE-2024-41091,\nCVE-2024-43890, CVE-2024-42314, CVE-2024-42064, CVE-2024-42302,\nCVE-2024-43887, CVE-2024-46832, CVE-2024-46765, CVE-2024-46770,\nCVE-2024-41080, CVE-2024-42253, CVE-2024-44941, CVE-2024-42306,\nCVE-2024-41027, CVE-2024-46689, CVE-2024-46781, CVE-2024-42247,\nCVE-2024-41066, CVE-2024-42287, CVE-2024-41097, CVE-2024-44939,\nCVE-2024-45019, CVE-2024-47674, CVE-2024-46705, CVE-2024-42119,\nCVE-2024-46725, CVE-2024-46746, CVE-2024-46732, CVE-2024-41042,\nCVE-2024-44958, CVE-2024-42114, CVE-2024-43893, CVE-2024-47666,\nCVE-2024-46843, CVE-2024-42252, CVE-2024-42102, CVE-2024-42136,\nCVE-2024-41045, CVE-2024-42260, CVE-2024-46771, CVE-2024-42124,\nCVE-2024-42297, CVE-2024-42271, CVE-2024-43845, CVE-2024-46775,\nCVE-2024-41079, CVE-2024-43868, CVE-2024-42140, CVE-2024-42313,\nCVE-2024-42145, CVE-2024-46724, CVE-2024-46788, CVE-2024-42234,\nCVE-2024-42144, CVE-2024-44974, CVE-2024-42097, CVE-2024-46714,\nCVE-2024-41055, CVE-2024-44956)\n","status":"published","published":"2024-12-12T17:47:44Z","modified":"2026-10-29T20:02:38.448595714Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}